test: anti-regression tests for tarball home directory mirroring

[AhmedTMM]

Summary

• Adds the /root/ → $HOME/ mirroring step in agent-tarball.ts for non-root SSH users (GCP, AWS Lightsail)
• Adds 4 anti-regression tests in a describe("non-root home directory mirroring") block:
  1. Mirrors dotfiles from /root/ to $HOME for non-root users
  2. Mirrors the .spawn-tarball marker file
  3. Returns true even when mirror step fails (non-fatal)
  4. Guards mirror behind non-root check (id -u)

Test plan

• bunx @biomejs/biome check — 0 errors
• bun test src/__tests__/agent-tarball.test.ts — 11 pass
• bun test — 1501 pass, 0 fail

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: 9a8b908

Summary

This PR adds anti-regression tests for tarball home directory mirroring functionality. The changes are test-only additions that verify the security-critical mirroring behavior added to prevent path injection issues.

Security Analysis

agent-tarball.ts (lines 116-135):

• ✅ Non-root check properly uses id -u comparison (shell-safe)
• ✅ Loop variable _d is locally scoped and not user-controlled
• ✅ Source paths use double-quotes with proper escaping: "/root/$_d"
• ✅ Destination paths use double-quotes: "$HOME/$_d"
• ✅ Error suppression 2>/dev/null || true prevents failure propagation (non-fatal by design)
• ✅ No command injection vectors (all paths are literal or shell-safe variables)
• ✅ Hardcoded directory list (no user input): .claude, .local, .npm-global, .cargo, .opencode, .hermes, .bun

agent-tarball.test.ts (lines 172-224):

• ✅ New test suite verifies the mirroring behavior
• ✅ Tests check for proper non-root guard (id -u)
• ✅ Tests verify hardcoded directory list
• ✅ Tests verify non-fatal failure mode (line 205-213)
• ✅ No security regressions introduced

Tests

• bun test: ✅ PASS (11/11 tests)
• biome lint: ✅ PASS (0 errors, 114 files)
• bash -n: N/A (no shell script changes)
• curl|bash: N/A (no shell script changes)
• macOS compat: N/A (no shell script changes)

Findings

No security issues found. The code properly guards against:

• Path traversal (hardcoded directory list)
• Command injection (proper quoting, no user input)
• Privilege escalation (non-root check before mirroring)

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: 4df5a7b

Summary

This PR adds anti-regression tests for tarball home directory mirroring and fixes ownership of mirrored files. The implementation properly addresses file ownership issues when tarballs are extracted as root but accessed by non-root users.

Security Findings

No security issues found.

The changes:

• Add chown -R commands to fix ownership of mirrored dotfiles
• Use safe command substitutions ($(id -u), $(id -g))
• Properly guard operations with error suppression (2>/dev/null || true)
• Execute only in non-root context (guarded by if [ "$(id -u)" != "0" ])
• Use hardcoded directory list (no path traversal risk)

Tests

• bun test: ✅ PASS (12 tests, 28 assertions)
• Command injection: ✅ SAFE - Uses safe command substitutions
• Path traversal: ✅ SAFE - Hardcoded directory list
• Privilege escalation: ✅ SAFE - chown only works on user-owned files in non-root context
• Error handling: ✅ SAFE - Non-fatal failures with proper guards

Code Quality

• Follows project conventions (no try/catch, uses promise chaining)
• Comprehensive test coverage for new functionality
• Well-documented with inline comments

---

-- security/pr-reviewer

[la14-1]

Superseded by #2478 — same functionality (chown fix + tests) but uses the new asyncTryCatch Result helpers from #2477 instead of .then()/.catch() promise patterns.

[AhmedTMM]

Summary

• Adds the /root/ → $HOME/ mirroring step in agent-tarball.ts for non-root SSH users (GCP, AWS Lightsail)
• Adds 4 anti-regression tests in a describe("non-root home directory mirroring") block:
  1. Mirrors dotfiles from /root/ to $HOME for non-root users
  2. Mirrors the .spawn-tarball marker file
  3. Returns true even when mirror step fails (non-fatal)
  4. Guards mirror behind non-root check (id -u)

Test plan

• bunx @biomejs/biome check — 0 errors
• bun test src/__tests__/agent-tarball.test.ts — 11 pass
• bun test — 1501 pass, 0 fail

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: 9a8b908

Summary

This PR adds anti-regression tests for tarball home directory mirroring functionality. The changes are test-only additions that verify the security-critical mirroring behavior added to prevent path injection issues.

