dirsql 0.4.59__tar.gz → 0.4.60__tar.gz

{dirsql-0.4.59 → dirsql-0.4.60}/Cargo.lock

@@ -552,7 +552,7 @@ checksum = "6184e33543162437515c2e2b48714794e37845ec9851711914eec9d308f6ebe8"
 
 [[package]]
 name = "dirsql"
-version = "0.4.59"
+version = "0.4.60"
 dependencies = [
  "assert_cmd",
  "axum",
@@ -601,7 +601,7 @@ dependencies = [
 
 [[package]]
 name = "dirsql-py-ext"
-version = "0.4.59"
+version = "0.4.60"
 dependencies = [
  "dirsql",
  "pyo3",

{dirsql-0.4.59 → dirsql-0.4.60}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dirsql
-Version: 0.4.59
+Version: 0.4.60
 Requires-Dist: bin-shim>=0.1
 Summary: Ephemeral SQL index over a local directory
 Keywords: sql,filesystem,directory,sqlite,index

{dirsql-0.4.59 → dirsql-0.4.60}/packages/python/Cargo.toml

@@ -4,7 +4,7 @@ name = "dirsql-py-ext"
 # pypi/maturin handler can rewrite it via `write-version` before
 # `maturin build`. `pyproject.toml` declares `dynamic = ["version"]`
 # and maturin reads this field. Mirrors `packages/rust/Cargo.toml`.
-version = "0.4.59"
+version = "0.4.60"
 # abi3 note: the `abi3-py310` pyo3 feature (below) builds ONE stable-ABI
 # `cp310-abi3` wheel per platform that loads on every CPython >= 3.10
 # (matching `pyproject.toml`'s `requires-python = ">=3.10"`), instead of

dirsql-0.4.60/packages/python/e2e-attestations/claude-1207-win-argv-quote.json

@@ -0,0 +1,7 @@
+{
+  "command": "just test-e2e",
+  "ran_at": 1790939617,
+  "exit_code": 0,
+  "commit": "009c015ffa36453da6d92ddec17b5b655b51372f",
+  "branch": "claude/1207-win-argv-quote"
+}

dirsql-0.4.60/packages/python/e2e-attestations/claude-1208-win-nonverbatim-paths.json

@@ -0,0 +1,7 @@
+{
+  "command": "just test-e2e",
+  "ran_at": 1790939958,
+  "exit_code": 0,
+  "commit": "64a48bb1eff07865a52fc25e1ad50722aced9e45",
+  "branch": "claude/1208-win-nonverbatim-paths"
+}

{dirsql-0.4.59 → dirsql-0.4.60}/packages/rust/Cargo.toml

@@ -6,7 +6,7 @@ description = "Ephemeral SQL index over a local directory"
 # version stays for the binding crates (publish = false). The literal
 # intentionally lags the published version: putitoutthere rewrites it to
 # the planned release version at build time and never commits it back.
-version = "0.4.59"
+version = "0.4.60"
 edition.workspace = true
 # Literal `license` (not `license.workspace = true`) because
 # putitoutthere's preflight check reads `[package].license` directly

