chati-dev 4.5.16 → 4.5.27

package/framework/hooks/mode-governance.js

@@ -10,13 +10,18 @@
  * Constitution Article XI enforcement.
  */
 
-import { existsSync, readFileSync } from 'fs';
-import { join, relative, isAbsolute } from 'path';
+import { lstatSync, realpathSync, statSync } from 'fs';
+import { dirname, relative, isAbsolute, resolve, sep } from 'path';
+import { readHookSession } from './session-reader.js';
 
 const MODE_SCOPES = {
+  manual: {
+    allowed: ['*'],
+    description: 'Paused session: manual control has full project write access',
+  },
   planning: {
-    allowed: ['chati.dev/', '.chati.dev/', '.chati/', 'artifacts/', 'CLAUDE.local.md', 'CLAUDE.md', '.claude/'],
-    description: 'Planning mode: write only to framework dir, .chati/, artifacts/, and Claude config files',
+    allowed: ['chati.dev/', 'artifacts/', 'CLAUDE.md'],
+    description: 'Planning mode: write only to framework source, artifacts, and the user-owned CLAUDE.md',
   },
   build: {
     allowed: ['*'],
@@ -39,39 +44,134 @@ const STATE_TO_GOVERNANCE_MODE = {
   completed: 'deploy',
 };
 
-function getCurrentMode(projectDir) {
-  const sessionPath = join(projectDir, '.chati', 'session.yaml');
-  // No session = no enforcement yet (orchestrator will set mode on first run).
-  // Defaulting to planning here would deadlock fresh installs (planning blocks
-  // session.yaml writes, so the orchestrator could never bootstrap).
-  if (!existsSync(sessionPath)) return 'build';
-
-  const raw = readFileSync(sessionPath, 'utf-8');
-  // Prefer explicit mode field; fall back to project.state mapping.
-  const modeMatch = raw.match(/^\s*mode:\s*(.+)$/m);
-  if (modeMatch) {
-    const mode = modeMatch[1].trim().replace(/^["']|["']$/g, '');
-    if (MODE_SCOPES[mode]) return mode;
+const PROTECTED_CONTROL_PLANE_PATHS = Object.freeze([
+  // All runtime state and installed framework material is controller
+  // authority. Keeping this list at the directory boundary avoids a provider
+  // changing an adjacent lock, journal or runtime module to bypass a narrower
+  // file-level guard.
+  '.chati/',
+  '.chati.dev/',
+  '.chati/session.yaml',
+  '.chati/v2/installation.json',
+  'chati.dev/hooks/',
+  'chati.dev/orchestrator/',
+  'CLAUDE.local.md',
+  'AGENTS.override.md',
+  '.claude/settings.json',
+  '.claude/commands/chati.md',
+  '.claude/rules/chati/',
+  '.codex/config.toml',
+  '.codex/hooks.json',
+  '.codex/rules/',
+  '.agents/skills/chati/',
+  '.grok/CHATI.md',
+  '.grok/config.toml',
+  '.grok/commands/chati.md',
+  '.grok/rules/chati-governance.md',
+  '.grok/session-lock.md',
+]);
+
+function pathEscapesProject(rel) {
+  return rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel);
+}
+
+function portablePath(value) {
+  return value.split(sep).join('/');
+}
+
+function scopedPathMatches(rel, scope) {
+  return scope.endsWith('/') ? rel.startsWith(scope) : rel === scope;
+}
+
+function physicalCandidate(filePath, projectDir) {
+  const root = realpathSync(resolve(projectDir));
+  const logical = isAbsolute(filePath) ? resolve(filePath) : resolve(root, filePath);
+  const logicalRel = relative(root, logical);
+  if (pathEscapesProject(logicalRel)) return null;
+
+  const missing = [];
+  let ancestor = logical;
+  while (true) {
+    try {
+      const physicalAncestor = realpathSync(ancestor);
+      const physical = resolve(physicalAncestor, ...missing.reverse());
+      const physicalRel = relative(root, physical);
+      if (pathEscapesProject(physicalRel)) return null;
+      return Object.freeze({
+        root,
+        logical,
+        logicalRel: portablePath(logicalRel),
+        physical,
+        physicalRel: portablePath(physicalRel),
+      });
+    } catch (error) {
+      if (error?.code !== 'ENOENT') return null;
+      const parent = dirname(ancestor);
+      if (parent === ancestor) return null;
+      missing.push(ancestor.slice(parent.length + (parent.endsWith(sep) ? 0 : 1)));
+      ancestor = parent;
+    }
   }
-  const stateMatch = raw.match(/^\s+state:\s*(.+)$/m);
-  if (stateMatch) {
-    const state = stateMatch[1].trim().replace(/^["']|["']$/g, '');
-    return STATE_TO_GOVERNANCE_MODE[state] || 'build';
+}
+
+function getCurrentMode(projectDir) {
+  const result = readHookSession(projectDir);
+  if (!result.loaded) return null;
+  if (result.session?.session_status === 'paused') return 'manual';
+  const mode = result.session?.mode;
+  if (MODE_SCOPES[mode]) return mode;
+  const state = result.session?.project?.state;
+  if (state) return STATE_TO_GOVERNANCE_MODE[state] || null;
+  return null;
+}
+
+function isCanonicalSessionTarget(filePath, projectDir) {
+  const canonical = resolve(projectDir, '.chati', 'session.yaml');
+  const candidate = isAbsolute(filePath) ? resolve(filePath) : resolve(projectDir, filePath);
+  if (candidate === canonical) return true;
+  try {
+    const canonicalStat = statSync(canonical);
+    const candidateStat = statSync(candidate);
+    return canonicalStat.dev === candidateStat.dev && canonicalStat.ino === candidateStat.ino;
+  } catch {
+    return false;
   }
-  // Session exists but no mode/state field — be permissive.
-  return 'build';
+}
+
+function isProtectedControlPlaneTarget(filePath, projectDir) {
+  const candidate = physicalCandidate(filePath, projectDir);
+  if (!candidate) return true;
+  if (PROTECTED_CONTROL_PLANE_PATHS.some((scope) =>
+    scopedPathMatches(candidate.logicalRel, scope) || scopedPathMatches(candidate.physicalRel, scope))) return true;
+
+  try {
+    const candidateStat = statSync(candidate.logical);
+    for (const protectedPath of PROTECTED_CONTROL_PLANE_PATHS.filter((value) => !value.endsWith('/'))) {
+      try {
+        const protectedStat = statSync(resolve(candidate.root, protectedPath));
+        if (candidateStat.dev === protectedStat.dev && candidateStat.ino === protectedStat.ino) return true;
+      } catch { /* a missing protected target has no physical alias yet */ }
+    }
+  } catch { /* a missing target is decided by its normalized path */ }
+  return false;
 }
 
