Keep managed source paths canonical across outer workbench aliases (#713)

src/capability-language/authoring-converge.ts

@@ -4,6 +4,7 @@ import { execFile as callback } from "node:child_process";
 import { promisify } from "node:util";
 import { randomUUID } from "node:crypto";
 import { authoringContext } from "./authoring-context.js";
+import { managedResourcePath } from "./managed-source-path.js";
 import { snapshotCommit } from "./checked-build.js";
 import { profile } from "./profile.js";
 import {
@@ -85,6 +86,11 @@ export async function convergeAuthoring(start: string, target = "root") {
   const context = await authoringContext(start);
   const graphFile = path.join(context.workbench, ".quixos/resource-graph.json");
   const graphBefore = await readFile(graphFile, "utf8");
+  const graph = JSON.parse(graphBefore);
+  // Discovery resolves outer guest aliases. Persist those same physical
+  // selections, without accepting symlinks within the managed workbench.
+  for (const resource of graph.resources)
+    resource.directory = await managedResourcePath(context.workbench, resource.directory);
   const blockers: AuthoringBlocker[] = [];
   const nodes = new Map<string, { directory: string; kind: string; source: GitSource; dependencies: string[] }>();
   const selected = new Map<string, string>();
@@ -247,9 +253,6 @@ export async function convergeAuthoring(start: string, target = "root") {
   profile("capture-recheck", recheckStarted, { repositories: complete.size });
   // Persist successful selections even if another repository is still broken.
   // Recovery must not depend on all parents succeeding in the same invocation.
-  const graph = JSON.parse(graphBefore);
-  for (const resource of graph.resources)
-    resource.directory = path.relative(context.workbench, path.resolve(context.workbench, resource.directory));
   const replacements = new Map<string, string>();
   for (const resource of graph.resources) {
     const source = complete.get(resource.directory);

src/capability-language/managed-source-path.ts

@@ -0,0 +1,19 @@
+import { realpath } from "node:fs/promises";
+import path from "node:path";
+
+/** Registration may name the workbench through its guest alias. Only that
+ * outer alias is permitted: resources and each checkout remain physical,
+ * directly contained directories. Persist the resulting root-relative path.
+ */
+export async function managedResourcePath(workbench: string, directory: string): Promise<string> {
+  const root = await realpath(workbench);
+  const selected = path.resolve(root, directory);
+  const name = path.basename(selected);
+  const resources = path.dirname(selected);
+  if (path.basename(resources) !== "resources" || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name))
+    throw new Error(`Repository is outside the managed workbench: ${directory}`);
+  const relative = `resources/${name}`;
+  if ((await realpath(path.dirname(resources))) !== root || (await realpath(selected)) !== path.join(root, relative))
+    throw new Error(`Managed repository path crosses a symlink or escapes the workbench: ${directory}`);
+  return relative;
+}

src/capability-language/pin-upgrades.ts

@@ -22,6 +22,7 @@ import {
   type EvolutionReview,
 } from "../capability-model/index.js";
 import { withFileLock } from "./file-lock.js";
+import { managedResourcePath } from "./managed-source-path.js";
 const execFile = promisify(callback);
 type Source = { repository: string; commit: string };
 export type UpgradeNode = { kind: "workspace" | "package" | "interface" | "build"; directory: string; source: Source };
@@ -98,7 +99,8 @@ const writeJournal = async (filename: string, journal: unknown) => {
   }
 };
 
