diff --git a/crates/pi-natives/src/path_identity.rs b/crates/pi-natives/src/path_identity.rs index b84f7d41de0..844e622efbc 100644 --- a/crates/pi-natives/src/path_identity.rs +++ b/crates/pi-natives/src/path_identity.rs @@ -2887,8 +2887,10 @@ pub(crate) mod platform { path: &Path, kind: &str, // Consulted only by the macOS read-denial retry below. - _policy: AcquisitionPolicy, + policy: AcquisitionPolicy, ) -> Result { + #[cfg(not(target_os = "macos"))] + let _ = policy; if !matches!(kind, "directory" | "file") { return Err(NativeOwnerOnlySecurityResult::failure("io_error")); } @@ -2983,7 +2985,7 @@ pub(crate) mod platform { let target_fd = if target_fd < 0 && !is_directory { let read_error = std::io::Error::last_os_error(); if read_error.raw_os_error() == Some(libc::EACCES) - && _policy == AcquisitionPolicy::RepairableWrite + && policy == AcquisitionPolicy::RepairableWrite { // A hostile macOS ACL may deny reads while leaving owner writes // available. Retry only that denial with write authority so ACLs can diff --git a/packages/natives/changelog.d/task-admission-stack-native-prerequisite.md b/packages/natives/changelog.d/task-admission-stack-native-prerequisite.md new file mode 100644 index 00000000000..9d70aa479cc --- /dev/null +++ b/packages/natives/changelog.d/task-admission-stack-native-prerequisite.md @@ -0,0 +1,3 @@ +### Fixed + +- Keep owner-only native acquisition policy checks compatible with strict macOS Clippy and regenerate matching diagnostic-artifact provenance without relaxing readonly security or loader validation. diff --git a/packages/natives/native/diagnostic-artifact.json b/packages/natives/native/diagnostic-artifact.json index be7fdeeb97a..6e2ecbf42c3 100644 --- a/packages/natives/native/diagnostic-artifact.json +++ b/packages/natives/native/diagnostic-artifact.json @@ -1,7 +1,7 @@ { "schema": "gjc.diagnostic-artifact", - "version": "0.17.7", + "version": "0.18.5", "artifacts": { - "pi_natives.darwin-arm64.node": "5a88297e7e66ae33fdffe08bfcad0291395c18a67dd7916fbadd5a11e0fcc633" + "pi_natives.darwin-arm64.node": "3708c0a4a667f5aa87d7d1fe39f7f003cdb79c141af9cf920e939843cfaf9dbe" } }