use std::collections::HashMap;
use std::sync::LazyLock;
use serde::Deserialize;
use crate::engine::facet::{FacetTerm, LocalLocus};
#[derive(Debug, Clone, Copy, PartialEq)]
pub(crate) enum Frozen {
Nothing,
Rebind,
Write,
}
#[derive(Debug, Clone, Copy)]
pub(crate) struct Role {
pub read_locus: LocalLocus,
pub write_locus: LocalLocus,
pub rebind_locus: LocalLocus,
pub reads_secret: bool,
pub frozen: Frozen,
}
impl Role {
fn write_grantable(&self) -> bool {
self.frozen != Frozen::Write && self.write_locus < LocalLocus::SystemIntegrity
}
fn rebind_grantable(&self) -> bool {
self.frozen == Frozen::Nothing && self.write_locus < LocalLocus::SystemIntegrity
}
}
#[derive(Deserialize)]
struct RegionsFile {
#[serde(default)]
role: HashMap<String, RoleDef>,
#[serde(default)]
region: Vec<RegionDef>,
}
#[derive(Deserialize)]
struct RoleDef {
read_locus: String,
write_locus: String,
#[serde(default)]
rebind_locus: Option<String>,
#[serde(default)]
reads_secret: bool,
#[serde(default)]
frozen: Option<String>,
#[serde(default)]
#[allow(dead_code)] description: String,
}
#[derive(Deserialize)]
struct RegionDef {
path: String,
role: String,
os: Option<Vec<String>>,
#[serde(default)]
#[allow(dead_code)]
note: String,
#[serde(default)]
#[allow(dead_code)]
researched: String,
}
enum Matcher {
Exact(String),
Prefix(String),
StringPrefix(String),
Segment(String),
Glob(Vec<String>),
}
impl Matcher {
fn from_path(path: &str) -> Matcher {
if let Some(p) = path.strip_suffix('*') {
Matcher::StringPrefix(p.to_string())
} else if path.contains('*') {
Matcher::Glob(path.split('/').map(str::to_string).collect())
} else if path.ends_with('/') {
Matcher::Prefix(path.to_string())
} else if path.starts_with('/') || path.starts_with('~') {
Matcher::Exact(path.to_string())
} else {
Matcher::Segment(path.to_string())
}
}
fn specificity(&self, path: &str, fold: bool) -> Option<usize> {
let eq = |a: &str, b: &str| if fold { a.eq_ignore_ascii_case(b) } else { a == b };
let starts = |h: &str, p: &str| if fold { ci_starts_with(h, p) } else { h.starts_with(p) };
match self {
Matcher::Exact(s) => eq(path, s).then_some(1_000_000 + s.len()),
Matcher::Prefix(s) => {
let dir = s.strip_suffix('/').unwrap_or(s);
(starts(path, s.as_str()) || eq(path, dir)).then_some(1_000 + s.len())
}
Matcher::StringPrefix(s) => starts(path, s.as_str()).then_some(1_000 + s.len()),
Matcher::Segment(seg) => path.split('/').any(|c| eq(c, seg)).then_some(seg.len()),
Matcher::Glob(pat) => {
let comps: Vec<&str> = path.split('/').collect();
(comps.len() == pat.len()
&& pat.iter().zip(&comps).all(|(p, c)| p == "*" || eq(c, p)))
.then_some(10_000 + path.len())
}
}
}
fn remainder<'a>(&self, path: &'a str) -> &'a str {
match self {
Matcher::Prefix(s) | Matcher::StringPrefix(s) => path.strip_prefix(s.as_str()).unwrap_or(""),
Matcher::Exact(_) => "",
Matcher::Glob(_) => "",
Matcher::Segment(_) => path,
}
}
fn root_in(&self, path: &str, fold: bool) -> Option<String> {
self.specificity(path, fold)?;
Some(match self {
Matcher::Exact(s) => s.clone(),
Matcher::Prefix(s) => s.strip_suffix('/').unwrap_or(s).to_string(),
Matcher::StringPrefix(s) => s.clone(),
Matcher::Glob(_) => path.to_string(),
Matcher::Segment(seg) => {
let eq = |a: &str, b: &str| if fold { a.eq_ignore_ascii_case(b) } else { a == b };
let mut offset = 0usize;
let mut end = None;
for comp in path.split('/') {
if eq(comp, seg) {
end = Some(offset + comp.len());
break;
}
offset += comp.len() + 1;
}
path[..end?].to_string()
}
})
}
}
fn at_or_below(inner: &str, outer: &str) -> bool {
let inner = inner.trim_end_matches('/');
let outer = outer.trim_end_matches('/');
if outer.is_empty() {
return false;
}
inner == outer || inner.strip_prefix(outer).is_some_and(|rest| rest.starts_with('/'))
}
fn has_hidden_component(remainder: &str) -> bool {
remainder.split('/').any(|seg| seg.len() > 1 && seg.starts_with('.'))
