@runuai/host 0.9.150 → 0.9.152

package/lib/task-machine-swap-safety.ts

@@ -0,0 +1,729 @@
+/**
+ * ADR-154 task-machine swap admission guard.
+ *
+ * A task machine must not ask for a credential lease until this guard has
+ * proved that plaintext cannot be paged to durable storage. No active swap is
+ * safe. Otherwise every active swap device must be a single dm-crypt mapping
+ * created in plain mode from `/dev/urandom`, with `swap` semantics. A device
+ * mapper mapping cannot survive a reboot and `/dev/urandom` supplies a new
+ * key whenever cryptsetup creates it, so that combination bounds the key and
+ * the plaintext it protects to the current boot.
+ *
+ * This is only an admission probe. The machine bootstrap owns replacing the
+ * legacy raw swap and removing it from the boot configuration before this is
+ * called.
+ */
+
+import { spawn } from "node:child_process";
+import { open } from "node:fs/promises";
+
+const PROC_SWAPS_PATH = "/proc/swaps";
+const CRYPTTAB_PATH = "/etc/crypttab";
+const DMSETUP_PATH = "/usr/sbin/dmsetup";
+const FINDFS_PATH = "/usr/sbin/findfs";
+const LOSETUP_PATH = "/usr/sbin/losetup";
+const READLINK_PATH = "/usr/bin/readlink";
+const STAT_PATH = "/usr/bin/stat";
+
+const FILE_TIMEOUT_MS = 2_000;
+const COMMAND_TIMEOUT_MS = 3_000;
+const PROC_SWAPS_MAX_BYTES = 64 * 1024;
+const CRYPTTAB_MAX_BYTES = 128 * 1024;
+const COMMAND_MAX_BYTES = 32 * 1024;
+const MAX_ACTIVE_SWAP_DEVICES = 16;
+
+const MAPPER_NAME = /^[A-Za-z0-9_.+-]{1,127}$/;
+const DEVICE_PATH = /^\/dev\/[A-Za-z0-9_.+:/-]{1,4089}$/;
+const DEVICE_SELECTOR = /^(?:UUID|PARTUUID)=[A-Fa-f0-9-]{1,128}$/;
+const INTEGER = /^(?:0|[1-9][0-9]*)$/;
+const SIGNED_INTEGER = /^-?(?:0|[1-9][0-9]*)$/;
+const SAFE_CIPHER = "aes-xts-plain64";
+const SAFE_KEY_BITS = 512;
+/** The task-machine bootstrap's one root-owned loop backing file. */
+const MANAGED_SWAP_FILE = "/swapfile";
+const APPROVED_CRYPTTAB_OPTIONS = new Set([
+  "plain",
+  "swap",
+  "cipher",
+  "size",
+]);
+
+export type SwapSafetyCommandResult =
+  | { ok: true; stdout: string }
+  | {
+      ok: false;
+      reason:
+        | "spawn"
+        | "timeout"
+        | "output-limit"
+        | "invalid-output"
+        | "exit";
+    };
+
+export interface SwapSafetyIo {
+  /** Read at most maxBytes and fail if the read does not finish in time. */
+  readText(
+    path: string,
+    limits: { maxBytes: number; timeoutMs: number },
+  ): Promise<string>;
+  /** Execute an argv directly (never through a shell), with bounded output. */
+  runFile(
+    command: string,
+    args: readonly string[],
+    limits: { maxOutputBytes: number; timeoutMs: number },
+  ): Promise<SwapSafetyCommandResult>;
+}
+
+export type TaskMachineSwapSafetyVerdict =
+  | {
+      ok: true;
+      proof: "no-active-swap" | "boot-ephemeral-dm-crypt";
+      activeSwapDevices: readonly string[];
+    }
+  | {
+      ok: false;
+      code:
+        | "unsupported-platform"
+        | "swap-state-unreadable"
+        | "swap-state-malformed"
+        | "too-many-swap-devices"
+        | "crypttab-unreadable"
+        | "crypttab-malformed"
+        | "swap-not-device-mapper"
+        | "swap-not-boot-ephemeral"
+        | "swap-probe-failed";
+      reason: string;
+      activeSwapDevices: readonly string[];
+      device?: string;
+    };
+
+export interface TaskMachineSwapSafetyOptions {
+  io?: SwapSafetyIo;
+  platform?: NodeJS.Platform;
+}
+
+interface ActiveSwap {
+  path: string;
+  sizeKiB: number;
+}
+
+interface CrypttabEntry {
+  name: string;
+  source: string;
+  keyFile: string | null;
+  options: Map<string, string | null>;
+}
+
+interface DeviceMapperInfo {
+  name: string;
+  uuid: string;
+}
+
+class SwapParseError extends Error {
+  constructor(
+    readonly kind: "malformed" | "too-many",
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
+function safeInteger(raw: string, signed = false): number | null {
