after moving all to cipher

worker-toolkit-stocks-in-the-future/scripts/lib/tree-permissions.test.ts

@@ -6,10 +6,21 @@
  * *inside* it, so the repair has to fix directory modes, not just ownership.
  * These tests run unprivileged, so they exercise the mode axis for real and the
  * ownership axis only as far as an unprivileged process can (target resolution +
- * graceful EPERM), which is the same shape CI runs in.
+ * graceful EPERM), which is the same shape CI runs in. One case needs root and
+ * skips otherwise; the rest hold under either uid, which is why the fixtures that
+ * must look human-owned say so with `ownedByHuman` instead of relying on the
+ * caller's uid.
  */
 import assert from 'node:assert/strict';
-import { chmodSync, mkdirSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
+import {
+  chmodSync,
+  chownSync,
+  mkdirSync,
+  rmSync,
+  statSync,
+  symlinkSync,
+  writeFileSync,
+} from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { test } from 'node:test';
@@ -28,6 +39,16 @@ function scratch(name: string): string {
   return dir;
 }
 
+const RUNNING_AS_ROOT = process.getuid?.() === 0;
+const HUMAN_UID = RUNNING_AS_ROOT ? 1000 : (process.getuid?.() ?? 0);
+const HUMAN_GID = RUNNING_AS_ROOT ? 1000 : (process.getgid?.() ?? 0);
+
+/** Give a fixture a non-root owner, so the repair sees a tree it can hand back. */
+function ownedByHuman(path: string): string {
+  chownSync(path, HUMAN_UID, HUMAN_GID);
+  return path;
+}
+
 test('restores the search bit on a directory that lost it', () => {
   const root = scratch('searchbit');
   const models = join(root, 'agent-output', 'app', 'models');
@@ -77,12 +98,13 @@ test('leaves already-correct trees untouched', () => {
 });
 
 test('does not widen group/other beyond what was already there', () => {
-  const root = scratch('narrow');
+  const root = ownedByHuman(scratch('narrow'));
   const f = join(root, 'secret.txt');
   writeFileSync(f, 'x\n');
+  ownedByHuman(f);
   chmodSync(f, 0o000);
 
-  normalizeTreePermissions(root);
+  normalizeTreePermissions(root, { ownerRef: root });
 
   const mode = statSync(f).mode & 0o777;
   assert.equal(mode, 0o600, 'owner rw only — group/other stay closed');
@@ -155,6 +177,47 @@ test('still normalizes modes when the chown target is root', () => {
   rmSync(root, { recursive: true, force: true });
 });
 
+test('keeps modes narrow for files that have a real owner, even under a root ref', () => {
+  // The complement of the case below: we declined to chown, but these entries are
+  // already the human's, so owner bits reach them and nothing should be widened.
+  const root = ownedByHuman(scratch('root-ref-narrow'));
+  const f = join(root, 'mine.txt');
+  writeFileSync(f, 'x\n');
+  ownedByHuman(f);
+  chmodSync(f, 0o600);
+
+  normalizeTreePermissions(root, { ownerRef: '/' });
+
+  assert.equal(statSync(f).mode & 0o077, 0, 'group/other untouched');
+  rmSync(root, { recursive: true, force: true });
+});
+
+test(
+  'grants read+search to group and other on files stranded root-owned',
+  { skip: process.getuid?.() !== 0 ? 'needs root to create root-owned files' : false },
+  () => {
+    // The worker authoring container: root process, root-owned workspace. The chown
+    // is declined, so owner bits land on root and the human — a different uid in
+    // Explore and on a WSL host — is still locked out of a --w------- capture.
+    const root = scratch('stranded');
+    const sub = join(root, 'agent-output');
+    mkdirSync(sub, { recursive: true });
+    const f = join(sub, 'answer.md');
+    writeFileSync(f, 'x\n');
+    chmodSync(f, 0o200);
+    chmodSync(sub, 0o300);
+
+    normalizeTreePermissions(root, { ownerRef: '/' });
+
+    assert.equal(
+      statSync(f).mode & 0o777,
+      0o644,
+      'file readable by everyone, writable by none but root'
+    );
+    assert.equal(statSync(sub).mode & 0o777, 0o755, 'directory searchable');
+  }
+);
+
 test('walks a tree as deep as the filesystem allows', () => {
   const root = scratch('deep');
   // PATH_MAX caps how deep a tree can physically get (~300 levels at these name