Fail gracefully when run inside the pub-cache (#3471)

lib/src/entrypoint.dart

diff --git a/lib/src/entrypoint.dart b/lib/src/entrypoint.dart
index d250cc0..b536cca 100644
--- a/lib/src/entrypoint.dart
+++ b/lib/src/entrypoint.dart
@@ -224,7 +224,11 @@
     bool withPubspecOverrides = true,
   })  : root = Package.load(null, rootDir, cache.sources,
             withPubspecOverrides: withPubspecOverrides),
-        globalDir = null;
+        globalDir = null {
+    if (p.isWithin(cache.rootDir, rootDir)) {
+      fail('Cannot operate on packages inside the cache.');
+    }
+  }
 
   Entrypoint.inMemory(this.root, this.cache,
       {required LockFile? lockFile, SolveResult? solveResult})

test/descriptor.dart

diff --git a/test/descriptor.dart b/test/descriptor.dart
index 9248ad4..0b11de9 100644
--- a/test/descriptor.dart
+++ b/test/descriptor.dart
@@ -188,11 +188,12 @@
 /// If [port] is passed, it's used as the port number of the local hosted server
 /// that this cache represents. It defaults to [globalServer.port].
 Descriptor hostedCache(Iterable<Descriptor> contents, {int? port}) {
-  return dir(cachePath, [
-    dir('hosted', [dir('localhost%58${port ?? globalServer.port}', contents)])
-  ]);
+  return dir(hostedCachePath(port: port), contents);
 }
 
+String hostedCachePath({int? port}) =>
+    p.join(cachePath, 'hosted', 'localhost%58${port ?? globalServer.port}');
+
 /// Describes the file that contains the client's OAuth2
 /// credentials. The URL "/token" on [server] will be used as the token
 /// endpoint for refreshing the access token.

test/get/get_inside_cache_fails_test.dart

diff --git a/test/get/get_inside_cache_fails_test.dart b/test/get/get_inside_cache_fails_test.dart
new file mode 100644
index 0000000..a7a6b45
--- /dev/null
+++ b/test/get/get_inside_cache_fails_test.dart
@@ -0,0 +1,27 @@
+// Copyright (c) 2014, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+
+import 'package:path/path.dart' as p;
+import 'package:test/test.dart';
+
+import '../descriptor.dart' as d;
+import '../test_pub.dart';
+
+void main() {
+  test('`pub get` inside the cache fails gracefully', () async {
+    final server = await servePackages();
+    server.serve('foo', '1.0.0', pubspec: {
+      'name': 'foo',
+      'version': '1.0.0',
+      'environment': {'sdk': '>=0.1.2+3 <0.2.0'}
+    });
+    await d.appDir({'foo': 'any'}).create();
+
+    await pubGet();
+
+    await pubGet(
+        workingDirectory: p.join(d.sandbox, d.hostedCachePath(), 'foo-1.0.0'),
+        error: 'Cannot operate on packages inside the cache.');
+  });
+}