+  if (!(signed ? SIGNED_INTEGER : INTEGER).test(raw)) return null;
+  const value = Number(raw);
+  return Number.isSafeInteger(value) ? value : null;
+}
+
+function parseProcSwaps(raw: string): ActiveSwap[] {
+  if (raw.includes("\0") || raw.includes("\r")) {
+    throw new SwapParseError("malformed", "the kernel swap table is malformed");
+  }
+  const lines = raw.split("\n");
+  if (lines.at(-1) === "") lines.pop();
+  const header = lines.shift();
+  if (!header || header.trim().split(/\s+/).join(" ") !== "Filename Type Size Used Priority") {
+    throw new SwapParseError("malformed", "the kernel swap table header is malformed");
+  }
+
+  if (lines.length > MAX_ACTIVE_SWAP_DEVICES) {
+    throw new SwapParseError(
+      "too-many",
+      `more than ${MAX_ACTIVE_SWAP_DEVICES} swap devices are active`,
+    );
+  }
+
+  const seen = new Set<string>();
+  const swaps: ActiveSwap[] = [];
+  for (const line of lines) {
+    if (line.trim() === "") {
+      throw new SwapParseError("malformed", "the kernel swap table contains an empty row");
+    }
+    const fields = line.trim().split(/\s+/);
+    if (fields.length !== 5) {
+      throw new SwapParseError("malformed", "the kernel swap table contains an ambiguous row");
+    }
+    const [path, type, rawSize, rawUsed, rawPriority] = fields as [
+      string,
+      string,
+      string,
+      string,
+      string,
+    ];
+    const sizeKiB = safeInteger(rawSize);
+    const usedKiB = safeInteger(rawUsed);
+    const priority = safeInteger(rawPriority, true);
+    if (
+      type !== "partition" ||
+      !DEVICE_PATH.test(path) ||
+      path.split("/").some((part) => part === "." || part === "..") ||
+      sizeKiB === null ||
+      sizeKiB < 1 ||
+      usedKiB === null ||
+      usedKiB < 0 ||
+      usedKiB > sizeKiB ||
+      priority === null
+    ) {
+      throw new SwapParseError(
+        "malformed",
+        "every active swap row must name one unambiguous block device",
+      );
+    }
+    if (seen.has(path)) {
+      throw new SwapParseError("malformed", "the kernel swap table contains a duplicate device");
+    }
+    seen.add(path);
+    swaps.push({ path, sizeKiB });
+  }
+  return swaps;
+}
+
+function stripCrypttabComment(line: string): string {
+  const comment = line.search(/(?:^|\s)#/);
+  return comment < 0 ? line : line.slice(0, comment).trimEnd();
+}
+
+function parseCrypttabOptions(raw: string): Map<string, string | null> {
+  const options = new Map<string, string | null>();
+  for (const item of raw.split(",")) {
+    if (item === "" || item.includes("\\") || /\s/.test(item)) {
+      throw new Error("invalid crypttab option");
+    }
+    const separator = item.indexOf("=");
+    const key = separator < 0 ? item : item.slice(0, separator);
+    const value = separator < 0 ? null : item.slice(separator + 1);
+    if (
+      !/^[a-z][a-z0-9-]*$/.test(key) ||
+      value === "" ||
+      options.has(key)
+    ) {
+      throw new Error("invalid crypttab option");
+    }
+    options.set(key, value);
+  }
+  return options;
+}
+
+function parseCrypttab(raw: string): Map<string, CrypttabEntry> {
+  if (raw.includes("\0") || raw.includes("\r")) {
+    throw new Error("crypttab is malformed");
+  }
+  const entries = new Map<string, CrypttabEntry>();
+  for (const original of raw.split("\n")) {
+    const line = stripCrypttabComment(original).trim();
+    if (line === "" || line.startsWith("#")) continue;
+    const fields = line.split(/\s+/);
+    if (fields.length < 2 || fields.length > 4) {
+      throw new Error("crypttab contains an ambiguous row");
+    }
+    const [name, source, keyFile = null, rawOptions = "defaults"] = fields;
+    if (
+      !name ||
+      !MAPPER_NAME.test(name) ||
+      !source ||
+      source.length > 4096 ||
+      source.includes("\\") ||
+      (source !== MANAGED_SWAP_FILE &&
+        !DEVICE_PATH.test(source) &&
+        !DEVICE_SELECTOR.test(source)) ||
