name takes any byte a file name can hold, controls, edge blanks and bytes not UTF-8 included, so what name reads writes back as it was

A pane opened on a file whose name held a tab, a control byte or bytes
not UTF-8 read that name from its name file, and the same bytes written
back were refused. Only what no file name holds is refused now: a second
line and a NUL. The ctl word name still refuses a second blank after the
word, as a line's words are split at blanks.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

1 files changed, 4 insertions, 1 deletions

diff --git a/src/ninep/ctl.zig b/src/ninep/ctl.zig
index fc0558f5..5a199f55 100644
--- a/src/ninep/ctl.zig
+++ b/src/ninep/ctl.zig
@@ -947,7 +947,10 @@ fn acmeCtl(p: *Pardes, req: Req, serial: u32, line: []const u8, apply: bool) Acm
     // A word written to one of the pane's own files, as acme's is to its.
     const Into = struct { file: File, data: []const u8 };
     // `name` takes all after its one blank, as the name file takes what is
-    // written: a blank at its start is refused there, not trimmed here.
+    // written. A second blank after the word is refused, not taken as the
+    // name's first byte: a line's words are split at blanks.
+    if (std.mem.eql(u8, word, "name") and rest.len > 0 and line[word.len + 1] == ' ')
+        return .{ .refused = tree.failText(req.tag, E.INVAL, "bad character in file name: a blank at its start") };
     const into: ?Into = if (std.mem.eql(u8, word, "name") and rest.len > 0)
         .{ .file = .name, .data = line[word.len + 1 ..] }
     else if (std.mem.eql(u8, line, "clean"))