fix(mcp): a symlinked workspace root contains its own files

Path membership is lexical, so a root that still carries a symlink (macOS
/tmp or /var, a symlinked home) matched none of the resolved paths checked
against it -- which silently voided the main checkout added to the
allow-list. Resolve both sides in tool_smart_edit, rich_edit._resolve and
_resolve_explicit_edit_root; the /tmp twin entry is redundant now.

Co-Authored-By: lemoncrow <302591943+lemoncrow-agent[bot]@users.noreply.github.com>
LemonCrow-Session: s1

Author: wongk

src/lemoncrow/gateway/adapters/mcp_server.py

@@ -6929,7 +6929,9 @@ def _resolve_explicit_edit_root(raw_root: str, *, workspace_root: Path, extra_ro
         return candidate
     if _linked_worktree_root(workspace_root, candidate) is not None:
         return candidate
-    if any(candidate == r or candidate.is_relative_to(r) for r in extra_roots):
+    # Resolved on both sides: an additional directory reached through a symlink
+    # (or the /tmp literal on macOS) contains nothing lexically.
+    if any(candidate == r or candidate.is_relative_to(r) for r in (extra.resolve() for extra in extra_roots)):
         return candidate
     return None
 
@@ -7851,10 +7853,9 @@ def tool_smart_edit(
     # Confine writes to the workspace root plus any additional directories from
     # Claude Code's additionalDirectories setting or LEMONCROW_ADDITIONAL_DIRS env.
     # Read tools accept any absolute path; writes need explicit opt-in.
-    # Path("/tmp").resolve() as well as "/tmp": on macOS /tmp is a symlink to
-    # /private/tmp, and the candidates below are resolved, so the bare literal
-    # never matched and the /tmp allowance was dead on that platform.
-    _extra_roots = [*_claude_additional_dirs(repo_root), Path("/tmp"), Path("/tmp").resolve()]
+    # "/tmp" needs no twin "/private/tmp" entry: _allowed_edit_roots resolves
+    # every root before comparing, so one literal covers macOS's symlink.
+    _extra_roots = [*_claude_additional_dirs(repo_root), Path("/tmp")]
     if _session_worktree is not None:
         _extra_roots.append(_session_worktree)
 
@@ -7880,7 +7881,18 @@ def tool_smart_edit(
             }
         _extra_roots.append(_explicit_root)
     _edit_root = _explicit_root or _session_worktree or repo_root
-    _allowed_edit_roots = [repo_root, _edit_root, *_extra_roots]
+    # Resolved against resolved. Touched paths arrive through
+    # _resolve_snapshot_path's .resolve(), while _workspace_root() hands back
+    # whatever the env or CLI gave it -- a macOS /tmp or /var path, a home
+    # reached through a symlink -- and is_relative_to is purely lexical, so an
+    # unresolved root lexically contains none of its own files. Compare the
+    # resolved forms; the escape error still prints the caller's own path.
+    _allowed_edit_roots = [_candidate.resolve() for _candidate in (repo_root, _edit_root, *_extra_roots)]
+    # Every later membership test below takes a RESOLVED path, so it needs the
+    # resolved root for the same reason -- under a symlinked workspace an
+    # unresolved one silently drops all hook diagnostics and every path the
+    # contract review would have read.
+    _repo_root_resolved = repo_root.resolve()
 
     # A relative path naming an existing file in BOTH the inferred worktree and
     # the workspace root has no right answer: the worktree came from another
@@ -8277,7 +8289,7 @@ def _diag_in_repo_root(d: dict[str, Any], root: Path) -> bool:
         result["diagnostics"] = [
             d
             for d in result["diagnostics"]
-            if d.get("severity") in ("error", "warning") and _diag_in_repo_root(d, repo_root)
+            if d.get("severity") in ("error", "warning") and _diag_in_repo_root(d, _repo_root_resolved)
         ]
         if not result["diagnostics"]:
             result.pop("diagnostics")
@@ -8294,7 +8306,7 @@ def _fmt_diag(d: dict[str, Any], root: Path) -> str:
                 msg = d.get("message", "")
                 return f"{loc} {code}: {msg}" if code else f"{loc}: {msg}"
 
