cdk-local 0.149.1 → 0.149.3

package/dist/{local-studio-D8cHeCcp.js → local-studio-BbLfdSy4.js}

@@ -1,4 +1,4 @@
-import { a as runDockerStreaming, c as resolveConfiguredLogLevel, d as setEmbedConfig, i as runDockerForeground, l as getEmbedConfig, n as formatDockerLoginError, o as spawnStreaming, r as getDockerCmd, s as getLogger } from "./docker-cmd-DLX1TqVw.js";
+import { a as runDockerForeground, c as warnFinchArgvExposure, d as getEmbedConfig, i as getDockerCmd, l as getLogger, n as finchSecretArgvRefusal, o as runDockerStreaming, p as setEmbedConfig, r as formatDockerLoginError, s as spawnStreaming, u as resolveConfiguredLogLevel } from "./docker-cmd-SocNyC9q.js";
 import { chmodSync, cpSync, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import * as path$1 from "node:path";
@@ -2552,7 +2552,12 @@ function resolveAssemblyPath(dir, candidate, options) {
 * because `cdk synth --no-staging` emits one — CDK writes the asset's absolute
 * SOURCE directory under `aws:cdk:disable-asset-staging`, usually outside the
 * outdir — and they WARN rather than refuse when it leaves the bound, so this
-* returns a verdict rather than throwing.
+* returns a verdict rather than throwing. The asset-MANIFEST readers that
+* honour an absolute value take the same verdict: `'honour-warn'` (the
+* start-cloudfront origin) warns when the value is a folder inside the user's
+* project not under a credential or version-control directory, and refuses
+* otherwise, `'honour'` (the soft-reload
+* sources) refuses (#745).
 *
 * It lives HERE so the containment rule has one spelling: it reuses this
 * module's own {@link isInside} and {@link resolveThroughLinks}, symlink arm
@@ -2603,15 +2608,60 @@ function absoluteAssemblyPathEscape(bound, absolutePath) {
 	};
 }
 /**
+* Whether `candidate` names the SAME directory as `bound` — lexically, or
+* through a symbolic link on either side.
+*
+* An asset source legitimately names a DIRECTORY, so a value that resolves
+* onto the output directory itself is not an escape; but it hands the WHOLE
+* assembly to the sink, which is worth a line. A caller that re-spells this as
+* `resolve(a) === resolve(b)` misses every second spelling of the bound
+* (macOS `/tmp` vs `/private/tmp`, a symlinked `cdk.out`), and
+* {@link absoluteAssemblyPathEscape} exonerates exactly those spellings as
+* inside — so the equality beside it would stay silent for them.
+*
+* Conservative on failure: an unresolvable side answers from the lexical
+* comparison alone, so it can only say "not the same", never wrongly claim
+* identity.
+*/
+function namesTheSameDirectory(bound, candidate) {
+	const resolvedBound = resolve(bound);
+	const target = resolve(candidate);
+	if (target === resolvedBound) return true;
+	const realBound = resolveThroughLinks(resolvedBound);
+	const realTarget = resolveThroughLinks(target);
+	return realBound !== void 0 && realTarget !== void 0 && realBound === realTarget;
+}
+/**
+* The escape verdict for an assembly-supplied path WITHOUT throwing, taking
+* whichever arm the value's own shape calls for: {@link absoluteAssemblyPathEscape}
+* for an absolute value, {@link resolveAssemblyPath} for a relative one.
+*
+* For a caller that only WARNS and has many values to judge — the BuildKit
+* passthroughs in `src/assets/buildkit-passthrough-warnings.ts`. `base` is what
+* a relative value resolves against, `bound` what it must stay inside.
+* Returns `undefined` when the value is fine, including when it names `bound`
+* itself ({@link namesTheSameDirectory}).
+*/
+function assemblyPathEscape(base, bound, candidate) {
+	if (isAbsolute(candidate)) return absoluteAssemblyPathEscape(bound, candidate);
+	const resolved = resolveAssemblyPath(base, candidate, { containWithin: bound });
+	if (resolved.contained || namesTheSameDirectory(bound, resolved.path)) return void 0;
+	return resolved;
+}
+/**
 * The shared tail of a containment refusal: what the value resolved to, what
 * it escaped, and why that means the assembly is not CDK-generated. The call
 * site supplies its own subject ("Lambda 'X' has ... which ") and its own
 * error class. `action` completes "Refusing to ..." and is REQUIRED rather
 * than defaulted: a default is a branch no caller takes, so it can neither be
 * fenced nor be right for the next caller.
+*
+* `provenanceOverride` replaces that whole closing sentence for a caller that
+* does NOT refuse — the BuildKit passthrough warnings, where "Refusing to ..."
+* would be a false statement about a value that is forwarded anyway.
 */
-function renderAssemblyPathEscape(escape, dir, action) {
-	const provenance = `CDK emits assembly paths that stay inside the assembly directory; one that leaves it indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to ${action}.`;
+function renderAssemblyPathEscape(escape, dir, action, provenanceOverride) {
+	const provenance = provenanceOverride ?? `CDK emits assembly paths that stay inside the assembly directory; one that leaves it indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to ${action}.`;
 	const base = resolve(dir);
 	const realBase = resolveThroughLinks(base) ?? base;
 	const shownPath = sanitizeServiceExceptionMessage(escape.path);
@@ -3049,6 +3099,30 @@ function assetPathDirs(stack) {
 	};
 }
 /**
+* The containment bound for the `--watch` reload readers, which re-read
+* `<output>/<stack>.assets.json` after each synth (their BASE is
+* {@link watchManifestDir}).
+*
+* A stack carrying `assetOutdir` (always, through `AssemblyReader`) gets the
+* same Stage-aware bound as {@link assetPathDirs}. One without it gets
+* `outputDir` itself, NOT `assetPathDirs`'s fallback, which can be the process
+* cwd — a DISJOINT bound that refuses every value with a message blaming the
+* assembly. `outputDir` is the user's own flag, never assembly-supplied, so it
+* is a legitimate bound.
+*/
+function outputAssetBound(stack, outputDir) {
+	return stack.assetOutdir === void 0 || stack.assetOutdir === "" ? outputDir : assetPathDirs(stack).assetOutdir;
+}
+/**
+* Where a `--watch` reader resolves a RELATIVE manifest value from: the
+* manifest's own directory, exactly as the build does — so a value resolves
+* to the same directory the running image was built from. Falls back to the
+* user's `--output` for a stack record without a manifest path.
+*/
+function watchManifestDir(stack, outputDir) {
+	return stack.assetManifestPath ? dirname(stack.assetManifestPath) : outputDir;
+}
+/**
 * The real assembly ROOT for a `--app` that names a `cdk.Stage`
 * SUB-assembly.
 *
@@ -8967,6 +9041,380 @@ function resolveRuntimeCodeMountPath(runtime) {
 	return "/var/task";
 }
 
+//#endregion
+//#region src/assets/asset-source-path.ts
+/**
+* Resolve a manifest-supplied asset path and REFUSE it when it leaves the
+* app's outdir — lexically, or through a symbolic link. The one exception is
+* an ABSOLUTE value under `'honour-warn'`, which is ACCEPTED with a warning
+* when it is a folder inside the user's project, not under a credential or
+* version-control directory, and refused
+* otherwise (see {@link AssetSourcePathOptions.absolute}).
+*
+* Returns the RESOLVED, normalized absolute path, and callers must use THAT
+* rather than re-joining the raw value. It matters for the kernel: a raw
+* `<dir>/sub/link/..` handed to the OS applies `..` AFTER following `link`,
+* while every lexical model folds it first. Opening the normalized path makes
+* the judged path and the opened path the same string, so the `<link>/..`
+* shape has no second reading left to exploit.
+*
+* Naming the bound ITSELF (`.`, or `..` from a Stage manifest) is accepted —
+* an asset source is a directory by design, and the absolute arm treats the
+* bound as inside, so the two arms must agree — but it is WARNED about,
+* because it hands the whole assembly to the sink.
