opencode-secrets-obfuscation 0.1.0 → 0.1.2

package/tests/README.md

@@ -1,26 +0,0 @@
-# Tests before implementation
-
-Use Node 24's built-in test runner and native erasable TypeScript support. No
-transpiling runner or plugin runtime dependency is required for this scaffold.
-`tsc` checks types separately; Node's TypeScript support does not typecheck.
-
-| Suite | Purpose | Current state |
-| --- | --- | --- |
-| `scaffold/` | Verify repository/test inventory and honest status reporting | Executable, not security tests |
-| `unit/` | Test-helper behavior now; product data/policy/interval algorithms later | Executable helper tests plus product TODOs |
-| `contract/` | Host-shape, lifecycle and serialization contracts | Named TODOs |
-| `integration/` | Source/HTTP/quota components against controlled OS/services | Named TODOs |
-| `smoke/` | Spawn an actual pinned OpenCode service and exercise its API | Case inventory; no harness yet |
-| `support/` | Safe evidence bookkeeping, loopback recorder and fixture process/directory helpers | Partial P0 implementation; not a qualified host harness |
-| `fixtures/` | Synthetic inputs, probe plugins and controlled services | Placeholders |
-
-`npm test` can pass with TODOs. That means **the implemented test helpers pass**, not that any
-credential protection works. `npm run test:smoke` and `npm run test:qualification`
-exit nonzero until a real harness exists; `npm run test:smoke:list` lists planned
-cases without spawning anything.
-
-Do not satisfy a TODO by changing it into a passing assertion about a stub. First
-write the actual failing behavior test, then implement the smallest component.
-Independent oracles must not import the implementation they are checking.
-
-See [test strategy and first work sequence](../docs/testing.md).

package/tests/contract/plugin-v2.test.ts

@@ -1,29 +0,0 @@
-import { test } from "node:test"
-import assert from "node:assert/strict"
-import { Effect, type Scope } from "effect"
-import type { Context } from "@opencode/plugin/effect/plugin"
-import plugin from "../../src/opencode/v2/index.ts"
-
-test("exports the native V2 Effect plugin identity", () => {
-  assert.equal(plugin.id, "opencode-secrets-obfuscation")
-  assert.equal(typeof plugin.effect, "function")
-})
-
-test("does not expose a Promise setup entrypoint", () => {
-  assert.equal("setup" in plugin, false)
-})
-
-test("invalid options install hooks but expose no plugin-owned tools", async () => {
-  let transformCalls = 0
-  const ctx = {
-    options: {},
-    location: { directory: "C:/synthetic" },
-    session: { hook: () => Effect.void },
-    tool: {
-      hook: () => Effect.void,
-      transform: () => Effect.sync(() => { transformCalls += 1 }),
-    },
-  } as unknown as Context
-  await Effect.runPromise(Effect.scoped(plugin.effect(ctx) as unknown as Effect.Effect<void, never, Scope.Scope>))
-  assert.equal(transformCalls, 0)
-})

package/tests/fixtures/README.md

@@ -1,9 +0,0 @@
-# Synthetic fixtures only
-
-Generate dotenv files, credentials, TLS certificates and captures per test run in
-a private ignored directory. Do not commit real `.env` files or reusable private
-keys. Inline short analytical values such as `abc`/`bcdef` are algorithm inputs,
-not valid credential admission examples.
-
-Fixtures must not modify global OpenCode config or automatically install a plugin
-in this repository's `.opencode` directory.

package/tests/fixtures/job-child.mjs

@@ -1,18 +0,0 @@
-import { appendFileSync, writeFileSync } from "node:fs";
-import { spawn } from "node:child_process";
-import process from "node:process";
-
-const pidFile = process.env.JOB_TEST_PID_FILE;
-const grandchildFile = process.env.JOB_TEST_GRANDCHILD_FILE;
-if (!pidFile || !grandchildFile) throw new Error("fixture paths are required");
-if (process.env.JOB_TEST_ARG_FILE) writeFileSync(process.env.JOB_TEST_ARG_FILE, JSON.stringify(process.argv.slice(2)));
-
-writeFileSync(pidFile, String(process.pid));
-const grandchild = spawn(process.execPath, ["-e", "setInterval(() => {}, 1000)"], {
-  stdio: "ignore",
-  windowsHide: true,
-});
-writeFileSync(grandchildFile, String(grandchild.pid));
-appendFileSync(process.env.JOB_TEST_OUTPUT_FILE ?? pidFile, "fixture-started\n");
-if (process.env.JOB_TEST_OVERFLOW === "1") setInterval(() => process.stdout.write("x".repeat(32768)), 1);
-setInterval(() => {}, 1000);

package/tests/fixtures/plugins/README.md

@@ -1,8 +0,0 @@
-# Real-host probe plugin placeholders
-
-P0 will add minimal native V2 **test-only** probes for hook ordering, failed
-activation/fallback, result normalization, progress and request abortion.
-
-These probes are not the product plugin and must never claim credential
-protection. Load only from an isolated smoke sandbox using an explicit fixture
-config. No probe implementation exists yet.

