@codyswann/lisa 4.72.6 → 4.73.0

package/all/copy-overwrite/scripts/lib/npm-update-rails-tool-identity.mjs

@@ -0,0 +1,288 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Fixed native runtime identities are rechecked before each Docker observation. */
+import {
+  constants,
+  existsSync,
+  openSync,
+  closeSync,
+  fstatSync,
+  readFileSync,
+  realpathSync,
+  lstatSync,
+} from "node:fs";
+import { join, isAbsolute, dirname } from "node:path";
+import { createHash } from "node:crypto";
+import { required } from "./npm-update-contract.mjs";
+import { runProcess } from "./npm-update-process.mjs";
+
+/** Runtime calls consume the original absolute phase, including every identity readback. */
+export function runtimeTime(deadline, maximum = 10000) {
+  const remaining = deadline - Date.now();
+  required(
+    Number.isSafeInteger(deadline) && remaining > 0 && remaining <= 1800000,
+    "original runtime deadline is absent or expired"
+  );
+  return Math.min(remaining, maximum);
+}
+
+/** Initial qualification reads only an already bounded no-follow executable descriptor. */
+function toolSnapshot(file) {
+  required(
+    isAbsolute(file) && realpathSync(file) === file,
+    "native tool identity is aliased or absent"
+  );
+  const fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const st = fstatSync(fd);
+    required(
+      st.isFile() &&
+        st.nlink === 1 &&
+        (st.mode & 0o111) !== 0 &&
+        st.size <= 536870912,
+      "native tool identity is not a bounded executable"
+    );
+    const hash = createHash("sha256").update(readFileSync(fd)).digest("hex");
+    const current = lstatSync(file);
+    required(
+      current.dev === st.dev &&
+        current.ino === st.ino &&
+        !current.isSymbolicLink(),
+      "native tool identity changed"
+    );
+    return { dev: st.dev, ino: st.ino, uid: st.uid, sha256: hash };
+  } finally {
+    closeSync(fd);
+  }
+}
+
+/** An owned descriptor cannot authorize a symlink, shared inode, nonexecutable or substituted bytes. */
+export function toolIdentity(file, expected) {
+  required(
+    /^[a-f0-9]{64}$/.test(expected),
+    "native tool identity is aliased or absent"
+  );
+  const identity = toolSnapshot(file);
+  required(identity.sha256 === expected, "native tool identity changed");
+  return identity;
+}
+
+/** Private config is generated data only; no original auths, helper or credential store is inherited. */
+function dockerEnvironment(docker) {
+  const env = docker.env;
+  required(
+    env &&
+      Object.keys(env).sort().join(",") === "DOCKER_CONFIG,HOME,PATH" &&
+      isAbsolute(env.HOME) &&
+      env.PATH.split(":").every(isAbsolute) &&
+      env.DOCKER_CONFIG === join(env.HOME, "docker-config"),
+    "Docker environment differs"
+  );
+  for (const dir of [env.HOME, env.DOCKER_CONFIG]) {
+    const st = lstatSync(dir);
+    required(
+      realpathSync(dir) === dir &&
+        st.isDirectory() &&
+        st.uid === process.getuid() &&
+        (st.mode & 0o077) === 0,
+      "Docker configuration directory is not private owned storage"
+    );
+  }
+  const file = join(env.DOCKER_CONFIG, "config.json");
+  const fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const st = fstatSync(fd);
+    required(
