From 2cf0df11232e92e158ec53fdd79e2f13b3e6d9cf Mon Sep 17 00:00:00 2001
From: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Date: Tue, 3 Nov 2026 14:05:08 -0800
Subject: [PATCH] fix(audit): count a .map link beside a selected file as a
 skipped companion

The sibling scan skipped any .map entry that was not a regular file, so a
symlink such as symbols.map -> payload beside a selected executable left
debug companion coverage at not observed. The reader never follows links,
so the linker map such a link may name is unread, not absent. Count a
generic .map sibling link as a skipped companion without following it,
as noteUnfollowedMapLink already does inside a selected directory.
---
 src/artifacts/ReleaseExposureReader.test.ts | 14 ++++++++++++++
 src/artifacts/ReleaseExposureReader.ts      |  8 +++++++-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/src/artifacts/ReleaseExposureReader.test.ts b/src/artifacts/ReleaseExposureReader.test.ts
index 35996f622f..9e2cf52f1a 100644
--- a/src/artifacts/ReleaseExposureReader.test.ts
+++ b/src/artifacts/ReleaseExposureReader.test.ts
@@ -1071,6 +1071,20 @@ describe("ReleaseExposureReader generic map links", () => {
     },
   );
 
+  it.skipIf(process.platform === "win32")(
+    "keeps debug companion coverage unresolved for a .map link beside a selected file",
+    async () => {
+      const root = await createTestTempDirectory("rea-release-sibling-link-");
+      await writeFile(join(root, "app"), "plain file");
+      await writeFile(join(root, "payload"), "not a map\n");
+      await symlink("payload", join(root, "symbols.map"));
+      await symlink("payload", join(root, "app.js.map"));
+      const scanned = await inspect(join(root, "app"));
+      expect(scanned.debug_companions).toEqual({ paths: [], skipped: 1 });
+      expect(debugCompanionsStatus(scanned)).toBe("unknown");
+    },
+  );
+
   it.skipIf(process.platform === "win32")(
     "leaves debug companions alone for a JavaScript map link",
     async () => {
diff --git a/src/artifacts/ReleaseExposureReader.ts b/src/artifacts/ReleaseExposureReader.ts
index 7b0b363802..fa9b0276b7 100644
--- a/src/artifacts/ReleaseExposureReader.ts
+++ b/src/artifacts/ReleaseExposureReader.ts
@@ -2561,8 +2561,14 @@ const scanSiblings = async (
       state.companionPaths.add(sibling);
       continue;
     }
-    if (!entry.name.toLowerCase().endsWith(".map") || !entry.isFile()) continue;
+    if (!entry.name.toLowerCase().endsWith(".map")) continue;
     if (isJavaScriptSourceMapName(entry.name)) continue;
+    // A link is not followed, so a linker map it names stays unread, not absent.
+    if (entry.isSymbolicLink()) {
+      state.skippedCompanions += 1;
+      continue;
+    }
+    if (!entry.isFile()) continue;
     await classifySiblingMap(sibling, state, input);
   }
 };