mosaicstack/stack
21
0
Fork 1
Code Issues 336 Pull Requests 13 Actions Packages Projects Releases 15 Wiki Activity

fix(fleet): resolve-then-validate symlink guard + framework helper resolution (#1380) (#1383)
ci/woodpecker/push/publish Pipeline failed
Details

Browse Source 
Co-authored-by: code-be-01 <[email protected]>
This commit was merged in pull request #1383.
This commit is contained in:
code-be-01
2026-08-24 19:39:13 +00:00
committed by orch-01
parent 9014a510a9
commit 8eb7e6354e
6 changed files with 505 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/mosaic/src/runtime/update-checker.reseed.spec.ts
+7 -2
View File
@@ -168,7 +168,9 @@ describe('repairFleetCommsTools', () => {
const result = repairFleetCommsTools(framework, home);
expect(result).toMatchObject({ ok: false, changed: false });
expect(result.reason).toContain('symbolic link');
// stack#1380: resolve-then-validate — an escaping symlink is still
// refused, with the new escape diagnostic.
expect(result.reason).toContain('symlink target escapes managed roots');
expect(readFileSync(target, 'utf8')).toBe('do not touch\n');
expect(lstatSync(join(home, 'tools', 'tmux', 'agent-send.sh')).isSymbolicLink()).toBe(true);
});
@@ -222,7 +224,10 @@ describe('repairFleetCommsTools', () => {
const result = repairFleetCommsTools(framework, targetHome);
expect(result, testCase.name).toMatchObject({ ok: false, changed: false });
expect(result.reason, testCase.name).toContain('symbolic link');
// stack#1380: escaping ancestor symlinks stay refused. The home case is
// caught by the managed-root guard ('is a symbolic link'); deeper
// components by resolve-then-validate ('symlink target escapes').
expect(result.reason, testCase.name).toMatch(/symbolic link|symlink target escapes/);
expect(readdirSync(external), testCase.name).toEqual([]);
}
});