@zaip-ai/cli 6.2.0 → 7.5.0

package/templates/.agents/tools/cloud-runner.test.mjs

@@ -1,9 +1,8 @@
 import assert from "node:assert/strict";
-import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { relative, resolve } from "node:path";
 import test from "node:test";
-import { execute, run } from "./cloud-runner.mjs";
+import { run } from "./cloud-runner.mjs";
 
 const root = resolve(import.meta.dirname, "../..");
 const path = ".agents/config/autonomous-cloud-contract.json";
@@ -85,8 +84,8 @@ function fixture() {
       import_targets: { "hostinger_vps.edge[0]": "101" },
       plan: {
         backend,
-        path: ".local/cloud/plans/test.tfplan",
-        policy_json_path: ".local/cloud/plans/test.json",
+        path: ".agents/private/state/cloud/plans/test.tfplan",
+        policy_json_path: ".agents/private/state/cloud/plans/test.json",
         policy_contract_path: ".agents/config/test-policy.json",
       },
     },
@@ -281,9 +280,11 @@ test("DNS writes use exact names and read-after-write, rejecting ambiguity", asy
   f.contract.cloudflare.direct_dns_records["probe.example.com"].name = "elsewhere.example.com";
   f.save();
   await assert.rejects(run(cf("cloudflare:dns:edit"), f.deps), /target_mismatch/);
+  f.contract.cloudflare.direct_dns_records["probe.example.com"].name = "probe.example.com";
+  f.save();
   f.setRecords([
-    { id: "one", name: "probe.example.com" },
-    { id: "two", name: "probe.example.com" },
+    { id: "one", name: "probe.example.com", type: "A" },
+    { id: "two", name: "probe.example.com", type: "A" },
   ]);
   await assert.rejects(run(cf("cloudflare:dns:read"), f.deps), /ambiguous_dns_record/);
 });
@@ -496,39 +497,3 @@ test("a lost DNS mutation response requires observation before a retry", async (
   assert.ok((await run(cf("cloudflare:dns:read"), f.deps)).targets.includes("dns-id"));
   assert.equal(f.calls.filter((call) => call.method === "POST").length, 1);
 });
-
-test("real subprocess preserves large JSON and reports overflow and timeout", async () => {
-  const result = await execute(
-    process.execPath,
-    ["-e", "process.stdout.write(JSON.stringify({data:'x'.repeat(50000)}))"],
-    { maxOutput: 60_000 },
-  );
-  assert.equal(result.code, 0);
-  assert.equal(JSON.parse(result.stdout).data.length, 50_000);
-  const overflow = await execute(
-    process.execPath,
-    ["-e", "process.stdout.write('x'.repeat(50000))"],
-    { maxOutput: 100 },
-  );
-  assert.notEqual(overflow.code, 0);
-  assert.equal(overflow.overflow, true);
-  const timeout = await execute(process.execPath, ["-e", "setInterval(()=>{},1000)"], {
-    timeout: 100,
-  });
-  assert.notEqual(timeout.code, 0);
-  assert.equal(timeout.timedOut, true);
-});
-
-test("CLI rejects invalid and duplicate arguments with sanitized errors", () => {
-  for (const args of [
-    ["--operation", "invalid"],
-    ["--operation", "contract:derive", "--operation", "invalid"],
-  ]) {
-    const result = spawnSync(process.execPath, [".agents/tools/cloud-runner.mjs", ...args], {
-      cwd: root,
-      encoding: "utf8",
-    });
-    assert.notEqual(result.status, 0);
-    assert.deepEqual(JSON.parse(result.stderr), { ok: false, code: "invalid_arguments" });
-  }
-});

