test(utils): pin the trusted-home independent-evidence rule on NSS-less identities - #4779
Conversation
aafa46d to
3dd0eb7
Compare
|
Exact-head adversarial review — recorded. Head at review time: Cross-family adversarial review through the external reviewer lane ( Five P3 nits were raised; all addressed in
The mutation proof was re-run after the hardening on the final head: guard removed → exactly the 2 userns cases fail with the attacker path as — |
3dd0eb7 to
b7c260b
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b7c260b07a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (!userNamespaceWorks()) | ||
| throw new Error( | ||
| "user namespace with unmapped uid unavailable: the #4773 fail-open shape cannot be exercised on this host (see the pure-predicate suite for the decision rule)", | ||
| ); |
There was a problem hiding this comment.
On every macOS and Windows run userNamespaceWorks() necessarily returns false, and it also returns false on Linux hosts where unshare is absent or user namespaces are disabled, so this test and the following one unconditionally throw and break the package's normal test suite before the cross-platform compatibility cases run. Gate these Linux-specific subprocess probes with a platform/capability skip while keeping platform-independent assertions runnable.
Useful? React with 👍 / 👎.
| /** A checkout whose `.env` declares HOME equal to the inherited value. */ | ||
| function projectDir(homeValue: string): string { | ||
| const dir = tempDir(); | ||
| fs.writeFileSync(path.join(dir, ".env"), `HOME=${homeValue}\n`); |
There was a problem hiding this comment.
This newly added setup writes the fixture with fs.writeFileSync, contrary to the repository's filesystem contract requiring Bun.write() and explicitly disallowing writeFileSync; make the setup asynchronous and await Bun.write() from its callers.
AGENTS.md reference: AGENTS.md:L124-L127
Useful? React with 👍 / 👎.
122c380 to
db896b0
Compare
Yeachan-Heo
changed the title
|
gajae.pr-self-review.v1 verdict:merge-self-approved base:6a55d0f12de92be5465832b1e5dcefaf36730586 head:db896b0c3f190d68b6d272ae47842ed1328ae15d sha256:13738cf6b0119eb985e9109c5fb678a437b65aac5bd0cec6425a9e087b74a10d reviewer-id:Yeachan-Heo risk:low-risk extra:none evidence:exact-head cross-family adversarial review rounds 1-4 recorded on this PR (final APPROVE on 122c380; the only delta past that head is the stale-comment P3 fix the reviewer itself requested); packages/utils suite 376 pass ambient+pristine HOME; mutation proof shows the new tests fail on the vulnerable behavior; zero packages/utils/src delta — the production independent-evidence rule landed via #4766 and is preserved verbatim |
|
gajae.pr-self-review.v1 verdict:merge-self-approved base:6a55d0f12de92be5465832b1e5dcefaf36730586 head:db896b0c3f190d68b6d272ae47842ed1328ae15d sha256:13738cf6b0119eb985e9109c5fb678a437b65aac5bd0cec6425a9e087b74a10d reviewer-id:Yeachan-Heo risk:low-risk extra:none evidence:exact-head cross-family adversarial review rounds 1-4 recorded on PR 4779 (final APPROVE on 122c380; the only delta past that head is the stale-comment P3 fix the reviewer itself requested); packages/utils suite 376 pass ambient+pristine HOME; mutation proof shows the new tests fail on the vulnerable behavior; zero packages/utils/src delta - the production independent-evidence rule landed via 4766 and is preserved verbatim |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: db896b0c3f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const result = child_process.spawnSync( | ||
| "unshare", | ||
| [...form, process.execPath, "-e", "console.log(process.getuid())"], | ||
| { encoding: "utf8", timeout: 15_000 }, |
There was a problem hiding this comment.
This new capability probe invokes a simple external command through node:child_process.spawnSync (and repeats the pattern in runProbeWithoutPasswdEntry), contrary to the repository contract requiring Bun-native command spawning and explicitly avoiding child_process; use Bun Shell or Bun.spawnSync consistently for both subprocess paths.
AGENTS.md reference: AGENTS.md:L124-L127
Useful? React with 👍 / 👎.
