std/fs: File.owner, the owner id of a file (native, step 1 of #293)

orion commented

2026-10-26 09:57:11 +00:00

Collaborator

Step 1 of #293 (the owner half of #288 criterion 3). Commit 1 of the two-commit rule (compiler/CONTRIBUTING.md, "Two commits for a breaking change"): the native is added and not used by the compiler; the seed is refreshed from it by the owner; step 2 (use in uploadDirectory, the registry.trb body writes) follows from #293 afterwards.

Goal. std/fs can answer who owns a file or directory, so a later change can refuse an upload directory of another user. Today Metadata carries kind, size, modification time and permissions only, and std/os has only the process's own Posix.effectiveUserIdentifier().

Design (decided by the loop). A new native beside fileMetadata in std/fs/src/lib.trb (not a changed signature of fileMetadata: the seed's compiler reaches it), implemented in runtime/ for POSIX (st_uid of lstat/stat per a follow flag, same as fileMetadata), and a method on File in std naming, e.g. File.owner(path) answering Result<Int64, IoError> (same type as Posix.effectiveUserIdentifier). Where there is no owner id (Windows, the browser) it answers an unsupported IoError, the way the other platform-limited File operations do.

Acceptance criteria

The native is declared in std/fs/src/lib.trb, implemented in runtime/ (POSIX), entered in docs/design/NATIVES.md and the natives manifest, with the generated table regenerated.
File.owner answers the owner id of a file, of a directory, and of a symbolic link per follow; an IoError naming the path for a missing path; an unsupported error on Windows and in the browser.
A std test (owner of a fresh temporary file equals Posix.effectiveUserIdentifier(); a missing path fails) and a runtime test.
Nothing under compiler/src/ calls the new function (the seed must know it first).

Seed. Yes: a new native, commit 1 of two. The seed refresh is the owner's step; #293 stays open for step 2 (waits on the refreshed seed).

Step 1 of #293 (the owner half of #288 criterion 3). Commit 1 of the two-commit rule (`compiler/CONTRIBUTING.md`, "Two commits for a breaking change"): the native is added and **not used by the compiler**; the seed is refreshed from it by the owner; step 2 (use in `uploadDirectory`, the `registry.trb` body writes) follows from #293 afterwards. **Goal.** `std/fs` can answer who owns a file or directory, so a later change can refuse an upload directory of another user. Today `Metadata` carries kind, size, modification time and permissions only, and `std/os` has only the process's own `Posix.effectiveUserIdentifier()`. **Design (decided by the loop).** A new native beside `fileMetadata` in `std/fs/src/lib.trb` (not a changed signature of `fileMetadata`: the seed's compiler reaches it), implemented in `runtime/` for POSIX (`st_uid` of `lstat`/`stat` per a `follow` flag, same as `fileMetadata`), and a method on `File` in std naming, e.g. `File.owner(path)` answering `Result<Int64, IoError>` (same type as `Posix.effectiveUserIdentifier`). Where there is no owner id (Windows, the browser) it answers an unsupported `IoError`, the way the other platform-limited `File` operations do. **Acceptance criteria** - [ ] The native is declared in `std/fs/src/lib.trb`, implemented in `runtime/` (POSIX), entered in `docs/design/NATIVES.md` and the natives manifest, with the generated table regenerated. - [ ] `File.owner` answers the owner id of a file, of a directory, and of a symbolic link per `follow`; an `IoError` naming the path for a missing path; an unsupported error on Windows and in the browser. - [ ] A std test (owner of a fresh temporary file equals `Posix.effectiveUserIdentifier()`; a missing path fails) and a runtime test. - [ ] Nothing under `compiler/src/` calls the new function (the seed must know it first). **Seed.** Yes: a new native, commit 1 of two. The seed refresh is the owner's step; #293 stays open for step 2 (waits on the refreshed seed).

orion added the

loop

ready

labels

2026-10-26 09:57:20 +00:00

orion referenced this issue

2026-10-26 09:57:20 +00:00

Request helper: refuse an upload directory of another user, and the body writes of registry.trb #293

orion commented

2026-10-26 10:05:05 +00:00

Author

Collaborator

[loop:torbscript] claim implement by session:loop-torbscript-20261026-1044 until 2026-10-26T16:05:05Z

orion commented

2026-10-26 10:08:06 +00:00

Author

Collaborator

[loop:torbscript] implement: checkpoint, context guard reached; branch loop/496-file-owner pushed (no PR yet).

Done (commit "feat(std/fs): add File.owner and File.linkOwner", checkpoint, to be amended before the PR):

runtime: torb_platform_owner (platform.c: POSIX st_uid via stat/lstat per follow; Windows and emscripten answer "Operation not supported"), torb_file_owner (file.c), prototypes in runtime/include/torb.h, C test the_owner_of_a_file_a_directory_and_a_link_is_the_user_who_made_them in runtime/tests/file_test.c.
std/fs: native fn fileOwner(path, follow, var owner: Int64, var failure): Bool, File.owner / File.linkOwner (Result<Int64, IoError>) in std/fs/src/lib.trb.

Still open:

Manifest row in compiler/src/backend/c/natives.trb after fileMetadata: runtimeOf("fileOwner", "torb_file_owner", "bool torb_file_owner(torb_text path, bool follow, int64_t *owner, torb_text *failure);").
Regenerated runtime/include/torb_natives.h and runtime/machine_natives.c (no torb binary in the worker exec: insert the prototype/thunk in the sorted position and renumber the thunks and the table by script; compiler/tests/natives.test.trb in CI asserts the files equal the render).
docs/design/NATIVES.md: row fileOwner | Runtime | keep | file and the audit counts (keep +1, total +1).
std test in std/fs/tests/files.test.trb (group "metadata"/new "owner": fresh temp file equals Posix.effectiveUserIdentifier() via use Posix from "std/os/posix/native", arm per OperatingSystem.current; missing path fails; Windows/Browser unsupported).
docs page for std/fs + skills/ regeneration (CI torb docs skill --check), then PR (Part of #293, Closes #496), ci-wait.sh.

Next: implement (continue), worktree: ~/workspaces/orion/code/tmp-496 on branch loop/496-file-owner. Rough usage so far: ~100k tokens.

[loop:torbscript] implement: checkpoint, context guard reached; branch `loop/496-file-owner` pushed (no PR yet). Done (commit "feat(std/fs): add File.owner and File.linkOwner", checkpoint, to be amended before the PR): - runtime: `torb_platform_owner` (platform.c: POSIX `st_uid` via stat/lstat per `follow`; Windows and emscripten answer "Operation not supported"), `torb_file_owner` (file.c), prototypes in `runtime/include/torb.h`, C test `the_owner_of_a_file_a_directory_and_a_link_is_the_user_who_made_them` in `runtime/tests/file_test.c`. - std/fs: `native fn fileOwner(path, follow, var owner: Int64, var failure): Bool`, `File.owner` / `File.linkOwner` (Result<Int64, IoError>) in `std/fs/src/lib.trb`. Still open: 1. Manifest row in `compiler/src/backend/c/natives.trb` after `fileMetadata`: `runtimeOf("fileOwner", "torb_file_owner", "bool torb_file_owner(torb_text path, bool follow, int64_t *owner, torb_text *failure);")`. 2. Regenerated `runtime/include/torb_natives.h` and `runtime/machine_natives.c` (no torb binary in the worker exec: insert the prototype/thunk in the sorted position and renumber the thunks and the table by script; `compiler/tests/natives.test.trb` in CI asserts the files equal the render). 3. `docs/design/NATIVES.md`: row `fileOwner | Runtime | keep | file` and the audit counts (keep +1, total +1). 4. std test in `std/fs/tests/files.test.trb` (group "metadata"/new "owner": fresh temp file equals `Posix.effectiveUserIdentifier()` via `use Posix from "std/os/posix/native"`, arm per `OperatingSystem.current`; missing path fails; Windows/Browser unsupported). 5. docs page for std/fs + `skills/` regeneration (CI `torb docs skill --check`), then PR (`Part of #293`, `Closes #496`), `ci-wait.sh`. Next: implement (continue), worktree: ~/workspaces/orion/code/tmp-496 on branch loop/496-file-owner. Rough usage so far: ~100k tokens.

orion commented

2026-10-26 10:15:10 +00:00

Author

Collaborator

[loop:torbscript] claim implement (continuation 1) by session:loop-torbscript-20261026-1044 until 2026-10-26T16:15:10Z

orion referenced this issue from a pull request that will close it,

2026-10-26 10:17:35 +00:00

feat(std/fs): add File.owner and File.linkOwner #499

argus closed this issue

2026-10-26 11:43:16 +00:00

orion commented

2026-10-26 11:43:23 +00:00

Author

Collaborator

[loop:torbscript] implement: PR #499 opened (one commit feat(std/fs): add File.owner and File.linkOwner, Part of #293 / Closes #496); forge CI green on 8fefad3b (gates, tier A and B, bootstrap, every host emits the same C, pdisc, commit messages; the hand-generated natives table matched the render). Nothing under compiler/src/ calls the new native (seed refresh stays the owner's step), next: review (Argus). Rough usage of this continuation: ~120k tokens.

[loop:torbscript] implement: PR https://git.torb.dev/torbscript/language/pulls/499 opened (one commit `feat(std/fs): add File.owner and File.linkOwner`, `Part of #293` / `Closes #496`); forge CI green on 8fefad3b (gates, tier A and B, bootstrap, every host emits the same C, pdisc, commit messages; the hand-generated natives table matched the render). Nothing under compiler/src/ calls the new native (seed refresh stays the owner's step), next: review (Argus). Rough usage of this continuation: ~120k tokens.

Rows
Columns

std/fs: File.owner, the owner id of a file (native, step 1 of #293) #496