rpscan: pre-flight safety for file operations

Date: February 02, 2026

If your script can delete, overwrite, or deploy, it can also follow a junction you never meant to trust. rpscan catches that early.

Live Demo Fixture

cmd /c mklink /J hype\tmp\rpscan_demo\link hype\tmp\rpscan_demo\target
_test\rpscan.exe hype\tmp\rpscan_demo --recursive --stats

Junction created for hype\tmp\rpscan_demo\link <<===>> hype\tmp\rpscan_demo\target
MOUNT_POINT 0xA0000003 hype\tmp\rpscan_demo\link -> C:\temp\rpscan_demo\target
scanned: 3
reparse: 1

Exactly the result you need before destructive automation touches a tree.

Workflow 1: Cheap CI Gate

_test\rpscan.exe C:\work\repo --recursive --stats

Fail the pipeline if unexpected reparse points appear. Pair with allowlisted tags/paths when needed.

Workflow 2: Path-Only Integration

_test\rpscan.exe hype\tmp\rpscan_demo --recursive --paths

hype\tmp\rpscan_demo\link

Use this mode to feed downstream policy logic without parsing verbose lines.

Guardrails

Directory reparse points are reported but not traversed by design. That is a safety choice, not a bug.