fix: reject/flag symlinked preserved configs on reinstall

Assisted-by: GitHub Copilot (model: GPT-5.6-Sol, autonomous)

Author: Copilot

src/specify_cli/extensions/__init__.py

@@ -1546,7 +1546,15 @@ def _recognized_config_names(directory: Path) -> set[str]:
                 staged_stat = staged_file.stat()
                 staged_bytes = staged_file.read_bytes()
                 live_file = dest_dir / staged_name
-                if live_file.is_file() and not live_file.is_symlink():
+                if live_file.is_symlink():
+                    # A user may have replaced the live config with a symlink
+                    # after the interrupted attempt. It cannot be compared by
+                    # bytes/mode against the staged copy, and the rmtree below
+                    # would silently delete this newer choice and restore the
+                    # older staged file. Treat any live symlink as a conflict so
+                    # both are preserved and the user resolves it.
+                    conflicting.add(staged_name)
+                elif live_file.is_file():
                     # A live config that cannot be read or stat'ed must not be
                     # treated as non-conflicting: the rmtree below would delete
                     # it and restore the stale staged copy. Abort while dest_dir
@@ -1584,7 +1592,22 @@ def _recognized_config_names(directory: Path) -> set[str]:
                 list(dest_dir.glob("*-config.yml"))
                 + list(dest_dir.glob("*-config.local.yml"))
             ):
-                if cfg_file.is_file() and not cfg_file.is_symlink():
+                if cfg_file.is_symlink():
+                    # `remove --keep-config` preserves a symlinked config
+                    # because Path.is_file() follows symlinks. Its bytes cannot
+                    # be safely rescued (the target may live outside dest_dir),
+                    # and the rmtree below would delete the link and silently
+                    # discard the kept configuration. Reject the reinstall while
+                    # dest_dir is untouched so the user resolves it rather than
+                    # losing the linked config.
+                    raise ValidationError(
+                        "Preserved extension config for "
+                        f"'{manifest.id}' is a symlink ({cfg_file.name}) in "
+                        f"{dest_dir}, which cannot be safely rescued during "
+                        "reinstall. Resolve manually — replace the symlink with "
+                        "a regular file or remove it — then reinstall."
+                    )
+                if cfg_file.is_file():
                     stranded_configs[cfg_file.name] = (
                         cfg_file.read_bytes(),
                         cfg_file.stat().st_mode,

tests/test_extensions.py

@@ -1290,6 +1290,113 @@ def test_reinstall_after_keep_config_preserves_local_config(
         assert local_cfg.exists()
         assert "local_override: true" in local_cfg.read_text()
 
+    def test_reinstall_with_symlinked_config_rejects_install(
+        self, extension_dir, project_dir
+    ):
+        """A preserved symlinked config must abort reinstall, not be deleted."""
+        ext_dir = project_dir / ".specify" / "extensions" / "test-ext"
+        if not can_create_symlink(ext_dir.parent if ext_dir.parent.exists() else project_dir):
+            pytest.skip("Current platform/user cannot create symlinks")
+
+        manager = ExtensionManager(project_dir)
+        packaged_config = extension_dir / "test-ext-config.yml"
+        packaged_config.write_text("model: default-model\n")
+        manager.install_from_directory(
+            extension_dir, "0.1.0", register_commands=False
+        )
+
+        # Replace the installed config with a symlink to a file outside dest_dir.
+        config_file = ext_dir / "test-ext-config.yml"
+        external_target = project_dir / "external-config.yml"
+        external_target.write_text("model: linked-model\n")
+        config_file.unlink()
+        os.symlink(external_target, config_file)
+        assert config_file.is_symlink()
+
+        # `remove --keep-config` follows the symlink via is_file() and keeps it.
+        manager.remove("test-ext", keep_config=True)
+        assert not manager.registry.is_installed("test-ext")
+        assert config_file.is_symlink()
+
+        # Plain reinstall must reject rather than silently delete the link.
+        with pytest.raises(ValidationError, match="is a symlink"):
+            manager.install_from_directory(
+                extension_dir, "0.1.0", register_commands=False
+            )
+
+        # The symlink and its target survive; nothing was silently discarded.
+        assert config_file.is_symlink()
+        assert external_target.read_text() == "model: linked-model\n"
+        assert not manager.registry.is_installed("test-ext")
+
+    def test_retry_with_symlinked_live_config_aborts_and_preserves_both(
+        self, extension_dir, project_dir, monkeypatch
+    ):
+        """A live config replaced by a symlink on retry is a conflict, not overwritten."""
+        ext_dir = project_dir / ".specify" / "extensions" / "test-ext"
+        if not can_create_symlink(project_dir):
+            pytest.skip("Current platform/user cannot create symlinks")
+
+        manager = ExtensionManager(project_dir)
+
+        packaged_config = extension_dir / "test-ext-config.yml"
+        packaged_config.write_text("model: default-model\n")
+
+        manager.install_from_directory(
+            extension_dir, "0.1.0", register_commands=False
+        )
+
+        config_file = ext_dir / "test-ext-config.yml"
+        config_file.write_text("model: custom-model\nmax_iterations: 99\n")
+        staged_bytes = config_file.read_bytes()
+
+        manager.remove("test-ext", keep_config=True)
+        assert not manager.registry.is_installed("test-ext")
+
+        staging_dir = manager._rescue_staging_dir("test-ext")
+
+        original_copytree = shutil.copytree
+        copytree_calls = 0
+
+        def flaky_copytree(*args, **kwargs):
+            nonlocal copytree_calls
+            copytree_calls += 1
+            if copytree_calls == 1:
+                dst = args[1]
+                Path(dst).mkdir(parents=True, exist_ok=True)
+                (Path(dst) / "_partial.txt").write_text("partial")
+                raise OSError("simulated disk full")
+            return original_copytree(*args, **kwargs)
+
+        monkeypatch.setattr(_ext_module.shutil, "copytree", flaky_copytree)
+
+        with pytest.raises(OSError, match="simulated disk full"):
+            manager.install_from_directory(
+                extension_dir, "0.1.0", register_commands=False
+            )
+
+        assert staging_dir.exists()
+        assert (staging_dir / ".rescue-complete").exists()
+
+        # Simulate the user replacing the live config with a symlink before retry.
+        external_target = project_dir / "external-config.yml"
+        external_target.write_text("model: newer-linked-model\n")
+        config_file.unlink()
+        os.symlink(external_target, config_file)
+        assert config_file.is_symlink()
+
+        with pytest.raises(ValidationError, match="Preserved extension config conflict"):
+            manager.install_from_directory(
+                extension_dir, "0.1.0", register_commands=False
+            )
+
+        # Both copies survive: the live symlink choice and the staged backup.
+        assert config_file.is_symlink()
+        assert external_target.read_text() == "model: newer-linked-model\n"
+        assert staging_dir.exists()
+        assert (staging_dir / "test-ext-config.yml").read_bytes() == staged_bytes
+        assert not manager.registry.is_installed("test-ext")
+
     def test_copytree_failure_restores_stranded_config(
         self, extension_dir, project_dir, monkeypatch
     ):