@iislee/opencodex 2.11.0 → 2.31.0

package/src/codex/model-entitlements.ts

@@ -0,0 +1,353 @@
+import { createHash } from "node:crypto";
+import { readBoundedResponseBody } from "../lib/bounded-body";
+import type { OcxConfig } from "../types";
+import { isSelectableCodexPoolAccount } from "./account-id";
+import { getValidCodexToken, readCodexAccountRecord } from "./account-store";
+import { getMainAccountToken, MAIN_CODEX_ACCOUNT_ID } from "./main-account";
+import { ACCOUNT_GATED_NATIVE_OPENAI_MODELS } from "./catalog/native-models";
+
+const CODEX_MODELS_URL = "https://chatgpt.com/backend-api/codex/models?client_version=0.0.0";
+const MODEL_ROSTER_TTL_MS = 5 * 60_000;
+const MODEL_ROSTER_FAILURE_TTL_MS = 15_000;
+const MODEL_ROSTER_TIMEOUT_MS = 8_000;
+const MODEL_ROSTER_MAX_BYTES = 2 * 1024 * 1024;
+const MODEL_ROSTER_CACHE_MAX = 64;
+const DIRECT_CALLER_ACCOUNT_PREFIX = "__direct_codex__:";
+
+export interface CodexModelEntitlementCredentialSnapshot {
+  readonly accountId: string;
+  readonly accessToken: string;
+  readonly chatgptAccountId: string;
+  /** Stable local identity for rejecting a catalog commit after credential replacement. */
+  readonly credentialIdentity: string;
+}
+
+interface CachedAccountModels {
+  readonly credentialIdentity: string;
+  readonly expiresAt: number;
+  readonly models: ReadonlySet<string>;
+  readonly confirmed: boolean;
+}
+
+export interface CodexModelEntitlementSnapshot {
+  readonly modelsByAccount: ReadonlyMap<string, ReadonlySet<string>>;
+  readonly confirmedAccountIds: ReadonlySet<string>;
+  readonly credentialIdentities: ReadonlyMap<string, string>;
+}
+
+export interface CodexModelEntitlementResolveOptions {
+  readonly fetcher?: typeof fetch;
+  readonly now?: number;
+  /** Test-only credential seam; production callers enumerate local main + Pool credentials. */
+  readonly credentials?: readonly CodexModelEntitlementCredentialSnapshot[];
+}
+
+const accountModelsCache = new Map<string, CachedAccountModels>();
+const accountModelsFlights = new Map<string, Promise<CachedAccountModels>>();
+
+/**
+ * Direct-caller entries are evicted separately from main/Pool entries.
+ *
+ * Direct keys are per-credential (`__direct_codex__:<hash>`) and unbounded in practice, while
+ * main/Pool keys are the evidence the CATALOG projects from. Sharing one LRU let 64 distinct
+ * Direct callers evict `__main__` and the Pool accounts, which makes the gated row vanish from
+ * the catalog until rediscovery — fail-closed flapping rather than a leak, but still a visible
+ * model disappearing for a reason the operator cannot see. Two budgets keep one class of caller
+ * from erasing the other's evidence.
