Function assertSafeInstancePath

scripts/stop-obsidian-e2e-instance.mjs:172–200

(instancePath, profileRoot)

}

function assertSafeInstancePath(instancePath, profileRoot) {
	if (!instancePath || !path.isAbsolute(instancePath)) {
		throw new Error(
			`Refusing to remove non-absolute instance path: ${instancePath}`,
		);
	}
	const base = path.basename(instancePath);
	if (!INSTANCE_DIR_PATTERN.test(base)) {
		throw new Error(
			`Refusing to remove ${instancePath}: not an Obsidian E2E instance directory.`,
		);
	}
	// A real instance dir is several levels deep (e.g. /tmp/quickadd-obsidian-e2e/<id>);
	// reject anything shallow enough to be a system root.
	if (instancePath.split(path.sep).filter(Boolean).length < 2) {
		throw new Error(`Refusing to remove shallow path: ${instancePath}`);
	}
	// Containment guard: when the caller knows the profile root, the dir we remove
	// must be a direct child of it. Real callers always do, so a bad --profile-root
	// can never make us rm a path outside the e2e profile tree.
	if (
		profileRoot &&
		path.resolve(path.dirname(instancePath)) !== path.resolve(profileRoot)
	) {
		throw new Error(
			`Refusing to remove ${instancePath}: not a direct child of profile root ${profileRoot}.`,
		);
	}
}

async function defaultRunPs() {
	const { stdout } = await execFileAsync(