}
fn ci_starts_with(haystack: &str, prefix: &str) -> bool {
haystack.len() >= prefix.len()
&& haystack.as_bytes()[..prefix.len()].eq_ignore_ascii_case(prefix.as_bytes())
}
fn role_is_protective(role: &Role) -> bool {
role.reads_secret
|| role.frozen != Frozen::Nothing
|| role.write_locus > LocalLocus::Worktree
|| role.read_locus > LocalLocus::WorktreeTrusted
}
struct Node {
matcher: Matcher,
role: Role,
os: Option<Vec<String>>,
fold: bool,
}
impl Node {
fn applies_here(&self) -> bool {
if self.role.reads_secret {
return true;
}
match &self.os {
None => true,
Some(list) => list.iter().any(|o| o == current_os()),
}
}
}
#[cfg(test)]
thread_local! {
static OS_OVERRIDE: std::cell::Cell<Option<&'static str>> = const { std::cell::Cell::new(None) };
}
#[cfg(test)]
pub(crate) fn with_os<T>(os: &'static str, f: impl FnOnce() -> T) -> T {
struct Reset(Option<&'static str>);
impl Drop for Reset {
fn drop(&mut self) {
OS_OVERRIDE.with(|c| c.set(self.0));
}
}
let _reset = Reset(OS_OVERRIDE.with(|c| c.replace(Some(os))));
f()
}
pub(super) fn current_os() -> &'static str {
#[cfg(test)]
if let Some(o) = OS_OVERRIDE.with(std::cell::Cell::get) {
return o;
}
std::env::consts::OS
}
struct Regions {
nodes: Vec<Node>,
worktree: Role,
unknown: Role,
}
fn parse_locus(s: &str) -> LocalLocus {
LocalLocus::from_term(s).unwrap_or_else(|| panic!("regions: unknown locus rung `{s}`"))
}
static REGIONS: LazyLock<Regions> = LazyLock::new(|| {
let src = include_str!("../../../regions/default.toml");
let file: RegionsFile = toml::from_str(src).expect("regions/default.toml is invalid TOML");
let role_of = |name: &str| -> Role {
let def = file
.role
.get(name)
.unwrap_or_else(|| panic!("regions: role `{name}` is not defined"));
let write_locus = parse_locus(&def.write_locus);
Role {
read_locus: parse_locus(&def.read_locus),
write_locus,
rebind_locus: def.rebind_locus.as_deref().map(parse_locus).unwrap_or(write_locus),
reads_secret: def.reads_secret,
frozen: match def.frozen.as_deref() {
None => Frozen::Nothing,
Some("rebind") => Frozen::Rebind,
Some("write") => Frozen::Write,
Some(other) => panic!("regions: role `{name}` has unknown frozen face `{other}` (known: rebind, write)"),
},
}
};
let nodes = file
.region
.iter()
.map(|r| {
let role = role_of(&r.role);
Node {
matcher: Matcher::from_path(&r.path),
role,
os: r.os.clone(),
fold: role_is_protective(&role),
}
})
.collect();
Regions {
nodes,
worktree: role_of("worktree"),
unknown: role_of("unknown"),
}
});
#[derive(Clone, Copy, PartialEq)]
enum GrantSource {
UserConfig,
Derived,
}
struct Grant {
matcher: Matcher,
read: bool,
write: bool,
source: GrantSource,
}
#[cfg(not(test))]
#[derive(Deserialize)]
struct GrantEntry {
path: String,
#[serde(default)]
read: bool,
#[serde(default)]
write: bool,
}
#[cfg(not(test))]
#[derive(Deserialize)]
struct GrantFile {
#[serde(default)]
grant: Vec<GrantEntry>,
}
#[cfg(not(test))]
fn load_user_grants() -> Vec<Grant> {
if std::env::var_os("SAFE_CHAINS_NO_LOCAL").is_some() {
return Vec::new();
}
let Some(home) = std::env::var_os("HOME").map(std::path::PathBuf::from) else {
return Vec::new();
};
let mut grants = Vec::new();
if let Ok(src) = std::fs::read_to_string(home.join(".config/safe-chains.toml")) {
grants.extend(
toml::from_str::<GrantFile>(&src)
.map(|f| f.grant)
.unwrap_or_default()
.into_iter()
.flat_map(|g| {
grant_matchers(&g.path)
.into_iter()
.map(move |m| Grant { matcher: m, read: g.read, write: g.write, source: GrantSource::UserConfig })
}),
);
}
if crate::claude_config_trusted() {
grants.extend(claude_settings_read_grants(&home));
}
grants
}
fn translate_read_pattern(inner: &str) -> Option<String> {
let inner = inner.trim();
let base = if let Some(rest) = inner.strip_prefix("//") {
format!("/{rest}")
} else if inner == "~" || inner.starts_with("~/") {
inner.to_string()
} else {
return None;
};
let mut prefix = base.as_str();
let mut had_glob = false;
while let Some(p) = prefix.strip_suffix("/**").or_else(|| prefix.strip_suffix("/*")) {
prefix = p;
had_glob = true;
}
let prefix = prefix.strip_suffix('/').unwrap_or(prefix);
if prefix.contains(['*', '?']) || prefix.is_empty() || prefix == "/" || prefix == "~" {
return None;
}
Some(if had_glob { format!("{prefix}/") } else { prefix.to_string() })
}
fn claude_read_grant_paths(settings_json: &str) -> Vec<String> {
let Ok(value) = serde_json::from_str::<serde_json::Value>(settings_json) else {
