@pasko70/pibo 2.0.0 → 2.2.0

package/dist/auth/better-auth.js

@@ -1,11 +1,12 @@
-import { mkdirSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, rmSync } from "node:fs";
 import { dirname, resolve } from "node:path";
-import { DatabaseSync } from "node:sqlite";
+import { backup, DatabaseSync } from "node:sqlite";
 import { betterAuth } from "better-auth";
 import { getMigrations } from "better-auth/db/migration";
 import { bearer } from "better-auth/plugins";
 import { loadPiboConfig } from "../config/config.js";
-import { piboHomePath } from "../core/pibo-home.js";
+import { ensurePrivatePiboHomeForPath, piboHomePath } from "../core/pibo-home.js";
+import { protectPrivateFileSync } from "../core/private-path.js";
 import { createMachineKeyAuthenticator } from "./machine-keys.js";
 import { createMachineSessionManager } from "./machine-session.js";
 import { createForbiddenAuthError, createUnauthenticatedError } from "./types.js";
@@ -42,10 +43,167 @@ function createAllowedEmailSet(emails) {
 }
 function createDatabase(path) {
     const resolvedPath = path === ":memory:" ? path : resolve(path);
-    if (resolvedPath !== ":memory:") {
-        mkdirSync(dirname(resolvedPath), { recursive: true });
+    if (resolvedPath === ":memory:")
+        return new DatabaseSync(resolvedPath);
+    ensurePrivatePiboHomeForPath(resolvedPath);
+    mkdirSync(dirname(resolvedPath), { recursive: true });
+    const database = new DatabaseSync(resolvedPath);
+    protectPrivateFileSync(resolvedPath);
+    return database;
+}
+const BETTER_AUTH_SQLITE_TABLES = new Set(["user", "session", "account", "verification"]);
+function quoteSqlIdentifier(value) {
+    return `"${value.replaceAll('"', '""')}"`;
+}
+function sqliteColumnType(field) {
+    if (Array.isArray(field.type))
+        return "text";
+    switch (field.type) {
+        case "string":
+        case "json":
+        case "string[]":
+        case "number[]":
+            return "text";
+        case "number":
+        case "boolean":
+            return "integer";
+        case "date":
+            return "date";
+        default:
+            return undefined;
+    }
+}
+function sqliteDefaultLiteral(value) {
+    if (typeof value === "boolean")
+        return value ? "1" : "0";
+    if (typeof value === "number") {
+        if (!Number.isFinite(value))
+            throw new Error("Better Auth migration default must be finite");
+        return String(value);
+    }
+    return `'${value.replaceAll("'", "''")}'`;
+}
+function safeRequiredColumnDefault(fieldName, field, migrationTimestamp) {
+    if (field.required === false || field.references || field.unique)
+        return undefined;
+    const declaredDefault = field.defaultValue;
+    if (typeof declaredDefault === "string" || typeof declaredDefault === "boolean")
+        return declaredDefault;
+    if (typeof declaredDefault === "number" && Number.isFinite(declaredDefault))
+        return declaredDefault;
+    if (declaredDefault instanceof Date && Number.isFinite(declaredDefault.getTime()))
+        return declaredDefault.toISOString();
+    if ((fieldName === "createdAt" || fieldName === "updatedAt") && field.type === "date") {
+        return migrationTimestamp;
+    }
+    return undefined;
+}
+function tableRowCount(database, table) {
+    const row = database.prepare(`SELECT COUNT(*) AS count FROM ${quoteSqlIdentifier(table)}`).get();
+    return Number(row.count);
+}
+function repairSafeRequiredColumns(database, pendingAdditions) {
+    const migrationTimestamp = new Date().toISOString();
+    const statements = [];
+    const unsafeColumns = [];
+    for (const addition of pendingAdditions) {
+        if (tableRowCount(database, addition.table) === 0)
+            continue;
+        for (const [fieldName, field] of Object.entries(addition.fields)) {
+            if (field.required === false)
+                continue;
+            const columnType = sqliteColumnType(field);
+            const defaultValue = safeRequiredColumnDefault(fieldName, field, migrationTimestamp);
+            if (!columnType || defaultValue === undefined) {
+                unsafeColumns.push(`${addition.table}.${fieldName}`);
+                continue;
+            }
+            statements.push(`ALTER TABLE ${quoteSqlIdentifier(addition.table)} ADD COLUMN ${quoteSqlIdentifier(fieldName)} ${columnType} NOT NULL DEFAULT ${sqliteDefaultLiteral(defaultValue)}`);
+            if (field.index) {
