fix(filesystem): check a retargeted allowed-directory symlink before creating under it

A Root's advertised form can be a symlink, which can be retargeted after the
Roots load. resolveUnicodeEquivalentPath started its walk for a missing path
from the allowed directory's realpath without checking it, so write_file or
create_directory under a retargeted alias landed outside every allowed
directory. Check that starting realpath like each component below it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: cliffhall <cliff@futurescale.com>

Author: cliffhall

src/filesystem/__tests__/server-roots.test.ts

@@ -132,6 +132,36 @@ describe("initial roots", () => {
     }
   });
 
+  // #5183: the advertised form names a symlink, which can be retargeted after
+  // the Roots load. A new file or directory under it must still be refused
+  // when the symlink now leads outside every allowed directory.
+  it("refuse creating under a root alias retargeted outside the root (#5183)", async () => {
+    const link = path.join(cliDir, "link-to-root");
+    await fs.symlink(rootDir, link);
+    const { client } = await connectTracked([], {
+      capabilities: ROOTS,
+      listRoots: () => [rootOf(link)],
+    });
+    await vi.waitFor(async () =>
+      expect(await allowedDirectoriesOf(client)).toEqual([link, rootDir]),
+    );
+    const outside = path.join(cliDir, "outside");
+    await fs.mkdir(outside);
+    await fs.rm(link);
+    await fs.symlink(outside, link);
+
+    const written = await call(client, "write_file", {
+      path: path.join(link, "new.txt"),
+      content: "x",
+    });
+    expect(textOf(written)).toMatch(/^Access denied/);
+    const created = await call(client, "create_directory", {
+      path: path.join(link, "a", "b"),
+    });
+    expect(textOf(created)).toMatch(/^Access denied/);
+    expect(await fs.readdir(outside)).toEqual([]);
+  });
+
   // #5183: the advertised form is kept as the client spelled it. Trimming
   // whitespace or quotes from it would name a different directory, here an
   // unrelated sibling, and allow it. POSIX only: Windows filenames cannot end

src/filesystem/lib.ts

@@ -267,6 +267,19 @@ async function resolveUnicodeEquivalentPath(
   }
 
   let currentPath = await fs.realpath(allowedDirectory);
+  // An allowed directory can be a symlink (the advertised form of a Root or a
+  // command-line directory), retargeted since it was allowed, so its realpath
+  // is checked like every component below it (#5183).
+  if (
+    !isPathWithinAllowedDirectories(
+      normalizePathFormat(currentPath),
+      allowedDirectories,
+    )
+  ) {
+    throw new Error(
+      `Access denied - symlink target outside allowed directories: ${currentPath} not in ${allowedDirectories.join(", ")}`,
+    );
+  }
   const relativeParts = path
     .relative(allowedDirectory, absolutePath)
     .split(path.sep)