Reject hard-linked generic outputs during refresh

Treat generated files with multiple hard links as unowned before command or skill refresh, so a matching hash cannot authorize changes to unrelated linked files. Cover both layouts and successful refresh after unlinking.

Assisted-by: GitHub Copilot (model: GPT-6 Sol, autonomous)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: mnriem

src/specify_cli/agents.py

@@ -631,6 +631,8 @@ def _generic_owned_output(path: Path, source_id: str, project_root: Path) -> boo
         hashes = metadata.get("generic_artifact_hashes", {}) if metadata else {}
         if not isinstance(hashes, dict) or not path.is_file():
             return False
+        if path.stat().st_nlink > 1:
+            return False
         if path.is_symlink() and not path.resolve().is_relative_to(
             (project_root / ".specify/extensions").resolve()
         ):

src/specify_cli/extensions/__init__.py

@@ -2102,6 +2102,8 @@ def _generic_owned_names(
                 continue
             if not path.is_file():
                 continue
+            if path.stat().st_nlink > 1:
+                continue
             if path.is_symlink() and not path.resolve().is_relative_to(
                 self.extensions_dir.resolve()
             ):

tests/integrations/test_integration_generic.py

@@ -113,6 +113,40 @@ def test_generic_extension_preserves_modified_artifact(tmp_path, generic_extensi
     assert artifact.read_text(encoding="utf-8").endswith("user edit\n")
 
 
+@pytest.mark.parametrize("skills", [False, True])
+def test_generic_refresh_rejects_hard_linked_artifact(
+    tmp_path, generic_extension, skills, capsys,
+):
+    project = generic_project(tmp_path, skills=skills)
+    manager = ExtensionManager(project)
+    manager.install_from_directory(generic_extension, "1.0.0")
+    artifact = project / ".custom/commands" / (
+        "speckit-sample-run/SKILL.md" if skills else "speckit.sample.run.md"
+    )
+    unrelated = project / "unrelated.md"
+    try:
+        os.link(artifact, unrelated)
+    except OSError:
+        pytest.skip("hard links are unavailable")
+    original = artifact.read_bytes()
+    metadata = manager.registry.get("sample")
+    source = manager.extensions_dir / "sample/commands/run.md"
+    source.write_text(source.read_text(encoding="utf-8") + "\nnew source\n", encoding="utf-8")
+
+    manager.register_enabled_extensions_for_agent("generic", force=skills)
+
+    warning = capsys.readouterr().out
+    assert "Missing" in warning and "invocation artifacts" in warning
+    assert artifact.read_bytes() == original
+    assert unrelated.read_bytes() == original
+    assert manager.registry.get("sample") == metadata
+
+    unrelated.unlink()
+    manager.register_enabled_extensions_for_agent("generic", force=skills)
+    assert b"new source" in artifact.read_bytes()
+    assert manager.remove("sample")
+
+
 @pytest.mark.parametrize("operation", ["resync", "remove", "force"])
 def test_generic_skill_symlinked_directory_is_not_owned(
     tmp_path, generic_extension, operation,