From 2a6f74027fa61f1e994547285ff62964ac9770a2 Mon Sep 17 00:00:00 2001
From: sim <sim@local>
Date: Sat, 12 Sep 2026 18:49:48 -0400
Subject: [PATCH] chore(#4653): backfill PR 4672 into both changesets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Also corrects the Changed fragment: it named three containment exports as the
only ones, which stopped being true when the lexical family was added to close
DW1/DW9. It now describes one decision resolved two ways, and says why the
lexical pair exists rather than leaving a reader to assume it is a weaker
alternative to the realpath form.

scripts/lint-docs-required.cjs now passes (ok_docs_updated) — it could not
evaluate against the mandated pr:0 placeholder.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .changeset/eager-badgers-bark.md   | 4 ++--
 .changeset/gallant-hawks-tumble.md | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.changeset/eager-badgers-bark.md b/.changeset/eager-badgers-bark.md
index 7882a6145..ab8071b6a 100644
--- a/.changeset/eager-badgers-bark.md
+++ b/.changeset/eager-badgers-bark.md
@@ -1,5 +1,5 @@
 ---
 type: Changed
-pr: 0
+pr: 4672
 ---
-**The path-containment predicate is now a single exported seam** — `security.cjs` no longer exports `validatePath`; `assertWithinRoot` (throws), `tryWithinRoot` (returns null) and `requireSafePath` are the only containment exports, and all three return a branded `ContainedPath` so a validated path cannot be silently swapped for an unvalidated one. The per-call-site `{ allowAbsolute: true }` flag is replaced by the named `PathAcceptance` policy, which states what it actually permits: an absolute path outside the root was always rejected and still is. The traversal rejection text `Path escapes allowed directory: <resolved> is outside <base>` is preserved verbatim, and no command changes what it accepts or rejects. Three rejection MESSAGES are reworded, none of which now reveals a host path it previously hid: `state.cts`'s `<label> path rejected: …` becomes `<label> path validation failed: …`, and the sub-repo and agent-skills warnings name the condition instead of echoing the predicate's error string. (#4653)
+**The path-containment predicate is now a single exported seam** — `security.cjs` no longer exports `validatePath`. Containment is decided in exactly one place and resolved two ways: `assertWithinRoot` (throws) and `tryWithinRoot` (returns null) resolve symlinks, while `assertWithinRootLexical` and `tryWithinRootLexical` use string resolution alone and never touch the filesystem, for the few callers that must preserve a symlink rather than resolve it or that validate a destination before it exists. `requireSafePath` is preserved as an alias of the throwing form. All of them return a branded `ContainedPath` so a validated path cannot be silently swapped for an unvalidated one. The per-call-site `{ allowAbsolute: true }` flag is replaced by the named `PathAcceptance` policy, which states what it actually permits: an absolute path outside the root was always rejected and still is. The traversal rejection text `Path escapes allowed directory: <resolved> is outside <base>` is preserved verbatim, and no command changes what it accepts or rejects. Three rejection MESSAGES are reworded, none of which now reveals a host path it previously hid: `state.cts`'s `<label> path rejected: …` becomes `<label> path validation failed: …`, and the sub-repo and agent-skills warnings name the condition instead of echoing the predicate's error string. (#4653)
diff --git a/.changeset/gallant-hawks-tumble.md b/.changeset/gallant-hawks-tumble.md
index 124cd9a50..95dd7409b 100644
--- a/.changeset/gallant-hawks-tumble.md
+++ b/.changeset/gallant-hawks-tumble.md
@@ -1,5 +1,5 @@
 ---
 type: Security
-pr: 0
+pr: 4672
 ---
 **Installed capability skills can no longer be redirected or leaked through a symlink** — the three install paths that confine a capability skill name relied on a lexical check, which cannot see a symlink. A link planted at the destination let `mkdirSync` succeed silently and the SKILL.md write land outside the install root, and a link planted at a capability's own SKILL.md was followed by `statSync` so an outside file's contents were installed as a skill body. All three now refuse to write or read through a link. (#4636)