 function isPathAllowed(filePath, projectDir, mode) {
   const scope = MODE_SCOPES[mode];
   if (!scope) return false;
 
-  const rel = isAbsolute(filePath) ? relative(projectDir, filePath) : filePath;
-  // Block paths that escape the project — regardless of mode
-  if (rel.startsWith('..')) return false;
+  const candidate = physicalCandidate(filePath, projectDir);
+  if (!candidate) return false;
+  if (mode === 'planning') {
+    try {
+      const stat = lstatSync(candidate.logical);
+      if (stat.isSymbolicLink() || stat.nlink !== 1) return false;
+    } catch { /* a new file is checked through its pinned existing ancestor */ }
+  }
 
   if (scope.allowed.includes('*')) return true;
-  return scope.allowed.some(prefix => rel.startsWith(prefix));
+  return scope.allowed.some((prefix) =>
+    scopedPathMatches(candidate.logicalRel, prefix) && scopedPathMatches(candidate.physicalRel, prefix));
 }
 
 async function main() {
@@ -84,25 +184,32 @@ async function main() {
     const event = JSON.parse(input);
     const projectDir = event.cwd || process.cwd();
     const toolInput = event.tool_input || {};
-    const filePath = toolInput.file_path || toolInput.path || '';
+    const filePath = toolInput.file_path || toolInput.path || toolInput.notebook_path || '';
 
     if (!filePath) {
-      process.stdout.write(JSON.stringify(allowOutput()));
+      process.stdout.write(JSON.stringify(denyOutput(
+        '[Session Security] Writes are blocked because the mutation target is missing.'
+      )));
       return;
     }
 
