Harden transcript_apply path validation and patch replay

[taylorai-coding-agents]

Addresses the correctness and security blockers called out in the merged PR review by tightening filesystem validation and making recovered patches compatible with standard git apply.

What changed

• Centralized path resolution in VirtualWorkspace.disk_path() so reads, writes, deletes, and creates resolve existing components, reject symlink escapes outside the target root, and fail early on non-directory parents or directory targets.
• Updated dry-run and apply-to-disk flows to use the same path checks, reject writes to existing directories before apply time, and convert filesystem write/unlink failures into TranscriptApplyError.
• Fixed apply_patch parsing to accept *** End of File inside update hunks instead of treating it as an unsupported directive.
• Fixed hunk replay for files without trailing newlines by honoring \ No newline at end of file and preserving line-ending semantics during context matching.
• Fixed generated patch paths to emit standard a/ and b/ prefixes instead of double-prefixed paths, then added a git apply --check regression test.

Why

The previous implementation could write through symlinks outside the requested root, emit unusable patch paths, and reject valid apply_patch payloads. These changes make transcript recovery safer and bring patch replay behavior in line with expected patch syntax.

Reviewer notes

• The main behavioral change is that all filesystem access now goes through the same root-bound resolution logic, so path safety checks apply consistently in both analysis and final apply.
• Test coverage now includes symlink escape rejection, directory-write rejection, valid *** End of File payloads, no-trailing-newline hunks, and git apply --check validation for generated patches.

[taylorai-coding-agents]

🤖 PR Review by codex (gpt-5.3-codex)

Verdict: 🔧 Changes Requested

Core fixes are mostly in place, but generated patch normalization currently corrupts file content via global replacements.

Issues

🔴 Global patch path normalization rewrites diff body content src/cacli/transcript_apply.py:1008

Replace only header/path metadata lines with anchored line-based rewriting (or generate correct prefixes without post-processing); avoid global string replacements over full patch text.

🟡 Patch test checks syntax only, not semantic fidelity tests/test_transcript_apply.py:74

Add a round-trip test: apply generated patch to a clean copy and assert resulting file content equals analysis.final_files, including strings like 'a/a/' and 'b/b/' in file data.