fix(permission): drop the cross-call realpath cache

A symlink target can move without changing the link text or the leaf
inode, and stamping only lexical ancestors misses the directory behind
the link. Resolved paths are no longer reused across tool calls. lstat
results live only for the current synchronous check.

Author: TheGreatAxios

src/permission/path-restriction.ts

@@ -3,15 +3,7 @@ import { dirname, join, resolve, sep } from "node:path";
 import { homedir } from "node:os";
 import { realpathOrOriginal, type RootsProvider } from "./worktree-roots.js";
 import { projectSessionsRoot } from "../session/project-key.js";
-import {
-  cachedLinkReal,
-  cachedNodeReal,
-  enterPathResolution,
-  lstatMemoized,
-  readlinkMemoized,
-  rememberLink,
-  rememberNode,
-} from "./realpath-cache.js";
+import { enterPathResolution, lstatMemoized } from "./realpath-cache.js";
 
 // Paths the agent must not touch without explicit operator approval, even
 // though read tools are otherwise allow-tier and write/edit auto-allow in
@@ -41,7 +33,7 @@ const LEGACY_STATE_DIR = ".agent-state";
 export const UNRESOLVABLE = "\0unresolvable\0";
 
 // A single normal path segment. `.`, `..`, a trailing slash, or an empty tail
-// stay on realpathSync so the cached join cannot diverge from the kernel.
+// stay on realpathSync so the join cannot diverge from the kernel.
 function existingTail(path: string, parent: string): string | undefined {
   const tailStart = parent.endsWith(sep) ? parent.length : parent.length + 1;
   const tail = path.slice(tailStart);
@@ -56,14 +48,9 @@ function existingTail(path: string, parent: string): string | undefined {
   return tail;
 }
 
-function rememberRealpath(
-  path: string,
-  st: NonNullable<ReturnType<typeof lstatMemoized>>,
-): string {
+function realpathOrUnresolvable(path: string): string {
   try {
-    const real = realpathSync(path);
-    rememberNode(path, st, real);
-    return real;
+    return realpathSync(path);
   } catch {
     return UNRESOLVABLE;
   }
@@ -72,32 +59,17 @@ function rememberRealpath(
 function resolveNearest(path: string): string {
   const st = lstatMemoized(path);
   if (st !== undefined && !st.isSymbolicLink()) {
-    const hit = cachedNodeReal(path, st);
-    if (hit !== undefined) return hit;
     const parent = dirname(path);
-    if (parent === path) return rememberRealpath(path, st);
+    if (parent === path) return realpathOrUnresolvable(path);
     const tail = existingTail(path, parent);
-    if (tail === undefined) return rememberRealpath(path, st);
+    if (tail === undefined) return realpathOrUnresolvable(path);
     const parentReal = resolveNearest(parent);
     if (parentReal === UNRESOLVABLE) return UNRESOLVABLE;
-    const real = join(parentReal, tail);
-    rememberNode(path, st, real);
-    return real;
+    return join(parentReal, tail);
   }
 
   if (st !== undefined && st.isSymbolicLink()) {
-    const linkTarget = readlinkMemoized(path);
-    if (linkTarget !== undefined) {
-      const hit = cachedLinkReal(path, st, linkTarget);
-      if (hit !== undefined) return hit;
-    }
-    try {
-      const real = realpathSync(path);
-      if (linkTarget !== undefined) rememberLink(path, st, linkTarget, real);
-      return real;
-    } catch {
-      return UNRESOLVABLE;
-    }
+    return realpathOrUnresolvable(path);
   }
 
   const parent = dirname(path);
@@ -122,9 +94,8 @@ function resolveNearest(path: string): string {
 // distinguishes the two: it succeeds for an existing-but-broken symlink and
 // fails only when the component is genuinely absent.
 //
-// Already-resolved ancestors are memoized across calls only while each
-// ancestor keeps the dev/ino (and symlink text) stored with the entry. The
-// check stays synchronous.
+// lstat results are shared only for the duration of this synchronous check.
+// A resolved path is not reused on a later tool call.
 export function realpathNearestOr(path: string): string {
   return enterPathResolution(() => resolveNearest(path));
 }

src/permission/realpath-cache.test.ts

@@ -24,7 +24,7 @@ afterEach(async () => {
   }
 });
 
-test("an unchanged path skips realpath but rechecks every ancestor", async () => {
+test("a later check of the same path lstats and realpaths again", async () => {
   scratch = await mkdtemp(join(tmpdir(), "corbits-realpath-once-"));
   const ancestorA = join(scratch, "a");
   const ancestorB = join(ancestorA, "b");
@@ -54,8 +54,9 @@ test("an unchanged path skips realpath but rechecks every ancestor", async () =>
       expect(realpathNearestOr(file)).toBe(canonical);
       const lstatAfterFirst = new Map(lstatCounts);
       const realpathAfterFirst = realpathCalls;
+      expect(realpathAfterFirst).toBeGreaterThan(0);
       expect(realpathNearestOr(file)).toBe(canonical);
-      expect(realpathCalls).toBe(realpathAfterFirst);
+      expect(realpathCalls).toBeGreaterThan(realpathAfterFirst);
       for (const ancestor of [scratch, ancestorA, ancestorB]) {
         expect(lstatAfterFirst.get(ancestor)).toBe(1);
         expect(lstatCounts.get(ancestor)).toBe(2);
@@ -170,3 +171,39 @@ test("renaming an ancestor and replacing it with a symlink does not keep the old
     }),
   ).toBe(outsideDir);
 });
+
+test("a symlink target tree moved out from behind an unchanged link is not served as the old real path", async () => {
+  // jail/link → inner/sub. Lexical stamps of the link do not include jail/inner.
+  // Moving that directory and symlinking it back keeps the link text and the
+  // leaf inode, so a cached link real path must not be reused or joined onto
+  // a child that was never resolved.
+  scratch = await mkdtemp(join(tmpdir(), "corbits-realpath-behind-"));
+  const jail = join(scratch, "jail");
+  const outside = join(scratch, "outside");
+  const inner = join(jail, "inner");
+  const sub = join(inner, "sub");
+  const file = join(sub, "file.txt");
+  await mkdir(sub, { recursive: true });
+  await mkdir(outside);
+  await writeFile(file, "x");
+  const link = join(jail, "link");
+  await symlink(join("inner", "sub"), link);
+
+  expect(realpathNearestOr(link)).toBe(realpathSync(sub));
+
+  const moved = join(outside, "inner");
+  await rename(inner, moved);
+  await symlink(moved, inner);
+
+  const outsideSub = realpathSync(link);
+  const outsideFile = realpathSync(join(link, "file.txt"));
+  expect(outsideSub).toBe(realpathSync(join(moved, "sub")));
+  expect(realpathNearestOr(link)).toBe(outsideSub);
+  expect(realpathNearestOr(join(link, "file.txt"))).toBe(outsideFile);
+  expect(() => resolvePerCallShellCwd(jail, "link")).toThrow(
+    /outside the session workspace/,
+  );
+  expect(
+    resolvePerCallShellCwd(jail, "link", { allowOutsideSession: true }),
+  ).toBe(outsideSub);
+});