+*/
+function resolveAssetSourcePath(opts) {
+	const { manifestDir, value, assetOutdir, field, subject, action, wrapError } = opts;
+	const shownValue = sanitizeServiceExceptionMessage(value);
+	if (isAbsolute(value) && opts.absolute !== "fold") {
+		const absolute = resolve(value);
+		const escape = absoluteAssemblyPathEscape(assetOutdir, absolute);
+		if (escape !== void 0 && opts.absolute === "honour") throw wrapError(`${subject} has an absolute ${field}='${shownValue}' which ` + renderAssemblyPathEscape(escape, assetOutdir, action));
+		if (escape !== void 0) {
+			const refusal = originScopeRefusal(absolute, assetOutdir);
+			if (refusal !== void 0) throw wrapError(`${subject} has an absolute ${field}='${shownValue}' which ${refusal}. An absolute ${field} is accepted only as a cdk synth --no-staging source folder: a directory inside your project (the git work tree holding the output directory, or the current directory when it contains the output directory or is a git work-tree root), not under a credential or version-control directory. Refusing to ${action}.`);
+			warnAbsoluteOutsideAssembly(opts, absolute, escape);
+			return absolute;
+		}
+		if (namesTheSameDirectory(assetOutdir, absolute)) warnWholeAssemblyAsSource(opts, absolute);
+		return absolute;
+	}
+	const resolved = resolveAssemblyPath(manifestDir, value, { containWithin: assetOutdir });
+	if (resolved.contained) return resolved.path;
+	if (namesTheSameDirectory(assetOutdir, resolved.path)) {
+		warnWholeAssemblyAsSource(opts, resolved.path);
+		return resolved.path;
+	}
+	throw wrapError(`${subject} has ${field}='${shownValue}' which ` + renderAssemblyPathEscape(resolved, assetOutdir, action));
+}
+/**
+* Why an accepted-absolute root is too broad to be a `--no-staging` source, or
+* `undefined`. `root` is already a real path ({@link realPath}); the other
+* sides are resolved the same way, so a link to `/` or to `$HOME` is the same
+* root:
+*
+* - `/` — the whole filesystem;
+* - the user's home directory (`os.homedir()`) or any ANCESTOR of it
+*   (`/Users`, `/home`) — each contains `~/.aws` / `~/.ssh`; a project folder
+*   UNDER home is fine. The ancestor arm matters when the project is not under
+*   home (`/tmp`, `/workspaces`), where the outdir arm does not cover it;
+* - an ANCESTOR of the app's outdir, which contains the assembly and
+*   everything beside it.
+*/
+function broadRootReason(root, assetOutdir) {
+	if (root === resolve("/")) return "names the filesystem root";
+	if (containsOrIs(root, realPath(homedir()))) return "names your home directory or a directory containing it";
+	if (containsOrIs(root, realPath(assetOutdir))) return "names a directory containing the app's output directory";
+}
+/**
+* Why an `'honour-warn'` absolute root is refused, or `undefined` to accept it
+* with the warning. Every comparison is on REAL paths, so a symlink whose
+* target leaves the project is refused however it is spelled.
+*
+* 1. {@link broadRootReason} — roots no `--no-staging` source can be.
+* 2. The root must lie STRICTLY inside a project root
+*    ({@link projectRoots}), and no path component between that project root
+*    and the origin may be a credential / VCS directory
+*    ({@link CREDENTIAL_DIR_NAMES}, case-insensitive — APFS folds case). Other
+*    hidden directories are fine: `docs/.vitepress/dist`, Nuxt's
+*    `.output/public` and SvelteKit's `.svelte-kit/output` are real
+*    `--no-staging` site folders. A monorepo sibling
+*    (`<repo>/packages/web/dist` beside `<repo>/packages/infra/cdk.out`) is
+*    inside the git work tree and accepted. Hidden FILES under an accepted
+*    root are kept out at serve time instead (`cloudfront-static-origin.ts`).
+*/
+function originScopeRefusal(absolute, assetOutdir) {
+	const root = realPath(absolute);
+	const broad = broadRootReason(root, assetOutdir);
+	if (broad !== void 0) return broad;
+	const projects = projectRoots(assetOutdir);
+	let hidden;
+	let isProjectRoot = false;
+	for (const project of projects) {
+		const rel = relative(project, root);
+		if (rel === "") isProjectRoot = true;
+		if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) continue;
+		const dotted = rel.split(sep).find((c) => CREDENTIAL_DIR_NAMES.has(c.toLowerCase()));
+		if (dotted === void 0) return void 0;
+		hidden = dotted;
+	}
+	if (isProjectRoot) return "is your project root itself; name a folder inside it";
+	if (hidden !== void 0) return `passes through the credential / version-control directory '${sanitizeServiceExceptionMessage(hidden)}' inside your project`;
+	const shown = projects.map((p) => `'${sanitizeServiceExceptionMessage(p)}'`).join(" or ");
+	return projects.length === 0 ? "is outside any usable project root (the current directory and the git work tree are too broad to scope it)" : `resolves to '${sanitizeServiceExceptionMessage(root)}', outside your project (${shown})`;
+}
+/**
+* Directory names no `--no-staging` site folder sits under: credential stores
+* and version-control / package-manager metadata. Compared lower-cased.
+*/
+const CREDENTIAL_DIR_NAMES = /* @__PURE__ */ new Set([
+	".git",
+	".hg",
+	".svn",
+	".ssh",
+	".aws",
+	".gnupg",
+	".docker",
+	".kube",
+	".config",
+	".azure",
+	".gcloud",
+	".terraform",
+	".npm",
+	".pnpm-store",
+	".yarn",
+	".cache",
+	".local"
+]);
+/**
+* The directories an accepted absolute origin may live in, both real paths:
+*
+* - the process cwd, ONLY when it contains the outdir or is itself a git work
+*   tree root (holds a `.git` entry) — running from a folder of repos (`~/work`,
+*   `/tmp`) must not make every project under it a scope;
+* - the nearest ancestor of the outdir holding a `.git` entry (a directory, or
+*   a FILE in a linked worktree / submodule). `git` is not spawned.
+*
+* A candidate that is `/`, the home directory or an ancestor of it is DROPPED
+* rather than used — running from `~` must not widen the scope to all of home.
+*/
+function projectRoots(assetOutdir) {
+	const roots = [];
+	const usable = (p) => p !== resolve("/") && !containsOrIs(p, realPath(homedir()));
+	const cwd = realPath(process.cwd());
+	const outdir = realPath(assetOutdir);
+	if (usable(cwd) && (containsOrIs(cwd, outdir) || existsSync(join(cwd, ".git")))) roots.push(cwd);
+	let dir = outdir;
+	for (;;) {
+		if (existsSync(join(dir, ".git"))) {
+			if (usable(dir) && !roots.includes(dir)) roots.push(dir);
+			break;
+		}
+		const parent = dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return roots;
+}
+/** `outer` is `inner` itself or an ancestor of it (both real paths). */
+function containsOrIs(outer, inner) {
+	const rel = relative(outer, inner);
+	return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+/**
+* `realpath(3)` of `p`, or — when `p` does not exist — the real path of its
+* deepest existing ancestor with the rest re-appended, so a not-yet-existing
+* path under a symlinked parent (`/tmp` -> `/private/tmp`) compares in the
+* same spelling as its existing neighbours. A DANGLING link component is
+* followed by hand (`readlink`), so `project/site -> /outside/missing` is
+* judged as `/outside/missing` — the place a later-created target would be
+* served from — not as `project/site`.
+*/
+function realPath(p, hops = 0) {
+	const abs = resolve(p);
+	try {
+		return realpathSync.native(abs);
+	} catch {
+		const parent = dirname(abs);
+		if (parent === abs) return abs;
+		const realParent = realPath(parent, hops);
+		let link;
+		try {
+			link = readlinkSync(abs);
+		} catch {
+			link = void 0;
+		}
+		if (link !== void 0 && hops < 40) return realPath(resolve(realParent, link), hops + 1);
+		return join(realParent, basename(abs));
+	}
+}
+/**
+* Absolute-outside lines already printed this process (deduped for the same
+* reason as {@link warnedWholeAssembly}).
+*/
+const warnedAbsoluteOutside = /* @__PURE__ */ new Set();
+function warnAbsoluteOutsideAssembly(opts, absolute, escape) {
+	const logger = getLogger().child("assets");
+	const line = `${opts.subject} has an absolute ${opts.field} pointing outside the assembly: '${sanitizeServiceExceptionMessage(absolute)}'` + (escape.escape === "symlink" ? ` (through a symbolic link to '${sanitizeServiceExceptionMessage(escape.realPath)}')` : "") + `. ${getEmbedConfig().productName} will ${opts.sink}. ` + (escape.escape === "lexical" ? "This is what cdk synth --no-staging emits, and is expected for it; if you did not synthesize with that flag, treat this assembly as untrusted." : "No CDK synth writes this, so treat this assembly as untrusted unless you made that link yourself.");
+	if (warnedAbsoluteOutside.has(line)) {
+		logger.debug(line);
+		return;
+	}
+	warnedAbsoluteOutside.add(line);
+	logger.warn(line);
+}
+/**
+* Whole-assembly lines already printed this process. A `start-service` with
+* `DesiredCount: 3` builds per replica and again per crash-loop restart, so an
+* undeduped line is a storm, and a storm is not read. Repeats drop to debug;
+* the WORK is never deduped.
