-- 
cgit v0.12

From cbed1606a6e4917db28ee91660c0cd1d672db7b6 Mon Sep 17 00:00:00 2001
From: kjnash <k.j.nash@usa.net>
Date: Thu, 9 Jul 2020 10:01:51 +0000
Subject: Apply patch for new features other than -autoPath

---
 library/safe.tcl | 127 ++++++++++++++++++---
 tests/safe.test  | 339 ++++++++++++++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 444 insertions(+), 22 deletions(-)

diff --git a/library/safe.tcl b/library/safe.tcl
index 3429b9e..dcf3c82 100644
--- a/library/safe.tcl
+++ b/library/safe.tcl
@@ -249,10 +249,11 @@ proc ::safe::interpConfigure {args} {
 # Optional Arguments :
 # + slave name : if empty, generated name will be used
 # + access_path: path list controlling where load/source can occur,
-#                if empty: the master auto_path will be used.
+#                if empty: the master auto_path and its subdirectories will be
+#                used.
 # + staticsok  : flag, if 0 :no static package can be loaded (load {} Xxx)
 #                      if 1 :static packages are ok.
-# + nestedok: flag, if 0 :no loading to sub-sub interps (load xx xx sub)
+# + nestedok   : flag, if 0 :no loading to sub-sub interps (load xx xx sub)
 #                      if 1 : multiple levels are ok.
 
 # use the full name and no indent so auto_mkIndex can find us
@@ -278,12 +279,16 @@ proc ::safe::InterpCreate {
 
 #
 # InterpSetConfig (was setAccessPath) :
-#    Sets up slave virtual auto_path and corresponding structure within
+#    Sets up slave virtual access path and corresponding structure within
 #    the master. Also sets the tcl_library in the slave to be the first
 #    directory in the path.
 #    NB: If you change the path after the slave has been initialized you
 #    probably need to call "auto_reset" in the slave in order that it gets
 #    the right auto_index() array values.
+#
+#    It is the caller's responsibility, if it supplies a non-empty value for
+#    access_path, to make the first directory in the path suitable for use as
+#    tcl_library, and (if ![SetAutoPathSync]), to set the slave's ::auto_path.
 
 proc ::safe::InterpSetConfig {slave access_path staticsok nestedok deletehook} {
     global auto_path
@@ -309,10 +314,14 @@ proc ::safe::InterpSetConfig {slave access_path staticsok nestedok deletehook} {
 			moved it to front of slave's access_path" NOTICE
 	}
 
+	set raw_auto_path $access_path
+
 	# Add 1st level sub dirs (will searched by auto loading from tcl
 	# code in the slave using glob and thus fail, so we add them here
 	# so by default it works the same).
 	set access_path [AddSubDirs $access_path]
+    } else {
+	set raw_auto_path {}
     }
 
     Log $slave "Setting accessPath=($access_path) staticsok=$staticsok\
@@ -343,7 +352,20 @@ proc ::safe::InterpSetConfig {slave access_path staticsok nestedok deletehook} {
 	incr i
     }
 
+    # Set the slave auto_path.
+    # If [SetAutoPathSync], SyncAccessPath will overwrite this value with the
+    # full access path.
+    # If ![SetAutoPathSync], Safe Base code will not change this value.
+    set tokens_auto_path {}
+    foreach dir $raw_auto_path {
+	if {[dict exists $remap_access_path $dir]} {
+	    lappend tokens_auto_path [dict get $remap_access_path $dir]
+	}
+    }
+    ::interp eval $slave [list set auto_path $tokens_auto_path]
+
     set morepaths [::tcl::tm::list]
+    set firstpass 1
     while {[llength $morepaths]} {
 	set addpaths $morepaths
 	set morepaths {}
@@ -361,7 +383,12 @@ proc ::safe::InterpSetConfig {slave access_path staticsok nestedok deletehook} {
 	    lappend map_access_path    $token $dir
 	    lappend remap_access_path  $dir $token
 	    lappend norm_access_path   [file normalize $dir]
-	    lappend slave_tm_path $token
+	    if {$firstpass} {
+		# $dir is in [::tcl::tm::list] and belongs in the slave_tm_path.
+		# Later passes handle subdirectories, which belong in the
+		# access path but not in the module path.
+		lappend slave_tm_path  $token
+	    }
 	    incr i
 
 	    # [Bug 2854929]
@@ -372,6 +399,7 @@ proc ::safe::InterpSetConfig {slave access_path staticsok nestedok deletehook} {
 	    # subdirectories.
 	    lappend morepaths {*}[glob -nocomplain -directory $dir -type d *]
 	}
+	set firstpass 0
     }
 
     set state(access_path)       $access_path
@@ -547,6 +575,15 @@ proc ::safe::interpDelete {slave} {
 
     namespace upvar ::safe S$slave state
 
+    # Sub interpreters would be deleted automatically, but if they are managed
+    # by the Safe Base we also need to clean up, and this needs to be done
+    # independently of the cleanupHook.
+    foreach sub [interp slaves $slave] {
+        if {[info exists ::safe::S[list $slave $sub]]} {
+            ::safe::interpDelete [list $slave $sub]
+        }
+    }
+
     # If the slave has a cleanup hook registered, call it.  Check the
     # existance because we might be called to delete an interp which has
     # not been registered with us at all
@@ -613,20 +650,23 @@ proc ::safe::setLogCmd {args} {
 # ------------------- END OF PUBLIC METHODS ------------
 
 #
-# Sets the slave auto_path to the master recorded value.  Also sets
-# tcl_library to the first token of the virtual path.
+# Sets the slave auto_path to its recorded access path.  Also sets
+# tcl_library to the first token of the access path.
 #
 proc ::safe::SyncAccessPath {slave} {
+    variable AutoPathSync
     namespace upvar ::safe S$slave state
 
     set slave_access_path $state(access_path,slave)
-    ::interp eval $slave [list set auto_path $slave_access_path]
+    if {$AutoPathSync} {
+	::interp eval $slave [list set auto_path $slave_access_path]
 
-    Log $slave "auto_path in $slave has been set to $slave_access_path"\
-	NOTICE
+	Log $slave "auto_path in $slave has been set to $slave_access_path"\
+		NOTICE
+    }
 
     # This code assumes that info library is the first element in the
-    # list of auto_path's. See -> InterpSetConfig for the code which
+    # list of access path's. See -> InterpSetConfig for the code which
     # ensures this condition.
 
     ::interp eval $slave [list \
@@ -690,6 +730,7 @@ proc ::safe::AliasFileSubcommand {slave subcommand name} {
 # AliasGlob is the target of the "glob" alias in safe interpreters.
 
 proc ::safe::AliasGlob {slave args} {
+    variable AutoPathSync
     Log $slave "GLOB ! $args" NOTICE
     set cmd {}
     set at 0
@@ -712,11 +753,15 @@ proc ::safe::AliasGlob {slave args} {
 
     while {$at < [llength $args]} {
 	switch -glob -- [set opt [lindex $args $at]] {
-	    -nocomplain - -- - -join - -tails {
+	    -nocomplain - -- - -tails {
 		lappend cmd $opt
 		set got($opt) 1
 		incr at
 	    }
+	    -join {
+		set got($opt) 1
+		incr at
+	    }
 	    -types - -type {
 		lappend cmd -types [lindex $args [incr at]]
 		incr at
@@ -731,15 +776,20 @@ proc ::safe::AliasGlob {slave args} {
 		incr at
 	    }
 	    pkgIndex.tcl {
-		# Oops, this is globbing a subdirectory in regular package
-		# search. That is not wanted. Abort, handler does catch
-		# already (because glob was not defined before). See
-		# package.tcl, lines 484ff in tclPkgUnknown.
-		return -code error "unknown command glob"
+		if {$AutoPathSync} {
+		    # Oops, this is globbing a subdirectory in regular package
+		    # search. That is not wanted. Abort, handler does catch
+		    # already (because glob was not defined before). See
+		    # package.tcl, lines 484ff in tclPkgUnknown.
+		    return -code error "unknown command glob"
+		} else {
+		    break
+		}
 	    }
 	    -* {
 		Log $slave "Safe base rejecting glob option '$opt'"
 		return -code error "Safe base rejecting glob option '$opt'"
+		# unsafe/unnecessary options rejected: -path
 	    }
 	    default {
 		break
@@ -763,7 +813,7 @@ proc ::safe::AliasGlob {slave args} {
 	lappend cmd -directory $dir
     }
 
-    # Apply the -join semantics ourselves
+    # Apply the -join semantics ourselves (hence -join not copied to $cmd)
     if {$got(-join)} {
 	set args [lreplace $args $at end [join [lrange $args $at end] "/"]]
     }
@@ -1105,8 +1155,49 @@ proc ::safe::Setup {} {
     return
 }
 
+# Accessor method for ::safe::SetAutoPathSync
+# Usage: ::safe::SetAutoPathSync ?newValue?
+
+proc ::safe::SetAutoPathSync {args} {
+    variable AutoPathSync
+
+    if {[llength $args] == 1} {
+        set newValue [lindex $args 0]
+        if {![string is boolean -strict $newValue]} {
+            return -code error "new value must be a valid boolean"
+        }
+        set args [expr {$newValue && $newValue}]
+        if {([info vars ::safe::S*] ne {}) && ($args != $AutoPathSync)} {
+            return -code error \
+                    "cannot change AutoPathSync while Safe Base slaves exist"
+        }
+    }
+
+    set AutoPathSync {*}$args
+}
+
 namespace eval ::safe {
-    # internal variables
+    # internal variables (must not begin with "S")
+
+    # AutoPathSync
+    #
+    # Set AutoPathSync to 0 to give a slave's ::auto_path the same meaning as
+    # for an unsafe interpreter: the package command will search its directories
+    # and first-level subdirectories for pkgIndex.tcl files; the auto-loader
+    # will search its directories for tclIndex files.  The access path and
+    # module path will be maintained as separate values, and ::auto_path will
+    # not be updated when the user calls ::safe::interpAddToAccessPath to add to
+    # the access path.  If the user specifies an access path when calling
+    # interpCreate, interpInit or interpConfigure, it is the user's
+    # responsibility to define the slave's auto_path.  If these commands are
+    # called with no (or empty) access path, the slave's auto_path will be set
+    # to a tokenized form of the master's auto_path, and these directories and
+    # their first-level subdirectories will be added to the access path.
+    #
+    # Set to 1 for "traditional" behavior: a slave's entire access path and
+    # module path are copied to its ::auto_path, which is updated whenever
+    # the user calls ::safe::interpAddToAccessPath to add to the access path.
+    variable AutoPathSync 1
 
     # Log command, set via 'setLogCmd'. Logging is disabled when empty.
     variable Log {}
diff --git a/tests/safe.test b/tests/safe.test
index 11ad2a9..fac52f1 100644
--- a/tests/safe.test
+++ b/tests/safe.test
@@ -17,6 +17,8 @@ if {[lsearch [namespace children] ::tcltest] == -1} {
     namespace import -force ::tcltest::*
 }
 
+testConstraint AutoSyncDefined 1
+
 foreach i [interp slaves] {
     interp delete $i
 }
@@ -180,22 +182,46 @@ test safe-6.3 {test safe interpreters knowledge of the world} {
 # leaking infos, but they still do...
 
 # high level general test
-test safe-7.1 {tests that everything works at high level} -body {
+test safe-7.1 {tests that everything works at high level with conventional AutoPathSync} -setup {
+    # All ::safe commands are loaded at start of file.
+    set SyncExists [expr {[info commands ::safe::SetAutoPathSync] ne {}}]
+
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::SetAutoPathSync]
+        safe::SetAutoPathSync 1
+    }
+
     set i [safe::interpCreate]
+
+} -body {
     # no error shall occur:
     # (because the default access_path shall include 1st level sub dirs so
     #  package require in a slave works like in the master)
     set v [interp eval $i {package require http 2}]
     # no error shall occur:
     interp eval $i {http::config}
-    safe::interpDelete $i
     set v
+} -cleanup {
+    safe::interpDelete $i
+    if {$SyncExists} {
+        safe::SetAutoPathSync $SyncVal_TMP
+    }
 } -match glob -result 2.*
-test safe-7.2 {tests specific path and interpFind/AddToAccessPath} -body {
+test safe-7.2 {tests specific path and interpFind/AddToAccessPath with conventional AutoPathSync} -setup {
+    # All ::safe commands are loaded at start of file.
+    set SyncExists [expr {[info commands ::safe::SetAutoPathSync] ne {}}]
+
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::SetAutoPathSync]
+        safe::SetAutoPathSync 1
+    } else {
+        set SyncVal_TMP 1
+    }
+} -body {
     set i [safe::interpCreate -nostat -nested 1 -accessPath [list [info library]]]
     # should not add anything (p0)
     set token1 [safe::interpAddToAccessPath $i [info library]]
-    # should add as p1
+    # should add as p* (not p1 if master has a module path)
     set token2 [safe::interpAddToAccessPath $i "/dummy/unixlike/test/path"]
     # an error shall occur (http is not anymore in the secure 0-level
     # provided deep path)
@@ -203,6 +229,10 @@ test safe-7.2 {tests specific path and interpFind/AddToAccessPath} -body {
 	    [catch {interp eval $i {package require http 1}} msg] $msg \
 	    [safe::interpConfigure $i]\
 	    [safe::interpDelete $i]
+} -cleanup {
+    if {$SyncExists} {
+        safe::SetAutoPathSync $SyncVal_TMP
+    }
 } -match glob -result "{\$p(:0:)} {\$p(:*:)} 1 {can't find package http 1} {-accessPath {[list $tcl_library */dummy/unixlike/test/path]} -statics 0 -nested 1 -deleteHook {}} {}"
 test safe-7.3 {check that safe subinterpreters work} {
     set i [safe::interpCreate]
@@ -210,6 +240,64 @@ test safe-7.3 {check that safe subinterpreters work} {
     list [interp eval $j {join {o k} ""}] [safe::interpDelete $i] [interp exists $j]
 } {ok {} 0}
 
+test safe-7.4 {tests specific path and positive search with conventional AutoPathSync} -setup {
+    # All ::safe commands are loaded at start of file.
+    set SyncExists [expr {[info commands ::safe::SetAutoPathSync] ne {}}]
+
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::SetAutoPathSync]
+        safe::SetAutoPathSync 1
+    } else {
+        set SyncVal_TMP 1
+    }
+} -body {
+    set i [safe::interpCreate -nostat -nested 1 -accessPath [list [info library]]]
+    # should not add anything (p0)
+    set token1 [safe::interpAddToAccessPath $i [info library]]
+    # should add as p* (not p1 if master has a module path)
+    set token2 [safe::interpAddToAccessPath $i [file join [info library] http1.0]]
+    # this time, unlike test safe-7.2, http 1.0 should be found
+    list $token1 $token2 \
+	    [catch {interp eval $i {package require http 1}} msg] $msg \
+	    [safe::interpConfigure $i]\
+	    [safe::interpDelete $i]
+    # Note that the glob match elides directories (those from the module path)
+    # other than the first and last in the access path.
+} -cleanup {
+    if {$SyncExists} {
+        safe::SetAutoPathSync $SyncVal_TMP
+    }
+} -match glob -result "{\$p(:0:)} {\$p(:*:)} 0 1.0 {-accessPath {[list $tcl_library *$tcl_library/http1.0]} -statics 0 -nested 1 -deleteHook {}} {}"
+
+test safe-7.5 {tests positive and negative module loading with conventional AutoPathSync} -setup {
+    # All ::safe commands are loaded at start of file.
+    set SyncExists [expr {[info commands ::safe::SetAutoPathSync] ne {}}]
+
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::SetAutoPathSync]
+        safe::SetAutoPathSync 1
+    }
+
+    set i [safe::interpCreate]
+
+    interp eval $i {
+        package forget platform::shell
+        package forget platform
+        catch {namespace delete ::platform}
+    }
+} -body {
+    # Should raise an error (module ancestor directory issue)
+    set code1 [catch {interp eval $i {package require shell}} msg1]
+    # Should not raise an error
+    set code2 [catch {interp eval $i {package require platform::shell}} msg2]
+    return [list $code1 $msg1 $code2]
+} -cleanup {
+    safe::interpDelete $i
+    if {$SyncExists} {
+        safe::SetAutoPathSync $SyncVal_TMP
+    }
+} -result {1 {can't find package shell} 0}
+
 # test source control on file name
 set i "a"
 test safe-8.1 {safe source control on file} -setup {
@@ -403,6 +491,8 @@ test safe-9.6 {interpConfigure widget like behaviour} -body {
 	 safe::interpConfigure $i]\
 	[safe::interpConfigure $i -deleteHook toto -nosta -nested 0
 	 safe::interpConfigure $i]
+} -cleanup {
+    safe::interpDelete $i
 } -match glob -result {{-accessPath * -statics 0 -nested 1 -deleteHook {foo bar}} {-accessPath *} {-nested 1} {-statics 0} {-deleteHook {foo bar}} {-accessPath * -statics 1 -nested 1 -deleteHook {foo bar}} {-accessPath * -statics 0 -nested 0 -deleteHook toto}}
 
