fix: add validation for outside project dir

Author: soridalac

messages/retrieve.start.md

@@ -204,3 +204,7 @@ This command expects the org to support source tracking. If it doesn't, you must
 
 Starting in December 2025, this command will require that the target org use source tracking.
 Specifically, to use this command with a production org, scratch org created with the `--no-track-source` flag, or other non-source-tracking org, you must specify the metadata you want to retrieve with either the `--metadata`, `--source-dir`, or `--manifest` flag.
+
+# outputDirOutsideProject
+
+The output directory must be inside the current project. The path relative you provided %s is outside the project root.

src/commands/project/retrieve/start.ts

@@ -15,7 +15,7 @@
  */
 
 import { rm } from 'node:fs/promises';
-import { dirname, join, resolve, sep } from 'node:path';
+import { dirname, join, relative, resolve, sep } from 'node:path';
 import * as fs from 'node:fs';
 
 import { MultiStageOutput } from '@oclif/multi-stage-output';
@@ -204,6 +204,16 @@ export default class RetrieveMetadata extends SfCommand<RetrieveResultJson> {
       if (SfProject.getInstance()?.getPackageNameFromPath(resolvedTargetDir)) {
         throw messages.createError('retrieveTargetDirOverlapsPackage', [flags['output-dir']]);
       }
+
+      // Ensure --output-dir is inside the current project directory
+      const project = await getOptionalProject();
+      if (project) {
+        const rel = relative(project.getPath(), resolvedTargetDir);
+        if (rel.startsWith('..')) {
+          // resolvedTargetDir is outside the project path
+          throw messages.createError('outputDirOutsideProject', [flags['output-dir']]);
+        }
+      }
     }
     const format = flags['target-metadata-dir'] ? 'metadata' : 'source';
     const zipFileName = flags['zip-file-name'] ?? DEFAULT_ZIP_FILE_NAME;