+ */
+function boundedCacheSet(accountId: string, value: CachedAccountModels): void {
+  accountModelsCache.delete(accountId);
+  accountModelsCache.set(accountId, value);
+  const isDirect = (key: string): boolean => key.startsWith(DIRECT_CALLER_ACCOUNT_PREFIX);
+  const evictClass = (direct: boolean): void => {
+    let count = 0;
+    for (const key of accountModelsCache.keys()) if (isDirect(key) === direct) count += 1;
+    while (count > MODEL_ROSTER_CACHE_MAX) {
+      let oldest: string | undefined;
+      for (const key of accountModelsCache.keys()) {
+        if (isDirect(key) === direct) { oldest = key; break; }
+      }
+      if (oldest === undefined) break;
+      accountModelsCache.delete(oldest);
+      count -= 1;
+    }
+  };
+  evictClass(isDirect(accountId));
+}
+
+function currentCredentialIdentity(accountId: string): string | undefined {
+  if (accountId.startsWith(DIRECT_CALLER_ACCOUNT_PREFIX)) {
+    return `direct:${accountId.slice(DIRECT_CALLER_ACCOUNT_PREFIX.length)}`;
+  }
+  if (accountId === MAIN_CODEX_ACCOUNT_ID) {
+    const token = getMainAccountToken();
+    return token ? `main:${token.chatgptAccountId}` : undefined;
+  }
+  const record = readCodexAccountRecord(accountId);
+  if (!record?.credential || record.deletedAt != null) return undefined;
+  return `pool:${record.generation}:${record.credential.chatgptAccountId}`;
+}
+
+async function accountCredentialSnapshot(accountId: string): Promise<CodexModelEntitlementCredentialSnapshot | null> {
+  if (accountId === MAIN_CODEX_ACCOUNT_ID) {
+    const token = getMainAccountToken();
+    return token
+      ? {
+        accountId,
+        accessToken: token.accessToken,
+        chatgptAccountId: token.chatgptAccountId,
+        credentialIdentity: `main:${token.chatgptAccountId}`,
+      }
+      : null;
+  }
+  try {
+    const token = await getValidCodexToken(accountId);
+    return {
+      accountId,
+      accessToken: token.accessToken,
+      chatgptAccountId: token.chatgptAccountId,
+      credentialIdentity: `pool:${token.generation}:${token.chatgptAccountId}`,
+    };
+  } catch {
+    return null;
+  }
+}
+
+function parseAccountModels(text: string): ReadonlySet<string> | null {
+  try {
+    const payload = JSON.parse(text) as { models?: unknown };
+    if (!Array.isArray(payload.models)) return null;
+    const models = payload.models.flatMap(entry => {
+      if (!entry || typeof entry !== "object" || Array.isArray(entry)) return [];
+      const row = entry as { slug?: unknown; supported_in_api?: unknown; visibility?: unknown };
+      if (typeof row.slug !== "string" || row.supported_in_api !== true || row.visibility === "hide") return [];
+      return [row.slug];
+    });
+    return new Set(models);
+  } catch {
+    return null;
+  }
+}
+
+async function fetchAccountModels(
+  credential: CodexModelEntitlementCredentialSnapshot,
+  fetcher: typeof fetch,
+  now: number,
+): Promise<CachedAccountModels> {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(new DOMException("Codex model discovery timed out", "TimeoutError")), MODEL_ROSTER_TIMEOUT_MS);
+  try {
+    const headers = new Headers({
+      Authorization: `Bearer ${credential.accessToken}`,
+      Accept: "application/json",
+    });
+    if (credential.chatgptAccountId) headers.set("ChatGPT-Account-Id", credential.chatgptAccountId);
+    const response = await fetcher(CODEX_MODELS_URL, {
+      headers,
+      redirect: "error",
+      signal: controller.signal,
+    });
+    const body = await readBoundedResponseBody(response, {
+      signal: controller.signal,
+      maxBytes: MODEL_ROSTER_MAX_BYTES,
+      fatalUtf8: true,
+    });
+    const models = response.ok && body.displaySafe && !body.truncated
+      ? parseAccountModels(body.text)
+      : null;
+    return {
+      credentialIdentity: credential.credentialIdentity,
+      expiresAt: now + (models ? MODEL_ROSTER_TTL_MS : MODEL_ROSTER_FAILURE_TTL_MS),
+      models: models ?? new Set(),
+      confirmed: models !== null,
+    };
+  } catch {
+    return {
+      credentialIdentity: credential.credentialIdentity,
+      expiresAt: now + MODEL_ROSTER_FAILURE_TTL_MS,