package/tests/fixtures/process-child.mjs

@@ -1,20 +0,0 @@
-const [mode, value] = process.argv.slice(2)
-
-if (mode === "env") {
-  process.stdout.write(`${process.env[value] ?? ""}\n`)
-} else if (mode === "stdout") {
-  process.stdout.write("x".repeat(Number(value)))
-} else if (mode === "stderr") {
-  process.stderr.write("x".repeat(Number(value)))
-} else if (mode === "sleep") {
-  await new Promise(() => {})
-} else if (mode === "ignore-term") {
-  process.on("SIGTERM", () => {})
-  await new Promise(() => {})
-} else if (mode === "marker") {
-  const { writeFile } = await import("node:fs/promises")
-  await writeFile(value, "spawned\n")
-  await new Promise(() => {})
-} else {
-  process.exitCode = 64
-}

package/tests/fixtures/services/README.md

@@ -1,10 +0,0 @@
-# Controlled service placeholders
-
-- Recording fake model provider exercised through a real OpenCode host.
-- Controlled HTTPS endpoint/test connector implementing the reviewed GitHub
-  access-check contract, including malicious response bodies and errors.
-- Real socket/DNS/TLS tests separate from connector fakes.
-
-No live model or GitHub credential is needed. Reject production network egress in
-the test envelope. A future optional live-service suite must be separately opt-in
-and must never reuse the user's credentials by discovery.

package/tests/integration/components.test.ts

@@ -1,5 +0,0 @@
-import { test } from "node:test"
-
-test.todo("R7: slow bodies, deadlines, expansion and concurrent reservations")
-test.todo("R8: Linux/ext4 source replacement, ACL, ancestor and link behavior")
-test.todo("R8: Windows/NTFS source replacement, inherited ACL and reparse behavior")

package/tests/integration/transparent-runtime.test.ts

@@ -1,97 +0,0 @@
-import assert from "node:assert/strict"
-import { test } from "node:test"
-import * as fs from "node:fs/promises"
-import * as os from "node:os"
-import * as path from "node:path"
-import { Effect } from "effect"
-import { parseOptions } from "../../src/config/options.ts"
-import { realRuntimeFactory } from "../../src/opencode/v2/runtime.ts"
-
-const SECRET = "HOOK_CANARY_7f3a9c2e"
-const HANDLE = /secret-[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/
-const limits = {
-  sourceBytes: 65_536, totalSourceBytes: 131_072, sourceCount: 2, secretCount: 50,
-  secretBytes: 4_096, indexBytes: 1_048_576, inputBytes: 32_768, outputBytes: 65_536,
-  traversalDepth: 8, traversalNodes: 1_000, activeSessions: 4, handlesPerSession: 64,
-  activeCalls: 2, workingBytes: 1_048_576, callTimeoutMs: 5_000, idleTimeoutMs: 1_000,
-}
-
-async function runtimeFixture(t: { after(fn: () => void): void }) {
-  const directory = await fs.mkdtemp(path.join(os.tmpdir(), "transparent-runtime-"))
-  await fs.writeFile(path.join(directory, ".env"), `TOKEN=${SECRET}\n`)
-  t.after(() => { void fs.rm(directory, { recursive: true, force: true }) })
-  const options = parseOptions({
-    version: 1,
-    sources: [{ id: "fixture", type: "file", format: "dotenv", path: ".env", required: true, keys: ["TOKEN"] }],
-    limits,
-  })
-  return Effect.runPromise(realRuntimeFactory(options, { directory } as never))
-}
-
-const text = (value: unknown): string => JSON.stringify(value)
-
-test("transparent runtime substitutes session surfaces and provider request/response bodies", async (t) => {
-  const runtime = await runtimeFixture(t)
-  const prompt = { text: `use ${SECRET}`, files: [], metadata: SECRET }
-  await Effect.runPromise(runtime.session.prompt({ sessionID: "ses_hooks", prompt, metadata: { value: SECRET } } as never))
-  assert.ok(!text(prompt).includes(SECRET))
-  assert.match(text(prompt), HANDLE)
-
-  const context = { sessionID: "ses_hooks", system: SECRET, messages: [{ content: SECRET }], options: { note: SECRET }, tools: [{ description: SECRET }] }
-  await Effect.runPromise(runtime.session.context(context as never))
-  assert.ok(!text(context).includes(SECRET))
-
-  const compaction = { sessionID: "ses_hooks", system: SECRET, messages: [], options: {}, result: { summary: SECRET } }
-  await Effect.runPromise(runtime.session.compaction(compaction as never))
-  assert.ok(!text(compaction).includes(SECRET))
-
-  const generated = { sessionID: "ses_hooks", system: SECRET, messages: [], options: {} }
-  await Effect.runPromise(runtime.session.generate(generated as never))
-  assert.ok(!text(generated).includes(SECRET))
-
-  const title = { sessionID: "ses_hooks", system: SECRET, messages: [], options: {}, result: SECRET }
-  await Effect.runPromise(runtime.session.title(title as never))
-  assert.ok(!text(title).includes(SECRET))
-
-  const model = { sessionID: "ses_hooks", headers: { "x-secret": SECRET }, baseURL: `https://provider.invalid/${SECRET}` }
-  await Effect.runPromise(runtime.session.modelRequest(model as never))
-  assert.ok(!text(model).includes(SECRET))
-
-  const requestEvent = { sessionID: "ses_hooks", request: new Request("https://provider.invalid", { method: "POST", body: JSON.stringify({ value: SECRET }) }) }
-  await Effect.runPromise(runtime.session.httpRequest(requestEvent as never))
-  const requestBody = await requestEvent.request.text()
-  assert.ok(!requestBody.includes(SECRET))
-  assert.match(requestBody, HANDLE)
-
-  const structuredEvent = {
-    sessionID: "ses_hooks",
-    request: new Request("https://provider.invalid", {
-      method: "POST",
-      body: JSON.stringify({ [SECRET]: SECRET, scalar: SECRET, parts: [{ text: SECRET }, { text: "suffix" }] }),
-    }),
-  }
-  await Effect.runPromise(runtime.session.httpRequest(structuredEvent as never))
-  const structuredBody = await structuredEvent.request.text()
-  assert.ok(!structuredBody.includes(SECRET), "structured values and keys must not retain the raw source")
-  assert.match(structuredBody, HANDLE)
-
-  const responseEvent = { sessionID: "ses_hooks", response: new Response(JSON.stringify({ value: SECRET }), { headers: { "content-type": "application/json" } }) }
-  await Effect.runPromise(runtime.session.httpResponse(responseEvent as never))
-  const responseBody = await responseEvent.response.text()
-  assert.ok(!responseBody.includes(SECRET))
-  assert.match(responseBody, HANDLE)
-})
-
-test("transparent runtime rejects raw source reads and sanitizes tool failures/results", async (t) => {
-  const runtime = await runtimeFixture(t)
-  const denied = await Effect.runPromiseExit(runtime.tool.before({ tool: "read", input: { filePath: ".env" } } as never))
-  assert.equal(denied._tag, "Failure")
-
-  const completed = { tool: "echo", status: "completed", result: { output: SECRET } }
-  await Effect.runPromise(runtime.tool.after(completed as never))
-  assert.ok(!text(completed).includes(SECRET))
-
-  const failed = { tool: "echo", status: "error", error: { message: SECRET } }
-  await Effect.runPromise(runtime.tool.after(failed as never))
-  assert.ok(!text(failed).includes(SECRET))
-})

