fix(server): show symlinked directories in the project picker#26168

Problem

Add Project omits symlinked directories from both its folder list and path autocomplete. WorkspaceEntries.browse checks only Dirent.isDirectory(), which is false for a symlink even when its target is a directory. On macOS, a directory symlink pointing to a project on another volume is therefore invisible; typing the complete symlink path with a trailing separator already works.

Fixes #8408.

Change

Include matching directory symlinks after checking their targets, with link inspections bounded by the SYMLINK_RESOLVE_BATCH_SIZE limit list already uses (64). Inspect each path component with lstat/readlink (bounded to 40 link expansions), rejecting UNC/device-style redirects before descending through them. Stat only the resolved target, so the original symlink path is not followed again. Ordinary directories need no additional stat. Keep the symlink's own name and fullPath, existing prefix/hidden-directory filtering, and alphabetical ordering. Skip links whose targets are files or cannot be inspected. When a listed link is chosen, it is resolved before its folder is read, so a link later retargeted to a network share is never followed by readdir; a UNC path the user types directly is still read as before.

This carries forward #8281 (closed by a maintainer in favour of this PR), credited to PengLx as co-author. The tests include its requested follow-up cases, including fixtures named Templates and Recent outside the user profile.

Scope and approval

Submitted under the small, focused obvious-bug exception: selecting a directory through its existing symlink path works when fully typed, but the same directory is omitted from discovery. Only WorkspaceEntries.browse and its tests change. The shared filesystem.browse service supplies web/desktop and mobile; there are no client or wire-contract changes.

This does not change project registration/identity or relative file-read containment. #26044 covers broader symlink browsing/file-reading behavior and remains separate. #26157 addresses Codex runtime working directories after a project has been added.

Verification

• Rebased onto 7c22e24e3f (after #21920's list symlink support; the source change applied cleanly). Against main's unchanged WorkspaceEntries.ts, the 5 new browse tests fail and 23 pass; on this branch 29/29 pass. A further regression (a chosen link whose folder is retargeted to a network share) fails against the previously published 8dfd61c5 and passes here. vp run check:changed passes. This rebase run used Node 24.19.0 locally; the earlier receipts below used 26.12.1.

Earlier receipts, before the rebase:

• macOS (darwin), Node 26.12.1, Vite+ 1.4.0; default macOS temporary directory.
• The original two discovery regressions against unchanged upstream implementation: 2 fail, 18 pass, because expected directory-link entries are missing. A third regression for direct and chained network links failed against the initial patch before the review fix. With the final fix: 23/23 pass in vp test run apps/server/src/workspace/WorkspaceEntries.test.ts.
• vp run check:changed on base 3b22620a5cbb: format, lint, both knip stages, GraphQL generation check, affected typechecks, and all 23 tests pass.
• Fixtures created with type junction (junctions on Windows, directory symlinks elsewhere; run on macOS only) cover listing, case-insensitive autocomplete, hidden-prefix autocomplete, preserved symlink paths, and browsing into a symlinked directory. File/broken/cyclic/permission-denied target states are injected in one unit test so it can run on Windows without file-symlink privileges. The separate macOS runtime probe below uses actual relative directory, file, broken, and cyclic symlinks, with no filesystem mocks.

Direct WorkspaceEntries.browse runtime transcript (temporary fixture root shortened to $FIXTURE; the directory target is outside projects):

File, broken, and cyclic links were absent from both listings. The fully typed symlink path worked before and after; discovery is what changes.

Not verified: actual Windows/Linux hosts or rendered web/desktop/mobile interactions. The runtime trace calls the production service directly, not the WebSocket transport or an installed T3 instance. No installed application or live T3 data was modified.

Independent Claude Opus 5.5 review reran the original 20 tests, checked the evidence and contribution guidelines, and found one blocking network-link issue. Addressed it with the bounded link-chain guard and a fail-first regression; also corrected the platform and symlink terminology. The reviewer did not rerun the post-review patch. CodeRabbit subsequently identified the intermediate-component gap; this follow-up closes it and adds regressions for intermediate network redirects, local redirects, relative parent components, and bounded cycles. Both new traversal tests fail against the previously published commit 67e2b39a and pass with the fix. The real-filesystem service probe was rerun successfully after this change.

Remaining limits: component inspection uses separate filesystem calls, so it does not guarantee protection against concurrent link retargeting; this is not a complete containment boundary. POSIX symlinks into hung mounts can delay the whole listing; concurrency is bounded but filesystem operations have no timeout. Windows legacy profile junctions and cloud-placeholder folders may now appear; behavior on a Windows host is unverified, and any legacy-junction filter should be limited to the profile directory in a follow-up rather than globally hiding names such as Templates or Recent.

Written with GPT-6 Astra through the Codex harness in T3 Code; reviewed with Claude Opus 5.5 through T3 Code delegation.

Fixes pingdotgg/t3code#8408