cdk-local 0.149.2 → 0.149.4

package/dist/{local-studio-CSIZELLP.js → local-studio-Cdq8klwg.js}

@@ -1699,6 +1699,393 @@ function effectiveAssumeRoleArn(logicalId, opt) {
 	return opt.perLambda?.[logicalId] ?? opt.globalArn;
 }
 
+//#endregion
+//#region src/utils/assembly-path.ts
+/**
+* `true` when `candidate` names something strictly beneath `base`, both given
+* as already-resolved absolute paths.
+*
+* The `..` test is SEPARATOR-AWARE rather than a bare `startsWith('..')`,
+* which would also reject a legitimate sibling named `..foo`. The empty-string
+* case is `base` itself; callers decide whether that counts as an escape,
+* because an asset path legitimately names a DIRECTORY while a template path
+* does not.
+*/
+function isInside(base, candidate) {
+	const rel = relative(base, candidate);
+	if (rel === "" || rel === "..") return false;
+	if (rel.startsWith(`..${sep}`)) return false;
+	return !isAbsolute(rel);
+}
+/**
+* `realpath(3)`, or `undefined` for a path that does not fully resolve.
+*
+* `.native` is load-bearing and must not be simplified to `fs.realpathSync`.
+* The plain form is a JavaScript walker that folds `..` LEXICALLY, so it
+* disagrees with the kernel on a target carrying a `..` after a symlinked
+* component — answering `ENOENT` for a path the kernel resolves, and on a
+* case-insensitive filesystem (APFS by default) it can spin on the same shape.
+* `.native` is libuv's `realpath(3)` and throws the same
+* `ENOENT` / `ELOOP` / `EACCES`.
+*/
+function tryRealpath(p) {
+	try {
+		return realpathSync.native(p);
+	} catch {
+		return;
+	}
+}
+/** `fs.readlinkSync`, or `undefined` when `p` is not a symbolic link. */
+function tryReadlink(p) {
+	try {
+		return readlinkSync(p);
+	} catch {
+		return;
+	}
+}
+/**
+* Link follows before the walk gives up and reports the path as unresolvable.
+* It does NOT refuse: an exhausted budget answers `undefined`, which leaves
+* the symlink arm silent and the lexical verdict standing. Safe because the OS
+* gives up first (macOS caps at 32, `ELOOP`), so a chain that reaches this cap
+* is one nothing can open anyway.
+*/
+const MAX_LINK_HOPS = 40;
+/**
+* Unresolvable path COMPONENTS the climb walks before giving up. Bounds the
+* recursion below, which is one frame per component, so a pathological value
+* cannot raise a `RangeError` from inside {@link tryRealpath}'s own `try` (its
+* `catch` would swallow the crash into a silent `undefined`).
+*
+* KNOW THAT EXHAUSTING THIS FAILS OPEN, and why that is accepted rather than
+* unnoticed. Unlike {@link MAX_LINK_HOPS}, which has the OS's own `ELOOP` cap
+* behind it, nothing else stops a path of 1 001 absent components: the climb
+* gives up, the symlink arm goes silent, and a value that would land outside
+* reads as CONTAINED on the lexical verdict alone. It is not reachable in
+* effect — such a path cannot exist, so `cdkl invoke`'s `existsSync` refuses it
+* and `start-api`'s `docker run` fails to mount it — but that safety lives in
+* the CONSUMERS, not here. A consumer that neither checks existence nor mounts
+* would need its own answer.
+*/
+const MAX_PATH_COMPONENTS = 1e3;
+/**
+* Where `target` REALLY points, for a path that may not exist yet.
+*
+* `realpathSync` answers only for a path that fully resolves, and it throws
+* `ENOENT` for a DANGLING symbolic link exactly as it does for an absent file.
+* `cdkl start-api` resolves an asset path without an existence check, so an
+* absent or dangling component must not silence the symlink arm.
+*
+* Each unresolvable component is therefore handled by hand: climb to the
+* deepest ancestor that DOES resolve, then re-apply the remaining components,
+* following any symbolic link with `readlink` and re-resolving its target.
+* `undefined` means the walk could not resolve the path at all.
+*
+* For a path that FULLY RESOLVES the answer is the kernel's and is exact. For
+* one that does not exist yet this is a best-effort MODEL of kernel
+* resolution; the known edge is a `..` INSIDE an unresolvable link's target,
+* folded lexically here while the kernel folds it only after following each
+* preceding component. That edge is benign for THESE callers rather than in
+* general: it needs the target to be absent, and both consumers resolve the
+* path and then open or mount it, so the divergence is between this model and
+* a path nothing can reach. A caller that CREATED a file through such a path
+* would need an `lstat` of its own.
+*
+* `EACCES` is folded into "does not resolve" along with `ENOENT`, so a link
+* under a directory this process cannot traverse reads as contained. Same
+* bound: the consumer's own `existsSync` / mount runs as the same user and
+* fails identically.
+*/
+function resolveThroughLinks(target, hops = 0, climbs = 0) {
+	const direct = tryRealpath(target);
+	if (direct !== void 0) return direct;
+	if (hops >= MAX_LINK_HOPS) return void 0;
+	if (climbs >= MAX_PATH_COMPONENTS) return void 0;
+	const parent = dirname(target);
+	if (parent === target) return void 0;
+	const realParent = resolveThroughLinks(parent, hops, climbs + 1);
+	if (realParent === void 0) return void 0;
+	const link = tryReadlink(target);
+	if (link === void 0) return join(realParent, basename(target));
+	return resolveThroughLinks(resolve(realParent, link), hops + 1, climbs);
+}
+/**
+* Resolve an assembly-supplied `candidate` against `dir` and report whether
+* the result stays inside it.
+*
+* The lexical arm joins exactly the way the call sites used to (`path.join`,
+* NOT `path.resolve`), so the verdict is about the path the caller will
+* actually use. `join`'s handling of an absolute candidate makes this arm
+* strictly more permissive than a `resolve`-based one would be; an absolute
+* value is therefore answered by {@link absoluteAssemblyPathEscape} instead,
+* because this function structurally cannot.
+*
+* The SYMLINK arm exists because the lexical arm alone leaves an equivalent
+* hole: `cdk.out/link -> /etc` plus a candidate of `link/passwd` is lexically
+* contained and still reaches `/etc/passwd`. Both sides go through
+* {@link resolveThroughLinks}, so an assembly directory REACHED through a link
+* (macOS spells `/tmp` as `/private/tmp`) is unaffected.
+*
+* The verdict is about the assembly AS IT SITS ON DISK. It is NOT a defence
+* against a process rewriting that directory concurrently — the caller uses
+* the path after this returns.
+*/
+function resolveAssemblyPath(dir, candidate, options) {
+	const base = resolve(dir);
+	const bound = options?.containWithin === void 0 ? base : resolve(options.containWithin);
+	const joined = resolve(join(base, candidate));
+	if (!isInside(bound, joined)) return {
+		contained: false,
+		escape: "lexical",
+		path: joined
+	};
+	const realBound = resolveThroughLinks(bound);
+	if (realBound !== void 0) {
+		const realTarget = resolveThroughLinks(joined);
+		if (realTarget !== void 0 && !isInside(realBound, realTarget)) return {
+			contained: false,
+			escape: "symlink",
+			path: joined,
+			realPath: realTarget
+		};
+	}
+	return {
+		contained: true,
+		path: joined
+	};
+}
+/**
+* Whether an ALREADY-ABSOLUTE assembly-supplied path lies outside `bound`.
+*
+* {@link resolveAssemblyPath} cannot answer this, and the reason is structural
+* rather than an oversight: its lexical arm joins with `path.join`, which does
+* NOT honour a leading separator, so an absolute candidate is folded INTO the
+* directory and the verdict would describe a path no caller opens. A site that
+* HONOURS an absolute value needs the verdict about the value itself.
+*
+* The callers are `cdkl invoke`'s and `cdkl start-api`'s
+* `Metadata['aws:asset:path']` resolution. Those honour an absolute path
+* because `cdk synth --no-staging` emits one — CDK writes the asset's absolute
+* SOURCE directory under `aws:cdk:disable-asset-staging`, usually outside the
+* outdir — and they WARN rather than refuse when it leaves the bound, so this
+* returns a verdict rather than throwing. The asset-MANIFEST readers that
+* honour an absolute value take the same verdict: `'honour-warn'` (the
+* start-cloudfront origin) warns when the value is a folder inside the user's
+* project not under a credential or version-control directory, and refuses
+* otherwise, `'honour'` (the soft-reload
+* sources) refuses (#745).
+*
+* It lives HERE so the containment rule has one spelling: it reuses this
+* module's own {@link isInside} and {@link resolveThroughLinks}, symlink arm
+* included, rather than letting a caller re-spell `path.relative` and drift.
+*
+* `bound` itself is NOT an escape, unlike in {@link resolveAssemblyPath},
+* where an empty `path.relative` means "names the directory rather than a file
+* inside it". An asset path legitimately names a DIRECTORY, so a value equal
+* to the bound is inside it and reporting it as outside would be false.
+*
+* THE REAL PATHS DECIDE IN BOTH DIRECTIONS, which is the one place this
+* deliberately does more than {@link resolveAssemblyPath}'s lexical-first
+* ordering. The lexical verdict here is about a SPELLING, and two spellings of
+* the same directory are common rather than exotic: macOS resolves `/tmp` to
+* `/private/tmp` and `/var` to `/private/var`, and a user may symlink `cdk.out`
+* itself. With an outdir of `/tmp/cdk.out` and a `--no-staging` value of
+* `/private/tmp/cdk.out/src`, a lexical-only verdict cries "pointing outside
+* the assembly ... treat this assembly as untrusted" about an asset that is
+* plainly inside it — and this arm exists to make an UNEXPECTED path visible,
+* so a false alarm is the failure that costs it its meaning.
+*
+* Exonerating requires the kernel to answer for BOTH operands: an unresolvable
+* one leaves the lexical verdict standing, so the arm stays loud when it cannot
+* see. (`resolveAssemblyPath` cannot take the same shape: its verdict is about
+* a path built with `path.join`, and letting a real path overrule the lexical
+* `..` there would answer about a location the caller never opens.)
+*/
+function absoluteAssemblyPathEscape(bound, absolutePath) {
+	const resolvedBound = resolve(bound);
+	const target = resolve(absolutePath);
+	const lexicallyOutside = !isInside(resolvedBound, target) && target !== resolvedBound;
+	const realBound = resolveThroughLinks(resolvedBound);
+	const realTarget = resolveThroughLinks(target);
+	const reallyOutside = realBound === void 0 || realTarget === void 0 ? void 0 : !isInside(realBound, realTarget) && realTarget !== realBound;
+	if (lexicallyOutside) {
+		if (reallyOutside === false) return void 0;
+		return {
+			contained: false,
+			escape: "lexical",
+			path: target
+		};
+	}
+	if (reallyOutside === true) return {
+		contained: false,
+		escape: "symlink",
+		path: target,
+		realPath: realTarget
+	};
+}
+/**
+* Whether `candidate` names the SAME directory as `bound` — lexically, or
+* through a symbolic link on either side.
+*
+* An asset source legitimately names a DIRECTORY, so a value that resolves
+* onto the output directory itself is not an escape; but it hands the WHOLE
+* assembly to the sink, which is worth a line. A caller that re-spells this as
+* `resolve(a) === resolve(b)` misses every second spelling of the bound
+* (macOS `/tmp` vs `/private/tmp`, a symlinked `cdk.out`), and
+* {@link absoluteAssemblyPathEscape} exonerates exactly those spellings as
+* inside — so the equality beside it would stay silent for them.
+*
+* Conservative on failure: an unresolvable side answers from the lexical
+* comparison alone, so it can only say "not the same", never wrongly claim
+* identity.
+*/
+function namesTheSameDirectory(bound, candidate) {
+	const resolvedBound = resolve(bound);
+	const target = resolve(candidate);
+	if (target === resolvedBound) return true;
+	const realBound = resolveThroughLinks(resolvedBound);
+	const realTarget = resolveThroughLinks(target);
+	return realBound !== void 0 && realTarget !== void 0 && realBound === realTarget;
+}
+/**
+* The escape verdict for an assembly-supplied path WITHOUT throwing, taking
+* whichever arm the value's own shape calls for: {@link absoluteAssemblyPathEscape}
+* for an absolute value, {@link resolveAssemblyPath} for a relative one.
+*
+* For a caller that only WARNS and has many values to judge — the BuildKit
+* passthroughs in `src/assets/buildkit-passthrough-warnings.ts`. `base` is what
+* a relative value resolves against, `bound` what it must stay inside.
+* Returns `undefined` when the value is fine, including when it names `bound`
+* itself ({@link namesTheSameDirectory}).
+*/
+function assemblyPathEscape(base, bound, candidate) {
+	if (isAbsolute(candidate)) return absoluteAssemblyPathEscape(bound, candidate);
+	const resolved = resolveAssemblyPath(base, candidate, { containWithin: bound });
+	if (resolved.contained || namesTheSameDirectory(bound, resolved.path)) return void 0;
+	return resolved;
+}
+/**
+* The shared tail of a containment refusal: what the value resolved to, what
+* it escaped, and why that means the assembly is not CDK-generated. The call
+* site supplies its own subject ("Lambda 'X' has ... which ") and its own
+* error class. `action` completes "Refusing to ..." and is REQUIRED rather
+* than defaulted: a default is a branch no caller takes, so it can neither be
+* fenced nor be right for the next caller.
+*
+* `provenanceOverride` replaces that whole closing sentence for a caller that
+* does NOT refuse — the BuildKit passthrough warnings, where "Refusing to ..."
+* would be a false statement about a value that is forwarded anyway.
+*/
+function renderAssemblyPathEscape(escape, dir, action, provenanceOverride) {
+	const provenance = provenanceOverride ?? `CDK emits assembly paths that stay inside the assembly directory; one that leaves it indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to ${action}.`;
+	const base = resolve(dir);
+	const realBase = resolveThroughLinks(base) ?? base;
+	const shownPath = displayUntrustedValue(escape.path);
+	const shownBase = displayUntrustedValue(base);
+	if (escape.escape === "symlink") {
+		if (escape.realPath === realBase) return `resolves to ${shownPath}, a symbolic link to the directory ${shownBase} itself rather than to a path inside it. ${provenance}`;
+		return `resolves to ${shownPath}, which leads through a symbolic link to ${displayUntrustedValue(escape.realPath)}, outside ${shownBase}. ${provenance}`;
+	}
+	if (escape.path === base) return `names the directory ${shownBase} itself rather than a path inside it. ${provenance}`;
+	return `resolves to ${shownPath}, outside ${shownBase}. ${provenance}`;
+}
+/**
+* A letter or digit that neither draws as a blank nor reads as a quote.
