@logicseek/hello-cc 1.0.2 → 1.1.0-rc.1

package/lib/db/connection.mjs

@@ -5,6 +5,7 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
+import process from 'node:process';
 import { DatabaseSync } from 'node:sqlite';
 import { CliError } from '../shared/errors.mjs';
 import {
@@ -13,26 +14,143 @@ import {
 } from './schema.mjs';
 import { initSchemaWithBackup } from './migration-backup.mjs';
 import { readProjectRegistry } from '../runtime/projects.mjs';
-import { resolveProjectDatabase } from '../runtime/project-path.mjs';
+import { resolveProjectDatabase, secureExistingProjectStateDirectory } from '../runtime/project-path.mjs';
+import { projectStateDir, legacyProjectStateDir } from '../runtime/paths.mjs';
+import { privateProjectStateDir, ensurePrivateProjectStateDir } from '../runtime/private-state.mjs';
+import { unsafeDirectoryAcl } from '../runtime/project-trust.mjs';
 
 const MIGRATION_FAILURE_COOLDOWN_MS = 5 * 60 * 1000;
 
+function managedDatabase(ctx) {
+  if (!ctx.root) return false;
+  const requestedRoot = path.resolve(ctx.root);
+  let canonicalRoot = requestedRoot;
+  try { canonicalRoot = fs.realpathSync.native(requestedRoot); } catch {}
+  const requestedDb = path.resolve(ctx.dbPath);
+  let canonicalCandidate = requestedDb;
+  try {
+    canonicalCandidate = path.join(fs.realpathSync.native(path.dirname(requestedDb)), path.basename(requestedDb));
+  } catch {}
+  return [requestedRoot, canonicalRoot].some(root =>
+    [legacyProjectStateDir(root), privateProjectStateDir(root)].some(stateDir =>
+      [requestedDb, canonicalCandidate].some(db => {
+        const relative = path.relative(stateDir, db);
+        return relative !== '' && relative !== '..' &&
+          !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+      })));
+}
+
+function secureOwnedSqliteFile(file, { create = false, readOnly = false, optional = false } = {}) {
+  const changed = () => new CliError('PROJECT_PATH_FORBIDDEN', `SQLite file changed during validation: ${file}`);
+  const safeStat = stat => stat && !stat.isSymbolicLink() && stat.isFile() && stat.nlink === 1 &&
+    (typeof process.getuid !== 'function' || stat.uid === process.getuid()) &&
+    (process.platform === 'win32' || (stat.mode & 0o022) === 0) &&
+    !unsafeDirectoryAcl(file, stat);
+  const stillSame = (current, original) => safeStat(current) &&
+    current.dev === original.dev && current.ino === original.ino;
+  const recheck = () => {
+    try { return fs.lstatSync(file); }
+    catch (error) {
+      if (!optional || error?.code !== 'ENOENT') throw error;
+      // An optional WAL/SHM/journal may disappear as SQLite closes its last
+      // connection. Do not accept a different file rebuilt at the same path.
+      try { fs.lstatSync(file); }
+      catch (again) {
+        if (again?.code === 'ENOENT') return null;
+        throw again;
+      }
+      throw changed();
+    }
+  };
+  let stat;
+  try { stat = fs.lstatSync(file); }
+  catch (error) {
+    if (error?.code !== 'ENOENT') throw error;
+    if (!create) return false;
+    try {
+      const fd = fs.openSync(file, fs.constants.O_RDWR | fs.constants.O_CREAT |
+        fs.constants.O_EXCL | (fs.constants.O_NOFOLLOW || 0), 0o600);
+      fs.closeSync(fd);
+    } catch (creationError) {
+      if (creationError?.code !== 'EEXIST') throw creationError;
+    }
+    stat = fs.lstatSync(file);
+  }
+  if (!safeStat(stat)) {
+    // ACL inspection invokes ls and may outlive a retiring optional sidecar.
+    // Missing is safe to skip; a rebuilt or otherwise unsafe file is not.
+    if (optional && !recheck()) return false;
+    throw new CliError('PROJECT_PATH_FORBIDDEN', `SQLite file must be an owned non-writable regular file: ${file}`);
+  }
+  // Never open/close an existing SQLite file outside SQLite: on POSIX, close()
+  // can release locks held by another SQLite connection in this process.
+  const current = recheck();
+  if (!current) return false;
+  if (!stillSame(current, stat)) throw changed();
+  if (!readOnly && process.platform !== 'win32' && (current.mode & 0o777) !== 0o600) {
+    try { fs.chmodSync(file, 0o600); }
+    catch (error) {
+      if (!optional || error?.code !== 'ENOENT') throw error;
+      if (!recheck()) return false;
+      throw changed();
+    }
+    const tightened = recheck();
+    if (!tightened) return false;
+    if (!stillSame(tightened, stat) || (tightened.mode & 0o777) !== 0o600) throw changed();
+  }
+  return true;
+}
+
+function secureManagedDatabaseFile(dbPath, create, readOnly = false) {
+  if (!secureOwnedSqliteFile(dbPath, { create, readOnly })) {
+    throw new CliError('NOT_FOUND', `Project database does not exist: ${dbPath}`);
+  }
+  for (const suffix of ['-wal', '-shm', '-journal']) {
+    secureOwnedSqliteFile(`${dbPath}${suffix}`, { readOnly, optional: true });
+  }
+}
+
 export function createConnectionHelpers({ now, dedupePeerBindings, redactedLogText }) {
   let projectMigrationFanoutDepth = 0;
   const migratedRegisteredProjectDbs = new Set();
 
