Review round 1 for the checks, ssh-client and the Go build module: sshdir (1484), socket path (1486), over_bound (1290, 1486), toolchain.reported and streams (1483), re-pin to mesh-sdk 36d6f774; delta part 2 of 4

checks/sshdir/main.go

@@ -61,7 +61,7 @@ func Check(root string) ([]Finding, error) {
 		if module == SSHModule {
 			continue
 		}
-		walk(m, "", func(key, value string) {
+		walk(m, "", dirsOf(m), func(key, value string) {
 			out = append(out, Finding{Module: module, Key: key, Value: value})
 		})
 	}
@@ -69,7 +69,7 @@ func Check(root string) ([]Finding, error) {
 }
 
 // walk calls found for every string under v, outside Prose, that names a path under ~/.ssh.
-func walk(v any, key string, found func(key, value string)) {
+func walk(v any, key string, dirs map[string]string, found func(key, value string)) {
 	switch x := v.(type) {
 	case map[string]any:
 		keys := make([]string, 0, len(x))
@@ -79,22 +79,68 @@ func walk(v any, key string, found func(key, value string)) {
 		sort.Strings(keys)
 		for _, k := range keys {
 			if !Prose[k] {
-				walk(x[k], k, found)
+				walk(x[k], k, dirs, found)
 			}
 		}
 	case []any:
 		for _, e := range x {
-			walk(e, key, found)
+			walk(e, key, dirs, found)
 		}
 	case string:
-		// A path under a directory of the module's own (${dir:<id>}, as a runs-as module's home) is that account's
-		// own .ssh, not the operator's ~/.ssh that ssh-client sweeps (issue 1484, ADR 0466 §4).
-		if underSSH.MatchString(x) && !strings.HasPrefix(x, "${dir:") {
+		// A path under a directory the mesh places for the module (${dir:<id>} of a directory with a place and no path,
+		// as a runs-as module's home) is that account's own .ssh, not the operator's ~/.ssh that ssh-client sweeps
+		// (issue 1484, ADR 0466 §4). Any other ${dir:<id>} is resolved to the path its resource declares and judged.
+		if resolved, placed := resolveDir(x, dirs); !placed && underSSH.MatchString(resolved) {
 			found(key, x)
 		}
 	}
 }
 
+var ofDir = regexp.MustCompile(`^\$\{dir:([a-z0-9][a-z0-9_-]*)\}`)
+
+// placedDir marks a directory the mesh places for the module: it has no path of its own.
+const placedDir = "\x00placed"
+
+// dirsOf are the module's directories by id: the path each declares, or placedDir for one with a place and no path.
+func dirsOf(m any) map[string]string {
+	dirs := map[string]string{}
+	obj, _ := m.(map[string]any)
+	list, _ := obj["resources"].([]any)
+	for _, r := range list {
+		res, _ := r.(map[string]any)
+		id, _ := res["id"].(string)
+		path, _ := res["path"].(string)
+		switch {
+		case id == "":
+		case path != "":
+			dirs[id] = path
+		case res["type"] == "directory":
+			dirs[id] = placedDir
+		}
+	}
+	return dirs
+}
+
+// resolveDir follows a leading ${dir:<id>} through the module's directories. It answers the path with the references
+// resolved, and whether it ends under a placed directory.
+func resolveDir(x string, dirs map[string]string) (string, bool) {
+	for i := 0; i < 8; i++ {
+		m := ofDir.FindStringSubmatch(x)
+		if m == nil {
+			return x, false
+		}
+		to, ok := dirs[m[1]]
+		if !ok {
+			return x, false
+		}
+		if to == placedDir {
+			return x, true
+		}
+		x = to + strings.TrimPrefix(x, m[0])
+	}
+	return x, false
+}
+
 func main() {
 	root := "."
 	if len(os.Args) > 1 {

checks/sshdir/main_test.go

@@ -41,7 +41,7 @@ func TestAnotherModuleNamingSSHIsRefused(t *testing.T) {
 // that is not the operator's ~/.ssh, which only ssh-client names. A path outside any ${dir:} is still refused.
 func TestAModulesOwnDirectoryMayHoldADotSSH(t *testing.T) {
 	root := t.TempDir()
-	manifest(t, root, "builder", `{"module":"builder","resources":[{"path":"${dir:state}/.ssh"},{"path":"${dir:ssh-dir}/config"}]}`)
+	manifest(t, root, "builder", `{"module":"builder","resources":[{"id":"state","type":"directory","place":"."},{"id":"ssh-dir","type":"directory","path":"${dir:state}/.ssh"},{"path":"${dir:ssh-dir}/config"}]}`)
 	manifest(t, root, "other", `{"module":"other","resources":[{"path":"${machine:account-home}/.ssh/config"}]}`)
 	found, err := Check(root)
 	if err != nil {
@@ -52,6 +52,21 @@ func TestAModulesOwnDirectoryMayHoldADotSSH(t *testing.T) {
 	}
 }
 
+// Issue 1484 review: only a directory the mesh places is the module's own home. A ${dir:} that resolves to the
+// operator's home is judged by the path it resolves to.
+func TestADirResolvingToTheOperatorsHomeIsStillRefused(t *testing.T) {
+	root := t.TempDir()
+	manifest(t, root, "escape", `{"module":"escape","resources":[{"id":"h","type":"directory","path":"${machine:account-home}","unknown":"module"},{"path":"${dir:h}/.ssh/config"}]}`)
+	manifest(t, root, "placed", `{"module":"placed","resources":[{"id":"state","type":"directory","place":".","unknown":"program"},{"id":"s","type":"directory","path":"${dir:state}/.ssh"},{"path":"${dir:s}/config"}]}`)
+	found, err := Check(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(found) != 1 || found[0].Module != "escape" {
+		t.Fatalf("refused %+v; want only escape", found)
+	}
+}
+
 func TestTheCatalogueHasNone(t *testing.T) {
 	found, err := Check("../..")
 	if err != nil {