…ss identities Closes #4773. The fail-open that issue reported — `accountHomeFromSystem()`'s final fallback `os.userInfo().homedir` is the environment home returned verbatim whenever it is set, so the ambiguous branch could accept attacker-influenced input as the trusted home on identities without a local passwd entry — is closed on dev by the independent-evidence rule from #4766 (`independentAccountHome`: the account home counts only when it does not merely echo the runtime home; otherwise the filesystem-root sentinel marks user state unavailable). #4766's repro is macOS-shaped; the Linux no-passwd-entry shape (NSS/LDAP/SSSD, distroless) had no discriminating coverage, and this PR supplies it without changing any production behavior (the `packages/utils/src` delta is empty). - New `trusted-home-failopen.test.ts` runs the resolver probe under an unprivileged user namespace whose mapped uid is verified absent from `/etc/passwd` (skipping candidate uids the host already maps, then using the invoking user's subordinate range) — the exact #4773 shape, without root. Every candidate `unshare` argument form is probed and the first working one reused. The discriminating tests are Linux-only; on a host without the capability they skip with a loud warning naming the lost coverage instead of failing cross-platform CI. Compat shapes are asserted unchanged: passwd-backed uid still resolves through `/etc/passwd` (the raw passwd field, mirroring the resolver's validity rule), absent platform home variable still resolves through the account database, unambiguous operator home still wins. - Mutation proof: removing the distinctness rule from dirs.ts (`independentAccountHome = accountHome`) makes exactly the two no-passwd-entry cases fail with the attacker path as `trustedHome`; with the rule, all pass. - `agent-dir-trust.test.ts`'s account-home expectation now reads the passwd database directly instead of a parent-side `os.userInfo().homedir`, which follows an isolated HOME and made the assertion fail under a pristine HOME (pre-existing on dev). - `docs/crash-reporting.md` now describes the landed contract accurately: independent evidence means not merely echoing the runtime home; without it, the root sentinel marks user state unavailable. The previous text claimed a filesystem root is never used as the refusal sentinel, which the implementation no longer honors. Relationship to #4772: none absorbed; that PR remains separate (its head carries its own version of the parent-side expectation fix). Lore-id: 4773-trusted-home-fail-open Constraint: no production-code change; the established dev contract (#4766 independent-evidence rule + root sentinel) is preserved verbatim Constraint: no overlap absorption from #4772 Rejected: shipping a competing implementation (eager throw at import) | dev's sentinel refusal already landed and is strictly more compatible at startup Confidence: high Scope-risk: narrow Reversibility: trivial Tested: bun test packages/utils/test/ (376 pass ambient + pristine HOME); coding-agent credential-boundary suites 61 pass under pristine HOME (auth-broker, credential-import, skill-hook-agent-dir, spawn-command, sdk-bus-token, exa-api-key, web-search, runtime-mcp redteam/precedence) Tested: mutation proof — distinctness rule removed → 2 no-passwd-entry cases fail with attacker home as trustedHome; rule present → 6/6 pass Not-tested: live NSS/LDAP/SSSD identity (simulated faithfully via uid without passwd entry in a user namespace); live macOS/Windows hosts (rule provenance established from Bun and libuv sources)
db896b0 to
2f6b954
Compare
|
gajae.pr-self-review.v1 verdict:merge-self-approved base:4db6b1368f1a4a912bc4497ffe83d33464e68a50 head:2f6b95415e6a1e4f859ec0b1cb5f135eb2a82f86 sha256:13738cf6b0119eb985e9109c5fb678a437b65aac5bd0cec6425a9e087b74a10d reviewer-id:Yeachan-Heo risk:low-risk extra:none evidence:exact-head cross-family adversarial review rounds 1-4 recorded on PR 4779 (final APPROVE; production rule landed via 4766 and is preserved verbatim - zero packages/utils/src delta); rebased onto dev 4db6b13 with packages/utils 376 pass ambient+pristine HOME, coding-agent credential suites green, mutation proof caught (2 failures), state-writer gate 0 sites |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2f6b95415e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (process.platform === "win32") { | ||
| // USERPROFILE absent: libuv falls back to the access-token profile | ||
| // directory, which the environment cannot plant. | ||
| expect(resolved.ok).toBe(true); |
There was a problem hiding this comment.
Fresh evidence at this head is that the capability probes now gate correctly, but this Windows-specific assertion still fails: projectDir() writes USERPROFILE into the child's .env, and although runProbe(cwd, undefined) removes the inherited variable, Bun reloads that .env before importing dirs.ts. As this test's own premise documents, os.userInfo().homedir then echoes the planted runtime value, leaving no independent account home and correctly producing { ok: false }, contrary to this unconditional true expectation on every Windows execution. Use a cwd without a home declaration to test the genuinely absent-variable compatibility case, or assert the fail-closed result here.
