@cuongtran001/kanna 1.63.2 → 1.63.3

package/src/server/claude-pty/sandbox/preflight.test.ts

@@ -1,69 +0,0 @@
-import { describe, expect, test } from "bun:test"
-import { mkdtemp, rm, writeFile, mkdir } from "node:fs/promises"
-import { tmpdir } from "node:os"
-import path from "node:path"
-import { runSandboxPreflight } from "./preflight"
-import { POLICY_DEFAULT } from "../../../shared/permission-policy"
-
-describe("runSandboxPreflight (cross-platform)", () => {
-  test("macOS: ok when sentinel denied", async () => {
-    if (process.platform !== "darwin") return
-    const home = await mkdtemp(path.join(tmpdir(), "kanna-sb-pf-mac-"))
-    const runtimeDir = await mkdtemp(path.join(tmpdir(), "kanna-sb-pf-runtime-"))
-    try {
-      await mkdir(path.join(home, ".ssh"), { recursive: true })
-      await writeFile(path.join(home, ".ssh", "id_rsa"), "SECRET", "utf8")
-      const policy = { ...POLICY_DEFAULT, readPathDeny: [`${home}/.ssh`] }
-      const result = await runSandboxPreflight({
-        platform: "darwin",
-        enabled: true,
-        policy,
-        homeDir: home,
-        runtimeDir,
-        sentinelPath: `${home}/.ssh/id_rsa`,
-      })
-      expect(result.ok).toBe(true)
-    } finally {
-      await rm(home, { recursive: true, force: true })
-      await rm(runtimeDir, { recursive: true, force: true })
-    }
-  }, 30_000)
-
-  test("linux: ok when sentinel denied via bwrap tmpfs", async () => {
-    if (process.platform !== "linux") return
-    const home = await mkdtemp(path.join(tmpdir(), "kanna-sb-pf-lin-"))
-    const runtimeDir = await mkdtemp(path.join(tmpdir(), "kanna-sb-pf-runtime-"))
-    try {
-      await mkdir(path.join(home, ".ssh"), { recursive: true })
-      await writeFile(path.join(home, ".ssh", "id_rsa"), "SECRET", "utf8")
-      const policy = { ...POLICY_DEFAULT, readPathDeny: [`${home}/.ssh`] }
-      const result = await runSandboxPreflight({
-        platform: "linux",
-        enabled: true,
-        policy,
-        homeDir: home,
-        runtimeDir,
-        sentinelPath: `${home}/.ssh/id_rsa`,
-      })
-      expect(result.ok).toBe(true)
-    } finally {
-      await rm(home, { recursive: true, force: true })
-      await rm(runtimeDir, { recursive: true, force: true })
-    }
-  }, 30_000)
-
-  test("returns ok on unsupported platform", async () => {
-    const runtimeDir = await mkdtemp(path.join(tmpdir(), "kanna-sb-pf-win-"))
-    try {
-      const result = await runSandboxPreflight({
-        platform: "win32",
-        enabled: true,
-        policy: POLICY_DEFAULT,
-        homeDir: "/tmp",
-        runtimeDir,
-        sentinelPath: "/tmp/x",
-      })
-      expect(result.ok).toBe(true)
-    } finally { await rm(runtimeDir, { recursive: true, force: true }) }
-  })
-})

package/src/server/claude-pty/sandbox/preflight.ts

@@ -1,44 +0,0 @@
-import path from "node:path"
-import type { ChatPermissionPolicy } from "../../../shared/permission-policy"
-import { spawnExitCode, writeTextFile } from "./preflight-io.adapter"
-import { generateMacosProfile } from "./profile-macos.adapter"
-import { generateBwrapArgs } from "./profile-linux.adapter"
-
-export interface SandboxPreflightArgs {
-  platform: NodeJS.Platform
-  enabled: boolean
-  policy: ChatPermissionPolicy
-  homeDir: string
-  runtimeDir: string
-  sentinelPath: string
-}
-
-export type SandboxPreflightResult =
-  | { ok: true }
-  | { ok: false; reason: string }
-
-export async function runSandboxPreflight(args: SandboxPreflightArgs): Promise<SandboxPreflightResult> {
-  if (!args.enabled) return { ok: true }
-
-  if (args.platform === "darwin") {
-    const profileBody = generateMacosProfile({ policy: args.policy, homeDir: args.homeDir })
-    const profilePath = path.join(args.runtimeDir, "preflight.sb")
-    await writeTextFile(profilePath, profileBody)
-    const code = await spawnExitCode("/usr/bin/sandbox-exec", ["-f", profilePath, "/bin/cat", args.sentinelPath])
-    if (code === 0) {
-      return { ok: false, reason: `sentinel readable under sandbox: ${args.sentinelPath}` }
-    }
-    return { ok: true }
-  }
-
-  if (args.platform === "linux") {
-    const { argv } = generateBwrapArgs({ policy: args.policy, homeDir: args.homeDir })
-    const code = await spawnExitCode("/usr/bin/bwrap", [...argv, "/bin/cat", args.sentinelPath])
-    if (code === 0) {
-      return { ok: false, reason: `sentinel readable under bwrap: ${args.sentinelPath}` }
-    }
-    return { ok: true }
-  }
-
-  return { ok: true }
-}