return Vec::new();
};
let Some(arr) = value
.get("permissions")
.and_then(|v| v.get("allow"))
.and_then(|v| v.as_array())
else {
return Vec::new();
};
arr.iter()
.filter_map(|e| e.as_str())
.filter_map(|entry| entry.strip_prefix("Read(").and_then(|s| s.strip_suffix(')')))
.filter_map(translate_read_pattern)
.collect()
}
fn claude_settings_read_grants(home: &std::path::Path) -> Vec<Grant> {
let Ok(src) = std::fs::read_to_string(home.join(".claude/settings.json")) else {
return Vec::new();
};
claude_read_grant_paths(&src)
.into_iter()
.flat_map(|p| {
grant_matchers(&p)
.into_iter()
.map(|m| Grant { matcher: m, read: true, write: false, source: GrantSource::Derived })
})
.collect()
}
fn grant_matchers(path: &str) -> Vec<Matcher> {
let home = || std::env::var_os("HOME").and_then(|h| h.into_string().ok());
let mut out = vec![Matcher::from_path(&as_subtree(path))];
if let Some(rest) = path.strip_prefix('~') {
if let Some(h) = home() {
out.push(Matcher::from_path(&as_subtree(&format!("{h}{rest}"))));
}
} else if let Some(h) = home()
&& let Some(rest) = path.strip_prefix(h.as_str())
{
out.push(Matcher::from_path(&as_subtree(&format!("~{rest}"))));
}
out
}
fn as_subtree(path: &str) -> String {
if path.ends_with('*') || path.ends_with('/') { path.to_string() } else { format!("{path}/") }
}
#[cfg(not(test))]
static USER_GRANTS: LazyLock<Vec<Grant>> = LazyLock::new(load_user_grants);
#[cfg(test)]
thread_local! {
static TEST_GRANTS: std::cell::RefCell<Vec<Grant>> = const { std::cell::RefCell::new(Vec::new()) };
}
#[cfg(test)]
pub(crate) fn with_grants<T>(grants: &[(&str, bool, bool)], f: impl FnOnce() -> T) -> T {
with_grants_of_kind(grants, GrantSource::UserConfig, f)
}
#[cfg(test)]
pub(crate) fn with_derived_grants<T>(grants: &[(&str, bool, bool)], f: impl FnOnce() -> T) -> T {
with_grants_of_kind(grants, GrantSource::Derived, f)
}
#[cfg(test)]
fn with_grants_of_kind<T>(grants: &[(&str, bool, bool)], source: GrantSource, f: impl FnOnce() -> T) -> T {
let parsed = grants
.iter()
.flat_map(|&(p, read, write)| {
grant_matchers(p).into_iter().map(move |m| Grant { matcher: m, read, write, source })
})
.collect();
TEST_GRANTS.with(|g| *g.borrow_mut() = parsed);
let out = f();
TEST_GRANTS.with(|g| g.borrow_mut().clear());
out
}
fn best_grant(path: &str, secret_root: Option<&str>) -> Option<(bool, bool)> {
let pick = |grants: &[Grant]| {
grants
.iter()
.filter_map(|g| {
let spec = g.matcher.specificity(path, false)?;
if let Some(root) = secret_root {
if g.source != GrantSource::UserConfig {
return None;
}
let grant_root = g.matcher.root_in(path, false)?;
if !at_or_below(&grant_root, root) {
return None;
}
}
(!has_hidden_component(g.matcher.remainder(path))).then_some((spec, g.read, g.write))
})
.max_by_key(|&(s, ..)| s)
.map(|(_, r, w)| (r, w))
};
#[cfg(test)]
{
TEST_GRANTS.with(|g| pick(&g.borrow()))
}
#[cfg(not(test))]
{
pick(&USER_GRANTS)
}
}
fn apply_grant(path: &str, base: Role) -> Role {
let secret_root = if base.reads_secret {
match secret_node_root(path) {
Some(root) => Some(root),
None => return base,
}
} else {
None
};
let Some((read, write)) = best_grant(path, secret_root.as_deref()) else {
return base;
};
Role {
read_locus: if read { base.read_locus.min(LocalLocus::WorktreeTrusted) } else { base.read_locus },
write_locus: if write && base.write_grantable() {
base.write_locus.min(LocalLocus::Worktree)
} else {
base.write_locus
},
rebind_locus: if write && base.rebind_grantable() {
base.rebind_locus.min(LocalLocus::Worktree)
} else {
base.rebind_locus
},
reads_secret: base.reads_secret && !read,
frozen: base.frozen,
}
}
pub(crate) fn classify_region(path: &str) -> Role {
let path = &super::locus::canonicalize(path);
if let Some(role) = scratchpad_role(path) {
return role;
}
apply_grant(path, base_region(path))
}
fn scratchpad_role(path: &str) -> Option<Role> {
crate::pathctx::in_session_scratchpad(path).then_some(Role {
read_locus: LocalLocus::SandboxScope,
write_locus: LocalLocus::SandboxScope,
rebind_locus: LocalLocus::SandboxScope,
reads_secret: false,
frozen: Frozen::Nothing,
})
}
fn secret_node(path: &str) -> Option<&'static Node> {
shield_spellings(path).into_iter().find_map(|p| {
REGIONS
.nodes
.iter()
.filter(|n| n.applies_here() && n.role.reads_secret)
.find(|n| n.matcher.specificity(&p, n.fold && current_os() == "macos").is_some())
})
}
fn shield_spellings(path: &str) -> Vec<String> {
