cloudflare-mcp-smart-proxy 1.4.1 → 1.5.0

package/README.md

@@ -37,25 +37,23 @@ node index.js
 
 当前已发布包名与可执行名不同，因此正式入口需要显式指定包与命令。仓库内入口只保留给本地开发调试，通过 `--runtime local` 显式选择。
 
-### 2. 作为参考连接器安装器运行
+### 2. 经过审批后自动安装（正式主线）
 
 ```bash
-cd /home/coder/project/CLOUDMCP/local-proxy
-node connector-cli.js install codex \
-  --cloud-url https://your-cloudmcp.example.com \
-  --api-key your_api_key \
-  --client-profile-id client_profile.codex.default
+npx -y -p cloudflare-mcp-smart-proxy cloudmcp-connector activate codex \
+  --cloud-url https://your-cloudmcp.example.com
 ```
 
+第一次运行会生成设备密钥并发起接入申请，不会取得任何租户配置或凭证。管理员在 CloudMCP 后台的“生态连接中心”选择精确生态与工作区并批准后，将一次性审批密令回传给智能体。智能体随后运行：
+
 ```bash
-cd /home/coder/project/CLOUDMCP/local-proxy
-node connector-cli.js install claude_code \
-  --scope project \
-  --cloud-url https://your-cloudmcp.example.com \
-  --api-key your_api_key \
-  --client-profile-id client_profile.claude_code.default
+CLOUDMCP_APPROVAL_CODE='<一次性审批密令>' \
+npx -y -p cloudflare-mcp-smart-proxy cloudmcp-connector activate codex \
+  --cloud-url https://your-cloudmcp.example.com
 ```
 
+审批密令 10 分钟内有效、只能成功领取一次，并且只能由原申请设备签名领取。连接凭证写入权限为 `0600` 的独立文件，IDE 配置只保存该文件路径。CloudMCP 的机器可发现入口为 `/.well-known/cloudmcp`。
+
 ## 目标配置文件
 
 ### Codex
@@ -74,8 +72,7 @@ node connector-cli.js install claude_code \
 
 ## 默认注入环境变量
 
-- `CLOUDFLARE_MCP_URL`
-- `CLOUDFLARE_MCP_API_KEY`
+- `CLOUDMCP_CREDENTIAL_PATH`
 - `WORKSPACE_ROOT`
 - `CLOUDMCP_CLIENT_PROFILE_ID`
 - `CLOUDMCP_CONNECTOR_ID`
@@ -83,7 +80,7 @@ node connector-cli.js install claude_code \
 - `CLOUDMCP_WORKSPACE_ID`
 - `CLOUDMCP_DEVICE_IDENTITY_PATH`
 
-这些字段会让连接器启动后直接进入：
+凭证文件保存服务 URL、设备绑定 API Key 和批准后的精确范围；这些字段会让连接器启动后直接进入：
 
 - `PUT /connectors/workspace-binding`
 - `GET /connectors/install-plan`
@@ -131,5 +128,6 @@ node --test /home/coder/project/CLOUDMCP/tests/reference-connector-a3.test.js \
 
 ## 备注
 
+- `install --api-key` 只保留给已经绑定设备的旧连接器迁移；未绑定 API Key 无法注册新设备。
 - 旧的 Cursor / Claude Desktop 入口仍保留兼容，但它们不再是 A3 主线。
 - A3 没有把 `systemPrompt` 直接写进项目根级 `AGENTS.md` 或 `CLAUDE.md`，以避免覆盖用户已有 agent 规范文件。

