fix(permission): resolve ENOTDIR paths like realpathSync

lstat of sub/link/../file throws ENOTDIR when link points at a file.
Walking that failure joined .. onto the file and returned the cwd file
instead of the realpathSync result. ENOTDIR now follows realpathSync
when that succeeds, and still walks when the tail is missing.

A failed lstat of a relative path is no longer stored under the key
path.resolve collapses . or .. onto. sub/link/. was remembered as
absent for sub/link, so the symlink resolved in-tree and
sub/link/./missing missed the target. Resolved paths are still not
reused across calls.

Author: TheGreatAxios

src/permission/path-restriction.ts

@@ -3,7 +3,11 @@ import { dirname, join, resolve, sep } from "node:path";
 import { homedir } from "node:os";
 import { realpathOrOriginal, type RootsProvider } from "./worktree-roots.js";
 import { projectSessionsRoot } from "../session/project-key.js";
-import { enterPathResolution, lstatMemoized } from "./realpath-cache.js";
+import {
+  enterPathResolution,
+  lstatFailureCode,
+  lstatMemoized,
+} from "./realpath-cache.js";
 
 // Paths the agent must not touch without explicit operator approval, even
 // though read tools are otherwise allow-tier and write/edit auto-allow in
@@ -61,6 +65,15 @@ function resolveNearest(path: string): string {
     return realpathOrUnresolvable(path);
   }
 
+  // ENOTDIR is not absence. `sub/link/../file` lstats as ENOTDIR when `link` is
+  // a symlink to a file, and the missing-tail walk then joins `..` onto that
+  // file (landing on `<cwd>/file`). realpathSync still resolves it to `sub/file`.
+  // When realpath also fails (a missing name under that component), keep walking.
+  if (lstatFailureCode(path) === "ENOTDIR") {
+    const real = realpathOrUnresolvable(path);
+    if (real !== UNRESOLVABLE) return real;
+  }
+
   const parent = dirname(path);
   if (parent === path) return path;
   const parentReal = resolveNearest(parent);

src/permission/realpath-cache.test.ts

@@ -58,6 +58,41 @@ test("a relative single-segment path is not sliced when its dirname is dot", ()
   expect(resolved.endsWith(`${sep}cret.pem`)).toBe(false);
 });
 
+test("dotdot through a symlink to a file matches realpathSync", async () => {
+  scratch = await mkdtemp(join(tmpdir(), "corbits-realpath-dotdot-"));
+  const sub = join(scratch, "sub");
+  await mkdir(sub);
+  await writeFile(join(scratch, "outside-target"), "t");
+  await writeFile(join(sub, "file"), "f");
+  await symlink(join(scratch, "outside-target"), join(sub, "link"));
+  const through = `${join(sub, "link")}${sep}..${sep}file`;
+  const canonical = realpathSync(through);
+  expect(canonical).toBe(realpathSync(join(sub, "file")));
+  expect(realpathNearestOr(through)).toBe(canonical);
+  expect(realpathNearestOr(through)).not.toBe(
+    join(realpathSync(scratch), "file"),
+  );
+});
+
+test("a failed dot lstat is not reused for the symlink it collapses onto", async () => {
+  scratch = await mkdtemp(join(tmpdir(), "corbits-realpath-dot-"));
+  const sub = join(scratch, "sub");
+  await mkdir(sub);
+  const outside = join(scratch, "outside-target");
+  await writeFile(outside, "t");
+  await symlink(outside, join(sub, "link"));
+  const previous = process.cwd();
+  process.chdir(scratch);
+  try {
+    expect(realpathNearestOr("sub/link/.")).toBe(realpathSync("sub/link/."));
+    expect(realpathNearestOr("sub/link/./missing")).toBe(
+      join(realpathSync(outside), "missing"),
+    );
+  } finally {
+    process.chdir(previous);
+  }
+});
+
 test("a later check of the same path lstats and realpaths again", async () => {
   scratch = await mkdtemp(join(tmpdir(), "corbits-realpath-once-"));
   const ancestorA = join(scratch, "a");

src/permission/realpath-cache.ts

@@ -1,12 +1,17 @@
 import { lstatSync, statSync, type Stats } from "node:fs";
-import { isAbsolute, resolve } from "node:path";
+import { isAbsolute, resolve, sep } from "node:path";
 
 // lstat results for one synchronous containment check (or one shell cwd
 // resolve plus its usability stat). A resolved real path is never stored:
 // the next tool call must walk again, because a symlink target can move
 // without changing the link text or the leaf inode.
 let depth = 0;
-let lstatMemo: Map<string, Stats | undefined> | undefined;
+let lstatMemo: Map<string, LstatMemoEntry> | undefined;
+
+type LstatMemoEntry = {
+  stats: Stats | undefined;
+  code: string | undefined;
+};
 
 export function enterPathResolution<T>(fn: () => T): T {
   const top = depth === 0;
@@ -24,18 +29,53 @@ function cacheKey(path: string): string {
   return isAbsolute(path) ? path : resolve(path);
 }
 
-export function lstatMemoized(path: string): Stats | undefined {
+// `path.resolve` drops `.` and `..`, so `sub/link/.` and `sub/link` share a key.
+// A failed lstat of the dotted path is not "absent" for the symlink it collapses
+// onto (`..` through a symlink is a different node than the lexical parent).
+function failureCollapsesOntoAnotherPath(path: string): boolean {
+  if (isAbsolute(path)) return false;
+  for (const segment of path.split(sep)) {
+    if (segment === "." || segment === "..") return true;
+  }
+  return false;
+}
+
+function errorCode(error: unknown): string | undefined {
+  if (typeof error !== "object" || error === null || !("code" in error)) {
+    return undefined;
+  }
+  return typeof error.code === "string" ? error.code : undefined;
+}
+
+function readLstat(path: string): LstatMemoEntry {
   const key = cacheKey(path);
   const memo = lstatMemo;
-  if (memo !== undefined && memo.has(key)) return memo.get(key);
-  let st: Stats | undefined;
+  const cached = memo?.get(key);
+  if (cached !== undefined) return cached;
+  let entry: LstatMemoEntry;
   try {
-    st = lstatSync(path);
-  } catch {
-    st = undefined;
+    entry = { stats: lstatSync(path), code: undefined };
+  } catch (error) {
+    entry = { stats: undefined, code: errorCode(error) };
+  }
+  if (
+    memo !== undefined &&
+    !(entry.stats === undefined && failureCollapsesOntoAnotherPath(path))
+  ) {
+    memo.set(key, entry);
   }
-  memo?.set(key, st);
-  return st;
+  return entry;
+}
+
+export function lstatMemoized(path: string): Stats | undefined {
+  return readLstat(path).stats;
+}
+
+// `code` is set only when lstat threw. ENOTDIR is not a missing path: the
+// component exists but is not a directory (a symlink to a file, then `.` or `..`).
+export function lstatFailureCode(path: string): string | undefined {
+  const entry = readLstat(path);
+  return entry.stats === undefined ? entry.code : undefined;
 }
 
 /**