+      st.isFile() &&
+        st.nlink === 1 &&
+        st.uid === process.getuid() &&
+        (st.mode & 0o077) === 0 &&
+        st.size <= 4096,
+      "Docker configuration is not private data"
+    );
+    const bytes = readFileSync(fd);
+    const config = JSON.parse(bytes.toString());
+    const dirs = docker.plugins ? [dirname(docker.plugins.compose.path)] : [];
+    required(
+      Object.keys(config).join(",") ===
+        (dirs.length ? "cliPluginsExtraDirs" : "") &&
+        JSON.stringify(config) ===
+          JSON.stringify(dirs.length ? { cliPluginsExtraDirs: dirs } : {}) &&
+        bytes.toString() === `${JSON.stringify(config)}\n`,
+      "Docker configuration differs"
+    );
+    if (docker.plugins) {
+      required(
+        Object.keys(docker.plugins).sort().join(",") === "buildx,compose" &&
+          dirname(docker.plugins.buildx.path) === dirs[0] &&
+          dirs[0] === join(env.HOME, "docker-plugins"),
+        "Docker plugin identity differs"
+      );
+      for (const plugin of Object.values(docker.plugins))
+        toolIdentity(plugin.path, plugin.sha256);
+    }
+  } finally {
+    closeSync(fd);
+  }
+  return env;
+}
+
+/** Native query errors never imply absence; daemon architecture is separate from the service platform. */
+export async function assertDockerQualified(docker, deadline) {
+  runtimeTime(deadline);
+  const env = dockerEnvironment(docker);
+  required(docker.version === "29.8.2", "unsupported native Docker identity");
+  const identity = toolIdentity(docker.path, docker.sha256);
+  const version = await runProcess(docker.path, ["--version"], {
+    env,
+    timeout: runtimeTime(deadline),
+    maximum: 4096,
+  });
+  required(
+    /^Docker version 29\.8\.2, build [a-z0-9]+\n$/.test(
+      version.stdout.toString()
+    ),
+    "native Docker version identity differs"
+  );
+  const result = await runProcess(
+    docker.path,
+    ["info", "--format", '{"ID":{{json .ID}},"OSType":{{json .OSType}}}'],
+    { env, timeout: runtimeTime(deadline), maximum: 4096 }
+  );
+  const value = JSON.parse(result.stdout.toString());
+  required(
+    Object.keys(value).sort().join(",") === "ID,OSType" &&
+      value.OSType === "linux" &&
+      typeof value.ID === "string" &&
+      value.ID.length > 0 &&
+      value.ID === docker.engineId,
+    "native Docker daemon identity differs"
+  );
+  const after = toolIdentity(docker.path, docker.sha256);
+  required(
+    identity.dev === after.dev &&
+      identity.ino === after.ino &&
+      identity.uid === after.uid,
+    "native Docker identity changed during observation"
+  );
+  return value;
+}
+
+export const SUPPORTED_RAILS_CLIENT = "1:10.11.14-0ubuntu0.24.04.1";
+/** Fixed Ubuntu archive versions supply browser libraries without ambient runner assumptions. */
+export const SUPPORTED_RAILS_BROWSER = Object.freeze([
+  "fonts-liberation=1:2.1.5-3",
+  "libasound2t64=1.2.11-1ubuntu0.3",
+  "libatk-bridge2.0-0t64=2.52.0-1build1",
+  "libatk1.0-0t64=2.52.0-1build1",
+  "libcairo2=1.18.0-3build1",
+  "libcups2t64=2.4.7-1.2ubuntu7.14",
+  "libdbus-1-3=1.14.10-4ubuntu4.1",
+  "libdrm2=2.4.125-1ubuntu0.1~24.04.2",
+  "libgbm1=25.2.8-0ubuntu0.24.04.4",
+  "libglib2.0-0t64=2.80.0-6ubuntu3.9",
+  "libnss3=2:3.98-1ubuntu0.2",
