[javierivanov]

What

Fix local asset resolution and containment checks for valid names beginning with two dots, such as ..intro.mp4 and ..assets/clip.mp4.

Why

The checks treated every relative path starting with .. as traversal. As a result, local assets with these names were rejected even when they were inside the project. The candidate resolver returned no candidates, which can produce false missing-asset reports.

How

Check for the complete parent-directory segment (.. or .. followed by the platform separator). Apply the same distinction to the existing POSIX-normalized root-clamping fallback. Actual parent and sibling paths remain outside the containment boundary.

Test plan

• Added 8 regression cases covering dot-prefixed files/directories, parent/sibling rejection, root equality, and root-clamping behavior. Four cases failed before the fix.
• All 30 focused tests passed: bun run --cwd packages/parsers test --configLoader runner src/assetPaths.test.ts src/assetResolution.test.ts src/rewriteSubCompPaths.test.ts.
• Parser typecheck passed: bun run --cwd packages/parsers typecheck.
• oxlint, oxfmt, fallow audit, tracked-artifact, large-file, and commit-message checks passed.
• Full monorepo build passed: bun run build.
• The broader pre-commit typecheck commands passed after generating build artifacts: core, studio, and scripts TypeScript checks.
• Full parser suite after building: 935 passed, 2 failed, 4 skipped, 3 todo. Both failures are existing ffBinaries.test.ts Windows failures, reproduced against the original code (Windows exe preference and PATH fallback spy count).

Maintainer follow-up

• Rebased onto main. isWithinProjectRoot now takes an injectable pathModule, so the segment check uses pathModule.sep (sep added to PathModuleLike); win32 two-dot names are covered next to the existing win32 traversal tests.
• reanchoredCandidates (used by resolveProjectRelativeSrc) had the same startsWith("..") false rejection: ../..top.mp4 never re-anchored to the root file ..top.mp4. Fixed with a regression test.
• After stripping leading ../ from a normalized path, the only remaining traversal is a bare .., so both clamp sites check === "..".
• Traversal stays blocked: .., ../x, ..\x, ..\..\x, %2e%2e/x, %2e%2e%2fx, ..%2fx, ..%5cx, a/../../x, ../proj-sibling/x produce no candidate outside the project root, and win32 .., ..\x, D:\x, UNC paths are rejected.

Size

Small on purpose: one boundary rule (a .. path segment vs. a name that starts with two dots) applied at the three places that test it, plus focused tests.

[miguel-heygen]

Thanks for this. The parsers change is right: a name that starts with two dots is not a parent-directory segment. One change before we can take it: packages/producer/src/utils/paths.ts:62 still treats any path starting with .. as outside the project, so lint would accept an asset like ..intro.mp4 while render still rejects it. Please make the producer use the same segment check (ideally by importing the parsers helper rather than a second copy), add one producer test with a ..name file, and mark the PR ready for review.

[miguel-heygen]

One correction to my note above: #5834 fixes that same producer check in paths.ts. If it lands first, this PR only needs a rebase and to mark it ready; no second copy of the check is needed.