opencode-secrets-obfuscation 0.1.0 → 0.1.1

package/tests/support/qualification.ts

@@ -1,154 +0,0 @@
-/**
- * Test-harness bookkeeping only. This assesses a trusted runner's selected-case
- * evidence; it does not verify artifact hashes, capture contents, assertions, or
- * completeness of the release's required-case selection. It cannot qualify a
- * runtime by itself. Inputs are validated as bounded plain-data records here.
- */
-export type Profile = "active-only" | "enforced"
-export type Expectation = "behavior" | "protected" | "denied" | "expected-gap"
-export type EvidenceStatus = "passed" | "observed-gap" | "planned" | "todo" | "skipped" | "failed" | "unavailable"
-
-export interface RequiredCase {
-  id: string
-  profile: Profile
-  platform: string
-  expectation: Expectation
-}
-
-export interface CaseEvidence extends RequiredCase {
-  runID: string
-  buildID: string
-  status: EvidenceStatus
-  assertions: number
-  captureIDs: string[]
-}
-
-interface RunIdentity {
-  runID: string
-  buildID: string
-  profile: Profile
-  platform: string
-}
-
-type FailureCode = "INVALID_SELECTION" | "INVALID_RUN" | "INVALID_REQUIREMENT" |
-  "INVALID_EVIDENCE" | "EVIDENCE_COUNT" | "EVIDENCE_MISMATCH" | "CASE_NOT_PASSED" |
-  "MISSING_ASSERTIONS_OR_CAPTURES" | "GAP_NOT_ALLOWED" | "INVALID_INPUT"
-
-export interface Assessment {
-  satisfied: boolean
-  failures: { code: FailureCode }[]
-}
-
-const safeID = (value: string) => /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(value)
-const caseID = (value: string) => /^P[0-9]-[A-Z0-9]+(?:-[A-Z0-9]+)*$/.test(value) && value.length <= 128
-const profile = (value: string) => value === "active-only" || value === "enforced"
-const expectation = (value: string) => ["behavior", "protected", "denied", "expected-gap"].includes(value)
-
-function plain(value: unknown, fields: readonly string[]): Record<string, unknown> | undefined {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) return undefined
-  const prototype = Object.getPrototypeOf(value)
-  if (prototype !== Object.prototype && prototype !== null) return undefined
-  if (Reflect.ownKeys(value).length !== fields.length) return undefined
-  const result: Record<string, unknown> = Object.create(null)
-  for (const key of fields) {
-    const descriptor = Object.getOwnPropertyDescriptor(value, key)
-    if (!descriptor || !("value" in descriptor)) return undefined
-    result[key] = descriptor.value
-  }
-  return result
-}
-
-function items(value: unknown, limit: number): unknown[] | undefined {
-  if (!Array.isArray(value) || value.length > limit) return undefined
-  const result: unknown[] = []
-  for (let index = 0; index < value.length; index++) {
-    const descriptor = Object.getOwnPropertyDescriptor(value, String(index))
-    if (!descriptor || !("value" in descriptor)) return undefined
-    result.push(descriptor.value)
-  }
-  return result
-}
-
-/** Throws neither malformed input nor its contents into the caller's diagnostics. */
-export function assessCases(requiredInput: unknown, evidenceInput: unknown, runInput: unknown): Assessment {
-  const invalidInput: Assessment = { satisfied: false, failures: [{ code: "INVALID_INPUT" }] }
-  try {
-    const requirements = items(requiredInput, 4096)
-    const records = items(evidenceInput, 4096)
-    const run = plain(runInput, ["runID", "buildID", "profile", "platform"])
-    if (!requirements || !records || !run || Object.values(run).some((value) => typeof value !== "string")) return invalidInput
-    const required: RequiredCase[] = []
-    for (const value of requirements) {
-      const item = plain(value, ["id", "profile", "platform", "expectation"])
-      if (!item || Object.values(item).some((field) => typeof field !== "string")) return invalidInput
-      required.push(item as unknown as RequiredCase)
-    }
-    const evidence: CaseEvidence[] = []
-    for (const value of records) {
-      const record = plain(value, ["id", "profile", "platform", "expectation", "runID", "buildID", "status", "assertions", "captureIDs"])
-      if (!record || typeof record.assertions !== "number") return invalidInput
-      const captures = items(record.captureIDs, 1024)
-      if (!captures || captures.some((id) => typeof id !== "string")) return invalidInput
-      for (const key of ["id", "profile", "platform", "expectation", "runID", "buildID", "status"]) {
-        if (typeof record[key] !== "string") return invalidInput
-      }
-      evidence.push({ ...record, captureIDs: captures } as unknown as CaseEvidence)
-    }
-    return assessValidatedCases(required, evidence, run as unknown as RunIdentity)
-  } catch {
-    // Includes proxy reflection traps; never invoke getters or format their causes.
