🛡️ Sentinel: [CRITICAL/HIGH] Fix path traversal

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2026-05-31 - [Path Traversal in Manual Path Resolution]
+**Vulnerability:** The manual path resolution logic in the TypeScript extractor popped path components directly when encountering `Component::ParentDir`. This could allow traversal escapes if paths like `../../foo` were evaluated, as the `ParentDir` components were erroneously dropped when the components stack was empty.
+**Learning:** Rust's `PathBuf::canonicalize()` resolves `..`, but when dealing with unresolved paths (e.g., inside non-existent directories), manual component traversal must handle `ParentDir` correctly. Specifically, dropping `ParentDir` without checking if the base of the path is already relative can truncate directory traversal semantics inappropriately.
+**Prevention:** When manually resolving paths with `std::path::Component`, explicitly block `Component::ParentDir` from popping `Component::RootDir` or `Component::Prefix`. Furthermore, if the current component list is empty or its last element is already `Component::ParentDir`, append the `Component::ParentDir` instead of ignoring it.

crates/flow/src/incremental/extractors/typescript.rs

@@ -808,7 +808,19 @@ impl TypeScriptDependencyExtractor {
                 for component in resolved.components() {
                     match component {
                         std::path::Component::ParentDir => {
-                            components.pop();
+                            let last = components.last();
+                            match last {
+                                Some(std::path::Component::RootDir)
+                                | Some(std::path::Component::Prefix(_)) => {
+                                    // Do not pop RootDir or Prefix to prevent traversal escapes
+                                }
+                                Some(std::path::Component::ParentDir) | None => {
+                                    components.push(component);
+                                }
+                                _ => {
+                                    components.pop();
+                                }
+                            }
                         }
                         std::path::Component::CurDir => {}
                         _ => components.push(component),