opencode-secrets-obfuscation 0.1.0 → 0.1.1

package/tests/p0-native/windows-handle-loader.tests.ps1

@@ -1,191 +0,0 @@
-$ErrorActionPreference = 'Stop'
-
-# P0-C feasibility fixture. This is intentionally test-only and emits no fixture
-# path, source content, ACL text, or native error detail.
-if (-not $IsWindows) { Write-Error 'P0-C-WINDOWS-ONLY'; exit 2 }
-
-$native = @'
-using System;
-using System.ComponentModel;
-using System.IO;
-using System.Runtime.InteropServices;
-
-public static class P0WindowsNative {
-  [StructLayout(LayoutKind.Sequential)] public struct UNICODE_STRING { public ushort Length; public ushort MaximumLength; public IntPtr Buffer; }
-  [StructLayout(LayoutKind.Sequential)] public struct OBJECT_ATTRIBUTES { public int Length; public IntPtr RootDirectory; public IntPtr ObjectName; public uint Attributes; public IntPtr SecurityDescriptor; public IntPtr SecurityQualityOfService; }
-  [StructLayout(LayoutKind.Sequential)] public struct IO_STATUS_BLOCK { public IntPtr Status; public UIntPtr Information; }
-  [StructLayout(LayoutKind.Sequential)] public struct BY_HANDLE_FILE_INFORMATION { public uint FileAttributes; public System.Runtime.InteropServices.ComTypes.FILETIME CreationTime; public System.Runtime.InteropServices.ComTypes.FILETIME LastAccessTime; public System.Runtime.InteropServices.ComTypes.FILETIME LastWriteTime; public uint VolumeSerialNumber; public uint FileSizeHigh; public uint FileSizeLow; public uint NumberOfLinks; public uint FileIndexHigh; public uint FileIndexLow; }
-  [StructLayout(LayoutKind.Sequential)] public struct ACL_SIZE_INFORMATION { public uint AceCount; public uint AclBytesInUse; public uint AclBytesFree; }
-  [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)] static extern IntPtr CreateFileW(string name, uint access, uint share, IntPtr security, uint disposition, uint flags, IntPtr template);
-  [DllImport("kernel32.dll", SetLastError=true)] static extern bool GetFileInformationByHandle(IntPtr h, out BY_HANDLE_FILE_INFORMATION info);
-  [DllImport("kernel32.dll", SetLastError=true)] static extern bool ReadFile(IntPtr h, byte[] buffer, uint count, out uint read, IntPtr overlapped);
-  [DllImport("kernel32.dll", SetLastError=true)] static extern bool SetFilePointerEx(IntPtr h, long distance, out long moved, uint method);
-  [DllImport("kernel32.dll", SetLastError=true)] static extern bool CloseHandle(IntPtr h);
-  [DllImport("advapi32.dll", SetLastError=true)] static extern uint GetSecurityInfo(IntPtr h, uint objectType, uint securityInfo, out IntPtr owner, out IntPtr group, out IntPtr dacl, out IntPtr sacl, out IntPtr descriptor);
-  [DllImport("advapi32.dll", SetLastError=true)] static extern bool GetSecurityDescriptorOwner(IntPtr descriptor, out IntPtr owner, out bool defaulted);
-  [DllImport("advapi32.dll", SetLastError=true)] static extern bool GetSecurityDescriptorDacl(IntPtr descriptor, out bool present, out IntPtr dacl, out bool defaulted);
-  [DllImport("advapi32.dll", SetLastError=true)] static extern bool GetAclInformation(IntPtr acl, out ACL_SIZE_INFORMATION info, uint length, uint kind);
-  [DllImport("advapi32.dll", SetLastError=true)] static extern bool GetAce(IntPtr acl, uint index, out IntPtr ace);
-  [DllImport("advapi32.dll", CharSet=CharSet.Unicode, SetLastError=true)] static extern bool ConvertSidToStringSidW(IntPtr sid, out IntPtr stringSid);
-  [DllImport("kernel32.dll")] static extern IntPtr LocalFree(IntPtr value);
-  [DllImport("ntdll.dll")] static extern int NtCreateFile(out IntPtr h, uint access, ref OBJECT_ATTRIBUTES oa, out IO_STATUS_BLOCK iosb, IntPtr allocation, uint attributes, uint share, uint disposition, uint options, IntPtr ea, uint ealen);
-  [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)] static extern bool GetVolumeInformationByHandleW(IntPtr h, System.Text.StringBuilder name, uint nameLength, out uint serial, out uint maxComponent, out uint flags, System.Text.StringBuilder fs, uint fsLength);
-  [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)] static extern bool CreateHardLinkW(string link, string existing, IntPtr security);
-  [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)] static extern bool CreateSymbolicLinkW(string link, string target, uint flags);
