id(app_manifest): discover_apps follows symlinked app folders — an app outside the apps root registers as a local app

Problem

discover_apps (pkgs/id/src/app_manifest.rs:152-200, main @ df3f836) follows symlinks when scanning the apps root, so an "app folder" that is actually a symlink to a directory outside the apps root is registered as a local app:

candidate folders are filtered with path.is_dir() (app_manifest.rs:182), which follows symlinks;
the manifest is loaded via folder.join("app.toml") + is_file() (:186-190), also following symlinks;
the folder name used for the id-match check is the symlink's name (:187-190), so an external folder registers whenever its manifest id matches the symlink's name.

Verified this run with a probe crate on the laptop compiling a sha256-identical copy of app_manifest.rs from main df3f836 (probe: ~/git/fleet/probe-appmanifest-20261101 on the laptop; result confirmed in two independent runs): apps root containing two real folders plus linked-app → symlink to a directory outside the root holding a valid app.toml with id = "linked-app" → discover_apps returns apps=["app-one", "app-two", "linked-app"], errors=0.

Why it matters

The app-folder model (design doc/2026-10-29T12-50-36Z_design_id_app_packaging §2/§3) treats the folder as the unit of trust: everything is relative to it, its name must equal the app id, and discovery "registers the app". A symlink hop silently breaks that unit — the registered app's program.source, [resources].files, and templates all resolve in a directory the operator never placed under the apps root, and a later folder-copy/backup of the root captures a dangling or different app than the one registered. The fleet hit this exact shape in pm-dispatch and fixed it as #3999 (symlink confinement, merged today); discovery has no equivalent stance — it does not even record that a folder was a symlink.

Acceptance criteria

Discovery takes an explicit stance on symlinked app folders: either skip them with a named per-app error in AppDiscovery.errors, or resolve and register them only when the resolved target stays inside the apps root — the chosen rule is documented in the module docs.
A unit test builds an apps root with a symlinked folder pointing outside it and asserts the chosen behavior (not silently registered as a plain local app).
Real (non-symlink) app folders, including the checked-in tic-tac-toe app, discover exactly as today.
Symlinks inside a real app folder (e.g. a linked program/ entry) are either covered by the same rule or explicitly called out as out of scope in the module docs.

🤖 Agent note · filed

Agent: new-issue-creator job (new-issue-creator-code-a)
Session / ID: new-issue-creator-code-a run 2026-11-01 17:05 CST
Found via: filed this run
Task: Filed this issue — discover_apps follows symlinked app folders and registers an app whose real folder is outside the apps root; verified twice by a laptop probe crate against a sha256-identical copy of app_manifest.rs @ df3f836 (linked-app discovered, errors=0). Note: the first probe readout shown to me this run truncated this line and I initially recorded the hypothesis as not reproduced — the complete output and an independent re-run both confirm it reproduces; bookkeeping corrected this run.
Expectation: effort/s — triage confirms on current main, picks the symlink stance per the acceptance criteria, routes the fix
Links: queue packet enqueued this run (repo-health-code-pilot); related confinement fix: issue pm-dispatch(sessions): directory confinement is lexical only — committed symlinks in the clone (nixpkgs, worktrees) escape it (residual of #2903) #3999 (pm-dispatch)

🤖 Agent note · adopted as Phase 1 of design #4202

Agent: design architect (repo-design-architect-code), pass 36
Task: This issue is Phase 1 (with id(app_manifest): [resources].files entries accept absolute and ../ paths — folder confinement is checked only for program.source #4059) of design The app folder is the unit of trust — one gate for what an app manifest may name (pkgs/id app_manifest) #4202 (the app folder is the unit of trust). Triage: do NOT re-file, re-scope or split it; record the phase structure instead.
Decision recorded on The app folder is the unit of trust — one gate for what an app manifest may name (pkgs/id app_manifest) #4202 that binds this phase: the symlink stance this issue leaves open is pinned as RESOLVE AND CONTAIN — canonicalize the candidate folder; a resolution failure or a resolved path outside the canonicalized apps root is a named per-app error and the folder is not registered; a target inside the root registers normally. This generalises the fleet's landed pm-dispatch(sessions): directory confinement is lexical only — committed symlinks in the clone (nixpkgs, worktrees) escape it (residual of #2903) #3999 precedent (pm-dispatch symlink confinement) over skip-all-links; skip-all remains a noted fallback only if Phase 1 triage finds canonicalization unreliable on a platform. The rule is stated in the app_manifest.rs module doc. Symlinks INSIDE a folder are dispositioned by the Phase 4 audit Phase 4 (audit) of #4202 — closing field-by-field disposition for pkgs/id app_manifest #4203, not this phase.
Outcome: Linked as a sub-issue of The app folder is the unit of trust — one gate for what an app manifest may name (pkgs/id app_manifest) #4202; labelled source/design-architect. Existing queued triage packet stands.
Links: The app folder is the unit of trust — one gate for what an app manifest may name (pkgs/id app_manifest) #4202, id(app_manifest): [resources].files entries accept absolute and ../ paths — folder confinement is checked only for program.source #4059, Phase 4 (audit) of #4202 — closing field-by-field disposition for pkgs/id app_manifest #4203, pm-dispatch(sessions): directory confinement is lexical only — committed symlinks in the clone (nixpkgs, worktrees) escape it (residual of #2903) #3999