+* `\p{L}` alone admits both, so two classes are carved out: the
+* default-ignorables, which hold letters that draw as a blank (the Hangul
+* fillers U+3164 and U+FFA0), and the quote-shaped letters — the Spacing
+* Modifier Letters block (U+02BA reads as `"`, U+02BC as `'`) plus the ones
+* outside it (U+0374, U+0559, U+07F4-U+07F5, U+A78B-U+A78C, and the halfwidth
+* sound marks U+FF9E-U+FF9F). Not all of `\p{Lm}`: U+30FC is in it, and it is
+* an ordinary character of a Japanese directory name.
+*/
+const VISIBLE_LETTER = new RegExp(String.raw`^(?![\p{Default_Ignorable_Code_Point}\u02b0-\u02ff\u0374\u0559\u07f4\u07f5\ua78b\ua78c\uff9e\uff9f])[\p{L}\p{N}]$`, "u");
+/**
+* A combining mark, which counts only DIRECTLY after a visible letter (or a
+* mark that itself counted): on a space or on punctuation it draws on its own,
+* and U+030B / U+030E there look like a quote.
+*/
+const COMBINING_MARK = /^\p{M}$/u;
+/**
+* A default-ignorable code point, which draws as NOTHING. Tested before the
+* mark rule, because some are combining marks (U+034F, U+17B4, U+180B, the
+* variation selectors U+FE00-U+FE0F and U+E0100-U+E01EF): after a letter they
+* would otherwise pass as bare, and `/home/me/.ss\u034fh` would print exactly
+* like `.ssh` while naming a different path. The host's classifier
+* (go-to-k/cdkd#3509) does not carve these out; this one does.
+*/
+const DEFAULT_IGNORABLE = /^\p{Default_Ignorable_Code_Point}$/u;
+/**
+* The ASCII a bare value may carry besides letters and digits. Everything else
+* — any whitespace, any quote, any other symbol — takes the boundary, which
+* costs a legitimate path nothing but a pair of quotes.
+*/
+const BARE_PUNCTUATION = /^[/\\._~+@:=-]$/;
+/**
+* Classify each code point: `bare` (allowed in a bare value), `shown` (shown
+* as itself inside the boundary), or `escaped`. An ALLOWLIST, because a
+* denylist has to enumerate every character that draws as a blank or reads as
+* a quote.
+*
+* Each test is ONE character and this walks the value — never `^(...)+$` over
+* the whole of it: alternatives that overlap under a quantifier backtrack
+* exponentially on a long value that fails near its end.
+*/
+function classify(chars) {
+	let afterLetter = false;
+	return chars.map((ch) => {
+		if (DEFAULT_IGNORABLE.test(ch)) {
+			afterLetter = false;
+			return "escaped";
+		}
+		if (COMBINING_MARK.test(ch)) return afterLetter ? "bare" : "escaped";
+		afterLetter = VISIBLE_LETTER.test(ch);
+		if (afterLetter || BARE_PUNCTUATION.test(ch)) return "bare";
+		return ch >= " " && ch <= "~" ? "shown" : "escaped";
+	});
+}
+/**
+* Render an untrusted value — a filesystem path, identifier or command an
+* assembly chose, or a key a request supplied — into cdk-local's own prose
+* (go-to-k/cdk-local#758; the host's `displayAssemblyPath`, go-to-k/cdkd#3509).
+* The caller writes NO quotes around the result.
+*
+* `sanitizeServiceExceptionMessage` alone is not enough inside quotes of ours:
+* it flattens control characters and passes `'`, so a value carrying one
+* closed the quote and wrote a clause of its own into the message. This keeps
+* a plain value bare and puts any other one inside a JSON string literal.
+* Inside it, `"` and `\` are escaped as JSON escapes them, and so is every
+* character that is neither printable ASCII nor a visible letter — a curly or
+* fullwidth quote that could pass for the boundary's own closing `"`, and a
+* blank that could pass for a space. The result stays valid JSON: `JSON.parse`
+* returns the sanitized value.
+*
+* A legitimate value with a space or any symbol outside `/ \ . _ ~ + @ : = -`
+* (`/Users/me/My Project/cdk.out`) renders quoted; a non-ASCII letter is
+* shown as itself, and a non-letter non-ASCII character (an emoji, `©`) as
+* its `\u` escape. A value the sanitizer ALTERED (a control character
+* flattened, an over-long value truncated) did not arrive plain, so it always
+* takes the boundary. The empty string renders as `""`.
+*
+* The sanitizer also CAPS the value at 512 code points, so a longer path
+* prints truncated (inside the boundary, with its true length named). That
+* is deliberate: an unbounded assembly-chosen value would otherwise make the
+* log line as long as the attacker likes, and a real path is far shorter.
+*/
+function displayUntrustedValue(value) {
+	const clean = sanitizeServiceExceptionMessage(value);
+	const chars = Array.from(clean);
+	const kinds = classify(chars);
+	if (clean === value && chars.length > 0 && kinds.every((k) => k === "bare")) return clean;
+	let body = "";
+	chars.forEach((ch, i) => {
+		if (ch === "\"" || ch === "\\") body += `\\${ch}`;
+		else if (kinds[i] !== "escaped") body += ch;
+		else for (let u = 0; u < ch.length; u++) body += `\\u${ch.charCodeAt(u).toString(16).padStart(4, "0")}`;
+	});
+	return `"${body}"`;
+}
+
 //#endregion
 //#region src/utils/error-handler.ts
 /**
@@ -2383,247 +2770,6 @@ function stringifyValue(value) {
 	}
 }
 
-//#endregion
-//#region src/utils/assembly-path.ts
-/**
-* `true` when `candidate` names something strictly beneath `base`, both given
-* as already-resolved absolute paths.
-*
-* The `..` test is SEPARATOR-AWARE rather than a bare `startsWith('..')`,
-* which would also reject a legitimate sibling named `..foo`. The empty-string
-* case is `base` itself; callers decide whether that counts as an escape,
-* because an asset path legitimately names a DIRECTORY while a template path
-* does not.
-*/
-function isInside(base, candidate) {
-	const rel = relative(base, candidate);
-	if (rel === "" || rel === "..") return false;
-	if (rel.startsWith(`..${sep}`)) return false;
-	return !isAbsolute(rel);
-}
-/**
-* `realpath(3)`, or `undefined` for a path that does not fully resolve.
-*
-* `.native` is load-bearing and must not be simplified to `fs.realpathSync`.
-* The plain form is a JavaScript walker that folds `..` LEXICALLY, so it
-* disagrees with the kernel on a target carrying a `..` after a symlinked
-* component — answering `ENOENT` for a path the kernel resolves, and on a
-* case-insensitive filesystem (APFS by default) it can spin on the same shape.
-* `.native` is libuv's `realpath(3)` and throws the same
-* `ENOENT` / `ELOOP` / `EACCES`.
-*/
-function tryRealpath(p) {
-	try {
-		return realpathSync.native(p);
-	} catch {
-		return;
-	}
-}
-/** `fs.readlinkSync`, or `undefined` when `p` is not a symbolic link. */
-function tryReadlink(p) {
-	try {
-		return readlinkSync(p);
-	} catch {
-		return;
-	}
-}
-/**
-* Link follows before the walk gives up and reports the path as unresolvable.
-* It does NOT refuse: an exhausted budget answers `undefined`, which leaves
-* the symlink arm silent and the lexical verdict standing. Safe because the OS
-* gives up first (macOS caps at 32, `ELOOP`), so a chain that reaches this cap
-* is one nothing can open anyway.
-*/
-const MAX_LINK_HOPS = 40;
-/**
-* Unresolvable path COMPONENTS the climb walks before giving up. Bounds the
-* recursion below, which is one frame per component, so a pathological value
-* cannot raise a `RangeError` from inside {@link tryRealpath}'s own `try` (its
-* `catch` would swallow the crash into a silent `undefined`).
-*
-* KNOW THAT EXHAUSTING THIS FAILS OPEN, and why that is accepted rather than
-* unnoticed. Unlike {@link MAX_LINK_HOPS}, which has the OS's own `ELOOP` cap
-* behind it, nothing else stops a path of 1 001 absent components: the climb
-* gives up, the symlink arm goes silent, and a value that would land outside
-* reads as CONTAINED on the lexical verdict alone. It is not reachable in
-* effect — such a path cannot exist, so `cdkl invoke`'s `existsSync` refuses it
-* and `start-api`'s `docker run` fails to mount it — but that safety lives in
-* the CONSUMERS, not here. A consumer that neither checks existence nor mounts
-* would need its own answer.
-*/
-const MAX_PATH_COMPONENTS = 1e3;
-/**
-* Where `target` REALLY points, for a path that may not exist yet.
-*
-* `realpathSync` answers only for a path that fully resolves, and it throws
-* `ENOENT` for a DANGLING symbolic link exactly as it does for an absent file.
-* `cdkl start-api` resolves an asset path without an existence check, so an
-* absent or dangling component must not silence the symlink arm.
-*
-* Each unresolvable component is therefore handled by hand: climb to the
-* deepest ancestor that DOES resolve, then re-apply the remaining components,
-* following any symbolic link with `readlink` and re-resolving its target.
-* `undefined` means the walk could not resolve the path at all.
-*
-* For a path that FULLY RESOLVES the answer is the kernel's and is exact. For
-* one that does not exist yet this is a best-effort MODEL of kernel
-* resolution; the known edge is a `..` INSIDE an unresolvable link's target,
-* folded lexically here while the kernel folds it only after following each
-* preceding component. That edge is benign for THESE callers rather than in
-* general: it needs the target to be absent, and both consumers resolve the
-* path and then open or mount it, so the divergence is between this model and
-* a path nothing can reach. A caller that CREATED a file through such a path
-* would need an `lstat` of its own.
-*
-* `EACCES` is folded into "does not resolve" along with `ENOENT`, so a link
-* under a directory this process cannot traverse reads as contained. Same
-* bound: the consumer's own `existsSync` / mount runs as the same user and
-* fails identically.
-*/
-function resolveThroughLinks(target, hops = 0, climbs = 0) {
-	const direct = tryRealpath(target);
-	if (direct !== void 0) return direct;
-	if (hops >= MAX_LINK_HOPS) return void 0;
-	if (climbs >= MAX_PATH_COMPONENTS) return void 0;
-	const parent = dirname(target);
-	if (parent === target) return void 0;
-	const realParent = resolveThroughLinks(parent, hops, climbs + 1);
-	if (realParent === void 0) return void 0;
-	const link = tryReadlink(target);
-	if (link === void 0) return join(realParent, basename(target));
-	return resolveThroughLinks(resolve(realParent, link), hops + 1, climbs);
-}
-/**
-* Resolve an assembly-supplied `candidate` against `dir` and report whether
-* the result stays inside it.
-*
-* The lexical arm joins exactly the way the call sites used to (`path.join`,
-* NOT `path.resolve`), so the verdict is about the path the caller will
-* actually use. `join`'s handling of an absolute candidate makes this arm
-* strictly more permissive than a `resolve`-based one would be; an absolute
-* value is therefore answered by {@link absoluteAssemblyPathEscape} instead,
-* because this function structurally cannot.
-*
-* The SYMLINK arm exists because the lexical arm alone leaves an equivalent
-* hole: `cdk.out/link -> /etc` plus a candidate of `link/passwd` is lexically
-* contained and still reaches `/etc/passwd`. Both sides go through
-* {@link resolveThroughLinks}, so an assembly directory REACHED through a link
-* (macOS spells `/tmp` as `/private/tmp`) is unaffected.
-*
-* The verdict is about the assembly AS IT SITS ON DISK. It is NOT a defence
-* against a process rewriting that directory concurrently — the caller uses
-* the path after this returns.
-*/
-function resolveAssemblyPath(dir, candidate, options) {
-	const base = resolve(dir);
-	const bound = options?.containWithin === void 0 ? base : resolve(options.containWithin);
-	const joined = resolve(join(base, candidate));
-	if (!isInside(bound, joined)) return {
-		contained: false,
-		escape: "lexical",
-		path: joined
-	};
-	const realBound = resolveThroughLinks(bound);
-	if (realBound !== void 0) {
-		const realTarget = resolveThroughLinks(joined);
-		if (realTarget !== void 0 && !isInside(realBound, realTarget)) return {
-			contained: false,
-			escape: "symlink",
-			path: joined,
-			realPath: realTarget
-		};
-	}
-	return {
-		contained: true,
-		path: joined
-	};
-}
-/**
-* Whether an ALREADY-ABSOLUTE assembly-supplied path lies outside `bound`.
-*
-* {@link resolveAssemblyPath} cannot answer this, and the reason is structural
-* rather than an oversight: its lexical arm joins with `path.join`, which does
-* NOT honour a leading separator, so an absolute candidate is folded INTO the
-* directory and the verdict would describe a path no caller opens. A site that
-* HONOURS an absolute value needs the verdict about the value itself.
-*
-* The callers are `cdkl invoke`'s and `cdkl start-api`'s
-* `Metadata['aws:asset:path']` resolution. Those honour an absolute path
-* because `cdk synth --no-staging` emits one — CDK writes the asset's absolute
-* SOURCE directory under `aws:cdk:disable-asset-staging`, usually outside the
-* outdir — and they WARN rather than refuse when it leaves the bound, so this
-* returns a verdict rather than throwing.
-*
-* It lives HERE so the containment rule has one spelling: it reuses this
-* module's own {@link isInside} and {@link resolveThroughLinks}, symlink arm
-* included, rather than letting a caller re-spell `path.relative` and drift.
-*
-* `bound` itself is NOT an escape, unlike in {@link resolveAssemblyPath},
-* where an empty `path.relative` means "names the directory rather than a file
-* inside it". An asset path legitimately names a DIRECTORY, so a value equal
-* to the bound is inside it and reporting it as outside would be false.
