hikoutei 0.11.102-dev → 0.11.103-dev

package/dist/cli/keyProvision.d.ts

@@ -59,11 +59,20 @@
  * unsafe types or permission failures reject the run without touching
  * foreign entries. The key create runs gcloud with a RELATIVE `key.json`
  * destination from the staging directory as the subprocess working
- * directory (runner `cwd`), with the staging directory re-verified
- * (type/mode/identity through a no-follow descriptor) IMMEDIATELY before
- * the spawn; the credential write is thereby bound to the validated
- * private staging directory for cooperating setup actors, and a
- * replacement at the staging pathname is never silently trusted. The same parent validation runs BEFORE the staged key is ever read during reconciliation: `key.json` is never inspected,
+ * directory (runner `cwd`, expected identity, and a pinned directory fd),
+ * with the staging directory re-verified through a no-follow descriptor
+ * immediately before spawn and its identity checked again immediately
+ * after spawn, before the result is recorded or staged output is trusted.
+ * The isolated Node child (`process.execPath`, parent CWD untouched)
+ * compares its `statSync('.')` with `fstatSync(3)` for the inherited pinned
+ * fd. A replacement cannot pass by reusing the old inode, and gcloud
+ * inherits the verified object-bound CWD — the
+ * staging-cwd write window (#673) is closed with portable built-ins, no
+ * native binding. The post-spawn identity re-check stays as defense in
+ * depth. A transient swap-back (the
+ * replacement removed before the post-spawn check) leaves no key in the
+ * real directory, so the bounded settlement below ends `uncertain`
+ * without ever trusting the foreign directory. The same parent validation runs BEFORE the staged key is ever read during reconciliation: `key.json` is never inspected,
  * opened, chmod'ed, or read unless its deterministic parent is absent or a
  * plain directory verified/secured to 0700 through the no-follow
  * descriptor, and a symlinked or non-directory stage parent fails closed
@@ -306,8 +315,7 @@ export type KeySettleOutcome = {
  */
 export declare function settleServiceAccountKey(runner: GcloudRunner, executed: PlannedCommand[], input: KeySettleInput): Promise<KeySettleOutcome>;
 /**
- * Creates the deterministic staging directory (mode 0700) and returns its
- * identity.
+ * Creates or secures the deterministic staging directory and pins it open.
  *
  * A pre-existing entry is accepted only when it is a real directory (a
  * crash between the checkpoint write and the create leaves an empty owned
@@ -317,23 +325,23 @@ export declare function settleServiceAccountKey(runner: GcloudRunner, executed:
  * platform supports it (the mode is applied and verified on the open
  * descriptor, never via a check-then-chmod path race), and any unsafe
  * type/permission failure rejects the run without touching foreign
- * entries. The returned device/inode is the identity the pre-subprocess
- * re-verification compares against. Exported so tests can exercise the
- * pre-existing-directory security path directly (it is only reachable
- * from the one fresh create).
+ * entries. Its open descriptor pins the directory object through process
+ * launch, preventing inode reuse from making a replacement appear identical.
+ * Exported so tests can exercise the pre-existing-directory path directly.
  */
 export declare function prepareStageDir(keyPath: string, keyMarker: string): PreparedStageDir;
 /**
  * Result of preparing the deterministic staging directory.
  *
- * `ok` carries the prepared directory's device/inode so the subprocess
- * pre-verification can prove the path still names the exact directory this
- * invocation created/secured.
+ * `ok` carries a pinned descriptor and its device/inode identity so the
+ * subprocess wrapper can verify its working directory against the exact
+ * open filesystem object.
  */
 export type PreparedStageDir = {
     readonly status: "ok";
     readonly dev: number;
     readonly ino: number;
+    readonly fd: number;
 } | {
     readonly status: "error";
     readonly error: SetupErrorResult;
@@ -354,36 +362,6 @@ export interface KeyCleanupFs {
     fstatSync(fd: number): Stats;
     closeSync(fd: number): void;
 }
-/**
- * Ownership-bound, crash-resumable staged cleanup, only after a verified
- * installation.
