Summary

• Harden sandboxed media path resolution by blocking hard-linked files when the os.tmpdir() bypass path is used.
• Prevent aliasing an out-of-sandbox file via a tmp hard link (the prior logic only blocked symlink traversal).
• Add a regression test that reproduces and asserts rejection of the hard-link alias case.

Change Type

• Security fix (filesystem containment hardening)
• Regression test

Scope

• src/agents/sandbox-paths.ts
• src/agents/sandbox-paths.test.ts

Security Impact

• Boundary crossed before fix: sandbox/workspace media path containment.
• Impact: a tmp hard link could alias an out-of-sandbox readable file and be accepted as a valid media source.
• Worst case: secret/file exfiltration via media send flows that trust resolveSandboxedMediaSource output.

Repro + Verification

1. Create a file outside sandbox root.
2. Create a hard link to it under os.tmpdir().
3. Call resolveSandboxedMediaSource({ media: <hardlinkPath>, sandboxRoot: <sandboxRoot> }).
4. Before fix: path resolves and can be read, leaking external content.
5. After fix: throws with a hard-link rejection error.

Automated verification:

• pnpm exec vitest run src/agents/sandbox-paths.test.ts --maxWorkers=1

Evidence

• Local PoC (before fix) resolved a tmp hard-link path and read TOP-SECRET from an out-of-sandbox source file.
• Added test: rejects hardlinked tmpdir paths to outside files.

Human Verification

1. Run the hard-link PoC locally (outside file + tmp hard link + resolveSandboxedMediaSource).
2. Confirm rejection error references hard-linked tmp media paths.
3. Re-run the targeted Vitest command above.

Compatibility / Migration

• No config migration required.
• Only tmp files with nlink > 1 are newly rejected in this path; standard tmp files continue to work.

Failure Recovery

• If a workflow hits this guard, replace hard-link usage with a real copied file in tmp/workspace and retry.

Risks and Mitigations

• Risk: legitimate tmp files intentionally managed as hard links may now fail.
• Mitigation: guard is scoped to the tmp bypass path only, and regular copied files remain unaffected.

Greptile Summary

Closes a sandbox escape vector where a hard link under os.tmpdir() could alias an out-of-sandbox file, bypassing the existing symlink-only traversal check in resolveAllowedTmpMediaPath. The fix adds assertNoHardlinkedFinalPath which uses lstat().nlink > 1 to detect and reject hard-linked files in the tmp media path. A regression test reproduces the attack (create outside file, hard-link it into tmpdir, call resolveSandboxedMediaSource) and verifies rejection.

• Adds assertNoHardlinkedFinalPath() in sandbox-paths.ts that rejects regular files with nlink > 1 in the tmp bypass path
• Hooks the new check into resolveAllowedTmpMediaPath after the existing assertNoSymlinkEscape call
• New test creates a real hard link and asserts rejection, with proper guards for Windows, cross-device links, and path overlap edge cases
• No changes to the sandbox root path or workspace path resolution — only the tmp bypass path is affected

Confidence Score: 5/5

• This PR is safe to merge — it adds a narrowly scoped security check with no risk to existing functionality.
• The change is minimal and well-targeted: a single new guard function (assertNoHardlinkedFinalPath) hooked into one specific code path (resolveAllowedTmpMediaPath). The nlink > 1 check is the standard approach for detecting hard links on Unix. The function correctly uses lstat (not stat), handles missing files and non-regular files gracefully, and only affects the tmp bypass path. The regression test is thorough with proper edge-case handling. No existing behavior is altered for normal (non-hardlinked) tmp files.
• No files require special attention.

_{Last reviewed commit: 68ca732}