[Resizetizer] Confine stale detection to the intermediate folder

Review of the previous two commits turned up three real problems. All three
are reproducible, and each fix is pinned by a mutation of the code it guards.

Deletes could escape the intermediate folder. A recursive MSBuild wildcard
walks through a directory link, so `$(_MauiIntermediateImages)\**\*` can name
a file that only appears to live inside obj. <Delete> then follows the link
and removes the real file rather than the link. Verified directly: a glob over
a folder containing a link to an outside directory deleted the outside file.
Returning the original item spec was not enough, because the spec itself
already pointed through the link. DetectStaleOutputFilesTask now takes the
intended Root and never reports anything whose resolved directory falls
outside it. Deleting the previous claim's guard fails 3 tests, one of which
drives the real target end to end.

A stale alias of a live output survived cleanup forever. Canonicalizing the
whole path meant a leftover link named orphan.png pointing at the current
camera.png compared equal to it and was kept, and on Android the whole
intermediate tree is exposed through LibraryResourceDirectories, so a removed
resource stayed visible. Only the directory part of a path is link resolved
now; the file name is kept verbatim. Canonicalizing the leaf again fails 3
tests.

The resolution cache could answer for the wrong directory. It was keyed with
the platform comparer, so on a case sensitive volume two directories whose
names differ only by case shared an entry and one could be handed the other's
resolved target. Cache keys are exact spellings now, and the case insensitive
comparer is used only for the final comparison.

Also adds IsUnder, which rejects a sibling whose name merely starts with the
root's name, and treats an unresolvable Root as "detect nothing" rather than
"delete everything".

All 15 end-to-end scenarios still fail against the previous targets and pass
with these. Full Resizetizer suite: 738 passed.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: Redth

src/SingleProject/Resizetizer/src/DetectStaleOutputFilesTask.cs

@@ -11,12 +11,20 @@ namespace Microsoft.Maui.Resizetizer
 	/// build can delete files left over from a previous build without ever deleting a file it just wrote.
 	/// </summary>
 	/// <remarks>
+	/// <para>
 	/// The two item lists reach this task through different code paths: <see cref="Files"/> comes from an
 	/// MSBuild wildcard rooted at the project directory, while <see cref="KnownOutputs"/> comes back from
 	/// a task that resolved the same directory itself. A plain <c>Remove</c> compares those item specs
 	/// textually, so a symbolic link or junction anywhere in the project path is enough to make every
 	/// generated file look stale. Comparing canonical paths makes the difference independent of spelling
 	/// while the returned items keep their original item spec and metadata.
+	/// </para>
+	/// <para>
+	/// A recursive MSBuild wildcard descends through directory links, so it can name a file that lives
+	/// outside <see cref="Root"/>, and <c>&lt;Delete&gt;</c> would then remove that outside file rather
+	/// than the link. Anything whose resolved directory escapes <see cref="Root"/> is therefore never
+	/// reported as stale.
+	/// </para>
 	/// </remarks>
 	public class DetectStaleOutputFilesTask : Task
 	{
@@ -26,6 +34,10 @@ public class DetectStaleOutputFilesTask : Task
 		/// <summary>The files the build expects to be there.</summary>
 		public ITaskItem[] KnownOutputs { get; set; }
 
+		/// <summary>The only directory whose contents this task is allowed to report as stale.</summary>
+		[Required]
+		public string Root { get; set; }
+
 		/// <summary>The members of <see cref="Files"/> that are safe to delete.</summary>
 		[Output]
 		public ITaskItem[] StaleFiles { get; set; }
@@ -38,23 +50,42 @@ public override bool Execute()
 				return true;
 
 			var canonicalizer = new PathCanonicalizer();
-			var keep = canonicalizer.CreateSet(KnownOutputs?.Select(i => i.ItemSpec) ?? Enumerable.Empty<string>());
+
+			var root = canonicalizer.CanonicalizeDirectory(Root);
+			if (string.IsNullOrEmpty(root))
+			{
+				Log.LogMessage(MessageImportance.Low, $"Skipping stale file detection because the root '{Root}' could not be resolved.");
+				return true;
+			}
+
+			var keep = new HashSet<string>(PathCanonicalizer.Comparer);
+			foreach (var known in KnownOutputs ?? Enumerable.Empty<ITaskItem>())
+			{
+				var key = canonicalizer.GetComparisonKey(known?.ItemSpec);
+				if (key is not null)
+					keep.Add(key);
+			}
 