-  [DllImport("kernel32.dll", SetLastError=true)] static extern bool DeviceIoControl(IntPtr h, uint code, byte[] input, uint inputLength, byte[] output, uint outputLength, out uint returned, IntPtr overlapped);
-  const uint GENERIC_READ=0x80000000, FILE_SHARE_READ=1, FILE_SHARE_WRITE=2, FILE_SHARE_DELETE=4, OPEN_EXISTING=3;
-  const uint FILE_FLAG_BACKUP_SEMANTICS=0x02000000, FILE_FLAG_OPEN_REPARSE_POINT=0x00200000;
-  const uint FILE_DIRECTORY_FILE=1, FILE_NON_DIRECTORY_FILE=0x40, FILE_OPEN=1, FILE_SYNCHRONOUS_IO_NONALERT=0x20;
-  const uint OBJ_CASE_INSENSITIVE=0x40, OBJ_DONT_REPARSE=0x1000, STATUS_SUCCESS=0, FILE_ATTRIBUTE_REPARSE_POINT=0x400;
-  const uint FSCTL_SET_REPARSE_POINT=0x000900A4, FSCTL_DELETE_REPARSE_POINT=0x000900AC, IO_REPARSE_TAG_MOUNT_POINT=0xA0000003;
-  const uint SE_FILE_OBJECT=1, OWNER_SECURITY_INFORMATION=1, DACL_SECURITY_INFORMATION=4, ACCESS_ALLOWED_ACE_TYPE=0, ACCESS_DENIED_ACE_TYPE=1, INHERITED_ACE=0x10, FILE_READ_DATA=1, FILE_ADD_FILE=2, FILE_ADD_SUBDIRECTORY=4, DELETE_CHILD=0x40;
-  static void Check(IntPtr h) { if (h == IntPtr.Zero || h == new IntPtr(-1)) throw new IOException("open-failed"); }
-  static IntPtr Unicode(string s, out GCHandle pin, out UNICODE_STRING us) { char[] c=(s+"\0").ToCharArray(); pin=GCHandle.Alloc(c, GCHandleType.Pinned); us=new UNICODE_STRING(); us.Length=(ushort)(s.Length*2); us.MaximumLength=(ushort)((s.Length+1)*2); us.Buffer=pin.AddrOfPinnedObject(); return us.Buffer; }
-  public static IntPtr OpenDirectory(string path) { IntPtr h=CreateFileW(path, GENERIC_READ, FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE, IntPtr.Zero, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS|FILE_FLAG_OPEN_REPARSE_POINT, IntPtr.Zero); Check(h); return h; }
-  public static IntPtr OpenRelative(IntPtr root, string component, bool directory) {
-    GCHandle pin; UNICODE_STRING us; Unicode(component, out pin, out us);
-    GCHandle usp=GCHandle.Alloc(us, GCHandleType.Pinned); OBJECT_ATTRIBUTES oa=new OBJECT_ATTRIBUTES(); oa.Length=Marshal.SizeOf(typeof(OBJECT_ATTRIBUTES)); oa.RootDirectory=root; oa.ObjectName=usp.AddrOfPinnedObject(); oa.Attributes=OBJ_CASE_INSENSITIVE|OBJ_DONT_REPARSE;
-    IO_STATUS_BLOCK io; IntPtr h; uint options=(directory?FILE_DIRECTORY_FILE:FILE_NON_DIRECTORY_FILE)|FILE_SYNCHRONOUS_IO_NONALERT|0x00200000;
-    int status=NtCreateFile(out h, 0x00120089U, ref oa, out io, IntPtr.Zero, 0, FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE, FILE_OPEN, options, IntPtr.Zero, 0);
-    usp.Free(); pin.Free(); if ((uint)status != STATUS_SUCCESS) throw new IOException("relative-open-rejected-"+((uint)status).ToString("X8")); BY_HANDLE_FILE_INFORMATION info; if(!GetFileInformationByHandle(h,out info)) { CloseHandle(h); throw new IOException("identity-failed-"+Marshal.GetLastWin32Error().ToString()); } if((info.FileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0) { CloseHandle(h); throw new IOException("relative-reparse-rejected"); } return h;
-  }
-  public static byte[] ReadAll(IntPtr h, int max) { byte[] b=new byte[max]; uint n; if(!ReadFile(h,b,(uint)b.Length,out n,IntPtr.Zero)) throw new IOException("read-failed"); Array.Resize(ref b,(int)n); return b; }
-  public static void Rewind(IntPtr h) { long moved; if(!SetFilePointerEx(h,0,out moved,0)) throw new IOException("seek-failed-"+Marshal.GetLastWin32Error().ToString()); }
-  public static string Identity(IntPtr h) { BY_HANDLE_FILE_INFORMATION i; if(!GetFileInformationByHandle(h,out i)) throw new IOException("identity-failed-"+Marshal.GetLastWin32Error().ToString()); return i.VolumeSerialNumber.ToString("X8")+":"+i.FileIndexHigh.ToString("X8")+i.FileIndexLow.ToString()+":"+i.NumberOfLinks.ToString(); }
-  public static string Volume(IntPtr h) { uint serial, max, flags; System.Text.StringBuilder fs=new System.Text.StringBuilder(64); System.Text.StringBuilder name=new System.Text.StringBuilder(64); if(!GetVolumeInformationByHandleW(h,name,(uint)name.Capacity,out serial,out max,out flags,fs,(uint)fs.Capacity)) throw new IOException("volume-failed-"+Marshal.GetLastWin32Error().ToString()); return fs.ToString(); }
-  static string Sid(IntPtr sid) { IntPtr p; if(sid==IntPtr.Zero || !ConvertSidToStringSidW(sid,out p)) return ""; try { return Marshal.PtrToStringUni(p); } finally { LocalFree(p); } }
