@enterpriseai/cli 3.19.0 → 3.19.1

package/resources/gofer/node-scripts/gofer-trust-bootstrap.mjs

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+/** Prepare the local capability identity without granting it runtime authority. */
+import { execFileSync } from 'node:child_process';
+import { generateKeyPairSync, randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { lstat, mkdir, open, realpath } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const denied = () => new Error('LOCAL_TRUST_SETUP_REQUIRES_REVIEW');
+
+function accountHome() {
+  if (typeof process.getuid !== 'function') throw denied();
+  if (process.platform === 'darwin') {
+    const name = execFileSync('/usr/bin/id', ['-un'], { encoding: 'utf8', timeout: 3000 }).trim();
+    if (!/^[a-zA-Z0-9._-]+$/.test(name)) throw denied();
+    const record = execFileSync('/usr/bin/dscl', ['.', '-read', path.join(path.sep, 'Users', name), 'NFSHomeDirectory'],
+      { encoding: 'utf8', timeout: 3000 }).trim();
+    return /^NFSHomeDirectory: (\/[^\n]+)$/.exec(record)?.[1] ?? null;
+  }
+  if (process.platform === 'linux') {
+    const record = execFileSync('/usr/bin/getent', ['passwd', String(process.getuid())],
+      { encoding: 'utf8', timeout: 3000 }).trim().split(':');
+    return record.length === 7 && record[2] === String(process.getuid()) ? record[5] : null;
+  }
+  throw denied();
+}
+
+async function writeExclusive(filename, value) {
+  const file = await open(filename, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+  try { await file.writeFile(value, 'utf8'); }
+  finally { await file.close(); }
+}
+
+/** Used by trusted setup only. Existing material is never replaced or activated. */
+export async function initializeStagedTrust(root) {
+  if (!path.isAbsolute(root)) throw denied();
+  const parent = await realpath(path.dirname(root));
+  const parentInfo = await lstat(parent);
+  if (!parentInfo.isDirectory() || ![0, process.getuid()].includes(parentInfo.uid) ||
+      (parentInfo.mode & 0o022) !== 0 || parent !== path.dirname(root)) throw denied();
+  await mkdir(root, { mode: 0o700 });
+  const rootInfo = await lstat(root);
+  if (!rootInfo.isDirectory() || rootInfo.uid !== process.getuid() ||
+      (rootInfo.mode & 0o077) !== 0) throw denied();
+  const staged = path.join(root, 'staged-keys');
+  await mkdir(staged, { mode: 0o700 });
+  // The benchmark verifier key is not staged here. A worker sandbox can read
+  // the account home, so a plaintext verifier key would be forgeable. It is
+  // created, encrypted, by the human-run gofer-verifier-key-ceremony.mjs.
+  const identities = [
+    { name: 'capability-evaluator', host: 'codex', evaluator: 'gofer-native-host-evaluator' },
+  ];
+  const records = [];
+  for (const identity of identities) {
+    const pair = generateKeyPairSync('ed25519');
+    const keyId = `${identity.name}-${randomUUID()}`;
+    await writeExclusive(path.join(staged, `${identity.name}.private.pem`),
+      pair.privateKey.export({ type: 'pkcs8', format: 'pem' }));
+    await writeExclusive(path.join(staged, `${identity.name}.public.pem`),
+      pair.publicKey.export({ type: 'spki', format: 'pem' }));
+    records.push({ ...identity, keyId });
+  }
+  await writeExclusive(path.join(root, 'trusted-evaluators.json'),
+    `${JSON.stringify({ schemaVersion: 1, evaluators: [] }, null, 2)}\n`);
+  await writeExclusive(path.join(staged, 'identities.json'), `${JSON.stringify(records, null, 2)}\n`);
+  return { root, identities: records.map(({ name, keyId }) => ({ name, keyId })), active: false };
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])) {
+  if (process.argv.length !== 2) throw denied();
+  const home = accountHome();
+  if (!home || !path.isAbsolute(home)) throw denied();
+  initializeStagedTrust(path.join(home, '.eai-gofer-trust'))
