[modacker]

What broke

packages/local-runtime/src/turns/file-changes.ts — the turn-diff capture layer — resolved the captured path lexically and then read it with fs.stat / fs.open. Both of those follow symlinks.

A path inside the workspace whose final component is a symlink to a file outside it passes the lexical check — the string is inside the workspace — and only then resolves outside it. The capture therefore put the content of a file outside the workspace into the turn-diff record, and from there into the database and into the WebUI review panel.

The write side of the same hole was closed by #232. The read side was still lexical.

Why it failed

normalizeCapturePath / safeCapturedPath answer the question "is this path inside the workspace as a string". snapshotCapturedFile took that answer as the containment decision and read the file.

With link.txt inside the workspace symlinked to outside/secret.txt, the persisted record held:

"content":"outside-secret-v1\n"
"diff":"-outside-secret-v1\n+outside-secret-v2-with-a-different-length\n"

What this changes

snapshotCapturedFile now asks a second question before it reads anything: does the path really live inside the workspace?

• isCapturedPathInsideWorkspace compares the real path of the target with the real path of the workspace root, reusing the resolveRealPath / isInsideDirectory helpers fix(local-runtime): contain turn-diff mutation targets by real path #232 added to this file. The two helpers stay private to the module: reading and writing are the same boundary and the same file.
• A target that escapes is still recorded — the turn did touch it, and the review panel should say so — but with metadata only: the size/mtime hash and the oversized marker this layer already reads as "no content was captured". The content is never read, never stored, never rendered.
• Because the snapshot carries no content, the rewind path does not restore it either: assertSnapshotComplete rejects an oversized snapshot, and diff-rewind.ts turns that into a skipped entry.

Paths that resolve outside the workspace on purpose are unchanged: normalizeCapturePath hands back the absolute path for those, and that is the capture layer's deliberate record of "a write landed outside the workspace". Those keep their existing behaviour.

How it was checked

• The fixtures drive the real capture service over the real SQLite store, so the assertions are about what actually lands in the persisted record — not about an internal helper's return value.
• Before the fix: 3 failed | 3 passed. The failures carried "content":"outside-secret-v1\n" and the unified diff of the outside file.
• After the fix: 6 passed — the three escapes (a file symlink, a symlinked directory, a relative symlink) plus three positive controls (a file inside the workspace, a symlink pointing at another file inside the workspace, and a workspace reached through a symlinked root).
• diff-mutation-symlink-containment.test.ts (10) + diff-mutation-precheck.test.ts (11) + this file (6) → 27 passed.
• packages/local-runtime/test → 38 files / 923 passed / 14 skipped.
• npx tsc -p tsconfig.standalone.json --noEmit → exit 0.
• node scripts/source-inventory.mjs → Public source check passed: 5420 files (the manifest is regenerated by the generator, not hand-edited).

Not addressed here

• The race between the check and the read. The real path is resolved before the read, so a symlink swapped in between is still a race. Closing it needs a read that cannot follow a link (O_NOFOLLOW), which is a larger change than this refusal.
• A hardlink is still not caught. realpath cannot tell a hardlink from a regular file: a hardlink inside the workspace that also points at a file outside it passes every path check, and writing to it changes the outside file. The path-based boundary does not cover it.
• Deliberately-outside absolute paths still keep their content (see above). Tightening that is a product decision about the external marker, not a defect fix.
• Windows has no coverage: the suite skips there, because creating a symlink needs privileges.