-  public static int Policy(IntPtr h, string currentSid, bool ancestor) {
-    BY_HANDLE_FILE_INFORMATION fi; if(!GetFileInformationByHandle(h,out fi)) return 90; if(fi.NumberOfLinks != 1) return 6;
-    IntPtr owner, group, dacl, sacl, sd; uint e=GetSecurityInfo(h,SE_FILE_OBJECT,OWNER_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION,out owner,out group,out dacl,out sacl,out sd); if(e!=0) return 90+(int)e;
-    try {
-      IntPtr ownerSid; bool ownerDefault; if(!GetSecurityDescriptorOwner(sd,out ownerSid,out ownerDefault)) return 91; string os=Sid(ownerSid); if(os!=currentSid && os!="S-1-5-32-544") return 7;
-      bool present, daclDefault; if(!GetSecurityDescriptorDacl(sd,out present,out dacl,out daclDefault) || !present || dacl==IntPtr.Zero) return 8;
-      ACL_SIZE_INFORMATION ai; if(!GetAclInformation(dacl,out ai,(uint)Marshal.SizeOf(typeof(ACL_SIZE_INFORMATION)),2)) return 92;
-      bool currentAccess=false;
-      for(uint i=0;i<ai.AceCount;i++) { IntPtr ace; if(!GetAce(dacl,i,out ace)) return 93; byte type=Marshal.ReadByte(ace,0); byte flags=Marshal.ReadByte(ace,1); uint mask=(uint)Marshal.ReadInt32(ace,4); if(type==ACCESS_DENIED_ACE_TYPE) return 9; if(type!=ACCESS_ALLOWED_ACE_TYPE) return 9; string sid=Sid(IntPtr.Add(ace,8)); bool trusted=sid==currentSid || sid=="S-1-5-18" || sid=="S-1-5-32-544"; if(!trusted) return 3; if((flags & INHERITED_ACE)!=0 && !trusted) return 4; if(sid==currentSid) { uint needed=ancestor ? (FILE_ADD_FILE|FILE_ADD_SUBDIRECTORY|DELETE_CHILD) : FILE_READ_DATA; if((mask & needed)==needed) currentAccess=true; } }
-      return currentAccess ? 0 : 10;
-    } finally { if(sd!=IntPtr.Zero) LocalFree(sd); }
-  }
-  public static int HardLink(string link, string existing) { if(CreateHardLinkW(link,existing,IntPtr.Zero)) return 0; return Marshal.GetLastWin32Error(); }
-  public static int SymbolicLink(string link, string target) { if(CreateSymbolicLinkW(link,target,0)) return 0; return Marshal.GetLastWin32Error(); }
-  public static int Junction(string path, string target) {
-    IntPtr h=CreateFileW(path,0x40000000U,FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,IntPtr.Zero,OPEN_EXISTING,FILE_FLAG_BACKUP_SEMANTICS|FILE_FLAG_OPEN_REPARSE_POINT,IntPtr.Zero); if(h==IntPtr.Zero || h==new IntPtr(-1)) return Marshal.GetLastWin32Error();
-    string sub="\\??\\"+target.TrimEnd('\\')+"\\"; string print=target.TrimEnd('\\')+"\\"; byte[] s=System.Text.Encoding.Unicode.GetBytes(sub); byte[] p=System.Text.Encoding.Unicode.GetBytes(print); byte[] b=new byte[16+s.Length+p.Length]; BitConverter.GetBytes(IO_REPARSE_TAG_MOUNT_POINT).CopyTo(b,0); BitConverter.GetBytes((ushort)(8+s.Length+p.Length)).CopyTo(b,4); BitConverter.GetBytes((ushort)0).CopyTo(b,8); BitConverter.GetBytes((ushort)s.Length).CopyTo(b,10); BitConverter.GetBytes((ushort)s.Length).CopyTo(b,12); BitConverter.GetBytes((ushort)p.Length).CopyTo(b,14); Array.Copy(s,0,b,16,s.Length); Array.Copy(p,0,b,16+s.Length,p.Length); uint n; bool ok=DeviceIoControl(h,FSCTL_SET_REPARSE_POINT,b,(uint)b.Length,null,0,out n,IntPtr.Zero); int e=ok?0:Marshal.GetLastWin32Error(); CloseHandle(h); return e;
-  }
-  public static int RemoveJunction(string path) { IntPtr h=CreateFileW(path,0x40000000U,FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,IntPtr.Zero,OPEN_EXISTING,FILE_FLAG_BACKUP_SEMANTICS|FILE_FLAG_OPEN_REPARSE_POINT,IntPtr.Zero); if(h==IntPtr.Zero || h==new IntPtr(-1)) return Marshal.GetLastWin32Error(); byte[] b=new byte[8]; BitConverter.GetBytes(IO_REPARSE_TAG_MOUNT_POINT).CopyTo(b,0); uint n; bool ok=DeviceIoControl(h,FSCTL_DELETE_REPARSE_POINT,b,8,null,0,out n,IntPtr.Zero); int e=ok?0:Marshal.GetLastWin32Error(); CloseHandle(h); return e; }
-  public static void Close(IntPtr h) { CloseHandle(h); }
-}
-public static class P0WindowsNativeTest {
-}
-'@
-Add-Type -TypeDefinition $native -Language CSharp
-
-function Assert([bool] $condition, [string] $code) { if (-not $condition) { throw $code } }
-$root = Join-Path ([IO.Path]::GetTempPath()) ('p0-c-' + [Guid]::NewGuid().ToString('N'))
-try {
-  $gaps = @()
-  $junctionRejected = $false
-  [IO.Directory]::CreateDirectory($root) | Out-Null
-  # Harden before any synthetic source bytes are created.