+    .then(result => process.stdout.write(`${JSON.stringify(result)}\n`))
+    .catch(error => { process.stderr.write(`${error.message}\n`); process.exitCode = 1; });
+}

package/resources/gofer/node-scripts/gofer-trusted-benchmark.mjs

@@ -0,0 +1,102 @@
+/** Authenticate a held-out benchmark report before it can govern routing. */
+import { createHash, createPublicKey, verify } from 'node:crypto';
+import { resolveTrustedEvaluatorPublicKey } from './gofer-trusted-evaluator.mjs';
+
+const text = value => typeof value === 'string' && value.trim().length > 0;
+const sha256 = value => createHash('sha256').update(value).digest('hex');
+const denied = () => new Error('TRUSTED_BENCHMARK_REQUIRED');
+const VERIFIER = 'gofer-heldout-benchmark-verifier';
+const digest = value => /^[a-f0-9]{64}$/.test(value ?? '');
+const nonnegative = value => Number.isFinite(value) && value >= 0;
+const wilson95 = (passes, total) => {
+  const z = 1.96;
+  const p = passes / total;
+  const denominator = 1 + z ** 2 / total;
+  const centre = (p + z ** 2 / (2 * total)) / denominator;
+  const spread = z * Math.sqrt((p * (1 - p) + z ** 2 / (4 * total)) / total) / denominator;
+  return { lower: Math.max(0, centre - spread), upper: Math.min(1, centre + spread) };
+};
+
+function validReport(report, receiptHash) {
+  if (report?.schemaVersion !== 2 || report.repetitions !== 3 ||
+      !Number.isInteger(report.caseCount) || report.caseCount < 4 ||
+      !Array.isArray(report.runs) || report.runs.length !== report.caseCount * 3 ||
+      !text(report.provenance?.harnessId) || !text(report.provenance?.modelId) ||
+      !digest(report.provenance?.corpusHash) ||
+      report.provenance?.capabilityReceiptHash !== receiptHash) return false;
+  const seen = new Set();
+  const executions = new Set();
+  const verifications = new Set();
+  let passes = 0;
+  let cost = 0;
+  let duration = 0;
+  for (const run of report.runs) {
+    const pair = `${run?.caseId}:${run?.run}`;
+    if (!text(run?.caseId) || !Number.isInteger(run.run) || run.run < 1 || run.run > 3 ||
+        seen.has(pair) || run.modelId !== report.provenance.modelId ||
+        !nonnegative(run.costUsd) || !nonnegative(run.durationMs) ||
+        !digest(run.receipt) || !digest(run.inputHash) || !digest(run.verifierReceipt) ||
+        !digest(run.reviewReceipt) || !text(run.verifierId) ||
+        !text(run.failureClassification) || typeof run.functionalVerified !== 'boolean' ||
+        executions.has(run.receipt) || verifications.has(run.verifierReceipt)) return false;
+    seen.add(pair);
+    executions.add(run.receipt);
+    verifications.add(run.verifierReceipt);
+    passes += Number(run.functionalVerified);
+    cost += run.costUsd;
+    duration += run.durationMs;
+  }
+  const cases = new Set(report.runs.map(run => run.caseId));
+  if (cases.size !== report.caseCount ||
+      [...cases].some(id => [1, 2, 3].some(run => !seen.has(`${id}:${run}`)))) return false;
+  const reliability = passes / report.runs.length;
+  const interval = report.confidenceInterval;
+  const expectedInterval = wilson95(passes, report.runs.length);
+  return report.functionalPasses === passes && report.functionalRuns === report.runs.length &&
+    Math.abs(report.reliability - reliability) < 1e-12 &&
+    Math.abs(report.costUsd - cost) < 1e-9 && report.durationMs === duration &&
+    report.status === (passes === report.runs.length ? 'pass' : 'fail') &&
+    interval?.level === 0.95 &&
+    Math.abs(interval.lower - expectedInterval.lower) < 1e-12 &&
+    Math.abs(interval.upper - expectedInterval.upper) < 1e-12;
+}
+
+/**
+ * A signed attestation binds all report fields, including every run verdict,
+ * cost, review receipt, and provenance field. Only a separately registered
+ * verifier key may authorize this evidence for the native runtime.