Useful? React with 👍 / 👎.
The trusted-home provenance hardening anchored getTrustedHomeDir() to a value captured when dirs.ts loaded. Every user-scope path derives from it, so a home established or changed after module load silently resolved elsewhere: user-scope skills under ~/.gjc/agent/skills and user-scope MCP servers under ~/.gjc/agent/mcp.json stopped being discovered entirely. Provenance decides which candidate home may be honored; call-time resolution decides when it is read. Freezing the result bought the first by giving up the second. The home is now re-derived per access with cached paths rebuilt when it changes, and the dotenv-ambiguity rule is applied unchanged at each resolution. Folded in while hardening the same resolver: - The runtime home is validated like the account home. Bun returns HOME verbatim, so a relative value anchored user state under the working directory. Root detection normalizes first, because /., //, /foo/.. and C:\x\.. are all roots that a raw comparison misses. The original spelling is returned so both sides of the dotenv ambiguity check stay comparable. - The Linux account home comes from NSS (getent passwd) instead of parsing /etc/passwd, which missed LDAP/SSSD accounts and fell through to os.userInfo().homedir -- the very $HOME-derived value the lookup exists to reject. The lookup is consulted lazily, so an unambiguous runtime home never pays for a spawn on a path that runs on every directory access. - Only environment-independent evidence is memoized, and provenance travels with it, so a cached env-derived home can never later be promoted to independent evidence once the runtime home moves. - Independence is a property of the source, not string inequality. An NSS answer that agrees with HOME is corroboration; refusing it locked out any operator whose HOME matched their account entry once a checkout declared HOME dynamically. - XDG eligibility is decided once and made sticky, so an agent directory cannot change storage lane when a home refresh makes its path coincide with the new default. Lore-id: 4f1a7c92 Constraint: setAgentDir(<default path>) selects the default profile, XDG included -- dirs-python-gateway.test.ts pins it Constraint: #4773's fail-closed contract (now merged via #4779) is preserved, not weakened or restated Rejected: keep the snapshot and rewrite the failing tests | the tests are a proxy for real user-scope discovery, not the defect Confidence: high Scope-risk: wide Reversibility: easy Tested: each fix reverted independently fails exactly its own regressions Tested: utils 395 pristine+ambient (incl. #4779's failopen suite), skills 36, MCP redteam 16, both checks clean Tested: 12-shape dotenv provenance matrix, zero bypasses Not-tested: a live LDAP/SSSD identity; NSS behavior is pinned against getent
The trusted-home provenance hardening anchored getTrustedHomeDir() to a value captured when dirs.ts loaded. Every user-scope path derives from it, so a home established or changed after module load silently resolved elsewhere: user-scope skills under ~/.gjc/agent/skills and user-scope MCP servers under ~/.gjc/agent/mcp.json stopped being discovered entirely. Provenance decides which candidate home may be honored; call-time resolution decides when it is read. Freezing the result bought the first by giving up the second. The home is now re-derived per access with cached paths rebuilt when it changes, and the dotenv-ambiguity rule is applied unchanged at each resolution. Folded in while hardening the same resolver: - The runtime home is validated like the account home. Bun returns HOME verbatim, so a relative value anchored user state under the working directory. Root detection normalizes first, because /., //, /foo/.. and C:\x\.. are all roots that a raw comparison misses. The original spelling is returned so both sides of the dotenv ambiguity check stay comparable. - The Linux account home comes from NSS (getent passwd) instead of parsing /etc/passwd, which missed LDAP/SSSD accounts and fell through to os.userInfo().homedir -- the very $HOME-derived value the lookup exists to reject. The lookup is consulted lazily, so an unambiguous runtime home never pays for a spawn on a path that runs on every directory access. - Only environment-independent evidence is memoized, and provenance travels with it, so a cached env-derived home can never later be promoted to independent evidence once the runtime home moves. - Independence is a property of the source, not string inequality. An NSS answer that agrees with HOME is corroboration; refusing it locked out any operator whose HOME matched their account entry once a checkout declared HOME dynamically. - XDG eligibility is