-*
-* THE REAL PATHS DECIDE IN BOTH DIRECTIONS, which is the one place this
-* deliberately does more than {@link resolveAssemblyPath}'s lexical-first
-* ordering. The lexical verdict here is about a SPELLING, and two spellings of
-* the same directory are common rather than exotic: macOS resolves `/tmp` to
-* `/private/tmp` and `/var` to `/private/var`, and a user may symlink `cdk.out`
-* itself. With an outdir of `/tmp/cdk.out` and a `--no-staging` value of
-* `/private/tmp/cdk.out/src`, a lexical-only verdict cries "pointing outside
-* the assembly ... treat this assembly as untrusted" about an asset that is
-* plainly inside it — and this arm exists to make an UNEXPECTED path visible,
-* so a false alarm is the failure that costs it its meaning.
-*
-* Exonerating requires the kernel to answer for BOTH operands: an unresolvable
-* one leaves the lexical verdict standing, so the arm stays loud when it cannot
-* see. (`resolveAssemblyPath` cannot take the same shape: its verdict is about
-* a path built with `path.join`, and letting a real path overrule the lexical
-* `..` there would answer about a location the caller never opens.)
-*/
-function absoluteAssemblyPathEscape(bound, absolutePath) {
-	const resolvedBound = resolve(bound);
-	const target = resolve(absolutePath);
-	const lexicallyOutside = !isInside(resolvedBound, target) && target !== resolvedBound;
-	const realBound = resolveThroughLinks(resolvedBound);
-	const realTarget = resolveThroughLinks(target);
-	const reallyOutside = realBound === void 0 || realTarget === void 0 ? void 0 : !isInside(realBound, realTarget) && realTarget !== realBound;
-	if (lexicallyOutside) {
-		if (reallyOutside === false) return void 0;
-		return {
-			contained: false,
-			escape: "lexical",
-			path: target
-		};
-	}
-	if (reallyOutside === true) return {
-		contained: false,
-		escape: "symlink",
-		path: target,
-		realPath: realTarget
-	};
-}
-/**
-* The shared tail of a containment refusal: what the value resolved to, what
-* it escaped, and why that means the assembly is not CDK-generated. The call
-* site supplies its own subject ("Lambda 'X' has ... which ") and its own
-* error class. `action` completes "Refusing to ..." and is REQUIRED rather
-* than defaulted: a default is a branch no caller takes, so it can neither be
-* fenced nor be right for the next caller.
-*/
-function renderAssemblyPathEscape(escape, dir, action) {
-	const provenance = `CDK emits assembly paths that stay inside the assembly directory; one that leaves it indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to ${action}.`;
-	const base = resolve(dir);
-	const realBase = resolveThroughLinks(base) ?? base;
-	const shownPath = sanitizeServiceExceptionMessage(escape.path);
-	const shownBase = sanitizeServiceExceptionMessage(base);
-	if (escape.escape === "symlink") {
-		if (escape.realPath === realBase) return `resolves to '${shownPath}', a symbolic link to the directory '${shownBase}' itself rather than to a path inside it. ${provenance}`;
-		return `resolves to '${shownPath}', which leads through a symbolic link to '${sanitizeServiceExceptionMessage(escape.realPath)}', outside '${shownBase}'. ${provenance}`;
-	}
-	if (escape.path === base) return `names the directory '${shownBase}' itself rather than a path inside it. ${provenance}`;
-	return `resolves to '${shownPath}', outside '${shownBase}'. ${provenance}`;
-}
-
 //#endregion
 //#region src/local/lambda-resolver.ts
 /**
@@ -2949,7 +3095,7 @@ function resolveAssetCodeDirectory(manifestDir, assetPath, wrapError, assetOutdi
 	if (isAbsolute(assetPath)) {
 		const absolute = resolve(assetPath);
 		const escape = absoluteAssemblyPathEscape(assetOutdir, absolute);
-		if (escape !== void 0) getLogger().warn(`Lambda '${sanitizeServiceExceptionMessage(logicalId)}' has an absolute Metadata['aws:asset:path'] pointing outside the assembly: '${sanitizeServiceExceptionMessage(absolute)}'` + (escape.escape === "symlink" ? ` (through a symbolic link to '${sanitizeServiceExceptionMessage(escape.realPath)}')` : "") + `. ${getEmbedConfig().productName} will read that directory and expose its contents to the container — bind-mounted read-only, or copied when the asset is a .zip or one of several merged layers — where the code in this assembly can read it. This is what cdk synth --no-staging emits, and is expected for it; if you did not synthesize with that flag, treat this assembly as untrusted.`);
+		if (escape !== void 0) getLogger().warn(`Lambda ${displayUntrustedValue(logicalId)} has an absolute Metadata['aws:asset:path'] pointing outside the assembly: ${displayUntrustedValue(absolute)}` + (escape.escape === "symlink" ? ` (through a symbolic link to ${displayUntrustedValue(escape.realPath)})` : "") + `. ${getEmbedConfig().productName} will read that directory and expose its contents to the container — bind-mounted read-only, or copied when the asset is a .zip or one of several merged layers — where the code in this assembly can read it. This is what cdk synth --no-staging emits, and is expected for it; if you did not synthesize with that flag, treat this assembly as untrusted.`);
 		warnOutsideNamedDirectory(assetOutdir, absolute);
 		return absolute;
 	}
@@ -2961,7 +3107,7 @@ function resolveAssetCodeDirectory(manifestDir, assetPath, wrapError, assetOutdi
 	if (!resolved.contained) {
 		const climbsOut = assetPath === ".." || assetPath.startsWith(`..${sep}`) || assetPath.startsWith("../");
 		const stageHint = basename(assetOutdir).startsWith("assembly-") && climbsOut ? " This directory is named like a cdk.Stage sub-assembly, but its parent is not an assembly (no manifest.json), so it was treated as the assembly root. If you meant to point --app at a Stage inside an app's output directory, point it at that output directory." : "";
-		throw wrapError(`Lambda '${sanitizeServiceExceptionMessage(logicalId)}' has Metadata['aws:asset:path']='${sanitizeServiceExceptionMessage(assetPath)}' which ${renderAssemblyPathEscape(resolved, assetOutdir, "mount it")}${stageHint}`);
+		throw wrapError(`Lambda ${displayUntrustedValue(logicalId)} has Metadata['aws:asset:path']=${displayUntrustedValue(assetPath)} which ${renderAssemblyPathEscape(resolved, assetOutdir, "mount it")}${stageHint}`);
 	}
 	warnOutsideNamedDirectory(assetOutdir, resolved.path);
 	return resolved.path;
@@ -3049,6 +3195,30 @@ function assetPathDirs(stack) {
 	};
 }
 /**
+* The containment bound for the `--watch` reload readers, which re-read
+* `<output>/<stack>.assets.json` after each synth (their BASE is
+* {@link watchManifestDir}).
+*
+* A stack carrying `assetOutdir` (always, through `AssemblyReader`) gets the
+* same Stage-aware bound as {@link assetPathDirs}. One without it gets
+* `outputDir` itself, NOT `assetPathDirs`'s fallback, which can be the process
+* cwd — a DISJOINT bound that refuses every value with a message blaming the
+* assembly. `outputDir` is the user's own flag, never assembly-supplied, so it
+* is a legitimate bound.
+*/
+function outputAssetBound(stack, outputDir) {
+	return stack.assetOutdir === void 0 || stack.assetOutdir === "" ? outputDir : assetPathDirs(stack).assetOutdir;
+}
+/**
+* Where a `--watch` reader resolves a RELATIVE manifest value from: the
+* manifest's own directory, exactly as the build does — so a value resolves
+* to the same directory the running image was built from. Falls back to the
+* user's `--output` for a stack record without a manifest path.
+*/
+function watchManifestDir(stack, outputDir) {
+	return stack.assetManifestPath ? dirname(stack.assetManifestPath) : outputDir;
+}
+/**
 * The real assembly ROOT for a `--app` that names a `cdk.Stage`
 * SUB-assembly.
 *
@@ -3191,7 +3361,7 @@ function warnOutsideNamedDirectory(assetOutdir, resolved) {
 	if (absoluteAssemblyPathEscape(named, resolved) === void 0) return;
 	if (warnedOutsideNamed.has(resolved)) return;
 	warnedOutsideNamed.add(resolved);
-	getLogger().warn(`'${sanitizeServiceExceptionMessage(resolved)}' is outside '${sanitizeServiceExceptionMessage(named)}', the directory --app named. It is inside the assembly root derived from it, so ${getEmbedConfig().productName} is using it.`);
+	getLogger().warn(`${displayUntrustedValue(resolved)} is outside ${displayUntrustedValue(named)}, the directory --app named. It is inside the assembly root derived from it, so ${getEmbedConfig().productName} is using it.`);
 }
 /**
 * Say that the assembly root was DERIVED rather than given.
@@ -3204,7 +3374,7 @@ function warnOutsideNamedDirectory(assetOutdir, resolved) {
 function warnDerivedAssemblyRoot(named, derived) {
 	if (warnedDerivedRoots.has(derived)) return;
 	warnedDerivedRoots.add(derived);
-	getLogger().warn(`'${sanitizeServiceExceptionMessage(named)}' is a cdk.Stage sub-assembly, so ${getEmbedConfig().productName} is treating its parent '${sanitizeServiceExceptionMessage(derived)}' as the assembly root — that is where cdk synth stages a Stage's assets. Everything under that parent is now inside the containment bound, including siblings of the directory you named. If you did not expect the wider directory, point --app at the app's own output directory instead.`);
+	getLogger().warn(`${displayUntrustedValue(named)} is a cdk.Stage sub-assembly, so ${getEmbedConfig().productName} is treating its parent ${displayUntrustedValue(derived)} as the assembly root — that is where cdk synth stages a Stage's assets. Everything under that parent is now inside the containment bound, including siblings of the directory you named. If you did not expect the wider directory, point --app at the app's own output directory instead.`);
 }
 /**
 * Resolve the local directory that corresponds to a function's deployed
@@ -3223,14 +3393,14 @@ function warnDerivedAssemblyRoot(named, derived) {
 */
 function resolveAssetCodePath$1(stack, logicalId, resource, options = {}) {
 	const assetPath = resource.Metadata?.["aws:asset:path"];
-	if (typeof assetPath !== "string" || assetPath.length === 0) throw new LocalInvokeResolutionError(`Lambda '${sanitizeServiceExceptionMessage(logicalId)}' has no Metadata['aws:asset:path']. ${getEmbedConfig().cliName} invoke needs this hint to find the local asset directory. Re-synthesize the app (without \`--output <stale-dir>\`) and retry.`);
+	if (typeof assetPath !== "string" || assetPath.length === 0) throw new LocalInvokeResolutionError(`Lambda ${displayUntrustedValue(logicalId)} has no Metadata['aws:asset:path']. ${getEmbedConfig().cliName} invoke needs this hint to find the local asset directory. Re-synthesize the app (without \`--output <stale-dir>\`) and retry.`);
 	const { manifestDir, assetOutdir } = assetPathDirs(stack);
 	const abs = resolveAssetCodeDirectory(manifestDir, assetPath, (message) => new LocalInvokeResolutionError(message), assetOutdir, logicalId);
-	if (!existsSync(abs)) throw new LocalInvokeResolutionError(`Lambda '${sanitizeServiceExceptionMessage(logicalId)}' asset path '${sanitizeServiceExceptionMessage(abs)}' does not exist. Re-synthesize the app and retry.`);
+	if (!existsSync(abs)) throw new LocalInvokeResolutionError(`Lambda ${displayUntrustedValue(logicalId)} asset path ${displayUntrustedValue(abs)} does not exist. Re-synthesize the app and retry.`);
 	const stat = statSync(abs);
 	if (stat.isDirectory()) return abs;
 	if (options.allowZip && stat.isFile() && abs.toLowerCase().endsWith(".zip")) return abs;
-	throw new LocalInvokeResolutionError(`Lambda '${sanitizeServiceExceptionMessage(logicalId)}' asset path '${sanitizeServiceExceptionMessage(abs)}' is not a directory` + (options.allowZip ? " or a .zip archive" : "") + ". Re-synthesize the app and retry.");
+	throw new LocalInvokeResolutionError(`Lambda ${displayUntrustedValue(logicalId)} asset path ${displayUntrustedValue(abs)} is not a directory` + (options.allowZip ? " or a .zip archive" : "") + ". Re-synthesize the app and retry.");
 }
 /**
 * Turn a resolved function-code asset path into a directory ready to
@@ -3249,14 +3419,14 @@ function resolveAssetCodePath$1(stack, logicalId, resource, options = {}) {
 * existing tmpdir cleanup.
