fix(io/local): resolve symlinks on sandbox root #10

Merged

Snider merged 1 commit from fix/macos-sandbox-symlink into dev

2026-02-19 14:22:28 +00:00

Author	SHA1	Message	Date
Snider	cbaa114bb2	fix(io/local): resolve symlinks on sandbox root to prevent false escape detection Some checks failed Auto Merge / merge (pull_request) Has been cancelled Details CI / qa (pull_request) Has been cancelled Details Coverage / coverage (pull_request) Has been cancelled Details PR Build / build (amd64, linux, ubuntu-latest) (pull_request) Has been cancelled Details PR Build / draft-release (pull_request) Has been cancelled Details On macOS, /var is a symlink to /private/var. When New() stores the unresolved root but validatePath() resolves child paths via EvalSymlinks, the mismatch causes filepath.Rel to produce ".." prefixes — triggering false SECURITY sandbox escape warnings on every file operation. Fix: resolve symlinks on the root path in New() so both sides compare like-for-like. Updates TestNew to compare against resolved paths. Co-Authored-By: Virgil <virgil@lethean.io>	2026-02-19 14:20:39 +00:00