 			var stale = new List<ITaskItem>();
 
 			foreach (var file in Files)
 			{
-				if (file is null || string.IsNullOrWhiteSpace(file.ItemSpec))
+				var key = canonicalizer.GetComparisonKey(file?.ItemSpec);
+				if (key is null)
 					continue;
 
-				if (keep.Contains(canonicalizer.Canonicalize(file.ItemSpec)))
+				if (!PathCanonicalizer.IsUnder(key, root))
+				{
+					Log.LogMessage(MessageImportance.Low, $"Leaving '{file.ItemSpec}' alone because it resolves to '{key}', which is outside '{root}'.");
 					continue;
+				}
 
-				stale.Add(file);
-			}
+				if (keep.Contains(key))
+					continue;
 
-			foreach (var file in stale)
 				Log.LogMessage(MessageImportance.Low, $"Detected stale output file '{file.ItemSpec}'.");
+				stale.Add(file);
+			}
 
 			StaleFiles = stale.ToArray();
 

src/SingleProject/Resizetizer/src/PathCanonicalizer.cs

@@ -7,8 +7,8 @@
 namespace Microsoft.Maui.Resizetizer
 {
 	/// <summary>
-	/// Produces a canonical spelling of a file system path so that two differently spelled paths
-	/// which point at the same file compare as equal.
+	/// Produces a canonical spelling of a file system path so that two differently spelled paths which
+	/// point at the same file compare as equal.
 	/// </summary>
 	/// <remarks>
 	/// <para>
@@ -20,13 +20,18 @@ namespace Microsoft.Maui.Resizetizer
 	/// MSBuild items and task outputs wrongly reports freshly written files as stale.
 	/// </para>
 	/// <para>
-	/// The canonical form is only ever used for comparison. Callers keep the original item spec so the
-	/// paths surfaced to the rest of the build stay in the spelling the user provided.
+	/// Only the <em>directory</em> part of a path is link resolved. The file name is kept verbatim, so two
+	/// different names in one directory never collapse into one even when one of them is a link to the
+	/// other. Resolving the leaf as well would let a stale alias masquerade as a live output and survive
+	/// cleanup forever.
 	/// </para>
 	/// <para>
-	/// Canonicalization resolves the links of each path segment that already exists and appends the
-	/// segments that do not, so paths for files which have not been created yet can be canonicalized
-	/// without the failure a plain <c>realpath</c> would produce.
+	/// Directories that do not exist yet are appended unresolved, so a path for a file the build has not
+	/// written can be canonicalized without the failure a plain <c>realpath</c> would produce.
+	/// </para>
+	/// <para>
+	/// The canonical form is only ever used for comparison. Callers keep the original item spec so the
+	/// paths surfaced to the rest of the build stay in the spelling the user provided.
 	/// </para>
 	/// </remarks>
 	internal sealed class PathCanonicalizer
@@ -44,114 +49,144 @@ internal sealed class PathCanonicalizer
 				? StringComparer.Ordinal
 				: StringComparer.OrdinalIgnoreCase;
 
+		/// <summary>The <see cref="StringComparison"/> matching <see cref="Comparer"/>.</summary>
+		public static StringComparison Comparison { get; } =
+			RuntimeInformation.IsOSPlatform(OSPlatform.Linux)
+				? StringComparison.Ordinal
+				: StringComparison.OrdinalIgnoreCase;
+
 		static readonly MethodInfo ResolveDirectoryLinkTarget =
 			typeof(Directory).GetMethod("ResolveLinkTarget", BindingFlags.Public | BindingFlags.Static, null, new[] { typeof(string), typeof(bool) }, null);
 
