fix(parser): propagate symlink resolution failures in remaining streaming discoverers

Claude, OpenClaw/QClaw, OpenCode storage, Grok, and Vibe streaming
discovery silently treated a followed directory symlink as absent when
statting its target failed (dangling link, unreadable parent).
Reconciliation treats a clean DiscoverEach as authoritative, so a
temporarily broken symlink could tombstone every session beneath it.

Route all five discoverers through a shared
streamingDirCandidateOrIncomplete helper that surfaces the failure as
DiscoveryIncompleteError, and convert the Gemini site from cd41db0 to
the same helper. Claude's project walk records the failure and
continues with healthy siblings, matching its existing accumulator;
the abort-style walkers (claw, opencode storage, grok, vibe) fail the
scope like their other discovery errors. Name filters now run before
the symlink stat so dangling links that cannot name a session are
still skipped silently.

This completes the isDirOrSymlink sweep for authoritative streaming
discovery; the remaining call sites are legacy Discover enumeration,
find-source lookups, changed-path mapping, and watch-root helpers,
none of which gate reconciliation tombstoning.

Author: wesm

internal/parser/claude_provider.go

@@ -276,7 +276,14 @@ func (s claudeSourceSet) streamLocalRoot(
 ) error {
 	var incomplete error
 	err := streamDirectoryEntries(ctx, root, func(project os.DirEntry) error {
-		if !isDirOrSymlink(project, root) {
+		isProjectDir, dirErr := streamingDirCandidateOrIncomplete(
+			AgentClaude, "Claude project directory", project, root,
+		)
+		if dirErr != nil {
+			incomplete = errors.Join(incomplete, dirErr)
+			return nil
+		}
+		if !isProjectDir {
 			return nil
 		}
 		projectRoot := filepath.Join(root, project.Name())

internal/parser/claude_provider_test.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
+	"runtime"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -175,6 +176,89 @@ func TestClaudeProviderDiscoversSymlinkedProjectDirectory(t *testing.T) {
 	assert.Equal(t, subagentPath, found.DisplayPath)
 }
 
+// A followed project-directory symlink whose target cannot be resolved must
+// surface incomplete streaming discovery rather than reading as absent:
+// reconciliation treats a clean DiscoverEach as authoritative and would
+// tombstone every session beneath the symlink.
+func TestClaudeProviderStreamingDiscoveryPropagatesProjectSymlinkErrors(t *testing.T) {
+	discoverEach := func(t *testing.T, root string) ([]string, error) {
+		t.Helper()
+		provider, ok := NewProvider(AgentClaude, ProviderConfig{
+			Roots: []string{root},
+		})
+		require.True(t, ok)
+		discoverer, ok := provider.(StreamingDiscoverer)
+		require.True(t, ok)
+		var yielded []string
+		err := discoverer.DiscoverEach(t.Context(), func(source SourceRef) error {
+			yielded = append(yielded, source.DisplayPath)
+			return nil
+		})
+		return yielded, err
+	}
+	healthyPath := func(root string) string {
+		return filepath.Join(root, "-Users-dev-code-demo", "session-main.jsonl")
+	}
+
+	t.Run("dangling project symlink", func(t *testing.T) {
+		root := t.TempDir()
+		writeSourceFile(t, healthyPath(root), claudeProviderFixture("hello claude"))
+		target := filepath.Join(t.TempDir(), "linked-project")
+		require.NoError(t, os.MkdirAll(target, 0o755))
+		link := filepath.Join(root, "linked")
+		if err := os.Symlink(target, link); err != nil {
+			t.Skipf("symlink not supported: %v", err)
+		}
+		require.NoError(t, os.RemoveAll(target))
+
+		yielded, err := discoverEach(t, root)
+
+		require.Error(t, err)
+		assert.ErrorIs(t, err, os.ErrNotExist)
+		var incomplete DiscoveryIncompleteError
+		assert.ErrorAs(t, err, &incomplete)
+		// The walker records the failure and continues with healthy siblings.
+		assert.Equal(t, []string{healthyPath(root)}, yielded)
+
+		require.NoError(t, os.Remove(link))
+		yielded, err = discoverEach(t, root)
+		require.NoError(t, err)
+		assert.Equal(t, []string{healthyPath(root)}, yielded)
+	})
+
+	t.Run("unstatable project symlink target", func(t *testing.T) {
+		if runtime.GOOS == "windows" {
+			t.Skip("directory read permissions are not enforced on Windows")
+		}
+		if os.Geteuid() == 0 {
+			t.Skip("root bypasses directory permissions")
+		}
+		root := t.TempDir()
+		writeSourceFile(t, healthyPath(root), claudeProviderFixture("hello claude"))
+		targetParent := t.TempDir()
+		target := filepath.Join(targetParent, "linked-project")
+		require.NoError(t, os.MkdirAll(target, 0o755))
+		if err := os.Symlink(target, filepath.Join(root, "linked")); err != nil {
+			t.Skipf("symlink not supported: %v", err)
+		}
+		require.NoError(t, os.Chmod(targetParent, 0o000))
+		t.Cleanup(func() { _ = os.Chmod(targetParent, 0o755) })
+
+		yielded, err := discoverEach(t, root)
+
+		require.Error(t, err)
+		assert.ErrorIs(t, err, os.ErrPermission)
+		var incomplete DiscoveryIncompleteError
+		assert.ErrorAs(t, err, &incomplete)
+		assert.Equal(t, []string{healthyPath(root)}, yielded)
+
+		require.NoError(t, os.Chmod(targetParent, 0o755))
+		yielded, err = discoverEach(t, root)
+		require.NoError(t, err)
+		assert.Equal(t, []string{healthyPath(root)}, yielded)
+	})
+}
+
 func TestClaudeProviderStreamingDiscoveryStopsAfterYieldError(t *testing.T) {
 	root := t.TempDir()
 	for _, project := range []string{"-Users-dev-code-one", "-Users-dev-code-two"} {