decided once and made sticky, so an agent directory cannot change storage lane when a home refresh makes its path coincide with the new default. Lore-id: 4f1a7c92 Constraint: setAgentDir(<default path>) selects the default profile, XDG included -- dirs-python-gateway.test.ts pins it Constraint: #4773's fail-closed contract (now merged via #4779) is preserved, not weakened or restated Rejected: keep the snapshot and rewrite the failing tests | the tests are a proxy for real user-scope discovery, not the defect Confidence: high Scope-risk: wide Reversibility: easy Tested: each fix reverted independently fails exactly its own regressions Tested: utils 395 pristine+ambient (incl. #4779's failopen suite), skills 36, MCP redteam 16, both checks clean Tested: 12-shape dotenv provenance matrix, zero bypasses Not-tested: a live LDAP/SSSD identity; NSS behavior is pinned against getent
The trusted-home provenance hardening anchored getTrustedHomeDir() to a value captured when dirs.ts loaded. Every user-scope path derives from it, so a home established or changed after module load silently resolved elsewhere: user-scope skills under ~/.gjc/agent/skills and user-scope MCP servers under ~/.gjc/agent/mcp.json stopped being discovered entirely. Provenance decides which candidate home may be honored; call-time resolution decides when it is read. Freezing the result bought the first by giving up the second. The home is now re-derived per access with cached paths rebuilt when it changes, and the dotenv-ambiguity rule is applied unchanged at each resolution. Folded in while hardening the same resolver: - The runtime home is validated like the account home. Bun returns HOME verbatim, so a relative value anchored user state under the working directory. Root detection normalizes first, because /., //, /foo/.. and C:\x\.. are all roots that a raw comparison misses. The original spelling is returned so both sides of the dotenv ambiguity check stay comparable. - The Linux account home comes from NSS (getent passwd) instead of parsing /etc/passwd, which missed LDAP/SSSD accounts and fell through to os.userInfo().homedir -- the very $HOME-derived value the lookup exists to reject. The lookup is consulted lazily, so an unambiguous runtime home never pays for a spawn on a path that runs on every directory access. - Only environment-independent evidence is memoized, and provenance travels with it, so a cached env-derived home can never later be promoted to independent evidence once the runtime home moves. - Independence is a property of the source, not string inequality. An NSS answer that agrees with HOME is corroboration; refusing it locked out any operator whose HOME matched their account entry once a checkout declared HOME dynamically. - XDG eligibility is decided once and made sticky, so an agent directory cannot change storage lane when a home refresh makes its path coincide with the new default. Lore-id: 4f1a7c92 Constraint: setAgentDir(<default path>) selects the default profile, XDG included -- dirs-python-gateway.test.ts pins it Constraint: #4773's fail-closed contract (now merged via #4779) is preserved, not weakened or restated Rejected: keep the snapshot and rewrite the failing tests | the tests are a proxy for real user-scope discovery, not the defect Confidence: high Scope-risk: wide Reversibility: easy Tested: each fix reverted independently fails exactly its own regressions Tested: utils 395 pristine+ambient (incl. #4779's failopen suite), skills 36, MCP redteam 16, both checks clean Tested: 12-shape dotenv provenance matrix, zero bypasses Not-tested: a live LDAP/SSSD identity; NSS behavior is pinned against getent
The trusted-home provenance hardening anchored getTrustedHomeDir() to a value captured when dirs.ts loaded. Every user-scope path derives from it, so a home established or changed after module load silently resolved elsewhere: user-scope skills under ~/.gjc/agent/skills and user-scope MCP servers under ~/.gjc/agent/mcp.json stopped being discovered entirely. Provenance decides which candidate home may be honored; call-time resolution decides when it is read. Freezing the result bought the first by giving up the second. The home is now re-derived per access with cached paths rebuilt when it changes, and the dotenv-ambiguity rule is applied unchanged at each resolution. Folded in while hardening the same resolver: - The runtime home is validated like the account home. Bun returns HOME verbatim, so a relative value anchored user state under the working directory. Root detection normalizes first, because /., //, /foo/.. and C:\x\.. are all roots that a raw comparison misses. The original spelling is returned so both sides