-export const discoverUpgradeSpec = async (workbench: string): Promise<UpgradeSpec> => {
+export const discoverUpgradeSpec = async (workbenchPath: string): Promise<UpgradeSpec> => {
+  const workbench = await fs.realpath(workbenchPath);
   const graph = JSON.parse(await fs.readFile(path.join(workbench, ".quixos/resource-graph.json"), "utf8"));
   const root = await location(workbench, "root");
   const nodes: UpgradeNode[] = [
@@ -110,11 +112,15 @@ export const discoverUpgradeSpec = async (workbench: string): Promise<UpgradeSpe
         commit: await command(root, "jj", ["--ignore-working-copy", "log", "--no-graph", "-r", "@", "-T", "commit_id"]),
       },
     },
-    ...graph.resources.map((entry: { kind: "interface" | "package" | "build"; directory: string; source: Source }) => ({
-      kind: entry.kind,
-      source: entry.source,
-      directory: path.relative(workbench, path.resolve(workbench, entry.directory)),
-    })),
+    ...(await Promise.all(
+      graph.resources.map(
+        async (entry: { kind: "interface" | "package" | "build"; directory: string; source: Source }) => ({
+          kind: entry.kind,
+          source: entry.source,
+          directory: await managedResourcePath(workbench, entry.directory),
+        }),
+      ),
+    )),
   ];
   let baseline: string | undefined;
   try {
@@ -406,10 +412,7 @@ export const applyPinUpgrades = async (
           previous.resources.map(async (entry: { kind: string; source: Source; directory: string }) => ({
             kind: entry.kind,
             ...entry.source,
-            directory: await location(
-              plan.workbench,
-              path.relative(plan.workbench, path.resolve(plan.workbench, entry.directory)),
-            ),
+            directory: await location(plan.workbench, await managedResourcePath(plan.workbench, entry.directory)),
           })),
         );
         for (const node of plan.nodes.filter((entry) => entry.kind !== "workspace")) {

test/managed-source-path.test.ts

@@ -0,0 +1,32 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { managedResourcePath } from "../src/capability-language/managed-source-path.js";
+
+test("source registration permits an outer workbench alias, never nested checkout or resources symlinks", async (t) => {
+  const scratch = await fs.mkdtemp(path.join(os.tmpdir(), "qx-managed-source-path-"));
+  t.after(() => fs.rm(scratch, { recursive: true, force: true }));
+  const root = path.join(scratch, "retained/workbench"),
+    alias = path.join(scratch, "guest"),
+    outside = path.join(scratch, "outside");
+  await fs.mkdir(path.join(root, "resources/Package"), { recursive: true });
+  await fs.mkdir(outside);
+  await fs.symlink(root, alias);
+  for (const registered of [
+    "resources/Package",
+    path.join(alias, "resources/Package"),
+    path.relative(root, path.join(alias, "resources/Package")),
+  ])
+    assert.equal(await managedResourcePath(alias, registered), "resources/Package");
+  await fs.symlink(path.join(root, "resources/Package"), path.join(root, "resources/Alias"));
+  await assert.rejects(managedResourcePath(root, "resources/Alias"), /crosses a symlink/);
+  await fs.symlink(outside, path.join(root, "resources/Escape"));
+  await assert.rejects(managedResourcePath(root, "resources/Escape"), /escapes the workbench/);
+  await fs.mkdir(path.join(outside, "resources/Package"), { recursive: true });
+  await assert.rejects(managedResourcePath(root, path.join(outside, "resources/Package")), /escapes the workbench/);
+  await fs.rename(path.join(root, "resources"), path.join(root, "relocated-resources"));
+  await fs.symlink(path.join(root, "relocated-resources"), path.join(root, "resources"));
+  await assert.rejects(managedResourcePath(root, "resources/Package"), /crosses a symlink/);
+});

test/pin-upgrades.test.ts

@@ -156,6 +156,26 @@ test(
     );
     assert.equal(graph.resources[0].directory, "resources/Named");
     assert.equal(graph.directResources[0].directory, "resources/Named");
+    const alias = `${workbench}-guest-alias`;
+    await fs.symlink(workbench, alias);
+    context.after(() => fs.unlink(alias));
+    const graphFile = path.join(workbench, ".quixos/resource-graph.json");
+    await fs.writeFile(
+      graphFile,
+      JSON.stringify({
+        ...graph,
+        resources: graph.resources.map((entry: { directory: string }) => ({
+          ...entry,
+          directory: path.join(alias, entry.directory),
+        })),
+      }),
+    );
+    assert.equal((await discoverUpgradeSpec(alias)).nodes[1]!.directory, "resources/Named");
+    const aliasPlan = await planPinUpgrades(alias, { ...(await discoverUpgradeSpec(alias)), bootstrap: true });
+    await applyPinUpgrades(aliasPlan);
+    const refreshed = JSON.parse(await fs.readFile(graphFile, "utf8"));
+    assert.equal(refreshed.resources[0].directory, "resources/Named");
+    assert.equal(refreshed.directResources[0].directory, "resources/Named");
     // A retained workbench can move without keeping its original absolute path
     // alive. Recovery journals remain bound to their original writer/root.
     const relocated = `${workbench}-relocated`;