 */
 function materializeAssetCodeDir(codePath) {
-	if (!existsSync(codePath)) throw new LocalInvokeResolutionError(`Lambda asset path '${sanitizeServiceExceptionMessage(codePath)}' does not exist. Re-synthesize the app and retry.`);
+	if (!existsSync(codePath)) throw new LocalInvokeResolutionError(`Lambda asset path ${displayUntrustedValue(codePath)} does not exist. Re-synthesize the app and retry.`);
 	if (statSync(codePath).isDirectory()) return { dir: codePath };
 	const zipBytes = readFileSync(codePath);
 	let files;
 	try {
 		files = unzipSync(zipBytes);
 	} catch (err) {
-		throw new LocalInvokeResolutionError(`Lambda asset '${sanitizeServiceExceptionMessage(codePath)}' is a file but could not be read as a ZIP archive: ${err instanceof Error ? err.message : String(err)}. Re-synthesize the app and retry.`);
+		throw new LocalInvokeResolutionError(`Lambda asset ${displayUntrustedValue(codePath)} is a file but could not be read as a ZIP archive: ${err instanceof Error ? err.message : String(err)}. Re-synthesize the app and retry.`);
 	}
 	const modes = parseZipUnixModes(zipBytes);
 	const S_IFMT = 61440;
@@ -6676,7 +6846,7 @@ var CfnLocalStateProvider = class {
 				return map.get(exportName);
 			},
 			async resolveGetStackOutput(producerStack, producerRegion, outputName) {
-				logger.warn(`${label}: Fn::GetStackOutput '${producerStack}.${outputName}' (${producerRegion}) has no CloudFormation equivalent and cannot be resolved when reading state from a CloudFormation stack. Use Fn::ImportValue against an exported output instead.`);
+				logger.warn(`${label}: Fn::GetStackOutput ${displayUntrustedValue(producerStack)}.${displayUntrustedValue(outputName)} (${displayUntrustedValue(producerRegion)}) has no CloudFormation equivalent and cannot be resolved when reading state from a CloudFormation stack. Use Fn::ImportValue against an exported output instead.`);
 			}
 		};
 	}
@@ -7591,7 +7761,7 @@ async function resolveImportValueAsync(arg, context) {
 	const exportName = inner.value;
 	if (!context.crossStackResolver) return {
 		kind: "unresolved",
-		reason: `Fn::ImportValue '${exportName}': no cross-stack resolver supplied (pass a state-source flag, e.g. --from-cfn-stack, and ensure the producer stack was deployed)`
+		reason: `Fn::ImportValue ${displayUntrustedValue(exportName)}: no cross-stack resolver supplied (pass a state-source flag, e.g. --from-cfn-stack, and ensure the producer stack was deployed)`
 	};
 	let resolved;
 	try {
@@ -7599,12 +7769,12 @@ async function resolveImportValueAsync(arg, context) {
 	} catch (err) {
 		return {
 			kind: "unresolved",
-			reason: `Fn::ImportValue '${flattenToOneLine(exportName)}': lookup failed: ${describeAwsFailureForWarn(err, "CrossStackResolver.resolveImport (Fn::ImportValue)")}`
+			reason: `Fn::ImportValue ${displayUntrustedValue(exportName)}: lookup failed: ${describeAwsFailureForWarn(err, "CrossStackResolver.resolveImport (Fn::ImportValue)")}`
 		};
 	}
 	if (resolved === void 0) return {
 		kind: "unresolved",
-		reason: `Fn::ImportValue '${exportName}': export not found in any deployed stack in this region`
+		reason: `Fn::ImportValue ${displayUntrustedValue(exportName)}: export not found in any deployed stack in this region`
 	};
 	return {
 		kind: "literal",
@@ -7658,15 +7828,15 @@ async function resolveGetStackOutputAsync(arg, context) {
 	} else region = context.consumerRegion ?? context.pseudoParameters?.region;
 	if (!region) return {
 		kind: "unresolved",
-		reason: `Fn::GetStackOutput '${stackName}.${outputName}': no Region supplied and consumer region is unknown (set --region, AWS_REGION, or env.region on the CDK stack)`
+		reason: `Fn::GetStackOutput ${displayUntrustedValue(stackName)}.${displayUntrustedValue(outputName)}: no Region supplied and consumer region is unknown (set --region, AWS_REGION, or env.region on the CDK stack)`
 	};
 	if (args["RoleArn"] !== void 0 && args["RoleArn"] !== null) return {
 		kind: "unresolved",
-		reason: `Fn::GetStackOutput '${stackName}.${outputName}': RoleArn (cross-account) is not yet supported by the state source — tracked under issue #449`
+		reason: `Fn::GetStackOutput ${displayUntrustedValue(stackName)}.${displayUntrustedValue(outputName)}: RoleArn (cross-account) is not yet supported by the state source — tracked under issue #449`
 	};
 	if (!context.crossStackResolver) return {
 		kind: "unresolved",
-		reason: `Fn::GetStackOutput '${stackName}.${outputName}': no cross-stack resolver supplied (pass a state-source flag, e.g. --from-cfn-stack, and ensure the producer stack was deployed)`
+		reason: `Fn::GetStackOutput ${displayUntrustedValue(stackName)}.${displayUntrustedValue(outputName)}: no cross-stack resolver supplied (pass a state-source flag, e.g. --from-cfn-stack, and ensure the producer stack was deployed)`
 	};
 	let resolved;
 	try {
@@ -7674,12 +7844,12 @@ async function resolveGetStackOutputAsync(arg, context) {
 	} catch (err) {
 		return {
 			kind: "unresolved",
-			reason: `Fn::GetStackOutput '${flattenToOneLine(stackName)}.${flattenToOneLine(outputName)}' (${flattenToOneLine(region)}): lookup failed: ${describeAwsFailureForWarn(err, "CrossStackResolver.resolveGetStackOutput (Fn::GetStackOutput)")}`
+			reason: `Fn::GetStackOutput ${displayUntrustedValue(stackName)}.${displayUntrustedValue(outputName)} (${displayUntrustedValue(region)}): lookup failed: ${describeAwsFailureForWarn(err, "CrossStackResolver.resolveGetStackOutput (Fn::GetStackOutput)")}`
 		};
 	}
 	if (resolved === void 0) return {
 		kind: "unresolved",
-		reason: `Fn::GetStackOutput '${stackName}.${outputName}' (${region}): output not found in producer stack state`
+		reason: `Fn::GetStackOutput ${displayUntrustedValue(stackName)}.${displayUntrustedValue(outputName)} (${displayUntrustedValue(region)}): output not found in producer stack state`
 	};
 	return {
 		kind: "literal",
@@ -8967,6 +9137,380 @@ function resolveRuntimeCodeMountPath(runtime) {
 	return "/var/task";
 }
 
+//#endregion
+//#region src/assets/asset-source-path.ts
+/**
+* Resolve a manifest-supplied asset path and REFUSE it when it leaves the
+* app's outdir — lexically, or through a symbolic link. The one exception is
+* an ABSOLUTE value under `'honour-warn'`, which is ACCEPTED with a warning
+* when it is a folder inside the user's project, not under a credential or
+* version-control directory, and refused
+* otherwise (see {@link AssetSourcePathOptions.absolute}).
+*
+* Returns the RESOLVED, normalized absolute path, and callers must use THAT
+* rather than re-joining the raw value. It matters for the kernel: a raw
+* `<dir>/sub/link/..` handed to the OS applies `..` AFTER following `link`,
+* while every lexical model folds it first. Opening the normalized path makes
+* the judged path and the opened path the same string, so the `<link>/..`
+* shape has no second reading left to exploit.
+*
+* Naming the bound ITSELF (`.`, or `..` from a Stage manifest) is accepted —
+* an asset source is a directory by design, and the absolute arm treats the
+* bound as inside, so the two arms must agree — but it is WARNED about,
+* because it hands the whole assembly to the sink.
+*/
+function resolveAssetSourcePath(opts) {
+	const { manifestDir, value, assetOutdir, field, subject, action, wrapError } = opts;
+	const shownValue = displayUntrustedValue(value);
+	if (isAbsolute(value) && opts.absolute !== "fold") {
+		const absolute = resolve(value);
+		const escape = absoluteAssemblyPathEscape(assetOutdir, absolute);
+		if (escape !== void 0 && opts.absolute === "honour") throw wrapError(`${subject} has an absolute ${field}=${shownValue} which ` + renderAssemblyPathEscape(escape, assetOutdir, action));
+		if (escape !== void 0) {
+			const refusal = originScopeRefusal(absolute, assetOutdir);
+			if (refusal !== void 0) throw wrapError(`${subject} has an absolute ${field}=${shownValue} which ${refusal}. An absolute ${field} is accepted only as a cdk synth --no-staging source folder: a directory inside your project (the git work tree holding the output directory, or the current directory when it contains the output directory or is a git work-tree root), not under a credential or version-control directory. Refusing to ${action}.`);
+			warnAbsoluteOutsideAssembly(opts, absolute, escape);
+			return absolute;
+		}
+		if (namesTheSameDirectory(assetOutdir, absolute)) warnWholeAssemblyAsSource(opts, absolute);
+		return absolute;
+	}
+	const resolved = resolveAssemblyPath(manifestDir, value, { containWithin: assetOutdir });
+	if (resolved.contained) return resolved.path;
+	if (namesTheSameDirectory(assetOutdir, resolved.path)) {
+		warnWholeAssemblyAsSource(opts, resolved.path);
+		return resolved.path;
+	}
+	throw wrapError(`${subject} has ${field}=${shownValue} which ` + renderAssemblyPathEscape(resolved, assetOutdir, action));
+}
+/**
+* Why an accepted-absolute root is too broad to be a `--no-staging` source, or
+* `undefined`. `root` is already a real path ({@link realPath}); the other
+* sides are resolved the same way, so a link to `/` or to `$HOME` is the same
+* root:
+*
+* - `/` — the whole filesystem;
+* - the user's home directory (`os.homedir()`) or any ANCESTOR of it
+*   (`/Users`, `/home`) — each contains `~/.aws` / `~/.ssh`; a project folder
+*   UNDER home is fine. The ancestor arm matters when the project is not under
+*   home (`/tmp`, `/workspaces`), where the outdir arm does not cover it;
+* - an ANCESTOR of the app's outdir, which contains the assembly and
+*   everything beside it.
+*/
+function broadRootReason(root, assetOutdir) {
+	if (root === resolve("/")) return "names the filesystem root";
+	if (containsOrIs(root, realPath(homedir()))) return "names your home directory or a directory containing it";
+	if (containsOrIs(root, realPath(assetOutdir))) return "names a directory containing the app's output directory";
+}
+/**
+* Why an `'honour-warn'` absolute root is refused, or `undefined` to accept it
+* with the warning. Every comparison is on REAL paths, so a symlink whose
+* target leaves the project is refused however it is spelled.
+*
+* 1. {@link broadRootReason} — roots no `--no-staging` source can be.
+* 2. The root must lie STRICTLY inside a project root
+*    ({@link projectRoots}), and no path component between that project root
+*    and the origin may be a credential / VCS directory
+*    ({@link CREDENTIAL_DIR_NAMES}, case-insensitive — APFS folds case). Other
+*    hidden directories are fine: `docs/.vitepress/dist`, Nuxt's
+*    `.output/public` and SvelteKit's `.svelte-kit/output` are real
+*    `--no-staging` site folders. A monorepo sibling
+*    (`<repo>/packages/web/dist` beside `<repo>/packages/infra/cdk.out`) is
+*    inside the git work tree and accepted. Hidden FILES under an accepted
+*    root are kept out at serve time instead (`cloudfront-static-origin.ts`).
+*/
+function originScopeRefusal(absolute, assetOutdir) {
+	const root = realPath(absolute);
+	const broad = broadRootReason(root, assetOutdir);
+	if (broad !== void 0) return broad;
+	const projects = projectRoots(assetOutdir);
+	let hidden;
+	let isProjectRoot = false;
+	for (const project of projects) {
+		const rel = relative(project, root);
+		if (rel === "") isProjectRoot = true;
+		if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) continue;
+		const dotted = rel.split(sep).find((c) => CREDENTIAL_DIR_NAMES.has(c.toLowerCase()));
+		if (dotted === void 0) return void 0;
+		hidden = dotted;
+	}
+	if (isProjectRoot) return "is your project root itself; name a folder inside it";
+	if (hidden !== void 0) return `passes through the credential / version-control directory ${displayUntrustedValue(hidden)} inside your project`;
+	const shown = projects.map((p) => displayUntrustedValue(p)).join(" or ");
+	return projects.length === 0 ? "is outside any usable project root (the current directory and the git work tree are too broad to scope it)" : `resolves to ${displayUntrustedValue(root)}, outside your project (${shown})`;
+}
+/**
+* Directory names no `--no-staging` site folder sits under: credential stores
+* and version-control / package-manager metadata. Compared lower-cased.
+*/
+const CREDENTIAL_DIR_NAMES = /* @__PURE__ */ new Set([
+	".git",
+	".hg",
+	".svn",
+	".ssh",
+	".aws",
+	".gnupg",
+	".docker",
+	".kube",
+	".config",
+	".azure",
+	".gcloud",
+	".terraform",
+	".npm",
+	".pnpm-store",
+	".yarn",
+	".cache",
+	".local"
+]);
+/**
+* The directories an accepted absolute origin may live in, both real paths:
+*
+* - the process cwd, ONLY when it contains the outdir or is itself a git work
+*   tree root (holds a `.git` entry) — running from a folder of repos (`~/work`,
+*   `/tmp`) must not make every project under it a scope;
+* - the nearest ancestor of the outdir holding a `.git` entry (a directory, or
+*   a FILE in a linked worktree / submodule). `git` is not spawned.
+*
+* A candidate that is `/`, the home directory or an ancestor of it is DROPPED
+* rather than used — running from `~` must not widen the scope to all of home.
+*/
+function projectRoots(assetOutdir) {
+	const roots = [];
+	const usable = (p) => p !== resolve("/") && !containsOrIs(p, realPath(homedir()));
+	const cwd = realPath(process.cwd());
+	const outdir = realPath(assetOutdir);
+	if (usable(cwd) && (containsOrIs(cwd, outdir) || existsSync(join(cwd, ".git")))) roots.push(cwd);
+	let dir = outdir;
+	for (;;) {
+		if (existsSync(join(dir, ".git"))) {
+			if (usable(dir) && !roots.includes(dir)) roots.push(dir);
+			break;
+		}
+		const parent = dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return roots;
+}
+/** `outer` is `inner` itself or an ancestor of it (both real paths). */
+function containsOrIs(outer, inner) {
+	const rel = relative(outer, inner);
+	return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+/**
+* `realpath(3)` of `p`, or — when `p` does not exist — the real path of its
+* deepest existing ancestor with the rest re-appended, so a not-yet-existing
+* path under a symlinked parent (`/tmp` -> `/private/tmp`) compares in the
+* same spelling as its existing neighbours. A DANGLING link component is
+* followed by hand (`readlink`), so `project/site -> /outside/missing` is
+* judged as `/outside/missing` — the place a later-created target would be
+* served from — not as `project/site`.
+*/
+function realPath(p, hops = 0) {
+	const abs = resolve(p);
+	try {
+		return realpathSync.native(abs);
+	} catch {
+		const parent = dirname(abs);
+		if (parent === abs) return abs;
+		const realParent = realPath(parent, hops);
+		let link;
+		try {
+			link = readlinkSync(abs);
+		} catch {
+			link = void 0;
+		}
+		if (link !== void 0 && hops < 40) return realPath(resolve(realParent, link), hops + 1);
+		return join(realParent, basename(abs));
+	}
+}
+/**
+* Absolute-outside lines already printed this process (deduped for the same
+* reason as {@link warnedWholeAssembly}).