+                const indexName = `${addition.table}_${fieldName}_idx`;
+                statements.push(`CREATE INDEX IF NOT EXISTS ${quoteSqlIdentifier(indexName)} ON ${quoteSqlIdentifier(addition.table)} (${quoteSqlIdentifier(fieldName)})`);
+            }
+        }
+    }
+    if (unsafeColumns.length > 0 || statements.length === 0)
+        return unsafeColumns;
+    database.exec("BEGIN IMMEDIATE");
+    try {
+        for (const statement of statements)
+            database.exec(statement);
+        database.exec("COMMIT");
+    }
+    catch (error) {
+        database.exec("ROLLBACK");
+        throw error;
+    }
+    return [];
+}
+function isSqliteRequiredColumnMigrationError(error) {
+    return error instanceof Error && error.message.includes("Cannot add a NOT NULL column with default value NULL");
+}
+function nextRecoveryBackupPath(databasePath) {
+    const timestamp = new Date().toISOString().replaceAll(":", "-").replaceAll(".", "-");
+    const base = `${databasePath}.pibo-auth-recovery-${timestamp}`;
+    for (let attempt = 0; attempt < 100; attempt += 1) {
+        const suffix = attempt === 0 ? "" : `-${attempt + 1}`;
+        const candidate = `${base}${suffix}.sqlite`;
+        if (!existsSync(candidate))
+            return candidate;
+    }
+    throw new Error(`Could not allocate a unique Better Auth recovery backup beside ${databasePath}`);
+}
+function removeSqliteDatabaseFiles(databasePath) {
+    for (const path of [databasePath, `${databasePath}-wal`, `${databasePath}-shm`, `${databasePath}-journal`]) {
+        rmSync(path, { force: true });
+    }
+}
+function makePrivateFile(path) {
+    protectPrivateFileSync(path, { force: true });
+}
+function assertAuthOnlyRecoveryDatabase(database) {
+    const tables = database.prepare(`
+		SELECT name
+		FROM sqlite_master
+		WHERE type = 'table' AND name NOT LIKE 'sqlite_%'
+	`).all();
+    if (tables.some((table) => !BETTER_AUTH_SQLITE_TABLES.has(table.name))) {
+        throw new Error("Better Auth SQLite recovery refused to replace a database that contains non-auth tables.");
+    }
+}
+/** @internal Exported for deterministic recovery failure injection. */
+export async function recoverBetterAuthSqliteDatabase(input) {
+    if (input.databasePath === ":memory:") {
+        throw new Error("Better Auth SQLite schema requires recovery, but an in-memory database cannot be preserved");
+    }
+    assertAuthOnlyRecoveryDatabase(input.failedRuntime.database);
+    const backupPath = nextRecoveryBackupPath(input.databasePath);
+    await backup(input.failedRuntime.database, backupPath);
+    makePrivateFile(backupPath);
+    input.failedRuntime.database.close();
+    removeSqliteDatabaseFiles(input.databasePath);
+    let replacement;
+    try {
+        replacement = input.createRuntime();
+        await input.migrateRuntime(replacement);
+        makePrivateFile(input.databasePath);
+        return { runtime: replacement, backupPath };
+    }
+    catch (recoveryError) {
+        try {
+            replacement?.database.close();
+        }
+        catch { }
+        removeSqliteDatabaseFiles(input.databasePath);
+        try {
+            copyFileSync(backupPath, input.databasePath);
+            makePrivateFile(input.databasePath);
+        }
+        catch (restoreError) {
+            throw new AggregateError([recoveryError, restoreError], `Pibo could not create a fresh Better Auth database or restore the original. The protected recovery backup remains at "${backupPath}".`);
+        }
+        throw new Error(`Pibo could not create a fresh Better Auth database. The original was restored and the protected recovery backup remains at "${backupPath}".`, { cause: recoveryError });
     }
-    return new DatabaseSync(resolvedPath);
 }
 function requiredAllowedEmails(options, configAllowedEmails) {
     const allowedEmails = options.allowedEmails !== undefined
@@ -68,28 +226,50 @@ export function createBetterAuthService(options = {}) {
     const allowedEmails = requiredAllowedEmails(options, authConfig?.allowedEmails);
     const machineKeys = createMachineKeyAuthenticator(options.machineKeyStorePath ?? authConfig?.machineKeyStorePath);
     const machineSessions = createMachineSessionManager({ secret, machineKeys });
-    const database = createDatabase(options.databasePath ?? authConfig?.databasePath ?? piboHomePath("auth.sqlite"));
+    const configuredDatabasePath = options.databasePath ?? authConfig?.databasePath ?? piboHomePath("auth.sqlite");
