[sunrioa]

Summary

Windows W1 read-only recursive Glob currently rejects an entire search root when it contains a nested NTFS junction. This PR lets it return ordinary entries beside the junction while omitting the junction and its descendants.

• Bind the internal nonFollowingReadRoot flag to the broker manifest digest and partition the approved root into bounded physical-directory ACL grants.
• Enumerate without following reparse entries. Retain unsorted encounter order and test match membership against the production globFiles implementation.
• Merge current upstream main at 222a06fe316f12df3129eff1c16ab3bfaf85c479 and adopt its files / truncated contract. Probe one additional distinct match, so exactly reaching the cap does not mean truncation.
• Propagate ordinary admitted-directory traversal failures before the cap. If the overflow probe fails after the cap, retain the bounded result with truncated: true.
• Extend portable regressions, the real Windows broker smoke suite, packaged verification, and the English/Chinese Windows sandbox RFCs.

Refs #3938.

Permission and cleanup boundary

• Only the explicitly marked, read-only W1 Glob plan uses non-following admission. Default recursive admission, Read/Write/Bash/Grep permissions, and the existing ACL cleanup rules remain unchanged.
• The marked root must be a declared recursive read root and a physical directory; write grants, reparse roots, multi-hard-link files, invalid policy combinations, and digest mismatches remain fail-closed.
• Neither ACL planning nor enumeration follows nested reparse entries. Targets independently authorized through their physical paths retain that independent access.
• ACL planning retains its bounds: 4,096 physical grants, 100,000 inspected entries, and 256 directory levels below the root.
• The original native ledger and settlement implementation is unchanged by this main-sync update: revoke grants after confirmed Job settlement; preserve/quarantine recovery evidence when settlement is uncertain.

The matcher uses a direct minimatch@10.2.5 dependency already present in main's dependency closure. This revision does not downgrade dependencies or carry the old dependency-only notice changes.

Verification

Current revision: f1eabe8c0c0a508fc71455bcf43a67dd68c1627b (2026-10-25).

Review follow-up: terminal . components now match the current directory, including after **. Explicit hidden matches do not carry recursive globstar state into the hidden directory, preserving membership and exact-cap completeness. The follow-up changes only matcher transitions and tests; admission and native ACL cleanup are unchanged.

Local macOS / Node 24 checks on this revision:

• npm run lint, npm run format:check, full npm run build, and full npm run typecheck: passed.
• Knip for apps/desktop and packages/ui: passed.
• Runtime suite: 4,096 passed, 14 skipped, 0 failed.
• Focused filesystem-worker, Glob, client/process, launch-spec, and Windows policy regressions: 130 passed; the Windows-only broker smoke suite was skipped.
• All 9 added portable regression tests fail against parent 51a9bb2 and pass with this fix.
• A temporary differential probe of 2,800 patterns against production globFiles found 0 differences in match membership and small-cap completeness.

Checks previously passed at parent 51a9bb2 in unchanged areas: 50 Windows harness/package-closure/inventory tests, the skip inventory check, 97 ASF source checks, Desktop/CLI third-party notice checks, Rust formatting, and locked Windows MSVC launcher/test cross-checking. These are baseline results, not fresh native Windows execution of this follow-up.

Native Windows verification (contributor-provided)

The contributor reports the following results on the previous Windows-validated revision, 51a9bb2daf29de50c2d7962edcd5facd8245e827, from a clean checkout at C:\maka-pr3955-test, branch codex/fix-windows-glob-junctions, matching the remote.

Environment: Node 24.18.1, npm 11.19.0, Cargo 1.98.0, PowerShell 7.6.6, Electron 43.5.0.

• npm ci, build, and typecheck: passed.
• Native Rust Broker tests: 62/62 passed.
• PR-focused Windows tests: 64 passed, 1 existing platform skip, 0 failed.
• Windows junction smoke: passed. Ordinary files were found; nested junctions and their external targets were not granted access or traversed. Exact-cap and overflowing truncated results were correct.
• Windows AppContainer/Broker smoke: passed.
• Packaged verify:windows-x64: passed, including cancellation recovery, parent-process exit cleanup, 64-launch concurrency, the adversarial matrix, node-pty, renderer, and Broker verification.

