ignore-files.ts: Don't follow dangling symlinks, don't recurse into state dir (#4)

Two bug fixes in ignore-files.ts at once:
- Dangling symlinks would break recursion and cause exception.
- Recursing into Tuor state dir was semantically incorrect (should never
even be mounted in the first place).

Author: codethief

src/cli/init.ts

@@ -2,6 +2,7 @@ import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { buildCommand, type CommandContext } from "@stricli/core";
 import type { TuorConfig } from "../config/schema.ts";
+import { STATE_DIR_NAME } from "../config/state-dir.ts";
 import { MOUNT_MODES, type MountMode } from "../core/mounts.ts";
 
 type Flags = {
@@ -44,7 +45,7 @@ export const command = buildCommand({
       join(tuorDir, "config.json"),
       JSON.stringify(config, null, 2) + "\n",
     );
-    writeFileSync(join(tuorDir, ".gitignore"), ".state\n");
+    writeFileSync(join(tuorDir, ".gitignore"), `${STATE_DIR_NAME}\n`);
     writeFileSync(
       join(tuorDir, "tuorignore"),
       [

src/config/ignore-files.test.ts

@@ -232,6 +232,54 @@ describe("collectIgnorePatterns", () => {
     }
   });
 
+  test("skips dangling symlinks instead of crashing the walk", () => {
+    const root = mkdtempSync(join(tmpdir(), "tuor-dangling-"));
+    try {
+      // A real ignore file that must still be found despite the bad symlink.
+      writeFileSync(join(root, ".tuorignore"), "secret");
+      // A symlink whose target does not exist. statSync (which follows the
+      // link) throws ENOENT on it; the walk must skip it, not crash.
+      symlinkSync(join(root, "does-not-exist"), join(root, "dangling"));
+
+      const refs = [parseIgnoreFileRef("mount:.tuorignore")];
+      const result = collectIgnorePatterns(
+        refs,
+        root,
+        "/cfg",
+        defaultIgnoreFileDeps,
+      );
+      expect(result).toEqual([{ pattern: "secret", scope: "/" }]);
+    } finally {
+      rmSync(root, { recursive: true });
+    }
+  });
+
+  test("does not scan Tuor's own state dir during recursive walk", () => {
+    const root = mkdtempSync(join(tmpdir(), "tuor-statedir-"));
+    try {
+      // A user ignore file at the mount root that must still be collected.
+      writeFileSync(join(root, ".tuorignore"), "user-pattern");
+
+      // Tuor persists overlay upper layers under <configDir>/.state. It is
+      // internal state, not user content, so an ignore file inside it must NOT
+      // be collected: the walk must not descend into the state dir at all.
+      const stateOverlay = join(root, ".tuor", ".state", "overlays", "root");
+      mkdirSync(stateOverlay, { recursive: true });
+      writeFileSync(join(stateOverlay, ".tuorignore"), "internal-pattern");
+
+      const refs = [parseIgnoreFileRef("mount:.tuorignore")];
+      const result = collectIgnorePatterns(
+        refs,
+        root,
+        join(root, ".tuor"),
+        defaultIgnoreFileDeps,
+      );
+      expect(result).toEqual([{ pattern: "user-pattern", scope: "/" }]);
+    } finally {
+      rmSync(root, { recursive: true });
+    }
+  });
+
   test("merges patterns from multiple refs", () => {
     const deps: IgnoreFileDeps = {
       readFile: (p) => {

src/config/ignore-files.ts

@@ -7,6 +7,7 @@ import {
 } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import type { ScopedPattern } from "../core/shadow.ts";
+import { getStateDir } from "./state-dir.ts";
 
 // --- Types ---
 
@@ -22,8 +23,15 @@ export const DEFAULT_IGNORE_FILE_REFS = [
 export type IgnoreFileDeps = {
   readFile: (path: string) => string;
   pathExists: (path: string) => boolean;
-  /** Find all files named `filename` under `rootDir`, returning absolute paths. */
-  walkFiles: (rootDir: string, filename: string) => string[];
+  /**
+   * Find all files named `filename` under `rootDir`, returning absolute paths.
+   * Directories whose absolute path is in `excludeDirs` are not descended into.
+   */
+  walkFiles: (
+    rootDir: string,
+    filename: string,
+    excludeDirs: ReadonlySet<string>,
+  ) => string[];
 };
 
 export function parseIgnoreFileRef(ref: string): IgnoreFileRef {
@@ -72,6 +80,11 @@ export function collectIgnorePatterns(
 ): ScopedPattern[] {
   const result: ScopedPattern[] = [];
 
