@runuai/host 0.9.149 → 0.9.151

package/lib/db.ts

@@ -64,6 +64,17 @@ export function getDb(): ReturnType<typeof drizzle> {
   return cached;
 }
 
+/**
+ * Run `use` on the connection behind `getDb()`, for what drizzle does not
+ * express: a pragma, VACUUM, a WAL checkpoint. Never a second connection:
+ * `secure_delete` is a setting of the connection, so it has to be on the one
+ * every delete goes through. VACUUM and a checkpoint run outside any
+ * transaction.
+ */
+export function withHostSqlite<T>(use: (sqlite: Database.Database) => T): T {
+  return use(getDb().$client);
+}
+
 export type Db = ReturnType<typeof getDb>;
 export type { HostTask } from "../db/schema";
 export { schema };

package/lib/docker-exec.ts

@@ -39,7 +39,9 @@ export function dockerCli(
      * each output stream. Use for legitimately verbose bounded operations
      * whose complete compiler/install log must not accumulate in host RAM. */
     tailOutputBytes?: number;
-    /** Selection probes can intentionally ignore this process's pinned host. */
+    /** Selection probes can intentionally ignore this process's pinned host,
+     * and an exec that names a credential bare carries its value here
+     * (cliExecEnv in task-environment/docker.ts). */
     env?: NodeJS.ProcessEnv;
   } = {},
 ): Promise<DockerResult> {

package/lib/engine-accounts.ts

@@ -54,6 +54,7 @@ import {
   type CredentialStore,
 } from "./credential-store";
 import { engineAccountListPaths } from "./credential-store-scope";
+import type { EngineCaptureMaterial } from "./capture-flow";
 import { getDb, schema } from "./db";
 import { brokeredFilesFor } from "./token-broker";
 import {
@@ -846,18 +847,16 @@ type LabeledAccountPlan =
 
 type PlannedAccount = { ok: false; message: string } | { ok: true; plan: LabeledAccountPlan };
 
-function planLabeledAccount(
+/**
+ * What a pasted token or API key becomes for an engine: env vars, or (Codex)
+ * an `auth.json` holding the key. Shared by local accounts and ADR-154
+ * capture flows, which carry no local scope.
+ */
+export function pastedSecretMaterial(
   kind: string,
-  label: string,
-  creds: { apiKey?: string; token?: string },
-  scope: string,
-): PlannedAccount {
-  if (!isEngineAccountScope(scope)) {
-    return { ok: false, message: "The account scope is invalid." };
-  }
-  const trimmedLabel = label.trim();
-  if (!trimmedLabel) return { ok: false, message: "Give the account a label." };
-  const secret = (creds.token ?? creds.apiKey ?? "").trim();
+  rawSecret: string,
+): { ok: true; material: EngineCaptureMaterial } | { ok: false; message: string } {
+  const secret = rawSecret.trim();
   if (!secret) return { ok: false, message: "Paste a token or API key." };
   if (/\s/.test(secret) || secret.length < 12) {
     return { ok: false, message: "That doesn't look like a token. Paste just the value." };
@@ -866,36 +865,18 @@ function planLabeledAccount(
     const envVar = secret.startsWith("sk-ant-api")
       ? "ANTHROPIC_API_KEY"
       : "CLAUDE_CODE_OAUTH_TOKEN";
-    return {
-      ok: true,
-      plan: {
-        authKind: "env",
-        label: trimmedLabel,
-        env: { [envVar]: secret },
-        message: `Added Claude account "${trimmedLabel}".`,
-      },
-    };
+    return { ok: true, material: { authKind: "env", env: { [envVar]: secret } } };
   }
   const envKeyVar = API_KEY_ENV_VARS[kind];
   if (envKeyVar) {
-    return {
-      ok: true,
-      plan: {
-        authKind: "env",
-        label: trimmedLabel,
-        env: { [envKeyVar]: secret },
-        message: `Added ${API_KEY_ENGINE_LABELS[kind] ?? kind} account "${trimmedLabel}".`,
-      },
-    };
+    return { ok: true, material: { authKind: "env", env: { [envKeyVar]: secret } } };
   }
   if (kind === "codex") {
     return {
       ok: true,
-      plan: {
+      material: {
         authKind: "config-dir",
-        label: trimmedLabel,
         files: { "auth.json": `${JSON.stringify({ OPENAI_API_KEY: secret }, null, 2)}\n` },
-        message: `Added Codex account "${trimmedLabel}".`,
       },
     };
   }
@@ -905,6 +886,35 @@ function planLabeledAccount(
   };
 }
 
