{"record":{"id":"9001c31641466aa6","repo":"multica-ai/multica","slug":"resolve-s-path-q-w","errorCode":null,"errorMessage":"resolve --%s path %q: %w","messagePattern":"resolve --(.+?) path %q: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/cmd/multica/cmd_issue.go","lineNumber":109,"sourceCode":"\n// ensureFileFlagWithinWorkdir fails closed when a --<name>-file path resolves\n// outside the current working directory, unless --allow-external-file is set.\n//\n// Agent task workdirs are isolated per profile and per task; machine-shared\n// scratch paths like /tmp are not. MUL-4252 traced a cross-environment context\n// leak to exactly this gap: a quick-create run wrote its description to a fixed\n// /tmp/desc.md, the write silently failed because a *different* environment's\n// run had left a stale file there minutes earlier, and --description-file then\n// fed that stale content into the new issue. Requiring the file to live under\n// the workdir turns \"silently read another run's file\" into a loud command\n// failure — an \"incorrect content\" bug becomes a \"command errored\" bug.\nfunc ensureFileFlagWithinWorkdir(cmd *cobra.Command, fileFlag, flagName, filePath string) error {\n\tif allow, _ := cmd.Flags().GetBool(\"allow-external-file\"); allow {\n\t\treturn nil\n\t}\n\twithin, err := fileWithinWorkingDir(filePath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"resolve --%s path %q: %w\", fileFlag, filePath, err)\n\t}\n\tif !within {\n\t\treturn fmt.Errorf(\n\t\t\t\"--%s path %q resolves outside the current working directory; \"+\n\t\t\t\t\"write agent temp files inside the task workdir (e.g. ./%s.md) rather than machine-shared \"+\n\t\t\t\t\"paths like /tmp, where another run's stale file can be read by mistake. \"+\n\t\t\t\t\"Pass --allow-external-file to override.\",\n\t\t\tfileFlag, filePath, flagName)\n\t}\n\treturn nil\n}\n\n// fileWithinWorkingDir reports whether filePath resolves to a location inside\n// the process working directory. Both sides are symlink-resolved so aliased\n// roots (e.g. macOS /tmp -> /private/tmp) and symlinks planted inside the\n// workdir fail closed. A path that does not exist yet is judged on its cleaned\n// absolute form so the caller's os.ReadFile still surfaces the real not-found\n// error afterwards.","sourceCodeStart":91,"sourceCodeEnd":127,"githubUrl":"https://github.com/multica-ai/multica/blob/2c0912b6ec764b373d44eeea1e80f0d9f11ab417/server/cmd/multica/cmd_issue.go#L91-L127","documentation":"While enforcing that a --description-file/--content-file path stays inside the working directory, the CLI could not resolve the path at all (fileWithinWorkingDir returned an error). The %w wraps the underlying filesystem error, typically a stat or absolute-path resolution failure. The guard runs before the file is read, so this fires for paths the process cannot even resolve.","triggerScenarios":"Passing a --*-file value that fileWithinWorkingDir cannot resolve: a path with a component that errors on stat (e.g. a dangling symlink whose target is inaccessible), a path on an unmounted filesystem, or a path with a symlink loop. Note a plain nonexistent relative file may still resolve; the failure comes from the resolution step itself, and the wrapped error names the cause.","commonSituations":"Dangling symlinks left in a workdir by a previous run; NFS/automount paths that are stale; symlink cycles created by scripting mistakes; paths whose permissions deny traversal to the resolving user.","solutions":["Read the wrapped error (%w) — it carries the exact OS-level cause (ENOENT, EACCES, ELOOP, ESTALE).","Run ls -l / realpath on the path to find the broken symlink or unmounted component and fix or recreate it.","Point the flag at a real regular file inside the current working directory (e.g. ./desc.md).","If the target legitimately sits outside the workdir and you accept the risk, pass --allow-external-file."],"exampleFix":"# before (dangling symlink)\nln -s /gone/desc.md desc.md\nmultica issue create --title T --description-file desc.md\n# after\nprintf 'real content' > ./desc.md\nmultica issue create --title T --description-file ./desc.md","handlingStrategy":"validation","validationCode":"# resolve the path first; a broken symlink or unresolvable path fails here with a clear message\nrealpath -e \"$DESC_FILE\" >/dev/null || { echo \"cannot resolve $DESC_FILE\" >&2; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use realpath -e on any file flag value before invoking the CLI.","Avoid symlink indirection for scratch files; write plain files inside the workdir.","Read the %w-wrapped cause in the error output — it names the exact OS failure."],"tags":["cli","filesystem","symlink","path-resolution"],"backgroundTag":null,"analyzedSha":"2c0912b6ec764b373d44eeea1e80f0d9f11ab417","analyzedAt":"2026-08-15T13:25:18.241Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}