- *
- * The final key path is verified with lstat (never following a symlink) and
- * must be a regular file; a final symlink is refused and the staged
- * credential is retained. Before any deletion the deterministic stage
- * directory is atomically quarantined: renamed to the deterministic private
- * cleanup sibling path derived from the SAME persisted key marker (never an
- * unrecoverable random name), with the device/inode captured before the
- * rename re-verified after it — a source replaced between the capture and
- * the rename fails closed and nothing is deleted. Inside the quarantined
- * 0700 directory the staged entry is re-checked as a regular file with the
- * same device/inode as the no-follow final key immediately before its
- * unlink; any mismatch, foreign, or non-empty entry is preserved (the
- * directory is moved back to the stage path so the user finds the state
- * where the docs say it is). The empty quarantined directory is then
- * rmdir'd. Never recursive-delete.
- *
- * Crash-resume boundaries: a crash-left cleanup directory with the matching
- * staged hardlink is finished (verify against the no-follow final, unlink,
- * rmdir); an empty cleanup directory (crash after the staged unlink) is
- * rmdir'd; an absent stage + cleanup pair means the cleanup already
- * finished (success); both existing at once fails closed. The setup lock is
- * held for the whole run — a second cooperating setup process cannot
- * acquire it concurrently, so no other run can be touching these
- * deterministic paths — and Node offers no literal unlinkat without a raw
- * libuv binding, so this quarantine + post-rename identity design is the
- * permitted boundary for the pathname unlink race.
- */
 export declare function cleanupOwnedStage(keyPath: string, keyMarker: string, fs?: KeyCleanupFs): SetupErrorResult | null;
 export {};
 //# sourceMappingURL=keyProvision.d.ts.map

package/dist/cli/keyProvision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keyProvision.d.ts","sourceRoot":"","sources":["../../../../../../src/keyProvision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoGG;AAEH,OAAO,EAaL,KAAK,KAAK,EACX,MAAM,SAAS,CAAC;AAUjB,OAAO,EAAiD,KAAK,cAAc,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC5H,OAAO,KAAK,EAAE,YAAY,EAAmB,MAAM,mBAAmB,CAAC;AAEvE,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAE/D,gEAAgE;AAChE,eAAO,MAAM,mBAAmB,aAAa,CAAC;AAE9C;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,uCAAuC,CAAC;AAE1E,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,mGAUnB,CAAC;AAEX,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEtE;AAED,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,sDAAsD;AACtD,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,SAAS,MAAM,EAAE,GAAG,IAAI,CAiB1B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,MAAM,GAAG,IAAI,CAcf;AAED;;;;;;;;GAQG;AACH,wBAAsB,iCAAiC,CACrD,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,WAAW,CAAA;CAAE,GAC1G,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,CAAC,CAoDxI;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,yDAA0D,CAAC;AAEjG,uEAAuE;AACvE,MAAM,WAAW,OAAO;IACtB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC1F;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC5F;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAExH;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,CAAC,KAAK,EAAE,sBAAsB,GAAG,IAAI,CAAC;CACvC;AAED,wGAAwG;AACxG,eAAO,MAAM,uBAAuB,QAAuC,CAAC;AAuB5E,sFAAsF;AACtF,eAAO,MAAM,WAAW,EAAE,OAMzB,CAAC;AAEF,yDAAyD;AACzD,UAAU,cAAc;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;IAC/C,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,6FAA6F;IAC7F,QAAQ,CAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAC;CACvD;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,WAAW,CAAC;AAExD,yCAAyC;AACzC,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,gBAAgB,CAAC,CA6F3B;AAyYD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,gBAAgB,CA+CpF;AAED;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAuUnE;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IAC/B,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACpC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9C,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,KAAK,CAAC;IAC7B,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAcD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,EAAE,GAAE,YAAkC,GACrC,gBAAgB,GAAG,IAAI,CAgRzB"}