   function connect(ctx, options = {}) {
-    if (options.create === false && !fs.existsSync(ctx.dbPath)) {
-      throw new CliError('NOT_FOUND', `Project database does not exist: ${ctx.dbPath}`);
+    let dbPath = ctx.dbPath;
+    if (managedDatabase(ctx)) {
+      const rootWasMissing = options.create !== false && !fs.existsSync(ctx.root);
+      const pendingDefault = rootWasMissing ? path.join(privateProjectStateDir(ctx.root), 'mesh.db') : null;
+      if (options.create !== false && !fs.existsSync(ctx.root)) {
+        fs.mkdirSync(ctx.root, { recursive: true });
+      }
+      if (rootWasMissing && path.resolve(dbPath) === pendingDefault) {
+        dbPath = path.join(projectStateDir(ctx.root), 'mesh.db');
+      }
+      if (rootWasMissing && path.resolve(ctx.dbPath) === pendingDefault &&
+          projectStateDir(ctx.root) === privateProjectStateDir(ctx.root)) {
+        ensurePrivateProjectStateDir(ctx.root, { create: true });
+      }
+      const resolved = resolveProjectDatabase({
+        root: ctx.root,
+        db: dbPath,
+        createStateDir: options.create !== false,
+        createDatabaseParents: options.create !== false
+      });
+      dbPath = resolved.db;
+      if (options.create === false) secureExistingProjectStateDirectory(resolved.root);
+      secureManagedDatabaseFile(dbPath, options.create !== false);
+    } else {
+      if (options.create === false && !fs.existsSync(dbPath)) {
+        throw new CliError('NOT_FOUND', `Project database does not exist: ${dbPath}`);
+      }
+      if (options.create !== false) fs.mkdirSync(path.dirname(dbPath), { recursive: true });
     }
-    if (options.create !== false) fs.mkdirSync(path.dirname(ctx.dbPath), { recursive: true });
-    const db = new DatabaseSync(ctx.dbPath, { timeout: 5000 });
+    const db = new DatabaseSync(dbPath, { timeout: 5000 });
     db.exec('PRAGMA busy_timeout = 5000;');
     execWithBusyRetry(db, 'PRAGMA journal_mode = WAL;', { ignoreBusy: true });
     db.exec('PRAGMA synchronous = NORMAL;');
     db.exec('PRAGMA wal_autocheckpoint = 1000;');
     db.exec('PRAGMA foreign_keys = ON;');
-    initSchemaWithBackup(db, ctx.dbPath, {
+    initSchemaWithBackup(db, dbPath, {
       beforePostMigrationIndexes: dedupePeerBindings
     });
     if (options.migrateRegistered !== false) migrateRegisteredProjectDbs(ctx);
@@ -40,10 +158,15 @@ export function createConnectionHelpers({ now, dedupePeerBindings, redactedLogTe
   }
 