package/templates/.agents/tools/historical-local-archive.mjs

@@ -0,0 +1,89 @@
+// Generated from packages/core/src/historical-local-archive.ts; do not edit.
+
+// packages/core/src/historical-local-archive.ts
+import { createHash } from "node:crypto";
+import { lstat, readFile, realpath } from "node:fs/promises";
+import { resolve } from "node:path";
+
+var digest = (value) => createHash("sha256").update(value).digest("hex");
+var same = (a, b) => (process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b);
+async function physical(root, name) {
+  if (/[\\:]/.test(name) || name.split("/").some((part) => !part || part === "." || part === ".."))
+    throw new Error("Invalid historical archive path");
+  let cursor = resolve(root);
+  for (const part of ["", ...name.split("/")]) {
+    if (part) cursor = resolve(cursor, part);
+    const info = await lstat(cursor);
+    if (
+      info.isSymbolicLink() ||
+      !same(await realpath(cursor), cursor) ||
+      (info.isFile() && info.nlink !== 1)
+    )
+      throw new Error("Historical archive refuses physical aliases");
+  }
+  return cursor;
+}
+async function json(root, name, limit) {
+  const path = await physical(root, name),
+    info = await lstat(path);
+  if (!info.isFile() || info.size > limit) throw new Error("Invalid historical archive metadata");
+  return JSON.parse(await readFile(path, "utf8"));
+}
+async function resolveHistoricalLocalArchive(root, name) {
+  const original = resolve(root, name);
+  try {
+    await lstat(original);
+    return original;
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  let plan;
+  try {
+    plan = await json(root, ".agents/private/state/local-legacy/index.json", 8 * 1024 * 1024);
+  } catch (error) {
+    if (error.code === "ENOENT") return original;
+    throw error;
+  }
+  const { id, ...body } = plan;
+  if (
+    plan.schema_version !== 1 ||
+    !same(plan.root, resolve(root)) ||
+    !Array.isArray(plan.rows) ||
+    plan.rows.length > 2e4 ||
+    id !== digest(JSON.stringify(body))
+  )
+    throw new Error("Historical archive index changed");
+  const receipt = await json(root, ".agents/state/storage-migrations/local-archive.json", 4096);
+  if (receipt.id !== id || receipt.manifest_sha256 !== digest(JSON.stringify(plan)))
+    throw new Error("Historical archive lacks its verified move receipt");
+  const prefix = name.split("/").slice(0, 2).join("/");
+  const rows = plan.rows.filter((row2) => row2.source === prefix);
+  if (!rows.length) return original;
+  if (rows.length !== 1) throw new Error("Ambiguous historical archive prefix");
+  const row = rows[0];
+  if (!row) throw new Error("Missing historical archive row");
+  const leaf = prefix.slice(7);
+  const allowed = [
+    `.agents/private/state/${leaf}`,
+    `.agents/private/state/local-legacy/${row.kind === "file" ? "files" : "directories"}/${leaf}`,
+  ];
+  if (!allowed.includes(row.destination) || !["file", "directory"].includes(row.kind))
+    throw new Error("Historical archive destination differs");
+  const parent = await physical(root, row.destination),
+    parentInfo = await lstat(parent);
+  if (parentInfo.dev !== row.dev || parentInfo.ino !== row.ino)
+    throw new Error("Historical archive identity changed");
+  const destination = `${row.destination}${name.slice(prefix.length)}`;
+  let target;
+  try {
+    target = await physical(root, destination);
+  } catch (error) {
+    if (error.code === "ENOENT") return original;
+    throw error;
+  }
+  if (row.kind === "file" && digest(await readFile(target)) !== row.sha256)
+    throw new Error("Historical archived file changed");
+  return target;
+}
+
+export { resolveHistoricalLocalArchive };

package/templates/.agents/tools/infisical-bootstrap-windows.test.mjs

@@ -0,0 +1,12 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { bootstrap } from "./infisical-bootstrap.mjs";
+import { fixture } from "./infisical-bootstrap.test-support.mjs";
+
+test("Windows requires explicit credential ACL review receipt before credential delivery", async (t) => {
+  assert.equal(process.platform, "win32", "This mandatory ACL suite requires native Windows");
+  const f = await fixture(t, { security: {} });
+  await assert.rejects(bootstrap(f.args, { root: f.root, fetch: () => assert.fail("network") }), {
+    safeCode: "windows_acl_review_required",
+  });
+});

