ai-agent-tools-2026

import { ToolsProviderController } from "@lmstudio/sdk";
import { configSchematics } from "./config";
import * as path from "path";

export function getSecureFilePath(ctl: ToolsProviderController, fileName: string): string {
  const config = ctl.getPluginConfig(configSchematics);
  const baseDir = config.get("baseDirectory")?.trim();

  let rootDir: string;
  if (baseDir) {
    rootDir = path.resolve(baseDir);
  } else {
    rootDir = ctl.getWorkingDirectory();
  }

  const targetPath = path.resolve(rootDir, fileName);
  const normalizedRoot = path.resolve(rootDir);
  const normalizedTarget = path.resolve(targetPath);

  if (!normalizedTarget.startsWith(normalizedRoot + path.sep) && normalizedTarget !== normalizedRoot) {
    throw new Error(`Недопустимый путь: выход за пределы базовой директории (${rootDir})`);
  }

  return normalizedTarget;
}