address review round 7: post-create resolve, mkdir error wrap, more payloads

Production:
- Wrap the entire ancestor validation/create loop in OSError handling
  so create-time races (PermissionError, EEXIST from another process)
  surface as a clean CLI error instead of an unhandled exception.
- Re-resolve every newly created component against project_root_resolved
  too (not just existing ones). A parent swapped to a junction / mount
  point / symlink during creation can land the new directory outside the
  project even when the new component itself is not a symlink. Mirrors
  shared_infra._ensure_safe_shared_directory:115-118.
- Add a final 'download_dir.resolve() under project_root_resolved' guard
  immediately before opening the ZIP. Defends the Windows fallback path
  of _safe_open_download_zip (no dir_fd/O_NOFOLLOW) against an ancestor
  swap between validation and write that the existing
  zip_path.resolve().relative_to(download_dir.resolve()) check would
  silently follow.

Tests:
- Add deep relative traversal payload (../../../../../etc/shadow) that
  escapes from the 4-level cache directory all the way past project_root.
- Add Windows-relevant absolute payloads: C:\tmp\evil, C:/tmp/evil,
  and \\server\share\evil. CI runs these on windows-latest.
- Extract _is_absolute_like() helper covering POSIX absolute, Windows
  drive-letter, and UNC roots; use it to filter the delete-side test so
  sentinel creation never escapes the pytest sandbox on any platform.

Author: mnriem

src/specify_cli/__init__.py

@@ -3687,41 +3687,69 @@ def extension_add(
                 # (consistent with shared_infra._ensure_safe_shared_directory):
                 # `mkdir(parents=True)` would silently traverse a symlinked ancestor,
                 # so each component is checked and created individually instead.
-                # Each existing component is also re-resolved and required to land
-                # under project_root, which catches non-symlink directory aliases
-                # (e.g. Windows junctions / mount points) that resolve outside.
+                # Each component (existing or newly created) is also re-resolved
+                # and required to land under project_root, which catches
+                # non-symlink directory aliases (e.g. Windows junctions / mount
+                # points) that resolve outside, including ones that may appear
+                # mid-creation via a parent swap.
                 import uuid as _uuid
                 download_dir = project_root / ".specify" / "extensions" / ".cache" / "downloads"
                 project_root_resolved = project_root.resolve()
-                _current = project_root
-                for _part in download_dir.relative_to(project_root).parts:
-                    _current = _current / _part
-                    if _current.is_symlink():
-                        console.print("[red]Error:[/red] Refusing to use symlinked download cache directory")
-                        raise typer.Exit(1)
-                    if _current.exists():
-                        if not _current.is_dir():
-                            console.print(
-                                f"[red]Error:[/red] Download cache path is not a directory: {_current}"
-                            )
+                try:
+                    _current = project_root
+                    for _part in download_dir.relative_to(project_root).parts:
+                        _current = _current / _part
+                        if _current.is_symlink():
+                            console.print("[red]Error:[/red] Refusing to use symlinked download cache directory")
+                            raise typer.Exit(1)
+                        if _current.exists():
+                            if not _current.is_dir():
+                                console.print(
+                                    f"[red]Error:[/red] Download cache path is not a directory: {_current}"
+                                )
+                                raise typer.Exit(1)
+                            try:
+                                _current.resolve().relative_to(project_root_resolved)
+                            except (OSError, ValueError):
+                                console.print("[red]Error:[/red] Download cache directory escapes project root")
+                                raise typer.Exit(1)
+                            continue
+                        _current.mkdir()
+                        if _current.is_symlink():
+                            console.print("[red]Error:[/red] Refusing to use symlinked download cache directory")
                             raise typer.Exit(1)
+                        # Post-create containment check: a parent swapped to a
+                        # junction / mount / symlink during creation could land
+                        # the new directory outside project_root even though
+                        # this component itself is not a symlink.
                         try:
                             _current.resolve().relative_to(project_root_resolved)
                         except (OSError, ValueError):
                             console.print("[red]Error:[/red] Download cache directory escapes project root")
                             raise typer.Exit(1)
-                        continue
-                    _current.mkdir()
-                    if _current.is_symlink():
-                        console.print("[red]Error:[/red] Refusing to use symlinked download cache directory")
-                        raise typer.Exit(1)
+                except OSError as _mkdir_err:
+                    console.print(
+                        f"[red]Error:[/red] Could not prepare download cache directory: {_mkdir_err}"
+                    )
+                    raise typer.Exit(1)
 
                 safe_name = Path(extension).name.replace("/", "_").replace("\\", "_") or "download"
                 safe_name = safe_name[:64]  # cap length to avoid filesystem errors
                 zip_filename = f"{safe_name}-{_uuid.uuid4().hex[:8]}.zip"
                 zip_path = download_dir / zip_filename
 
