Verify real paths in create_safe_path to prevent path traversal

- Update `create_safe_path` to find the deepest existing ancestor of the target path, resolve its `realpath`, and strictly verify it begins with the workspace root's `realpath` plus `path.sep` to prevent symlink escapes.

└── apps
    └── editor
        └── src
            ├── commands
            │   ├── apply-response-command
            │   │   ├── response-processor
            │   │   │   ├── handlers
            │   │   │   │   ├── diff-handler.ts
            │   │   │   │   ├── fast-replace-handler.ts
            │   │   │   │   ├── patch-repair-handler.ts
            │   │   │   │   ├── restore-preview-handler.ts
            │   │   │   │   ├── search-replace-handler.ts
            │   │   │   │   └── truncated-handler.ts
            │   │   │   └── response-processor.ts
            │   │   └── utils
            │   │       ├── file-operations
            │   │       │   ├── apply-file-relocations.ts
            │   │       │   ├── create-file-if-needed.ts
            │   │       │   ├── read-rename-source-file.ts
            │   │       │   ├── relocate-file.ts
            │   │       │   └── undo-files.ts
            │   │       └── preview
            │   │           ├── build-history-files.ts
            │   │           └── file-preparer.ts
            │   ├── code-at-cursor-command
            │   │   └── code-at-cursor-commands.ts
            │   ├── new-file-command.ts
            │   ├── new-folder-command.ts
            │   └── rename-command.ts
            ├── utils
            │   ├── normalize-path.ts
            │   └── path-sanitizer.ts
            └── views
                └── prompt
                    └── backend
                        └── message-handlers
                            └── handle-patch-repair.ts

Author: robertpiosik

apps/editor/src/utils/path-sanitizer.ts

@@ -15,7 +15,7 @@ export const sanitize_file_name = (name: string): string => {
   }
 
   const segments = name.split(/[/\\]/)
-  if (segments.some(seg => seg === '.git')) {
+  if (segments.some((seg) => seg === '.git')) {
     return ''
   }
 
@@ -51,6 +51,26 @@ export const create_safe_path = (
 
   const full_path = path.resolve(resolved_parent, sanitized_name)
 
+  let current_path = full_path
+  while (true) {
+    try {
+      const real_path = fs.realpathSync(current_path)
+      const prefix = resolved_parent.endsWith(path.sep)
+        ? resolved_parent
+        : resolved_parent + path.sep
+      if (real_path !== resolved_parent && !real_path.startsWith(prefix)) {
+        return null
+      }
+      break
+    } catch {
+      const parent = path.dirname(current_path)
+      if (parent === current_path) {
+        break
+      }
+      current_path = parent
+    }
+  }
+
   const relative_path = path.relative(resolved_parent, full_path)
 
   if (relative_path.startsWith('..') || path.isAbsolute(relative_path)) {