@mycadet/assistant 0.12.10 → 0.13.0

package/src/runtime/migrations/__tests__/vbundle-validator-v1-schema.test.ts

@@ -1,473 +0,0 @@
-/**
- * Tests for the v1-tightened `validateVBundle` schema.
- *
- * Covers:
- *   - Accepts a v1 ten-field manifest produced by `buildVBundle`.
- *   - Rejects every legacy six-field manifest shape.
- *   - Rejects when `schema_version` is anything other than `1`.
- *   - Enforces the cloud-mode redaction `.refine()` (`origin.mode === "managed" ⇒ secrets_redacted === true`).
- *   - Enforces the `data/db/assistant.db`-in-contents `.refine()`.
- *   - Rejects when the declared `checksum` doesn't match the recomputed self-checksum.
- */
-
-import { createHash } from "node:crypto";
-import { gzipSync } from "node:zlib";
-import { describe, expect, test } from "bun:test";
-
-import { buildVBundle } from "../vbundle-builder.js";
-import {
-  canonicalizeJson,
-  computeLegacyManifestSha256,
-  computeManifestChecksum,
-  MANIFEST_MAX_BYTES,
-  MANIFEST_MAX_ENTRIES,
-  ManifestSchema,
-  validateVBundle,
-} from "../vbundle-validator.js";
-import { buildTestManifest, defaultV1Options } from "./v1-test-helpers.js";
-
-// ---------------------------------------------------------------------------
-// Tar helpers — minimum-viable to wrap a manifest object into a vbundle.
-// ---------------------------------------------------------------------------
-
-const BLOCK = 512;
-
-function padToBlock(data: Uint8Array): Uint8Array {
-  const r = data.length % BLOCK;
-  if (r === 0) {
-    return data;
-  }
-  const out = new Uint8Array(data.length + (BLOCK - r));
-  out.set(data);
-  return out;
-}
-
-function writeOctal(
-  buf: Uint8Array,
-  offset: number,
-  length: number,
-  value: number,
-): void {
-  const s = value.toString(8).padStart(length - 1, "0");
-  for (let i = 0; i < s.length; i++) {
-    buf[offset + i] = s.charCodeAt(i);
-  }
-  buf[offset + length - 1] = 0;
-}
-
-function tarEntry(name: string, data: Uint8Array): Uint8Array {
-  const enc = new TextEncoder();
-  const header = new Uint8Array(BLOCK);
-  header.set(enc.encode(name).subarray(0, 100), 0);
-  writeOctal(header, 100, 8, 0o644);
-  writeOctal(header, 108, 8, 0);
-  writeOctal(header, 116, 8, 0);
-  writeOctal(header, 124, 12, data.length);
-  writeOctal(header, 136, 12, Math.floor(Date.now() / 1000));
-  header[156] = "0".charCodeAt(0);
-  header.set(enc.encode("ustar\0"), 257);
-  header[263] = "0".charCodeAt(0);
-  header[264] = "0".charCodeAt(0);
-  let sum = 0;
-  for (let i = 0; i < BLOCK; i++) {
-    sum += i >= 148 && i < 156 ? 0x20 : header[i];
-  }
-  writeOctal(header, 148, 7, sum);
-  header[155] = 0x20;
-  const padded = padToBlock(data);
-  const out = new Uint8Array(header.length + padded.length);
-  out.set(header, 0);
-  out.set(padded, header.length);
-  return out;
-}
-
-function tarArchive(
-  entries: Array<{ name: string; data: Uint8Array }>,
-): Uint8Array {
-  const parts: Uint8Array[] = entries.map((e) => tarEntry(e.name, e.data));
-  parts.push(new Uint8Array(BLOCK * 2));
-  const total = parts.reduce((n, p) => n + p.length, 0);
-  const out = new Uint8Array(total);
-  let off = 0;
-  for (const p of parts) {
-    out.set(p, off);
-    off += p.length;
-  }
-  return out;
-}
-
-function gzipTarOf(
-  manifestObj: Record<string, unknown>,
-  files: Array<{ name: string; data: Uint8Array }> = [],
-): Uint8Array {
-  const manifestData = new TextEncoder().encode(JSON.stringify(manifestObj));
-  return gzipSync(
-    tarArchive([{ name: "manifest.json", data: manifestData }, ...files]),
-  );
-}
-
-function sha256Hex(data: Uint8Array | string): string {
-  return createHash("sha256").update(data).digest("hex");
-}
-
-const DB_BYTES = new TextEncoder().encode("db-bytes");
-
-function v1Skeleton(): Record<string, unknown> {
-  return {
-    schema_version: 1,