of the dotenv ambiguity check stay comparable. - The Linux account home comes from NSS (getent passwd) instead of parsing /etc/passwd, which missed LDAP/SSSD accounts and fell through to os.userInfo().homedir -- the very $HOME-derived value the lookup exists to reject. The lookup is consulted lazily, so an unambiguous runtime home never pays for a spawn on a path that runs on every directory access. - Only environment-independent evidence is memoized, and provenance travels with it, so a cached env-derived home can never later be promoted to independent evidence once the runtime home moves. - Independence is a property of the source, not string inequality. An NSS answer that agrees with HOME is corroboration; refusing it locked out any operator whose HOME matched their account entry once a checkout declared HOME dynamically. - XDG eligibility is decided once and made sticky, so an agent directory cannot change storage lane when a home refresh makes its path coincide with the new default. Lore-id: 4f1a7c92 Constraint: setAgentDir(<default path>) selects the default profile, XDG included -- dirs-python-gateway.test.ts pins it Constraint: #4773's fail-closed contract (now merged via #4779) is preserved, not weakened or restated Rejected: keep the snapshot and rewrite the failing tests | the tests are a proxy for real user-scope discovery, not the defect Confidence: high Scope-risk: wide Reversibility: easy Tested: each fix reverted independently fails exactly its own regressions Tested: utils 395 pristine+ambient (incl. #4779's failopen suite), skills 36, MCP redteam 16, both checks clean Tested: 12-shape dotenv provenance matrix, zero bypasses Not-tested: a live LDAP/SSSD identity; NSS behavior is pinned against getent
The trusted-home provenance hardening anchored getTrustedHomeDir() to a value captured when dirs.ts loaded. Every user-scope path derives from it, so a home established or changed after module load silently resolved elsewhere: user-scope skills under ~/.gjc/agent/skills and user-scope MCP servers under ~/.gjc/agent/mcp.json stopped being discovered entirely. Provenance decides which candidate home may be honored; call-time resolution decides when it is read. Freezing the result bought the first by giving up the second. The home is now re-derived per access with cached paths rebuilt when it changes, and the dotenv-ambiguity rule is applied unchanged at each resolution. Folded in while hardening the same resolver: - The runtime home is validated like the account home. Bun returns HOME verbatim, so a relative value anchored user state under the working directory. Root detection normalizes first, because /., //, /foo/.. and C:\x\.. are all roots that a raw comparison misses. The original spelling is returned so both sides of the dotenv ambiguity check stay comparable. - The Linux account home comes from NSS (getent passwd) instead of parsing /etc/passwd, which missed LDAP/SSSD accounts and fell through to os.userInfo().homedir -- the very $HOME-derived value the lookup exists to reject. The lookup is consulted lazily, so an unambiguous runtime home never pays for a spawn on a path that runs on every directory access. - Only environment-independent evidence is memoized, and provenance travels with it, so a cached env-derived home can never later be promoted to independent evidence once the runtime home moves. - Independence is a property of the source, not string inequality. An NSS answer that agrees with HOME is corroboration; refusing it locked out any operator whose HOME matched their account entry once a checkout declared HOME dynamically. - XDG eligibility is decided once and made sticky, so an agent directory cannot change storage lane when a home refresh makes its path coincide with the new default. Lore-id: 4f1a7c92 Constraint: setAgentDir(<default path>) selects the default profile, XDG included -- dirs-python-gateway.test.ts pins it Constraint: #4773's fail-closed contract (now merged via #4779) is preserved, not weakened or restated Rejected: keep the snapshot and rewrite the failing tests | the tests are a proxy for real user-scope discovery, not the defect Confidence: high Scope-risk: wide Reversibility: easy Tested: each fix reverted independently fails exactly its own regressions Tested: utils 395 pristine+ambient (incl. #4779's failopen suite), skills 36, MCP redteam 16, both checks clean Tested: 12-shape dotenv provenance matrix, zero bypasses Not-tested: a live LDAP/SSSD identity; NSS behavior is pinned against getent
1 participant
What
Closes #4773 by pinning the trusted-home independent-evidence rule with the discriminating regression proof its original macOS repro could not provide.