-    // Block direct edits to session.yaml — it must be managed by CLI only.
-    // CLI uses fs.writeFileSync (not intercepted by hooks), so this only blocks
-    // Claude's Edit/Write tool calls, which is exactly what we want.
-    const rel = isAbsolute(filePath) ? relative(projectDir, filePath) : filePath;
-    if (rel === join('.chati', 'session.yaml') || rel === '.chati/session.yaml') {
+    // The lifecycle, installation artifact and installed runtime are controller
+    // authority. Provider tool calls may never mutate them directly or through
+    // symlink/hard-link aliases. The CLI writes these files outside hook calls.
+    if (isProtectedControlPlaneTarget(filePath, projectDir)) {
       process.stdout.write(JSON.stringify(denyOutput(
-        '[Article XV] session.yaml is managed by the CLI. Use the router: node chati.dev/orchestrator/chati-router.js advance --agent {name} --score {score}'
+        '[Control Plane] This path is managed by the CHATI controller and cannot be edited by a provider tool call.'
       )));
       return;
     }
 
     const mode = getCurrentMode(projectDir);
+    if (!mode) {
+      process.stdout.write(JSON.stringify(denyOutput(
+        '[Session Security] Writes are blocked because session.yaml could not be validated.'
+      )));
+      return;
+    }
 
     if (isPathAllowed(filePath, projectDir, mode)) {
       process.stdout.write(JSON.stringify(allowOutput()));
@@ -114,9 +221,9 @@ async function main() {
     }
   } catch (err) {
     process.stderr.write(`[chati-hook-error] mode-governance: ${err?.message || 'unknown'}\n`);
-    // Hook errors are fail-OPEN: a broken hook should not block the user.
-    // Security-critical denials are handled by explicit logic above.
-    process.stdout.write(JSON.stringify(allowOutput()));
+    process.stdout.write(JSON.stringify(denyOutput(
+      '[Session Security] Writes are blocked because the mode governance hook could not validate its input.'
+    )));
   }
 }
 
@@ -139,14 +246,16 @@ function denyOutput(reason) {
   };
 }
 
-export { getCurrentMode, isPathAllowed, MODE_SCOPES, STATE_TO_GOVERNANCE_MODE };
+export {
+  getCurrentMode, isPathAllowed, isCanonicalSessionTarget, isProtectedControlPlaneTarget,
+  MODE_SCOPES, STATE_TO_GOVERNANCE_MODE, PROTECTED_CONTROL_PLANE_PATHS,
+};
 
 // Only run main when executed directly (not imported by tests).
 // realpathSync resolves symlinks on both sides — important on macOS where
 // /tmp is a symlink to /private/tmp. Without realpath the comparison fails
 // silently and main() never runs.
 import { fileURLToPath } from 'url';
-import { realpathSync } from 'fs';
 if (process.argv[1]) {
   try {
     if (realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))) {

package/framework/hooks/model-governance.js

@@ -23,8 +23,9 @@
  * This hook is advisory in IDE mode — it warns but does not block.
  */
 
-import { existsSync, readFileSync } from 'fs';
+import { existsSync } from 'fs';
 import { join } from 'path';
+import { readHookSession } from './session-reader.js';
 
 const AGENT_MODELS = {
   orchestrator: { provider: 'claude', model: 'sonnet', tier: 'sonnet' },
@@ -44,22 +45,8 @@ const AGENT_MODELS = {
 };
 
 function getCurrentAgent(projectDir) {
-  const sessionPath = join(projectDir, '.chati', 'session.yaml');
-  if (!existsSync(sessionPath)) return null;
-
-  const raw = readFileSync(sessionPath, 'utf-8');
-  const match = raw.match(/^\s*current_agent:\s*(.+)$/m);
-  return match ? match[1].trim().replace(/^["']|["']$/g, '') : null;
-}
-
-function getSessionField(projectDir, key) {
-  const sessionPath = join(projectDir, '.chati', 'session.yaml');
-  if (!existsSync(sessionPath)) return null;
-  const raw = readFileSync(sessionPath, 'utf-8');
-  const match = raw.match(new RegExp(`^\\s*${key}:\\s*(.+)$`, 'm'));
-  if (!match) return null;
-  const v = match[1].trim().replace(/^["']|["']$/g, '');
-  return v === 'null' || v === '' ? null : v;
+  const result = readHookSession(projectDir);
+  return result.loaded ? result.session?.current_agent ?? null : null;
 }
 