package/connector-cli.js

@@ -1,17 +1,26 @@
 #!/usr/bin/env node
 
+import fs from 'fs';
+import os from 'os';
 import path from 'path';
+import { createHash } from 'crypto';
 import { fileURLToPath } from 'url';
 import { reloadCodexMcpServer } from './src/codex-app-server.js';
 import { installReferenceConnector, printReferenceConnectorConfig } from './src/reference-connectors.js';
+import { DeviceIdentity } from './src/device-identity.js';
+import { writeFileAtomically } from './src/reference-connectors.js';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
 function printUsage() {
-  console.error('Usage: cloudmcp-connector <install|print|smoke|reload> <codex|claude_code> [options]');
+  console.error('Usage: cloudmcp-connector <activate|install|print|smoke|reload> <codex|claude_code> [options]');
   console.error('');
-  console.error('Required options for install, print, and smoke:');
+  console.error('Required option for activate:');
+  console.error('  --cloud-url <url>');
+  console.error('  First run creates an approval request; rerun with --approval-code after admin approval.');
+  console.error('');
+  console.error('Required options for legacy install, print, and smoke:');
   console.error('  --cloud-url <url>');
   console.error('  --api-key <key>');
   console.error('  --client-profile-id <id>');
@@ -29,6 +38,8 @@ function printUsage() {
   console.error('  --app-server-socket <path> Current runtime Codex app-server socket');
   console.error('  --runtime-id <id>          Current Codex runtime identity');
   console.error('  --dry-run                  Show output without writing');
+  console.error('  --show-secrets             Explicitly include credentials in print output');
+  console.error('  --approval-code <code>     One-time code shown by the CloudMCP administrator');
   console.error('');
   console.error('The reload codex command uses the existing Codex config and requires no credentials.');
 }
@@ -47,8 +58,8 @@ function parseArgs(argv) {
     }
 
     const key = token.slice(2);
-    if (key === 'dry-run') {
-      options.dryRun = true;
+    if (key === 'dry-run' || key === 'show-secrets') {
+      options[key === 'dry-run' ? 'dryRun' : key] = true;
       continue;
     }
 