-  $dirAcl = Get-Acl $root
-  $dirAcl.SetAccessRuleProtection($true, $false)
-  $me = [Security.Principal.WindowsIdentity]::GetCurrent().User
-  $dirAcl.SetOwner($me)
-  $dirAcl.Access | ForEach-Object { $dirAcl.RemoveAccessRule($_) | Out-Null }
-  $dirAcl.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule($me,'FullControl','ContainerInherit,ObjectInherit','None','Allow')))
-  $dirAcl.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule('NT AUTHORITY\SYSTEM','FullControl','ContainerInherit,ObjectInherit','None','Allow')))
-  $dirAcl.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule('BUILTIN\Administrators','FullControl','ContainerInherit,ObjectInherit','None','Allow')))
-  Set-Acl $root $dirAcl
-  $source = Join-Path $root 'source.env'
-  [IO.File]::WriteAllText($source, "P0_SYNTHETIC_CANARY=not-logged`r`n")
-  $hard=Join-Path $root 'hard.env'
-  $hardError=[P0WindowsNative]::HardLink($hard,$source)
-  if ($hardError -ne 0) { $gaps += ('hardlink-create-' + $hardError) }
-  $single=Join-Path $root 'single.env'
-  [IO.File]::WriteAllText($single, "P0_SYNTHETIC_SINGLE=not-logged`r`n")
-  $fileAcl = Get-Acl $source
-  $fileAcl.SetAccessRuleProtection($true, $false); $fileAcl.SetOwner($me)
-  $fileAcl.Access | ForEach-Object { $fileAcl.RemoveAccessRule($_) | Out-Null }
-  $fileAcl.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule($me,'Read','None','None','Allow')))
-  $fileAcl.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule('NT AUTHORITY\SYSTEM','Read','None','None','Allow')))
-  $fileAcl.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule('BUILTIN\Administrators','Read','None','None','Allow')))
-  Set-Acl $source $fileAcl
-  $singleAcl=Get-Acl $single
-  $singleAcl.SetAccessRuleProtection($true, $false); $singleAcl.SetOwner($me)
-  $singleAcl.Access | ForEach-Object { $singleAcl.RemoveAccessRule($_) | Out-Null }
-  $singleAcl.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule($me,'Read','None','None','Allow')))
-  $singleAcl.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule('NT AUTHORITY\SYSTEM','Read','None','None','Allow')))
-  $singleAcl.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule('BUILTIN\Administrators','Read','None','None','Allow')))
-  Set-Acl $single $singleAcl
-
-  $rootH=[P0WindowsNative]::OpenDirectory($root)
-  $volume=[P0WindowsNative]::Volume($rootH)
-  Assert ($volume -eq 'NTFS') 'P0-C-WIN-VOLUME-IDENTITY'
-  Assert (([P0WindowsNative]::Policy($rootH,$me.Value,$true)) -eq 0) 'P0-C-WIN-ANCESTOR-POLICY'
-  $fileH=[P0WindowsNative]::OpenRelative($rootH,'single.env',$false)
-  $id=[P0WindowsNative]::Identity($fileH)
-  Assert (($id -match ':1$')) 'P0-C-WIN-SINGLE-LINK-COUNT'
-  Assert (([P0WindowsNative]::Policy($fileH,$me.Value,$false)) -eq 0) 'P0-C-WIN-SOURCE-POLICY'
-  $bytes=[P0WindowsNative]::ReadAll($fileH,4096)
-  Assert ($bytes.Length -gt 0) 'P0-C-WIN-SAME-HANDLE-READ'
-  $rotated=Join-Path $root 'single.rotated'; [IO.File]::Move($single,$rotated); [IO.File]::WriteAllText($single, "P0_SYNTHETIC_REPLACEMENT=not-logged`r`n")
-  $idAfter=[P0WindowsNative]::Identity($fileH); Assert ($idAfter -eq $id) 'P0-C-WIN-POST-SWAP-IDENTITY'
-  [P0WindowsNative]::Rewind($fileH)
-  $bytesAfter=[P0WindowsNative]::ReadAll($fileH,4096); Assert ($bytesAfter.Length -gt 0) 'P0-C-WIN-POST-SWAP-READ'
-  [P0WindowsNative]::Close($fileH); [P0WindowsNative]::Close($rootH)
-
-  if ($hardError -eq 0) {
-    $rootH=[P0WindowsNative]::OpenDirectory($root); $hardH=[P0WindowsNative]::OpenRelative($rootH,'hard.env',$false)
-    Assert (([P0WindowsNative]::Policy($hardH,$me.Value,$false)) -eq 6) 'P0-C-WIN-MULTI-LINK-ACCEPTED'
-    [P0WindowsNative]::Close($hardH); [P0WindowsNative]::Close($rootH)
-  }
-
-  # Reparse points are rejected at the component open, not followed by a path read.
-  $link=Join-Path $root 'link.env'
-  try {
-    $symbolicError=[P0WindowsNative]::SymbolicLink($link,$source)
-    if ($symbolicError -ne 0) { $gaps += ('reparse-create-' + $symbolicError); throw 'P0-C-REPARSE-SETUP-GAP' }
-    $rootH=[P0WindowsNative]::OpenDirectory($root)
-    $reparseRejected=$false; try { [P0WindowsNative]::OpenRelative($rootH,'link.env',$false) | Out-Null; throw 'P0-C-WIN-REPARSE-FOLLOWED' } catch { $reparseRejected=$_.Exception.ToString().Contains('relative-reparse-rejected') }; Assert $reparseRejected 'P0-C-WIN-REPARSE-UNEXPECTED'
-    [P0WindowsNative]::Close($rootH)
-  } catch { if ($_.Exception.Message -ne 'P0-C-REPARSE-SETUP-GAP') { throw } }
-
-  # Hard links are observable on the opened object and therefore rejectable.