Security Analysis

agent-tarball.ts (lines 116-135):

• ✅ Non-root check properly uses id -u comparison (shell-safe)
• ✅ Loop variable _d is locally scoped and not user-controlled
• ✅ Source paths use double-quotes with proper escaping: "/root/$_d"
• ✅ Destination paths use double-quotes: "$HOME/$_d"
• ✅ Error suppression 2>/dev/null || true prevents failure propagation (non-fatal by design)
• ✅ No command injection vectors (all paths are literal or shell-safe variables)
• ✅ Hardcoded directory list (no user input): .claude, .local, .npm-global, .cargo, .opencode, .hermes, .bun

agent-tarball.test.ts (lines 172-224):

• ✅ New test suite verifies the mirroring behavior
• ✅ Tests check for proper non-root guard (id -u)
• ✅ Tests verify hardcoded directory list
• ✅ Tests verify non-fatal failure mode (line 205-213)
• ✅ No security regressions introduced

Tests

• bun test: ✅ PASS (11/11 tests)
• biome lint: ✅ PASS (0 errors, 114 files)
• bash -n: N/A (no shell script changes)
• curl|bash: N/A (no shell script changes)
• macOS compat: N/A (no shell script changes)

Findings

No security issues found. The code properly guards against:

• Path traversal (hardcoded directory list)
• Command injection (proper quoting, no user input)
• Privilege escalation (non-root check before mirroring)

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: 4df5a7b

Summary

This PR adds anti-regression tests for tarball home directory mirroring and fixes ownership of mirrored files. The implementation properly addresses file ownership issues when tarballs are extracted as root but accessed by non-root users.

Security Findings

No security issues found.

The changes:

• Add chown -R commands to fix ownership of mirrored dotfiles
• Use safe command substitutions ($(id -u), $(id -g))
• Properly guard operations with error suppression (2>/dev/null || true)
• Execute only in non-root context (guarded by if [ "$(id -u)" != "0" ])
• Use hardcoded directory list (no path traversal risk)

Tests

• bun test: ✅ PASS (12 tests, 28 assertions)
• Command injection: ✅ SAFE - Uses safe command substitutions
• Path traversal: ✅ SAFE - Hardcoded directory list
• Privilege escalation: ✅ SAFE - chown only works on user-owned files in non-root context
• Error handling: ✅ SAFE - Non-fatal failures with proper guards

Code Quality

• Follows project conventions (no try/catch, uses promise chaining)
• Comprehensive test coverage for new functionality
• Well-documented with inline comments

---

-- security/pr-reviewer

[la14-1]

Superseded by #2478 — same functionality (chown fix + tests) but uses the new asyncTryCatch Result helpers from #2477 instead of .then()/.catch() promise patterns.

[AhmedTMM]

Summary

• Adds the /root/ → $HOME/ mirroring step in agent-tarball.ts for non-root SSH users (GCP, AWS Lightsail)
• Adds 4 anti-regression tests in a describe("non-root home directory mirroring") block:
  1. Mirrors dotfiles from /root/ to $HOME for non-root users
  2. Mirrors the .spawn-tarball marker file
  3. Returns true even when mirror step fails (non-fatal)
  4. Guards mirror behind non-root check (id -u)

Test plan

• bunx @biomejs/biome check — 0 errors
• bun test src/__tests__/agent-tarball.test.ts — 11 pass
• bun test — 1501 pass, 0 fail

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: 9a8b908

Summary

This PR adds anti-regression tests for tarball home directory mirroring functionality. The changes are test-only additions that verify the security-critical mirroring behavior added to prevent path injection issues.

Security Analysis

agent-tarball.ts (lines 116-135):

• ✅ Non-root check properly uses id -u comparison (shell-safe)
• ✅ Loop variable _d is locally scoped and not user-controlled
• ✅ Source paths use double-quotes with proper escaping: "/root/$_d"
• ✅ Destination paths use double-quotes: "$HOME/$_d"
• ✅ Error suppression 2>/dev/null || true prevents failure propagation (non-fatal by design)
• ✅ No command injection vectors (all paths are literal or shell-safe variables)
• ✅ Hardcoded directory list (no user input): .claude, .local, .npm-global, .cargo, .opencode, .hermes, .bun

agent-tarball.test.ts (lines 172-224):

• ✅ New test suite verifies the mirroring behavior
• ✅ Tests check for proper non-root guard (id -u)
• ✅ Tests verify hardcoded directory list
• ✅ Tests verify non-fatal failure mode (line 205-213)
• ✅ No security regressions introduced

Tests

• bun test: ✅ PASS (11/11 tests)
• biome lint: ✅ PASS (0 errors, 114 files)
• bash -n: N/A (no shell script changes)
• curl|bash: N/A (no shell script changes)
• macOS compat: N/A (no shell script changes)

Findings

No security issues found. The code properly guards against:

• Path traversal (hardcoded directory list)
• Command injection (proper quoting, no user input)
• Privilege escalation (non-root check before mirroring)

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: 4df5a7b

Summary

This PR adds anti-regression tests for tarball home directory mirroring and fixes ownership of mirrored files. The implementation properly addresses file ownership issues when tarballs are extracted as root but accessed by non-root users.

Security Findings

No security issues found.

The changes:

• Add chown -R commands to fix ownership of mirrored dotfiles
• Use safe command substitutions ($(id -u), $(id -g))
• Properly guard operations with error suppression (2>/dev/null || true)
• Execute only in non-root context (guarded by if [ "$(id -u)" != "0" ])
• Use hardcoded directory list (no path traversal risk)

Tests

• bun test: ✅ PASS (12 tests, 28 assertions)
• Command injection: ✅ SAFE - Uses safe command substitutions
• Path traversal: ✅ SAFE - Hardcoded directory list
• Privilege escalation: ✅ SAFE - chown only works on user-owned files in non-root context
• Error handling: ✅ SAFE - Non-fatal failures with proper guards

Code Quality

• Follows project conventions (no try/catch, uses promise chaining)
• Comprehensive test coverage for new functionality
• Well-documented with inline comments

---

-- security/pr-reviewer

[la14-1]

Superseded by #2478 — same functionality (chown fix + tests) but uses the new asyncTryCatch Result helpers from #2477 instead of .then()/.catch() promise patterns.

[AhmedTMM]

Summary

• Adds the /root/ → $HOME/ mirroring step in agent-tarball.ts for non-root SSH users (GCP, AWS Lightsail)
• Adds 4 anti-regression tests in a describe("non-root home directory mirroring") block:
  1. Mirrors dotfiles from /root/ to $HOME for non-root users
  2. Mirrors the .spawn-tarball marker file
  3. Returns true even when mirror step fails (non-fatal)
  4. Guards mirror behind non-root check (id -u)

Test plan

• bunx @biomejs/biome check — 0 errors
• bun test src/__tests__/agent-tarball.test.ts — 11 pass
• bun test — 1501 pass, 0 fail

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: 9a8b908

Summary

This PR adds anti-regression tests for tarball home directory mirroring functionality. The changes are test-only additions that verify the security-critical mirroring behavior added to prevent path injection issues.

Security Analysis

agent-tarball.ts (lines 116-135):

• ✅ Non-root check properly uses id -u comparison (shell-safe)
• ✅ Loop variable _d is locally scoped and not user-controlled
• ✅ Source paths use double-quotes with proper escaping: "/root/$_d"
• ✅ Destination paths use double-quotes: "$HOME/$_d"
• ✅ Error suppression 2>/dev/null || true prevents failure propagation (non-fatal by design)
• ✅ No command injection vectors (all paths are literal or shell-safe variables)
• ✅ Hardcoded directory list (no user input): .claude, .local, .npm-global, .cargo, .opencode, .hermes, .bun

agent-tarball.test.ts (lines 172-224):

