fix(snapshot): canonicalize agent directory symlinks at Open

Docker Agent · Docker Agent · commit e3bd4aaaae3c · 2026-05-27T08:07:41.000Z
Address review feedback on #2904. git rev-parse --show-toplevel resolves symlinks, while filepath.Abs preserves them. When the agent's directory is reached through a symlink (e.g. /tmp -> /private/tmp on macOS), r.directory and r.worktree no longer share a prefix, so filepath.Rel produces a '..'-prefixed path and scope() silently falls back to '.' — expanding snapshot operations to the entire worktree and defeating the subfolder fix. EvalSymlinks the abs path at Open() so r.directory uses the same canonicalization as r.worktree. Also stabilizes the shadow gitdir hash for symlinked entry points. Add TestOpenCanonicalizesSymlinkedDirectory to lock this in.
diff --git a/pkg/snapshot/snapshot.go b/pkg/snapshot/snapshot.go
@@ -73,6 +73,15 @@ func (m *Manager) Open(ctx context.Context, dir string) (*Repo, error) {
 	if err != nil {
 		return nil, err
 	}
+	// Canonicalize symlinks so r.directory uses the same convention as the
+	// worktree path returned by `git rev-parse --show-toplevel` (which always
+	// resolves symlinks). Without this, on hosts where the working directory
+	// is reached through a symlink (e.g. /tmp -> /private/tmp on macOS),
+	// filepath.Rel(worktree, directory) would produce a ".."-prefixed path
+	// and scope() would silently expand to the entire worktree.
+	if resolved, err := filepath.EvalSymlinks(abs); err == nil {
+		abs = resolved
+	}
 	worktree, err := gitWorktree(ctx, abs)
 	if err != nil {
 		return nil, err
@@ -482,6 +491,10 @@ func (r *Repo) add(ctx context.Context) error {
 	if err := r.syncExcludes(ctx, nil); err != nil {
 		return err
 	}
+	// Both git plumbing commands emit worktree-root-relative paths here:
+	// diff-files always does so by design, and ls-files is forced to do so
+	// via --full-name. Keeping the conventions aligned is what lets us merge
+	// the two lists and feed them back to git as pathspecs unchanged.
 	diff := r.git(ctx, append(quoteArgs(), r.args(append([]string{"diff-files", "--name-only", "-z", "--"}, r.scope()...)...)...), gitOpts{cwd: r.worktree})
 	other := r.git(ctx, append(quoteArgs(), r.args(append([]string{"ls-files", "--others", "--exclude-standard", "-z", "--full-name", "--"}, r.scope()...)...)...), gitOpts{cwd: r.worktree})
 	if diff.err != nil {
diff --git a/pkg/snapshot/snapshot_test.go b/pkg/snapshot/snapshot_test.go
@@ -170,6 +170,41 @@ func TestSubfolderScopeIgnoresSiblingChanges(t *testing.T) {
 	}, patch.Files)
 }
 
+// Regression test: when the agent's directory is reached through a symlink
+// (e.g. /tmp -> /private/tmp on macOS), git rev-parse --show-toplevel
+// returns the canonicalized path while filepath.Abs preserves the symlink.
+// Without canonicalizing the directory at Open() time, filepath.Rel would
+// produce a "..-prefixed path and scope() would silently expand to the
+// entire worktree — defeating the subfolder-scoping fix.
+func TestOpenCanonicalizesSymlinkedDirectory(t *testing.T) {
+	root := bootstrapRepo(t)
+	sub := filepath.Join(root, "assistant")
+	require.NoError(t, os.MkdirAll(sub, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(sub, "gogo.yaml"), []byte("hello"), 0o644))
+	runGit(t, root, "add", ".")
+	runGit(t, root, "commit", "-m", "add subfolder")
+
+	link := filepath.Join(t.TempDir(), "link")
+	if err := os.Symlink(sub, link); err != nil {
+		t.Skipf("cannot create symlink: %v", err)
+	}
+
+	repo := openRepo(t, link)
+	assert.Equal(t, sub, repo.Directory(), "Open must canonicalize the directory so it matches the worktree-relative scope")
+
+	before, err := repo.Track(t.Context())
+	require.NoError(t, err)
+
+	require.NoError(t, os.WriteFile(filepath.Join(root, "a.txt"), []byte("sibling change"), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(sub, "new.yaml"), []byte("new"), 0o644))
+
+	patch, err := repo.Patch(t.Context(), before)
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{
+		filepath.ToSlash(filepath.Join(repo.Worktree(), "assistant", "new.yaml")),
+	}, patch.Files)
+}
+
 func bootstrapRepo(t *testing.T) string {
 	t.Helper()
 	if _, err := exec.LookPath("git"); err != nil {