 catch {teststaticpkg Safepkg1 0 0}
@@ -831,6 +921,247 @@ test safe-16.4 {Bug 3529949: defang ~user in globs} -setup {
 } -cleanup {
     safe::interpDelete $i
 } -result {}
+
+### 17. The first element in a slave's ::auto_path and access path must be [info library].
+
+test safe-17.1 {Check that first element of slave auto_path (and access path) is Tcl Library} -setup {
+    set lib1        [info library]
+    set lib2        [file dirname $lib1]
+    set ::auto_TMP  $::auto_path
+    set ::auto_path [list $lib1 $lib2]
+
+    set i [safe::interpCreate]
+} -body {
+    set autoList {}
+    set token [lindex [$i eval set ::auto_path] 0]
+    set auto0 [dict get [set ::safe::S${i}(access_path,map)] $token]
+    set accessList [lindex [safe::interpConfigure $i -accessPath] 1]
+    return [list [lindex $accessList 0] $auto0]
+} -cleanup {
+    set ::auto_path $::auto_TMP
+    safe::interpDelete $i
+} -result [list [info library] [info library]]
+
+test safe-17.2 {Check that first element of slave auto_path (and access path) is Tcl Library, even if not true for master} -setup {
+    set lib1        [info library]
+    set lib2        [file dirname $lib1]
+    set ::auto_TMP  $::auto_path
+    set ::auto_path [list $lib2 $lib1]
+    # Unexpected order, should be reversed in the slave
+
+    set i [safe::interpCreate]
+} -body {
+    set autoList {}
+    set token [lindex [$i eval set ::auto_path] 0]
+    set auto0 [dict get [set ::safe::S${i}(access_path,map)] $token]
+    set accessList [lindex [safe::interpConfigure $i -accessPath] 1]
+
+    return [list [lindex $accessList 0] $auto0]
+} -cleanup {
+    set ::auto_path $::auto_TMP
+    safe::interpDelete $i
+} -result [list [info library] [info library]]
+
+### 18. Tests for AutoSyncDefined without conventional AutoPathSync, i.e. with AutoPathSync off.
+
+test safe-18.1 {cf. safe-7.1 - tests that everything works at high level without conventional AutoPathSync} -constraints AutoSyncDefined -setup {
+    # All ::safe commands are loaded at start of file.
+    set SyncExists [expr {[info commands ::safe::SetAutoPathSync] ne {}}]
+
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::SetAutoPathSync]
+        safe::SetAutoPathSync 0
+    } else {
+        error {This test is meaningful only if the command ::safe::SetAutoPathSync is defined}
+    }
+
+    # Without AutoPathSync, we need a more complete auto_path, because the slave will use the same value.
+    set lib1        [info library]
+    set lib2        [file dirname $lib1]
+    set ::auto_TMP  $::auto_path
+    set ::auto_path [list $lib1 $lib2]
+
+    set i [safe::interpCreate]
+} -body {
+    # no error shall occur:
+    # (because the default access_path shall include 1st level sub dirs
+    #  so package require in a slave works like in the master)
+    set v [interp eval $i {package require http 1}]
+    # no error shall occur:
+    interp eval $i {http_config}
+    set v
+} -cleanup {
+    set ::auto_path $::auto_TMP
+    safe::interpDelete $i
+    if {$SyncExists} {
+        safe::SetAutoPathSync $SyncVal_TMP
+    }
+} -result 1.0
+
+test safe-18.2 {cf. safe-7.2 - tests specific path and interpFind/AddToAccessPath without conventional AutoPathSync} -constraints AutoSyncDefined -setup {
+    # All ::safe commands are loaded at start of file.
+    set SyncExists [expr {[info commands ::safe::SetAutoPathSync] ne {}}]
+
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::SetAutoPathSync]
+        safe::SetAutoPathSync 0
+    } else {
+        error {This test is meaningful only if the command ::safe::SetAutoPathSync is defined}
+    }
+} -body {
+    set i [safe::interpCreate -nostat -nested 1 -accessPath [list [info library]]]
+    set auto1 [interp eval $i {set ::auto_path}]
+    interp eval $i {set ::auto_path [list {$p(:0:)}]}
+    # should not add anything (p0)
+    set token1 [safe::interpAddToAccessPath $i [info library]]
+    # should add as p1
+    set token2 [safe::interpAddToAccessPath $i "/dummy/unixlike/test/path"]
+    # an error shall occur (http is not anymore in the secure 0-level
+    # provided deep path)
+    list $auto1 $token1 $token2 \
+	    [catch {interp eval $i {package require http 1}} msg] $msg \
+	    [safe::interpConfigure $i]\
+	    [safe::interpDelete $i]
+} -cleanup {
+    if {$SyncExists} {
+        safe::SetAutoPathSync $SyncVal_TMP
+    }
+} -match glob -result "{} {\$p(:0:)} {\$p(:*:)} 1 {can't find package http 1} {-accessPath {[list $tcl_library */dummy/unixlike/test/path]} -statics 0 -nested 1 -deleteHook {}} {}"
+
+test safe-18.3 {Check that default auto_path is the same as in the master interpreter without conventional AutoPathSync} -constraints AutoSyncDefined -setup {
+    # All ::safe commands are loaded at start of file.
+    set SyncExists [expr {[info commands ::safe::SetAutoPathSync] ne {}}]
+
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::SetAutoPathSync]
+        safe::SetAutoPathSync 0
+    } else {
+        error {This test is meaningful only if the command ::safe::SetAutoPathSync is defined}
+    }
+
+    set i [safe::interpCreate]
+
+} -body {
+    # This file's header sets auto_path to a single directory [info library],
+    # which is the one required by Safe Base to be present & first in the list.
+
+    set ap {}
+    foreach token [$i eval set ::auto_path] {
+        lappend ap [dict get [set ::safe::S${i}(access_path,map)] $token]
+    }
+    return $ap
+} -cleanup {
+    safe::interpDelete $i
+    if {$SyncExists} {
+	safe::SetAutoPathSync $SyncVal_TMP
+    }
+} -result [set ::auto_path]
+
+test safe-18.4 {cf. safe-7.4 - tests specific path and positive search and auto_path without conventional AutoPathSync} -constraints AutoSyncDefined -setup {
+    # All ::safe commands are loaded at start of file.
+    set SyncExists [expr {[info commands ::safe::SetAutoPathSync] ne {}}]
+
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::SetAutoPathSync]
+        safe::SetAutoPathSync 0
+    } else {
+        error {This test is meaningful only if the command ::safe::SetAutoPathSync is defined}
+    }
+} -body {
+    set i [safe::interpCreate -nostat -nested 1 -accessPath [list [info library]]]
+
+    # should not have been set by Safe Base:
+    set auto1 [interp eval $i {set ::auto_path}]
+
+    interp eval $i {set ::auto_path [list {$p(:0:)}]}
+
+    # should not add anything (p0)
+    set token1 [safe::interpAddToAccessPath $i [info library]]
+
+    # should add as p* (not p1 if master has a module path)
+    set token2 [safe::interpAddToAccessPath $i [file join [info library] http1.0]]
+
+    # should not have been changed by Safe Base:
+    set auto2 [interp eval $i {set ::auto_path}]
+
+    # This time, unlike test safe-18.2 and the try above, http 1.0 should be found:
+    list $auto1 $auto2 $token1 $token2 \
+	    [catch {interp eval $i {package require http 1}} msg] $msg \
+	    [safe::interpConfigure $i]\
+	    [safe::interpDelete $i]
+} -cleanup {
+    if {$SyncExists} {
+	safe::SetAutoPathSync $SyncVal_TMP
+    }
+} -match glob -result "{} {{\$p(:0:)}} {\$p(:0:)} {\$p(:*:)} 0 1.0 {-accessPath {[list $tcl_library *$tcl_library/http1.0]} -statics 0 -nested 1 -deleteHook {}} {}"
+
+test safe-18.5 {cf. safe-7.5 - tests positive and negative module loading without conventional AutoPathSync} -setup {
+    # All ::safe commands are loaded at start of file.
+    set SyncExists [expr {[info commands ::safe::SetAutoPathSync] ne {}}]
+
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::SetAutoPathSync]
+        safe::SetAutoPathSync 0
+    } else {
+        error {This test is meaningful only if the command ::safe::SetAutoPathSync is defined}
+    }
+
+    set i [safe::interpCreate]
+
+    interp eval $i {
+        package forget platform::shell
+        package forget platform
+        catch {namespace delete ::platform}
+    }
+} -body {
+    # Should raise an error (tests module ancestor directory rule)
+    set code1 [catch {interp eval $i {package require shell}} msg1]
+    # Should not raise an error
+    set code2 [catch {interp eval $i {package require platform::shell}} msg2]
+    return [list $code1 $msg1 $code2]
+} -cleanup {
+    safe::interpDelete $i
+    if {$SyncExists} {
+        safe::SetAutoPathSync $SyncVal_TMP
+    }
+} -result {1 {can't find package shell} 0}
+
+### 19. Test tokenization of directories available to a slave.
+
+test safe-19.1 {Check that each directory of the default auto_path is a valid token} -setup {
+    set i [safe::interpCreate]
+} -body {
+    set badTokens {}
+    foreach dir [$i eval {set ::auto_path}] {
+        if {[regexp {^\$p\(:[0-9]+:\)$} $dir]} {
+            # Match - OK - token has expected form
+        } else {
+            # No match - possibly an ordinary path has not been tokenized
+            lappend badTokens $dir
+        }
+    }
+    set badTokens
+} -cleanup {
+    safe::interpDelete $i
+} -result {}
+
+test safe-19.2 {Check that each directory of the module path is a valid token} -setup {
+    set i [safe::interpCreate]
+} -body {
+    set badTokens {}
+    foreach dir [$i eval {::tcl::tm::path list}] {
+        if {[regexp {^\$p\(:[0-9]+:\)$} $dir]} {
+            # Match - OK - token has expected form
+        } else {
+            # No match - possibly an ordinary path has not been tokenized
+            lappend badTokens $dir
+        }
+    }
+    set badTokens
+} -cleanup {
+    safe::interpDelete $i
+} -result {}
+
 
 set ::auto_path $saveAutoPath
 # cleanup
-- 
cgit v0.12


From 40970bda3738a098f7adea63dcaed2ccb4ef15c0 Mon Sep 17 00:00:00 2001
From: kjnash <k.j.nash@usa.net>
Date: Thu, 9 Jul 2020 10:11:35 +0000
Subject: Add code for -autoPath option in Safe Base.

---
 library/safe.tcl | 150 ++++++++++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 132 insertions(+), 18 deletions(-)

diff --git a/library/safe.tcl b/library/safe.tcl
index dcf3c82..a1fadb1 100644
--- a/library/safe.tcl
+++ b/library/safe.tcl
@@ -78,18 +78,29 @@ proc ::safe::InterpNested {} {
 
 # Interface/entry point function and front end for "Create"
 proc ::safe::interpCreate {args} {
+    variable AutoPathSync
+    if {$AutoPathSync} {
+        set autoPath {}
+    }
     set Args [::tcl::OptKeyParse ::safe::interpCreate $args]
+
+    set withAutoPath [::tcl::OptProcArgGiven -autoPath]
     InterpCreate $slave $accessPath \
-	[InterpStatics] [InterpNested] $deleteHook
+	[InterpStatics] [InterpNested] $deleteHook $autoPath $withAutoPath
 }
 
 proc ::safe::interpInit {args} {
+    variable AutoPathSync
+    if {$AutoPathSync} {
+        set autoPath {}
+    }
     set Args [::tcl::OptKeyParse ::safe::interpIC $args]
     if {![::interp exists $slave]} {
 	return -code error "\"$slave\" is not an interpreter"
     }
+    set withAutoPath [::tcl::OptProcArgGiven -autoPath]
     InterpInit $slave $accessPath \
-	[InterpStatics] [InterpNested] $deleteHook
+	[InterpStatics] [InterpNested] $deleteHook $autoPath $withAutoPath
 }
 
 # Check that the given slave is "one of us"
@@ -115,6 +126,7 @@ proc ::safe::CheckInterp {slave} {
 # So this will be hopefully written and some integrated with opt1.0
 # (hopefully for tcl8.1 ?)
 proc ::safe::interpConfigure {args} {
+    variable AutoPathSync
     switch [llength $args] {
 	1 {
 	    # If we have exactly 1 argument the semantic is to return all
@@ -125,11 +137,17 @@ proc ::safe::interpConfigure {args} {
 	    CheckInterp $slave
 	    namespace upvar ::safe S$slave state
 
-	    return [join [list \
+	    set TMP [list \
 		[list -accessPath $state(access_path)] \
 		[list -statics    $state(staticsok)]   \
 		[list -nested     $state(nestedok)]    \
-	        [list -deleteHook $state(cleanupHook)]]]
+	        [list -deleteHook $state(cleanupHook)] \
+	    ]
+	    if {!$AutoPathSync} {
+	        set SLAP [DetokPath $slave [$slave eval set ::auto_path]]
+	        lappend TMP [list -autoPath $SLAP]
+	    }
+	    return [join $TMP]
 	}
 	2 {
 	    # If we have exactly 2 arguments the semantic is a "configure
@@ -154,6 +172,14 @@ proc ::safe::interpConfigure {args} {
 		-accessPath {
 		    return [list -accessPath $state(access_path)]
 		}
+		-autoPath {
+		    if {$AutoPathSync} {
+		        return -code error "unknown flag $name (bug)"
+		    } else {
+		        set SLAP [DetokPath $slave [$slave eval set ::auto_path]]
+		        return [list -autoPath $SLAP]
+		    }
+		}
 		-statics    {
 		    return [list -statics $state(staticsok)]
 		}
@@ -194,9 +220,17 @@ proc ::safe::interpConfigure {args} {
 	    if {![::tcl::OptProcArgGiven -accessPath]} {
 		set doreset 1
 		set accessPath $state(access_path)
+		# BUG? is doreset the wrong way round?
 	    } else {
 		set doreset 0
 	    }
+	    if {(!$AutoPathSync) && (![::tcl::OptProcArgGiven -autoPath])} {
+		set SLAP [DetokPath $slave [$slave eval set ::auto_path]]
+		set autoPath $SLAP
+	    } elseif {$AutoPathSync} {
+		set autoPath {}
+	    } else {
+	    }
 	    if {
 		![::tcl::OptProcArgGiven -statics]
 		&& ![::tcl::OptProcArgGiven -noStatics]
@@ -217,7 +251,9 @@ proc ::safe::interpConfigure {args} {
 		set deleteHook $state(cleanupHook)
 	    }
 	    # we can now reconfigure :
-	    InterpSetConfig $slave $accessPath $statics $nested $deleteHook
+	    set withAutoPath [::tcl::OptProcArgGiven -autoPath]
+	    set res [InterpSetConfig $slave $accessPath $statics $nested $deleteHook $autoPath $withAutoPath]
+puts stderr [list changed_map $res do_reset $doreset]
 	    # auto_reset the slave (to completly synch the new access_path)
 	    if {$doreset} {
 		if {[catch {::interp eval $slave {auto_reset}} msg]} {
@@ -263,6 +299,8 @@ proc ::safe::InterpCreate {
 			   staticsok
 			   nestedok
 			   deletehook
+			   autoPath
+			   withAutoPath
 		       } {
     # Create the slave.
     if {$slave ne ""} {
@@ -274,7 +312,7 @@ proc ::safe::InterpCreate {
     Log $slave "Created" NOTICE
 
     # Initialize it. (returns slave name)
-    InterpInit $slave $access_path $staticsok $nestedok $deletehook
+    InterpInit $slave $access_path $staticsok $nestedok $deletehook $autoPath $withAutoPath
 }
 
 #
@@ -290,8 +328,9 @@ proc ::safe::InterpCreate {
 #    access_path, to make the first directory in the path suitable for use as
 #    tcl_library, and (if ![SetAutoPathSync]), to set the slave's ::auto_path.
 
-proc ::safe::InterpSetConfig {slave access_path staticsok nestedok deletehook} {
+proc ::safe::InterpSetConfig {slave access_path staticsok nestedok deletehook autoPath withAutoPath} {
     global auto_path
+    variable AutoPathSync
 
     # determine and store the access path if empty
     if {$access_path eq ""} {
@@ -321,11 +360,18 @@ proc ::safe::InterpSetConfig {slave access_path staticsok nestedok deletehook} {
 	# so by default it works the same).
 	set access_path [AddSubDirs $access_path]
     } else {
-	set raw_auto_path {}
+        set raw_auto_path $autoPath
+    }
+
+    if {$withAutoPath} {
+        set raw_auto_path $autoPath
     }
 
     Log $slave "Setting accessPath=($access_path) staticsok=$staticsok\
 		nestedok=$nestedok deletehook=($deletehook)" NOTICE
+    if {!$AutoPathSync} {
+        Log $slave "Setting auto_path=($raw_auto_path)" NOTICE
+    }
 
     namespace upvar ::safe S$slave state
 
@@ -335,7 +381,11 @@ proc ::safe::InterpSetConfig {slave access_path staticsok nestedok deletehook} {
     # We save the virtual form separately as well, as syncing it with the
     # slave has to be defered until the necessary commands are present for
     # setup.
-
+if {[info exists state(access_path,map)]} {
+    set old_map_access_path $state(access_path,map)
+} else {
+    set old_map_access_path {}
+}
     set norm_access_path  {}
     set slave_access_path {}
     set map_access_path   {}
@@ -352,7 +402,8 @@ proc ::safe::InterpSetConfig {slave access_path staticsok nestedok deletehook} {
 	incr i
     }
 
-    # Set the slave auto_path.
+    # Set the slave auto_path to a tokenized raw_auto_path.
+    # Silently ignore any directories that are not in the access path.
     # If [SetAutoPathSync], SyncAccessPath will overwrite this value with the
     # full access path.
     # If ![SetAutoPathSync], Safe Base code will not change this value.
@@ -364,6 +415,7 @@ proc ::safe::InterpSetConfig {slave access_path staticsok nestedok deletehook} {
     }
     ::interp eval $slave [list set auto_path $tokens_auto_path]
 
+    # Add the tcl::tm directories to the access path.
     set morepaths [::tcl::tm::list]
     set firstpass 1
     while {[llength $morepaths]} {
@@ -413,23 +465,50 @@ proc ::safe::InterpSetConfig {slave access_path staticsok nestedok deletehook} {
     set state(cleanupHook)       $deletehook
 
     SyncAccessPath $slave
+
+    set result [expr {[lrange $map_access_path 0 end] ne [lrange $old_map_access_path 0 end]}]
+    return $result
+}
+
+
+#
+# DetokPath:
+#    Convert tokens to directories where possible.
+#    Leave undefined tokens unconverted.  They are
+#    nonsense in both the slave and the master.
+#
+proc ::safe::DetokPath {slave tokenPath} {
+    namespace upvar ::safe S$slave state
+
+    set slavePath {}
+    foreach token $tokenPath {
+	if {[dict exists $state(access_path,map) $token]} {
+	    lappend slavePath [dict get $state(access_path,map) $token]
+	} else {
+	    lappend slavePath $token
+	}
+    }
+    return $slavePath
 }
 
 #
 #
-# FindInAccessPath:
+# interpFindInAccessPath:
 #    Search for a real directory and returns its virtual Id (including the
 #    "$")
+#
+#    When debugging, use TranslatePath for the inverse operation.
 proc ::safe::interpFindInAccessPath {slave path} {
     namespace upvar ::safe S$slave state
 
     if {![dict exists $state(access_path,remap) $path]} {
-	return -code error "$path not found in access path $access_path"
+	return -code error "$path not found in access path"
     }
 
     return [dict get $state(access_path,remap) $path]
 }
 
+
 #
 # addToAccessPath:
 #    add (if needed) a real directory to access path and return its
@@ -465,9 +544,11 @@ proc ::safe::InterpInit {
 			 staticsok
 			 nestedok
 			 deletehook
+			 autoPath
+			 withAutoPath
 		     } {
     # Configure will generate an access_path when access_path is empty.
-    InterpSetConfig $slave $access_path $staticsok $nestedok $deletehook
+    InterpSetConfig $slave $access_path $staticsok $nestedok $deletehook $autoPath $withAutoPath
 
     # NB we need to add [namespace current], aliases are always absolute
     # paths.
@@ -671,6 +752,7 @@ proc ::safe::SyncAccessPath {slave} {
 
     ::interp eval $slave [list \
 	      set tcl_library [lindex $slave_access_path 0]]
+    return
 }
 
 # Returns the virtual token for directory number N.
@@ -1109,16 +1191,21 @@ proc ::safe::Setup {} {
     # Setup the arguments parsing
     #
     ####
+    variable AutoPathSync
 