+ */
+export async function verifyTrustedBenchmarkEvidence({ host, receiptHash, evidence,
+  attestation, capabilityKeyId, capabilityPublicKey, workspaceRoot, now = Date.now() } = {}) {
+  if (!text(host) || !/^[a-f0-9]{64}$/.test(receiptHash ?? '') || !text(capabilityKeyId) ||
+      !capabilityPublicKey || !text(workspaceRoot) || !Number.isFinite(now) || !attestation ||
+      attestation.schemaVersion !== 1 || attestation.host !== host ||
+      attestation.capabilityReceiptHash !== receiptHash ||
+      attestation.verification !== 'functional-tests+independent-review' ||
+      !text(attestation.verifierVersion) || attestation.provenance?.evaluator !== VERIFIER ||
+      !text(attestation.provenance?.keyId) || attestation.provenance.keyId === capabilityKeyId ||
+      !text(attestation.provenance?.source) || attestation.signature?.algorithm !== 'ed25519' ||
+      attestation.signature.keyId !== attestation.provenance.keyId ||
+      !/^[A-Za-z0-9_-]+$/.test(attestation.signature.value ?? '')) throw denied();
+  const verifiedAt = Date.parse(attestation.verifiedAt);
+  const expiresAt = Date.parse(attestation.expiresAt);
+  if (!Number.isFinite(verifiedAt) || !Number.isFinite(expiresAt) ||
+      verifiedAt > now || expiresAt <= now || expiresAt <= verifiedAt) throw denied();
+  let bytes;
+  try { bytes = JSON.stringify(evidence); } catch { throw denied(); }
+  const reports = Array.isArray(evidence) ? evidence : [evidence];
+  if (!reports.length || !reports.every(report => validReport(report, receiptHash)) ||
+      attestation.evidenceHash !== sha256(bytes)) throw denied();
+  const { signature, ...payload } = attestation;
+  const publicKey = await resolveTrustedEvaluatorPublicKey(attestation,
+    { workspaceRoot }).catch(() => { throw denied(); });
+  try {
+    const capabilityKey = capabilityPublicKey?.type === 'public'
+      ? capabilityPublicKey : createPublicKey(capabilityPublicKey);
+    if (publicKey.export({ type: 'spki', format: 'der' }).equals(
+      capabilityKey.export({ type: 'spki', format: 'der' }))) throw denied();
+  } catch { throw denied(); }
+  if (!verify(null, Buffer.from(JSON.stringify(payload)), publicKey,
+    Buffer.from(signature.value, 'base64url'))) throw denied();
+  return Object.freeze({ valid: true, receiptHash, receipt: `benchmark:${sha256(JSON.stringify(attestation))}` });
+}

package/resources/gofer/node-scripts/gofer-trusted-evaluator.mjs

@@ -0,0 +1,274 @@
+/** Read a locally provisioned evaluator key. The worker never chooses it. */
+import { createHash, createPrivateKey, createPublicKey } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { constants } from 'node:fs';
+import { lstat, open, realpath } from 'node:fs/promises';
+import path from 'node:path';
+import { loadHeldOutCorpus } from './gofer-heldout-corpus.mjs';
+import { decryptSigningKey } from './gofer-encrypted-key.mjs';
+
+const text = value => typeof value === 'string' && value.trim().length > 0;
+const inside = (parent, child) => {
+  const relative = path.relative(parent, child);
+  return relative === '' || (relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+};
+const denied = () => new Error('TRUSTED_EVALUATOR_REQUIRED');
+
+export function accountTrustRoot() {
+  // HOME is caller-controlled. Resolve the account record by effective UID.