+*/
+const warnedWholeAssembly = /* @__PURE__ */ new Set();
+function warnWholeAssemblyAsSource(opts, outdir) {
+	const logger = getLogger().child("assets");
+	const line = `${opts.subject} has ${opts.field} naming the assembly's output directory ITSELF: '${sanitizeServiceExceptionMessage(outdir)}'. ${getEmbedConfig().productName} will ${opts.sink} — that is the WHOLE assembly, every template and every staged asset, not one asset directory. No CDK synth emits this, so treat this assembly as untrusted unless you wrote that path yourself.`;
+	if (warnedWholeAssembly.has(line)) {
+		logger.debug(line);
+		return;
+	}
+	warnedWholeAssembly.add(line);
+	logger.warn(line);
+}
+
+//#endregion
+//#region src/assets/docker-cache-option.ts
+/**
+* Render a `cacheFrom` / `cacheTo` entry as the single `--cache-from` /
+* `--cache-to` value BuildKit parses: `type=<t>,<k>=<v>,...`, unquoted.
+*
+* Its own module because two readers need the SAME string: the argv builder in
+* `docker-build.ts`, and the passthrough warnings, which judge the rendered
+* flag rather than the struct (a `params` value can smuggle a `,src=` that the
+* struct never shows).
+*/
+function cacheOptionToFlag(option) {
+	let flag = `type=${option.type}`;
+	if (option.params) for (const [k, v] of Object.entries(option.params)) flag += `,${k}=${v}`;
+	return flag;
+}
+
+//#endregion
+//#region src/assets/buildkit-passthrough-warnings.ts
+/**
+* Every candidate host path in a buildx option value: a part with a key yields
+* its value when the key is `src` / `source` / `dest` (the keys that make
+* BuildKit open a file), and a part without a key yields itself.
+*
+* Over-inclusive on purpose for a BARE part: a non-path string resolves inside
+* the build context and is dropped before anything is printed. A keyed part is
+* limited to the three file keys because `ref=` / `scope=` / `env=` are not
+* paths, and taking them announced a registry ref as a host read.
+*
+* Known incomplete, and both misses cost a WARNING, never a refusal: a quoted
+* CSV value containing a comma is split wrongly here; a leading or trailing
+* space is trimmed here while buildx keeps it (an over-warn only).
+*/
+function candidateHostPaths(value, opts) {
+	const out = [];
+	for (const part of value.split(",")) {
+		const eq = part.indexOf("=");
+		if (eq < 0) {
+			const bare = part.trim();
+			if (bare.length > 0) out.push({
+				path: bare,
+				write: opts.bareIsWrite
+			});
+			continue;
+		}
+		const key = part.slice(0, eq).trim().toLowerCase();
+		const v = part.slice(eq + 1).trim();
+		if (v.length === 0) continue;
+		if (key !== "src" && key !== "source" && key !== "dest") continue;
+		out.push({
+			path: v,
+			write: key === "dest"
+		});
+	}
+	return out;
+}
+/**
+* Every host path this source hands to BuildKit. Each field is judged as the
+* RENDERED argv string `buildDockerBuildCommand` pushes, not as the struct —
+* nothing there is quoted, so CSV smuggled into a key or a `params` value
+* reaches BuildKit and must reach this walk too.
+*/
+function hostPathsOf(source) {
+	const refs = [];
+	if (source.dockerFile) refs.push({
+		field: "dockerFile",
+		where: "dockerFile",
+		path: source.dockerFile,
+		write: false
+	});
+	for (const [k, v] of Object.entries(source.dockerBuildContexts ?? {})) {
+		const rendered = `${k}=${v}`;
+		const contextPath = rendered.slice(rendered.indexOf("=") + 1).trim().replace(/^oci-layout:\/\//, "");
+		if (contextPath.length === 0) continue;
+		refs.push({
+			field: "dockerBuildContexts",
+			where: k,
+			path: contextPath,
+			write: false
+		});
+	}
+	const ssh = source.dockerBuildSsh ?? "";
+	const sshEq = ssh.indexOf("=");
+	(sshEq < 0 ? [] : ssh.slice(sshEq + 1).split(",")).forEach((entry, i) => {
+		const p = entry.trim();
+		if (p.length > 0) refs.push({
+			field: "dockerBuildSsh",
+			where: String(i),
+			path: p,
+			write: false
+		});
+	});
+	for (const [k, v] of Object.entries(source.dockerBuildSecrets ?? {})) for (const { path: p, write } of candidateHostPaths(`id=${k},${v}`, { bareIsWrite: false })) refs.push({
+		field: "dockerBuildSecrets",
+		where: k,
+		path: p,
+		write
+	});
+	(source.cacheFrom ?? []).forEach((c, i) => {
+		for (const { path: p, write } of candidateHostPaths(cacheOptionToFlag(c), { bareIsWrite: false })) refs.push({
+			field: "cacheFrom",
+			where: String(i),
+			path: p,
+			write
+		});
+	});
+	if (source.cacheTo) for (const { path: p, write } of candidateHostPaths(cacheOptionToFlag(source.cacheTo), { bareIsWrite: false })) refs.push({
+		field: "cacheTo",
+		where: "cacheTo",
+		path: p,
+		write
+	});
+	(source.dockerOutputs ?? []).forEach((o, i) => {
+		for (const { path: p, write } of candidateHostPaths(o, { bareIsWrite: true })) refs.push({
+			field: "dockerOutputs",
+			where: String(i),
+			path: p,
+			write
+		});
+	});
+	return refs;
+}
+/**
+* Lines already printed this process; a repeat drops to debug. Replicas and
+* reloads rebuild the same asset, and the same line N times is a storm.
+*/
+const warnedPassthroughs = /* @__PURE__ */ new Set();
+/**
+* Warn for each BuildKit passthrough whose host path leaves the assembly.
+*
+* `base` is the build context directory (what BuildKit resolves a relative
+* value against — the build's cwd); `bound` is the app's outdir. Called above
+* the spawn so the line precedes the read or write it describes.
+*
+* No "inside the build context" exemption is needed, unlike a builder that
+* honours an absolute context: `buildDockerImage` has already contained the
+* context within `bound`, so a path inside the context is inside the bound.