     # Share the descriptions
-    set temp [::tcl::OptKeyRegister {
+    set OptList {
 	{-accessPath -list {} "access path for the slave"}
 	{-noStatics "prevent loading of statically linked pkgs"}
 	{-statics true "loading of statically linked pkgs"}
 	{-nestedLoadOk "allow nested loading"}
 	{-nested false "nested loading"}
 	{-deleteHook -script {} "delete hook"}
-    }]
+    }
+    if {!$AutoPathSync} {
+        lappend OptList {-autoPath -list {} "::auto_path for the slave"}
+    }
+    set temp [::tcl::OptKeyRegister $OptList]
 
     # create case (slave is optional)
     ::tcl::OptKeyRegister {
@@ -1157,11 +1244,23 @@ proc ::safe::Setup {} {
 
 # Accessor method for ::safe::SetAutoPathSync
 # Usage: ::safe::SetAutoPathSync ?newValue?
+# Respond to changes by calling Setup again, precerving any
+# caller-defined logging.  This allows complete equivalence with
+# prior Safe Base behavior if AutoPathSync is true.
+#
+#                   >>> WARNING <<<
+#
+# DO NOT CHANGE AutoPathSync EXCEPT BY THIS COMMAND - IT IS VITAL THAT WHENEVER
+# THE VALUE CHANGES, THE EXISTING PARSE TOKENS ARE DELETED AND Setup IS CALLED
+# AGAIN.
+# (The initialization of AutoPathSync at the end of this file is acceptable
+#  because Setup has not yet been called.)
 
 proc ::safe::SetAutoPathSync {args} {
     variable AutoPathSync
 
-    if {[llength $args] == 1} {
+    if {[llength $args] == 0} {
+    } elseif {[llength $args] == 1} {
         set newValue [lindex $args 0]
         if {![string is boolean -strict $newValue]} {
             return -code error "new value must be a valid boolean"
@@ -1169,11 +1268,22 @@ proc ::safe::SetAutoPathSync {args} {
         set args [expr {$newValue && $newValue}]
         if {([info vars ::safe::S*] ne {}) && ($args != $AutoPathSync)} {
             return -code error \
-                    "cannot change AutoPathSync while Safe Base slaves exist"
+                    "cannot set new value while Safe Base slaves exist"
+        }
+        if {($args != $AutoPathSync)} {
+            set AutoPathSync {*}$args
+            ::tcl::OptKeyDelete ::safe::interpCreate
+            ::tcl::OptKeyDelete ::safe::interpIC
+            set TmpLog [setLogCmd]
+            Setup
+            setLogCmd $TmpLog
         }
+    } else {
+        set msg {wrong # args: should be "safe::SetAutoPathSync ?newValue?"}
+        return -code error $msg
     }
 
-    set AutoPathSync {*}$args
+    return $AutoPathSync
 }
 
 namespace eval ::safe {
@@ -1219,6 +1329,10 @@ namespace eval ::safe {
     # staticsok         : Value of option -statics
     # nestedok          : Value of option -nested
     # cleanupHook       : Value of option -deleteHook
+    #
+    # Because the slave can change its value of ::auto_path, the value of
+    # option -autoPath is not stored in the array but must be obtained from
+    # the slave.
 }
 
 ::safe::Setup
-- 
cgit v0.12


From 2ccefe1d8265285eee3b36fb090840c55306ccde Mon Sep 17 00:00:00 2001
From: kjnash <k.j.nash@usa.net>
Date: Thu, 9 Jul 2020 16:26:35 +0000
Subject: Update safe(n) to document the changes.

---
 doc/safe.n | 135 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 133 insertions(+), 2 deletions(-)

diff --git a/doc/safe.n b/doc/safe.n
index b39f2c2..5b95eeb 100644
--- a/doc/safe.n
+++ b/doc/safe.n
@@ -23,10 +23,13 @@ safe \- Creating and manipulating safe interpreters
 .sp
 \fB::safe::interpFindInAccessPath\fR \fIslave\fR \fIdirectory\fR
 .sp
+\fB::safe::setAutoPathSync\fR ?\fInewValue\fR?
+.sp
 \fB::safe::setLogCmd\fR ?\fIcmd arg...\fR?
 .SS OPTIONS
 .PP
 ?\fB\-accessPath\fR \fIpathList\fR?
+?\fB\-autoPath\fR \fIpathList\fR?
 ?\fB\-statics\fR \fIboolean\fR? ?\fB\-noStatics\fR?
 ?\fB\-nested\fR \fIboolean\fR? ?\fB\-nestedLoadOk\fR?
 ?\fB\-deleteHook\fR \fIscript\fR?
@@ -140,6 +143,15 @@ $slave eval [list set tk_library \e
 .CE
 .RE
 .TP
+\fB::safe::setAutoPathSync\fR ?\fInewValue\fR?
+This command is used to get or set the "Sync Mode" of the Safe Base.
+When an argument is supplied, the command returns an error if the argument
+is not a boolean value, or if any Safe Base interpreters exist.  Typically
+the value will be set as part of initialization - boolean true for
+"Sync Mode" on (the default), false for "Sync Mode" off.  With "Sync Mode"
+on, the Safe Base keeps each slave interpreter's ::auto_path synchronized
+with its access path.  See the section \fBSYNC MODE\fR below for details.
+.TP
 \fB::safe::setLogCmd\fR ?\fIcmd arg...\fR?
 This command installs a script that will be called when interesting
 life cycle events occur for a safe interpreter.
@@ -191,6 +203,13 @@ master for auto-loading.
 See the section \fBSECURITY\fR below for more detail about virtual paths,
 tokens and access control.
 .TP
+\fB\-autoPath\fR \fIdirectoryList\fR
+This option sets the list of directories in the safe interpreter's
+::auto_path.  The option is undefined if the Safe Base has "Sync Mode" on
+- in that case the safe interpreter's ::auto_path is managed by the Safe
+Base and is a tokenized form of its access path.
+See the section \fBSYNC MODE\fR below for details.
+.TP
 \fB\-statics\fR \fIboolean\fR
 This option specifies if the safe interpreter will be allowed
 to load statically linked packages (like \fBload {} Tk\fR).
@@ -323,7 +342,8 @@ list will be assigned a token that will be set in
 the slave \fBauto_path\fR and the first element of that list will be set as
 the \fBtcl_library\fR for that slave.
 .PP
-If the access path argument is not given or is the empty list,
+If the access path argument is not given to \fB::safe::interpCreate\fR or
+\fB::safe::interpInit\fR or is the empty list,
 the default behavior is to let the slave access the same packages
 as the master has access to (Or to be more precise:
 only packages written in Tcl (which by definition cannot be dangerous
@@ -349,8 +369,119 @@ When the \fIaccessPath\fR is changed after the first creation or
 initialization (i.e. through \fBinterpConfigure -accessPath \fR\fIlist\fR),
 an \fBauto_reset\fR is automatically evaluated in the safe interpreter
 to synchronize its \fBauto_index\fR with the new token list.
+.SH SYNC MODE
+Before Tcl version 8.6.x, the Safe Base kept each safe interpreter's
+::auto_path synchronized with a tokenized form of its access path.
+Limitations of Tcl 8.4 and earlier made this feature necessary.  This
+definition of ::auto_path did not conform its specification in library(n)
+and pkg_mkIndex(n), but nevertheless worked perfectly well for the discovery
+and loading of packages.  The introduction of Tcl modules in Tcl 8.5 added a
+large number of directories to the access path, and it is inconvenient to
+have these additional directories unnecessarily appended to the ::auto_path.
+.PP
+In order to preserve compatibility with existing code, this synchronization
+of the ::auto_path and access path ("Sync Mode" on) is still the default.
+However, the Safe Base offers the option of limiting the safe interpreter's
+::auto_path to the much shorter list of directories that is necessary for
+it to perform its function ("Sync Mode" off).  Use the command
+\fB::safe::setAutoPathSync\fR to choose the mode before creating any Safe
+Base interpreters.
+.PP
+In either mode, the most convenient way to initialize a safe interpreter is
+to call \fB::safe::interpCreate\fR or \fB::safe::interpInit\fR without the
+\fB\-accessPath\fR or \fB\-autoPath\fR options (or with the \fB\-accessPath\fR
+option set to the
+empty list), which will give the safe interpreter the same access as the
+master interpreter to packages, modules, and autoloader files.  With
+"Sync Mode" off, the ::auto_path will be set to a tokenized form of the master's
+::auto_path.
+.PP
+With "Sync Mode" off, if a value is specified for \fB\-autoPath\fR, even the empty
+list, in a call to \fB::safe::interpCreate\fR, \fB::safe::interpInit\fR, or
+\fB::safe::interpConfigure\fR, it will be tokenized and used as the safe
+interpreter's ::auto_path.  Any directories that do not also belong to the
+access path cannot be tokenized and will be silently ignored.
+.PP
+With "Sync Mode" off, if the access path is reset to the values in the
+master interpreter by calling \fB::safe::interpConfigure\fR with arguments
+\fB\-accessPath\fR {}, then the ::auto_path will also be reset unless the argument
+\fB\-autoPath\fR is supplied to specify a different value.
+.PP
+With "Sync Mode" off, if a non-empty value of \fB\-accessPath\fR is supplied, the
+safe interpreter's ::auto_path will be set to {} (by
+\fB::safe::interpCreate\fR, \fB::safe::interpInit\fR) or left unchanged
+(by \fB::safe::interpConfigure\fR).  If the same command specifies a new
+value for \fB\-autoPath\fR, it will be applied after the \fB\-accessPath\fR argument has
+been processed.
+
+Examples of use with "Sync Mode" off: any of these commands will set the
+::auto_path to a tokenized form of its value in the master interpreter:
+.RS
+.PP
+.CS
+ safe::interpCreate foo
+ safe::interpCreate foo -accessPath {}
+ safe::interpInit bar
+ safe::interpInit bar -accessPath {}
+ safe::interpConfigure foo -accessPath {}
+.CE
+.RE
+.TP
+Example of use with "Sync Mode" off: when initializing a safe interpreter
+with a non-empty access path, the ::auto_path will be set to {} unless its
+own value is also specified:
+.RS
+.PP
+.CS
+ safe::interpCreate foo -accessPath {
+     /usr/local/TclHome/lib/tcl8.6
+     /usr/local/TclHome/lib/tcl8.6/http1.0
+     /usr/local/TclHome/lib/tcl8.6/opt0.4
+     /usr/local/TclHome/lib/tcl8.6/msgs
+     /usr/local/TclHome/lib/tcl8.6/encoding
+     /usr/local/TclHome/lib
+ }
+
+ # The slave's ::auto_path must be given a suitable value:
+
+ safe::interpConfigure foo -autoPath {
+     /usr/local/TclHome/lib/tcl8.6
+     /usr/local/TclHome/lib
+ }
+
+ # The two commands can be combined:
+
+ safe::interpCreate foo -accessPath {
+     /usr/local/TclHome/lib/tcl8.6
+     /usr/local/TclHome/lib/tcl8.6/http1.0
+     /usr/local/TclHome/lib/tcl8.6/opt0.4
+     /usr/local/TclHome/lib/tcl8.6/msgs
+     /usr/local/TclHome/lib/tcl8.6/encoding
+     /usr/local/TclHome/lib
+ } -autoPath {
+     /usr/local/TclHome/lib/tcl8.6
+     /usr/local/TclHome/lib
+ }
+.CE
+.RE
+.TP
+Example of use with "Sync Mode" off: the command
+\fBsafe::interpAddToAccessPath\fR does not change the safe interpreter's
+::auto_path, and so any necessary change must be made by the script:
+.RS
+.PP
+.CS
+ safe::interpAddToAccessPath foo /usr/local/TclHome/lib/extras/Img1.4.11
+
+ lassign [safe::interpConfigure foo -autoPath] DUM slaveAutoPath
+ lappend slaveAutoPath /usr/local/TclHome/lib/extras/Img1.4.11
+ safe::interpConfigure foo -autoPath $slaveAutoPath
+.CE
+.RE
+.TP
 .SH "SEE ALSO"
-interp(n), library(n), load(n), package(n), source(n), unknown(n)
+interp(n), library(n), load(n), package(n), pkg_mkIndex(n), source(n),
+tm(n), unknown(n)
 .SH KEYWORDS
 alias, auto\-loading, auto_mkindex, load, master interpreter, safe
 interpreter, slave interpreter, source
-- 
cgit v0.12


From a52e71f534a53b923ecdd96be5dec47ca9875544 Mon Sep 17 00:00:00 2001
From: kjnash <k.j.nash@usa.net>
Date: Thu, 9 Jul 2020 17:03:02 +0000
Subject: Rename command ::safe::SetAutoPathSync to ::safe::setAutoPathSync and
 add to library/tclIndex.

---
 library/safe.tcl | 16 +++++------
 library/tclIndex |  1 +
 tests/safe.test  | 82 ++++++++++++++++++++++++++++----------------------------
 3 files changed, 50 insertions(+), 49 deletions(-)

diff --git a/library/safe.tcl b/library/safe.tcl
index a1fadb1..474dd01 100644
--- a/library/safe.tcl
+++ b/library/safe.tcl
@@ -326,7 +326,7 @@ proc ::safe::InterpCreate {
 #
 #    It is the caller's responsibility, if it supplies a non-empty value for
 #    access_path, to make the first directory in the path suitable for use as
-#    tcl_library, and (if ![SetAutoPathSync]), to set the slave's ::auto_path.
+#    tcl_library, and (if ![setAutoPathSync]), to set the slave's ::auto_path.
 
 proc ::safe::InterpSetConfig {slave access_path staticsok nestedok deletehook autoPath withAutoPath} {
     global auto_path
@@ -404,9 +404,9 @@ if {[info exists state(access_path,map)]} {
 
     # Set the slave auto_path to a tokenized raw_auto_path.
     # Silently ignore any directories that are not in the access path.
-    # If [SetAutoPathSync], SyncAccessPath will overwrite this value with the
+    # If [setAutoPathSync], SyncAccessPath will overwrite this value with the
     # full access path.
-    # If ![SetAutoPathSync], Safe Base code will not change this value.
+    # If ![setAutoPathSync], Safe Base code will not change this value.
     set tokens_auto_path {}
     foreach dir $raw_auto_path {
 	if {[dict exists $remap_access_path $dir]} {
@@ -1242,9 +1242,9 @@ proc ::safe::Setup {} {
     return
 }
 
-# Accessor method for ::safe::SetAutoPathSync
-# Usage: ::safe::SetAutoPathSync ?newValue?
-# Respond to changes by calling Setup again, precerving any
+# Accessor method for ::safe::AutoPathSync
+# Usage: ::safe::setAutoPathSync ?newValue?
+# Respond to changes by calling Setup again, preserving any
 # caller-defined logging.  This allows complete equivalence with
 # prior Safe Base behavior if AutoPathSync is true.
 #
@@ -1256,7 +1256,7 @@ proc ::safe::Setup {} {
 # (The initialization of AutoPathSync at the end of this file is acceptable
 #  because Setup has not yet been called.)
 
-proc ::safe::SetAutoPathSync {args} {
+proc ::safe::setAutoPathSync {args} {
     variable AutoPathSync
 
     if {[llength $args] == 0} {
@@ -1279,7 +1279,7 @@ proc ::safe::SetAutoPathSync {args} {
             setLogCmd $TmpLog
         }
     } else {
-        set msg {wrong # args: should be "safe::SetAutoPathSync ?newValue?"}
+        set msg {wrong # args: should be "safe::setAutoPathSync ?newValue?"}
         return -code error $msg
     }
 
diff --git a/library/tclIndex b/library/tclIndex
index 0409d9b..0d2db02 100644
--- a/library/tclIndex
+++ b/library/tclIndex
@@ -61,6 +61,7 @@ set auto_index(::safe::DirInAccessPath) [list source [file join $dir safe.tcl]]
 set auto_index(::safe::Subset) [list source [file join $dir safe.tcl]]
 set auto_index(::safe::AliasSubset) [list source [file join $dir safe.tcl]]
 set auto_index(::safe::AliasEncoding) [list source [file join $dir safe.tcl]]
+set auto_index(::safe::setAutoPathSync) [list source [file join $dir safe.tcl]]
 set auto_index(tcl_wordBreakAfter) [list source [file join $dir word.tcl]]
 set auto_index(tcl_wordBreakBefore) [list source [file join $dir word.tcl]]
 set auto_index(tcl_endOfWord) [list source [file join $dir word.tcl]]
diff --git a/tests/safe.test b/tests/safe.test
index fac52f1..2a910fd 100644
--- a/tests/safe.test
+++ b/tests/safe.test
@@ -184,11 +184,11 @@ test safe-6.3 {test safe interpreters knowledge of the world} {
 # high level general test
 test safe-7.1 {tests that everything works at high level with conventional AutoPathSync} -setup {
     # All ::safe commands are loaded at start of file.
-    set SyncExists [expr {[info commands ::safe::SetAutoPathSync] ne {}}]
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
 
     if {$SyncExists} {
-        set SyncVal_TMP [safe::SetAutoPathSync]
-        safe::SetAutoPathSync 1
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 1
     }
 
     set i [safe::interpCreate]
@@ -204,16 +204,16 @@ test safe-7.1 {tests that everything works at high level with conventional AutoP
 } -cleanup {
     safe::interpDelete $i
     if {$SyncExists} {
-        safe::SetAutoPathSync $SyncVal_TMP
+        safe::setAutoPathSync $SyncVal_TMP
     }
 } -match glob -result 2.*
 test safe-7.2 {tests specific path and interpFind/AddToAccessPath with conventional AutoPathSync} -setup {
     # All ::safe commands are loaded at start of file.
-    set SyncExists [expr {[info commands ::safe::SetAutoPathSync] ne {}}]
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
 
     if {$SyncExists} {
-        set SyncVal_TMP [safe::SetAutoPathSync]
-        safe::SetAutoPathSync 1
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 1
     } else {
         set SyncVal_TMP 1
     }
@@ -231,7 +231,7 @@ test safe-7.2 {tests specific path and interpFind/AddToAccessPath with conventio
 	    [safe::interpDelete $i]
 } -cleanup {
     if {$SyncExists} {
-        safe::SetAutoPathSync $SyncVal_TMP
+        safe::setAutoPathSync $SyncVal_TMP
     }
 } -match glob -result "{\$p(:0:)} {\$p(:*:)} 1 {can't find package http 1} {-accessPath {[list $tcl_library */dummy/unixlike/test/path]} -statics 0 -nested 1 -deleteHook {}} {}"
 test safe-7.3 {check that safe subinterpreters work} {
@@ -242,11 +242,11 @@ test safe-7.3 {check that safe subinterpreters work} {
 
 test safe-7.4 {tests specific path and positive search with conventional AutoPathSync} -setup {
     # All ::safe commands are loaded at start of file.
-    set SyncExists [expr {[info commands ::safe::SetAutoPathSync] ne {}}]
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
 
     if {$SyncExists} {
-        set SyncVal_TMP [safe::SetAutoPathSync]
-        safe::SetAutoPathSync 1
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 1
     } else {
         set SyncVal_TMP 1
     }
@@ -265,17 +265,17 @@ test safe-7.4 {tests specific path and positive search with conventional AutoPat
     # other than the first and last in the access path.
 } -cleanup {
     if {$SyncExists} {
-        safe::SetAutoPathSync $SyncVal_TMP
+        safe::setAutoPathSync $SyncVal_TMP
     }
 } -match glob -result "{\$p(:0:)} {\$p(:*:)} 0 1.0 {-accessPath {[list $tcl_library *$tcl_library/http1.0]} -statics 0 -nested 1 -deleteHook {}} {}"
 
 test safe-7.5 {tests positive and negative module loading with conventional AutoPathSync} -setup {
     # All ::safe commands are loaded at start of file.
-    set SyncExists [expr {[info commands ::safe::SetAutoPathSync] ne {}}]
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
 
     if {$SyncExists} {
-        set SyncVal_TMP [safe::SetAutoPathSync]
-        safe::SetAutoPathSync 1
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 1
     }
 
     set i [safe::interpCreate]
@@ -294,7 +294,7 @@ test safe-7.5 {tests positive and negative module loading with conventional Auto
 } -cleanup {
     safe::interpDelete $i
     if {$SyncExists} {
-        safe::SetAutoPathSync $SyncVal_TMP
+        safe::setAutoPathSync $SyncVal_TMP
     }
 } -result {1 {can't find package shell} 0}
 
