fix(tools): preserve rss scan accounting

Charge fs_list examination slots for non-UTF8 and vanished dirents, increment dirs_visited at walk entry before file-cap checks, and decode nested clock overflow codes instead of collapsing them to cancelled.

Author: fffonion

rss/tools/search_files.rss

@@ -698,8 +698,8 @@ fn observe_limits(state: map) -> map {
     let tick: map = cap::clock_monotonic_ms(types::map_string(state, "token", ""));
     if map_bool(tick, "ok", false) == false {
         state.fatal = true;
-        state.fatal_code = types::map_string(tick, "code", "cancelled");
-        state.fatal_message = types::map_string(tick, "message", "clock failed");
+        state.fatal_code = types::map_string(types::map_map(tick, "error"), "code", "internal_error");
+        state.fatal_message = types::map_string(types::map_map(tick, "error"), "message", "capability failed");
         state.stop = true;
     } else {
         let now: int = map_int(tick, "ms", 0);
@@ -734,6 +734,7 @@ fn observe_limits(state: map) -> map {
 }
 
 fn walk_search(state: map, path: string, depth: int) -> map {
+    state.dirs_visited = map_int(state, "dirs_visited", 0) + 1;
     state = observe_limits(state);
     if map_bool(state, "stop", false) == false {
         if depth > map_int(state, "max_search_depth", 32) {
@@ -745,7 +746,6 @@ fn walk_search(state: map, path: string, depth: int) -> map {
                 state.stop = true;
             } else {
                 if remaining <= 1 {
-                    state.dirs_visited = map_int(state, "dirs_visited", 0) + 1;
                     state.truncated = true;
                     state.stop = true;
                 } else {
@@ -758,7 +758,6 @@ fn walk_search(state: map, path: string, depth: int) -> map {
                     let error: map = types::map_map(listed, "error");
                     let code: string = types::map_string(error, "code", "internal_error");
                     if code == "budget_exceeded" {
-                        state.dirs_visited = map_int(state, "dirs_visited", 0) + 1;
                         state.truncated = true;
                         state.stop = true;
                     } else {
@@ -778,7 +777,6 @@ fn walk_search(state: map, path: string, depth: int) -> map {
                         state.stop = true;
                     }
                 } else {
-                    state.dirs_visited = map_int(state, "dirs_visited", 0) + 1;
                     let mut drop_page: bool = false;
                     if remaining <= 2 {
                         let probe_entries: array = types::map_array(listed, "entries");
@@ -1030,7 +1028,10 @@ pub fn execute(context: map, arguments: map) -> map {
                 result = fail_host(start_clock);
             } else {
                 state.start_ms = map_int(start_clock, "ms", 0);
-                state = walk_search(state, path, 0);
+                state = observe_limits(state);
+                if map_bool(state, "stop", false) == false {
+                    state = walk_search(state, path, 0);
+                }
                 if map_bool(state, "fatal", false) {
                     result = fail(types::map_string(state, "fatal_code", "internal_error"), types::map_string(state, "fatal_message", ""), {});
                 } else {

src/capabilities/confined_io.rs

@@ -35,7 +35,8 @@ pub(crate) struct ListEntry {
     pub len: u64,
 }
 
-/// One cursor page. Only `limit` entries are retained, plus constant lookahead.
+/// One cursor page. `limit` bounds physical dirents examined (not only emitted
+/// valid names), plus constant one-entry lookahead for `truncated`.
 pub(crate) struct ListPage {
     pub entries: Vec<ListEntry>,
     pub next_cursor: u64,
@@ -316,7 +317,7 @@ mod unix {
                 skipped += 1;
                 continue;
             }
-            if entries.len() >= limit {
+            if consumed >= u64::try_from(limit).unwrap_or(u64::MAX) {
                 truncated = true;
                 break;
             }

tests/capability_tests.rs

@@ -1877,3 +1877,114 @@ fn list_omits_non_utf8_names() {
             .collect::<Vec<_>>()
     );
 }
+
+#[cfg(unix)]
+#[test]
+fn list_examination_budget_counts_non_utf8_slots() {
+    use std::ffi::OsString;
+    use std::os::unix::ffi::OsStringExt;
+
+    let fixture = Fixture::new("list-exam-slots");
+    fs::create_dir(fixture.root.join("dir")).expect("dir");
+    fs::write(
+        fixture
+            .root
+            .join("dir")
+            .join(OsString::from_vec(vec![0xff, 0x80])),
+        "secret",
+    )
+    .expect("invalid-a");
+    fs::write(
+        fixture
+            .root
+            .join("dir")
+            .join(OsString::from_vec(vec![0xff, 0x81])),
+        "secret",
+    )
+    .expect("invalid-b");
+    fs::write(fixture.root.join("dir").join("keep.txt"), "ok").expect("keep");
+
+    let fs_cap = fixture.filesystem();
+    let token = fixture.token(CapabilityRisk::Read);
+    let mut cursor = 0_u64;
+    let mut pages = 0_usize;
+    let mut seen_keep = false;
+    loop {
+        pages += 1;
+        assert!(pages <= 8, "pagination must not loop");
+        let page = fs_cap.list(&token, "dir", cursor, 1).expect("page");
+        let examined = page.next_cursor.saturating_sub(page.cursor);
+        assert!(
+            examined <= 1,
+            "limit must bound physical dirents examined, got examined={examined} page={page:?}"
+        );
+        assert!(
+            page.entries.len() <= 1,
+            "page must not emit more names than the examination budget"
+        );
+        assert!(
+            page.entries
+                .iter()
+                .all(|entry| !entry.name.contains('\u{FFFD}')),
+            "lossy names must not be listed: {:?}",
+            page.entries
+                .iter()
+                .map(|entry| &entry.name)
+                .collect::<Vec<_>>()
+        );
+        assert!(
+            !page.entries.iter().any(|entry| entry.name == "secret"),
+            "invalid-byte contents must not leak through the name slot"
+        );
+        if page.entries.iter().any(|entry| entry.name == "keep.txt") {
+            seen_keep = true;
+        }
+        if page.truncated {
+            assert_ne!(
+                page.next_cursor, cursor,
+                "truncated pages must advance next_cursor"
+            );
+            cursor = page.next_cursor;
+            continue;
+        }
+        break;
+    }
+    assert!(seen_keep, "valid keep.txt must remain reachable by cursor");
+
+    let host_fs = Arc::new(fixture.filesystem());
+    let source = format!(
+        r#"
+        pub fn run(input: map) -> map {{
+            cap::fs_list("{token}", "dir", 0, 1)
+        }}
+    "#
+    );
+    let result = run_cap_source(&fixture, Some(host_fs), None, None, &source);
+    let VmValue::Map(fields) = &result else {
+        panic!("expected list envelope, got {result:?}");
+    };
+    assert_eq!(
+        fields.get(&VmValue::string("ok")),
+        Some(&VmValue::Bool(true))
+    );
+    let Some(VmValue::Int(next_cursor)) = fields.get(&VmValue::string("next_cursor")) else {
+        panic!("expected next_cursor, got {result:?}");
+    };
+    assert!(
+        *next_cursor <= 1,
+        "host list must charge examined slots, got {result:?}"
+    );
+    if let Some(VmValue::Array(entries)) = fields.get(&VmValue::string("entries")) {
+        for entry in entries.iter() {
+            let VmValue::Map(entry) = entry else {
+                panic!("expected entry map, got {entry:?}");
+            };
+            if let Some(VmValue::String(name)) = entry.get(&VmValue::string("name")) {
+                assert!(
+                    !name.contains('\u{FFFD}'),
+                    "host list must not expose lossy names: {name}"
+                );
+            }
+        }
+    }
+}

tests/rss_file_tool_tests.rs

@@ -1253,6 +1253,21 @@ fn search_enumeration_budget_counts_dot_slots_like_native() {
         "exam-nested-rem-2",
         5,
         &["adir/f0.txt", "adir/f1.txt", "adir/f2.txt", "zdir/late.txt"],
+        content.clone(),
+    );
+
+    // After the first subtree consumes the file budget, entering the next
+    // sibling increments dirs_visited before truncation (native walk-entry order).
+    assert_search_exam_budget_eq(
+        "exam-nested-rem-0",
+        6,
+        &[
+            "adir/f0.txt",
+            "adir/f1.txt",
+            "adir/f2.txt",
+            "adir/f3.txt",
+            "zdir/late.txt",
+        ],
         content,
     );
 }
@@ -1808,6 +1823,48 @@ fn search_skips_non_utf8_names_like_native() {
     assert_search_eq(&fixture, json!({"pattern": "*", "target": "files"}));
 }
 
+#[cfg(unix)]
+#[test]
+fn search_non_utf8_name_consumes_exam_slot_and_does_not_leak_secret() {
+    use std::ffi::OsString;
+    use std::os::unix::ffi::OsStringExt;
+
+    let fixture = Fixture::new("search-non-utf8-cap");
+    fs::write(
+        fixture
+            .root
+            .join(OsString::from_vec(vec![0xff, b'x', 0x80])),
+        "secret needle\n",
+    )
+    .unwrap();
+    fs::write(fixture.root.join("secret.txt"), "secret needle\n").unwrap();
+    fs::write(fixture.root.join("other.txt"), "other\n").unwrap();
+    let mut config = fixture.config();
+    config.max_search_files = 4;
+    config.artifact_store.root = fixture.parent.join("artifacts-non-utf8-cap");
+    let arguments = json!({"pattern": "secret"});
+    let native = native_execute(
+        &fixture.tools_with_config(config.clone()),
+        NativeToolExecutor::SearchFiles,
+        &arguments,
+    );
+    let rss = run_rss_search(&fixture, &config, arguments);
+    assert_exact_envelope(&native, &rss.result);
+    assert!(native.ok, "native={native:?}");
+    assert!(native.truncated, "native must truncate at the exam cap");
+    assert!(
+        !native.content.contains("secret.txt"),
+        "secret.txt must not leak after a non-UTF8 exam slot: native={native:?}"
+    );
+    assert!(
+        !rss.result["content"]
+            .as_str()
+            .is_some_and(|content| content.contains("secret.txt")),
+        "secret.txt must not leak after a non-UTF8 exam slot: rss={}",
+        rss.result
+    );
+}
+
 #[test]
 fn search_directory_order_is_byte_lexicographic_including_multibyte() {
     let fixture = Fixture::new("sort-multi");
@@ -1858,6 +1915,88 @@ fn search_fake_clock_backward_jump_does_not_extend_budget() {
     assert_eq!(rss.result["error"], Value::Null);
 }
 
+struct OverflowAfterClock {
+    ok_ticks: AtomicU64,
+    overflow_after: u64,
+    instant: Instant,
+}
+
+impl OverflowAfterClock {
+    fn after_ok_ticks(ok_ticks: u64) -> Arc<Self> {
+        Arc::new(Self {
+            ok_ticks: AtomicU64::new(0),
+            overflow_after: ok_ticks,
+            instant: Instant::now(),
+        })
+    }
+}
+
+impl LifecycleClock for OverflowAfterClock {
+    fn now_ms(&self) -> u64 {
+        1_000
+    }
+
+    fn now(&self) -> Instant {
+        self.instant
+    }
+
+    fn monotonic_ms(&self) -> Option<u64> {
+        let seen = self.ok_ticks.fetch_add(1, Ordering::SeqCst);
+        if seen >= self.overflow_after {
+            None
+        } else {
+            Some(1_000)
+        }
+    }
+}
+
+#[test]
+fn search_fake_clock_overflow_uses_nested_capability_error_envelope() {
+    let fixture = Fixture::new("search-clock-overflow");
+    fs::write(fixture.root.join("a.txt"), "alpha\n").unwrap();
+    let mut config = fixture.config();
+    config.max_search_wall_time = Duration::from_millis(2_000);
+    let rss = run_rss_exec(
+        &fixture,
+        &config,
+        RssExec {
+            module: "search_files.rss",
+            tool_name: "search_files",
+            arguments: json!({"pattern": "alpha"}),
+            durable: MemoryDurable::new(),
+            approval: Arc::new(AllowAll),
+            cancellation: Arc::new(NeverCancelled),
+            clock: OverflowAfterClock::after_ok_ticks(1),
+            deadline_ms: 1_000_000,
+            install_artifacts: false,
+            artifact_limits: default_artifact_limits(),
+            call_id: "call-clock-overflow".to_string(),
+        },
+    );
+    assert_eq!(rss.result["ok"], json!(false), "rss={}", rss.result);
+    assert_eq!(
+        rss.result["error"]["code"],
+        json!("internal_error"),
+        "overflow must preserve the nested capability code, rss={}",
+        rss.result
+    );
+    assert_eq!(
+        rss.result["error"]["message"],
+        json!("monotonic clock overflow"),
+        "overflow must preserve the nested capability message, rss={}",
+        rss.result
+    );
+    assert_ne!(
+        rss.result["error"]["code"],
+        json!("cancelled"),
+        "top-level code must not collapse overflow to cancelled"
+    );
+    assert_eq!(rss.result["truncated"], json!(false), "rss={}", rss.result);
+    assert_eq!(rss.result["content"], json!(""));
+    assert_eq!(rss.result["data"], json!({}));
+    assert_eq!(rss.result["artifacts"], json!([]));
+}
+
 #[test]
 fn published_result_artifact_is_retracted_when_commit_fails() {
     let fixture = Fixture::new("artifact-rollback");