feat(core): remove a directory on Unix and finish the leftovers of a crash (#445)

Closed
QN
3d ago
+342-22

User description

Part of #359 (R-15 Gate 4, slice H1a-2), part 3 of 4, stacked on #1069. test-support only: no production caller, no production deletion release.

What this adds

  • remove_empty_dir on Unix: the child directory is opened without following a link, refused if it has entries (NotEmpty), moved through the same quarantine directory, identified by the open directory and removed with unlinkat(AT_REMOVEDIR); one that fills after the check goes back. The link count of the held directory is checked afterwards (Disturbed otherwise): an empty foreign directory that wins the last window is removed instead and the removal says so (it holds no data).
  • remove_leftover_file: a crash, a refused put-back (Swapped { restored: false }) or Stranded leaves a .h1q-* directory holding the entry as x; a sweep never removes it by itself. It is taken by its generated name only (.h1q- + exactly 32 lowercase hex digits; anything else is InvalidName and untouched), must be a directory of the effective user without group/other access, the file in it is authenticated again, and only an accepted file is removed. An empty generated quarantine directory is removed.

No new unsafe, no new package.

Proof

Directory swapped in the first window / filled after the check (put back, not removed); an empty directory in the last window (Disturbed, original intact); a simulated crash (observer panics once the entry is in the quarantine directory): the entry is left there, refused when the authentication fails, finished when it succeeds; names outside the generated grammar refused (.h1q-empty, non-hex, other directories); a foreign object left by a refused put-back is never removed; a stranded entry (quarantine lost its search permission) is finished after the permission is back. Local: fmt, clippy -D warnings on Linux / Windows / macOS targets, lib and isolation tests.

Findings of the first draft answered here: Codex / CodeAnt on the leftover-name grammar, on the directory in the last window (unlinkat(AT_REMOVEDIR) can remove an empty replacement: detected, documented), and on the honesty of the claims.

Status: H1A_2_UNIX_DIRECTORY_AND_LEFTOVERS=IMPLEMENTED_TEST_SUPPORT_ONLY, H1_PROVED=NO, R1_PRODUCTION_RECLAMATION=NOT_ADMITTED, GATE4_TERMINAL=NO.

Summary by Sourcery

Complete the Unix test-support implementation for empty-directory removal and safe recovery of interrupted quarantine cleanup.

New Features:

  • Add Unix test-support for safely removing empty directories while preserving directories that become non-empty or are replaced during removal.
  • Add authenticated recovery for generated quarantine leftovers after crashes, failed restoration, or stranded cleanup.

Enhancements:

  • Restrict leftover recovery to authenticated files in owner-controlled, correctly named quarantine directories and leave foreign or unrecognized objects untouched.

Documentation:

  • Document the Unix directory-removal, crash-recovery, race-detection behavior, and test-support-only status.

Tests:

  • Cover directory swaps, late additions, last-window disturbances, simulated crashes, invalid quarantine names, foreign quarantine objects, and stranded-entry recovery.

Summary by cubic

Implements Unix directory removal and crash-leftover recovery for test-support, replacing the Unsupported stubs from part 1. No production caller and no production deletion release.

  • remove_empty_dir opens the child without following links, refuses a non-empty directory, and removes it through the quarantine directory with the same link-count check as files.
  • remove_leftover_file finishes .h1q-* directories left after a crash or a refused put-back: it accepts only generated names, re-authenticates the held file, and removes it only when accepted.
  • Foreign objects in quarantine are never removed; names outside the generated grammar are refused and untouched.

No new unsafe, no new package.

CodeAnt-AI Description

Add safe Unix directory removal and recovery for interrupted cleanup

What Changed

  • Unix test-support can remove empty directories while leaving filled directories intact.
  • Leftover files from interrupted removals can be removed after they pass authentication again; unrecognized leftovers and files that fail authentication are left untouched.
  • Empty generated quarantine directories are cleaned up.

Impact

✅ Empty directories removable in Unix test-support
✅ Interrupted removals recoverable after authentication
✅ Unrecognized or unauthenticated leftovers stay intact

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.