+{"version":3,"file":"keyProvision.d.ts","sourceRoot":"","sources":["../../../../../../src/keyProvision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6GG;AAEH,OAAO,EAaL,KAAK,KAAK,EACX,MAAM,SAAS,CAAC;AAUjB,OAAO,EAAiD,KAAK,cAAc,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC5H,OAAO,KAAK,EAAE,YAAY,EAAmB,MAAM,mBAAmB,CAAC;AAEvE,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAE/D,gEAAgE;AAChE,eAAO,MAAM,mBAAmB,aAAa,CAAC;AAE9C;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,uCAAuC,CAAC;AAE1E,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,mGAUnB,CAAC;AAEX,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEtE;AAED,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,sDAAsD;AACtD,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,SAAS,MAAM,EAAE,GAAG,IAAI,CAiB1B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,MAAM,GAAG,IAAI,CAcf;AAED;;;;;;;;GAQG;AACH,wBAAsB,iCAAiC,CACrD,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,WAAW,CAAA;CAAE,GAC1G,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,CAAC,CAoDxI;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,yDAA0D,CAAC;AAEjG,uEAAuE;AACvE,MAAM,WAAW,OAAO;IACtB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC1F;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC5F;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAExH;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,CAAC,KAAK,EAAE,sBAAsB,GAAG,IAAI,CAAC;CACvC;AAED,wGAAwG;AACxG,eAAO,MAAM,uBAAuB,QAAuC,CAAC;AAuB5E,sFAAsF;AACtF,eAAO,MAAM,WAAW,EAAE,OAMzB,CAAC;AAEF,yDAAyD;AACzD,UAAU,cAAc;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;IAC/C,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,6FAA6F;IAC7F,QAAQ,CAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAC;CACvD;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,WAAW,CAAC;AAExD,yCAAyC;AACzC,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,gBAAgB,CAAC,CA6F3B;AAiaD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAmBpF;AAED;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC1F;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAoZnE;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IAC/B,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACpC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9C,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,KAAK,CAAC;IAC7B,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAmGD,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,EAAE,GAAE,YAAkC,GACrC,gBAAgB,GAAG,IAAI,CAmTzB"}

package/dist/cli/keyProvision.js

@@ -59,11 +59,20 @@
  * unsafe types or permission failures reject the run without touching
  * foreign entries. The key create runs gcloud with a RELATIVE `key.json`
  * destination from the staging directory as the subprocess working
- * directory (runner `cwd`), with the staging directory re-verified
- * (type/mode/identity through a no-follow descriptor) IMMEDIATELY before
- * the spawn; the credential write is thereby bound to the validated
- * private staging directory for cooperating setup actors, and a
- * replacement at the staging pathname is never silently trusted. The same parent validation runs BEFORE the staged key is ever read during reconciliation: `key.json` is never inspected,
+ * directory (runner `cwd`, expected identity, and a pinned directory fd),
+ * with the staging directory re-verified through a no-follow descriptor
+ * immediately before spawn and its identity checked again immediately
+ * after spawn, before the result is recorded or staged output is trusted.
+ * The isolated Node child (`process.execPath`, parent CWD untouched)
+ * compares its `statSync('.')` with `fstatSync(3)` for the inherited pinned
+ * fd. A replacement cannot pass by reusing the old inode, and gcloud
+ * inherits the verified object-bound CWD — the
+ * staging-cwd write window (#673) is closed with portable built-ins, no
+ * native binding. The post-spawn identity re-check stays as defense in
+ * depth. A transient swap-back (the
+ * replacement removed before the post-spawn check) leaves no key in the
+ * real directory, so the bounded settlement below ends `uncertain`
+ * without ever trusting the foreign directory. The same parent validation runs BEFORE the staged key is ever read during reconciliation: `key.json` is never inspected,
  * opened, chmod'ed, or read unless its deterministic parent is absent or a
  * plain directory verified/secured to 0700 through the no-follow
  * descriptor, and a symlinked or non-directory stage parent fails closed
@@ -657,15 +666,20 @@ async function settleKeyPass(runner, executed, input, createIssued) {
             return { status: "error", error: prepared.error };
         }
         // The gcloud create runs with the staging directory as the subprocess
-        // working directory and a RELATIVE `key.json` destination, so the
-        // credential write is bound to the validated private directory instead
-        // of a pathname that could be swapped mid-run. Immediately before the
-        // spawn, the directory is re-verified (no-follow descriptor, type,
-        // identity, owner-only mode) against the identity captured by
-        // prepareStageDir: a replacement is never silently trusted.