@@ -95,7 +106,163 @@ function buildInstallOptions(options) {
   };
 }
 
-function printInstallResult(result, { includeContent = false } = {}) {
+function activationPaths(options) {
+  const homeDir = os.homedir();
+  const workspaceRoot = path.resolve(options['workspace-root'] || process.cwd());
+  const cloudUrl = resolveRequiredOption(options, 'cloud-url', ['CLOUDFLARE_MCP_URL', 'MCP_URL']).replace(/\/$/, '');
+  const fingerprint = createHash('sha256')
+    .update(`${cloudUrl}\n${options.ecosystem}\n${workspaceRoot}`)
+    .digest('hex')
+    .slice(0, 20);
+  const deviceIdentityPath = options['codex-device-identity-path']
+    || (options.ecosystem === 'codex'
+      ? path.join(homeDir, '.codex', 'cloudmcp', 'device-identity.json')
+      : path.join(homeDir, '.cloudmcp', 'device-identity.json'));
+  return {
+    cloudUrl,
+    workspaceRoot,
+    deviceIdentityPath,
+    pendingPath: path.join(homeDir, '.cloudmcp', 'activation-requests', `${fingerprint}.json`),
+    credentialPath: path.join(homeDir, '.cloudmcp', 'credentials', `${fingerprint}.json`)
+  };
+}
+
+function defaultConnectorId(ecosystem, workspaceRoot) {
+  const workspaceName = path.basename(workspaceRoot).replace(/[^a-zA-Z0-9_.-]/g, '_');
+  return `connector.${ecosystem}.${workspaceName}`;
+}
+
+async function activationFetch(url, options = {}) {
+  const response = await fetch(url, options);
+  const data = await response.json().catch(() => ({}));
+  if (!response.ok) throw new Error(data.error || `${response.status} ${response.statusText}`);
+  return data;
+}
+
+async function runActivation(options) {
+  const paths = activationPaths(options);
+  const identity = new DeviceIdentity({ identityPath: paths.deviceIdentityPath });
+  const device = await identity.loadOrCreate();
+  const approvalCode = options['approval-code'] || process.env.CLOUDMCP_APPROVAL_CODE || '';
+  let pending = null;
+  try {
+    pending = JSON.parse(fs.readFileSync(paths.pendingPath, 'utf8'));
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw error;
+  }
+
+  const installClaimedConnection = async (connection) => {
+    const result = installReferenceConnector({
+      ecosystem: options.ecosystem,
+      cloudUrl: connection.cloudUrl,
+      cloudApiKey: '',
+      credentialPath: paths.credentialPath,
+      clientProfileId: connection.clientProfileId,
+      workspaceId: connection.workspaceId,
+      connectorId: connection.connectorId,
+      connectorType: connection.connectorType,
+      workspaceRoot: paths.workspaceRoot,
+      scope: options.scope || 'user',
+      serverName: options['server-name'] || 'cloudmcp',
+      runtime: options.runtime || 'npm',
+      codexConfigPath: options['codex-config-path'] || process.env.CODEX_SHARED_CONFIG_PATH || '',
+      codexDeviceIdentityPath: paths.deviceIdentityPath,
+      packageRoot: __dirname,
+      dryRun: options.dryRun === true
+    });
+    if (options.ecosystem === 'codex' && !options.dryRun) {
+      result.activation = await reloadCodexMcpServer({
+        serverName: result.serverName,
+        socketPath: options['app-server-socket'] || process.env.CODEX_APP_SERVER_SOCKET || '',
+        runtimeId: options['runtime-id'] || process.env.CODEX_RUNTIME_ID || ''
+      });
+    }
+    if (!options.dryRun) fs.chmodSync(paths.credentialPath, 0o600);
+    if (!options.dryRun && pending) {
+      writeFileAtomically(paths.pendingPath, `${JSON.stringify({
+        requestId: pending.requestId,
+        cloudUrl: pending.cloudUrl,
+        ecosystem: pending.ecosystem,
+        workspaceRoot: pending.workspaceRoot,
+        status: 'claimed',
+        claimedAt: Date.now()
+      }, null, 2)}\n`);
+    }
+    printInstallResult(result);
+    console.error(`credential: ${paths.credentialPath}`);
+  };
+
+  if (fs.existsSync(paths.credentialPath)) {
+    const connection = JSON.parse(fs.readFileSync(paths.credentialPath, 'utf8'));
+    await installClaimedConnection(connection);
+    return;
+  }
+
+  if (!pending) {
+    if (approvalCode) throw new Error('No local activation request matches this CloudMCP URL and workspace');
+    const requested = await activationFetch(`${paths.cloudUrl}/connectors/activation-requests`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        ecosystem: options.ecosystem,
+        deviceId: device.deviceId,
+        publicKeyJwk: device.publicKeyJwk,
+        deviceLabel: options['device-label'] || os.hostname(),
+        workspaceLabel: path.basename(paths.workspaceRoot),
+        connectorId: options['connector-id'] || defaultConnectorId(options.ecosystem, paths.workspaceRoot)
+      })
+    });
+    pending = {
+      requestId: requested.activationRequest.id,
+      requestToken: requested.requestToken,
+      cloudUrl: paths.cloudUrl,
+      ecosystem: options.ecosystem,
+      workspaceRoot: paths.workspaceRoot,
+      createdAt: Date.now()
+    };
+    writeFileAtomically(paths.pendingPath, `${JSON.stringify(pending, null, 2)}\n`);
+    console.error(`approval request: ${pending.requestId}`);
+    console.error('status: pending administrator approval');
+    console.error('After approval, rerun this command with --approval-code <code>.');
+    return;
+  }
+
+  if (!approvalCode) {
+    const status = await activationFetch(
+      `${paths.cloudUrl}/connectors/activation-requests/${encodeURIComponent(pending.requestId)}`,
+      { headers: { Authorization: `Activation ${pending.requestToken}` } }
+    );
+    console.error(`approval request: ${pending.requestId}`);
+    console.error(`status: ${status.activationRequest.status}`);
+    console.error('When approved, rerun with --approval-code <code>.');
+    return;
+  }
+
+  const claimUrl = new URL(`${paths.cloudUrl}/connectors/activation-requests/${encodeURIComponent(pending.requestId)}/claim`);
+  const claimBody = JSON.stringify({ approvalCode });
+  const signedHeaders = await identity.buildSignedHeaders({
+    method: 'POST',
+    pathname: claimUrl.pathname,
+    search: claimUrl.search,
+    body: claimBody
+  });
+  const claimed = await activationFetch(
+    claimUrl.toString(),
+    {
+      method: 'POST',
+      headers: {
+        Authorization: `Activation ${pending.requestToken}`,
+        'Content-Type': 'application/json',
+        ...signedHeaders
+      },
+      body: claimBody
+    }
+  );
+  writeFileAtomically(paths.credentialPath, `${JSON.stringify(claimed.connection, null, 2)}\n`);
+  await installClaimedConnection(claimed.connection);
+}
+
+function printInstallResult(result, { includeContent = false, includeSecrets = false } = {}) {
   console.error(`ecosystem: ${result.ecosystem}`);
   console.error(`scope: ${result.scope}`);
   console.error(`target: ${result.targetFile}`);
@@ -111,7 +278,11 @@ function printInstallResult(result, { includeContent = false } = {}) {
     }
   }
   if (includeContent) {
-    process.stdout.write(`${result.renderedContent}\n`);
+    const apiKey = result.serverDefinition?.env?.CLOUDFLARE_MCP_API_KEY || '';
+    const renderedContent = includeSecrets
+      ? result.renderedContent
+      : (apiKey ? result.renderedContent.split(apiKey).join('[REDACTED]') : result.renderedContent);
+    process.stdout.write(`${renderedContent}\n`);
   }
 }
 