-		static readonly MethodInfo ResolveFileLinkTarget =
-			typeof(File).GetMethod("ResolveLinkTarget", BindingFlags.Public | BindingFlags.Static, null, new[] { typeof(string), typeof(bool) }, null);
-
-		readonly Dictionary<string, string> directoryCache = new Dictionary<string, string>(Comparer);
+		// Cache keys are exact spellings. Two directories whose names differ only by case can be two
+		// different directories on a case sensitive volume, so a case insensitive key could hand back
+		// another directory's resolved target.
+		readonly Dictionary<string, string> directoryCache = new Dictionary<string, string>(StringComparer.Ordinal);
 
 		/// <summary>
-		/// Returns a canonical spelling of <paramref name="path"/>, or the input unchanged when it
-		/// cannot be canonicalized. Never throws.
+		/// Returns the key to compare <paramref name="path"/> by: its link resolved directory plus its
+		/// file name unchanged. Returns <see langword="null"/> when the path cannot be interpreted.
 		/// </summary>
-		public string Canonicalize(string path)
+		public string GetComparisonKey(string path)
 		{
 			if (string.IsNullOrWhiteSpace(path))
-				return path;
+				return null;
 
 			string full;
 			try
 			{
-				full = Path.GetFullPath(path);
+				full = TrimTrailingSeparators(Path.GetFullPath(path));
 			}
 			catch (Exception)
 			{
-				// An item spec can contain characters that are not valid in a path; leave it alone.
-				return path;
+				// An item spec can contain characters that are not valid in a path.
+				return null;
 			}
 
-			return CanonicalizeFullPath(TrimTrailingSeparators(full), MaxLinkHops);
+			var parent = Path.GetDirectoryName(full);
+			var name = Path.GetFileName(full);
+
+			// A bare root such as "/" or "C:\" has no file name to keep.
+			if (string.IsNullOrEmpty(parent) || string.IsNullOrEmpty(name))
+				return CanonicalizeDirectory(full);
+
+			var directory = CanonicalizeDirectory(parent);
+
+			return directory is null ? null : Path.Combine(directory, name);
 		}
 
 		/// <summary>
-		/// Builds a set of canonical paths that can be probed with <see cref="Canonicalize"/> results.
+		/// Returns <paramref name="directory"/> with every link in it resolved, or <see langword="null"/>
+		/// when it cannot be interpreted. Segments that do not exist are kept as they are.
 		/// </summary>
-		public HashSet<string> CreateSet(IEnumerable<string> paths)
+		public string CanonicalizeDirectory(string directory)
 		{
-			var set = new HashSet<string>(Comparer);
+			if (string.IsNullOrWhiteSpace(directory))
+				return null;
 
-			if (paths is not null)
+			string full;
+			try
+			{
+				full = TrimTrailingSeparators(Path.GetFullPath(directory));
+			}
+			catch (Exception)
 			{
-				foreach (var path in paths)
-				{
-					if (!string.IsNullOrWhiteSpace(path))
-						set.Add(Canonicalize(path));
-				}
+				return null;
 			}
 
-			return set;
+			return Canonicalize(full, MaxLinkHops);
 		}
 
-		string CanonicalizeFullPath(string full, int hops)
+		/// <summary>
+		/// Returns whether <paramref name="key"/> names something inside <paramref name="root"/>. Both
+		/// must already be comparison keys.
+		/// </summary>
+		public static bool IsUnder(string key, string root)
 		{
-			var parent = Path.GetDirectoryName(full);
-			var name = Path.GetFileName(full);
+			if (string.IsNullOrEmpty(key) || string.IsNullOrEmpty(root))
+				return false;
 
-			// A root such as "/" or "C:\" has nothing left to resolve.
-			if (string.IsNullOrEmpty(parent) || string.IsNullOrEmpty(name))
-				return full;
+			if (Comparer.Equals(key, root))
+				return true;
+
+			if (key.Length <= root.Length || !key.StartsWith(root, Comparison))
+				return false;
 