@@ -966,13 +966,13 @@ test safe-17.2 {Check that first element of slave auto_path (and access path) is
 
 test safe-18.1 {cf. safe-7.1 - tests that everything works at high level without conventional AutoPathSync} -constraints AutoSyncDefined -setup {
     # All ::safe commands are loaded at start of file.
-    set SyncExists [expr {[info commands ::safe::SetAutoPathSync] ne {}}]
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
 
     if {$SyncExists} {
-        set SyncVal_TMP [safe::SetAutoPathSync]
-        safe::SetAutoPathSync 0
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 0
     } else {
-        error {This test is meaningful only if the command ::safe::SetAutoPathSync is defined}
+        error {This test is meaningful only if the command ::safe::setAutoPathSync is defined}
     }
 
     # Without AutoPathSync, we need a more complete auto_path, because the slave will use the same value.
@@ -994,19 +994,19 @@ test safe-18.1 {cf. safe-7.1 - tests that everything works at high level without
     set ::auto_path $::auto_TMP
     safe::interpDelete $i
     if {$SyncExists} {
-        safe::SetAutoPathSync $SyncVal_TMP
+        safe::setAutoPathSync $SyncVal_TMP
     }
 } -result 1.0
 
 test safe-18.2 {cf. safe-7.2 - tests specific path and interpFind/AddToAccessPath without conventional AutoPathSync} -constraints AutoSyncDefined -setup {
     # All ::safe commands are loaded at start of file.
-    set SyncExists [expr {[info commands ::safe::SetAutoPathSync] ne {}}]
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
 
     if {$SyncExists} {
-        set SyncVal_TMP [safe::SetAutoPathSync]
-        safe::SetAutoPathSync 0
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 0
     } else {
-        error {This test is meaningful only if the command ::safe::SetAutoPathSync is defined}
+        error {This test is meaningful only if the command ::safe::setAutoPathSync is defined}
     }
 } -body {
     set i [safe::interpCreate -nostat -nested 1 -accessPath [list [info library]]]
@@ -1024,19 +1024,19 @@ test safe-18.2 {cf. safe-7.2 - tests specific path and interpFind/AddToAccessPat
 	    [safe::interpDelete $i]
 } -cleanup {
     if {$SyncExists} {
-        safe::SetAutoPathSync $SyncVal_TMP
+        safe::setAutoPathSync $SyncVal_TMP
     }
 } -match glob -result "{} {\$p(:0:)} {\$p(:*:)} 1 {can't find package http 1} {-accessPath {[list $tcl_library */dummy/unixlike/test/path]} -statics 0 -nested 1 -deleteHook {}} {}"
 
 test safe-18.3 {Check that default auto_path is the same as in the master interpreter without conventional AutoPathSync} -constraints AutoSyncDefined -setup {
     # All ::safe commands are loaded at start of file.
-    set SyncExists [expr {[info commands ::safe::SetAutoPathSync] ne {}}]
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
 
     if {$SyncExists} {
-        set SyncVal_TMP [safe::SetAutoPathSync]
-        safe::SetAutoPathSync 0
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 0
     } else {
-        error {This test is meaningful only if the command ::safe::SetAutoPathSync is defined}
+        error {This test is meaningful only if the command ::safe::setAutoPathSync is defined}
     }
 
     set i [safe::interpCreate]
@@ -1053,19 +1053,19 @@ test safe-18.3 {Check that default auto_path is the same as in the master interp
 } -cleanup {
     safe::interpDelete $i
     if {$SyncExists} {
-	safe::SetAutoPathSync $SyncVal_TMP
+	safe::setAutoPathSync $SyncVal_TMP
     }
 } -result [set ::auto_path]
 
 test safe-18.4 {cf. safe-7.4 - tests specific path and positive search and auto_path without conventional AutoPathSync} -constraints AutoSyncDefined -setup {
     # All ::safe commands are loaded at start of file.
-    set SyncExists [expr {[info commands ::safe::SetAutoPathSync] ne {}}]
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
 
     if {$SyncExists} {
-        set SyncVal_TMP [safe::SetAutoPathSync]
-        safe::SetAutoPathSync 0
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 0
     } else {
-        error {This test is meaningful only if the command ::safe::SetAutoPathSync is defined}
+        error {This test is meaningful only if the command ::safe::setAutoPathSync is defined}
     }
 } -body {
     set i [safe::interpCreate -nostat -nested 1 -accessPath [list [info library]]]
@@ -1091,19 +1091,19 @@ test safe-18.4 {cf. safe-7.4 - tests specific path and positive search and auto_
 	    [safe::interpDelete $i]
 } -cleanup {
     if {$SyncExists} {
-	safe::SetAutoPathSync $SyncVal_TMP
+	safe::setAutoPathSync $SyncVal_TMP
     }
 } -match glob -result "{} {{\$p(:0:)}} {\$p(:0:)} {\$p(:*:)} 0 1.0 {-accessPath {[list $tcl_library *$tcl_library/http1.0]} -statics 0 -nested 1 -deleteHook {}} {}"
 
 test safe-18.5 {cf. safe-7.5 - tests positive and negative module loading without conventional AutoPathSync} -setup {
     # All ::safe commands are loaded at start of file.
-    set SyncExists [expr {[info commands ::safe::SetAutoPathSync] ne {}}]
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
 
     if {$SyncExists} {
-        set SyncVal_TMP [safe::SetAutoPathSync]
-        safe::SetAutoPathSync 0
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 0
     } else {
-        error {This test is meaningful only if the command ::safe::SetAutoPathSync is defined}
+        error {This test is meaningful only if the command ::safe::setAutoPathSync is defined}
     }
 
     set i [safe::interpCreate]
@@ -1122,7 +1122,7 @@ test safe-18.5 {cf. safe-7.5 - tests positive and negative module loading withou
 } -cleanup {
     safe::interpDelete $i
     if {$SyncExists} {
-        safe::SetAutoPathSync $SyncVal_TMP
+        safe::setAutoPathSync $SyncVal_TMP
     }
 } -result {1 {can't find package shell} 0}
 
-- 
cgit v0.12


From 541671a2f136159742365818e09d29f6be51f96b Mon Sep 17 00:00:00 2001
From: kjnash <k.j.nash@usa.net>
Date: Thu, 9 Jul 2020 17:37:34 +0000
Subject: Revise tests safe-18.2 and safe-18.4 to allow for -autoPath in
 interpConfigure output.

---
 tests/safe.test | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/safe.test b/tests/safe.test
index 2a910fd..ce70bf9 100644
--- a/tests/safe.test
+++ b/tests/safe.test
@@ -1026,7 +1026,7 @@ test safe-18.2 {cf. safe-7.2 - tests specific path and interpFind/AddToAccessPat
     if {$SyncExists} {
         safe::setAutoPathSync $SyncVal_TMP
     }
-} -match glob -result "{} {\$p(:0:)} {\$p(:*:)} 1 {can't find package http 1} {-accessPath {[list $tcl_library */dummy/unixlike/test/path]} -statics 0 -nested 1 -deleteHook {}} {}"
+} -match glob -result "{} {\$p(:0:)} {\$p(:*:)} 1 {can't find package http 1} {-accessPath {[list $tcl_library */dummy/unixlike/test/path]} -statics 0 -nested 1 -deleteHook {} -autoPath [list $tcl_library]} {}"
 
 test safe-18.3 {Check that default auto_path is the same as in the master interpreter without conventional AutoPathSync} -constraints AutoSyncDefined -setup {
     # All ::safe commands are loaded at start of file.
@@ -1093,7 +1093,7 @@ test safe-18.4 {cf. safe-7.4 - tests specific path and positive search and auto_
     if {$SyncExists} {
 	safe::setAutoPathSync $SyncVal_TMP
     }
-} -match glob -result "{} {{\$p(:0:)}} {\$p(:0:)} {\$p(:*:)} 0 1.0 {-accessPath {[list $tcl_library *$tcl_library/http1.0]} -statics 0 -nested 1 -deleteHook {}} {}"
+} -match glob -result "{} {{\$p(:0:)}} {\$p(:0:)} {\$p(:*:)} 0 1.0 {-accessPath {[list $tcl_library *$tcl_library/http1.0]} -statics 0 -nested 1 -deleteHook {} -autoPath [list $tcl_library]} {}"
 
 test safe-18.5 {cf. safe-7.5 - tests positive and negative module loading without conventional AutoPathSync} -setup {
     # All ::safe commands are loaded at start of file.
-- 
cgit v0.12


From 586ba274757dbac124ef994fd13adf1fd0a9cbe7 Mon Sep 17 00:00:00 2001
From: kjnash <k.j.nash@usa.net>
Date: Tue, 14 Jul 2020 16:15:19 +0000
Subject: Sync with bugfixes and tests pushed upstream via safe-bugfixes-8-6 to
 core-8-6-branch.

---
 library/safe.tcl |  70 ++++--
 library/tm.tcl   |   6 +-
 tests/safe.test  | 733 ++++++++++++++++++++++++++++++++++++++++++++++++++++++-
 3 files changed, 770 insertions(+), 39 deletions(-)

diff --git a/library/safe.tcl b/library/safe.tcl
index 474dd01..cf2c164 100644
--- a/library/safe.tcl
+++ b/library/safe.tcl
@@ -218,11 +218,10 @@ proc ::safe::interpConfigure {args} {
 	    # Get the current (and not the default) values of whatever has
 	    # not been given:
 	    if {![::tcl::OptProcArgGiven -accessPath]} {
-		set doreset 1
+		set doreset 0
 		set accessPath $state(access_path)
-		# BUG? is doreset the wrong way round?
 	    } else {
-		set doreset 0
+		set doreset 1
 	    }
 	    if {(!$AutoPathSync) && (![::tcl::OptProcArgGiven -autoPath])} {
 		set SLAP [DetokPath $slave [$slave eval set ::auto_path]]
@@ -252,8 +251,7 @@ proc ::safe::interpConfigure {args} {
 	    }
 	    # we can now reconfigure :
 	    set withAutoPath [::tcl::OptProcArgGiven -autoPath]
-	    set res [InterpSetConfig $slave $accessPath $statics $nested $deleteHook $autoPath $withAutoPath]
-puts stderr [list changed_map $res do_reset $doreset]
+	    set slave_tm_rel [InterpSetConfig $slave $accessPath $statics $nested $deleteHook $autoPath $withAutoPath]
 	    # auto_reset the slave (to completly synch the new access_path)
 	    if {$doreset} {
 		if {[catch {::interp eval $slave {auto_reset}} msg]} {
@@ -261,6 +259,26 @@ puts stderr [list changed_map $res do_reset $doreset]
 		} else {
 		    Log $slave "successful auto_reset" NOTICE
 		}
+
+		# Sync the paths used to search for Tcl modules.
+		::interp eval $slave {tcl::tm::path remove {*}[tcl::tm::list]}
+		if {[llength $state(tm_path_slave)] > 0} {
+		    ::interp eval $slave [list \
+			    ::tcl::tm::add {*}[lreverse $state(tm_path_slave)]]
+		}
+
+		# Wherever possible, refresh package/module data.
+		# - Ideally [package ifneeded $pkg $ver {}] would clear the
+		#   stale data from the interpreter, but instead it sets a
+		#   nonsense empty script.
+		# - We cannot purge stale package data, but we can overwrite
+		#   it where we have fresh data.  Any remaining stale data will
+		#   do no harm but the error messages may be cryptic.
+		::interp eval $slave [list catch {package require NOEXIST}]
+		foreach rel $slave_tm_rel {
+		    set cmd [list package require [string map {/ ::} $rel]::NOEXIST]
+		    ::interp eval $slave [list catch $cmd]
+		}
 	    }
 	}
     }
@@ -381,16 +399,13 @@ proc ::safe::InterpSetConfig {slave access_path staticsok nestedok deletehook au
     # We save the virtual form separately as well, as syncing it with the
     # slave has to be defered until the necessary commands are present for
     # setup.
-if {[info exists state(access_path,map)]} {
-    set old_map_access_path $state(access_path,map)
-} else {
-    set old_map_access_path {}
-}
     set norm_access_path  {}
     set slave_access_path {}
     set map_access_path   {}
     set remap_access_path {}
     set slave_tm_path     {}
+    set slave_tm_roots    {}
+    set slave_tm_rel      {}
 
     set i 0
     foreach dir $access_path {
@@ -426,6 +441,13 @@ if {[info exists state(access_path,map)]} {
 	    # Prevent the addition of dirs on the tm list to the
 	    # result if they are already known.
 	    if {[dict exists $remap_access_path $dir]} {
+	        if {$firstpass} {
+		    # $dir is in [::tcl::tm::list] and belongs in the slave_tm_path.
+		    # Later passes handle subdirectories, which belong in the
+		    # access path but not in the module path.
+		    lappend slave_tm_path  [dict get $remap_access_path $dir]
+		    lappend slave_tm_roots [file normalize $dir] [file normalize $dir]
+		}
 		continue
 	    }
 
@@ -440,6 +462,7 @@ if {[info exists state(access_path,map)]} {
 		# Later passes handle subdirectories, which belong in the
 		# access path but not in the module path.
 		lappend slave_tm_path  $token
+		lappend slave_tm_roots [file normalize $dir] [file normalize $dir]
 	    }
 	    incr i
 
@@ -450,6 +473,14 @@ if {[info exists state(access_path,map)]} {
 	    # 'platform/shell-X.tm', i.e arbitrarily deep
 	    # subdirectories.
 	    lappend morepaths {*}[glob -nocomplain -directory $dir -type d *]
+	    foreach sub [glob -nocomplain -directory $dir -type d *] {
+	        lappend slave_tm_roots [file normalize $sub] [dict get $slave_tm_roots $dir]
+	        set lenny [string length [dict get $slave_tm_roots $dir]]
+	        set relpath [string range [file normalize $sub] $lenny+1 end]
+                if {$relpath ni $slave_tm_rel} {
+	            lappend slave_tm_rel $relpath
+                }
+	    }
 	}
 	set firstpass 0
     }
@@ -465,9 +496,7 @@ if {[info exists state(access_path,map)]} {
     set state(cleanupHook)       $deletehook
 
     SyncAccessPath $slave
-
-    set result [expr {[lrange $map_access_path 0 end] ne [lrange $old_map_access_path 0 end]}]
-    return $result
+    return $slave_tm_rel
 }
 
 
@@ -656,15 +685,6 @@ proc ::safe::interpDelete {slave} {
 
     namespace upvar ::safe S$slave state
 
-    # Sub interpreters would be deleted automatically, but if they are managed
-    # by the Safe Base we also need to clean up, and this needs to be done
-    # independently of the cleanupHook.
-    foreach sub [interp slaves $slave] {
-        if {[info exists ::safe::S[list $slave $sub]]} {
-            ::safe::interpDelete [list $slave $sub]
-        }
-    }
-
     # If the slave has a cleanup hook registered, call it.  Check the
     # existance because we might be called to delete an interp which has
     # not been registered with us at all
@@ -835,15 +855,11 @@ proc ::safe::AliasGlob {slave args} {
 
     while {$at < [llength $args]} {
 	switch -glob -- [set opt [lindex $args $at]] {
-	    -nocomplain - -- - -tails {
+	    -nocomplain - -- - -join - -tails {
 		lappend cmd $opt
 		set got($opt) 1
 		incr at
 	    }
-	    -join {
-		set got($opt) 1
-		incr at
-	    }
 	    -types - -type {
 		lappend cmd -types [lindex $args [incr at]]
 		incr at
diff --git a/library/tm.tcl b/library/tm.tcl
index 1802bb9..3861532 100644
--- a/library/tm.tcl
+++ b/library/tm.tcl
@@ -238,12 +238,16 @@ proc ::tcl::tm::UnknownHandler {original name args} {
 			continue
 		    }
 
-		    if {[package ifneeded $pkgname $pkgversion] ne {}} {
+		    if {    ([package ifneeded $pkgname $pkgversion] ne {})
+			 && (![interp issafe])
+		    } {
 			# There's already a provide script registered for
 			# this version of this package.  Since all units of
 			# code claiming to be the same version of the same
 			# package ought to be identical, just stick with
 			# the one we already have.
+			# This does not apply to Safe Base interpreters because
+			# the token-to-directory mapping may have changed.
 			continue
 		    }
 
diff --git a/tests/safe.test b/tests/safe.test
index ce70bf9..2de29fd 100644
--- a/tests/safe.test
+++ b/tests/safe.test
@@ -26,6 +26,8 @@ foreach i [interp slaves] {
 set saveAutoPath $::auto_path
 set ::auto_path [info library]
 
+set TestsDir [file normalize [file dirname [info script]]]
+
 # Force actual loading of the safe package because we use un exported (and
 # thus un-autoindexed) APIs in this test result arguments:
 catch {safe::interpConfigure}
@@ -181,31 +183,164 @@ test safe-6.3 {test safe interpreters knowledge of the world} {
 # More test should be added to check that hostname, nameofexecutable, aren't
 # leaking infos, but they still do...
 