package/templates/.agents/tools/infisical-bootstrap.mjs

@@ -0,0 +1,240 @@
+import {
+  constants,
+  createCipheriv,
+  createPublicKey,
+  publicEncrypt,
+  randomBytes,
+} from "node:crypto";
+import { lstat, mkdir, realpath, writeFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { parseEnv } from "node:util";
+import { argumentsFor, fail, hash, localFile, origin } from "./infisical-policy.mjs";
+
+const workspace = resolve(import.meta.dirname, "../..");
+const destination = ".agents/private/state/credentials/infisical-bootstrap";
+const codes = new Set([
+  "invalid_arguments",
+  "invalid_contract",
+  "invalid_origin",
+  "authorization_missing",
+  "recovery_key_mismatch",
+  "invalid_recovery_key",
+  "credential_missing",
+  "unsafe_path",
+  "unsafe_credential_path",
+  "linked_path",
+  "unsafe_file",
+  "unsafe_file_permissions",
+  "bootstrap_attempt_exists",
+  "bootstrap_rejected",
+  "bootstrap_uncertain",
+  "windows_acl_review_required",
+]);
+export const diagnostic = (error) => ({
+  ok: false,
+  code: codes.has(error?.safeCode) ? error.safeCode : "bootstrap_failed",
+});
+
+export function validateBootstrap(c) {
+  if (
+    c?.version !== 1 ||
+    c.provider !== "infisical-self-hosted" ||
+    c.mode !== "first-initialization"
+  )
+    fail("invalid_contract");
+  origin(c.origin);
+  if (
+    c.authorization?.approved !== true ||
+    c.authorization.operation !== "bootstrap" ||
+    typeof c.authorization.reference !== "string" ||
+    !c.authorization.reference.trim() ||
+    c.authorization.uninitializedInstanceConfirmed !== true
+  )
+    fail("authorization_missing");
+  if (
+    typeof c.credentialsFile !== "string" ||
+    !/^\.agents\/private\/state\/credentials\/[a-zA-Z0-9_./-]+$/.test(c.credentialsFile) ||
+    c.credentialsFile.split("/").some((part) => !part || part === "." || part === "..") ||
+    typeof c.recoveryPublicKey?.path !== "string" ||
+    !/^[a-f0-9]{64}$/.test(c.recoveryPublicKey.sha256 ?? "")
+  )
+    fail("invalid_contract");
+  return c;
+}
+
+async function privateDirectory(base, relative) {
+  let current = base;
+  for (const part of relative.split("/")) {
+    current = resolve(current, part);
+    await mkdir(current, { mode: 0o700 }).catch((e) => {
+      if (e.code !== "EEXIST") throw e;
+    });
+    const info = await lstat(current);
+    if (!info.isDirectory() || info.isSymbolicLink() || (await realpath(current)) !== current)
+      fail("linked_path");
+    if (current === resolve(base, relative) && process.platform !== "win32" && info.mode & 0o077)
+      fail("unsafe_file_permissions");
+  }
+  return current;
+}
+
+function seal(value, key, context) {
+  const dataKey = randomBytes(32),
+    iv = randomBytes(12);
+  try {
+    const cipher = createCipheriv("aes-256-gcm", dataKey, iv);
+    cipher.setAAD(Buffer.from(JSON.stringify(context), "utf8"));
+    const ciphertext = Buffer.concat([
+      cipher.update(JSON.stringify(value), "utf8"),
+      cipher.final(),
+    ]);
+    return {
+      version: 1,
+      algorithm: "RSA-OAEP-SHA256+AES-256-GCM",
+      context,
+      wrappedKey: publicEncrypt(
+        { key, padding: constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha256" },
+        dataKey,
+      ).toString("base64"),
+      iv: iv.toString("base64"),
+      tag: cipher.getAuthTag().toString("base64"),
+      ciphertext: ciphertext.toString("base64"),
+    };
+  } finally {
+    dataKey.fill(0);
+  }
+}
+
+/** One-shot bootstrap; only encrypted administrator credentials reach disk. Never retries POST. */
+export async function bootstrap(args, injected = {}) {
+  const base = await realpath(injected.root ?? workspace);
+  if (!["validate", "bootstrap"].includes(args.operation) || !args.contract)
+    fail("invalid_arguments");
+  const contractFile = await localFile(base, args.contract);
+  const c = validateBootstrap(JSON.parse(contractFile.bytes.toString("utf8")));
+  const keyFile = await localFile(base, c.recoveryPublicKey.path, { max: 16384 });
+  if (hash(keyFile.bytes) !== c.recoveryPublicKey.sha256) fail("recovery_key_mismatch");
