M12-04D Status

status: done task: resolve symlink/hardlink entries before writing and constrain them to the temporary root updated: 2026-08-18 America/New_York enablingTask: false parityStateChange: false

Scope

Archive entries are parsed before any write. Every member is canonicalized as a relative path under the declared temporary-root identity. Symlink targets resolve relative to the link's parent; hardlink targets resolve from the archive root and must end at a regular file. Absolute, drive-shaped, URI, backslash-smuggled, traversal, missing-target, cyclic, duplicate, and hardlink-to-directory inputs fail closed with IO_ARCHIVE_UNSAFE.

The resolver returns a write plan with the final in-root target and an explicit withinTemporaryRoot: true proof for every member. It does not follow or write any link before the entire manifest has passed validation.

Evidence

npm --prefix web run test:library-link-safety passed 5/5 unit tests.
Parent-directory symlinks, archive-root hardlinks, and chained links resolve to canonical in-root members.
Absolute/UNC/drive/URI/traversal targets, missing members, cycles, duplicate paths, undeclared fields, and hardlinks to directories are rejected before a write plan is returned.

Artifact Hashes

parent manifest: a7f3a45eb7f68d022f38185a1c1409e1db1b27647fef587d66d2ffa52d78f98e
protocol: d55a4ba762898aed22bdcc7aa6493c713ee94f6bb1bf58754fdc459d0ddf70d1
unit: 7739275be91222d7bfb61d2f5a1daf812c6860fe34d0aea27df8380a77322120
package commands: cfb232baa494ff59f6c8d65514a08c86332ee9354350b2a0392b6f932a7ee42c

Next Task

M12-04E: archive first reads the central directory/manifest and does not extract payload first.

Rollback

Remove the archive link-safety protocol, unit suite, manifest, package command, and this status entry. Restore M12-04C to pending and move the machine queue back to M12-04D. No parity ledger rollback is required.

1.9 KiB Raw Blame History