@jpkme/diff-review 0.1.12 → 0.1.14

package/README.md

@@ -71,7 +71,7 @@ va por el adaptador `@agentclientprotocol/claude-agent-acp` (se baja con `npx` l
 
 - El select de modelo muestra los que ofrece cada agente (se consultan por ACP la primera vez).
 - La web muestra lo que va haciendo (comandos, archivos que lee, plan). La terminal solo avisa fallos duros o JSON válido.
-- Al terminar cada turno, el server valida el JSON; si falta algo se lo pide al agente una vez y, cuando valida,
+- Al terminar cada turno, el server valida el JSON; si falta algo se lo pide al agente hasta dos veces y, cuando valida,
   la web abre el reporte.
 - Cada pedido de permiso pasa por una política fija: leer dentro del repo, escribir únicamente el JSON del review
   y comandos de solo lectura: `git` (diff, log, show, blame…), `cat`, `head`, `tail`, `grep`, `rg`, `find`, `ls`,

package/bin/diff-review.mjs

@@ -201,12 +201,15 @@ function defaultBase(listed, branch) {
 	return listed.branches.find((b) => b !== branch) || preferred || '';
 }
 
-function branchOptions(listed) {
-	return listed.branches.map((b) => ({
-		value: b,
-		label: b,
-		hint: b === listed.current ? 'actual' : b === listed.defaultBase ? 'base típica' : undefined
-	}));
+function branchOptions(listed, exclude = '') {
+	const skip = String(exclude || '').trim();
+	return listed.branches
+		.filter((b) => !skip || b !== skip)
+		.map((b) => ({
+			value: b,
+			label: b,
+			hint: b === listed.current ? 'actual' : b === listed.defaultBase ? 'base típica' : undefined
+		}));
 }
 
 /** Selects solo con terminal interactiva. (`p.isTTY` de Clack es una función, no un booleano.) */
@@ -270,12 +273,18 @@ async function resolveBranchBase(launch, opts) {
 		p.log.step(`Branch: ${branch}`);
 	}
 
+	const baseOptions = branchOptions(launch.listed, branch);
+	if (!baseOptions.length) {
+		p.cancel(`No hay otra base disponible distinta de \`${branch}\`.`);
+		process.exit(1);
+	}
+
 	let base = flagBase;
 	if (!base) {
 		base = ensureValue(
 			await autocompleteEs({
 				message: 'Base (merge-base)',
-				options,
+				options: baseOptions,
 				initialValue: defaultBase(launch.listed, branch) || undefined,
 				maxItems: 12
 			}),
@@ -290,7 +299,7 @@ async function resolveBranchBase(launch, opts) {
 		base = ensureValue(
 			await autocompleteEs({
 				message: 'Elegí otra base',
-				options,
+				options: baseOptions,
 				initialValue: defaultBase(launch.listed, branch) || undefined,
 				maxItems: 12
 			}),
@@ -317,6 +326,49 @@ function buildOutputFilename(repo, branch, base) {
 	}
 }
 
