Function resolveAndValidatePath

src/lib/workspace-resolver.ts:47–55

(workspaceId: string, filePath: string)

 * Prevents path traversal attacks.
 */
export function resolveAndValidatePath(workspaceId: string, filePath: string): { base: string; fullPath: string } | null {
  const base = resolveWorkspace(workspaceId || 'workspace');
  if (!base) return null;

  const fullPath = path.resolve(base, filePath);
  if (!fullPath.startsWith(base)) return null; // path traversal check

  return { base, fullPath };
}