fix(agent): apply symlink fail-close guard to own-file --dry-run installs (#129)

The codex managed-section branch already runs inspectTargetPath during
--dry-run ([P2]) so a planted symlink is refused the same way the real
install refuses it. The own-file targets (claude, cursor, cline,
antigravity) skipped that guard in dry-run and reported the write as
successful, so 'agent install --dry-run' could claim success for an
install that would actually exit 5.

Run the same guard in the own-file dry-run branch and cover both the
symlinked-target and symlinked-parent cases with regression tests.

Co-authored-by: ahndohun <19940813+ahndohun@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: ahndohun

src/commands/agent.test.ts

@@ -1311,6 +1311,50 @@ describe('runInstall — symlink safety', () => {
     expect(writeCalls.length).toBe(0); // never wrote a .bak nor through the link
   });
 
+  it('dry-run: refuses (exit 5) when the target file is a symlink (parity with real install)', async () => {
+    const { fs: agentFs, writeCalls, seedSymlink } = makeMemFs();
+    // Same planted SKILL.md symlink as the real-install case above: dry-run
+    // must report the same refusal the real install would, not a success.
+    seedSymlink(path.resolve(CWD, TARGETS.claude.path));
+    const { deps } = makeCapture();
+
+    let thrown: unknown;
+    try {
+      await runInstall(
+        { ...BASE_OPTS, target: ['claude'], force: false, dryRun: true },
+        { cwd: CWD, fs: agentFs, ...deps },
+      );
+    } catch (err) {
+      thrown = err;
+    }
+
+    expect(thrown).toBeInstanceOf(CLIError);
+    expect((thrown as CLIError).exitCode).toBe(5);
+    expect((thrown as CLIError).message).toContain('symlink');
+    expect(writeCalls.length).toBe(0);
+  });
+
+  it('dry-run: refuses (exit 5) when a parent path component is a symlink', async () => {
+    const { fs: agentFs, writeCalls, seedSymlink } = makeMemFs();
+    seedSymlink(path.resolve(CWD, '.claude'));
+    const { deps } = makeCapture();
+
+    let thrown: unknown;
+    try {
+      await runInstall(
+        { ...BASE_OPTS, target: ['claude'], force: false, dryRun: true },
+        { cwd: CWD, fs: agentFs, ...deps },
+      );
+    } catch (err) {
+      thrown = err;
+    }
+
+    expect(thrown).toBeInstanceOf(CLIError);
+    expect((thrown as CLIError).exitCode).toBe(5);
+    expect((thrown as CLIError).message).toContain('symlink');
+    expect(writeCalls.length).toBe(0);
+  });
+
   it('does not write through a symlinked .bak slot — backs up to a numbered slot', async () => {
     const { store, fs: agentFs, seedFile, seedSymlink } = makeMemFs();
     const abs = path.resolve(CWD, TARGETS.claude.path);

src/commands/agent.ts

@@ -638,6 +638,17 @@ export async function runInstall(opts: InstallOptions, deps: AgentDeps = {}): Pr
       const content = renderForTarget(t, skill, bodyForSkill(skill)).content;
 
       if (opts.dryRun) {
+        // Apply the SAME symlink fail-close guard as the real install path
+        // below (the codex managed-section branch already does this). Without
+        // it, dry-run reports success for a planted symlink that the real
+        // install would refuse with exit 5.
+        const dryRunSt = await inspectTargetPath(agentFs, root, relPath);
+        if (dryRunSt !== null && !dryRunSt.isFile) {
+          throw new CLIError(
+            `${relPath} exists but is not a regular file — remove it and re-run.`,
+            5,
+          );
+        }
         const bytes = Buffer.byteLength(content, 'utf8');
         dryRunLines.push({ abs, bytes, note: '' });
         results.push({ target: t, path: relPath, action: 'dry-run', skills: [skill] });