Close diagnostic and restore coverage gaps

internal/fileops/confined_open_test.go

@@ -54,3 +54,95 @@ func TestOpenFileConfinedRejectsSymlinkWithoutTruncatingTarget(t *testing.T) {
 		t.Fatalf("target content = %q, want %q", data, original)
 	}
 }
+
+func TestOpenFileConfinedDoesNotFollowLeafReplacedBeforeTruncate(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("creating symlinks requires privileges that are not available on every Windows runner")
+	}
+	dir := t.TempDir()
+	target := filepath.Join(dir, "target.log")
+	const original = "unrelated content"
+	if err := os.WriteFile(target, []byte(original), 0o600); err != nil {
+		t.Fatalf("WriteFile(target) error = %v", err)
+	}
+	leaf := filepath.Join(dir, "diagnostic.log")
+	if err := os.WriteFile(leaf, []byte("old diagnostic"), 0o600); err != nil {
+		t.Fatalf("WriteFile(leaf) error = %v", err)
+	}
+
+	file, err := openFileConfined(leaf, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, WorkspaceFileMode, func() error {
+		if err := os.Remove(leaf); err != nil {
+			return err
+		}
+		return os.Symlink(filepath.Base(target), leaf)
+	})
+	if err != nil {
+		t.Fatalf("openFileConfined() error = %v", err)
+	}
+	if _, err := file.WriteString("new diagnostic"); err != nil {
+		_ = file.Close()
+		t.Fatalf("WriteString() error = %v", err)
+	}
+	if err := file.Close(); err != nil {
+		t.Fatalf("Close() error = %v", err)
+	}
+
+	targetData, err := os.ReadFile(target)
+	if err != nil {
+		t.Fatalf("ReadFile(target) error = %v", err)
+	}
+	if string(targetData) != original {
+		t.Fatalf("target content = %q, want %q", targetData, original)
+	}
+	leafData, err := os.ReadFile(leaf)
+	if err != nil {
+		t.Fatalf("ReadFile(leaf) error = %v", err)
+	}
+	if string(leafData) != "new diagnostic" {
+		t.Fatalf("leaf content = %q, want replacement diagnostic", leafData)
+	}
+	info, err := os.Lstat(leaf)
+	if err != nil {
+		t.Fatalf("Lstat(leaf) error = %v", err)
+	}
+	if info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() {
+		t.Fatalf("leaf mode = %v, want regular file", info.Mode())
+	}
+}
+
+func TestOpenFileConfinedRejectsLeafReplacedBeforeExistingFileOpen(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("creating symlinks requires privileges that are not available on every Windows runner")
+	}
+	dir := t.TempDir()
+	target := filepath.Join(dir, "target.lock")
+	const original = "unrelated lock content"
+	if err := os.WriteFile(target, []byte(original), 0o600); err != nil {
+		t.Fatalf("WriteFile(target) error = %v", err)
+	}
+	leaf := filepath.Join(dir, "session.lock")
+	if err := os.WriteFile(leaf, []byte("old lock"), 0o600); err != nil {
+		t.Fatalf("WriteFile(leaf) error = %v", err)
+	}
+
+	file, err := openFileConfined(leaf, os.O_RDWR|os.O_CREATE, WorkspaceFileMode, func() error {
+		if err := os.Remove(leaf); err != nil {
+			return err
+		}
+		return os.Symlink(filepath.Base(target), leaf)
+	})
+	if file != nil {
+		_ = file.Close()
+		t.Fatal("openFileConfined() returned a raced symbolic-link target")
+	}
+	if err == nil || !strings.Contains(err.Error(), "changed while being opened") {
+		t.Fatalf("openFileConfined() error = %v, want identity-change rejection", err)
+	}
+	targetData, readErr := os.ReadFile(target)
+	if readErr != nil {
+		t.Fatalf("ReadFile(target) error = %v", readErr)
+	}
+	if string(targetData) != original {
+		t.Fatalf("target content = %q, want %q", targetData, original)
+	}
+}