+    const databasePath = configuredDatabasePath === ":memory:" ? configuredDatabasePath : resolve(configuredDatabasePath);
     const trustedOrigins = options.trustedOrigins ?? authConfig?.trustedOrigins;
-    const authOptions = {
-        appName: "Pibo",
-        baseURL,
-        secret,
-        database,
-        trustedOrigins: createTrustedOrigins(baseURL, trustedOrigins),
-        session: {
-            expiresIn: SESSION_EXPIRES_IN_SECONDS,
-            updateAge: SESSION_UPDATE_AGE_SECONDS,
-        },
-        socialProviders: {
-            google: {
-                clientId: googleClientId,
-                clientSecret: googleClientSecret,
-                prompt: "select_account",
+    const createRuntime = () => {
+        const database = createDatabase(databasePath);
+        if (databasePath !== ":memory:")
+            makePrivateFile(databasePath);
+        const authOptions = {
+            appName: "Pibo",
+            baseURL,
+            secret,
+            database,
+            trustedOrigins: createTrustedOrigins(baseURL, trustedOrigins),
+            session: {
+                expiresIn: SESSION_EXPIRES_IN_SECONDS,
+                updateAge: SESSION_UPDATE_AGE_SECONDS,
             },
-        },
-        plugins: [bearer()],
+            socialProviders: {
+                google: {
+                    clientId: googleClientId,
+                    clientSecret: googleClientSecret,
+                    prompt: "select_account",
+                },
+            },
+            plugins: [bearer()],
+        };
+        return { database, authOptions, auth: betterAuth(authOptions) };
+    };
+    let runtime = createRuntime();
+    const recoverAuthDatabase = async (failedRuntime) => {
+        const recovered = await recoverBetterAuthSqliteDatabase({
+            databasePath,
+            failedRuntime,
+            createRuntime,
+            migrateRuntime: async (replacement) => {
+                const migrations = await getMigrations(replacement.authOptions);
+                await migrations.runMigrations();
+            },
+        });
+        console.warn(`[pibo] Better Auth SQLite schema was incompatible with a safe in-place migration. `
+            + `Pibo preserved a protected backup at "${recovered.backupPath}", created a fresh authentication database, `
+            + "and reset existing browser sessions. Sign in again.");
+        return recovered.runtime;
     };
-    const auth = betterAuth(authOptions);
     const requireAllowedMachineSession = (session) => {
         const email = session.identity.email?.toLowerCase();
         if (!email || !allowedEmails.has(email))
@@ -99,17 +279,30 @@ export function createBetterAuthService(options = {}) {
     return {
         name: "better-auth",
         async start() {
-            const migrations = await getMigrations(authOptions);
-            await migrations.runMigrations();
+            let migrations = await getMigrations(runtime.authOptions);
+            const unsafeColumns = repairSafeRequiredColumns(runtime.database, migrations.toBeAdded);
+            if (unsafeColumns.length > 0) {
+                runtime = await recoverAuthDatabase(runtime);
+                return;
+            }
+            migrations = await getMigrations(runtime.authOptions);
+            try {
+                await migrations.runMigrations();
+            }
+            catch (error) {
+                if (!isSqliteRequiredColumnMigrationError(error))
+                    throw error;
+                runtime = await recoverAuthDatabase(runtime);
+            }
         },
         stop() {
-            database.close();
+            runtime.database.close();
         },
         async getSession(headers) {
             const machineSession = machineKeys.getSession(headers) ?? machineSessions.getSession(headers);
             if (machineSession)
                 return requireAllowedMachineSession(machineSession);
-            const session = await auth.api.getSession({ headers });
+            const session = await runtime.auth.api.getSession({ headers });
             if (!session)
                 return undefined;
             const user = session.user;
@@ -172,7 +365,7 @@ export function createBetterAuthService(options = {}) {
                     },
                 });
             }
-            return auth.handler(request);
+            return runtime.auth.handler(request);
         },
     };
 }

