fix(providers,cli,mcp): never descend into a symlink-to-directory

GAP-A02 is the standing rule: a symlink is unlinked, never followed.
`rmdir_recursive`, the used-bytes scan, the rm/purge plan, the MCP delete
preview and MCP storage_quota honoured it. Fifteen other recursive walks
did not. They gated the descent on `is_dir` alone, and `list` resolves a
symlink-to-directory to `is_dir = true` because callers need that to
render the entry, so every one of them walked straight into the link.

On a tree holding `sub/loop -> ..`, `lsjson -R` emitted 123 entries for
3 real ones, stopping only at the MAX_SCAN_DEPTH cap of 100, and `tree
-d 6` reported 6 directories and 3 files where 2 and 1 exist. The
`visited` sets do not catch the cycle: each pass yields a longer,
distinct path string. `build_tree` even carried a comment claiming
"Symlink loop detection" over one of them.

Put the invariant on the type that carries the data, as
`RemoteEntry::is_walkable_dir()`, and gate every descent on it. The
entry keeps `is_dir = true`: only the traversal is refused. Swapping the
guard naively would drop a symlink-to-directory into each walker's
`else` branch, where `get -r` would try to download it and `dedupe`
would hash it. `rmdirs` skips it entirely, out of both the descent stack
and the empty-directory candidate list, because SSH_FXP_RMDIR does not
follow links and removing the link because its target looks empty is not
this tool's call.

Two walks needed more than the guard. `tree`'s text renderer decided to
descend by sniffing a trailing `/` off the rendered name, which a
symlink-to-directory also carries; it now carries `walkable` explicitly
on its queue item. The local_tree agent tool typed entries with
`metadata()`, which follows links; it now uses `file_type()`, which does
not.

Providers other than SFTP always report `is_symlink = false`, so
`is_walkable_dir()` collapses to `is_dir` and nothing changes for S3,
WebDAV or FTP.

Live on a plain OpenSSH remote: the cycle tree drops from 123 entries at
depth 81 to 3 at depth 1, and `tree -d 6` from 6 dirs / 3 files to the
true 2 / 1. On the symlink matrix `link-to-dir` is still listed with
`IsDir: true` while `link-to-dir/inner.txt` is gone, and `ls -l`,
`rm --dry-run -r` and `size` are unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: axpnet

src-tauri/src/ai_core/remote_tools.rs

@@ -1543,7 +1543,9 @@ async fn tree(ctx: &dyn ToolCtx, args: &Value) -> Result<Value, ToolError> {
                     "depth": depth + 1,
                 }));
             }
-            if entry.is_dir && depth + 1 < max_depth + 1 {
+            // Reported with `is_dir: true`, but a symlink-to-dir is never
+            // walked (GAP-A02): a link to `..` would never terminate.
+            if entry.is_walkable_dir() && depth + 1 < max_depth + 1 {
                 queue.push_back((entry.path, depth + 1));
             }
         }
@@ -2197,7 +2199,9 @@ async fn cleanup(ctx: &dyn ToolCtx, args: &Value) -> Result<Value, ToolError> {
             Ok(entries) => {
                 for entry in entries {
                     if entry.is_dir {
-                        dirs.push((entry.path.clone(), depth + 1));
+                        if entry.is_walkable_dir() {
+                            dirs.push((entry.path.clone(), depth + 1));
+                        }
                     } else if entry.name.ends_with(".aerotmp") || entry.path.ends_with(".aerotmp") {
                         orphans.push((entry.path.clone(), entry.size));
                     }
@@ -2418,7 +2422,9 @@ async fn sync_doctor(ctx: &dyn ToolCtx, args: &Value) -> Result<Value, ToolError
             if let Ok(entries) = backend.list(&dir).await {
                 for e in entries {
                     if e.is_dir {
-                        queue.push((e.path.clone(), depth + 1));
+                        if e.is_walkable_dir() {
+                            queue.push((e.path.clone(), depth + 1));
+                        }
                     } else {
                         let relative = e
                             .path
@@ -2531,7 +2537,9 @@ async fn dedupe(ctx: &dyn ToolCtx, args: &Value) -> Result<Value, ToolError> {
             Ok(entries) => {
                 for e in entries {
                     if e.is_dir {
-                        dirs.push((e.path, depth + 1));
+                        if e.is_walkable_dir() {
+                            dirs.push((e.path, depth + 1));
+                        }
                     } else {
                         files.push((e.path, e.size, e.modified));
                     }
@@ -2763,7 +2771,9 @@ async fn reconcile(ctx: &dyn ToolCtx, args: &Value) -> Result<Value, ToolError>
         };
         for e in entries {
             if e.is_dir {
-                queue.push((e.path.clone(), depth + 1));
+                if e.is_walkable_dir() {
+                    queue.push((e.path.clone(), depth + 1));
+                }
             } else {
                 let rel = e
                     .path