-    bundle_id: "00000000-0000-4000-8000-000000000000",
-    created_at: "2026-04-01T00:00:00Z",
-    assistant: { id: "self", name: "Test", runtime_version: "0.0.0-test" },
-    origin: { mode: "self-hosted-local" },
-    compatibility: {
-      min_runtime_version: "0.0.0-test",
-      max_runtime_version: null,
-    },
-    contents: [
-      {
-        path: "data/db/assistant.db",
-        sha256: sha256Hex(DB_BYTES),
-        size_bytes: DB_BYTES.length,
-      },
-    ],
-    checksum: "",
-    secrets_redacted: false,
-    export_options: {
-      include_logs: false,
-      include_browser_state: false,
-      include_memory_vectors: false,
-    },
-  };
-}
-
-function withChecksum(
-  manifest: Record<string, unknown>,
-): Record<string, unknown> {
-  const checksum = computeManifestChecksum(manifest);
-  return { ...manifest, checksum };
-}
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-
-describe("ManifestSchema — v1 acceptance", () => {
-  test("accepts a freshly-built v1 manifest from buildVBundle", () => {
-    const { archive } = buildVBundle({
-      files: [{ path: "data/db/assistant.db", data: DB_BYTES }],
-      ...defaultV1Options(),
-    });
-    const result = validateVBundle(archive);
-    expect(result.is_valid).toBe(true);
-    expect(result.manifest?.schema_version).toBe(1);
-  });
-
-  test("accepts when origin.mode === 'managed' and secrets_redacted === true", () => {
-    const manifest = withChecksum({
-      ...v1Skeleton(),
-      origin: { mode: "managed" },
-      secrets_redacted: true,
-    });
-    const archive = gzipTarOf(manifest, [
-      { name: "data/db/assistant.db", data: DB_BYTES },
-    ]);
-    const result = validateVBundle(archive);
-    expect(result.is_valid).toBe(true);
-  });
-});
-
-describe("validateVBundle: streaming manifest limits", () => {
-  test("rejects a manifest over MANIFEST_MAX_BYTES with MANIFEST_TOO_LARGE", () => {
-    const oversized = new Uint8Array(MANIFEST_MAX_BYTES + 1).fill(0x20);
-    const archive = gzipSync(
-      tarArchive([{ name: "manifest.json", data: oversized }]),
-    );
-    const result = validateVBundle(archive, { enforceStreamingLimits: true });
-    expect(result.is_valid).toBe(false);
-    expect(result.errors.map((e) => e.code)).toEqual(["MANIFEST_TOO_LARGE"]);
-  });
-
-  test("rejects a manifest declaring more than MANIFEST_MAX_ENTRIES with MANIFEST_TOO_MANY_ENTRIES", () => {
-    const skeleton = v1Skeleton();
-    const dbEntry = (skeleton.contents as Array<Record<string, unknown>>)[0]!;
-    const extra = Array.from({ length: MANIFEST_MAX_ENTRIES }, (_, i) => ({
-      ...dbEntry,
-      path: `workspace/${i}`,
-    }));
-    const archive = gzipTarOf(
-      withChecksum({ ...skeleton, contents: [dbEntry, ...extra] }),
-    );
-    const result = validateVBundle(archive, { enforceStreamingLimits: true });
-    expect(result.is_valid).toBe(false);
-    expect(result.errors.map((e) => e.code)).toEqual([
-      "MANIFEST_TOO_MANY_ENTRIES",
-    ]);
-  });
-
-  test("does not apply the limits unless enforceStreamingLimits is set", () => {
-    const skeleton = v1Skeleton();
-    const dbEntry = (skeleton.contents as Array<Record<string, unknown>>)[0]!;
-    const extra = Array.from({ length: MANIFEST_MAX_ENTRIES }, (_, i) => ({
-      ...dbEntry,
-      path: `workspace/${i}`,
-    }));
-    const archive = gzipTarOf(
-      withChecksum({ ...skeleton, contents: [dbEntry, ...extra] }),
-      [{ name: "data/db/assistant.db", data: DB_BYTES }],
-    );
-    const result = validateVBundle(archive);
-    expect(result.errors.map((e) => e.code)).not.toContain(
-      "MANIFEST_TOO_MANY_ENTRIES",
-    );
-  });
-});
-
-describe("ManifestSchema — v1 rejection", () => {
-  test("rejects schema_version !== 1", () => {
-    const manifest = withChecksum({ ...v1Skeleton(), schema_version: 2 });
-    const archive = gzipTarOf(manifest, [