+*/
+function warnEscapingBuildKitPaths(source, base, bound) {
+	const logger = getLogger().child("assets");
+	for (const ref of hostPathsOf(source)) {
+		const escape = assemblyPathEscape(base, bound, ref.path);
+		if (escape === void 0) continue;
+		const verb = ref.write ? "WRITE to" : "read";
+		const line = `Docker asset ${ref.field}` + (ref.where === ref.field ? "" : `['${sanitizeServiceExceptionMessage(ref.where)}']`) + ` names a host path outside the assembly, which ` + renderAssemblyPathEscape(escape, bound, "load", `${getEmbedConfig().productName} will ${verb} it during the image build, matching the CDK CLI — a pre-synthesized assembly is trusted input. If you did not produce this assembly, that is a host path it chose and the CloudFormation template does not show.`);
+		if (warnedPassthroughs.has(line)) {
+			logger.debug(line);
+			continue;
+		}
+		warnedPassthroughs.add(line);
+		logger.warn(line);
+	}
+}
+
 //#endregion
 //#region src/assets/docker-build.ts
 /**
@@ -9042,11 +9490,23 @@ function warnManifestExecutable(cmd, executable, cwd) {
 async function buildDockerImage(asset, cdkOutDir, options) {
 	const source = asset.source;
 	const logger = getLogger().child("docker-build");
+	const assetOutdir = options.assetOutdir ?? cdkOutDir;
+	const contextDirectory = (directory, sink) => resolveAssetSourcePath({
+		manifestDir: cdkOutDir,
+		value: directory,
+		assetOutdir,
+		absolute: "fold",
+		field: "source.directory",
+		subject: "Docker image asset",
+		action: "build it",
+		sink,
+		wrapError: (message) => new LocalInvokeBuildError(message)
+	});
 	if (source.executable && source.executable.length > 0) {
 		const [cmd, ...args] = source.executable;
 		if (!cmd) throw options.wrapError("asset source.executable[] is empty");
-		const cwd = source.directory ? `${cdkOutDir}/${source.directory}` : cdkOutDir;
-		logger.debug(`Building Docker image via executable: ${source.executable.join(" ")} (cwd=${cwd})`);
+		const cwd = source.directory ? contextDirectory(source.directory, "run this asset's source.executable with that directory as its working directory") : cdkOutDir;
+		logger.debug(`Building Docker image via executable: ${sanitizeServiceExceptionMessage(source.executable.join(" "))} (cwd=${sanitizeServiceExceptionMessage(cwd)})`);
 		warnManifestExecutable(cmd, source.executable, cwd);
 		let result;
 		try {
@@ -9062,8 +9522,9 @@ async function buildDockerImage(asset, cdkOutDir, options) {
 	if (!source.directory) throw options.wrapError(`DockerImageAssetSource must set either 'directory' or 'executable' (got: ${JSON.stringify(source)})`);
 	if (!options.tag) throw options.wrapError("buildDockerImage(directory mode) requires options.tag");
 	const buildArgs = buildDockerBuildCommand(source, options.tag, options.platform);
-	const contextDir = `${cdkOutDir}/${source.directory}`;
+	const contextDir = contextDirectory(source.directory, `send that directory to docker build as the context of an image ${getEmbedConfig().productName} then runs locally`);
 	buildArgs.push(".");
+	warnEscapingBuildKitPaths(source, contextDir, assetOutdir);
 	logger.debug(`${getDockerCmd()} ${buildArgs.join(" ")} (cwd=${contextDir})`);
 	try {
 		await runDockerStreaming(buildArgs, {
@@ -9104,11 +9565,6 @@ function buildDockerBuildCommand(source, tag, platformOverride) {
 	if (source.cacheDisabled) args.push("--no-cache");
 	return args;
 }
-function cacheOptionToFlag(option) {
-	let flag = `type=${option.type}`;
-	if (option.params) for (const [k, v] of Object.entries(option.params)) flag += `,${k}=${v}`;
-	return flag;
-}
 
 //#endregion
 //#region src/local/ecr-puller.ts
@@ -9384,8 +9840,9 @@ async function buildContainerImage(asset, cdkOutDir, options) {
 	const actualTag = await buildDockerImage(asset, cdkOutDir, {
 		tag,
 		platform,
-		wrapError: (stderr) => new LocalInvokeBuildError(`docker build failed for container Lambda asset (${asset.source.directory ?? asset.source.executable?.join(" ")}): ${stderr}`),
-		progressLabel: `Building container image (platform=${platform})`
+		wrapError: (stderr) => new LocalInvokeBuildError(`docker build failed for container Lambda asset (${sanitizeServiceExceptionMessage(asset.source.directory ?? asset.source.executable?.join(" ") ?? "")}): ${stderr}`),
+		progressLabel: `Building container image (platform=${platform})`,
+		...options.assetOutdir !== void 0 && { assetOutdir: options.assetOutdir }
 	});
 	if (actualTag !== tag) {
 		logger.debug(`Re-tagging executable-built image '${actualTag}' → '${tag}'`);
@@ -9615,6 +10072,10 @@ async function runDetached(opts) {
 	}
 	args.push(opts.image, ...entryPointTail, ...opts.cmd);
 	getLogger().child("docker").debug(`${getDockerCmd()} ${redactAwsCredentialsInArgs(args).join(" ")}`);
+	const forwardedKeys = Object.keys(passthroughEnv);
+	const refusal = finchSecretArgvRefusal(forwardedKeys.filter((k) => opts.sensitiveEnvKeys?.has(k)), `Container for image ${opts.image}`);
+	if (refusal !== void 0) throw new DockerRunnerError(refusal);
+	warnFinchArgvExposure(forwardedKeys);
 	try {
 		const { stdout } = await execFileAsync$5(getDockerCmd(), args, {
 			maxBuffer: 10 * 1024 * 1024,
@@ -9813,6 +10274,8 @@ var AssetManifestLoader = class {
 	* @returns Asset manifest or null if not found
 	*/
 	async loadManifest(cdkOutputDir, stackName) {
+		const resolved = resolveAssemblyPath(cdkOutputDir, `${stackName}.assets.json`);
+		if (!resolved.contained) throw new Error(`Refusing to read the asset manifest for stack '${sanitizeServiceExceptionMessage(stackName)}': it ` + renderAssemblyPathEscape(resolved, cdkOutputDir, "read it"));
 		const manifestPath = join$1(cdkOutputDir, `${stackName}.assets.json`);
 		try {
 			this.logger.debug(`Loading asset manifest from: ${manifestPath}`);
@@ -9847,14 +10310,31 @@ var AssetManifestLoader = class {
 		return fileAssets;
 	}
 	/**
-	* Get asset source path (absolute path)
+	* Get a file asset's source directory (absolute path), REFUSING a
+	* `source.path` that leaves `opts.assetOutdir` (go-to-k/cdk-local#745).
+	*
+	* The value resolves against `cdkOutputDir` with `path.join` semantics, as
+	* it always has, so an ABSOLUTE value is folded under it rather than
+	* honoured (`'fold'` in `resolveAssetSourcePath`). `assetOutdir` is the
+	* app's outdir — `assetPathDirs(stack).assetOutdir` — and is REQUIRED so a
+	* caller cannot silently bound a Stage's `../asset.<hash>` at the manifest
+	* directory.
 	*
-	* @param cdkOutputDir CDK output directory
-	* @param asset File asset
-	* @returns Absolute path to asset source
+	* The one reader is the AgentCore CodeConfiguration bundle, which builds an
+	* image FROM this directory; `subject` names it in the refusal.
 	*/
-	getAssetSourcePath(cdkOutputDir, asset) {
-		return join$1(cdkOutputDir, asset.source.path);
+	getAssetSourcePath(cdkOutputDir, asset, opts) {
+		return resolveAssetSourcePath({
+			manifestDir: cdkOutputDir,
+			value: asset.source.path,
+			assetOutdir: opts.assetOutdir,
+			absolute: "fold",
+			field: "source.path",
+			subject: opts.subject,
+			action: "build an image from it",
+			sink: "build an image from that directory and run it locally",
+			wrapError: opts.wrapError
+		});
 	}
 	/**
 	* Resolve asset destination values (replace ${AWS::AccountId}, ${AWS::Region}, etc.)
