Documentation
¶
Overview ¶
Package pathutil contains small, dependency-free path helpers shared across aiwf packages. The helpers are designed to fail closed: when input is unusable (relative paths, empty strings, broken symlinks), they return false / an error rather than guessing.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrNotAbsolute = errors.New("path must be absolute")
ErrNotAbsolute is returned by Resolve when its input is a relative path. Callers are expected to make paths absolute before calling Resolve (typically via filepath.Join with an absolute repo root).
Functions ¶
func AtomicWriteFile ¶ added in v0.14.0
AtomicWriteFile writes data to path so that a crash or hard kill mid-write never leaves a half-written file at path: the bytes go to a sibling temp file first, are fsynced to disk, and the temp file is renamed over path in a single atomic step. Readers see either the old content or the new content, never a truncated mix (G-0221).
The temp file lives in path's parent directory so the final os.Rename never crosses a filesystem boundary. perm is applied to the temp file before the rename, so the final file carries exactly the requested mode (unlike os.WriteFile, umask does not apply). The temp file is removed on every error path.
Two deliberate semantic edges: a symlink at path is replaced by a regular file rather than written through (os.Rename semantics), and the parent directory is not fsynced after the rename — the file's *content* is durable and the swap is atomic, but the rename itself may be lost on power failure, leaving the old file intact. Both match the canonical sequence G-0221 specifies.
func Inside ¶
Inside reports whether candidate, after cleaning, lies at or under root. Both paths must be absolute; relative inputs return false.
The check appends a path separator to root before prefix-matching so that "/repo" does not match "/repository". Paths equal to root are considered inside.
func Resolve ¶
Resolve returns candidate with symlinks evaluated and the result cleaned. candidate must be absolute; relative inputs return ErrNotAbsolute so callers fail closed instead of silently joining against an unrelated working directory.
If the path does not exist, Resolve returns the cleaned absolute form (lexical fallback) and a nil error so callers can still report a clean "missing" finding rather than crashing.
Broken symlinks and symlink loops produce errors — they are treated as "unresolvable" so callers fail closed.
Types ¶
This section is empty.
Source Files