-      { name: "data/db/assistant.db", data: DB_BYTES },
-    ]);
-    const result = validateVBundle(archive);
-    expect(result.is_valid).toBe(false);
-  });
-
-  test("rejects managed mode with secrets_redacted=false", () => {
-    const manifest = withChecksum({
-      ...v1Skeleton(),
-      origin: { mode: "managed" },
-      secrets_redacted: false,
-    });
-    const archive = gzipTarOf(manifest, [
-      { name: "data/db/assistant.db", data: DB_BYTES },
-    ]);
-    const result = validateVBundle(archive);
-    expect(result.is_valid).toBe(false);
-  });
-
-  test("rejects manifest whose contents lacks data/db/assistant.db", () => {
-    const manifest = withChecksum({
-      ...v1Skeleton(),
-      contents: [
-        {
-          path: "config/settings.json",
-          sha256: sha256Hex(new TextEncoder().encode("{}")),
-          size_bytes: 2,
-        },
-      ],
-    });
-    const archive = gzipTarOf(manifest);
-    const result = validateVBundle(archive);
-    expect(result.is_valid).toBe(false);
-  });
-
-  test("rejects a checksum that does not match the recomputed self-checksum", () => {
-    // Build a structurally valid manifest but tamper with `checksum` after
-    // computing it so the validator's recomputation fails.
-    const valid = withChecksum(v1Skeleton());
-    const tampered = {
-      ...valid,
-      // Twiddle one byte; still 64 hex chars so the schema accepts it,
-      // but the recomputation rejects it.
-      checksum:
-        (valid.checksum as string).slice(0, -1) +
-        ((valid.checksum as string).slice(-1) === "0" ? "1" : "0"),
-    };
-    const archive = gzipTarOf(tampered, [
-      { name: "data/db/assistant.db", data: DB_BYTES },
-    ]);
-    const result = validateVBundle(archive);
-    expect(result.is_valid).toBe(false);
-    expect(
-      result.errors.some((e) => e.code === "MANIFEST_CHECKSUM_MISMATCH"),
-    ).toBe(true);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Legacy six-field manifest fallback — required for backwards compatibility
-// with on-disk bundles produced by pre-v1 runtimes (backup snapshots,
-// cross-version migration artifacts). AGENTS.md prohibits silent breaks of
-// persisted state.
-// ---------------------------------------------------------------------------
-
-function legacySkeleton(
-  files: Array<{ path: string; sha256: string; size: number }>,
-): Record<string, unknown> {
-  return {
-    schema_version: "1.0",
-    created_at: new Date().toISOString(),
-    source: "runtime-export",
-    description: "legacy fixture",
-    files,
-    manifest_sha256: "",
-  };
-}
-
-function withLegacyChecksum(
-  manifest: Record<string, unknown>,
-): Record<string, unknown> {
-  // `computeLegacyManifestSha256` strips the field internally before
-  // canonicalizing, so passing the manifest in unmodified is correct.
-  const manifest_sha256 = computeLegacyManifestSha256(manifest);
-  return { ...manifest, manifest_sha256 };
-}
-
-describe("ManifestSchema — legacy fallback (backwards compatibility)", () => {
-  test("accepts a valid legacy six-field manifest", () => {
-    const legacy = withLegacyChecksum(
-      legacySkeleton([
-        {
-          path: "data/db/assistant.db",
-          sha256: sha256Hex(DB_BYTES),
-          size: DB_BYTES.length,
-        },
-      ]),
-    );
-    const archive = gzipTarOf(legacy, [
-      { name: "data/db/assistant.db", data: DB_BYTES },
-    ]);
-    const result = validateVBundle(archive);
-    expect(result.is_valid).toBe(true);
-  });
-
-  test("rejects a legacy manifest with a wrong manifest_sha256", () => {
-    const legacy = {
-      ...legacySkeleton([
-        {
-          path: "data/db/assistant.db",
-          sha256: sha256Hex(DB_BYTES),
-          size: DB_BYTES.length,
-        },
-      ]),
-      // Deliberately wrong checksum.