{dirsql-0.4.59 → dirsql-0.4.60}/packages/rust/src/command.rs

@@ -49,6 +49,63 @@ impl Placeholder {
             value: value.into(),
         }
     }
+
+    /// A placeholder whose value is a filesystem path, handed to the child in
+    /// its plain (non-verbatim) form; see [`non_verbatim`].
+    pub fn path(name: impl Into<String>, path: &str) -> Self {
+        Self::new(name, non_verbatim(path))
+    }
+}
+
+/// The plain form of a Windows verbatim path: `\\?\C:\x` becomes `C:\x` and
+/// `\\?\UNC\server\share\x` becomes `\\server\share\x`. Anything else, and any
+/// verbatim path whose plain spelling would name a different file, is returned
+/// unchanged.
+pub(crate) fn non_verbatim(path: &str) -> String {
+    plain_form(path).unwrap_or_else(|| path.to_string())
+}
+
+fn plain_form(path: &str) -> Option<String> {
+    let rest = path.strip_prefix(r"\\?\")?;
+    let (plain, tail) = if let Some(unc) = rest.strip_prefix(r"UNC\") {
+        if unc.split('\\').count() < 2 {
+            return None;
+        }
+        (format!(r"\\{unc}"), unc)
+    } else {
+        let drive = rest.as_bytes();
+        let is_drive = drive.len() >= 3
+            && drive[0].is_ascii_alphabetic()
+            && drive[1] == b':'
+            && drive[2] == b'\\';
+        if !is_drive {
+            return None;
+        }
+        (rest.to_string(), &rest[3..])
+    };
+    // Win32 rejects or rewrites these, so the plain spelling would not name
+    // the same file; MAX_PATH counts UTF-16 units including the terminator.
+    let same_file = (tail.is_empty() || tail.split('\\').all(is_plain_component))
+        && plain.encode_utf16().count() < 260;
+    same_file.then_some(plain)
+}
+
+fn is_plain_component(name: &str) -> bool {
+    let invalid_char = |c: char| c < ' ' || r#"/<>:"|?*"#.contains(c);
+    let stem = name
+        .split_once('.')
+        .map_or(name, |(stem, _)| stem)
+        .trim_end_matches(' ');
+    let reserved = matches!(
+        stem.to_ascii_uppercase().as_bytes(),
+        b"CON"
+            | b"PRN"
+            | b"AUX"
+            | b"NUL"
+            | [b'C', b'O', b'M', b'1'..=b'9']
+            | [b'L', b'P', b'T', b'1'..=b'9']
+    );
+    !name.is_empty() && !name.ends_with(['.', ' ']) && !name.contains(invalid_char) && !reserved
 }
 
 /// A successful command run.
@@ -119,8 +176,8 @@ pub fn run_command(
     let argv = build_argv(command, placeholders)?;
     // `build_argv` guarantees a non-empty argv.
     let mut cmd = Command::new(&argv[0]);
-    cmd.args(&argv[1..])
-        .current_dir(cwd)
+    push_args(&mut cmd, &argv[1..]);
+    cmd.current_dir(cwd)
         .stdout(Stdio::piped())
         .stderr(Stdio::piped())
         .stdin(if stdin_payload.is_some() {
@@ -193,6 +250,20 @@ pub fn run_command(
     }
 }
 
+// One fn with cfg blocks rather than two cfg'd fns: cargo-mutants mutates
+// the uncompiled twin too, and no test on a Linux gate can kill that mutant.
+fn push_args(cmd: &mut Command, args: &[String]) {
+    #[cfg(windows)]
+    {
+        use std::os::windows::process::CommandExt;
+        for arg in args {
+            cmd.raw_arg(quote_windows_arg(arg));
+        }
+    }
+    #[cfg(not(windows))]
+    cmd.args(args);
+}
+
 fn spawn_error(program: &str, source: std::io::Error, cwd: &Path) -> CommandError {
     // A missing cwd fails the child's chdir with `NotFound` too.
     if !searched_path(program, source.kind()) || !cwd.is_dir() {
@@ -244,6 +315,35 @@ pub(crate) fn build_argv(
     Ok(argv)
 }
 