+      models: new Set(),
+      confirmed: false,
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+function directCallerCredential(headers: Headers): CodexModelEntitlementCredentialSnapshot | null {
+  const match = /^Bearer\s+(\S+)$/i.exec(headers.get("authorization")?.trim() ?? "");
+  if (!match) return null;
+  const accessToken = match[1]!;
+  const chatgptAccountId = headers.get("chatgpt-account-id")?.trim() ?? "";
+  const fingerprint = createHash("sha256")
+    .update(accessToken)
+    .update("\0")
+    .update(chatgptAccountId)
+    .digest("hex");
+  return {
+    accountId: `${DIRECT_CALLER_ACCOUNT_PREFIX}${fingerprint}`,
+    accessToken,
+    chatgptAccountId,
+    credentialIdentity: `direct:${fingerprint}`,
+  };
+}
+
+async function modelsForCredential(
+  credential: CodexModelEntitlementCredentialSnapshot,
+  fetcher: typeof fetch,
+  now: number,
+): Promise<CachedAccountModels> {
+  const cached = accountModelsCache.get(credential.accountId);
+  if (
+    cached
+    && cached.credentialIdentity === credential.credentialIdentity
+    && cached.expiresAt > now
+  ) return cached;
+
+  const flightKey = `${credential.accountId}\u0000${credential.credentialIdentity}`;
+  const existing = accountModelsFlights.get(flightKey);
+  if (existing) return existing;
+  const flight = fetchAccountModels(credential, fetcher, now)
+    .then(result => {
+      if (currentCredentialIdentity(credential.accountId) === credential.credentialIdentity) {
+        boundedCacheSet(credential.accountId, result);
+      }
+      return result;
+    })
+    .finally(() => {
+      if (accountModelsFlights.get(flightKey) === flight) accountModelsFlights.delete(flightKey);
+    });
+  accountModelsFlights.set(flightKey, flight);
+  return flight;
+}
+
+function candidateAccountIds(config: Pick<OcxConfig, "codexAccounts">): string[] {
+  return [
+    MAIN_CODEX_ACCOUNT_ID,
+    ...(config.codexAccounts ?? [])
+      .filter(isSelectableCodexPoolAccount)
+      .map(account => account.id),
+  ];
+}
+
+/**
+ * Fetch the authenticated model roster for every locally usable Codex account.
+ *
+ * [Decision Log]
+ * - 목적과 의도: Account-gated native models must be advertised and selected only for accounts
+ *   whose own authenticated upstream catalog confirms the model.
+ * - 기존 구현 및 제약 조건: The injected Codex catalog is static, while Pool may contain
+ *   accounts with different entitlements. A global allowlist therefore exposed unusable rows.
+ * - 검토한 주요 대안: Infer access from plan labels, learn only after a failed prompt, or rewrite
+ *   Daybreak to its current physical model.
+ * - 선택한 방식: Cache bounded authenticated `/models` rosters per credential generation and
+ *   fail closed for unconfirmed accounts.
+ * - 다른 대안 대신 이 방식을 선택한 이유: Plan names do not prove grants, post-failure
+ *   learning spends a real turn, and model rewriting changes the requested product identity.
+ * - 장점, 단점 및 영향: Catalog and routing share exact account evidence. Cold gated requests
+ *   pay one bounded discovery call per account; discovery failure temporarily hides the gated row.
+ */
+export async function resolveCodexModelEntitlements(
+  config: Pick<OcxConfig, "codexAccounts">,
+  options: CodexModelEntitlementResolveOptions = {},
+): Promise<CodexModelEntitlementSnapshot> {
+  const now = options.now ?? Date.now();
+  const fetcher = options.fetcher ?? fetch;
+  const credentials = options.credentials
+    ? [...options.credentials]
+    : (await Promise.all(candidateAccountIds(config).map(accountCredentialSnapshot)))
+      .filter((value): value is CodexModelEntitlementCredentialSnapshot => value !== null);
+  const results = await Promise.all(credentials.map(async credential => ({
+    credential,
+    result: await modelsForCredential(credential, fetcher, now),
+  })));
+  return {
+    modelsByAccount: new Map(results.map(({ credential, result }) => [credential.accountId, result.models])),
+    confirmedAccountIds: new Set(results.flatMap(({ credential, result }) => result.confirmed ? [credential.accountId] : [])),
+    credentialIdentities: new Map(results.map(({ credential }) => [credential.accountId, credential.credentialIdentity])),
