feat: enhance symlink detection and cache invalidation

- Add `_entry_is_symlink` method to detect symlinks and Windows junctions
- Include first-level symlinks in fingerprint for better cache invalidation
- Re-enable preview path validation for security
- Update tests to verify retargeted symlinks trigger rescan

tests/config/test_symlink_cache.py

@@ -112,7 +112,8 @@ def test_symlink_cache_survives_noise_mtime(monkeypatch: pytest.MonkeyPatch, tmp
     assert second_cfg.map_path_to_link(str(target_dir)) == _normalize(str(dir_link))
 
 
-def test_manual_rescan_refreshes_cache(monkeypatch: pytest.MonkeyPatch, tmp_path):
+def test_retargeted_symlink_triggers_rescan(monkeypatch: pytest.MonkeyPatch, tmp_path):
+    """Changing a symlink's target should trigger automatic cache invalidation."""
     loras_dir, _ = _setup_paths(monkeypatch, tmp_path)
 
     target_dir = loras_dir / "target"
@@ -122,22 +123,16 @@ def test_manual_rescan_refreshes_cache(monkeypatch: pytest.MonkeyPatch, tmp_path
 
     # Build initial cache pointing at the first target
     first_cfg = config_module.Config()
-    old_real = _normalize(os.path.realpath(target_dir))
     assert first_cfg.map_path_to_link(str(target_dir)) == _normalize(str(dir_link))
 
-    # Retarget the symlink to a new directory without touching the cache file
+    # Retarget the symlink to a new directory
     new_target = loras_dir / "target_v2"
     new_target.mkdir()
     dir_link.unlink()
     dir_link.symlink_to(new_target, target_is_directory=True)
 
+    # Second config should automatically detect the change and rescan
     second_cfg = config_module.Config()
-
-    # Cache still point at the old real path immediately after load
-    assert second_cfg.map_path_to_link(str(new_target)) == _normalize(str(new_target))
-
-    # Manual rescan should refresh the mapping to the new target
-    second_cfg.rebuild_symlink_cache()
     new_real = _normalize(os.path.realpath(new_target))
     assert second_cfg._path_mappings.get(new_real) == _normalize(str(dir_link))
     assert second_cfg.map_path_to_link(str(new_target)) == _normalize(str(dir_link))
@@ -177,3 +172,48 @@ def test_symlink_roots_are_preserved(monkeypatch: pytest.MonkeyPatch, tmp_path):
     cache_path = settings_dir / "cache" / "symlink_map.json"
     payload = json.loads(cache_path.read_text(encoding="utf-8"))
     assert payload["path_mappings"][normalized_real] == normalized_link
+
+
+def test_symlink_subfolder_to_external_location(monkeypatch: pytest.MonkeyPatch, tmp_path):
+    """Symlink under root pointing outside root should be detected and allowed."""
+    loras_dir, settings_dir = _setup_paths(monkeypatch, tmp_path)
+
+    # Create external directory (outside loras_dir)
+    external_dir = tmp_path / "external_models"
+    external_dir.mkdir()
+    preview_file = external_dir / "model.preview.png"
+    preview_file.write_bytes(b"preview")
+
+    # Create symlink under loras_dir pointing to external location
+    symlink = loras_dir / "characters"
+    symlink.symlink_to(external_dir, target_is_directory=True)
+
+    cfg = config_module.Config()
+
+    # Verify symlink was detected
+    normalized_external = _normalize(str(external_dir))
+    normalized_link = _normalize(str(symlink))
+    assert cfg._path_mappings[normalized_external] == normalized_link
+
+    # Verify preview path is allowed
+    assert cfg.is_preview_path_allowed(str(preview_file))
+
+
+def test_new_symlink_triggers_rescan(monkeypatch: pytest.MonkeyPatch, tmp_path):
+    """Adding a new symlink should trigger cache invalidation."""
+    loras_dir, settings_dir = _setup_paths(monkeypatch, tmp_path)
+
+    # Initial scan with no symlinks
+    first_cfg = config_module.Config()
+    assert len(first_cfg._path_mappings) == 0
+
+    # Create a symlink after initial cache
+    external_dir = tmp_path / "external"
+    external_dir.mkdir()
+    symlink = loras_dir / "new_link"
+    symlink.symlink_to(external_dir, target_is_directory=True)
+
+    # Second config should detect the change and rescan
+    second_cfg = config_module.Config()
+    normalized_external = _normalize(str(external_dir))
+    assert normalized_external in second_cfg._path_mappings