Reported artifacts:

Artifact	SHA-256
Maka-0.2.2-win-x64.exe	5983cca21ae10c2575fab2888475a353c5f8a1aae02e905014803c2b95cba8bc
Maka-0.2.2-win-x64.zip	1c334b74d76b3f7eb0ddf45402071b4a697db7dd6a34dca20ece4935758ba0d1

Artifacts are under C:\maka-pr3955-test\apps\desktop\release; full logs are retained locally at C:\maka-pr3955-evidence. This update records the contributor's Windows report; those local logs and artifact hashes have not been independently inspected from the macOS workspace.

Additional Windows validation limits: smoke:windows:dist passed its CLI checks, but native-window visibility remains unconfirmed (visible=false). The mixed full Runtime run reported 9 failures, with reported causes including symlink privileges and Linux/Unix-specific assumptions; a full Windows Runtime pass is not claimed. The new dot/hidden-directory Broker smoke cases in f1eabe8c0 still need a real Windows run; the Windows results above apply to parent 51a9bb2.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex analyzed and implemented the original scoped policy/traversal change and this current-main compatibility update, added regression tests, ran the local checks above, and updated documentation. The material update commit includes a Generated-by: Codex trailer. Native Windows results were supplied separately by the contributor. Human review is required before merge.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

简体中文

摘要

Windows W1 的只读递归 Glob 目前会因目录树中的嵌套 NTFS junction 拒绝整个搜索。本 PR 允许返回旁边的普通条目，同时跳过 junction 及其后代。

• 将内部 nonFollowingReadRoot 标记绑定到 Broker manifest 摘要，并把批准的根拆成有界的物理目录 ACL 授权。
• 枚举时不跟随 reparse entry，保持实际遍历次序，不额外排序；匹配集合以生产 globFiles 为对照。
• 合入最新核对的上游 main 222a06fe316f12df3129eff1c16ab3bfaf85c479，适配现有 files / truncated 契约：额外探测一个不同匹配，区分恰好达到上限和实际截断。
• 上限前的普通目录遍历错误正常报错；上限后的完整性探测失败保留已有结果并标记 truncated: true。
• 补齐可移植回归、真实 Windows Broker smoke、打包验证及中英文 RFC。

关联 #3938。

权限与清理边界

只有显式标记的只读 W1 Glob 采用新的准入方式。默认递归准入、Read/Write/Bash/Grep 权限和原有 ACL 清理规则保持不变。根必须是已声明的递归只读物理目录；写授权、reparse 根、多硬链接文件、无效策略或摘要不匹配仍然安全拒绝。

ACL 规划和枚举都跳过嵌套 reparse entry；目标通过物理路径独立获得的权限不受影响。规划仍限制为 4,096 条物理授权、100,000 个条目和根目录以下 256 层。此次同步没有修改原生 ledger 与 settlement 实现：确认 Job 结束后清理授权，无法确认时保留并隔离恢复证据。

直接声明的 minimatch@10.2.5 已在 main 的依赖闭包中；本轮没有降级依赖或携带旧版仅更新依赖的许可证清单差异。

本轮验证

当前提交：f1eabe8c0c0a508fc71455bcf43a67dd68c1627b，2026-10-25。

本轮修复两条 P2：终止位置的 .（含 **/.）正确匹配当前目录；显式隐藏条目匹配后不再携带递归 globstar 状态，避免多返回结果及误报截断。只改匹配状态和测试，未改准入或原生 ACL 清理。

• lint、格式、完整构建、完整类型检查及 Desktop/UI Knip 通过。
• Runtime：4,096 通过、14 跳过、0 失败。
• 定向回归：130 通过；Windows 专用 Broker smoke 按平台跳过。
• 新增 9 项可移植回归在父提交 51a9bb2 上全部失败，在本轮修复后通过。
• 临时生成 2,800 个模式与生产 globFiles 对比，匹配集合和小上限完整性判断 0 差异。

未改动部分的基线检查在父提交 51a9bb2 已通过：50 项 Windows 验证脚本测试及跳过清单检查、97 项 ASF 源码检查、Desktop/CLI 许可证清单校验、Rust 格式和 Windows MSVC 交叉检查。它们是基线记录，不代表本轮新增用例已在真实 Windows 执行。

Windows 原生验证（贡献者提供）

贡献者已在干净且与远端一致的 C:\maka-pr3955-test 上验证此前提交 51a9bb2daf29de50c2d7962edcd5facd8245e827，分支为 codex/fix-windows-glob-junctions。环境为 Node 24.18.1、npm 11.19.0、Cargo 1.98.0、PowerShell 7.6.6、Electron 43.5.0。