@@ -19405,6 +19885,7 @@ async function resolveContainerImageForStartApi(lambda, skipPull, profile, optio
 	const localBuild = await resolveLocalBuildPlan$1(lambda);
 	if (localBuild) return { imageRef: await buildContainerImage(localBuild.asset, localBuild.cdkOutDir, {
 		architecture: lambda.architecture,
+		assetOutdir: localBuild.assetOutdir,
 		...options?.noBuild !== void 0 && { noBuild: options.noBuild }
 	}) };
 	if (!parseEcrUri(lambda.imageUri)) throw new Error(`Container Lambda '${lambda.logicalId}' has no matching asset in cdk.out, and Code.ImageUri '${lambda.imageUri}' is not an ECR URI ${getEmbedConfig().binaryName} can authenticate against. Re-synthesize the CDK app (so cdk.out includes the build context) or deploy the image to ECR first.`);
@@ -19434,7 +19915,8 @@ async function resolveLocalBuildPlan$1(lambda) {
 	if (!entry) return void 0;
 	return {
 		asset: entry.asset,
-		cdkOutDir
+		cdkOutDir,
+		assetOutdir: assetPathDirs(lambda.stack).assetOutdir
 	};
 }
 /**
@@ -20462,7 +20944,8 @@ async function resolveContainerImagePlan$1(lambda, options) {
 	let imageRef;
 	if (localBuild) imageRef = await buildContainerImage(localBuild.asset, localBuild.cdkOutDir, {
 		architecture: lambda.architecture,
-		noBuild: options.build === false
+		noBuild: options.build === false,
+		assetOutdir: localBuild.assetOutdir
 	});
 	else {
 		if (!parseEcrUri(lambda.imageUri)) throw new Error(`Container Lambda '${lambda.logicalId}' has no matching asset in cdk.out, and Code.ImageUri '${lambda.imageUri}' is not an ECR URI ${getEmbedConfig().binaryName} can authenticate against. Re-synthesize the CDK app (so cdk.out includes the build context) or deploy the image to ECR first.`);
@@ -20496,7 +20979,8 @@ async function resolveLocalBuildPlan(lambda) {
 	if (!entry) return void 0;
 	return {
 		asset: entry.asset,
-		cdkOutDir
+		cdkOutDir,
+		assetOutdir: assetPathDirs(lambda.stack).assetOutdir
 	};
 }
 function envHasIntrinsicValue(templateEnv) {
@@ -21146,7 +21630,7 @@ async function buildAgentCoreCodeImage(options) {
 		], { progressLabel: `Building agent image (runtime=${options.runtime})` });
 	} catch (err) {
 		const stderr = err.stderr?.trim();
-		throw new LocalInvokeBuildError(`docker build failed for AgentCore code artifact (${options.sourceDir})${stderr ? `: ${stderr}` : ""}`);
+		throw new LocalInvokeBuildError(`docker build failed for AgentCore code artifact (${flattenToOneLine(options.sourceDir)})${stderr ? `: ${stderr}` : ""}`);
 	} finally {
 		await rm(buildDir, {
 			recursive: true,
@@ -21191,14 +21675,14 @@ async function warnIfDependenciesNotVendored(sourceDir, runtime, isNode, logger)
 	}
 	const has = (name) => entries.includes(name);
 	if (isNode) {
-		if (has("package.json") && !has("node_modules")) logger.warn(`AgentCore code bundle '${sourceDir}' declares package.json but does not vendor node_modules. The AgentCore managed runtime does NOT install dependencies at runtime, so the deployed agent will fail to resolve them. Vendor dependencies into the bundle (e.g. 'npm install --omit=dev' in the bundle dir) so the deploy artifact is self-contained. cdk-local runs the bundle as-is to match the deployed runtime.`);
+		if (has("package.json") && !has("node_modules")) logger.warn(`AgentCore code bundle '${flattenToOneLine(sourceDir)}' declares package.json but does not vendor node_modules. The AgentCore managed runtime does NOT install dependencies at runtime, so the deployed agent will fail to resolve them. Vendor dependencies into the bundle (e.g. 'npm install --omit=dev' in the bundle dir) so the deploy artifact is self-contained. cdk-local runs the bundle as-is to match the deployed runtime.`);
 		return;
 	}
 	const manifest = await pythonManifestDeclaringDeps(sourceDir, entries);
 	const vendored = entries.some((e) => e.endsWith(".dist-info"));
 	if (manifest && !vendored) {
 		const pyVersion = runtime.replace("PYTHON_", "").replace("_", ".");
-		logger.warn(`AgentCore code bundle '${sourceDir}' declares ${manifest} but does not vendor its dependencies. The AgentCore managed runtime does NOT install dependencies at runtime, so the deployed agent will fail with ModuleNotFoundError. Vendor arm64 wheels into the bundle, e.g.:
+		logger.warn(`AgentCore code bundle '${flattenToOneLine(sourceDir)}' declares ${manifest} but does not vendor its dependencies. The AgentCore managed runtime does NOT install dependencies at runtime, so the deployed agent will fail with ModuleNotFoundError. Vendor arm64 wheels into the bundle, e.g.:
   uv pip install --python-platform aarch64-manylinux2014 --python-version ${pyVersion} --target <bundle-dir> -r requirements.txt\ncdk-local runs the bundle as-is to match the deployed runtime.`);
 	}
 }
@@ -22496,7 +22980,8 @@ async function resolveAgentCoreImage(resolved, options, loaded, stateProvider) {
 			const entry = getDockerImageBySourceHash(manifest, containerUri);
 			if (entry) return buildContainerImage(entry.asset, cdkOutDir, {
 				architecture,
-				noBuild: options.build === false
+				noBuild: options.build === false,
+				assetOutdir: assetPathDirs(resolved.stack).assetOutdir
 			});
 		}
 	}
@@ -22531,8 +23016,12 @@ async function resolveAgentCoreCodeImage(resolved, code, options, architecture,
 	const fileAssets = manifest ? loader.getFileAssets(manifest) : void 0;
 	const asset = fileAssets ? fileAssets.get(code.codeAssetHash) ?? findFileAssetByObjectKey$1(fileAssets, code.codeAssetHash) : void 0;
 	if (!asset) throw new CdkLocalError(`AgentCore Runtime '${resolved.logicalId}' code bundle (asset ${code.codeAssetHash}) was not found in the cdk.out asset manifest. ${getEmbedConfig().cliName} invoke-agentcore runs a local from-source build of a fromCodeAsset bundle — re-synthesize the app so the asset is staged in cdk.out and retry. (A fromS3 bundle is downloaded from S3 instead; this runtime has no literal Code.S3.Bucket.)`, "LOCAL_INVOKE_AGENTCORE_CODE_ASSET_NOT_FOUND");
-	const sourceDir = loader.getAssetSourcePath(cdkOutDir, asset);
-	if (!existsSync(sourceDir) || !statSync(sourceDir).isDirectory()) throw new CdkLocalError(`AgentCore Runtime '${resolved.logicalId}' code bundle source '${sourceDir}' does not exist or is not a directory. Re-synthesize the app and retry.`, "LOCAL_INVOKE_AGENTCORE_CODE_SOURCE_MISSING");
+	const sourceDir = loader.getAssetSourcePath(cdkOutDir, asset, {
+		assetOutdir: assetPathDirs(resolved.stack).assetOutdir,
+		subject: `AgentCore Runtime '${flattenToOneLine(resolved.logicalId)}' code bundle`,
+		wrapError: (message) => new CdkLocalError(message, "LOCAL_INVOKE_AGENTCORE_CODE_SOURCE_ESCAPES_ASSEMBLY")
+	});
+	if (!existsSync(sourceDir) || !statSync(sourceDir).isDirectory()) throw new CdkLocalError(`AgentCore Runtime '${flattenToOneLine(resolved.logicalId)}' code bundle source '${flattenToOneLine(sourceDir)}' does not exist or is not a directory. Re-synthesize the app and retry.`, "LOCAL_INVOKE_AGENTCORE_CODE_SOURCE_MISSING");
 	return buildAgentCoreCodeImage({
 		sourceDir,
 		runtime: code.runtime,
@@ -23248,7 +23737,7 @@ async function softReloadAgentContainer(containerId, newAssetSourceDir) {
 		throw new CdkLocalError(`softReloadAgentContainer: docker inspect of container '${containerId}' failed: ${describeExecError(err)}.`, "LOCAL_INVOKE_AGENTCORE_WATCH_SOFT_RELOAD_INSPECT_FAILED");
 	}
 	const workdirDest = workdir.endsWith("/") ? workdir : `${workdir}/`;
-	logger.info(`Soft-reload: docker cp ${newAssetSourceDir} -> ${containerId}:${workdirDest}; restart.`);
+	logger.info(`Soft-reload: docker cp ${flattenToOneLine(newAssetSourceDir)} -> ${containerId}:${workdirDest}; restart.`);
 	try {
 		await execFileAsync$4(dockerCmd, [
 			"cp",
@@ -23295,7 +23784,11 @@ async function loadAgentCoreAssetContext(args) {
 		if (!manifest) return void 0;
 		const asset = assetLoader.getFileAssets(manifest).get(resolved.codeArtifact.codeAssetHash);
 		if (!asset) return void 0;
-		const sourceDir = assetLoader.getAssetSourcePath(cdkOutDir, asset);
+		const sourceDir = assetLoader.getAssetSourcePath(watchManifestDir(newCandidate, cdkOutDir), asset, {
+			assetOutdir: outputAssetBound(newCandidate, cdkOutDir),
+			subject: `AgentCore Runtime '${flattenToOneLine(resolved.logicalId)}' code bundle`,
+			wrapError: (message) => new CdkLocalError(message, "LOCAL_INVOKE_AGENTCORE_CODE_SOURCE_ESCAPES_ASSEMBLY")
+		});
 		return {
 			...oldAssetHash !== void 0 && { oldAssetHash },
 			newAssetHash: resolved.codeArtifact.codeAssetHash,
@@ -23311,7 +23804,17 @@ async function loadAgentCoreAssetContext(args) {
 	const newAssetHash = dockerImageEntry.hash;
 	const newDockerImage = dockerImageEntry.asset;
 	if (!newDockerImage.source.directory) return void 0;
-	const newAssetSourceDir = path.resolve(cdkOutDir, newDockerImage.source.directory);
+	const newAssetSourceDir = resolveAssetSourcePath({
+		manifestDir: watchManifestDir(newCandidate, cdkOutDir),
+		value: newDockerImage.source.directory,
+		assetOutdir: outputAssetBound(newCandidate, cdkOutDir),
+		absolute: "honour",
+		field: "source.directory",
+		subject: `AgentCore Runtime '${flattenToOneLine(resolved.logicalId)}' image asset`,
+		action: "copy from it",
+		sink: "copy that directory into the running agent container on a soft reload",
+		wrapError: (message) => new CdkLocalError(message, "LOCAL_INVOKE_AGENTCORE_CODE_SOURCE_ESCAPES_ASSEMBLY")
+	});
 	return {
 		...oldAssetHash !== void 0 && { oldAssetHash },
 		newAssetHash,
@@ -23734,6 +24237,7 @@ async function createNetworkAndSidecar(args) {
 	if (cluster) sidecarEnv["CLUSTER"] = cluster;