-			return ResolveLink(Path.Combine(CanonicalizeDirectory(parent, hops), name), hops);
+			// A root that already ends in a separator, such as "/" or "C:\", has no separator to skip.
+			var last = root[root.Length - 1];
+			if (last == Path.DirectorySeparatorChar || last == Path.AltDirectorySeparatorChar)
+				return true;
+
+			// Guard against "…/r-backup" being treated as living inside "…/r".
+			var next = key[root.Length];
+			return next == Path.DirectorySeparatorChar || next == Path.AltDirectorySeparatorChar;
 		}
 
-		string CanonicalizeDirectory(string directory, int hops)
+		string Canonicalize(string full, int hops)
 		{
-			directory = TrimTrailingSeparators(directory);
-
-			if (directoryCache.TryGetValue(directory, out var cached))
+			if (directoryCache.TryGetValue(full, out var cached))
 				return cached;
 
-			var canonical = CanonicalizeFullPath(directory, hops);
-			directoryCache[directory] = canonical;
+			var parent = Path.GetDirectoryName(full);
+			var name = Path.GetFileName(full);
+
+			// A root resolves to itself, which also terminates the walk.
+			var canonical = string.IsNullOrEmpty(parent) || string.IsNullOrEmpty(name)
+				? full
+				: ResolveDirectoryLink(Path.Combine(Canonicalize(parent, hops), name), hops);
+
+			directoryCache[full] = canonical;
 			return canonical;
 		}
 
-		string ResolveLink(string path, int hops)
+		string ResolveDirectoryLink(string path, int hops)
 		{
 			if (hops <= 0)
 				return path;
 
-			var target = GetLinkTarget(path);
+			var target = GetDirectoryLinkTarget(path);
 			if (target is null)
 				return path;
 
 			var resolved = TrimTrailingSeparators(target.FullName);
 			if (Comparer.Equals(resolved, path))
 				return path;
 
-			// The target itself may live under directories that are links, so canonicalize it too.
-			return CanonicalizeFullPath(resolved, hops - 1);
+			// The target itself may live under directories that are links.
+			return Canonicalize(resolved, hops - 1);
 		}
 
-		static FileSystemInfo GetLinkTarget(string path)
+		static FileSystemInfo GetDirectoryLinkTarget(string path)
 		{
-			// Directory/File.ResolveLinkTarget only exist on .NET 6 and later. This assembly targets
+			// Directory.ResolveLinkTarget only exists on .NET 6 and later. This assembly targets
 			// netstandard2.0 so that it can also load into MSBuild.exe on .NET Framework, where link
-			// resolution is simply unavailable and comparison falls back to the lexical full path.
-			var resolve = Directory.Exists(path)
-				? ResolveDirectoryLinkTarget
-				: File.Exists(path)
-					? ResolveFileLinkTarget
-					: null;
-
-			if (resolve is null)
+			// resolution is unavailable and comparison falls back to the lexical full path.
+			if (ResolveDirectoryLinkTarget is null || !Directory.Exists(path))
 				return null;
 
 			try
 			{
-				return resolve.Invoke(null, new object[] { path, /* returnFinalTarget: */ true }) as FileSystemInfo;
+				return ResolveDirectoryLinkTarget.Invoke(null, new object[] { path, /* returnFinalTarget: */ true }) as FileSystemInfo;
 			}
 			catch (Exception)
 			{

src/SingleProject/Resizetizer/src/nuget/buildTransitive/Microsoft.Maui.Resizetizer.After.targets

@@ -815,9 +815,12 @@
         </ItemGroup>
 
         <!-- Compare canonical paths rather than item specs. The wildcard above and the collected images
-             can legitimately spell the same file differently (symlinked project paths, separators,
-             casing), and a textual Remove would then classify every generated image as stale. -->
+             can legitimately spell the same file differently (symlinked project paths, casing), and a
+             textual Remove would then classify every generated image as stale. Root also confines the
+             delete list to the intermediate folder, because the recursive wildcard descends through any
+             directory link it finds inside it. -->
         <DetectStaleOutputFilesTask
+            Root="$(_MauiIntermediateImagesFullPath)"
             Files="@(_ResizetizerExistingImages->'%(FullPath)')"
             KnownOutputs="@(_ResizetizerCollectedImages)">
             <Output TaskParameter="StaleFiles" ItemName="_ResizetizerImagesToDelete" />