let mut out = vec![path.to_string()];
if let Some(folded) = super::locus::firmlink_fold_case_insensitive(path)
&& folded != path
{
out.push(folded);
}
out
}
fn secret_node_root(path: &str) -> Option<String> {
let fold_shields = current_os() == "macos";
shield_spellings(path)
.iter()
.flat_map(|p| {
REGIONS
.nodes
.iter()
.filter(|n| n.applies_here() && n.role.reads_secret)
.filter_map(move |n| n.matcher.root_in(p, n.fold && fold_shields))
})
.max_by_key(|r| (r.split('/').count(), r.len()))
}
fn base_region(path: &str) -> Role {
let r = &*REGIONS;
let fold_shields = current_os() == "macos";
if let Some(node) = secret_node(path) {
return node.role;
}
let mut best: Option<(usize, Role)> = None;
for node in &r.nodes {
if !node.applies_here() {
continue;
}
let Some(spec) = node.matcher.specificity(path, node.fold && fold_shields) else {
continue;
};
let take = match best {
None => true,
Some((bs, br)) => spec > bs || (spec == bs && more_restrictive(node.role, br)),
};
if take {
best = Some((spec, node.role));
}
}
if let Some((_, role)) = best {
return role;
}
if path.starts_with('/') || path.starts_with('~') {
adjacent_role(path)
.or_else(|| other_user_home_role(path))
.or_else(|| home_role(path))
.unwrap_or(r.unknown)
} else {
r.worktree
}
}
fn other_user_home_role(path: &str) -> Option<Role> {
let tilde_named = path.strip_prefix('~').is_some_and(|r| !r.is_empty() && !r.starts_with('/'));
(tilde_named || absolute_other_home(path)).then_some(Role {
read_locus: LocalLocus::Machine,
write_locus: LocalLocus::Machine,
rebind_locus: LocalLocus::Machine,
reads_secret: true,
frozen: Frozen::Nothing,
})
}
fn absolute_other_home(path: &str) -> bool {
let home = std::env::var("HOME").unwrap_or_default();
let ours = home.rsplit_once('/').map(|(_, name)| name).unwrap_or_default();
["/Users", "/home"].iter().any(|parent| {
path.strip_prefix(parent)
.and_then(|r| r.strip_prefix('/'))
.and_then(|r| r.split('/').next())
.is_some_and(|user| !user.is_empty() && (ours.is_empty() || user != ours))
})
}
fn home_role(path: &str) -> Option<Role> {
if path != "~" && !path.starts_with("~/") {
return None;
}
Some(Role {
read_locus: LocalLocus::User,
write_locus: LocalLocus::Machine,
rebind_locus: LocalLocus::Machine,
reads_secret: false,
frozen: Frozen::Nothing,
})
}
fn adjacent_role(path: &str) -> Option<Role> {
matches!(peer_kind(path), PeerKind::Ordinary).then_some(Role {
read_locus: LocalLocus::Adjacent,
write_locus: LocalLocus::Adjacent,
rebind_locus: LocalLocus::Adjacent,
reads_secret: false,
frozen: Frozen::Nothing,
})
}
#[cfg(test)]
pub(crate) fn declared_region_paths() -> Vec<String> {
let src = include_str!("../../../regions/default.toml");
let file: RegionsFile = toml::from_str(src).expect("regions/default.toml is invalid TOML");
file.region.into_iter().map(|r| r.path).collect()
}
enum PeerKind {
Ordinary,
NotPeer,
}
fn peer_kind(path: &str) -> PeerKind {
let Some(home) = std::env::var("HOME").ok().filter(|h| h.starts_with('/')) else {
return PeerKind::NotPeer;
};
let Some(root_raw) = crate::pathctx::root() else {
return PeerKind::NotPeer;
};
let root = if root_raw == home {
"~".to_string()
} else if let Some(rest) = root_raw.strip_prefix(&home).filter(|r| r.starts_with('/')) {
format!("~{rest}")
} else if root_raw.starts_with('~') {
root_raw
} else {
return PeerKind::NotPeer; };
let root = root.trim_end_matches('/');
let Some(stripped) = root.strip_prefix("~/") else {
return PeerKind::NotPeer;
};
let comps: Vec<&str> = stripped.split('/').filter(|s| !s.is_empty()).collect();
let Some(last) = comps.last().filter(|_| comps.len() >= 2) else {
return PeerKind::NotPeer;
};
let parent = &root[..root.len() - last.len() - 1]; let Some(under_parent) = path.strip_prefix(parent).filter(|r| r.starts_with('/')) else {
return PeerKind::NotPeer;
};
if path == root || path.strip_prefix(root).is_some_and(|r| r.starts_with('/')) {
return PeerKind::NotPeer;
}
let _ = under_parent;
PeerKind::Ordinary
}
fn more_restrictive(a: Role, b: Role) -> bool {
(a.write_locus, a.read_locus) > (b.write_locus, b.read_locus)
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn the_region_file_compiles_and_defaults_exist() {
let _ = classify_region("/etc/hosts");
assert_eq!(classify_region("relative/file.txt").write_locus, LocalLocus::Worktree);
assert_eq!(classify_region("/some/unmapped/path").write_locus, LocalLocus::Machine);