package/src/server/claude-pty/sandbox/profile-linux.adapter.ts

@@ -1,63 +0,0 @@
-import path from "node:path"
-import { realpathSync } from "node:fs"
-import type { ChatPermissionPolicy } from "../../../shared/permission-policy"
-
-function expandTilde(p: string, homeDir: string): string {
-  if (!p.startsWith("~")) return p
-  return path.join(homeDir, p.slice(1).replace(/^\//, ""))
-}
-
-function resolveReal(p: string): string {
-  try {
-    return realpathSync(p)
-  } catch {
-    const parent = path.dirname(p)
-    if (parent === p) return p
-    try {
-      return path.join(realpathSync(parent), path.basename(p))
-    } catch {
-      return p
-    }
-  }
-}
-
-export interface BwrapArgsResult {
-  argv: string[]
-  unmountableGlobs: string[]
-}
-
-function classify(raw: string): { kind: "path"; value: string } | { kind: "glob" } {
-  if (raw.endsWith("/**")) return { kind: "path", value: raw.slice(0, -3) }
-  if (raw.includes("*")) return { kind: "glob" }
-  return { kind: "path", value: raw }
-}
-
-export function generateBwrapArgs(args: {
-  policy: ChatPermissionPolicy
-  homeDir: string
-}): BwrapArgsResult {
-  const deny = new Set<string>()
-  const unmountableGlobs = new Set<string>()
-
-  const consume = (raw: string) => {
-    const c = classify(raw)
-    if (c.kind === "glob") {
-      unmountableGlobs.add(raw)
-      return
-    }
-    deny.add(resolveReal(expandTilde(c.value, args.homeDir)))
-  }
-  for (const raw of args.policy.readPathDeny) consume(raw)
-  for (const raw of args.policy.writePathDeny) consume(raw)
-
-  const argv: string[] = [
-    "--bind", "/", "/",
-    "--dev", "/dev",
-    "--proc", "/proc",
-    "--die-with-parent",
-  ]
-  for (const p of deny) {
-    argv.push("--tmpfs", p)
-  }
-  return { argv, unmountableGlobs: [...unmountableGlobs] }
-}

package/src/server/claude-pty/sandbox/profile-linux.test.ts

@@ -1,90 +0,0 @@
-import { describe, expect, test } from "bun:test"
-import { mkdtempSync, symlinkSync, mkdirSync, realpathSync } from "node:fs"
-import { tmpdir } from "node:os"
-import path from "node:path"
-import { generateBwrapArgs } from "./profile-linux.adapter"
-
-function r(p: string): string {
-  try {
-    return realpathSync(p)
-  } catch {
-    try {
-      return path.join(realpathSync(path.dirname(p)), path.basename(p))
-    } catch {
-      return p
-    }
-  }
-}
-
-const POLICY = {
-  defaultAction: "ask" as const,
-  bash: { autoAllowVerbs: [] },
-  readPathDeny: ["~/.ssh", "/etc/shadow"],
-  writePathDeny: ["/etc/**"],
-  toolDenyList: [],
-  toolAllowList: [],
-}
-
-function tmpfsTargets(argv: string[]): string[] {
-  const out: string[] = []
-  for (let i = 0; i < argv.length; i++) {
-    if (argv[i] === "--tmpfs") out.push(argv[i + 1])
-  }
-  return out
-}
-
-describe("generateBwrapArgs", () => {
-  test("emits base --bind / / and --die-with-parent", () => {
-    const { argv } = generateBwrapArgs({ policy: POLICY, homeDir: "/home/u" })
-    expect(argv).toContain("--bind")
-    expect(argv).toContain("--die-with-parent")
-  })
-
-  test("emits --tmpfs for each non-glob deny entry (tilde expanded, symlink-resolved)", () => {
-    const { argv } = generateBwrapArgs({ policy: POLICY, homeDir: "/home/u" })
-    const targets = tmpfsTargets(argv)
-    expect(targets).toContain(r("/home/u/.ssh"))
-    expect(targets).toContain(r("/etc/shadow"))
-  })
-
-  test("strips /** suffix to the directory path", () => {
-    const { argv } = generateBwrapArgs({ policy: POLICY, homeDir: "/home/u" })
-    expect(tmpfsTargets(argv)).toContain(r("/etc"))
-  })
-
-  test("glob patterns surface in unmountableGlobs, never as a --tmpfs arg", () => {
-    const { argv, unmountableGlobs } = generateBwrapArgs({
-      policy: { ...POLICY, readPathDeny: ["**/.env", "**/*.pem", "~/.ssh"] },
-      homeDir: "/home/u",
-    })
-    expect(unmountableGlobs).toContain("**/.env")
-    expect(unmountableGlobs).toContain("**/*.pem")
-    expect(tmpfsTargets(argv)).toContain(r("/home/u/.ssh"))
-    expect(tmpfsTargets(argv).some((t) => t.includes("*"))).toBe(false)
-  })
-
-  test("resolves a symlinked homeDir to its real target (no symlink bypass)", () => {
-    const root = mkdtempSync(path.join(tmpdir(), "kanna-bwrap-sym-"))
-    const realHome = path.join(root, "real-home")
-    mkdirSync(path.join(realHome, ".ssh"), { recursive: true })
-    const linkHome = path.join(root, "link-home")
-    symlinkSync(realHome, linkHome)
-
-    const { argv } = generateBwrapArgs({
-      policy: { ...POLICY, readPathDeny: ["~/.ssh"], writePathDeny: [] },
-      homeDir: linkHome,
-    })
-    const targets = tmpfsTargets(argv)
-    expect(targets).toContain(path.join(realpathSync(realHome), ".ssh"))
-    expect(targets).not.toContain(path.join(linkHome, ".ssh"))
-  })
-
-  test("non-existent deny path falls back to walk-up real prefix (never throws)", () => {
-    const root = mkdtempSync(path.join(tmpdir(), "kanna-bwrap-ne-"))
-    const { argv } = generateBwrapArgs({
-      policy: { ...POLICY, readPathDeny: [path.join(root, "nope", "creds")], writePathDeny: [] },
-      homeDir: root,
-    })
-    expect(tmpfsTargets(argv).length).toBeGreaterThanOrEqual(1)
-  })
-})

package/src/server/claude-pty/sandbox/profile-macos.adapter.ts

@@ -1,72 +0,0 @@
-import path from "node:path"
-import { realpathSync } from "node:fs"
-import type { ChatPermissionPolicy } from "../../../shared/permission-policy"
-
-function expandTilde(p: string, homeDir: string): string {
-  if (!p.startsWith("~")) return p
-  return path.join(homeDir, p.slice(1).replace(/^\//, ""))
-}
-
-function resolveReal(p: string): string {
-  try {
-    return realpathSync(p)
-  } catch {
-    const parent = path.dirname(p)
-    if (parent === p) return p
-    try {
-      return path.join(realpathSync(parent), path.basename(p))
-    } catch {
-      return p
-    }
-  }
-}
-
-function escapeForScheme(s: string): string {
-  return s
-    .replace(/[\x00-\x1f\x7f]/g, "")
-    .replace(/\\/g, "\\\\")
-    .replace(/"/g, '\\"')
-}
-
-function denyEntry(action: string, raw: string, homeDir: string): string {
-  if (raw.endsWith("/**")) {
-    const base = resolveReal(expandTilde(raw.slice(0, -3), homeDir))
-    return `(deny ${action} (subpath "${escapeForScheme(base)}"))`
-  }
-
-  const expanded = expandTilde(raw, homeDir)
-
-  if (expanded.includes("*")) {
-    return `(deny ${action} (literal "${escapeForScheme(expanded)}"))`
-  }
-
-  const resolved = resolveReal(expanded)
-  const escaped = escapeForScheme(resolved)
-
-  if (raw.startsWith("~")) {
-    return `(deny ${action} (subpath "${escaped}"))`
-  }
-
-  const basename = path.basename(resolved)
-  if (basename.startsWith(".")) {
-    return `(deny ${action} (subpath "${escaped}"))`
-  }
-  return `(deny ${action} (literal "${escaped}"))`
-}
-
-export function generateMacosProfile(args: {
-  policy: ChatPermissionPolicy
-  homeDir: string
-}): string {
-  const readDenies = args.policy.readPathDeny.map((p) => denyEntry("file-read*", p, args.homeDir))
-  const writeDenies = args.policy.writePathDeny.map((p) => denyEntry("file-write*", p, args.homeDir))
-
-  const lines = [
-    "(version 1)",
-    "(allow default)",
-    ";; Kanna-generated profile for claude PTY",
-    ...readDenies,
-    ...writeDenies,
-  ]
-  return lines.join("\n")
-}

