Glob walk: a drive-root base no longer drops the pattern, and three ways a failure could lose a match

[ronleizrowice-ant]

Summary

The walk behind a read-deny glob reads its pattern as an automaton, one path component at a time (#564). Reading it again turned up one base it cannot start from and three ways a failure loses a match instead of reporting it. The first drops a whole configuration entry on Windows, in silence.

What was wrong

• A drive root or a share root as the base. path.dirname keeps the separator of a root, so the base of C:\Users*\**\.env is C:/ and of \\server\share\x*\y is //server/share/. Split into path components to seed the automaton, either ends in an empty name no position can consume: the walk starts nowhere, nothing matches, and the entry is dropped with no error and no warning. That is every denyRead, denyWrite, allowRead and allowWrite glob of that shape on Windows.
• A listing failure cached against the directory. Its positions were marked before the listing and never rolled back, so a transient EMFILE, or a real path too long to name, answered for every later name that led there and dropped every match beneath it.
• A second name answering for the first. A failed call was retried under a shorter name whatever the errno, and the caller judged the second call's: EACCES on the real path then ENOENT on the short one reads as "nothing is there" -- no match, nothing unlistable, no deny.
• A link met by a pattern that cannot be split. Such a pattern matches whole paths and lists no directory through a symlink, so a link out of the tree dropped whatever the pattern matches in there.
• The weaker reading, taken in silence. A pattern the automaton could not be built for fell back to whole-path matching with nothing said, and one long enough to overflow the stack reached that fallback through a RangeError.

Change

A base never carries a trailing separator, so a Windows pattern whose wildcard sits in the component right below a drive root or a share root (C:\Users*\**\.env, \\server\share\x*\y) is now walked instead of matching nothing; a drive root is handed to the filesystem as C:/, since C: alone is the drive's current directory. Only / and a pattern with no literal directory at all are refused, as before, in the walk and in the manager's glob warnings through one predicate; a ** right below a drive or share root lists that volume. An earlier head of this branch refused a drive root and a share root as it refuses /, which also dropped the shapes the last release enforces (\\server\share\*.pem, D:\**\*.key); that refusal is gone. A failure is uncached again: one record per real directory, named once in unlisted, retried under each name that leads to it. A call answers from a second name only for a path too long to be one, and logs which it used. A link out of the tree that an unsplittable pattern cannot be followed through is denied whole, except one that leads back up to the starting directory or above it: such a link is left alone, as it is for a pattern that can be followed, because what it leads to holds the starting directory itself, and denying that whole would hide it, everything beside it and every path bound back beneath it, over one link anything able to write the tree can make; the links the walk does follow are named where it follows them. Both regular expressions are compiled inside the try that guards the automaton: a pattern that compiles into none is raised under its own name, one too long to build is refused at a bound on the piece count, and either fallback warns. Cleanups: the directory-form automaton is built only for the caller that asks, positions are not sorted for an order nothing reads, the automaton's state is held rather than cast.

Who sees a difference

• A Windows glob whose first wildcard sits in the component below a drive or share root was dropped in silence and is now walked and enforced, as one whose wildcard starts that component always was. A ** there lists the whole volume, at initialize(); a rule of that shape is better off naming the directories it means (C:\Users\*\... starts from C:\Users). For a drive-root pattern on the working directory's own drive, main listed the current directory and spelled the results as if they were under the root, so nothing was stamped; handing the root over as C:/ puts that right as well.
• An unsplittable denyRead glob now mounts over the directory a link out of the tree leads to, and binds nothing back beneath it.
• A directory that cannot be listed is denied whole where a transient failure used to lose it.

Not done here

• globToRegex itself: globToRegex: negate bracket sets, and compile from tokens so no path text can become a wildcard #573 rewrites it. This branch keeps to walkGlobPattern, globPositions and globPatternBaseDir; the two meet in one README line and in the piece bound, which counts what globPieces returns either way. globToRegex: negate bracket sets, and compile from tokens so no path text can become a wildcard #573 also drops one of the three shapes the README calls unsplittable, so that clause is left to it.
• A link whose target cannot be looked at (a directory above the target is not searchable), and that the pattern would continue through rather than match, is not followed and nothing is denied for it, whether or not the pattern can be split; for one that can, that is unchanged from the last release. Denying it whole would hide the directory holding it, which under a ** pattern is any directory with such a link in it, the project root included. A link of that kind that is itself a match is still denied under its own spelling. The README says so.
• Nothing here was run on Windows. The drive-root walk is driven on Linux through a directory named C: with path's Windows semantics spied in; a share root is covered by the pure functions only, since a leading // does not survive path normalisation on POSIX.
• The refusal of a pattern that compiles into no regular expression has no test: the only patterns reaching it are the unterminated bracket sets globToRegex: negate bracket sets, and compile from tokens so no path text can become a wildcard #573 makes legal.

Testing

tsc --noEmit, eslint and prettier --check clean on the changed files; full npm test on Linux matches a clean checkout of main on the same machine. Against main's sources, with only the new predicate carried over, all five new behaviour tests fail. The three added last (a link that leads up is in neither the matches nor the unlisted directories, and no mount is put over what holds the tree; a drive root and a share root are not refused and their bases carry no separator; the walk from a drive-shaped base finds its matches) fail at the head before them and fail again with each fix taken back out.

Live, under bubblewrap: with denyRead: ["<root>/proj/**/?[*].pem"] and proj/away -> outside, main reads outside/b].pem in full inside the sandbox where this branch finds an empty directory, and a match inside the tree stays masked in both. The property test compares the walk with globToRegex over four generated trees and 500 patterns in about 30ms.