fix: allow canonical git worktree roots

Author: Waishnav

src/git-worktrees.ts

@@ -2,9 +2,9 @@ import { randomBytes } from "node:crypto";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { mkdir, realpath, rm, stat } from "node:fs/promises";
-import { basename, join } from "node:path";
+import { basename, join, relative, resolve } from "node:path";
 import type { ServerConfig } from "./config.js";
-import { assertAllowedPath } from "./roots.js";
+import { assertAllowedPath, isPathInsideRoot } from "./roots.js";
 
 const execFileAsync = promisify(execFile);
 
@@ -93,7 +93,7 @@ export async function createManagedWorktree(input: {
 async function resolveGitRoot(path: string, allowedRoots: string[]): Promise<string> {
   try {
     const output = await git(["rev-parse", "--show-toplevel"], path);
-    return assertAllowedPath(await realpath(output.trim()), allowedRoots);
+    return await assertGitRootAllowed(output.trim(), allowedRoots);
   } catch (error) {
     if (isGitUnavailable(error)) {
       throw new GitWorktreeError(
@@ -109,6 +109,25 @@ async function resolveGitRoot(path: string, allowedRoots: string[]): Promise<str
   }
 }
 
+async function assertGitRootAllowed(gitRoot: string, allowedRoots: string[]): Promise<string> {
+  try {
+    return assertAllowedPath(gitRoot, allowedRoots);
+  } catch {
+    const canonicalGitRoot = await realpath(gitRoot);
+    for (const allowedRoot of allowedRoots) {
+      const canonicalAllowedRoot = await realpath(allowedRoot).catch(() => undefined);
+      if (!canonicalAllowedRoot || !isPathInsideRoot(canonicalGitRoot, canonicalAllowedRoot)) {
+        continue;
+      }
+
+      const logicalGitRoot = resolve(allowedRoot, relative(canonicalAllowedRoot, canonicalGitRoot));
+      return assertAllowedPath(logicalGitRoot, allowedRoots);
+    }
+
+    return assertAllowedPath(canonicalGitRoot, allowedRoots);
+  }
+}
+
 async function resolveBaseCommit(sourceRoot: string, baseRef: string): Promise<string> {
   try {
     return (await git(["rev-parse", "--verify", `${baseRef}^{commit}`], sourceRoot)).trim();

src/workspaces.test.ts

@@ -1,6 +1,6 @@
 import { execFile } from "node:child_process";
-import { mkdtemp, mkdir, rm, stat, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
+import { mkdtemp, mkdir, rm, stat, symlink, writeFile } from "node:fs/promises";
+import { platform, tmpdir } from "node:os";
 import { join } from "node:path";
 import { promisify } from "node:util";
 import assert from "node:assert/strict";
@@ -104,6 +104,23 @@ try {
   assert.equal(restoredWorktree.root, persistentWorktree.workspace.root);
   assert.equal(restoredWorktree.worktree?.managed, true);
   secondStore.close();
+
+  if (platform() !== "win32") {
+    const aliasRoot = join(root, "alias-root");
+    await symlink(root, aliasRoot, "dir");
+    const aliasConfig = loadConfig({
+      DEVSPACE_ALLOWED_ROOTS: aliasRoot,
+      DEVSPACE_WORKTREE_ROOT: join(aliasRoot, ".devspace", "alias-worktrees"),
+      DEVSPACE_AGENT_DIR: agentDir,
+      DEVSPACE_OAUTH_OWNER_TOKEN: "test-owner-token-that-is-long-enough",
+      PORT: "1",
+    });
+    const aliasWorkspace = await new WorkspaceRegistry(aliasConfig).openWorkspace({
+      path: join(aliasRoot, "git-project"),
+      mode: "worktree",
+    });
+    assert.equal(aliasWorkspace.workspace.sourceRoot, join(aliasRoot, "git-project"));
+  }
 } finally {
   await rm(root, { recursive: true, force: true });
 }