package/src/server/claude-pty/sandbox/profile-macos.test.ts

@@ -1,68 +0,0 @@
-import { describe, expect, test } from "bun:test"
-import { realpathSync } from "node:fs"
-import path from "node:path"
-import { generateMacosProfile } from "./profile-macos.adapter"
-
-function r(p: string): string {
-  try { return realpathSync(p) } catch { }
-  try { return path.join(realpathSync(path.dirname(p)), path.basename(p)) } catch { return p }
-}
-
-const POLICY = {
-  defaultAction: "ask" as const,
-  bash: { autoAllowVerbs: [] },
-  readPathDeny: ["~/.ssh", "~/.aws", "/etc/shadow"],
-  writePathDeny: ["/etc/**", "~/.ssh/**"],
-  toolDenyList: [],
-  toolAllowList: [],
-}
-
-describe("generateMacosProfile", () => {
-  test("emits version + default-allow + deny entries for readPathDeny", () => {
-    const profile = generateMacosProfile({ policy: POLICY, homeDir: "/Users/u" })
-    expect(profile).toContain("(version 1)")
-    expect(profile).toContain(`(deny file-read* (subpath "/Users/u/.ssh"))`)
-    expect(profile).toContain(`(deny file-read* (subpath "/Users/u/.aws"))`)
-    expect(profile).toContain(`(deny file-read* (literal "${r("/etc/shadow")}"))`)
-  })
-
-  test("emits writePathDeny entries as file-write* denies", () => {
-    const profile = generateMacosProfile({ policy: POLICY, homeDir: "/Users/u" })
-    expect(profile).toContain(`file-write* (subpath "${r("/etc")}")`)
-    expect(profile).toContain(`file-write* (subpath "/Users/u/.ssh")`)
-  })
-
-  test("escapes quotes in paths defensively", () => {
-    const profile = generateMacosProfile({
-      policy: { ...POLICY, readPathDeny: ['/tmp/with"quote'] },
-      homeDir: "/Users/u",
-    })
-    const match = profile.match(/subpath "[^"]*"/g) ?? profile.match(/literal "[^"]*"/g)
-    expect(match).not.toBeNull()
-  })
-
-  test("strips control chars (newline/CR/tab) so a crafted path cannot inject profile clauses", () => {
-    const profile = generateMacosProfile({
-      policy: {
-        ...POLICY,
-        readPathDeny: ['/tmp/evil\n(allow file-read* (subpath "/"))'],
-        writePathDeny: [],
-      },
-      homeDir: "/Users/u",
-    })
-    const denyLines = profile.split("\n").filter((l) => l.startsWith("(deny"))
-    expect(denyLines).toHaveLength(1)
-    expect(profile.split("\n")).not.toContain(`(allow file-read* (subpath "/"))`)
-    expect(denyLines[0]).toContain('\\"/\\"')
-    expect(/[\x00-\x08\x0b\x0c\x0e-\x1f]/.test(profile)).toBe(false)
-  })
-
-  test("skips empty deny lists", () => {
-    const empty = generateMacosProfile({
-      policy: { ...POLICY, readPathDeny: [], writePathDeny: [] },
-      homeDir: "/Users/u",
-    })
-    expect(empty).toContain("(version 1)")
-    expect(empty).not.toContain("file-read*")
-  })
-})

package/src/server/claude-pty/sandbox/wrap.adapter.ts

@@ -1,58 +0,0 @@
-import path from "node:path"
-import { writeFile } from "node:fs/promises"
-import type { ChatPermissionPolicy } from "../../../shared/permission-policy"
-import { generateMacosProfile } from "./profile-macos.adapter"
-import { generateBwrapArgs } from "./profile-linux.adapter"
-import { log } from "../../../shared/log"
-
-const SANDBOX_EXEC = "/usr/bin/sandbox-exec"
-const BWRAP = "/usr/bin/bwrap"
-
-export interface WrapArgs {
-  platform: NodeJS.Platform
-  enabled: boolean
-  policy: ChatPermissionPolicy
-  homeDir: string
-  runtimeDir: string
-  command: string
-  args: string[]
-}
-
-export interface WrapResult {
-  command: string
-  args: string[]
-}
-
-export async function wrapWithSandbox(opts: WrapArgs): Promise<WrapResult> {
-  if (!opts.enabled) {
-    return { command: opts.command, args: opts.args }
-  }
-  if (opts.platform === "darwin") {
-    const profileBody = generateMacosProfile({ policy: opts.policy, homeDir: opts.homeDir })
-    const profilePath = path.join(opts.runtimeDir, "claude-sandbox.sb")
-    await writeFile(profilePath, profileBody, "utf8")
-    return {
-      command: SANDBOX_EXEC,
-      args: ["-f", profilePath, opts.command, ...opts.args],
-    }
-  }
-  if (opts.platform === "linux") {
-    const { argv, unmountableGlobs } = generateBwrapArgs({
-      policy: opts.policy,
-      homeDir: opts.homeDir,
-    })
-    if (unmountableGlobs.length > 0) {
-      log.warn(
-        "[claude-pty/sandbox] bwrap cannot tmpfs glob deny patterns "
-        + `(${unmountableGlobs.join(", ")}); these are enforced by the `
-        + "kanna-mcp tool-callback layer (permission-gate minimatch), not "
-        + "the OS sandbox. Literal credential dirs remain tmpfs-protected.",
-      )
-    }
-    return {
-      command: BWRAP,
-      args: [...argv, opts.command, ...opts.args],
-    }
-  }
-  return { command: opts.command, args: opts.args }
-}

package/src/server/claude-pty/sandbox/wrap.test.ts

@@ -1,82 +0,0 @@
-import { describe, expect, test } from "bun:test"
-import { mkdtemp, rm, readFile } from "node:fs/promises"
-import { tmpdir } from "node:os"
-import path from "node:path"
-import { wrapWithSandbox } from "./wrap.adapter"
-import { POLICY_DEFAULT } from "../../../shared/permission-policy"
-
-describe("wrapWithSandbox (async dispatch)", () => {
-  test("darwin enabled → prepends sandbox-exec and writes profile", async () => {
-    if (process.platform !== "darwin") return
-    const runtimeDir = await mkdtemp(path.join(tmpdir(), "kanna-wrap-"))
-    try {
-      const result = await wrapWithSandbox({
-        platform: "darwin",
-        enabled: true,
-        policy: POLICY_DEFAULT,
-        homeDir: "/Users/u",
-        runtimeDir,
-        command: "/usr/local/bin/claude",
-        args: ["--model", "x"],
-      })
-      expect(result.command).toBe("/usr/bin/sandbox-exec")
-      expect(result.args[0]).toBe("-f")
-      const profile = await readFile(result.args[1], "utf8")
-      expect(profile).toContain("(version 1)")
-    } finally { await rm(runtimeDir, { recursive: true, force: true }) }
-  })
-
-  test("linux enabled → prepends bwrap argv", async () => {
-    if (process.platform !== "linux") return
-    const runtimeDir = await mkdtemp(path.join(tmpdir(), "kanna-wrap-"))
-    try {
-      const result = await wrapWithSandbox({
-        platform: "linux",
-        enabled: true,
-        policy: POLICY_DEFAULT,
-        homeDir: "/home/u",
-        runtimeDir,
-        command: "/usr/local/bin/claude",
-        args: ["--model", "x"],
-      })
-      expect(result.command).toBe("/usr/bin/bwrap")
-      expect(result.args).toContain("--bind")
-      expect(result.args).toContain("--die-with-parent")
-      expect(result.args).toContain("/usr/local/bin/claude")
-      expect(result.args).toContain("--model")
-    } finally { await rm(runtimeDir, { recursive: true, force: true }) }
-  })
-
-  test("disabled → pass through", async () => {
-    const runtimeDir = await mkdtemp(path.join(tmpdir(), "kanna-wrap-"))
-    try {
-      const result = await wrapWithSandbox({
-        platform: "darwin",
-        enabled: false,
-        policy: POLICY_DEFAULT,
-        homeDir: "/Users/u",
-        runtimeDir,
-        command: "/usr/local/bin/claude",
-        args: ["--model", "x"],
-      })
-      expect(result.command).toBe("/usr/local/bin/claude")
-      expect(result.args).toEqual(["--model", "x"])
-    } finally { await rm(runtimeDir, { recursive: true, force: true }) }
-  })
-
-  test("unsupported platform → pass through", async () => {
-    const runtimeDir = await mkdtemp(path.join(tmpdir(), "kanna-wrap-"))
-    try {
-      const result = await wrapWithSandbox({
-        platform: "win32",
-        enabled: true,
-        policy: POLICY_DEFAULT,
-        homeDir: "/Users/u",
-        runtimeDir,
-        command: "claude.exe",
-        args: ["--model", "x"],
-      })
-      expect(result.command).toBe("claude.exe")
-    } finally { await rm(runtimeDir, { recursive: true, force: true }) }
-  })
-})

