Reject symlinked Git object storage before history reads

Author: mchwang

README.md

@@ -43,7 +43,8 @@ Inputs such as `planText` and the ledger must come from the caller. The future `
 
 ## Current limits and safety
 
-- History must be linear and descend from the requested base. Merge histories are rejected with a rebase instruction; repositories using object alternates are rejected. Reads are bounded to 500 commits, 32 MiB per Git response, 64 MiB of unique blob bytes across the history (callers may lower `maxBlobBytes`), and a 2-second budget per line diff; oversized work fails explicitly.
+- History must be linear and descend from the requested base. Merge histories are rejected with a rebase instruction; repositories using object alternates or symlinked object storage are rejected (storage inspection is limited to 100,000 entries). Reads are bounded to 500 commits, 32 MiB per Git response, 64 MiB of unique blob bytes across the history (callers may lower `maxBlobBytes`), and a 2-second budget per line diff; oversized work fails explicitly.
+- Object storage must remain unchanged during a read; these library checks do not isolate a concurrently hostile filesystem.
 - Ownership uses line diffs, not semantic inference. Within one replacement block, new lines inherit all affected owners conservatively. Function context comes from Git hunk headers, not an AST.
 - The importer requires an accurate base-file list. It rejects path traversal, Git metadata paths, and traversal through a listed file/symlink/submodule. Runtime symlink and write-scope enforcement belong to the future container/runner; plan validation alone is not a sandbox.
 - Allowed commands restrict accidents, not hostile programs or changed scripts. Parsing returns argv and never executes it. An unlisted valid command is a warning and must not run until allowed.

docs/implementation/build-step-1.md

@@ -51,6 +51,10 @@ Declined adding rename-only ownership to later text edits. The approved design r
 
 Fixed unbounded accumulation of unique blobs across a history. The adapter checks object size before loading it and enforces a cumulative 64 MiB byte budget; callers can choose a smaller positive limit. A small-budget fixture failed before the fix, then passed with explicit rejection below the required total and success at the exact total. Repeated references to the same blob do not count twice.
 
+## Review round 6
+
+Fixed symlinked object storage bypassing the alternates check. Root, loose-directory, and pack-directory symlink regressions all reproduced the problem. The adapter now inspects the object store without following symlinks, rejects links at any depth, and bounds inspection to 100,000 entries before resolving commits. The caller must keep storage stable during reads; concurrent filesystem isolation belongs to the runner.
+
 ## Remaining gates
 
 This is a working foundation, not a completed application or a claim that all implementation tasks are done. T18's pure validation/edit core is present; its agent adapters, import UI, and persistence are pending. Ledger storage, rebase mappings, and the read-only review screen remain next. The already-fixed GitHub check belongs to the later GitHub/runner integration.

git/history.ts

@@ -1,6 +1,6 @@
 import { execFileSync } from 'node:child_process';
-import { lstatSync } from 'node:fs';
-import { resolve as resolvePath } from 'node:path';
+import { lstatSync, readdirSync } from 'node:fs';
+import { resolve as resolvePath, join } from 'node:path';
 import type { FileDelta, FileVersion, History } from '../core/linking.ts';
 
 /** Read-only Git adapter. Never follows working-tree symlinks or runs diff helpers. */
@@ -16,7 +16,21 @@ export function readHistory(repo: string, baseRef: string, headRef = 'HEAD', lim
       GIT_NO_LAZY_FETCH: '1', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' },
     stdio: ['ignore', 'pipe', 'pipe'],
   });
-  const alternates = resolvePath(repo, run('rev-parse', '--git-path', 'objects/info/alternates').toString().trim());
+  // Inspect storage without following links before any object-resolving command.
+  const objects = resolvePath(repo, run('rev-parse', '--git-path', 'objects').toString().trim());
+  const pending = [objects];
+  let inspected = 0;
+  while (pending.length) {
+    const path = pending.pop()!;
+    if (++inspected > 100_000) throw new Error('Object storage inspection exceeds 100000 entries.');
+    const stat = lstatSync(path);
+    if (stat.isSymbolicLink()) throw new Error('Review repositories must not use symlinked object storage.');
+    if (stat.isDirectory()) for (const entry of readdirSync(path)) {
+      if (pending.length + inspected >= 100_000) throw new Error('Object storage inspection exceeds 100000 entries.');
+      pending.push(join(path, entry));
+    }
+  }
+  const alternates = join(objects, 'info/alternates');
   if (lstatSync(alternates, { throwIfNoEntry: false })) throw new Error('Review repositories must not use object alternates.');
   const resolve = (ref: string) => run('rev-parse', '--verify', '--end-of-options', `${ref}^{commit}`).toString().trim();
   const base = resolve(baseRef), head = resolve(headRef);

test/history.test.ts

@@ -1,4 +1,4 @@
-import { mkdtempSync, mkdirSync, writeFileSync, existsSync, rmSync, chmodSync, symlinkSync, renameSync } from 'node:fs';
+import { mkdtempSync, readdirSync, mkdirSync, writeFileSync, existsSync, rmSync, chmodSync, symlinkSync, renameSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, dirname } from 'node:path';
 import { execFileSync } from 'node:child_process';
@@ -199,3 +199,12 @@ it('fails explicitly when cumulative unique blob bytes exceed the history budget
   expect(() => readHistory(f.dir, f.base, 'HEAD', { maxBlobBytes: 20 })).toThrow(/blob byte budget/i);
   expect(readHistory(f.dir, f.base, 'HEAD', { maxBlobBytes: 27 }).final).toHaveLength(1);
 });
+
+it.each(['root', 'loose', 'pack'])('rejects symlinked %s object storage', kind => {
+  const f = fixture(); f.write('a.txt', 'changed\n'); f.commit('P1');
+  const objects = join(f.dir, '.git/objects');
+  const storage = kind === 'root' ? objects : join(objects, kind === 'pack' ? 'pack' : readdirSync(objects).find(name => /^[0-9a-f]{2}$/.test(name))!);
+  const borrowed = join(f.dir, 'borrowed-objects');
+  renameSync(storage, borrowed); symlinkSync(borrowed, storage);
+  expect(() => readHistory(f.dir, f.base)).toThrow(/symlinked object storage/i);
+});