-  if ($hardError -eq 0) {
-    $rootH=[P0WindowsNative]::OpenDirectory($root); $hardH=[P0WindowsNative]::OpenRelative($rootH,'hard.env',$false)
-    Assert (([P0WindowsNative]::Identity($hardH) -match ':2$')) 'P0-C-WIN-HARDLINK-NOT-OBSERVED'
-    [P0WindowsNative]::Close($hardH); [P0WindowsNative]::Close($rootH)
-  }
-  $broadDir=Join-Path $root 'broad-parent'; New-Item -ItemType Directory -Path $broadDir | Out-Null
-  $broadAcl=Get-Acl $broadDir
-  $broadAcl.SetAccessRuleProtection($true, $false); $broadAcl.SetOwner($me)
-  $broadAcl.Access | ForEach-Object { $broadAcl.RemoveAccessRule($_) | Out-Null }
-  $broadAcl.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule($me,'FullControl','ContainerInherit,ObjectInherit','None','Allow')))
-  $broadAcl.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule('NT AUTHORITY\SYSTEM','FullControl','ContainerInherit,ObjectInherit','None','Allow')))
-  $broadAcl.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule('BUILTIN\Administrators','FullControl','ContainerInherit,ObjectInherit','None','Allow')))
-  $broadAcl.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule('BUILTIN\Users','Read','ContainerInherit,ObjectInherit','None','Allow')))
-  Set-Acl $broadDir $broadAcl
-  $broadFile=Join-Path $broadDir 'broad.env'; [IO.File]::WriteAllText($broadFile, "P0_SYNTHETIC_BROAD=not-logged`r`n")
-  $rootH=[P0WindowsNative]::OpenDirectory($root); $broadH=[P0WindowsNative]::OpenRelative($rootH,'broad-parent',$true)
-  Assert (([P0WindowsNative]::Policy($broadH,$me.Value,$true)) -eq 3) 'P0-C-WIN-BROAD-ANCESTOR-ACCEPTED'
-  $broadFileH=[P0WindowsNative]::OpenRelative($broadH,'broad.env',$false)
-  Assert (([P0WindowsNative]::Policy($broadFileH,$me.Value,$false)) -eq 3) 'P0-C-WIN-BROAD-FILE-ACCEPTED'
-  [P0WindowsNative]::Close($broadFileH); [P0WindowsNative]::Close($broadH); [P0WindowsNative]::Close($rootH)
-  $junction=Join-Path $root 'ancestor-junction'; New-Item -ItemType Directory -Path $junction | Out-Null
-  $junctionError=[P0WindowsNative]::Junction($junction,$root)
-  if ($junctionError -ne 0) {
-    $gaps += ('junction-native-create-' + $junctionError)
-    Remove-Item -LiteralPath $junction -Force
-    try { New-Item -ItemType Junction -Path $junction -Target $root -ErrorAction Stop | Out-Null } catch { $gaps += 'junction-fallback-create'; $junction = $null }
-  }
-  if ($junction) {
-    $rootH=[P0WindowsNative]::OpenDirectory($root)
-    try { $reparseRejected=$false; try { $jH=[P0WindowsNative]::OpenRelative($rootH,'ancestor-junction',$true); throw 'P0-C-WIN-ANCESTOR-REPARSE-FOLLOWED' } catch { $reparseRejected=$_.Exception.ToString().Contains('relative-reparse-rejected') }; Assert $reparseRejected 'P0-C-WIN-ANCESTOR-REPARSE-UNEXPECTED'; $junctionRejected = $true } finally { [P0WindowsNative]::Close($rootH) }
-    Assert (([P0WindowsNative]::RemoveJunction($junction)) -eq 0) 'P0-C-WIN-JUNCTION-CLEANUP'
-  }
-  Write-Output ('P0-C-WINDOWS: PARTIAL (NTFS/relative/identity/read/post-read/hardlink/junction-rejection=' + $junctionRejected + '; gaps=' + ($gaps -join ',') + ')')
-  if ($gaps.Count -gt 0) { exit 2 }
-} finally {
-  if ($junction) { [P0WindowsNative]::RemoveJunction($junction) | Out-Null }
-  if (Test-Path $root) { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
-}

package/tests/scaffold/repository.test.ts

@@ -1,105 +0,0 @@
-import assert from "node:assert/strict"
-import { readFile } from "node:fs/promises"
-import { spawnSync } from "node:child_process"
-import { test } from "node:test"
-import { fileURLToPath } from "node:url"
-
-const root = new URL("../../", import.meta.url)
-const load = async (path: string): Promise<unknown> => JSON.parse(await readFile(new URL(path, root), "utf8"))
-
-interface Case {
-  id: string
-  phase: string
-  profile: string
-  expectation: string
-  reviews: string[]
-  status: string
-  title: string
-}
-
-test("scaffold: package is private and exposes no pretend plugin entrypoint", async () => {
-  const pkg = await load("package.json") as Record<string, unknown>
-  assert.equal(pkg.private, true)
-  assert.equal(pkg.exports, undefined)
-  assert.equal(pkg.main, undefined)
-})
-
-test("scaffold: smoke inventory has unique IDs, honest states and R1-R8 coverage", async () => {
-  const inventory = await load("tests/smoke/cases.json") as { schemaVersion: number; cases: Case[] }
-  assert.equal(inventory.schemaVersion, 1)
-  assert.ok(inventory.cases.length > 0)
-  assert.equal(new Set(inventory.cases.map((item) => item.id)).size, inventory.cases.length)
-  // Exactly these cases are implemented; flipping a status is a deliberate
-  // contract edit tied to a bound handler in scripts/smoke.mjs.