-    return invalidInput
-  }
-}
-
-function assessValidatedCases(required: readonly RequiredCase[], evidence: readonly CaseEvidence[], run: RunIdentity): Assessment {
-  const codes = new Set<FailureCode>()
-  const fail = (code: FailureCode) => { codes.add(code) }
-  const finish = (): Assessment => ({ satisfied: codes.size === 0, failures: [...codes].map((code) => ({ code })) })
-
-  if (required.length === 0 || required.length > 4096 || evidence.length > 4096) {
-    fail("INVALID_SELECTION")
-    return finish()
-  }
-  if (!safeID(run.runID) || !safeID(run.buildID) || !safeID(run.platform) || !profile(run.profile)) {
-    fail("INVALID_RUN")
-    return finish()
-  }
-
-  const selected = new Set<string>()
-  for (const item of required) {
-    if (!caseID(item.id) || selected.has(item.id) || item.profile !== run.profile ||
-        item.platform !== run.platform || !expectation(item.expectation)) fail("INVALID_REQUIREMENT")
-    selected.add(item.id)
-    if (item.expectation === "expected-gap" && run.profile !== "active-only") fail("GAP_NOT_ALLOWED")
-  }
-  if (codes.size > 0) return finish()
-
-  const grouped = new Map<string, CaseEvidence[]>()
-  for (const record of evidence) {
-    if (!caseID(record.id) || !selected.has(record.id)) {
-      fail("INVALID_EVIDENCE")
-      continue
-    }
-    const records = grouped.get(record.id) ?? []
-    records.push(record)
-    grouped.set(record.id, records)
-  }
-
-  for (const item of required) {
-    const records = grouped.get(item.id) ?? []
-    if (records.length !== 1) {
-      fail("EVIDENCE_COUNT")
-      continue
-    }
-    const record = records[0]!
-    if (record.runID !== run.runID || record.buildID !== run.buildID || record.profile !== run.profile ||
-        record.platform !== run.platform || record.expectation !== item.expectation) fail("EVIDENCE_MISMATCH")
-    const needed = item.expectation === "expected-gap" ? "observed-gap" : "passed"
-    if (record.status !== needed) fail("CASE_NOT_PASSED")
-    if (!Number.isSafeInteger(record.assertions) || record.assertions < 1 || record.assertions > 1_000_000 ||
-        record.captureIDs.length === 0 || record.captureIDs.length > 1024 ||
-        record.captureIDs.some((id) => !safeID(id))) fail("MISSING_ASSERTIONS_OR_CAPTURES")
-  }
-  return finish()
-}

package/tests/support/recording-endpoint.ts

@@ -1,242 +0,0 @@
-import { createServer } from "node:http"
-import type { Socket } from "node:net"
-
-export interface ScriptedResponse {
-  status: number
-  body: string
-  contentType?: "application/json" | "text/event-stream" | "text/plain"
-}
-
-/** Selects a scripted response index from the captured request; body must not be mutated. */
-export interface ResponseResolver {
-  (request: { readonly sequence: number; readonly method: string; readonly target: string; readonly headers: Record<string, string>; readonly body: Buffer }): number
-}
-
-interface Options {
-  responses: readonly ScriptedResponse[]
-  resolve?: ResponseResolver
-  maxRequests?: number
-  maxBodyBytes?: number
-  timeoutMs?: number
-}
-
-interface Capture {
-  method: string
-  target: string
-  /** Lowercase header names with joined values; private capture data like bodies. */
-  headers: Record<string, string>
-  body: Buffer
-}
-
-export interface RecordingEndpoint {
-  readonly url: string
-  /** Synthetic private captures only: never include these in assertions/log output. */
-  captures(): Capture[]
-  /** parsed HTTP requests; malformed connections are counted separately. */
-  counts(): { attempted: number; rejected: number; malformed: number; connections: number; openConnections: number; pendingRequests: number }