+function planLabeledAccount(
+  kind: string,
+  label: string,
+  creds: { apiKey?: string; token?: string },
+  scope: string,
+): PlannedAccount {
+  if (!isEngineAccountScope(scope)) {
+    return { ok: false, message: "The account scope is invalid." };
+  }
+  const trimmedLabel = label.trim();
+  if (!trimmedLabel) return { ok: false, message: "Give the account a label." };
+  const pasted = pastedSecretMaterial(kind, creds.token ?? creds.apiKey ?? "");
+  if (!pasted.ok) return pasted;
+  const engineName =
+    kind === "claude"
+      ? "Claude"
+      : kind === "codex"
+        ? "Codex"
+        : (API_KEY_ENGINE_LABELS[kind] ?? kind);
+  const message = `Added ${engineName} account "${trimmedLabel}".`;
+  return {
+    ok: true,
+    plan:
+      pasted.material.authKind === "env"
+        ? { authKind: "env", label: trimmedLabel, env: pasted.material.env, message }
+        : { authKind: "config-dir", label: trimmedLabel, files: pasted.material.files, message },
+  };
+}
+
 function planCapturedConfigDirAccount(
   kind: "codex" | "grok",
   label: string,

package/lib/engine-connect.ts

@@ -19,7 +19,9 @@ import {
   type EngineConnectEventFrame,
   type EngineConnectKind,
 } from "../src/protocol";
-import { addEngineAccount } from "./engine-accounts";
+import type { CaptureFlowWire, CaptureResultWire } from "../src/cloud-credentials";
+import type { CaptureOutcome, EngineCaptureMaterial } from "./capture-flow";
+import { addEngineAccount, pastedSecretMaterial } from "./engine-accounts";
 import { connectEngine, type EngineKind } from "./engines";
 
 const CONNECT_TIMEOUT_MS = 2 * 60_000;
@@ -54,6 +56,13 @@ export interface EngineConnectManagerOptions {
     secret: string,
     scope: string,
   ) => AddAccountOutcome | Promise<AddAccountOutcome>;
+  /** ADR-154: the sign-in box's sink for a capture flow. Absent elsewhere:
+   *  only the box writes cloud credentials. */
+  captureAccount?: (
+    flow: CaptureFlowWire,
+    kind: EngineConnectKind,
+    material: EngineCaptureMaterial,
+  ) => Promise<CaptureOutcome>;
   timers?: {
     setTimeout(handler: () => void, ms: number): NodeJS.Timeout;
     clearTimeout(timer: NodeJS.Timeout): void;
@@ -70,6 +79,9 @@ interface ConnectOperation {
 
 export class EngineConnectManager {
   private readonly operations = new Map<string, ConnectOperation>();
+  /** Each connect's work, which goes on writing (a key, an account) after
+   *  its operation is finished or stopped. */
+  private readonly runs = new Set<Promise<void>>();
 
   constructor(private readonly options: EngineConnectManagerOptions) {}
 
@@ -80,6 +92,7 @@ export class EngineConnectManager {
     label: string | undefined,
     emit: EmitEngineConnectEvent,
     scope: string | undefined = undefined,
+    flow: CaptureFlowWire | undefined = undefined,
   ): boolean {
     if (!isHostOpId(opId) || this.operations.has(opId)) return false;
     if (scope !== undefined && !isEngineAccountScope(scope)) return false;
@@ -117,16 +130,24 @@ export class EngineConnectManager {
       this.finish(operation, false, "Engine connect timed out.");
     }, CONNECT_TIMEOUT_MS);
     operation.timer.unref?.();
-    void this.run(operation, secret, label, scope).catch((error: unknown) => {
+    const running = this.run(operation, secret, label, scope, flow).catch((error: unknown) => {
       this.finish(
         operation,
         false,
         error instanceof Error ? error.message : "Engine connect failed.",
       );
     });
+    this.runs.add(running);
+    void running.finally(() => this.runs.delete(running));
     return true;
   }
 