package/src/server/claude-pty/settings-writer.adapter.ts

@@ -1,23 +0,0 @@
-import { mkdir, writeFile } from "node:fs/promises"
-import path from "node:path"
-
-export interface WriteSpawnSettingsResult {
-  settingsPath: string
-}
-
-export async function writeSpawnSettings(args: {
-  runtimeDir: string
-}): Promise<WriteSpawnSettingsResult> {
-  await mkdir(args.runtimeDir, { recursive: true, mode: 0o700 })
-  const settingsPath = path.join(args.runtimeDir, "settings.local.json")
-  const body = {
-    spinnerTipsEnabled: false,
-    showTurnDuration: false,
-    syntaxHighlightingDisabled: true,
-    permissions: {
-      allow: ["mcp__kanna__*"],
-    },
-  }
-  await writeFile(settingsPath, JSON.stringify(body, null, 2), { encoding: "utf8", mode: 0o600 })
-  return { settingsPath }
-}

package/src/server/claude-pty/settings-writer.test.ts

@@ -1,22 +0,0 @@
-import { describe, expect, test } from "bun:test"
-import { mkdtemp, rm, readFile } from "node:fs/promises"
-import { tmpdir } from "node:os"
-import path from "node:path"
-import { writeSpawnSettings } from "./settings-writer.adapter"
-
-describe("writeSpawnSettings", () => {
-  test("writes per-spawn settings with claimed keys", async () => {
-    const dir = await mkdtemp(path.join(tmpdir(), "kanna-settings-"))
-    try {
-      const result = await writeSpawnSettings({ runtimeDir: dir })
-      expect(result.settingsPath.startsWith(dir)).toBe(true)
-      const raw = await readFile(result.settingsPath, "utf8")
-      const parsed = JSON.parse(raw)
-      expect(parsed.spinnerTipsEnabled).toBe(false)
-      expect(parsed.showTurnDuration).toBe(false)
-      expect(parsed.permissions?.allow).toContain("mcp__kanna__*")
-    } finally {
-      await rm(dir, { recursive: true, force: true })
-    }
-  })
-})

package/src/server/claude-pty/smoke-test-io.adapter.ts

@@ -1,28 +0,0 @@
-import { mkdir, mkdtemp, readFile, writeFile, rm } from "node:fs/promises"
-import { existsSync } from "node:fs"
-import path from "node:path"
-import { tmpdir } from "node:os"
-
-export function makeTempCwd(prefix: string): Promise<string> {
-  return mkdtemp(path.join(tmpdir(), prefix))
-}
-
-export function readTextFile(p: string): Promise<string> {
-  return readFile(p, "utf8")
-}
-
-export async function rmDirRecursive(p: string): Promise<void> {
-  await rm(p, { recursive: true, force: true })
-}
-
-export function fileExists(p: string): boolean {
-  return existsSync(p)
-}
-
-export async function mkdirRecursive(p: string): Promise<void> {
-  await mkdir(p, { recursive: true })
-}
-
-export async function writeFile0600(p: string, contents: string): Promise<void> {
-  await writeFile(p, contents, { encoding: "utf8", mode: 0o600 })
-}