Latest Results
Keep the mount's diagnostic path canonical, or fail
The previous commit made `canonicalize` best-effort, falling back to the
caller's raw path when it failed after a successful open. That quietly
dropped an invariant: `host_path` was always absolute and canonical, or
construction failed.
It matters because callers copy that value out as a mount's durable
identity — `MountDir::new` puts it in a `MountSpec` and drops the `Mount`,
so every later feed rebuilds from it. A relative path persisted there would
re-resolve against the process CWD, and the `host_path` getter advertises
"the canonical host directory path" either way.
So make the failure fatal again, still after the open. The ordering fix is
untouched: the capability comes from the open, and nothing resolves through
the label — this only decides what happens when the label cannot be built.
Nothing regresses, either, since that same failure rejected the mount before
the previous commit, just from an earlier call.
Raised by cubic on #669, though it read this as the cause of the mount being
re-resolved per feed. That is #676 and predates both commits: `MountDir`
already discarded the `Dir`, and carrying the capability across rebuilds is
a `monty-pool`/`monty-python` change.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>rewitt94:fix-toctou-cap-std Take the mount descriptor from the open, not a checked path
`Mount::new` canonicalized the host path, stat'd it with `is_dir()`, then
opened that same string — a check-to-open pair. Whoever can rename in the
mount root's parent could land a symlink in the gap, and the descriptor the
whole mount then resolves against would pin a directory the host never
shared. Narrow, but it is the one line the rest of this PR trusts.
Open first, and the gap closes: the capability comes from the name directly,
and every check now runs on the handle. `O_DIRECTORY` (a handle `metadata()`
on Windows) already rejects a non-directory, so the `is_dir()` stat goes
away rather than moving. `canonicalize` stays for the diagnostic label only,
now after the open and best-effort — a race leaves a stale label on the
right descriptor, never a good label on the wrong one.
Construction failures therefore all surface from the open, so a missing
host path reports `cannot open host path` where it used to say `cannot
canonicalize host path`; the JS, Python and pool tests naming that message
move with it. `mount_construction_rejects_only_at_the_open` pins the
ordering — it is red against the old sequence on both a file and a missing
path.
This does not address the mount root being re-resolved from a path string
on every feed (#676); that one needs the descriptor carried across
rebuilds, and its seam is `monty-pool`/`monty-python`, not here.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>rewitt94:fix-toctou-cap-std Latest Branches
0%
rewitt94:fix-toctou-cap-std 0%
0%
rewitt94:fix-pyo3-type-check-message © 2026 CodSpeed Technology