-  const implemented = new Set(["P5-TRANSPARENT-ROUNDTRIP", "P5-SINKS", "P5-BODIES"])
-  const reviews = new Set<string>()
-  for (const item of inventory.cases) {
-    assert.match(item.id, /^P[056]-[A-Z-]+$/)
-    assert.ok(["P0", "P5", "P6"].includes(item.phase))
-    assert.ok(["active-only", "enforced"].includes(item.profile))
-    assert.ok(["behavior", "protected", "denied", "expected-gap"].includes(item.expectation))
-    assert.ok(["planned", "implemented"].includes(item.status))
-    assert.equal(item.status, implemented.has(item.id) ? "implemented" : "planned", item.id)
-    assert.ok(item.title.length > 0)
-    if (item.expectation === "expected-gap") assert.equal(item.profile, "active-only")
-    for (const review of item.reviews) {
-      assert.match(review, /^R[1-8]$/)
-      reviews.add(review)
-    }
-  }
-  for (const id of [1, 2, 3, 5, 6, 7, 8]) assert.ok(reviews.has(`R${id}`))
-})
-
-test("scaffold: research commit is not represented as runtime qualification", async () => {
-  const manifest = await load("tests/smoke/qualification.json") as {
-    status: string; host: { version: unknown; artifacts: unknown[] }; evidence: unknown[]
-  }
-  assert.equal(manifest.status, "unqualified")
-  assert.equal(manifest.host.version, null)
-  assert.deepEqual(manifest.host.artifacts, [])
-  assert.deepEqual(manifest.evidence, [])
-})
-
-const smokeInvocation = (args: readonly string[], cwd = fileURLToPath(root)) =>
-  spawnSync(process.execPath, [fileURLToPath(new URL("scripts/smoke.mjs", root)), ...args], {
-    cwd, encoding: "utf8", timeout: 10000,
-  })
-
-test("smoke runner: without --run it refuses to execute anything", () => {
-  for (const args of [[], ["--unsupported"], ["--run"], ["--run", "ALL", "--qualification", "--extra"]]) {
-    const result = smokeInvocation(args)
-    assert.equal(result.error, undefined, `args=${JSON.stringify(args)}`)
-    assert.equal(result.status, 2, `args=${JSON.stringify(args)}`)
-    assert.match(result.stderr, /SMOKE_INVALID_ARGUMENT/, `args=${JSON.stringify(args)}`)
-  }
-})
-
-test("smoke runner: qualification execution stays refused until gates pass", () => {
-  for (const args of [["--qualification"], ["--qualification", "--run", "all"]]) {
-    const result = smokeInvocation(args)
-    assert.equal(result.status, 2, `args=${JSON.stringify(args)}`)
-    assert.match(result.stderr, /SMOKE_NOT_IMPLEMENTED/, `args=${JSON.stringify(args)}`)
-  }
-})
-
-test("smoke runner: unknown or unimplemented case selections fail before any launch", () => {
-  const unknown = smokeInvocation(["--run", "NO-SUCH-CASE"])
-  assert.equal(unknown.status, 2)
-  assert.match(unknown.stderr, /SMOKE_UNKNOWN_CASE/)
-  const unimplemented = smokeInvocation(["--run", "P0-BOOT"])
-  assert.equal(unimplemented.status, 2)
-  assert.match(unimplemented.stderr, /SMOKE_CASE_NOT_IMPLEMENTED/)
-})
-
-test("scaffold: list mode is inventory-only and works outside the repo cwd", () => {
-  const result = spawnSync(process.execPath, [fileURLToPath(new URL("scripts/smoke.mjs", root)), "--list"], {
-    cwd: fileURLToPath(new URL("tests/", root)), encoding: "utf8", timeout: 10000,
-  })
-  assert.equal(result.error, undefined)
-  assert.equal(result.status, 0)
-  assert.match(result.stdout, /P0-BOOT \[planned\]/)
-  assert.match(result.stdout, /P5-TRANSPARENT-ROUNDTRIP \[implemented\]/)
-  assert.match(result.stdout, /P5-SINKS \[implemented\]/)
-  assert.match(result.stdout, /P5-BODIES \[implemented\]/)
-  assert.match(result.stdout, /No smoke tests executed/)
-})

package/tests/smoke/README.md

@@ -1,37 +0,0 @@
-'# Real OpenCode smoke tests
-
-`cases.json` is the stable-ID inventory. `P5-TRANSPARENT-ROUNDTRIP` is the
-implemented case and is bound explicitly in `scripts/smoke.mjs`; the previous
-`P5-ROUNDTRIP` tool-broker experiment is retained as planned history only.
-`qualification.json` deliberately contains **null pins**. A passing smoke case
-is sandbox evidence, not release qualification.
-
-The runner launches the actual pinned V2 host with private config/data/cache/home,
-a scripted loopback provider and an allowlisted environment. The plugin adds no
-model-visible tools and starts no network request of its own.
-
-`P5-TRANSPARENT-ROUNDTRIP` installs `dist/plugin.mjs` as `index.js`, drives one
-`opencode run` conversation, and asserts exit 0, an opaque `secret-<uuid>`
-replacement in existing provider traffic, no raw canary in provider bodies or
-public output, and no plugin-owned request. P0 native-loader cases run real OS operations alongside'
-host qualification and must state the tested filesystem. Unsupported OS cases
-are **unqualified**, not silently passing skips.
-
-Standing rules for handlers:
-
-- Require explicit artifact paths and verified versions/checksums from the
-  manifest before claiming qualification; a case run records what it actually
-  used.
-- Use a dedicated service, private config/data/cache/home and allowlisted child
-  environment. Never attach to or restart the user's shared service.
-- Record real provider bytes, events, database/state and spill files privately;
-  stdout and ordinary CI artifacts contain safe case IDs/counts only.
-- Bound startup, calls, buffers and teardown. Kill the run's owned processes
-  (by sandbox path and by managed-service port); validate the run-directory
-  marker before exact-path cleanup.
-- Run a zero-egress/zero-resolution oracle for denial cases, not just text scans.
-- Distinguish `expected-gap` evidence from `protected`/`denied` evidence. It
-  cannot qualify an enforced profile. Unexpected fixes/regressions require
-  review of the evidence; do not simply invert assertions to keep tests green.
-- Qualification must reject missing/TODO/skipped required cases, unknown pins,
-  empty case selection, unsupported platforms and unavailable mandatory gates.