+  if (process.platform === 'linux') {
+    const uid = process.getuid();
+    const record = execFileSync('/usr/bin/getent', ['passwd', String(uid)],
+      { encoding: 'utf8', timeout: 3000 }).trim();
+    const fields = record.split(':');
+    const home = fields.length === 7 && fields[2] === String(uid) ? fields[5] : null;
+    if (!home || !path.isAbsolute(home) || home.includes('\n')) throw denied();
+    return path.join(home, '.eai-gofer-trust');
+  }
+  if (process.platform !== 'darwin') throw denied();
+  const name = execFileSync('/usr/bin/id', ['-un'], { encoding: 'utf8', timeout: 3000 }).trim();
+  if (!/^[a-zA-Z0-9._-]+$/.test(name)) throw denied();
+  const record = execFileSync('/usr/bin/dscl', ['.', '-read', path.join(path.sep, 'Users', name), 'NFSHomeDirectory'],
+    { encoding: 'utf8', timeout: 3000 }).trim();
+  const home = /^NFSHomeDirectory: (\/[^\n]+)$/.exec(record)?.[1];
+  if (!home) throw denied();
+  return path.join(home, '.eai-gofer-trust');
+}
+
+// A directory handle stays bound to the inode it opened even if something
+// later renames or replaces the path. Re-checking a path-based file open
+// against the handle's device/inode closes the gap between validating a
+// directory and reading a file inside it: a same-uid path substitution is
+// detected instead of silently trusted.
+async function assertSameDirectory(candidatePath, boundInfo) {
+  const current = await lstat(candidatePath).catch(() => null);
+  if (!current || current.dev !== boundInfo.dev || current.ino !== boundInfo.ino) throw denied();
+}
+
+async function inspectAccountTrustRoot(root, workspaceRoot) {
+  if (!path.isAbsolute(root)) throw denied();
+  const [workspace, parent] = await Promise.all([realpath(workspaceRoot), realpath(path.dirname(root))]);
+  const parentInfo = await lstat(parent);
+  const canonicalRoot = path.join(parent, path.basename(root));
+  if (!parentInfo.isDirectory() || ![0, process.getuid()].includes(parentInfo.uid) ||
+      (parentInfo.mode & 0o022) !== 0 || inside(workspace, canonicalRoot) ||
+      inside(canonicalRoot, workspace)) throw denied();
+  const handle = await open(canonicalRoot, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+  try {
+    const rootInfo = await handle.stat();
+    if (!rootInfo.isDirectory() || rootInfo.uid !== process.getuid() ||
+        (rootInfo.mode & 0o077) !== 0) throw denied();
+    return { canonicalRoot, handle, info: rootInfo };
+  } catch (err) { await handle.close(); throw err; }
+}
+
+// Open a file below a directory already validated by `inspectAccountTrustRoot`,
+// re-confirming immediately beforehand that the directory path has not been
+// substituted since that validation.
+async function openVerifiedFile(directory, filename) {
+  const filePath = path.join(directory.canonicalRoot, filename);
+  const file = await open(filePath, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    await assertSameDirectory(directory.canonicalRoot, directory.info);
+    return file;
+  } catch (err) { await file.close(); throw err; }
+}
+
+export const VERIFIER_EVALUATOR = 'gofer-heldout-benchmark-verifier';
+
+/** Verifier keys are trusted only from a root-owned registry. Anything the
+ * account can write, an unsandboxed process in that account can also write. */
+export function protectedVerifierRegistryPath() {
+  if (process.platform === 'darwin') return '/Library/Application Support/EAI Gofer/verifier-registry.json';
+  if (process.platform === 'linux') return '/etc/eai-gofer/verifier-registry.json';
+  throw denied();
+}
+
+async function loadProtectedVerifierKey(receipt, { path: registryPath = protectedVerifierRegistryPath(),
+  ownerUid = 0 } = {}) {
+  try {
+    if (!path.isAbsolute(registryPath) || !Number.isInteger(ownerUid)) throw denied();
+    const parent = await realpath(path.dirname(registryPath));
+    for (let current = parent; ;) {
+      const info = await lstat(current);
+      if (!info.isDirectory() || ![0, ownerUid].includes(info.uid) || (info.mode & 0o022) !== 0) throw denied();
+      const above = path.dirname(current);
+      if (above === current) break;
+      current = above;
+    }
+    let registry;
+    const file = await open(path.join(parent, path.basename(registryPath)),
+      constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+      const info = await file.stat();
+      if (!info.isFile() || info.uid !== ownerUid || info.nlink !== 1 ||
+          (info.mode & 0o022) !== 0 || info.size < 2 || info.size > 65536) throw denied();
+      registry = JSON.parse(await file.readFile('utf8'));
+    } finally { await file.close(); }
+    if (registry?.schemaVersion !== 1 || !Array.isArray(registry.evaluators) ||
+        registry.evaluators.length < 1 || registry.evaluators.length > 32 ||
+        registry.evaluators.some(item => !text(item?.keyId) || !text(item?.host) ||
+          item.evaluator !== VERIFIER_EVALUATOR || !text(item?.publicKeyPem)) ||
+        new Set(registry.evaluators.map(item => item.keyId)).size !== registry.evaluators.length) throw denied();
+    const entry = registry.evaluators.find(item => item.keyId === receipt.provenance.keyId &&
+      item.host === receipt.host);
+    if (!entry) throw denied();
+    const key = createPublicKey(entry.publicKeyPem);
+    if (key.asymmetricKeyType !== 'ed25519') throw denied();
+    return key;
+  } catch { throw denied(); }
+}
+
+/**
+ * The default trust root is fixed outside the checkout. `trustRoot` exists for
+ * isolated tests; the production composition root never accepts an override.
+ */
+export async function resolveTrustedEvaluatorPublicKey(receipt, { workspaceRoot, trustRoot, protectedRegistry } = {}) {
+  if (process.platform === 'win32' || typeof process.getuid !== 'function' ||
+      !text(workspaceRoot) || !text(receipt?.host) || !text(receipt?.provenance?.keyId) ||
+      !text(receipt?.provenance?.evaluator)) throw denied();
+  if (receipt.provenance.evaluator === VERIFIER_EVALUATOR) return loadProtectedVerifierKey(receipt, protectedRegistry);
+  const root = trustRoot ?? accountTrustRoot();
+  try {
+    const directory = await inspectAccountTrustRoot(root, workspaceRoot);
+    let registry;
+    try {
+      const file = await openVerifiedFile(directory, 'trusted-evaluators.json');
+      try {
+        const actual = await file.stat();
+        if (!actual.isFile() || actual.uid !== process.getuid() ||
+            (actual.mode & 0o077) !== 0 || actual.size < 2 || actual.size > 65536) throw denied();
+        registry = JSON.parse(await file.readFile('utf8'));
+      } finally { await file.close(); }
+    } finally { await directory.handle.close(); }
+    if (registry?.schemaVersion !== 1 || !Array.isArray(registry.evaluators) ||
+        registry.evaluators.length < 1 || registry.evaluators.length > 32 ||
+        registry.evaluators.some(item => !text(item?.keyId) || !text(item?.host) ||
+          !text(item?.evaluator) || !text(item?.publicKeyPem)) ||
+        new Set(registry.evaluators.map(item => item.keyId)).size !== registry.evaluators.length) throw denied();
+    const entry = registry.evaluators.find(item => item.keyId === receipt.provenance.keyId &&
+      item.host === receipt.host && item.evaluator === receipt.provenance.evaluator);
+    if (!entry) throw denied();
+    const key = createPublicKey(entry.publicKeyPem);
+    if (key.asymmetricKeyType !== 'ed25519') throw denied();
+    return key;
+  } catch { throw denied(); }
+}
+
+/** Only activated identities can sign. Production issuers never expose a
+ * caller-selected trust root; the override is for isolated tests. */