   function connectReadOnly(ctx) {
-    if (!fs.existsSync(ctx.dbPath) || !fs.statSync(ctx.dbPath).isFile()) {
-      throw new CliError('NOT_FOUND', `Project database does not exist: ${ctx.dbPath}`);
+    const managed = managedDatabase(ctx);
+    const dbPath = managed
+      ? resolveProjectDatabase({ root: ctx.root, db: ctx.dbPath, createStateDir: false }).db
+      : ctx.dbPath;
+    if (!fs.existsSync(dbPath) || !fs.statSync(dbPath).isFile()) {
+      throw new CliError('NOT_FOUND', `Project database does not exist: ${dbPath}`);
     }
-    return new DatabaseSync(ctx.dbPath, { timeout: 5000, readOnly: true });
+    if (managed) secureManagedDatabaseFile(dbPath, false, true);
+    return new DatabaseSync(dbPath, { timeout: 5000, readOnly: true });
   }
 
   function migrateRegisteredProjectDbs(ctx) {
@@ -57,7 +180,7 @@ export function createConnectionHelpers({ now, dedupePeerBindings, redactedLogTe
         try {
           resolved = resolveProjectDatabase({
             root: project.root,
-            db: project.db || path.join(project.root, '.hello-cc', 'mesh.db'),
+            db: project.db || path.join(projectStateDir(project.root), 'mesh.db'),
             createStateDir: false
           });
         } catch (err) {
@@ -77,6 +200,8 @@ export function createConnectionHelpers({ now, dedupePeerBindings, redactedLogTe
         } catch {}
         let db = null;
         try {
+          secureExistingProjectStateDirectory(root);
+          secureManagedDatabaseFile(dbPath, false);
           db = new DatabaseSync(dbPath, { timeout: 5000 });
           db.exec('PRAGMA busy_timeout = 5000;');
           execWithBusyRetry(db, 'PRAGMA journal_mode = WAL;', { ignoreBusy: true });

package/lib/db/schema.mjs

@@ -1,7 +1,9 @@
 import { aggregateCleanupFailure } from '../shared/cleanup-error.mjs';
+import { automaticResultKey } from '../shared/automatic-result-key.mjs';
 import { CliError } from '../shared/errors.mjs';
 
 export const DB_SCHEMA_VERSION = 7;
+const AUTOMATIC_RESULT_SCRUB_KEY = 'automatic_result_content_scrub_v1';
 
