fix: block sensitive symlink targets

2026-05-25 16:28:57 +08:00
parent dc8b06f961
commit 2f28b4880e
4 changed files with 31 additions and 0 deletions
--- a/task_plan.md
+++ b/task_plan.md
@@ -30,3 +30,4 @@
 | Time | Phase | Error | Attempt | Resolution |
 | --- | --- | --- | --- | --- |
 | 2026-05-25 | 1 | 代码质量审查发现 symlink 边界绕过、敏感文件大小写匹配、缺少操作域 resolver、`CODEX_HOME` 未生效 | TDD 补充失败测试后修复 `codexhome` 和 `app` | 已通过最终验证 |
+| 2026-05-25 | 1 | 规格复审发现 `ResolveAgentTOML` 可通过 `agents/*.toml` symlink 指向 root `auth.json` 绕过 forbidden 检查 | TDD 补充 symlink-to-auth 测试后检查 resolved final target | 已通过最终验证 |