[bug-fix] Harden persisted workflow run artifact access against symlinks

src/specify_cli/workflows/command_status.py

@@ -100,7 +100,12 @@ def workflow_status(
                     f"{cli._escape_markup(scope['workflow_id'])}: {scope['status']}"
                 )
     else:
-        runs = engine.list_runs()
+        err = cli._error_console(json_output)
+        try:
+            runs = engine.list_runs()
+        except (OSError, ValueError) as exc:
+            err.print(f"[red]Error:[/red] {cli._escape_markup(str(exc))}")
+            raise cli.typer.Exit(1)
 
         if json_output:
             payload = {

tests/specify_cli/workflows/test_command_status.py

@@ -3,13 +3,13 @@
 from __future__ import annotations
 
 import json
+import os
 from pathlib import Path
 
 import pytest
 import typer
 
 
-
 class TestWorkflowJsonOutput:
     """Test the --json machine-readable output for run/resume/status."""
 
@@ -95,6 +95,41 @@ def test_status_json_single_and_list(self, project_dir):
         )
         assert any(r["run_id"] == rid for r in listing["runs"])
 
+    @pytest.mark.skipif(not hasattr(os, "symlink"), reason="symlinks are unavailable")
+    @pytest.mark.parametrize(
+        "symlink_target", ["run-directory", "state.json", "dangling-runs-root"]
+    )
+    def test_status_json_list_rejects_symlinked_storage(
+        self, project_dir, tmp_path, symlink_target
+    ):
+        runs_dir = project_dir / ".specify" / "workflows" / "runs"
+        runs_dir.mkdir(parents=True)
+        outside = tmp_path / "outside"
+        outside.mkdir()
+        (outside / "state.json").write_text(
+            json.dumps({
+                "run_id": "run-1",
+                "workflow_id": "workflow",
+                "status": "paused",
+            }),
+            encoding="utf-8",
+        )
+        if symlink_target == "run-directory":
+            (runs_dir / "run-1").symlink_to(outside, target_is_directory=True)
+        elif symlink_target == "state.json":
+            run_dir = runs_dir / "run-1"
+            run_dir.mkdir()
+            (run_dir / "state.json").symlink_to(outside / "state.json")
+        else:
+            runs_dir.rmdir()
+            runs_dir.symlink_to(tmp_path / "missing", target_is_directory=True)
+
+        result = self._invoke(project_dir, ["workflow", "status", "--json"])
+
+        assert result.exit_code == 1
+        assert result.stdout == ""
+        assert "symlinked" in result.stderr
+
     def test_composed_gate_status_and_resume(self, project_dir):
         from specify_cli.workflows.catalog import WorkflowRegistry