-            _diag_lines = [_fmt_diag(d, repo_root) for d in result.pop("diagnostics")]
+            _diag_lines = [_fmt_diag(d, _repo_root_resolved) for d in result.pop("diagnostics")]
             # Cap: a touched file with many pre-existing findings must not dump
             # an unbounded lint report into the edit result.
             if len(_diag_lines) > _EDIT_DIAG_CAP:
@@ -8340,7 +8352,9 @@ def _fmt_diag(d: dict[str, Any], root: Path) -> str:
             result,
             edits,
             repo_root=repo_root,
-            touched_paths=[str(p.relative_to(repo_root)) for p in paths.values() if p.is_relative_to(repo_root)],
+            touched_paths=[
+                str(p.relative_to(_repo_root_resolved)) for p in paths.values() if p.is_relative_to(_repo_root_resolved)
+            ],
         )
         _phase_contract_ms = int((time.monotonic() - _contract_start) * 1000)
         # Incremental: refresh the shared index for the touched files now, so a

src/lemoncrow/pro/capabilities/tool_supervision/rich_edit.py

@@ -137,7 +137,11 @@ def _resolve(root: Path, raw_path: str, allowed_roots: list[Path] | None = None)
     path = Path(spec.path)
     resolved = path if path.is_absolute() else root / path
     resolved = resolved.resolve()
-    roots = [root, *(allowed_roots or [])]
+    # `resolved` is resolved, so the roots must be too: is_relative_to is
+    # lexical, and a root carrying a symlink (macOS /tmp, /var, a symlinked
+    # home) lexically contains none of its own files. The message below still
+    # names `root` as the caller passed it.
+    roots = [Path(r).resolve() for r in (root, *(allowed_roots or []))]
     if not any(resolved == r or resolved.is_relative_to(r) for r in roots):
         raise ValueError(
             f"path escape denied: {raw_path} is outside the workspace root {root} — "

tests/gateway/test_edit_mcp_handler.py

@@ -1563,6 +1563,36 @@ def test_absolute_main_checkout_path_survives_a_worktree_inference(
     assert target.read_text(encoding="utf-8") == "EDITED\n"
 
 
+def test_absolute_edit_under_a_symlinked_workspace_root_is_not_an_escape(
+    workspace: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """A workspace reached through a symlink still contains its own files.
+
+    Touched paths come back resolved, while the workspace root arrives however
+    the env handed it over -- and ``is_relative_to`` is lexical, so an
+    unresolved root lexically contains none of its own files. On macOS every
+    workspace under /tmp or /var reaches the handler this way.
+    """
+    real = workspace / "real"
+    real.mkdir()
+    link = workspace / "link"
+    link.symlink_to(real, target_is_directory=True)
+    monkeypatch.setenv("CLAUDE_WORKSPACE_ROOT", str(link))
+    wt = _repo_with_worktree(real)
+    monkeypatch.setattr(mcp_server, "_last_session_cwd", str(wt))
+    (link / "main_only.txt").write_text("MAIN\n", encoding="utf-8")
+
+    payload = _edit(
+        {
+            "post_edit_hooks": False,
+            "edits": [{"file_path": str(link / "main_only.txt"), "old_string": "MAIN", "new_string": "EDITED"}],
+        }
+    )
+
+    assert "failed" not in payload, payload
+    assert (real / "main_only.txt").read_text(encoding="utf-8") == "EDITED\n"
+
+
 def test_bash_cwd_is_what_teaches_edit_where_the_session_is(monkeypatch: pytest.MonkeyPatch) -> None:
     """Only a bash call's cwd is recorded -- it is the sole session-cwd signal."""
     monkeypatch.setattr(mcp_server, "_last_session_cwd", None)