fix(plugins): run process: programs through their PATH-found link (#2007)

* fix(plugins): run process: programs through their PATH-found link

resolve_program canonicalized the found file, so a symlinked cargo
(rustup, asdf, mise and other multicall shims) resolved to the shim
itself: Command::new then ran rustup with cargo's arguments.

The link is what dispatches on argv[0], so keep it as the pinned path.
The grant still pins the target's content: hashing through the link
reads the file it points to, and relinking or replacing either still
fails the approved-file check.

Fixes #2001

* fix(plugins): canonicalize the dir, not the program link

CI showed the middle ground is needed: tests (and the pins file)
compare against canonicalized paths — /var → /private/var on macOS —
but the file name itself must stay the PATH-found link so multicall
shims dispatch on argv[0]. Canonicalize the parent only.

* fix(ide-plugin): set file_action in windows-only test action

The CodeAction struct gained a file_action field but this windows-only
test fixture was not updated, breaking the Windows build (E0063). A plain
action is not a file action.

crates/ide-extension/src/ledger.rs

@@ -308,6 +308,13 @@ pub fn by_risk(caps: &[Capability]) -> Vec<(Risk, Vec<Capability>)> {
 
 /// Resolves a `process:` program to an absolute path once, at grant time:
 /// absolute names are taken as is, others are looked up in `path_var`.
+/// The directory is canonicalized but the file name kept as found: `cargo`,
+/// `rustc` and friends are often links to a multicall shim (rustup, asdf,
+/// mise) that picks the tool by the name it was invoked under — resolving the
+/// link itself would start the shim with the tool's arguments. The grant
+/// still pins the target's content: a hash read through a link reads the file
+/// it points to, so relinking or replacing either still fails the
+/// approved-file check.
 pub fn resolve_program(name: &str, path_var: Option<&OsStr>) -> Result<PathBuf, String> {
     let candidate = Path::new(name);
     if candidate.is_absolute() {
@@ -325,15 +332,21 @@ pub fn resolve_program(name: &str, path_var: Option<&OsStr>) -> Result<PathBuf,
         for ext in &exts {
             let p = dir.join(format!("{name}{ext}"));
             if is_executable(&p) {
-                return Ok(dunce_canonical(&p));
+                return Ok(canonical_dir(&p));
             }
         }
     }
     Err(format!("{name} was not found on PATH"))
 }
 
-fn dunce_canonical(p: &Path) -> PathBuf {
-    std::fs::canonicalize(p).unwrap_or_else(|_| p.to_path_buf())
+/// `p` with its parent canonicalized but the file name as found: PATH
+/// entries like `/var` → `/private/var` (macOS) or `~` links collapse to
+/// their real directory, while a linked program (`cargo` → rustup) keeps
+/// its link name so the shim still dispatches on argv[0].
+fn canonical_dir(p: &Path) -> PathBuf {
+    let Some(dir) = p.parent() else { return p.to_path_buf() };
+    let Some(name) = p.file_name() else { return p.to_path_buf() };
+    std::fs::canonicalize(dir).map(|d| d.join(name)).unwrap_or_else(|_| p.to_path_buf())
 }
 
 fn is_executable(p: &Path) -> bool {
@@ -474,6 +487,42 @@ mod tests {
         assert!(l.check_binary(&r.subject, &cap).unwrap_err().contains("changed"));
     }
 
+    /// A program found as a link stays the link: multicall shims (rustup,
+    /// asdf, mise) pick the tool by the name they were invoked under, so
+    /// `Command::new` must see the link. The hash still covers the target —
+    /// reading through the link reads it — so replacing either still trips
+    /// the approved-file check.
+    #[cfg(unix)]
+    #[test]
+    fn linked_programs_resolve_to_the_link() {
+        use std::os::unix::fs::PermissionsExt;
+        let tmp = tempfile::tempdir().unwrap();
+        let bin_dir = tmp.path().join("bin");
+        let real_dir = tmp.path().join("real");
+        std::fs::create_dir(&bin_dir).unwrap();
+        std::fs::create_dir(&real_dir).unwrap();
+        let target = real_dir.join("shim");
+        std::fs::write(&target, "#!/bin/sh\necho v1\n").unwrap();
+        std::fs::set_permissions(&target, std::fs::Permissions::from_mode(0o755)).unwrap();
+        std::os::unix::fs::symlink(&target, bin_dir.join("cargo")).unwrap();
+
+        let path_var = std::env::join_paths([bin_dir.clone()]).unwrap();
+        let resolved = resolve_program("cargo", Some(&path_var)).unwrap();
+        // Directory canonicalized, file name kept — still the link.
+        let want = std::fs::canonicalize(&bin_dir).unwrap().join("cargo");
+        assert_eq!(resolved, want);
+        assert!(resolved.symlink_metadata().unwrap().file_type().is_symlink());
+
+        let mut l = Ledger::in_memory();
+        let r = req("1.0.0", "h", &["process:cargo"], &[]);
+        let cap: Capability = "process:cargo".parse().unwrap();
+        let bin = BinaryGrant { path: resolved.clone(), hash: file_hash(&resolved).unwrap() };
+        l.confirm(&r, &[], [(cap.to_string(), bin)].into());
+        assert_eq!(l.check_binary(&r.subject, &cap).unwrap(), resolved);
+        std::fs::write(&target, "#!/bin/sh\necho evil\n").unwrap();
+        assert!(l.check_binary(&r.subject, &cap).unwrap_err().contains("changed"));
+    }
+
     #[test]
     fn hashes_and_grouping() {
         let tmp = tempfile::tempdir().unwrap();

crates/ide-plugin/src/runtime.rs

@@ -1650,6 +1650,7 @@ mod tests {
                 operations: Vec::new(),
                 open: None,
                 data: None,
+                file_action: false,
             };
             assert_eq!(code_action_to_wit(&action).edits[0].path, expected);
         }