bug(intake): directory expansion follows symlinks — symlink escape into arbitrary files

[robertDouglass]

Problem

The directory-expansion branch in scan_for_plans (src/specify_cli/intake_sources.py):

for child in sorted(abs_path.iterdir()):
    if child.is_file() and child.suffix == ".md":
        results.append(...)

child.is_file() follows symlinks. A symlink inside .opencode/plans/ pointing to any world-readable file with a .md suffix would be included in the results and its full contents written verbatim into .kittify/mission-brief.md.

Suggested fix

Either skip symlinks explicitly:

if child.is_file() and not child.is_symlink() and child.suffix == ".md":

Or, stronger: verify the resolved child path is still within abs_path:

if child.is_file() and child.suffix == ".md" and child.resolve().is_relative_to(abs_path.resolve()):

[robertDouglass]

Closed for GitHub hygiene after PR #803 merged into main.

Evidence: #803 merged at 2026-04-26T12:28:43Z as squash commit 184b172. The PR body and committed issue matrix at kitty-specs/stability-and-hygiene-hardening-2026-04-01KQ4ARB/issue-matrix.md list this issue with a fixed or verified-already-fixed verdict and regression/evidence references.