+# Tests 7.0* test the example files before using them to test safe interpreters.
+
+test safe-7.0a {example tclIndex commands, test in master interpreter} -setup {
+    set tmpAutoPath $::auto_path
+    lappend ::auto_path [file join $TestsDir auto0 auto1] [file join $TestsDir auto0 auto2]
+} -body {
+    # Try to load the commands.
+    set code3 [catch report1 msg3]
+    set code4 [catch report2 msg4]
+    list $code3 $msg3 $code4 $msg4
+} -cleanup {
+    catch {rename report1 {}}
+    catch {rename report2 {}}
+    set ::auto_path $tmpAutoPath
+    auto_reset
+} -match glob -result {0 ok1 0 ok2}
+
+test safe-7.0b {example tclIndex commands, negative test in master interpreter} -setup {
+    set tmpAutoPath $::auto_path
+    lappend ::auto_path [file join $TestsDir auto0]
+} -body {
+    # Try to load the commands.
+    set code3 [catch report1 msg3]
+    set code4 [catch report2 msg4]
+    list $code3 $msg3 $code4 $msg4
+} -cleanup {
+    catch {rename report1 {}}
+    catch {rename report2 {}}
+    set ::auto_path $tmpAutoPath
+    auto_reset
+} -match glob -result {1 {invalid command name "report1"} 1 {invalid command name "report2"}}
+
+test safe-7.0c {example pkgIndex.tcl packages, test in master interpreter, child directories} -setup {
+    set tmpAutoPath $::auto_path
+    lappend ::auto_path [file join $TestsDir auto0]
+} -body {
+    # Try to load the packages and run a command from each one.
+    set code3 [catch {package require SafeTestPackage1} msg3]
+    set code4 [catch {package require SafeTestPackage2} msg4]
+    set code5 [catch HeresPackage1 msg5]
+    set code6 [catch HeresPackage2 msg6]
+
+    list $code3 $msg3 $code4 $msg4 $code5 $msg5 $code6 $msg6
+} -cleanup {
+    set ::auto_path $tmpAutoPath
+    catch {package forget SafeTestPackage1}
+    catch {package forget SafeTestPackage2}
+    catch {rename HeresPackage1 {}}
+    catch {rename HeresPackage2 {}}
+} -match glob -result {0 1.2.3 0 2.3.4 0 OK1 0 OK2}
+
+test safe-7.0d {example pkgIndex.tcl packages, test in master interpreter, main directories} -setup {
+    set tmpAutoPath $::auto_path
+    lappend ::auto_path [file join $TestsDir auto0 auto1] \
+                        [file join $TestsDir auto0 auto2]
+} -body {
+    # Try to load the packages and run a command from each one.
+    set code3 [catch {package require SafeTestPackage1} msg3]
+    set code4 [catch {package require SafeTestPackage2} msg4]
+    set code5 [catch HeresPackage1 msg5]
+    set code6 [catch HeresPackage2 msg6]
+
+    list $code3 $msg3 $code4 $msg4 $code5 $msg5 $code6 $msg6
+} -cleanup {
+    set ::auto_path $tmpAutoPath
+    catch {package forget SafeTestPackage1}
+    catch {package forget SafeTestPackage2}
+    catch {rename HeresPackage1 {}}
+    catch {rename HeresPackage2 {}}
+} -match glob -result {0 1.2.3 0 2.3.4 0 OK1 0 OK2}
+
+test safe-7.0e {example modules packages, test in master interpreter, replace path} -setup {
+    set oldTm [tcl::tm::path list]
+    foreach path $oldTm {
+        tcl::tm::path remove $path
+    }
+    tcl::tm::path add [file join $TestsDir auto0 modules]
+} -body {
+    # Try to load the modules and run a command from each one.
+    set code0 [catch {package require test0} msg0]
+    set code1 [catch {package require mod1::test1} msg1]
+    set code2 [catch {package require mod2::test2} msg2]
+    set out0  [test0::try0]
+    set out1  [mod1::test1::try1]
+    set out2  [mod2::test2::try2]
+
+    list $code0 $msg0 $code1 $msg1 $code2 $msg2 -- $out0 $out1 $out2
+} -cleanup {
+    tcl::tm::path remove [file join $TestsDir auto0 modules]
+    foreach path [lreverse $oldTm] {
+        tcl::tm::path add $path
+    }
+    catch {package forget test0}
+    catch {package forget mod1::test1}
+    catch {package forget mod2::test2}
+    catch {namespace delete ::test0}
+    catch {namespace delete ::mod1}
+} -match glob -result {0 0.5 0 1.0 0 2.0 -- res0 res1 res2}
+
+test safe-7.0f {example modules packages, test in master interpreter, append to path} -setup {
+    tcl::tm::path add [file join $TestsDir auto0 modules]
+} -body {
+    # Try to load the modules and run a command from each one.
+    set code0 [catch {package require test0} msg0]
+    set code1 [catch {package require mod1::test1} msg1]
+    set code2 [catch {package require mod2::test2} msg2]
+    set out0  [test0::try0]
+    set out1  [mod1::test1::try1]
+    set out2  [mod2::test2::try2]
+
+    list $code0 $msg0 $code1 $msg1 $code2 $msg2 -- $out0 $out1 $out2
+} -cleanup {
+    tcl::tm::path remove [file join $TestsDir auto0 modules]
+    catch {package forget test0}
+    catch {package forget mod1::test1}
+    catch {package forget mod2::test2}
+    catch {namespace delete ::test0}
+    catch {namespace delete ::mod1}
+} -match glob -result {0 0.5 0 1.0 0 2.0 -- res0 res1 res2}
+
 # high level general test
+# Use example packages not http1.0
 test safe-7.1 {tests that everything works at high level with conventional AutoPathSync} -setup {
     # All ::safe commands are loaded at start of file.
     set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
-
     if {$SyncExists} {
         set SyncVal_TMP [safe::setAutoPathSync]
         safe::setAutoPathSync 1
     }
-
+    set tmpAutoPath $::auto_path
+    lappend ::auto_path [file join $TestsDir auto0]
     set i [safe::interpCreate]
-
+    set ::auto_path $tmpAutoPath
 } -body {
     # no error shall occur:
     # (because the default access_path shall include 1st level sub dirs so
     #  package require in a slave works like in the master)
-    set v [interp eval $i {package require http 2}]
+    set v [interp eval $i {package require SafeTestPackage1}]
     # no error shall occur:
-    interp eval $i {http::config}
+    interp eval $i {HeresPackage1}
     set v
 } -cleanup {
     safe::interpDelete $i
     if {$SyncExists} {
         safe::setAutoPathSync $SyncVal_TMP
     }
+} -match glob -result 1.2.3
+# high level general test
+test safe-7.1http {tests that everything works at high level, uses http 2} -body {
+    set i [safe::interpCreate]
+    # no error shall occur:
+    # (because the default access_path shall include 1st level sub dirs so
+    #  package require in a slave works like in the master)
+    set v [interp eval $i {package require http 2}]
+    # no error shall occur:
+    interp eval $i {http::config}
+    safe::interpDelete $i
+    set v
 } -match glob -result 2.*
 test safe-7.2 {tests specific path and interpFind/AddToAccessPath with conventional AutoPathSync} -setup {
     # All ::safe commands are loaded at start of file.
@@ -223,16 +358,34 @@ test safe-7.2 {tests specific path and interpFind/AddToAccessPath with conventio
     set token1 [safe::interpAddToAccessPath $i [info library]]
     # should add as p* (not p1 if master has a module path)
     set token2 [safe::interpAddToAccessPath $i "/dummy/unixlike/test/path"]
-    # an error shall occur (http is not anymore in the secure 0-level
+    # should add as p* (not p2 if master has a module path)
+    set token3 [safe::interpAddToAccessPath $i [file join $TestsDir auto0]]
+    # an error shall occur (SafeTestPackage1 is not anymore in the secure 0-level
     # provided deep path)
-    list $token1 $token2 \
-	    [catch {interp eval $i {package require http 1}} msg] $msg \
+    list $token1 $token2 $token3 \
+	    [catch {interp eval $i {package require SafeTestPackage1}} msg] $msg \
 	    [safe::interpConfigure $i]\
 	    [safe::interpDelete $i]
 } -cleanup {
     if {$SyncExists} {
         safe::setAutoPathSync $SyncVal_TMP
     }
+} -match glob -result "{\$p(:0:)} {\$p(:*:)} {\$p(:*:)} 1\
+        {can't find package SafeTestPackage1}\
+        {-accessPath {[list $tcl_library */dummy/unixlike/test/path $TestsDir/auto0]}\
+        -statics 0 -nested 1 -deleteHook {}} {}"
+test safe-7.2http {tests specific path and interpFind/AddToAccessPath, uses http1.0} -body {
+    set i [safe::interpCreate -nostat -nested 1 -accessPath [list [info library]]]
+    # should not add anything (p0)
+    set token1 [safe::interpAddToAccessPath $i [info library]]
+    # should add as p1
+    set token2 [safe::interpAddToAccessPath $i "/dummy/unixlike/test/path"]
+    # an error shall occur (http is not anymore in the secure 0-level
+    # provided deep path)
+    list $token1 $token2 \
+	    [catch {interp eval $i {package require http 1}} msg] $msg \
+	    [safe::interpConfigure $i]\
+	    [safe::interpDelete $i]
 } -match glob -result "{\$p(:0:)} {\$p(:*:)} 1 {can't find package http 1} {-accessPath {[list $tcl_library */dummy/unixlike/test/path]} -statics 0 -nested 1 -deleteHook {}} {}"
 test safe-7.3 {check that safe subinterpreters work} {
     set i [safe::interpCreate]
@@ -255,10 +408,10 @@ test safe-7.4 {tests specific path and positive search with conventional AutoPat
     # should not add anything (p0)
     set token1 [safe::interpAddToAccessPath $i [info library]]
     # should add as p* (not p1 if master has a module path)
-    set token2 [safe::interpAddToAccessPath $i [file join [info library] http1.0]]
-    # this time, unlike test safe-7.2, http 1.0 should be found
+    set token2 [safe::interpAddToAccessPath $i [file join $TestsDir auto0 auto1]]
+    # this time, unlike test safe-7.2, SafeTestPackage1 should be found
     list $token1 $token2 \
-	    [catch {interp eval $i {package require http 1}} msg] $msg \
+	    [catch {interp eval $i {package require SafeTestPackage1}} msg] $msg \
 	    [safe::interpConfigure $i]\
 	    [safe::interpDelete $i]
     # Note that the glob match elides directories (those from the module path)
@@ -267,6 +420,20 @@ test safe-7.4 {tests specific path and positive search with conventional AutoPat
     if {$SyncExists} {
         safe::setAutoPathSync $SyncVal_TMP
     }
+} -match glob -result "{\$p(:0:)} {\$p(:*:)} 0 1.2.3\
+        {-accessPath {[list $tcl_library * $TestsDir/auto0/auto1]}\
+        -statics 0 -nested 1 -deleteHook {}} {}"
+test safe-7.4http {tests specific path and positive search, uses http1.0} -body {
+    set i [safe::interpCreate -nostat -nested 1 -accessPath [list [info library]]]
+    # should not add anything (p0)
+    set token1 [safe::interpAddToAccessPath $i [info library]]
+    # should add as p1
+    set token2 [safe::interpAddToAccessPath $i [file join [info library] http1.0]]
+    # this time, unlike test safe-7.2, http should be found
+    list $token1 $token2 \
+	    [catch {interp eval $i {package require http 1}} msg] $msg \
+	    [safe::interpConfigure $i]\
+	    [safe::interpDelete $i]
 } -match glob -result "{\$p(:0:)} {\$p(:*:)} 0 1.0 {-accessPath {[list $tcl_library *$tcl_library/http1.0]} -statics 0 -nested 1 -deleteHook {}} {}"
 