package/tests/integration/windows-job.test.ts

@@ -1,71 +0,0 @@
-import { strict as assert } from "node:assert";
-import { copyFile, mkdtemp, readFile, stat, writeFile } from "node:fs/promises";
-import { execFile, spawn } from "node:child_process";
-import { promisify } from "node:util";
-import { join } from "node:path";
-import process from "node:process";
-import { test } from "node:test";
-import { createHash } from "node:crypto";
-
-const exec = promisify(execFile);
-const root = process.cwd();
-const supervisor = join(root, "tests", "p0-host", "windows-job.ps1");
-const fixture = join(root, "tests", "fixtures", "job-child.mjs");
-const powershell = join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
-async function sha256(path: string): Promise<string> { return createHash("sha256").update(await readFile(path)).digest("hex"); }
-async function privateCmd(rootDir: string): Promise<string> { const p = join(rootDir, "cmd-fixture.exe"); await copyFile(join(process.env.SystemRoot ?? "C:\\Windows", "System32", "cmd.exe"), p); return p; }
-
-async function ownedRoot(): Promise<string> {
-  const d = await mkdtemp(join(process.env.TEMP ?? "C:\\Windows\\Temp", "p0-job-"));
-  await writeFile(join(d, ".owned-p0-job"), "p0-test-owner\n", { flag: "wx" });
-  return d;
-}
-async function pidState(pid: number): Promise<boolean> {
-  if (!Number.isSafeInteger(pid) || pid < 1) throw new Error("invalid fixture PID");
-  const tasklist = join(process.env.SystemRoot ?? "C:\\Windows", "System32", "tasklist.exe");
-  const { stdout } = await exec(tasklist, ["/FI", `PID eq ${pid}`, "/FO", "CSV", "/NH"]);
-  if (stdout.includes("No tasks are running")) return false;
-  if (!stdout.includes(`"${pid}"`)) throw new Error(`PID oracle returned ambiguous state for ${pid}`);
-  return true;
-}
-async function run(rootDir: string, extra: Record<string, string> = {}, args = ["space arg", "C:\\path\\with\\slashes\\"]): Promise<{ report: any; rootDir: string; platformBlocked: boolean }> {
-  const envRoot = join(rootDir, "child-env");
-  const env = { SystemRoot: process.env.SystemRoot ?? "C:\\Windows", SystemDrive: process.env.SystemDrive ?? "C:", ComSpec: join(process.env.SystemRoot ?? "C:\\Windows", "System32", "cmd.exe"),
-    TEMP: envRoot, TMP: envRoot, HOME: envRoot, USERPROFILE: envRoot, LOCALAPPDATA: join(envRoot, "local"), APPDATA: join(envRoot, "roaming"),
-    JOB_TEST_PID_FILE: join(rootDir, "parent.pid"), JOB_TEST_GRANDCHILD_FILE: join(rootDir, "grandchild.pid"), JOB_TEST_OUTPUT_FILE: join(rootDir, "fixture.log"), JOB_TEST_ARG_FILE: join(rootDir, "args.json"), ...extra };
-  const request = { executable: process.execPath, expectedSHA256: await sha256(process.execPath), arguments: [fixture, ...args], environment: env, cwd: rootDir, stdout: join(rootDir, "stdout.log"), stderr: join(rootDir, "stderr.log"), pidFile: join(rootDir, "child.pid"), timeoutMs: 800, memoryLimitMb: 512, forceAssignmentFailure: false };
-  await writeFile(join(rootDir, "request.json"), JSON.stringify(request), { flag: "wx" });
-  try {
-    const { stdout } = await exec(powershell, ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", supervisor, "-RequestPath", join(rootDir, "request.json")], { windowsHide: true, maxBuffer: 1024 * 1024 });
-    return { report: JSON.parse(stdout.trim()), rootDir, platformBlocked: false };
-  } catch (error) {
-    const failure = error as { code?: string | number; stderr?: string };
-    const nonzero = failure.code !== undefined && failure.code !== 0 && failure.code !== "0";
-    if (!nonzero || !(failure.stderr ?? "").includes("ATOMIC_JOB_LIST_UNSUPPORTED")) throw error;
-    assert.equal(await stat(join(rootDir, "child.pid")).catch(() => null), null, "platform block must occur before child creation");
-    return { report: { platformBlocked: true }, rootDir, platformBlocked: true };
-  }
-}
-
-test("P0-JOB atomic containment cases", { skip: process.platform !== "win32" || process.arch !== "x64" }, async (t) => {
-  await t.test("normal child, exact argv, and descendant timeout", async () => {
-    const d = await ownedRoot();
-    try { const { report } = await run(d); assert.equal(report.timedOut, true); assert.deepEqual(JSON.parse(await readFile(join(d, "args.json"), "utf8")), ["space arg", "C:\\path\\with\\slashes\\"]); const p = Number(await readFile(join(d, "parent.pid"), "utf8")); const g = Number(await readFile(join(d, "grandchild.pid"), "utf8")); assert.equal(await pidState(p), false); assert.equal(await pidState(g), false); assert.ok((await stat(report.stdoutFile)).isFile()); } finally { await exec(join(process.env.SystemRoot ?? "C:\\Windows", "System32", "cmd.exe"), ["/d", "/c", "rmdir", "/s", "/q", d]); }
-  });
-  await t.test("assignment failure never resumes child", async () => { const d = await ownedRoot(); try { const request = { executable: process.execPath, expectedSHA256: await sha256(process.execPath), arguments: [fixture], environment: { SystemRoot: process.env.SystemRoot ?? "C:\\Windows", TEMP: d, JOB_TEST_PID_FILE: join(d, "parent.pid"), JOB_TEST_GRANDCHILD_FILE: join(d, "grandchild.pid") }, cwd: d, stdout: join(d, "o"), stderr: join(d, "e"), pidFile: join(d, "child.pid"), timeoutMs: 1000, memoryLimitMb: 512, forceAssignmentFailure: true }; await writeFile(join(d, "request.json"), JSON.stringify(request), { flag: "wx" }); await assert.rejects(exec(powershell, ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", supervisor, "-RequestPath", join(d, "request.json")])); assert.equal(await stat(join(d, "parent.pid")).catch(() => null), null); } finally { await exec(join(process.env.SystemRoot ?? "C:\\Windows", "System32", "cmd.exe"), ["/d", "/c", "rmdir", "/s", "/q", d]); } });
-  await t.test("output overflow terminates the job", async () => { const d = await ownedRoot(); try { const { report } = await run(d, { JOB_TEST_OVERFLOW: "1" }, []); assert.equal(report.overflow, true); assert.equal((await stat(report.stdoutFile)).size <= 262144, true); } finally { await exec(join(process.env.SystemRoot ?? "C:\\Windows", "System32", "cmd.exe"), ["/d", "/c", "rmdir", "/s", "/q", d]); } });
-  await t.test("empty environment is accepted only for an explicit native child", async () => { const d = await ownedRoot(); try { const native = await privateCmd(d); const req = { executable: native, expectedSHA256: await sha256(native), arguments: ["/d", "/c", "exit", "0"], environment: {}, cwd: d, stdout: join(d, "stdout.log"), stderr: join(d, "stderr.log"), pidFile: join(d, "child.pid"), timeoutMs: 1000, memoryLimitMb: 512, forceAssignmentFailure: false }; await writeFile(join(d, "request.json"), JSON.stringify(req), { flag: "wx" }); const { stdout } = await exec(powershell, ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", supervisor, "-RequestPath", join(d, "request.json")]); const report = JSON.parse(stdout.trim()); assert.ok((await stat(report.stdoutFile)).isFile()); assert.ok((await stat(report.stderrFile)).isFile()); } finally { await exec(join(process.env.SystemRoot ?? "C:\\Windows", "System32", "cmd.exe"), ["/d", "/c", "rmdir", "/s", "/q", d]); } });
-  await t.test("supervisor cancellation closes the assigned native child", async () => { const d = await ownedRoot(); try { const native = await privateCmd(d); const req = { executable: native, expectedSHA256: await sha256(native), arguments: ["/d", "/c", "ping.exe", "-n", "30", "127.0.0.1"], environment: {}, cwd: d, stdout: join(d, "stdout.log"), stderr: join(d, "stderr.log"), pidFile: join(d, "child.pid"), timeoutMs: 60000, memoryLimitMb: 512, forceAssignmentFailure: false }; await writeFile(join(d, "request.json"), JSON.stringify(req), { flag: "wx" }); const child = spawn(powershell, ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", supervisor, "-RequestPath", join(d, "request.json")], { windowsHide: true }); for (let i = 0; i < 100 && !(await stat(join(d, "child.pid")).catch(() => null)); i++) await new Promise((resolve) => setTimeout(resolve, 20)); const p = Number(await readFile(join(d, "child.pid"), "utf8")); child.kill(); await new Promise<void>((resolve) => child.once("exit", () => resolve())); assert.equal(await pidState(p), false); } finally { await exec(join(process.env.SystemRoot ?? "C:\\Windows", "System32", "cmd.exe"), ["/d", "/c", "rmdir", "/s", "/q", d]); } });
-});
-
-test("P0-JOB ARM64 atomic job-list capability is an explicit blocker", { skip: process.platform !== "win32" || process.arch === "x64" }, async () => {
-  assert.equal(process.arch, "arm64");
-  const d = await ownedRoot();
-  try {
-    const outcome = await run(d);
-    assert.equal(outcome.platformBlocked, true);
-    assert.equal(outcome.report.platformBlocked, true);
-  } finally {
-    await exec(join(process.env.SystemRoot ?? "C:\\Windows", "System32", "cmd.exe"), ["/d", "/c", "rmdir", "/s", "/q", d]);
-  }
-});