+  if (!keyFile.bytes.toString("utf8").startsWith("-----BEGIN PUBLIC KEY-----"))
+    fail("invalid_recovery_key");
+  let key;
+  try {
+    key = createPublicKey(keyFile.bytes);
+  } catch {
+    fail("invalid_recovery_key");
+  }
+  if (key.asymmetricKeyType !== "rsa" || key.asymmetricKeyDetails.modulusLength < 3072)
+    fail("invalid_recovery_key");
+  if (args.operation === "validate")
+    return { ok: true, operation: "validate", remoteOperations: false };
+  if (process.platform === "win32" && c.security?.windowsCredentialAclReviewed !== true)
+    fail("windows_acl_review_required");
+  const credentials = parseEnv(
+    (await localFile(base, c.credentialsFile, { secret: true, max: 16384 })).bytes.toString("utf8"),
+  );
+  const {
+    INFISICAL_ADMIN_EMAIL: email,
+    INFISICAL_ADMIN_PASSWORD: password,
+    INFISICAL_ORGANIZATION: organization,
+  } = credentials;
+  if (
+    !email ||
+    !/^[^\s@]+@[^\s@]+$/.test(email) ||
+    !password ||
+    password.length < 16 ||
+    password.includes("\0") ||
+    !organization?.trim()
+  )
+    fail("credential_missing");
+  await privateDirectory(base, ".agents/private/state/credentials");
+  const output = resolve(base, destination);
+  try {
+    await mkdir(output, { mode: 0o700 });
+  } catch (e) {
+    if (e.code === "EEXIST") fail("bootstrap_attempt_exists");
+    throw e;
+  }
+  await writeFile(
+    resolve(output, "attempt.json"),
+    JSON.stringify({
+      version: 1,
+      origin: c.origin,
+      state: "attempted-reconcile-before-any-retry",
+      authorization: c.authorization.reference,
+    }),
+    { flag: "wx", mode: 0o600 },
+  );
+  let response;
+  try {
+    response = await (injected.fetch ?? fetch)(`${c.origin}/api/v1/admin/bootstrap`, {
+      method: "POST",
+      redirect: "error",
+      signal: AbortSignal.timeout(15000),
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ email, password, organization }),
+    });
+    if (!response.ok) fail(response.status >= 500 ? "bootstrap_uncertain" : "bootstrap_rejected");
+    const reader = response.body.getReader(),
+      chunks = [];
+    let size = 0;
+    try {
+      for (;;) {
+        const { value, done } = await reader.read();
+        if (done) break;
+        size += value.length;
+        if (size > 1048576) fail("bootstrap_uncertain");
+        chunks.push(value);
+      }
+    } finally {
+      await reader.cancel();
+    }
+    const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    if (
+      typeof body.identity?.credentials?.token !== "string" ||
+      !body.identity.credentials.token ||
+      typeof body.identity.id !== "string" ||
+      typeof body.organization?.id !== "string" ||
+      body.user?.superAdmin !== true
+    )
+      fail("bootstrap_uncertain");
+    const context = { origin: c.origin, contractSha256: hash(contractFile.bytes) };
+    await writeFile(
+      resolve(output, "administrator.sealed.json"),
+      JSON.stringify(seal(body, key, context)),
+      { flag: "wx", mode: 0o600 },
+    );
+    return {
+      ok: true,
+      operation: "bootstrap",
+      encryptedCredentialSaved: true,
+      recoveryRequired: true,
+    };
+  } catch (e) {
+    if (e.safeCode === "bootstrap_rejected") throw e;
+    fail("bootstrap_uncertain");
+  } finally {
+    for (const name of Object.keys(credentials)) delete credentials[name];
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+  try {
+    const args = process.argv.slice(2);
+    console.log(
+      JSON.stringify(
+        args.length === 1 && args[0] === "--help"
+          ? {
+              usage:
+                "node .agents/tools/infisical-bootstrap.mjs --contract PATH --operation validate|bootstrap",
+              validate: "offline; contract and public recovery key only",
+              bootstrap:
+                "explicit first-initialization authorization; single POST; encrypted output; no automatic retry",
+            }
+          : await bootstrap(argumentsFor(args, ["contract", "operation"])),
+      ),
+    );
+  } catch (error) {
+    console.error(JSON.stringify(diagnostic(error)));
+    process.exitCode = 1;
+  }
+}