package/tests/smoke/cases.json

@@ -1,17 +0,0 @@
-{
-  "schemaVersion": 1,
-  "cases": [
-    { "id": "P0-BOOT", "phase": "P0", "profile": "active-only", "expectation": "behavior", "reviews": [], "status": "planned", "title": "Boot an isolated pinned V2 host and verify plugin/artifact identity" },
-    { "id": "P0-HOOKS", "phase": "P0", "profile": "active-only", "expectation": "behavior", "reviews": ["R1", "R6"], "status": "planned", "title": "Probe prompt, context, model and HTTP hook ordering and serialization" },
-    { "id": "P0-ABORT", "phase": "P0", "profile": "active-only", "expectation": "denied", "reviews": ["R6"], "status": "planned", "title": "Unsafe or unverifiable provider publication fails before transmission" },
-    { "id": "P0-SOURCE-LINUX", "phase": "P0", "profile": "active-only", "expectation": "denied", "reviews": ["R8"], "status": "planned", "title": "Qualify Linux source opening, replacement and link behavior" },
-    { "id": "P0-SOURCE-WINDOWS", "phase": "P0", "profile": "active-only", "expectation": "denied", "reviews": ["R8"], "status": "planned", "title": "Qualify Windows source opening, replacement and reparse behavior" },
-    { "id": "P0-QUOTAS", "phase": "P0", "profile": "active-only", "expectation": "behavior", "reviews": ["R7"], "status": "planned", "title": "Prove bounded source, traversal and activation accounting" },
-    { "id": "P5-TRANSPARENT-ROUNDTRIP", "phase": "P5", "profile": "active-only", "expectation": "protected", "reviews": ["R1", "R2", "R6"], "status": "implemented", "title": "Substitute configured secrets behind the scenes in existing provider traffic" },
-    { "id": "P5-SINKS", "phase": "P5", "profile": "active-only", "expectation": "protected", "reviews": ["R1", "R2"], "status": "implemented", "title": "Protect outgoing provider requests and returned provider text" },
-    { "id": "P5-BODIES", "phase": "P5", "profile": "active-only", "expectation": "protected", "reviews": ["R1", "R2", "R3", "R6"], "status": "implemented", "title": "Protect provider headers, bodies, errors and final serialized bytes" },
-    { "id": "P5-LIFECYCLE-GAP", "phase": "P5", "profile": "active-only", "expectation": "expected-gap", "reviews": ["R5", "R6"], "status": "planned", "title": "Observe plugin unload, late overlays and stale activation behavior" },
-    { "id": "P5-EXPANSION", "phase": "P5", "profile": "active-only", "expectation": "denied", "reviews": ["R7"], "status": "planned", "title": "Exercise expansion, cancellation and concurrency bounds" },
-    { "id": "P5-PACKAGING", "phase": "P5", "profile": "active-only", "expectation": "behavior", "reviews": [], "status": "planned", "title": "Install the packed artifact in a clean environment and restart" }
-  ]
-}

package/tests/smoke/qualification.json

@@ -1,20 +0,0 @@
-{
-  "schemaVersion": 1,
-  "status": "unqualified",
-  "researchCommit": "e9def88a7790efc6abace15b67f3625ff4d66237",
-  "host": {
-    "version": null,
-    "sourceCommit": null,
-    "artifacts": []
-  },
-  "pluginApiVersion": null,
-  "effectVersion": null,
-  "provider": {
-    "package": null,
-    "version": null,
-    "protocol": null
-  },
-  "platforms": [],
-  "trustedPluginOrder": [],
-  "evidence": []
-}

package/tests/smoke/runtime-candidate.json

@@ -1,111 +0,0 @@
-{
-  "schemaVersion": 1,
-  "status": "unqualified",
-  "profile": "active-only-mvp-candidate",
-  "host": {
-    "version": "2.0.28",
-    "sourceTag": "v2.0.28",
-    "sourceCommit": "026b106bc5d41b679ffc413264229c340871e4d3",
-    "sourceAssociation": "official Git tag; binary build provenance and reproducible-build equality are not established",
-    "distribution": {
-      "package": "@opencode/cli",
-      "version": "2.0.28",
-      "tarball": "https://registry.npmjs.org/@opencode/cli/-/cli-2.0.28.tgz",
-      "npmIntegrity": "sha512-nKStJJVG6to58gSPv5AuzNQZhYtou6b1jfI5EIckshWT9w8teesSLgP3gH/iSA/madUhvkNqsFjUFuD3NRne9Q==",
-      "platformPackages": [
-        {
-          "package": "@opencode/cli-linux-x64@2.0.28",
-          "tarball": "https://registry.npmjs.org/@opencode/cli-linux-x64/-/cli-linux-x64-2.0.28.tgz",
-          "tarballSha256": "76F8505BAAF56965ED28F305B74C526B54ECCD18FE78C81621A4090CC026C9F9",
-          "npmIntegrity": "sha512-HdgQ2c9FrER88w3Alm/UGdzU55lCc0FXxSm+VNMXUz+Yyv03uLc0Z+PxSnEBysmYNKcFvcnxdT7e0xGPoytrNg==",
-          "member": "package/bin/opencode",
-          "memberSha256": "20D305D0140BFE04DF7264A4ECB014402B74B6AC0A0F6456EE07EF3325FB4A85"
-        },
-        {
-          "package": "@opencode/cli-windows-arm64@2.0.28",
-          "tarball": "https://registry.npmjs.org/@opencode/cli-windows-arm64/-/cli-windows-arm64-2.0.28.tgz",
-          "tarballSha256": "5DD7944A1EE879E7D9794263D945386B706F404F3EEE885CB599E81ABC5E59EF",
-          "npmIntegrity": "sha512-9HXcqjQa2ghY6tgqjRqaVCZfBuP10b55ffo2QdgHESzsItTwL0yKWaorzj91q96dqmQJ6MOvpl31PdhJnhuJ4g==",
-          "member": "package/bin/opencode.exe",
-          "memberSha256": "65F0E7ACCC7D5FD77CA7380FDE87E3289D0CF27687851E5240BBDE6CAA7BDB66",