+  /** Resolves once no connect's work is under way, a stopped one's included:
+   *  what it writes has been written (ADR-154 §13's leaving waits for it). */
+  async idle(): Promise<void> {
+    while (this.runs.size > 0) await Promise.allSettled([...this.runs]);
+  }
+
   stop(opId: string): void {
     const operation = this.operations.get(opId);
     if (operation) this.finish(operation, false, "Cancelled.");
@@ -143,8 +164,30 @@ export class EngineConnectManager {
     secret: string | undefined,
     label: string | undefined,
     scope: string | undefined,
+    flow: CaptureFlowWire | undefined,
   ): Promise<void> {
     const { engine } = operation;
+    // ADR-154: a capture flow writes one revision of a cloud credential, on
+    // the sign-in box only, from the pasted secret alone.
+    if (flow !== undefined) {
+      if (!this.options.workspaceOnly || !this.options.captureAccount) {
+        this.finish(operation, false, "Only the Uai Cloud sign-in box writes cloud credentials.");
+        return;
+      }
+      if (secret === undefined) {
+        this.finish(operation, false, "Paste a token or API key.");
+        return;
+      }
+      const pasted = pastedSecretMaterial(engine, secret);
+      if (!pasted.ok) {
+        this.finish(operation, false, pasted.message);
+        return;
+      }
+      const outcome = await this.options.captureAccount(flow, engine, pasted.material);
+      if (operation.done) return;
+      this.finish(operation, outcome.ok, outcome.message, undefined, outcome.capture);
+      return;
+    }
     const emitLine = (line: string): void => {
       const bounded = line.trim().slice(0, MAX_ENGINE_CONNECT_LINE_CHARS);
       if (!bounded || operation.done) return;
@@ -239,6 +282,7 @@ export class EngineConnectManager {
     ok: boolean,
     message: string,
     accountId?: string,
+    capture?: CaptureResultWire,
   ): void {
     if (operation.done) return;
     operation.done = true;
@@ -254,6 +298,7 @@ export class EngineConnectManager {
       ok,
       message,
       ...(ok && accountId !== undefined ? { accountId } : {}),
+      ...(ok && capture !== undefined ? { capture } : {}),
     });
   }
 }

package/lib/engine-credential-env.ts

@@ -0,0 +1,50 @@
+import { ENGINE_ENV_CREDENTIAL_KEYS } from "../src/cloud-credentials";
+
+/** Every env-token engine's credential names, of any account kind. */
+export const ENGINE_CREDENTIAL_ENV_NAMES: ReadonlySet<string> = new Set(
+  Object.values(ENGINE_ENV_CREDENTIAL_KEYS).flat(),
+);
+
+/**
+ * Whether an exec env entry carries an env-token engine's credential: a name
+ * some account kind may set (ENGINE_ENV_CREDENTIAL_KEYS is the one list).
+ * ADR-154 §6 never puts such a value on the runner's argv, which every local
+ * user can read with `ps`. The docker and Apple providers pass it by name,
+ * from the exec client's own environment (cliExecEnv in
+ * task-environment/docker.ts). The machine and self providers, whose
+ * request environment rides a command line (buildRemoteCommand in
+ * machine-exec.ts), carry a leased launch's values in its single-use
+ * admission instead (credential-consumers/engine-anchor.ts).
+ */
+export function isEngineCredentialEnvName(name: string): boolean {
+  return ENGINE_CREDENTIAL_ENV_NAMES.has(name);
+}
+
+/**
+ * An agent's task token (ADR-048: its own permissions on the task's API)
+ * and the Managed Engine's names for it (ADR-128: the gateway's bearer):
+ * bearer credentials as an engine's own are.
+ */
+export const TASK_SECRET_ENV_NAMES: ReadonlySet<string> = new Set([
+  "UAI_TASK_TOKEN",
+  "UAI_INFERENCE_TOKEN",
+  "OPENAI_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+]);
+
+/** Every name whose value never rides a runner's command line. */
+export const LAUNCH_SECRET_ENV_NAMES: ReadonlySet<string> = new Set([
+  ...ENGINE_CREDENTIAL_ENV_NAMES,
+  ...TASK_SECRET_ENV_NAMES,
+]);
+
+/**
+ * Whether an exec env entry carries a launch's secret: an engine's
+ * credential, or an agent's task token under any of its names. Like an
+ * engine credential, such a value is passed by name on the docker and Apple
+ * providers, and carried in a leased launch's admission on the machine and
+ * self providers (ADR-154 §6).
+ */
+export function isLaunchSecretEnvName(name: string): boolean {
+  return LAUNCH_SECRET_ENV_NAMES.has(name);
+}