 test safe-7.5 {tests positive and negative module loading with conventional AutoPathSync} -setup {
@@ -494,6 +661,549 @@ test safe-9.6 {interpConfigure widget like behaviour} -body {
 } -cleanup {
     safe::interpDelete $i
 } -match glob -result {{-accessPath * -statics 0 -nested 1 -deleteHook {foo bar}} {-accessPath *} {-nested 1} {-statics 0} {-deleteHook {foo bar}} {-accessPath * -statics 1 -nested 1 -deleteHook {foo bar}} {-accessPath * -statics 0 -nested 0 -deleteHook toto}}
+test safe-9.7 {interpConfigure widget like behaviour (demystified)} -body {
+   # this test shall work, believed equivalent to 9.6
+    set i [safe::interpCreate \
+	    -noStatics \
+	    -nestedLoadOk \
+	    -deleteHook {foo bar} \
+    ]
+
+	   safe::interpConfigure $i -accessPath /foo/bar
+    set a [safe::interpConfigure $i]
+    set b [safe::interpConfigure $i -aCCess]
+    set c [safe::interpConfigure $i -nested]
+    set d [safe::interpConfigure $i -statics]
+    set e [safe::interpConfigure $i -DEL]
+	   safe::interpConfigure $i -accessPath /blah -statics 1
+    set f [safe::interpConfigure $i]
+	   safe::interpConfigure $i -deleteHook toto -nosta -nested 0
+    set g [safe::interpConfigure $i]
+
+    list $a $b $c $d $e $f $g
+} -cleanup {
+    safe::interpDelete $i
+} -match glob -result {{-accessPath * -statics 0 -nested 1 -deleteHook {foo bar}} {-accessPath *} {-nested 1} {-statics 0} {-deleteHook {foo bar}} {-accessPath * -statics 1 -nested 1 -deleteHook {foo bar}} {-accessPath * -statics 0 -nested 0 -deleteHook toto}}
+
+test safe-9.8 {interpConfigure change the access path; tclIndex commands unaffected by token rearrangement (dummy test of doreset)} -setup {
+} -body {
+    set i [safe::interpCreate -accessPath [list $tcl_library \
+                                            [file join $TestsDir auto0 auto1] \
+                                            [file join $TestsDir auto0 auto2]]]
+
+    # Inspect.
+    set confA [safe::interpConfigure $i]
+    set path1 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto1]]
+    set path2 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto2]]
+
+    # Load auto_load data.
+    interp eval $i {catch nonExistentCommand}
+
+    # Load and run the commands.
+    # This guarantees the test will pass even if the tokens are swapped.
+    set code1 [catch {interp eval $i {report1}} msg1]
+    set code2 [catch {interp eval $i {report2}} msg2]
+
+    # Rearrange access path.  Swap tokens {$p(:1:)} and {$p(:2:)}.
+    safe::interpConfigure $i -accessPath [list $tcl_library \
+                                           [file join $TestsDir auto0 auto2] \
+                                           [file join $TestsDir auto0 auto1]]
+
+    # Inspect.
+    set confB [safe::interpConfigure $i]
+    set path3 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto1]]
+    set path4 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto2]]
+
+    # Run the commands.
+    set code3 [catch {interp eval $i {report1}} msg3]
+    set code4 [catch {interp eval $i {report2}} msg4]
+
+    list $path1 $path2 $path3 $path4 $code3 $msg3 $code4 $msg4 $confA $confB
+} -cleanup {
+    safe::interpDelete $i
+} -match glob -result "{\$p(:1:)} {\$p(:2:)} {\$p(:2:)} {\$p(:1:)} 0 ok1 0 ok2\
+        {-accessPath {[list $tcl_library $TestsDir/auto0/auto1 $TestsDir/auto0/auto2]*}\
+        -statics 1 -nested 0 -deleteHook {}}\
+        {-accessPath {[list $tcl_library $TestsDir/auto0/auto2 $TestsDir/auto0/auto1]*}\
+        -statics 1 -nested 0 -deleteHook {}}"
+
+test safe-9.9 {interpConfigure change the access path; tclIndex commands unaffected by token rearrangement (actual test of doreset)} -setup {
+} -body {
+    set i [safe::interpCreate -accessPath [list $tcl_library \
+                                            [file join $TestsDir auto0 auto1] \
+                                            [file join $TestsDir auto0 auto2]]]
+
+    # Inspect.
+    set confA [safe::interpConfigure $i]
+    set path1 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto1]]
+    set path2 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto2]]
+
+    # Load auto_load data.
+    interp eval $i {catch nonExistentCommand}
+
+    # Do not load the commands.  With the tokens swapped, the test
+    # will pass only if the Safe Base has called auto_reset.
+
+    # Rearrange access path.  Swap tokens {$p(:1:)} and {$p(:2:)}.
+    safe::interpConfigure $i -accessPath [list $tcl_library \
+                                           [file join $TestsDir auto0 auto2] \
+                                           [file join $TestsDir auto0 auto1]]
+
+    # Inspect.
+    set confB [safe::interpConfigure $i]
+    set path3 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto1]]
+    set path4 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto2]]
+
+    # Load and run the commands.
+    set code3 [catch {interp eval $i {report1}} msg3]
+    set code4 [catch {interp eval $i {report2}} msg4]
+
+    list $path1 $path2 $path3 $path4 $code3 $msg3 $code4 $msg4 $confA $confB
+} -cleanup {
+    safe::interpDelete $i
+} -match glob -result "{\$p(:1:)} {\$p(:2:)} {\$p(:2:)} {\$p(:1:)} 0 ok1 0 ok2\
+        {-accessPath {[list $tcl_library $TestsDir/auto0/auto1 $TestsDir/auto0/auto2]*}\
+        -statics 1 -nested 0 -deleteHook {}}\
+        {-accessPath {[list $tcl_library $TestsDir/auto0/auto2 $TestsDir/auto0/auto1]*}\
+        -statics 1 -nested 0 -deleteHook {}}"
+
+test safe-9.10 {interpConfigure change the access path; pkgIndex.tcl packages unaffected by token rearrangement} -setup {
+} -body {
+    # For complete correspondence to safe-9.10opt, include auto0 in access path.
+    set i [safe::interpCreate -accessPath [list $tcl_library \
+                                            [file join $TestsDir auto0] \
+                                            [file join $TestsDir auto0 auto1] \
+                                            [file join $TestsDir auto0 auto2]]]
+
+    # Inspect.
+    set confA [safe::interpConfigure $i]
+    set path0 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0]]
+    set path1 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto1]]
+    set path2 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto2]]
+
+    # Load pkgIndex.tcl data.
+    catch {interp eval $i {package require NOEXIST}}
+
+    # Rearrange access path.  Swap tokens {$p(:2:)} and {$p(:3:)}.
+    # This would have no effect because the records in Pkg of these directories
+    # were from access as children of {$p(:1:)}.
+    safe::interpConfigure $i -accessPath [list $tcl_library \
+                                           [file join $TestsDir auto0] \
+                                           [file join $TestsDir auto0 auto2] \
+                                           [file join $TestsDir auto0 auto1]]
+
+    # Inspect.
+    set confB [safe::interpConfigure $i]
+    set path3 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto1]]
+    set path4 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto2]]
+
+    # Try to load the packages and run a command from each one.
+    set code3 [catch {interp eval $i {package require SafeTestPackage1}} msg3 opts3]
+    set code4 [catch {interp eval $i {package require SafeTestPackage2}} msg4 opts4]
+    set code5 [catch {interp eval $i {HeresPackage1}} msg5 opts5]
+    set code6 [catch {interp eval $i {HeresPackage2}} msg6 opts6]
+
+    list $path1 $path2 $path3 $path4 $code3 $msg3 $code4 $msg4 $confA $confB \
+         $code5 $msg5 $code6 $msg6
+
+} -cleanup {
+    safe::interpDelete $i
+} -match glob -result "{\$p(:2:)} {\$p(:3:)} {\$p(:3:)} {\$p(:2:)} 0 1.2.3 0 2.3.4\
+        {-accessPath {[list $tcl_library $TestsDir/auto0 $TestsDir/auto0/auto1 $TestsDir/auto0/auto2]*}\
+        -statics 1 -nested 0 -deleteHook {}}\
+        {-accessPath {[list $tcl_library $TestsDir/auto0 $TestsDir/auto0/auto2 $TestsDir/auto0/auto1]*}\
+        -statics 1 -nested 0 -deleteHook {}}\
+        0 OK1 0 OK2"
+
+test safe-9.11 {interpConfigure change the access path; pkgIndex.tcl packages unaffected by token rearrangement, 9.10 without path auto0} -setup {
+} -body {
+    set i [safe::interpCreate -accessPath [list $tcl_library \
+                                            [file join $TestsDir auto0 auto1] \
+                                            [file join $TestsDir auto0 auto2]]]
+
+    # Inspect.
+    set confA [safe::interpConfigure $i]
+    set path1 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto1]]
+    set path2 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto2]]
+
+    # Load pkgIndex.tcl data.
+    catch {interp eval $i {package require NOEXIST}}
+
+    # Rearrange access path.  Swap tokens {$p(:1:)} and {$p(:2:)}.
+    safe::interpConfigure $i -accessPath [list $tcl_library \
+                                           [file join $TestsDir auto0 auto2] \
+                                           [file join $TestsDir auto0 auto1]]
+
+    # Inspect.
+    set confB [safe::interpConfigure $i]
+    set path3 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto1]]
+    set path4 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto2]]
+
+    # Try to load the packages and run a command from each one.
+    set code3 [catch {interp eval $i {package require SafeTestPackage1}} msg3 opts3]
+    set code4 [catch {interp eval $i {package require SafeTestPackage2}} msg4 opts4]
+    set code5 [catch {interp eval $i {HeresPackage1}} msg5 opts5]
+    set code6 [catch {interp eval $i {HeresPackage2}} msg6 opts6]
+
+    list $path1 $path2 $path3 $path4 $code3 $msg3 $code4 $msg4 $confA $confB \
+         $code5 $msg5 $code6 $msg6
+} -cleanup {
+    safe::interpDelete $i
+} -match glob -result "{\$p(:1:)} {\$p(:2:)} {\$p(:2:)} {\$p(:1:)} 0 1.2.3 0 2.3.4\
+        {-accessPath {[list $tcl_library $TestsDir/auto0/auto1 $TestsDir/auto0/auto2]*}\
+        -statics 1 -nested 0 -deleteHook {}}\
+        {-accessPath {[list $tcl_library $TestsDir/auto0/auto2 $TestsDir/auto0/auto1]*}\
+        -statics 1 -nested 0 -deleteHook {}}\
+        0 OK1 0 OK2"
+
+test safe-9.12 {interpConfigure change the access path; pkgIndex.tcl packages fail if directory de-listed} -setup {
+} -body {
+    set i [safe::interpCreate -accessPath [list $tcl_library \
+                                            [file join $TestsDir auto0 auto1] \
+                                            [file join $TestsDir auto0 auto2]]]
+
+    # Inspect.
+    set confA [safe::interpConfigure $i]
+    set path1 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto1]]
+    set path2 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto2]]
+
+    # Load pkgIndex.tcl data.
+    catch {interp eval $i {package require NOEXIST}}
+
+    # Limit access path.  Remove tokens {$p(:1:)} and {$p(:2:)}.
+    safe::interpConfigure $i -accessPath [list $tcl_library]
+
+    # Inspect.
+    set confB [safe::interpConfigure $i]
+    set code4 [catch {::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto1]} path4]
+    set code5 [catch {::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto2]} path5]
+
+    # Try to load the packages.
+    set code3 [catch {interp eval $i {package require SafeTestPackage1}} msg3]
+    set code6 [catch {interp eval $i {package require SafeTestPackage2}} msg6]
+
+    list $path1 $path2 $code4 $path4 $code5 $path5 $code3 $msg3 $code6 $msg6 $confA $confB
+} -cleanup {
+    safe::interpDelete $i
+} -match glob -result "{\$p(:1:)} {\$p(:2:)} 1 {* not found in access path}\
+        1 {* not found in access path} 1 {*} 1 {*}\
+        {-accessPath {[list $tcl_library $TestsDir/auto0/auto1 $TestsDir/auto0/auto2]*}\
+        -statics 1 -nested 0 -deleteHook {}}\
+        {-accessPath {[list $tcl_library]*} -statics 1 -nested 0 -deleteHook {}}"
+
+test safe-9.20 {check module loading} -setup {
+    set oldTm [tcl::tm::path list]
+    foreach path $oldTm {
+        tcl::tm::path remove $path
+    }
+    tcl::tm::path add [file join $TestsDir auto0 modules]
+} -body {
+    set i [safe::interpCreate -accessPath [list $tcl_library]]
+
+    # Inspect.
+    set confA [safe::interpConfigure $i]
+    set modsA [interp eval $i {tcl::tm::path list}]
+    set path0 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules]]
+    set path1 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules mod1]]
+    set path2 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules mod2]]
+
+    # Try to load the packages and run a command from each one.
+    set code0 [catch {interp eval $i {package require test0}} msg0]
+    set code1 [catch {interp eval $i {package require mod1::test1}} msg1]
+    set code2 [catch {interp eval $i {package require mod2::test2}} msg2]
+    set out0  [interp eval $i {test0::try0}]
+    set out1  [interp eval $i {mod1::test1::try1}]
+    set out2  [interp eval $i {mod2::test2::try2}]
+
+    list $path0 $path1 $path2 -- $modsA -- \
+         $code0 $msg0 $code1 $msg1 $code2 $msg2 -- $confA -- $out0 $out1 $out2
+} -cleanup {
+    tcl::tm::path remove [file join $TestsDir auto0 modules]
+    foreach path [lreverse $oldTm] {
+        tcl::tm::path add $path
+    }
+    safe::interpDelete $i
+} -match glob -result "{\$p(:1:)} {\$p(:2:)} {\$p(:3:)} -- {{\$p(:1:)}} --\
+        0 0.5 0 1.0 0 2.0 --\
+        {-accessPath {[list $tcl_library $TestsDir/auto0/modules \
+                        $TestsDir/auto0/modules/mod1 \
+                        $TestsDir/auto0/modules/mod2]*}\
+        -statics 1 -nested 0 -deleteHook {}} --\
+        res0 res1 res2"
+
+test safe-9.21 {interpConfigure change the access path; check module loading; stale data case 1} -setup {
+    set oldTm [tcl::tm::path list]
+    foreach path $oldTm {
+        tcl::tm::path remove $path
+    }
+    tcl::tm::path add [file join $TestsDir auto0 modules]
+} -body {
+    set i [safe::interpCreate -accessPath [list $tcl_library]]
+
+    # Inspect.
+    set confA [safe::interpConfigure $i]
+    set modsA [interp eval $i {tcl::tm::path list}]
+    set path0 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules]]
+    set path1 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules mod1]]
+    set path2 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules mod2]]
+
+    # Add to access path.
+    # This injects more tokens, pushing modules to higher token numbers.
+    safe::interpConfigure $i -accessPath [list $tcl_library \
+                                           [file join $TestsDir auto0 auto1] \
+                                           [file join $TestsDir auto0 auto2]]
+
+    # Inspect.
+    set confB [safe::interpConfigure $i]
+    set modsB [interp eval $i {tcl::tm::path list}]
+    set path3 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules]]
+    set path4 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules mod1]]
+    set path5 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules mod2]]
+
+    # Load pkg data.
+    catch {interp eval $i {package require NOEXIST}}
+    catch {interp eval $i {package require mod1::NOEXIST}}
+    catch {interp eval $i {package require mod2::NOEXIST}}
+
+    # Try to load the packages and run a command from each one.
+    set code0 [catch {interp eval $i {package require test0}} msg0]
+    set code1 [catch {interp eval $i {package require mod1::test1}} msg1]
+    set code2 [catch {interp eval $i {package require mod2::test2}} msg2]
+    set out0  [interp eval $i {test0::try0}]
+    set out1  [interp eval $i {mod1::test1::try1}]
+    set out2  [interp eval $i {mod2::test2::try2}]
+
+    list $path0 $path1 $path2 -- $modsA -- $path3 $path4 $path5 -- $modsB -- \
+         $code0 $msg0 $code1 $msg1 $code2 $msg2 -- $confA -- $confB -- \
+         $out0 $out1 $out2
+} -cleanup {
+    tcl::tm::path remove [file join $TestsDir auto0 modules]
+    foreach path [lreverse $oldTm] {
+        tcl::tm::path add $path
+    }
+    safe::interpDelete $i
+} -match glob -result "{\$p(:1:)} {\$p(:2:)} {\$p(:3:)} -- {{\$p(:1:)}} --\
+        {\$p(:3:)} {\$p(:4:)} {\$p(:5:)} -- {{\$p(:3:)}} --\
+        0 0.5 0 1.0 0 2.0 --\
+        {-accessPath {[list $tcl_library \
+                        $TestsDir/auto0/modules \
+                        $TestsDir/auto0/modules/mod1 \
+                        $TestsDir/auto0/modules/mod2]}\
+        -statics 1 -nested 0 -deleteHook {}} --\
+        {-accessPath {[list $tcl_library \
+                        $TestsDir/auto0/auto1 \
+                        $TestsDir/auto0/auto2 \
+                        $TestsDir/auto0/modules \
+                        $TestsDir/auto0/modules/mod1 \
+                        $TestsDir/auto0/modules/mod2]}\
+        -statics 1 -nested 0 -deleteHook {}} --\
+        res0 res1 res2"
+
+test safe-9.22 {interpConfigure change the access path; check module loading; stale data case 0} -setup {
+    set oldTm [tcl::tm::path list]
+    foreach path $oldTm {
+        tcl::tm::path remove $path
+    }
+    tcl::tm::path add [file join $TestsDir auto0 modules]
+} -body {
+    set i [safe::interpCreate -accessPath [list $tcl_library]]
+
+    # Inspect.
+    set confA [safe::interpConfigure $i]
+    set modsA [interp eval $i {tcl::tm::path list}]
+    set path0 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules]]
+    set path1 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules mod1]]
+    set path2 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules mod2]]
+
+    # Add to access path.
+    # This injects more tokens, pushing modules to higher token numbers.
+    safe::interpConfigure $i -accessPath [list $tcl_library \
+                                          [file join $TestsDir auto0 auto1] \
+                                          [file join $TestsDir auto0 auto2]]
+
+    # Inspect.
+    set confB [safe::interpConfigure $i]
+    set modsB [interp eval $i {tcl::tm::path list}]
+    set path3 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules]]
+    set path4 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules mod1]]
+    set path5 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules mod2]]
+
+    # Try to load the packages and run a command from each one.
+    set code0 [catch {interp eval $i {package require test0}} msg0]
+    set code1 [catch {interp eval $i {package require mod1::test1}} msg1]
+    set code2 [catch {interp eval $i {package require mod2::test2}} msg2]
+    set out0  [interp eval $i {test0::try0}]
+    set out1  [interp eval $i {mod1::test1::try1}]
+    set out2  [interp eval $i {mod2::test2::try2}]
+
+    list $path0 $path1 $path2 -- $modsA -- $path3 $path4 $path5 -- $modsB -- \
+         $code0 $msg0 $code1 $msg1 $code2 $msg2 -- $confA -- $confB -- \
+         $out0 $out1 $out2
+} -cleanup {
+    tcl::tm::path remove [file join $TestsDir auto0 modules]
+    foreach path [lreverse $oldTm] {
+        tcl::tm::path add $path
+    }
+    safe::interpDelete $i
+} -match glob -result "{\$p(:1:)} {\$p(:2:)} {\$p(:3:)} -- {{\$p(:1:)}} --\
+        {\$p(:3:)} {\$p(:4:)} {\$p(:5:)} -- {{\$p(:3:)}} --\
+        0 0.5 0 1.0 0 2.0 --\
+        {-accessPath {[list $tcl_library \
+                            $TestsDir/auto0/modules \
+                            $TestsDir/auto0/modules/mod1 \
+                            $TestsDir/auto0/modules/mod2]}\
+        -statics 1 -nested 0 -deleteHook {}} --\
+        {-accessPath {[list $tcl_library \
+                            $TestsDir/auto0/auto1 \
+                            $TestsDir/auto0/auto2 \
+                            $TestsDir/auto0/modules \
+                            $TestsDir/auto0/modules/mod1 \
+                            $TestsDir/auto0/modules/mod2]}\
+        -statics 1 -nested 0 -deleteHook {}} --\
+        res0 res1 res2"
+
+test safe-9.23 {interpConfigure change the access path; check module loading; stale data case 3} -setup {
+    set oldTm [tcl::tm::path list]
+    foreach path $oldTm {
+        tcl::tm::path remove $path
+    }
+    tcl::tm::path add [file join $TestsDir auto0 modules]
+} -body {
+    set i [safe::interpCreate -accessPath [list $tcl_library]]
+
+    # Inspect.
+    set confA [safe::interpConfigure $i]
+    set modsA [interp eval $i {tcl::tm::path list}]
+    set path0 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules]]
+    set path1 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules mod1]]
+    set path2 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules mod2]]
+
+    # Force the interpreter to acquire pkg data which will soon become stale.
+    catch {interp eval $i {package require NOEXIST}}
+    catch {interp eval $i {package require mod1::NOEXIST}}
+    catch {interp eval $i {package require mod2::NOEXIST}}
+
+    # Add to access path.
+    # This injects more tokens, pushing modules to higher token numbers.
+    safe::interpConfigure $i -accessPath [list $tcl_library \
+                                           [file join $TestsDir auto0 auto1] \
+                                           [file join $TestsDir auto0 auto2]]
+
+    # Inspect.
+    set confB [safe::interpConfigure $i]
+    set modsB [interp eval $i {tcl::tm::path list}]
+    set path3 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules]]
+    set path4 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules mod1]]
+    set path5 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules mod2]]
+
+    # Refresh stale pkg data.
+    catch {interp eval $i {package require NOEXIST}}
+    catch {interp eval $i {package require mod1::NOEXIST}}
+    catch {interp eval $i {package require mod2::NOEXIST}}
+
+    # Try to load the packages and run a command from each one.
+    set code0 [catch {interp eval $i {package require test0}} msg0]
+    set code1 [catch {interp eval $i {package require mod1::test1}} msg1]
+    set code2 [catch {interp eval $i {package require mod2::test2}} msg2]
+    set out0  [interp eval $i {test0::try0}]
+    set out1  [interp eval $i {mod1::test1::try1}]
+    set out2  [interp eval $i {mod2::test2::try2}]
+
+    list $path0 $path1 $path2 -- $modsA -- $path3 $path4 $path5 -- $modsB -- \
+         $code0 $msg0 $code1 $msg1 $code2 $msg2 -- $confA -- $confB -- \
+         $out0 $out1 $out2
+
+} -cleanup {
+    tcl::tm::path remove [file join $TestsDir auto0 modules]
+    foreach path [lreverse $oldTm] {
+        tcl::tm::path add $path
+    }
+    safe::interpDelete $i
+} -match glob -result "{\$p(:1:)} {\$p(:2:)} {\$p(:3:)} -- {{\$p(:1:)}} --\
+        {\$p(:3:)} {\$p(:4:)} {\$p(:5:)} -- {{\$p(:3:)}} --\
+        0 0.5 0 1.0 0 2.0 --\
+        {-accessPath {[list $tcl_library \
+                            $TestsDir/auto0/modules \
+                            $TestsDir/auto0/modules/mod1 \
+                            $TestsDir/auto0/modules/mod2]}\
+        -statics 1 -nested 0 -deleteHook {}} --\
+        {-accessPath {[list $tcl_library \
+                            $TestsDir/auto0/auto1 \
+                            $TestsDir/auto0/auto2 \
+                            $TestsDir/auto0/modules \
+                            $TestsDir/auto0/modules/mod1 \
+                            $TestsDir/auto0/modules/mod2]}\
+        -statics 1 -nested 0 -deleteHook {}} --\
+        res0 res1 res2"
+
+test safe-9.24 {interpConfigure change the access path; check module loading; stale data case 2 (worst case)} -setup {
+    set oldTm [tcl::tm::path list]
+    foreach path $oldTm {
+        tcl::tm::path remove $path
+    }
+    tcl::tm::path add [file join $TestsDir auto0 modules]
+} -body {
+    set i [safe::interpCreate -accessPath [list $tcl_library]]
+
+    # Inspect.
+    set confA [safe::interpConfigure $i]
+    set modsA [interp eval $i {tcl::tm::path list}]
+    set path0 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules]]
+    set path1 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules mod1]]
+    set path2 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules mod2]]
+
+    # Force the interpreter to acquire pkg data which will soon become stale.
+    catch {interp eval $i {package require NOEXIST}}
+    catch {interp eval $i {package require mod1::NOEXIST}}
+    catch {interp eval $i {package require mod2::NOEXIST}}
+
+    # Add to access path.
+    # This injects more tokens, pushing modules to higher token numbers.
+    safe::interpConfigure $i -accessPath [list $tcl_library \
+                                           [file join $TestsDir auto0 auto1] \
+                                           [file join $TestsDir auto0 auto2]]
+
+    # Inspect.
+    set confB [safe::interpConfigure $i]
+    set modsB [interp eval $i {tcl::tm::path list}]
+    set path3 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules]]
+    set path4 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules mod1]]
+    set path5 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 modules mod2]]
+
+    # Try to load the packages and run a command from each one.
+    set code0 [catch {interp eval $i {package require test0}} msg0]
+    set code1 [catch {interp eval $i {package require mod1::test1}} msg1]
+    set code2 [catch {interp eval $i {package require mod2::test2}} msg2]
+    set out0  [interp eval $i {test0::try0}]
+    set out1  [interp eval $i {mod1::test1::try1}]
+    set out2  [interp eval $i {mod2::test2::try2}]
+
+    list $path0 $path1 $path2 -- $modsA -- $path3 $path4 $path5 -- $modsB -- \
+         $code0 $msg0 $code1 $msg1 $code2 $msg2 -- $confA -- $confB -- \
+         $out0 $out1 $out2
+} -cleanup {
+    tcl::tm::path remove [file join $TestsDir auto0 modules]
+    foreach path [lreverse $oldTm] {
+        tcl::tm::path add $path
+    }
+    safe::interpDelete $i
+} -match glob -result "{\$p(:1:)} {\$p(:2:)} {\$p(:3:)} -- {{\$p(:1:)}} --\
+        {\$p(:3:)} {\$p(:4:)} {\$p(:5:)} -- {{\$p(:3:)}} --\
+        0 0.5 0 1.0 0 2.0 --\
+        {-accessPath {[list $tcl_library \
+                            $TestsDir/auto0/modules \
+                            $TestsDir/auto0/modules/mod1 \
+                            $TestsDir/auto0/modules/mod2]}\
+        -statics 1 -nested 0 -deleteHook {}} --\
+        {-accessPath {[list $tcl_library \
+			    $TestsDir/auto0/auto1 \
+			    $TestsDir/auto0/auto2 \
+			    $TestsDir/auto0/modules \
+			    $TestsDir/auto0/modules/mod1 \
+			    $TestsDir/auto0/modules/mod2]}\
+        -statics 1 -nested 0 -deleteHook {}} --\
+        res0 res1 res2"
+
 
 catch {teststaticpkg Safepkg1 0 0}
 test safe-10.1 {testing statics loading} -constraints TcltestPackage -setup {
@@ -1164,6 +1874,7 @@ test safe-19.2 {Check that each directory of the module path is a valid token} -
 
 
 set ::auto_path $saveAutoPath
+unset saveAutoPath TestsDir
 # cleanup
 ::tcltest::cleanupTests
 return
-- 
cgit v0.12


From b7691676aafa7a3b4ae2464af6e1c4051084c12d Mon Sep 17 00:00:00 2001
From: kjnash <k.j.nash@usa.net>
Date: Wed, 22 Jul 2020 19:38:22 +0000
Subject: Move tests that depend on platform::shell and http1.0 from safe.test
 to safe-stock86.test, and replace with tests that use example packages.  Add
 -setup and -cleanup code where missing from tests that use AutoPathSync.

