What
Validation now refuses to follow symlinks and reports what it skipped, so a passing validation no longer implies the real target was checked. Install behaviour is unchanged and still dereferences them.
Details
- A local marketplace source that is a symlink, or reached through one, produces a warning saying install still dereferences it and that the real path should be validated separately.
- Files that are symlinks, are not regular files, or exceed a size cap are reported as unvalidated rather than passing.
- A path component that exists but is not a directory now yields an ENOTDIR error; the shared checker classifies each component as ok, absent, not-a-directory or refused.
- Skill, agent and command discovery now count the symlinked entries they skipped.
Evidence
validation never follows one. Install dereferences symlinks that stay inside the marketplace, so this entry still loads. Validate the real path separately.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.