felixxia-oai 6f51c65958 Fix macOS system-alias matching in patch permission checks (#47879) ...

## Why

Local `apply_patch` permission checks can treat a macOS system alias and its canonical spelling as different locations, sending writes covered by temporary-directory grants for unnecessary approval.

## What changed

- Normalize trusted top-level aliases in local policy roots and patch targets, reusing a prepared matcher for permission requests and patch safety checks.
- Share alias normalization with Seatbelt and the macOS executor sandbox while preserving mutable symlinks and missing descendants.
- Preserve read-only and deny precedence, protected metadata restrictions, and remote URI matching. Propagate normalization failures from fallible permission checks.

## Testing

Add macOS regressions for multi-file patches with missing parent directories through both direct `apply_patch` calls and shell interception, asserting automatic approval and file contents. Add unit coverage for alias restriction precedence, mutable symlink preservation, missing descendants, and remote permission isolation.

GitOrigin-RevId: 0822ff951eaab728cb1ad91281745fa1b8809f15

2026-09-24 16:36:57 +00:00

..

absolutize.rs

Fix plugin cache panic when cwd is unavailable (#18499)

2026-04-18 19:04:53 -07:00

lib.rs

Fix macOS system-alias matching in patch permission checks (#47879)

2026-09-24 16:36:57 +00:00

system_aliases_tests.rs

Fix macOS system-alias matching in patch permission checks (#47879)

2026-09-24 16:36:57 +00:00

system_aliases.rs

Fix macOS system-alias matching in patch permission checks (#47879)

2026-09-24 16:36:57 +00:00