package/templates/.agents/tools/infisical-bootstrap.test-support.mjs

@@ -0,0 +1,39 @@
+import { generateKeyPairSync } from "node:crypto";
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { hash } from "./infisical-policy.mjs";
+
+export const keys = generateKeyPairSync("rsa", { modulusLength: 3072 });
+export const publicPem = keys.publicKey.export({ type: "spki", format: "pem" });
+export const token = "synthetic-administrator-token-do-not-disclose";
+
+export async function fixture(t, change = {}) {
+  const root = await mkdtemp(join(tmpdir(), "zaip-bootstrap-test-"));
+  t.after(() => rm(root, { recursive: true, force: true }));
+  await mkdir(join(root, ".agents/private/state/credentials"), { recursive: true, mode: 0o700 });
+  await writeFile(join(root, "public.pem"), publicPem);
+  await writeFile(
+    join(root, ".agents/private/state/credentials/admin.env"),
+    "INFISICAL_ADMIN_EMAIL=admin@example.test\nINFISICAL_ADMIN_PASSWORD=synthetic-private-password-123\nINFISICAL_ORGANIZATION=Example\n",
+    { mode: 0o600 },
+  );
+  const contract = {
+    version: 1,
+    provider: "infisical-self-hosted",
+    mode: "first-initialization",
+    origin: "https://vault.example.test",
+    authorization: {
+      approved: true,
+      operation: "bootstrap",
+      reference: "offline test",
+      uninitializedInstanceConfirmed: true,
+    },
+    credentialsFile: ".agents/private/state/credentials/admin.env",
+    recoveryPublicKey: { path: "public.pem", sha256: hash(publicPem) },
+    security: { windowsCredentialAclReviewed: true },
+    ...change,
+  };
+  await writeFile(join(root, "contract.json"), JSON.stringify(contract));
+  return { root, contract, args: { contract: "contract.json", operation: "bootstrap" } };
+}