package/lib/engine-login.ts

@@ -40,6 +40,8 @@ import {
   type EngineLoginEventFrame,
   type EngineLoginKind,
 } from "../src/protocol";
+import type { CaptureFlowWire } from "../src/cloud-credentials";
+import type { CaptureOutcome, EngineCaptureMaterial } from "./capture-flow";
 import {
   addCodexAccountFromAuthJson,
   addEngineAccount,
@@ -189,6 +191,12 @@ export interface EngineLoginSeams {
     scope: string,
   ): AccountAddOutcome | Promise<AccountAddOutcome>;
   persistGrokAuth(sourceFile: string): Promise<void>;
+  /** ADR-154: the sign-in box's sink for a capture flow; absent elsewhere. */
+  captureEngineAccount?(
+    flow: CaptureFlowWire,
+    engine: EngineLoginKind,
+    material: EngineCaptureMaterial,
+  ): Promise<CaptureOutcome>;
   /** Optional engines ride the standard image only when configured; a fresh
    * account may be the first configuration → rebuild (queue-deduped). */
   ensureStandardImage(): Promise<void>;
@@ -256,6 +264,9 @@ interface LoginOperation {
   callbackUsed: boolean;
   pendingInput: string | null;
   callbackTarget: CodexCallbackTarget | null;
+  /** ADR-154: when set, the capture is written as this revision of a cloud
+   * credential and nothing else happens to it. */
+  captureFlow: CaptureFlowWire | null;
   /** ADR-116: when set, the captured credential lands in a labeled extra
    * account instead of the default slot. */
   accountLabel: string | null;
@@ -466,8 +477,21 @@ export class EngineLoginManager {
     emit: EmitEngineLoginEvent,
     label?: string,
     scope?: string,
+    flow?: CaptureFlowWire,
   ): boolean {
     if (!isHostOpId(opId)) return false;
+    // ADR-154: a capture flow names its own destination; it runs only on the
+    // sign-in box, which alone writes cloud credentials.
+    if (
+      flow !== undefined &&
+      (!this.workspaceOnly || this.seams.captureEngineAccount === undefined)
+    ) {
+      safeEmit(
+        emit,
+        failedEvent(opId, engine, "start_failed", "Only the Uai Cloud sign-in box writes cloud credentials."),
+      );
+      return false;
+    }
     if (scope !== undefined && !isEngineAccountScope(scope)) {
       safeEmit(
         emit,
@@ -479,6 +503,7 @@ export class EngineLoginManager {
     // host-scope account would belong to a runner that owns no credential.
     if (
       this.workspaceOnly &&
+      flow === undefined &&
       (scope === undefined || scope === HOST_ACCOUNT_SCOPE || label === undefined)
     ) {
       safeEmit(
@@ -560,12 +585,15 @@ export class EngineLoginManager {
       callbackUsed: false,
       pendingInput: null,
       callbackTarget: null,
+      captureFlow: flow ?? null,
       accountLabel: label ?? null,
       accountScope: scope ?? HOST_ACCOUNT_SCOPE,
       postInputOutputSeen: false,
     };
     this.operations.set(opId, operation);
-    if (label === undefined) this.defaultSlotOperations.set(engine, operation);
+    if (label === undefined && flow === undefined) {
+      this.defaultSlotOperations.set(engine, operation);
+    }
     operation.timer = this.seams.timers.setTimeout(() => {
       void this.timeout(operation);
     }, ENGINE_LOGIN_TIMEOUT_MS);
@@ -1088,6 +1116,13 @@ export class EngineLoginManager {
     token: string,
   ): Promise<void> {
     let terminal: EngineLoginEventFrame;
+    if (operation.captureFlow !== null) {
+      await this.finishCapture(operation, {
+        authKind: "env",
+        env: { CLAUDE_CODE_OAUTH_TOKEN: token },
+      });
+      return;
+    }
     if (operation.accountLabel !== null) {
       // ADR-116: labeled capture — an extra account, not the default slot.
       // Extras are picked up at the next agent spawn / rotation, so no
@@ -1141,6 +1176,31 @@ export class EngineLoginManager {
     await this.finishCommit(operation, terminal);
   }
 
