fix(plugin): add native account lookup and portable proof fixtures

Author: kmbroai

plugins/codex-security/native/README.md

@@ -2,7 +2,7 @@
 
 This foundation supplies the descriptor operations that Node does not expose. The SDK and CLI continue to use their existing helpers while Windows primitives and universal package assembly are completed.
 
-The eight Node-API 8 functions are typed in `binding.mts`. Paths remain byte buffers. `statAt` never follows the final symlink; device and inode numbers are decimal strings so JavaScript does not round them. `openAt` and `duplicate` create descriptors with close-on-exec set. Node owns subsequent reads, writes, `fstat`, `fsync`, and close calls.
+The nine Node-API 8 functions are typed in `binding.mts`. Paths remain byte buffers. `statAt` never follows the final symlink; device and inode numbers are decimal strings so JavaScript does not round them. `openAt` and `duplicate` create descriptors with close-on-exec set. Node owns subsequent reads, writes, `fstat`, `fsync`, and close calls. `userHome` looks up raw username bytes through the operating system and returns raw home-directory bytes or a missing result, without Git.
 
 `openAt` and `fileLock` retry EINTR, matching the current Python helpers. Other operations return their native errno. `readDescriptor` retries one interrupted Node read without losing earlier chunks. Blocking locks must run outside the main JavaScript event loop; a process that holds a lock releases it on close or exit. A Python signal handler can raise during a blocked call, so later routing must preserve cancellation through the worker lifecycle.
 
@@ -17,7 +17,7 @@ cargo +1.97.1 fmt --check --manifest-path plugins/codex-security/native/Cargo.to
 cargo +1.97.1 clippy --locked --manifest-path plugins/codex-security/native/Cargo.toml -- -D warnings
 ```
 
-The proof runs without Python. It checks directory replacement, byte paths, unreadable-file metadata, long raw symlinks, descriptor duplication, Node descriptor I/O, contention, unlock, and process-death release. CI invokes it with an empty `PATH`. During migration, the same protocol can compare the existing Python lock helper:
+The proof runs without Python. It checks directory replacement, byte paths, unreadable-file metadata, long raw symlinks, descriptor duplication, Node descriptor I/O, account lookup, contention, unlock, and process-death release. Linux exercises undecodable filename bytes; macOS uses valid UTF-8 filenames required by APFS. CI invokes it with an empty `PATH`. During migration, the same protocol can compare the existing Python lock helper:
 
 ```sh
 node plugins/codex-security/native/proof.mjs python3 plugins/codex-security/scripts

plugins/codex-security/native/binding.mts

@@ -43,6 +43,7 @@ export interface UnixBinding {
     unlock: boolean,
     nonblocking: boolean,
   ): SyscallResult;
+  userHome(username: Buffer): { errno: number; value: Buffer | null };
 }
 
 export function loadBinding(): UnixBinding {

plugins/codex-security/native/proof.mts

@@ -17,7 +17,8 @@ import {
   symlinkSync,
   writeFileSync,
 } from "node:fs";
-import { tmpdir } from "node:os";
+import { tmpdir, userInfo } from "node:os";
+import { randomUUID } from "node:crypto";
 import { basename, join } from "node:path";
 import { createInterface } from "node:readline";
 import { fileURLToPath } from "node:url";
@@ -63,6 +64,41 @@ const readLinkAt = (fd: number, path: string | Buffer) =>
   checked(native.readLinkAt(fd, bytes(path))).value;
 const rawPath = (parent: string, name: Buffer) =>
   Buffer.concat([Buffer.from(parent + "/"), name]);
+// APFS requires valid UTF-8 names; Linux also exercises undecodable bytes.
+const fixtureName = (prefix: string, byte: number) =>
+  process.platform === "darwin"
+    ? Buffer.from(`${prefix}-é`)
+    : Buffer.from([prefix.charCodeAt(0), byte]);
+
+function accountProof() {
+  let currentHomeMatches: boolean | null = null;
+  try {
+    const current = userInfo({ encoding: "buffer" });
+    assert.deepEqual(
+      checked(native.userHome(current.username)).value,
+      current.homedir,
+    );
+    currentHomeMatches = true;
+  } catch (error) {
+    // A container can run a numeric UID with no account database entry.
+    const system = error as { code?: string; info?: { code?: string } };
+    assert.equal(system.code, "ERR_SYSTEM_ERROR");
+    assert.equal(system.info?.code, "ENOENT");
+  }
+  const other = checked(native.userHome(Buffer.from("root"))).value;
+  assert(other !== null && other[0] === 0x2f);
+  assert.equal(
+    checked(native.userHome(Buffer.from(`codex-${randomUUID().slice(0, 8)}`)))
+      .value,
+    null,
+  );
+  assert.throws(() => native.userHome(Buffer.from([0])));
+  return {
+    currentHomeMatches,
+    namedHomeWithoutGit: true,
+    missingAccount: true,
+  };
+}
 
 const directoryFlags =
   constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW;
@@ -109,8 +145,8 @@ function descriptorProof(root: string) {
     const originalParent = keep(openAt(rootFd, "artifacts", directoryFlags));
     const parentFd = keep(duplicate(originalParent));
     close(originalParent);
-    const unreadable = Buffer.from([0x75, 0xff]);
-    const rawLink = Buffer.from([0x6c, 0xfe]);
+    const unreadable = fixtureName("u", 0xff);
+    const rawLink = fixtureName("l", 0xfe);
     const rawTarget = Buffer.concat([
       Buffer.from("component/".repeat(80)),
       Buffer.from([0xff]),
@@ -154,9 +190,9 @@ function descriptorProof(root: string) {
     assert.equal(readLinkAt(rootFd, "artifacts").toString(), outside);
     mkdirAt(parentFd, "nested", 0o700);
 
-    const rawDirectory = Buffer.from([0x64, 0xfd]);
-    const rawSource = Buffer.from([0x73, 0xfc]);
-    const rawDestination = Buffer.from([0x74, 0xfb]);
+    const rawDirectory = fixtureName("d", 0xfd);
+    const rawSource = fixtureName("s", 0xfc);
+    const rawDestination = fixtureName("t", 0xfb);
     mkdirAt(parentFd, rawDirectory, 0o700);
     assert.equal(statAt(parentFd, rawDirectory).mode & 0o777, 0o700);
     const rawDirectoryFd = keep(openAt(parentFd, rawDirectory, directoryFlags));
@@ -445,6 +481,7 @@ if (process.argv[2] === "lock-worker") {
   const root = mkdtempSync(join(tmpdir(), "codex-security-native-"));
   try {
     const descriptors = descriptorProof(root);
+    const accounts = accountProof();
     const locks = await lockProof(root);
     const pythonCompatibility =
       python && scripts ? await lockProof(root, python, scripts) : undefined;
@@ -456,6 +493,7 @@ if (process.argv[2] === "lock-worker") {
           architecture: process.arch,
           nodeApi: 8,
           descriptors,
+          accounts,
           locks,
           pythonCompatibility,
           fixture: basename(root),

plugins/codex-security/native/src/lib.rs

@@ -1,6 +1,9 @@
 use napi::bindgen_prelude::Buffer;
 use napi_derive::napi;
-use std::{ffi::CString, io};
+use std::{
+    ffi::{CStr, CString},
+    io,
+};
 
 #[napi(object)]
 pub struct SyscallResult {
@@ -168,3 +171,43 @@ pub fn read_link_at(directory: i32, name: Buffer) -> napi::Result<ReadLinkResult
         buffer.resize(buffer.len() * 2, 0);
     }
 }
+
+#[napi(object, use_nullable = true)]
+pub struct UserHomeResult {
+    pub errno: i32,
+    pub value: Option<Buffer>,
+}
+
+#[napi]
+pub fn user_home(username: Buffer) -> napi::Result<UserHomeResult> {
+    let username = path(username)?;
+    let mut buffer = vec![0_u8; 1024];
+    loop {
+        let mut entry = std::mem::MaybeUninit::<libc::passwd>::uninit();
+        let mut found = std::ptr::null_mut();
+        let code = unsafe {
+            libc::getpwnam_r(
+                username.as_ptr(),
+                entry.as_mut_ptr(),
+                buffer.as_mut_ptr().cast(),
+                buffer.len(),
+                &mut found,
+            )
+        };
+        if code == libc::ERANGE {
+            buffer.resize(buffer.len() * 2, 0);
+            continue;
+        }
+        let value = if code == 0 && !found.is_null() {
+            Some(
+                unsafe { CStr::from_ptr((*found).pw_dir) }
+                    .to_bytes()
+                    .to_vec()
+                    .into(),
+            )
+        } else {
+            None
+        };
+        return Ok(UserHomeResult { errno: code, value });
+    }
+}