fix(@angular-devkit/schematics): prevent schematic writes from escaping the workspace via symlinks by adilburaksen · Pull Request #33334 · angular/angular-cli

…ng the workspace via symlinks

A schematic/migration write can escape the workspace root via a symlinked
directory inside the workspace: ScopedHost's containment is lexical and does
not resolve symlinks. WorkspaceRootHost resolves the real (symlink-collapsed)
path and rejects any write/delete/rename whose real location is outside the
workspace root, mirroring the MCP host's realpath-based restriction.

…ce-root containment

The previous WorkspaceRootHost resolved the workspace root with
realpathSync(getSystemPath(root)) in the constructor, which throws ENOENT
when the root directory does not exist yet — e.g. during `ng new`, which
creates the workspace — crashing the workflow.

Extract a resolveRealPath helper that walks up to the first existing
ancestor, resolves its real path, and re-appends the remaining
non-existent segments. Use it for both the workspace root and the
asserted target path, so containment works for not-yet-created files and
a not-yet-created root while still rejecting symlink escapes.