+/// Quote `arg` for a Windows command line by the MS C-runtime rules, always
+/// wrapped in double quotes: an MSYS/Cygwin child globs, brace-expands and
+/// unescapes any unquoted word, while an MSVCRT child parses the quoted form
+/// back to `arg` exactly.
+#[cfg_attr(not(windows), allow(dead_code))]
+pub(crate) fn quote_windows_arg(arg: &str) -> String {
+    let mut out = String::with_capacity(arg.len() + 2);
+    out.push('"');
+    let mut backslashes = 0;
+    for ch in arg.chars() {
+        match ch {
+            '\\' => backslashes += 1,
+            '"' => {
+                out.extend(std::iter::repeat_n('\\', backslashes * 2 + 1));
+                out.push('"');
+                backslashes = 0;
+            }
+            _ => {
+                out.extend(std::iter::repeat_n('\\', backslashes));
+                out.push(ch);
+                backslashes = 0;
+            }
+        }
+    }
+    out.extend(std::iter::repeat_n('\\', backslashes * 2));
+    out.push('"');
+    out
+}
+
 /// Replace every `{name}` in `token` with its placeholder value in a single
 /// left-to-right pass. Injected values are never re-scanned, so an untrusted
 /// value containing `{…}` is inert. Unknown `{…}` sequences are left literal.
@@ -315,6 +415,117 @@ mod tests {
         build_argv(command, placeholders).expect("valid command")
     }
 
+    fn unchanged(path: &str) {
+        assert_eq!(non_verbatim(path), path);
+    }
+
+    #[test]
+    fn non_verbatim_strips_a_verbatim_drive_path() {
+        assert_eq!(
+            non_verbatim(r"\\?\C:\Users\runner\in_cwd.txt"),
+            r"C:\Users\runner\in_cwd.txt"
+        );
+        assert_eq!(non_verbatim(r"\\?\d:\x"), r"d:\x");
+        assert_eq!(non_verbatim(r"\\?\C:\my file.txt"), r"C:\my file.txt");
+    }
+
+    #[test]
+    fn non_verbatim_strips_a_verbatim_drive_root() {
+        assert_eq!(non_verbatim(r"\\?\C:\"), r"C:\");
+    }
+
+    #[test]
+    fn non_verbatim_rewrites_a_verbatim_unc_path() {
+        assert_eq!(
+            non_verbatim(r"\\?\UNC\server\share\dir\f.txt"),
+            r"\\server\share\dir\f.txt"
+        );
+        assert_eq!(non_verbatim(r"\\?\UNC\server\share"), r"\\server\share");
+    }
+
+    #[test]
+    fn non_verbatim_leaves_plain_paths_unchanged() {
+        unchanged(r"C:\Users\runner\f.txt");
+        unchanged(r"\\server\share\f.txt");
+        unchanged("/tmp/root/f.txt");
+        unchanged("relative/f.txt");
+        unchanged("");
+    }
+
+    #[test]
+    fn non_verbatim_leaves_verbatim_forms_without_a_drive_or_unc_unchanged() {
+        unchanged(r"\\?\GLOBALROOT\Device\HarddiskVolume1\f.txt");
+        unchanged(r"\\?\Volume{0b1c2d3e-0000-0000-0000-100000000000}\f.txt");
+        unchanged(r"\\?\C:");
+        unchanged(r"\\?\C:x");
+        unchanged(r"\\?\1:\x");
+        unchanged(r"\\?\");
+    }
+
+    #[test]
+    fn non_verbatim_leaves_an_incomplete_unc_unchanged() {
+        unchanged(r"\\?\UNC\");
+        unchanged(r"\\?\UNC\server");
+        unchanged(r"\\?\UNC\server\");
+    }
+
+    #[test]
+    fn non_verbatim_leaves_components_win32_would_reinterpret_unchanged() {
+        unchanged(r"\\?\C:\a\..\b");
+        unchanged(r"\\?\C:\a\.\b");
+        unchanged(r"\\?\C:\a\\b");
+        unchanged(r"\\?\C:\a\");
+        unchanged(r"\\?\C:\trailing.");
+        unchanged(r"\\?\C:\trailing ");
+        unchanged(r"\\?\C:\a/b");
+        unchanged(r"\\?\C:\a?b");
+        unchanged(r"\\?\C:\a*b");
+        unchanged(r"\\?\C:\a:b");
+        unchanged(r#"\\?\C:\a"b"#);
+        unchanged(r"\\?\C:\a<b");
+        unchanged(r"\\?\C:\a>b");
+        unchanged(r"\\?\C:\a|b");
+        unchanged("\\\\?\\C:\\a\u{1}b");
+        unchanged(r"\\?\UNC\server\share\..\x");
+    }
+
+    #[test]
+    fn non_verbatim_leaves_reserved_device_names_unchanged() {
+        for name in [
+            "CON", "con", "PRN", "AUX", "NUL", "nul.txt", "NUL .txt", "COM1", "COM9", "LPT1",
+            "lpt9.log",
+        ] {
+            unchanged(&format!(r"\\?\C:\dir\{name}"));
+        }
+    }
+
+    #[test]
+    fn non_verbatim_strips_names_that_only_resemble_device_names() {
+        for name in [
+            "CONSOLE", "NULL.txt", "COM0", "COM10", "LPT", "xCON", "AUXa",
+        ] {
+            assert_eq!(
+                non_verbatim(&format!(r"\\?\C:\dir\{name}")),
+                format!(r"C:\dir\{name}")
+            );
+        }
+    }
+
+    #[test]
+    fn non_verbatim_strips_up_to_max_path_and_no_further() {
+        let fits = format!(r"C:\{}", "a".repeat(256));
+        assert_eq!(fits.encode_utf16().count(), 259);
+        assert_eq!(non_verbatim(&format!(r"\\?\{fits}")), fits);
+        unchanged(&format!(r"\\?\C:\{}", "a".repeat(257)));
+    }
+
+    #[test]
+    fn path_placeholder_carries_the_non_verbatim_value() {
+        let placeholder = Placeholder::path("path", r"\\?\C:\a\f.txt");
+        assert_eq!(placeholder.name, "path");
+        assert_eq!(placeholder.value, r"C:\a\f.txt");
+    }
+
     #[test]
     fn splits_on_whitespace_without_placeholders() {
         assert_eq!(argv("echo hello world", &[]), ["echo", "hello", "world"]);
@@ -402,6 +613,47 @@ mod tests {
         assert_eq!(argv("run", &[Placeholder::new("path", "/tmp/x")]), ["run"]);
     }
 
