Function resolveSafePath

services/kiloclaw/controller/src/safe-path.ts:15–35

(relativePath: string, rootDir: string)

 * `verifyCanonicalized` after confirming the path exists on disk).
 */
export function resolveSafePath(relativePath: string, rootDir: string): string {
  if (!relativePath) {
    throw new SafePathError('Path must not be empty');
  }

  if (relativePath.includes('\0')) {
    throw new SafePathError('Path must not contain null bytes');
  }

  if (path.isAbsolute(relativePath)) {
    throw new SafePathError('Path must be relative');
  }

  const resolved = path.resolve(rootDir, relativePath);

  if (resolved !== rootDir && !resolved.startsWith(rootDir + '/')) {
    throw new SafePathError('Path escapes root directory');
  }

  return resolved;
}

/**
 * Verify that a resolved path, after canonicalization via realpath, still