assert_eq!(classify_region("/some/unmapped/path").read_locus, LocalLocus::Machine);
}
#[test]
fn system_integrity_substrate_write_worst_cases_above_machine() {
for p in ["/etc/passwd", "/etc/group", "/etc/sudoers", "/etc/sudoers.d/pkg", "/etc/pam.d/sshd"] {
assert_eq!(classify_region(p).write_locus, LocalLocus::SystemIntegrity, "write {p}");
assert_eq!(classify_region(p).read_locus, LocalLocus::Machine, "read {p}");
}
assert_eq!(classify_region("/etc/nginx/nginx.conf").write_locus, LocalLocus::Machine, "ordinary /etc stays machine");
assert_eq!(classify_region("/usr/local/bin/tool").write_locus, LocalLocus::Machine, "/usr/local is admin-managed, stays machine");
}
#[test]
fn adjacent_sibling_classification() {
use crate::pathctx::{enter, PathCtx};
let ws = |root: &str, path: &str| {
let _g = enter(PathCtx { cwd: Some(root.to_string()), root: Some(root.to_string()), ..Default::default() });
classify_region(path)
};
const WS: &str = "~/projects/safe-chains";
assert_eq!(ws(WS, "~/projects/branchdiff/src/main.rs").read_locus, LocalLocus::Adjacent);
assert_eq!(ws(WS, "~/projects/branchdiff/src/main.rs").write_locus, LocalLocus::Adjacent);
assert_eq!(ws(WS, "~/projects/notes.txt").read_locus, LocalLocus::Adjacent, "a file peer to the workspace dir");
assert_eq!(ws(WS, "~/projects/branchdiff/.env").read_locus, LocalLocus::Adjacent, "peer .env reads as peer content");
assert_eq!(ws(WS, "~/projects/branchdiff/.npmrc").read_locus, LocalLocus::Machine, "peer .npmrc is a token file, not peer content");
assert_eq!(ws(WS, "~/projects/branchdiff/.ssh/id_rsa").read_locus, LocalLocus::Machine, "the shield still bites in a peer");
assert_eq!(ws(WS, "~/projects/branchdiff/.git/hooks/pre-commit").write_locus, LocalLocus::WorktreeTrusted, "peer .git hook stays frozen");
assert_ne!(ws("~/work", "~/.ssh/id_rsa").read_locus, LocalLocus::Adjacent, "~/.ssh is never adjacent");
assert_ne!(ws("~/work", "~/other-notes.txt").read_locus, LocalLocus::Adjacent, "depth-1 workspace has no siblings");
assert_ne!(ws("~", "~/anything.txt").read_locus, LocalLocus::Adjacent);
assert_ne!(ws(WS, "~/other/thing.txt").read_locus, LocalLocus::Adjacent, "different parent → not a sibling");
assert_eq!(ws(WS, "~/projects/safe-chains-fork/x").read_locus, LocalLocus::Adjacent);
assert_ne!(ws(WS, "~/projects/safe-chains/x").read_locus, LocalLocus::Adjacent);
assert_ne!(ws("/opt/app", "/opt/other/x").read_locus, LocalLocus::Adjacent);
assert_ne!(classify_region("~/projects/branchdiff/src/main.rs").read_locus, LocalLocus::Adjacent);
}
#[test]
fn a_peers_hidden_files_are_adjacent_and_the_shield_still_holds() {
use crate::pathctx::{enter, PathCtx};
let at = |root: &str, path: &str| {
let _g = enter(PathCtx { cwd: Some(root.to_string()), root: Some(root.to_string()), ..Default::default() });
classify_region(path).read_locus
};
const WS: &str = "~/projects/safe-chains";
for p in [
"~/projects/branchdiff/.github/workflows/ci.yml",
"~/projects/branchdiff/.vscode/settings.json",
"~/projects/branchdiff/.cargo/config.toml",
"~/projects/branchdiff/.env",
"~/projects/branchdiff/sub/.config/app.toml",
] {
assert_eq!(at(WS, p), LocalLocus::Adjacent, "hidden peer content should be adjacent: {p}");
}
assert_eq!(at(WS, "~/projects/branchdiff/src/main.rs"), LocalLocus::Adjacent);
for p in [
"~/projects/branchdiff/.ssh/id_rsa",
"~/projects/branchdiff/.aws/credentials",
"~/projects/branchdiff/a/b/c/.netrc",
"~/projects/branchdiff/deep/.gnupg/secring.gpg",
] {
assert_eq!(at(WS, p), LocalLocus::Machine, "the credential shield must still bite: {p}");
}
assert_ne!(at(WS, "~/other/notes.txt"), LocalLocus::Adjacent);
}
#[test]
fn most_specific_wins() {
let ssh = classify_region("~/.ssh/id_rsa");
assert_eq!(ssh.read_locus, LocalLocus::Machine);
assert!(ssh.reads_secret);
assert!(classify_region("myproj/.ssh/id_rsa").reads_secret, "segment bites a relative spelling too");
assert_eq!(classify_region("~/notes.txt").read_locus, LocalLocus::User);
assert_eq!(classify_region("~/notes.txt").write_locus, LocalLocus::Machine);
assert!(classify_region("~root/.bashrc").reads_secret, "another user's home is private");
}
#[test]
fn in_project_trusted_files_read_but_do_not_write() {
let git = classify_region(".git/config");
assert_eq!(git.read_locus, LocalLocus::WorktreeTrusted, "read is admitted at read-local");
assert_eq!(git.write_locus, LocalLocus::WorktreeTrusted, "above the worktree write ceiling → frozen");
