@@ -36,6 +36,23 @@ describe('pangular build --outDir', () => {
     }
   });
 
+  it('treats a folder named like ..app as a child, so its parent is refused even with --force', () => {
+    const parent = fixtureDir('pangular-cli-dots-');
+    const cwd = join(parent, '..app');
+    mkdirSync(join(cwd, 'src'), { recursive: true });
+    for (const outDir of [parent, '..']) {
+      expect(() => checkReportOutDir(outDir, { cwd, force: true })).toThrow(
+        /working directory or one of its parents/,
+      );
+    }
+    expect(() =>
+      checkReportOutDir(join(cwd, 'dist-report'), { cwd: parent, invokedFrom: cwd, force: true }),
+    ).not.toThrow();
+    expect(() =>
+      checkReportOutDir(parent, { cwd: join(cwd, 'src'), invokedFrom: cwd, force: true }),
+    ).toThrow(/working directory or one of its parents/);
+  });
+
   it('sees through symlinks to the working directory and its parents, even with --force', () => {
     const root = fixtureDir('pangular-cli-link-');
     const cwd = join(root, 'workspace');
 
@@ -27,6 +27,7 @@ import { pangularMcp } from './agent-mcp.ts';
 import { PANGULAR_MCP_TOKEN_ENV, loadMcpToken } from './mcp-token.ts';
 import { registerSkillsCommand } from './skills-install.ts';
 import { registerLintCommand } from './lint-export.ts';
+import { escapes } from './rpc/source-scan.ts';
 import pkg from '../package.json' with { type: 'json' };
 
 export const PANGULAR_CONFIG_FILE = 'pangular.config.json';
@@ -55,7 +56,9 @@ export function checkReportOutDir(
   const kept = [cwd, ...(options.invokedFrom ? [canonical(resolve(options.invokedFrom))] : [])];
   const holds = (dir: string) => {
     const up = relative(target, dir);
-    return up === '' || (!up.startsWith('..') && !isAbsolute(up));
+    // Only a real `..` segment leaves the target: a folder named `..app` is inside it.
+    const leaves = escapes(up) || isAbsolute(up);
+    return up === '' || !leaves;
   };
   if (kept.some(holds)) {
     throw new Error(