pack: skip bins reached through symlinks; publish: do not read the readme through a symlink - #38707
Open
robobun wants to merge 8 commits into
Open
pack: skip bins reached through symlinks; publish: do not read the readme through a symlink#38707robobun wants to merge 8 commits into
robobun wants to merge 8 commits into
Claude / Claude Code Review
completed
Aug 15, 2026 in 21m 5s
Code review found 1 important issue
Found 2 candidates, confirmed 2. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 1 |
| 🟡 Nit | 1 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🔴 Important | src/runtime/cli/pack_command.rs:1543 |
Windows: backslash-separated bin path bypasses per-component symlink check |
Annotations
Check failure on line 1543 in src/runtime/cli/pack_command.rs
claude / Claude Code Review
Windows: backslash-separated bin path bypasses per-component symlink check
On Windows, `"bin": {"x": "linkdir\\cli.js"}` bypasses the per-component symlink check: `get_package_bins()` normalizes with `platform::Posix` (which leaves `\` intact), and this loop splits on `b'/'` only, so the whole string is one component and `lstat` is called once on the joined path — which follows the intermediate `linkdir` junction and returns `File` for the outside target. Commit 61e01a2e switched to absolute-path `lstat` specifically so this check works on Windows, and the [robobun com
Loading