// own-working-tree.mjs — Is a scan target the caller's own working tree?
// Zero external dependencies.
//
// Configuration that lives INSIDE a scanned target (.llm-security-ignore,
// .llm-security/policy.json and the custom SIG ruleset it can point at) is
// honored only when the target is the caller's own working directory (or a
// subdirectory of it), and NEVER when the target resolves under the OS temp
// directory (where git-clone.mjs materializes clones) — the second check is
// defense-in-depth for the case a caller's own cwd sits under tmpdir.
// Otherwise a foreign/cloned target could configure the scan of itself.
//
// S3b (v8.1.0, 2026-09-22) introduced this check in scan-orchestrator.mjs for
// the ignore file; S3c moved it here so policy-loader.mjs shares the one rule.

import { resolve, sep } from 'node:path';
import { realpathSync } from 'node:fs';
import { tmpdir } from 'node:os';

/**
 * @param {string} targetPath
 * @returns {boolean}
 */
export function isOwnWorkingTree(targetPath) {
  let resolvedTarget;
  let resolvedCwd;
  let resolvedTmp;
  try {
    resolvedTarget = realpathSync(resolve(targetPath));
    resolvedCwd = realpathSync(process.cwd());
    resolvedTmp = realpathSync(tmpdir());
  } catch {
    return false;
  }
  if (resolvedTarget === resolvedTmp || resolvedTarget.startsWith(resolvedTmp + sep)) {
    return false;
  }
  return resolvedTarget === resolvedCwd || resolvedTarget.startsWith(resolvedCwd + sep);
}