Repository navigation
🔒 fix: Refuse a Pathname Root That Changes Before It Is Held - #361
Conversation
A pathname-only root replaced between its identity capture and its open is refused as INVALID_PATH instead of rerunning the mutation unanchored against the replacement.
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Chef's kiss. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Codex Review: Didn't find any major issues. Keep it up! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Summary
This is a follow-up to #360, which merged at
16e7fcebefore its second review pass. That pass found one issue in the new descriptor anchoring.withAnchoredParentCreationcaptures a pathname-only root's identity and then opens it by descriptor. If the root was replaced by another real directory between those two steps, the open raisesWorkspaceRootAccessError. The fallback then ran the mutation again without an anchor. When the replacement directory already contained the requested parent, awrite_fileorimport_filecould succeed against a root inode other than the one this request inspected. That undoes the point of anchoring for the request.Now a
WorkspaceRootAccessErrorfrom that open rejects the request asINVALID_PATHbefore the mutation runs.withWorkspaceRootraises that error only while opening the root, so nothing has been written at that point and the rejection is atomic. A root that is no longer a real directory at its registered path still never gets an anchor and is refused by the unanchored path, as before.Compatibility and deploy
This is worker-only. No protocol, Code API or LibreChat change. It narrows a race and changes nothing in the common path. Ship it with #360 when updating workers. The Skynet worker needs both.
Testing
packages/code:npm run build(tsc) is clean.node --test dist/workspace.test.js dist/workspace-import.test.json Node 24.16.0: 103 tests, 102 pass, 1 skipped, as onmain.captureWorkspaceRootIdentityandWorkspaceRootAccess.openinside one call, and neither function has a seam a test can use without mocking the module. The change is the single branch shown in the diff. The tests from 🪜 fix: Create Missing Parents on Pathname-Only Roots So Imports Land #360 cover the surrounding cases: a pathname-only root replaced by a symlink before the request creates nothing, and parent creation never follows a symlink out of the root.