+  "libpango-1.0-0=1.52.1+ds-1build1",
+  "libx11-xcb1=2:1.8.7-1build1",
+  "libxcomposite1=1:0.4.5-1build3",
+  "libxdamage1=1:1.1.6-1build1",
+  "libxext6=2:1.3.4-1build2",
+  "libxfixes3=1:6.0.0-2build1",
+  "libxkbcommon0=1.6.0-1build1",
+  "libxrandr2=2:1.5.2-2build1",
+]);
+
+/** Original trusted PATH selects regular Ruby tools; their bytes are pinned around native version calls. */
+export async function qualifyRailsRuby(env, deadline) {
+  const output = {};
+  required(
+    typeof env.PATH === "string" && env.PATH.split(":").every(isAbsolute),
+    "Ruby tool environment path differs"
+  );
+  for (const [name, version] of [
+    ["ruby", "3.4.11"],
+    ["bundle", "2.4.10"],
+  ]) {
+    const path = env.PATH.split(":")
+      .map(dir => join(dir, name))
+      .find(existsSync);
+    required(typeof path === "string", "supported native Ruby tool is absent");
+    const before = toolSnapshot(path);
+    const sha256 = before.sha256;
+    const result = await runProcess(path, ["--version"], {
+      env,
+      timeout: runtimeTime(deadline),
+      maximum: 4096,
+    });
+    const text = result.stdout.toString();
+    required(
+      name === "ruby"
+        ? text.startsWith("ruby 3.4.11 ")
+        : text === "Bundler version 2.4.10\n",
+      "supported native Ruby/Bundler identity differs"
+    );
+    const after = toolIdentity(path, sha256);
+    required(
+      before.dev === after.dev &&
+        before.ino === after.ino &&
+        before.uid === after.uid,
+      "native Ruby tool changed during qualification"
+    );
+    output[name] = { path, sha256, version };
+  }
+  return output;
+}
+
+/** Signed Ubuntu packages qualify both native client and bounded header identities. */
+export async function qualifyRailsClient(step) {
+  const versions = await step("/usr/bin/dpkg-query", [
+    "-W",
+    "-f=${Package} ${Version}\n",
+    "libmariadb-dev",
+    "libmariadb-dev-compat",
+  ]);
+  required(
+    versions.stdout.toString() ===
+      `libmariadb-dev ${SUPPORTED_RAILS_CLIENT}\nlibmariadb-dev-compat ${SUPPORTED_RAILS_CLIENT}\n`,
+    "supported native client package version differs"
+  );
+  const verified = await step("/usr/bin/dpkg", [
+    "--verify",
+    "libmariadb-dev",
+    "libmariadb-dev-compat",
+  ]);
+  required(verified.stdout.length === 0, "native client package bytes differ");
+  const path = "/usr/bin/mariadb_config";
+  const sha256 = toolSnapshot(path).sha256;
+  const version = await step(path, ["--version"]);
+  required(
+    version.stdout.toString() === "10.11.14\n",
+    "supported native client identity differs"
+  );
+  const header = "/usr/include/mariadb/mysql.h";
+  const fd = openSync(header, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const st = fstatSync(fd);
+    required(
+      st.isFile() &&
+        st.nlink === 1 &&
+        st.uid === 0 &&
+        st.size <= 1048576 &&
+        realpathSync(header) === header,
+      "native client header identity differs"
+    );
+    const headerSha256 = createHash("sha256")
+      .update(readFileSync(fd))
+      .digest("hex");
+    return {
+      path,
+      sha256,
+      version: SUPPORTED_RAILS_CLIENT,
+      header,
+      headerSha256,
+    };
+  } finally {
+    closeSync(fd);
+  }
+}

package/all/copy-overwrite/scripts/lib/npm-update-rails-tools.mjs

@@ -0,0 +1,292 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Authenticated finite Rails profiles install only the fixed supported native prerequisites. */
+import {
+  chmodSync,
+  closeSync,
+  constants,
+  fstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  realpathSync,
+  writeFileSync,
+} from "node:fs";
+import { join, dirname } from "node:path";
+import { required } from "./npm-update-contract.mjs";
+import { canonicalJson } from "./automation-provenance-contract.mjs";
+import {
+  assertRuntimeBinding,
+  railsRuntime,
+} from "./npm-update-rails-runtime-contract.mjs";
+import {
+  downloadRailsTool,
+  extractRailsBrowser,
+  assertRailsArchive,
+  railsBrowserEnvironment,
+} from "./npm-update-rails-tool-downloads.mjs";
+import {
+  assertDockerQualified,
+  runtimeTime,
+  toolIdentity,
+  qualifyRailsClient,
+  qualifyRailsRuby,
+  SUPPORTED_RAILS_CLIENT,
+  SUPPORTED_RAILS_BROWSER,
+} from "./npm-update-rails-tool-identity.mjs";
+import { runProcess } from "./npm-update-process.mjs";
+
+export { assertDockerQualified, runtimeTime, toolIdentity };
+const CLIENT = SUPPORTED_RAILS_CLIENT;
+const BROWSER = "154.0.8037.92";
+const SUDO = "/usr/bin/sudo";
+const SNAPSHOT = "--snapshot=20261008T000000Z";
+
+/** Observe the actual supported OS; no caller-supplied platform can authorize installation. */
+function hostedPlatform() {
+  required(
+    process.platform === "linux" && process.arch === "x64",
+    "Rails tools require native Linux AMD64"
+  );
+  const os = readFileSync("/etc/os-release", "utf8");
+  required(
+    /^ID=ubuntu$/m.test(os) && /^VERSION_ID="24\.04"$/m.test(os),
+    "Rails tools require supported Ubuntu 24.04"
+  );
+}
+
+/** Fixed privileged package operations inherit only the original credential-free candidate keys. */
+function toolEnvironment(root, env) {
+  const allowed = new Set([
+    "PATH",
+    "HOME",
+    "LANG",
+    "LC_ALL",
+    "TZ",
+    "TMPDIR",
+    "NPM_CONFIG_USERCONFIG",
+    "NPM_CONFIG_GLOBALCONFIG",
+    "NPM_CONFIG_CACHE",
+    "NPM_CONFIG_REGISTRY",
+    "NPM_CONFIG_AUDIT",
+    "NPM_CONFIG_FUND",
+    "NPM_CONFIG_UPDATE_NOTIFIER",
+    "GIT_TERMINAL_PROMPT",
+    "GIT_AUTHOR_NAME",
+    "GIT_AUTHOR_EMAIL",
+    "GIT_COMMITTER_NAME",
+    "GIT_COMMITTER_EMAIL",
+    "GIT_AUTHOR_DATE",
+    "GIT_COMMITTER_DATE",
+  ]);
+  required(
+    Object.keys(env).every(name => allowed.has(name)) &&
+      env.HOME === root &&
+      typeof env.PATH === "string" &&
+      realpathSync(root) === root,
+    "Rails tool environment differs"
+  );
+  const fd = openSync(
+    root,
+    constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW
+  );
+  try {
+    const st = fstatSync(fd);
+    required(
+      st.isDirectory() &&
+        st.uid === process.getuid() &&
+        (st.mode & 0o077) === 0,
+      "Rails tool root is not private owned storage"
+    );
+  } finally {
+    closeSync(fd);
+  }
+  return { ...env, BUNDLER_VERSION: "2.4.10" };
+}
+
+async function plugins(root, step, deadline) {
+  const directory = join(root, "docker-plugins");
+  mkdirSync(directory, { mode: 0o700 });
+  const value = {};
+  for (const [name, version] of [
+    ["compose", "5.6.0"],
+    ["buildx", "0.38.0"],
+  ]) {
+    const archive = await downloadRailsTool(name, root, deadline);
+    const path = join(directory, `docker-${name}`);
+    writeFileSync(path, readFileSync(archive.file), {
+      flag: "wx",
+      mode: 0o700,
+    });
+    toolIdentity(path, archive.sha256);
+    const result = await step(path, ["version"]);
+    required(
+      result.stdout.toString().includes(`v${version}`),
+      "fixed Docker plugin version differs"
+    );
+    value[name] = { path, sha256: archive.sha256, version };
+  }
+  return value;
+}
+
+/** Pin the vendor SUID helper descriptor; sandbox and AppArmor policy remain enabled. */
+async function browser(root, step, deadline) {
+  const paths = {};
+  let sandboxHash;
+  for (const name of ["chrome", "chromedriver"]) {
+    const archive = await downloadRailsTool(name, root, deadline);
+    paths[name] = await extractRailsBrowser(name, archive.file, root, step);
+    toolIdentity(paths[name], archive.binary);
+    const version = await step(paths[name], ["--version"]);
+    required(
+      version.stdout.toString().includes(BROWSER),
+      "fixed native browser version differs"
+    );
+    if (name === "chrome") sandboxHash = archive.sandbox;
+  }
+  const sandbox = join(root, "chrome/chrome-linux64/chrome_sandbox");
+  toolIdentity(sandbox, sandboxHash);
+  const fd = openSync(sandbox, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const reference = `/proc/${process.pid}/fd/${fd}`;
+    await step(SUDO, ["-n", "/usr/bin/chown", "root:root", reference]);
+    await step(SUDO, ["-n", "/usr/bin/chmod", "4755", reference]);
+    const st = fstatSync(fd);
+    required(
+      st.uid === 0 && st.gid === 0 && (st.mode & 0o7777) === 0o4755,
+      "fixed native sandbox ownership differs"
+    );
+    toolIdentity(sandbox, sandboxHash);
+  } finally {
+    closeSync(fd);
+  }
+  return railsBrowserEnvironment(paths.chrome, paths.chromedriver, sandbox);
+}
+
+/** Fixed Docker bytes and private plugin-only config bind the actual Linux daemon. */
+async function prepareDocker(root, profile, step, deadline) {
+  const directory = join(root, "runtime-tools");
+  mkdirSync(directory, { mode: 0o700 });
+  const archive = await downloadRailsTool("docker", directory, deadline);
+  assertRailsArchive("docker", archive.file);
+  await step("/usr/bin/tar", [
+    "-xzf",
+    archive.file,
+    "--no-same-owner",
+    "--no-same-permissions",
+    "-C",
+    directory,
+    "docker/docker",
+  ]);
+  const path = join(directory, "docker/docker");
+  chmodSync(path, 0o700);
+  toolIdentity(path, archive.binary);
+  const pluginMap = profile.dockerFixtures
+    ? await plugins(root, step, deadline)
+    : undefined;
+  const config = join(root, "docker-config");
+  mkdirSync(config, { mode: 0o700 });
+  writeFileSync(
+    join(config, "config.json"),
+    `${JSON.stringify(pluginMap ? { cliPluginsExtraDirs: [join(root, "docker-plugins")] } : {})}\n`,
+    { flag: "wx", mode: 0o600 }
+  );
+  const dockerEnv = {
+    HOME: root,
+    PATH: "/usr/bin:/bin",
+    DOCKER_CONFIG: config,
+  };
+  const info = await runProcess(path, ["info", "--format", "{{json .ID}}"], {
+    env: dockerEnv,
+    timeout: runtimeTime(deadline),
+    maximum: 4096,
+  });
+  const docker = {
+    path,
+    sha256: archive.binary,
+    version: "29.8.2",
+    engineId: JSON.parse(info.stdout.toString()),
+    env: dockerEnv,
+    ...(pluginMap ? { plugins: pluginMap } : {}),
+  };
+  await assertDockerQualified(docker, deadline);
+  return docker;
+}
+
+/** One immutable signed Ubuntu snapshot retains the fixed roster when moving mirrors retire pins. */
+export async function installRailsPackages(step, browser) {
+  const libraries = browser ? SUPPORTED_RAILS_BROWSER : [];
+  await step(SUDO, ["-n", "/usr/bin/apt-get", SNAPSHOT, "update"]);
+  await step(SUDO, [
+    "-n",
+    "/usr/bin/apt-get",
+    SNAPSHOT,
+    "install",
+    "--yes",
+    "--no-install-recommends",
+    `libmariadb-dev=${CLIENT}`,
+    `libmariadb-dev-compat=${CLIENT}`,
+    ...libraries,
+  ]);
+  return libraries;
+}
+
+/** Caller authentication precedes this fixed route; signed policy is rechecked before all side effects. */
+export async function prepareRailsTools(context, root, env, profile) {
+  assertRuntimeBinding(context.proposal, context.policy);
+  required(
+    canonicalJson(railsRuntime(context.policy)) === canonicalJson(profile),
+    "original runtime profile differs"
+  );
+  hostedPlatform();
+  const environment = toolEnvironment(root, env);
+  const step = (command, args, maximum = 3145728) =>
+    runProcess(command, args, {
+      cwd: context.cwd,
+      env: environment,
+      timeout: runtimeTime(context.deadline, 1800000),
+      maximum,
+    });
+  const ruby = await qualifyRailsRuby(environment, context.deadline);
+  const libraries = await installRailsPackages(step, profile.browser);
+  const client = await qualifyRailsClient(step);
+  for (const library of libraries) {
+    const [name, expected] = library.split("=");
+    const version = await step("/usr/bin/dpkg-query", [
+      "-W",
+      "-f=${Version}\n",
+      name,
+    ]);
+    required(
+      version.stdout.toString() === `${expected}\n`,
+      "native browser library version differs"
+    );
+  }
+  if (libraries.length) {
+    const verified = await step("/usr/bin/dpkg", [
+      "--verify",
+      ...libraries.map(value => value.split("=")[0]),
+    ]);
+    required(
+      verified.stdout.length === 0,
+      "native browser library bytes differ"
+    );
+  }
+  const docker = await prepareDocker(root, profile, step, context.deadline);
+  const chrome = profile.browser
+    ? await browser(root, step, context.deadline)
+    : {};
+  return {
+    docker,
+    client,
+    ruby,
+    env: {
+      ...environment,
+      ...chrome,
+      PATH: `${dirname(docker.path)}:${dirname(ruby.ruby.path)}:${dirname(ruby.bundle.path)}:${environment.PATH}`,
+      DOCKER_CONFIG: docker.env.DOCKER_CONFIG,
+      BUNDLE_BUILD__MYSQL2: "--with-mysql-config=/usr/bin/mariadb_config",
+    },
+  };
+}