@@ -133,7 +304,7 @@ async function main() {
   try {
     const options = parseArgs(process.argv.slice(2));
 
-    if (!['install', 'print', 'smoke', 'reload'].includes(options.command)) {
+    if (!['activate', 'install', 'print', 'smoke', 'reload'].includes(options.command)) {
       printUsage();
       process.exit(1);
     }
@@ -142,6 +313,11 @@ async function main() {
       process.exit(1);
     }
 
+    if (options.command === 'activate') {
+      await runActivation(options);
+      return;
+    }
+
     if (options.command === 'install') {
       const result = installReferenceConnector(buildInstallOptions(options));
       if (options.ecosystem === 'codex' && !options.dryRun) {
@@ -177,7 +353,7 @@ async function main() {
 
     if (options.command === 'print') {
       const result = printReferenceConnectorConfig(buildInstallOptions(options));
-      printInstallResult(result, { includeContent: true });
+      printInstallResult(result, { includeContent: true, includeSecrets: options['show-secrets'] === true });
       return;
     }
 

package/index.js

@@ -16,15 +16,32 @@ import {
 import { sanitizeProxyError, SmartRouter } from './src/router.js';
 import { LocalToolExecutor } from './src/local-tools.js';
 import { ConnectorBridge } from './src/connector-bridge.js';
+import fs from 'fs';
 
 // 从环境变量读取配置
-const CLOUD_URL = process.env.CLOUDFLARE_MCP_URL || process.env.MCP_URL;
-const CLOUD_API_KEY = process.env.CLOUDFLARE_MCP_API_KEY || process.env.MCP_API_KEY;
+function readManagedCredential() {
+  const credentialPath = process.env.CLOUDMCP_CREDENTIAL_PATH || '';
+  if (!credentialPath) return null;
+  try {
+    const stat = fs.statSync(credentialPath);
+    if (process.platform !== 'win32' && (stat.mode & 0o077) !== 0) {
+      throw new Error('credential file permissions must be 0600');
+    }
+    return JSON.parse(fs.readFileSync(credentialPath, 'utf8'));
+  } catch (error) {
+    console.error(`Error: unable to read CloudMCP credential file: ${error.message}`);
+    process.exit(1);
+  }
+}
+
+const MANAGED_CREDENTIAL = readManagedCredential();
+const CLOUD_URL = MANAGED_CREDENTIAL?.cloudUrl || process.env.CLOUDFLARE_MCP_URL || process.env.MCP_URL;
+const CLOUD_API_KEY = MANAGED_CREDENTIAL?.apiKey || process.env.CLOUDFLARE_MCP_API_KEY || process.env.MCP_API_KEY;
 const WORKSPACE_ROOT = process.env.WORKSPACE_ROOT || process.cwd();
-const CLIENT_PROFILE_ID = process.env.CLOUDMCP_CLIENT_PROFILE_ID || process.env.CLIENT_PROFILE_ID || '';
-const CONNECTOR_ID = process.env.CLOUDMCP_CONNECTOR_ID || process.env.CONNECTOR_ID || '';
-const CONNECTOR_TYPE = process.env.CLOUDMCP_CONNECTOR_TYPE || process.env.CONNECTOR_TYPE || 'smart_proxy';
-const WORKSPACE_ID = process.env.CLOUDMCP_WORKSPACE_ID || process.env.WORKSPACE_ID || '';
+const CLIENT_PROFILE_ID = MANAGED_CREDENTIAL?.clientProfileId || process.env.CLOUDMCP_CLIENT_PROFILE_ID || process.env.CLIENT_PROFILE_ID || '';
+const CONNECTOR_ID = MANAGED_CREDENTIAL?.connectorId || process.env.CLOUDMCP_CONNECTOR_ID || process.env.CONNECTOR_ID || '';
+const CONNECTOR_TYPE = MANAGED_CREDENTIAL?.connectorType || process.env.CLOUDMCP_CONNECTOR_TYPE || process.env.CONNECTOR_TYPE || 'smart_proxy';
+const WORKSPACE_ID = MANAGED_CREDENTIAL?.workspaceId || process.env.CLOUDMCP_WORKSPACE_ID || process.env.WORKSPACE_ID || '';
 const DEVICE_IDENTITY_PATH = process.env.CLOUDMCP_DEVICE_IDENTITY_PATH || '';
 const AUTO_SYNC_PROFILE = (process.env.CLOUDMCP_AUTO_SYNC_PROFILE || 'true') !== 'false';
 const AUTO_APPLY_BRAIN = (process.env.CLOUDMCP_AUTO_APPLY_BRAIN || 'true') !== 'false';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-mcp-smart-proxy",
-  "version": "1.4.1",
+  "version": "1.5.0",
   "description": "Smart proxy for Cloudflare MCP - routes tools to cloud or local execution",
   "repository": {
     "type": "git",
@@ -36,7 +36,9 @@
       "@hono/node-server": "2.0.12",
       "ajv": "8.20.0",
       "body-parser": "2.3.0",
-      "fast-uri": "3.1.4",
+      "fast-uri": "3.1.5",
+      "hono": "4.12.34",
+      "ip-address": "10.4.0",
       "path-to-regexp": "8.4.0",
       "qs": "6.15.3"
     }