+  };
+}
+
+/** Fail-closed entitlement check for a Direct request's own forwarded ChatGPT credential. */
+export async function isDirectCallerEntitledToCodexModel(
+  headers: Headers,
+  modelId: string,
+  options: Pick<CodexModelEntitlementResolveOptions, "fetcher" | "now"> = {},
+): Promise<boolean> {
+  if (!ACCOUNT_GATED_NATIVE_OPENAI_MODELS.has(modelId)) return true;
+  const credential = directCallerCredential(headers);
+  if (!credential) return false;
+  const result = await modelsForCredential(
+    credential,
+    options.fetcher ?? fetch,
+    options.now ?? Date.now(),
+  );
+  return result.confirmed && result.models.has(modelId);
+}
+
+export function entitledCodexAccountIdsForModel(
+  snapshot: CodexModelEntitlementSnapshot,
+  modelId: string | undefined,
+): ReadonlySet<string> | undefined {
+  if (!modelId || !ACCOUNT_GATED_NATIVE_OPENAI_MODELS.has(modelId)) return undefined;
+  return new Set([...snapshot.modelsByAccount].flatMap(([accountId, models]) => (
+    snapshot.confirmedAccountIds.has(accountId) && models.has(modelId) ? [accountId] : []
+  )));
+}
+
+export function availableAccountGatedNativeModels(
+  snapshot: CodexModelEntitlementSnapshot,
+  eligibleAccountIds?: ReadonlySet<string>,
+): ReadonlySet<string> {
+  return new Set([...ACCOUNT_GATED_NATIVE_OPENAI_MODELS].filter(modelId => (
+    [...snapshot.modelsByAccount].some(([accountId, models]) => (
+      (!eligibleAccountIds || eligibleAccountIds.has(accountId))
+      && snapshot.confirmedAccountIds.has(accountId)
+      && models.has(modelId)
+    ))
+  )));
+}
+
+/** Synchronous projection for management/catalog readers after a discovery pass. */
+export function cachedAvailableAccountGatedNativeModels(
+  now = Date.now(),
+  eligibleAccountIds?: ReadonlySet<string>,
+): ReadonlySet<string> {
+  return new Set([...ACCOUNT_GATED_NATIVE_OPENAI_MODELS].filter(modelId => (
+    [...accountModelsCache].some(([accountId, entry]) => (
+      (!eligibleAccountIds || eligibleAccountIds.has(accountId))
+      && !accountId.startsWith(DIRECT_CALLER_ACCOUNT_PREFIX)
+      && entry.confirmed
+      && entry.expiresAt > now
+      && entry.models.has(modelId)
+    ))
+  )));
+}
+
+export function isCodexModelEntitlementSnapshotCurrent(snapshot: CodexModelEntitlementSnapshot): boolean {
+  for (const [accountId, identity] of snapshot.credentialIdentities) {
+    if (currentCredentialIdentity(accountId) !== identity) return false;
+  }
+  return true;
+}
+
+export function invalidateCodexModelEntitlementsForAccount(accountId: string | null | undefined): void {
+  if (accountId) accountModelsCache.delete(accountId);
+}
+
+export function resetCodexModelEntitlementCacheForTests(): void {
+  accountModelsCache.clear();
+  accountModelsFlights.clear();
+}
+
+export function seedCodexModelEntitlementsForTests(
+  accountId: string,
+  models: readonly string[],
+  now = Date.now(),
+): void {
+  boundedCacheSet(accountId, {
+    credentialIdentity: `test:${accountId}`,
+    expiresAt: now + MODEL_ROSTER_TTL_MS,
+    models: new Set(models),
+    confirmed: true,
+  });
+}

package/src/codex/native-main-admission.ts

@@ -0,0 +1,47 @@
+import type { AdmissionLease } from "../lib/admission";
+import {
+  tryAcquireNativeMainProfileClaim as tryAcquireLifecycleNativeMainProfileClaim,
+  tryClaimNativeMainProfileForTurn as tryClaimLifecycleNativeMainProfileForTurn,
+} from "../server/lifecycle";
+import { isNativeMainTrafficBlocked } from "./native-profile-startup";
+
+export interface NativeMainTurnClaimDeps {
+  /** Test seams for the synchronous precheck/claim/postcheck transition. */
+  isTrafficBlocked?: typeof isNativeMainTrafficBlocked;
+  claimTurn?: typeof tryClaimLifecycleNativeMainProfileForTurn;
+}
+
+/**
+ * Admit a physical native-main credential read on an existing turn.
+ *
+ * Lifecycle admission owns the scoped switch/shutdown fence while the startup
+ * gate owns retained journal/manual recovery. Keep their composition here so
+ * low-level server lifecycle code does not import NativeProfileManager through
+ * native-profile-startup and create a fragile dependency cycle.