+*/
+const warnedAbsoluteOutside = /* @__PURE__ */ new Set();
+function warnAbsoluteOutsideAssembly(opts, absolute, escape) {
+	const logger = getLogger().child("assets");
+	const line = `${opts.subject} has an absolute ${opts.field} pointing outside the assembly: ` + displayUntrustedValue(absolute) + (escape.escape === "symlink" ? ` (through a symbolic link to ${displayUntrustedValue(escape.realPath)})` : "") + `. ${getEmbedConfig().productName} will ${opts.sink}. ` + (escape.escape === "lexical" ? "This is what cdk synth --no-staging emits, and is expected for it; if you did not synthesize with that flag, treat this assembly as untrusted." : "No CDK synth writes this, so treat this assembly as untrusted unless you made that link yourself.");
+	if (warnedAbsoluteOutside.has(line)) {
+		logger.debug(line);
+		return;
+	}
+	warnedAbsoluteOutside.add(line);
+	logger.warn(line);
+}
+/**
+* Whole-assembly lines already printed this process. A `start-service` with
+* `DesiredCount: 3` builds per replica and again per crash-loop restart, so an
+* undeduped line is a storm, and a storm is not read. Repeats drop to debug;
+* the WORK is never deduped.
+*/
+const warnedWholeAssembly = /* @__PURE__ */ new Set();
+function warnWholeAssemblyAsSource(opts, outdir) {
+	const logger = getLogger().child("assets");
+	const line = `${opts.subject} has ${opts.field} naming the assembly's output directory ITSELF: ${displayUntrustedValue(outdir)}. ${getEmbedConfig().productName} will ${opts.sink} — that is the WHOLE assembly, every template and every staged asset, not one asset directory. No CDK synth emits this, so treat this assembly as untrusted unless you wrote that path yourself.`;
+	if (warnedWholeAssembly.has(line)) {
+		logger.debug(line);
+		return;
+	}
+	warnedWholeAssembly.add(line);
+	logger.warn(line);
+}
+
+//#endregion
+//#region src/assets/docker-cache-option.ts
+/**
+* Render a `cacheFrom` / `cacheTo` entry as the single `--cache-from` /
+* `--cache-to` value BuildKit parses: `type=<t>,<k>=<v>,...`, unquoted.
+*
+* Its own module because two readers need the SAME string: the argv builder in
+* `docker-build.ts`, and the passthrough warnings, which judge the rendered
+* flag rather than the struct (a `params` value can smuggle a `,src=` that the
+* struct never shows).
+*/
+function cacheOptionToFlag(option) {
+	let flag = `type=${option.type}`;
+	if (option.params) for (const [k, v] of Object.entries(option.params)) flag += `,${k}=${v}`;
+	return flag;
+}
+
+//#endregion
+//#region src/assets/buildkit-passthrough-warnings.ts
+/**
+* Every candidate host path in a buildx option value: a part with a key yields
+* its value when the key is `src` / `source` / `dest` (the keys that make
+* BuildKit open a file), and a part without a key yields itself.
+*
+* Over-inclusive on purpose for a BARE part: a non-path string resolves inside
+* the build context and is dropped before anything is printed. A keyed part is
+* limited to the three file keys because `ref=` / `scope=` / `env=` are not
+* paths, and taking them announced a registry ref as a host read.
+*
+* Known incomplete, and both misses cost a WARNING, never a refusal: a quoted
+* CSV value containing a comma is split wrongly here; a leading or trailing
+* space is trimmed here while buildx keeps it (an over-warn only).
+*/
+function candidateHostPaths(value, opts) {
+	const out = [];
+	for (const part of value.split(",")) {
+		const eq = part.indexOf("=");
+		if (eq < 0) {
+			const bare = part.trim();
+			if (bare.length > 0) out.push({
+				path: bare,
+				write: opts.bareIsWrite
+			});
+			continue;
+		}
+		const key = part.slice(0, eq).trim().toLowerCase();
+		const v = part.slice(eq + 1).trim();
+		if (v.length === 0) continue;
+		if (key !== "src" && key !== "source" && key !== "dest") continue;
+		out.push({
+			path: v,
+			write: key === "dest"
+		});
+	}
+	return out;
+}
+/**
+* Every host path this source hands to BuildKit. Each field is judged as the
+* RENDERED argv string `buildDockerBuildCommand` pushes, not as the struct —
+* nothing there is quoted, so CSV smuggled into a key or a `params` value
+* reaches BuildKit and must reach this walk too.
+*/
+function hostPathsOf(source) {
+	const refs = [];
+	if (source.dockerFile) refs.push({
+		field: "dockerFile",
+		where: "dockerFile",
+		path: source.dockerFile,
+		write: false
+	});
+	for (const [k, v] of Object.entries(source.dockerBuildContexts ?? {})) {
+		const rendered = `${k}=${v}`;
+		const contextPath = rendered.slice(rendered.indexOf("=") + 1).trim().replace(/^oci-layout:\/\//, "");
+		if (contextPath.length === 0) continue;
+		refs.push({
+			field: "dockerBuildContexts",
+			where: k,
+			path: contextPath,
+			write: false
+		});
+	}
+	const ssh = source.dockerBuildSsh ?? "";
+	const sshEq = ssh.indexOf("=");
+	(sshEq < 0 ? [] : ssh.slice(sshEq + 1).split(",")).forEach((entry, i) => {
+		const p = entry.trim();
+		if (p.length > 0) refs.push({
+			field: "dockerBuildSsh",
+			where: String(i),
+			path: p,
+			write: false
+		});
+	});
+	for (const [k, v] of Object.entries(source.dockerBuildSecrets ?? {})) for (const { path: p, write } of candidateHostPaths(`id=${k},${v}`, { bareIsWrite: false })) refs.push({
+		field: "dockerBuildSecrets",
+		where: k,
+		path: p,
+		write
+	});
+	(source.cacheFrom ?? []).forEach((c, i) => {
+		for (const { path: p, write } of candidateHostPaths(cacheOptionToFlag(c), { bareIsWrite: false })) refs.push({
+			field: "cacheFrom",
+			where: String(i),
+			path: p,
+			write
+		});
+	});
+	if (source.cacheTo) for (const { path: p, write } of candidateHostPaths(cacheOptionToFlag(source.cacheTo), { bareIsWrite: false })) refs.push({
+		field: "cacheTo",
+		where: "cacheTo",
+		path: p,
+		write
+	});
+	(source.dockerOutputs ?? []).forEach((o, i) => {
+		for (const { path: p, write } of candidateHostPaths(o, { bareIsWrite: true })) refs.push({
+			field: "dockerOutputs",
+			where: String(i),
+			path: p,
+			write
+		});
+	});
+	return refs;
+}
+/**
+* Lines already printed this process; a repeat drops to debug. Replicas and
+* reloads rebuild the same asset, and the same line N times is a storm.
+*/
+const warnedPassthroughs = /* @__PURE__ */ new Set();
+/**
+* Warn for each BuildKit passthrough whose host path leaves the assembly.
+*
+* `base` is the build context directory (what BuildKit resolves a relative
+* value against — the build's cwd); `bound` is the app's outdir. Called above
+* the spawn so the line precedes the read or write it describes.
+*
+* No "inside the build context" exemption is needed, unlike a builder that
+* honours an absolute context: `buildDockerImage` has already contained the
+* context within `bound`, so a path inside the context is inside the bound.
+*/
+function warnEscapingBuildKitPaths(source, base, bound) {
+	const logger = getLogger().child("assets");
+	for (const ref of hostPathsOf(source)) {
+		const escape = assemblyPathEscape(base, bound, ref.path);
+		if (escape === void 0) continue;
+		const verb = ref.write ? "WRITE to" : "read";
+		const line = `Docker asset ${ref.field}` + (ref.where === ref.field ? "" : `[${displayUntrustedValue(ref.where)}]`) + ` names a host path outside the assembly, which ` + renderAssemblyPathEscape(escape, bound, "load", `${getEmbedConfig().productName} will ${verb} it during the image build, matching the CDK CLI — a pre-synthesized assembly is trusted input. If you did not produce this assembly, that is a host path it chose and the CloudFormation template does not show.`);
+		if (warnedPassthroughs.has(line)) {
+			logger.debug(line);
+			continue;
+		}
+		warnedPassthroughs.add(line);
+		logger.warn(line);
+	}
+}
+
 //#endregion
 //#region src/assets/docker-build.ts
 /**
@@ -9005,9 +9549,10 @@ function resolveRuntimeCodeMountPath(runtime) {
 * to `debug`, where the argv already is. Deduping the LINE must never dedupe
 * the WORK: the spawn happens every time regardless.
 *
-* `sanitizeServiceExceptionMessage` for the same reason `assembly-path.ts`
-* uses it: the value is manifest-chosen, it keeps control characters, and an
-* unsanitized one lets the command forge its own log line. It is applied to
+* `displayUntrustedValue` for the same reason `assembly-path.ts` uses it: the
+* value is manifest-chosen, it keeps control characters and quotes, and an
+* unsanitized one lets the command forge its own log line or close a quote
+* of ours (go-to-k/cdk-local#758). It is applied to
 * the DISPLAYED command only — the dedupe key is built from the raw argv and
 * cwd, so two commands differing only in control characters stay distinct
 * keys.
@@ -9017,12 +9562,12 @@ function warnManifestExecutable(cmd, executable, cwd) {
 	const logger = getLogger().child("docker-build");
 	const key = JSON.stringify([cwd, executable]);
 	if (warnedExecutables.has(key)) {
-		logger.debug(`source.executable already announced this process: ${sanitizeServiceExceptionMessage(cmd)} (cwd=${cwd})`);
+		logger.debug(`source.executable already announced this process: ${displayUntrustedValue(cmd)} (cwd=${displayUntrustedValue(cwd)})`);
 		return;
 	}
 	warnedExecutables.add(key);
 	const argCount = executable.length - 1;
-	logger.warn(`Docker asset source.executable runs a command this asset manifest chose, on this machine: '${sanitizeServiceExceptionMessage(cmd)}'` + (argCount > 0 ? ` (with ${argCount} argument(s); --verbose shows them)` : "") + ". cdk-local runs it, matching the CDK CLI — a pre-synthesized assembly is trusted input. Note that this means running a local command against a pre-synthesized assembly DOES execute code from it, which the CloudFormation template does not show.");
+	logger.warn(`Docker asset source.executable runs a command this asset manifest chose, on this machine: ${displayUntrustedValue(cmd)}` + (argCount > 0 ? ` (with ${argCount} argument(s); --verbose shows them)` : "") + `. ${getEmbedConfig().productName} runs it, matching the CDK CLI — a pre-synthesized assembly is trusted input. Note that this means running a local command against a pre-synthesized assembly DOES execute code from it, which the CloudFormation template does not show.`);
 }
 /**
 * Build a Docker image from a CDK asset source. Returns the local image
@@ -9042,11 +9587,23 @@ function warnManifestExecutable(cmd, executable, cwd) {
 async function buildDockerImage(asset, cdkOutDir, options) {
 	const source = asset.source;
 	const logger = getLogger().child("docker-build");
+	const assetOutdir = options.assetOutdir ?? cdkOutDir;
+	const contextDirectory = (directory, sink) => resolveAssetSourcePath({
+		manifestDir: cdkOutDir,
+		value: directory,
+		assetOutdir,
+		absolute: "fold",
+		field: "source.directory",
+		subject: "Docker image asset",
+		action: "build it",
+		sink,
+		wrapError: (message) => new LocalInvokeBuildError(message)
+	});
 	if (source.executable && source.executable.length > 0) {
 		const [cmd, ...args] = source.executable;
 		if (!cmd) throw options.wrapError("asset source.executable[] is empty");
-		const cwd = source.directory ? `${cdkOutDir}/${source.directory}` : cdkOutDir;
-		logger.debug(`Building Docker image via executable: ${source.executable.join(" ")} (cwd=${cwd})`);
+		const cwd = source.directory ? contextDirectory(source.directory, "run this asset's source.executable with that directory as its working directory") : cdkOutDir;
+		logger.debug(`Building Docker image via executable: ${sanitizeServiceExceptionMessage(source.executable.join(" "))} (cwd=${displayUntrustedValue(cwd)})`);
 		warnManifestExecutable(cmd, source.executable, cwd);
 		let result;
 		try {
@@ -9062,8 +9619,9 @@ async function buildDockerImage(asset, cdkOutDir, options) {
 	if (!source.directory) throw options.wrapError(`DockerImageAssetSource must set either 'directory' or 'executable' (got: ${JSON.stringify(source)})`);
 	if (!options.tag) throw options.wrapError("buildDockerImage(directory mode) requires options.tag");
 	const buildArgs = buildDockerBuildCommand(source, options.tag, options.platform);
-	const contextDir = `${cdkOutDir}/${source.directory}`;
+	const contextDir = contextDirectory(source.directory, `send that directory to docker build as the context of an image ${getEmbedConfig().productName} then runs locally`);
 	buildArgs.push(".");
+	warnEscapingBuildKitPaths(source, contextDir, assetOutdir);
 	logger.debug(`${getDockerCmd()} ${buildArgs.join(" ")} (cwd=${contextDir})`);
 	try {
 		await runDockerStreaming(buildArgs, {
@@ -9104,11 +9662,6 @@ function buildDockerBuildCommand(source, tag, platformOverride) {
 	if (source.cacheDisabled) args.push("--no-cache");
 	return args;
 }
-function cacheOptionToFlag(option) {
-	let flag = `type=${option.type}`;
-	if (option.params) for (const [k, v] of Object.entries(option.params)) flag += `,${k}=${v}`;
-	return flag;
-}
 
 //#endregion
 //#region src/local/ecr-puller.ts
@@ -9384,8 +9937,9 @@ async function buildContainerImage(asset, cdkOutDir, options) {
 	const actualTag = await buildDockerImage(asset, cdkOutDir, {
 		tag,
 		platform,
-		wrapError: (stderr) => new LocalInvokeBuildError(`docker build failed for container Lambda asset (${asset.source.directory ?? asset.source.executable?.join(" ")}): ${stderr}`),
-		progressLabel: `Building container image (platform=${platform})`
+		wrapError: (stderr) => new LocalInvokeBuildError(`docker build failed for container Lambda asset (${sanitizeServiceExceptionMessage(asset.source.directory ?? asset.source.executable?.join(" ") ?? "")}): ${stderr}`),
+		progressLabel: `Building container image (platform=${platform})`,
+		...options.assetOutdir !== void 0 && { assetOutdir: options.assetOutdir }
 	});
 	if (actualTag !== tag) {
 		logger.debug(`Re-tagging executable-built image '${actualTag}' → '${tag}'`);
@@ -9817,6 +10371,8 @@ var AssetManifestLoader = class {
 	* @returns Asset manifest or null if not found
 	*/
 	async loadManifest(cdkOutputDir, stackName) {
+		const resolved = resolveAssemblyPath(cdkOutputDir, `${stackName}.assets.json`);
+		if (!resolved.contained) throw new Error(`Refusing to read the asset manifest for stack ${displayUntrustedValue(stackName)}: it ` + renderAssemblyPathEscape(resolved, cdkOutputDir, "read it"));
 		const manifestPath = join$1(cdkOutputDir, `${stackName}.assets.json`);
 		try {
 			this.logger.debug(`Loading asset manifest from: ${manifestPath}`);
@@ -9851,14 +10407,31 @@ var AssetManifestLoader = class {
 		return fileAssets;
 	}
 	/**
-	* Get asset source path (absolute path)
+	* Get a file asset's source directory (absolute path), REFUSING a
+	* `source.path` that leaves `opts.assetOutdir` (go-to-k/cdk-local#745).
