Function ensurePathContained

src/node/services/tools/skillFileUtils.ts:92–107

(
  containmentRoot: string,
  candidatePath: string,
  options?: { allowMissing?: boolean }
)

 * escape.
 */
export async function ensurePathContained(
  containmentRoot: string,
  candidatePath: string,
  options?: { allowMissing?: boolean }
): Promise<string> {
  const containmentRootReal = await fsPromises.realpath(containmentRoot);
  const candidateReal = options?.allowMissing
    ? await resolveRealPathAllowMissing(candidatePath)
    : await fsPromises.realpath(candidatePath);

  if (!isPathInsideRoot(containmentRootReal, candidateReal)) {
    throw new Error("Path resolves outside containment root after symlink resolution.");
  }

  return candidateReal;
}

async function resolveRealPathAllowMissing(targetPath: string): Promise<string> {
  const missingSegments: string[] = [];