+      (keyFile !== null &&
+        (keyFile.length > 4096 || keyFile.includes("\\"))) ||
+      entries.has(name)
+    ) {
+      throw new Error("crypttab contains an ambiguous row");
+    }
+    entries.set(name, {
+      name,
+      source,
+      keyFile,
+      options: parseCrypttabOptions(rawOptions),
+    });
+  }
+  return entries;
+}
+
+function parseDmInfo(raw: string): DeviceMapperInfo | null {
+  const lines = raw.trim().split("\n");
+  if (lines.length !== 1 || lines[0] === "") return null;
+  const fields = lines[0]!.split("\t").map((field) => field.trim());
+  if (fields.length !== 4) return null;
+  const [name, uuid, rawSegments, attributes] = fields as [
+    string,
+    string,
+    string,
+    string,
+  ];
+  if (
+    !MAPPER_NAME.test(name) ||
+    !uuid.startsWith("CRYPT-PLAIN-") ||
+    !uuid.endsWith(`-${name}`) ||
+    safeInteger(rawSegments) !== 1 ||
+    // Live table, no inactive replacement waiting, not suspended, writable.
+    attributes !== "L--w"
+  ) {
+    return null;
+  }
+  return { name, uuid };
+}
+
+function crypttabEntryIsBootEphemeral(entry: CrypttabEntry): boolean {
+  if ([...entry.options.keys()].some((name) => !APPROVED_CRYPTTAB_OPTIONS.has(name))) {
+    return false;
+  }
+  return (
+    entry.keyFile === "/dev/urandom" &&
+    entry.options.get("swap") === null &&
+    // systemd's `swap` option itself implies plain mode. Accepting an
+    // explicit valueless `plain` is harmless; a value-bearing lookalike is
+    // not. Cipher and key size are mandatory so the next boot cannot fall
+    // back to distro defaults that differ from the live table proved below.
+    (!entry.options.has("plain") || entry.options.get("plain") === null) &&
+    entry.options.get("cipher") === SAFE_CIPHER &&
+    entry.options.get("size") === String(SAFE_KEY_BITS)
+  );
+}
+
+function safeDmTable(raw: string): { backing: string } | null {
+  const lines = raw.trim().split("\n");
+  if (lines.length !== 1 || lines[0] === "") return null;
+  const fields = lines[0]!.trim().split(/\s+/);
+  // No optional dm-crypt target features are approved. In particular,
+  // allow_discards would reveal allocation patterns and must not be smuggled
+  // into the live table independently of crypttab.
+  if (fields.length !== 8) return null;
+  const [rawStart, rawLength, target, cipher, hiddenKey, rawIvOffset, backing, rawDataOffset] =
+    fields as [string, string, string, string, string, string, string, string];
+  if (
+    safeInteger(rawStart) === 0 &&
+    (safeInteger(rawLength) ?? 0) > 0 &&
+    target === "crypt" &&
+    cipher === SAFE_CIPHER &&
+    hiddenKey.length === SAFE_KEY_BITS / 4 &&
+    /^0+$/.test(hiddenKey) &&
+    safeInteger(rawIvOffset) !== null &&
+    /^[0-9]+:[0-9]+$/.test(backing) &&
+    safeInteger(rawDataOffset) !== null
+  ) {
+    return { backing };
+  }
+  return null;
+}
+
+function oneLine(raw: string): string | null {
+  const lines = raw.trim().split("\n");
+  return lines.length === 1 && lines[0] !== "" ? lines[0]! : null;
+}
+
+async function resolvedSourceDeviceNumber(
+  entry: CrypttabEntry,
+  io: SwapSafetyIo,
+  limits: { maxOutputBytes: number; timeoutMs: number },
+): Promise<string | null> {
+  let path = entry.source;
+  if (DEVICE_SELECTOR.test(path)) {
+    const found = await io.runFile(FINDFS_PATH, [path], limits);
+    if (!found.ok) return null;
+    const value = oneLine(found.stdout);
+    if (!value || !DEVICE_PATH.test(value)) return null;
+    path = value;
+  }
+  const resolved = await io.runFile(READLINK_PATH, ["-f", "--", path], limits);
+  if (!resolved.ok) return null;
+  const device = oneLine(resolved.stdout);
+  if (!device || !DEVICE_PATH.test(device)) return null;
+  const stat = await io.runFile(
+    STAT_PATH,
+    ["--format=%t:%T", "--", device],
+    limits,
+  );
+  if (!stat.ok) return null;
+  const rawNumber = oneLine(stat.stdout);