 const sleepBuffer = new SharedArrayBuffer(4);
 const sleepView = new Int32Array(sleepBuffer);
@@ -125,6 +127,63 @@ export function initSchema(db, {
   runSchemaMigrations(db);
   if (typeof beforePostMigrationIndexes === 'function') beforePostMigrationIndexes(db);
   createPostMigrationIndexes(db);
+  scrubAutomaticTaskResults(db);
+}
+
+function scrubAutomaticTaskResults(db) {
+  const marker = db.prepare('SELECT 1 FROM meta WHERE key = ?');
+  if (marker.get(AUTOMATIC_RESULT_SCRUB_KEY)) return;
+  tx(db, () => {
+    if (marker.get(AUTOMATIC_RESULT_SCRUB_KEY)) return;
+    const read = db.prepare("SELECT id,payload,created_at FROM events WHERE type = 'task.result.recorded' AND id > ? ORDER BY id LIMIT 100");
+    const update = db.prepare('UPDATE events SET payload = ? WHERE id = ?');
+    let lastId = 0;
+    while (true) {
+      const rows = read.all(lastId);
+      if (!rows.length) break;
+      for (const row of rows) {
+        let record;
+        try { record = JSON.parse(row.payload); } catch { continue; }
+        if (record?.source !== 'executor' || record.stage !== 'local' ||
+            !['command', 'diff'].includes(record.kind) ||
+            typeof record.executor_id !== 'string' || !record.executor_id ||
+            typeof record.thread_id !== 'string' || !record.thread_id ||
+            typeof record.turn_id !== 'string' || !record.turn_id ||
+            typeof record.result_key !== 'string') continue;
+        // Legacy Web observer keys identify these records more precisely than
+        // source/kind/turn metadata, which an explicit result may also carry.
+        const commandKey = `${record.executor_id}:${record.turn_id}:${record.item_id}:command`;
+        const diffPrefix = `${record.executor_id}:${record.turn_id}:diff:`;
+        const legacyCommand = record.kind === 'command' && typeof record.item_id === 'string' &&
+          record.item_id && record.result_key === commandKey;
+        const legacyDiff = record.kind === 'diff' && record.title === 'Turn changes awaiting review' &&
+          record.result_key.startsWith(diffPrefix) &&
+          /^[a-f0-9]{64}$/.test(record.result_key.slice(diffPrefix.length));
+        if (!legacyCommand && !legacyDiff) continue;
+        const executorId = typeof record.executor_id === 'string' ? record.executor_id : null;
+        const turnId = typeof record.turn_id === 'string' ? record.turn_id : null;
+        const itemId = typeof record.item_id === 'string' ? record.item_id : null;
+        // Distinct old diff hashes may become the same structural key. Keep the
+        // historical rows; result-key lookup already chooses the latest ID.
+        const resultKey = automaticResultKey({ executorId,
+          threadId: typeof record.thread_id === 'string' ? record.thread_id : null,
+          turnId, kind: record.kind, itemId: record.kind === 'command' ? itemId : null });
+        update.run(JSON.stringify({
+          result_id: record.result_id, result_key: resultKey,
+          peer: record.peer, task_id: record.task_id, stage: 'local', status: record.status,
+          kind: record.kind, source: 'executor',
+          title: record.kind === 'command' ? 'Command execution' : 'Turn changes awaiting review',
+          details: '', evidence: [], command: '', diff: '',
+          executor_id: executorId, thread_id: record.thread_id, turn_id: turnId,
+          item_id: record.kind === 'command' ? itemId : null,
+          exit_code: Number.isSafeInteger(record.exit_code) ? record.exit_code : null,
+          created_at: row.created_at
+        }), row.id);
+      }
+      lastId = rows.at(-1).id;
+    }
+    db.prepare('INSERT INTO meta(key,value) VALUES (?,?)').run(AUTOMATIC_RESULT_SCRUB_KEY, '1');
+  });
 }
 
 function createBaseSchema(db) {

package/lib/discover.mjs

@@ -11,6 +11,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
 import { spawnSync } from 'node:child_process';
+import { providerSessionPeerId } from './core/peers/session.mjs';
 
 // ─── Root detection ──────────────────────────────────────────────────────────
 
@@ -33,9 +34,8 @@ function fsExists(p) {
  * Derive a stable peer ID.
  *
  * Stability contract:
- *   - `claude --resume <old-id>`  →  claude-<old-id[:8]>   (same across restarts)
- *   - `codex resume <id>`         →  codex-<id[:8]>         (same across restarts)
- *   - fresh session               →  <kind>-<sessionId[:8]> (unique per session)
+ *   - provider session ID/name → the same full-value hash used by hooks/shims
+ *   - fresh session            → the same stable provider identity
  */
 export function derivePeerId(kind, sessionId, resumeId, explicitPeer = null) {
   if (explicitPeer) return explicitPeer;
@@ -44,7 +44,7 @@ export function derivePeerId(kind, sessionId, resumeId, explicitPeer = null) {
   if (process.env.HCC_PEER) return process.env.HCC_PEER;
 
   const base = resumeId || sessionId;
-  if (base && base.length >= 4) return `${kind}-${base.slice(0, 8)}`;
+  if (base) return providerSessionPeerId(kind, base);
 
   // Fallback: tty device number or pid
   const ttyNum = getTtyNum();

package/lib/guidance.mjs

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { resolveProjectDatabase } from './runtime/project-path.mjs';
 
 export function guidanceMarkdown() {
   return `# hello-cc Coordination Rules
@@ -84,8 +85,8 @@ Before stopping:
 }
 
 export function writeGuidance(root) {
-  const guidePath = path.join(root, '.hello-cc', 'HCC.md');
-  fs.mkdirSync(path.dirname(guidePath), { recursive: true });
+  const stateDir = resolveProjectDatabase({ root, createStateDir: true }).stateDir;
+  const guidePath = path.join(stateDir, 'HCC.md');
   const content = guidanceMarkdown();
   fs.writeFileSync(guidePath, content);
   const clause = `\n<!-- hello-cc:start -->\n\n${content}\n<!-- hello-cc:end -->\n`;

