[howonlee]

Validate VULN-565 copy escape remediation.

[linear]

VULN-565

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

Adds integration tests for follow-up worktree creation with committed relative symlinks, and documents VULN-565 retest results, limitations, procedures, and outstanding closure blockers.

Changes

VULN-565 copy remediation validation

Layer / File(s)	Summary
Symlink retests and evidence tests/copy_followup.bats, docs/security-vuln-565-followup.md	Tests leaf and parent symlink cases with existing or absent outside targets. The follow-up document records version comparisons, retest procedures, limitations, and closure blockers.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Possibly related PRs

• coderabbitai/git-worktree-runner#208: Addresses VULN-565 by preventing directory exclusions from traversing symlinks and affecting files outside the worktree.

Suggested reviewers: natoboram

Merge Risk: Minimal · up to 0dcd6

The added tests exercise the copy safeguard, and no actionable merge-blocking risk was identified.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly states that the change adds tests to validate the VULN-565 copy escape remediation, which matches the pull request’s main change.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 1 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate docstrings

• Commit to this branch
• Create a new PR

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks each symlink trail,
Through leaf and parent, without fail.
The tests record what stays outside,
And note the versions side by side.
With careful notes, the checks are done.}

Recent review info

Run configuration

• Source mode: Auto
• Repository: coderabbitai/git-worktree-runner
• Branch: main
• File: .coderabbit.yaml
• Commit: fc8afc0
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 8ae97a47-b6ba-4529-b5bd-9342ba429061

Commits

Reviewing files that changed from the base of the PR and between fc8afc0 and 0dcd6cf.

Files selected for processing: 2

• docs/security-vuln-565-followup.md
• tests/copy_followup.bats

Included review availability: This review used your included allowance. Your plan provides up to 100 included reviews per hour; 97 remain after this review.