 	const sidecarPassthroughEnv = appendEnvFlags(sidecarArgs, sidecarEnv, SENSITIVE_ENV_KEYS);
 	sidecarArgs.push(METADATA_ENDPOINT_IMAGE);
+	warnFinchArgvExposure(Object.keys(sidecarPassthroughEnv));
 	logger.info(`Starting ECS local-container-endpoints sidecar at ${sidecarIp}...`);
 	try {
 		const { stdout } = await execFileAsync$3(getDockerCmd(), sidecarArgs, {
@@ -24044,6 +24548,12 @@ async function runEcsTask(task, options, state) {
 	if (task.containers.length === 0) throw new EcsTaskRunnerError(`Task '${task.taskDefinitionLogicalId}' has no containers — nothing to run.`);
 	for (const w of task.warnings) logger.warn(w);
 	const startOrder = topoSort(buildDependencyGraph(task.containers), task.containers);
+	const finchRefusals = [];
+	for (const c of task.containers) {
+		const refusal = finchSecretArgvRefusal([...c.secrets.map((s) => s.name), ...c.sensitiveEnvKeys], `Container '${c.name}'`);
+		if (refusal !== void 0) finchRefusals.push(refusal);
+	}
+	if (finchRefusals.length > 0) throw new EcsTaskRunnerError(finchRefusals.join("\n"));
 	const imagePlan = options.imagePlanByContainer ?? /* @__PURE__ */ new Map();
 	if (!options.imagePlanByContainer) await prepareImages(task, imagePlan, options);
 	const allSecrets = [];
@@ -24128,6 +24638,7 @@ async function runEcsTask(task, options, state) {
 		const { args, sensitiveEnv } = dockerCmds.get(container.name);
 		logger.info(`Starting container '${container.name}' (image=${imagePlan.get(container.name)})`);
 		let id;
+		warnFinchArgvExposure(Object.keys(sensitiveEnv));
 		try {
 			const { stdout } = await execFileAsync$2(getDockerCmd(), args, {
 				maxBuffer: 10 * 1024 * 1024,
@@ -24340,8 +24851,9 @@ async function prepareOneImage(task, container, options) {
 			}
 			const actualTag = await buildDockerImage(asset, cdkOutDir, {
 				tag,
+				assetOutdir: assetPathDirs(task.stack).assetOutdir,
 				...options.platformOverride !== void 0 && { platform: options.platformOverride },
-				wrapError: (stderr) => new LocalInvokeBuildError(`docker build failed for ECS container '${container.name}' (${asset.source.directory ?? asset.source.executable?.join(" ")}): ${stderr}`),
+				wrapError: (stderr) => new LocalInvokeBuildError(`docker build failed for ECS container '${container.name}' (${sanitizeServiceExceptionMessage(asset.source.directory ?? asset.source.executable?.join(" ") ?? "")}): ${stderr}`),
 				progressLabel: `Building container image for '${container.name}'`
 			});
 			if (actualTag !== tag) try {
@@ -25718,7 +26230,7 @@ async function softReloadReplica(args) {
 	instance.softReloadInProgress = true;
 	instance.softReloadGeneration = (instance.softReloadGeneration ?? 0) + 1;
 	try {
-		logger.info(`Soft-reloading replica r${instance.index} (gen ${instance.generation}): docker cp ${sourceDirToCopy} -> ${targets.length} essential container(s); restart.`);
+		logger.info(`Soft-reloading replica r${instance.index} (gen ${instance.generation}): docker cp ${flattenToOneLine(sourceDirToCopy)} -> ${targets.length} essential container(s); restart.`);
 		for (const target of targets) {
 			let workdir;
 			try {
@@ -25766,7 +26278,7 @@ async function softReloadReplica(args) {
 const defaultDockerInspectWorkdirImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-DLX1TqVw.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-SocNyC9q.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), [
 		"inspect",
 		"--format",
@@ -25785,7 +26297,7 @@ let dockerInspectWorkdirImpl = defaultDockerInspectWorkdirImpl;
 const defaultDockerCpImpl = async (src, dst) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-DLX1TqVw.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-SocNyC9q.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), [
 		"cp",
 		src,
@@ -25800,7 +26312,7 @@ let dockerCpImpl = defaultDockerCpImpl;
 const defaultDockerRestartImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-DLX1TqVw.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-SocNyC9q.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), ["restart", containerId]);
 };
 let dockerRestartImpl = defaultDockerRestartImpl;
@@ -25840,7 +26352,7 @@ async function disconnectOldFromSharedNetwork(oldInstance) {
 const defaultDockerNetworkDisconnectImpl = async (networkName, containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-DLX1TqVw.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-SocNyC9q.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), [
 		"network",
 		"disconnect",
@@ -26017,7 +26529,7 @@ function pickEssentialContainerId(instance, service) {
 const defaultWaitForExitImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-DLX1TqVw.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-SocNyC9q.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), ["wait", containerId], { maxBuffer: 1024 * 1024 });
 	const code = parseInt(stdout.trim(), 10);
 	return Number.isFinite(code) ? code : -1;
@@ -26037,7 +26549,7 @@ const EXIT_LOG_TAIL_LINES = 50;
 const defaultReadContainerLogsImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-DLX1TqVw.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-SocNyC9q.js").then((n) => n.t);
 	const { stdout, stderr } = await promisify(execFile)(getDockerCmd(), [
 		"logs",
 		"--tail",
@@ -27846,7 +28358,10 @@ async function resolveContainerImagePlan(lambda, opts) {
 		const manifest = await new AssetManifestLoader().loadManifest(cdkOutDir, lambda.stack.stackName);
 		const entry = manifest ? getDockerImageBySourceHash(manifest, lambda.imageUri) : void 0;
 		if (entry) {
-			imageRef = await buildContainerImage(entry.asset, cdkOutDir, { architecture: lambda.architecture });
+			imageRef = await buildContainerImage(entry.asset, cdkOutDir, {
+				architecture: lambda.architecture,
+				assetOutdir: assetPathDirs(lambda.stack).assetOutdir
+			});
 			localBuilt = true;
 		}
 	}
@@ -29243,7 +29758,17 @@ async function loadAssetContextForTarget(args) {
 		logger.debug(`loadAssetContext: docker asset '${newAssetHash}' for stack '${candidate.stackName}' is executable-mode (no source.directory). Classifier will see no asset context (rebuild).`);
 		return;
 	}
-	const newAssetSourceDir = path.resolve(cdkOutDir, newDockerImage.source.directory);
+	const newAssetSourceDir = resolveAssetSourcePath({
+		manifestDir: watchManifestDir(candidate, cdkOutDir),
+		value: newDockerImage.source.directory,
+		assetOutdir: outputAssetBound(candidate, cdkOutDir),
+		absolute: "honour",
+		field: "source.directory",
+		subject: `Docker image asset '${sanitizeServiceExceptionMessage(newAssetHash)}' of stack '${sanitizeServiceExceptionMessage(candidate.stackName)}'`,
+		action: "copy from it",
+		sink: "copy that directory into the running replicas on a soft reload",
+		wrapError: (message) => new Error(message)
+	});
 	let oldAssetHash;
 	const liveReplica = controller.runState.replicas.find((r) => !r.shuttingDown);
 	if (liveReplica?.lastDeployedAssetHash !== void 0) oldAssetHash = liveReplica.lastDeployedAssetHash;
@@ -29591,6 +30116,7 @@ async function buildFrontDoor(plan, options, logger, extraStateProviders) {
 		...action,
 		auth: authForGuard(guard)
 	} : action;
+	let bootingLambda;
 	try {
 		for (const listener of plan.listeners) {
 			const defaultRoute = listener.defaultAction ? attachAuth(toRouteAction(listener.defaultAction), listener.defaultAuthGuard) : void 0;
@@ -29641,12 +30167,15 @@ async function buildFrontDoor(plan, options, logger, extraStateProviders) {
 			if (!listener.defaultAction) logger.info("  (no default action: unmatched requests return 404)");
 		}
 		for (const runner of lambdaRegistry.values()) {
-			logger.info(`Booting Lambda target '${runner.logicalId}' behind the ALB front-door...`);
+			bootingLambda = flattenToOneLine(runner.logicalId);
+			logger.info(`Booting Lambda target '${bootingLambda}' behind the ALB front-door...`);
 			await runner.start();
 		}
+		bootingLambda = void 0;
 	} catch (err) {
 		await Promise.allSettled(servers.map((s) => s.close()));
 		await Promise.allSettled([...lambdaRegistry.values()].map((r) => r.stop()));
+		if (bootingLambda !== void 0) throw new LocalStartServiceError(`Failed to boot ALB Lambda target '${bootingLambda}': ${err instanceof Error ? err.message : String(err)}`);
 		throw new LocalStartServiceError(`Failed to start ALB front-door: ${err instanceof Error ? err.message : String(err)}. If a listener port is privileged (< 1024), remap it to a non-privileged host port with --lb-port <listenerPort>=<hostPort> (e.g. --lb-port 80=8080).`);
 	}
 	const frontDoorByService = /* @__PURE__ */ new Map();
@@ -32112,12 +32641,17 @@ function resolveOrigins(dc, template, stack, overrides) {
 			continue;
 		}
 		const localDirs = bucketLogicalId && manifest ? resolveBucketDeploymentDirs(template, manifest, stack, bucketLogicalId) : [];
-		if (localDirs.length > 0) out.set(originId, {
-			kind: "s3",
-			originId,
-			localDirs
-		});
-		else {
+		if (localDirs.length > 0) {
+			const { assetOutdir } = assetPathDirs(stack);
+			const hideDotfilesIn = localDirs.filter((d) => absoluteAssemblyPathEscape(assetOutdir, d) !== void 0);
+			out.set(originId, {
+				kind: "s3",
+				originId,
+				localDirs,
+				fromAssembly: true,
+				...hideDotfilesIn.length > 0 && { hideDotfilesIn }
+			});
+		} else {
 			const literalBucket = bucketLogicalId === void 0 ? s3Domain.bucketName : void 0;
 			out.set(originId, {
 				kind: "s3-unresolved",
@@ -32192,8 +32726,8 @@ function loadStackManifest(stack) {
 * object key cannot be matched to a manifest file asset.
