[wan9chi]

Motivation

A task that makes a folder and leaves it empty can't be rebuilt by a hit today; astro build, for example, makes .astro/collections. fspy records nothing for mkdir, and the archive holds only files, so the folder holding the empty one stays pinned and a clean checkout misses.

Changes

• fspy records mkdir as a new access kind, Mkdir, before the call. This covers the Unix preload, the Linux seccomp supervisor and Windows NtCreateFile creating a directory; on Windows those calls were recorded as reads.
• A mkdir'd folder that is empty after the run is rebuildable and a starting point for the climb.
• The archive gets directory entries for those folders, filtered by output exclusions and ignoreOutput like files: all of them with automatic output tracking, otherwise those an output glob matches. A restore recreates them.
• Each folder is listed once: a mkdir'd folder above a written path is decided by the climb.

E2E cases: empty_folder_in_output and empty_folder_in_output_globs (synthetic; automatic outputs and explicit output globs) and astro_empty_collections (astro build with Astro 6.4.8, added to packages/tools with a scoped vite override; true clean checkout).

Part of a stack that lets automatic tracking cache tasks which read their own outputs and list the folders holding them, so they also hit on a clean checkout.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes core cache fingerprinting, output archiving, and cross-platform fspy semantics; incorrect mkdir or empty-folder handling could cause false cache hits or incomplete restores.

Overview
Cache hits now recreate empty directories the task created (e.g. Astro’s .astro/collections), instead of leaving them missing and forcing misses when a parent folder was deleted.

fspy gains a Mkdir access kind: Unix mkdir / mkdirat (preload + seccomp) and Windows directory NtCreateFile (FILE_CREATE / FILE_OPEN_IF + FILE_DIRECTORY_FILE) are recorded as mkdir, not as reads. Failed mkdirs are still logged, matching rename-target behavior.

Rebuild / fingerprint / archive pipeline: empty task-made folders are treated as rebuildable (skipped in input fingerprints like other output-only trees), collected into empty_folders, written into the output tar.zst as directory entries, and restored on replay. With automatic outputs, all such folders are archived; with explicit output globs, only paths the globs match. Parent folders that hold only rebuildable outputs can be absent on a clean checkout without invalidating the fingerprint.

Adds e2e snapshots for a synthetic empty-folder task (with and without globs) and astro build (Astro 6 in packages/tools).

^{Reviewed by Cursor Bugbot for commit 5cdc29e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​astro@​6.4.8

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	Critical CVE: Astro: Remote code execution through AVIF image optimization CVE: GHSA-26w7-cxv4-gfx2 Astro: Remote code execution through AVIF image optimization (CRITICAL) Affected versions: < 7.2.8 Patched version: 7.2.8 From: packages/tools/package.json → npm/astro@6.4.8 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/astro@6.4.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

[github-actions]

fspy benchmark

linux

dynamic/launch             change  +0.06%  [ -3.38% ..  +4.64%]  overhead   +56.75%
dynamic/access             change  -1.24%  [ -5.21% ..  +2.46%]  overhead   +19.76%
dynamic/access-relative    change  -0.60%  [ -3.20% ..  +2.97%]  overhead   +68.73%
dynamic/access-contended   change  -1.65%  [ -7.74% ..  +4.93%]  overhead   +47.53%
static/launch              change  +1.56%  [ -1.45% ..  +5.88%]  overhead  +199.82%
static/access              change  -0.09%  [ -1.11% ..  +1.36%]  overhead +1448.40%
static/access-relative     change  -0.36%  [ -1.95% ..  +0.76%]  overhead +1935.48%
static/access-contended    change  +0.66%  [ -3.42% ..  +7.74%]  overhead +1925.80%

macos

dynamic/launch             change  +0.70%  [ -3.53% ..  +5.04%]  overhead  +241.84%
dynamic/access             change  +0.33%  [ -2.11% ..  +2.49%]  overhead    +5.26%
dynamic/access-relative    change  +2.42%  [ -0.49% ..  +6.20%]  overhead  +267.39%
dynamic/access-contended   change  +0.89%  [ -6.95% ..  +7.70%]  overhead    +4.68%

windows

dynamic/launch             change  -0.50%  [ -4.06% ..  +3.08%]  overhead   +27.75%
dynamic/access             change  -0.36%  [ -1.46% ..  +0.75%]  overhead    +1.13%
dynamic/access-relative    change  +0.18%  [ -0.55% ..  +0.73%]  overhead    +1.47%
dynamic/access-contended   change  -0.18%  [ -1.41% ..  +0.89%]  overhead    +1.43%

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b81c7bb. Configure here.}