Canonicalize cwd in write-path allowlist compare

Author: TheGreatAxios

src/permission/path-restriction.ts

@@ -44,7 +44,7 @@ function realpathOr(path: string): string {
 // the raw (possibly symlink-relative) path, which would defeat containment
 // checks whenever the workspace root itself is reached through a symlink
 // (e.g. macOS's /tmp -> /private/tmp).
-function realpathNearestOr(path: string): string {
+export function realpathNearestOr(path: string): string {
   try {
     return realpathSync(path);
   } catch {

src/permission/write-path-policy.test.ts

@@ -1,5 +1,7 @@
 import { describe, expect, test } from "bun:test";
-import { resolve } from "node:path";
+import { mkdtempSync, realpathSync, rmSync, symlinkSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
 import {
   matchesWritePathAllowlist,
   writePathDeniedReason,
@@ -58,6 +60,39 @@ describe("matchesWritePathAllowlist", () => {
   });
 });
 
+describe("matchesWritePathAllowlist with a symlinked cwd", () => {
+  test("allows a write under the canonical target of a symlinked cwd", () => {
+    // Mirrors macOS's /tmp -> /private/tmp: cwd is spelled via the symlink,
+    // but resolveWorkspacePath (and any tool arg it rewrites) hands the
+    // subject in already realpathed. Both sides of the compare must
+    // canonicalize the same way or a legitimate write is hard-denied.
+    const real = mkdtempSync(join(realpathSync(tmpdir()), "write-path-real-"));
+    const linkDir = join(realpathSync(tmpdir()), `write-path-link-${process.pid}`);
+    try {
+      symlinkSync(real, linkDir);
+      const symlinkedCwd = linkDir; // lexically distinct from `real`
+      const canonicalSubject = join(real, "docs", "a.md"); // already realpathed
+
+      expect(
+        matchesWritePathAllowlist(canonicalSubject, ["docs/*"], symlinkedCwd),
+      ).toBe(true);
+
+      // A genuinely outside path is still denied.
+      const outsideReal = mkdtempSync(join(realpathSync(tmpdir()), "write-path-outside-"));
+      try {
+        expect(
+          matchesWritePathAllowlist(join(outsideReal, "docs", "a.md"), ["docs/*"], symlinkedCwd),
+        ).toBe(false);
+      } finally {
+        rmSync(outsideReal, { recursive: true, force: true });
+      }
+    } finally {
+      rmSync(linkDir, { force: true });
+      rmSync(real, { recursive: true, force: true });
+    }
+  });
+});
+
 describe("writePathDeniedReason", () => {
   test("names allowlist and subject", () => {
     const reason = writePathDeniedReason("src/x.ts", ["PRODUCT.md", "docs/*"]);

src/permission/write-path-policy.ts

@@ -1,5 +1,6 @@
 import { resolve, sep } from "node:path";
 import { matchesPattern } from "./matcher.js";
+import { realpathNearestOr } from "./path-restriction.js";
 
 /**
  * Director write-path allowlist (authz, not prompt policy).
@@ -29,8 +30,12 @@ export function matchesWritePathAllowlist(
   if (allowlist.length === 0) return false;
   if (subject.length === 0) return false;
 
-  const absCwd = resolve(cwd);
-  const abs = resolve(cwd, subject);
+  // Canonicalize both sides the same way path-restriction does: a symlinked
+  // cwd (e.g. macOS /tmp -> /private/tmp) must not desync from a subject
+  // already resolved to its realpath by resolveWorkspacePath, which would
+  // otherwise hard-deny a legitimate allowlisted write.
+  const absCwd = realpathNearestOr(resolve(cwd));
+  const abs = realpathNearestOr(resolve(cwd, subject));
   let rel: string;
   if (abs === absCwd) {
     rel = ".";

src/plugins/path-escape-plugin.test.ts

@@ -1,6 +1,6 @@
 import { describe, test, expect, beforeEach, afterEach } from "bun:test";
-import { mkdir, mkdtemp, rm, symlink } from "node:fs/promises";
-import { realpathSync } from "node:fs";
+import { mkdir, mkdtemp, readFile, rm, symlink, writeFile } from "node:fs/promises";
+import { existsSync, realpathSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
@@ -220,6 +220,13 @@ describe("pathEscapePlugin", () => {
       await rm(link);
       await symlink(outside, link);
       expect(args.path).not.toContain(outside);
+
+      // A real writer using the resolved path lands the bytes at the
+      // canonical (safe) location, never under the retargeted symlink.
+      await writeFile(args.path, "hi");
+      expect(await readFile(args.path, "utf8")).toBe("hi");
+      expect(existsSync(join(outside, "note.txt"))).toBe(false);
+
       await rm(outside, { recursive: true, force: true });
     });
   });