vfs: address follow-up items from #62328

Security:
- Reject overlapping VFS mounts with clear error
- Add allowWithPermissionModel opt-in for permission model
- RealFSProvider: validate symlink targets, throw EACCES on escape

API compatibility:
- VirtualFileHandle: add no-op stubs and Symbol.asyncDispose
- Intercept fsPromises.open() for VFS paths
- Streams: add bytesRead/pending and bytesWritten/pending
- VirtualDir: add Symbol.asyncDispose/Symbol.dispose
- Stats: use dev=4085 and incrementing ino
- Fix VFSStatWatcher listener signature

Correctness:
- Fix checkClosed to accept syscall parameter
- Fix writeFileSync to use isAppend() for ax/ax+ flags
- Fix dead ternary in hookProcessCwd
- SEAProvider: cache asset sizes, recursive readdir, numeric flags
- Streams: use inherited destroyed, EBADF on null fd

Architecture:
- Cross-VFS rename/copyFile/link throw EXDEV
- Clear package.json caches on unmount
- Convert readFile async handler to use promises

Mock integration:
- Make MockFSContext.vfs a private field with getter
- Fix parentDir root check for Windows portability
- restoreAll() collects errors into AggregateError
- Remove obsolete skipped dynamic content test

Provider fixes:
- MemoryProvider: statSync uses contentProvider for dynamic size
- MemoryProvider: recursive readdir follows symlinks
- RealFSProvider: add watch/watchFile/unwatchFile support

Code quality:
- Cap watcher pending events queue at 1024
- Remove redundant destroyed field from streams

Author: mcollina

lib/fs.js

@@ -409,16 +409,7 @@ function readFile(path, options, callback) {
   if (h !== null) {
     const opts = typeof options === 'function' ? undefined : options;
     if (checkAborted(opts?.signal, callback)) return;
-    try {
-      const result = h.readFileSync(path, opts);
-      if (result !== undefined) {
-        process.nextTick(callback, null, result);
-        return;
-      }
-    } catch (err) {
-      process.nextTick(callback, err);
-      return;
-    }
+    if (vfsResult(h.readFile(path, opts), callback)) return;
   }
 
   options = getOptions(options, { flag: 'r' });

lib/internal/fs/promises.js

@@ -641,6 +641,11 @@ async function copyFile(src, dest, mode) {
 // Note that unlike fs.open() which uses numeric file descriptors,
 // fsPromises.open() uses the fs.FileHandle class.
 async function open(path, flags, mode) {
+  const h = vfsState.handlers;
+  if (h !== null) {
+    const result = h.open(path, flags, mode);
+    if (result !== undefined) return result;
+  }
   path = getValidatedPath(path);
   const flagsNumber = stringToFlags(flags);
   mode = parseFileMode(mode, 'mode', 0o666);

lib/internal/modules/package_json_reader.js

@@ -358,11 +358,21 @@ function findPackageJSON(specifier, base = 'data:') {
   return pkg?.path;
 }
 
+/**
+ * Clears all package.json caches. Called by VFS on unmount to prevent
+ * stale entries from paths that were resolved while a VFS was mounted.
+ */
+function clearPackageJSONCache() {
+  moduleToParentPackageJSONCache.clear();
+  deserializedPackageJSONCache.clear();
+}
+
 module.exports = {
   read,
   getNearestParentPackageJSON,
   getPackageScopeConfig,
   getPackageType,
   getPackageJSONURL,
   findPackageJSON,
+  clearPackageJSONCache,
 };

lib/internal/test_runner/mock/mock.js

@@ -51,7 +51,8 @@ const {
 const { MockTimers } = require('internal/test_runner/mock/mock_timers');
 const { Module } = require('internal/modules/cjs/loader');
 const { _load, _nodeModulePaths, _resolveFilename, isBuiltin } = Module;
-const { dirname, join } = require('path');
+const path = require('path');
+const { dirname, join } = path;
 
 // Lazy-load VirtualFileSystem to avoid loading VFS code if fs mocking is not used
 const lazyVirtualFileSystem = getLazy(
@@ -413,11 +414,7 @@ const { restore: restoreProperty } = MockPropertyContext.prototype;
  * Context for mocking the file system using VFS.
  */
 class MockFSContext {
-  /**
-   * The underlying VirtualFileSystem instance.
-   * @type {VirtualFileSystem}
-   */
-  vfs;
+  #vfs;
 
   /**
    * The mount prefix for the mock file system.
@@ -426,10 +423,18 @@ class MockFSContext {
   prefix;
 
   constructor(vfs, prefix) {
-    this.vfs = vfs;
+    this.#vfs = vfs;
     this.prefix = prefix;
   }
 
