cache: confine storage I/O with os.Root

Hold an os.Root for the cache directory instead of a path string in
CAS and ActionCache. Every entry read, write, rename, and eviction now
goes through the root, so no entry name — hash-derived or deserialized
from an action cache entry — can traverse outside the cache directory.

Cache handles now hold a directory fd, so Open gains a matching Close:
the analyzer opens the cache once per instance and closes it with the
analyzer, and the WASM runner closes it after loading a plugin.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MPgq3rwip76D554BktbqR4

Author: claude

internal/analyzer/analyzer.go

@@ -20,6 +20,7 @@ type CachedAnalyzer struct {
 	config      config.Config
 	configBytes []byte
 	db          config.Database
+	store       *cache.Cache
 }
 
 func Cached(a Analyzer, c config.Config, db config.Database) *CachedAnalyzer {
@@ -53,12 +54,17 @@ func (c *CachedAnalyzer) analyze(ctx context.Context, n ast.Node, q string, sche
 		return nil, true, nil
 	}
 
-	store, err := cache.Open()
-	if err != nil {
-		return nil, true, err
+	if c.store == nil {
+		var err error
+		c.store, err = cache.Open()
+		if err != nil {
+			return nil, true, err
+		}
 	}
+	store := c.store
 
 	if c.configBytes == nil {
+		var err error
 		c.configBytes, err = json.Marshal(c.config)
 		if err != nil {
 			return nil, true, err
@@ -113,6 +119,9 @@ func (c *CachedAnalyzer) analyze(ctx context.Context, n ast.Node, q string, sche
 }
 
 func (c *CachedAnalyzer) Close(ctx context.Context) error {
+	if c.store != nil {
+		c.store.Close()
+	}
 	return c.a.Close(ctx)
 }
 

internal/cache/action.go

@@ -2,6 +2,7 @@ package cache
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io/fs"
 	"os"
@@ -22,17 +23,21 @@ type ActionResult struct {
 // entries are not self-validating — the value is not derivable from the key —
 // so Get additionally checks that every referenced output still exists in the
 // CAS before reporting a hit, exactly like Bazel's disk cache does.
+//
+// Entry I/O goes through the same os.Root as the CAS, confining every read
+// and write to the cache directory.
 type ActionCache struct {
-	root string
+	root *os.Root
 	cas  *CAS
 }
 
-func newActionCache(root string, cas *CAS) *ActionCache {
+func newActionCache(root *os.Root, cas *CAS) *ActionCache {
 	return &ActionCache{root: root, cas: cas}
 }
 
+// path returns an entry's path relative to the cache root.
 func (a *ActionCache) path(d Digest) string {
-	return filepath.Join(a.root, "ac", d.Hash[:2], d.Hash)
+	return filepath.Join("ac", d.Hash[:2], d.Hash)
 }
 
 // Get returns the cached result for an action, or ErrNotFound on a miss. An
@@ -43,21 +48,21 @@ func (a *ActionCache) Get(action Digest) (*ActionResult, error) {
 		return nil, ErrNotFound
 	}
 	path := a.path(action)
-	data, err := os.ReadFile(path)
+	data, err := a.root.ReadFile(path)
 	if err != nil {
-		if os.IsNotExist(err) {
+		if errors.Is(err, fs.ErrNotExist) {
 			return nil, ErrNotFound
 		}
 		return nil, fmt.Errorf("cache: %w", err)
 	}
 	var result ActionResult
 	if err := json.Unmarshal(data, &result); err != nil {
-		os.Remove(path)
+		a.root.Remove(path)
 		return nil, ErrNotFound
 	}
 	for _, d := range result.Outputs {
 		if !a.cas.Contains(d) {
-			os.Remove(path)
+			a.root.Remove(path)
 			return nil, ErrNotFound
 		}
 	}
@@ -99,8 +104,8 @@ func (a *ActionCache) PutTree(action Digest, dir string) error {
 