-          "peMachine": "AA64"
-        },
-        {
-          "package": "@opencode/cli-windows-x64@2.0.28",
-          "tarball": "https://registry.npmjs.org/@opencode/cli-windows-x64/-/cli-windows-x64-2.0.28.tgz",
-          "tarballSha256": "A5A212125E497726A95D6F9C3CDCFE6F1FA35CA61F3F263E6575D557747FEAE2",
-          "npmIntegrity": "sha512-1/pyMMi61RHsROPJbLUsO8U2hIUMwzNQvY/XUlF5IgxXvIVd9oNI8kxmZcD72rta3s17doKAEB+MKdsnmeFxQ==",
-          "member": "package/bin/opencode.exe",
-          "memberSha256": "9C59FCD39AA9C611AEDA04711BAB9D668CE3145FA5CDE9868F69C31ADCCFD3E3",
-          "peMachine": "8664"
-        }
-      ]
-    },
-    "privateArtifact": {
-      "archiveMember": "package/bin/opencode.exe",
-      "sha256": "65F0E7ACCC7D5FD77CA7380FDE87E3289D0CF27687851E5240BBDE6CAA7BDB66",
-      "format": "PE32+ Windows executable",
-      "peMachine": "AA64",
-      "executed": false
-    }
-  },
-  "pluginApiVersion": "2.0.28",
-  "effectVersion": "4.0.1",
-  "provider": {
-    "runtimePackage": "@opencode/ai@2.0.28",
-    "package": "@opencode/ai/providers/openai-compatible",
-    "version": "2.0.28",
-    "protocol": "OpenAI-compatible HTTP; exact fixture endpoint/model remains unselected"
-  },
-  "platforms": [
-    {
-      "os": "linux",
-      "arch": "x64",
-      "status": "candidate-only",
-      "note": "Linux x64 native artifact; runtime/containment remain unqualified"
-    },
-    {
-      "os": "win32",
-      "arch": "arm64",
-      "status": "candidate-only",
-      "note": "Windows ARM64 native artifact; runtime/containment remain unqualified"
-    },
-    {
-      "os": "win32",
-      "arch": "x64",
-      "status": "candidate-only",
-      "note": "Windows x64 native artifact; runtime/containment remain unqualified"
-    }
-  ],
-  "startupIsolation": {
-    "status": "source-verified-controls-not-runtime-proven",
-    "mode": "standalone or foreground serve; never shared service",
-    "allowlistRequired": true,
-    "environmentControls": [
-      "XDG_DATA_HOME",
-      "XDG_CACHE_HOME",
-      "XDG_CONFIG_HOME",
-      "XDG_STATE_HOME",
-      "TEMP",
-      "TMP",
-      "ProgramData",
-      "OPENCODE_CONFIG_DIR",
-      "OPENCODE_CONFIG_PROJECT_DISABLE=1",
-      "OPENCODE_CONFIG_CONTENT",
-      "OPENCODE_DB=<private-root>/data/opencode.db",
-      "OPENCODE_PASSWORD=<run-owned-random-password>"
-    ],
-    "sharedService": "must not be discovered, attached to, stopped, or restarted"
-  },
-  "evidence": [
-    "https://github.com/anomalyco/opencode/tree/v2.0.28",
-    "https://api.github.com/repos/anomalyco/opencode/git/ref/tags/v2.0.28",
-    "https://opencode.ai/v2/docs/",
-    "https://opencode.ai/v2/docs/cli"
-  ],
-  "qualificationBlockers": [
-    "P0-BOOT has not executed the candidate host",
-    "startup filesystem/service isolation has not been runtime-proven",
-    "Windows ARM64 execution of the x64 artifact is not qualified"
-  ]
-}

package/tests/support/README.md

@@ -1,32 +0,0 @@
-# P0 test-harness support
-
-Current helpers (test-only; none constitutes real-host qualification):
-
-- `qualification.ts`: bounded case-evidence bookkeeping. Validates input shapes
-  and rejects missing/TODO/stale/mixed-profile records. It does not verify capture
-  truth, hashes, authoritative case selection, or actual execution.
-- `recording-endpoint.ts`: bounded scripted loopback HTTP recorder for synthetic
-  traffic. Owns its sockets and in-memory captures. It is not a model protocol
-  implementation, HTTPS connector, or a firewall. Parsed-request and connection
-  counters are distinct; request counts alone cannot prove zero network egress.
-- `run-directory.ts` and `child-process.ts`: local synthetic fixture support under
-  active review. Do not use them to start OpenCode until the documented privacy,
-  artifact identity and whole-process-tree prerequisites pass.
-
-Implement these test facilities before production code:
-
-1. Run-directory lifecycle: private OS permissions, exact owned-path cleanup,
-   validated safe output. Store beneath ignored `.artifacts/` or an explicitly
-   approved private test root. Git ignore alone is not access control.
-2. Process harness: explicit pinned binary, allowlisted environment, isolated
-   service/config/data/cache/home, bounded startup and teardown, tracked PIDs.
-3. Recording provider and controlled HTTPS adapter fixtures; generated synthetic
-   credentials only, independent expected outcomes and call counters.
-4. Sink-byte, overlap-interval, authorization, destination, revision and quota
-   oracles. Do not import a production sanitizer to decide whether it leaked.
-5. Evidence writer: safe case IDs/status/counts on stdout, private raw captures,
-   explicit profile/build/OS/request-kind and expectation type.
-
-The real-host orchestration and evidence store are not implemented. Do not read
-the operator's real credentials/config, attach to the shared service, or kill
-arbitrary OpenCode processes to make a test pass.