Function assertSafePath

runner/server.mjs:18–24

(root, path)

}

function assertSafePath(root, path) {
  if (!path || path.includes("\0")) throw new Error("invalid artifact path");
  const full = resolve(root, path);
  const rel = relative(root, full);
  if (rel.startsWith("..") || resolve(root, rel) !== full) throw new Error("artifact path escapes workspace");
  return full;
}

const SECRET_KEYS = ["CLOUDBOX_GITLAB_TOKEN", "GITLAB_TOKEN", "NPM_TOKEN"];