• ✅ New test suite verifies the mirroring behavior
• ✅ Tests check for proper non-root guard (id -u)
• ✅ Tests verify hardcoded directory list
• ✅ Tests verify non-fatal failure mode (line 205-213)
• ✅ No security regressions introduced

Tests

• bun test: ✅ PASS (11/11 tests)
• biome lint: ✅ PASS (0 errors, 114 files)
• bash -n: N/A (no shell script changes)
• curl|bash: N/A (no shell script changes)
• macOS compat: N/A (no shell script changes)

Findings

No security issues found. The code properly guards against:

• Path traversal (hardcoded directory list)
• Command injection (proper quoting, no user input)
• Privilege escalation (non-root check before mirroring)

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: 4df5a7b

Summary

This PR adds anti-regression tests for tarball home directory mirroring and fixes ownership of mirrored files. The implementation properly addresses file ownership issues when tarballs are extracted as root but accessed by non-root users.

Security Findings

No security issues found.

The changes:

• Add chown -R commands to fix ownership of mirrored dotfiles
• Use safe command substitutions ($(id -u), $(id -g))
• Properly guard operations with error suppression (2>/dev/null || true)
• Execute only in non-root context (guarded by if [ "$(id -u)" != "0" ])
• Use hardcoded directory list (no path traversal risk)

Tests

• bun test: ✅ PASS (12 tests, 28 assertions)
• Command injection: ✅ SAFE - Uses safe command substitutions
• Path traversal: ✅ SAFE - Hardcoded directory list
• Privilege escalation: ✅ SAFE - chown only works on user-owned files in non-root context
• Error handling: ✅ SAFE - Non-fatal failures with proper guards

Code Quality

• Follows project conventions (no try/catch, uses promise chaining)
• Comprehensive test coverage for new functionality
• Well-documented with inline comments

---

-- security/pr-reviewer

[la14-1]

Superseded by #2478 — same functionality (chown fix + tests) but uses the new asyncTryCatch Result helpers from #2477 instead of .then()/.catch() promise patterns.

[AhmedTMM]

Summary

• Adds the /root/ → $HOME/ mirroring step in agent-tarball.ts for non-root SSH users (GCP, AWS Lightsail)
• Adds 4 anti-regression tests in a describe("non-root home directory mirroring") block:
  1. Mirrors dotfiles from /root/ to $HOME for non-root users
  2. Mirrors the .spawn-tarball marker file
  3. Returns true even when mirror step fails (non-fatal)
  4. Guards mirror behind non-root check (id -u)

Test plan

• bunx @biomejs/biome check — 0 errors
• bun test src/__tests__/agent-tarball.test.ts — 11 pass
• bun test — 1501 pass, 0 fail

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: 9a8b908

Summary

This PR adds anti-regression tests for tarball home directory mirroring functionality. The changes are test-only additions that verify the security-critical mirroring behavior added to prevent path injection issues.

Security Analysis

agent-tarball.ts (lines 116-135):

• ✅ Non-root check properly uses id -u comparison (shell-safe)
• ✅ Loop variable _d is locally scoped and not user-controlled
• ✅ Source paths use double-quotes with proper escaping: "/root/$_d"
• ✅ Destination paths use double-quotes: "$HOME/$_d"
• ✅ Error suppression 2>/dev/null || true prevents failure propagation (non-fatal by design)
• ✅ No command injection vectors (all paths are literal or shell-safe variables)
• ✅ Hardcoded directory list (no user input): .claude, .local, .npm-global, .cargo, .opencode, .hermes, .bun

agent-tarball.test.ts (lines 172-224):

• ✅ New test suite verifies the mirroring behavior
• ✅ Tests check for proper non-root guard (id -u)
• ✅ Tests verify hardcoded directory list
• ✅ Tests verify non-fatal failure mode (line 205-213)
• ✅ No security regressions introduced

Tests

• bun test: ✅ PASS (11/11 tests)
• biome lint: ✅ PASS (0 errors, 114 files)
• bash -n: N/A (no shell script changes)
• curl|bash: N/A (no shell script changes)
• macOS compat: N/A (no shell script changes)

Findings

No security issues found. The code properly guards against:

• Path traversal (hardcoded directory list)
• Command injection (proper quoting, no user input)
• Privilege escalation (non-root check before mirroring)

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: 4df5a7b

Summary

This PR adds anti-regression tests for tarball home directory mirroring and fixes ownership of mirrored files. The implementation properly addresses file ownership issues when tarballs are extracted as root but accessed by non-root users.

