fix: guard repo_root.resolve() and .ts/.tsx swap against containment escape in ccarch resolver

- repo_root.resolve() now sits inside the try block so a symlink loop
  at/above repo_root reports missing instead of raising RuntimeError.
- The .ts<->.tsx swap candidate is now routed through the same
  resolve()+relative_to(repo_resolved) containment check as the primary
  path (extracted into a shared _contained helper), so a swapped-extension
  symlink pointing outside the repo can no longer be reported as "moved".

Adds regression tests reproducing both findings under tmp_path.

Author: pwx603

mcp/ccarch/ccarch/resolver.py

@@ -41,6 +41,22 @@ def _swap_ext(p: str) -> str | None:
     return None
 
 
+def _contained(repo_root: Path, repo_resolved: Path, rel: str) -> Path | None:
+    # Resolve rel against repo_root and confirm it stays inside
+    # repo_resolved, returning the resolved Path if so or None otherwise.
+    # Every candidate path derived from a doc citation — the primary q as
+    # well as any alternate like a .ts/.tsx extension swap — must go
+    # through this exact check before being probed with _safe_check.
+    # Probing an unresolved/uncontained path directly is how a cited path
+    # can end up resolving outside the repo (constraint B).
+    try:
+        candidate = (repo_root / rel).resolve()
+        candidate.relative_to(repo_resolved)
+    except (ValueError, OSError, RuntimeError):
+        return None
+    return candidate
+
+
 def resolve(repo_root: Path, cited: str) -> Resolved:
     repo_root = Path(repo_root)
     raw = (cited or "").strip()
@@ -52,18 +68,26 @@ def resolve(repo_root: Path, cited: str) -> Resolved:
 
     # Never let a cited path escape the repo. A doc citing ../../etc/passwd
     # resolves to missing rather than probing outside the tree.
-    repo_resolved = repo_root.resolve()
     try:
-        target = (repo_root / q).resolve()
-        target.relative_to(repo_resolved)
-    except (ValueError, OSError, RuntimeError):
+        # repo_root.resolve() must stay inside this try too: a circular
+        # symlink at/above repo_root itself raises the same
+        # RuntimeError("Symlink loop ...") that .resolve() raises for the
+        # cited path below, and repo_resolved is still referenced later
+        # (Python doesn't scope names to blocks), so binding it here is
+        # both necessary and sufficient.
+        repo_resolved = repo_root.resolve()
+    except (OSError, RuntimeError):
         # Path.resolve() raises RuntimeError("Symlink loop from ...") for a
         # circular symlink instead of OSError/ValueError like every other
         # unresolvable-path case. It looks redundant to catch it here, but
-        # it isn't — leave it, or a symlink loop in a doc-cited path will
+        # it isn't — leave it, or a symlink loop at/above repo_root will
         # crash resolve() instead of reporting "missing".
         return Resolved(path=raw, status="missing", kind="dir" if is_dir_cite else "file")
 
+    target = _contained(repo_root, repo_resolved, q)
+    if target is None:
+        return Resolved(path=raw, status="missing", kind="dir" if is_dir_cite else "file")
+
     # Degenerate citations like "", "///", ".", "./" all normalize to the
     # repo root itself once joined and resolved (repo_root / "" is
     # repo_root; "." and "./" resolve to the same directory). None of these
@@ -86,7 +110,14 @@ def resolve(repo_root: Path, cited: str) -> Resolved:
         return Resolved(path=q, status="ok", kind="dir")
 
     alt = _swap_ext(q)
-    if alt and _safe_check(repo_root / alt, "file"):
-        return Resolved(path=alt, status="moved", kind="file")
+    if alt:
+        # The swapped-extension candidate must go through the same
+        # containment check as q above (_contained), not a raw
+        # repo_root / alt probe — _safe_check only guards OSError during
+        # the stat, it does not re-verify the result stays inside the
+        # repo, and is_file() happily follows a symlink to anywhere.
+        alt_target = _contained(repo_root, repo_resolved, alt)
+        if alt_target is not None and _safe_check(alt_target, "file"):
+            return Resolved(path=alt, status="moved", kind="file")
 
     return Resolved(path=q, status="missing", kind="file")

mcp/ccarch/tests/test_resolver.py

@@ -103,3 +103,36 @@ def test_permission_denied_dir_does_not_raise(tmp_path):
     finally:
         # Restore permissions so tmp_path teardown can clean up the dir.
         os.chmod(locked, 0o755)
+
+
+def test_symlink_loop_at_repo_root_does_not_raise(tmp_path):
+    # Finding 1: repo_resolved = repo_root.resolve() used to sit *before*
+    # the try: block, so a symlink loop at/above repo_root itself (as
+    # opposed to inside the repo, which the loop test above already covers)
+    # raised RuntimeError instead of being caught and reported as missing.
+    loop_root = tmp_path / "looproot"
+    loop_root.symlink_to(tmp_path / "looproot2")
+    (tmp_path / "looproot2").symlink_to(loop_root)
+
+    r = resolve(loop_root, "src/foo.ts")
+    assert r.status == "missing"
+
+
+def test_swapped_extension_symlink_escaping_repo_is_missing(tmp_path):
+    # Finding 2: the .ts<->.tsx swap branch probed `repo_root / alt`
+    # directly with _safe_check, never through .resolve() +
+    # relative_to(repo_resolved) like the primary `q` path. So an in-repo
+    # symlink at the swapped-extension path pointing outside the repo was
+    # reported "moved" with a path string that actually dereferences
+    # outside the tree, instead of "missing".
+    outside = tmp_path / "outside"
+    outside.mkdir()
+    (outside / "secret.tsx").write_text("TOP SECRET CONTENT OUTSIDE REPO")
+
+    repo = tmp_path / "repo"
+    tool_dir = repo / "packages" / "builtin-tools" / "src" / "tools" / "AgentTool"
+    tool_dir.mkdir(parents=True)
+    (tool_dir / "AgentTool.tsx").symlink_to(outside / "secret.tsx")
+
+    r = resolve(repo, "packages/builtin-tools/src/tools/AgentTool/AgentTool.ts")
+    assert r.status == "missing"