[BillyOutlast]

Summary

Hardening follow-ups from the fork audit, split into logical commits.

1. Archive extraction symlink policy

• path_guard::remove_escaping_symlinks sweeps a directory for symlinks whose resolved target escapes the install root (canonicalize for existing targets, lexical fallback for dangling links, no traversal of linked dirs).
• pipeline::sweep_extraction_symlinks runs after extract_rar, extract_iso, extract_archive and innoextract: escaping links are unlinked and the step fails with an actionable error; links resolving inside the install dir (legit Linux releases) are kept.
• Policy documented in docs/implementation/archive-symlink-policy.md.
• Tests: 5 new path_guard tests + 3 pipeline tests.

2. cargo-deny breadth

• security.yml cargo-deny job now uses the same 7-crate matrix as cargo-audit (cli, torrential, desktop/src-tauri, libraries/{droplet,droplet_types,libarchive,native_model}), discovering the root deny.toml; lockfiles are generated for the vendored crates like cargo-audit already does.
• All workspace manifests now declare AGPL-3.0-only (12 crates were missing a license field).
• deny.toml: unmaintained = "workspace" (transitive Tauri/GTK unmaintained stack stays a weekly cargo-audit signal) + scoped RUSTSEC-2025-0141 ignore for bincode, a direct dep of the vendored native_model.
• Refreshed yanked chacha20 0.10.1 -> 0.10.2 in desktop/src-tauri/Cargo.lock.
• Triage documented in docs/implementation/rust-supply-chain-policy.md.

3. Upstream docs correction

• upstream-pr1/2 docs and roadmap-status.md now point at the real open PRs #497 (upstream-pr/platform-stability) and #498 (upstream-pr/generic-plugin-spi); stale duplicate upstream/pr{1,2}-* branches (commit 536e63ac) are noted only, not deleted.

4. TODO triage (real fixes)

• Session: expired sessions now clear the cookie with the same attributes used to set it (session/index.ts), via isEvent so headers-only callers are unaffected.
• Objects: writeWithPermissions refuses to overwrite unless the caller passes allowOverwrite; the POST /api/v1/object/[id] update endpoint opts in explicitly. FsObjectBackend::write truncates before writing so shorter payloads can't leave stale trailing bytes. New unit tests for the overwrite policy.
• Update check: ETag/If-None-Match caching, optional GITHUB_TOKEN, and 403/429 rate-limit responses log the reset time and return instead of failing the task.
• cloud_saves resolver: unreadable/undiscoverable save paths are skipped with a warning instead of panicking on unwrap.
• i18n: dropped leftover (TODO) markers from user.recent (en_us/de).

5. Input backend honesty

• supported_backends() now reports only NullBackend; Uinput/ViGEm stay in the enum as documented, not-yet-implemented API surface (no InputBackend impl exists).

6. Docs honesty

• Removed the non-existent OverlaySlot SPI claim; the overlay slot names are registered in ClientPluginManager but nothing mounts them.
• ROADMAP HTTP/QUIC line now marks QUIC deferred/optional (contract-only ChunkFetcher).

Verification

• pnpm --filter drop run test -> 13/13 files (incl. new objectHandler tests)
• pnpm --filter drop run typecheck -> clean
• pnpm --filter drop run lint -> clean (0 errors; pre-existing warnings unchanged)
• cargo +nightly test --manifest-path desktop/src-tauri/Cargo.toml -p cloud_saves -p input -> 14 + 6 passed
• path_guard tests run standalone (8/8) because cargo test -p process cannot link GTK/WebKit on this box; cargo +nightly check --manifest-path desktop/src-tauri/Cargo.toml --tests -p process compiles clean
• cargo deny check -> ok (advisories/bans/licenses/sources) for all 7 crates
• rustfmt --check clean on touched Rust files

Deliberately left out

• Overwrite remains available on the documented object:update endpoint (explicit opt-in) — the audit asked to preserve intended update behavior; all other paths are create-only.
• The transitive unmaintained advisories (async-std, instant, proc-macro-error, unic-*) stay report-only via weekly cargo-audit until upstream crates migrate.
• cargo test -p process local link failure is an environment limitation documented in AGENTS.md, not a code issue.
• Remote stale branches were documented, not deleted.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud