bantamkit-mcp 0.35.8 → 0.35.9

package/README.md

@@ -445,7 +445,16 @@ all ship inside `dist/` and none of them is reachable through an import — they
 running `bantamkit-mcp` and `bantamkit-memory`. Importing the package starts no server and
 opens no transport. The vendored `assets/` is not importable either, but it is *readable*:
 `assetsRoot()` resolves to the `assets/` directory inside the installed package, which is how
-`loadTool('memory_save')` answers from a consumer that never unpacked anything itself.
+`loadTool('memory_save')` answers from a consumer that never unpacked anything itself. The
+loaders take a **bare** asset name: one with `/`, `\`, `..`, a drive colon or a NUL in it is
+refused with `AssetNotFound: <kind> asset name is not a bare name: <name>` before the disk is
+touched, so a name taken from user input cannot read a file outside the pack (the Python
+loaders refuse it in the same sentence).
+
+**The types need no `@types/node`.** The package declares no dependency on it, so nothing
+reachable from `index.d.ts` names a Node-only global: a `strict` consumer with `types: []`
+and `skipLibCheck: false` type-checks `import ... from 'bantamkit-mcp'` clean.
+`encodeRecord` is declared to return `Uint8Array` (the value is a `Buffer`, a subclass of it).
 
 **What the one entry point exports**, grouped by the module each name comes from:
 
@@ -530,7 +539,9 @@ node tools/conformance/npx-cold-start.mjs --offline    # + the no-network arms (
 The conformance harness shells out to a CPython for the reference side. That is a
 **development-time** dependency of the test tooling; nothing under `tools/` ships, and
 `files: ["dist", "assets"]` is the whole published surface. Runtime dependencies: exactly one,
-`@modelcontextprotocol/sdk`, pinned to `1.30.0`.
+`@modelcontextprotocol/sdk`, pinned to `1.31.0`, the first release outside advisory
+GHSA-6qxp-vccf-f47h (`>= 1.12.0, < 1.31.0`, the SDK's OAuth client, which this package never
+imports).
 
 ## Measurements and history
 

package/dist/assets.js

@@ -5,7 +5,7 @@
  * reference; where this file deviates the deviation is a comment, not an accident.
  */
 import { existsSync, realpathSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { BantamError } from './errors.js';
 import { pyReadText } from './memory/pyfs.js';
@@ -61,6 +61,30 @@ export function assetsRoot() {
     }
     throw new AssetNotFound('no assets directory found; set BANTAMKIT_ASSETS');
 }
+/**
+ * job66/#145: the one path every loader below builds, and the containment check on it.
+ *
+ * `name` is a BARE asset name — `memory`, `shiftwork-checkpoint`, `memory_recall` — and
+ * nothing else. Before this, each loader joined `name` under its directory verbatim, so a
+ * caller passing user input could read any `.json`/`.md` on disk: `loadSchema('../../x')`
+ * parsed a file outside the pack, and `loadTool('../schemas/shiftwork-checkpoint')` returned
+ * a Tool whose three fields were all `undefined`. A name holding a path separator (`/` or
+ * `\`, either platform's), `..`, a drive colon or a NUL is refused BEFORE any filesystem
+ * access, and the joined path is then checked LEXICALLY to sit directly inside
+ * `<root>/<kind>s/` — lexically, not by `realpath`, because a pack is allowed to be a
+ * symlink farm and the check is about the name, not about the disk. The refusal is an
+ * `AssetNotFound`, so the MCP resource handler's existing `unknown skill asset: <name>`
+ * answer is unchanged; the sentence is the reference's, byte for byte
+ * (`runtime-py/src/bantamkit/assets.py::_asset_path`).
+ */
+function assetPath(kind, name, ext) {
+    const dir = join(assetsRoot(), `${kind}s`);
+    const path = join(dir, `${name}${ext}`);
+    if (/[/\\:\0]/.test(name) || name.includes('..') || dirname(resolve(path)) !== resolve(dir)) {
+        throw new AssetNotFound(`${kind} asset name is not a bare name: ${name}`);
+    }
+    return path;
+}
 /**
  * Return one tool asset VERBATIM — every key, including the ones no surface uses.
  *
@@ -70,7 +94,7 @@ export function assetsRoot() {
  * and neither belongs on the agent-facing `Tool`.
  */
 export function loadToolAsset(name) {
-    const path = join(assetsRoot(), 'tools', `${name}.json`);
+    const path = assetPath('tool', name, '.json');
     if (!existsSync(path)) {
         throw new AssetNotFound(`tool asset not found: ${path}`);
     }
@@ -94,14 +118,14 @@ export function loadTool(name) {
 }
 /** Return a JSON Schema asset (parsed) — e.g. the shift-work checkpoint contract. */
 export function loadSchema(name) {
-    const path = join(assetsRoot(), 'schemas', `${name}.json`);
+    const path = assetPath('schema', name, '.json');
     if (!existsSync(path)) {
         throw new AssetNotFound(`schema asset not found: ${path}`);
     }
     return JSON.parse(readTextUniversal(path));
 }
 export function loadSkill(name) {
-    const path = join(assetsRoot(), 'skills', `${name}.md`);
+    const path = assetPath('skill', name, '.md');
     if (!existsSync(path)) {
         throw new AssetNotFound(`skill asset not found: ${path}`);
     }

package/dist/cli.js

@@ -327,9 +327,40 @@ const PARSER = {
     // line alone would silently make two unrelated flags mutually exclusive.
     groups: [[13, 14]],
 };
+/**
+ * job66/#139: the flags that each ACT and then exit, in registration order — the reference's
+ * `_ONE_SHOT_DESTS`. At most one may be given. WAS: `main` ran the first in registration
+ * order and dropped the rest at exit 0.
+ */
+const ONE_SHOT_DESTS = [
+    'assets_root',
+    'hook',
+    'mcp_report',
+    'statusline',
+    'update',
+    'install',
+    'install_hooks',
+    'remove_hooks',
+];
+/**
+ * `_refuse_stacked_one_shots`: two one-shot flags together are a USAGE error — the usage
+ * block, argparse's mutually-exclusive sentence, exit 2. Not a `groups` entry, for the
+ * reference's measured reason: the eight are not contiguous, and CPython 3.14 brackets a
+ * non-contiguous group in the usage line where 3.12/3.13 omit it, so a real group would make
+ * the reference's `-h` depend on its interpreter. Checked after the parse, naming the two
+ * EARLIEST-REGISTERED flags given, exactly as the reference does.
+ */
+function refuseStackedOneShots(values) {
+    const given = PARSER.actions.filter((action) => ONE_SHOT_DESTS.includes(action.dest) && values[action.dest] !== null && values[action.dest] !== false);
+    if (given.length > 1) {
+        const [first, second] = given.map((action) => action.optionStrings.join('/'));
+        throw new ArgvError(PARSER, `argument ${second}: not allowed with argument ${first}`);
+    }
+}
 /** `_parse_args`, arm for arm, including the mutually exclusive group and `-h`. */
 export function parseArgs(argv) {
     const values = parseWithSpec(PARSER, argv);
+    refuseStackedOneShots(values);
     return {
         k: values['k'],
         indexBudget: values['index_budget'],
@@ -613,6 +644,25 @@ function version() {
 }
 async function main(argv) {
     const options = parseArgs(argv);
+    // job66/#139: THE MODIFIERS ARE CHECKED BEFORE ANY FLAG ACTS, in the reference's order and
+    // with its sentences. WAS: the two refusals sat after every acting arm, so `--hook --yes`,
+    // `--hook --force` and `--statusline --force` dropped the modifier at exit 0.
+    //
+    // `--force` alone is a typo with a plausible reading — somebody meant to install and
+    // dropped the flag that says where. Refusing names the missing half.
+    if (options.force && (options.install ?? null) === null)
+        throw new Refusal('--force is only meaningful with --install');
+    // The same reading for the consent flag; the sentence names BOTH flags since the ruling of
+    // 2026-09-20.
+    if (options.yes && !(options.installHooks || options.removeHooks)) {
+        throw new Refusal('--yes is only meaningful with --install-hooks or --remove-hooks');
+    }
+    // REFUSED, NOT HONOURED: the hook binds the store from the cwd the HOST put in the event,
+    // and `runHook()` takes no options, so `--hook --store X` used to inject nothing from X.
+    if (options.hook && options.store !== null)
+        throw new Refusal('--store is not meaningful with --hook');
+    if (options.hook && options.start !== null)
+        throw new Refusal('--start is not meaningful with --hook');
     if (options.assetsRoot) {
         const root = assetsRoot();
         // `packFileCount`, not a second walk: the count printed here and the count
@@ -622,10 +672,8 @@ async function main(argv) {
         return 0;
     }
     if (options.hook) {
-        // DISPATCH ORDER IS REGISTRATION ORDER, which is the rule the four flags below already
-        // follow and the reason `--mcp-report --install cursor` prints a report and writes
-        // nothing. `--hook` is registered directly after `--index-budget`, so it is checked
-        // directly after `--assets-root`.
+        // ALONE ON ITS COMMAND LINE (job66/#139): another one-shot flag beside it is a usage
+        // error, and `--store`/`--start`/`--yes`/`--force` beside it are refused above.
         //
         // EXIT 0 ALWAYS, AND THAT IS THE CONTRACT, not a convenience. A hook that exits non-zero
         // or lets a stack reach stderr is rendered by the host as an error on the user's screen,
@@ -679,11 +727,9 @@ async function main(argv) {
         // that record no origin, and it is not a guess: it is where the code being executed lives.
         return await runUpdate((text) => process.stdout.write(text), (text) => process.stderr.write(text), version(), dirname(fileURLToPath(import.meta.url)));
     }
-    // ORDER IS OBSERVABLE, and it is the reference's order. `main` in `mcpserver.py` checks
-    // assets_root, then mcp_report, then statusline, then update, then install, then force — so
-    // `--mcp-report --install cursor` prints a report and writes NOTHING. Dispatching install
-    // earlier here made the same argv write a file on one runtime and not the other: one
-    // command line, two different states on the user's disk. Reviewed and moved.
+    // ORDER WAS OBSERVABLE, and it was the reference's order: `--mcp-report --install cursor`
+    // printed a report and wrote NOTHING. Since job66/#139 that argv is a usage error on both
+    // sides (`refuseStackedOneShots`), so at most one arm below is ever reached.
     if (options.install !== null && options.install !== undefined) {
         // Before any store or transport exists, the shape `--assets-root` established. The command
         // is resolved INSIDE the try: on an `npx` cache it makes the kept install first, and npm
@@ -699,9 +745,6 @@ async function main(argv) {
         }
         return 0;
     }
-    // REGISTRATION ORDER AGAIN, which is what makes `--mcp-report --install-hooks` print a
-    // report and write nothing, exactly as `--mcp-report --install cursor` already does.
-    //
     // THREE EXITS, AND THE TWO THAT WRITE NOTHING ARE NOT THE SAME EXIT (S1 RULING Q3.3/Q3.4):
     //
     //   0  written, or already installed and matching
@@ -772,18 +815,6 @@ async function main(argv) {
         }
         return 0;
     }
-    // `--force` alone is a typo with a plausible reading — somebody meant to install and
-    // dropped the flag that says where. Refusing names the missing half.
-    if (options.force)
-        throw new Refusal('--force is only meaningful with --install');
-    // The same reading, and the same refusal, for the consent flag: `--yes` on its own is
-    // somebody who meant to install or remove hooks and dropped the flag that says which. It is
-    // checked AFTER `--force` because that is registration order, and both are checked after
-    // every flag that acts, so `--install-hooks --yes` never reaches either of them. The
-    // sentence names BOTH flags since the ruling of 2026-09-20: naming only one would send an
-    // operator who mistyped `--remove-hooks` looking for a flag they already had.
-    if (options.yes)
-        throw new Refusal('--yes is only meaningful with --install-hooks or --remove-hooks');
     // A PERSON TYPED IT. `typedBareAtATerminal` carries the whole argument; what belongs here is
     // only that this sits BEFORE `buildMemory`, which is what creates a store. Somebody who typed
     // a command to see what it does has not asked for a `.bantamkit/memory` directory in whatever

package/dist/eventlog.d.ts

@@ -50,8 +50,15 @@ export declare function formatTimestamp(epochMs: number): string;
  * by CODE POINT and JavaScript's default comparator by UTF-16 code UNIT, and those two
  * disagree above the BMP. Every key written today is ASCII; the comparator is what keeps
  * that a fact about the data instead of a difference between the runtimes.
+ *
+ * job66/#144: the DECLARED return type is `Uint8Array`, not `Buffer`. The value is still a
+ * `Buffer` (a `Uint8Array` subclass), so nothing changes at runtime, but `Buffer` is a name
+ * only `@types/node` defines, and this signature is reachable from the package entry point
+ * (`index.d.ts` re-exports it). Spelled `Buffer`, it made a strict consumer without
+ * `@types/node` fail `tsc` on `import ... from 'bantamkit-mcp'` with TS2591 — a dependency
+ * the package never declared. `test/packaging.test.mjs` type-checks such a consumer.
  */
-export declare function encodeRecord(epochMs: number, tool: string, outcome: string, detail: Readonly<Record<string, DetailValue>>): Buffer;
+export declare function encodeRecord(epochMs: number, tool: string, outcome: string, detail: Readonly<Record<string, DetailValue>>): Uint8Array;
 /**
  * `<store>/events/mcp.jsonl` — provably outside everything `MemoryStore` reads.
  *

package/dist/eventlog.js

@@ -120,6 +120,13 @@ export function formatTimestamp(epochMs) {
  * by CODE POINT and JavaScript's default comparator by UTF-16 code UNIT, and those two
  * disagree above the BMP. Every key written today is ASCII; the comparator is what keeps
  * that a fact about the data instead of a difference between the runtimes.
+ *
+ * job66/#144: the DECLARED return type is `Uint8Array`, not `Buffer`. The value is still a
+ * `Buffer` (a `Uint8Array` subclass), so nothing changes at runtime, but `Buffer` is a name
+ * only `@types/node` defines, and this signature is reachable from the package entry point
+ * (`index.d.ts` re-exports it). Spelled `Buffer`, it made a strict consumer without
+ * `@types/node` fail `tsc` on `import ... from 'bantamkit-mcp'` with TS2591 — a dependency
+ * the package never declared. `test/packaging.test.mjs` type-checks such a consumer.
  */
 export function encodeRecord(epochMs, tool, outcome, detail) {
     const sorted = {};

package/dist/hookadapter.js

@@ -776,8 +776,14 @@ const UPDATE_TTL_MS = 24 * 60 * 60 * 1000;
  * nothing this file injects is unbounded. The sentence itself is 137 bytes plus two version
  * numbers; the one component that is not fixed is the operator's home path inside `{path}`, so
  * the cap is generous and exists to bound that, not to trim the sentence.
+ *
+ * AMENDED 2026-10-15 (job66/#171): 500 → 1024. The line now carries THREE absolute paths (the
+ * manifest, `process.execPath`, the kept `cli.js`), and a cap that cuts the line cuts the
+ * command the operator is told to run — a truncated command is worse than none. Measured: the
+ * conformance bed's home (a long `$TMPDIR` scratch path) put the line past 500 and the printed
+ * command was cut before its closing backtick. 1024 still bounds it.
  */
-const UPDATE_LINE_MAX = 500;
+const UPDATE_LINE_MAX = 1024;
 /**
  * THE SENTENCE. Only in the stale state, silent in the other four.
  *
@@ -801,8 +807,15 @@ const UPDATE_LINE_MAX = 500;
  * machine it was measured on. `node "<cli>"` is what a host is already told to run
  * (`npminstall.keptCli`), needs no PATH and no `.cmd` shim on Windows, and the double quotes
  * hold a home directory with a space in it in zsh, bash, cmd and PowerShell alike.
+ *
+ * AMENDED 2026-10-15 (job66/#171): "needs no PATH" was true of `{cli}` and false of `node`.
+ * Run through `/bin/sh` with `PATH=/usr/bin:/bin` — a GUI-launched host's PATH — the bare
+ * `node` answered `exit 127, node: command not found`. `{node}` is `process.execPath`, the
+ * absolute interpreter running THIS hook (the one the hook registration launched), quoted
+ * like `{cli}`. A quoted first word is a string in PowerShell, which runs it with `& `
+ * in front; zsh, bash, sh and cmd run it as printed.
  */
-const UPDATE_LINE = '[bantamkit] {program} {installed} at {path} is running; the package index has {latest} — run `node "{cli}" --update`, then reconnect the host.';
+const UPDATE_LINE = '[bantamkit] {program} {installed} at {path} is running; the package index has {latest} — run `"{node}" "{cli}" --update`, then reconnect the host.';
 /** `{name}` substitution. A missing key is left alone rather than rendered `undefined`. */
 function fillLine(template, values) {
     return template.replace(/\{([a-z]+)\}/g, (whole, name) => values[name] ?? whole);
@@ -858,6 +871,7 @@ function updateSignal(run) {
                 installed: kept.version,
                 path: kept.path,
                 cli: kept.cli,
+                node: process.execPath,
                 latest,
             }), UPDATE_LINE_MAX);
         }

package/dist/hostinstall.d.ts

@@ -152,8 +152,8 @@ export declare const HOOK_MARKER_VALUE = "hook";
  *   5. dated backup, then one atomic write.
  *
  * The write itself is `writeConfig` — the same temp-file replace, the same carried mode, the
- * same `indent: 2` through `dumps` — so the bytes this leaves and the bytes `--install` leaves
- * are produced by one function (RULING Q3.5).
+ * same detected indent and literal non-ASCII through `hostJsonText` (#118) — so the bytes this
+ * leaves and the bytes `--install` leaves are produced by one function (RULING Q3.5).
  */
 export declare function installHooks(options?: HookOptions): string;
 /**

package/dist/hostinstall.js

@@ -12,9 +12,10 @@
  *      never `JSON.stringify`. Python writes `{"args": [], "command": "OLD"}` and
  *      `JSON.stringify` writes `{"args":[],"command":"OLD"}` — same object, different
  *      bytes, and the separators are the whole difference.
- *   2. The file is written with the same helper at `indent: 2`, which also reproduces
- *      `ensure_ascii`. A home directory with a non-ASCII name would otherwise make the two
- *      runtimes write different bytes for the same install.
+ *   2. The file is written through `hostJsonText`, which reproduces the reference's
+ *      `json.dumps(data, indent=<the file's own unit>, ensure_ascii=False)` (#118): the user's
+ *      Thai text stays Thai, their 4-space or tab indent stays theirs, and the two runtimes
+ *      still write identical bytes — `install-host-text` in the install suite compares them.
  *
  * WHAT IS RULED DIFFERENT, and it is one field: the COMMAND. This side records
  * `<absolute node> <absolute .../dist/cli.js>`; the reference records its own console script.
@@ -243,7 +244,7 @@ function writeConfig(path, data) {
     // before this line existed.
     const mode = existsSync(target) ? statSync(target).mode & 0o7777 : null;
     try {
-        writeFileSync(tmp, `${dumpJson(data, { indent: 2 })}\n`, 'utf8');
+        writeFileSync(tmp, `${hostJsonText(data, detectedIndent(target))}\n`, 'utf8');
         if (mode !== null)
             chmodSync(tmp, mode);
         renameSync(tmp, target);
@@ -253,6 +254,68 @@ function writeConfig(path, data) {
         throw new InstallError(`cannot write ${path}: ${e.message}`);
     }
 }
+/**
+ * The indent unit the file already uses: a tab, or N spaces; two for a new file (#118).
+ *
+ * Read off the FIRST line that starts with whitespace and has something after it. A JSON
+ * string cannot hold a raw newline, so every line start is structural and that line is a
+ * depth-one member. A file with no such line (absent, empty, all on one line) gets two
+ * spaces, which is what this writer always used. The reference's `_detected_indent` applies
+ * the same rule to the same text.
+ *
+ * Lines break where Python's universal newlines break them — `\r\n`, a bare `\r`, or `\n` —
+ * because the reference reads through `Path.read_text`, which translates all three. Splitting
+ * on `\n` alone saw a classic-Mac (CR-only) file as one line, fell back to two spaces, and so
+ * wrote different bytes from the reference and lost the file's indent (#118, review J66-12 B1).
+ */
+function detectedIndent(path) {
+    let text;
+    try {
+        text = readFileSync(path, 'utf8');
+    }
+    catch {
+        return '  ';
+    }
+    for (const line of text.split(/\r\n|\r|\n/)) {
+        if ((line[0] !== ' ' && line[0] !== '\t') || !/[^ \t\r]/.test(line))
+            continue;
+        if (line[0] === '\t')
+            return '\t';
+        return ' '.repeat(line.length - line.replace(/^ +/, '').length);
+    }
+    return '  ';
+}
+/**
+ * The host file's text: the user's indent unit, non-ASCII as literal UTF-8 (#118) — the
+ * bytes the reference's `json.dumps(data, indent=<unit>, ensure_ascii=False)` writes.
+ *
+ * Built from `dumpJson`'s `ensure_ascii` output at indent 2, which is already CPython's in
+ * every other respect, by two rewrites that cannot touch a string's meaning:
+ *   - indentation: every line start in that output is structural (a string holds no raw
+ *     newline), and its leading spaces are exactly 2 × depth, so they become unit × depth;
+ *   - escapes: each `\uXXXX` at 0x7f or above goes back to the character itself — a valid
+ *     surrogate PAIR as one astral character — which is what `ensure_ascii=False` writes
+ *     (it escapes only `"`, `\` and C0). A LONE surrogate stays escaped: UTF-8 cannot carry
+ *     it, and the reference writes it back the same way. A `\\` pair is consumed first, so
+ *     the text `ก` inside a string (an escaped backslash) is never mistaken for one.
+ */
+function hostJsonText(data, indent) {
+    const ascii = dumpJson(data, { indent: 2 });
+    const unescaped = ascii.replace(/\\u(d[89ab][0-9a-f]{2})\\u(d[c-f][0-9a-f]{2})|\\u([0-9a-f]{4})|\\[^u]/g, (whole, high, low, single) => {
+        if (high !== undefined && low !== undefined) {
+            return String.fromCharCode(parseInt(high, 16), parseInt(low, 16));
+        }
+        if (single === undefined)
+            return whole;
+        const unit = parseInt(single, 16);
+        if (unit < 0x7f || (unit >= 0xd800 && unit <= 0xdfff))
+            return whole;
+        return String.fromCharCode(unit);
+    });
+    if (indent === '  ')
+        return unescaped;
+    return unescaped.replace(/^((?: {2})+)/gm, (lead) => indent.repeat(lead.length / 2));
+}
 /** `date.today().isoformat()` — the LOCAL date, which is what the reference takes. */
 function today() {
     const now = new Date();
@@ -824,8 +887,8 @@ function removalPlan(path, events, entries) {
  *   5. dated backup, then one atomic write.
  *
  * The write itself is `writeConfig` — the same temp-file replace, the same carried mode, the
- * same `indent: 2` through `dumps` — so the bytes this leaves and the bytes `--install` leaves
- * are produced by one function (RULING Q3.5).
+ * same detected indent and literal non-ASCII through `hostJsonText` (#118) — so the bytes this
+ * leaves and the bytes `--install` leaves are produced by one function (RULING Q3.5).
  */
 export function installHooks(options = {}) {
     const { command, args } = thisCommand(options);

package/dist/mcp/identity.js

@@ -75,9 +75,35 @@ const unavailable = (reason) => ({ unavailable: reason });
  */
 function walkFiles(root) {
     const found = [];
+    // job66/#140: `rglob` over a root that is not a directory yields NOTHING — missing, a
+    // regular file, or a dangling link alike (`select_from` checks `is_dir()` first) — and it
+    // swallows `PermissionError` on any directory it cannot list. WAS: `readdirSync` threw, so
+    // `BANTAMKIT_ASSETS=<missing> --assets-root` died with a raw ENOENT stack where the
+    // reference prints `<path>` / `0 files` at exit 0. Measured on CPython 3.12:
+    // `list(Path("<missing>").rglob("*"))`, `<file>` and a mode-000 directory are all `[]`.
+    let rootIsDir = false;
+    try {
+        rootIsDir = statSync(root).isDirectory();
+    }
+    catch {
+        rootIsDir = false;
+    }
+    if (!rootIsDir)
+        return [];
+    const listing = (here) => {
+        try {
+            return readdirSync(here, { withFileTypes: true });
+        }
+        catch (e) {
+            const code = e.code;
+            if (code === 'EACCES' || code === 'EPERM')
+                return [];
+            throw e;
+        }
+    };
     const descend = (parts) => {
         const here = parts.length === 0 ? root : join(root, ...parts);
-        for (const entry of readdirSync(here, { withFileTypes: true })) {
+        for (const entry of listing(here)) {
             const next = [...parts, entry.name];
             if (entry.isDirectory()) {
                 descend(next);