+async function loadActiveEvaluatorKey({ workspaceRoot, trustRoot, identityName, evaluator,
+  getPassphrase, protectedRegistry } = {}) {
+  if (!text(workspaceRoot) || process.platform === 'win32' || typeof process.getuid !== 'function') throw denied();
+  const root = trustRoot ?? accountTrustRoot();
+  try {
+    const active = path.join(root, 'active-keys');
+    const handle = await open(active, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+    let identity, privateKey;
+    try {
+      const activeInfo = await handle.stat();
+      if (!activeInfo.isDirectory() || activeInfo.uid !== process.getuid() ||
+          (activeInfo.mode & 0o077) !== 0) throw denied();
+      const directory = { canonicalRoot: active, handle, info: activeInfo };
+      const identityFile = await openVerifiedFile(directory, `${identityName}.json`);
+      try {
+        const info = await identityFile.stat();
+        if (!info.isFile() || info.uid !== process.getuid() ||
+            (info.mode & 0o077) !== 0 || info.size < 2 || info.size > 4096) throw denied();
+        identity = JSON.parse(await identityFile.readFile('utf8'));
+      } finally { await identityFile.close(); }
+      if (identity?.schemaVersion !== 1 || identity.host !== 'codex' ||
+          identity.evaluator !== evaluator || !text(identity.keyId)) throw denied();
+      const publicKey = await resolveTrustedEvaluatorPublicKey({ host: identity.host,
+        provenance: { evaluator: identity.evaluator, keyId: identity.keyId } }, { workspaceRoot, trustRoot, protectedRegistry });
+      if (evaluator === VERIFIER_EVALUATOR) {
+        // A plaintext verifier key is readable by any worker. Only an
+        // encrypted envelope, opened with a passphrase a person types, loads.
+        if (typeof getPassphrase !== 'function') throw denied();
+        const envelopeFile = await openVerifiedFile(directory, `${identityName}.private.enc.json`);
+        let envelope;
+        try {
+          const info = await envelopeFile.stat();
+          if (!info.isFile() || info.uid !== process.getuid() || info.nlink !== 1 ||
+              (info.mode & 0o077) !== 0 || info.size < 100 || info.size > 8192) throw denied();
+          envelope = JSON.parse(await envelopeFile.readFile('utf8'));
+        } finally { await envelopeFile.close(); }
+        privateKey = await decryptSigningKey(envelope, await getPassphrase());
+      } else {
+        const privateFile = await openVerifiedFile(directory, `${identityName}.private.pem`);
+        try {
+          const info = await privateFile.stat();
+          if (!info.isFile() || info.uid !== process.getuid() ||
+              (info.mode & 0o077) !== 0 || info.size < 32 || info.size > 8192) throw denied();
+          privateKey = createPrivateKey(await privateFile.readFile('utf8'));
+        } finally { await privateFile.close(); }
+      }
+      if (privateKey.asymmetricKeyType !== 'ed25519' ||
+          !createPublicKey(privateKey).export({ type: 'spki', format: 'der' })
+            .equals(publicKey.export({ type: 'spki', format: 'der' }))) throw denied();
+    } finally { await handle.close(); }
+    return Object.freeze({ privateKey, keyId: identity.keyId });
+  } catch { throw denied(); }
+}
+
+export async function loadActiveCodexEvaluatorKey({ workspaceRoot, trustRoot } = {}) {
+  return loadActiveEvaluatorKey({ workspaceRoot, trustRoot,
+    identityName: 'codex-evaluator', evaluator: 'gofer-native-host-evaluator' });
+}
+
+export async function loadActiveBenchmarkVerifierKey({ workspaceRoot, trustRoot, getPassphrase,
+  protectedRegistry } = {}) {
+  return loadActiveEvaluatorKey({ workspaceRoot, trustRoot, getPassphrase, protectedRegistry,
+    identityName: 'heldout-verifier', evaluator: VERIFIER_EVALUATOR });
+}
+
+/** The controller pins one corpus inside its account-owned trust root.
