Module naming 

Destination filename selection and sanitisation.

Everything a server tells us about a filename is hostile input. The only guarantee this module makes, and it makes it unconditionally: the returned path’s parent is exactly the requested directory.

Structs

Destination

Enums

FilenameSource

Where a filename came from — used for --verbose reporting.

Functions

assert_within

Final gate before we open anything: the resolved path must sit directly in the intended directory. Defends against a .. that slipped through and against symlinked parents.

choose

Pick a filename, in the priority order from PRD §21.

expand_tilde

sanitize

Reduce a server-supplied string to a single safe path component, or None if nothing safe remains.