Function resolveProjectFilePath

packages/cli/src/path-resolver.ts:22–53

(filePath: string, projectRoot: string)

 * - `/abs/path/outside/project/file.tsx`
 */
export function resolveProjectFilePath(filePath: string, projectRoot: string): string | null {
  const normalizedRoot = path.resolve(projectRoot);
  const incomingPath = filePath.trim();
  if (!incomingPath) return null;

  if (path.isAbsolute(incomingPath)) {
    const absoluteCandidate = path.resolve(incomingPath);
    if (isWithinProjectRoot(absoluteCandidate, normalizedRoot)) {
      return absoluteCandidate;
    }

    // If the absolute path exists outside the project, treat it as a real
    // filesystem absolute and reject it. Only reinterpret missing leading-slash
    // paths like "/src/App.tsx" as project-root-relative source paths.
    if (fs.existsSync(absoluteCandidate)) {
      return null;
    }

    const projectRelativeCandidate = path.resolve(
      normalizedRoot,
      incomingPath.replace(/^[/\\]+/, ""),
    );
    return isWithinProjectRoot(projectRelativeCandidate, normalizedRoot)
      ? projectRelativeCandidate
      : null;
  }

  const relativeCandidate = path.resolve(normalizedRoot, incomingPath);
  return isWithinProjectRoot(relativeCandidate, normalizedRoot)
    ? relativeCandidate
    : null;
}

export function isProjectFilePathSafe(filePath: string, projectRoot: string): boolean {
  return resolveProjectFilePath(filePath, projectRoot) !== null;