* test: route four unguarded symlink fixtures through symlink_or_skip
`tests/support/symlinks.py` was added in #5414 so suites that need a real
symlink skip cleanly when the host cannot create one. On a stock Windows host
(no Developer Mode, not elevated) `Path.symlink_to` / `os.symlink` raise
`OSError: [WinError 1314]`, and four fixtures still called them directly, so
they reported hard errors instead of skipping:
- tests/test_shared_reset_marker.py::test_marker_path_follows_a_symlinked_config
- tests/test_view_image_middleware.py::test_host_image_copy_is_scoped_to_current_user_and_thread
- tests/test_review_skill_package_tool.py::test_review_skill_package_rejects_symlink_planted_in_callers_outputs
- tests/test_channel_file_attachments.py::TestInboundFileSandboxPerms::test_make_inbound_file_sandbox_readable_swap_after_lstat_does_not_follow_symlink
These were the only symlink-related failures in a Windows run of the full
backend suite; the other bare symlink call sites there are already guarded by a
`skipif` or a `try/except OSError`. The view-image test plants its symlink
after its scoping assertions, so those still run before the skip. The
inbound-attachment test stages a symlink from inside a monkeypatched `os.lstat`
to exercise a TOCTOU race; a host that cannot create a symlink cannot stage
that race at all, so skipping is the only honest outcome.
* test: make channel symlink race fixture portable
---------
Co-authored-by: Willem Jiang <willem.jiang@gmail.com>
* fix(skills): confine review_skill_package local targets to the caller
Local path targets were allowed anywhere under the Gateway cwd or /tmp.
Every documented deployment keeps DEER_FLOW_HOME under the cwd, so a user
who knew another user's id could pass
.deer-flow/users/<id>/skills/custom/<skill> and get that skill's SKILL.md
and references/ back in the model response. The tool is always available,
so skill tool policy could not remove it.
Local targets are now confined to the configured skills root and the
caller's own user directory (resolved from the runtime user id through
make_safe_user_id, like the user-scoped skill storage). skill:// and
inline:// targets are unchanged.
* test(skills): pin dot-dot and sandbox-planted symlink review targets
* docs(changelog): reference #6580
* fix(skills): ignore a review skills root that contains per-user directories
A skills root configured at or above DEER_FLOW_HOME would re-admit every
user's directory as a local review target. Drop such a root and log a
warning instead of trusting it silently.
* test(skills): use the platform temp dir for the shared-temp review case
A hardcoded /tmp does not exist on Windows dev hosts.
---------
Co-authored-by: Willem Jiang <willem.jiang@gmail.com>
