Path recovery: keep every write and delete inside the working tree #141

New Issue

2026-11-10T18:57:04Z

james.maes commented

2026-11-10 18:57:04 +00:00

Problem

Path recovery materializes a working tree itself (rename and skip choices for Windows-invalid paths) instead of using a git checkout. That code does its own file writes and deletes, and it is less careful than a checkout:

the list of previously written files in .git\gclo-recovery.json is used as-is to decide what to delete;
a path segment named .git is not treated as invalid;
writes follow existing links in the working tree;
cleanup of a failed clone follows directory links while clearing attributes.

Scope

One internal, fully tested WorkingTree helper for every write and delete the recovery does: the target must resolve inside the working directory, must not be in a .git folder, and must not be reached through a link; an existing file is replaced, never written through.
Validate the recovery file's stored paths when it is loaded; a file that lists a path outside the repository fails with a message that says how to rebuild it.
WindowsPathValidator: .git (any letter case) and its short-name alias are invalid segments, with a suggested replacement.
Cleanup of a failed clone does not follow links.
Threat model updated.

Acceptance

Tests for each rule, including a directory link inside the working tree and a recovery file with a path outside it. 100% line coverage holds; zero warnings; format clean.

## Problem Path recovery materializes a working tree itself (rename and skip choices for Windows-invalid paths) instead of using a git checkout. That code does its own file writes and deletes, and it is less careful than a checkout: - the list of previously written files in `.git\gclo-recovery.json` is used as-is to decide what to delete; - a path segment named `.git` is not treated as invalid; - writes follow existing links in the working tree; - cleanup of a failed clone follows directory links while clearing attributes. ## Scope - One internal, fully tested `WorkingTree` helper for every write and delete the recovery does: the target must resolve inside the working directory, must not be in a `.git` folder, and must not be reached through a link; an existing file is replaced, never written through. - Validate the recovery file's stored paths when it is loaded; a file that lists a path outside the repository fails with a message that says how to rebuild it. - `WindowsPathValidator`: `.git` (any letter case) and its short-name alias are invalid segments, with a suggested replacement. - Cleanup of a failed clone does not follow links. - Threat model updated. ## Acceptance Tests for each rule, including a directory link inside the working tree and a recovery file with a path outside it. 100% line coverage holds; zero warnings; format clean.

james.maes added the bug quality labels 2026-11-10 18:57:04 +00:00

james.maes referenced this issue from a commit

2026-11-10 19:02:57 +00:00

fix(recovery): keep every write and delete inside the working tree

james.maes referenced a pull request that will close this issue

2026-11-10 19:03:40 +00:00

fix(recovery): keep every write and delete inside the working tree #142

james.maes referenced this issue from a commit

2026-11-10 19:32:36 +00:00

fix(recovery): names Windows opens differently, real links only, safe cleanup

james.maes referenced this issue from a commit

2026-11-10 19:33:12 +00:00