Security Findings

No security issues found.

The changes:

• Add chown -R commands to fix ownership of mirrored dotfiles
• Use safe command substitutions ($(id -u), $(id -g))
• Properly guard operations with error suppression (2>/dev/null || true)
• Execute only in non-root context (guarded by if [ "$(id -u)" != "0" ])
• Use hardcoded directory list (no path traversal risk)

Tests

• bun test: ✅ PASS (12 tests, 28 assertions)
• Command injection: ✅ SAFE - Uses safe command substitutions
• Path traversal: ✅ SAFE - Hardcoded directory list
• Privilege escalation: ✅ SAFE - chown only works on user-owned files in non-root context
• Error handling: ✅ SAFE - Non-fatal failures with proper guards

Code Quality

• Follows project conventions (no try/catch, uses promise chaining)
• Comprehensive test coverage for new functionality
• Well-documented with inline comments

---

-- security/pr-reviewer

[la14-1]

Superseded by #2478 — same functionality (chown fix + tests) but uses the new asyncTryCatch Result helpers from #2477 instead of .then()/.catch() promise patterns.

[AhmedTMM]

Summary

• Adds the /root/ → $HOME/ mirroring step in agent-tarball.ts for non-root SSH users (GCP, AWS Lightsail)
• Adds 4 anti-regression tests in a describe("non-root home directory mirroring") block:
  1. Mirrors dotfiles from /root/ to $HOME for non-root users
  2. Mirrors the .spawn-tarball marker file
  3. Returns true even when mirror step fails (non-fatal)
  4. Guards mirror behind non-root check (id -u)

Test plan

• bunx @biomejs/biome check — 0 errors
• bun test src/__tests__/agent-tarball.test.ts — 11 pass
• bun test — 1501 pass, 0 fail

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: 9a8b908

Summary

This PR adds anti-regression tests for tarball home directory mirroring functionality. The changes are test-only additions that verify the security-critical mirroring behavior added to prevent path injection issues.

Security Analysis

agent-tarball.ts (lines 116-135):

• ✅ Non-root check properly uses id -u comparison (shell-safe)
• ✅ Loop variable _d is locally scoped and not user-controlled
• ✅ Source paths use double-quotes with proper escaping: "/root/$_d"
• ✅ Destination paths use double-quotes: "$HOME/$_d"
• ✅ Error suppression 2>/dev/null || true prevents failure propagation (non-fatal by design)
• ✅ No command injection vectors (all paths are literal or shell-safe variables)
• ✅ Hardcoded directory list (no user input): .claude, .local, .npm-global, .cargo, .opencode, .hermes, .bun

agent-tarball.test.ts (lines 172-224):

• ✅ New test suite verifies the mirroring behavior
• ✅ Tests check for proper non-root guard (id -u)
• ✅ Tests verify hardcoded directory list
• ✅ Tests verify non-fatal failure mode (line 205-213)
• ✅ No security regressions introduced

Tests

• bun test: ✅ PASS (11/11 tests)
• biome lint: ✅ PASS (0 errors, 114 files)
• bash -n: N/A (no shell script changes)
• curl|bash: N/A (no shell script changes)
• macOS compat: N/A (no shell script changes)

Findings

No security issues found. The code properly guards against:

• Path traversal (hardcoded directory list)
• Command injection (proper quoting, no user input)
• Privilege escalation (non-root check before mirroring)

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: 4df5a7b

Summary

This PR adds anti-regression tests for tarball home directory mirroring and fixes ownership of mirrored files. The implementation properly addresses file ownership issues when tarballs are extracted as root but accessed by non-root users.

Security Findings

No security issues found.