package/templates/.agents/tools/infisical-bootstrap.test.mjs

@@ -0,0 +1,193 @@
+import assert from "node:assert/strict";
+import { constants, createDecipheriv, generateKeyPairSync, privateDecrypt } from "node:crypto";
+import { link, mkdir, readFile, symlink, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import test from "node:test";
+import { bootstrap, diagnostic } from "./infisical-bootstrap.mjs";
+import { fixture, keys, publicPem, token } from "./infisical-bootstrap.test-support.mjs";
+import { hash } from "./infisical-policy.mjs";
+
+test("bootstrap sends exact self-hosted request and persists only encrypted response", async (t) => {
+  const f = await fixture(t);
+  let calls = 0;
+  const fetch = async (url, options) => {
+    calls++;
+    assert.equal(url, "https://vault.example.test/api/v1/admin/bootstrap");
+    assert.equal(options.redirect, "error");
+    assert.deepEqual(Object.keys(JSON.parse(options.body)).sort(), [
+      "email",
+      "organization",
+      "password",
+    ]);
+    return Response.json({
+      user: { superAdmin: true },
+      organization: { id: "org" },
+      identity: { id: "admin-identity", credentials: { token } },
+    });
+  };
+  const result = await bootstrap(f.args, { root: f.root, fetch });
+  assert.equal(result.encryptedCredentialSaved, true);
+  assert.equal(JSON.stringify(result).includes(token), false);
+  const raw = await readFile(
+    join(f.root, ".agents/private/state/credentials/infisical-bootstrap/administrator.sealed.json"),
+    "utf8",
+  );
+  assert.equal(raw.includes(token), false);
+  const sealed = JSON.parse(raw);
+  const dataKey = privateDecrypt(
+    { key: keys.privateKey, padding: constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha256" },
+    Buffer.from(sealed.wrappedKey, "base64"),
+  );
+  const decipher = createDecipheriv("aes-256-gcm", dataKey, Buffer.from(sealed.iv, "base64"));
+  assert.deepEqual(sealed.context, {
+    origin: f.contract.origin,
+    contractSha256: hash(await readFile(join(f.root, "contract.json"))),
+  });
+  decipher.setAAD(Buffer.from(JSON.stringify(sealed.context), "utf8"));
+  decipher.setAuthTag(Buffer.from(sealed.tag, "base64"));
+  const decoded = JSON.parse(
+    Buffer.concat([decipher.update(Buffer.from(sealed.ciphertext, "base64")), decipher.final()]),
+  );
+  assert.equal(decoded.identity.credentials.token, token);
+  const wrongContext = createDecipheriv("aes-256-gcm", dataKey, Buffer.from(sealed.iv, "base64"));
+  wrongContext.setAAD(
+    Buffer.from(
+      JSON.stringify({ ...sealed.context, origin: "https://other.example.test" }),
+      "utf8",
+    ),
+  );
+  wrongContext.setAuthTag(Buffer.from(sealed.tag, "base64"));
+  wrongContext.update(Buffer.from(sealed.ciphertext, "base64"));
+  assert.throws(() => wrongContext.final());
+  await assert.rejects(bootstrap(f.args, { root: f.root, fetch }), {
+    safeCode: "bootstrap_attempt_exists",
+  });
+  assert.equal(calls, 1);
+});
+
+test("offline validation never fetches or opens the private credentials file", async (t) => {
+  const f = await fixture(t, { credentialsFile: ".agents/private/state/credentials/absent.env" });
+  const result = await bootstrap(
+    { ...f.args, operation: "validate" },
+    { root: f.root, fetch: () => assert.fail("network") },
+  );
+  assert.equal(result.remoteOperations, false);
+});
+
+test("missing approval, HTTP, changed recovery key and unsafe credential path fail before network", async (t) => {
+  for (const patch of [
+    { authorization: { approved: false } },
+    { origin: "http://vault.example.test" },
+    { recoveryPublicKey: { path: "public.pem", sha256: "0".repeat(64) } },
+    { credentialsFile: "outside.env" },
+  ]) {
+    const f = await fixture(t, patch);
+    await assert.rejects(bootstrap(f.args, { root: f.root, fetch: () => assert.fail("network") }));
+  }
+});
+