 // Collapse a model id to its family so opus and opus[1m] count as the same
@@ -91,7 +78,13 @@ async function main() {
       return;
     }
 
-    const agent = getCurrentAgent(projectDir);
+    const sessionRead = readHookSession(projectDir);
+    if (!sessionRead.loaded && !sessionRead.missing) {
+      process.stderr.write(`[chati] model-governance: unsafe session state: ${sessionRead.error}\n`);
+      process.stdout.write('{}');
+      return;
+    }
+    const agent = sessionRead.session?.current_agent ?? null;
 
     // Advisory context injection via the canonical UserPromptSubmit schema.
     const lines = [];
@@ -108,8 +101,8 @@ async function main() {
     // from the model at the last harness audit, advise a re-audit. Advisory
     // only, never blocks; the family comparison ignores variant changes such
     // as opus vs opus[1m].
-    const activeModel = getSessionField(projectDir, 'active_model');
-    const modelAtLastAudit = getSessionField(projectDir, 'model_at_last_audit');
+    const activeModel = sessionRead.session?.active_model ?? null;
+    const modelAtLastAudit = sessionRead.session?.model_at_last_audit ?? null;
     if (activeModel && modelAtLastAudit && modelFamily(activeModel) !== modelFamily(modelAtLastAudit)) {
       lines.push(`[Article XXIV] Active model "${activeModel}" differs from the model at the last harness audit ("${modelAtLastAudit}"). Consider running /chati-update to re-audit the harness for this model. This is advisory and does not block your work.`);
     }

package/framework/hooks/prism-engine.js

@@ -16,11 +16,12 @@
  *   cumulative estimation and resolves the window from the active model.
  *
  * Detection chain for the active model (first hit wins):
- *   1. process.env.CLAUDE_MODEL           (Claude Code set)
- *   2. event.session.model                (future-proof for event payload)
- *   3. session.active_model               (written by /chati boot)
- *   4. HOOK_AGENT_MODELS[currentAgent]    (last-resort default)
- *   5. null                                (provider fallback takes over)
+ *   1. session.current_execution_binding.model (v2 canonical route)
+ *   2. process.env.CLAUDE_MODEL                (legacy Claude Code session)
+ *   3. event.session.model                     (legacy event payload)
+ *   4. session.active_model                    (legacy projection)
+ *   5. HOOK_AGENT_MODELS[currentAgent]         (legacy last-resort default)
+ *   6. null                                     (provider fallback takes over)
  *
  * Context limits come from the shared JSON table at either
  * `.chati.dev/data/model-limits.json` (installed) or
@@ -32,8 +33,11 @@
  * Claude Code Hook: triggers on every user message submission.
  */
 
-import { existsSync, readFileSync, writeFileSync, renameSync, statSync } from 'fs';
+import { existsSync, readFileSync, statSync } from 'fs';
 import { join } from 'path';
+import { fileURLToPath } from 'url';
+import { readHookSession } from './session-reader.js';
+import { updateHookContextUsage, updateHookSession } from './session-writer.js';
 
 // mtime-keyed read cache. This is a no-op for the per-prompt hook process
 // (it starts fresh each invocation and must read at least once), but it
@@ -132,81 +136,57 @@ function resolveLimit(limits, modelKey, provider) {
 }
 
 // ---------------------------------------------------------------------------
-// Session read — lightweight YAML extraction (avoids js-yaml dependency).
+// Session read through the canonical nofollow, bounded and lock-aware reader.
 // ---------------------------------------------------------------------------
 
