Repository navigation
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reproduction
On origin/main, replacing the scanned root redirects planned removal, and replacing an intermediate parent redirects the built-in XDG trash fallback so it moves an outside file. Throwaway tests against origin/main (not included here) failed for both, and also showed permissive modes on newly created trash directories and exhausted trash names reusing an occupied name. A follow-up regression,
same_named_trash_entries_keep_distinct_metadata, failed on an earlier revision of this branch when an orphaned.trashinforeserved the next same-name suffix (0 passed / 1 failed,AlreadyExists).Fix
Retain the scan-start root identity and verify the opened root descriptor against it before deleting. Normalize platform stat widths and compare source and trash devices through opened descriptors. Create new trash directories privately (0700) and reserve metadata (0600) with exclusive creation before the payload moves. Payload and metadata names match, occupied metadata names are skipped, and native NOREPLACE prevents a payload overwrite. A metadata failure leaves the source intact; a failed payload move removes its reserved record. Existing directory permissions are unchanged. Rustix native NOREPLACE is used on Apple as well as Linux and Android; other Unix platforms refuse the built-in trash rather than use a racy rename fallback. No new dependencies.
Checks run
cargo xtask lintpassed.cargo xtask testpassed: 72 app, 148 core (2 ignored), 3 xtask. The exact core tests for matching metadata, real-source exhaustion, existing modes, metadata failure and failed-move cleanup each passed (1 passed).cargo check -p disktree-core --target x86_64-apple-darwin --testspassed.Limitations
macOS compilation is not runtime verification. Windows:
cargo check -p disktree-core --target x86_64-pc-windows-msvc --testspasses; nothing was run on Windows. External and native trash backends were not exercised; their path races and final-target identity changes are not claimed solved. Two mount fixtures remain ignored.Developed with AI assistance (OMP agents). I reviewed the diffs; every check listed was run on the final branch.