-                # Guard: resolved path must stay inside download_dir (CWE-22)
+                # Guard: resolved zip_path must stay inside the validated cache
+                # directory *and* the cache directory must still resolve under
+                # project_root. The second check defends the Windows fallback
+                # path of `_safe_open_download_zip` (no `dir_fd`/`O_NOFOLLOW`)
+                # against an ancestor swapped to a junction/symlink between the
+                # validation loop above and this point: comparing only against
+                # `download_dir.resolve()` would silently follow the redirect.
+                try:
+                    download_dir.resolve().relative_to(project_root_resolved)
+                except (OSError, ValueError):
+                    console.print("[red]Error:[/red] Download cache directory escapes project root")
+                    raise typer.Exit(1)
                 try:
                     zip_path.resolve().relative_to(download_dir.resolve())
                 except ValueError:

tests/test_extension_add_path_traversal.py

@@ -39,13 +39,40 @@ def _require_symlinks(tmp_path) -> None:
             except OSError:
                 pass
 
+def _is_absolute_like(payload: str) -> bool:
+    """Detect payloads that may be treated as an absolute path on any supported OS.
+
+    Used to skip the delete-side regression test for those payloads, since
+    constructing a sentinel relative to ``cache_dir`` for an absolute-like
+    payload would land outside the pytest sandbox (especially on Windows
+    where ``Path('C:\\\\...')`` and ``\\\\\\\\server\\\\share`` are roots).
+    The write-side test still covers containment for these cases.
+    """
+    if payload.startswith(("/", "\\")):
+        return True
+    # Drive letter forms: C:\..., C:/...
+    if len(payload) >= 2 and payload[1] == ":" and payload[0].isalpha():
+        return True
+    return False
+
+
 TRAVERSAL_PAYLOADS = [
     "../pwned",
     "../../etc/passwd",
     "subdir/../../escape",
     "..\\pwned",
     "..\\..\\etc\\passwd",
     "/tmp/evil",
+    # Deep relative traversal long enough to escape from
+    # `.specify/extensions/.cache/downloads` (4 segments) all the way out
+    # of project_root and beyond.
+    "../../../../../etc/shadow",
+    # Windows absolute path forms. The CI matrix runs these tests on
+    # windows-latest, so the sanitiser must reject drive-letter and UNC
+    # roots in addition to POSIX absolute paths.
+    "C:\\tmp\\evil",
+    "C:/tmp/evil",
+    "\\\\server\\share\\evil",
 ]
 
 
@@ -85,13 +112,14 @@ def test_traversal_payload_writes_inside_cache(self, project_dir, bad_name):
         zip_arg = mock_install.call_args[0][0]  # positional arg: zip_path
         zip_arg.resolve().relative_to(cache_dir.resolve())  # raises ValueError if outside
 
-    @pytest.mark.parametrize("bad_name", [p for p in TRAVERSAL_PAYLOADS if not p.startswith(("/", "\\"))])
+    @pytest.mark.parametrize("bad_name", [p for p in TRAVERSAL_PAYLOADS if not _is_absolute_like(p)])
     def test_traversal_payload_cannot_delete_outside_cache(self, project_dir, bad_name):
         """The finally-block cleanup must not delete files outside the cache dir.
 
-        Absolute-path payloads are excluded here to avoid writing sentinels
-        outside the pytest sandbox (e.g. ``/tmp``); the write-side test above
-        already proves the production guard contains absolute payloads.
+        Absolute-like payloads (POSIX absolute, Windows drive letter, UNC) are
+        excluded here to avoid writing sentinels outside the pytest sandbox;
+        the write-side test above already proves the production guard contains
+        absolute payloads.
         """
         # Place a sentinel at the path the pre-fix code would have constructed
         cache_dir = project_dir / ".specify" / "extensions" / ".cache" / "downloads"