• npm ci、构建和类型检查通过。
• Rust Broker：62/62 通过。
• PR 聚焦测试：64 通过、1 个既有平台跳过、0 失败。
• junction smoke 通过：普通文件可被找到，嵌套 junction 及其外部目标不获授权、不被遍历；精确上限和溢出标记正确。
• AppContainer/Broker smoke 通过。
• 打包版 verify:windows-x64 通过，包含取消恢复、父进程退出清理、64 次并发、对抗矩阵、node-pty、渲染器和 Broker 验证。

产物及 SHA-256 见上方英文表格。完整日志保留在 Windows 本地 C:\maka-pr3955-evidence，本次记录依据贡献者的验证报告，未在 macOS 工作区独立检查这些本地日志或重新计算产物哈希。

补充验证限制：smoke:windows:dist 的 CLI 检查通过，原生窗口可见性仍未确认（visible=false）。混合完整 Runtime 测试报告 9 项失败，报告原因包括 symlink 权限及 Linux/Unix 专属假设；未宣称完整 Windows Runtime 全量通过。 上述 Windows 结果对应父提交 51a9bb2；本轮 f1eabe8c0 新增的点组件和隐藏目录 Broker smoke 仍需真实 Windows 复测。

[me2seeks]

Automated review notice: This comment was posted by an automated review agent operated by me2seeks make. It is not an independent human review and does not replace one.

Summary

Lets W1 Glob skip nested junctions on Windows: acl_ledger.rs gains a non_following_read_root grant kind — it must name a declared recursive readRoot and requires a read-only launch (rejected if any write roots exist), with hard bounds (MAX_NON_FOLLOWING_READ_GRANTS=4096, ENTRIES=100k, DEPTH=256) and a partition_non_following_read_root helper feeding upsert_ledger_root. Protocol tests, broker-authorization tests, windows-launcher tests, the RFC docs (en+zh), the experiments README, and the filesystem-worker client/Windows-smoke tests move in step; packages/runtime/package.json records the boundary. The direct-peer addon builds pass on all four platforms.

Findings

1. [P2] Third open PR for this fix — #3952 (fix(windows): let Glob skip nested junctions) and already-reviewed #4683 implement the same change in the same files. Maintain at most one; this one's non_following_read_root is the cleanest formulation of the three (named grant kind with explicit bounds and a read-only requirement), but the trio must be reconciled before any merges.
2. [P3] Only the addon-build lanes ran on this head — for a sandbox-grant change, the runtime test lane and windows_recovery must run green.

Verdict

needs-discussion — the strongest of the three implementations, but it must be reconciled with #3952/#4683 and get a real Windows test run.

[github-actions]

This pull request has had no new commits for 30 days and has been marked stale. It will be closed in 7 days unless a new commit is pushed.

Comments do not reset this timer: only a new commit does. If the pull request is intentionally long-lived, a maintainer can apply the pinned label.

[me2seeks]

Automated review notice: This review was performed by an automated agent operated by me2seeks. It is not an independent human review and does not replace one.

Reviewed current head 51a9bb2daf29de50c2d7962edcd5facd8245e827. Two reproducible matching regressions remain in the new Windows walker; see inline findings.

Validation on Linux / Node 24.22.1: 95 focused source-level filesystem-worker / Windows-policy tests passed, 50 Windows harness / package-closure / inventory tests passed, Rust formatting passed, and cargo check --locked --tests --target x86_64-pc-windows-msvc passed. The source-level tests reuse the installed dependency tree (glob 13.0.6 and minimatch 10.2.5). An additional 2,042-pattern comparison against production globFiles found 32 differing memberships, reduced to the two cases below. These are portable operation reproductions, not independently executed native Windows/AppContainer tests.

Hosted Windows packaging and recovery checks passed; the main CI test job was cancelled. The older duplicate PRs #3952 and #4683 are closed.

[me2seeks]

The two Glob matching regressions are fixed and covered by portable and Windows smoke regressions. Focused source tests, a 2,042-pattern parity comparison, formatting, Windows recovery/protocol, packaging, and the complete hosted CI checks pass. Reviewed at f1eabe8c0c0a508fc71455bcf43a67dd68c1627b.