cache: harden the exec output-tree path

Address three issues in the action cache's tree materialization, found
in adversarial review:

1. GetTree wrote output blobs to filepath.Join(dir, rel) with plain os
   calls, where rel is an output name read from the (non-self-validating)
   action cache entry. A tampered entry with a "../" name could escape
   the exec directory and write attacker-controlled CAS content anywhere
   the process could — contradicting the confinement the rest of the
   cache gets from os.Root. Reject any rel that is not filepath.IsLocal.

2. GetTree trusted an already-present file by size alone and never
   re-hashed it, and staged writes without fsync. A right-sized but torn
   or corrupt exec file (power loss, bitrot) was therefore trusted
   forever: wazero hard-fails deserializing it instead of recompiling,
   and the size match kept GetTree from ever repairing it from the CAS,
   bricking codegen until a manual cache wipe. Reuse an existing file
   only when it still hashes to the digest, and stage writes through an
   fsynced temp + rename.

3. The exec directory was shared across processes at exec/<action-hash>.
   wazero stages <key>.tmp files in place while compiling, which a
   concurrent process's PutTree WalkDir could sweep into its action
   result. ExecDir now returns a fresh private directory per call, and
   the WASM runner removes it once wazero has loaded the module; the
   compiled bytes remain reproducible from the CAS.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MPgq3rwip76D554BktbqR4

Author: claude

internal/cache/action.go

@@ -103,17 +103,30 @@ func (a *ActionCache) PutTree(action Digest, dir string) error {
 }
 
 // GetTree materializes a cached action's outputs as files under dir, or
-// returns ErrNotFound on a miss. Files already present with the right size
-// are left in place; missing ones are staged in their destination directory
-// and renamed so concurrent processes never observe partial files.
+// returns ErrNotFound on a miss. A file already present is reused only if its
+// contents still hash to the expected digest; otherwise it is rewritten from
+// the CAS. Writes are staged, fsynced, and renamed, so a crash cannot leave a
+// right-sized but torn file that later reads would trust.
 func (a *ActionCache) GetTree(action Digest, dir string) error {
 	result, err := a.Get(action)
 	if err != nil {
 		return err
 	}
 	for rel, d := range result.Outputs {
+		// Output names come from the action cache entry, which — unlike a CAS
+		// blob — is not self-validating, so a tampered entry could carry a
+		// name like "../../etc/x". Reject anything that isn't a relative path
+		// confined to dir; this is the confinement the os.Root gives the rest
+		// of the cache, which GetTree can't use because dir is a caller-owned
+		// path a tool must read by absolute name.
+		if !filepath.IsLocal(rel) {
+			return fmt.Errorf("cache: unsafe output path %q in action %s", rel, action)
+		}
 		path := filepath.Join(dir, filepath.FromSlash(rel))
-		if fi, err := os.Stat(path); err == nil && fi.Size() == d.SizeBytes {
+		// Trust an existing file only if it still hashes to the digest;
+		// size alone can mask in-place corruption that would make the
+		// consuming tool hard-fail with no way to repair (see wazero).
+		if existing, err := os.ReadFile(path); err == nil && DigestOf(existing) == d {
 			continue
 		}
 		data, err := a.cas.Get(d)
@@ -123,27 +136,43 @@ func (a *ActionCache) GetTree(action Digest, dir string) error {
 		if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
 			return fmt.Errorf("cache: %w", err)
 		}
-		f, err := os.CreateTemp(filepath.Dir(path), d.Hash[:8]+"-*")
-		if err != nil {
-			return fmt.Errorf("cache: %w", err)
-		}
-		if _, err := f.Write(data); err != nil {
-			f.Close()
-			os.Remove(f.Name())
-			return fmt.Errorf("cache: %w", err)
-		}
-		if err := f.Close(); err != nil {
-			os.Remove(f.Name())
-			return fmt.Errorf("cache: %w", err)
-		}
-		if err := os.Rename(f.Name(), path); err != nil {
-			os.Remove(f.Name())
+		if err := writeFileAtomic(path, data); err != nil {
 			return fmt.Errorf("cache: %w", err)
 		}
 	}
 	return nil
 }
 
