fix(backup): reject missing hardlink targets

jason-allen-oneal · steipete · commit 77d115761805 · 2026-05-24T00:05:55.000+01:00
diff --git a/src/commands/backup-verify.test.ts b/src/commands/backup-verify.test.ts
@@ -343,6 +343,39 @@ describe("backupVerifyCommand", () => {
     }
   });
 
+  it("rejects hardlink targets missing from archive entries", async () => {
+    const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-backup-missing-linkpath-"));
+    const archivePath = path.join(tempDir, "broken.tar.gz");
+    const payloadArchivePath = `${TEST_ARCHIVE_ROOT}/payload/posix/tmp/.openclaw/target.txt`;
+    const hardlinkArchivePath = `${TEST_ARCHIVE_ROOT}/payload/posix/tmp/.openclaw/hardlink.txt`;
+    const missingTargetPath = `${TEST_ARCHIVE_ROOT}/payload/posix/tmp/.openclaw/missing-target.txt`;
+    try {
+      const archive = gzipSync(
+        Buffer.concat([
+          encodeTarEntry({
+            path: `${TEST_ARCHIVE_ROOT}/manifest.json`,
+            contents: `${JSON.stringify(createBackupManifest(payloadArchivePath), null, 2)}\n`,
+          }),
+          encodeTarEntry({ path: payloadArchivePath, contents: "payload\n" }),
+          encodeTarEntry({
+            path: hardlinkArchivePath,
+            type: "Link",
+            linkpath: missingTargetPath,
+          }),
+          Buffer.alloc(1024),
+        ]),
+      );
+      await fs.writeFile(archivePath, archive);
+
+      const runtime = createBackupVerifyRuntime();
+      await expect(backupVerifyCommand(runtime, { archive: archivePath })).rejects.toThrow(
+        /hardlink target is missing from archive entries/i,
+      );
+    } finally {
+      await fs.rm(tempDir, { recursive: true, force: true });
+    }
+  });
+
   it("ignores payload manifest.json files when locating the backup manifest", async () => {
     const archiveDir = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-backup-verify-out-"));
     try {
diff --git a/src/commands/backup-verify.ts b/src/commands/backup-verify.ts
@@ -262,6 +262,7 @@ function verifyManifestAgainstEntries(manifest: BackupManifest, entries: Set<str
 function verifyHardlinkTargetsAgainstArchiveRoot(
   hardlinkTargets: Array<{ entryPath: string; normalized: string }>,
   archiveRoot: string,
+  entries: Set<string>,
 ): void {
   const normalizedRoot = normalizeArchiveRoot(archiveRoot);
   for (const target of hardlinkTargets) {
@@ -270,6 +271,11 @@ function verifyHardlinkTargetsAgainstArchiveRoot(
         `Archive hardlink target is outside the declared archive root: ${target.entryPath} -> ${target.normalized}`,
       );
     }
+    if (!entries.has(target.normalized)) {
+      throw new Error(
+        `Archive hardlink target is missing from archive entries: ${target.entryPath} -> ${target.normalized}`,
+      );
+    }
   }
 }
 
@@ -338,7 +344,11 @@ export async function backupVerifyCommand(
   const manifestRaw = await extractManifest({ archivePath, manifestEntryPath });
   const manifest = parseManifest(manifestRaw);
   verifyManifestAgainstEntries(manifest, normalizedEntrySet);
-  verifyHardlinkTargetsAgainstArchiveRoot(hardlinkTargets, manifest.archiveRoot);
+  verifyHardlinkTargetsAgainstArchiveRoot(
+    hardlinkTargets,
+    manifest.archiveRoot,
+    normalizedEntrySet,
+  );
 
   const result: BackupVerifyResult = {
     ok: true,