-  close(): Promise<void>
-}
-
-const bounded = (value: number, maximum: number) => Number.isSafeInteger(value) && value > 0 && value <= maximum
-
-function dataRecord(value: unknown, keys: readonly string[]): Record<string, unknown> {
-  if (typeof value !== "object" || value === null || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype) throw 0
-  const ownKeys = Reflect.ownKeys(value)
-  if (ownKeys.length > keys.length) throw 0
-  const result: Record<string, unknown> = Object.create(null)
-  for (const key of ownKeys) {
-    if (typeof key !== "string" || !keys.includes(key)) throw 0
-    const descriptor = Object.getOwnPropertyDescriptor(value, key)
-    if (!descriptor || !("value" in descriptor)) throw 0
-    result[key] = descriptor.value
-  }
-  return result
-}
-
-function parseOptions(input: unknown): Options {
-  try {
-    const options = dataRecord(input, ["responses", "resolve", "maxRequests", "maxBodyBytes", "timeoutMs"])
-    if (!Array.isArray(options.responses) || options.responses.length > 64) throw 0
-    if (options.resolve !== undefined && typeof options.resolve !== "function") throw 0
-    for (const key of ["maxRequests", "maxBodyBytes", "timeoutMs"]) {
-      if (options[key] !== undefined && typeof options[key] !== "number") throw 0
-    }
-    const responses: ScriptedResponse[] = []
-    for (let index = 0; index < options.responses.length; index++) {
-      const descriptor = Object.getOwnPropertyDescriptor(options.responses, String(index))
-      if (!descriptor || !("value" in descriptor)) throw 0
-      const response = dataRecord(descriptor.value, ["status", "body", "contentType"])
-      if (typeof response.status !== "number" || typeof response.body !== "string" ||
-          (response.contentType !== undefined && typeof response.contentType !== "string")) throw 0
-      responses.push(response as unknown as ScriptedResponse)
-    }
-    return { ...options, responses } as unknown as Options
-  } catch { throw new Error("FIXTURE_INVALID_OPTIONS") }
-}
-
-/** Test-only loopback HTTP recorder, not a model implementation or TLS connector. */
-export async function startRecordingEndpoint(input: unknown): Promise<RecordingEndpoint> {
-  const options = parseOptions(input)
-  const maxRequests = options.maxRequests ?? 16
-  const maxBodyBytes = options.maxBodyBytes ?? 65536
-  const timeoutMs = options.timeoutMs ?? 5000
-  if (!bounded(maxRequests, 64) || !bounded(maxBodyBytes, 1_048_576) || !bounded(timeoutMs, 30_000) ||
-      options.responses.length > maxRequests || options.responses.some((response) =>
-        !Number.isInteger(response.status) || response.status < 200 || response.status > 599 ||
-        Buffer.byteLength(response.body) > 1_048_576 ||
-        (response.contentType !== undefined && !["application/json", "text/event-stream", "text/plain"].includes(response.contentType))) ||
-      options.responses.reduce((total, response) => total + Buffer.byteLength(response.body), 0) > 2_097_152) {
-    throw new Error("FIXTURE_INVALID_OPTIONS")
-  }
-  const responses = options.responses.map((response) => ({ ...response }))
-  const captures: Capture[] = []
-  const pending = new Set<Buffer[]>()
-  const sockets = new Set<Socket>()
-  const deadlines = new Set<ReturnType<typeof setTimeout>>()
-  let attempted = 0
-  let rejected = 0
-  let malformed = 0
-  let connections = 0
-  let closing = false
-  let closePromise: Promise<void> | undefined
-  let checkClosed = () => {}
-  const server = createServer({ maxHeaderSize: 8192, requestTimeout: timeoutMs, headersTimeout: timeoutMs }, (request, response) => {
