fix: resolve absolute symlink targets correctly when packing

[claude]

Requested by Samuel Attard · Slack thread

Fixes #366

Before / After

Before: When a symlink's target was an absolute path, Filesystem.resolveLink used path.join(parentPath, symlink). path.join ignores the fact that symlink may itself be absolute and simply concatenates it onto parentPath, swallowing the leading separator. This had two bad consequences:

• An absolute target pointing inside the package was packed as a broken relative link (e.g. subdir/package/inner/file.txt instead of inner/file.txt), so it dangled when the archive was extracted.
• An absolute target pointing outside the package was silently mangled into an in-package-looking path, bypassing the existing "links out of the package" guard.

After: Absolute targets resolve to the path they actually point at. In-package absolute targets are stored as the correct in-package relative link, and out-of-package absolute targets resolve to a ../-prefixed path that the existing isAbsolute/.. guard rejects, exactly like a relative escape (e.g. ../../etc/passwd).

How

One-line change in src/filesystem.ts: path.join(parentPath, symlink) → path.resolve(parentPath, symlink). path.resolve honors an absolute target as-is while treating a relative target identically to before, so absolute and relative targets now flow through a single, correct code path. Relative-target behavior is unchanged.

Tests

Added regression tests in test/filesystem-spec.ts (the existing insertLink symlink validation block):

• An absolute symlink target pointing inside the package is stored as the correct in-package relative link.
• An absolute symlink target pointing outside the package is rejected with the existing links out of the package error.

Both tests fail on main and pass with this change. The symlinks are constructed at runtime via insertLink arguments (no absolute-path-dependent fixtures committed).

---

Generated by Claude Code