install: prune stale workspace node_modules in hoisted installs - #29794
Open
robobun wants to merge 8 commits into
Open
install: prune stale workspace node_modules in hoisted installs#29794robobun wants to merge 8 commits into
robobun wants to merge 8 commits into
Claude / Claude Code Review
completed
Aug 15, 2026 in 25m 40s
Code review found 2 potential issues
Found 1 candidates, confirmed 2. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 0 |
| 🟡 Nit | 2 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟡 Nit | src/install/hoisted_install.rs:823-827 |
prune_scoped_node_modules follows @scope symlinks; sibling prune.rs uses O_NOFOLLOW |
Annotations
Check warning on line 827 in src/install/hoisted_install.rs
claude / Claude Code Review
prune_scoped_node_modules follows @scope symlinks; sibling prune.rs uses O_NOFOLLOW
`prune_scoped_node_modules` opens the `@scope` entry via `sys::open_dir_for_iteration` (no `O_NOFOLLOW`), so if `packages/<ws>/node_modules/@scope` is a symlink it descends into the target and `delete_tree()`s entries there — outside the workspace's `node_modules`. The sibling deletion code in `prune.rs` guards this exact descent with `open_real_subdir` (lstat + `O::NOFOLLOW`, prune.rs:1168/1325); reuse that helper (or add the same lstat/`O_NOFOLLOW` guard) here to match the established defensiv
Loading