 	*
-	* @param cdkOutputDir CDK output directory
-	* @param asset File asset
-	* @returns Absolute path to asset source
+	* The value resolves against `cdkOutputDir` with `path.join` semantics, as
+	* it always has, so an ABSOLUTE value is folded under it rather than
+	* honoured (`'fold'` in `resolveAssetSourcePath`). `assetOutdir` is the
+	* app's outdir — `assetPathDirs(stack).assetOutdir` — and is REQUIRED so a
+	* caller cannot silently bound a Stage's `../asset.<hash>` at the manifest
+	* directory.
+	*
+	* The one reader is the AgentCore CodeConfiguration bundle, which builds an
+	* image FROM this directory; `subject` names it in the refusal.
 	*/
-	getAssetSourcePath(cdkOutputDir, asset) {
-		return join$1(cdkOutputDir, asset.source.path);
+	getAssetSourcePath(cdkOutputDir, asset, opts) {
+		return resolveAssetSourcePath({
+			manifestDir: cdkOutputDir,
+			value: asset.source.path,
+			assetOutdir: opts.assetOutdir,
+			absolute: "fold",
+			field: "source.path",
+			subject: opts.subject,
+			action: "build an image from it",
+			sink: "build an image from that directory and run it locally",
+			wrapError: opts.wrapError
+		});
 	}
 	/**
 	* Resolve asset destination values (replace ${AWS::AccountId}, ${AWS::Region}, etc.)
@@ -14577,7 +15150,7 @@ function parseHttpV2IdentitySources(raw) {
 */
 function parseCognitoUserPoolArn(arn, location) {
 	const m = /^arn:aws[a-z0-9-]*:cognito-idp:([a-z0-9-]+):[0-9]+:userpool\/(.+)$/.exec(arn);
-	if (!m) throw new RouteDiscoveryError(`${location}: malformed Cognito User Pool ARN '${arn}'. Expected 'arn:aws:cognito-idp:<region>:<account>:userpool/<id>'.`);
+	if (!m) throw new RouteDiscoveryError(`${location}: malformed Cognito User Pool ARN ${displayUntrustedValue(arn)}. Expected 'arn:aws:cognito-idp:<region>:<account>:userpool/<id>'.`);
 	return {
 		region: m[1],
 		userPoolId: m[2]
@@ -19409,6 +19982,7 @@ async function resolveContainerImageForStartApi(lambda, skipPull, profile, optio
 	const localBuild = await resolveLocalBuildPlan$1(lambda);
 	if (localBuild) return { imageRef: await buildContainerImage(localBuild.asset, localBuild.cdkOutDir, {
 		architecture: lambda.architecture,
+		assetOutdir: localBuild.assetOutdir,
 		...options?.noBuild !== void 0 && { noBuild: options.noBuild }
 	}) };
 	if (!parseEcrUri(lambda.imageUri)) throw new Error(`Container Lambda '${lambda.logicalId}' has no matching asset in cdk.out, and Code.ImageUri '${lambda.imageUri}' is not an ECR URI ${getEmbedConfig().binaryName} can authenticate against. Re-synthesize the CDK app (so cdk.out includes the build context) or deploy the image to ECR first.`);
@@ -19438,7 +20012,8 @@ async function resolveLocalBuildPlan$1(lambda) {
 	if (!entry) return void 0;
 	return {
 		asset: entry.asset,
-		cdkOutDir
+		cdkOutDir,
+		assetOutdir: assetPathDirs(lambda.stack).assetOutdir
 	};
 }
 /**
@@ -19639,7 +20214,7 @@ function resolveImageLambda(args) {
 */
 function resolveAssetCodePath(stack, logicalId, resource) {
 	const assetPath = resource.Metadata?.["aws:asset:path"];
-	if (typeof assetPath !== "string" || assetPath.length === 0) throw new Error(`Lambda '${sanitizeServiceExceptionMessage(logicalId)}' has no Metadata['aws:asset:path']. ${getEmbedConfig().cliName} start-api needs this hint to find the local asset directory. Re-synthesize the app and retry.`);
+	if (typeof assetPath !== "string" || assetPath.length === 0) throw new Error(`Lambda ${displayUntrustedValue(logicalId)} has no Metadata['aws:asset:path']. ${getEmbedConfig().cliName} start-api needs this hint to find the local asset directory. Re-synthesize the app and retry.`);
 	const { manifestDir, assetOutdir } = assetPathDirs(stack);
 	return resolveAssetCodeDirectory(manifestDir, assetPath, (message) => new Error(message), assetOutdir, logicalId);
 }
@@ -20466,7 +21041,8 @@ async function resolveContainerImagePlan$1(lambda, options) {
 	let imageRef;
 	if (localBuild) imageRef = await buildContainerImage(localBuild.asset, localBuild.cdkOutDir, {
 		architecture: lambda.architecture,
-		noBuild: options.build === false
+		noBuild: options.build === false,
+		assetOutdir: localBuild.assetOutdir
 	});
 	else {
 		if (!parseEcrUri(lambda.imageUri)) throw new Error(`Container Lambda '${lambda.logicalId}' has no matching asset in cdk.out, and Code.ImageUri '${lambda.imageUri}' is not an ECR URI ${getEmbedConfig().binaryName} can authenticate against. Re-synthesize the CDK app (so cdk.out includes the build context) or deploy the image to ECR first.`);
@@ -20500,7 +21076,8 @@ async function resolveLocalBuildPlan(lambda) {
 	if (!entry) return void 0;
 	return {
 		asset: entry.asset,
-		cdkOutDir
+		cdkOutDir,
+		assetOutdir: assetPathDirs(lambda.stack).assetOutdir
 	};
 }
 function envHasIntrinsicValue(templateEnv) {
@@ -21150,7 +21727,7 @@ async function buildAgentCoreCodeImage(options) {
 		], { progressLabel: `Building agent image (runtime=${options.runtime})` });
 	} catch (err) {
 		const stderr = err.stderr?.trim();
-		throw new LocalInvokeBuildError(`docker build failed for AgentCore code artifact (${options.sourceDir})${stderr ? `: ${stderr}` : ""}`);
+		throw new LocalInvokeBuildError(`docker build failed for AgentCore code artifact (${displayUntrustedValue(options.sourceDir)})${stderr ? `: ${stderr}` : ""}`);
 	} finally {
 		await rm(buildDir, {
 			recursive: true,
@@ -21195,14 +21772,14 @@ async function warnIfDependenciesNotVendored(sourceDir, runtime, isNode, logger)
 	}
 	const has = (name) => entries.includes(name);
 	if (isNode) {
-		if (has("package.json") && !has("node_modules")) logger.warn(`AgentCore code bundle '${sourceDir}' declares package.json but does not vendor node_modules. The AgentCore managed runtime does NOT install dependencies at runtime, so the deployed agent will fail to resolve them. Vendor dependencies into the bundle (e.g. 'npm install --omit=dev' in the bundle dir) so the deploy artifact is self-contained. cdk-local runs the bundle as-is to match the deployed runtime.`);
+		if (has("package.json") && !has("node_modules")) logger.warn(`AgentCore code bundle ${displayUntrustedValue(sourceDir)} declares package.json but does not vendor node_modules. The AgentCore managed runtime does NOT install dependencies at runtime, so the deployed agent will fail to resolve them. Vendor dependencies into the bundle (e.g. 'npm install --omit=dev' in the bundle dir) so the deploy artifact is self-contained. cdk-local runs the bundle as-is to match the deployed runtime.`);
 		return;
 	}
 	const manifest = await pythonManifestDeclaringDeps(sourceDir, entries);
 	const vendored = entries.some((e) => e.endsWith(".dist-info"));
 	if (manifest && !vendored) {
 		const pyVersion = runtime.replace("PYTHON_", "").replace("_", ".");
-		logger.warn(`AgentCore code bundle '${sourceDir}' declares ${manifest} but does not vendor its dependencies. The AgentCore managed runtime does NOT install dependencies at runtime, so the deployed agent will fail with ModuleNotFoundError. Vendor arm64 wheels into the bundle, e.g.:
+		logger.warn(`AgentCore code bundle ${displayUntrustedValue(sourceDir)} declares ${manifest} but does not vendor its dependencies. The AgentCore managed runtime does NOT install dependencies at runtime, so the deployed agent will fail with ModuleNotFoundError. Vendor arm64 wheels into the bundle, e.g.:
   uv pip install --python-platform aarch64-manylinux2014 --python-version ${pyVersion} --target <bundle-dir> -r requirements.txt\ncdk-local runs the bundle as-is to match the deployed runtime.`);
 	}
 }
@@ -22500,7 +23077,8 @@ async function resolveAgentCoreImage(resolved, options, loaded, stateProvider) {
 			const entry = getDockerImageBySourceHash(manifest, containerUri);
 			if (entry) return buildContainerImage(entry.asset, cdkOutDir, {
 				architecture,
-				noBuild: options.build === false
+				noBuild: options.build === false,
+				assetOutdir: assetPathDirs(resolved.stack).assetOutdir
 			});
 		}
 	}
@@ -22535,8 +23113,12 @@ async function resolveAgentCoreCodeImage(resolved, code, options, architecture,
 	const fileAssets = manifest ? loader.getFileAssets(manifest) : void 0;
 	const asset = fileAssets ? fileAssets.get(code.codeAssetHash) ?? findFileAssetByObjectKey$1(fileAssets, code.codeAssetHash) : void 0;
 	if (!asset) throw new CdkLocalError(`AgentCore Runtime '${resolved.logicalId}' code bundle (asset ${code.codeAssetHash}) was not found in the cdk.out asset manifest. ${getEmbedConfig().cliName} invoke-agentcore runs a local from-source build of a fromCodeAsset bundle — re-synthesize the app so the asset is staged in cdk.out and retry. (A fromS3 bundle is downloaded from S3 instead; this runtime has no literal Code.S3.Bucket.)`, "LOCAL_INVOKE_AGENTCORE_CODE_ASSET_NOT_FOUND");
-	const sourceDir = loader.getAssetSourcePath(cdkOutDir, asset);
-	if (!existsSync(sourceDir) || !statSync(sourceDir).isDirectory()) throw new CdkLocalError(`AgentCore Runtime '${resolved.logicalId}' code bundle source '${sourceDir}' does not exist or is not a directory. Re-synthesize the app and retry.`, "LOCAL_INVOKE_AGENTCORE_CODE_SOURCE_MISSING");
+	const sourceDir = loader.getAssetSourcePath(cdkOutDir, asset, {
+		assetOutdir: assetPathDirs(resolved.stack).assetOutdir,
+		subject: `AgentCore Runtime ${displayUntrustedValue(resolved.logicalId)} code bundle`,
+		wrapError: (message) => new CdkLocalError(message, "LOCAL_INVOKE_AGENTCORE_CODE_SOURCE_ESCAPES_ASSEMBLY")
+	});
+	if (!existsSync(sourceDir) || !statSync(sourceDir).isDirectory()) throw new CdkLocalError(`AgentCore Runtime ${displayUntrustedValue(resolved.logicalId)} code bundle source ${displayUntrustedValue(sourceDir)} does not exist or is not a directory. Re-synthesize the app and retry.`, "LOCAL_INVOKE_AGENTCORE_CODE_SOURCE_MISSING");
 	return buildAgentCoreCodeImage({
 		sourceDir,
 		runtime: code.runtime,
@@ -23252,7 +23834,7 @@ async function softReloadAgentContainer(containerId, newAssetSourceDir) {
 		throw new CdkLocalError(`softReloadAgentContainer: docker inspect of container '${containerId}' failed: ${describeExecError(err)}.`, "LOCAL_INVOKE_AGENTCORE_WATCH_SOFT_RELOAD_INSPECT_FAILED");
 	}
 	const workdirDest = workdir.endsWith("/") ? workdir : `${workdir}/`;
-	logger.info(`Soft-reload: docker cp ${newAssetSourceDir} -> ${containerId}:${workdirDest}; restart.`);
+	logger.info(`Soft-reload: docker cp ${flattenToOneLine(newAssetSourceDir)} -> ${containerId}:${workdirDest}; restart.`);
 	try {
 		await execFileAsync$4(dockerCmd, [
 			"cp",
@@ -23299,7 +23881,11 @@ async function loadAgentCoreAssetContext(args) {
 		if (!manifest) return void 0;
 		const asset = assetLoader.getFileAssets(manifest).get(resolved.codeArtifact.codeAssetHash);
 		if (!asset) return void 0;
-		const sourceDir = assetLoader.getAssetSourcePath(cdkOutDir, asset);
+		const sourceDir = assetLoader.getAssetSourcePath(watchManifestDir(newCandidate, cdkOutDir), asset, {
+			assetOutdir: outputAssetBound(newCandidate, cdkOutDir),
+			subject: `AgentCore Runtime ${displayUntrustedValue(resolved.logicalId)} code bundle`,
+			wrapError: (message) => new CdkLocalError(message, "LOCAL_INVOKE_AGENTCORE_CODE_SOURCE_ESCAPES_ASSEMBLY")
+		});
 		return {
 			...oldAssetHash !== void 0 && { oldAssetHash },
 			newAssetHash: resolved.codeArtifact.codeAssetHash,
@@ -23315,7 +23901,17 @@ async function loadAgentCoreAssetContext(args) {
 	const newAssetHash = dockerImageEntry.hash;
 	const newDockerImage = dockerImageEntry.asset;
 	if (!newDockerImage.source.directory) return void 0;
-	const newAssetSourceDir = path.resolve(cdkOutDir, newDockerImage.source.directory);
+	const newAssetSourceDir = resolveAssetSourcePath({
+		manifestDir: watchManifestDir(newCandidate, cdkOutDir),
+		value: newDockerImage.source.directory,
+		assetOutdir: outputAssetBound(newCandidate, cdkOutDir),
+		absolute: "honour",
+		field: "source.directory",
+		subject: `AgentCore Runtime ${displayUntrustedValue(resolved.logicalId)} image asset`,
+		action: "copy from it",
+		sink: "copy that directory into the running agent container on a soft reload",
+		wrapError: (message) => new CdkLocalError(message, "LOCAL_INVOKE_AGENTCORE_CODE_SOURCE_ESCAPES_ASSEMBLY")
+	});