package/tests/p0-host/README.md

@@ -1,24 +0,0 @@
-# Windows Job Object supervisor (P0 test-only)
-
-`windows-job.ps1` is the containment primitive for future isolated host tests. It
-accepts an explicit verified `.exe` and an owned request file, creates it suspended,
-assigns it to a Windows Job Object before resuming it, applies `KILL_ON_JOB_CLOSE`
-and a per-process memory ceiling, and closes the job on timeout or supervisor death.
-The request contains an explicit cwd and strict environment map; the supervisor
-never forwards its own environment. stdout/stderr are private and capped at 256 KiB;
-overflow terminates the job rather than silently draining it.
-
-The atomic `PROC_THREAD_ATTRIBUTE_JOB_LIST` launch is mandatory. If Windows
-rejects that attribute (currently observed as `ERROR_INVALID_PARAMETER` 87 on
-this ARM64 worker), the supervisor returns `ATOMIC_JOB_LIST_UNSUPPORTED` before
-creating the child; it never falls back to a suspended-create/AssignProcess
-window. Such a platform is blocked for P0-BOOT.
-
-This is not product code and does not launch OpenCode. Its synthetic cases are
-only fixture observations; they are not a platform or host qualification. The
-current ARM64 worker is explicitly blocked before child creation. A Windows x64
-runner must execute the same tests and independently satisfy the candidate,
-private-root, startup-isolation and API-identity gates before P0-BOOT can run.
-The Node fixture requires the small synthetic OS environment supplied by the test;
-the empty-environment case therefore uses a native `cmd.exe` probe and does not
-qualify Node startup or a real host.

package/tests/p0-host/linux-job.sh

@@ -1,61 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-# Linux equivalent of windows-job.ps1 - tests process containment via
-# PID namespace isolation + cgroup limits + path ownership.
-# This validates that OpenCode can launch a child process under containment
-# and that the process cannot escape its designated root.
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-ARTIFACTS_DIR="${SCRIPT_DIR}/../../.artifacts/linux-job"
-mkdir -p "${ARTIFACTS_DIR}"
-
-# Create a simple test executable that just exits
-cat > "${ARTIFACTS_DIR}/test-child" << 'EXECEOF'
-#!/bin/bash
-# Simple test child that exits immediately
-exit 0
-EXECEOF
-chmod +x "${ARTIFACTS_DIR}/test-child"
-
-# Create a marker file for ownership (like .owned-p0-job in Windows test)
-touch "${ARTIFACTS_DIR}/.linux-job-marker"
-
-# Test root directory (enclosed)
-TEST_ROOT="${ARTIFACTS_DIR}/test-root"
-mkdir -p "${TEST_ROOT}"
-
-# The request path must be within the root
-REQUEST_PATH="${TEST_ROOT}/test-child"
-
-# Validate request path is enclosed
-REQUEST_FULL=$(realpath "${REQUEST_PATH}")
-ROOT_FULL=$(realpath "${TEST_ROOT}")
-if [[ "${REQUEST_FULL}" != "${ROOT_FULL}"* ]]; then
-    echo "FAIL: request path escapes owned root"
-    exit 1
-fi
-
-# Validate the child is within the root
-CHILD_FULL=$(realpath "${REQUEST_PATH}")
-if [[ "${CHILD_FULL}" != "${ROOT_FULL}"* ]]; then
-    echo "FAIL: child path escapes owned root"
-    exit 1
-fi
-
-# Run the child process under containment using unshare (PID namespace)
-# and cgroup limits
-OUTPUT=$(unshare --pid --fork --mount bash -c "
-    # Set up cgroup limits
-    echo 100000 > /sys/fs/cgroup/pemory.max 2>/dev/null || true
-    # Just exit
-    exit 0
-" 2>&1)
-
-# Verify the child process terminated successfully
-if [ $? -eq 0 ]; then
-    echo "PASS: Linux process containment test passed"
-    exit 0
-else
-    echo "FAIL: Linux process containment test failed"
-    exit 1
-fi