package/dist/auth/cli.js

@@ -4,6 +4,7 @@ import { dirname, resolve } from "node:path";
 import { Command } from "commander";
 import { loadPiboConfig } from "../config/config.js";
 import { piboHomePath } from "../core/pibo-home.js";
+import { protectPrivateFileSync } from "../core/private-path.js";
 import { generateMachineKey, getDefaultMachineKeyStorePath, importMachineKeyRecord, listMachineKeys, parseMachineKeyRecord, revokeMachineKey, } from "./machine-keys.js";
 function printJson(value) {
     console.log(JSON.stringify(value, null, 2));
@@ -103,7 +104,15 @@ function requireNewOutputPath(path, label) {
 }
 function writePrivateNewFile(path, content) {
     mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-    writeFileSync(path, content, { encoding: "utf8", mode: 0o600, flag: "wx" });
+    try {
+        writeFileSync(path, content, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        protectPrivateFileSync(path, { force: true });
+    }
+    catch (error) {
+        if (existsSync(path))
+            unlinkSync(path);
+        throw error;
+    }
 }
 function parseExpiresAt(value) {
     if (value === undefined)

package/dist/auth/machine-keys.js

@@ -1,7 +1,8 @@
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
 import { dirname, resolve } from "node:path";
-import { piboHomePath } from "../core/pibo-home.js";
+import { ensurePrivatePiboHomeForPath, piboHomePath } from "../core/pibo-home.js";
+import { protectPrivateFileSync } from "../core/private-path.js";
 export const PIBO_MACHINE_KEY_HEADER = "x-pibo-machine-key";
 export const MACHINE_KEY_STORE_VERSION = 1;
 const MACHINE_KEY_ID_PATTERN = /^[a-f0-9]{16}$/;
@@ -108,8 +109,10 @@ function parseMachineKeyStore(value) {
     return { version: MACHINE_KEY_STORE_VERSION, keys };
 }
 function assertPrivateStoreFile(path) {
-    if (process.platform === "win32")
+    if (process.platform === "win32") {
+        protectPrivateFileSync(path, { force: true });
         return;
+    }
     const stat = statSync(path);
     if ((stat.mode & 0o077) !== 0) {
         throw new Error(`Machine-key store must not be accessible by group or other users: ${path}`);
@@ -128,12 +131,13 @@ export function readMachineKeyStore(path = getDefaultMachineKeyStorePath()) {
 }
 function writeMachineKeyStore(store, path) {
     const resolvedPath = resolve(path);
+    ensurePrivatePiboHomeForPath(resolvedPath);
     mkdirSync(dirname(resolvedPath), { recursive: true, mode: 0o700 });
     const temporaryPath = `${resolvedPath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
     try {
         writeFileSync(temporaryPath, `${JSON.stringify(store, null, 2)}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
         renameSync(temporaryPath, resolvedPath);
-        chmodSync(resolvedPath, 0o600);
+        protectPrivateFileSync(resolvedPath, { force: true });
     }
     finally {
         if (existsSync(temporaryPath))

