fix: resolver 不再因 symlink 环抛异常，退化输入不再误报 ok

review 发现两处缺陷（均源自计划中的参考实现）：

- Critical：Path.resolve() 对循环 symlink 抛 RuntimeError（非 OSError/
  ValueError），未被捕获，违反「resolve() 永不抛异常」的硬约束。
- Important："///" / "." / "./" 归一化后指向 repo root，被误报为
  ok/dir；原 junk 测试仅断言 status 取值合法，无法捕获。

补充回归测试：tmp_path 下构造 symlink 环、退化输入断言 missing。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: pwx603

mcp/ccarch/ccarch/resolver.py

@@ -37,10 +37,25 @@ def resolve(repo_root: Path, cited: str) -> Resolved:
 
     # Never let a cited path escape the repo. A doc citing ../../etc/passwd
     # resolves to missing rather than probing outside the tree.
+    repo_resolved = repo_root.resolve()
     try:
         target = (repo_root / q).resolve()
-        target.relative_to(repo_root.resolve())
-    except (ValueError, OSError):
+        target.relative_to(repo_resolved)
+    except (ValueError, OSError, RuntimeError):
+        # Path.resolve() raises RuntimeError("Symlink loop from ...") for a
+        # circular symlink instead of OSError/ValueError like every other
+        # unresolvable-path case. It looks redundant to catch it here, but
+        # it isn't — leave it, or a symlink loop in a doc-cited path will
+        # crash resolve() instead of reporting "missing".
+        return Resolved(path=raw, status="missing", kind="dir" if is_dir_cite else "file")
+
+    # Degenerate citations like "", "///", ".", "./" all normalize to the
+    # repo root itself once joined and resolved (repo_root / "" is
+    # repo_root; "." and "./" resolve to the same directory). None of these
+    # actually names a path the doc could plausibly be citing, so treat a
+    # cite that resolves to exactly the repo root as missing rather than an
+    # "ok" hit on the whole repository.
+    if target == repo_resolved:
         return Resolved(path=raw, status="missing", kind="dir" if is_dir_cite else "file")
 
     if is_dir_cite:

mcp/ccarch/tests/test_resolver.py

@@ -1,4 +1,5 @@
 from pathlib import Path
+
 from ccarch.resolver import resolve
 
 REPO = Path(__file__).resolve().parents[3]
@@ -26,5 +27,55 @@ def test_genuinely_missing_is_missing():
     assert r.status == "missing"
 
 def test_never_raises_on_junk():
+    # Every entry below is parser garbage or a fabricated/escaping path —
+    # none of them names a real, in-repo file or dir. resolve() must not
+    # raise, and must not mislabel any of them as "ok"/"moved".
     for junk in ["", "   ", "///", "src/foo.ts", "../../etc/passwd"]:
-        assert resolve(REPO, junk).status in {"ok", "moved", "missing"}
+        assert resolve(REPO, junk).status == "missing"
+
+
+def test_degenerate_slash_and_dot_input_is_missing():
+    # q = raw.rstrip("/") can collapse to "", and repo_root / "" is just
+    # repo_root — which must never be reported as a legitimate directory hit.
+    for junk in ["", "   ", "///", ".", "./"]:
+        r = resolve(REPO, junk)
+        assert r.status == "missing", f"{junk!r} -> {r.status}"
+
+
+def test_symlink_escaping_repo_is_missing(tmp_path):
+    # Reviewed/confirmed behavior: a symlink inside the repo pointing outside
+    # it must still resolve to missing. Guard against regressing this while
+    # fixing the symlink-loop RuntimeError below. Built under tmp_path so we
+    # never write symlinks into the real repo tree.
+    outside = tmp_path / "outside"
+    outside.mkdir()
+    (outside / "passwd").write_text("secret")
+
+    repo = tmp_path / "repo"
+    (repo / "src").mkdir(parents=True)
+    (repo / "src" / "escaped").symlink_to(outside, target_is_directory=True)
+
+    r = resolve(repo, "src/escaped/passwd")
+    assert r.status == "missing"
+
+
+def test_symlink_loop_does_not_raise(tmp_path):
+    # Path.resolve() raises RuntimeError("Symlink loop from ...") on a
+    # circular symlink — not OSError/ValueError. resolve() must catch it
+    # and report missing, never propagate.
+    (tmp_path / "docs").mkdir()
+    src = tmp_path / "src"
+    src.mkdir()
+    (src / "loopa").symlink_to(src / "loopb")
+    (src / "loopb").symlink_to(src / "loopa")
+
+    r = resolve(tmp_path, "src/loopa/file.ts")
+    assert r.status == "missing"
+
+
+def test_broken_symlink_does_not_raise(tmp_path):
+    (tmp_path / "src").mkdir()
+    (tmp_path / "src" / "ghost").symlink_to(tmp_path / "src" / "nonexistent")
+
+    r = resolve(tmp_path, "src/ghost")
+    assert r.status == "missing"