Confine subprocess diagnostics and retain redacted tails

internal/fileops/confined_open_test.go

@@ -0,0 +1,56 @@
+package fileops
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+func TestOpenFileConfinedRejectsNonRegularLeaf(t *testing.T) {
+	leaf := filepath.Join(t.TempDir(), "diagnostic.log")
+	if err := os.Mkdir(leaf, 0o700); err != nil {
+		t.Fatalf("Mkdir() error = %v", err)
+	}
+	file, err := OpenFileConfined(leaf, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, WorkspaceFileMode)
+	if file != nil {
+		_ = file.Close()
+		t.Fatal("OpenFileConfined() returned a file for a directory")
+	}
+	if err == nil || !strings.Contains(err.Error(), "not a regular file") {
+		t.Fatalf("OpenFileConfined() error = %v, want regular-file rejection", err)
+	}
+}
+
+func TestOpenFileConfinedRejectsSymlinkWithoutTruncatingTarget(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("creating symlinks requires privileges that are not available on every Windows runner")
+	}
+	dir := t.TempDir()
+	target := filepath.Join(dir, "target.log")
+	const original = "outside content"
+	if err := os.WriteFile(target, []byte(original), 0o600); err != nil {
+		t.Fatalf("WriteFile(target) error = %v", err)
+	}
+	leaf := filepath.Join(dir, "diagnostic.log")
+	if err := os.Symlink(target, leaf); err != nil {
+		t.Fatalf("Symlink() error = %v", err)
+	}
+
+	file, err := OpenFileConfined(leaf, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, WorkspaceFileMode)
+	if file != nil {
+		_ = file.Close()
+		t.Fatal("OpenFileConfined() returned a file for a symbolic link")
+	}
+	if err == nil || !strings.Contains(err.Error(), "symbolic link") {
+		t.Fatalf("OpenFileConfined() error = %v, want symbolic-link rejection", err)
+	}
+	data, readErr := os.ReadFile(target)
+	if readErr != nil {
+		t.Fatalf("ReadFile(target) error = %v", readErr)
+	}
+	if string(data) != original {
+		t.Fatalf("target content = %q, want %q", data, original)
+	}
+}