@vzn/vx 0.0.595 → 0.0.597

package/src/exec/sandbox-paths.ts

@@ -27,6 +27,17 @@ export function isMountableLiteral(grant: string): boolean {
   return !MOUNT_WILDCARDS.test(grant)
 }
 
+/**
+ * The one path a grant names, or undefined for a pattern. A grant whose
+ * only brackets are escaped (`out/\[id\]`) names `out/[id]` as surely as a
+ * literal does, though it is still scanned and matched as a glob.
+ */
+export function namedPath(grant: string): string | undefined {
+  if (isMountableLiteral(grant)) return grant
+  const escaped = /\\([[\]])/g
+  return isMountableLiteral(grant.replace(escaped, '')) ? grant.replace(escaped, '$1') : undefined
+}
+
 /**
  * Canonicalize a path with realpath, tolerating paths that don't exist
  * yet: resolve the longest existing ancestor and re-append the rest.
@@ -82,7 +93,7 @@ export function localBindingOn(c: { localBinding?: boolean | readonly number[] }
  * rest of the host is mounted read-only), or under a read grant, a write
  * grant or a baseline read, by its canonical path. A path no grant holds
  * under a denial is not there inside the sandbox, which the shell reports
- * as "not found" with no denial a trace can see (an `execve`).
+ * as "not found": a PATH search is a stat, which the trace does not stop on.
  */
 export function sandboxReads(
   sandbox: {