+        // working directory and a RELATIVE `key.json` destination. Immediately
+        // before the spawn, the directory is re-verified (no-follow
+        // descriptor, type, identity, owner-only mode) against the identity
+        // captured by prepareStageDir; the runner then binds the child CWD to
+        // that verified object through an isolated Node wrapper (chdir +
+        // statSync('.') identity check, gcloud inherits the bound directory
+        // with no `cwd` option), so a replacement at the staging pathname
+        // cannot redirect the credential write. Immediately AFTER the spawn
+        // returns the identity is re-checked again before the result is
+        // recorded, as defense in depth.
         const stageDir = keyStageDir(input.keyPath, input.keyMarker);
         const stillSecure = verifyStageDirBeforeSubprocess(stageDir, prepared);
         if (stillSecure !== null) {
+            closePreparedStageDir(prepared.fd);
             return { status: "error", error: stillSecure };
         }
         const keyCreateCommand = [
@@ -681,15 +695,35 @@ async function settleKeyPass(runner, executed, input, createIssued) {
             input.projectId,
         ];
         let keyCreate;
+        let afterSpawn = null;
         try {
-            keyCreate = await runner.run(keyCreateCommand, { cwd: stageDir });
+            try {
+                keyCreate = await runner.run(keyCreateCommand, {
+                    cwd: stageDir,
+                    cwdIdentity: { dev: prepared.dev, ino: prepared.ino },
+                    cwdFd: prepared.fd,
+                });
+            }
+            catch {
+                // The invocation threw (spawn/transport failure) after gcloud may or
+                // may not have written the staged key. Treat it as a lost result and
+                // poll the deterministic stage + current key list below instead of
+                // bubbling an unexpected error; the thrown text is never forwarded.
+                keyCreate = { status: "failed", code: null, stdout: "", stderr: "" };
+            }
+            // Keep the prepared directory descriptor open through this path check:
+            // otherwise an unlinked inode could be reused before dev/ino comparison.
+            afterSpawn = verifyStageDirIdentityAfterSpawn(stageDir, prepared);
         }
-        catch {
-            // The invocation threw (spawn/transport failure) after gcloud may or
-            // may not have written the staged key. Treat it as a lost result and
-            // poll the deterministic stage + current key list below instead of
-            // bubbling an unexpected error; the thrown text is never forwarded.
-            keyCreate = { status: "failed", code: null, stdout: "", stderr: "" };
+        finally {
+            closePreparedStageDir(prepared.fd);
+        }
+        // Before the result is recorded or any staged output is trusted, a
+        // mismatch — or a vanished directory — fails closed with nothing from
+        // the replacement read, chmod'ed, installed, or cleaned up, and the
+        // `key_create_started` checkpoint is retained for a reconcile-only resume.
+        if (afterSpawn !== null) {
+            return { status: "error", error: afterSpawn };
         }
         executed.push({
             kind: "gcloud",
@@ -739,8 +773,7 @@ function uncertainResult(message) {
 /** Owner-only permission of the key staging directory. */
 const KEY_STAGE_DIR_MODE = 0o700;
 /**
- * Creates the deterministic staging directory (mode 0700) and returns its
- * identity.
+ * Creates or secures the deterministic staging directory and pins it open.