package/src/local-tools.js

@@ -214,13 +214,13 @@ export class LocalToolExecutor {
       },
       {
         name: 'execute_command',
-        description: 'Execute a shell command locally',
+        description: 'Execute a local process without shell interpretation',
         inputSchema: {
           type: 'object',
           properties: {
             command: {
               type: 'string',
-              description: 'Shell command to execute'
+              description: 'Executable and arguments to run'
             },
             cwd: {
               type: 'string',

package/src/reference-connectors.js

@@ -93,6 +93,7 @@ function formatTomlArray(values) {
 function toManagedEnv({
   cloudUrl,
   cloudApiKey,
+  credentialPath,
   workspaceRoot,
   clientProfileId,
   connectorId,
@@ -104,6 +105,7 @@ function toManagedEnv({
   const env = {
     CLOUDFLARE_MCP_URL: normalizeEnvValue(cloudUrl),
     CLOUDFLARE_MCP_API_KEY: normalizeEnvValue(cloudApiKey),
+    CLOUDMCP_CREDENTIAL_PATH: normalizeEnvValue(credentialPath),
     WORKSPACE_ROOT: normalizeEnvValue(workspaceRoot),
     CLOUDMCP_CLIENT_PROFILE_ID: normalizeEnvValue(clientProfileId),
     CLOUDMCP_CONNECTOR_ID: normalizeEnvValue(connectorId),
@@ -146,6 +148,7 @@ export function buildReferenceConnectorServer({
   ecosystem,
   cloudUrl,
   cloudApiKey,
+  credentialPath = '',
   workspaceRoot = process.cwd(),
   clientProfileId,
   connectorId = '',
@@ -170,6 +173,7 @@ export function buildReferenceConnectorServer({
     env: toManagedEnv({
       cloudUrl,
       cloudApiKey,
+      credentialPath,
       workspaceRoot: resolvedWorkspaceRoot,
       clientProfileId,
       connectorId: resolvedConnectorId,
@@ -292,6 +296,7 @@ export function installReferenceConnector({
   ecosystem,
   cloudUrl,
   cloudApiKey,
+  credentialPath = '',
   workspaceRoot = process.cwd(),
   clientProfileId,
   connectorId = '',
@@ -345,6 +350,7 @@ export function installReferenceConnector({
     ecosystem,
     cloudUrl,
     cloudApiKey,
+    credentialPath,
     workspaceRoot,
     clientProfileId,
     connectorId,

package/src/tools/command-executor.js

@@ -4,6 +4,17 @@
 
 import { spawn } from 'child_process';
 import path from 'path';
+import { FileOperations } from './file-operations.js';
+
+function parseCommand(command) {
+  const tokens = [];
+  const pattern = /"((?:\\.|[^"\\])*)"|'([^']*)'|([^\s]+)/g;
+  let match;
+  while ((match = pattern.exec(command)) !== null) {
+    tokens.push((match[1] ?? match[2] ?? match[3]).replace(/\\([\\"])/g, '$1'));
+  }
+  return tokens;
+}
 
 export class CommandExecutor {
   /**
@@ -16,17 +27,21 @@ export class CommandExecutor {
       throw new Error('command parameter is required');
     }
     
