@agentsdock/server 1.0.7-beta.5 → 1.0.8-beta.2

package/server/cursor_history.py

@@ -0,0 +1,219 @@
+"""Read-only Cursor CLI discovery (verified with 2026.09.18).
+
+Only the CLI's metadata and plaintext user-facing JSONL export are read. Never
+open conversation blobs, decrypt data, invoke the CLI, or migrate native stores.
+Cursor IDE and cloud histories are different formats and are not advertised.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import sqlite3
+import stat
+import unicodedata
+from typing import Iterator
+
+MAX_METADATA_BYTES = 64 * 1024
+MAX_SCAN_ENTRIES = 10_000
+IDENTIFIER = re.compile(r"[A-Za-z0-9][A-Za-z0-9._:-]{0,255}")
+
+
+def native_title(value: object) -> str | None:
+    """Bound display metadata before choosing between native naming sources.
+
+    Cursor's default is New Agent. Other names (including a user's literal
+    'New chat' or 'Untitled') are not generic AgentsDock placeholders here.
+    """
+    if not isinstance(value, str) or len(value) > 4096:
+        return None
+    clean = " ".join("".join(
+        character for character in value
+        if character.isspace()
+        or unicodedata.category(character) not in {"Cc", "Cf", "Cs"}
+    ).split())[:120]
+    return clean if clean and clean.casefold() != "new agent" else None
+
+
+def config_root(cwd: str | None = None) -> Path:
+    config = os.environ.get("CURSOR_CONFIG_DIR", "").strip()
+    xdg = os.environ.get("XDG_CONFIG_HOME", "").strip()
+    root = Path(config) if config else Path(xdg) / "cursor" if xdg else Path.home() / ".cursor"
+    return Path(os.path.abspath(root if root.is_absolute() else Path(cwd or os.getcwd()) / root))
+
+
+def data_root(cwd: str) -> Path:
+    data = os.environ.get("CURSOR_DATA_DIR", "").strip()
+    root = Path(data) if data else Path.home() / ".cursor"
+    return Path(os.path.abspath(root if root.is_absolute() else Path(cwd) / root))
+
+
+def project_slug(cwd: str) -> str:
+    # Cursor utils/dist/workspace-paths.js; do not guess a cwd by reversing it.
+    return re.sub(r"-+", "-", re.sub(r"[^a-zA-Z0-9]", "-", cwd)).strip("-")
+
+
+def safe_path(path: Path, root: Path) -> bool:
+    """Do not follow symlinks beneath the configured native root."""
+    try:
+        relative = path.relative_to(root)
+        if ".." in relative.parts or root.is_symlink():
+            return False
+        current = root
+        for part in relative.parts:
+            current = current / part
+            if current.is_symlink():
+                return False
+        return True
+    except (OSError, ValueError):
+        return False
+
+
+def read_json(path: Path, root: Path) -> dict | None:
+    if not safe_path(path, root):
+        return None
+    try:
+        descriptor = os.open(path, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
+        with os.fdopen(descriptor, "rb") as stream:
+            if not stat.S_ISREG(os.fstat(stream.fileno()).st_mode):
+                return None
+            raw = stream.read(MAX_METADATA_BYTES + 1)
+        if len(raw) > MAX_METADATA_BYTES:
+            return None
+        value = json.loads(raw)
+        return value if isinstance(value, dict) else None
+    except (OSError, ValueError, RecursionError):
+        return None
+
+
+def store_metadata(database: Path, root: Path) -> dict | None:
+    if not safe_path(database, root) or not database.is_file():
+        return None
+    try:
+        connection = sqlite3.connect(database.resolve().as_uri() + "?mode=ro", uri=True, timeout=0.05)
+        try:
+            connection.execute("PRAGMA query_only = ON")
+            connection.execute("PRAGMA trusted_schema = OFF")
+            connection.set_progress_handler(lambda: 1, 10000)
+            row = connection.execute(
+                "SELECT substr(value, 1, 32769) FROM meta WHERE key = '0' AND typeof(value) = 'text'",
+            ).fetchone()
+        finally:
+            connection.close()
+        if not row or len(row[0]) > 32768:
+            return None
+        value = json.loads(bytes.fromhex(row[0]))
+        if not isinstance(value, dict):
+            return None
+        # Do not return encryption keys, root blobs, or unrelated metadata.