+/**
+ * Precomputa el diff en CLI (spinner si hay Clack). Si el resultado no tiene archivos, sale con error.
+ * @returns {ReturnType<typeof prepareReviewPromptOpts>}
+ */
+function prepareContextOrFail(launch, branch, base, outputFilename, { useClack }) {
+	const spin = useClack ? p.spinner() : null;
+	if (!useClack) console.log('Preparando el contexto…');
+	spin?.start('Preparando el contexto…');
+
+	/** @type {ReturnType<typeof prepareReviewPromptOpts>} */
+	let promptOpts = { outputFilename };
+	try {
+		promptOpts = prepareReviewPromptOpts({
+			repo: launch.repo,
+			branch,
+			base,
+			outputFilename
+		});
+	} catch (err) {
+		const msg = err instanceof Error ? err.message : String(err);
+		spin?.stop('No pude precomputar el diff');
+		if (useClack) p.log.warn(`No pude precomputar el diff: ${msg}`);
+		else console.warn('No pude precomputar el diff:', msg);
+		ensureReviewDir(launch.repo);
+		writeDiffCache(launch.repo, outputFilename, { branch, base });
+		return promptOpts;
+	}
+
+	const n = Array.isArray(promptOpts.files) ? promptOpts.files.length : 0;
+	if (n === 0) {
+		spin?.stop('Diff vacío');
+		const msg = `El diff entre \`${branch}\` y \`${base}\` está vacío: no hay nada que revisar.`;
+		if (useClack) p.cancel(msg);
+		else console.error(msg);
+		process.exit(1);
+	}
+
+	const done = `Contexto listo · ${n} archivo${n === 1 ? '' : 's'}`;
+	spin?.stop(done);
+	if (!useClack) console.log(done);
+	return promptOpts;
+}
+
 function copyPromptOrWarn(prompt) {
 	if (copyTextToClipboard(prompt)) return true;
 	p.log.warn(
@@ -622,22 +674,9 @@ async function runUiMode(opts, launch, launchCwd) {
 	if (launch) {
 		console.log(`Repo:   ${launch.repo}`);
 		console.log(`Branch: ${branch}  (base: ${base})`);
-		let promptOpts = { outputFilename };
-		try {
-			promptOpts = prepareReviewPromptOpts({
-				repo: launch.repo,
-				branch,
-				base,
-				outputFilename
-			});
-		} catch (err) {
-			console.warn(
-				'No pude precomputar el diff:',
-				err instanceof Error ? err.message : err
-			);
-			ensureReviewDir(launch.repo);
-			writeDiffCache(launch.repo, outputFilename, { branch, base });
-		}
+		const promptOpts = prepareContextOrFail(launch, branch, base, outputFilename, {
+			useClack: false
+		});
 		const prompt = buildPrompt(
 			{
 				source: 'local',
@@ -698,38 +737,13 @@ async function main() {
 	const { branch, base, prompted } = await resolveBranchBase(launch, opts);
 
 	if (branch === base) {
-		// Ambos flags iguales / sin TTY: no se puede corregir en selects.
-		console.log(
-			`Branch y base son iguales (${branch}): el diff estaría vacío.\nAbro la UI para que elijas otra combinación.`
-		);
-		await startServer({
-			host: opts.host,
-			port: opts.port,
-			open: opts.open,
-			launchCwd,
-			openPath: '/'
-		});
-		return;
+		const msg = `Branch y base son iguales (${branch}): no hay diff que revisar.`;
+		if (prompted) p.cancel(msg);
+		else console.error(msg);
+		process.exit(1);
 	}
 
 	const outputFilename = buildOutputFilename(launch.repo, branch, base);
-	// El agente escribe en .diff-review/ (que se ignora sola) y lee de ahí el diff ya calculado.
-	let promptOpts = { outputFilename };
-	try {
-		promptOpts = prepareReviewPromptOpts({
-			repo: launch.repo,
-			branch,
-			base,
-			outputFilename
-		});
-	} catch (err) {
-		const msg = err instanceof Error ? err.message : String(err);
-		if (prompted) p.log.warn(`No pude precomputar el diff: ${msg}`);
-		else console.warn('No pude precomputar el diff:', msg);
-		ensureReviewDir(launch.repo);
-		writeDiffCache(launch.repo, outputFilename, { branch, base });
-	}
-
 	if (!prompted) {
 		console.log(`Repo:   ${launch.repo}`);
 		console.log(`Branch: ${branch}  (base: ${base})`);
@@ -737,6 +751,11 @@ async function main() {
 		p.note(`${branch}  →  ${base}\n${outputRelPath(outputFilename)}`, 'Review');
 	}
 
