Module security 

Shared sandbox-boundary check for allowed_paths-style path validation.

Extracted from the near-identical validate_path bodies in zeph-tools::file::FileExecutor and zeph-tools::diagnostics::DiagnosticsExecutor (#6032 SEC-2) so every caller enforcing an allowed_paths sandbox — including zeph-tools::cwd::resolve_and_set_cwd, the third caller this module was extracted for — shares one canonical starts_with-against-allowed-roots check instead of three textually-similar-but-independently-maintained copies.

Deliberately does not own path resolution strategy (tilde-expansion, relative-path joining, or symlink-tolerant canonicalization of a not-yet-existing target): callers differ legitimately there — FileExecutor must tolerate a nonexistent target (writing a new file), while DiagnosticsExecutor and resolve_and_set_cwd require the target to already exist. Only the final containment check — the actual security invariant — is shared.

Functions

is_path_within

Returns true if canonical is contained within (or equal to) at least one of allowed_paths.

validate_path_within

Canonicalize path (which must already exist) and verify it falls within one of allowed_paths.