+        return {
+            "id": value.get("agentId"), "title": value.get("name"),
+            "is_subagent": value.get("subagentInfo") is not None,
+        }
+    except (OSError, ValueError, RecursionError, sqlite3.Error):
+        return None
+
+
+@dataclass(frozen=True)
+class LocalSession:
+    provider_id: str
+    cwd: str
+    title: str | None
+    updated_at: float
+    transcript: Path
+
+
+def read_session(directory: Path, root: Path, *, expected_cwd: str | None = None) -> LocalSession | None:
+    provider_id = directory.name
+    if not IDENTIFIER.fullmatch(provider_id) or not safe_path(directory, root):
+        return None
+    sidecar = read_json(directory / "meta.json", root)
+    if not sidecar or type(sidecar.get("schemaVersion")) is not int or sidecar["schemaVersion"] != 1:
+        return None
+    if sidecar.get("hasConversation") is not True or sidecar.get("isSubagent") is True:
+        return None
+    cwd = sidecar.get("cwd")
+    if (not isinstance(cwd, str) or not cwd or len(cwd) > 16384
+            or any(ord(char) < 32 or ord(char) == 127 for char in cwd)
+            or not Path(cwd).is_absolute() or os.path.normpath(cwd) != cwd):
+        return None
+    if expected_cwd is not None and cwd != expected_cwd:
+        return None
+    try:
+        bucket = hashlib.md5(cwd.encode(), usedforsecurity=False).hexdigest()
+        usable = Path(cwd).is_dir() and config_root(cwd).absolute() == root.absolute()
+    except (OSError, ValueError):
+        return None
+    if bucket != directory.parent.name:
+        return None
+    # CLI resume is workspace-bound. Do not silently substitute DEFAULT_CWD
+    # for a vanished temporary project, which would create an unrelated chat.
+    if not usable:
+        return None
+    metadata = store_metadata(directory / "store.db", root)
+    if not metadata or metadata["id"] != provider_id or metadata["is_subagent"]:
+        return None
+    # Native configuration and transcript data have independent roots.
+    data = data_root(cwd)
+    projects = data / "projects"
+    slug = project_slug(cwd)
+    if not slug:
+        return None
+    transcript = projects / slug / "agent-transcripts" / provider_id / f"{provider_id}.jsonl"
+    if not safe_path(transcript, data):
+        return None
+    try:
+        info = transcript.stat()
+        if not stat.S_ISREG(info.st_mode):
+            return None
+    except OSError:
+        return None
+    updated = sidecar.get("updatedAtMs")
+    timestamp = updated / 1000 if type(updated) is int and 0 < updated < 253402300800000 else info.st_mtime
+    title = native_title(metadata["title"]) or native_title(sidecar.get("title"))
+    return LocalSession(provider_id, cwd, title, timestamp, transcript)
+
+
+def find_session(provider_id: str, cwd: str) -> LocalSession | None:
+    if not isinstance(provider_id, str) or not IDENTIFIER.fullmatch(provider_id) or not isinstance(cwd, str):
+        return None
+    root = config_root(cwd)
+    try:
+        bucket = hashlib.md5(cwd.encode(), usedforsecurity=False).hexdigest()
+    except ValueError:
+        return None
+    return read_session(root / "chats" / bucket / provider_id, root, expected_cwd=cwd)
+
+
+def local_sessions() -> Iterator[LocalSession]:
+    root = config_root()
+    chats = root / "chats"
+    if not safe_path(chats, root):
+        return
+    remaining = MAX_SCAN_ENTRIES
+    try:
+        with os.scandir(chats) as buckets:
+            for bucket in buckets:
+                remaining -= 1
+                if remaining < 0:
+                    return
+                if not re.fullmatch(r"[0-9a-f]{32}", bucket.name) or not bucket.is_dir(follow_symlinks=False):
+                    continue
+                try:
+                    with os.scandir(bucket.path) as directories:
+                        for entry in directories:
+                            remaining -= 1
+                            if remaining < 0:
+                                return
+                            if not entry.is_dir(follow_symlinks=False):
+                                continue
+                            session = read_session(Path(entry.path), root)
+                            if session is not None:
+                                yield session
+                except OSError:
+                    continue
+    except OSError:
+        return

package/server/cursor_provider_mcp.py

@@ -0,0 +1,290 @@
+"""Run-scoped Cursor CLI MCP transport; never edits native login or permissions.
+
+Native print-mode sessions, login and cwd remain unchanged. A private per-run
+configuration adds only the exact internal MCP tool permission, retaining
+native permissions and explicit denies. A bounded loopback broker keeps
+helper authority in AgentsServer and expires when the run ends.
+"""
+from __future__ import annotations
+
+import asyncio
+import contextlib
+import hmac
+import json
+import os
+from pathlib import Path
+import secrets
+import socket
+import stat
+import itertools
+import sys
+import tempfile
+import subprocess
+from typing import Any
+
+PLUGIN_NAME = "agentsdock-internal-9f3a2c71"
+MCP_SERVER_KEY = "provider"
+MCP_NAME = "plugin-" + PLUGIN_NAME + "-" + MCP_SERVER_KEY
+MCP_ALLOW = "Mcp(" + MCP_NAME + ":run)"
+MAX_MESSAGE = 2 * 1024 * 1024
+ENV_PORT = "AGENTSDOCK_CURSOR_TOOL_PORT"
+ENV_SECRET = "AGENTSDOCK_CURSOR_TOOL_SECRET"
+
+
+class CursorToolBroker:
+    """One run's authenticated IPC endpoint, with bounded in-flight work."""
+
+    def __init__(self, definition: dict, execute: Any):
+        self.definition = definition
+        self.execute = execute
+        self.secret = secrets.token_urlsafe(48)
+        self.server = None
+        self.tasks: set[asyncio.Task] = set()
+        self.closed = False
+
+    async def start(self) -> dict[str, str]:
+        self.server = await asyncio.start_server(
+            self.handle, "127.0.0.1", 0, limit=MAX_MESSAGE + 1,
+        )
+        return {ENV_PORT: str(self.server.sockets[0].getsockname()[1]),
+                ENV_SECRET: self.secret}
+
+    async def close(self) -> None:
+        self.closed = True
+        if self.server:
+            self.server.close()
+        tasks = list(self.tasks)
+        for task in tasks:
+            task.cancel()
+        if tasks:
+            await asyncio.gather(*tasks, return_exceptions=True)
+        if self.server:
+            await self.server.wait_closed()
+
+    async def handle(self, reader, writer) -> None:
+        task = asyncio.current_task()
+        if self.closed or len(self.tasks) >= 8:
+            writer.close()
+            return
+        self.tasks.add(task)
+        response = None
+        try:
+            line = await asyncio.wait_for(reader.readline(), 5)
+            if not line.endswith(b"\n") or len(line) > MAX_MESSAGE:
+                raise ValueError("invalid provider IPC frame")
+            request = json.loads(line)
+            if (not isinstance(request, dict) or self.closed
+                    or not isinstance(request.get("secret"), str)
+                    or not hmac.compare_digest(request["secret"], self.secret)):
+                raise ValueError("provider IPC is forbidden")
+            if request.get("method") == "definition":
+                result = self.definition
+            elif request.get("method") == "call":
+                key = request.get("key")
+                if not isinstance(key, str) or not 1 <= len(key) <= 160:
+                    raise ValueError("invalid provider call identity")
+                # The callback rechecks the actual live process/run/capability.
+                text, error = await self.execute(request.get("arguments"), key)
+                result = {"content": [{"type": "text", "text": text}], "isError": error}
+            else:
+                raise ValueError("unsupported provider IPC method")
+            response = {"result": result}
+        except asyncio.CancelledError:
+            raise
+        except Exception:
+            # Never reflect bearer material or an untrusted request in errors.
+            response = {"error": "Provider tool unavailable or authorization expired."}
+        finally:
+            if response is not None and not self.closed:
+                data = (json.dumps(response) + "\n").encode()
+                if len(data) <= MAX_MESSAGE:
+                    with contextlib.suppress(Exception):
+                        writer.write(data)
+                        await asyncio.wait_for(writer.drain(), 5)
+            writer.close()
+            with contextlib.suppress(Exception):
+                await asyncio.wait_for(writer.wait_closed(), 5)
+            self.tasks.discard(task)
+
+
+def broker_request(method: str, **payload) -> Any:
+    request = {"method": method, "secret": os.environ[ENV_SECRET], **payload}
+    data = (json.dumps(request) + "\n").encode()
+    if len(data) > MAX_MESSAGE:
+        raise ValueError("provider request exceeds limit")
+    with socket.create_connection(("127.0.0.1", int(os.environ[ENV_PORT])), timeout=5) as conn:
+        conn.settimeout(240)
+        conn.sendall(data)
+        with conn.makefile("rb") as stream:
+            line = stream.readline(MAX_MESSAGE + 1)
+        if len(line) > MAX_MESSAGE or not line.endswith(b"\n"):
+            raise ValueError("invalid provider response")
+        response = json.loads(line)
+        if "error" in response:
+            raise ValueError(response["error"])
+        return response["result"]
+
+
+def mcp_main() -> None:
+    """Native Cursor launches this stdio MCP, with a private per-run env."""