package/all/copy-overwrite/scripts/lisa-automation-provenance.mjs

@@ -18,6 +18,7 @@ import {
   canonicalJson,
   trustedConfiguration,
   npmProposal,
+  signedProposalFields,
 } from "./lib/automation-provenance-contract.mjs";
 import {
   git,
@@ -72,6 +73,7 @@ function recoveryPermission(
         parent: descriptor.parent,
         policySha256: npmPolicySha256,
         updates: descriptor.updates,
+        ...signedProposalFields(descriptor),
       })
     ),
     leafBodySha256: sha256(context.issue.body),
@@ -103,6 +105,7 @@ export function verifyAutomationProvenance(messageFile) {
           repository: policy.repository,
           parent: descriptor.parent,
           updates: descriptor.updates,
+          ...signedProposalFields(descriptor),
         })
       ),
     "deterministic proposal key differs"

package/all/copy-overwrite/scripts/lisa-hooks/parity-safety-net.sh

@@ -534,7 +534,7 @@ followed_text=""
 followed_rm_text=""
 # Generated from the canonical reviewed supervisor, never from a host manifest.
 # Regenerate through scripts/generate-scratch-supervisor-profile.mjs.
-readonly SCRATCH_SUPERVISOR_SHA256='6fdec1ad0441d7636dc6749c44a23167baf7b75004f156b8a7d4ce1c18c790b7'
+readonly SCRATCH_SUPERVISOR_SHA256='76ccf8ca6f98b214361f02ebf6ad58041129b76ed29128455e810095db6c292f'
 readonly SCRATCH_SUPERVISOR_CLEANUP_COUNT='7'
 
 # An authenticated public supervisor owns its fixed cleanup sites. Its original

package/all/copy-overwrite/scripts/lisa-scratch-run.sh

@@ -223,14 +223,17 @@ lisa_marker_get() {
   _key="$2"
   [ -f "$_file" ] || return 1
   if [ -L "$_file" ]; then return 1; fi
-  _bytes="$(wc -c <"$_file" 2>/dev/null | tr -d ' ')" || return 1
-  [ -n "$_bytes" ] || return 1
+  # Cleanup may remove this invocation's marker between native reads. A
+  # failed open remains a refusal, without leaking shell pathname diagnostics.
+  _bytes="$(wc -c 2>/dev/null <"$_file" | tr -d ' ')" || return 1
+  case "$_bytes" in "" | *[!0-9]*) return 1 ;; esac
   [ "$_bytes" -le "$LISA_SCRATCH_MARKER_MAX_BYTES" ] || return 1
-  _lines="$(wc -l <"$_file" 2>/dev/null | tr -d ' ')" || return 1
+  _lines="$(wc -l 2>/dev/null <"$_file" | tr -d ' ')" || return 1
+  case "$_lines" in "" | *[!0-9]*) return 1 ;; esac
   [ "$_lines" -le "$LISA_SCRATCH_MARKER_MAX_LINES" ] || return 1
   _hits="$(grep -c "^${_key}=" "$_file" 2>/dev/null || true)"
   [ "$_hits" = "1" ] || return 1
-  sed -n "s/^${_key}=//p" "$_file"
+  sed -n "s/^${_key}=//p" "$_file" 2>/dev/null
 }
 
 # --- path safety -------------------------------------------------------------