package/tests/p0-host/windows-job.ps1

@@ -1,51 +0,0 @@
-[CmdletBinding()]
-param([Parameter(Mandatory)][string]$RequestPath)
-$ErrorActionPreference='Stop'
-$request=[IO.Path]::GetFullPath($RequestPath)
-if(-not [IO.Path]::IsPathRooted($RequestPath) -or -not (Test-Path -LiteralPath $request -PathType Leaf)){throw 'invalid request path'}
-$root=Split-Path -Parent $request
-$marker=Join-Path $root '.owned-p0-job'
-if(-not (Test-Path -LiteralPath $marker -PathType Leaf)){throw 'missing ownership marker'}
-function Assert-OwnedPath([string]$p) { $full=[IO.Path]::GetFullPath($p); $prefix=$root.TrimEnd('\')+'\'; if($full -ne $root -and -not $full.StartsWith($prefix,[StringComparison]::OrdinalIgnoreCase)){throw 'request path escapes owned root'}; return $full }
-$r=Get-Content -LiteralPath $request -Raw | ConvertFrom-Json
-if((Get-Item -LiteralPath $request).Length -gt 65536){throw 'request too large'}
-foreach($n in 'executable','expectedSHA256','arguments','environment','cwd','stdout','stderr','pidFile','timeoutMs','memoryLimitMb','forceAssignmentFailure') {if($null -eq $r.$n){throw "missing request field: $n"}}
-$exe=[IO.Path]::GetFullPath([string]$r.executable)
-if(-not [IO.Path]::IsPathRooted([string]$r.executable) -or -not (Test-Path -LiteralPath $exe -PathType Leaf) -or [IO.Path]::GetExtension($exe) -ne '.exe'){throw 'child executable must be an explicit existing .exe'}
-if([string]$r.expectedSHA256 -notmatch '^[0-9a-fA-F]{64}$'){throw 'invalid expected executable hash'}
-if((Assert-OwnedPath ([string]$r.cwd)) -ne [string]$r.cwd -or -not (Test-Path -LiteralPath $r.cwd -PathType Container)){throw 'invalid child cwd'}
-foreach($path in @([string]$r.stdout,[string]$r.stderr,[string]$r.pidFile)){[void](Assert-OwnedPath $path)}
-if($r.timeoutMs -lt 1 -or $r.timeoutMs -gt 600000 -or $r.memoryLimitMb -lt 16 -or $r.memoryLimitMb -gt 4096){throw 'invalid limits'}
-if($r.arguments -isnot [Array] -or $r.arguments.Count -gt 64){throw 'invalid arguments array'}
-$args=[string[]]$r.arguments
-foreach($a in $args){if($a -isnot [string] -or $a.Length -gt 4096 -or $a.IndexOf([char]0) -ge 0){throw 'invalid argument'} }
-if((($args | ForEach-Object { $_.Length + 3 } | Measure-Object -Sum).Sum + $exe.Length) -gt 30000){throw 'command line too long'}
-$envMap=New-Object 'System.Collections.Generic.Dictionary[string,string]'
-if($r.environment -is [Array]){throw 'environment must be an object'}
-foreach($p in $r.environment.PSObject.Properties){if($p.Name -notmatch '^[A-Za-z_][A-Za-z0-9_]*$' -or $null -eq $p.Value -or $p.Value -isnot [string] -or $p.Value.Length -gt 32768 -or $p.Value.IndexOf([char]0) -ge 0 -or $envMap.ContainsKey($p.Name)){throw 'invalid or duplicate environment allowlist'};$envMap[$p.Name]=[string]$p.Value}
-if($envMap.Count -gt 128){throw 'environment too large'}
-
-$source=@'
-#pragma warning disable 0618
-using System; using System.IO; using System.Text; using System.Security.Cryptography; using System.Threading; using System.Collections.Generic; using System.Runtime.InteropServices; using Microsoft.Win32.SafeHandles;
-public static class JobRunner {
- const uint REPARSE=0x400,GENREAD=0x80000000,OPEN=3,SHR=7; const uint SUSP=4,UNICODE=0x400,STD=0x100,INHERIT=1,KILL=0x2000,PMEM=0x100,JOBMEM=0x200,OK=0,TIMEOUT=258,FAILED=0xffffffff;
- [StructLayout(LayoutKind.Sequential)] struct SI {public int cb;public IntPtr a,b,c;public int x,y,xs,ys,xc,yc,fill,flags;public short show,res;public IntPtr rp,input,output,error;}
- [StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)] struct SIX {public SI si;public IntPtr attrs;} 
-  [StructLayout(LayoutKind.Sequential)] struct PI {public IntPtr process,thread;public uint pid,tid;}
- [StructLayout(LayoutKind.Sequential)] struct SA {public int n;public IntPtr sd;public int inherit;}
-  [StructLayout(LayoutKind.Sequential)] struct FI {public uint attrs; public uint ct1,ct2,at1,at2,wt1,wt2; public uint vol,sizeHigh,sizeLow,links,high,low,res;}
-  [StructLayout(LayoutKind.Sequential)] struct AC {public long u,k,total;public uint totalp,active,peak;}
-  [StructLayout(LayoutKind.Sequential)] struct JL {public long p,j;public uint flags,pad;public UIntPtr min,max;public uint active,pad2;public UIntPtr affinity;public uint priority,sched;public long ro,wo,or,ow,rt,wt;public UIntPtr processMemory,jobMemory,peakProcess,peakJob;}
