refactor(pack): harden project staging and export paths

cmd/spx/internal/command/export.go

@@ -54,7 +54,17 @@ func (cmd *CmdTool) Export() error {
 }
 
 func (cmd *CmdTool) prepareExport() error {
-	projectDir, _ := filepath.Abs(cmd.ProjectDir)
-	util.CopyDir2(filepath.Join(projectDir, "..", "assets"), filepath.Join(cmd.ProjectDir, "assets"))
+	if cmd.TargetAbsDir == "" {
+		return fmt.Errorf("stage project-local resources: logical project directory is empty")
+	}
+	sourceProjectDir := cmd.TargetAbsDir
+	sourceAssetDir := filepath.Join(sourceProjectDir, "assets")
+	destinationAssetDir := filepath.Join(cmd.ProjectDir, "assets")
+	if err := validateExportStage(sourceAssetDir, destinationAssetDir); err != nil {
+		return err
+	}
+	if err := util.CopyDir2(sourceAssetDir, destinationAssetDir); err != nil {
+		return fmt.Errorf("stage project-local resources from %s: %w", sourceAssetDir, err)
+	}
 	return nil
 }

cmd/spx/internal/command/export_staging.go

@@ -0,0 +1,82 @@
+/*
+ * Copyright (c) 2026 The XGo Authors (xgo.dev). All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package command
+
+import (
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+func validateExportStage(source, destination string) error {
+	info, err := os.Lstat(source)
+	if err != nil {
+		return fmt.Errorf("inspect project assets %q: %w", source, err)
+	}
+	if info.Mode()&os.ModeSymlink != 0 || !info.IsDir() {
+		return fmt.Errorf("project assets %q must be a real directory", source)
+	}
+
+	source, err = filepath.Abs(source)
+	if err != nil {
+		return err
+	}
+	destination, err = filepath.Abs(destination)
+	if err != nil {
+		return err
+	}
+	if source == destination || pathWithin(destination, source) {
+		return fmt.Errorf("stage project assets: destination %q is inside source %q", destination, source)
+	}
+	if info, err := os.Lstat(destination); err == nil {
+		if info.Mode()&os.ModeSymlink != 0 {
+			return fmt.Errorf("stage project assets: destination %q must not be a symlink", destination)
+		}
+	} else if !os.IsNotExist(err) {
+		return fmt.Errorf("inspect staged project assets %q: %w", destination, err)
+	}
+
+	return filepath.WalkDir(source, func(name string, entry fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if entry.Type()&os.ModeSymlink != 0 {
+			return fmt.Errorf("project asset %q must not be a symlink", name)
+		}
+		if entry.IsDir() {
+			return nil
+		}
+		info, err := entry.Info()
+		if err != nil {
+			return err
+		}
+		if !info.Mode().IsRegular() {
+			return fmt.Errorf("project asset %q must be a regular file", name)
+		}
+		return nil
+	})
+}
+
+func pathWithin(name, root string) bool {
+	rel, err := filepath.Rel(root, name)
+	if err != nil {
+		return false
+	}
+	return rel != "." && rel != ".." && !strings.HasPrefix(rel, ".."+string(filepath.Separator))
+}

cmd/spx/internal/command/export_test.go

@@ -0,0 +1,84 @@
+/*
+ * Copyright (c) 2026 The XGo Authors (xgo.dev). All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package command
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestPrepareExportStagesAssetsFromLogicalProject(t *testing.T) {
+	sourceProjectDir := filepath.Join(t.TempDir(), "game")
+	generatedProjectDir := filepath.Join(sourceProjectDir, "project")
+	if err := os.MkdirAll(filepath.Join(sourceProjectDir, "assets"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(sourceProjectDir, "assets", "index.json"), []byte(`{}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	cmd := &CmdTool{TargetAbsDir: sourceProjectDir, ProjectDir: generatedProjectDir}
+	if err := cmd.prepareExport(); err != nil {
+		t.Fatalf("prepareExport() error = %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(generatedProjectDir, "assets", "index.json")); err != nil {
+		t.Fatalf("staged project asset: %v", err)
+	}
+}
+
+func TestPrepareExportRejectsMissingLogicalProject(t *testing.T) {
+	cmd := &CmdTool{ProjectDir: filepath.Join(t.TempDir(), "generated")}
+	if err := cmd.prepareExport(); err == nil {
+		t.Fatal("prepareExport() accepted an empty logical project directory")
+	}
+}
+
+func TestPrepareExportRejectsAssetSymlink(t *testing.T) {
+	root := t.TempDir()
+	source := filepath.Join(root, "game")
+	destination := filepath.Join(source, "project")
+	if err := os.MkdirAll(filepath.Join(source, "assets"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	outside := filepath.Join(t.TempDir(), "outside.txt")
+	if err := os.WriteFile(outside, []byte("outside"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(outside, filepath.Join(source, "assets", "linked.txt")); err != nil {
+		t.Skipf("symlink unavailable: %v", err)
+	}
+
+	cmd := &CmdTool{TargetAbsDir: source, ProjectDir: destination}
+	if err := cmd.prepareExport(); err == nil {
+		t.Fatal("prepareExport() accepted a symlinked asset")
+	}
+}
+
+func TestPrepareExportRejectsDestinationInsideSourceAssets(t *testing.T) {
+	source := filepath.Join(t.TempDir(), "game")
+	if err := os.MkdirAll(filepath.Join(source, "assets"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	cmd := &CmdTool{
+		TargetAbsDir: source,
+		ProjectDir:   filepath.Join(source, "assets", "generated"),
+	}
+	if err := cmd.prepareExport(); err == nil {
+		t.Fatal("prepareExport() accepted a destination inside the source assets")
+	}
+}

cmd/spx/internal/command/platform.go

@@ -15,10 +15,6 @@ func executableSuffix(goos string) string {
 	return ""
 }
 
-func goBinaryName(goos string) string {
-	return "go" + executableSuffix(goos)
-}
-
 func sharedLibrarySuffix(goos string) string {
 	switch goos {
 	case goosWindows: