[cadence fe45540a65f87fa8] Finding 2 remains open: command substitution strips trailing newlines from readlink output, allowing a pre-existing directory symlink to pass the new ownership check. #249

Raised at install.sh:195 as high by openai, ruled downgraded.

Claim. Finding 2 remains open: command substitution strips trailing newlines from readlink output, allowing a pre-existing directory symlink to pass the new ownership check.

Failure scenario. Before line 194, create a directory whose pathname is "$staged" followed by a literal newline, and make "$temporary" a symlink to that directory. The installer's ln follows this directory symlink, creates a baley link inside it, and succeeds. The new readlink comparison strips the target's trailing newline, making it compare equal to "$staged". The installer consequently claims the pre-existing symlink and moves it over the working stable link, reporting success while ~/.local/bin/baley points to a directory.

Filed by Cadence. Fingerprint fe45540a65f87fa8 over (file, claim).