file.list works for directories, shows timestamp information as epoch for create,access,modified,changed by AmeliaYeah · Pull Request #2376 · spellshift/realm

AmeliaYeah · 2026-06-28T12:48:50Z

What type of PR is this?

Feature
Eldritch-Function

What this PR does / why we need it:

While this does somewhat exist in the file.list API call (in regards to obtaining the stringified version of modified time), this is a bit of a hacky approach, and also doesn't work with directories. This API call is designed to be an easier way to obtain the time metadata of a file (aswell as beyond just the mtime).

My specific personal motivation was in regard to timestomping a file to it's metadata BEFORE writing to such file, but I'm sure there are multitudes of other use cases for this API call.

hulto

Thanks for the PR @AmeliaYeah and sorry for the delay.
We're all on a short break post CCDC so may be slow to respond.

This looks like a great feature!
Instead of adding a new function though would moving this capability to the existing file list function make sense for your use case?
I like the idea of update file list to work on dirs, and also switching to epoch.

AmeliaYeah · 2026-07-08T16:17:48Z

Thanks for the PR @AmeliaYeah and sorry for the delay. We're all on a short break post CCDC so may be slow to respond.

This looks like a great feature! Instead of adding a new function though would moving this capability to the existing file list function make sense for your use case? I like the idea of update file list to work on dirs, and also switching to epoch.

Yeah the more I think of it the more I feel this might be better, I'll update file list to show the directory and also show timestamp information as epoch

jabbate19 · 2026-07-10T03:00:57Z

Reviewing a9f110ac..27f9d1f8 – file.list now returns dir self + epoch timestamps.

Summary: Good forensic enhancement, keeps legacy modified UTC string for back-compat while adding times dict. Main risk is breaking change on len() semantics.

Detailed file:line comments posted below as inline review comments + this summary.

jabbate19

File:line review for timestamp + dir-self changes – see inline comments for exact locations.

jabbate19 · 2026-07-10T03:01:45Z

-                // If I implement `handle_list` roughly:
+                // show information for the file
+                // if it's a directory, show information of the directory being listed from
+                final_res.push(create_dict_from_file(&path_buf)?);


Breaking change – dir self now included (55-68) at list_impl.rs:55-68:

Old:

if path_buf.is_dir() { push children } else { push self }

New always pushes self then children if dir. Callers checking len() == child_count or files[0] as first child break – adds +1 per dir.

Document breaking change in PR description / changelog, or gate with include_self param (default false for v1 compat).

read_dir order is FS-dependent; doc example shows deterministic order. Consider sorting by absolute_path or documenting as unordered.

Glob edge: file.list("/tmp/*") where matches are dirs now returns each matched dir (self) + its children – one-level recursive for wildcards. Confirm intentional.

File: implants/lib/eldritch/stdlib/eldritch-libfile/src/std/list_impl.rs:55-68

i added dir_self as a flag, false by default, to show the directory itself. i also added sorting by absolute_path

jabbate19 · 2026-07-10T03:01:45Z

+    #[cfg(unix)] {
+        use std::os::unix::fs::MetadataExt;
+        times.insert(Value::String("changed".to_string()), Value::Int(metadata.ctime()));
+    }


get_times_dict mixes epoch sources + silent omission (76-107) at list_impl.rs:77-106:

changed via MetadataExt::ctime() already epoch i64 (can be negative pre-1970). Others via SystemTime::duration_since(UNIX_EPOCH) errors pre-1970 and gets silently dropped. A pre-1970 file could expose only changed. Normalize or document omission.

cast_signed() on u64 truncates >i64::MAX; i64::try_from more explicit.

Style: return Value::Dictionary(...) + stray ; after } line 103 non-idiomatic – use tail expr Value::Dictionary(Arc::new(RwLock::new(times))).

Duplicate syscall: create_dict_from_file:177-182 calls modified() for legacy string then get_times_dict calls it again. Cache once.

Typo compatability line 177 → compatibility.

