Function resolveReferences

src/session/references.js:29–100

* Parse @file references from user input. * Returns the text with references resolved + injected file contents.

(input, cwd)

 * Returns the text with references resolved + injected file contents.
 */
function resolveReferences(input, cwd) {
  const matches = [...input.matchAll(FILE_REGEX)];
  if (matches.length === 0) return { text: input, files: [] };

  const files = [];
  const seen = new Set();

  for (const match of matches) {
    const rawPath = match[1];
    if (!rawPath || rawPath.length < 2) continue;
    if (seen.has(rawPath)) continue;
    seen.add(rawPath);

    // Resolve the path safely. We allow `~/...` but require the resolved
    // path NOT to be a sensitive credential file (.ssh, .aws, etc.).
    // For project-relative paths we additionally require containment.
    const isHome = rawPath.startsWith('~/') || rawPath.startsWith('~\\');
    const safe = safeResolvePath(rawPath, cwd, {
      allowHome: isHome,
      allowOutside: isHome, // a ~/-relative path is by definition outside cwd
    });
    if (!safe.ok) continue; // Silently skip unsafe references — model gets nothing
    const resolvedPath = safe.fullPath;

    if (!fs.existsSync(resolvedPath)) continue;

    let stat;
    try { stat = fs.statSync(resolvedPath); } catch { continue; }

    if (stat.isFile()) {
      // Refuse files larger than 5MB up front — prevents DoS via @largebinary
      if (stat.size > 5 * 1024 * 1024) continue;
      // Read file content (capped at 500 lines)
      try {
        const content = fs.readFileSync(resolvedPath, 'utf-8');
        const lines = content.split('\n');
        const truncated = lines.length > 500
          ? lines.slice(0, 500).join('\n') + `\n... (${lines.length - 500} more lines)`
          : content;

        files.push({
          path: rawPath,
          resolvedPath,
          type: 'file',
          // Sanitize before sending into the conversation: strip ANSI/control
          // chars and redact secrets. A user-typed `@.env` no longer leaks
          // their API keys to a (possibly remote) model.
          content: sanitizeToolOutput(truncated),
          lines: lines.length,
        });
      } catch {}
    } else if (stat.isDirectory()) {
      // List directory contents
      try {
        const entries = fs.readdirSync(resolvedPath, { withFileTypes: true })
          .filter(e => !e.name.startsWith('.') && e.name !== 'node_modules')
          .slice(0, 50)
          .map(e => e.isDirectory() ? `${e.name}/` : e.name);