package/dist/auth/openai-codex-usage.js

@@ -1,4 +1,4 @@
-import { AuthStorage } from "@earendil-works/pi-coding-agent";
+import { readPiCredential, resolvePiProviderAuth, } from "../agent-runtimes/pi/credentials.js";
 const OPENAI_CODEX_PROVIDER = "openai-codex";
 const OPENAI_CODEX_USAGE_URL = "https://chatgpt.com/backend-api/wham/usage";
 const OPENAI_JWT_CLAIM_PATH = "https://api.openai.com/auth";
@@ -124,11 +124,11 @@ function normalizeUsagePayload(payload) {
 export async function getOpenAiCodexProviderUsageForActiveModel(activeModel) {
     if (activeModel?.provider !== OPENAI_CODEX_PROVIDER)
         return undefined;
-    const authStorage = AuthStorage.create();
-    const credential = authStorage.get(OPENAI_CODEX_PROVIDER);
+    const credential = await readPiCredential(OPENAI_CODEX_PROVIDER);
     if (credential?.type !== "oauth")
         return undefined;
-    const accessToken = await authStorage.getApiKey(OPENAI_CODEX_PROVIDER, { includeFallback: false });
+    const resolvedAuth = await resolvePiProviderAuth(OPENAI_CODEX_PROVIDER);
+    const accessToken = resolvedAuth?.auth.apiKey;
     if (!accessToken)
         return undefined;
     const headers = {

package/dist/cli-session/fakeSessionSource.js

@@ -774,10 +774,10 @@ function fakeUploadResult(args) {
     if (!target)
         return {
             supported: false,
-            unsupportedReason: "Usage: /upload <path>. Browser file picker upload is Web-only; copy files to ~/.pibo/uploads from the shell.",
+            unsupportedReason: "Usage: /upload <path>. Browser file picker upload is Web-only; copy files to $PIBO_HOME/uploads (default ~/.pibo/uploads) from the shell.",
         };
     return {
-        message: `Terminal upload for ${target}: copy the file to ~/.pibo/uploads or use Web /upload. The CLI did not copy file contents.`,
+        message: `Terminal upload for ${target}: copy the file to $PIBO_HOME/uploads (default ~/.pibo/uploads) or use Web /upload. The CLI did not copy file contents.`,
     };
 }
 function sessionIdFromActionResult(value) {

package/dist/cli-session/localSessionSource.js

@@ -1113,10 +1113,10 @@ function terminalUploadResult(args) {
     if (!target)
         return {
             supported: false,
-            unsupportedReason: "Usage: /upload <path>. Browser file picker upload is Web-only; from SSH, copy files with scp/rsync or place them under ~/.pibo/uploads.",
+            unsupportedReason: "Usage: /upload <path>. Browser file picker upload is Web-only; from SSH, copy files with scp/rsync or place them under $PIBO_HOME/uploads (default ~/.pibo/uploads).",
         };
     return {
-        message: `Terminal upload for ${target}: copy or move the file to ~/.pibo/uploads, or use Web /upload for browser file selection. The CLI did not copy file contents or echo secrets.`,
+        message: `Terminal upload for ${target}: copy or move the file to $PIBO_HOME/uploads (default ~/.pibo/uploads), or use Web /upload for browser file selection. The CLI did not copy file contents or echo secrets.`,
     };
 }
 function sessionMetadataResult(session, defaultRoomId, roomTitle) {