+  // Never scan Tuor's own state dir: it holds serialized overlay upper layers
+  // (whiteout markers, plus symlinks whose targets only resolve inside the
+  // sandbox), which is internal state, not user content.
+  const excludeDirs = new Set([getStateDir(configDir)]);
+
   for (const ref of refs) {
     switch (ref.source) {
       case "host": {
@@ -88,7 +101,11 @@ export function collectIgnorePatterns(
       }
       case "mount": {
         if (ref.recursive) {
-          for (const absPath of deps.walkFiles(hostPath, ref.path)) {
+          for (const absPath of deps.walkFiles(
+            hostPath,
+            ref.path,
+            excludeDirs,
+          )) {
             const dir = relative(hostPath, dirname(absPath));
             const scope = dir === "" ? "/" : `/${dir}`;
             result.push(
@@ -125,13 +142,27 @@ export function _parseIgnoreFile(contents: string): string[] {
 
 // --- Default deps (real filesystem) ---
 
-function walkFilesRecursive(rootDir: string, filename: string): string[] {
+function walkFilesRecursive(
+  rootDir: string,
+  filename: string,
+  excludeDirs: ReadonlySet<string> = new Set(),
+): string[] {
   const results: string[] = [];
   const walk = (dir: string) => {
     for (const entry of readdirSync(dir, { withFileTypes: true })) {
       const full = join(dir, entry.name);
+      if (excludeDirs.has(full)) continue;
       if (entry.isSymbolicLink()) {
-        if (!statSync(full).isDirectory()) continue;
+        // statSync follows the link to its target. A dangling symlink (target
+        // missing) throws ENOENT, so guard against it and skip rather than
+        // letting one broken link crash the entire walk.
+        let isDir: boolean;
+        try {
+          isDir = statSync(full).isDirectory();
+        } catch {
+          continue;
+        }
+        if (!isDir) continue;
         const real = realpathSync(full);
         if (dir.startsWith(real + "/") || dir === real) {
           throw new Error(

src/config/resolve.ts

@@ -24,6 +24,7 @@ import type {
   VolumeConfig,
   WorkdirConfig,
 } from "./schema.ts";
+import { getOverlaysDir } from "./state-dir.ts";
 
 // --- Types ---
 
@@ -254,7 +255,7 @@ export function _getOverlayStateDir(
 ): string {
   const stripped = guestPath.replace(/^\//, "");
   const sanitized = stripped === "" ? "_root" : stripped.replace(/\//g, "_");
-  return join(configDir, ".state", "overlays", sanitized);
+  return join(getOverlaysDir(configDir), sanitized);
 }
 
 // --- Default deps ---

src/config/state-dir.ts

@@ -0,0 +1,25 @@
+import { join } from "node:path";
+
+/**
+ * Layout of Tuor's internal state directory.
+ *
+ * Within a config dir (a `.tuor/` directory), Tuor persists internal state
+ * under `STATE_DIR_NAME`. This is Tuor's own data (e.g. persistent overlay
+ * upper layers), not user content, and should never be treated as such — e.g.
+ * the recursive ignore-file scan must not descend into it.
+ */
+
+export const STATE_DIR_NAME = ".state";
+
+/** Subdir of the state dir holding persistent overlay upper layers. */
+export const OVERLAYS_DIR_NAME = "overlays";
+
+/** Absolute path to Tuor's internal state dir for the given config dir. */
+export function getStateDir(configDir: string): string {
+  return join(configDir, STATE_DIR_NAME);
+}
+
+/** Absolute path to the dir holding persistent overlay upper layers. */
+export function getOverlaysDir(configDir: string): string {
+  return join(getStateDir(configDir), OVERLAYS_DIR_NAME);
+}