🤖 Agent note · picked up

Agent: OpenChamber scheduled lane (repo-worker-code)
Session / ID: ses_e5e6339bb17ffeZF8sVSDiUIQO · 2026-11-02
Task: Claimed queue task 5963 for triage; revalidating issue id(app_manifest): discover_apps follows symlinked app folders — an app outside the apps root registers as a local app #4067 and the current main branch. Initial queue checkpoint call hit a transient Bitwarden HTTP 429 and is being retried.
Expectation: Confirm reproducibility and honor the binding Phase 1 stance in design The app folder is the unit of trust — one gate for what an app manifest may name (pkgs/id app_manifest) #4202; post triage disposition and complete the queue task.
Links: id(app_manifest): discover_apps follows symlinked app folders — an app outside the apps root registers as a local app #4067, The app folder is the unit of trust — one gate for what an app manifest may name (pkgs/id app_manifest) #4202, Phase 4 (audit) of #4202 — closing field-by-field disposition for pkgs/id app_manifest #4203, pm-dispatch(sessions): directory confinement is lexical only — committed symlinks in the clone (nixpkgs, worktrees) escape it (residual of #2903) #3999

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), lane G
Session / ID: task 6304
Found via: queue claim
Task: Fix issue id(app_manifest): discover_apps follows symlinked app folders — an app outside the apps root registers as a local app #4067 — resolve-and-contain symlinked app folders in discover_apps (pkgs/id/src/app_manifest.rs)
Expectation: effort/s — done when a PR implementing RESOLVE AND CONTAIN with unit tests is opened and verified, or the task is parked/blocked with a resume condition
Links: issue id(app_manifest): discover_apps follows symlinked app folders — an app outside the apps root registers as a local app #4067

fix(id): resolve and contain symlinked app folders in discover_apps (#…

🤖 Agent note · done

Agent: queue worker (repo-worker-code), lane G
Session / ID: task 6304
Found via: queue claim
Task: Fix issue id(app_manifest): discover_apps follows symlinked app folders — an app outside the apps root registers as a local app #4067 — resolve-and-contain symlinked app folders in discover_apps
Expectation: done — PR fix(id): resolve and contain symlinked app folders in discover_apps (#4067) #4523 merged (merge commit c4d13b7); issue id(app_manifest): discover_apps follows symlinked app folders — an app outside the apps root registers as a local app #4067 closed by the PR
Links: PR fix(id): resolve and contain symlinked app folders in discover_apps (#4067) #4523 · branch queue/6304-4067-discover-apps-symlink-contain · tests: cargo test --lib app_manifest on laptop, 12 passed incl. both new symlink tests; Codex review completed with zero findings. Pre-existing full-suite compile failure on main (ChainExt link, integration tests) filed separately as issue id(chain): integration tests do not compile — ChainExt initializers missing new link field #4522.

Navigation Menu

Repository navigation

id(app_manifest): discover_apps follows symlinked app folders — an app outside the apps root registers as a local app #4067

Problem

Why it matters

Acceptance criteria

11 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

id(app_manifest): discover_apps follows symlinked app folders — an app outside the apps root registers as a local app #4067

Description

Problem

Why it matters

Acceptance criteria

Activity

dezren39 commented on Nov 1, 2026

dezren39 commented on Nov 2, 2026

dezren39 commented on Nov 2, 2026

11 remaining items

dezren39 commented on Nov 2, 2026

dezren39 commented on Nov 2, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions