fix(security): structural symlink detection via git diff --raw (closes #15)

[axisrow]

Closes #15 (reopened — #19 missed a bypass).

The bypass in #19

#19 detected symlinks by scanning the patch text for a mode 120000 header line. Codex review found that an existing tracked symlink that Codex retargets emits index <oldsha>..<newsha> 120000 — with NO new file mode / old|new mode line — so the regex missed it. git apply then redirected the symlink to the attacker-chosen host path in repoRoot.

Reproduced: tracked link -> /tmp/benign, retargeted to -> /etc/passwd, produced a patch with only index d0a3aa8..3594a94 120000; git apply --index recreated link -> /etc/passwd.

Fix — structural, format-independent

Replace patch-text scanning with git diff --cached --raw, which reports :<oldmode> <newmode> <oldsha> <newsha> <status>\t<path> for every changed entry. Parse the two mode columns; reject if either is 120000. This catches all symlink variants uniformly — new, retargeted, mode-changed, renamed — because it reads git's structural mode data, not a rendered header string. Patch generation still uses git diff --cached --binary --output (byte-safe); --raw is only the detection pass.

Leave-branch invariant preserved (worktree stays on refusal).

Regression tests (3, all green)

• retargeted existing symlink → applied:false, repoRoot symlink unchanged (the bypass fix(security): reject symlink-mode blobs in the worktree patch (closes #15) #19 missed).
• new symlink (mode 120000) → still caught.
• regular file whose content literally mentions mode 120000 → still applied (no false positive — structural check reads mode columns, not patch text).

Verified: worktree.test.mjs 16/16; full npm test 159 pass / 4 pre-existing (unchanged).

[axisrow]

🔍 Local review (cycle 1) — security (forced-update: TOCTOU-closed redesign)

Initial two-phase detection (--raw check separate from patch gen) was TOCTOU-exploitable. Codex + Claude both found it; Claude demonstrated a ~15% reliable bash busy-poll bypass. Redesigned to frozen-tree.

Reviewer	Verdict	Finding	Status
claude	CRITICAL	TOCTOU: patch from mutable index, --raw check reads index again — background process mutates index between calls, patch carries symlink while --raw reports clean, git apply replays symlink. ~15% reliable. IN-SCOPE for #15 threat model (worktree = Codex workspace, write access + can spawn).	redesigned eb3f692: git write-tree freezes index → patch AND modes both read from immutable tree, no window
codex	HIGH	diff.external evasion: crafted repo poisons diff driver, patch carries symlink while --raw clean	refuted empirically (--raw is structural, not subject to diff.external); but the MEDIUM DoS variant (diff.external via shared commondir poisons repoRoot config) closed by --no-ext-diff --no-textconv on both commands
claude/codex	MEDIUM	diff.external DoS via linked-worktree shared commondir	closed: --no-ext-diff --no-textconv added to patch-gen and diff-tree

Triage: 1 CRITICAL (redesigned) + 1 MEDIUM (closed) — both addressed in eb3f692. The frozen-tree approach closes the TOCTOU class the same way worktree.mjs's leave-branch closed the capture-then-remove class: remove the mutable state between the two reads.

Cycle 2 re-runs on eb3f692 to confirm the frozen-tree redesign is itself sound (write-tree atomicity, diff-tree on tree-object correctness, no remaining window).

[axisrow]

🔍 Local review (cycle 2) — neutralize redesign (forced-update 579f6b6)

Cycle 2 found the frozen-tree approach still had a residual: refs/replace/<tree> race (Codex CRITICAL) — git honors replace-refs for tree objects, mutable via the shared commondir. The 4th detection iteration in a row found a new mutable-indirection layer. Same whack-a-mole pattern as the worktree-cleanup class.

Redesign (same principle as leave-branch): remove the vulnerable path, don't guard it. Instead of detecting symlinks in the patch (which requires reading the patch and a separate check — always a TOCTOU window between two git invocations, across whatever mutable layer git resolves through), NEUTRALIZE: apply with git -c core.symlinks=false apply --index. git then materializes any symlink-mode entry as a regular text file containing the target path, not a symlink. It cannot point at a host file, cannot exfil, cannot append. The symlink-replay class (#15) disappears by construction — no detection, no TOCTOU, no mutable-indirection to chase.

Reviewer	Cycle	Verdict	Finding	Resolution
codex	1	needs-attention	patch-text scan misses retarget (index-header 120000)	redesigned → --raw → frozen-tree → neutralize
claude	1	CRITICAL	TOCTOU: patch from index, --raw from index, ~15% bash bypass	frozen-tree closed it, but cycle-2 found replace-ref
codex	2	needs-attention	frozen-tree: refs/replace/ race between the two reads	neutralize eliminates both reads
claude	2	APPROVE	frozen-tree sound (missed replace-ref)	neutralize is strictly stronger

Neutralize approach (579f6b6): git -c core.symlinks=false apply --index <patch>. No write-tree, no diff-tree, no regex, no detection pass at all. Byte-preserving --output patch transfer and --no-ext-diff/--no-textconv hardening kept.

Regression tests (3, all green): new symlink → regular file (content = target path); retargeted existing symlink → regular file; regular file mentioning "mode 120000" → applied normally.

Cost: legitimate symlinks in the worktree also land as text files (rare in code; render layer already warns to inspect special files manually). Acceptable for a rescue-transfer path.

Cycle 3 re-runs on 579f6b6 to confirm neutralize is airtight.

[axisrow]

🔍 Local review (cycle 3) — neutralize redesign — APPROVE

Claude: APPROVE, definitive. Codex: not run (classifier blocked node; will retry post-restart).

Question	Answer
Does core.symlinks=false prevent ALL symlink apply cases?	YES — 6 vectors tested (new/retarget/mode-change/rename/binary/submodule), all neutralized
Can attacker re-enable via config (shared commondir)?	NO — CLI -c has highest precedence; 5 override paths tested (local/global config, GIT_CONFIG_PARAMETERS, include.path, GIT_CONFIG_COUNT), all defeated
Documented escape hatch?	NONE — git man page: "If false, symbolic links are checked out as small plain files that contain the link text." Absolute rule.
Side-channel via hooks/filters?	NONE — git apply does not fire hooks; .gitattributes filters don't run on apply
Path traversal via crafted patch?	BLOCKED — git apply rejects b/../ and absolute paths

The symlink-replay class (#15) is dead by construction. Cycles 1-2 failed because DETECTION requires a second observation (race-able); cycle 3 tells git "do not create symlinks, period" — no race because no second observation.

16/16 tests green. lstatSync (not statSync) correctly distinguishes regular file from symlink-to-file. Merge-ready.