+	// El agente escribe en .diff-review/ (que se ignora sola) y lee de ahí el diff ya calculado.
+	const promptOpts = prepareContextOrFail(launch, branch, base, outputFilename, {
+		useClack: prompted || isInteractive()
+	});
+
 	const prompt = buildPrompt(
 		{
 			source: 'local',

package/lib/acp-policy.mjs

@@ -1,15 +1,16 @@
 /**
  * Qué puede hacer el agente cuando corre por ACP. Cada `session/request_permission` pasa por acá: no hay nadie
  * mirando la terminal para aprobar, así que la política es una allowlist (leer, comandos de solo lectura y escribir
- * dentro de `.diff-review/`) y todo lo demás se rechaza.
+ * el JSON de salida en `.diff-review/`) y todo lo demás se rechaza.
  *
  * Ojo: el agente solo pide permiso para lo que *su* configuración no aprueba sola (p. ej. Claude Code aplica la
  * allowlist de `~/.claude/settings.json` antes de preguntar). Esto acota lo que pide, no lo que el usuario ya
  * habilitó en su agente.
  */
-import { isAbsolute, normalize, resolve } from "node:path";
+import { realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, normalize, resolve } from "node:path";
 import { checkShell } from "./acp-shell.mjs";
-import { OUTPUT_DIR } from "./output-name.mjs";
+import { outputRelPath } from "./output-name.mjs";
 
 /**
  * @typedef {"review" | "ask" | "edit"} PolicyMode
@@ -32,10 +33,34 @@ function samePath(a, b, platform = process.platform) {
   return platform === "win32" ? na.toLowerCase() === nb.toLowerCase() : na === nb;
 }
 
+/**
+ * Resuelve symlinks cuando el path (o un ancestro) existe. Sin eso, un link dentro del repo
+ * puede apuntar fuera y pasar `isInside` con solo `resolve`.
+ * @param {string} path
+ */
+function canonicalPath(path) {
+  try {
+    return realpathSync(path);
+  } catch {
+    const parts = [];
+    let cur = normalize(path);
+    for (;;) {
+      const parent = dirname(cur);
+      if (!parent || parent === cur) return normalize(path);
+      parts.unshift(basename(cur));
+      try {
+        return resolve(realpathSync(parent), ...parts);
+      } catch {
+        cur = parent;
+      }
+    }
+  }
+}
+
 /** @param {string} child @param {string} root */
 function isInside(child, root, platform = process.platform) {
-  const c = normalize(child);
-  const r = normalize(root).replace(/[\\/]+$/, "");
+  const c = normalize(canonicalPath(child));
+  const r = normalize(canonicalPath(root)).replace(/[\\/]+$/, "");
   const [cc, rr] = platform === "win32" ? [c.toLowerCase(), r.toLowerCase()] : [c, r];
   return cc === rr || cc.startsWith(`${rr}\\`) || cc.startsWith(`${rr}/`);
 }
@@ -68,6 +93,66 @@ function commandOf(rawInput) {
   return typeof cmd === "string" ? cmd : "";
 }
 
