fix(workspace): attribute a skill by both ends of its path, not one

Moving attribution onto the resolved path closed the alias pointing INTO
a snapshot and opened the reverse: a link inside a foreign snapshot whose
target lives outside it resolves to a path with no managed component, so
it read as an ordinary skill. A symlink crosses that boundary in either
direction, so both ends are checked, and a match touching any managed
project is served only if every one of them is ours.

Verified separately for each end: gating on the resolved path alone fails
the link-out test, gating on the matched path alone fails the link-in
test, and both together pass. The mutations were confirmed applied rather
than assumed from the edit.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Tneq4MLNoRLsX7htV6fGZC

Author: saravmajestic

packages/opencode/src/skill/index.ts

@@ -326,16 +326,30 @@ const withoutForeignSnapshots = Effect.fnUntraced(function* (matches: string[])
     ),
   )
 
-  const unresolved = matches.filter((_, i) => real[i] === null || real[i] === undefined)
+  const unresolved = matches.filter((_, i) => !real[i])
   if (unresolved.length > 0)
     yield* Effect.logWarning("withholding skills whose paths could not be resolved", { paths: unresolved })
 
-  const projects = new Set<string>()
-  for (const candidate of real) {
-    if (!candidate) continue
-    const project = snapshotProjectOf(candidate)
-    if (project !== null) projects.add(project)
+  // BOTH ends, because a symlink crosses the boundary in either direction: one
+  // pointing INTO a snapshot has no managed component in its matched path, and
+  // one INSIDE a snapshot pointing out has none in its resolved path. Checking
+  // only the resolved end traded the first bypass for the second. A match that
+  // touches any managed project is served only if every one of them is ours.
+  // (review)
+  const projectsOf = (match: string, resolved: string | null): string[] => {
+    const found = new Set<string>()
+    for (const candidate of [match, resolved]) {
+      if (!candidate) continue
+      const project = snapshotProjectOf(candidate)
+      if (project !== null) found.add(project)
+    }
+    return [...found]
   }
+
+  const projects = new Set<string>()
+  matches.forEach((match, i) => {
+    for (const project of projectsOf(match, real[i] ?? null)) projects.add(project)
+  })
   if (projects.size === 0 && unresolved.length === 0) return matches
 
   const ours = new Map<string, boolean>()
@@ -352,11 +366,10 @@ const withoutForeignSnapshots = Effect.fnUntraced(function* (matches: string[])
     ours.set(project, ok)
   }
 
-  return matches.filter((_, i) => {
-    const candidate = real[i]
-    if (!candidate) return false
-    const project = snapshotProjectOf(candidate)
-    return project === null || ours.get(project) === true
+  return matches.filter((match, i) => {
+    const resolved = real[i]
+    if (!resolved) return false
+    return projectsOf(match, resolved).every((project) => ours.get(project) === true)
   })
 })
 // altimate_change end

packages/opencode/test/skill/skill.test.ts

@@ -809,6 +809,39 @@ description: A skill in the .opencode/skills directory.
     ),
   )
 
+  // The reverse alias: a link INSIDE a foreign snapshot pointing at a file
+  // outside it. Its resolved path carries no managed component, so gating on
+  // the resolved end alone traded one bypass for another. (review)
+  it.live("a link out of another account's snapshot is not a way out", () =>
+    provideTmpdirInstance(
+      (dir) =>
+        withHome(
+          dir,
+          Effect.gen(function* () {
+            yield* Effect.promise(() => writeSnapshot(dir, credentialDigest(API_URL, TENANT, "someone-else")))
+            yield* Effect.promise(async () => {
+              // The real content lives outside the snapshot; the snapshot only
+              // links to it, so `realpath` leads away from `_workspace`.
+              await fs.mkdir(path.join(dir, "elsewhere"), { recursive: true })
+              await fs.writeFile(
+                path.join(dir, "elsewhere", "SKILL.md"),
+                `---\nname: linked-out\ndescription: Reached through a foreign snapshot.\n---\n\nBody.\n`,
+              )
+              await fs.mkdir(path.join(dir, MANAGED, "pub-linked"), { recursive: true })
+              await fs.symlink(
+                path.join(dir, "elsewhere", "SKILL.md"),
+                path.join(dir, MANAGED, "pub-linked", "SKILL.md"),
+              )
+            })
+
+            const skill = yield* Skill.Service
+            expect((yield* skill.all()).find((s) => s.name === "linked-out")).toBeUndefined()
+          }),
+        ),
+      { git: true },
+    ),
+  )
+
   // A path that cannot be resolved cannot be attributed, so it is withheld.
   // Falling back to the matched path answered "ordinary skill" for a broken or
   // momentarily unreadable alias — and one whose target became readable again