-      manifest_sha256:
-        "0000000000000000000000000000000000000000000000000000000000000000",
-    };
-    const archive = gzipTarOf(legacy, [
-      { name: "data/db/assistant.db", data: DB_BYTES },
-    ]);
-    const result = validateVBundle(archive);
-    expect(result.is_valid).toBe(false);
-    expect(
-      result.errors.some((e) => e.code === "MANIFEST_CHECKSUM_MISMATCH"),
-    ).toBe(true);
-  });
-
-  test("translator surfaces a v1 ManifestType to downstream consumers", () => {
-    const legacy = withLegacyChecksum(
-      legacySkeleton([
-        {
-          path: "data/db/assistant.db",
-          sha256: sha256Hex(DB_BYTES),
-          size: DB_BYTES.length,
-        },
-      ]),
-    );
-    const archive = gzipTarOf(legacy, [
-      { name: "data/db/assistant.db", data: DB_BYTES },
-    ]);
-    const result = validateVBundle(archive);
-    expect(result.is_valid).toBe(true);
-    expect(result.manifest).toBeDefined();
-    // Translation fills in v1 fields and renames legacy fields.
-    expect(result.manifest?.schema_version).toBe(1);
-    expect(result.manifest?.contents).toHaveLength(1);
-    expect(result.manifest?.contents[0]?.path).toBe("data/db/assistant.db");
-    expect(result.manifest?.contents[0]?.size_bytes).toBe(DB_BYTES.length);
-    expect(result.manifest?.contents[0]?.sha256).toBe(sha256Hex(DB_BYTES));
-    // Conservative defaults so the v1 refines never trip.
-    expect(result.manifest?.origin.mode).toBe("self-hosted-local");
-    expect(result.manifest?.secrets_redacted).toBe(false);
-  });
-
-  test("legacy manifest with corrupted file payload still flags FILE_CHECKSUM_MISMATCH", () => {
-    // Verifies the per-file integrity pipeline runs on translated legacy
-    // bundles too — translation must preserve `files` → `contents` /
-    // `size` → `size_bytes` so verification works uniformly.
-    const legacy = withLegacyChecksum(
-      legacySkeleton([
-        {
-          path: "data/db/assistant.db",
-          sha256: sha256Hex(DB_BYTES),
-          size: DB_BYTES.length,
-        },
-      ]),
-    );
-    const corruptedDb = new TextEncoder().encode("not-the-real-db-bytes");
-    const archive = gzipTarOf(legacy, [
-      { name: "data/db/assistant.db", data: corruptedDb },
-    ]);
-    const result = validateVBundle(archive);
-    expect(result.is_valid).toBe(false);
-    expect(result.errors.some((e) => e.code === "FILE_CHECKSUM_MISMATCH")).toBe(
-      true,
-    );
-  });
-});
-
-describe("ManifestFileEntry — link_target field", () => {
-  test("accepts manifest entry with link_target", () => {
-    const manifest = buildTestManifest({
-      contents: [
-        {
-          path: "workspace/data/db/assistant.db",
-          sha256: sha256Hex(DB_BYTES),
-          size_bytes: 1,
-          link_target: "bar.md",
-        },
-      ],
-    });
-    const result = ManifestSchema.safeParse(manifest);
-    expect(result.success).toBe(true);
-    if (result.success) {
-      expect(result.data.contents[0]?.link_target).toBe("bar.md");
-    }
-  });
-
-  test("accepts manifest entry without link_target (backwards-compat)", () => {
-    const manifest = buildTestManifest({
-      contents: [
-        {
-          path: "workspace/data/db/assistant.db",
-          sha256: sha256Hex(DB_BYTES),
-          size_bytes: 1,
-        },
-      ],
-    });
-    const result = ManifestSchema.safeParse(manifest);
-    expect(result.success).toBe(true);
-  });
-
-  test("rejects manifest entry with empty link_target", () => {
-    const manifest = buildTestManifest({
-      contents: [
-        {
-          path: "workspace/data/db/assistant.db",
-          sha256: sha256Hex(DB_BYTES),
-          size_bytes: 1,
-          link_target: "",
-        },
-      ],
-    });
-    const result = ManifestSchema.safeParse(manifest);
-    expect(result.success).toBe(false);
-  });
-});
-
-// Exercise canonicalizeJson + computeManifestChecksum themselves to keep the
-// helpers from rotting if signatures change.