The changes:

• Add chown -R commands to fix ownership of mirrored dotfiles
• Use safe command substitutions ($(id -u), $(id -g))
• Properly guard operations with error suppression (2>/dev/null || true)
• Execute only in non-root context (guarded by if [ "$(id -u)" != "0" ])
• Use hardcoded directory list (no path traversal risk)

Tests

• bun test: ✅ PASS (12 tests, 28 assertions)
• Command injection: ✅ SAFE - Uses safe command substitutions
• Path traversal: ✅ SAFE - Hardcoded directory list
• Privilege escalation: ✅ SAFE - chown only works on user-owned files in non-root context
• Error handling: ✅ SAFE - Non-fatal failures with proper guards

Code Quality

• Follows project conventions (no try/catch, uses promise chaining)
• Comprehensive test coverage for new functionality
• Well-documented with inline comments

---

-- security/pr-reviewer

[la14-1]

Superseded by #2478 — same functionality (chown fix + tests) but uses the new asyncTryCatch Result helpers from #2477 instead of .then()/.catch() promise patterns.

[AhmedTMM]

Summary

• Adds the /root/ → $HOME/ mirroring step in agent-tarball.ts for non-root SSH users (GCP, AWS Lightsail)
• Adds 4 anti-regression tests in a describe("non-root home directory mirroring") block:
  1. Mirrors dotfiles from /root/ to $HOME for non-root users
  2. Mirrors the .spawn-tarball marker file
  3. Returns true even when mirror step fails (non-fatal)
  4. Guards mirror behind non-root check (id -u)

Test plan

• bunx @biomejs/biome check — 0 errors
• bun test src/__tests__/agent-tarball.test.ts — 11 pass
• bun test — 1501 pass, 0 fail

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: 9a8b908

Summary

This PR adds anti-regression tests for tarball home directory mirroring functionality. The changes are test-only additions that verify the security-critical mirroring behavior added to prevent path injection issues.

Security Analysis

agent-tarball.ts (lines 116-135):

• ✅ Non-root check properly uses id -u comparison (shell-safe)
• ✅ Loop variable _d is locally scoped and not user-controlled
• ✅ Source paths use double-quotes with proper escaping: "/root/$_d"
• ✅ Destination paths use double-quotes: "$HOME/$_d"
• ✅ Error suppression 2>/dev/null || true prevents failure propagation (non-fatal by design)
• ✅ No command injection vectors (all paths are literal or shell-safe variables)
• ✅ Hardcoded directory list (no user input): .claude, .local, .npm-global, .cargo, .opencode, .hermes, .bun

agent-tarball.test.ts (lines 172-224):

• ✅ New test suite verifies the mirroring behavior
• ✅ Tests check for proper non-root guard (id -u)
• ✅ Tests verify hardcoded directory list
• ✅ Tests verify non-fatal failure mode (line 205-213)
• ✅ No security regressions introduced

Tests

• bun test: ✅ PASS (11/11 tests)
• biome lint: ✅ PASS (0 errors, 114 files)
• bash -n: N/A (no shell script changes)
• curl|bash: N/A (no shell script changes)
• macOS compat: N/A (no shell script changes)

Findings

No security issues found. The code properly guards against:

• Path traversal (hardcoded directory list)
• Command injection (proper quoting, no user input)
• Privilege escalation (non-root check before mirroring)

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: 4df5a7b

Summary

This PR adds anti-regression tests for tarball home directory mirroring and fixes ownership of mirrored files. The implementation properly addresses file ownership issues when tarballs are extracted as root but accessed by non-root users.

Security Findings

No security issues found.

The changes:

• Add chown -R commands to fix ownership of mirrored dotfiles
• Use safe command substitutions ($(id -u), $(id -g))
• Properly guard operations with error suppression (2>/dev/null || true)
• Execute only in non-root context (guarded by if [ "$(id -u)" != "0" ])
• Use hardcoded directory list (no path traversal risk)

Tests

• bun test: ✅ PASS (12 tests, 28 assertions)
• Command injection: ✅ SAFE - Uses safe command substitutions
• Path traversal: ✅ SAFE - Hardcoded directory list
• Privilege escalation: ✅ SAFE - chown only works on user-owned files in non-root context
• Error handling: ✅ SAFE - Non-fatal failures with proper guards

Code Quality

• Follows project conventions (no try/catch, uses promise chaining)
• Comprehensive test coverage for new functionality
• Well-documented with inline comments

---

-- security/pr-reviewer

[la14-1]

Superseded by #2478 — same functionality (chown fix + tests) but uses the new asyncTryCatch Result helpers from #2477 instead of .then()/.catch() promise patterns.