 */
 function resolveBucketDeploymentDirs(template, manifest, stack, bucketLogicalId) {
-	const manifestDir = stack.assetManifestPath ? dirname(stack.assetManifestPath) : void 0;
-	if (!manifestDir) return [];
+	if (!stack.assetManifestPath) return [];
+	const { manifestDir, assetOutdir } = assetPathDirs(stack);
 	const dirs = [];
 	for (const resource of Object.values(template.Resources ?? {})) {
 		if (!String(resource.Type).startsWith("Custom::CDKBucketDeployment")) continue;
@@ -32204,7 +32738,17 @@ function resolveBucketDeploymentDirs(template, manifest, stack, bucketLogicalId)
 			if (typeof key !== "string") continue;
 			const asset = findFileAssetByObjectKey(manifest, key);
 			if (!asset) continue;
-			dirs.push(resolve(manifestDir, asset.source.path));
+			dirs.push(resolveAssetSourcePath({
+				manifestDir,
+				value: asset.source.path,
+				assetOutdir,
+				absolute: "honour-warn",
+				field: "source.path",
+				subject: `BucketDeployment source asset for bucket '${sanitizeServiceExceptionMessage(bucketLogicalId)}'`,
+				action: "serve it",
+				sink: "serve every file under that directory as this bucket's local S3 origin",
+				wrapError: (message) => new Error(message)
+			}));
 		}
 	}
 	return dirs;
@@ -32641,14 +33185,16 @@ function normalizeHeaders(headers) {
 */
 function serveFromStaticOrigin(input) {
 	const key = uriToKey(input.uri, input.defaultRootObject);
-	const direct = readKey(input.localDirs, key);
+	const containLinks = input.containLinks === true;
+	const hideIn = new Set(input.hideDotfilesIn ?? []);
+	const direct = readKey(input.localDirs, key, containLinks, hideIn);
 	if (direct) return {
 		statusCode: 200,
 		headers: { "content-type": contentTypeForKey(key) },
 		body: direct
 	};
 	for (const candidate of resolveErrorResponseCandidates(input.customErrorResponses)) {
-		const body = readKey(input.localDirs, candidate.errorKey);
+		const body = readKey(input.localDirs, candidate.errorKey, containLinks, hideIn);
 		if (body) return {
 			statusCode: candidate.responseCode,
 			headers: { "content-type": contentTypeForKey(candidate.errorKey) },
@@ -32702,15 +33248,30 @@ function uriToKey(uri, defaultRootObject) {
 }
 /**
 * Read a key from the first directory that contains it as a regular file.
-* Path-traversal safe: the resolved absolute path must stay within the origin
-* directory (a `../` in the key, or a symlink escaping the root, yields no
-* read). Returns `undefined` when no directory has the key.
+* Path-traversal safe: a `../` in the key never leaves the origin directory
+* (`safeJoin`, always), and with `containLinks` neither does a symlink.
+* Returns `undefined` when no directory has the key.
+*
+* The symlink half is {@link realPathInsideRoot}, not `safeJoin`: `safeJoin`
+* judges the path's TEXT, and `statSync` / `readFileSync` follow links, so a
+* `cdk.out/asset.x/index.html -> ~/.aws/credentials` inside a contained origin
+* directory used to be served (go-to-k/cdk-local#745).
 */
-function readKey(localDirs, key) {
+function readKey(localDirs, key, containLinks, hideDotfilesIn) {
 	if (key === "") return void 0;
 	for (const dir of localDirs) {
-		const resolved = safeJoin(dir, key);
-		if (!resolved) continue;
+		const joined = safeJoin(dir, key);
+		if (!joined) continue;
+		let resolved = joined;
+		if (containLinks) {
+			const real = realPathInsideRoot(dir, joined);
+			if (real === false) continue;
+			if (real !== void 0) resolved = real;
+		}
+		if (hideDotfilesIn.has(dir) && isHiddenKey(dir, key, resolved)) {
+			if (isExistingFile(resolved)) warnHiddenKey(dir, key, resolved);
+			continue;
+		}
 		try {
 			if (statSync(resolved).isFile()) return readFileSync(resolved);
 		} catch {}
@@ -32727,6 +33288,68 @@ function safeJoin(dir, key) {
 	if (candidate !== root && !candidate.startsWith(rootWithSep)) return void 0;
 	return candidate;
 }
+/**
+* `file`'s REAL path (every symbolic link followed by the kernel) when it lies
+* inside `root`'s real path; `false` when it leaves it, with a warning once per
+* file; `undefined` when either does not resolve — the read after it fails the
+* same way, so it reaches nothing.
+*/
+function realPathInsideRoot(root, file) {
+	let realFile;
+	let realRoot;
+	try {
+		realFile = realpathSync.native(file);
+		realRoot = realpathSync.native(root);
+	} catch {
+		return;
+	}
+	const rel = relative(realRoot, realFile);
+	if (rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel)) return realFile;
+	if (!warnedEscapes.has(file)) {
+		warnedEscapes.add(file);
+		getLogger().warn(`Not serving '${flattenToOneLine(file)}': it is a symbolic link to '${flattenToOneLine(realFile)}', outside the origin directory '${flattenToOneLine(root)}' the asset manifest named. Answering as if the key did not exist.`);
+	}
+	return false;
+}
+/** Files already warned about; a browser re-requests the same key. */
+const warnedEscapes = /* @__PURE__ */ new Set();
+/**
+* Whether a key under an accepted absolute `--no-staging` folder names a
+* hidden entry — on the request key itself, or on the file's REAL path relative
+* to the folder's real path (a link inside the folder pointing at `.env`).
+* `.well-known` is the one hidden name served, for parity with a deployed
+* bucket's ACME / app-association files. The caller warns, and only for an
+* entry that exists.
+*/
+function isHiddenKey(dir, key, resolved) {
+	const hidden = (rel) => rel.split(/[\\/]/).some((c) => c.startsWith(".") && c !== "." && c !== ".." && c !== ".well-known");
+	let realRel = "";
+	try {
+		realRel = relative(realpathSync.native(dir), realpathSync.native(resolved));
+	} catch {
+		realRel = "";
+	}
+	return hidden(key) || hidden(realRel);
+}
+function isExistingFile(p) {
+	try {
+		return statSync(p).isFile();
+	} catch {
+		return false;
+	}
+}
+/**
+* Warn once per withheld FILE. Keyed on the resolved path, not the request
+* key: `x/../.env`, `xx/../.env`, ... are unbounded spellings of one file, and
+* keying on them let any client grow this set and the log without limit.