}
#[test]
fn user_grant_widens_read_and_write() {
with_grants(&[("~/projects/", true, true)], || {
let r = classify_region("~/projects/other/src/main.rs");
assert_eq!(r.write_locus, LocalLocus::Worktree, "write admitted");
assert!(r.read_locus <= LocalLocus::WorktreeTrusted, "read admitted");
});
assert_eq!(classify_region("~/projects/other/src/main.rs").write_locus, LocalLocus::Machine);
}
#[test]
fn read_only_grant_admits_read_but_not_write() {
with_grants(&[("~/.local/share/mise/", true, false)], || {
let r = classify_region("~/.local/share/mise/installs/python/bin/python");
assert!(r.read_locus <= LocalLocus::WorktreeTrusted, "read admitted");
assert!(r.write_locus > LocalLocus::Worktree, "write NOT admitted");
});
}
#[test]
fn translate_read_pattern_only_honors_absolute_and_home_prefixes() {
assert_eq!(translate_read_pattern("//Users/me/x/**"), Some("/Users/me/x/".into()));
assert_eq!(translate_read_pattern("~/.gem/**"), Some("~/.gem/".into()));
assert_eq!(translate_read_pattern("//Users/me/x/*"), Some("/Users/me/x/".into()));
assert_eq!(translate_read_pattern("~/.gem"), Some("~/.gem".into()));
assert_eq!(translate_read_pattern("//etc/hosts"), Some("/etc/hosts".into()));
assert_eq!(translate_read_pattern("src/**"), None);
assert_eq!(translate_read_pattern("/logs/**"), None);
assert_eq!(translate_read_pattern("//Users/*/mise/**"), None);
assert_eq!(translate_read_pattern("~/**/*.pem"), None);
assert_eq!(translate_read_pattern("//**"), None);
assert_eq!(translate_read_pattern("~/**"), None);
assert_eq!(translate_read_pattern("~/"), None);
assert_eq!(translate_read_pattern(""), None);
}
#[test]
fn claude_read_grant_paths_extracts_only_read_allow_rules() {
let paths = claude_read_grant_paths(
r#"{"permissions":{"allow":[
"Bash(ls)","Edit(~/x/**)","Write(~/y/**)","Read(~/z/**)","WebFetch"
]}}"#,
);
assert_eq!(paths, vec!["~/z/".to_string()]);
assert!(claude_read_grant_paths("not json").is_empty());
assert!(claude_read_grant_paths("{}").is_empty());
assert!(claude_read_grant_paths(r#"{"permissions":{}}"#).is_empty());
assert!(claude_read_grant_paths(r#"{"permissions":{"deny":["Read(~/z/**)"]}}"#).is_empty());
}
#[test]
fn claude_read_rule_admits_read_but_never_write() {
let paths = claude_read_grant_paths(
r#"{"permissions":{"allow":["Read(~/.local/share/mise/**)","Edit(~/.local/share/mise/**)"]}}"#,
);
assert_eq!(paths, vec!["~/.local/share/mise/".to_string()]);
let grants: Vec<(&str, bool, bool)> = paths.iter().map(|p| (p.as_str(), true, false)).collect();
with_grants(&grants, || {
let r = classify_region("~/.local/share/mise/installs/python/bin/python");
assert!(r.read_locus <= LocalLocus::WorktreeTrusted, "read admitted");
assert!(r.write_locus > LocalLocus::Worktree, "the Edit() rule is ignored — write stays denied");
});
}
#[test]
fn a_claude_read_grant_still_respects_the_dot_rule_and_shields() {
let paths = claude_read_grant_paths(r#"{"permissions":{"allow":["Read(~/work/**)"]}}"#);
assert_eq!(paths, vec!["~/work/".to_string()]);
let grants: Vec<(&str, bool, bool)> = paths.iter().map(|p| (p.as_str(), true, false)).collect();
with_grants(&grants, || {
assert!(classify_region("~/work/notes.txt").read_locus <= LocalLocus::WorktreeTrusted, "granted read admitted");
assert_eq!(classify_region("~/work/.ssh/id_rsa").read_locus, LocalLocus::Machine, "hidden cred not widened");
});
}
#[test]
fn claude_settings_read_grants_reads_home_settings_only() {
let home = tempfile::tempdir().unwrap();
let claude = home.path().join(".claude");
std::fs::create_dir_all(&claude).unwrap();
std::fs::write(
claude.join("settings.json"),
r#"{"permissions":{"allow":["Read(~/.gem/**)","Edit(~/.gem/**)"]}}"#,
)
.unwrap();
let grants = claude_settings_read_grants(home.path());
assert!(!grants.is_empty());
assert!(grants.iter().all(|g| g.read && !g.write), "Read() rules are read-only");
let empty = tempfile::tempdir().unwrap();
assert!(claude_settings_read_grants(empty.path()).is_empty());
}
#[cfg(test)]
fn naming_probe(matcher: &Matcher) -> Option<(String, String, String)> {
let parent_of = |s: &str| {
let t = s.trim_end_matches('/');
match t.rfind('/') {
Some(0) => "/".to_string(),
Some(i) => format!("{}/", &t[..i]),
None => return None,
}
.into()
};
match matcher {
Matcher::Exact(s) => Some((s.clone(), s.clone(), parent_of(s)?)),
Matcher::Prefix(s) => {
Some((format!("{s}probe"), s.clone(), parent_of(s)?))