+  /** ADR-154: hand a capture to the box's sink and report its revision. */
+  private async finishCapture(
+    operation: LoginOperation,
+    material: EngineCaptureMaterial,
+  ): Promise<void> {
+    const sink = this.seams.captureEngineAccount;
+    const outcome =
+      sink && operation.captureFlow
+        ? await sink(operation.captureFlow, operation.engine, material)
+        : { ok: false, message: "Only the Uai Cloud sign-in box writes cloud credentials." };
+    await this.finishCommit(
+      operation,
+      outcome.ok && outcome.capture
+        ? {
+            kind: "engine.login.event",
+            opId: operation.opId,
+            engine: operation.engine,
+            phase: "succeeded",
+            message: outcome.message,
+            capture: outcome.capture,
+          }
+        : failedEvent(operation.opId, operation.engine, "persist_failed", outcome.message),
+    );
+  }
+
   private beginCodexFinish(operation: LoginOperation): void {
     if (
       !this.isCurrent(operation) ||
@@ -1164,6 +1224,28 @@ export class EngineLoginManager {
     const authFile = join(tempDir, grok ? "grok" : "codex", "auth.json");
     const label = grok ? "Grok" : "Codex";
     let terminal: EngineLoginEventFrame;
+    if (operation.captureFlow !== null) {
+      let contents: string;
+      try {
+        contents = await readFile(authFile, "utf8");
+      } catch {
+        await this.finishCommit(
+          operation,
+          failedEvent(
+            operation.opId,
+            operation.engine,
+            "persist_failed",
+            `${label} authorized, but its credential could not be read.`,
+          ),
+        );
+        return;
+      }
+      await this.finishCapture(operation, {
+        authKind: "config-dir",
+        files: { "auth.json": contents.endsWith("\n") ? contents : `${contents}\n` },
+      });
+      return;
+    }
     if (operation.accountLabel !== null) {
       // ADR-116: labeled capture — the auth.json this login produced becomes
       // an isolated extra account instead of overwriting ~/.codex.

package/lib/env-file.ts

@@ -89,13 +89,28 @@ export function removeEnvValuesAtomic(
   keys: readonly string[],
 ): string[] {
   if (keys.length === 0 || !existsSync(file)) return [];
-  for (const key of keys) {
-    if (!ENV_KEY.test(key)) throw new Error(`invalid environment key: ${key}`);
-  }
+  assertEnvKeys(keys);
+  const { body, removed } = withoutEnvKeys(readFileSync(file, "utf8"), keys);
+  if (removed.length > 0) replaceEnvFileAtomic(file, body);
+  return removed;
+}
+
+/**
+ * `body` without the lines that set any of `keys`, and the keys it dropped.
+ * A line sets a key as every writer here writes one: `KEY=value`, the key at
+ * the start of its own line. Pure, so that a caller that reads the file its
+ * own way (the cutover purge, which must not trust what it opens) drops
+ * exactly the lines `removeEnvValuesAtomic` would. With nothing dropped,
+ * `body` comes back as it was.
+ */
+export function withoutEnvKeys(
+  body: string,
+  keys: readonly string[],
+): { body: string; removed: string[] } {
+  assertEnvKeys(keys);
   const drop = new Set(keys);
   const removed: string[] = [];
-  const current = readFileSync(file, "utf8");
-  const kept = current.split(/\r?\n/).filter((line, index, lines) => {
+  const kept = body.split(/\r?\n/).filter((line, index, lines) => {
     if (index === lines.length - 1 && line === "") return false;
     const equals = line.indexOf("=");
     if (equals <= 0) return true;
@@ -104,9 +119,48 @@ export function removeEnvValuesAtomic(
     removed.push(key);
     return false;
   });
-  if (removed.length === 0) return [];
-  replaceEnvFileAtomic(file, kept.length === 0 ? "" : `${kept.join("\n")}\n`);
-  return [...new Set(removed)];
+  if (removed.length === 0) return { body, removed: [] };
+  return {
+    body: kept.length === 0 ? "" : `${kept.join("\n")}\n`,
+    removed: [...new Set(removed)],
+  };
+}
+
+/**
+ * The keys among `keys` whose line, as withoutEnvKeys finds it, opens a
+ * quoted value that it does not close: a value that runs on past its line,
+ * of which dropping that line would leave the rest. Read by this rule
+ * alone, not by any parser's notion of what a quoted value may hold, so it
+ * says the same under every Node: the value, its leading spaces aside,
+ * starts with `"`, `'` or a backtick, and no unescaped same quote follows on
+ * its line (a backslash takes the character after it).
+ */
+export function keysQuotedPastTheirLine(body: string, keys: readonly string[]): string[] {
+  assertEnvKeys(keys);
+  const wanted = new Set(keys);
+  const found = new Set<string>();
+  for (const line of body.split(/\r?\n/)) {
+    const equals = line.indexOf("=");
+    if (equals <= 0) continue;
+    const key = line.slice(0, equals);
+    if (!wanted.has(key)) continue;
+    const value = line.slice(equals + 1).trimStart();
+    const quote = value[0];
+    if (quote !== '"' && quote !== "'" && quote !== "`") continue;
+    let closed = false;
+    for (let index = 1; index < value.length && !closed; index += 1) {
+      if (value[index] === "\\") index += 1;
+      else closed = value[index] === quote;
+    }
+    if (!closed) found.add(key);
+  }
+  return [...found];
+}
+
+function assertEnvKeys(keys: readonly string[]): void {
+  for (const key of keys) {
+    if (!ENV_KEY.test(key)) throw new Error(`invalid environment key: ${key}`);
+  }
 }
 
