refactor(install): share safe install path helpers

src/infra/install-safe-path.ts

@@ -0,0 +1,37 @@
+import path from "node:path";
+
+export function unscopedPackageName(name: string): string {
+  const trimmed = name.trim();
+  if (!trimmed) {
+    return trimmed;
+  }
+  return trimmed.includes("/") ? (trimmed.split("/").pop() ?? trimmed) : trimmed;
+}
+
+export function safeDirName(input: string): string {
+  const trimmed = input.trim();
+  if (!trimmed) {
+    return trimmed;
+  }
+  return trimmed.replaceAll("/", "__").replaceAll("\\", "__");
+}
+
+export function resolveSafeInstallDir(params: {
+  baseDir: string;
+  id: string;
+  invalidNameMessage: string;
+}): { ok: true; path: string } | { ok: false; error: string } {
+  const targetDir = path.join(params.baseDir, safeDirName(params.id));
+  const resolvedBase = path.resolve(params.baseDir);
+  const resolvedTarget = path.resolve(targetDir);
+  const relative = path.relative(resolvedBase, resolvedTarget);
+  if (
+    !relative ||
+    relative === ".." ||
+    relative.startsWith(`..${path.sep}`) ||
+    path.isAbsolute(relative)
+  ) {
+    return { ok: false, error: params.invalidNameMessage };
+  }
+  return { ok: true, path: targetDir };
+}