Function assertWithinRoot

src/git/shadow.ts:18–25

(rootDir: string, filePath: string)

}

function assertWithinRoot(rootDir: string, filePath: string): string {
  const resolved = resolve(rootDir, filePath);
  const normalizedRoot = resolve(rootDir) + "/";
  if (!resolved.startsWith(normalizedRoot) && resolved !== resolve(rootDir)) {
    throw new Error(`Path traversal denied: "${filePath}" resolves outside root directory`);
  }
  return resolved;
}

async function ensureDataDir(rootDir: string): Promise<string> {
  const dataPath = join(rootDir, DATA_DIR);