+/**
+ * Comando de shell que la política evalúa (rawInput, backticks o título entero).
+ * Cursor a veces envuelve el script con `@…@` en el título.
+ * @param {ToolCallLike} toolCall
+ */
+export function toolCallCommand(toolCall) {
+  const fromRaw = commandOf(toolCall.rawInput).trim();
+  if (fromRaw) return fromRaw;
+  const title = String(toolCall.title ?? "").trim();
+  const tick = /^`([\s\S]+)`$/.exec(title);
+  if (tick) return tick[1].trim();
+  const at = /^@\s*([\s\S]*?)\s*@$/.exec(title);
+  if (at) return at[1].trim();
+  return title;
+}
+
+/**
+ * Etiqueta corta del agente si el título no es el comando mismo.
+ * @param {ToolCallLike} toolCall
+ * @param {string} [command]
+ */
+export function toolCallLabel(toolCall, command = toolCallCommand(toolCall)) {
+  const title = String(toolCall.title ?? "").trim();
+  if (!title) return "";
+  if (/^`[\s\S]+`$/.test(title) || /^@\s*[\s\S]*?\s*@$/.test(title)) return "";
+  const norm = (s) => s.replace(/\s+/g, " ").trim();
+  if (command && norm(title) === norm(command)) return "";
+  if (command && command.length >= 24 && title.includes(command.slice(0, 24))) return "";
+  return title;
+}
+
+/**
+ * Motivo de denegación legible en la UI de permisos.
+ * @param {string} reason
+ */
+export function humanizePolicyReason(reason) {
+  const r = String(reason || "").trim();
+  if (!r) return "La política bloqueó este pedido.";
+  let m;
+  if ((m = /^(.+?) no está permitido$/.exec(r))) {
+    return `La política bloqueó «${m[1]}» (no está en la allowlist de comandos).`;
+  }
+  if ((m = /^variables de entorno en el comando:\s*(.*)$/s.exec(r))) {
+    const token = String(m[1] || "?").trim().slice(0, 40);
+    return `La política interpretó parte del comando como variable de entorno (${token}) y lo bloqueó.`;
+  }
+  if ((m = /^path fuera del repo:\s*(.*)$/s.exec(r))) {
+    return `El path queda fuera del repo: ${m[1]}`;
+  }
+  if ((m = /^lectura fuera del repo:\s*(.*)$/s.exec(r))) {
+    return `Lectura fuera del repo: ${m[1]}`;
+  }
+  if ((m = /^opción global de git no permitida:\s*(.*)$/s.exec(r))) {
+    return `Opción de git no permitida: ${m[1]}`;
+  }
+  if (r.startsWith("git ")) return `Comando git no permitido por la política: ${r}`;
+  if (r.startsWith("solo se puede escribir") || r.includes("sin path") || r.startsWith("modo pregunta")) return r;
+  return `La política bloqueó el pedido: ${r}`;
+}
+
 /**
  * ¿El comando de shell solo lee? Ver `checkShell` en `acp-shell.mjs`.
  * @param {string} command
@@ -87,15 +172,17 @@ export function decidePermission(toolCall, { repo, outputFilename, mode }) {
   const paths = toolCallPaths(toolCall, repo);
 
   if (kind === "read" || kind === "search") {
+    if (!paths.length) {
+      return { allow: false, reason: `${kind === "search" ? "búsqueda" : "lectura"} sin path` };
+    }
     const outside = paths.find((p) => !isInside(p, repo));
     return outside ? { allow: false, reason: `lectura fuera del repo: ${outside}` } : { allow: true, reason: "lectura" };
   }
   if (kind === "think") return { allow: true, reason: "pensar" };
 
   if (kind === "execute") {
-    // Cursor no manda `rawInput`: el comando viene solo en el título, entre backticks.
-    const title = String(toolCall.title ?? "").trim();
-    const cmd = commandOf(toolCall.rawInput) || (/^`([\s\S]+)`$/.exec(title)?.[1] ?? title);
+    // Cursor no manda `rawInput`: el comando viene en el título (backticks / @…@ / texto).
+    const cmd = toolCallCommand(toolCall);
     const check = checkShell(cmd, { repo });
     return check.ok ? { allow: true, reason: "comando de solo lectura" } : { allow: false, reason: check.reason };
   }
@@ -103,14 +190,14 @@ export function decidePermission(toolCall, { repo, outputFilename, mode }) {
   if (kind === "edit" || kind === "delete") {
     if (mode === "ask") return { allow: false, reason: "modo pregunta: no se edita nada" };
     if (!paths.length) return { allow: false, reason: `${kind === "delete" ? "borrado" : "edición"} sin path` };
-    const reviewRoot = resolve(repo, OUTPUT_DIR);
-    const outside = paths.find((p) => !isInside(p, reviewRoot) && !samePath(p, reviewRoot));
+    const target = resolve(repo, outputRelPath(outputFilename));
+    const outside = paths.find((p) => !samePath(canonicalPath(p), canonicalPath(target)));
     return outside
       ? {
           allow: false,
-          reason: `solo se puede escribir en ${OUTPUT_DIR}/ (no ${outside})`
+          reason: `solo se puede escribir ${outputRelPath(outputFilename)} (no ${outside})`
         }
-      : { allow: true, reason: `escritura en ${OUTPUT_DIR}/` };
+      : { allow: true, reason: `escritura de ${outputRelPath(outputFilename)}` };
   }
 
