mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-25 17:45:53 +01:00
nickyleachandPaperclip
bb88ff93f6
removeMaintainerOnlySkillSymlinks checked a manifest-named entry's shape, then removed it with fs.rm(recursive, force) in every case. A concurrent process could replace an approved symlink with a populated directory in the gap between the check and the removal; the recursive call would then delete that directory's contents. Branch the removal on the shape the check confirmed: fs.unlink for a symlink, so a directory swapped in during the race fails the unlink instead of being deleted, and fs.rm(recursive) only for a directory the check already approved. Co-authored-by: Paperclip <noreply@paperclip.ing>