fix(F7): canonicalize paths in permission check_path to follow symlinks (#82)

Track F-HIGH #7 from ROADMAP.md.

## Problem

`resolve_absolute` (`permission/checker.rs:370-376`) joined
relative paths against working_dir but never followed symlinks.
A user could create:

  ln -s /etc/passwd ./benign-name.txt

…and any deny rule on `/etc/**` would be bypassed because the
pattern matcher only saw `./benign-name.txt`. Same hole for
external-directory rules in `Accept` mode.

## Fix

`resolve_absolute` now calls `std::fs::canonicalize` on the
joined path. canonicalize() resolves symlinks AND normalizes
`.` / `..` lexically — the path the rule matches is now the
real target, not the link name.

Three-level fallback for nonexistent paths (writes to new files
need to resolve too):

1. Try `canonicalize(full_path)` — works for existing paths +
   symlinks.
2. If that fails (NotFound on write-to-new), try
   `canonicalize(parent) + basename` — catches
   `/safe/parent/../../etc/passwd` style attacks where the
   parent exists.
3. If even the parent can't canonicalize (test fixture dirs
   that don't exist on disk), fall back to the lexical join.
   Matches pre-F7 behavior so existing permission tests on
   not-yet-existing paths still match.

## Tests

Two new tests in `permission::checker::tests`:

- `resolve_absolute_follows_symlinks`: creates a tempdir with
  `real-secret.txt` and a `benign-name.txt` symlink to it;
  asserts resolve returns the real target's canonical path,
  not the link name. Handles macOS `/tmp -> /private/tmp` by
  canonicalizing the expected path too.
- `resolve_absolute_handles_nonexistent_via_parent_canonicalize`:
  parent dir exists but the leaf doesn't; asserts the result is
  `canonical(parent) / leaf` — proves the second-level fallback
  works without breaking parent resolution.

662 pass (was 660). All build profiles clean.

Co-authored-by: Yogthos <yogthos@gmail.com>

Author: yogthos

src/permission/checker.rs

@@ -369,10 +369,41 @@ impl PermissionChecker {
 
 fn resolve_absolute(path: &str, working_dir: &str) -> String {
     let p = Path::new(path);
-    if p.is_absolute() {
-        p.to_string_lossy().to_string()
+    let joined = if p.is_absolute() {
+        p.to_path_buf()
     } else {
-        Path::new(working_dir).join(p).to_string_lossy().to_string()
+        Path::new(working_dir).join(p)
+    };
+    // F7: canonicalize so symlinks resolve to their real target.
+    // Without this, a symlink like `safe_link -> /etc/passwd` would
+    // be checked against rules as `safe_link`, bypassing any
+    // `/etc/**` deny / external-directory rule. opencode handles
+    // this implicitly via TypeScript fs APIs that follow links;
+    // Rust requires the explicit call.
+    //
+    // Fallback: if canonicalize fails (path doesn't exist yet —
+    // e.g. a write to a new file), normalize `.` / `..` lexically
+    // and return the joined path as-is. The non-existence is
+    // intentional for write ops; canonicalize() would return
+    // NotFound and we'd lose the path entirely.
+    match std::fs::canonicalize(&joined) {
+        Ok(canonical) => canonical.to_string_lossy().to_string(),
+        Err(_) => {
+            // The path doesn't exist (write to new file, parent
+            // also missing, etc.). Try canonicalize on the parent
+            // then re-append the basename — catches
+            // `/safe/parent/../../etc/passwd` style attacks where
+            // the parent exists but the leaf doesn't. If even the
+            // parent doesn't canonicalize, fall back to the
+            // LEXICAL join (matches pre-F7 behavior so rules on
+            // not-yet-existing paths still match).
+            if let (Some(parent), Some(name)) = (joined.parent(), joined.file_name())
+                && let Ok(canonical_parent) = std::fs::canonicalize(parent)
+            {
+                return canonical_parent.join(name).to_string_lossy().to_string();
+            }
+            joined.to_string_lossy().to_string()
+        }
     }
 }
 
@@ -389,6 +420,64 @@ mod tests {
         )
     }
 
+    /// F7: `resolve_absolute` must follow symlinks so a symlink
+    /// pointing at a deny-listed path can't bypass the rule.
+    #[test]
+    fn resolve_absolute_follows_symlinks() {
+        // Create a temp dir with a real file + a symlink to it.
+        // Use a unique dir per test process to avoid collisions
+        // across parallel test runs.
+        let dir =
+            std::env::temp_dir().join(format!("dirge-f7-symlink-test-{}", std::process::id(),));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        let target = dir.join("real-secret.txt");
+        std::fs::write(&target, "hunter2").unwrap();
+        let link = dir.join("benign-name.txt");
+
+        #[cfg(unix)]
+        std::os::unix::fs::symlink(&target, &link).unwrap();
+        #[cfg(windows)]
+        std::os::windows::fs::symlink_file(&target, &link).unwrap();
+
+        let resolved = resolve_absolute(link.to_str().unwrap(), "/");
+        // The resolved path must match the real target, not the
+        // symlink name. Canonicalize the comparand too — on macOS
+        // /tmp is itself a symlink to /private/tmp.
+        let expected = std::fs::canonicalize(&target)
+            .unwrap()
+            .to_string_lossy()
+            .into_owned();
+        assert_eq!(resolved, expected, "symlink should resolve to its target",);
+
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// F7: nonexistent paths (writes to new files) must still
+    /// resolve sensibly. They can't canonicalize fully but we
+    /// canonicalize the parent so `/real/parent/../../etc/passwd`
+    /// becomes `/etc/passwd` instead of staying lexical.
+    #[test]
+    fn resolve_absolute_handles_nonexistent_via_parent_canonicalize() {
+        let dir =
+            std::env::temp_dir().join(format!("dirge-f7-newfile-test-{}", std::process::id(),));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        let new_file = dir.join("does-not-exist-yet.txt");
+
+        let resolved = resolve_absolute(new_file.to_str().unwrap(), "/");
+        // The leaf doesn't canonicalize but the parent does.
+        // Expected form: canonical(parent) / "does-not-exist-yet.txt"
+        let expected_parent = std::fs::canonicalize(&dir).unwrap();
+        let expected = expected_parent
+            .join("does-not-exist-yet.txt")
+            .to_string_lossy()
+            .into_owned();
+        assert_eq!(resolved, expected);
+
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
     // Regression: "allow always" → `cd *` saved to session allowlist must
     // satisfy the NEXT bash check for `cd /absolute/path`. Before the fix,
     // path-glob semantics on `*` (`[^/]*`) refused to match the absolute