-    const sequence = attempted++
-    const resolver = options.resolve
-    if (closing || sequence >= maxRequests || (resolver === undefined && !responses[sequence])) {
-      rejected++
-      response.writeHead(503, { connection: "close" })
-      response.end("FIXTURE_UNSCRIPTED_REQUEST")
-      return
-    }
-
-    const chunks: Buffer[] = []
-    pending.add(chunks)
-    let bytes = 0
-    let settled = false
-    const discard = () => {
-      for (const chunk of chunks) chunk.fill(0)
-      chunks.length = 0
-      pending.delete(chunks)
-      checkClosed()
-    }
-    const fail = (status: number) => {
-      if (settled) return
-      settled = true
-      rejected++
-      clearTimeout(deadline)
-      deadlines.delete(deadline)
-      discard()
-      response.writeHead(status, { connection: "close" })
-      response.end("FIXTURE_REQUEST_REJECTED")
-    }
-    const deadline = setTimeout(() => fail(408), timeoutMs)
-    deadlines.add(deadline)
-    deadline.unref()
-    request.on("data", (chunk: Buffer) => {
-      if (settled || closing) return
-      bytes += chunk.length
-      if (bytes > maxBodyBytes) {
-        fail(413)
-        return
-      }
-      chunks.push(Buffer.from(chunk))
-    })
-    request.on("end", () => {
-      if (settled || closing) return
-      settled = true
-      clearTimeout(deadline)
-      deadlines.delete(deadline)
-      const body = Buffer.concat(chunks, bytes)
-      discard()
-      const headers: Record<string, string> = {}
-      for (const [name, value] of Object.entries(request.headers)) {
-        if (value === undefined) continue
-        headers[name] = Array.isArray(value) ? value.join(", ") : value
-      }
-      captures.push({ method: request.method ?? "", target: request.url ?? "", headers, body })
-      let chosen = sequence
-      if (resolver !== undefined) {
-        try {
-          chosen = resolver({ sequence, method: request.method ?? "", target: request.url ?? "", headers, body })
-        } catch {
-          chosen = -1
-        }
-        if (!Number.isSafeInteger(chosen)) chosen = -1
-      }
-      const scripted = responses[chosen]
-      if (!scripted) {
-        rejected++
-        response.writeHead(503, { connection: "close" })
-        response.end("FIXTURE_UNSCRIPTED_REQUEST")
-        return
-      }
-      response.writeHead(scripted.status, { "content-type": scripted.contentType ?? "text/plain", connection: "close" })
-      response.end(scripted.body)
-    })
-    request.on("error", () => fail(400))
-    request.on("close", () => {
-      clearTimeout(deadline)
-      deadlines.delete(deadline)
-      if (!settled) { settled = true; rejected++ }
-      discard()
-    })
-  })
-  server.maxConnections = maxRequests
-  server.setTimeout(timeoutMs, (socket) => socket.destroy())
-  server.on("clientError", (_error, socket) => { malformed++; socket.destroy() })
-  server.on("connection", (socket) => {
-    connections++
-    sockets.add(socket)
-    socket.once("close", () => { sockets.delete(socket); checkClosed() })
-    if (closing) socket.destroy()
-  })
-
-  await new Promise<void>((resolve, reject) => {
-    server.once("error", () => reject(new Error("FIXTURE_LISTEN_FAILED")))
-    server.listen(0, "127.0.0.1", () => resolve())
-  })
-  const address = server.address()
-  if (!address || typeof address === "string") {
-    server.closeAllConnections()
-    server.close()
-    throw new Error("FIXTURE_LISTEN_FAILED")
-  }
-  return {
-    url: `http://127.0.0.1:${address.port}`,
-    captures: () => captures.map((capture) => ({ ...capture, headers: { ...capture.headers }, body: Buffer.from(capture.body) })),