+    connection_id = secrets.token_hex(16)
+    while True:
+        line = sys.stdin.buffer.readline(MAX_MESSAGE + 1)
+        if not line:
+            return
+        if len(line) > MAX_MESSAGE or not line.endswith(b"\n"):
+            raise ValueError("MCP frame exceeds limit")
+        message = json.loads(line)
+        if "id" not in message:
+            continue
+        method, params = message.get("method"), message.get("params") or {}
+        error = None
+        try:
+            if method == "initialize":
+                result = {"protocolVersion": params.get("protocolVersion", "2024-11-05"),
+                          "capabilities": {"tools": {}},
+                          "serverInfo": {"name": MCP_NAME, "version": "1"}}
+            elif method == "ping":
+                result = {}
+            elif method == "tools/list":
+                result = {"tools": [broker_request("definition")]}
+            elif method == "tools/call" and params.get("name") == "run":
+                result = broker_request("call", arguments=params.get("arguments"),
+                                        key=connection_id + ":" + str(message["id"]))
+            else:
+                error = {"code": -32601, "message": "Method not found"}
+        except Exception:
+            result = {"content": [{"type": "text", "text":
+                      "Provider tool unavailable or authorization expired. Do not resend an accepted message."}],
+                      "isError": True}
+        response = {"jsonrpc": "2.0", "id": message["id"],
+                    **({"error": error} if error else {"result": result})}
+        print(json.dumps(response), flush=True)
+
+
+
+def read_config(path: Path) -> dict:
+    # A repository-controlled FIFO/device must not hang configuration startup.
+    try:
+        fd = os.open(path, os.O_RDONLY | getattr(os, "O_NONBLOCK", 0))
+    except FileNotFoundError:
+        return {}
+    with os.fdopen(fd, "rb") as source:
+        info = os.fstat(source.fileno())
+        if not stat.S_ISREG(info.st_mode) or info.st_size > MAX_MESSAGE:
+            raise ValueError("Cursor configuration must be a bounded regular file")
+        data = source.read(MAX_MESSAGE + 1)
+    if len(data) > MAX_MESSAGE:
+        raise ValueError("Cursor configuration exceeds limit")
+    value = json.loads(data)
+    if not isinstance(value, dict):
+        raise ValueError("Cursor configuration must be an object")
+    return value
+
+
+def config_root(env: dict[str, str]) -> Path:
+    home = Path(env.get("HOME") or Path.home())
+    explicit = env.get("CURSOR_CONFIG_DIR", "").strip()
+    if explicit:
+        return Path(explicit).expanduser().resolve()
+    xdg = env.get("XDG_CONFIG_HOME", "").strip()
+    return (Path(xdg) / "cursor" if xdg else home / ".cursor").resolve()
+
+
+def permission_snapshot(base: dict, projects: list[dict]) -> dict:
+    """Match native replacement of allow lists; retain every explicit deny.
+
+    Project permission lists override the global lists in Cursor. Keeping
+    the union of explicit denies is deliberately conservative: a later empty
+    deny list must not remove an earlier user prohibition to admit our tool.
+    """
+    result = dict(base)
+    permissions = {"allow": ["Shell(ls)"], "deny": []}
+    denies = []
+    for config in [base, *projects]:
+        supplied = config.get("permissions", {})
+        if not isinstance(supplied, dict) or set(supplied) - {"allow", "deny"}:
+            raise ValueError("Unsupported Cursor permission configuration")
+        for key in ("allow", "deny"):
+            if key not in supplied:
+                continue
+            values = supplied[key]
+            if not isinstance(values, list) or any(not isinstance(v, str) for v in values):
+                raise ValueError("Invalid Cursor permission list")
+            permissions[key] = list(values)
+        denies.extend(permissions["deny"])
+    permissions["deny"] = list(dict.fromkeys(denies))
+    permissions["allow"] = list(dict.fromkeys([*permissions["allow"], MCP_ALLOW]))
+    result["permissions"] = permissions
+    result.setdefault("version", 1)
+    result.setdefault("editor", {"vimMode": False})
+    return result
+
+
+class CursorRuntimeProfile:
+    """Ephemeral config/plugin; never writes native config, auth or history."""