-    const workingDir = cwd ? path.resolve(workspaceRoot, cwd) : workspaceRoot;
+    const workingDir = cwd ? FileOperations.validatePath(cwd, workspaceRoot) : FileOperations.validatePath('.', workspaceRoot);
     
     return new Promise((resolve, reject) => {
       // 解析命令和参数
-      const parts = command.trim().split(/\s+/);
+      const parts = parseCommand(command.trim());
       const cmd = parts[0];
       const args = parts.slice(1);
+      if (!cmd) {
+        reject(new Error('command parameter must include an executable'));
+        return;
+      }
       
       // 安全限制：禁止某些危险命令
-      const dangerousCommands = ['rm', 'del', 'format', 'shutdown', 'reboot'];
-      if (dangerousCommands.some(danger => cmd.includes(danger))) {
+      const dangerousCommands = new Set(['rm', 'del', 'format', 'shutdown', 'reboot']);
+      if (dangerousCommands.has(path.basename(cmd).toLowerCase())) {
         reject(new Error(`Command "${cmd}" is not allowed for security reasons`));
         return;
       }
@@ -38,9 +53,13 @@ export class CommandExecutor {
       // 执行命令
       const proc = spawn(cmd, args, {
         cwd: workingDir,
-        shell: true,
+        shell: false,
         stdio: ['ignore', 'pipe', 'pipe']
       });
+      const timeout = setTimeout(() => {
+        proc.kill();
+        reject(new Error('Command execution timeout (30s)'));
+      }, 30000);
       
       // 收集输出
       proc.stdout.on('data', (data) => {
@@ -53,6 +72,7 @@ export class CommandExecutor {
       
       // 处理完成
       proc.on('close', (code) => {
+        clearTimeout(timeout);
         const duration = Date.now() - startTime;
         
         resolve({
@@ -68,15 +88,9 @@ export class CommandExecutor {
       
       // 处理错误
       proc.on('error', (error) => {
+        clearTimeout(timeout);
         reject(new Error(`Command execution failed: ${error.message}`));
       });
-      
-      // 超时保护（30秒）
-      setTimeout(() => {
-        proc.kill();
-        reject(new Error('Command execution timeout (30s)'));
-      }, 30000);
     });
   }
 }
-

package/src/tools/file-operations.js

@@ -3,6 +3,7 @@
  */
 
 import fs from 'fs/promises';
+import fsSync from 'fs';
 import path from 'path';
 
 export class FileOperations {
@@ -16,14 +17,28 @@ export class FileOperations {
     }
     
     // 限制在工作目录内
-    const resolvedPath = path.resolve(workspaceRoot, filePath);
-    const resolvedRoot = path.resolve(workspaceRoot);
+    const resolvedRoot = fsSync.realpathSync(path.resolve(workspaceRoot));
+    const resolvedPath = path.resolve(resolvedRoot, filePath);
+    const relativePath = path.relative(resolvedRoot, resolvedPath);
     
-    if (!resolvedPath.startsWith(resolvedRoot)) {
+    if (relativePath.startsWith('..') || path.isAbsolute(relativePath)) {
       throw new Error('File path outside workspace root');
     }
-    
-    return resolvedPath;
+
+    let existingAncestor = resolvedPath;
+    while (!fsSync.existsSync(existingAncestor)) {
+      const parent = path.dirname(existingAncestor);
+      if (parent === existingAncestor) break;
+      existingAncestor = parent;
+    }
+    const realAncestor = fsSync.realpathSync(existingAncestor);
+    const realTarget = path.resolve(realAncestor, path.relative(existingAncestor, resolvedPath));
+    const realRelativePath = path.relative(resolvedRoot, realTarget);
+    if (realRelativePath.startsWith('..') || path.isAbsolute(realRelativePath)) {
+      throw new Error('File path resolves outside workspace root');
+    }
+
+    return realTarget;
   }
 
   /**
@@ -208,4 +223,3 @@ export class FileOperations {
     }
   }
 }
-