[teamleaderleo]

Leo, 2026-11-03: "yeah let's do alllll of those things! :DDD", on the folder sync improvements. This one is the symlinks piece:

Keep symlinks whose target resolves inside the synced root, as symlinks. Skip ones that point outside it, and list them with the reason.

What changes

cmux link sync push / pull (cmux-tui/crates/cmux-tui/src/link/sync_cli):

• Push. A symlink whose target resolves inside the folder now goes to the machine as a symlink. Its text is kept as written when it is relative and stays inside by its own words; an absolute target inside the folder is rewritten relative from the link's folder. The record (cmux-sync.json) gains links: {path: {target}}, omitted when empty, so older records still read. A link this push made and that is gone here is deleted on the machine only while the machine still has it with the same text. A path where the machine holds something else is left alone and named.

• Pull. A machine symlink comes back as a symlink by the same three-way rule as files, with the link text as its content: changed on both sides is a conflict and nothing here changes. The machine is not trusted, so only a relative text that stays inside the folder by its own words comes back. Absolute, climbing (../../..), and .git-reaching texts are skipped. Links are made and removed through the existing O_NOFOLLOW folder handles and roll back with the rest of the transaction (place.rs). The pull answer now also has skipped_files / skipped_counts.

• Skipped and named on both sides: outside the folder, to nothing, into the repository folder, the machine too old, something else at the path.

• Daemon (cmux-tui-core fs_ops). A new capability, fs-symlink-v1, with two ops:

  • fs.readlink {path} returns {target, revision}, and never follows the link.
  • fs.symlink {path, target} makes a link, never over anything that is there. The target must be relative, and it must stay inside the root when counted from where the link's folder really is, with every link on the way followed.

  The link entry gate admits these two ops exactly. A machine without them refuses the op, and the client then skips every link with the reason "this Cloud machine is too old to make one" instead of failing the push.

• A cmux link access share (files only) still takes no symlinks.

Risk

This touches sync state and user data, so it gets a different-model review. The new daemon ops are fenced the same way as the rest of fs-v1:

• descriptor-relative, with no follow of the last component;
• create-only;
• relative targets only, with a lexical depth check against the walk's real depth.

The resolver already refuses to follow any link out of the roots. On this Mac, nothing is ever written through a symlink.

Tests

• tests/link_sync.rs
  • an_inside_symlink_round_trips_and_an_outside_one_is_skipped_and_named: push, then a machine edit, a pull, a re-pull and a re-push.
  • a_symlink_changed_on_both_sides_is_a_conflict_that_changes_nothing.
  • outside_git_heavy_folders_secrets_and_links_stay_and_are_named is updated: the inside link now arrives as a link.
• place.rs: symlinks_are_placed_and_put_back_and_a_changed_one_stays (roll back).
• links.rs: unit tests for text resolution and rewriting.
• fs_wire_tests.rs: a_symlink_is_made_inside_the_root_and_one_leaving_it_is_refused, plus the gate tests extended to the two new ops.

Observed / Not run

• Ran on the fleet with cmux-ci test: cargo test -p cmux-tui --test link_sync, the link unit tests, the cmux-tui-core fs tests and clippy (-D warnings). Results are in the first comment.
• Not run here: a DEV-build push/pull against a real Cloud machine. That end-to-end check is done after all three sync PRs land.

Changelog

Added: Folder sync keeps symlinks that point inside the folder, as symlinks, and lists the ones it skips with the reason.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Keeps symlinks that stay inside a synced folder as symlinks in cmux link sync push and pull; symlinks pointing outside the folder, to nothing, or into a repository folder are skipped and named with the reason on both sides. The pull answer now also includes skipped_files and skipped_counts.

• Push sends an inside symlink as a symlink, keeping relative text as written and rewriting an absolute inside target relative to the link's folder; a file is never written through a machine's symlink.
• Pull applies the same three-way rule as files, but only a relative text that stays inside the folder comes back, checked through every link on its way as this Mac's disk compares names; a symlink changed on both sides is a conflict that changes nothing, and one at or above the git hooks folder never comes back.
• A new daemon capability, fs-symlink-v1, adds fs.readlink and fs.symlink: descriptor-relative, create-only, never following the last component, and accepting only relative targets that stay inside the root once every link on their way is followed.
• Machines without the capability skip these symlinks with a named reason instead of failing the push.
• A symlink named like the sync record is never pushed, and one swapped for a file mid-pull goes back on rollback.
• cmux link access shares still take no symlinks.