   return { allow: false, reason: `${kind} no permitido: ${toolCall.title ?? "?"}` };

package/lib/acp-policy.test.mjs

@@ -1,7 +1,15 @@
 import { test } from "node:test";
 import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { decidePermission, permissionOutcome } from "./acp-policy.mjs";
+import {
+  decidePermission,
+  humanizePolicyReason,
+  permissionOutcome,
+  toolCallCommand,
+  toolCallLabel,
+} from "./acp-policy.mjs";
 
 const repo = process.platform === "win32" ? "C:\\repos\\app" : "/repos/app";
 const out = "diff-rev_75eca0c739_52eb729c8f.json";
@@ -19,12 +27,43 @@ test("decidePermission: lecturas solo dentro del repo", () => {
   const home = process.platform === "win32" ? "C:\\Users\\me\\.ssh\\id_rsa" : "/home/me/.ssh/id_rsa";
   assert.equal(decidePermission(read(home), ctx()).allow, false);
   assert.equal(decidePermission(read(join(repo, "..", "otro", "x")), ctx()).allow, false);
+  assert.equal(decidePermission({ kind: "read", title: "Read", rawInput: {} }, ctx()).allow, false);
+  assert.equal(decidePermission({ kind: "search", title: "Grep", rawInput: { pattern: "x" } }, ctx()).allow, false);
+  assert.equal(decidePermission({ kind: "search", title: "Grep", rawInput: { pattern: "x", path: "lib" } }, ctx()).allow, true);
 });
 
-test("decidePermission: escritura libre en .diff-review/, nunca en modo pregunta ni fuera", () => {
+test("decidePermission: symlink dentro del repo que apunta afuera no pasa", () => {
+  const root = mkdtempSync(join(tmpdir(), "dr-policy-"));
+  const outside = mkdtempSync(join(tmpdir(), "dr-policy-out-"));
+  writeFileSync(join(outside, "secret.txt"), "secret");
+  mkdirSync(join(root, "lib"), { recursive: true });
+  writeFileSync(join(root, "lib", "ok.mjs"), "ok");
+  const link = join(root, "escape");
+  try {
+    // junction en Windows no pide admin; 'dir' en posix.
+    symlinkSync(outside, link, process.platform === "win32" ? "junction" : "dir");
+  } catch (err) {
+    rmSync(root, { recursive: true, force: true });
+    rmSync(outside, { recursive: true, force: true });
+    // Entornos sin permiso de symlink: no fallar el suite.
+    if (err && (err.code === "EPERM" || err.code === "EACCES")) return;
+    throw err;
+  }
+  const local = (mode = "review") => ({ repo: root, outputFilename: out, mode });
+  try {
+    assert.equal(decidePermission(read(join(root, "lib", "ok.mjs")), local()).allow, true);
+    assert.equal(decidePermission(read(join(link, "secret.txt")), local()).allow, false);
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+    rmSync(outside, { recursive: true, force: true });
+  }
+});
+
+test("decidePermission: escritura solo del JSON objetivo, nunca en modo pregunta ni fuera", () => {
   assert.equal(decidePermission(edit(outPath), ctx("review")).allow, true);
   assert.equal(decidePermission(edit(`.diff-review/${out}`), ctx("edit")).allow, true);
-  assert.equal(decidePermission(edit(join(repo, ".diff-review", "scratch.tmp")), ctx("review")).allow, true);
+  assert.equal(decidePermission(edit(join(repo, ".diff-review", "scratch.tmp")), ctx("review")).allow, false);
+  assert.equal(decidePermission(edit(join(repo, ".diff-review", out.replace(/\.json$/i, ".diff"))), ctx("review")).allow, false);
   assert.equal(decidePermission(edit(outPath), ctx("ask")).allow, false);
   // Fuera de .diff-review/: no.
   assert.equal(decidePermission(edit(join(repo, out)), ctx("review")).allow, false);
@@ -61,6 +100,20 @@ test("decidePermission: comandos según isAllowedShell y el resto rechazado", ()
   assert.equal(decidePermission({ kind: "delete", title: "rm", rawInput: {} }, ctx("edit")).allow, false);
 });
 