src-tauri/src/bin/aeroftp_cli.rs

@@ -7452,7 +7452,12 @@ async fn scan_remote_tree_with_progress(
                         format!("{}/{}", rel_prefix, entry.name)
                     };
                     if entry.is_dir {
-                        queue.push((entry.path.clone(), entry_rel, current_depth + 1));
+                        // A symlink-to-directory is listed but never walked
+                        // (GAP-A02): syncing through one would duplicate the
+                        // target's tree, and a link to `..` never terminates.
+                        if entry.is_walkable_dir() {
+                            queue.push((entry.path.clone(), entry_rel, current_depth + 1));
+                        }
                         continue;
                     }
                     if opts.skip_filenames.iter().any(|name| name == &entry.name) {
@@ -13787,7 +13792,9 @@ async fn size_remote_dir(
                 entry.path.clone()
             };
             if entry.is_dir {
-                stack.push(child);
+                if entry.is_walkable_dir() {
+                    stack.push(child);
+                }
             } else {
                 total_bytes += entry.size;
                 files += 1;
@@ -28102,8 +28109,12 @@ async fn cmd_get_recursive(
             Ok(entries) => {
                 for e in entries {
                     if e.is_dir {
-                        queue.push((e.path.clone(), depth + 1));
-                        dirs.push(e.path);
+                        // Never walk (nor recreate locally) a symlink-to-dir:
+                        // it would copy the target's tree twice, or cycle.
+                        if e.is_walkable_dir() {
+                            queue.push((e.path.clone(), depth + 1));
+                            dirs.push(e.path);
+                        }
                     } else {
                         let relative = e
                             .path
@@ -35095,7 +35106,7 @@ async fn cmd_find(
                             }
                             break;
                         }
-                        if e.is_dir {
+                        if e.is_walkable_dir() {
                             queue.push((e.path.clone(), depth + 1));
                         }
                         if matcher.is_match(&e.name) {
@@ -35742,7 +35753,11 @@ async fn cmd_rmdirs(url: &str, path: &str, force: bool, cli: &Cli, format: Outpu
         match provider.list(&dir).await {
             Ok(entries) => {
                 for entry in entries {
-                    if !entry.is_dir {
+                    // A symlink-to-directory is neither descended into nor
+                    // offered as an empty-directory candidate (GAP-A02):
+                    // SSH_FXP_RMDIR does not follow links, and removing the
+                    // link because its target looks empty is not our call.
+                    if !entry.is_walkable_dir() {
                         continue;
                     }
                     let rel = entry.path.strip_prefix(&root_norm).unwrap_or(&entry.path);
@@ -36090,7 +36105,9 @@ async fn cmd_lsjson(
                 };
                 // Directories are still descended even when filtered out of
                 // the output, so `--files-only -R` still finds nested files.
-                let descend = recursive && e.is_dir && depth < max_depth;
+                // A symlink-to-directory is reported but never descended into
+                // (GAP-A02): it is still emitted with `IsDir: true`.
+                let descend = recursive && e.is_walkable_dir() && depth < max_depth;
                 let emit = if files_only {
                     !e.is_dir
                 } else if dirs_only {
@@ -39484,7 +39501,9 @@ async fn cmd_cleanup(
                 for entry in entries {
                     scanned_entries += 1;
                     if entry.is_dir {
-                        dirs.push((entry.path.clone(), depth + 1));
+                        if entry.is_walkable_dir() {
+                            dirs.push((entry.path.clone(), depth + 1));
+                        }
                     } else if entry.name.ends_with(".aerotmp") || entry.path.ends_with(".aerotmp") {
                         orphans.push((entry.path.clone(), entry.size, entry.modified.clone()));
                     }
@@ -39730,7 +39749,9 @@ async fn cmd_dedupe(
             Ok(entries) => {
                 for entry in entries {
                     if entry.is_dir {
-                        dirs.push((entry.path.clone(), depth + 1));
+                        if entry.is_walkable_dir() {
+                            dirs.push((entry.path.clone(), depth + 1));
+                        }
                     } else {
                         files.push((entry.path.clone(), entry.size, entry.modified.clone()));
                     }
@@ -41117,7 +41138,9 @@ async fn cmd_sync(
                                     format!("{}/{}", rel_prefix, e.name)
                                 };
                                 if e.is_dir {
-                                    queue.push((e.path.clone(), entry_rel, depth + 1));
+                                    if e.is_walkable_dir() {
+                                        queue.push((e.path.clone(), entry_rel, depth + 1));
+                                    }
                                 } else {
                                     let relative = entry_rel;
                                     if !relative.is_empty() && relative != BISYNC_SNAPSHOT_FILE {
@@ -42468,6 +42491,10 @@ async fn cmd_tree(url: &str, path: &str, max_depth: usize, cli: &Cli, format: Ou
         name: String,
         depth: usize,
         prefix: String,
+        /// Whether the walk may list this entry's children. Carried explicitly
+        /// rather than sniffed back out of the rendered `name`, which cannot
+        /// tell a real directory from a symlink-to-directory (GAP-A02).
+        walkable: bool,
     }
 