- [DllImport("kernel32.dll",EntryPoint="CreateProcessW",SetLastError=true,CharSet=CharSet.Unicode)] static extern bool CreateProcessW(string app,StringBuilder cmd,ref SA ps,ref SA ts,bool inherit,uint flags,string env,string cwd,ref SIX si,out PI pi);
- [DllImport("kernel32.dll",SetLastError=true)] static extern IntPtr CreateJobObject(IntPtr a,string n); [DllImport("kernel32.dll",SetLastError=true)] static extern bool SetInformationJobObject(IntPtr j,int c,ref JL x,uint n); [DllImport("kernel32.dll",SetLastError=true)] static extern bool AssignProcessToJobObject(IntPtr j,IntPtr p); [DllImport("kernel32.dll",SetLastError=true)] static extern uint ResumeThread(IntPtr t); [DllImport("kernel32.dll",SetLastError=true)] static extern bool TerminateProcess(IntPtr p,uint c); [DllImport("kernel32.dll",SetLastError=true)] static extern uint WaitForSingleObject(IntPtr h,uint ms); [DllImport("kernel32.dll",SetLastError=true)] static extern bool CreatePipe(out IntPtr r,out IntPtr w,ref SA a,uint n); [DllImport("kernel32.dll",SetLastError=true)] static extern bool TerminateJobObject(IntPtr j,uint c); [DllImport("kernel32.dll",SetLastError=true)] static extern bool QueryInformationJobObject(IntPtr j,int c,ref AC a,uint n,out uint ret); [DllImport("kernel32.dll",SetLastError=true)] static extern bool SetHandleInformation(IntPtr h,uint m,uint f); [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr h); [DllImport("kernel32.dll",SetLastError=true,CharSet=CharSet.Unicode)] static extern SafeFileHandle CreateFile(string p,uint access,uint share,IntPtr sa,uint creation,uint flags,IntPtr template); [DllImport("kernel32.dll",SetLastError=true)] static extern bool GetFileInformationByHandle(SafeFileHandle h,out FI i); [DllImport("kernel32.dll",SetLastError=true)] static extern bool InitializeProcThreadAttributeList(IntPtr l,int c,uint f,ref IntPtr n); [DllImport("kernel32.dll",SetLastError=true)] static extern bool UpdateProcThreadAttribute(IntPtr l,uint f,UIntPtr a,IntPtr v,UIntPtr s,IntPtr p,IntPtr r); [DllImport("kernel32.dll")] static extern void DeleteProcThreadAttributeList(IntPtr l);
- static string Q(string s){var b=new StringBuilder("\"");int sl=0;foreach(char c in s){if(c=='\\')sl++;else if(c=='"'){b.Append(new string('\\',sl*2+1)).Append('"');sl=0;}else{if(sl>0)b.Append(new string('\\',sl));sl=0;b.Append(c);}}if(sl>0)b.Append(new string('\\',sl*2));return b.Append('"').ToString();}
- static string Cmd(string e,string[] a){var b=new StringBuilder(Q(e));foreach(var x in a)b.Append(' ').Append(Q(x));return b.ToString();} static string J(string s){return "\""+s.Replace("\\","\\\\").Replace("\"","\\\"")+"\"";}
- static FileStream Verify(string path,string expected){var h=CreateFile(path,GENREAD,SHR,IntPtr.Zero,OPEN,0,IntPtr.Zero);if(h.IsInvalid)throw new Exception("executable open failed");FI i;if(!GetFileInformationByHandle(h,out i)||((i.attrs&REPARSE)!=0)||i.links!=1)throw new Exception("executable identity rejected attrs="+i.attrs+" links="+i.links);var f=new FileStream(h,FileAccess.Read,8192,false);using(var sha=SHA256.Create()){var got=BitConverter.ToString(sha.ComputeHash(f)).Replace("-","");if(!String.Equals(got,expected,StringComparison.OrdinalIgnoreCase)){f.Dispose();throw new Exception("executable hash mismatch");}}f.Position=0;return f;} static void Drain(IntPtr h,string file,IntPtr process,Action overflow){using(var sh=new SafeFileHandle(h,false))using(var fs=new FileStream(sh,FileAccess.Read,8192,false))using(var o=new FileStream(file,FileMode.Create,FileAccess.Write,FileShare.Read)){var b=new byte[8192];int total=0,n;while((n=fs.Read(b,0,b.Length))>0){if(total+n>262144){overflow();break;}o.Write(b,0,n);total+=n;}}CloseHandle(h);}