+ */
+export function tryClaimNativeMainProfileForTurn(
+  lease?: AdmissionLease,
+  deps: NativeMainTurnClaimDeps = {},
+): boolean {
+  const isBlocked = deps.isTrafficBlocked ?? isNativeMainTrafficBlocked;
+  const claimTurn = deps.claimTurn ?? tryClaimLifecycleNativeMainProfileForTurn;
+  if (isBlocked()) return false;
+  if (!claimTurn(lease)) return false;
+  if (!isBlocked()) return true;
+
+  // Recovery became visible between the precheck and lifecycle claim. This
+  // request must not read auth.json. Keep the caller-owned turn claimed until
+  // normal request cleanup: optional routed work may continue, and releasing
+  // the whole turn here would let shutdown/profile switching overlap it.
+  return false;
+}
+
+/** Acquire standalone ownership only when both native-main gates admit work. */
+export function tryAcquireNativeMainProfileClaim(): AdmissionLease | null {
+  if (isNativeMainTrafficBlocked()) return null;
+  const claim = tryAcquireLifecycleNativeMainProfileClaim();
+  if (!claim) return null;
+  if (!isNativeMainTrafficBlocked()) return claim;
+  claim.release();
+  return null;
+}

package/src/codex/native-main-auth-temp.ts

@@ -0,0 +1,187 @@
+import {
+  closeSync,
+  constants as fsConstants,
+  fstatSync,
+  fsyncSync,
+  ftruncateSync,
+  lstatSync,
+  openSync,
+  readdirSync,
+  realpathSync,
+  unlinkSync,
+} from "node:fs";
+import { dirname, join, resolve } from "node:path";
+
+import type { NativeProfileContext } from "./native-profile-store";
+import { NativeProfileError } from "./native-profile-types";
+
+const AUTH_TEMP_NAME = /^auth\.json\.ocx\.[1-9]\d*\.[1-9]\d*\.tmp$/;
+const MAX_AUTH_TEMP_RESIDUES = 128;
+
+interface PathIdentity {
+  readonly dev: bigint;
+  readonly ino: bigint;
+}
+
+export interface NativeMainAuthTempScrubTestSeam {
+  /** Test-only race seam. Production never supplies this callback. */
+  beforeOpen?: (path: string) => void;
+  /** Test-only removal-failure seam. Production never supplies this callback. */
+  beforeUnlink?: (path: string) => void;
+}
+
+export interface NativeMainAuthTempScrubResult {
+  scrubbed: number;
+}
+
+function cleanupRequired(): NativeProfileError {
+  return new NativeProfileError(
+    "AUTH_TEMP_CLEANUP_REQUIRED",
+    "A native-main credential write residue could not be safely removed; manual cleanup is required.",
+    500,
+    false,
+    true,
+  );
+}
+
+function errorCode(error: unknown): string | undefined {
+  return error && typeof error === "object" && "code" in error
+    ? String((error as { code?: unknown }).code)
+    : undefined;
+}
+
+function sameIdentity(stats: { dev: bigint; ino: bigint }, expected: PathIdentity): boolean {
+  return stats.dev === expected.dev && stats.ino === expected.ino;
+}
+
+function samePath(left: string, right: string): boolean {
+  return resolve(left) === resolve(right);
+}
+
+function inspectCanonicalParent(path: string, expected?: PathIdentity): PathIdentity {
+  const absolute = resolve(path);
+  const entry = lstatSync(absolute, { bigint: true });
+  if (!entry.isDirectory() || entry.isSymbolicLink()) throw cleanupRequired();
+  const canonical = realpathSync.native(absolute);
+  if (!samePath(canonical, absolute)) throw cleanupRequired();
+  if (expected && !sameIdentity(entry, expected)) throw cleanupRequired();
+  return { dev: entry.dev, ino: entry.ino };
+}
+
+function inspectExactPath(path: string, parent: string, expected?: PathIdentity): PathIdentity {
+  const absolute = resolve(path);
+  if (!samePath(dirname(absolute), parent)) throw cleanupRequired();
+  const entry = lstatSync(absolute, { bigint: true });
+  if (!entry.isFile() || entry.isSymbolicLink() || entry.nlink !== 1n) throw cleanupRequired();
+  const canonical = realpathSync.native(absolute);
+  if (!samePath(canonical, absolute) || !samePath(dirname(canonical), parent)) throw cleanupRequired();