     let mut file_count: usize = 0;
@@ -42485,7 +42512,10 @@ async fn cmd_tree(url: &str, path: &str, max_depth: usize, cli: &Cli, format: Ou
         if depth >= max_depth || *entry_count >= MAX_SCAN_ENTRIES {
             return Vec::new();
         }
-        // Symlink loop detection: skip already-visited paths
+        // Re-entry guard: skip a path we already expanded. This does NOT catch
+        // a symlink loop, because every pass through `sub/loop -> ..` yields a
+        // longer, distinct path string. Loops are prevented by refusing to
+        // descend into symlinks at all (see `is_walkable_dir` below).
         if !visited.insert(path.to_string()) {
             return Vec::new();
         }
@@ -42499,7 +42529,7 @@ async fn cmd_tree(url: &str, path: &str, max_depth: usize, cli: &Cli, format: Ou
                 break;
             }
             *entry_count += 1;
-            let children = if e.is_dir {
+            let children = if e.is_walkable_dir() {
                 Box::pin(build_tree(
                     provider,
                     &e.path,
@@ -42649,6 +42679,7 @@ async fn cmd_tree(url: &str, path: &str, max_depth: usize, cli: &Cli, format: Ou
                     ),
                     depth: 1,
                     prefix: child_prefix.to_string(),
+                    walkable: e.is_walkable_dir(),
                 });
                 if e.is_dir {
                     dir_count += 1;
@@ -42670,8 +42701,10 @@ async fn cmd_tree(url: &str, path: &str, max_depth: usize, cli: &Cli, format: Ou
                 println!("{}", item.name);
 