---
 tests/safe-stock86.test | 157 +++++++++++++++++++++++++++++++-
 tests/safe.test         | 231 +++++++++++++++++++++++++++++++-----------------
 2 files changed, 303 insertions(+), 85 deletions(-)

diff --git a/tests/safe-stock86.test b/tests/safe-stock86.test
index 2fbe108..a3f6bb5 100644
--- a/tests/safe-stock86.test
+++ b/tests/safe-stock86.test
@@ -50,6 +50,7 @@ catch {safe::interpConfigure}
 # package - Tcltest - but it might be absent if we're in standard tclsh)
 
 testConstraint TcltestPackage [expr {![catch {package require Tcltest}]}]
+testConstraint AutoSyncDefined 1
 
 # high level general test
 test safe-stock86-7.1 {tests that everything works at high level, uses http 2} -body {
@@ -91,6 +92,31 @@ test safe-stock86-7.4 {tests specific path and positive search, uses http1.0} -b
 	    [catch {interp eval $i {package require http 1}} msg] $msg -- \
 	    $mappA -- [safe::interpDelete $i]
 } -match glob -result {{$p(:0:)} {$p(:*:)} -- 0 1.0 -- {TCLLIB *TCLLIB/http1.0} -- {}}
+test safe-stock86-7.5 {tests positive and negative module loading with conventional AutoPathSync} -setup {
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 1
+    }
+    set i [safe::interpCreate]
+    interp eval $i {
+        package forget platform::shell
+        package forget platform
+        catch {namespace delete ::platform}
+# for platform::shell use mod1::test1
+    }
+} -body {
+    # Should raise an error (module ancestor directory issue)
+    set code1 [catch {interp eval $i {package require shell}} msg1]
+    # Should not raise an error
+    set code2 [catch {interp eval $i {package require platform::shell}} msg2]
+    return [list $code1 $msg1 $code2]
+} -cleanup {
+    safe::interpDelete $i
+    if {$SyncExists} {
+        safe::setAutoPathSync $SyncVal_TMP
+    }
+} -result {1 {can't find package shell} 0}
 
 # The following test checks whether the definition of tcl_endOfWord can be
 # obtained from auto_loading.  It was previously test "safe-5.1".
@@ -102,12 +128,139 @@ test safe-stock86-9.8 {test auto-loading in safe interpreters, was test 5.1} -se
 } -cleanup {
     safe::interpDelete a
 } -result -1
+
+### 18. Tests for AutoSyncDefined without conventional AutoPathSync, i.e. with AutoPathSync off.
+test safe-stock86-18.1 {cf. safe-stock86-7.1 - tests that everything works at high level without conventional AutoPathSync} -constraints AutoSyncDefined -setup {
+    # All ::safe commands are loaded at start of file.
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
+
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 0
+    } else {
+        error {This test is meaningful only if the command ::safe::setAutoPathSync is defined}
+    }
+
+    # Without AutoPathSync, we need a more complete auto_path,
+    # because the slave will use the same value.
+    set lib1        [info library]
+    set lib2        [file dirname $lib1]
+    set ::auto_TMP  $::auto_path
+    set ::auto_path [list $lib1 $lib2]
+
+    set i [safe::interpCreate]
+    set ::auto_path $::auto_TMP
+} -body {
+    # no error shall occur:
+    # (because the default access_path shall include 1st level sub dirs so
+    #  package require in a slave works like in the master)
+    set v [interp eval $i {package require http 1}]
+    # no error shall occur:
+    interp eval $i {http_config}
+    set v
+} -cleanup {
+    safe::interpDelete $i
+    if {$SyncExists} {
+        safe::setAutoPathSync $SyncVal_TMP
+    }
+} -result 1.0
+test safe-stock86-18.2 {cf. safe-stock86-7.2 - tests specific path and interpFind/AddToAccessPath without conventional AutoPathSync} -constraints AutoSyncDefined -setup {
+    # All ::safe commands are loaded at start of file.
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
+
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 0
+    } else {
+        error {This test is meaningful only if the command ::safe::setAutoPathSync is defined}
+    }
+} -body {
+    set i [safe::interpCreate -nostat -nested 1 -accessPath [list [info library]]]
+    set auto1 [interp eval $i {set ::auto_path}]
+    interp eval $i {set ::auto_path [list {$p(:0:)}]}
+    # should not add anything (p0)
+    set token1 [safe::interpAddToAccessPath $i [info library]]
+    # should add as p1
+    set token2 [safe::interpAddToAccessPath $i "/dummy/unixlike/test/path"]
+    # an error shall occur (http is not anymore in the secure 0-level
+    # provided deep path)
+    list $auto1 $token1 $token2 \
+	    [catch {interp eval $i {package require http 1}} msg] $msg \
+	    [safe::interpConfigure $i]\
+	    [safe::interpDelete $i]
+} -cleanup {
+    if {$SyncExists} {
+        safe::setAutoPathSync $SyncVal_TMP
+    }
+} -match glob -result "{} {\$p(:0:)} {\$p(:*:)} 1 {can't find package http 1} {-accessPath {[list $tcl_library */dummy/unixlike/test/path]} -statics 0 -nested 1 -deleteHook {} -autoPath [list $tcl_library]} {}"
+test safe-stock86-18.4 {cf. safe-stock86-7.4 - tests specific path and positive search and auto_path without conventional AutoPathSync} -constraints AutoSyncDefined -setup {
+    # All ::safe commands are loaded at start of file.
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
+
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 0
+    } else {
+        error {This test is meaningful only if the command ::safe::setAutoPathSync is defined}
+    }
+} -body {
+    set i [safe::interpCreate -nostat -nested 1 -accessPath [list [info library]]]
+
+    # should not have been set by Safe Base:
+    set auto1 [interp eval $i {set ::auto_path}]
+
+    interp eval $i {set ::auto_path [list {$p(:0:)}]}
+
+    # should not add anything (p0)
+    set token1 [safe::interpAddToAccessPath $i [info library]]
+
+    # should add as p* (not p1 if master has a module path)
+    set token2 [safe::interpAddToAccessPath $i [file join [info library] http1.0]]
+
+    # should not have been changed by Safe Base:
+    set auto2 [interp eval $i {set ::auto_path}]
+
+    # This time, unlike test safe-stock86-18.2 and the try above, http 1.0 should be found:
+    list $auto1 $auto2 $token1 $token2 \
+	    [catch {interp eval $i {package require http 1}} msg] $msg \
+	    [safe::interpConfigure $i]\
+	    [safe::interpDelete $i]
+} -cleanup {
+    if {$SyncExists} {
+	safe::setAutoPathSync $SyncVal_TMP
+    }
+} -match glob -result "{} {{\$p(:0:)}} {\$p(:0:)} {\$p(:*:)} 0 1.0 {-accessPath {[list $tcl_library *$tcl_library/http1.0]} -statics 0 -nested 1 -deleteHook {} -autoPath [list $tcl_library]} {}"
+test safe-stock86-18.5 {cf. safe-stock86-7.5 - tests positive and negative module loading without conventional AutoPathSync} -setup {
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 0
+    } else {
+        error {This test is meaningful only if the command ::safe::setAutoPathSync is defined}
+    }
+    set i [safe::interpCreate]
+    interp eval $i {
+        package forget platform::shell
+        package forget platform
+        catch {namespace delete ::platform}
+    }
+} -body {
+    # Should raise an error (tests module ancestor directory rule)
+    set code1 [catch {interp eval $i {package require shell}} msg1]
+    # Should not raise an error
+    set code2 [catch {interp eval $i {package require platform::shell}} msg2]
+    return [list $code1 $msg1 $code2]
+} -cleanup {
+    safe::interpDelete $i
+    if {$SyncExists} {
+        safe::setAutoPathSync $SyncVal_TMP
+    }
+} -result {1 {can't find package shell} 0}
 
+# cleanup
 set ::auto_path $SaveAutoPath
 unset SaveAutoPath TestsDir PathMapp
 rename mapList {}
-
-# cleanup
 ::tcltest::cleanupTests
 return
 
diff --git a/tests/safe.test b/tests/safe.test
index ec469ee..5987ce8 100644
--- a/tests/safe.test
+++ b/tests/safe.test
@@ -28,8 +28,6 @@ if {[lsearch [namespace children] ::tcltest] == -1} {
     namespace import -force ::tcltest::*
 }
 
-testConstraint AutoSyncDefined 1
-
 foreach i [interp slaves] {
     interp delete $i
 }
@@ -62,6 +60,7 @@ catch {safe::interpConfigure}
 # package - Tcltest - but it might be absent if we're in standard tclsh)
 
 testConstraint TcltestPackage [expr {![catch {package require Tcltest}]}]
+testConstraint AutoSyncDefined 1
 
 test safe-1.1 {safe::interpConfigure syntax} -returnCodes error -body {
     safe::interpConfigure
@@ -287,7 +286,6 @@ test safe-5.6 {example modules packages, test in master interpreter, append to p
     catch {namespace delete ::mod1}
 } -match glob -result {0 0.5 0 1.0 0 2.0 -- res0 res1 res2}
 
-
 # test safe interps 'information leak'
 proc SafeEval {script} {
     # Helper procedure that ensures the safe interp is cleaned up even if
@@ -319,9 +317,8 @@ rename SafeEval {}
 # leaking infos, but they still do...
 
 # high level general test
-# Use example packages not http1.0
+# Use example packages not http1.0 etc
 test safe-7.1 {tests that everything works at high level with conventional AutoPathSync} -setup {
-    # All ::safe commands are loaded at start of file.
     set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
     if {$SyncExists} {
         set SyncVal_TMP [safe::setAutoPathSync]
@@ -346,9 +343,7 @@ test safe-7.1 {tests that everything works at high level with conventional AutoP
     }
 } -match glob -result 1.2.3
 test safe-7.2 {tests specific path and interpFind/AddToAccessPath with conventional AutoPathSync} -setup {
-    # All ::safe commands are loaded at start of file.
     set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
-
     if {$SyncExists} {
         set SyncVal_TMP [safe::setAutoPathSync]
         safe::setAutoPathSync 1
@@ -409,9 +404,7 @@ test safe-7.3.1 {check that safe subinterpreters work with namespace names} -set
             [interp exists $j] [info vars ::safe::S*]
 } -match glob -result {{} {} ok ok {} 0 {}}
 test safe-7.4 {tests specific path and positive search with conventional AutoPathSync} -setup {
-    # All ::safe commands are loaded at start of file.
     set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
-
     if {$SyncExists} {
         set SyncVal_TMP [safe::setAutoPathSync]
         safe::setAutoPathSync 1
@@ -439,33 +432,30 @@ test safe-7.4 {tests specific path and positive search with conventional AutoPat
 } -match glob -result {{$p(:0:)} {$p(:*:)} -- 0 1.2.3 --\
         {TCLLIB * TESTSDIR/auto0/auto1} -- {}}
 test safe-7.5 {tests positive and negative module loading with conventional AutoPathSync} -setup {
-    # All ::safe commands are loaded at start of file.
     set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
-
     if {$SyncExists} {
         set SyncVal_TMP [safe::setAutoPathSync]
         safe::setAutoPathSync 1
     }
-
+    tcl::tm::path add [file join $TestsDir auto0 modules]
     set i [safe::interpCreate]
-
+    tcl::tm::path remove [file join $TestsDir auto0 modules]
     interp eval $i {
-        package forget platform::shell
-        package forget platform
-        catch {namespace delete ::platform}
+        package forget mod1::test1
+        catch {namespace delete ::mod1}
     }
 } -body {
     # Should raise an error (module ancestor directory issue)
-    set code1 [catch {interp eval $i {package require shell}} msg1]
+    set code1 [catch {interp eval $i {package require test1}} msg1]
     # Should not raise an error
-    set code2 [catch {interp eval $i {package require platform::shell}} msg2]
+    set code2 [catch {interp eval $i {package require mod1::test1}} msg2]
     return [list $code1 $msg1 $code2]
 } -cleanup {
     safe::interpDelete $i
     if {$SyncExists} {
         safe::setAutoPathSync $SyncVal_TMP
     }
-} -result {1 {can't find package shell} 0}
+} -result {1 {can't find package test1} 0}
 
 # test source control on file name
 test safe-8.1 {safe source control on file} -setup {
@@ -734,7 +724,12 @@ test safe-9.8 {test autoloading commands indexed in tclIndex files} -setup {
     safe::interpDelete $i
 } -match glob -result {{$p(:1:)} {$p(:2:)} -- 0 ok1 0 ok2 --\
         {TCLLIB TESTSDIR/auto0/auto1 TESTSDIR/auto0/auto2*}}
-test safe-9.9 {interpConfigure change the access path; tclIndex commands unaffected by token rearrangement (dummy test of doreset)} -setup {
+test safe-9.9 {interpConfigure change the access path; tclIndex commands unaffected by token rearrangement (dummy test of doreset), with conventional AutoPathSync} -setup {
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 1
+    }
 } -body {
     set i [safe::interpCreate -accessPath [list $tcl_library \
                                             [file join $TestsDir auto0 auto1] \
@@ -770,10 +765,18 @@ test safe-9.9 {interpConfigure change the access path; tclIndex commands unaffec
     list $path1 $path2 -- $path3 $path4 -- $code3 $msg3 $code4 $msg4 -- $mappA -- $mappB
 } -cleanup {
     safe::interpDelete $i
+    if {$SyncExists} {
+        safe::setAutoPathSync $SyncVal_TMP
+    }
 } -match glob -result {{$p(:1:)} {$p(:2:)} -- {$p(:2:)} {$p(:1:)} -- 0 ok1 0 ok2 --\
         {TCLLIB TESTSDIR/auto0/auto1 TESTSDIR/auto0/auto2*} --\
         {TCLLIB TESTSDIR/auto0/auto2 TESTSDIR/auto0/auto1*}}
-test safe-9.10 {interpConfigure change the access path; tclIndex commands unaffected by token rearrangement (actual test of doreset)} -setup {
+test safe-9.10 {interpConfigure change the access path; tclIndex commands unaffected by token rearrangement (actual test of doreset), with conventional AutoPathSync} -setup {
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 1
+    }
 } -body {
     set i [safe::interpCreate -accessPath [list $tcl_library \
                                             [file join $TestsDir auto0 auto1] \
@@ -807,11 +810,19 @@ test safe-9.10 {interpConfigure change the access path; tclIndex commands unaffe
     list $path1 $path2 -- $path3 $path4 -- $code3 $msg3 $code4 $msg4 -- $mappA -- $mappB
 } -cleanup {
     safe::interpDelete $i
+    if {$SyncExists} {
+        safe::setAutoPathSync $SyncVal_TMP
+    }
 } -match glob -result {{$p(:1:)} {$p(:2:)} -- {$p(:2:)} {$p(:1:)} --\
         0 ok1 0 ok2 --\
         {TCLLIB TESTSDIR/auto0/auto1 TESTSDIR/auto0/auto2*} --\
         {TCLLIB TESTSDIR/auto0/auto2 TESTSDIR/auto0/auto1*}}
-test safe-9.11 {interpConfigure change the access path; pkgIndex.tcl packages unaffected by token rearrangement} -setup {
+test safe-9.11 {interpConfigure change the access path; pkgIndex.tcl packages unaffected by token rearrangement, with conventional AutoPathSync} -setup {
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 1
+    }
 } -body {
     # For complete correspondence to safe-9.10opt, include auto0 in access path.
     set i [safe::interpCreate -accessPath [list $tcl_library \
@@ -851,11 +862,19 @@ test safe-9.11 {interpConfigure change the access path; pkgIndex.tcl packages un
          $mappA -- $mappB -- $code5 $msg5 $code6 $msg6
 } -cleanup {
     safe::interpDelete $i
+    if {$SyncExists} {
+        safe::setAutoPathSync $SyncVal_TMP
+    }
 } -match glob -result {{$p(:2:)} {$p(:3:)} -- {$p(:3:)} {$p(:2:)} -- 0 1.2.3 0 2.3.4 --\
         {TCLLIB TESTSDIR/auto0 TESTSDIR/auto0/auto1 TESTSDIR/auto0/auto2*} --\
         {TCLLIB TESTSDIR/auto0 TESTSDIR/auto0/auto2 TESTSDIR/auto0/auto1*} --\
         0 OK1 0 OK2}
-test safe-9.12 {interpConfigure change the access path; pkgIndex.tcl packages unaffected by token rearrangement, 9.10 without path auto0} -setup {
+test safe-9.12 {interpConfigure change the access path; pkgIndex.tcl packages unaffected by token rearrangement, 9.10 without path auto0, with conventional AutoPathSync} -setup {
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 1
+    }
 } -body {
     set i [safe::interpCreate -accessPath [list $tcl_library \
                                             [file join $TestsDir auto0 auto1] \
@@ -890,12 +909,20 @@ test safe-9.12 {interpConfigure change the access path; pkgIndex.tcl packages un
             $code5 $msg5 $code6 $msg6
 } -cleanup {
     safe::interpDelete $i
+    if {$SyncExists} {
+        safe::setAutoPathSync $SyncVal_TMP
+    }
 } -match glob -result {{$p(:1:)} {$p(:2:)} -- {$p(:2:)} {$p(:1:)} --\
         0 1.2.3 0 2.3.4 --\
         {TCLLIB TESTSDIR/auto0/auto1 TESTSDIR/auto0/auto2*} --\
         {TCLLIB TESTSDIR/auto0/auto2 TESTSDIR/auto0/auto1*} --\
         0 OK1 0 OK2}
-test safe-9.13 {interpConfigure change the access path; pkgIndex.tcl packages fail if directory de-listed} -setup {
+test safe-9.13 {interpConfigure change the access path; pkgIndex.tcl packages fail if directory de-listed, with conventional AutoPathSync} -setup {
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 1
+    }
 } -body {
     set i [safe::interpCreate -accessPath [list $tcl_library \
                                             [file join $TestsDir auto0 auto1] \
@@ -926,10 +953,18 @@ test safe-9.13 {interpConfigure change the access path; pkgIndex.tcl packages fa
             $mappA -- $mappB
 } -cleanup {
     safe::interpDelete $i
+    if {$SyncExists} {
+        safe::setAutoPathSync $SyncVal_TMP
+    }
 } -match glob -result {{$p(:1:)} {$p(:2:)} -- 1 {* not found in access path} --\
         1 {* not found in access path} -- 1 1 --\
         {TCLLIB TESTSDIR/auto0/auto1 TESTSDIR/auto0/auto2*} -- {TCLLIB*}}
-test safe-9.20 {check module loading} -setup {
+test safe-9.20 {check module loading, with conventional AutoPathSync} -setup {
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 1
+    }
     set oldTm [tcl::tm::path list]
     foreach path $oldTm {
         tcl::tm::path remove $path
@@ -962,6 +997,9 @@ test safe-9.20 {check module loading} -setup {
         tcl::tm::path add $path
     }
     safe::interpDelete $i
+    if {$SyncExists} {
+        safe::setAutoPathSync $SyncVal_TMP
+    }
 } -match glob -result {{{$p(:1:)} {$p(:2:)} {$p(:3:)}} -- {{$p(:1:)}} --\
         0 0.5 0 1.0 0 2.0 --\
         {TCLLIB TESTSDIR/auto0/modules TESTSDIR/auto0/modules/mod1\
@@ -975,7 +1013,12 @@ test safe-9.20 {check module loading} -setup {
 #   directories in the access path.  Both those things must be sorted before
 #   comparing with expected results.  The test is therefore not totally strict,
 #   but will notice missing or surplus directories.
-test safe-9.21 {interpConfigure change the access path; check module loading; stale data case 1} -setup {
+test safe-9.21 {interpConfigure change the access path; check module loading, with conventional AutoPathSync; stale data case 1} -setup {
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 1
+    }
     set oldTm [tcl::tm::path list]
     foreach path $oldTm {
         tcl::tm::path remove $path
@@ -1028,6 +1071,9 @@ test safe-9.21 {interpConfigure change the access path; check module loading; st
         tcl::tm::path add $path
     }
     safe::interpDelete $i
+    if {$SyncExists} {
+        safe::setAutoPathSync $SyncVal_TMP
+    }
 } -match glob -result {{{$p(:1:)} {$p(:2:)} {$p(:3:)}} -- {{$p(:1:)}} --\
         {{$p(:3:)} {$p(:4:)} {$p(:5:)}} -- {{$p(:3:)}} --\
         0 0.5 0 1.0 0 2.0 --\
@@ -1037,7 +1083,12 @@ test safe-9.21 {interpConfigure change the access path; check module loading; st
          TESTSDIR/auto0/modules/mod1 TESTSDIR/auto0/modules/mod2} --\
         res0 res1 res2}
 # See comments on lsort after test safe-9.20.
-test safe-9.22 {interpConfigure change the access path; check module loading; stale data case 0} -setup {
+test safe-9.22 {interpConfigure change the access path; check module loading, with conventional AutoPathSync; stale data case 0} -setup {
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 1
+    }
     set oldTm [tcl::tm::path list]
     foreach path $oldTm {
         tcl::tm::path remove $path
@@ -1075,7 +1126,7 @@ test safe-9.22 {interpConfigure change the access path; check module loading; st
     set out1  [interp eval $i {mod1::test1::try1}]
     set out2  [interp eval $i {mod2::test2::try2}]
 
