sortie-dogs 0.12.5 → 0.12.6

package/dist/plugin/index.js

@@ -7,7 +7,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     return path;
 };
 import { createHash, randomUUID } from "node:crypto";
-import { lstat, mkdir, open, readFile, readdir, realpath, rm, stat, writeFile } from "node:fs/promises";
+import { lstat, mkdir, open, readFile, readdir, readlink, realpath, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { RUNTIME_ASSET_VERSION } from "../asset-version.js";
 import { GOAL_DECLARATION_FORMAT, GOAL_DELIVERY_INTENTS, GOAL_DELIVERY_MODES, GOAL_CRITERION_ENUMS, expandGoalDeclaration } from "../core/goal-declaration-format.js";
@@ -235,6 +235,7 @@ async function durableScopeRoot(projectRoot) {
 }
 async function protectedScopeDigest(projectRoot, paths, manifestHash) {
     const entries = [];
+    const canonicalRoot = await realpath(projectRoot);
     const visit = async (absolute) => {
         const scoped = relative(projectRoot, absolute).replaceAll("\\", "/");
         if (scoped === ".." || scoped.startsWith("../") || isAbsolute(scoped))
@@ -248,8 +249,22 @@ async function protectedScopeDigest(projectRoot, paths, manifestHash) {
             entries.push([scoped, "missing"]);
             return true;
         }
-        if (metadata.isSymbolicLink())
-            return false;
+        if (metadata.isSymbolicLink()) {
+            // Package managers place executable links under node_modules/.bin. Record
+            // both the link and its target bytes, but never follow a link out of the
+            // project or recurse through a linked directory (which may form a cycle).
+            const target = await realpath(absolute).catch(() => undefined);
+            if (target === undefined)
+                return false;
+            const relativeTarget = relative(canonicalRoot, target);
+            if (relativeTarget === ".." || relativeTarget.startsWith("../") || isAbsolute(relativeTarget) ||
+                !(await stat(target)).isFile())
+                return false;
+            const link = await readlink(absolute);
+            const contents = await readFile(target);
+            entries.push([scoped, `symlink:${link}`, createHash("sha256").update(contents).digest("hex")]);
+            return true;
+        }
         if (metadata.isDirectory()) {
             entries.push([scoped, "directory"]);
             const children = await readdir(absolute);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sortie-dogs",
-  "version": "0.12.5",
+  "version": "0.12.6",
   "description": "Bounded agent harness and validated orchestration loop plugin for OpenCode",
   "keywords": [
     "opencode",