+  const match = rawNumber?.match(/^([0-9a-fA-F]+):([0-9a-fA-F]+)$/);
+  if (!match) return null;
+  const major = Number.parseInt(match[1]!, 16);
+  const minor = Number.parseInt(match[2]!, 16);
+  if (!Number.isSafeInteger(major) || !Number.isSafeInteger(minor)) return null;
+  return `${String(major)}:${String(minor)}`;
+}
+
+async function configuredSourceMatchesBacking(
+  entry: CrypttabEntry,
+  liveBacking: string,
+  io: SwapSafetyIo,
+  limits: { maxOutputBytes: number; timeoutMs: number },
+): Promise<boolean> {
+  if (entry.source !== MANAGED_SWAP_FILE) {
+    return (await resolvedSourceDeviceNumber(entry, io, limits)) === liveBacking;
+  }
+
+  // cryptsetup attaches a regular-file source through a loop device. Bind
+  // all three identities: the canonical root-owned 0600 file, the loop node
+  // named by the live dm table, and that loop node's reported backing file.
+  const resolvedFile = await io.runFile(
+    READLINK_PATH,
+    ["-f", "--", MANAGED_SWAP_FILE],
+    limits,
+  );
+  if (!resolvedFile.ok || oneLine(resolvedFile.stdout) !== MANAGED_SWAP_FILE) {
+    return false;
+  }
+  const fileStat = await io.runFile(
+    STAT_PATH,
+    ["--format=%F\t%u\t%a", "--", MANAGED_SWAP_FILE],
+    limits,
+  );
+  if (!fileStat.ok || oneLine(fileStat.stdout) !== "regular file\t0\t600") {
+    return false;
+  }
+  if (!/^[0-9]+:[0-9]+$/.test(liveBacking)) return false;
+  const blockLink = `/dev/block/${liveBacking}`;
+  const resolvedLoop = await io.runFile(
+    READLINK_PATH,
+    ["-f", "--", blockLink],
+    limits,
+  );
+  const loopDevice = resolvedLoop.ok ? oneLine(resolvedLoop.stdout) : null;
+  if (!loopDevice || !/^\/dev\/loop[0-9]+$/.test(loopDevice)) return false;
+  const loopBacking = await io.runFile(
+    LOSETUP_PATH,
+    ["--noheadings", "--raw", "--output", "BACK-FILE", loopDevice],
+    limits,
+  );
+  return loopBacking.ok && oneLine(loopBacking.stdout) === MANAGED_SWAP_FILE;
+}
+
+function failure(
+  code: Exclude<TaskMachineSwapSafetyVerdict, { ok: true }>["code"],
+  reason: string,
+  activeSwapDevices: readonly string[],
+  device?: string,
+): TaskMachineSwapSafetyVerdict {
+  return { ok: false, code, reason, activeSwapDevices, device };
+}
+
+async function verifyDevice(
+  swap: ActiveSwap,
+  entries: Map<string, CrypttabEntry>,
+  io: SwapSafetyIo,
+  activeSwapDevices: readonly string[],
+): Promise<TaskMachineSwapSafetyVerdict | null> {
+  const limits = {
+    maxOutputBytes: COMMAND_MAX_BYTES,
+    timeoutMs: COMMAND_TIMEOUT_MS,
+  };
+  const info = await io.runFile(
+    DMSETUP_PATH,
+    [
+      "info",
+      "--columns",
+      "--noheadings",
+      "--separator",
+      "\t",
+      "--options",
+      "name,uuid,segments,attr",
+      swap.path,
+    ],
+    limits,
+  );
+  if (!info.ok) {
+    return failure(
+      info.reason === "exit" ? "swap-not-device-mapper" : "swap-probe-failed",
+      info.reason === "exit"
+        ? `active swap ${swap.path} is not a readable device-mapper mapping`
+        : `the device-mapper identity probe for ${swap.path} did not complete safely`,
+      activeSwapDevices,
+      swap.path,
+    );
+  }
+  const identity = parseDmInfo(info.stdout);
+  if (!identity) {
+    return failure(
+      "swap-not-device-mapper",
+      `active swap ${swap.path} is not one plain, cryptsetup-owned device-mapper mapping`,
+      activeSwapDevices,
+      swap.path,
+    );
+  }
+
+  const entry = entries.get(identity.name);
+  if (!entry || !crypttabEntryIsBootEphemeral(entry)) {
+    return failure(
+      "swap-not-boot-ephemeral",
+      `active swap ${swap.path} has no unambiguous boot-ephemeral crypttab entry`,
+      activeSwapDevices,
+      swap.path,
+    );
+  }
+
+  // Deliberately omit dmsetup's --showkeys. The default table view replaces
+  // the key with zeroes; checking that mask also fails closed if a platform's
+  // dmsetup would unexpectedly expose key material in its ordinary output.
+  const table = await io.runFile(
+    DMSETUP_PATH,
+    ["table", "--target", "crypt", swap.path],
+    limits,
+  );
+  if (!table.ok) {
+    return failure(
+      "swap-probe-failed",
+      `the encrypted mapping probe for ${swap.path} did not complete safely`,
+      activeSwapDevices,
+      swap.path,
+    );
+  }
+  const liveTable = safeDmTable(table.stdout);
+  if (!liveTable) {
+    return failure(
+      "swap-not-boot-ephemeral",
+      `active swap ${swap.path} is not one ${SAFE_KEY_BITS}-bit ${SAFE_CIPHER} mapping`,
+      activeSwapDevices,
+      swap.path,
+    );
+  }
+  // crypttab states how this boot creates the mapping; the live table states
+  // what it actually protects. Bind the two so an identically named mapping
+  // over another device cannot borrow the safe policy entry. The hidden key
+  // itself is intentionally not observable; this proof trusts the root-owned
+  // boot policy plus its exact live dm-crypt identity.
+  const backingMatches = await configuredSourceMatchesBacking(
+    entry,
+    liveTable.backing,
+    io,
+    limits,
+  );
+  if (!backingMatches) {
+    return failure(
+      "swap-not-boot-ephemeral",
+      `active swap ${swap.path} is not bound to its boot-ephemeral source`,
+      activeSwapDevices,
+      swap.path,
+    );
+  }
+  return null;
+}
+
+/**
+ * Return an admission verdict. Callers must ask for no lease and read no
+ * credential parameter when `ok` is false.
+ */
+export async function verifyTaskMachineSwapSafety(
+  options: TaskMachineSwapSafetyOptions = {},
+): Promise<TaskMachineSwapSafetyVerdict> {
+  if ((options.platform ?? process.platform) !== "linux") {
+    return failure(
+      "unsupported-platform",
+      "task-machine swap safety can only be proved on Linux",
+      [],
+    );
+  }
+  const io = options.io ?? nodeSwapSafetyIo;
+  let rawSwaps: string;
+  try {
+    rawSwaps = await io.readText(PROC_SWAPS_PATH, {
+      maxBytes: PROC_SWAPS_MAX_BYTES,
+      timeoutMs: FILE_TIMEOUT_MS,
+    });
+  } catch {
+    return failure(
+      "swap-state-unreadable",
+      "the active kernel swap table could not be read safely",
+      [],
+    );
+  }
+
+  let swaps: ActiveSwap[];
+  try {
+    swaps = parseProcSwaps(rawSwaps);
+  } catch (error) {
+    const kind = error instanceof SwapParseError ? error.kind : "malformed";
+    return failure(
+      kind === "too-many" ? "too-many-swap-devices" : "swap-state-malformed",
+      error instanceof Error ? error.message : "the kernel swap table is malformed",
+      [],
+    );
+  }
+  const activeSwapDevices = swaps.map((swap) => swap.path);
+  if (swaps.length === 0) {
+    return { ok: true, proof: "no-active-swap", activeSwapDevices };
+  }
+
+  let rawCrypttab: string;
+  try {
+    rawCrypttab = await io.readText(CRYPTTAB_PATH, {
+      maxBytes: CRYPTTAB_MAX_BYTES,
+      timeoutMs: FILE_TIMEOUT_MS,
+    });
+  } catch {
+    return failure(
+      "crypttab-unreadable",
+      "active swap exists but its boot-time key policy could not be read safely",
+      activeSwapDevices,
+    );
+  }
+  let entries: Map<string, CrypttabEntry>;
+  try {
+    entries = parseCrypttab(rawCrypttab);
+  } catch {
+    return failure(
+      "crypttab-malformed",
+      "active swap exists but its boot-time key policy is ambiguous",
+      activeSwapDevices,
+    );
+  }
+
+  // Probe independently, but concurrently: the total admission latency stays
+  // bounded by two command timeouts rather than growing with the swap count.
