cmd/corral/ledger.go at 82dc300e39, reviewed by gemini-3.6-flash.
runLedgerAppend fails to block in-place re-linking when dir is a relative path because filepath.Rel errors on comparing an absolute target path against a relative base path.
cat << 'EOF' > cmd/corral/ledger_append_bug_test.go
package main
import (
"bytes"
"compress/gzip"
"os"
"path/filepath"
"testing"
)
func TestLedgerAppendInPlaceRelativeDir(t *testing.T) {
tmp, err := os.MkdirTemp("", "ledger_test")
if err != nil {
t.Fatal(err)
}
defer os.RemoveAll(tmp)
ledgerDir := filepath.Join(tmp, "myledger")
scansDir := filepath.Join(ledgerDir, "scans")
if err := os.MkdirAll(scansDir, 0755); err != nil {
t.Fatal(err)
}
entryPath := filepath.Join(scansDir, "entry.json.gz")
f, err := os.Create(entryPath)
if err != nil {
t.Fatal(err)
}
gw := gzip.NewWriter(f)
gw.Write([]byte("{}"))
gw.Close()
f.Close()
origWd, _ := os.Getwd()
defer os.Chdir(origWd)
if err := os.Chdir(tmp); err != nil {
t.Fatal(err)
}
var stdout, stderr bytes.Buffer
code := runLedgerAppend([]string{"myledger/scans/entry.json.gz", "myledger"}, &stdout, &stderr)
if code != 2 {
t.Errorf("DEFECT DEMONSTRATED: expected exit status 2 when appending in-place entry with relative dir, got status %d (stderr: %q)", code, stderr.String())
}
}
EOF
OUTPUT=$(go test ./cmd/corral -run TestLedgerAppendInPlaceRelativeDir 2>&1)
if echo "$OUTPUT" | grep -q "DEFECT DEMONSTRATED"; then
echo "$OUTPUT"
exit 0
else
echo "Defect not demonstrated"
exit 1
fi--- FAIL: TestLedgerAppendInPlaceRelativeDir (0.00s)
ledger_append_bug_test.go:44: DEFECT DEMONSTRATED: expected exit status 2 when appending in-place entry with relative dir, got status 1 (stderr: "corral ledger append: auditpush: entry.json.gz: format \"\", want \"corral-ledger-2\"
")
FAIL
FAIL github.com/pdbethke/corralai/cmd/corral 0.012s
FAILconfirmed by pdbethke — the claim holds: filepath.Rel errors on a relative --dir against an absolute src and the error skipped the in-place check (proven by a test that fails on the unfixed code). the script's own evidence was for a different reason — its fixture entry was malformed, so exit 1 came from ReadLedgerEntry before the check ran. fixed in feat/review-loop
ref c85b6ebcd6e4886c8d11c0226e4600d2be5dadd2bb69cd8eeb566a1a6302032e#R1
Recorded so that "found nothing here" can be told apart from "never looked here".
In `cmd/corral/ledger.go`, the `runLedgerAppend` function attempts to prevent re-linking an entry in place by checking if the source file resides within the ledger directory's `scans` subdirectory. However, it compares an absolute path for `src` (`filepath.Abs(src)`) against a relative path constructed for `dir` (`filepath.Join(dir, auditpush.ScansSubdir)`). In Go, `filepath.Rel` returns an error when one path is absolute and the other is relative, causing the check to fail and be bypassed whenever `dir` is specified as a relative path (finding 1).