 	return {
 		...oldAssetHash !== void 0 && { oldAssetHash },
 		newAssetHash,
@@ -23889,7 +24485,7 @@ async function resolveOne(entry, secretsClient, ssmClient) {
 	switch (shape.kind) {
 		case "secrets-manager": return resolveSecretsManager(entry, shape, secretsClient);
 		case "ssm": return resolveSsm(entry, shape, ssmClient);
-		case "unknown": throw new EcsSecretsResolutionError(`Container '${entry.containerName}' secret '${entry.name}' references an unsupported ValueFrom shape '${arn}'. Expected Secrets Manager ARN (optionally with :<json-key>::) or SSM Parameter ARN.`);
+		case "unknown": throw new EcsSecretsResolutionError(`Container ${displayUntrustedValue(entry.containerName)} secret ${displayUntrustedValue(entry.name)} references an unsupported ValueFrom shape ${displayUntrustedValue(arn)}. Expected Secrets Manager ARN (optionally with :<json-key>::) or SSM Parameter ARN.`);
 	}
 }
 /**
@@ -24352,8 +24948,9 @@ async function prepareOneImage(task, container, options) {
 			}
 			const actualTag = await buildDockerImage(asset, cdkOutDir, {
 				tag,
+				assetOutdir: assetPathDirs(task.stack).assetOutdir,
 				...options.platformOverride !== void 0 && { platform: options.platformOverride },
-				wrapError: (stderr) => new LocalInvokeBuildError(`docker build failed for ECS container '${container.name}' (${asset.source.directory ?? asset.source.executable?.join(" ")}): ${stderr}`),
+				wrapError: (stderr) => new LocalInvokeBuildError(`docker build failed for ECS container '${container.name}' (${sanitizeServiceExceptionMessage(asset.source.directory ?? asset.source.executable?.join(" ") ?? "")}): ${stderr}`),
 				progressLabel: `Building container image for '${container.name}'`
 			});
 			if (actualTag !== tag) try {
@@ -24380,7 +24977,7 @@ async function realizeDockerVolumes(volumes, state) {
 	const out = /* @__PURE__ */ new Map();
 	for (const v of volumes) {
 		if (v.kind === "host") {
-			if (v.hostPath && !checkVolumeHostPath(v.hostPath)) logger.warn(`Volume '${v.name}': host path '${v.hostPath}' does not exist or is not a directory. Docker will create an anonymous bind mount; create the host path before run-task if you expected to bind-mount it.`);
+			if (v.hostPath && !checkVolumeHostPath(v.hostPath)) logger.warn(`Volume ${displayUntrustedValue(v.name)}: host path ${displayUntrustedValue(v.hostPath)} does not exist or is not a directory. Docker will create an anonymous bind mount; create the host path before run-task if you expected to bind-mount it.`);
 			out.set(v.name, v);
 			continue;
 		}
@@ -25730,7 +26327,7 @@ async function softReloadReplica(args) {
 	instance.softReloadInProgress = true;
 	instance.softReloadGeneration = (instance.softReloadGeneration ?? 0) + 1;
 	try {
-		logger.info(`Soft-reloading replica r${instance.index} (gen ${instance.generation}): docker cp ${sourceDirToCopy} -> ${targets.length} essential container(s); restart.`);
+		logger.info(`Soft-reloading replica r${instance.index} (gen ${instance.generation}): docker cp ${flattenToOneLine(sourceDirToCopy)} -> ${targets.length} essential container(s); restart.`);
 		for (const target of targets) {
 			let workdir;
 			try {
@@ -27858,7 +28455,10 @@ async function resolveContainerImagePlan(lambda, opts) {
 		const manifest = await new AssetManifestLoader().loadManifest(cdkOutDir, lambda.stack.stackName);
 		const entry = manifest ? getDockerImageBySourceHash(manifest, lambda.imageUri) : void 0;
 		if (entry) {
-			imageRef = await buildContainerImage(entry.asset, cdkOutDir, { architecture: lambda.architecture });
+			imageRef = await buildContainerImage(entry.asset, cdkOutDir, {
+				architecture: lambda.architecture,
+				assetOutdir: assetPathDirs(lambda.stack).assetOutdir
+			});
 			localBuilt = true;
 		}
 	}
@@ -29255,7 +29855,17 @@ async function loadAssetContextForTarget(args) {
 		logger.debug(`loadAssetContext: docker asset '${newAssetHash}' for stack '${candidate.stackName}' is executable-mode (no source.directory). Classifier will see no asset context (rebuild).`);
 		return;
 	}
-	const newAssetSourceDir = path.resolve(cdkOutDir, newDockerImage.source.directory);
+	const newAssetSourceDir = resolveAssetSourcePath({
+		manifestDir: watchManifestDir(candidate, cdkOutDir),
+		value: newDockerImage.source.directory,
+		assetOutdir: outputAssetBound(candidate, cdkOutDir),
+		absolute: "honour",
+		field: "source.directory",
+		subject: `Docker image asset ${displayUntrustedValue(newAssetHash)} of stack ${displayUntrustedValue(candidate.stackName)}`,
+		action: "copy from it",
+		sink: "copy that directory into the running replicas on a soft reload",
+		wrapError: (message) => new Error(message)
+	});
 	let oldAssetHash;
 	const liveReplica = controller.runState.replicas.find((r) => !r.shuttingDown);
 	if (liveReplica?.lastDeployedAssetHash !== void 0) oldAssetHash = liveReplica.lastDeployedAssetHash;
@@ -29603,6 +30213,7 @@ async function buildFrontDoor(plan, options, logger, extraStateProviders) {
 		...action,
 		auth: authForGuard(guard)
 	} : action;
+	let bootingLambda;
 	try {
 		for (const listener of plan.listeners) {
 			const defaultRoute = listener.defaultAction ? attachAuth(toRouteAction(listener.defaultAction), listener.defaultAuthGuard) : void 0;
@@ -29653,12 +30264,15 @@ async function buildFrontDoor(plan, options, logger, extraStateProviders) {
 			if (!listener.defaultAction) logger.info("  (no default action: unmatched requests return 404)");
 		}
 		for (const runner of lambdaRegistry.values()) {
-			logger.info(`Booting Lambda target '${runner.logicalId}' behind the ALB front-door...`);
+			bootingLambda = flattenToOneLine(runner.logicalId);
+			logger.info(`Booting Lambda target '${bootingLambda}' behind the ALB front-door...`);
 			await runner.start();
 		}
+		bootingLambda = void 0;
 	} catch (err) {
 		await Promise.allSettled(servers.map((s) => s.close()));
 		await Promise.allSettled([...lambdaRegistry.values()].map((r) => r.stop()));
+		if (bootingLambda !== void 0) throw new LocalStartServiceError(`Failed to boot ALB Lambda target '${bootingLambda}': ${err instanceof Error ? err.message : String(err)}`);
 		throw new LocalStartServiceError(`Failed to start ALB front-door: ${err instanceof Error ? err.message : String(err)}. If a listener port is privileged (< 1024), remap it to a non-privileged host port with --lb-port <listenerPort>=<hostPort> (e.g. --lb-port 80=8080).`);
 	}
 	const frontDoorByService = /* @__PURE__ */ new Map();
@@ -29776,11 +30390,11 @@ async function resolvePlaceholderAccount$1(arn, region, profile) {
 	}));
 	try {
 		const account = (await sts.send(new GetCallerIdentityCommand({}))).Account;
-		if (!account) throw new LocalStartServiceError(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN '${arn}'.`);
+		if (!account) throw new LocalStartServiceError(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN ${displayUntrustedValue(arn)}.`);
 		return arn.split(TASK_ROLE_ACCOUNT_PLACEHOLDER).join(account);
 	} catch (err) {
 		if (err instanceof LocalStartServiceError) throw err;
-		throw new LocalStartServiceError(`--assume-task-role: STS GetCallerIdentity failed while resolving placeholder ARN '${flattenToOneLine(arn)}': ${describeAwsFailureForWarn(err, "STS GetCallerIdentity (task-role placeholder)")}. Pass the ARN explicitly: --assume-task-role <arn>`);
+		throw new LocalStartServiceError(`--assume-task-role: STS GetCallerIdentity failed while resolving placeholder ARN ${displayUntrustedValue(arn)}: ${describeAwsFailureForWarn(err, "STS GetCallerIdentity (task-role placeholder)")}. Pass the ARN explicitly: --assume-task-role <arn>`);
 	} finally {
 		sts.destroy();
 	}
@@ -30353,13 +30967,13 @@ async function resolvePlaceholderAccount(arn, region, profile) {
 	}));
 	try {
 		const account = (await sts.send(new GetCallerIdentityCommand({}))).Account;
-		if (!account) throw new PlaceholderAccountError(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN '${arn}'. Pass the ARN explicitly: --assume-task-role <arn>`);
+		if (!account) throw new PlaceholderAccountError(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN ${displayUntrustedValue(arn)}. Pass the ARN explicitly: --assume-task-role <arn>`);
 		return arn.split(TASK_ROLE_ACCOUNT_PLACEHOLDER).join(account);
 	} catch (err) {
 		if (err instanceof PlaceholderAccountError) throw err;
-		const shownArn = flattenToOneLine(arn);
+		const shownArn = displayUntrustedValue(arn);
 		const detail = describeAwsFailureForWarn(err, "STS GetCallerIdentity (task-role placeholder)");
-		throw new PlaceholderAccountError(`--assume-task-role: STS GetCallerIdentity failed while resolving placeholder ARN '${shownArn}': ${detail}. Pass the ARN explicitly: --assume-task-role <arn>`);
+		throw new PlaceholderAccountError(`--assume-task-role: STS GetCallerIdentity failed while resolving placeholder ARN ${shownArn}: ${detail}. Pass the ARN explicitly: --assume-task-role <arn>`);
 	} finally {
 		sts.destroy();
 	}
@@ -32124,12 +32738,17 @@ function resolveOrigins(dc, template, stack, overrides) {
 			continue;
 		}
 		const localDirs = bucketLogicalId && manifest ? resolveBucketDeploymentDirs(template, manifest, stack, bucketLogicalId) : [];
-		if (localDirs.length > 0) out.set(originId, {
-			kind: "s3",
-			originId,
-			localDirs
-		});
-		else {
+		if (localDirs.length > 0) {
+			const { assetOutdir } = assetPathDirs(stack);
+			const hideDotfilesIn = localDirs.filter((d) => absoluteAssemblyPathEscape(assetOutdir, d) !== void 0);
+			out.set(originId, {
+				kind: "s3",
+				originId,
+				localDirs,
+				fromAssembly: true,
+				...hideDotfilesIn.length > 0 && { hideDotfilesIn }
+			});
+		} else {
 			const literalBucket = bucketLogicalId === void 0 ? s3Domain.bucketName : void 0;
 			out.set(originId, {
 				kind: "s3-unresolved",
@@ -32204,8 +32823,8 @@ function loadStackManifest(stack) {
 * object key cannot be matched to a manifest file asset.
 */
 function resolveBucketDeploymentDirs(template, manifest, stack, bucketLogicalId) {
-	const manifestDir = stack.assetManifestPath ? dirname(stack.assetManifestPath) : void 0;
-	if (!manifestDir) return [];
+	if (!stack.assetManifestPath) return [];
+	const { manifestDir, assetOutdir } = assetPathDirs(stack);
 	const dirs = [];
 	for (const resource of Object.values(template.Resources ?? {})) {
 		if (!String(resource.Type).startsWith("Custom::CDKBucketDeployment")) continue;
@@ -32216,7 +32835,17 @@ function resolveBucketDeploymentDirs(template, manifest, stack, bucketLogicalId)
 			if (typeof key !== "string") continue;
 			const asset = findFileAssetByObjectKey(manifest, key);
 			if (!asset) continue;
-			dirs.push(resolve(manifestDir, asset.source.path));
+			dirs.push(resolveAssetSourcePath({
+				manifestDir,
+				value: asset.source.path,
+				assetOutdir,
+				absolute: "honour-warn",
+				field: "source.path",
+				subject: `BucketDeployment source asset for bucket ${displayUntrustedValue(bucketLogicalId)}`,
+				action: "serve it",
+				sink: "serve every file under that directory as this bucket's local S3 origin",
+				wrapError: (message) => new Error(message)
+			}));
 		}
 	}
 	return dirs;
@@ -32653,14 +33282,16 @@ function normalizeHeaders(headers) {
 */
 function serveFromStaticOrigin(input) {
 	const key = uriToKey(input.uri, input.defaultRootObject);
-	const direct = readKey(input.localDirs, key);
+	const containLinks = input.containLinks === true;
+	const hideIn = new Set(input.hideDotfilesIn ?? []);
+	const direct = readKey(input.localDirs, key, containLinks, hideIn);
 	if (direct) return {
 		statusCode: 200,
 		headers: { "content-type": contentTypeForKey(key) },
 		body: direct
 	};
 	for (const candidate of resolveErrorResponseCandidates(input.customErrorResponses)) {
-		const body = readKey(input.localDirs, candidate.errorKey);
+		const body = readKey(input.localDirs, candidate.errorKey, containLinks, hideIn);
 		if (body) return {
 			statusCode: candidate.responseCode,
 			headers: { "content-type": contentTypeForKey(candidate.errorKey) },
@@ -32714,15 +33345,30 @@ function uriToKey(uri, defaultRootObject) {
 }
 /**
 * Read a key from the first directory that contains it as a regular file.
