fix(client): skip symlinks in directory uploads

openviking_cli/client/http.py

@@ -344,12 +344,19 @@ def _zip_directory(self, dir_path: str) -> str:
         if not dir_path.is_dir():
             raise ValueError(f"Path {dir_path} is not a directory")
 
+        root = dir_path.resolve()
         temp_dir = tempfile.gettempdir()
         zip_path = Path(temp_dir) / f"temp_upload_{uuid.uuid4().hex}.zip"
 
         with zipfile.ZipFile(zip_path, "w", zipfile.ZIP_DEFLATED) as zipf:
             for file_path in dir_path.rglob("*"):
+                if file_path.is_symlink():
+                    continue
                 if file_path.is_file():
+                    try:
+                        file_path.resolve().relative_to(root)
+                    except ValueError:
+                        continue
                     arcname = file_path.relative_to(dir_path)
                     arcname = str(arcname).replace("\\", "/")
                     zipf.write(file_path, arcname=arcname)

tests/client/test_rebuild_clients.py

@@ -1,5 +1,7 @@
 import asyncio
 import threading
+import zipfile
+from pathlib import Path
 from types import SimpleNamespace
 from unittest.mock import AsyncMock, patch
 
@@ -20,6 +22,34 @@ def clear_ovcli_config(monkeypatch):
     monkeypatch.setattr(http_module, "load_ovcli_config", lambda: None)
 
 
+def test_async_http_client_zip_directory_skips_symlinked_entries(tmp_path):
+    root = tmp_path / "upload"
+    root.mkdir()
+    (root / "keep.txt").write_text("keep", encoding="utf-8")
+    nested = root / "nested"
+    nested.mkdir()
+    (nested / "nested.txt").write_text("nested", encoding="utf-8")
+    outside = tmp_path / "outside.txt"
+    outside.write_text("outside", encoding="utf-8")
+
+    try:
+        (root / "inside-link.txt").symlink_to(root / "keep.txt")
+        (root / "outside-link.txt").symlink_to(outside)
+        (root / "dir-link").symlink_to(tmp_path, target_is_directory=True)
+    except OSError as exc:
+        pytest.skip(f"symlinks are not available in this environment: {exc}")
+
+    client = AsyncHTTPClient(url="http://localhost:1933")
+    zip_path = Path(client._zip_directory(str(root)))
+    try:
+        with zipfile.ZipFile(zip_path) as zipf:
+            names = sorted(zipf.namelist())
+    finally:
+        zip_path.unlink(missing_ok=True)
+
+    assert names == ["keep.txt", "nested/nested.txt"]
+
+
 async def test_async_openviking_reindex_forwards_to_local_client(tmp_path):
     client = AsyncOpenViking(path=str(tmp_path))
     with patch.object(client, "_ensure_initialized", new_callable=AsyncMock) as mock_init: