Yeachan-Heo 66ed7528e2 fix(hooks): catch EEXIST on Windows concurrent mkdir race (#2138) ...

On Windows, Node.js mkdirSync({ recursive: true }) can throw EEXIST
when multiple hook processes race to create the same directory. The
existsSync() pre-check introduces a TOCTOU window that recursive:true
alone cannot close. Add EEXIST catch to all vulnerable mkdir sites.

Fixes: ensureOmcDir, ensureAllOmcDirs, ensureSessionStateDir in
worktree-paths.ts, plus unguarded mkdirSync in context-guard-stop.mjs
and session-summary.mjs. Pattern matches atomic-write.ts:ensureDirSync.

Constraint: Must not change behavior on POSIX (EEXIST catch is a no-op)
Rejected: Extract shared ensureMkdir utility | .mjs scripts cannot import TS; minimal diff preferred for bugfix
Confidence: high
Scope-risk: narrow
Not-tested: Actual Windows parallel-hook reproduction (no Windows CI)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-04-04 19:50:43 +00:00

6.6 KiB

Executable File

Raw Permalink Blame History

View Raw