Turbopack: next build fails with "Permission denied (os error 13)" when a dynamic path.join meets an unreadable folder #100870

Link to the code that reproduces this issue

https://github.com/ivermin1123/next-turbopack-eacces-repro

To Reproduce

pnpm install
mkdir -p private/sealed && chmod 000 private/sealed
pnpm build            # fails
pnpm build:webpack    # passes
chmod 755 private/sealed
pnpm build            # passes

The only code involved is app/api/files/route.js:

import path from "node:path";

export async function GET(request) {
  const dir = new URL(request.url).searchParams.get("dir") ?? "/tmp";
  return Response.json({ out: path.join(dir, "out") });
}

Current vs. Expected behavior

If the project has a directory I can't read (chmod 000), next build with Turbopack crashes with "Permission denied (os error 13)", even though nothing reads that directory. It should just skip it, like webpack and next dev do.

Error [TurbopackInternalError]: Failed to write app endpoint /page

Caused by:
- [project]/app/api/files/route.js [app-route] (ecmascript)
- reading dir "/path/to/repro/private/sealed"
- Permission denied (os error 13)

Debug info:
- Execution of SingleModuleGraph::new_with_entries failed
- [project]/app/api/files/route.js [app-route] (ecmascript)
- Execution of primary_chunkable_referenced_modules failed
- Execution of <DirAssetReference as ModuleReference>::resolve_reference failed
- Execution of read_matches failed
- Execution of read_matches failed
- Execution of <DiskFileSystem as FileSystem>::raw_read_dir failed
- reading dir "/path/to/repro/private/sealed"
- Permission denied (os error 13)

Provide environment information

Operating System:
  Platform: darwin
  Arch: arm64
  Version: Darwin Kernel Version 27.0.0
  Available memory (MB): 18432
  Available CPU cores: 11
Binaries:
  Node: 24.21.0
  npm: 11.19.0
  Yarn: N/A
  pnpm: 10.15.0
Relevant Packages:
  next: 16.5.0-canary.30 // Latest available version is detected (16.5.0-canary.30).
  eslint-config-next: N/A
  react: 19.2.7
  react-dom: 19.2.7
  typescript: N/A
Next.js Config:
  output: N/A

Which area(s) are affected? (Select all that apply)

Output, Turbopack

Which stage(s) are affected? (Select all that apply)

next build (local)

Additional context

The locked dir holds the answer key for a blind eval, so nobody (agents included) can read it until we're done. turbopackIgnore doesn't fully help: the outputFileTracingIncludes globs in next.config.ts still walk into it, and there's no way to ignore those, so I had to build from a clean worktree. I have a fix with tests based on #78622 and will open a PR.

• Fails on 16.3.3, 16.4.3, 16.5.0-canary.27 and 16.5.0-canary.30.
• Passes: the same folder readable; next build --webpack; next dev (200); path.join(/* turbopackIgnore: true */ dir, "out").
• Does not help: outputFileTracingExcludes.
• raw_read_dir in turbopack/crates/turbo-tasks-fs/src/disk.rs (lines 966-995 at canary 7fd2d0a6) treats NotFound, NotADirectory and InvalidFilename as not found, but returns PermissionDenied as an error.
• Related: Turbopack instrumentation fails with permission denied error on CI #78509 (same chain in next dev, closed after Turbopack: don't resolve traced references in dev #78623), Turbopack: ignore PermissionDenied in raw_read_dir #78622 (proposed fix, open).