 function readSessionState(projectDir) {
-  const sessionPath = join(projectDir, '.chati', 'session.yaml');
-  if (!existsSync(sessionPath)) return null;
-
-  const raw = readFileCached(sessionPath);
-  if (raw == null) return null;
-  const extract = (key) => {
-    const match = raw.match(new RegExp(`^\\s*${key}:\\s*(.+)$`, 'm'));
-    if (!match) return null;
-    const v = match[1].trim().replace(/^["']|["']$/g, '');
-    return v === 'null' || v === '' ? null : v;
-  };
-  const extractNum = (key) => {
-    const v = extract(key);
-    if (v === null) return null;
-    const n = parseInt(v, 10);
-    return Number.isFinite(n) ? n : null;
-  };
-
-  // Detect active team (Article XXI)
-  let activeTeamId = null;
-  let activeTeamPhase = null;
-  const teamStatusMatch = raw.match(/teams:[\s\S]*?status:\s*(active|forming)/m);
-  if (teamStatusMatch) {
-    const teamIdMatch = raw.match(/team_id:\s*(TM-\d{8}-[a-z]{3})/m);
-    activeTeamId = teamIdMatch ? teamIdMatch[1] : null;
-    const teamPhaseMatch = raw.match(/phase:\s*(planning|build)/m);
-    activeTeamPhase = teamPhaseMatch ? teamPhaseMatch[1] : null;
-  }
+  const sessionRead = readHookSession(projectDir);
+  if (!sessionRead.loaded) return null;
+  const document = sessionRead.session;
+  const binding = document.current_execution_binding && typeof document.current_execution_binding === 'object'
+    ? document.current_execution_binding
+    : {};
+  const routedProvider = binding.provider || null;
+  const routedModel = binding.model || null;
+  const activeTeam = Array.isArray(document.teams)
+    ? document.teams.find((team) => ['active', 'forming'].includes(team?.status))
+    : null;
+  const numeric = (value, fallback) => value !== null && value !== undefined && Number.isFinite(Number(value))
+    ? Number(value)
+    : fallback;
 
   return {
-    raw,
-    sessionPath,
-    mode: extract('mode') || 'discover',
-    currentAgent: extract('current_agent') || null,
-    workflow: extract('workflow') || null,
-    pipelinePosition: extract('pipeline_position') || null,
-    provider: extract('active_provider') || extract('provider') || null,
-    // v1.2 context detection fields.
-    activeModel: extract('active_model'),
-    modelAtLastAudit: extract('model_at_last_audit'),
-    contextTokensUsed: extractNum('context_tokens_used') || 0,
-    contextWindowTokens: extractNum('context_window_tokens'),
-    activeTeamId,
-    activeTeamPhase,
+    mode: document.mode || 'discover',
+    currentAgent: document.current_agent || null,
+    workflow: document.workflow || null,
+    pipelinePosition: document.pipeline_position || null,
+    provider: routedProvider || document.active_provider || document.provider || null,
+    routedProvider,
+    routedModel,
+    activeModel: document.active_model || null,
+    modelAtLastAudit: document.model_at_last_audit || null,
+    contextTokensUsed: numeric(document.context_tokens_used, 0),
+    contextWindowTokens: numeric(document.context_window_tokens, null),
+    activeTeamId: activeTeam?.team_id || null,
+    activeTeamPhase: activeTeam?.phase || null,
   };
 }
 
 // ---------------------------------------------------------------------------
-// Session write — targeted line replacement on session.yaml.
-// Atomic via tmp+rename. Only touches the fields we own.
+// Session writes use only the canonical lock-aware manager below.
 // ---------------------------------------------------------------------------
 
-function writeBackSession(sessionPath, rawContent, updates) {
-  let out = rawContent;
-  for (const [key, value] of Object.entries(updates)) {
-    const serialized =
-      value === null || value === undefined ? 'null' :
-      typeof value === 'number'             ? String(value) :
-      typeof value === 'string'             ? value :
-                                              JSON.stringify(value);
-    const re = new RegExp(`^(\\s*${key}:\\s*)(.*)$`, 'm');
-    if (re.test(out)) {
-      out = out.replace(re, `$1${serialized}`);
-    } else {
-      // Key not present — append at end (migration path).
-      out += (out.endsWith('\n') ? '' : '\n') + `${key}: ${serialized}\n`;
-    }
-  }
-  const tmpPath = sessionPath + '.tmp';
-  writeFileSync(tmpPath, out, 'utf-8');
-  renameSync(tmpPath, sessionPath);
+/**
+ * Persist PRISM projections through the hook-local safe writer. Hooks never
+ * import the project runtime: a provider that can alter .chati.dev must not
+ * execute code before the hook's governance decision completes.
+ */
+async function persistPrismSession(projectDir, updates) {
+  return updateHookSession(projectDir, updates);
+}
+
+async function persistPrismUsage(projectDir, usage) {
+  return updateHookContextUsage(projectDir, usage);
 }
 
