mosaicstack/stack
1
0
Fork 1
Code Issues 246 Pull Requests 7 Actions Packages Projects Releases 15 Wiki Activity

Make workspace placement enforcement atomic against symlink replacement #1199

New Issue
Open
opened 2026-08-13 11:44:25 +00:00 by coder2 · 0 comments
coder2 commented 2026-08-13 11:44:25 +00:00
Collaborator
Copy Link
Copy Source

Problem

wrapper-guard.sh is a Bash PreToolUse text guard. It can canonicalize the current longest existing parent of a git clone / git worktree add placement, but inspection occurs before the reviewed shell command executes.

A single approved command can deterministically mutate a destination parent before Git uses it, for example by redirecting a previously safe symlink into $HOME and then checking out through that link. Existing symlink aliases are now resolved in PR #1174, but no pre-execution path check can atomically prevent replacement after inspection.

Required outcome

Move authoritative workspace-placement enforcement adjacent to the filesystem mutation path, or provide an equivalent atomic mechanism:

  • canonicalize/open/create destination parents without following unsafe links;
  • use descriptor-relative/no-follow resolution where supported;
  • invoke Git only after the destination invariant is secured;
  • retain the PreToolUse guard as defense in depth and useful error guidance;
  • test existing symlink aliases, symlink replacement, and symlink-plus-parent traversal.

Context

Found by independent security review of PR #1174. The current hook documents this TOCTOU residual and resolves existing aliases, repeated separators, and dot segments. This issue is the architectural closure; relative cwd-dependent destinations remain separately tracked by #1197.

## Problem `wrapper-guard.sh` is a Bash PreToolUse text guard. It can canonicalize the current longest existing parent of a `git clone` / `git worktree add` placement, but inspection occurs before the reviewed shell command executes. A single approved command can deterministically mutate a destination parent before Git uses it, for example by redirecting a previously safe symlink into `$HOME` and then checking out through that link. Existing symlink aliases are now resolved in PR #1174, but no pre-execution path check can atomically prevent replacement after inspection. ## Required outcome Move authoritative workspace-placement enforcement adjacent to the filesystem mutation path, or provide an equivalent atomic mechanism: - canonicalize/open/create destination parents without following unsafe links; - use descriptor-relative/no-follow resolution where supported; - invoke Git only after the destination invariant is secured; - retain the PreToolUse guard as defense in depth and useful error guidance; - test existing symlink aliases, symlink replacement, and symlink-plus-parent traversal. ## Context Found by independent security review of PR #1174. The current hook documents this TOCTOU residual and resolves existing aliases, repeated separators, and dot segments. This issue is the architectural closure; relative cwd-dependent destinations remain separately tracked by #1197.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
be-coder-05 be-coder-06 be-coder-07 be-coder-08 coder-mos1 coder-mos2 coder2 coder3 f10-coder fred happy jason.woltje (Jason Woltje) merge-gate mos-dt-0 pepper rev-974 (Rev-974 (Mosaic reviewer seat, web1)) rev-security-02 rev0 sanity scooby (Scooby) scrappy shaggy tess velma
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1199