-describe("computeManifestChecksum helper", () => {
-  test("ignores the existing checksum value when computing the canonical form", () => {
-    const a = withChecksum(v1Skeleton());
-    const b = withChecksum({ ...v1Skeleton(), checksum: "deadbeef" });
-    // Both inputs canonicalize to the same form (checksum field replaced by
-    // empty string), so both produce the same checksum.
-    expect(a.checksum).toBe(b.checksum);
-    // Sanity: the same canonicalization explanation as in the validator.
-    const expected = sha256Hex(
-      canonicalizeJson({ ...v1Skeleton(), checksum: "" }),
-    );
-    expect(a.checksum).toBe(expected);
-  });
-});

package/src/runtime/migrations/gcs-signed-url.ts

@@ -1,190 +0,0 @@
-/**
- * Validator for Google Cloud Storage signed URLs.
- *
- * Used by the migrations import path to confirm that a URL the daemon is
- * about to `fetch()` is, in fact, a signed GCS object URL (and not an
- * attacker-chosen host, scheme, or path).
- *
- * This is a pure function — no I/O, no side effects. The caller decides
- * what to do with the validation result.
- *
- * What we check:
- *   - The string parses as a URL.
- *   - The scheme is `https:` (no `http:`, `file:`, `data:`, etc.).
- *   - The hostname is exactly `storage.googleapis.com`.
- *   - No explicit port is present (the default HTTPS port is required;
- *     WHATWG URL normalizes `:443` to an empty port string for HTTPS).
- *   - The URL carries a signature query param — `X-Goog-Signature` (GCS
- *     V4) or `Signature` (GCS V2); for hosts on a non-default allowlist
- *     (local/minikube SeaweedFS) SigV4's `X-Amz-Signature` is also
- *     accepted. A URL with no signature param is not a presigned URL and
- *     is refused.
- *   - The pathname does not contain `..` segments (traversal guard).
- *
- * On success we return the hostname and pathname for logging/telemetry.
- * We deliberately do NOT return the full URL or the query string,
- * because the signature is sensitive and should not end up in logs.
- */
-
-export type GcsUrlValidation =
-  | { ok: true; host: string; path: string }
-  | { ok: false; reason: string };
-
-const EXPECTED_HOST = "storage.googleapis.com";
-const DEFAULT_ALLOWED_HOSTS: readonly string[] = [EXPECTED_HOST];
-
-export interface ValidateGcsSignedUrlOptions {
-  /**
-   * Allowlisted hosts. Defaults to `["storage.googleapis.com"]` — the only
-   * production value. A non-default list (local/minikube via
-   * `CADET_MIGRATION_IMPORT_ALLOWED_HOSTS`, or tests pointing at a local
-   * HTTP fixture) relaxes the `scheme` check to accept `http:`, skips the
-   * explicit-port check, and skips the signature-param requirement for the
-   * listed hosts. Production code MUST NOT pass a wider list.
-   */
-  allowedHosts?: readonly string[];
-}
-
-export function validateGcsSignedUrl(
-  raw: string,
-  options?: ValidateGcsSignedUrlOptions,
-): GcsUrlValidation {
-  let parsed: URL;
-  try {
-    parsed = new URL(raw);
-  } catch {
-    return { ok: false, reason: "invalid_url" };
-  }
-
-  const allowedHosts = options?.allowedHosts ?? DEFAULT_ALLOWED_HOSTS;
-  const isDefaultHostList =
-    allowedHosts.length === 1 && allowedHosts[0] === EXPECTED_HOST;
-
-  // When the allowlist is the production default (GCS only), require HTTPS.
-  // When a caller passes a non-default allowlist (tests pointing at a local
-  // HTTP server), allow http too — same-process tests cannot reasonably
-  // stand up HTTPS. We still refuse non-http(s) schemes (file:, data:, etc).
-  if (isDefaultHostList) {
-    if (parsed.protocol !== "https:") {
-      return { ok: false, reason: "scheme" };
-    }
-  } else {
-    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
-      return { ok: false, reason: "scheme" };
-    }
-  }
-
-  if (!allowedHosts.includes(parsed.hostname)) {
-    return { ok: false, reason: "host" };
-  }
-
-  // Reject any explicit port. GCS signed URLs use the default HTTPS
-  // port (443), and WHATWG URL normalizes `:443` to an empty port
-  // string for HTTPS — so a correctly-issued signed URL always has
-  // `parsed.port === ""`. A non-empty port indicates an attacker is
-  // trying to redirect the fetch to a non-default port (SSRF vector).