  *
  * A pre-existing entry is accepted only when it is a real directory (a
  * crash between the checkpoint write and the create leaves an empty owned
@@ -750,10 +783,9 @@ const KEY_STAGE_DIR_MODE = 0o700;
  * platform supports it (the mode is applied and verified on the open
  * descriptor, never via a check-then-chmod path race), and any unsafe
  * type/permission failure rejects the run without touching foreign
- * entries. The returned device/inode is the identity the pre-subprocess
- * re-verification compares against. Exported so tests can exercise the
- * pre-existing-directory security path directly (it is only reachable
- * from the one fresh create).
+ * entries. Its open descriptor pins the directory object through process
+ * launch, preventing inode reuse from making a replacement appear identical.
+ * Exported so tests can exercise the pre-existing-directory path directly.
  */
 export function prepareStageDir(keyPath, keyMarker) {
     const stageDir = keyStageDir(keyPath, keyMarker);
@@ -767,33 +799,19 @@ export function prepareStageDir(keyPath, keyMarker) {
                 error: errorResult(SETUP_ERROR_CODES.KEY_CREATE_FAILED, `could not create a private staging directory for the service-account key: ${messageOf(error)}`),
             };
         }
-        const secured = secureExistingStageDir(stageDir, defaultKeyCleanupFs, "staging directory");
-        return secured.status === "ok"
-            ? { status: "ok", dev: secured.dev, ino: secured.ino }
-            : { status: "error", error: secured.error };
-    }
-    // Freshly created: capture the identity (device/inode) so the
-    // pre-subprocess verification can prove the directory at the staging
-    // path is still the one this invocation created.
+    }
+    const secured = secureExistingStageDir(stageDir, defaultKeyCleanupFs, "staging directory");
+    return secured.status === "ok"
+        ? { status: "ok", dev: secured.dev, ino: secured.ino, fd: secured.fd }
+        : { status: "error", error: secured.error };
+}
+/** Closes the pinned staging descriptor after the subprocess identity check. */
+function closePreparedStageDir(fd) {
     try {
-        const stat = lstatSync(stageDir);
-        if (stat.isSymbolicLink() || !stat.isDirectory()) {
-            // The directory we just created was replaced before it could be
-            // verified: fail closed and never touch the replacement.
-            return {
-                status: "error",
-                error: errorResult(SETUP_ERROR_CODES.KEY_CREATE_FAILED, `the staging directory ${stageDir} is not a plain directory; remove it after ` +
-                    `confirming it is not needed and rerun setup`),
-            };
-        }
-        return { status: "ok", dev: stat.dev, ino: stat.ino };
+        closeSync(fd);
     }
-    catch (error) {
-        return {
-            status: "error",
-            error: errorResult(SETUP_ERROR_CODES.KEY_CREATE_FAILED, `could not verify the staging directory ${stageDir}: ${messageOf(error)}; remove it ` +
-                `after confirming it is not needed and rerun setup`),
-        };
+    catch {
+        // Preserve the setup result; the descriptor is no longer in use.
     }
 }
 /**
@@ -803,12 +821,14 @@ export function prepareStageDir(keyPath, keyMarker) {
  * The directory is opened WITHOUT following symlinks and its type,
  * device/inode identity, and owner-only mode are verified THROUGH the
  * descriptor against the identity captured by `prepareStageDir`; only an
- * exact match is allowed to receive an `fchmod` (the directory is ours),
- * and the subprocess runs with that directory as its working directory and
- * a RELATIVE `key.json` destination, so the credential write is bound to
- * the validated private directory. A replacement — symlink, non-directory,
- * foreign directory, or mode failure — fails closed BEFORE the spawn and
- * is never chmod'ed, read, or written through.
+ * exact match is allowed to receive an `fchmod` (the directory is ours).
+ * The pinned prepared descriptor is inherited by the wrapper, which
+ * compares `statSync('.')` with `fstatSync(3)` before gcloud runs; a path
+ * replacement cannot pass merely by reusing the inode number. The
+ * post-spawn identity re-check stays as defense in depth. A replacement
+ * — symlink, non-directory, foreign directory, or mode failure — fails
+ * closed BEFORE the spawn and is never chmod'ed, read, or written
+ * through.
