Function isRealPathWithinTeamDir

src/memdir/teamMemPaths.ts:183–206

* Check whether a real (symlink-resolved) path is within the real team * memory directory. Both sides are realpath'd so the comparison is between * canonical filesystem locations. * * If teamDir does not exist, returns true (skips the check). This is safe: * a symlink escape requires a pre-exis

(
  realCandidate: string,
)

 * and the first-pass string-level containment check is sufficient.
 */
async function isRealPathWithinTeamDir(
  realCandidate: string,
): Promise<boolean> {
  let realTeamDir: string
  try {
    // getTeamMemPath() includes a trailing separator; strip it because
    // realpath() rejects trailing separators on some platforms.
    realTeamDir = await realpath(getTeamMemPath().replace(/[/\\]+$/, ''))
  } catch (e: unknown) {
    const code = getErrnoCode(e)
    if (code === 'ENOENT' || code === 'ENOTDIR') {
      // Team dir doesn't exist — symlink escape impossible, skip check.
      return true
    }
    // Unexpected error (EACCES, EIO) — fail closed.
    return false
  }
  if (realCandidate === realTeamDir) {
    return true
  }
  // Prefix-attack protection: require separator after the prefix so that
  // "/foo/team-evil" doesn't match "/foo/team".
  return realCandidate.startsWith(realTeamDir + sep)
}

/**
 * Check if a resolved absolute path is within the team memory directory.