Problem
The run write path (createRun → ensureDir → fs.promises.mkdir(recursive:true)) performs none of the lstat-before-realpath symlink verification the read path does (verifiedRoot/readVerifiedRootFile). A .picklab symlink committed in a target repo could redirect project-local-mode writes at mkdir time.
Pre-existing behavior — predates #34, which actually reduces exposure by making project-local opt-in instead of default. Surfaced by the #34 security review; not a blocker there.
Expected
The write path applies the same root-verification discipline as the read path before creating/writing run directories.
Refs #34
Problem
The run write path (
createRun→ensureDir→fs.promises.mkdir(recursive:true)) performs none of the lstat-before-realpath symlink verification the read path does (verifiedRoot/readVerifiedRootFile). A.picklabsymlink committed in a target repo could redirect project-local-mode writes at mkdir time.Pre-existing behavior — predates #34, which actually reduces exposure by making project-local opt-in instead of default. Surfaced by the #34 security review; not a blocker there.
Expected
The write path applies the same root-verification discipline as the read path before creating/writing run directories.
Refs #34