import { readFileSync } from "node:fs";
import { resolve } from "node:path";
//#region src/agent/reply/workspace-boundary-read.ts
/**
* Read a file relative to workspace root with path traversal guard and byte cap.
*/
function readWorkspaceRelativeFile(params) {
	const root = resolve(params.workspaceDir);
	const absolutePath = resolve(root, params.relativePath);
	if (!absolutePath.startsWith(root)) return {
		ok: false,
		reason: "outside-root"
	};
	try {
		const buf = readFileSync(absolutePath);
		if (buf.length > params.maxBytes) return {
			ok: false,
			reason: "too-large"
		};
		return {
			ok: true,
			content: buf.toString("utf-8")
		};
	} catch (err) {
		if (err?.code === "ENOENT") return {
			ok: false,
			reason: "missing"
		};
		return {
			ok: false,
			reason: "read-error"
		};
	}
}
//#endregion
export { readWorkspaceRelativeFile };

//# sourceMappingURL=workspace-boundary-read.js.map