                 if item.depth < max_depth {
-                    // Check if this is a directory by checking the trailing /
-                    if item.name.ends_with('/') && tree_visited.insert(item.path.clone()) {
+                    // A symlink-to-directory renders with a trailing `/` like any
+                    // other directory, so the descent is gated on `walkable`, not
+                    // on the rendered name.
+                    if item.walkable && tree_visited.insert(item.path.clone()) {
                         if let Ok(children) = provider.list(&item.path).await {
                             let mut sorted: Vec<_> = children.into_iter().collect();
                             sorted.sort_by(|a, b| match (a.is_dir, b.is_dir) {
@@ -42699,6 +42732,7 @@ async fn cmd_tree(url: &str, path: &str, max_depth: usize, cli: &Cli, format: Ou
                                     ),
                                     depth: item.depth + 1,
                                     prefix: format!("{}{}", item.prefix, child_prefix),
+                                    walkable: e.is_walkable_dir(),
                                 });
                                 if e.is_dir {
                                     dir_count += 1;
@@ -45780,7 +45814,10 @@ async fn cmd_crypt_ls(
                 };
                 if entry.is_dir {
                     rows.push((rel.clone(), true, 0));
-                    stack.push((entry.path.clone(), rel, depth + 1));
+                    // Listed, never walked (GAP-A02).
+                    if entry.is_walkable_dir() {
+                        stack.push((entry.path.clone(), rel, depth + 1));
+                    }
                 } else {
                     rows.push((rel, false, entry.size));
                 }
@@ -46350,7 +46387,11 @@ async fn cmd_crypt_get(
                 entries_seen += 1;
                 let ltarget = ldir.join(crypt_sanitize_component(&plain));
                 if entry.is_dir {
-                    stack.push((entry.path.clone(), ltarget, depth + 1));
+                    // Never follow a symlink-to-dir into the local tree: the
+                    // target's plaintext would be written twice (GAP-A02).
+                    if entry.is_walkable_dir() {
+                        stack.push((entry.path.clone(), ltarget, depth + 1));
+                    }
                     continue;
                 }
                 let ciphertext = match provider.download_to_bytes(&entry.path).await {
@@ -47576,7 +47617,9 @@ async fn cmd_sync_doctor(
             if let Ok(entries) = provider.list(&dir).await {
                 for e in entries {
                     if e.is_dir {
-                        queue.push((e.path.clone(), depth + 1));
+                        if e.is_walkable_dir() {
+                            queue.push((e.path.clone(), depth + 1));
+                        }
                     } else {
                         let relative = e
                             .path
@@ -52895,6 +52938,11 @@ async fn execute_cli_tool(
                         }
                         let meta = entry.metadata().ok();
                         let is_dir = meta.as_ref().map(|m| m.is_dir()).unwrap_or(false);
+                        // `file_type()` does not follow the link, unlike
+                        // `metadata()` above: a symlink-to-directory is still
+                        // rendered as a directory, but never descended into,
+                        // or a link to `..` walks its own parent forever.
+                        let is_symlink = entry.file_type().map(|t| t.is_symlink()).unwrap_or(false);
                         if !is_dir {
                             if let Some(ref glob) = glob_filter {
                                 let pattern = glob.trim_start_matches('*').to_lowercase();
@@ -52908,7 +52956,7 @@ async fn execute_cli_tool(
                             "is_dir": is_dir,
                             "size": meta.as_ref().map(|m| m.len()).unwrap_or(0),
                         });
-                        if is_dir {
+                        if is_dir && !is_symlink {
                             let children = build_tree(
                                 &entry.path(),
                                 depth + 1,

src-tauri/src/providers/types.rs

@@ -1573,6 +1573,21 @@ impl RemoteEntry {
         }
     }
 
+    /// Whether a recursive walk may descend into this entry.
+    ///
+    /// A symlink is unlinked, never followed (`sftp.rs` GAP-A02). `list`
+    /// resolves a symlink-to-directory and reports `is_dir = true`, which is
+    /// what callers need to render it, but descending into one opens a
+    /// cur/parent cycle: a link to `..` makes the walk revisit its own parent
+    /// under an ever longer path, so a `visited` set keyed on the path never
+    /// catches it.
+    ///
+    /// Every recursive walk over `StorageProvider::list` must gate its descent
+    /// on this, never on `is_dir` alone.
+    pub fn is_walkable_dir(&self) -> bool {
+        self.is_dir && !self.is_symlink
+    }
+
     /// Get file extension (used in tests and MIME type detection)
     #[allow(dead_code)]
     pub fn extension(&self) -> Option<&str> {
@@ -2193,4 +2208,23 @@ mod s3_config_assume_role_tests {
         assert!(cfg.role_mfa_serial.is_none());
         assert!(cfg.role_mfa_token_code.is_none());
     }
+
+    #[test]
+    fn test_is_walkable_dir_refuses_symlinks() {
+        // A plain directory is walkable.
+        let mut dir = RemoteEntry::directory("d".into(), "/d".into());
+        assert!(dir.is_walkable_dir());
+
+        // A symlink-to-directory is reported as a directory (callers render
+        // it) but must never be descended into: a link to `..` cycles.
+        dir.is_symlink = true;
+        assert!(dir.is_dir);
+        assert!(!dir.is_walkable_dir());
+
+        // Files are never walkable, symlink or not.
+        let mut file = RemoteEntry::file("f".into(), "/f".into(), 10);
+        assert!(!file.is_walkable_dir());
+        file.is_symlink = true;
+        assert!(!file.is_walkable_dir());
+    }
 }