-    list [lsort [list $path0 $path1 $path2]] -- $modsA --\
+    list [lsort [list $path0 $path1 $path2]] -- $modsA -- \
             [lsort [list $path3 $path4 $path5]] -- $modsB -- \
             $code0 $msg0 $code1 $msg1 $code2 $msg2 -- $sortA -- $sortB -- \
             $out0 $out1 $out2
@@ -1085,6 +1136,9 @@ test safe-9.22 {interpConfigure change the access path; check module loading; st
         tcl::tm::path add $path
     }
     safe::interpDelete $i
+    if {$SyncExists} {
+        safe::setAutoPathSync $SyncVal_TMP
+    }
 } -match glob -result {{{$p(:1:)} {$p(:2:)} {$p(:3:)}} -- {{$p(:1:)}} --\
         {{$p(:3:)} {$p(:4:)} {$p(:5:)}} -- {{$p(:3:)}} --\
         0 0.5 0 1.0 0 2.0 --\
@@ -1094,7 +1148,12 @@ test safe-9.22 {interpConfigure change the access path; check module loading; st
          TESTSDIR/auto0/modules/mod1 TESTSDIR/auto0/modules/mod2} --\
         res0 res1 res2}
 # See comments on lsort after test safe-9.20.
-test safe-9.23 {interpConfigure change the access path; check module loading; stale data case 3} -setup {
+test safe-9.23 {interpConfigure change the access path; check module loading, with conventional AutoPathSync; stale data case 3} -setup {
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 1
+    }
     set oldTm [tcl::tm::path list]
     foreach path $oldTm {
         tcl::tm::path remove $path
@@ -1142,7 +1201,7 @@ test safe-9.23 {interpConfigure change the access path; check module loading; st
     set out1  [interp eval $i {mod1::test1::try1}]
     set out2  [interp eval $i {mod2::test2::try2}]
 
-    list [lsort [list $path0 $path1 $path2]] -- $modsA --\
+    list [lsort [list $path0 $path1 $path2]] -- $modsA -- \
             [lsort [list $path3 $path4 $path5]] -- $modsB -- \
             $code0 $msg0 $code1 $msg1 $code2 $msg2 -- $sortA -- $sortB -- \
             $out0 $out1 $out2
@@ -1152,6 +1211,9 @@ test safe-9.23 {interpConfigure change the access path; check module loading; st
         tcl::tm::path add $path
     }
     safe::interpDelete $i
+    if {$SyncExists} {
+        safe::setAutoPathSync $SyncVal_TMP
+    }
 } -match glob -result {{{$p(:1:)} {$p(:2:)} {$p(:3:)}} -- {{$p(:1:)}} --\
         {{$p(:3:)} {$p(:4:)} {$p(:5:)}} -- {{$p(:3:)}} --\
         0 0.5 0 1.0 0 2.0 --\
@@ -1161,7 +1223,12 @@ test safe-9.23 {interpConfigure change the access path; check module loading; st
          TESTSDIR/auto0/modules/mod1 TESTSDIR/auto0/modules/mod2} --\
         res0 res1 res2}
 # See comments on lsort after test safe-9.20.
-test safe-9.24 {interpConfigure change the access path; check module loading; stale data case 2 (worst case)} -setup {
+test safe-9.24 {interpConfigure change the access path; check module loading, with conventional AutoPathSync; stale data case 2 (worst case)} -setup {
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 1
+    }
     set oldTm [tcl::tm::path list]
     foreach path $oldTm {
         tcl::tm::path remove $path
@@ -1214,6 +1281,9 @@ test safe-9.24 {interpConfigure change the access path; check module loading; st
         tcl::tm::path add $path
     }
     safe::interpDelete $i
+    if {$SyncExists} {
+        safe::setAutoPathSync $SyncVal_TMP
+    }
 } -match glob -result {{{$p(:1:)} {$p(:2:)} {$p(:3:)}} -- {{$p(:1:)}} --\
         {{$p(:3:)} {$p(:4:)} {$p(:5:)}} -- {{$p(:3:)}} --\
         0 0.5 0 1.0 0 2.0 --\
@@ -1606,7 +1676,7 @@ test safe-15.1 {safe file ensemble does not surprise code} -setup {
     unset -nocomplain msg
     interp delete $i
 } -result {1 {a b c} 1 {a b c} 1 {invalid command name "file"} 1 0 {a b c} 1 {not allowed to invoke subcommand isdirectory of file}}
-test safe-15.1.1 {safe file ensemble does not surprise code} -setup {
+test safe-15.2 {safe file ensemble does not surprise code} -setup {
     set i [interp create -safe]
 } -body {
     set result [expr {"file" in [interp hidden $i]}]
@@ -1721,9 +1791,9 @@ test safe-16.8 {Bug 3529949: defang ~user in paths used by AliasGlob (2)} -setup
     safe::interpDelete $i
     unset user
 } -result {~USER}
-
-### 17. The first element in a slave's ::auto_path and access path must be [info library].
 
+### 17. The first element in a slave's ::auto_path and access path must be [info library].
+### Merge back to no-TIP safe.test
 test safe-17.1 {Check that first element of slave auto_path (and access path) is Tcl Library} -setup {
     set lib1        [info library]
     set lib2        [file dirname $lib1]
@@ -1763,45 +1833,39 @@ test safe-17.2 {Check that first element of slave auto_path (and access path) is
 } -result [list [info library] [info library]]
 
 ### 18. Tests for AutoSyncDefined without conventional AutoPathSync, i.e. with AutoPathSync off.
-
 test safe-18.1 {cf. safe-7.1 - tests that everything works at high level without conventional AutoPathSync} -constraints AutoSyncDefined -setup {
-    # All ::safe commands are loaded at start of file.
     set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
-
     if {$SyncExists} {
         set SyncVal_TMP [safe::setAutoPathSync]
         safe::setAutoPathSync 0
     } else {
         error {This test is meaningful only if the command ::safe::setAutoPathSync is defined}
     }
-
-    # Without AutoPathSync, we need a more complete auto_path, because the slave will use the same value.
+    # Without AutoPathSync, we need a more complete auto_path,
+    # because the slave will use the same value.
     set lib1        [info library]
-    set lib2        [file dirname $lib1]
+    set lib2        [file join $TestsDir auto0]
     set ::auto_TMP  $::auto_path
     set ::auto_path [list $lib1 $lib2]
 
     set i [safe::interpCreate]
+    set ::auto_path $::auto_TMP
 } -body {
     # no error shall occur:
-    # (because the default access_path shall include 1st level sub dirs
-    #  so package require in a slave works like in the master)
-    set v [interp eval $i {package require http 1}]
+    # (because the default access_path shall include 1st level sub dirs so
+    #  package require in a slave works like in the master)
+    set v [interp eval $i {package require SafeTestPackage1}]
     # no error shall occur:
-    interp eval $i {http_config}
+    interp eval $i HeresPackage1
     set v
 } -cleanup {
-    set ::auto_path $::auto_TMP
     safe::interpDelete $i
     if {$SyncExists} {
         safe::setAutoPathSync $SyncVal_TMP
     }
-} -result 1.0
-
+} -match glob -result 1.2.3
 test safe-18.2 {cf. safe-7.2 - tests specific path and interpFind/AddToAccessPath without conventional AutoPathSync} -constraints AutoSyncDefined -setup {
-    # All ::safe commands are loaded at start of file.
     set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
-
     if {$SyncExists} {
         set SyncVal_TMP [safe::setAutoPathSync]
         safe::setAutoPathSync 0
@@ -1814,37 +1878,38 @@ test safe-18.2 {cf. safe-7.2 - tests specific path and interpFind/AddToAccessPat
     interp eval $i {set ::auto_path [list {$p(:0:)}]}
     # should not add anything (p0)
     set token1 [safe::interpAddToAccessPath $i [info library]]
-    # should add as p1
+    # should add as p* (not p1 if master has a module path)
     set token2 [safe::interpAddToAccessPath $i "/dummy/unixlike/test/path"]
-    # an error shall occur (http is not anymore in the secure 0-level
+    # should add as p* (not p2 if master has a module path)
+    set token3 [safe::interpAddToAccessPath $i [file join $TestsDir auto0]]
+    # an error shall occur (SafeTestPackage1 is not anymore in the secure 0-level
     # provided deep path)
-    list $auto1 $token1 $token2 \
-	    [catch {interp eval $i {package require http 1}} msg] $msg \
+    list $auto1 $token1 $token2 $token3 \
+	    [catch {interp eval $i {package require SafeTestPackage1}} msg] $msg \
 	    [safe::interpConfigure $i]\
 	    [safe::interpDelete $i]
 } -cleanup {
     if {$SyncExists} {
         safe::setAutoPathSync $SyncVal_TMP
     }
-} -match glob -result "{} {\$p(:0:)} {\$p(:*:)} 1 {can't find package http 1} {-accessPath {[list $tcl_library */dummy/unixlike/test/path]} -statics 0 -nested 1 -deleteHook {} -autoPath [list $tcl_library]} {}"
-
+} -match glob -result "{} {\$p(:0:)} {\$p(:*:)} {\$p(:*:)}\
+        1 {can't find package SafeTestPackage1}\
+        {-accessPath {[list $tcl_library \
+                            */dummy/unixlike/test/path \
+                            $TestsDir/auto0]}\
+        -statics 0 -nested 1 -deleteHook {} -autoPath [list $tcl_library]} {}"
 test safe-18.3 {Check that default auto_path is the same as in the master interpreter without conventional AutoPathSync} -constraints AutoSyncDefined -setup {
-    # All ::safe commands are loaded at start of file.
     set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
-
     if {$SyncExists} {
         set SyncVal_TMP [safe::setAutoPathSync]
         safe::setAutoPathSync 0
     } else {
         error {This test is meaningful only if the command ::safe::setAutoPathSync is defined}
     }
-
     set i [safe::interpCreate]
-
 } -body {
     # This file's header sets auto_path to a single directory [info library],
     # which is the one required by Safe Base to be present & first in the list.
-
     set ap {}
     foreach token [$i eval set ::auto_path] {
         lappend ap [dict get [set ::safe::S${i}(access_path,map)] $token]
@@ -1855,12 +1920,9 @@ test safe-18.3 {Check that default auto_path is the same as in the master interp
     if {$SyncExists} {
 	safe::setAutoPathSync $SyncVal_TMP
     }
-} -result [set ::auto_path]
-
+} -result $::auto_path
 test safe-18.4 {cf. safe-7.4 - tests specific path and positive search and auto_path without conventional AutoPathSync} -constraints AutoSyncDefined -setup {
-    # All ::safe commands are loaded at start of file.
     set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
-
     if {$SyncExists} {
         set SyncVal_TMP [safe::setAutoPathSync]
         safe::setAutoPathSync 0
@@ -1879,55 +1941,59 @@ test safe-18.4 {cf. safe-7.4 - tests specific path and positive search and auto_
     set token1 [safe::interpAddToAccessPath $i [info library]]
 
     # should add as p* (not p1 if master has a module path)
-    set token2 [safe::interpAddToAccessPath $i [file join [info library] http1.0]]
+    set token2 [safe::interpAddToAccessPath $i [file join $TestsDir auto0]]
+
+    # should add as p* (not p2 if master has a module path)
+    set token3 [safe::interpAddToAccessPath $i [file join $TestsDir auto0 auto1]]
 
     # should not have been changed by Safe Base:
     set auto2 [interp eval $i {set ::auto_path}]
 
-    # This time, unlike test safe-18.2 and the try above, http 1.0 should be found:
-    list $auto1 $auto2 $token1 $token2 \
-	    [catch {interp eval $i {package require http 1}} msg] $msg \
+    set auto3 [interp eval $i [list set ::auto_path [list {$p(:0:)} $token2]]]
+
+    # This time, unlike test safe-18.2 and the try above, SafeTestPackage1 should be found:
+    list $auto1 $auto2 $token1 $token2 $token3 \
+	    [catch {interp eval $i {package require SafeTestPackage1}} msg] $msg \
 	    [safe::interpConfigure $i]\
 	    [safe::interpDelete $i]
 } -cleanup {
     if {$SyncExists} {
 	safe::setAutoPathSync $SyncVal_TMP
     }
-} -match glob -result "{} {{\$p(:0:)}} {\$p(:0:)} {\$p(:*:)} 0 1.0 {-accessPath {[list $tcl_library *$tcl_library/http1.0]} -statics 0 -nested 1 -deleteHook {} -autoPath [list $tcl_library]} {}"
-
+} -match glob -result "{} {{\$p(:0:)}} {\$p(:0:)} {\$p(:*:)} {\$p(:*:)} 0 1.2.3\
+        {-accessPath {[list $tcl_library *$TestsDir/auto0 $TestsDir/auto0/auto1]}\
+        -statics 0 -nested 1 -deleteHook {}\
+        -autoPath {[list $tcl_library $TestsDir/auto0]}} {}"
 test safe-18.5 {cf. safe-7.5 - tests positive and negative module loading without conventional AutoPathSync} -setup {
-    # All ::safe commands are loaded at start of file.
     set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
-
     if {$SyncExists} {
         set SyncVal_TMP [safe::setAutoPathSync]
         safe::setAutoPathSync 0
     } else {
         error {This test is meaningful only if the command ::safe::setAutoPathSync is defined}
     }
-
+    tcl::tm::path add [file join $TestsDir auto0 modules]
     set i [safe::interpCreate]
-
+    tcl::tm::path remove [file join $TestsDir auto0 modules]
     interp eval $i {
-        package forget platform::shell
-        package forget platform
-        catch {namespace delete ::platform}
+        package forget mod1::test1
+        catch {namespace delete ::mod1}
     }
 } -body {
     # Should raise an error (tests module ancestor directory rule)
-    set code1 [catch {interp eval $i {package require shell}} msg1]
+    set code1 [catch {interp eval $i {package require test1}} msg1]
     # Should not raise an error
-    set code2 [catch {interp eval $i {package require platform::shell}} msg2]
+    set code2 [catch {interp eval $i {package require mod1::test1}} msg2]
     return [list $code1 $msg1 $code2]
 } -cleanup {
     safe::interpDelete $i
     if {$SyncExists} {
         safe::setAutoPathSync $SyncVal_TMP
     }
-} -result {1 {can't find package shell} 0}
+} -result {1 {can't find package test1} 0}
 
 ### 19. Test tokenization of directories available to a slave.
-
+### Merge back to no-TIP safe.test
 test safe-19.1 {Check that each directory of the default auto_path is a valid token} -setup {
     set i [safe::interpCreate]
 } -body {
@@ -1962,12 +2028,11 @@ test safe-19.2 {Check that each directory of the module path is a valid token} -
     safe::interpDelete $i
 } -result {}
 
+# cleanup
 set ::auto_path $SaveAutoPath
 unset SaveAutoPath TestsDir PathMapp
 rename mapList {}
 rename mapAndSortList {}
-
-# cleanup
 ::tcltest::cleanupTests
 return
 
-- 
cgit v0.12