From 8348fb990d4f84b994776c8efe381c3aff6e02ed Mon Sep 17 00:00:00 2001
From: haelyra <49814733+haelyra@users.noreply.github.com>
Date: Mon, 24 Aug 2026 20:28:01 -0400
Subject: [PATCH] fix(security): pin guided preflight reads before validation

---
 scripts/lib/multi-harness-setup.js | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/scripts/lib/multi-harness-setup.js b/scripts/lib/multi-harness-setup.js
index 4bb829958..76826eea5 100644
--- a/scripts/lib/multi-harness-setup.js
+++ b/scripts/lib/multi-harness-setup.js
@@ -73,29 +73,26 @@ function sameFileIdentity(left, right) {
 }
 
 function readRegularFileSnapshot(filePath) {
-  let pathStat;
+  const flags = fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0);
+  let descriptor;
   try {
-    pathStat = fs.lstatSync(filePath);
+    descriptor = fs.openSync(filePath, flags);
   } catch (error) {
     if (error && (error.code === 'ENOENT' || error.code === 'ENOTDIR')) return null;
     throw error;
   }
-  if (!pathStat.isFile() || pathStat.isSymbolicLink()) {
-    throw new Error(`Refusing to read a symbolic link or non-file at ${filePath}.`);
-  }
 
-  const flags = fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0);
-  const descriptor = fs.openSync(filePath, flags);
   try {
     const before = fs.fstatSync(descriptor);
-    if (!before.isFile() || !sameFileIdentity(pathStat, before)) {
-      throw new Error(`Refusing to read a file that changed during open: ${filePath}.`);
+    if (!before.isFile()) {
+      throw new Error(`Refusing to read a non-file at ${filePath}.`);
     }
     const content = fs.readFileSync(descriptor);
     const after = fs.fstatSync(descriptor);
     const finalPathStat = fs.lstatSync(filePath);
     if (
       finalPathStat.isSymbolicLink()
+      || !finalPathStat.isFile()
       || !sameFileIdentity(before, after)
       || !sameFileIdentity(after, finalPathStat)
     ) {