fix(security): reject symlink-mode blobs in the worktree patch (closes #15)

[axisrow]

Closes #15 (HIGH, security review of #12).

Vulnerability

applyWorktreePatch captures the worktree diff (git diff --cached --binary --output=<file>) and replays it in repoRoot (git apply --index). A symlink created in the worktree — ln -s ~/.ssh/authorized_keys ./steal — is captured as a mode-120000 diff entry with the target path verbatim. git apply --index recreates it in repoRoot pointing at the attacker-chosen host path → exfil (cat/git-show/editor) and append (>>) primitive.

The byte-preserving --output transfer does not help — the symlink target is legitimately part of the diff. git apply rejects literal ../ filename paths, but symlink-mode entries bypass that guard (the repo-side filename is normal; only the symlink target points outside).

Attack reproduced before the fix: ln -s /etc/passwd ./steal in the worktree produced a patch with new file mode 120000, and git apply --index recreated <repoRoot>/steal -> /etc/passwd.

Fix

After writing the patch file, scan it for a mode 120000 line. If found, do NOT apply — return {applied:false} directing the user to inspect/copy symlinks manually from the worktree. Leave-branch preserved (worktree stays; nothing destroyed).

patchContent = readFileSync(patchPath)
if /\bmode 120000\b/.test(patchContent) → {applied:false, detail:"...symlinks...inspect manually"}

Verified

• Regression test: symlink in worktree → keep → applied:false, symlink NOT in repoRoot.
• Pre-fix attack confirmed (git apply recreated the symlink).
• worktree.test.mjs 14/14; full npm test 157 pass / 4 pre-existing (unchanged).

Severity note (from #15): code-path-severity-once-wired — no production callers today; closes the hole before companion --worktree wiring.

[axisrow]

🔍 Local review (cycle 1) — security

Reviewer	Verdict	Finding	Status
claude	CLAIM HOLDS	regex catches all symlink-mode variants (empirically tested); git apply creates symlink IFF patch has 'mode 120000'; suppression of marker = no symlink replay. No bypass.	confirmed
claude (LOW)	FP on tracked files documenting git modes	regex /\bmode 120000\b/ matched literal content	tightened to line-anchored /^(?:new file|deleted file|old|new) mode 120000$/m + FP regression test (a6658d8)
codex	(truncated earlier; non-blocking)	—	—
claude (INFO)	TOCTOU on patchPath non-exploitable (swapped patch without marker can't create symlink; attacker already owns repoRoot in that scenario)	—	not a finding

Triage: 0 FIX in scope, 1 LOW applied (regex tightening). #15 closed. 15/15 worktree tests; full npm test 158 pass / 4 pre-existing. Local mode — merge on user trigger.