mathiasandClaude Opus 5.5
796d226497
The brain dir is a Syncthing sendreceive folder and Syncthing syncs symlinks; search, vectorstore, context and graph readers follow one out of the brain and would index or return what it points to (reproduced with search.Query). Decision (#157): a tripwire now, brain-wide os.Root readers next. - symlinkguard.Scan lists every symlink inside the brain dir (skipping .git; the brain dir itself may be a mount symlink). - At startup the server refuses to start while any exists, naming them. - symlinkguard.Watch rescans every BRAIN_SYMLINK_SCAN_INTERVAL seconds (default 300) and sends one ntfy alert per new set of symlinks. The live brain dir had 0 symlinks on 2026-10-03, checked before this change, so deploying it does not trip. Refs #157 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
25 lines
743 B
Go
25 lines
743 B
Go
package main
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/mathiasbq/hyperguild/ingestion/internal/symlinkguard"
|
|
)
|
|
|
|
// startupSymlinkCheck is the hyperguild#157 tripwire at boot: a symlink in the
|
|
// brain dir would let brain readers serve a file from outside the brain, so
|
|
// the server does not start until it is removed. A scan that cannot run (e.g.
|
|
// a missing brain dir on first boot) is not treated as an incident.
|
|
func startupSymlinkCheck(brainDir string) error {
|
|
found, err := symlinkguard.Scan(brainDir)
|
|
if err != nil {
|
|
return nil
|
|
}
|
|
if len(found) > 0 {
|
|
return fmt.Errorf("refusing to start: %d symlink(s) in the brain dir %s (hyperguild#157); remove them: %s",
|
|
len(found), brainDir, strings.Join(found, ", "))
|
|
}
|
|
return nil
|
|
}
|