^{Written for commit dab083f. Summary will update on new commits.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 7394586: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr34362 -f ref=lane/link-sync-symlinks -f platform=macos -f backend_mode=local

web and size checks: green

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4177134165301 (4a7517355a)
• cmux NEXT nightly 1.0.0-nightly.4177399658201 (443d56f95d)
• cmux NEXT nightly 1.0.0-nightly.4177479261801 (0df62819ad)

[teamleaderleo]

Owned by an agent session · session

[blacksmith-sh]

Found 2 test failures on Blacksmith runners:

Failures

Test	View Logs
test_live_typed_catalog_matches_every_registry (main.ContractRegistryTests.test_liv e_typed_catalog_matches_every_registry)/ test_live_typed_catalog_matches_every_registry (main.ContractRegistryTests.test_liv e_typed_catalog_matches_every_registry)	View Logs
test_live_typed_catalog_matches_every_registry (main.ContractRegistryTests.test_liv e_typed_catalog_matches_every_registry)/ test_live_typed_catalog_matches_every_registry (main.ContractRegistryTests.test_liv e_typed_catalog_matches_every_registry)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Review (codex gpt-6.1-sol xhigh, router-review): BLOCK at 7b1cf6b

BLOCK at 7b1cf6b
Visual verdict: no images; Leo tries the build

1. [P1] [blocking] sync_cli.rs:602: Exclude the manifest name from set.links. A local .cmux-sync.json -> data.txt is pushed as a symlink because the reserved-name filter only removes regular files. The final manifest write follows that symlink and overwrites remote data.txt with JSON. Filter reserved symlink paths before remote mutations.

2. [P1] [blocking] place.rs:397: Preserve the moved entry when read_link fails. If an editor replaces the symlink with a regular file between entry() and move_aside(), read_link returns EINVAL. This branch returns without restoring the file or recording undo information; rollback succeeds and staging cleanup permanently deletes the concurrent save. Every post-move error must restore or retain the entry.

3. [P1] [blocking] pull.rs:180: Validate target traversal through other links. For a sync rooted at ~/projects/site, both src/up -> .. and leak -> src/up/../../.ssh/id_ed25519 pass this lexical check. Together they create a local link to ~/.ssh/id_ed25519, outside the synced folder. Validate against the local and planned symlink graph so an untrusted machine cannot bypass the boundary with chained links.

4. [P1] [blocking] pull.rs:178: Keep files-only access pulls from accepting symlinks. cmux link access calls this same pull implementation without a files-only restriction. A machine can now create local symlinks or replace a previously shared regular file with one; base refused those replacements. Carry the files-only policy into pull and reject symlinks before planning either new paths or replacements.

5. [P2] [follow-up] pull.rs:171: Account for rewritten absolute targets in the local comparison. Push records a relative target while leaving the local absolute link unchanged. If the machine subsequently edits or deletes that link, its untouched local counterpart differs from the recorded base and produces a false conflict. Preserve the original local text separately or compare using a consistent representation.

[teamleaderleo]

Review (codex gpt-6-astra high, router-review): BLOCK at 6e736fb

BLOCK at 6e736fb
Visual verdict: no images; Leo tries the build

1. [P1] [blocking] pull.rs:180: Check link chains using destination filesystem name matching. With new machine links d/up -> .. and leak -> d/UP/../../victim, the exact-case map lookup misses d/up while validating leak. Both links are accepted, but on a case-insensitive Mac, leak resolves to ../victim outside the synced folder. The local lookup cannot catch links that this pull has yet to create.

2. [P1] [blocking] sync_cli.rs:556: Prevent file uploads through a retained, changed symlink. Push link -> a, then replace the local link with a regular file and retarget the machine link to a machine-only file. ours() correctly refuses deletion, but the subsequent file-upload loop still writes to link. PendingWrite::begin follows the final symlink, overwriting the unrelated machine file. Skip the conflicting path before uploading.

