[ronleizrowice-ant]

Four faults in the walk that expands a glob entry. The walk was rewritten under this branch (#620, #627, #628, #644, #645), so each fault was checked again on today's main, and each fails its test there.

What changes

• A drive root or a share root is a base like any other (Windows). C:/Users*/id.pem and //server/share/x*/y.key found nothing: the base came back with the root's separator, a component the pattern does not have. C:/*.pem listed the drive's current directory, not its root. / is still refused. A doubled separator before the first wildcard (C:\a\\*.pem, or ~\*.pem when the home directory is a drive root) is walked as on main.
• A directory that answers ENOENT under one name is asked for again under its others. It was taken for absent under all of them, and its matches stayed readable.
• What the shorter name says is added to what the real path said. A call is made on the real path, which crosses no link, and after any failure on the shorter name the walk got there by, as on main. The short name crosses links that a sandboxed command can repoint, at nothing or at an empty directory, and main took its answer in place of the real path's: a directory that could not be read came back as absent or empty, and nothing was denied.
  • Now a real path that fails with anything but ENOENT or ENAMETOOLONG has the directory denied whole (a link that matches: covered under its own spelling), whatever the short name says. For a link's own stat and realpath, ENOTDIR and ELOOP are absences too.
  • What the short name lists or leads to is walked as well, so what a link in there leads out to is still masked. Where the short name alone says a matching link leads is denied besides.
  • Of two failures, the one that is not an absence counts.
• A pattern that is no regular expression says which pattern it is. Still a SyntaxError, with the engine's error as its cause.

How it meets #645

#645 keeps a failed listing (any error but ENOENT) for the patterns that follow in the same wrap. That stays. In a walk's own map nothing is kept, so a second name still gets its try. An absence is never kept.

Where it mounts more than main

1. The ENOENT case above: the matches are masked.
2. A directory reached by a name shorter than its real path (a rule spelled through a link, such as ~/**/.env with a linked home directory), whose listing by the real path fails with anything but ENOENT or ENAMETOOLONG: denied whole, where main went by the short name. This hurts when the failure is momentary. With the working directory HOME/proj, one failed first listing of it gives --bind CWD CWD … --tmpfs CWD and nothing restores it, so what the command writes there is lost. It lasts one wrap. Under a plain spelling main does the same.
3. The same for a matching link's own stat and realpath: covered as spelled.

Where it mounts less than main

Within one pattern, nowhere, in 28,980 injected cases under Node and 18,900 of them again under Bun. They include a link that matches inside a directory the same pattern denies, reached through a shorter directory link.

Between patterns, in the one case main took for an absence: the real path fails while the short name says ENOENT. main kept nothing, and every later pattern asked again. Here the failure is kept for the wrap like any other and the directory is denied whole. If the failure has cleared by then, a later pattern does not find what a link leads out of that directory to. main does the same after any failure it recognises.

Not covered, as on main

A matching link that is kept under its own spelling, beneath a directory the same pattern denies, gets no mount of its own: the directory above it counts as hiding it. So where such a link leads is masked only if a name said where that is. A follow-up takes this up.

Dropped from this branch

• The cap of 1024 pattern pieces: capped patterns lost a match behind a link that main finds.
• Three refactors that changed no behaviour.

Testing

• 19 tests fail on main's source. 48 mutations each fail a test.
• File system calls for one wrap with 300 rules, main and here: 9,337 and 9,337 (names present), 8,137 and 8,137 (absent), 8,116 and 8,116 (bases absent), 31,919 and 31,919 (20 unlistable directories). The mounts are identical.
• Worst case found: a directory that answers ENOENT under many short names costs two failed listings per name and rule. 200 such links and 300 rules, injected: 120,300 tries against 300, 1.7 s against 0.9 s. Under Bun the state can be real: links to /proc/self/fd/<n> of a removed directory pass stat and realpath while readdir says ENOENT.
• With real bubblewrap, against main: a folder with a backslash in its name under Bun, whose realpathSync fails on such a path; ENOENT once on a listing; a link leading out of a directory whose listing fails once; a directory that never lists by its real path; a matching link inside a denied directory whose stat or realpath fails once, under Node and Bun. All masked or hidden.
• Windows: eight rows run on the Windows jobs only, four through expandWindowsFsPaths with doubled separators and four that walk from a real drive root. All eight pass there, on x86-64 and arm64. The share root is only computed.

Merge order

Conflicts with #672, #607 and #573 in the walk and the README.