Deny dangling symlink components in nearest-realpath walks

realpathNearestOr treated a realpath failure as an always-missing tail
and rejoined the raw component name, so a dangling symlink under cwd
whose target didn't exist yet was reattached as a normal path segment
and read as in-bounds. Now lstat distinguishes "doesn't exist at all"
(safe, missing tail) from "exists but unresolvable" (dangling link or
symlink loop), and the latter denies via resolveWorkspacePath/underRoot.

Author: TheGreatAxios

src/permission/path-restriction.ts

@@ -1,4 +1,4 @@
-import { realpathSync } from "node:fs";
+import { lstatSync, realpathSync } from "node:fs";
 import { dirname, join, resolve, sep } from "node:path";
 import { homedir } from "node:os";
 import type { RootsProvider } from "./worktree-roots.js";
@@ -39,22 +39,46 @@ function realpathOr(path: string): string {
   }
 }
 
+// Sentinel returned by realpathNearestOr for a path that exists but couldn't
+// be resolved (a dangling symlink, or a symlink loop) rather than one that's
+// simply missing. Contains a NUL byte, which can never appear in a real
+// filesystem path, so it can't collide with (or be mistaken for a prefix of)
+// any genuine result, and every containment compare against it fails.
+const UNRESOLVABLE = "\0unresolvable\0";
+
 // A write/edit target usually doesn't exist yet, so realpath the nearest
 // existing ancestor and rejoin the missing tail rather than falling back to
 // the raw (possibly symlink-relative) path, which would defeat containment
 // checks whenever the workspace root itself is reached through a symlink
 // (e.g. macOS's /tmp -> /private/tmp).
+//
+// realpath failure is ambiguous: it's either "this component doesn't exist
+// yet" (safe — the missing tail gets rejoined onto the nearest real ancestor)
+// or "this component exists but is a dangling symlink / symlink loop" (unsafe
+// — the link's name must not stand in for a normal under-cwd path segment,
+// since the walk otherwise reattaches it verbatim and containment sees a
+// plain child path with no idea a symlink is involved). lstat distinguishes
+// the two: it succeeds for an existing-but-broken symlink and fails only when
+// the component is genuinely absent.
 export function realpathNearestOr(path: string): string {
   try {
     return realpathSync(path);
   } catch {
+    try {
+      lstatSync(path);
+      return UNRESOLVABLE;
+    } catch {
+      // Doesn't exist at all — fall through to the nearest-ancestor walk.
+    }
     const parent = dirname(path);
     if (parent === path) return path;
     // Root (e.g. "/") already ends in the separator, so slicing past
     // parent.length alone lands on the tail; anywhere else the separator
     // between parent and tail must be skipped too.
     const tailStart = parent.endsWith(sep) ? parent.length : parent.length + 1;
-    return join(realpathNearestOr(parent), path.slice(tailStart));
+    const parentReal = realpathNearestOr(parent);
+    if (parentReal === UNRESOLVABLE) return UNRESOLVABLE;
+    return join(parentReal, path.slice(tailStart));
   }
 }
 
@@ -93,6 +117,7 @@ export function resolveWorkspacePath(
   const abs = resolve(cwd, path);
   const realCwd = realpathOr(resolve(cwd));
   const real = realpathNearestOr(abs);
+  if (real === UNRESOLVABLE) return undefined;
   if (real === realCwd || real.startsWith(realCwd + sep)) return real;
   if (inKnownRoots(real, rootsProvider())) return real;
   if (inKnownRoots(real, rootsProvider(true))) return real;
@@ -139,6 +164,7 @@ function underRoot(abs: string, root: string): boolean {
   // unresolved while the abs path is rebuilt through an existing ancestor).
   const realRoot = realpathNearestOr(root);
   const realAbs = realpathNearestOr(abs);
+  if (realRoot === UNRESOLVABLE || realAbs === UNRESOLVABLE) return false;
   return realAbs === realRoot || realAbs.startsWith(realRoot + sep);
 }
 

src/permission/workspace-containment.test.ts

@@ -92,6 +92,30 @@ test("a symlink pointing outside the workspace is refused, even for a not-yet-ex
   expect(restricted).toBe(true);
 });
 
+test("a dangling symlink under cwd pointing outside denies a child path, and stays denied after the outside target is created (CL-6715)", async () => {
+  // The symlink target does not exist yet, so realpath fails on the link
+  // itself (not just on the not-yet-existing child) — the walk must not
+  // treat the dangling link's name as an ordinary missing tail segment.
+  const rootsProvider = () => [];
+  const link = join(cwd, "dangling-link");
+  const outsideTarget = join(outside, "not-created-yet");
+  await symlink(outsideTarget, link);
+  const target = join(link, "child.txt");
+
+  expect(resolveWorkspacePath(cwd, join("dangling-link", "child.txt"), rootsProvider)).toBeUndefined();
+
+  const restriction = createPathRestriction(cwd, rootsProvider, home);
+  expect(restriction.isRestricted(target, false)).toBe(true);
+  expect(restriction.isRestricted(target, true)).toBe(true);
+
+  // A race that creates the outside target between check and open must not
+  // retroactively legitimize the earlier check, and a fresh check afterward
+  // must still deny (the link still ultimately points outside the workspace).
+  await mkdir(outsideTarget, { recursive: true });
+  await writeFile(join(outsideTarget, "child.txt"), "s");
+  expect(resolveWorkspacePath(cwd, join("dangling-link", "child.txt"), rootsProvider)).toBeUndefined();
+});
+
 test("resolveWorkspacePath returns the canonical target so a later symlink retarget cannot redirect a write (CL-6712 TOCTOU)", async () => {
   // A symlink that is in-bounds at check time (target -> inside cwd) must
   // resolve to the canonical real path, not the lexical path through the