[erunion]

Summary

• oas:sync treated containment as a string comparison, so a directory symlink committed at reference/<info.title> (git mode 120000) passed the check and the following mkdir, writeFile, rename, unlink, and rm calls followed it out of the repo. Sync now refuses any symlink under reference/ before it modifies the tree, and every write or delete resolves the real path and rejects a symlink segment. The command prints the refused path and exits non-zero. lint --fix reports that refusal instead of marking the sync fixed.
• The same lexical check in pretty and the import staging guard now uses the same helper.
• Fixes CX-4160.

Test plan

• npx vitest run (275 tests)
• Symlink at reference/<title> pointing outside the repo: sync throws, the outside directory is unchanged, and an in-repo stale page is not deleted first
• Symlink whose target is also inside reference/, a tag-folder symlink, and a symlinked page are refused
• oas:sync prints the refusal and exits 1
• lint --fix reports the refusal and does not mark the missing page fixed
• Confirm a normal docs repo with no symlinks under reference/ still syncs

Made with Cursor

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no new actionable issue was found.

_{Reviews (3) · Last reviewed commit: "fix(oas:sync): read order files through ..." · Reviewed by Greptile}