}
Matcher::Segment(seg) => Some((format!("~/{seg}/probe"), format!("~/{seg}"), "~/".to_string())),
Matcher::StringPrefix(_) => None,
Matcher::Glob(pat) => {
let concrete = pat
.iter()
.map(|c| if c == "*" { "probe" } else { c.as_str() })
.collect::<Vec<_>>()
.join("/");
Some((concrete.clone(), concrete.clone(), parent_of(&concrete)?))
}
}
}
#[cfg(test)]
fn absolute_segment_probe(matcher: &Matcher) -> Option<(String, String, String)> {
let Matcher::Segment(seg) = matcher else { return None };
Some((format!("/opt/app/{seg}/probe"), format!("/opt/app/{seg}"), "/opt/app/".to_string()))
}
#[test]
fn the_naming_test_uses_the_deepest_matching_secret_node() {
with_os("linux", || {
assert_eq!(secret_node_root("/root/.ssh/id_rsa").as_deref(), Some("/root/.ssh"));
assert_eq!(secret_node_root("/root/notes.txt").as_deref(), Some("/root"));
with_grants(&[("/root", true, true)], || {
assert_eq!(
classify_region("/root/.ssh/id_rsa").read_locus,
LocalLocus::Machine,
"a grant on /root must not name the .ssh nested inside it"
);
});
});
}
#[test]
fn a_trust_files_directory_cannot_be_destroyed_or_replaced() {
let mut checked = 0usize;
for node in REGIONS.nodes.iter().filter(|n| n.applies_here() && n.role.frozen == Frozen::Write) {
let Matcher::Exact(path) = &node.matcher else { continue };
let Some((parent, _)) = path.rsplit_once('/') else { continue };
if parent == "~" {
continue;
}
with_grants(&[(parent, true, true)], || {
for line in [format!("rm -rf {parent}"), format!("ln -s /tmp/evil {parent}")] {
assert!(
!crate::is_safe_command(&line),
"`{line}` relocates the trust root holding {path}"
);
}
assert!(
crate::is_safe_command(&format!("touch {parent}/ordinary.toml")),
"{parent}: freezing the directory must not freeze its contents"
);
});
checked += 1;
}
assert!(checked >= 2, "only {checked} trust files probed — the guard is vacuous");
}
#[test]
fn a_trust_root_directory_is_writable_into_but_not_replaceable() {
for dir in ["~/.config", "~/.claude"] {
with_grants(&[(dir, true, true)], || {
for allowed in [format!("cp a.toml {dir}"), format!("mv a.toml {dir}"), format!("touch {dir}/x")] {
assert!(crate::is_safe_command(&allowed), "{allowed} must stay allowed");
}
for refused in [
format!("rm -rf {dir}"),
format!("rmdir {dir}"),
format!("ln -s /tmp/evil {dir}"),
format!("mv {dir} {dir}.bak"),
] {
assert!(!crate::is_safe_command(&refused), "{refused} relocates the trust root");
}
});
}
}
#[test]
fn a_rebinding_command_into_a_container_is_an_ordinary_write() {
with_grants(&[("~/.config", true, true)], || {
for allowed in [
"ln -t ~/.config a",
"ln --target-directory=~/.config a",
"ln -s a b ~/.config",
] {
assert!(crate::is_safe_command(allowed), "{allowed} links INTO the directory");
}
assert!(!crate::is_safe_command("ln -s /tmp/evil ~/.config"), "the 2-operand form rebinds");
});
}
#[test]
fn a_home_anchored_node_protects_the_absolute_spelling_too() {
let Some(home) = std::env::var_os("HOME").and_then(|h| h.into_string().ok()) else {
return;
};
let cases = [
("~/.config", "the trust-root directory"),
("~/.config/safe-chains.toml", "safe-chains' own config"),
("~/.claude/settings.json", "the harness settings file"),
("~/Library/Keychains/login.keychain", "a credential store"),
];
for (tilde, what) in cases {
let absolute = tilde.replacen('~', &home, 1);
let compare = |when: &str| {
let t = classify_region(tilde);
let a = classify_region(&absolute);
assert_eq!(a.reads_secret, t.reads_secret, "{absolute} ({when}): {what} loses its secret bit");
assert_eq!(a.write_locus, t.write_locus, "{absolute} ({when}): {what} write face diverges");
assert_eq!(a.rebind_locus, t.rebind_locus, "{absolute} ({when}): {what} rebind face diverges");
};
compare("no grant");
with_grants(&[(tilde, true, true)], || compare("granted"));
}
}
#[test]
fn a_freeze_holds_at_every_level_that_still_gates() {
let attacks = [
"echo x > ~/.config/safe-chains.toml",
"echo x > ~/.claude/settings.json",
"cp a ~/.config/safe-chains.toml",
"rmdir ~/.config",
"ln -s /tmp/evil ~/.config",
"mv ~/.config ~/x",
"rm -rf ~/.claude",
];
let mut checked = 0usize;
for name in ["local-admin", "network-admin"] {
let level = crate::upper_level_by_name(name).expect("level exists");
for attack in attacks {
assert!(
!crate::command_verdict_at_level(attack, level).is_allowed(),
"`{attack}` is auto-approved at `{name}`, which can then rewrite its own ceiling"