Reconciliation note (why the diff shrank): while this PR was in review, dev merged #4766, whose
91f8fd09b4("require independent evidence for a trusted account home") closes the same fail-open #4773 reported — the account home now counts in the ambiguous branch only when it does not merely echo the runtime home, otherwise the filesystem-root sentinel marks user state unavailable (lazy, startup-compatible refusal). This PR was rebased onto that contract and now ships zero production-code change (git diff origin/dev...HEAD -- packages/utils/srcis empty): the implementation is dev's, unchanged. What remains is exactly what dev still lacked:packages/utils/test/trusted-home-failopen.test.ts— the discriminating proof for the Linux no-local-passwd-entry shape (NSS/LDAP/SSSD-backed identities, distroless containers) that fix(utils): fold project dotenv provenance keys on Windows only #4766's macOS repro cannot reach: the probe runs under an unprivileged user namespace whose mapped uid is verified absent from/etc/passwd(candidates filtered against the passwd database, then the invoking user's/etc/subuidrange; the mapped uid is confirmed by the capability probe). Linux-only; hosts without the capability skip with a loud warning naming the lost coverage. Compat shapes asserted unchanged on every platform using the platform-authoritative key (USERPROFILEon Windows): passwd-backed uid, absent platform home variable, unambiguous operator home, dynamic declaration.agent-dir-trust.test.ts— the account-home expectation now reads the passwd database directly instead of a parent-sideos.userInfo().homedir(which follows an isolatedHOMEand made the assertion fail under a pristineHOME— pre-existing on dev).docs/crash-reporting.md— describes the landed sentinel contract accurately; the old text claimed a filesystem root is never used as the refusal sentinel, which the implementation no longer honors.packages/utils/CHANGELOG.md— one line under[Unreleased].Why
#4773's fail-open needed an identity whose uid has no local passwd entry for the runtime
userInfo().homedirecho to be the only "account" source. #4766 fixed the rule from a macOS repro; without a Linux no-passwd-entry regression test, the exact shape the issue reported could silently regress back into the trusted set (and with it,.envfiles under a checkout-controlled home being treated as trusted by$credentialEnv). Mutation proof: removing the distinctness rule fromdirs.ts(independentAccountHome = accountHome) makes exactly the two no-passwd-entry cases fail with the attacker path astrustedHome; with the rule, all pass.Exact-head adversarial review
Four cross-family review rounds (external codex lane, full diff + current files as untrusted input, fail-closed verdict contract) are recorded in PR comments. Round 1: APPROVE with 5 P3 nits on the original implementation (all addressed). Rounds 2–3 on the reconciled tests-only head: REQUEST_CHANGES with a genuine Windows-lane breakage (POSIX-only home key) and an unverified uid premise — both fixed (platform-aware
homeEnvKey(), passwd-filtered candidate uids). Round 4 on head122c380882: APPROVE ("Nothing blocks"), with one stale-comment P3 fixed in the final headdb896b0c3f(comment wording only; the only delta past the approved head).Testing
bun test packages/utils/test/— 376 pass / 0 fail, ambient and pristineHOME.trustedHome; rule present → 6/6 pass;packages/utils/srcbyte-identical to dev.HOME: auth-broker, credential-import, skill-hook-agent-dir, spawn-command, sdk-bus-token, exa-api-key, web-search, runtime-mcp redteam + precedence — 61 pass / 0 fail.bun --cwd=packages/utils run check(biome + tsc) clean;bun scripts/verify-gjc-state-writers.ts --fail— 0 write sites;git diff --checkclean.Risk classification
low-risk— ordinary fix/maintenance; the repository owner may use the explicitmerge-self-approvedsolo verdict (no independent human review; the verdict name itself records this) with a risk-record comment bound to the exact head.regression-risk— fix with material regression risk; requires one assigned independent domain reviewer whose authenticated exact-headAPPROVEDreview the gate verifies (extra:independent:<login>; the token alone never suffices).high-risk— large refactor, feature, or materially high-risk change (security/auth/install/remove/public API/destructive lifecycle/architecture); requires one assigned independent domain reviewer with an authenticated exact-headAPPROVEDreview (extra:independent:<login>).The production security change this PR originally carried was reclassified out of it when dev absorbed the implementation via #4766 (which went through its own merge path). What remains is test files, one docs paragraph, and a changelog line — no runtime code, no public API, no lifecycle surface. The security-relevant decision itself (fail closed on indistinguishable homes) is already merged on dev; this PR adds its Linux NSS-less regression proof. Honest classification of this diff: low-risk, merged through the explicitly named
merge-self-approvedsolo path, with the exact-head adversarial review recorded above and on the issue.GJC verdict
merge-self-approved: the named solo path for a low-risk change; the name itself records that no independent human reviewed this tests+docs-only diff. The signed risk-record comment bound to this exact base/head/digest follows.devbun checkpasses