  */
 function verifyStageDirBeforeSubprocess(stageDir, expected) {
     let fd;
@@ -855,20 +875,58 @@ function verifyStageDirBeforeSubprocess(stageDir, expected) {
     }
 }
 /**
- * Verifies and secures a pre-existing deterministic directory.
+ * Re-checks the staging directory identity immediately AFTER the gcloud
+ * key-create subprocess returns, before its result is recorded or any
+ * staged output is trusted (defense in depth behind the wrapper's
+ * object-bound CWD, which already prevents the write from landing in a
+ * replacement).
+ *
+ * Only the exact device/inode captured by `prepareStageDir` passes;
+ * anything else fails closed with `key_create_failed` and nothing from
+ * the replacement is ever read, chmod'ed, installed, or cleaned up.
+ * Deliberately chmod-free (unlike the pre-spawn check): the entry may be
+ * foreign, so its mode is never touched. A transient swap-back — the
+ * replacement removed before this check — leaves no key in the real
+ * directory, so the bounded settlement ends `uncertain` without ever
+ * trusting the foreign directory.
+ */
+function verifyStageDirIdentityAfterSpawn(stageDir, expected) {
+    let lst;
+    try {
+        lst = lstatSync(stageDir);
+    }
+    catch (error) {
+        if (isNodeError(error) && error.code === "ENOENT") {
+            return errorResult(SETUP_ERROR_CODES.KEY_CREATE_FAILED, `the staging directory ${stageDir} disappeared while the key was being created; ` +
+                `nothing was trusted — rerun setup`);
+        }
+        return errorResult(SETUP_ERROR_CODES.KEY_CREATE_FAILED, `could not re-verify the staging directory ${stageDir}: ${messageOf(error)}; nothing ` +
+            `was trusted — rerun setup`);
+    }
+    if (lst === undefined || lst.isSymbolicLink() || !lst.isDirectory()) {
+        return errorResult(SETUP_ERROR_CODES.KEY_CREATE_FAILED, `the staging directory ${stageDir} is not a plain directory; nothing was trusted — ` +
+            `remove it after confirming it is not needed and rerun setup`);
+    }
+    if (lst.dev !== expected.dev || lst.ino !== expected.ino) {
+        return errorResult(SETUP_ERROR_CODES.KEY_CREATE_FAILED, `the staging directory ${stageDir} was replaced while the key was being created; ` +
+            `nothing was trusted — remove the replacement after confirming it is not needed and rerun setup`);
+    }
+    return null;
+}
+/**
+ * Verifies and secures a deterministic directory through a no-follow fd.
  *
  * The entry must be a plain directory (a symlink or non-directory is
- * refused and left untouched). The directory is opened with `O_NOFOLLOW`
- * where the platform defines it, its type is confirmed on the descriptor,
- * and its mode is enforced to owner-only 0700 through `fchmod` on that
- * descriptor with the resulting mode verified before close — so a swap
- * between the type check and the chmod cannot redirect the chmod onto a
- * foreign target. Any open/type/chmod failure fails closed; entries inside
- * the directory are never touched. `label` names the directory kind in
- * messages ("staging directory" or "cleanup directory").
+ * refused and left untouched). Descriptor and pathname identities are
+ * matched before any mode change; the mode is enforced through `fchmod`
+ * and verified on the descriptor. Success returns the still-open fd so a
+ * caller can pin the object across process launch; other callers close it
+ * after this check. Entries inside the directory are never touched.
+ * `label` names the directory kind in messages.