+test("timeout, rejected response and malformed success lock POST against replay and sanitize diagnostics", async (t) => {
+  for (const fetch of [
+    async () => {
+      throw new Error(token);
+    },
+    async () => new Response(token, { status: 403 }),
+    async () => Response.json({ token }),
+  ]) {
+    const f = await fixture(t);
+    try {
+      await bootstrap(f.args, { root: f.root, fetch });
+      assert.fail("must fail");
+    } catch (error) {
+      assert.equal(JSON.stringify(diagnostic(error)).includes(token), false);
+    }
+    await assert.rejects(bootstrap(f.args, { root: f.root, fetch: () => assert.fail("replay") }), {
+      safeCode: "bootstrap_attempt_exists",
+    });
+  }
+});
+
+test("invalid and weak RSA recovery keys are rejected without network or reservation", async (t) => {
+  const weak = generateKeyPairSync("rsa", { modulusLength: 2048 }).publicKey.export({
+    type: "spki",
+    format: "pem",
+  });
+  for (const publicKey of ["invalid public key", weak]) {
+    const f = await fixture(t, {
+      recoveryPublicKey: { path: "weak.pem", sha256: hash(publicKey) },
+    });
+    await writeFile(join(f.root, "weak.pem"), publicKey);
+    await assert.rejects(bootstrap(f.args, { root: f.root, fetch: () => assert.fail("network") }), {
+      safeCode: "invalid_recovery_key",
+    });
+    await assert.rejects(
+      readFile(join(f.root, ".agents/private/state/credentials/infisical-bootstrap/attempt.json")),
+      { code: "ENOENT" },
+    );
+  }
+});
+
+test("hardlinked recovery key and private input are rejected before network", async (t) => {
+  for (const path of ["public.pem", ".agents/private/state/credentials/admin.env"]) {
+    const f = await fixture(t);
+    await link(join(f.root, path), join(f.root, "extra-link"));
+    await assert.rejects(bootstrap(f.args, { root: f.root, fetch: () => assert.fail("network") }), {
+      safeCode: "unsafe_file",
+    });
+  }
+});
+
+test("symlinked recovery key is rejected before network", async (t) => {
+  const f = await fixture(t, {
+    recoveryPublicKey: { path: "linked.pem", sha256: hash(publicPem) },
+  });
+  try {
+    await symlink(join(f.root, "public.pem"), join(f.root, "linked.pem"));
+  } catch (error) {
+    if (process.platform === "win32" && error.code === "EPERM")
+      return t.skip("observed EPERM creating a Windows file symlink");
+    throw error;
+  }
+  await assert.rejects(bootstrap(f.args, { root: f.root, fetch: () => assert.fail("network") }), {
+    safeCode: "linked_path",
+  });
+});
+
+test("ancestor directory link or Windows junction is rejected before network", async (t) => {
+  const f = await fixture(t, {
+    recoveryPublicKey: { path: "linked-key/public.pem", sha256: hash(publicPem) },
+  });
+  await mkdir(join(f.root, "key-store"));
+  await writeFile(join(f.root, "key-store/public.pem"), publicPem);
+  await symlink(
+    join(f.root, "key-store"),
+    join(f.root, "linked-key"),
+    process.platform === "win32" ? "junction" : "dir",
+  );
+  await assert.rejects(bootstrap(f.args, { root: f.root, fetch: () => assert.fail("network") }), {
+    safeCode: "linked_path",
+  });
+});
+
+test("500, oversized success and aborted body remain uncertain and never repeat POST", async (t) => {
+  for (const fetch of [
+    async () => new Response("internal", { status: 500 }),
+    async () => new Response("x".repeat(1048577)),
+    async () =>
+      new Response(
+        new ReadableStream({
+          start(controller) {
+            controller.error(new Error(token));
+          },
+        }),
+      ),
+  ]) {
+    const f = await fixture(t);
+    await assert.rejects(bootstrap(f.args, { root: f.root, fetch }), {
+      safeCode: "bootstrap_uncertain",
+    });
+    await assert.rejects(bootstrap(f.args, { root: f.root, fetch: () => assert.fail("replay") }), {
+      safeCode: "bootstrap_attempt_exists",
+    });
+  }
+});