internal/parser/claw_provider.go

@@ -247,7 +247,16 @@ func (s clawSourceSet) DiscoverEach(ctx context.Context, yield func(SourceRef) e
 			return err
 		}
 		err := streamDirectoryEntries(ctx, root, func(agent os.DirEntry) error {
-			if !isDirOrSymlink(agent, root) || !IsValidSessionID(agent.Name()) {
+			if !IsValidSessionID(agent.Name()) {
+				return nil
+			}
+			isAgentDir, dirErr := streamingDirCandidateOrIncomplete(
+				s.spec.agent, "agent directory", agent, root,
+			)
+			if dirErr != nil {
+				return dirErr
+			}
+			if !isAgentDir {
 				return nil
 			}
 			dir := filepath.Join(root, agent.Name(), "sessions")

internal/parser/claw_provider_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"os"
 	"path/filepath"
+	"runtime"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -30,6 +31,102 @@ func TestQClawProviderDiscoversSymlinkedAgentDirectory(t *testing.T) {
 	assertClawProviderDiscoversSymlinkedAgentDirectory(t, spec)
 }
 
+func TestOpenClawProviderStreamingDiscoveryPropagatesAgentSymlinkErrors(t *testing.T) {
+	spec := openClawProviderTestSpec()
+	assertClawProviderStreamingDiscoveryPropagatesAgentSymlinkErrors(t, spec)
+}
+
+func TestQClawProviderStreamingDiscoveryPropagatesAgentSymlinkErrors(t *testing.T) {
+	spec := qClawProviderTestSpec()
+	assertClawProviderStreamingDiscoveryPropagatesAgentSymlinkErrors(t, spec)
+}
+
+// A followed agent-directory symlink whose target cannot be resolved must
+// surface incomplete streaming discovery rather than reading as absent:
+// reconciliation treats a clean DiscoverEach as authoritative and would
+// tombstone every session beneath the symlink.
+func assertClawProviderStreamingDiscoveryPropagatesAgentSymlinkErrors(
+	t *testing.T, spec clawProviderTestSpec,
+) {
+	t.Helper()
+	discoverEach := func(t *testing.T, root string) ([]string, error) {
+		t.Helper()
+		provider, ok := NewProvider(spec.agent, ProviderConfig{
+			Roots: []string{root},
+		})
+		require.True(t, ok)
+		discoverer, ok := provider.(StreamingDiscoverer)
+		require.True(t, ok)
+		var yielded []string
+		err := discoverer.DiscoverEach(t.Context(), func(source SourceRef) error {
+			yielded = append(yielded, source.DisplayPath)
+			return nil
+		})
+		return yielded, err
+	}
+	writeHealthySession := func(t *testing.T, root string) string {
+		t.Helper()
+		path := filepath.Join(root, "main", "sessions", "abc-123.jsonl")
+		writeSourceFile(t, path, spec.fixture("abc-123", "healthy question"))
+		return path
+	}
+
+	t.Run("dangling agent symlink", func(t *testing.T) {
+		root := t.TempDir()
+		healthy := writeHealthySession(t, root)
+		target := filepath.Join(t.TempDir(), "linked-agent")
+		require.NoError(t, os.MkdirAll(target, 0o755))
+		link := filepath.Join(root, "linked")
+		if err := os.Symlink(target, link); err != nil {
+			t.Skipf("symlink not supported: %v", err)
+		}
+		require.NoError(t, os.RemoveAll(target))
+
+		_, err := discoverEach(t, root)
+
+		require.Error(t, err)
+		assert.ErrorIs(t, err, os.ErrNotExist)
+		var incomplete DiscoveryIncompleteError
+		assert.ErrorAs(t, err, &incomplete)
+
+		require.NoError(t, os.Remove(link))
+		yielded, err := discoverEach(t, root)
+		require.NoError(t, err)
+		assert.Equal(t, []string{healthy}, yielded)