-    counts: () => ({ attempted, rejected, malformed, connections, openConnections: sockets.size, pendingRequests: pending.size }),
-    close: () => {
-      if (closePromise) return closePromise
-      closing = true
-      closePromise = new Promise<void>((resolve, reject) => {
-        let serverClosed = false
-        const deadline = setTimeout(() => reject(new Error("FIXTURE_CLOSE_FAILED")), 5000)
-        const discard = () => {
-          for (const timer of deadlines) clearTimeout(timer)
-          deadlines.clear()
-          for (const capture of captures) capture.body.fill(0)
-          captures.length = 0
-          for (const chunks of pending) {
-            for (const chunk of chunks) chunk.fill(0)
-            chunks.length = 0
-          }
-          pending.clear()
-        }
-        checkClosed = () => {
-          if (!serverClosed || sockets.size > 0) return
-          discard()
-          clearTimeout(deadline)
-          resolve()
-        }
-        discard()
-        server.close(() => {
-          serverClosed = true
-          checkClosed()
-        })
-        for (const socket of sockets) socket.destroy()
-      })
-      return closePromise
-    },
-  }
-}

package/tests/support/run-directory.ts

@@ -1,179 +0,0 @@
-import { execFile } from "node:child_process"
-import { constants } from "node:fs"
-import { chmod, lstat, mkdir, open, readFile, readdir, rm, rmdir } from "node:fs/promises"
-import { promisify } from "node:util"
-import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path"
-
-const execFileAsync = promisify(execFile)
-const MARKER_NAME = ".opencode-secrets-obfuscation-owned"
-const MARKER = "opencode-secrets-obfuscation run-directory v1\n"
-
-export interface RunDirectory {
-  readonly path: string
-  readonly marker: string
-  cleanup(): Promise<void>
-  verifyPrivateChild(path: string): Promise<void>
-}
-
-function fail(code: string): Error { return new Error(code) }
-
-async function validateAncestors(path: string): Promise<string[]> {
-  let current = resolve(path)
-  const missing: string[] = []
-  for (;;) {
-    const stat = await lstat(current).catch(() => undefined)
-    if (stat) {
-      if (!stat.isDirectory() || stat.isSymbolicLink()) throw fail("RUN_DIRECTORY_UNSAFE_ROOT")
-      if (process.platform !== "win32") {
-        const uid = typeof process.getuid === "function" ? process.getuid() : undefined
-        const mode = stat.mode & 0o7777
-        // Root-owned ancestors are normal on Linux. Ownership of the newly
-        // created run directory is checked separately and must be current UID.
-        if (uid !== undefined && stat.uid !== uid && stat.uid !== 0) throw fail("RUN_DIRECTORY_UNSAFE_ROOT")
-        if ((mode & 0o022) !== 0 && (mode & 0o1000) === 0) throw fail("RUN_DIRECTORY_UNSAFE_ROOT")
-      }
-    } else {
-      missing.push(current)
-    }
-    const parent = dirname(current)
-    if (parent === current) return missing.reverse()
-    current = parent
-  }
-}
-
-function windowsTool(name: string): string {
-  const systemRoot = process.env.SystemRoot
-  if (typeof systemRoot !== "string" || !isAbsolute(systemRoot)) throw fail("RUN_DIRECTORY_PERMISSION_FAILED")
-  return join(systemRoot, "System32", name)
-}
-
-// Windows PowerShell 5.1 must not inherit PowerShell 7's PSModulePath: it can
-// contain a WindowsApps path with a PS7 Microsoft.PowerShell.Security copy that
-// shadows the system module, making Get-Acl/Set-Acl autoload fail
-// (CouldNotAutoloadMatchingModule). Strip it so powershell.exe computes its own
-// canonical module path.