 /** Capture the exact bytes needed to roll back a multi-store config write. */

package/lib/env.ts

@@ -76,6 +76,11 @@ if (!parsed.success) {
 }
 
 const raw = parsed.success ? parsed.data : schema.parse({});
+// The PAT is validated above but kept nowhere here: its one reader takes it
+// from process.env when it injects it (github-tokens.ts), and the cutover
+// purge removes it from there (ADR-154 §13). A long-lived copy in this
+// module would outlive that purge for the life of the process.
+delete raw.UAI_GH_PAT_FALLBACK;
 const here = dirname(fileURLToPath(import.meta.url)); // <pkg>/lib
 
 function expandHome(path: string): string {

package/lib/fs-aliases.ts

@@ -0,0 +1,49 @@
+/**
+ * ADR-154 §13: removing a credential by one name must not leave it under
+ * another. Shared by the cutover purge and the credential store's cleanup of
+ * staged writes.
+ */
+
+import { lstatSync, readdirSync, readlinkSync } from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+
+/**
+ * Throws, naming each, while removing `path` would leave another name of
+ * what is in it: a link in it that leads out of it (what it leads to stays,
+ * and the runner's own writes, which follow links, may have filled it), and
+ * a file in it with a second name (a hard link: the other name keeps its
+ * bytes). A link that leads somewhere inside it goes with it. Walked with
+ * lstat, following nothing; a link's target is taken from its own
+ * directory, by name, which is how the kernel follows it: one that leads
+ * out through another link on the way is caught at that link. `path` itself
+ * is no link (the callers checked).
+ */
+export function assertNoAliases(path: string): void {
+  const found: string[] = [];
+  const visit = (at: string): void => {
+    const stats = lstatSync(at, { bigint: true });
+    if (stats.isSymbolicLink()) {
+      const to = resolve(dirname(at), readlinkSync(at));
+      if (!isWithin(path, to)) found.push(`${at} (a symbolic link to ${to})`);
+      return;
+    }
+    if (stats.isDirectory()) {
+      for (const name of readdirSync(at)) visit(join(at, name));
+      return;
+    }
+    if (stats.nlink > 1n) found.push(`${at} (a file with ${stats.nlink} names)`);
+  };
+  visit(path);
+  if (found.length > 0) {
+    throw new Error(
+      `${found.join(", ")}: removing it would leave what the runner wrote through ` +
+        `${found.length === 1 ? "that" : "those"}; nothing here is removed until ` +
+        `${found.length === 1 ? "it is" : "they are"} gone`,
+    );
+  }
+}
+
+function isWithin(dir: string, path: string): boolean {
+  const rel = relative(dir, path);
+  return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
+}