+test("toolCallCommand / toolCallLabel y humanizePolicyReason para la UI de permisos", () => {
+  assert.equal(toolCallCommand({ kind: "execute", rawInput: { command: "git status" } }), "git status");
+  assert.equal(toolCallCommand({ kind: "execute", title: "`ls -la`" }), "ls -la");
+  assert.equal(
+    toolCallCommand({ kind: "execute", title: "@\nnode -e 'x'\n@" }),
+    "node -e 'x'"
+  );
+  assert.equal(toolCallLabel({ title: "Probe symlink" }, "node -e 'x'"), "Probe symlink");
+  assert.equal(toolCallLabel({ title: "`ls`" }, "ls"), "");
+  assert.equal(toolCallLabel({ title: "@node@" }, "node"), "");
+  assert.match(humanizePolicyReason("node no está permitido"), /allowlist/);
+  assert.match(humanizePolicyReason("variables de entorno en el comando: @"), /variable de entorno/);
+});
+
 test("permissionOutcome elige once / always según el scope", () => {
   const options = [
     { optionId: "a1", kind: "allow_always", name: "Siempre" },

package/lib/acp-shell.mjs

@@ -6,7 +6,8 @@
  * El comando se tokeniza respetando comillas (un `grep "a\|b"` no es un pipe). Se aceptan `|`, `&&`, `||`, `;` y
  * descartar salida a /dev/null; cualquier otra redirección, `$(…)`, backticks o `&` lo rechazan.
  */
-import { isAbsolute, normalize, resolve } from "node:path";
+import { realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, normalize, resolve } from "node:path";
 
 /** @typedef {{ ok: true } | { ok: false, reason: string }} ShellCheck */
 
@@ -99,18 +100,48 @@ const TEXT_ARGS = new Set(["echo", "printf", "tr", "write-output", "which", "typ
 /** Destinos de redirección que solo descartan salida. */
 const DISCARD = new Set(["/dev/null", "nul", "$null"]);
 
-/** `/c/Users/...` (Git Bash) → `C:/Users/...` en Windows. */
+/**
+ * Paths de shell Unix → forma Windows cuando la política corre en win32:
+ * - Git Bash: `/c/Users/...` → `C:/Users/...`
+ * - WSL: `/mnt/c/Users/...` → `C:/Users/...`
+ */
 function toNativePath(p, platform) {
   if (platform === "win32") {
+    const wsl = /^\/mnt\/([a-zA-Z])(\/|$)(.*)$/.exec(p);
+    if (wsl) return `${wsl[1].toUpperCase()}:/${wsl[3]}`;
     const msys = /^\/([a-zA-Z])(\/|$)(.*)$/.exec(p);
     if (msys) return `${msys[1].toUpperCase()}:/${msys[3]}`;
   }
   return p;
 }
 