+  /**
+   * The underlying VirtualFileSystem instance.
+   * @type {VirtualFileSystem}
+   */
+  get vfs() {
+    return this.#vfs;
+  }
+
   /**
    * Adds a file to the mock file system.
    * @param {string} filePath - The path of the file (relative to prefix).
@@ -438,10 +443,11 @@ class MockFSContext {
   addFile(filePath, content) {
     const fullPath = join(this.prefix, filePath);
     const parentDir = dirname(fullPath);
-    if (parentDir !== '/') {
-      this.vfs.mkdirSync(parentDir, { __proto__: null, recursive: true });
+    const { root } = path.parse(parentDir);
+    if (parentDir !== root) {
+      this.#vfs.mkdirSync(parentDir, { __proto__: null, recursive: true });
     }
-    this.vfs.writeFileSync(fullPath, content);
+    this.#vfs.writeFileSync(fullPath, content);
   }
 
   /**
@@ -450,7 +456,7 @@ class MockFSContext {
    */
   addDirectory(dirPath) {
     const fullPath = join(this.prefix, dirPath);
-    this.vfs.mkdirSync(fullPath, { __proto__: null, recursive: true });
+    this.#vfs.mkdirSync(fullPath, { __proto__: null, recursive: true });
   }
 
   /**
@@ -460,14 +466,14 @@ class MockFSContext {
    */
   existsSync(path) {
     const fullPath = join(this.prefix, path);
-    return this.vfs.existsSync(fullPath);
+    return this.#vfs.existsSync(fullPath);
   }
 
   /**
    * Restores the file system to its original state.
    */
   restore() {
-    this.vfs.unmount();
+    this.#vfs.unmount();
   }
 }
 
@@ -819,7 +825,8 @@ class MockTracker {
         const filePath = paths[i];
         const content = files[filePath];
         const parentDir = dirname(filePath);
-        if (parentDir !== '/') {
+        const { root } = path.parse(parentDir);
+        if (parentDir !== root) {
           vfs.mkdirSync(parentDir, { __proto__: null, recursive: true });
         }
         vfs.writeFileSync(filePath, content);
@@ -850,12 +857,20 @@ class MockTracker {
 
   /**
    * Restore all mocks created by this MockTracker instance.
+   * Collects errors and throws AggregateError after all mocks are restored.
    */
   restoreAll() {
+    const errors = [];
     for (let i = 0; i < this.#mocks.length; i++) {
       const { ctx, restore } = this.#mocks[i];
-
-      FunctionPrototypeCall(restore, ctx);
+      try {
+        FunctionPrototypeCall(restore, ctx);
+      } catch (err) {
+        ArrayPrototypePush(errors, err);
+      }
+    }
+    if (errors.length > 0) {
+      throw new AggregateError(errors, 'Failed to restore some mocks');
     }
   }
 

lib/internal/vfs/dir.js

@@ -2,6 +2,8 @@
 
 const {
   SymbolAsyncIterator,
+  SymbolAsyncDispose,
+  SymbolDispose,
 } = primordials;
 
 const {
@@ -75,15 +77,31 @@ class VirtualDir {
     if (this.#closed) {
       throw new ERR_DIR_CLOSED();
     }
-    let entry;
-    while ((entry = this.readSync()) !== null) {
-      yield entry;
+    try {
+      let entry;
+      while ((entry = this.readSync()) !== null) {
+        yield entry;
+      }
+    } finally {
+      if (!this.#closed) {
+        this.closeSync();
+      }
     }
   }
 
   [SymbolAsyncIterator]() {
     return this.entries();
   }
+
+  [SymbolAsyncDispose]() {
+    return this.close();
+  }
+
+  [SymbolDispose]() {
+    if (!this.#closed) {
+      this.closeSync();
+    }
+  }
 }
 
 module.exports = {

lib/internal/vfs/errors.js

@@ -19,6 +19,7 @@ const {
   UV_EINVAL,
   UV_ELOOP,
   UV_EACCES,
+  UV_EXDEV,
 } = internalBinding('uv');
 
 /**
@@ -179,6 +180,22 @@ function createEACCES(syscall, path) {
   return err;
 }
 
+/**
+ * Creates an EXDEV error for cross-device link operations.
+ * @param {string} syscall The system call name
+ * @param {string} path The path
+ * @returns {Error}
+ */
+function createEXDEV(syscall, path) {
+  const err = new UVException({
+    errno: UV_EXDEV,
+    syscall,
+    path,
+  });
+  ErrorCaptureStackTrace(err, createEXDEV);
+  return err;
+}
+
 module.exports = {
   createENOENT,
   createENOTDIR,
@@ -190,4 +207,5 @@ module.exports = {
   createEINVAL,
   createELOOP,
   createEACCES,
+  createEXDEV,
 };