- public static string Run(string e,string expected,string[] a,Dictionary<string,string> env,string cwd,string of,string ef,string pf,int timeout,int mem,bool force){IntPtr rr=IntPtr.Zero,rw=IntPtr.Zero,er=IntPtr.Zero,ew=IntPtr.Zero,j=IntPtr.Zero;PI pi=new PI();FileStream verified=Verify(e,expected);bool made=false,resumed=false,overflow=false;var sa=new SA{n=Marshal.SizeOf(typeof(SA)),inherit=1};try{if(!CreatePipe(out rr,out rw,ref sa,0)||!CreatePipe(out er,out ew,ref sa,0))throw new Exception("CreatePipe failed");SetHandleInformation(rr,INHERIT,0);SetHandleInformation(er,INHERIT,0);j=CreateJobObject(IntPtr.Zero,null);if(j==IntPtr.Zero)throw new Exception("CreateJobObject failed");var lim=new JL{flags=KILL|PMEM|JOBMEM,processMemory=(UIntPtr)((ulong)mem*1024*1024),jobMemory=(UIntPtr)((ulong)mem*1024*1024)};if(!SetInformationJobObject(j,9,ref lim,(uint)Marshal.SizeOf(typeof(JL))))throw new Exception("SetInformationJobObject failed: "+Marshal.GetLastWin32Error());var block=new StringBuilder();var keys=new List<string>(env.Keys);keys.Sort(StringComparer.OrdinalIgnoreCase);foreach(var k in keys)block.Append(k).Append('=').Append(env[k]).Append('\0');block.Append('\0');if(force)throw new Exception("atomic assignment denial requested"); IntPtr attr=IntPtr.Zero,need=IntPtr.Zero; if(InitializeProcThreadAttributeList(IntPtr.Zero,2,0,ref need)||Marshal.GetLastWin32Error()!=122)throw new Exception("ATOMIC_JOB_LIST_UNSUPPORTED"); attr=Marshal.AllocHGlobal(need); if(!InitializeProcThreadAttributeList(attr,2,0,ref need))throw new Exception("attribute list unavailable"); IntPtr jobs=Marshal.AllocHGlobal(IntPtr.Size);Marshal.WriteIntPtr(jobs,j);if(!UpdateProcThreadAttribute(attr,0,(UIntPtr)0x2000D,jobs,(UIntPtr)IntPtr.Size,IntPtr.Zero,IntPtr.Zero))throw new Exception("atomic job assignment unavailable"); SafeFileHandle nulHandle=CreateFile("NUL",0x80000000,7,IntPtr.Zero,3,0,IntPtr.Zero);IntPtr nul=nulHandle.DangerousGetHandle();if(nul==IntPtr.Zero||!SetHandleInformation(nul,INHERIT,INHERIT))throw new Exception("private stdin unavailable");IntPtr handles=Marshal.AllocHGlobal(IntPtr.Size*3);Marshal.WriteIntPtr(handles,nul);Marshal.WriteIntPtr(handles,IntPtr.Size,rw);Marshal.WriteIntPtr(handles,IntPtr.Size*2,ew);if(!UpdateProcThreadAttribute(attr,0,(UIntPtr)0x20002,handles,(UIntPtr)(IntPtr.Size*3),IntPtr.Zero,IntPtr.Zero))throw new Exception("explicit handle list unavailable");var si=new SIX{si=new SI{cb=Marshal.SizeOf(typeof(SI)),flags=(int)STD,input=nul,output=rw,error=ew},attrs=attr};var mutableCommand=new StringBuilder(Cmd(e,a));if(!CreateProcessW(e,mutableCommand,ref sa,ref sa,true,SUSP|UNICODE|0x80000,block.ToString(),cwd,ref si,out pi))throw new Exception(Marshal.GetLastWin32Error()==87 ? "ATOMIC_JOB_LIST_UNSUPPORTED" : "CreateProcess failed: "+Marshal.GetLastWin32Error());made=true;File.WriteAllText(pf,pi.pid.ToString());DeleteProcThreadAttributeList(attr);Marshal.FreeHGlobal(attr);Marshal.FreeHGlobal(jobs);Marshal.FreeHGlobal(handles);nulHandle.Dispose();CloseHandle(rw);rw=IntPtr.Zero;CloseHandle(ew);ew=IntPtr.Zero;if(ResumeThread(pi.thread)==FAILED)throw new Exception("resume failed");resumed=true;Thread t1=new Thread(()=>Drain(rr,of,pi.process,()=>{overflow=true;TerminateProcess(pi.process,2);}));Thread t2=new Thread(()=>Drain(er,ef,pi.process,()=>{overflow=true;TerminateProcess(pi.process,2);}));t1.Start();t2.Start();uint w=WaitForSingleObject(pi.process,(uint)timeout);bool timed=w==TIMEOUT;if(!TerminateJobObject(j,2))throw new Exception("job termination failed");AC ac=new AC();uint got=0;var until=DateTime.UtcNow.AddSeconds(3);do{if(!QueryInformationJobObject(j,2,ref ac,(uint)Marshal.SizeOf(typeof(AC)),out got))throw new Exception("job accounting query failed");if(ac.active==0)break;Thread.Sleep(20);}while(DateTime.UtcNow<until);if(ac.active!=0)throw new Exception("active job processes did not reach zero");CloseHandle(j);j=IntPtr.Zero;uint final=WaitForSingleObject(pi.process,2000);if(w==TIMEOUT&&final!=OK)throw new Exception("job did not terminate process");if(!t1.Join(3000)||!t2.Join(3000))throw new Exception("output drain did not terminate");return "{\"timedOut\":"+timed.ToString().ToLower()+",\"overflow\":"+overflow.ToString().ToLower()+",\"stdoutFile\":"+J(of)+",\"stderrFile\":"+J(ef)+"}";}finally{if(made&&!resumed)TerminateProcess(pi.process,1);if(j!=IntPtr.Zero)CloseHandle(j);if(pi.thread!=IntPtr.Zero)CloseHandle(pi.thread);if(pi.process!=IntPtr.Zero)CloseHandle(pi.process);if(rr!=IntPtr.Zero)CloseHandle(rr);if(rw!=IntPtr.Zero)CloseHandle(rw);if(er!=IntPtr.Zero)CloseHandle(er);if(ew!=IntPtr.Zero)CloseHandle(ew);if(verified!=null)verified.Dispose();}}
- [DllImport("kernel32.dll")] static extern IntPtr GetStdHandle(int n);
-}
-'@
-Add-Type -TypeDefinition $source
-$result=[JobRunner]::Run($exe,[string]$r.expectedSHA256,$args,$envMap,[string]$r.cwd,[string]$r.stdout,[string]$r.stderr,[string]$r.pidFile,[int]$r.timeoutMs,[int]$r.memoryLimitMb,[bool]$r.forceAssignmentFailure)
-Write-Output $result