package/lib/integrations/codex-interactions.mjs

@@ -1,3 +1,7 @@
+import { createMcpFormValidator } from './mcp-elicitation.mjs';
+import { createMcpUrlValidator } from './mcp-url-elicitation.mjs';
+
+const mcpForms = createMcpFormValidator(), mcpUrls = createMcpUrlValidator();
 // Shared validation for the official App Server command/file/permissions/input
 // server requests. Human responses may narrow a request, never widen it.
 export const CODEX_INTERACTION_METHODS = new Set([
@@ -37,20 +41,18 @@ function subset(selected, requested) {
     fail('Granted permissions must be an exact subset of the requested permissions');
   }
 }
-// Codex 0.144.6 hosts MCP tool approvals as an empty form elicitation.
-// Return the official action/content shape. Do not persist permission in _meta,
-// and do not pretend arbitrary form fields or URL authentication were answered.
+// Reply only to the correlated request. URL acceptance has no form content or
+// authentication result; the MCP server owns completion of the external flow.
 function mcpResponse(request, input) {
-  if (!['accept', 'decline', 'cancel'].includes(input.decision)) fail('An MCP approval decision is required');
+  if (!['accept', 'decline', 'cancel'].includes(input.decision)) fail('An MCP decision is required');
   if (input.decision !== 'accept') return { action: input.decision };
-  const params = request.params, schema = params?.requestedSchema;
-  if (params?.mode !== 'form' || params?._meta?.codex_approval_kind !== 'mcp_tool_call' ||
-      !object(schema) || schema.type !== 'object' || !object(schema.properties) ||
-      Object.keys(schema.properties).length || (schema.required?.length || 0) ||
-      Object.keys(schema).some(key => !['type', 'properties', 'required', 'additionalProperties'].includes(key))) {
-    fail('Only an explicit empty-form MCP tool approval is supported; decline or cancel other elicitations');
+  if (request.params?.mode === 'url') {
+    mcpUrls.describe(request.params);
+    if (input.content !== undefined || input.answers !== undefined || input.permissions !== undefined) fail('MCP URL responses cannot contain form content or permissions');
+    return { action: 'accept' };
   }
-  return { action: 'accept', content: {} };
+  const { fields } = mcpForms.describe(request.params);
+  return { action: 'accept', content: mcpForms.validate(request.params, input.content === undefined && !fields.length ? {} : input.content) };
 }
 
 function permissionsResponse(request, input) {

package/lib/integrations/dsh-collaboration.mjs

@@ -153,18 +153,12 @@ export function createDshCollaboration({ sessionId, cwd, maxContextChars = 16000
     dispose() {
       if (disposed) return;
       retiring = true;
-      try {
-        owned(db => {
-          peers.touchPeer(db, peer, 'exited');
-          db.prepare('UPDATE peer_bindings SET runtime_target = NULL, updated_at = ? WHERE peer = ? AND runtime_target = ?').run(now(), peer, owner);
-          addEvent(db, 'dsh.cordis.closed', peer, null, { session_id: sessionId });
-        }, true, true);
-        disposed = true;
-      } catch (error) {
-        // A lost generation cannot be retried; storage failures can be.
-        if (error?.code === 'DSH_COLLABORATION_CONFLICT') disposed = true;
-        throw error;
-      }
+      owned(db => {
+        peers.touchPeer(db, peer, 'exited');
+        db.prepare('UPDATE peer_bindings SET runtime_target = NULL, updated_at = ? WHERE peer = ? AND runtime_target = ?').run(now(), peer, owner);
+        addEvent(db, 'dsh.cordis.closed', peer, null, { session_id: sessionId });
+      }, true, true);
+      disposed = true;
     }
   };
 }

package/lib/integrations/dsh-cordis.mjs

@@ -10,8 +10,20 @@ export const name = 'hello-cc-dsh-collaboration';
 export const inject = ['agents', 'tools', 'sessions'];
 export const DSH_CORDIS_VERSION = '0.2.0-rc.2';
 