File: implants/lib/eldritch/stdlib/eldritch-libfile/src/std/list_impl.rs:77-106

fixes applied, negative epochs supported for mtime/atime/crtime

jabbate19 · 2026-07-10T03:01:45Z

+    "absolute_path": "/some_directory",
+    "file_name": "some_directory",
+    "group": "root",
+    "modified": "2026-07-09 18:24:44 UTC", // modification time represented as a UTC string


Docs file.list example – style (735-791) at eldritch.md:747:

Caps: CHANGED TIME IS ONLY SUPPORTED IN UNIX SYSTEMS! → changed is Unix-only (ctime).

"type": "dir" / "file" lower-case matches code (good) but previous docs said Directory/File – call out normalization.

Epoch values 1783621485 ≈ mid-2026 future – consider realistic 1700... or note illustrative.

Missing disclosure: times.created absent on Linux ext4 (no birthtime), times fields may be missing pre-1970 when duration_since fails.

Grammar: along with it's output line 735 → its output.

Document that file.list("/some_directory") now returns directory itself as first entry – new vs upstream.

File: docs/_docs/user-guide/eldritch.md:735-791

applied, lowercase dir and file are accurate, and all fields are accurate to the current version of file.list (including this PR)

AmeliaYeah · 2026-07-12T18:30:56Z

didnt want to make a separate issue for this but during testing i noticed file.timestomp doesn't seem to support negative epochs (with ref_file and specifying them in fields like mtime) and just defaults them to 0. i might make a fix to this in the future but just wanted to note it.

hulto · 2026-07-17T22:43:06Z

+`file.list(path: str, dir_self: Optional<bool> = False) -> List<Dict>`

 The **file.list** method returns a list of files at the specified path. The path is relative to your current working directory and can be traversed with `../`.
+If `path` is a directory, `dir_self` denotes whether to show the information of `path` itself in the `List<Dict>`. This field has no impact if `path` is not a directory.


Does dir_self only show the local dir or optionally include it?
If only itself - can you name it only_dir_self to be more clear.
If optionally include the local dir - i think we should include that by default similar to ls

Okay seems like it optionally includes the local dir. I think we should always include this.

hulto · 2026-07-17T22:51:51Z

Thanks @AmeliaYeah !
And feel free to ping us on Discord if you need re-review or workflow run approval.

get_times

a52455a

AmeliaYeah changed the title ~~get_times~~ Added get_times() to get timestamp information of files Jun 28, 2026

hulto reviewed Jul 3, 2026

View reviewed changes

file.list shows timestamp information and directory being listed from

3cb83a7

AmeliaYeah force-pushed the main branch from 9261bc5 to 3cb83a7 Compare July 8, 2026 17:39

AmeliaYeah changed the title ~~Added get_times() to get timestamp information of files~~ file.list works for directories, shows timestamp information as epoch for create,access,modified,changed Jul 9, 2026

legacy support with stringified modification time, docs/name changes

27f9d1f

jabbate19 reviewed Jul 10, 2026

View reviewed changes

jabbate19 requested changes Jul 10, 2026

View reviewed changes

fixes

8026b42

docs fixup

9b2712c

hulto reviewed Jul 17, 2026

View reviewed changes

Uh oh!

Conversation

AmeliaYeah commented Jun 28, 2026

What type of PR is this?

What this PR does / why we need it:

Uh oh!

hulto left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AmeliaYeah commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jabbate19 commented Jul 10, 2026

Uh oh!

jabbate19 left a comment

Choose a reason for hiding this comment

Uh oh!

jabbate19 Jul 10, 2026

Choose a reason for hiding this comment

Uh oh!

AmeliaYeah Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

jabbate19 Jul 10, 2026

Choose a reason for hiding this comment

Uh oh!

AmeliaYeah Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jabbate19 Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AmeliaYeah Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AmeliaYeah commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hulto Jul 17, 2026

Choose a reason for hiding this comment

Uh oh!

hulto Jul 17, 2026

Choose a reason for hiding this comment

Uh oh!

hulto commented Jul 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

hulto left a comment •

edited

Loading

AmeliaYeah commented Jul 8, 2026 •

edited

Loading

jabbate19 Jul 10, 2026 •

edited

Loading

AmeliaYeah Jul 12, 2026 •

edited

Loading

AmeliaYeah commented Jul 12, 2026 •

edited

Loading