package/dist/cli.js

@@ -2,7 +2,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { Command } from "commander";
 import { PIBO_CONFIG_KEYS, getDefaultPiboConfigPath, deletePiboConfigValue, getDisplayPiboConfigValue, loadPiboConfig, redactPiboConfig, savePiboConfig, setPiboConfigValue, } from "./config/config.js";
 import { parsePiboThinkingLevel } from "./core/thinking.js";
-import { piboHomePath } from "./core/pibo-home.js";
+import { ensurePrivatePiboHome, piboHomePath } from "./core/pibo-home.js";
 async function createCliProfile(profileName) {
     const { createDefaultPiboPluginRegistry, createGatewayProducerPiboProfile, createPiboProfileFromRegistryOrDefault } = await import("./plugins/builtin.js");
     if (profileName === "gateway-producer" || profileName === "pibo-gateway-producer") {
@@ -80,6 +80,8 @@ export async function runPiboCli(argv = process.argv) {
         printPiboVersion();
         return;
     }
+    if (argv.length > 2)
+        ensurePrivatePiboHome();
     if (argv[2] === "auth") {
         const { runAuthCli } = await import("./auth/cli.js");
         await runAuthCli([argv[0] ?? "node", "pibo auth", ...argv.slice(3)]);

package/dist/config/config.js

@@ -1,6 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
-import { piboHomePath } from "../core/pibo-home.js";
+import { ensurePrivatePiboHomeForPath, piboHomePath } from "../core/pibo-home.js";
+import { protectPrivateFileSync } from "../core/private-path.js";
 export const DEFAULT_PIBO_CONFIG_PATH = "config.json";
 export function getDefaultPiboConfigPath() {
     return piboHomePath(DEFAULT_PIBO_CONFIG_PATH);
@@ -104,13 +105,17 @@ export function loadPiboConfig(path) {
     const resolvedPath = resolve(path ?? getDefaultPiboConfigPath());
     if (!existsSync(resolvedPath))
         return {};
-    const parsed = JSON.parse(readFileSync(resolvedPath, "utf-8"));
+    protectPrivateFileSync(resolvedPath);
+    const source = readFileSync(resolvedPath, "utf-8").replace(/^\uFEFF/, "");
+    const parsed = JSON.parse(source);
     return assertObject(parsed);
 }
 export function savePiboConfig(config, path) {
     const resolvedPath = resolve(path ?? getDefaultPiboConfigPath());
-    mkdirSync(dirname(resolvedPath), { recursive: true });
-    writeFileSync(resolvedPath, `${JSON.stringify(config, null, 2)}\n`);
+    ensurePrivatePiboHomeForPath(resolvedPath);
+    mkdirSync(dirname(resolvedPath), { recursive: true, mode: 0o700 });
+    writeFileSync(resolvedPath, `${JSON.stringify(config, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    protectPrivateFileSync(resolvedPath, { force: true });
 }
 export function getPiboConfigValue(config, key) {
     getKeyDefinition(key);

package/dist/core/compaction-prompt.js

@@ -275,7 +275,9 @@ export function createPiboCompactionPromptExtension(options = {}) {
                     spec: await readActivePiboCompactionPromptSpec(ctx.cwd),
                     model: ctx.model,
                     apiKey: auth.apiKey,
-                    headers: auth.headers,
+                    headers: auth.headers
+                        ? Object.fromEntries(Object.entries(auth.headers).filter((entry) => typeof entry[1] === "string"))
+                        : undefined,
                     customInstructions: event.customInstructions,
                     signal: event.signal,
                     thinkingLevel: sessionContext.thinkingLevel,

package/dist/core/context-build.js

@@ -180,6 +180,7 @@ function withoutRequestedModels(profile) {
         builtinTools: profile.builtinTools,
         builtinToolNames: profile.builtinToolNames,
         autoContextFiles: profile.autoContextFiles,
+        nativeSubagents: profile.nativeSubagents,
         toolPackages: profile.toolPackages,
     });
 }