+    #[test]
+    fn windows_quoting_wraps_a_plain_arg_in_quotes() {
+        assert_eq!(quote_windows_arg("hello"), r#""hello""#);
+    }
+
+    #[test]
+    fn windows_quoting_keeps_an_empty_arg_as_an_empty_quoted_word() {
+        assert_eq!(quote_windows_arg(""), r#""""#);
+    }
+
+    #[test]
+    fn windows_quoting_quotes_glob_and_brace_characters() {
+        assert_eq!(quote_windows_arg("[{}]"), r#""[{}]""#);
+        assert_eq!(quote_windows_arg("a?b*c"), r#""a?b*c""#);
+    }
+
+    #[test]
+    fn windows_quoting_leaves_backslashes_not_before_a_quote_alone() {
+        assert_eq!(
+            quote_windows_arg(r"\\?\C:\Users\x.txt"),
+            r#""\\?\C:\Users\x.txt""#
+        );
+    }
+
+    #[test]
+    fn windows_quoting_doubles_trailing_backslashes_before_the_closing_quote() {
+        assert_eq!(quote_windows_arg(r"C:\dir\"), r#""C:\dir\\""#);
+        assert_eq!(quote_windows_arg(r"a\\"), r#""a\\\\""#);
+    }
+
+    #[test]
+    fn windows_quoting_escapes_embedded_quotes() {
+        assert_eq!(quote_windows_arg(r#"[{"n":1}]"#), r#""[{\"n\":1}]""#);
+    }
+
+    #[test]
+    fn windows_quoting_doubles_backslashes_before_an_embedded_quote() {
+        assert_eq!(quote_windows_arg(r#"a\"b"#), r#""a\\\"b""#);
+        assert_eq!(quote_windows_arg(r#"a\\"b"#), r#""a\\\\\"b""#);
+    }
+
     #[test]
     fn extract_payload_takes_the_last_non_empty_line() {
         assert_eq!(