[AhmedTMM]

Summary

• Adds the /root/ → $HOME/ mirroring step in agent-tarball.ts for non-root SSH users (GCP, AWS Lightsail)
• Adds 4 anti-regression tests in a describe("non-root home directory mirroring") block:
  1. Mirrors dotfiles from /root/ to $HOME for non-root users
  2. Mirrors the .spawn-tarball marker file
  3. Returns true even when mirror step fails (non-fatal)
  4. Guards mirror behind non-root check (id -u)

Test plan

• bunx @biomejs/biome check — 0 errors
• bun test src/__tests__/agent-tarball.test.ts — 11 pass
• bun test — 1501 pass, 0 fail

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: 9a8b908

Summary

This PR adds anti-regression tests for tarball home directory mirroring functionality. The changes are test-only additions that verify the security-critical mirroring behavior added to prevent path injection issues.

Security Analysis

agent-tarball.ts (lines 116-135):

• ✅ Non-root check properly uses id -u comparison (shell-safe)
• ✅ Loop variable _d is locally scoped and not user-controlled
• ✅ Source paths use double-quotes with proper escaping: "/root/$_d"
• ✅ Destination paths use double-quotes: "$HOME/$_d"
• ✅ Error suppression 2>/dev/null || true prevents failure propagation (non-fatal by design)
• ✅ No command injection vectors (all paths are literal or shell-safe variables)
• ✅ Hardcoded directory list (no user input): .claude, .local, .npm-global, .cargo, .opencode, .hermes, .bun

agent-tarball.test.ts (lines 172-224):

• ✅ New test suite verifies the mirroring behavior
• ✅ Tests check for proper non-root guard (id -u)
• ✅ Tests verify hardcoded directory list
• ✅ Tests verify non-fatal failure mode (line 205-213)
• ✅ No security regressions introduced

Tests

• bun test: ✅ PASS (11/11 tests)
• biome lint: ✅ PASS (0 errors, 114 files)
• bash -n: N/A (no shell script changes)
• curl|bash: N/A (no shell script changes)
• macOS compat: N/A (no shell script changes)

Findings

No security issues found. The code properly guards against:

• Path traversal (hardcoded directory list)
• Command injection (proper quoting, no user input)
• Privilege escalation (non-root check before mirroring)

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: 4df5a7b

Summary

This PR adds anti-regression tests for tarball home directory mirroring and fixes ownership of mirrored files. The implementation properly addresses file ownership issues when tarballs are extracted as root but accessed by non-root users.

Security Findings

No security issues found.

The changes:

• Add chown -R commands to fix ownership of mirrored dotfiles
• Use safe command substitutions ($(id -u), $(id -g))
• Properly guard operations with error suppression (2>/dev/null || true)
• Execute only in non-root context (guarded by if [ "$(id -u)" != "0" ])
• Use hardcoded directory list (no path traversal risk)

Tests

• bun test: ✅ PASS (12 tests, 28 assertions)
• Command injection: ✅ SAFE - Uses safe command substitutions
• Path traversal: ✅ SAFE - Hardcoded directory list
• Privilege escalation: ✅ SAFE - chown only works on user-owned files in non-root context
• Error handling: ✅ SAFE - Non-fatal failures with proper guards

Code Quality

• Follows project conventions (no try/catch, uses promise chaining)
• Comprehensive test coverage for new functionality
• Well-documented with inline comments

---

-- security/pr-reviewer

[la14-1]

Superseded by #2478 — same functionality (chown fix + tests) but uses the new asyncTryCatch Result helpers from #2477 instead of .then()/.catch() promise patterns.