package/dist/core/pibo-home.js

@@ -1,8 +1,31 @@
+import { existsSync, mkdirSync, statSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { protectPrivateDirectorySync } from "./private-path.js";
 export function getPiboHome() {
     return process.env.PIBO_HOME || join(homedir(), ".pibo");
 }
 export function piboHomePath(...segments) {
     return join(getPiboHome(), ...segments);
 }
+export function ensurePrivatePiboHome(path = getPiboHome()) {
+    const resolvedPath = resolve(path);
+    if (existsSync(resolvedPath) && !statSync(resolvedPath).isDirectory()) {
+        throw new Error(`Pibo Home must be a directory: ${resolvedPath}`);
+    }
+    mkdirSync(resolvedPath, { recursive: true, mode: 0o700 });
+    protectPrivateDirectorySync(resolvedPath);
+    return resolvedPath;
+}
+export function ensurePrivatePiboHomeForPath(path) {
+    if (path === ":memory:")
+        return false;
+    const home = resolve(getPiboHome());
+    const target = resolve(path);
+    const relativePath = relative(home, target);
+    const outsideHome = relativePath === ".." || relativePath.startsWith(`..${sep}`) || isAbsolute(relativePath);
+    if (outsideHome)
+        return false;
+    ensurePrivatePiboHome(home);
+    return true;
+}

