[devin-ai-integration]

Fixes OR-617.

Summary

• prepare_snapshot_dir in src/compute.rs checked ownership with std::fs::symlink_metadata. That call describes the link itself, which is never a directory, so a user-owned symlink to a user-owned directory always failed with "Source snapshot directory … is not owned by the current user." As a result, orx exp run --backend ssh (and every other snapshot-based launch) could not start.
• It now uses std::fs::metadata, so the directory and ownership check runs on the resolved target. The uid check and 0700 permissions are unchanged. The same helper also guards submission-handles, so that root gets the same fix.
• Cleanup had the same problem (found in review). Store::validate_run_artifact_roots refused experiment/project deletion and orphan cleanup when the root was a symlink. It now follows links only for source-snapshots and submission-handles, the two roots prepare_snapshot_dir accepts. Every other run-artifact root (for example local-runs) still refuses links.
• New tests: snapshot_dir_accepts_a_user_owned_symlinked_directory and artifact_cleanup_follows_symlinked_snapshot_roots_only. Both fail against the old lines and pass here.

No linked contributor PR existed for this issue.

Test plan

• cargo fmt --check, cargo clippy --all-targets --locked -- -D warnings
• cargo test --locked -- store:: snapshot_dir (109 passed)
• Reproduced on main: with source-snapshots symlinked, orx exp run --backend ssh --host lab fails with the ownership error
• Post-fix on d2f0a177: live Claude Code dashboard chat replied CLAUDE_OK, SSH host lab was Ready, the same launch ran to done and printed hello from ssh run with the snapshot tar written into the link target, and orx exp delete exited 0 and removed the tar

Bug reproduction on main:

Post-fix functionality on this branch:

Automation improvements

• The Codex preflight failed with token_expired. Refresh the CODEX_AUTH_JSON repository secret so the Codex subscription check can pass.

Link to Devin session: https://app.devin.ai/sessions/aa62a8a8cc0b4411a59c5dd608719611
Open in Devin Desktop: https://app.devin.ai/desktop/session/aa62a8a8cc0b4411a59c5dd608719611?variant=devin

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; launch and cleanup now accept the same linked roots.

Summary

The PR lets snapshot-based launches and cleanup use linked directories.

• Snapshot and recovery folders can use links to user-owned directories.
• Cleanup follows links only for snapshot and recovery folders.

_{Reviews (2) · Last reviewed commit: "Allow artifact cleanup through symlinked..." · Reviewed by Greptile}

[greptile-apps]

Deletion still rejects directory links

Accepting a symlinked source-snapshots directory fixes launch, but cleanup still rejects that newly supported setup. Store::validate_run_artifact_roots uses symlink_metadata and returns “Refusing artifact cleanup through …” for the same directory. After a run finishes, users cannot delete its experiment or project, and orphan cleanup also fails.

Update the cleanup checks to safely accept the same owned directory targets, and add a test that covers launch through deletion.

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/compute.rs
Line: 157

Comment:
**Deletion still rejects directory links**

Accepting a symlinked `source-snapshots` directory fixes launch, but cleanup still rejects that newly supported setup. `Store::validate_run_artifact_roots` uses `symlink_metadata` and returns “Refusing artifact cleanup through …” for the same directory. After a run finishes, users cannot delete its experiment or project, and orphan cleanup also fails.

Update the cleanup checks to safely accept the same owned directory targets, and add a test that covers launch through deletion.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[devin-ai-integration]

Valid. Fixed in d2f0a17: validate_run_artifact_roots now follows links for source-snapshots and submission-handles (the two roots prepare_snapshot_dir accepts), while other roots such as local-runs still refuse links. Added artifact_cleanup_follows_symlinked_snapshot_roots_only.

[devin-ai-integration]

@greptileai review