{dirsql-0.4.59 → dirsql-0.4.60}/packages/rust/src/extension_resolution.rs

@@ -512,7 +512,11 @@ mod tests {
         );
         assert_eq!(
             err.to_string(),
-            "multiple loadable extension files found in package 'vec': /pkg/a.so, /pkg/z.so; disambiguate with a literal path"
+            format!(
+                "multiple loadable extension files found in package 'vec': {}, {}; disambiguate with a literal path",
+                dir.join("a.so").display(),
+                dir.join("z.so").display()
+            )
         );
     }
 }

{dirsql-0.4.59 → dirsql-0.4.60}/packages/rust/src/lib.rs

@@ -1938,8 +1938,8 @@ fn run_on_file(
     root: &Path,
 ) -> std::result::Result<Vec<Row>, BoxError> {
     let placeholders = [
-        Placeholder::new("path", abs_path),
-        Placeholder::new("root", root.to_string_lossy().into_owned()),
+        Placeholder::path("path", abs_path),
+        Placeholder::path("root", &root.to_string_lossy()),
     ];
 
     // Errors travel to the caller rather than being logged and flattened to an
@@ -2936,7 +2936,12 @@ mod internal_tests {
     /// so `notify` never sees `.`.
     #[test]
     fn relative_root_canonicalizes_watch_root_only() {
-        let fake = FakeFs::default().with_canonical_root(".", "/ws/canonical");
+        let canonical = if cfg!(windows) {
+            r"C:\ws\canonical"
+        } else {
+            "/ws/canonical"
+        };
+        let fake = FakeFs::default().with_canonical_root(".", canonical);
         let db = DirSQL::with_ignore_and_fs(
             ".",
             vec![Table::new(
@@ -2956,7 +2961,7 @@ mod internal_tests {
             "watch_root must be absolute, got {:?}",
             db.inner.watch_root
         );
-        assert_eq!(db.inner.watch_root, PathBuf::from("/ws/canonical"));
+        assert_eq!(db.inner.watch_root, PathBuf::from(canonical));
     }
 
     /// With an absolute root, `process_file_event` strips the `watch_root`
@@ -4376,6 +4381,22 @@ mod internal_tests {
         );
     }
 
+    #[test]
+    fn run_on_file_hands_the_hook_non_verbatim_path_and_root() {
+        let dir = TempDir::new().unwrap();
+        run_on_file(
+            r#"sh -c 'printf "%s|%s" "$1" "$2" > seen; echo "[]"' sh {path} {root}"#,
+            r"\\?\C:\r\f.txt",
+            dir.path(),
+            Path::new(r"\\?\D:\r"),
+        )
+        .expect("a well-formed payload parses");
+        assert_eq!(
+            std::fs::read_to_string(dir.path().join("seen")).unwrap(),
+            r"C:\r\f.txt|D:\r"
+        );
+    }
+
     /// A command that cannot be spawned is an error the caller records, not an
     /// empty row set: a skip and a file that legitimately produced no rows must
     /// stay distinguishable.

{dirsql-0.4.59 → dirsql-0.4.60}/packages/rust/src/parsed_vtab.rs

@@ -292,8 +292,8 @@ fn no_rows_message(pattern: &str) -> String {
 fn run_parser(command: &str, root: &Path, rel_path: &Path) -> std::result::Result<String, String> {
     let abs_path = root.join(rel_path);
     let placeholders = [
-        Placeholder::new("path", abs_path.to_string_lossy().into_owned()),
-        Placeholder::new("root", root.to_string_lossy().into_owned()),
+        Placeholder::path("path", &abs_path.to_string_lossy()),
+        Placeholder::path("root", &root.to_string_lossy()),
     ];
 
     run_command(command, &placeholders, root, None)