-const failedRetirements = new Map();
-const disposedAgents = new WeakSet();
+// A failed retirement is retried only after exact Agent disposal, or by that
+// same Agent after its previous plugin context has been disposed.
+const retirementRegistryKey = Symbol.for('@logicseek/hello-cc/dsh-cordis/retirements/v1');
+if (!Object.hasOwn(globalThis, retirementRegistryKey)) {
+  Object.defineProperty(globalThis, retirementRegistryKey, {
+    value: Object.freeze({ failedRetirements: new Map(), disposedAgents: new WeakSet() })
+  });
+}
+const retirementRegistry = globalThis[retirementRegistryKey];
+if (!(retirementRegistry?.failedRetirements instanceof Map) ||
+    !(retirementRegistry?.disposedAgents instanceof WeakSet)) {
+  throw new Error('Invalid hello-cc Cordis retirement registry');
+}
+const { failedRetirements, disposedAgents } = retirementRegistry;
 
 function retire(agent, state, { agentDisposed = false, contextDisposed = false }, forget) {
   let entry = failedRetirements.get(agent);
@@ -22,17 +34,9 @@ function retire(agent, state, { agentDisposed = false, contextDisposed = false }
     if (agentDisposed) entry.agentDisposed = true;
     if (contextDisposed) entry.contextDisposed = true;
   }
-  try {
-    entry.state.dispose();
-    entry.forget();
-    failedRetirements.delete(agent);
-  } catch (error) {
-    if (error?.code === 'DSH_COLLABORATION_CONFLICT') {
-      entry.forget();
-      failedRetirements.delete(agent);
-    }
-    throw error;
-  }
+  entry.state.dispose();
+  entry.forget();
+  failedRetirements.delete(agent);
 }
 
 function retryRetirements(candidate) {

package/lib/integrations/dsh.mjs

@@ -8,6 +8,8 @@ import { CliError } from '../shared/errors.mjs';
 import { withFileLock } from '../shared/file-lock.mjs';
 import { commandPath } from '../cli-runtime.mjs';
 import { shellQuoteArg } from '../format.mjs';
+import { resolveProjectDatabase, ensurePrivateProjectStateSubdirectory } from '../runtime/project-path.mjs';
+import { unsafeDirectoryAcl } from '../runtime/project-trust.mjs';
 
 export const DSH_BASELINE_VERSION = '0.2.0-rc.2';
 export const DSH_INSTALL_HINT = `npm install -g @deepseek-ai/dsh@${DSH_BASELINE_VERSION}`;
@@ -42,16 +44,14 @@ function integrationPaths(ctx, create = false) {
   try { root = fs.realpathSync(ctx.root); }
   catch { throw new CliError('BAD_ARGS', `Project root does not exist: ${ctx.root}`); }
   if (!fs.statSync(root).isDirectory()) throw new CliError('BAD_ARGS', `Project root is not a directory: ${root}`);
-  const stateDir = path.join(root, '.hello-cc');
+  const stateDir = resolveProjectDatabase({ root, createStateDir: create }).stateDir;
   const directory = path.join(stateDir, 'dsh');
+  // DSH artifacts are opened and renamed by pathname. Their parent must be
+  // owned and non-rebindable by another OS user before either operation.
+  ensurePrivateProjectStateSubdirectory(root, 'dsh', { create });
   const parents = [];
   for (const dir of [root, stateDir, directory]) {
-    let stat = lstat(dir);
-    if (!stat && create) {
-      try { fs.mkdirSync(dir, { mode: 0o700 }); }
-      catch (error) { if (error.code !== 'EEXIST') throw error; }
-      stat = lstat(dir);
-    }
+    const stat = lstat(dir);
     if (stat && (!stat.isDirectory() || stat.isSymbolicLink())) {
       throw forbidden(dir, 'expected an ordinary directory, found a symlink or other object');
     }
@@ -75,8 +75,11 @@ function readArtifact(paths, name) {
   const file = path.join(paths.directory, name);
   const stat = lstat(file);
   if (!stat) return null;
-  if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) {
-    throw forbidden(file, 'expected an ordinary file with no symlink or hard-link alias');
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 ||
+      (typeof process.getuid === 'function' && stat.uid !== process.getuid()) ||
+      (process.platform !== 'win32' && (stat.mode & 0o777) !== 0o600) ||
+      unsafeDirectoryAcl(file, stat)) {
+    throw forbidden(file, 'expected an owned private file with no symlink or hard-link alias');
   }
   const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0));
   try {