[tsarlandie-oai]

Stacked on #1409. The base is DaleSeo/skills-fs.

Motivation

The catalog walks a skill directory and reads file contents later. If a regular file or one of its parent directories is replaced with a symlink between those steps, the read can publish a hidden or sibling file under the original skill URI. Both paths can be inside the configured catalog root.

Changes

• Enumerate each directory through its open handle. Open child directories relative to their parent with symlink following disabled.
• For each file read, reopen each path component relative to the preceding directory handle with symlink following disabled. Verify the opened file is regular before reading it under the existing byte budget. A failed reload keeps serving the previous snapshot.
• Use the cap-fs-ext companion to cap-std under the optional skills-fs feature.

Validation

• The regression test walks real files, installs replacement symlinks, and verifies that both a leaf swap and an ancestor swap fail before any replacement bytes are cached. It reproduced the issue on feat: load skills from a directory tree #1409 at 58f424a.
• cargo test -p rmcp --features skills-fs,client --lib --test test_skill_catalog passed all 298 library tests and 30 catalog integration tests on Linux. All 14 test_skills protocol tests also passed.
• A separate Linux check replaced a walked file with a FIFO. The read returned an error immediately with no writer attached.
• cargo clippy -p rmcp --no-default-features --features skills-fs --lib -- -D warnings, cargo +nightly fmt --all -- --check, and the repository spelling check passed.
• cargo check --target x86_64-pc-windows-gnu passed for the skills-fs library. The repository’s full CI workflow runs on PRs targeting main or release.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-07T06:07:34.323450Z	abf030a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

@jamadeo is on triage rotation this week and is the reviewer for this one.

Labels come from the PR labeler. Please review the change.

_{Automated triage. Labels are a first pass and the assigned maintainer has the final say.}