  */
 function secureExistingStageDir(dirPath, fs, label) {
     let fd;
+    let keepOpen = false;
     try {
         fd = fs.openSync(dirPath, constants.O_RDONLY | noFollowFlag() | directoryFlag());
     }
@@ -888,11 +946,16 @@ function secureExistingStageDir(dirPath, fs, label) {
     }
     try {
         let stat = fs.fstatSync(fd);
-        if (!stat.isDirectory()) {
+        const pathStat = fs.lstatSync(dirPath);
+        if (!stat.isDirectory() ||
+            pathStat.isSymbolicLink() ||
+            !pathStat.isDirectory() ||
+            pathStat.dev !== stat.dev ||
+            pathStat.ino !== stat.ino) {
             return {
                 status: "error",
-                error: errorResult(SETUP_ERROR_CODES.KEY_CREATE_FAILED, `the ${label} ${dirPath} is not a plain directory; remove it after confirming it ` +
-                    `is not needed and rerun setup`),
+                error: errorResult(SETUP_ERROR_CODES.KEY_CREATE_FAILED, `the ${label} ${dirPath} is not the verified plain directory; remove it after confirming ` +
+                    `it is not needed and rerun setup`),
             };
         }
         if ((Number(stat.mode) & 0o777) !== KEY_STAGE_DIR_MODE) {
@@ -914,7 +977,8 @@ function secureExistingStageDir(dirPath, fs, label) {
                 };
             }
         }
-        return { status: "ok", dev: stat.dev, ino: stat.ino };
+        keepOpen = true;
+        return { status: "ok", dev: stat.dev, ino: stat.ino, fd };
     }
     catch (error) {
         return {
@@ -923,11 +987,13 @@ function secureExistingStageDir(dirPath, fs, label) {
         };
     }
     finally {
-        try {
-            fs.closeSync(fd);
-        }
-        catch {
-            // The security verdict is the one to report.
+        if (!keepOpen) {
+            try {
+                fs.closeSync(fd);
+            }
+            catch {
+                // The security verdict is the one to report.
+            }
         }
     }
 }
@@ -975,6 +1041,12 @@ function inspectStagedKeyParent(keyPath, keyMarker) {
     if (secured.status === "error") {
         return { status: "error", error: secured.error };
     }
+    try {
+        defaultKeyCleanupFs.closeSync(secured.fd);
+    }
+    catch {
+        // Keep the validation result; the descriptor is no longer needed here.
+    }
     return { status: "present", dev: secured.dev, ino: secured.ino };
 }
 /**
@@ -1052,35 +1124,42 @@ const defaultKeyCleanupFs = {
     closeSync,
 };
 /**
- * Ownership-bound, crash-resumable staged cleanup, only after a verified
- * installation.
- *
- * The final key path is verified with lstat (never following a symlink) and
- * must be a regular file; a final symlink is refused and the staged
- * credential is retained. Before any deletion the deterministic stage
- * directory is atomically quarantined: renamed to the deterministic private
- * cleanup sibling path derived from the SAME persisted key marker (never an
- * unrecoverable random name), with the device/inode captured before the
- * rename re-verified after it — a source replaced between the capture and
- * the rename fails closed and nothing is deleted. Inside the quarantined
- * 0700 directory the staged entry is re-checked as a regular file with the
- * same device/inode as the no-follow final key immediately before its
- * unlink; any mismatch, foreign, or non-empty entry is preserved (the
- * directory is moved back to the stage path so the user finds the state
- * where the docs say it is). The empty quarantined directory is then
- * rmdir'd. Never recursive-delete.
+ * Re-reads both quarantine paths after `renameSync` reports ENOENT.
  *
- * Crash-resume boundaries: a crash-left cleanup directory with the matching
- * staged hardlink is finished (verify against the no-follow final, unlink,
- * rmdir); an empty cleanup directory (crash after the staged unlink) is
- * rmdir'd; an absent stage + cleanup pair means the cleanup already
- * finished (success); both existing at once fails closed. The setup lock is
- * held for the whole run — a second cooperating setup process cannot
- * acquire it concurrently, so no other run can be touching these
- * deterministic paths — and Node offers no literal unlinkat without a raw
- * libuv binding, so this quarantine + post-rename identity design is the
- * permitted boundary for the pathname unlink race.
+ * Either entry may have appeared, vanished, or been replaced since the
+ * pre-rename inspection, so the stale pair must not decide the outcome.
+ * A non-ENOENT inspection failure fails closed; otherwise the fresh pair
+ * is returned (an entry confirmed absent is `undefined`).