 // ---------------------------------------------------------------------------
@@ -221,20 +201,25 @@ const HOOK_AGENT_MODELS = {
 };
 
 function detectModel(event, session) {
-  // 1. Environment override — Claude Code or user-set.
+  // 1. V2 canonical route. The opened harness is not the execution provider.
+  if (session && session.routedModel) {
+    const parsed = parseClaudeModelId(session.routedModel);
+    return parsed ? parsed.normalized : session.routedModel;
+  }
+  // 2. Legacy environment override from Claude Code or the user.
   if (process.env.CLAUDE_MODEL) {
     const parsed = parseClaudeModelId(process.env.CLAUDE_MODEL);
     if (parsed) return parsed.normalized;
     return process.env.CLAUDE_MODEL; // trust the raw string
   }
-  // 2. Event payload (future-proof — Claude Code may populate this).
+  // 3. Legacy event payload.
   if (event && event.session && event.session.model) {
     const parsed = parseClaudeModelId(event.session.model);
     if (parsed) return parsed.normalized;
   }
-  // 3. Session-recorded active model — written at /chati boot.
+  // 4. Legacy session projection.
   if (session && session.activeModel) return session.activeModel;
-  // 4. Agent default (last resort, matches historic behavior).
+  // 5. Legacy agent default.
   if (session && session.currentAgent && HOOK_AGENT_MODELS[session.currentAgent]) {
     return HOOK_AGENT_MODELS[session.currentAgent];
   }
@@ -307,32 +292,29 @@ async function main() {
 
     // 1. Model + window detection.
     const detectedModel = detectModel(event, session);
-    const contextLimit = resolveLimit(limits, detectedModel, session.provider);
+    const contextLimit = resolveLimit(limits, detectedModel, session.routedProvider || session.provider);
 
     // 2. Token accounting — cumulative, replaces turn-count.
     const promptText = event.prompt || '';
     const delta = estimatePromptDelta(promptText);
-    const tokensUsed = Math.min(contextLimit, session.contextTokensUsed + delta);
-    const remainingPercent = Math.max(0, Math.round((1 - tokensUsed / contextLimit) * 100));
+    let tokensUsed = Math.min(contextLimit, session.contextTokensUsed + delta);
+    let remainingPercent = Math.max(0, Math.round((1 - tokensUsed / contextLimit) * 100));
 
     // 3. Bracket computation (percentage-based, model-scaled).
-    const bracket = computeBracket(remainingPercent);
+    let bracket = computeBracket(remainingPercent);
 
     // 4. Persist back to session.yaml (best-effort, non-fatal on write error).
     try {
-      writeBackSession(session.sessionPath, session.raw, {
-        context_tokens_used:    tokensUsed,
-        context_window_tokens:  contextLimit,
-        context_last_bracket:   bracket,
-        // If we detected a model and the session did not have one, cache it.
-        ...(detectedModel && !session.activeModel ? { active_model: detectedModel } : {}),
-        // Seed the harness-audit baseline once (Article XXIV). Only when unset,
-        // so a later model change leaves the old baseline in place for the
-        // model-governance advisory to detect.
-        ...((detectedModel || session.activeModel) && !session.modelAtLastAudit
-          ? { model_at_last_audit: detectedModel || session.activeModel }
-          : {}),
+      const persisted = await persistPrismUsage(projectDir, {
+        delta,
+        contextWindowTokens: contextLimit,
+        detectedModel,
+        routedProvider: session.routedProvider,
       });
+      if (!persisted.saved) throw new Error(persisted.error || 'session update failed');
+      tokensUsed = persisted.tokensUsed;
+      remainingPercent = Math.max(0, Math.round((1 - tokensUsed / contextLimit) * 100));
+      bracket = persisted.bracket || computeBracket(remainingPercent);
     } catch (err) {
       process.stderr.write(`[chati] prism-engine write-back failed (non-fatal): ${err.message}\n`);
     }
@@ -442,12 +424,12 @@ export {
   loadLimits,
   estimatePromptDelta,
   computeBracket,
-  writeBackSession,
+  persistPrismSession,
+  persistPrismUsage,
   TOOL_OUTPUT_MULTIPLIER,
 };
 
 // Only run main when executed directly (not imported by tests).
-import { fileURLToPath } from 'url';
 import { realpathSync } from 'fs';
 if (process.argv[1]) {
   try {