+
+    def __init__(self, env: dict[str, str], cwd: str):
+        self.temp = None
+        self.path = None
+        self.env = env
+        self.cwd = Path(cwd).resolve()
+
+    def prepare(self) -> tuple[dict[str, str], list[str]]:
+        original = config_root(self.env)
+        base = read_config(original / "cli-config.json")
+        try:
+            git = subprocess.run(["git", "-C", str(self.cwd), "rev-parse", "--show-toplevel"],
+                                 capture_output=True, text=True, timeout=5, env=self.env)
+        except FileNotFoundError:
+            git = None
+        project_root = Path(git.stdout.strip()).resolve() if git and git.returncode == 0 else self.cwd
+        try:
+            relative = self.cwd.relative_to(project_root)
+        except ValueError:
+            raise ValueError("Cursor workspace root does not contain cwd") from None
+        roots = [project_root]
+        for part in relative.parts:
+            roots.append(roots[-1] / part)
+        projects = []
+        for root in roots:
+            config = read_config(root / ".cursor" / "cli.json")
+            if set(config) - {"permissions"}:
+                raise ValueError("Unsupported Cursor project configuration; internal tools were not enabled")
+            projects.append(config)
+        merged = permission_snapshot(base, projects)
+        self.temp = tempfile.TemporaryDirectory(prefix="agentsdock-cursor-")
+        self.path = Path(self.temp.name)
+        self.path.chmod(0o700)
+        config_dir = self.path / "config"
+        config_dir.mkdir(mode=0o700)
+        # Preserve native sibling configuration (plugins, rules, MCP settings).
+        # Credential stores and CLI history use the unchanged HOME/data roots.
+        if original.is_dir():
+            children = list(itertools.islice(original.iterdir(), 1025))
+            if len(children) > 1024:
+                raise ValueError("Cursor configuration directory exceeds limit")
+            for child in children:
+                if child.name != "cli-config.json":
+                    (config_dir / child.name).symlink_to(child, target_is_directory=child.is_dir())
+        config_file = config_dir / "cli-config.json"
+        config_file.write_text(json.dumps(merged), encoding="utf-8")
+        config_file.chmod(0o600)
+        plugin = self.path / PLUGIN_NAME
+        (plugin / ".cursor-plugin").mkdir(parents=True, mode=0o700)
+        (plugin / ".cursor-plugin" / "plugin.json").write_text(json.dumps({"name": PLUGIN_NAME, "version": "1.0.0"}))
+        (plugin / "mcp.json").write_text(json.dumps({"mcpServers": {MCP_SERVER_KEY: {
+            "command": sys.executable, "args": [str(Path(__file__).resolve()), "--mcp"],
+            "env": {key: self.env[key] for key in (ENV_PORT, ENV_SECRET)}}}}))
+        (plugin / "mcp.json").chmod(0o600)
+        return {"CURSOR_CONFIG_DIR": str(config_dir)}, ["--disable-project-configs", "--plugin-dir", str(plugin)]
+
+    def close(self) -> None:
+        if self.temp:
+            self.temp.cleanup()
+
+
+if __name__ == "__main__":
+    if sys.argv[1:] != ["--mcp"]:
+        raise SystemExit("Only the run-bound MCP transport may invoke this module")
+    mcp_main()

package/server/execution_durability.py

@@ -47,8 +47,11 @@ def flush_tree(root: Path, *, dependency_prefix: bool = False) -> dict[str, int]
     if not root.is_absolute() or root.resolve(strict=True) != root:
         raise ValueError("durability tree must have no linked ancestors")
     root_info = root.lstat()
+    # uv can retain a same-user runtime with 0775 directories and 0664 files.
+    # Flushing that admitted dependency must not change its permission policy.