  */
+function reinspectStageAndCleanup(stageDir, cleanupDir, fs) {
+    let stage;
+    try {
+        stage = fs.lstatSync(stageDir);
+    }
+    catch (error) {
+        if (!isNodeError(error) || error.code !== "ENOENT") {
+            return {
+                status: "error",
+                error: errorResult(SETUP_ERROR_CODES.KEY_CREATE_FAILED, `could not inspect the staging directory ${stageDir}: ${messageOf(error)}; rerun setup to finish`),
+            };
+        }
+        stage = undefined;
+    }
+    let cleanup;
+    try {
+        cleanup = fs.lstatSync(cleanupDir);
+    }
+    catch (error) {
+        if (!isNodeError(error) || error.code !== "ENOENT") {
+            return {
+                status: "error",
+                error: errorResult(SETUP_ERROR_CODES.KEY_CREATE_FAILED, `could not inspect the cleanup directory ${cleanupDir}: ${messageOf(error)}; rerun setup to finish`),
+            };
+        }
+        cleanup = undefined;
+    }
+    return { status: "ok", stage, cleanup };
+}
 export function cleanupOwnedStage(keyPath, keyMarker, fs = defaultKeyCleanupFs) {
     const stageDir = keyStageDir(keyPath, keyMarker);
     const cleanupDir = keyCleanupDir(keyPath, keyMarker);
@@ -1148,10 +1227,34 @@ export function cleanupOwnedStage(keyPath, keyMarker, fs = defaultKeyCleanupFs)
         }
         catch (error) {
             if (isNodeError(error) && error.code === "ENOENT") {
-                // The stage directory vanished between the check and the rename:
-                // nothing was quarantined; resume from whatever is at the cleanup
-                // path below.
+                // The rename lost a source-or-destination race (the stage vanished
+                // or the cleanup parent changed under us): the pre-rename
+                // `cleanupLst` is now stale evidence and must not decide the
+                // outcome. Re-inspect BOTH paths fresh — only a freshly confirmed
+                // absent/absent pair is already-clean.
+                const fresh = reinspectStageAndCleanup(stageDir, cleanupDir, fs);
+                if (fresh.status === "error") {
+                    return fresh.error;
+                }
+                if (fresh.stage === undefined && fresh.cleanup === undefined) {
+                    return null;
+                }
+                if (fresh.stage !== undefined && fresh.cleanup !== undefined) {
+                    return errorResult(SETUP_ERROR_CODES.KEY_CREATE_FAILED, `both the staging directory ${stageDir} and the cleanup directory ${cleanupDir} exist; ` +
+                        `remove one after confirming it is not needed and rerun setup`);
+                }
+                if (fresh.stage !== undefined) {
+                    // The stage is (still) there but the rename reported ENOENT, so
+                    // the quarantine never happened: fail closed and let the next
+                    // run retry it instead of deleting through a path we never
+                    // quarantined.
+                    return errorResult(SETUP_ERROR_CODES.KEY_CREATE_FAILED, `could not quarantine the staging directory ${stageDir}: the directory changed ` +
+                        `during the rename; rerun setup to finish`);
+                }
+                // Stage confirmed absent with a freshly present cleanup directory:
+                // finish that directory below (it is re-validated there).
                 stageLst = undefined;
+                cleanupLst = fresh.cleanup;
             }
             else {
                 return errorResult(SETUP_ERROR_CODES.KEY_CREATE_FAILED, `could not quarantine the staging directory ${stageDir}: ${messageOf(error)}; rerun setup to finish`);
@@ -1198,6 +1301,12 @@ export function cleanupOwnedStage(keyPath, keyMarker, fs = defaultKeyCleanupFs)
     if (secured.status === "error") {
         return secured.error;
     }
+    try {
+        fs.closeSync(secured.fd);
+    }
+    catch {
+        // Keep the validation result; the descriptor is no longer needed here.
+    }
     let entries;
     try {
         entries = fs.readdirSync(cleanupDir);