+/**
+ * Resuelve symlinks cuando el path (o un ancestro) existe. Sin eso, un link
+ * dentro del repo puede apuntar fuera y pasar `isInside` con solo `normalize`.
+ * @param {string} path
+ */
+function canonicalPath(path) {
+  try {
+    return realpathSync(path);
+  } catch {
+    const parts = [];
+    let cur = normalize(path);
+    for (;;) {
+      const parent = dirname(cur);
+      if (!parent || parent === cur) return normalize(path);
+      parts.unshift(basename(cur));
+      try {
+        return resolve(realpathSync(parent), ...parts);
+      } catch {
+        cur = parent;
+      }
+    }
+  }
+}
+
 function isInside(child, root, platform) {
-  const c = normalize(child).replace(/[\\/]+$/, "");
-  const r = normalize(root).replace(/[\\/]+$/, "");
+  const c = normalize(canonicalPath(child)).replace(/[\\/]+$/, "");
+  const r = normalize(canonicalPath(root)).replace(/[\\/]+$/, "");
   const [cc, rr] = platform === "win32" ? [c.toLowerCase(), r.toLowerCase()] : [c, r];
   return cc === rr || cc.startsWith(`${rr}\\`) || cc.startsWith(`${rr}/`);
 }
@@ -318,13 +349,12 @@ function isValidate(argv) {
  */
 function checkReviewDirMkdir(argv, ctx) {
   const name = argv[0].toLowerCase();
-  const reviewRoot = normalize(resolve(ctx.repo, ".diff-review")).replace(/[\\/]+$/, "");
+  const reviewRoot = resolve(ctx.repo, ".diff-review");
   /** @param {string} arg */
   const underReviewDir = (arg) => {
     const native = toNativePath(String(arg || "").replace(/^~(?=[\\/]|$)/, "/__home__"), ctx.platform);
-    const abs = normalize(isAbsolute(native) ? native : resolve(ctx.repo, native)).replace(/[\\/]+$/, "");
-    const [a, r] = ctx.platform === "win32" ? [abs.toLowerCase(), reviewRoot.toLowerCase()] : [abs, reviewRoot];
-    return a === r || a.startsWith(`${r}\\`) || a.startsWith(`${r}/`);
+    const abs = isAbsolute(native) ? native : resolve(ctx.repo, native);
+    return isInside(abs, reviewRoot, ctx.platform);
   };
 
   if (name === "mkdir" || name === "md") {

package/lib/acp-shell.test.mjs

@@ -1,5 +1,7 @@
 import { test } from "node:test";
 import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { checkShell, tokenizeShell } from "./acp-shell.mjs";
 
@@ -121,7 +123,36 @@ test("checkShell permite mkdir bajo .diff-review en el repo", () => {
   assert.equal(ok("New-Item -ItemType Directory lib"), false);
 });
 
-test("checkShell entiende los paths de Git Bash en Windows", { skip: !win }, () => {
+test("checkShell entiende paths de Git Bash y WSL en Windows", { skip: !win }, () => {
   assert.equal(ok("cat /c/repos/app/lib/a.mjs"), true);
   assert.equal(ok("cat /c/Users/me/.ssh/id_rsa"), false);
+  assert.equal(ok("cd /mnt/c/repos/app && ls -la"), true);
+  assert.equal(ok("cat /mnt/c/repos/app/lib/a.mjs"), true);
+  assert.equal(ok("cd /mnt/c/Users/me && ls"), false);
+  assert.equal(ok("cat /mnt/c/Users/me/.ssh/id_rsa"), false);
+});
+
+test("checkShell rechaza symlink dentro del repo que apunta afuera", () => {
+  const root = mkdtempSync(join(tmpdir(), "dr-shell-"));
+  const outside = mkdtempSync(join(tmpdir(), "dr-shell-out-"));
+  writeFileSync(join(outside, "secret.txt"), "secret");
+  mkdirSync(join(root, "lib"), { recursive: true });
+  writeFileSync(join(root, "lib", "ok.mjs"), "ok");
+  const link = join(root, "escape");
+  try {
+    symlinkSync(outside, link, process.platform === "win32" ? "junction" : "dir");
+  } catch (err) {
+    rmSync(root, { recursive: true, force: true });
+    rmSync(outside, { recursive: true, force: true });
+    if (err && (err.code === "EPERM" || err.code === "EACCES")) return;
+    throw err;
+  }
+  try {
+    assert.equal(checkShell(`cat "${join(root, "lib", "ok.mjs")}"`, { repo: root }).ok, true);
+    assert.equal(checkShell(`cat "${join(link, "secret.txt")}"`, { repo: root }).ok, false);
+    assert.equal(checkShell(`cd "${link}" && ls`, { repo: root }).ok, false);
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+    rmSync(outside, { recursive: true, force: true });
+  }
 });