fix(generator): add symlink-ancestor containment checks and regression tests

[Muhamadmust]

Summary of Changes

• Hardened generator destination containment in src/generator/validation.ts (assertSymlinkAncestorContainment and planProjectDestination) to verify that the destination and its existing ancestors do not escape the current working directory through symbolic links.
• Hardened template generation in src/generator/template-generation.ts (assertDestinationContainment and generateProjectFromTemplate) to verify that destination paths and their ancestors do not escape the trusted root directory via symlinks before any filesystem writes or staging directories are created.
• Added comprehensive cross-platform regression test suite in tests/generator-symlink-ancestor.test.ts covering:
  • Rejection of escaping symlink ancestors before any writes or staging directories are created;
  • Preserving pre-existing content and empty destinations in escape targets;
  • Deeply nested symlink ancestor traversal attempts;
  • Successful planning and generation for valid contained symlink destinations within the root;
  • Full orchestrator execution verifying end-to-end security rejection;
  • Cross-platform support with junction handling and symlink capability probing.

Testing & Verification

• npm test -- tests/generator-symlink-ancestor.test.ts: 8/8 tests passed.
• npm test -- tests/generator-destination-containment.test.ts tests/template-generation.test.ts tests/generator-destination-collision.test.ts tests/project-validation.test.ts tests/generator-orchestration.test.ts: 104/104 tests passed.
• ESLint and Prettier checks passed on all modified and new files (npx eslint, npx prettier --check).

Closes #134
Fixes #134

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: a9212878-610c-46b1-8b63-efa17a1bba1c

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}