Spot the bug in the MCP source reader

import { readFile } from "node:fs/promises";
import { resolve } from "node:path";

const SOURCE_ROOT = "/srv/project/src";

export async function readSource(args) {
  const fullPath = resolve(SOURCE_ROOT, args.path);
  if (!fullPath.startsWith(SOURCE_ROOT)) {
    return { isError: true, message: "outside source root" };
  }
  const text = await readFile(fullPath, "utf8");
  return {
    isError: false,
    content: [{ type: "text", text }],
  };
}