-function windowsPowerShellEnv(): NodeJS.ProcessEnv {
-  const env: NodeJS.ProcessEnv = { ...process.env }
-  delete env.PSModulePath
-  delete env.psmodulepath
-  return env
-}
-
-async function windowsSid(): Promise<string> {
-  try {
-    const result = await execFileAsync(windowsTool("whoami.exe"), ["/user"], { windowsHide: true, maxBuffer: 4096 })
-    const sid = result.stdout.match(/S-\d-(?:\d+-){1,14}\d+/i)?.[0]
-    if (!sid) throw new Error("missing sid")
-    return sid
-  } catch {
-    throw fail("RUN_DIRECTORY_PERMISSION_FAILED")
-  }
-}
-
-async function windowsRules(path: string): Promise<Array<{ Id: string; Type: string; Rights: string; Inherited: boolean }>> {
-  try {
-    const encodedPath = Buffer.from(path, "utf8").toString("base64")
-    const script = `$p=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encodedPath}')); $a=Get-Acl -LiteralPath $p; $r=@($a.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier]) | ForEach-Object { [pscustomobject]@{Id=$_.IdentityReference.Value;Type=$_.AccessControlType.ToString();Rights=$_.FileSystemRights.ToString();Inherited=$_.IsInherited} }); [pscustomobject]@{Rules=$r}|ConvertTo-Json -Compress`
-    const command = Buffer.from(script, "utf16le").toString("base64")
-    const result = await execFileAsync(windowsTool("WindowsPowerShell\\v1.0\\powershell.exe"), ["-NoProfile", "-NonInteractive", "-EncodedCommand", command], { windowsHide: true, maxBuffer: 16384, env: windowsPowerShellEnv() })
-    const parsed = JSON.parse(result.stdout) as { Rules?: Array<{ Id: string; Type: string; Rights: string; Inherited: boolean }> | { Id: string; Type: string; Rights: string; Inherited: boolean } }
-    if (Array.isArray(parsed.Rules)) return parsed.Rules
-    return parsed.Rules ? [parsed.Rules] : []
-  } catch {
-    throw fail("RUN_DIRECTORY_PERMISSION_FAILED")
-  }
-}
-
-async function verifyPrivate(path: string, sid?: string, root = false): Promise<void> {
-  const stat = await lstat(path).catch(() => undefined)
-  if (!stat?.isDirectory() || stat.isSymbolicLink()) throw fail("RUN_DIRECTORY_PERMISSION_FAILED")
-  if (process.platform !== "win32") {
-    const uid = typeof process.getuid === "function" ? process.getuid() : undefined
-    if ((stat.mode & 0o777) !== 0o700 || (uid !== undefined && !root && stat.uid !== uid)) throw fail("RUN_DIRECTORY_PERMISSION_FAILED")
-    return
-  }
-  const rules = await windowsRules(path)
-  if (!sid || rules.length !== 1 || rules[0]?.Id.toUpperCase() !== sid.toUpperCase() || rules[0]?.Type !== "Allow" || rules[0]?.Rights !== "FullControl" || (root && rules[0]?.Inherited)) {
-    throw fail("RUN_DIRECTORY_PERMISSION_FAILED")
-  }
-}
-
-async function makePrivateNew(path: string, sid?: string): Promise<void> {
-  if (process.platform !== "win32") {
-    try {
-      await chmod(path, 0o700)
-      await verifyPrivate(path)
-    } catch { throw fail("RUN_DIRECTORY_PERMISSION_FAILED") }
-    return
-  }
-  const currentSid = sid ?? await windowsSid()
-  try {
-    const encodedPath = Buffer.from(path, "utf8").toString("base64")
-    const encodedSid = Buffer.from(currentSid, "utf8").toString("base64")