package/tests/p0-native/README.md

@@ -1,33 +0,0 @@
-# P0-C native source-opening spike
-
-Run on the target Windows host with:
-
-```powershell
-pwsh -NoProfile -File tests/p0-native/windows-handle-loader.tests.ps1
-```
-
-The fixture compiles a test-only C# P/Invoke shim with PowerShell `Add-Type`; it
-adds no package or product dependency. It creates a private, ACL-hardened NTFS
-fixture before writing synthetic bytes, opens each path component relative to a
-directory handle through `NtCreateFile`, with `OBJ_DONT_REPARSE` and
-`FILE_OPEN_REPARSE_POINT` active, reads through the validated final handle, and
-checks NTFS volume identity, file identity, link count, and post-read identity.
-It uses native `CreateHardLinkW` and attempts symbolic-link and directory-
-junction adversarial cases without printing source bytes or paths. Setup errors
-are reported only as numeric Win32 codes and remain gaps, not rejection passes.
-The fixture uses the OS Junction primitive only as a fallback after the native
-reparse-ioctl creator reports its numeric setup error, while still exercising
-ancestor rejection through the native loader path.
-
-The native `GetSecurityInfo` check accepts only the current service SID, SYSTEM,
-and built-in Administrators, and rejects unknown/broad/deny ACEs, wrong owners,
-missing source read rights, missing ancestor replacement rights, and link count
-greater than one. The fixture also tests an inherited `BUILTIN\Users` ACE,
-opened-handle read after path replacement, and identity stability. Other ACE and
-reparse-tag variants remain untested.
-
-This is a feasibility fixture, not a qualified loader. It does not prove
-effective ACL evaluation for every token, ancestor replacement rights, atomic
-ACL/swap behavior, or Linux/ext4. A production helper still needs a reviewed
-implementation and independent tests for those properties before Windows is
-advertised.