+  if (expected && !sameIdentity(entry, expected)) throw cleanupRequired();
+  return { dev: entry.dev, ino: entry.ino };
+}
+
+function exactResidues(parent: string, parentIdentity: PathIdentity): string[] {
+  inspectCanonicalParent(parent, parentIdentity);
+  const names = readdirSync(parent).filter(name => AUTH_TEMP_NAME.test(name)).sort();
+  inspectCanonicalParent(parent, parentIdentity);
+  if (names.length > MAX_AUTH_TEMP_RESIDUES) throw cleanupRequired();
+  return names;
+}
+
+function assertOpenIdentity(
+  fd: number,
+  path: string,
+  parent: string,
+  parentIdentity: PathIdentity,
+  expected: PathIdentity,
+  expectedLinks: bigint,
+): void {
+  inspectCanonicalParent(parent, parentIdentity);
+  const opened = fstatSync(fd, { bigint: true });
+  if (
+    !opened.isFile()
+    || !sameIdentity(opened, expected)
+    || opened.nlink !== expectedLinks
+  ) throw cleanupRequired();
+  inspectExactPath(path, parent, expected);
+  inspectCanonicalParent(parent, parentIdentity);
+}
+
+function scrubOne(
+  path: string,
+  parent: string,
+  parentIdentity: PathIdentity,
+  seam: NativeMainAuthTempScrubTestSeam,
+): void {
+  const observed = inspectExactPath(path, parent);
+  inspectCanonicalParent(parent, parentIdentity);
+  seam.beforeOpen?.(path);
+
+  const flags = process.platform === "win32"
+    ? fsConstants.O_RDWR
+    : fsConstants.O_RDWR | fsConstants.O_NOFOLLOW;
+  let fd: number | undefined;
+  let failed = false;
+  try {
+    fd = openSync(path, flags);
+    assertOpenIdentity(fd, path, parent, parentIdentity, observed, 1n);
+
+    ftruncateSync(fd, 0);
+    fsyncSync(fd);
+    const truncated = fstatSync(fd, { bigint: true });
+    if (!sameIdentity(truncated, observed) || truncated.nlink !== 1n || truncated.size !== 0n) {
+      throw cleanupRequired();
+    }
+    assertOpenIdentity(fd, path, parent, parentIdentity, observed, 1n);
+    seam.beforeUnlink?.(path);
+
+    // The lifetime owner and exclusive claim exclude cooperative OpenCodex writers.
+    // A malicious process running as the same OS user can still race Node's final
+    // identity-check/unlink gap and is intentionally outside this trusted-owner boundary.
+    unlinkSync(path);
+    const unlinked = fstatSync(fd, { bigint: true });
+    if (!sameIdentity(unlinked, observed) || unlinked.nlink !== 0n || unlinked.size !== 0n) {
+      throw cleanupRequired();
+    }
+    try {
+      lstatSync(path);
+      throw cleanupRequired();
+    } catch (error) {
+      if (error instanceof NativeProfileError) throw error;
+      if (errorCode(error) !== "ENOENT") throw error;
+    }
+    inspectCanonicalParent(parent, parentIdentity);
+  } catch (error) {
+    failed = true;
+    throw error;
+  } finally {
+    if (fd !== undefined) {
+      try { closeSync(fd); }
+      catch (error) { if (!failed) throw error; }
+    }
+  }
+}
+
+/**
+ * Remove only crash residues created by atomicWriteFileAsync for canonical auth.json.
+ * The caller must hold the lifetime native-main owner and exclusive credential claim.
+ */
+export function scrubNativeMainAuthTempResidues(
+  context: NativeProfileContext,
+  seam: NativeMainAuthTempScrubTestSeam = {},
+): NativeMainAuthTempScrubResult {
+  try {
+    const parent = resolve(context.codexHome);
+    const parentIdentity = inspectCanonicalParent(parent);
+    const names = exactResidues(parent, parentIdentity);
+    for (const name of names) {
+      scrubOne(join(parent, name), parent, parentIdentity, seam);
+    }
+    // A cooperative writer cannot create a new residue while the owner and
+    // exclusive claim are held. Seeing one now is ambiguous, so admission stays closed.
+    if (exactResidues(parent, parentIdentity).length !== 0) throw cleanupRequired();
+    return { scrubbed: names.length };
+  } catch (error) {
+    if (error instanceof NativeProfileError) throw error;
+    throw cleanupRequired();
+  }
+}