fix(cli): reject linked runtime configs

src/cli.ts

@@ -6,8 +6,8 @@ import { resolveInstallSecrets } from './cli-secrets.js';
 import { derivePublicKey } from './crypto.js';
 import {
   ensurePrivateDirectory,
-  isMissingPath,
   requirePhysicalDirectory,
+  requirePhysicalFile,
   resolvePrivateChildDirectory,
 } from './runtime-paths.js';
 import { writePrivateFile } from './secure-files.js';
@@ -74,11 +74,11 @@ async function readInstalledAgent(agentId: string): Promise<InstalledAgent | und
   if (!(await requirePhysicalDirectory(agentDirectory))) return undefined;
 
   const configPath = path.join(agentDirectory, 'config.json');
+  if (!(await requirePhysicalFile(configPath))) return undefined;
   let raw: string;
   try {
     raw = await fsp.readFile(configPath, 'utf-8');
   } catch (error) {
-    if (isMissingPath(error)) return undefined;
     throw new Error(`Could not read agent config: ${configPath}`, { cause: error });
   }
 

src/runtime-paths.ts

@@ -30,6 +30,20 @@ export async function requirePhysicalDirectory(directory: string): Promise<boole
   return true;
 }
 
+export async function requirePhysicalFile(filePath: string): Promise<boolean> {
+  let metadata;
+  try {
+    metadata = await fsp.lstat(filePath);
+  } catch (error) {
+    if (isMissingPath(error)) return false;
+    throw new Error(`Could not inspect agent runtime file: ${filePath}`, { cause: error });
+  }
+  if (!metadata.isFile() || metadata.isSymbolicLink()) {
+    throw new Error(`Agent runtime config is not a physical file: ${filePath}`);
+  }
+  return true;
+}
+
 export function resolvePrivateChildDirectory(root: string, childName: string): string {
   const isWindowsDeviceName = /^(?:con|prn|aux|nul|com[1-9¹²³]|lpt[1-9¹²³])(?:\.|$)/i.test(childName);
   if (