refactor(plugin): use native recursive Windows directory creation

Author: kmbroai

plugins/codex-security/native/proof-windows-wide.mts

@@ -159,6 +159,7 @@ function worker(root: string): Record<string, boolean> {
     error: 3,
     value: [],
   });
+  assert.deepEqual(native.windowsAbsolutePath(Buffer.alloc(0)), emptyAbsolute);
   const notDirectory = native.windowsDirectoryEntries(widePath(names[0]!));
   assert.notEqual(notDirectory.error, 0);
   assert(Number.isInteger(notDirectory.error));
@@ -251,6 +252,9 @@ function worker(root: string): Record<string, boolean> {
   files.mkdir(widePath(longDirectory));
   files.mkdir(widePath(longDirectory));
   assert(files.stat(widePath(longDirectory)).isDirectory());
+  assert.throws(() => files.mkdir(Buffer.alloc(0)));
+  assert.throws(() => files.mkdir(widePath(names[0]!)));
+  assert.throws(() => files.mkdir(widePath(`${names[0]}\\child`)));
   const longFile = widePath(win32.join(longDirectory, "file-\udc80"));
   files.writeFile(longFile, Buffer.from("long raw path"));
   const longLength = files.readInto(longFile, contents);

plugins/codex-security/native/src/windows.rs

@@ -116,9 +116,10 @@ pub fn windows_environment(name: Buffer) -> napi::Result<Option<Buffer>> {
 pub fn windows_absolute_path(path: Buffer) -> napi::Result<BufferResult> {
     let path = os_string(path)?;
     if path.is_empty() {
-        // Rust rejects empty paths before Win32; retain the native error contract.
+        // The public Rust path API rejects empty input before reaching Win32.
         let mut value = [0_u16; 256];
         let error = unsafe {
+            SetLastError(0);
             GetFullPathNameW([0_u16].as_ptr(), 256, value.as_mut_ptr(), null_mut());
             GetLastError()
         };
@@ -284,6 +285,11 @@ pub fn create_windows_directory(path: Buffer) -> napi::Result<u32> {
     Ok(status(unsafe { CreateDirectoryW(path.as_ptr(), null()) }))
 }
 
+#[napi]
+pub fn create_windows_directories(path: Buffer) -> napi::Result<u32> {
+    Ok(io_status(fs::create_dir_all(os_string(path)?)))
+}
+
 #[napi]
 impl WindowsHandle {
     #[napi]

plugins/codex-security/native/windows-binding.mts

@@ -44,6 +44,7 @@ export interface WindowsBinding {
     flags: number,
   ): { error: number; handle?: WindowsHandle | null };
   createWindowsDirectory(path: Buffer): number;
+  createWindowsDirectories(path: Buffer): number;
 }
 
 export const windowsFlags = {

plugins/codex-security/native/windows-files.mts

@@ -143,21 +143,7 @@ export function windowsFileSystem(native: WindowsBinding) {
   }
 
   function mkdir(path: Buffer): void {
-    const resolved = absolute(path);
-    const parent = widePath(win32.dirname(pathText(resolved)));
-    let error = native.createWindowsDirectory(operationPath(resolved));
-    if (error === 3 && !parent.equals(resolved)) {
-      mkdir(parent);
-      error = native.createWindowsDirectory(operationPath(resolved));
-    }
-    if (error !== 0) {
-      try {
-        if (stat(resolved).isDirectory()) return;
-      } catch {
-        // Report the original creation error.
-      }
-      check(error, path);
-    }
+    check(native.createWindowsDirectories(operationPath(path)), path);
   }
 
   function readInto(path: Buffer, buffer: Buffer): number {