package/dist/core/private-path.js

@@ -0,0 +1,146 @@
+import { spawnSync } from "node:child_process";
+import { chmodSync, lstatSync, readdirSync, statSync } from "node:fs";
+import { resolve } from "node:path";
+const protectedWindowsPaths = new Set();
+const WINDOWS_PRIVATE_ACL_SCRIPT = `
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+$entries = @((ConvertFrom-Json -InputObject $env:PIBO_PRIVATE_PATHS_JSON))
+$current = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+$system = New-Object System.Security.Principal.SecurityIdentifier('S-1-5-18')
+$administrators = New-Object System.Security.Principal.SecurityIdentifier('S-1-5-32-544')
+$allowed = @($current.Value, $system.Value, $administrators.Value)
+$inheritBoth = [System.Security.AccessControl.InheritanceFlags]([int][System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [int][System.Security.AccessControl.InheritanceFlags]::ObjectInherit)
+foreach ($entry in $entries) {
+	$path = [System.IO.Path]::GetFullPath([string]$entry.path)
+	$kind = [string]$entry.kind
+	$sections = [System.Security.AccessControl.AccessControlSections]([int][System.Security.AccessControl.AccessControlSections]::Access -bor [int][System.Security.AccessControl.AccessControlSections]::Owner)
+	if ($kind -eq 'directory') {
+		if (-not [System.IO.Directory]::Exists($path)) { throw "Private directory does not exist" }
+		$security = [System.IO.Directory]::GetAccessControl($path, $sections)
+		$inheritance = $inheritBoth
+	} elseif ($kind -eq 'file') {
+		if (-not [System.IO.File]::Exists($path)) { throw "Private file does not exist" }
+		$security = [System.IO.File]::GetAccessControl($path, $sections)
+		$inheritance = [System.Security.AccessControl.InheritanceFlags]::None
+	} else {
+		throw "Unsupported private path kind"
+	}
+	if ($security.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $current.Value) { throw "Private path owner is not the current user" }
+	$security.SetAccessRuleProtection($true, $false)
+	foreach ($rule in @($security.GetAccessRules($true, $false, [System.Security.Principal.SecurityIdentifier]))) {
+		$security.RemoveAccessRuleAll($rule)
+	}
+	foreach ($sid in @($current, $system, $administrators)) {
+		$rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
+			$sid,
+			[System.Security.AccessControl.FileSystemRights]::FullControl,
+			$inheritance,
+			[System.Security.AccessControl.PropagationFlags]::None,
+			[System.Security.AccessControl.AccessControlType]::Allow
+		)
+		$security.AddAccessRule($rule) | Out-Null
+	}
+	if ($kind -eq 'directory') {
+		[System.IO.Directory]::SetAccessControl($path, $security)
+	} else {
+		[System.IO.File]::SetAccessControl($path, $security)
+	}
+	$applied = Get-Acl -LiteralPath $path
+	if (-not $applied.AreAccessRulesProtected) { throw "Private path still inherits access rules" }
+	if ($applied.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $current.Value) { throw "Private path owner is not the current user" }
+	$seen = @{}
+	foreach ($rule in $applied.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])) {
+		$sid = $rule.IdentityReference.Value
+		if ($allowed -notcontains $sid) { throw "Private path grants access to an unexpected principal" }
+		if ($rule.AccessControlType -ne [System.Security.AccessControl.AccessControlType]::Allow) { throw "Private path contains a deny rule" }
+		if (($rule.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -ne [System.Security.AccessControl.FileSystemRights]::FullControl) { throw "Private path does not grant required full control" }
+		$seen[$sid] = $true
+	}
+	foreach ($sid in $allowed) {
+		if (-not $seen.ContainsKey($sid)) { throw "Private path is missing a required principal" }
+	}
+}
+`;
+const WINDOWS_PRIVATE_ACL_COMMAND = Buffer.from(WINDOWS_PRIVATE_ACL_SCRIPT, "utf16le").toString("base64");
+function protectWindowsPathBatchSync(paths) {
+    const result = spawnSync("powershell.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", WINDOWS_PRIVATE_ACL_COMMAND], {
+        encoding: "utf8",
+        env: { ...process.env, PIBO_PRIVATE_PATHS_JSON: JSON.stringify(paths) },
+        timeout: 15_000,
+        windowsHide: true,
+    });
+    if (result.error || result.status !== 0) {
+        const reason = result.error instanceof Error && result.error.message
+            ? ` (${result.error.message})`
+            : "";
+        throw new Error(`Could not apply a private Windows ACL${reason}`);
+    }
+}
+function protectWindowsPathsSync(paths) {
+    let batch = [];
+    let batchCharacters = 2;
+    for (const descriptor of paths) {
+        const characters = JSON.stringify(descriptor).length + 1;
+        if (batch.length > 0 && batchCharacters + characters > 24_000) {
+            protectWindowsPathBatchSync(batch);
+            batch = [];
+            batchCharacters = 2;
+        }
+        batch.push(descriptor);
+        batchCharacters += characters;
+    }
+    if (batch.length > 0)
+        protectWindowsPathBatchSync(batch);
+}
+function protectPosixPathSync(path, kind) {
+    const expectedMode = kind === "directory" ? 0o700 : 0o600;
+    chmodSync(path, expectedMode);
+    if ((statSync(path).mode & 0o077) !== 0) {
+        throw new Error(`Private ${kind} must not be accessible by group or other users: ${path}`);
+    }
+}
+export function protectPrivatePathsSync(paths, options = {}) {
+    if (paths.length === 0)
+        return;
+    const normalized = paths.map((descriptor) => ({ ...descriptor, path: resolve(descriptor.path) }));
+    if (process.platform === "win32") {
+        const pending = options.force
+            ? normalized
+            : normalized.filter((descriptor) => !protectedWindowsPaths.has(`${descriptor.kind}:${descriptor.path.toLowerCase()}`));
+        if (pending.length === 0)
+            return;
+        protectWindowsPathsSync(pending);
+        for (const descriptor of pending)
+            protectedWindowsPaths.add(`${descriptor.kind}:${descriptor.path.toLowerCase()}`);
+        return;
+    }
+    for (const descriptor of normalized)
+        protectPosixPathSync(descriptor.path, descriptor.kind);
+}
+export function protectPrivateDirectorySync(path, options) {
+    protectPrivatePathsSync([{ path, kind: "directory" }], options);
+}
+export function protectPrivateFileSync(path, options) {
+    protectPrivatePathsSync([{ path, kind: "file" }], options);
+}
+export function protectPrivateTreeSync(root) {
+    if (process.platform !== "win32")
+        return;
+    const paths = [];
+    const visit = (path) => {
+        const metadata = lstatSync(path);
+        if (metadata.isSymbolicLink())
+            throw new Error(`Private path tree contains a symbolic link: ${path}`);
+        if (metadata.isDirectory()) {
+            paths.push({ path, kind: "directory" });
+            for (const entry of readdirSync(path))
+                visit(resolve(path, entry));
+            return;
+        }
+        if (metadata.isFile())
+            paths.push({ path, kind: "file" });
+    };
+    visit(resolve(root));
+    protectPrivatePathsSync(paths, { force: true });
+}