+    writable_mask = 0o002 if dependency_prefix else 0o022
     if (not stat.S_ISDIR(root_info.st_mode) or root_info.st_uid != os.getuid()
-            or root_info.st_mode & 0o022):
+            or root_info.st_mode & writable_mask):
         raise PermissionError("durability tree root is unsafe")
     total = {"entries": 0, "bytes": 0}
     external: set[Path] = set()
@@ -70,7 +73,7 @@ def flush_tree(root: Path, *, dependency_prefix: bool = False) -> dict[str, int]
                 info = os.stat(name, dir_fd=descriptor, follow_symlinks=False)
                 if info.st_uid != os.getuid() or info.st_dev != root_info.st_dev:
                     raise PermissionError("durability member ownership or device changed")
-                if dependency_prefix and not stat.S_ISLNK(info.st_mode) and info.st_mode & 0o022:
+                if dependency_prefix and not stat.S_ISLNK(info.st_mode) and info.st_mode & 0o002:
                     raise PermissionError("standalone Python durability member is writable by others")
                 total["entries"] += 1
                 if total["entries"] > MAX_ENTRIES:
@@ -116,16 +119,17 @@ def flush_tree(root: Path, *, dependency_prefix: bool = False) -> dict[str, int]
     visit(root)
     for interpreter in sorted(external):
         info = interpreter.lstat()
+        prefix = interpreter.parent.parent
+        match = re.fullmatch(r"python([0-9]+\.[0-9]+)", interpreter.name)
+        standalone = re.fullmatch(r"cpython-[0-9]+\.[0-9]+\.[0-9]+(?:[a-z0-9.]*)?-(?:macos|linux)-[a-z0-9_]+-[a-z0-9_]+", prefix.name)
+        writable_mask = 0o002 if info.st_uid == os.getuid() else 0o022
         if (not stat.S_ISREG(info.st_mode) or info.st_uid not in {0, os.getuid()}
-                or info.st_mode & 0o022 or not info.st_mode & 0o111):
+                or info.st_mode & writable_mask or not info.st_mode & 0o111):
             raise PermissionError("external durability interpreter is unsafe")
         if info.st_uid == 0:
             # System interpreters are provisioned outside this updater. Never
             # traverse /usr or another OS-managed Python installation.
             continue
-        prefix = interpreter.parent.parent
-        match = re.fullmatch(r"python([0-9]+\.[0-9]+)", interpreter.name)
-        standalone = re.fullmatch(r"cpython-[0-9]+\.[0-9]+\.[0-9]+(?:[a-z0-9.]*)?-(?:macos|linux)-[a-z0-9_]+-[a-z0-9_]+", prefix.name)
         if standalone:
             if (interpreter.parent.name != "bin" or match is None
                     or not (prefix / "lib" / ("python" + match[1])).is_dir()

package/server/execution_preparation.py

@@ -67,8 +67,12 @@ def _file(path: Path, *, private: bool = False, dependency: bool = False,
         mode = stat.S_IMODE(before.st_mode)
         maximum = MAX_RECEIPT_BYTES if private else MAX_FILE_BYTES
         owners = {os.getuid(), 0} if external else {os.getuid()}
+        # Existing user-managed Python installations can inherit a group-write
+        # umask. Bind their bytes and mode in the receipt without chmodding a
+        # shared prerequisite. Private staging files retain their usual policy.
+        writable_mask = 0o002 if external and dependency and before.st_uid == os.getuid() else 0o022
         if (not stat.S_ISREG(before.st_mode) or before.st_uid not in owners
-                or (mode & 0o022 and not uv_lock) or mode & 0o7000 or (private and mode != 0o600)
+                or (mode & writable_mask and not uv_lock) or mode & 0o7000 or (private and mode != 0o600)
                 or (uv_lock and (before.st_size != 0 or before.st_nlink != 1))
                 or (not dependency and before.st_nlink != 1) or before.st_size > maximum):
             raise PermissionError("preparation file is unsafe or too large")
@@ -201,7 +205,7 @@ def _inventory_tree(candidate: Path, source: dict[str, dict]) -> dict[str, dict]
                                 or not re.fullmatch(r"python(?:[0-9]+(?:\.[0-9]+)*)?", resolved.name)
                                 or not os.access(resolved, os.X_OK)):
                             raise ValueError("external prepared dependency link is not an interpreter")
-                    target_info, _data = _file(resolved, dependency=True, external=True)
+                    target_info, _data = _file(resolved, dependency=True, external=candidate not in resolved.parents)
                     total += target_info["size"]
                 if _stable(info) != _stable(child.lstat()) or target != os.readlink(child):
                     raise RuntimeError("prepared dependency link changed")