refactor(fspy): return arena-backed absolute paths

Co-authored-by: GPT-5 Codex <codex@openai.com>

Author: wan9chi

crates/fspy_preload_unix/src/client/convert.rs

@@ -6,7 +6,8 @@ use std::{
     path::PathBuf,
 };
 
-use bstr::{BStr, ByteSlice};
+use allocator_api2::{alloc::Allocator, vec::Vec};
+use bstr::ByteSlice;
 use fspy_shared::ipc::AccessMode;
 use libc::{c_char, c_int};
 use nix::unistd::getcwd;
@@ -40,55 +41,75 @@ fn get_fd_path(fd: RawFd) -> nix::Result<Option<PathBuf>> {
     }
 }
 
+pub struct AbsolutePath<A: Allocator>(Vec<u8, A>);
+
+impl<A: Allocator> AbsolutePath<A> {
+    fn new_in(path: &[u8], allocator: A) -> Self {
+        let mut bytes = Vec::with_capacity_in(path.len() + 1, allocator);
+        bytes.extend_from_slice(path);
+        bytes.push(0);
+        Self(bytes)
+    }
+
+    pub fn as_bytes(&self) -> &[u8] {
+        &self.0[..self.0.len() - 1]
+    }
+
+    #[cfg(target_os = "linux")]
+    pub fn as_ptr(&self) -> *const c_char {
+        self.0.as_ptr().cast()
+    }
+}
+
 pub trait ToAbsolutePath {
-    unsafe fn to_absolute_path<R, F: FnOnce(Option<&BStr>) -> nix::Result<R>>(
+    unsafe fn to_absolute_path<A: Allocator>(
         self,
-        f: F,
-    ) -> nix::Result<R>;
+        allocator: A,
+    ) -> nix::Result<Option<AbsolutePath<A>>>;
 }
 
 pub struct Fd(pub c_int);
 impl ToAbsolutePath for Fd {
-    unsafe fn to_absolute_path<R, F: FnOnce(Option<&BStr>) -> nix::Result<R>>(
+    unsafe fn to_absolute_path<A: Allocator>(
         self,
-        f: F,
-    ) -> nix::Result<R> {
+        allocator: A,
+    ) -> nix::Result<Option<AbsolutePath<A>>> {
         let path = get_fd_path(self.0)?;
-        f(path.as_ref().map(|p| p.as_os_str().as_bytes().as_bstr()))
+        Ok(path.map(|path| AbsolutePath::new_in(path.as_os_str().as_bytes(), allocator)))
     }
 }
 
 pub struct PathAt(pub c_int, pub *const c_char);
 
 impl ToAbsolutePath for PathAt {
-    unsafe fn to_absolute_path<R, F: FnOnce(Option<&BStr>) -> nix::Result<R>>(
+    unsafe fn to_absolute_path<A: Allocator>(
         self,
-        f: F,
-    ) -> nix::Result<R> {
+        allocator: A,
+    ) -> nix::Result<Option<AbsolutePath<A>>> {
         // SAFETY: self.1 is a non-null pointer to a valid null-terminated C string, as guaranteed by the libc calling convention
         let pathname = unsafe { CStr::from_ptr(self.1) }.to_bytes().as_bstr();
 
         if pathname.first().copied() == Some(b'/') {
-            f(pathname.into())
+            Ok(Some(AbsolutePath::new_in(pathname, allocator)))
         } else {
             let Some(mut abs_path) = get_fd_path(self.0)? else {
-                return f(None);
+                return Ok(None);
             };
             if !pathname.is_empty() {
                 abs_path.push(OsStr::from_bytes(pathname));
             }
-            f(Some(abs_path.as_os_str().as_bytes().as_bstr()))
+            Ok(Some(AbsolutePath::new_in(abs_path.as_os_str().as_bytes(), allocator)))
         }
     }
 }
 
 impl ToAbsolutePath for *const c_char {
-    unsafe fn to_absolute_path<R, F: FnOnce(Option<&BStr>) -> nix::Result<R>>(
+    unsafe fn to_absolute_path<A: Allocator>(
         self,
-        f: F,
-    ) -> nix::Result<R> {
+        allocator: A,
+    ) -> nix::Result<Option<AbsolutePath<A>>> {
         // SAFETY: delegates to PathAt::to_absolute_path with AT_FDCWD and the caller-provided C string pointer
-        unsafe { PathAt(libc::AT_FDCWD, self).to_absolute_path(f) }
+        unsafe { PathAt(libc::AT_FDCWD, self).to_absolute_path(allocator) }
     }
 }
 

crates/fspy_preload_unix/src/client/mod.rs

@@ -109,15 +109,12 @@ impl Client {
     ) -> anyhow::Result<()> {
         // SAFETY: mode contains a valid pointer (if ModeStr) or a plain value, as provided by the caller
         let mode = unsafe { mode.to_access_mode() };
+        let arena = sigsafe_alloc::arena();
         // SAFETY: path contains valid pointers to C strings/file descriptors, as provided by the caller
-        let () = unsafe {
-            path.to_absolute_path(|abs_path| {
-                let Some(abs_path) = abs_path else {
-                    return Ok(Ok(()));
-                };
-                Ok(self.send(mode, Path::new(OsStr::from_bytes(abs_path))))
-            })
-        }??;
+        let Some(abs_path) = (unsafe { path.to_absolute_path(&arena) })? else {
+            return Ok(());
+        };
+        self.send(mode, Path::new(OsStr::from_bytes(abs_path.as_bytes())))?;
 
         Ok(())
     }

crates/fspy_preload_unix/src/interceptions/spawn/exec/mod.rs

@@ -1,8 +1,5 @@
 mod with_argv;
 
-#[cfg(target_os = "linux")]
-use std::ffi::CString;
-
 use fspy_shared_unix::exec::ExecResolveConfig;
 use libc::{c_char, c_int};
 use with_argv::with_argv;
@@ -195,27 +192,26 @@ mod linux_only {
             reason = "suppresses unused warning on *::original"
         )]
         let _unused = execveat::original;
+        let arena = sigsafe_alloc::arena();
         // SAFETY: PathAt wraps a valid dirfd and pathname pointer from the interposed execveat call
-        let abs_path_result = unsafe {
-            PathAt(dirfd, pathname).to_absolute_path(|path| {
-                let Some(path) = path else {
-                    return Ok(None);
-                };
-                Ok(Some(CString::new(&**path).unwrap()))
-            })
-        };
+        let abs_path_result = unsafe { PathAt(dirfd, pathname).to_absolute_path(&arena) };
         let abs_path = match abs_path_result {
             Ok(None) => {
                 // SAFETY: forwarding the original arguments to the real execveat syscall
                 return unsafe { execveat::original()(dirfd, pathname, argv, envp, flags) };
             }
-            Ok(Some(path)) => path.as_ptr(),
+            Ok(Some(path)) => path,
             Err(errno) => {
                 errno.set();
                 return -1;
             }
         };
-        handle_exec(ExecResolveConfig::search_path_disabled(), abs_path, argv.cast(), envp.cast())
+        handle_exec(
+            ExecResolveConfig::search_path_disabled(),
+            abs_path.as_ptr(),
+            argv.cast(),
+            envp.cast(),
+        )
     }
 
     intercept!(fexecve(64): unsafe extern "C" fn(