[ronleizrowice-ant]

On Linux the mandatory write denies below the working directory missed some names one level down, and could be lost altogether. Now every dangerous name of a subdirectory is denied, whatever else the tree holds.

What was wrong

The names come from one rg --files --max-depth N (3 by default).

• The depth was the file's. sub/.git/config is within it; sub/.git/hooks/pre-commit and sub/.claude/commands/x.md are one level too deep.
• Two-component names never matched a single path segment, so only the file found was denied, not .claude/commands.
• The absolute path was searched. Under a directory named .idea or .vscode nothing below the working directory was denied.
• Any failure counted as "nothing found". ripgrep exits 2 if there was a directory it could not read, having listed the rest. All of it was dropped.
• Ignore files and ripgrep's configuration file steered the scan. Nothing under a directory named in .gitignore was seen.

What changes

• ripgrep looks one level deeper. A dangerous file counts down to the depth, as before (a/b/.bashrc). A dangerous directory, and the hooks and config of a repository, count one level higher up, all alike (a/.vscode, a/.claude/commands, a/.git/hooks).
• Names are taken by path component, relative to the working directory.
• A repository is known by its HEAD: its hooks are denied whether full, empty or missing.
• The scan runs with --no-ignore --no-config --line-buffered, and what it listed counts however it ended. Without line buffering a killed ripgrep drops its output.
• A directory of the user's own that ripgrep could not read is denied whole, which also keeps its mode from being changed from inside.
• ripgrep's message about it is a hint only. Its wording depends on the version and the number of threads, and the paths in it are the tree's own text. What stands before each : is tried, and counts only if it is a directory below the working directory, with no link on the way, that the host process cannot read either.

Who sees a difference

• Over 119 paths at the default depth, nothing refused before is written now. 18 more are refused, all one level down. The same holds in a directory that an ignore file names.
• git add, commit and checkout -b inside a nested repository work as before.
• A repository one level down costs four mounts, not three: with 100 of them a whole CLI run took 0.84 s, not 0.66 s; with 300, 3.0 s, not 1.9 s (medians of 7). bwrap's argument limit is reached at about 740 of them, not 985. Two levels down nothing changes.

Known limits

• Two levels down is as before: a/b/.git/hooks, a/b/.git/config, a/b/.vscode, a/b/.claude/*. Denying them costs four mounts a repository where there were none, and stops a/b from being removed or renamed from inside.
• A dangerous file, or a dangerous directory other than a repository's hooks, that does not exist yet can be made below the working directory.
• HEAD stays writable, so hooks that are empty or missing are covered only while it is there. A repository with no hooks directory has an empty file in its place while a command runs, and after a hard kill until it is removed; git init run again and installing a hook fail with it there.
• An unreadable directory of another user's is left alone: its mode cannot be given back from inside, and there can be thousands. One whose name holds a newline or is not UTF-8 is not recognised; a directory that holds denies cannot be renamed from inside.
• A scan that cannot be started denies nothing. One killed after its ten seconds denies what it had listed, not what it had not come to.
• Conflicts textually with Mandatory denies: submodule git dirs, .git pointer files, nested hooks, gitignored paths #569.

Testing

• 52 new cases, nearly all with a real sandbox; nothing tested a subdirectory before. 25 fail on main. 34 mutations of the final code each fail a test.
• Real bubblewrap, ripgrep and git beside main, row by row: four other depths, allowGitConfig, other spellings, a linked worktree, five kinds of ignore file, three configuration lines, directories unreadable in five ways with all CPUs, one CPU and one thread, a real ripgrep killed in mid scan, forged messages spelled by directory names.
• Not run through the CLI: an unreadable directory of another user's in a writable one. The built function was given real ripgrep output about three such directories.