[wan9chi]

Motivation

A task that makes a folder and leaves it empty can't be rebuilt by a hit today; astro build, for example, makes .astro/collections. fspy records nothing for mkdir, and the archive holds only files, so the folder holding the empty one stays pinned and a clean checkout misses.

Changes

• fspy records mkdir as a new access kind, Mkdir, before the call. This covers the Unix preload, the Linux seccomp supervisor and Windows NtCreateFile creating a directory; on Windows those calls were recorded as reads.
• A mkdir'd folder that is empty after the run is rebuildable and a starting point for the climb.
• The archive gets directory entries for those folders, filtered by output exclusions like files, and a restore recreates them.

E2E cases: empty_folder_in_output (synthetic) and astro_empty_collections (astro build with Astro 6.4.8, added to packages/tools with a scoped vite override; true clean checkout).

Part of a stack that lets automatic tracking cache tasks which read their own outputs and list the folders holding them, so they also hit on a clean checkout.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes cross-platform fspy interception and cache fingerprint/archive replay logic; incorrect tracking would cause false hits or misses, though the PR adds substantial unit and e2e tests.

Overview
Automatic file tracking now records paths created without a normal open: Mkdir for directory creation, RenameTarget for rename destinations, and hard-link destinations as writes. This is wired through Unix seccomp/preload, Windows NtCreateFile / NtSetInformationFile, and new IPC PathAccess variants (recorded even when the syscall fails).

Task cache builds on those signals in Rebuildable: empty post-run mkdir folders are outputs and skip input fingerprinting; folder renames expand to the files underneath for archiving and “may be missing” validation; gone temp dirs the task wrote in are treated like rebuildable outputs. Output tar.zst archives now include explicit empty directory entries, and cache restore recreates them.

E2E coverage adds empty_folder_in_output and astro_empty_collections (Astro 6 in dev deps); existing rename/Vitest snapshot fixtures now expect cache hits after deleting outputs.

^{Reviewed by Cursor Bugbot for commit e038c4c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​astro@​6.4.8

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	Critical CVE: Astro: Remote code execution through AVIF image optimization CVE: GHSA-26w7-cxv4-gfx2 Astro: Remote code execution through AVIF image optimization (CRITICAL) Affected versions: < 7.2.8 Patched version: 7.2.8 From: packages/tools/package.json → npm/astro@6.4.8 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/astro@6.4.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

[github-actions]

fspy benchmark

linux

dynamic/launch             change  +0.42%  [ -3.17% ..  +4.61%]  overhead   +59.74%
dynamic/access             change  -0.44%  [ -5.25% ..  +4.30%]  overhead   +19.90%
dynamic/access-relative    change  +0.00%  [ -3.60% ..  +4.10%]  overhead   +67.02%
dynamic/access-contended   change  -0.80%  [ -3.03% ..  +6.07%]  overhead   +34.87%
static/launch              change  +1.83%  [ -3.16% ..  +7.45%]  overhead  +193.92%
static/access              change  -0.39%  [ -4.45% ..  +2.69%]  overhead +1434.27%
static/access-relative     change  -0.75%  [ -3.11% ..  +1.29%]  overhead +1936.22%
static/access-contended    change  -0.07%  [ -2.09% ..  +1.73%]  overhead +2103.13%

macos

dynamic/launch             change  +0.61%  [ -4.28% ..  +4.74%]  overhead  +233.14%
dynamic/access             change  -0.68%  [ -6.64% ..  +6.23%]  overhead    -0.38%
dynamic/access-relative    change  +2.67%  [ -2.83% ..  +9.18%]  overhead  +264.92%
dynamic/access-contended   change  -2.09%  [ -7.51% ..  +5.53%]  overhead    +6.00%

windows

dynamic/launch             change  -0.37%  [ -9.78% ..  +7.10%]  overhead   +23.39%
dynamic/access             change  +0.19%  [ -1.09% ..  +0.93%]  overhead    +1.68%
dynamic/access-relative    change  +0.18%  [ -1.47% ..  +0.94%]  overhead    +0.94%
dynamic/access-contended   change  +0.18%  [ -1.07% ..  +1.24%]  overhead    +1.80%

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b81c7bb. Configure here.}