Guard Clear with an ownership marker and a path guard - #124
Merged
Conversation
Reverse mode calls DirOps.Clear(), which os.RemoveAll's the objects directory. A mistargeted --moddir (e.g. $HOME) could destroy unrelated data, and the extension allowlist was only a weak proxy for ownership. Clear now drops a hidden .ttsmm-managed sentinel after recreating the directory and refuses to delete unless the directory is absent, empty, already carries the marker, or (for backward compatibility) passes the existing extension allowlist. A pathGuard additionally refuses the filesystem root, the home directory, any ancestor of home, and suspiciously shallow paths. The marker is filtered out of ListFilesAndFolders so it stays invisible to the rest of the pipeline. Fixes #96 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
argonui
force-pushed
the
fix/clear-ownership-guard
branch
from
August 4, 2026 02:33
e3feaf8 to
7fd3062
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #96
Reverse mode calls
DirOps.Clear(), whichos.RemoveAlls the objects directory before rewriting it. If a user mistargets--moddir(say, at$HOME), that deletion could wipe out unrelated data, and the previous extension allowlist was only a weak proxy for "this tool owns this directory." This PR replaces that proxy with a real ownership signal plus a path guard: after recreating the directory,Cleardrops a hidden.ttsmm-managedsentinel, and on subsequent runs it refuses to delete unless the directory is absent, empty, already carries the marker, or — for backward compatibility with trees written before the marker existed — passes the existing extension allowlist (which then earns a marker going forward). Independently, apathGuardresolves the target to an absolute, cleaned path and refuses the filesystem root, the user's home directory, any ancestor of home, and suspiciously shallow single-segment paths, all with explicit errors. The marker is filtered out ofListFilesAndFoldersso it never leaks into the pipeline as mod content, which as a side effect also clears the original.DS_Store/.gitkeepfalse positives since a tool-created directory no longer relies on the extension check. New unit tests infile/dirops_test.gocover refusal of unmarked foreign content, clearing of marked/empty/absent/legacy directories, and the path guard rejecting/and the home dir.go build,go vet, andgo test ./...are all green.