+// writeFileAtomic writes data to path via a staged temp file in the same
+// directory, fsynced before an atomic rename, so a reader never observes a
+// partial or torn file even across a crash.
+func writeFileAtomic(path string, data []byte) error {
+	f, err := os.CreateTemp(filepath.Dir(path), "."+filepath.Base(path)+"-*")
+	if err != nil {
+		return err
+	}
+	tmp := f.Name()
+	if _, err := f.Write(data); err != nil {
+		f.Close()
+		os.Remove(tmp)
+		return err
+	}
+	if err := f.Sync(); err != nil {
+		f.Close()
+		os.Remove(tmp)
+		return err
+	}
+	if err := f.Close(); err != nil {
+		os.Remove(tmp)
+		return err
+	}
+	if err := os.Rename(tmp, path); err != nil {
+		os.Remove(tmp)
+		return err
+	}
+	return nil
+}
+
 // Put records the result of an action. All outputs must already be in the
 // CAS; writes are staged and renamed so concurrent processes never observe a
 // partial entry.

internal/cache/cache.go

@@ -83,15 +83,21 @@ func (c *Cache) Close() error {
 	return c.root.Close()
 }
 
-// ExecDir returns a stable directory for materializing the output tree of
-// the given action, for tools that need their outputs on disk (like wazero's
-// compilation cache). It lives at exec/<action-hash> under the cache root
-// and, like everything else in the cache, is safe to delete at any time: the
-// authoritative copy of its contents is the CAS.
+// ExecDir creates a fresh, private scratch directory for materializing the
+// output tree of the given action, for tools that need their outputs on disk
+// (like wazero's compilation cache). Each call returns a new directory under
+// exec/, so two concurrent processes never share one — otherwise a tool
+// staging files there (wazero writes <key>.tmp files in place) could be swept
+// into the other's PutTree. The caller must remove it when done; its contents
+// are always reproducible from the CAS, so losing it is harmless.
 func (c *Cache) ExecDir(action Digest) (string, error) {
-	rel := filepath.Join("exec", action.Hash)
-	if err := c.root.MkdirAll(rel, 0755); err != nil {
-		return "", fmt.Errorf("failed to create %s directory: %w", rel, err)
+	base := filepath.Join(c.root.Name(), "exec")
+	if err := os.MkdirAll(base, 0755); err != nil {
+		return "", fmt.Errorf("failed to create %s directory: %w", base, err)
 	}
-	return filepath.Join(c.root.Name(), rel), nil
+	dir, err := os.MkdirTemp(base, action.Hash+"-")
+	if err != nil {
+		return "", fmt.Errorf("cache: %w", err)
+	}
+	return dir, nil
 }

internal/ext/wasm/wasm.go

@@ -139,8 +139,9 @@ func (r *Runner) loadAndCompileWASM(ctx context.Context, store *cache.Cache, exp
 	// Its only declared input is the module's checksum: the embedded wazero
 	// version and the target platform are determined by the sqlc binary,
 	// which is an implicit input of every action. Compiled artifacts are
-	// materialized into an exec directory for wazero's compilation cache to
-	// find; the authoritative copies live in the CAS.
+	// materialized into a private exec directory for wazero's compilation
+	// cache to find; the authoritative copies live in the CAS. Once wazero
+	// has loaded the module into memory the directory is no longer needed.
 	compileAction := store.NewAction("CompileModule").
 		AddInput("wasm", []byte(expected)).
 		Digest()
@@ -149,6 +150,7 @@ func (r *Runner) loadAndCompileWASM(ctx context.Context, store *cache.Cache, exp
 	if err != nil {
 		return nil, err
 	}
+	defer os.RemoveAll(execDir)
 	compiled := true
 	if err := store.Actions.GetTree(compileAction, execDir); errors.Is(err, cache.ErrNotFound) {
 		compiled = false