Key delete_file containment off the parent directory

Author: TheGreatAxios

src/plugins/delete-file-plugin.test.ts

@@ -1,8 +1,10 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import {
   chmod,
+  lstat,
   mkdtemp,
   mkdir,
+  readFile,
   realpath,
   rm,
   stat,
@@ -31,6 +33,15 @@ async function exists(path: string): Promise<boolean> {
   }
 }
 
+async function linkExists(path: string): Promise<boolean> {
+  try {
+    await lstat(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 describe("deleteFilePlugin", () => {
   let cwd: string;
 
@@ -130,6 +141,43 @@ describe("deleteFilePlugin", () => {
     await rm(outside, { recursive: true, force: true });
   });
 
+  test("deletes a dangling symlink inside cwd (CL-6729)", async () => {
+    const link = join(cwd, "broken-link");
+    await symlink(join(cwd, "does-not-exist.txt"), link);
+    expect(await linkExists(link)).toBe(true);
+
+    const result = await handler()(
+      call("broken-link"),
+      new AbortController().signal,
+    );
+
+    expect(result.isError ?? false).toBe(false);
+    expect(String(result.content)).toContain("Deleted file: broken-link");
+    expect(await linkExists(link)).toBe(false);
+  });
+
+  test("deletes a link with an outside referent without touching the referent (CL-6729)", async () => {
+    const outside = await mkdtemp(
+      join(tmpdir(), "corbits-delete-link-referent-"),
+    );
+    const referent = join(outside, "keep.txt");
+    await writeFile(referent, "keep");
+    const link = join(cwd, "outside-link");
+    await symlink(referent, link);
+    expect(await linkExists(link)).toBe(true);
+
+    const result = await handler()(
+      call("outside-link"),
+      new AbortController().signal,
+    );
+
+    expect(result.isError ?? false).toBe(false);
+    expect(String(result.content)).toContain("Deleted file: outside-link");
+    expect(await linkExists(link)).toBe(false);
+    expect(await readFile(referent, "utf8")).toBe("keep");
+    await rm(outside, { recursive: true, force: true });
+  });
+
   test("allowOutside deletes a file outside the working directory", async () => {
     const outside = await mkdtemp(join(tmpdir(), "corbits-delete-yolo-"));
     const path = join(outside, "gone.txt");

src/plugins/delete-file-plugin.ts

@@ -1,5 +1,5 @@
 import { lstat, readFile, unlink } from "node:fs/promises";
-import { resolve } from "node:path";
+import { dirname, resolve } from "node:path";
 import { type } from "arktype";
 import type { ExtraTool, ToolPlugin } from "@intx/tools-posix";
 import type { ToolCall, ToolResult } from "@intx/types/runtime";
@@ -81,14 +81,19 @@ export function deleteFilePlugin(
       }
 
       const allowOutside = resolveAllowOutside(options.allowOutside);
-      // Containment is delegated to the shared workspace resolver, which
-      // realpaths the session root before comparing and admits registered
-      // sibling worktree roots — the same boundary pathEscapePlugin enforces.
+      // Containment is keyed off the parent directory, not the full target:
+      // lstat/unlink never follow the final component, so unlinking a link
+      // itself cannot escape even when the link dangles or points outside.
+      // Resolving the full target would refuse both (UNRESOLVABLE / outside
+      // referent). The shared workspace resolver still realpaths the session
+      // root before comparing and admits registered sibling worktree roots —
+      // the same boundary pathEscapePlugin enforces.
+      const target = resolve(cwd, args.path);
       if (
         !allowOutside &&
         resolveWorkspacePath(
           cwd,
-          args.path,
+          dirname(target),
           options.rootsProvider ?? (() => []),
         ) === undefined
       ) {
@@ -97,7 +102,6 @@ export function deleteFilePlugin(
           `${args.path} resolves outside the working directory`,
         );
       }
-      const target = resolve(cwd, args.path);
       try {
         const info = await lstat(target);
         if (info.isDirectory()) {