Method assertContained

src/node/services/memoryService.ts:387–417

(relPath: string)

  }

  async assertContained(relPath: string): Promise<void> {
    let realRoot: string;
    try {
      realRoot = await fsPromises.realpath(this.physicalRoot);
    } catch {
      // Missing root (read paths never create it): nothing exists under a
      // nonexistent root, so there is nothing to escape — lookups simply
      // report "not found". Write paths ensureRoot first, so they get here
      // only with an existing root.
      return;
    }
    // Walk up from the target to the deepest existing ancestor, then realpath it.
    let candidate = this.abs(relPath);
    for (;;) {
      try {
        const real = await fsPromises.realpath(candidate);
        if (!isPathWithinRoot(realRoot, real, path)) {
          throw new MemoryCommandError(
            `Path escapes the memory root (symlinks are not allowed to point outside)`
          );
        }
        return;
      } catch (error) {
        if (error instanceof MemoryCommandError) throw error;
        const parent = path.dirname(candidate);
        // The root exists (realpath above succeeded), so the walk terminates at it.
        assert(parent !== candidate, "containment walk must terminate at the memory root");
        candidate = parent;
      }
    }
  }
}

// ---------------------------------------------------------------------------