-  //
-  // For the non-default (test) allowlist, an explicit port is expected
-  // (local servers bind to arbitrary ephemeral ports), so the check is
-  // skipped in that case.
-  if (isDefaultHostList && parsed.port !== "") {
-    return { ok: false, reason: "port" };
-  }
-
-  // Every URL must carry a signature param — possession of a complete
-  // presigned URL is the capability, and this shape check keeps unsigned
-  // object paths from being fetched/PUT even on allowlisted hosts. GCS
-  // signs with X-Goog-Signature (V4) or Signature (V2); S3-compatible
-  // backends behind a non-default allowlist (local/minikube SeaweedFS)
-  // sign with X-Amz-Signature (SigV4), which is only accepted for
-  // explicitly allowlisted hosts. The storage backend itself verifies the
-  // signature; this validator only checks the shape.
-  const hasV4 = parsed.searchParams.has("X-Goog-Signature");
-  const hasV2 = parsed.searchParams.has("Signature");
-  const hasSigV4 =
-    !isDefaultHostList && parsed.searchParams.has("X-Amz-Signature");
-  if (!hasV4 && !hasV2 && !hasSigV4) {
-    return { ok: false, reason: "missing_signature" };
-  }
-
-  // Defense-in-depth: reject any `..` path segment. The WHATWG URL
-  // parser silently normalizes `/bucket/../foo` to `/foo`, which would
-  // hide a traversal attempt — so inspect the *raw* input before
-  // normalization in addition to the parsed pathname.
-  if (hasTraversalSegment(parsed.pathname) || hasTraversalInRawPath(raw)) {
-    return { ok: false, reason: "path_traversal" };
-  }
-
-  return { ok: true, host: parsed.hostname, path: parsed.pathname };
-}
-
-function hasTraversalSegment(pathname: string): boolean {
-  for (const segment of pathname.split("/")) {
-    if (segment === "..") {
-      return true;
-    }
-  }
-  return false;
-}
-
-/**
- * Look for `..` path segments in the raw input before URL normalization.
- * We slice off the scheme+authority and stop at the first `?` or `#`,
- * then examine each segment split on both `/` and `\` (the WHATWG URL
- * parser treats `\` as equivalent to `/` for special schemes like
- * `https:`, so a backslash-delimited traversal would be normalized
- * away by `new URL()`).
- *
- * Inside each segment we also handle percent-encoded separators
- * (`%2F` = `/`, `%5C` = `\`): we pre-normalize those before the
- * top-level split, and we also re-split each decoded segment on `/`
- * and `\` to catch cases like `%2e%2e%2fother` where the encoded
- * slash hides a traversal within a single raw segment.
- */
-function hasTraversalInRawPath(raw: string): boolean {
-  const schemeEnd = raw.indexOf("://");
-  if (schemeEnd === -1) {
-    return false;
-  }
-  const afterScheme = raw.slice(schemeEnd + 3);
-  const pathStart = afterScheme.search(/[\/\\]/);
-  if (pathStart === -1) {
-    return false;
-  }
-  let path = afterScheme.slice(pathStart);
-  const queryIdx = path.indexOf("?");
-  if (queryIdx !== -1) {
-    path = path.slice(0, queryIdx);
-  }
-  const hashIdx = path.indexOf("#");
-  if (hashIdx !== -1) {
-    path = path.slice(0, hashIdx);
-  }
-
-  // Normalize percent-encoded forms of `/` and `\` so that encoded
-  // separators participate in the segment split.
-  const normalized = path.replace(/%2[fF]/g, "/").replace(/%5[cC]/g, "\\");
-
-  for (const segment of normalized.split(/[\/\\]/)) {
-    if (segment === "..") {
-      return true;
-    }
-    // Percent-decoded forms of ".." — e.g. "%2E%2E", ".%2e", "%2e.".
-    // Also re-split on `/` and `\` to catch encoded separators that
-    // weren't covered by the top-level normalization (e.g. a decoded
-    // segment `../other`).
-    let decoded: string;
-    try {
-      decoded = decodeURIComponent(segment);
-    } catch {
-      // Ignore malformed percent-encoding; URL parser would handle it.
-      continue;
-    }
-    for (const sub of decoded.split(/[\/\\]/)) {
-      if (sub === "..") {
-        return true;
-      }
-    }
-  }
-  return false;
-}