+  const verdicts = await Promise.all(
+    swaps.map((swap) =>
+      verifyDevice(swap, entries, io, activeSwapDevices).catch(() =>
+        failure(
+          "swap-probe-failed",
+          `the swap safety probe for ${swap.path} failed closed`,
+          activeSwapDevices,
+          swap.path,
+        ),
+      ),
+    ),
+  );
+  const rejected = verdicts.find(
+    (verdict): verdict is Exclude<TaskMachineSwapSafetyVerdict, { ok: true }> =>
+      verdict !== null && !verdict.ok,
+  );
+  if (rejected) return rejected;
+  return {
+    ok: true,
+    proof: "boot-ephemeral-dm-crypt",
+    activeSwapDevices,
+  };
+}
+
+async function withTimeout<T>(
+  promise: Promise<T>,
+  timeoutMs: number,
+): Promise<T> {
+  let timer: NodeJS.Timeout | undefined;
+  try {
+    return await Promise.race([
+      promise,
+      new Promise<T>((_resolve, reject) => {
+        timer = setTimeout(() => reject(new Error("swap safety read timed out")), timeoutMs);
+        timer.unref();
+      }),
+    ]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
+async function readBoundedText(
+  path: string,
+  limits: { maxBytes: number; timeoutMs: number },
+): Promise<string> {
+  const read = (async (): Promise<string> => {
+    const handle = await open(path, "r");
+    try {
+      const buffer = Buffer.allocUnsafe(limits.maxBytes + 1);
+      let offset = 0;
+      while (offset < buffer.length) {
+        const { bytesRead } = await handle.read(
+          buffer,
+          offset,
+          buffer.length - offset,
+          null,
+        );
+        if (bytesRead === 0) break;
+        offset += bytesRead;
+      }
+      if (offset > limits.maxBytes) throw new Error("swap safety file exceeds limit");
+      return new TextDecoder("utf-8", { fatal: true }).decode(buffer.subarray(0, offset));
+    } finally {
+      await handle.close();
+    }
+  })();
+  return withTimeout(read, limits.timeoutMs);
+}
+
+function runBoundedFile(
+  command: string,
+  args: readonly string[],
+  limits: { maxOutputBytes: number; timeoutMs: number },
+): Promise<SwapSafetyCommandResult> {
+  return new Promise((resolve) => {
+    let settled = false;
+    let outputBytes = 0;
+    let timer: NodeJS.Timeout | undefined;
+    const stdout: Buffer[] = [];
+    const finish = (result: SwapSafetyCommandResult): void => {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      resolve(result);
+    };
+    const child = spawn(command, [...args], {
+      env: {
+        LANG: "C",
+        LC_ALL: "C",
+        PATH: "/usr/sbin:/usr/bin:/sbin:/bin",
+      },
+      shell: false,
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true,
+    });
+    const consume = (chunk: Buffer, keep: boolean): void => {
+      if (settled) return;
+      outputBytes += chunk.length;
+      if (outputBytes > limits.maxOutputBytes) {
+        child.kill("SIGKILL");
+        finish({ ok: false, reason: "output-limit" });
+        return;
+      }
+      if (keep) stdout.push(chunk);
+    };
+    child.stdout.on("data", (chunk: Buffer) => consume(chunk, true));
+    child.stderr.on("data", (chunk: Buffer) => consume(chunk, false));
+    child.once("error", () => finish({ ok: false, reason: "spawn" }));
+    child.once("close", (code) => {
+      if (code !== 0) {
+        finish({ ok: false, reason: "exit" });
+        return;
+      }
+      try {
+        finish({
+          ok: true,
+          stdout: new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(stdout)),
+        });
+      } catch {
+        finish({ ok: false, reason: "invalid-output" });
+      }
+    });
+    timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      finish({ ok: false, reason: "timeout" });
+    }, limits.timeoutMs);
+    timer.unref();
+  });
+}
+
+const nodeSwapSafetyIo: SwapSafetyIo = {
+  readText: readBoundedText,
+  runFile: runBoundedFile,
+};