 // GetTree materializes a cached action's outputs as files under dir, or
 // returns ErrNotFound on a miss. Files already present with the right size
-// are left in place; missing ones are staged and renamed so concurrent
-// processes never observe partial files.
+// are left in place; missing ones are staged in their destination directory
+// and renamed so concurrent processes never observe partial files.
 func (a *ActionCache) GetTree(action Digest, dir string) error {
 	result, err := a.Get(action)
 	if err != nil {
@@ -118,7 +123,7 @@ func (a *ActionCache) GetTree(action Digest, dir string) error {
 		if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
 			return fmt.Errorf("cache: %w", err)
 		}
-		f, err := os.CreateTemp(a.cas.tmp, d.Hash[:8]+"-*")
+		f, err := os.CreateTemp(filepath.Dir(path), d.Hash[:8]+"-*")
 		if err != nil {
 			return fmt.Errorf("cache: %w", err)
 		}
@@ -153,22 +158,22 @@ func (a *ActionCache) Put(action Digest, result *ActionResult) error {
 		return fmt.Errorf("cache: %w", err)
 	}
 	path := a.path(action)
-	if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+	if err := a.root.MkdirAll(filepath.Dir(path), 0755); err != nil {
 		return fmt.Errorf("cache: %w", err)
 	}
-	f, err := os.CreateTemp(a.cas.tmp, action.Hash[:8]+"-*")
+	f, name, err := a.cas.createTemp(action.Hash[:8] + "-")
 	if err != nil {
 		return fmt.Errorf("cache: %w", err)
 	}
-	defer os.Remove(f.Name())
+	defer a.root.Remove(name)
 	if _, err := f.Write(data); err != nil {
 		f.Close()
 		return fmt.Errorf("cache: %w", err)
 	}
 	if err := f.Close(); err != nil {
 		return fmt.Errorf("cache: %w", err)
 	}
-	if err := os.Rename(f.Name(), path); err != nil {
+	if err := a.root.Rename(name, path); err != nil {
 		return fmt.Errorf("cache: %w", err)
 	}
 	return nil

internal/cache/cache.go

@@ -24,9 +24,11 @@ import (
 	"path/filepath"
 )
 
-// Cache bundles the CAS and the action cache that shares it.
+// Cache bundles the CAS and the action cache that shares it. All storage
+// I/O is confined to the cache directory through an os.Root; callers should
+// Close the cache when finished with it to release the root.
 type Cache struct {
-	root    string
+	root    *os.Root
 	CAS     *CAS
 	Actions *ActionCache
 }
@@ -56,9 +58,17 @@ func Open() (*Cache, error) {
 
 // OpenAt returns the cache rooted at the given directory, creating it if
 // necessary.
-func OpenAt(root string) (*Cache, error) {
+func OpenAt(dir string) (*Cache, error) {
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		return nil, fmt.Errorf("failed to create %s directory: %w", dir, err)
+	}
+	root, err := os.OpenRoot(dir)
+	if err != nil {
+		return nil, fmt.Errorf("cache: %w", err)
+	}
 	cas, err := newCAS(root)
 	if err != nil {
+		root.Close()
 		return nil, err
 	}
 	return &Cache{
@@ -68,15 +78,20 @@ func OpenAt(root string) (*Cache, error) {
 	}, nil
 }
 
+// Close releases the cache's handle on its root directory.
+func (c *Cache) Close() error {
+	return c.root.Close()
+}
+
 // ExecDir returns a stable directory for materializing the output tree of
 // the given action, for tools that need their outputs on disk (like wazero's
 // compilation cache). It lives at exec/<action-hash> under the cache root
 // and, like everything else in the cache, is safe to delete at any time: the
 // authoritative copy of its contents is the CAS.
 func (c *Cache) ExecDir(action Digest) (string, error) {
-	dir := filepath.Join(c.root, "exec", action.Hash)
-	if err := os.MkdirAll(dir, 0755); err != nil {
-		return "", fmt.Errorf("failed to create %s directory: %w", dir, err)
+	rel := filepath.Join("exec", action.Hash)
+	if err := c.root.MkdirAll(rel, 0755); err != nil {
+		return "", fmt.Errorf("failed to create %s directory: %w", rel, err)
 	}
-	return dir, nil
+	return filepath.Join(c.root.Name(), rel), nil
 }

internal/cache/cache_test.go

@@ -4,6 +4,7 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"errors"
+	"io/fs"
 	"os"
 	"path/filepath"
 	"testing"
@@ -15,6 +16,7 @@ func testCache(t *testing.T) *Cache {
 	if err != nil {
 		t.Fatal(err)
 	}
+	t.Cleanup(func() { c.Close() })
 	return c
 }
 
@@ -66,14 +68,14 @@ func TestCASCorruptionEvicted(t *testing.T) {
 
 	// Corrupt the blob on disk while keeping its size.
 	path := c.CAS.path(d)
-	if err := os.WriteFile(path, []byte("tampered contents"), 0644); err != nil {
+	if err := c.CAS.root.WriteFile(path, []byte("tampered contents"), 0644); err != nil {
 		t.Fatal(err)
 	}
 
 	if _, err := c.CAS.Get(d); !errors.Is(err, ErrNotFound) {
 		t.Errorf("want ErrNotFound for corrupt blob, got %v", err)
 	}
-	if _, err := os.Stat(path); !os.IsNotExist(err) {
+	if _, err := c.CAS.root.Stat(path); !errors.Is(err, fs.ErrNotExist) {
 		t.Error("corrupt blob was not evicted")
 	}
 }
@@ -89,7 +91,7 @@ func TestCASPutRepairsCorruptEntry(t *testing.T) {
 	// Corrupt the entry on disk with different-sized contents, then Put the
 	// correct blob again: the entry must be repaired, not trusted.
 	path := c.CAS.path(d)
-	if err := os.WriteFile(path, append(blob, "tampered"...), 0644); err != nil {
+	if err := c.CAS.root.WriteFile(path, append(blob, "tampered"...), 0644); err != nil {
 		t.Fatal(err)
 	}
 	if _, err := c.CAS.Put(blob); err != nil {
@@ -201,7 +203,7 @@ func TestActionCacheMissingOutputIsMiss(t *testing.T) {
 	}
 
 	// Simulate the blob being garbage collected out from under the entry.
-	if err := os.Remove(c.CAS.path(out)); err != nil {
+	if err := c.CAS.root.Remove(c.CAS.path(out)); err != nil {
 		t.Fatal(err)
 	}
 

internal/cache/cas.go

@@ -3,8 +3,11 @@ package cache
 import (
 	"errors"
 	"fmt"
+	"io/fs"
+	"math/rand/v2"
 	"os"
 	"path/filepath"
+	"strconv"
 )
 
 // ErrNotFound is returned when a blob or action result is not in the cache.
@@ -19,21 +22,37 @@ var ErrNotFound = errors.New("cache: not found")
 // Content with an externally declared checksum (remotely fetched plugins)
 // needs no action cache entry: the declared sha256 is the address, so it is
 // stored and loaded directly — see SHA256Digest.
+//
+// All I/O goes through an os.Root, so no entry name — hash-derived or read
+// from an action cache entry — can escape the cache directory.
 type CAS struct {
-	root string
-	tmp  string
+	root *os.Root
 }
 
-func newCAS(root string) (*CAS, error) {
-	tmp := filepath.Join(root, "tmp")
-	if err := os.MkdirAll(tmp, 0755); err != nil {
-		return nil, fmt.Errorf("cache: create %s: %w", tmp, err)
+func newCAS(root *os.Root) (*CAS, error) {
+	if err := root.MkdirAll("tmp", 0755); err != nil {
+		return nil, fmt.Errorf("cache: create tmp: %w", err)
 	}
-	return &CAS{root: root, tmp: tmp}, nil
+	return &CAS{root: root}, nil
 }
 
+// path returns a blob's path relative to the cache root.
 func (c *CAS) path(d Digest) string {
-	return filepath.Join(c.root, "cas", d.Hash[:2], d.Hash)
+	return filepath.Join("cas", d.Hash[:2], d.Hash)
+}
+
+// createTemp creates a staging file under tmp/ in the cache root, returning
+// the open file and its root-relative name.
+func (c *CAS) createTemp(prefix string) (*os.File, string, error) {
+	for range 10000 {
+		name := filepath.Join("tmp", prefix+strconv.FormatUint(rand.Uint64(), 36))
+		f, err := c.root.OpenFile(name, os.O_RDWR|os.O_CREATE|os.O_EXCL, 0644)
+		if errors.Is(err, fs.ErrExist) {
+			continue
+		}
+		return f, name, err
+	}
+	return nil, "", errors.New("cache: could not create temp file")
 }
 
 // Put stores a blob and returns its digest. Writing is atomic: the blob is
@@ -45,25 +64,25 @@ func (c *CAS) Put(data []byte) (Digest, error) {
 	// Skip the write only when an entry of the right size already exists; a
 	// wrong-sized entry is corrupt and is atomically replaced by the rename
 	// below.
-	if fi, err := os.Stat(path); err == nil && fi.Size() == d.SizeBytes {
+	if fi, err := c.root.Stat(path); err == nil && fi.Size() == d.SizeBytes {
 		return d, nil
 	}
-	if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+	if err := c.root.MkdirAll(filepath.Dir(path), 0755); err != nil {
 		return Digest{}, fmt.Errorf("cache: %w", err)
 	}
-	f, err := os.CreateTemp(c.tmp, d.Hash[:8]+"-*")
+	f, name, err := c.createTemp(d.Hash[:8] + "-")
 	if err != nil {
 		return Digest{}, fmt.Errorf("cache: %w", err)
 	}
-	defer os.Remove(f.Name())
+	defer c.root.Remove(name)
 	if _, err := f.Write(data); err != nil {
 		f.Close()
 		return Digest{}, fmt.Errorf("cache: %w", err)
 	}
 	if err := f.Close(); err != nil {
 		return Digest{}, fmt.Errorf("cache: %w", err)
 	}
-	if err := os.Rename(f.Name(), path); err != nil {
+	if err := c.root.Rename(name, path); err != nil {
 		return Digest{}, fmt.Errorf("cache: %w", err)
 	}
 	return d, nil
@@ -77,15 +96,15 @@ func (c *CAS) Get(d Digest) ([]byte, error) {
 		return nil, ErrNotFound
 	}
 	path := c.path(d)
-	data, err := os.ReadFile(path)
+	data, err := c.root.ReadFile(path)
 	if err != nil {
-		if os.IsNotExist(err) {
+		if errors.Is(err, fs.ErrNotExist) {
 			return nil, ErrNotFound
 		}
 		return nil, fmt.Errorf("cache: %w", err)
 	}
 	if DigestOf(data).Hash != d.Hash {
-		os.Remove(path)
+		c.root.Remove(path)
 		return nil, ErrNotFound
 	}
 	return data, nil
@@ -98,7 +117,7 @@ func (c *CAS) Contains(d Digest) bool {
 	if !d.valid() {
 		return false
 	}
-	fi, err := os.Stat(c.path(d))
+	fi, err := c.root.Stat(c.path(d))
 	if err != nil {
 		return false
 	}

internal/ext/wasm/wasm.go

@@ -58,6 +58,7 @@ func (r *Runner) loadAndCompile(ctx context.Context) (*runtimeAndCode, error) {
 	if err != nil {
 		return nil, err
 	}
+	defer store.Close()
 	value, err, _ := flight.Do(expected, func() (any, error) {
 		return r.loadAndCompileWASM(ctx, store, expected)
 	})