3. [P1] [blocking] ops.rs:359: Resolve target-side symlinks before accepting creation. Two calls creating root/alias -> . and root/leak -> alias/../secret both pass this depth check, although leak points outside the allowed root. The filesystem reproduction confirms native reads through it reach the outside file. The existing resolver protects subsequent fs.* access, but does not make the created link safe for other programs.

4. [P2] [follow-up] pull.rs:214: Skip and name dangling links on pull. A machine link new -> nonexistent passes both checks because unresolved components count as directories. Pull creates and records it instead of reporting “a symlink (to nothing)” as promised. Check target existence as well as containment.

Validation: source review and isolated filesystem/algorithm reproductions; Cargo was unavailable.

[teamleaderleo]

I’m adding a repository-sync barrier for Cloud agent startup and writes. Your symlink work overlaps the legacy cmux link sync push path that needs the same barrier; I will keep your branch unchanged.

The shared primitive is cmux_git::sync_barrier::{Sync, probe} (commit 90e51b20e9c75d86fbd7886756a31ca77b80a7e5). Git seeding acquires Sync before returning its start response, completes it only after checkout/submodules/LFS, and leaves interrupted syncs blocked. Agent startup and daemon-owned writes wait on it.

For the legacy copy path, the proposed extension is connection-owned fs.sync.begin / fs.sync.finish: acquire before destination mutations, release as ready after the final manifest, and drop incomplete when the control connection disconnects. The marker open must reuse the descriptor-relative path sandbox; the guard must be keyed by connection, not principal. This touches fs_ops, fs_wire, disconnect handling, and sync_cli::push_inner, so it should build on your symlink changes.

Can you confirm whether you are already adding a transfer transaction, or whether I should stack this extension after your PR?

[teamleaderleo]

Review (codex gpt-6-astra high, router-review): BLOCK at 9be686e

BLOCK at 9be686e

Visual verdict: no images; Leo tries the build

1. [P1] [blocking] sync_cli.rs:785-793 checks only the final component before writing. fs.stat/fs.write follow symlinks in parent components, so a machine-side remote/sub -> other causes a local sub/file to be written under other/file (and a race can swap any component after the check). This violates the no-write-through-symlink guarantee and can corrupt data outside the synced folder.

Follow-ups:

2. [P1] [follow-up] pull.rs:232-236 accepts dangling relative machine links. links::reaches_inside treats a missing terminal path as inside, so link -> missing is recreated locally instead of skipped and named as “to nothing.”

[teamleaderleo]

Review (codex gpt-6-astra high, router-review): BLOCK at 7394586

BLOCK at 7394586
Visual verdict: no images; Leo tries the build

1. [P1] [blocking] Fail closed on unreadable local symlink targets. In cmux-tui/crates/cmux-tui/src/link/sync_cli/pull.rs:189, a non-UTF-8 target contributes no link text, so validation treats that symlink as a directory. On Linux, an existing bridge -> ../outside-\xFF lets a machine-supplied incoming -> bridge/secret pass validation and resolve outside the synced root. Reject chains containing symlinks whose targets cannot be read or decoded.

2. [P2] [follow-up] Skip dangling links on pull. In cmux-tui/crates/cmux-tui/src/link/sync_cli/pull.rs:233, both checks validate containment without checking existence. Consequently, new-link -> nonexistent is installed and recorded instead of skipped and named as promised. Check target existence against the planned resulting tree.

Rust tests could not run because cargo is unavailable.

[teamleaderleo]

Review (codex gpt-6-astra high, router-review): SHIP at 7394586

Visual verdict: no images; Leo tries the build

Checked the fixes for the earlier BLOCK rounds: link chains on pull, the hooks-folder fence, writes through machine links (the file's own path and the folders above it), daemon target checks, and the manifest name. The router could not post this receipt itself because the GraphQL quota ran out, so the lane posted it.

Follow-ups:

• link sync pull: name links as unsupported on a machine without fs-symlink-v1 #34716: a pull from a machine without fs-symlink-v1 should name its links as unsupported.
• link sync push: record links made before a push is cut off #34717: record the links a push made before it was cut off.
• link sync pull: skip and name a machine symlink that points at nothing #34426: a pull should skip and name a machine link that points at nothing.

Fleet checks at this head: link_sync 24/24, cmux-tui --lib link::, cmux-tui-core --lib fs_, clippy and fmt all green (https://github.com/manaflow-ai/cmux/actions/runs/41757276644).