+	})
+
+	t.Run("unstatable agent symlink target", func(t *testing.T) {
+		if runtime.GOOS == "windows" {
+			t.Skip("directory read permissions are not enforced on Windows")
+		}
+		if os.Geteuid() == 0 {
+			t.Skip("root bypasses directory permissions")
+		}
+		root := t.TempDir()
+		healthy := writeHealthySession(t, root)
+		targetParent := t.TempDir()
+		target := filepath.Join(targetParent, "linked-agent")
+		require.NoError(t, os.MkdirAll(target, 0o755))
+		if err := os.Symlink(target, filepath.Join(root, "linked")); err != nil {
+			t.Skipf("symlink not supported: %v", err)
+		}
+		require.NoError(t, os.Chmod(targetParent, 0o000))
+		t.Cleanup(func() { _ = os.Chmod(targetParent, 0o755) })
+
+		_, err := discoverEach(t, root)
+
+		require.Error(t, err)
+		assert.ErrorIs(t, err, os.ErrPermission)
+		var incomplete DiscoveryIncompleteError
+		assert.ErrorAs(t, err, &incomplete)
+
+		require.NoError(t, os.Chmod(targetParent, 0o755))
+		yielded, err := discoverEach(t, root)
+		require.NoError(t, err)
+		assert.Equal(t, []string{healthy}, yielded)
+	})
+}
+
 func TestOpenClawProviderParse(t *testing.T) {
 	spec := openClawProviderTestSpec()
 	assertClawProviderParse(t, spec)

internal/parser/gemini_provider.go

@@ -161,19 +161,11 @@ func (s geminiSourceSet) DiscoverEach(ctx context.Context, yield func(SourceRef)
 		}
 		tmpDir := filepath.Join(root, "tmp")
 		err = streamDirectoryEntries(ctx, tmpDir, func(projectDir os.DirEntry) error {
-			isProjectDir, dirErr := streamingDirOrSymlinkCandidate(projectDir, tmpDir)
+			isProjectDir, dirErr := streamingDirCandidateOrIncomplete(
+				AgentGemini, "Gemini project directory", projectDir, tmpDir,
+			)
 			if dirErr != nil {
-				// A followed symlink whose target cannot be resolved
-				// (dangling link, unreadable parent) must not read as an
-				// absent project: reconciliation treats a clean streaming
-				// discovery as authoritative and would tombstone every
-				// session beneath the symlink.
-				return incompleteDiscoveryError(
-					AgentGemini,
-					"resolve Gemini project directory "+
-						filepath.Join(tmpDir, projectDir.Name()),
-					dirErr,
-				)
+				return dirErr
 			}
 			if !isProjectDir {
 				return nil

internal/parser/grok_provider.go

@@ -33,12 +33,27 @@ func grokDiscoverEach(
 	ctx context.Context, root string, yield func(singleFileMatch) error,
 ) error {
 	return streamDirectoryEntries(ctx, root, func(cwd os.DirEntry) error {
-		if !isDirOrSymlink(cwd, root) {
+		isCwdDir, dirErr := streamingDirCandidateOrIncomplete(
+			AgentGrok, "Grok cwd directory", cwd, root,
+		)
+		if dirErr != nil {
+			return dirErr
+		}
+		if !isCwdDir {
 			return nil
 		}
 		cwdRoot := filepath.Join(root, cwd.Name())
 		return streamDirectoryEntries(ctx, cwdRoot, func(session os.DirEntry) error {
-			if !isDirOrSymlink(session, cwdRoot) || !IsValidSessionID(session.Name()) {
+			if !IsValidSessionID(session.Name()) {
+				return nil
+			}
+			isSessionDir, sessionErr := streamingDirCandidateOrIncomplete(
+				AgentGrok, "Grok session directory", session, cwdRoot,
+			)
+			if sessionErr != nil {
+				return sessionErr
+			}
+			if !isSessionDir {
 				return nil
 			}
 			if match, ok := grokStrictMatch(