P0: Symlink safety — make file operations fd-based end-to-end

[galic1987]

Source

ChatGPT security review feedback

Problem

path_validator.rs already uses O_NOFOLLOW to prevent TOCTOU symlink races (good), but there are still non-atomic checks elsewhere (is_symlink() then read_link() flows) which are raceable.

Fix

For any "real" file operation:

1. Open the path with fd-based APIs (or capability dir handles)
2. Resolve realpath from the fd
3. Perform the action via fd (or via path derived from fd)
4. Have path validation operate on the resolved target of that fd

Consider integrating cap-std for capability-based filesystem access.

Relevant Code

• src/safety/path_validator.rs
• src/tools/file.rs
• src/cognitive/self_edit.rs (symlink bypass fix already applied)

Priority

P0 — completes existing security work

Labels

security, P0