Confine local file installation paths

internal/fileops/modes.go

@@ -3,7 +3,6 @@ package fileops
 import (
 	"fmt"
 	"os"
-	"path/filepath"
 	"strings"
 )
 
@@ -23,35 +22,7 @@ func EnsureWorkspaceDirectory(directory string) error {
 		return fmt.Errorf("workspace directory is required")
 	}
 
-	directory = filepath.Clean(directory)
-	missing := make([]string, 0)
-	for current := directory; ; current = filepath.Dir(current) {
-		info, err := os.Lstat(current)
-		if err == nil {
-			if !info.IsDir() {
-				return fmt.Errorf("workspace directory %q is not a directory", current)
-			}
-			break
-		}
-		if !os.IsNotExist(err) {
-			return fmt.Errorf("inspect workspace directory %q: %w", current, err)
-		}
-		missing = append(missing, current)
-		parent := filepath.Dir(current)
-		if parent == current {
-			break
-		}
-	}
-
-	if err := os.MkdirAll(directory, WorkspaceDirectoryMode); err != nil {
-		return fmt.Errorf("create workspace directory %q: %w", directory, err)
-	}
-	for index := len(missing) - 1; index >= 0; index-- {
-		if err := os.Chmod(missing[index], WorkspaceDirectoryMode); err != nil {
-			return fmt.Errorf("set workspace directory permissions %q: %w", missing[index], err)
-		}
-	}
-	if err := os.Chmod(directory, WorkspaceDirectoryMode); err != nil {
+	if err := ensureConfinedDirectory(directory, WorkspaceDirectoryMode); err != nil {
 		return fmt.Errorf("set workspace directory permissions %q: %w", directory, err)
 	}
 	return nil