Function writeFile

src/main/lib/git/security/secure-fs.ts:327–339

* Write content to a file within a worktree. * * SECURITY: Blocks writes if the file is a symlink pointing outside * the worktree. This prevents malicious repos from tricking users * into overwriting sensitive files like ~/.bashrc. * * @throws PathValidationError with code "SYMLINK_ESCAP

(
		worktreePath: string,
		filePath: string,
		content: string,
	)

	 * @throws PathValidationError with code "SYMLINK_ESCAPE" if target escapes worktree
	 */
	async writeFile(
		worktreePath: string,
		filePath: string,
		content: string,
	): Promise<void> {
		assertRegisteredWorktree(worktreePath);
		const fullPath = resolvePathInWorktree(worktreePath, filePath);

		// Block writes through symlinks that escape the worktree
		await assertRealpathInWorktree(worktreePath, fullPath);

		await writeFile(fullPath, content, "utf-8");
	},

	/**
	 * Delete a file or directory within a worktree.