+*/
+function warnHiddenKey(dir, key, resolved) {
+	if (warnedHiddenKeys.has(resolved)) return;
+	warnedHiddenKeys.add(resolved);
+	getLogger().warn(`Not serving '${flattenToOneLine(key)}' from '${flattenToOneLine(dir)}': it is a hidden entry in a cdk synth --no-staging source folder (your own tree, not a staged asset). Answering as if the key did not exist.`);
+}
+/** Hidden keys already warned about. */
+const warnedHiddenKeys = /* @__PURE__ */ new Set();
 function stripLeadingSlash(s) {
 	return s.startsWith("/") ? s.replace(/^\/+/, "") : s;
 }
@@ -33093,6 +33716,8 @@ async function serveFromOrigin(origin, args) {
 	if (origin.kind !== "s3") return void 0;
 	const result = serveFromStaticOrigin({
 		localDirs: origin.localDirs,
+		...origin.fromAssembly === true && { containLinks: true },
+		...origin.hideDotfilesIn !== void 0 && { hideDotfilesIn: origin.hideDotfilesIn },
 		uri: args.uri,
 		...distribution.defaultRootObject !== void 0 && { defaultRootObject: distribution.defaultRootObject },
 		customErrorResponses: distribution.customErrorResponses
@@ -41059,4 +41684,4 @@ function addStudioSpecificOptions(cmd) {
 
 //#endregion
 export { applyEdgeResponseResult as $, buildJwksUrlFromIssuer as $n, resolveCfnStackName as $r, buildCloudMapIndex as $t, startAgentCoreHttpServer as A, describeCredentialLoadFailure as Ai, classifySourceChange as An, ConnectionRegistry as Ar, addRunTaskSpecificOptions as At, idFromArn as B, buildStageMap as Bn, resolveRuntimeFileExtension as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, resolveAgentCoreTarget as Ci, waitForAgentCorePing as Cn, tryParseStatus as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, tryResolveImageFnJoin as Di, computeCodeImageTag as Dn, probeHostGatewaySupport as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, substituteImagePlaceholders as Ei, buildAgentCoreCodeImage as En, HOST_GATEWAY_MIN_VERSION as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, createWatchPredicates as Fn, buildDisconnectEvent as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, filterRoutesByApiIdentifiers as Gn, substituteEnvVarsFromState as Gr, enforceImageOverrideOrphans as Gt, createDeployedKvsDataSource as H, resolveEnvVars$1 as Hn, EcsTaskResolutionError as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, resolveApiTargetSubset as In, buildMessageEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, startApiServer as Jn, createLocalStateProvider as Jr, resolveImageOverrides as Jt, createS3OriginReader as K, groupRoutesByServer as Kn, substituteEnvVarsFromStateAsync as Kr, mergeForService as Kt, parseKvsFileOverrides as L, createAuthorizerCache as Ln, architectureToPlatform as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, resolveProfileCredentials as Mi, createLocalInvokeCommand as Mn, handleConnectionsRequest as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, buildProxyClientConfig as Ni, addStartApiSpecificOptions as Nn, parseConnectionsPath as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, LocalInvokeBuildError as Oi, renderCodeDockerfile as On, resolveHostGatewayExtraHosts as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, isProxyEnvConfigured as Pi, createLocalStartApiCommand as Pn, buildConnectEvent as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, buildCognitoJwksUrl as Qn, resolveCfnRegion as Qr, listPinnedTargets as Qt, parseOriginOverrides as R, createFileWatcher as Rn, buildContainerImage as Rr, parseMaxTasks as Rt, StudioEventBus as S, pickAgentCoreCandidateStack as Si, waitForAgentCoreHttpReady as Sn, selectIntegrationResponse as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, formatStateRemedy as Ti, SUPPORTED_CODE_RUNTIMES as Tn, HOST_DOCKER_INTERNAL_GATEWAY as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, availableApiIdentifiers as Un, substituteAgainstState as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, materializeLayerFromArn as Vn, resolveRuntimeImage as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, filterRoutesByApiIdentifier as Wn, substituteAgainstStateAsync as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveServiceIntegrationParameters as Xn, rejectExplicitCfnStackWithMultipleStacks as Xr, describePinnedImageUri as Xt, resolveErrorResponseCandidates as Y, resolveSelectionExpression as Yn, isCfnFlagPresent as Yr, runImageOverrideBuilds as Yt, serveLambdaUrlOrigin as Z, defaultCredentialsLoader as Zn, resolveCfnFallbackRegion as Zr, isLocalCdkAssetImage as Zt, filterStudioTargetGroups as _, AGENTCORE_AGUI_PROTOCOL as _i, parseSseForJsonRpc as _n, applyAuthorizerOverlay as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, countTargets as ai, attachContainerLogStreamer as an, computeRequestIdentityHash as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_RUNTIME_TYPE as bi, AGENTCORE_SESSION_ID_HEADER as bn, evaluateResponseParameters as br, addAlbSpecificOptions as bt, startStudioProxy as c, discoverWebSocketApis as ci, bridgeAgentCoreWs as cn, invokeTokenAuthorizer as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, parseSelectionExpressionPath as di, A2A_PATH as dn, buildCorsConfigByApiId as dr, pickTargetFunctionLogicalId as dt, CfnLocalStateProvider as ei, CloudMapRegistry as en, createJwksCache as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, webSocketApiMatchesIdentifier as fi, a2aInvokeOnce as fn, buildCorsConfigFromCloudFrontChain as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, AGENTCORE_A2A_PROTOCOL as gi, mcpInvokeOnce as gn, translateLambdaResponse as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, resolveLambdaArnIntrinsic as hi, MCP_PROTOCOL_VERSION as hn, matchRoute as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSingleTarget as ii, getContainerNetworkIp as in, buildMethodArn as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, buildStsClientConfig as ji, addInvokeSpecificOptions as jn, buildMgmtEndpointEnvUrl as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, describeAwsFailureForWarn as ki, toCmdArgv as kn, bufferToBody as kr, serviceStrategy as kt, relayServeRequest as l, discoverWebSocketApisOrThrow as li, invokeAgentCoreWs as ln, attachAuthorizers as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, pickRefLogicalId as mi, MCP_PATH as mn, matchPreflight as mr, runViewerRequest as mt, coerceRunRequest as n, resolveSsmParameters as ni, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as nn, verifyJwtAuthorizer as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, listTargets as oi, addInvokeAgentCoreSpecificOptions as on, evaluateCachedLambdaPolicy as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, discoverRoutes as pi, MCP_CONTAINER_PORT as pn, isFunctionUrlOacFronted as pr, compileCloudFrontFunction as pt, matchBehavior as q, readMtlsMaterialsFromDisk as qn, LocalStateSourceError as qr, parseImageOverrideFlags as qt, coerceServeRequest as r, resolveWatchConfig as ri, setShadowReadyTimeoutMs as rn, verifyJwtViaDiscovery as rr, httpHeadersToEdge as rt, createStudioServeManager as s, availableWebSocketApiIdentifiers as si, createLocalInvokeAgentCoreCommand as sn, invokeRequestAuthorizer as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, collectSsmParameterRefs as ti, DEFAULT_SHADOW_READY_TIMEOUT_MS as tn, verifyCognitoJwt as tr, buildEdgeResponseEvent as tt, reinvoke as u, filterWebSocketApisByIdentifiers as ui, A2A_CONTAINER_PORT as un, applyCorsResponseHeaders as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_HTTP_PROTOCOL as vi, AGENTCORE_SIGV4_SERVICE as vn, buildHttpApiV2Event as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, derivePseudoParametersFromRegion as wi, downloadAndExtractS3Bundle as wn, VtlEvaluationError as wr, resolveAlbTarget as wt, createStudioStore as x, AgentCoreResolutionError as xi, invokeAgentCore as xn, pickResponseTemplate as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_MCP_PROTOCOL as yi, signAgentCoreInvocation as yn, buildRestV1Event as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, attachStageContext as zn, resolveRuntimeCodeMountPath as zr, parseRestartPolicy as zt };
-//# sourceMappingURL=local-studio-D8cHeCcp.js.map
+//# sourceMappingURL=local-studio-BbLfdSy4.js.map