🔒 fix(exec): preserve trusted command aliases

Author: jiunbae

Sources/MenubucketCore/ExecService.swift

@@ -345,19 +345,15 @@ public final class ExecService {
         }
 
         func matchesCommandIdentity(_ candidate: URL) -> Bool {
-            if !command0.contains("/") {
-                return candidate.resolvingSymlinksInPath().lastPathComponent == command0
-            }
-
-            let declared: URL
-            if command0.hasPrefix("./") || command0.hasPrefix("../") {
-                let base = workingDirectory ?? URL(fileURLWithPath: fm.currentDirectoryPath)
-                declared = base.appendingPathComponent(command0)
-            } else {
-                declared = URL(fileURLWithPath: (command0 as NSString).expandingTildeInPath)
-            }
-            return candidate.standardizedFileURL.resolvingSymlinksInPath().path
-                == declared.standardizedFileURL.resolvingSymlinksInPath().path
+            let trustedBareCommand = command0.contains("/")
+                ? nil
+                : searchPATH(for: command0, executableURL: executableURL)
+            return executableMatchesCommandIdentity(
+                command0: command0,
+                candidate: candidate,
+                workingDirectory: workingDirectory,
+                trustedBareCommand: trustedBareCommand
+            )
         }
 
         func authorizedExecutableURL(atPath path: String) -> URL? {
@@ -411,6 +407,33 @@ public final class ExecService {
         return searchPATH(for: command0, executableURL: executableURL)
     }
 
+    static func executableMatchesCommandIdentity(
+        command0: String,
+        candidate: URL,
+        workingDirectory: URL?,
+        trustedBareCommand: URL?
+    ) -> Bool {
+        let canonicalCandidate = candidate.standardizedFileURL.resolvingSymlinksInPath()
+        if !command0.contains("/") {
+            guard candidate.lastPathComponent == command0 else { return false }
+            if canonicalCandidate.lastPathComponent == command0 { return true }
+            guard let trustedBareCommand else { return false }
+            return canonicalCandidate.path
+                == trustedBareCommand.standardizedFileURL.resolvingSymlinksInPath().path
+        }
+
+        let declared: URL
+        if command0.hasPrefix("./") || command0.hasPrefix("../") {
+            let base = workingDirectory
+                ?? URL(fileURLWithPath: FileManager.default.currentDirectoryPath)
+            declared = base.appendingPathComponent(command0)
+        } else {
+            declared = URL(fileURLWithPath: (command0 as NSString).expandingTildeInPath)
+        }
+        return canonicalCandidate.path
+            == declared.standardizedFileURL.resolvingSymlinksInPath().path
+    }
+
     private static func searchPATH(
         for name: String,
         executableURL: (String) -> URL?

Tests/MenubucketCoreTests/ExecServiceTests.swift

@@ -49,23 +49,55 @@ final class ExecServiceTests: XCTestCase {
         XCTAssertNil(resolved)
     }
 
-    func testDiscoveryAcceptsBareCommandSymlinkedToSameExecutableIdentity() throws {
+    func testIdentityAcceptsTrustedPATHAliasWithDifferentCanonicalBasename() throws {
         let directory = FileManager.default.temporaryDirectory
             .appendingPathComponent(UUID().uuidString, isDirectory: true)
         try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
         defer { try? FileManager.default.removeItem(at: directory) }
-        let symlink = directory.appendingPathComponent("sh")
+        let symlink = directory.appendingPathComponent("python3")
         try FileManager.default.createSymbolicLink(atPath: symlink.path, withDestinationPath: "/bin/sh")
-        var searched: [String] = []
 
-        let resolved = ExecService.resolveExecutable(
+        XCTAssertTrue(ExecService.executableMatchesCommandIdentity(
+            command0: "python3",
+            candidate: symlink,
+            workingDirectory: nil,
+            trustedBareCommand: URL(fileURLWithPath: "/bin/sh")
+        ))
+    }
+
+    func testIdentityRejectsAliasThatDiffersFromTrustedPATHExecutable() throws {
+        let directory = FileManager.default.temporaryDirectory
+            .appendingPathComponent(UUID().uuidString, isDirectory: true)
+        try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+        defer { try? FileManager.default.removeItem(at: directory) }
+        let symlink = directory.appendingPathComponent("git")
+        try FileManager.default.createSymbolicLink(atPath: symlink.path, withDestinationPath: "/bin/sh")
+
+        XCTAssertFalse(ExecService.executableMatchesCommandIdentity(
+            command0: "git",
+            candidate: symlink,
+            workingDirectory: nil,
+            trustedBareCommand: URL(fileURLWithPath: "/usr/bin/git")
+        ))
+    }
+
+    func testIdentityRejectsCandidateWhosePresentedNameDiffers() {
+        XCTAssertFalse(ExecService.executableMatchesCommandIdentity(
+            command0: "git",
+            candidate: URL(fileURLWithPath: "/bin/sh"),
+            workingDirectory: nil,
+            trustedBareCommand: URL(fileURLWithPath: "/bin/sh")
+        ))
+    }
+
+    func testIdentityAcceptsOrdinarySameCanonicalBasename() {
+        XCTAssertTrue(ExecService.executableMatchesCommandIdentity(
             command0: "sh",
-            discover: [symlink.path],
+            candidate: URL(fileURLWithPath: "/bin/sh"),
             workingDirectory: nil,
-            searched: &searched
+            trustedBareCommand: nil
+        )
         )
-
-        XCTAssertEqual(try XCTUnwrap(resolved).path, symlink.path)
     }
 
     func testDiscoveryRejectsCandidateForDifferentPathCommandIdentity() {