-    const script = `$p=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encodedPath}')); $s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encodedSid}')); $a=Get-Acl -LiteralPath $p; $a.SetAccessRuleProtection($true,$false); foreach($x in @($a.Access)){ [void]$a.RemoveAccessRule($x) }; $id=New-Object System.Security.Principal.SecurityIdentifier($s); $f=[System.Security.AccessControl.FileSystemAccessRule]::new($id,[System.Security.AccessControl.FileSystemRights]::FullControl,([System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [System.Security.AccessControl.InheritanceFlags]::ObjectInherit),[System.Security.AccessControl.PropagationFlags]::None,[System.Security.AccessControl.AccessControlType]::Allow); [void]$a.AddAccessRule($f); Set-Acl -LiteralPath $p -AclObject $a`
-    const command = Buffer.from(script, "utf16le").toString("base64")
-    await execFileAsync(windowsTool("WindowsPowerShell\\v1.0\\powershell.exe"), ["-NoProfile", "-NonInteractive", "-EncodedCommand", command], { windowsHide: true, maxBuffer: 16384, env: windowsPowerShellEnv() })
-    await verifyPrivate(path, currentSid)
-  } catch { throw fail("RUN_DIRECTORY_PERMISSION_FAILED") }
-}
-
-async function assertOwned(path: string, marker: string): Promise<void> {
-  const stat = await lstat(path).catch(() => undefined)
-  if (!stat?.isDirectory() || stat.isSymbolicLink()) throw fail("RUN_DIRECTORY_NOT_OWNED")
-  const markerStat = await lstat(marker).catch(() => undefined)
-  if (!markerStat?.isFile() || markerStat.isSymbolicLink() || markerStat.nlink !== 1) throw fail("RUN_DIRECTORY_NOT_OWNED")
-  if ((await readFile(marker, "utf8")) !== MARKER) throw fail("RUN_DIRECTORY_NOT_OWNED")
-}
-
-async function cleanupEmptyOwned(path: string, marker: string): Promise<void> {
-  await assertOwned(path, marker)
-  const entries = await readdir(path)
-  if (entries.length !== 1 || entries[0] !== MARKER_NAME) throw fail("RUN_DIRECTORY_CONTENT_UNSAFE")
-  await rm(marker)
-  await rmdir(path)
-}
-
-export async function createRunDirectory(rootInput: string): Promise<RunDirectory> {
-  if (!isAbsolute(rootInput)) throw fail("RUN_DIRECTORY_ROOT_NOT_ABSOLUTE")
-  const root = resolve(rootInput)
-  const missing = await validateAncestors(root)
-  const existing = await lstat(root).catch(() => undefined)
-  const sid = process.platform === "win32" ? await windowsSid() : undefined
-  for (const directory of missing) {
-    await mkdir(directory, { mode: 0o700 }).catch(() => { throw fail("RUN_DIRECTORY_CREATE_FAILED") })
-    await makePrivateNew(directory, sid)
-  }
-  if (existing) {
-    await verifyPrivate(root, sid, true)
-  }
-  let path: string | undefined
-  for (let attempt = 0; attempt < 10 && !path; attempt += 1) {
-    const candidate = join(root, `run-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`)
-    try { await mkdir(candidate, { mode: 0o700 }); path = candidate } catch (error) {
-      if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw fail("RUN_DIRECTORY_CREATE_FAILED")
-    }
-  }
-  if (!path) throw fail("RUN_DIRECTORY_CREATE_FAILED")
-  const marker = join(path, MARKER_NAME)
-  try {
-    await makePrivateNew(path, sid)
-    const handle = await open(marker, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600)
-    await handle.writeFile(MARKER, "utf8")
-    await handle.close()
-    await assertOwned(path, marker)
-  } catch {
-    await rmdir(path).catch(() => undefined)
-    throw fail("RUN_DIRECTORY_PERMISSION_FAILED")
-  }
-  return {
-    path,
-    marker,
-    cleanup: () => cleanupEmptyOwned(path!, marker),
-    async verifyPrivateChild(childPath: string) {
-      const child = resolve(childPath)
-      const childRelative = relative(path!, child)
-      if (isAbsolute(childRelative) || childRelative === ".." || childRelative.startsWith(`..${sep}`)) throw fail("RUN_DIRECTORY_UNSAFE_ROOT")
-      await verifyPrivate(child, sid)
-    },
-  }
-}