+ * A worker cannot select a path or replace a pinned input through this API. */
+export async function loadTrustedHeldOutCorpus({ workspaceRoot, trustRoot } = {}) {
+  if (!text(workspaceRoot) || process.platform === 'win32' ||
+      typeof process.getuid !== 'function') throw denied();
+  const root = trustRoot ?? accountTrustRoot();
+  try {
+    const trustDirectory = await inspectAccountTrustRoot(root, workspaceRoot);
+    let config;
+    try {
+      const configFile = await openVerifiedFile(trustDirectory, 'heldout-corpus.json');
+      try {
+        const info = await configFile.stat();
+        if (!info.isFile() || info.uid !== process.getuid() || info.nlink !== 1 ||
+            (info.mode & 0o077) !== 0 || info.size < 2 || info.size > 4096) throw denied();
+        config = JSON.parse(await configFile.readFile('utf8'));
+      } finally { await configFile.close(); }
+    } finally { await trustDirectory.handle.close(); }
+    if (config?.schemaVersion !== 1 || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(config.corpusId ?? '') ||
+        !/^[a-f0-9]{64}$/.test(config.corpusHash ?? '')) throw denied();
+    const corpora = path.join(trustDirectory.canonicalRoot, 'corpora');
+    const corpusRoot = path.join(corpora, config.corpusId);
+    for (const directory of [corpora, corpusRoot]) {
+      const info = await lstat(directory);
+      if (!info.isDirectory() || info.uid !== process.getuid() ||
+          (info.mode & 0o077) !== 0) throw denied();
+    }
+    const manifestFile = await open(path.join(corpusRoot, 'manifest.json'),
+      constants.O_RDONLY | constants.O_NOFOLLOW);
+    let manifest;
+    try {
+      const info = await manifestFile.stat();
+      if (!info.isFile() || info.uid !== process.getuid() || info.nlink !== 1 ||
+          (info.mode & 0o077) !== 0 || info.size < 2 || info.size > 65536) throw denied();
+      manifest = JSON.parse(await manifestFile.readFile('utf8'));
+    } finally { await manifestFile.close(); }
+    if (!Array.isArray(manifest?.cases) ||
+        createHash('sha256').update(JSON.stringify(manifest)).digest('hex') !== config.corpusHash) throw denied();
+    for (const name of manifest.cases.map(item => item?.inputFile)) {
+      if (!text(name) || name === '.' || name === '..' || name.includes('/') ||
+          name.includes('\\')) throw denied();
+      const info = await lstat(path.join(corpusRoot, name));
+      if (!info.isFile() || info.uid !== process.getuid() || info.nlink !== 1 ||
+          (info.mode & 0o077) !== 0) throw denied();
+    }
+    const corpus = await loadHeldOutCorpus({ corpusRoot, workspaceRoot });
+    if (corpus.corpusHash !== config.corpusHash) throw denied();
+    return Object.freeze({ ...corpus, corpusRoot });
+  } catch { throw denied(); }
+}

package/resources/gofer/node-scripts/gofer-tty-prompt.mjs

@@ -0,0 +1,34 @@
+/** Read a secret from a real terminal only. Never from a pipe, an argument,
+ * the environment, or a file: a person must be present to type it. */
+import process from 'node:process';
+
+const denied = () => new Error('INTERACTIVE_TERMINAL_REQUIRED');
+const CANCEL = new Set([String.fromCharCode(3), String.fromCharCode(4)]);
+const BACKSPACE = new Set([String.fromCharCode(127), String.fromCharCode(8)]);
+
+export function promptHidden(label, { stdin = process.stdin, stdout = process.stdout } = {}) {
+  if (!stdin.isTTY || !stdout.isTTY || typeof stdin.setRawMode !== 'function') throw denied();
+  return new Promise((resolve, reject) => {
+    let value = '';
+    const finish = (error, result) => {
+      stdin.removeListener('data', onData);
+      stdin.setRawMode(false);
+      stdin.pause();
+      stdout.write('\n');
+      if (error) reject(error);
+      else resolve(result);
+    };
+    const onData = chunk => {
+      for (const character of chunk.toString('utf8')) {
+        if (character === '\r' || character === '\n') return finish(null, value);
+        if (CANCEL.has(character)) return finish(new Error('PASSPHRASE_ENTRY_CANCELLED'));
+        if (BACKSPACE.has(character)) value = value.slice(0, -1);
+        else if (character >= ' ') value += character;
+      }
+    };
+    stdout.write(label);
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.on('data', onData);
+  });
+}