-* Path-traversal safe: the resolved absolute path must stay within the origin
-* directory (a `../` in the key, or a symlink escaping the root, yields no
-* read). Returns `undefined` when no directory has the key.
+* Path-traversal safe: a `../` in the key never leaves the origin directory
+* (`safeJoin`, always), and with `containLinks` neither does a symlink.
+* Returns `undefined` when no directory has the key.
+*
+* The symlink half is {@link realPathInsideRoot}, not `safeJoin`: `safeJoin`
+* judges the path's TEXT, and `statSync` / `readFileSync` follow links, so a
+* `cdk.out/asset.x/index.html -> ~/.aws/credentials` inside a contained origin
+* directory used to be served (go-to-k/cdk-local#745).
 */
-function readKey(localDirs, key) {
+function readKey(localDirs, key, containLinks, hideDotfilesIn) {
 	if (key === "") return void 0;
 	for (const dir of localDirs) {
-		const resolved = safeJoin(dir, key);
-		if (!resolved) continue;
+		const joined = safeJoin(dir, key);
+		if (!joined) continue;
+		let resolved = joined;
+		if (containLinks) {
+			const real = realPathInsideRoot(dir, joined);
+			if (real === false) continue;
+			if (real !== void 0) resolved = real;
+		}
+		if (hideDotfilesIn.has(dir) && isHiddenKey(dir, key, resolved)) {
+			if (isExistingFile(resolved)) warnHiddenKey(dir, key, resolved);
+			continue;
+		}
 		try {
 			if (statSync(resolved).isFile()) return readFileSync(resolved);
 		} catch {}
@@ -32739,6 +33385,68 @@ function safeJoin(dir, key) {
 	if (candidate !== root && !candidate.startsWith(rootWithSep)) return void 0;
 	return candidate;
 }
+/**
+* `file`'s REAL path (every symbolic link followed by the kernel) when it lies
+* inside `root`'s real path; `false` when it leaves it, with a warning once per
+* file; `undefined` when either does not resolve — the read after it fails the
+* same way, so it reaches nothing.
+*/
+function realPathInsideRoot(root, file) {
+	let realFile;
+	let realRoot;
+	try {
+		realFile = realpathSync.native(file);
+		realRoot = realpathSync.native(root);
+	} catch {
+		return;
+	}
+	const rel = relative(realRoot, realFile);
+	if (rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel)) return realFile;
+	if (!warnedEscapes.has(file)) {
+		warnedEscapes.add(file);
+		getLogger().warn(`Not serving ${displayUntrustedValue(file)}: it is a symbolic link to ${displayUntrustedValue(realFile)}, outside the origin directory ${displayUntrustedValue(root)} the asset manifest named. Answering as if the key did not exist.`);
+	}
+	return false;
+}
+/** Files already warned about; a browser re-requests the same key. */
+const warnedEscapes = /* @__PURE__ */ new Set();
+/**
+* Whether a key under an accepted absolute `--no-staging` folder names a
+* hidden entry — on the request key itself, or on the file's REAL path relative
+* to the folder's real path (a link inside the folder pointing at `.env`).
+* `.well-known` is the one hidden name served, for parity with a deployed
+* bucket's ACME / app-association files. The caller warns, and only for an
+* entry that exists.
+*/
+function isHiddenKey(dir, key, resolved) {
+	const hidden = (rel) => rel.split(/[\\/]/).some((c) => c.startsWith(".") && c !== "." && c !== ".." && c !== ".well-known");
+	let realRel = "";
+	try {
+		realRel = relative(realpathSync.native(dir), realpathSync.native(resolved));
+	} catch {
+		realRel = "";
+	}
+	return hidden(key) || hidden(realRel);
+}
+function isExistingFile(p) {
+	try {
+		return statSync(p).isFile();
+	} catch {
+		return false;
+	}
+}
+/**
+* Warn once per withheld FILE. Keyed on the resolved path, not the request
+* key: `x/../.env`, `xx/../.env`, ... are unbounded spellings of one file, and
+* keying on them let any client grow this set and the log without limit.
+*/
+function warnHiddenKey(dir, key, resolved) {
+	if (warnedHiddenKeys.has(resolved)) return;
+	warnedHiddenKeys.add(resolved);
+	getLogger().warn(`Not serving ${displayUntrustedValue(key)} from ${displayUntrustedValue(dir)}: it is a hidden entry in a cdk synth --no-staging source folder (your own tree, not a staged asset). Answering as if the key did not exist.`);
+}
+/** Hidden keys already warned about. */
+const warnedHiddenKeys = /* @__PURE__ */ new Set();
 function stripLeadingSlash(s) {
 	return s.startsWith("/") ? s.replace(/^\/+/, "") : s;
 }
@@ -33105,6 +33813,8 @@ async function serveFromOrigin(origin, args) {
 	if (origin.kind !== "s3") return void 0;
 	const result = serveFromStaticOrigin({
 		localDirs: origin.localDirs,
+		...origin.fromAssembly === true && { containLinks: true },
+		...origin.hideDotfilesIn !== void 0 && { hideDotfilesIn: origin.hideDotfilesIn },
 		uri: args.uri,
 		...distribution.defaultRootObject !== void 0 && { defaultRootObject: distribution.defaultRootObject },
 		customErrorResponses: distribution.customErrorResponses
@@ -33211,9 +33921,9 @@ function createS3OriginReader(bucketName, options = {}) {
 			};
 			if (direct.kind === "denied" && !deniedWarned) {
 				deniedWarned = true;
-				getLogger().warn(`S3 denied reading '${flattenToOneLine(key)}' from bucket '${flattenToOneLine(bucketName)}'. If this is an OAC-locked / private bucket your credentials cannot read, point the origin at a local directory with --origin <originId>=<dir> (or use credentials with s3:GetObject on the bucket). ${getEmbedConfig().cliName} start-cloudfront reads the origin from real S3.`);
+				getLogger().warn(`S3 denied reading ${displayUntrustedValue(key)} from bucket ${displayUntrustedValue(bucketName)}. If this is an OAC-locked / private bucket your credentials cannot read, point the origin at a local directory with --origin <originId>=<dir> (or use credentials with s3:GetObject on the bucket). ${getEmbedConfig().cliName} start-cloudfront reads the origin from real S3.`);
 			}
-			if (direct.kind === "error") getLogger().warn(`S3 read of '${flattenToOneLine(key)}' from bucket '${flattenToOneLine(bucketName)}' failed: ${direct.message}`);
+			if (direct.kind === "error") getLogger().warn(`S3 read of ${displayUntrustedValue(key)} from bucket ${displayUntrustedValue(bucketName)} failed: ${direct.message}`);
 		}
 		for (const candidate of resolveErrorResponseCandidates(input.customErrorResponses)) {
 			const page = await fetchObject(candidate.errorKey);
@@ -33222,7 +33932,7 @@ function createS3OriginReader(bucketName, options = {}) {
 				headers: { "content-type": contentTypeForKey(candidate.errorKey) },
 				body: page.body
 			};
-			if (page.kind === "denied" || page.kind === "error") getLogger().warn(`S3 could not read custom-error page '${flattenToOneLine(candidate.errorKey)}' from bucket '${flattenToOneLine(bucketName)}' (${page.kind}); falling through.`);
+			if (page.kind === "denied" || page.kind === "error") getLogger().warn(`S3 could not read custom-error page ${displayUntrustedValue(candidate.errorKey)} from bucket ${displayUntrustedValue(bucketName)} (${page.kind}); falling through.`);
 		}
 		return {
 			statusCode: 404,
@@ -41071,4 +41781,4 @@ function addStudioSpecificOptions(cmd) {
 
 //#endregion
 export { applyEdgeResponseResult as $, buildJwksUrlFromIssuer as $n, resolveCfnStackName as $r, buildCloudMapIndex as $t, startAgentCoreHttpServer as A, describeCredentialLoadFailure as Ai, classifySourceChange as An, ConnectionRegistry as Ar, addRunTaskSpecificOptions as At, idFromArn as B, buildStageMap as Bn, resolveRuntimeFileExtension as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, resolveAgentCoreTarget as Ci, waitForAgentCorePing as Cn, tryParseStatus as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, tryResolveImageFnJoin as Di, computeCodeImageTag as Dn, probeHostGatewaySupport as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, substituteImagePlaceholders as Ei, buildAgentCoreCodeImage as En, HOST_GATEWAY_MIN_VERSION as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, createWatchPredicates as Fn, buildDisconnectEvent as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, filterRoutesByApiIdentifiers as Gn, substituteEnvVarsFromState as Gr, enforceImageOverrideOrphans as Gt, createDeployedKvsDataSource as H, resolveEnvVars$1 as Hn, EcsTaskResolutionError as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, resolveApiTargetSubset as In, buildMessageEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, startApiServer as Jn, createLocalStateProvider as Jr, resolveImageOverrides as Jt, createS3OriginReader as K, groupRoutesByServer as Kn, substituteEnvVarsFromStateAsync as Kr, mergeForService as Kt, parseKvsFileOverrides as L, createAuthorizerCache as Ln, architectureToPlatform as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, resolveProfileCredentials as Mi, createLocalInvokeCommand as Mn, handleConnectionsRequest as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, buildProxyClientConfig as Ni, addStartApiSpecificOptions as Nn, parseConnectionsPath as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, LocalInvokeBuildError as Oi, renderCodeDockerfile as On, resolveHostGatewayExtraHosts as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, isProxyEnvConfigured as Pi, createLocalStartApiCommand as Pn, buildConnectEvent as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, buildCognitoJwksUrl as Qn, resolveCfnRegion as Qr, listPinnedTargets as Qt, parseOriginOverrides as R, createFileWatcher as Rn, buildContainerImage as Rr, parseMaxTasks as Rt, StudioEventBus as S, pickAgentCoreCandidateStack as Si, waitForAgentCoreHttpReady as Sn, selectIntegrationResponse as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, formatStateRemedy as Ti, SUPPORTED_CODE_RUNTIMES as Tn, HOST_DOCKER_INTERNAL_GATEWAY as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, availableApiIdentifiers as Un, substituteAgainstState as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, materializeLayerFromArn as Vn, resolveRuntimeImage as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, filterRoutesByApiIdentifier as Wn, substituteAgainstStateAsync as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveServiceIntegrationParameters as Xn, rejectExplicitCfnStackWithMultipleStacks as Xr, describePinnedImageUri as Xt, resolveErrorResponseCandidates as Y, resolveSelectionExpression as Yn, isCfnFlagPresent as Yr, runImageOverrideBuilds as Yt, serveLambdaUrlOrigin as Z, defaultCredentialsLoader as Zn, resolveCfnFallbackRegion as Zr, isLocalCdkAssetImage as Zt, filterStudioTargetGroups as _, AGENTCORE_AGUI_PROTOCOL as _i, parseSseForJsonRpc as _n, applyAuthorizerOverlay as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, countTargets as ai, attachContainerLogStreamer as an, computeRequestIdentityHash as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_RUNTIME_TYPE as bi, AGENTCORE_SESSION_ID_HEADER as bn, evaluateResponseParameters as br, addAlbSpecificOptions as bt, startStudioProxy as c, discoverWebSocketApis as ci, bridgeAgentCoreWs as cn, invokeTokenAuthorizer as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, parseSelectionExpressionPath as di, A2A_PATH as dn, buildCorsConfigByApiId as dr, pickTargetFunctionLogicalId as dt, CfnLocalStateProvider as ei, CloudMapRegistry as en, createJwksCache as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, webSocketApiMatchesIdentifier as fi, a2aInvokeOnce as fn, buildCorsConfigFromCloudFrontChain as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, AGENTCORE_A2A_PROTOCOL as gi, mcpInvokeOnce as gn, translateLambdaResponse as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, resolveLambdaArnIntrinsic as hi, MCP_PROTOCOL_VERSION as hn, matchRoute as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSingleTarget as ii, getContainerNetworkIp as in, buildMethodArn as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, buildStsClientConfig as ji, addInvokeSpecificOptions as jn, buildMgmtEndpointEnvUrl as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, describeAwsFailureForWarn as ki, toCmdArgv as kn, bufferToBody as kr, serviceStrategy as kt, relayServeRequest as l, discoverWebSocketApisOrThrow as li, invokeAgentCoreWs as ln, attachAuthorizers as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, pickRefLogicalId as mi, MCP_PATH as mn, matchPreflight as mr, runViewerRequest as mt, coerceRunRequest as n, resolveSsmParameters as ni, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as nn, verifyJwtAuthorizer as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, listTargets as oi, addInvokeAgentCoreSpecificOptions as on, evaluateCachedLambdaPolicy as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, discoverRoutes as pi, MCP_CONTAINER_PORT as pn, isFunctionUrlOacFronted as pr, compileCloudFrontFunction as pt, matchBehavior as q, readMtlsMaterialsFromDisk as qn, LocalStateSourceError as qr, parseImageOverrideFlags as qt, coerceServeRequest as r, resolveWatchConfig as ri, setShadowReadyTimeoutMs as rn, verifyJwtViaDiscovery as rr, httpHeadersToEdge as rt, createStudioServeManager as s, availableWebSocketApiIdentifiers as si, createLocalInvokeAgentCoreCommand as sn, invokeRequestAuthorizer as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, collectSsmParameterRefs as ti, DEFAULT_SHADOW_READY_TIMEOUT_MS as tn, verifyCognitoJwt as tr, buildEdgeResponseEvent as tt, reinvoke as u, filterWebSocketApisByIdentifiers as ui, A2A_CONTAINER_PORT as un, applyCorsResponseHeaders as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_HTTP_PROTOCOL as vi, AGENTCORE_SIGV4_SERVICE as vn, buildHttpApiV2Event as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, derivePseudoParametersFromRegion as wi, downloadAndExtractS3Bundle as wn, VtlEvaluationError as wr, resolveAlbTarget as wt, createStudioStore as x, AgentCoreResolutionError as xi, invokeAgentCore as xn, pickResponseTemplate as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_MCP_PROTOCOL as yi, signAgentCoreInvocation as yn, buildRestV1Event as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, attachStageContext as zn, resolveRuntimeCodeMountPath as zr, parseRestartPolicy as zt };
-//# sourceMappingURL=local-studio-CSIZELLP.js.map
+//# sourceMappingURL=local-studio-Cdq8klwg.js.map