);
checked += 1;
}
}
assert!(checked >= 14, "only {checked} level/attack pairs probed — the guard is vacuous");
let admin = crate::upper_level_by_name("local-admin").expect("level exists");
for ordinary in ["echo x > /etc/nginx/nginx.conf", "cat /etc/passwd", "cp a ~/.config/other.toml"] {
assert!(
crate::command_verdict_at_level(ordinary, admin).is_allowed(),
"`{ordinary}` should still be admin work at `local-admin`"
);
}
}
#[test]
fn nothing_names_a_root_that_claims_everything() {
assert!(!at_or_below("/etc/shadow", ""), "an empty node root must not admit an absolute grant");
assert!(!at_or_below("~/.ssh", ""));
assert!(at_or_below("~/.ssh/known_hosts", "~/.ssh"), "a path inside the store still names it");
assert!(!at_or_below("~/.sshfoo", "~/.ssh"), "a name-prefix neighbour does not name it");
}
#[test]
fn a_grant_covers_the_subtree_however_the_path_is_spelled() {
for spelling in ["~/projects", "~/projects/"] {
with_grants(&[(spelling, true, true)], || {
assert_eq!(
classify_region("~/projects/sibling/notes.txt").write_locus,
LocalLocus::Worktree,
"{spelling} must cover its contents"
);
assert_eq!(classify_region("~/projects").write_locus, LocalLocus::Worktree, "{spelling} covers the dir itself");
});
}
with_grants(&[("~/projects", true, true)], || {
assert_eq!(classify_region("~/projectsX/secret.txt").write_locus, LocalLocus::Machine, "~/projectsX is a different directory");
});
}
#[test]
fn the_private_spelling_of_a_firmlinked_node_classifies_identically() {
let os = "macos";
{
with_os(os, || {
let mut covered = 0;
for node in REGIONS.nodes.iter().filter(|n| n.applies_here()) {
let Some((path, _, _)) = naming_probe(&node.matcher) else { continue };
if !["/etc/", "/var/", "/tmp/"].iter().any(|r| path.starts_with(r)) {
continue;
}
covered += 1;
let private = format!("/private{path}");
let (plain, firm) = (classify_region(&path), classify_region(&private));
assert_eq!(
(plain.read_locus, plain.write_locus, plain.reads_secret),
(firm.read_locus, firm.write_locus, firm.reads_secret),
"{os}: {path} and {private} name one file but classify differently"
);
if plain.reads_secret {
for variant in ["/PRIVATE", "/Private"] {
let cased = format!("{variant}{path}");
assert!(
classify_region(&cased).reads_secret,
"{os}: {cased} is {path} on a case-insensitive volume, but the shield missed it"
);
}
}
}
assert!(covered >= 3, "{os}: guard covered only {covered} firmlinked nodes — vacuous");
});
}
}
#[test]
fn a_grant_reaches_a_credential_store_only_when_it_names_it() {
for os in ["macos", "linux"] {
with_os(os, || {
let mut covered = 0;
for node in REGIONS.nodes.iter().filter(|n| n.applies_here() && n.role.reads_secret) {
let probes: Vec<_> = [naming_probe(&node.matcher), absolute_segment_probe(&node.matcher)]
.into_iter()
.flatten()
.collect();
if probes.is_empty() {
continue;
}
for (path, naming, parent) in probes {
assert!(
base_region(&path).reads_secret,
"{os}: probe {path} does not reach the secret node it was built from"
);
with_grants(&[(naming.as_str(), true, true)], || {
assert_eq!(
classify_region(&path).read_locus,
LocalLocus::WorktreeTrusted,
"{os}: a grant naming {naming} must reach {path}"
);
});
with_grants(&[(parent.as_str(), true, true)], || {
assert_eq!(
classify_region(&path).read_locus,
LocalLocus::Machine,
"{os}: a grant on the parent {parent} must NOT reach the secret at {path}"
);
});
covered += 1;
}
}
assert!(covered > 10, "{os}: only {covered} credential stores probed - the guard has gone vacuous");
});
}
}
#[test]
fn a_derived_grant_never_names_a_credential_store() {
for os in ["macos", "linux"] {
with_os(os, || {
let mut covered = 0;
for node in REGIONS.nodes.iter().filter(|n| n.applies_here() && n.role.reads_secret) {
let Some((path, naming, _)) = naming_probe(&node.matcher) else {
continue;
};
with_derived_grants(&[(naming.as_str(), true, false)], || {
assert_eq!(
classify_region(&path).read_locus,
LocalLocus::Machine,
"{os}: a derived grant on {naming} must not reach {path}"
);
});
with_grants(&[(naming.as_str(), true, false)], || {
assert_eq!(classify_region(&path).read_locus, LocalLocus::WorktreeTrusted);
});
covered += 1;
}
assert!(covered > 10, "{os}: only {covered} stores probed - the guard has gone vacuous");
});
}
}
#[test]
fn no_grant_opens_a_frozen_face() {
for os in ["macos", "linux"] {
with_os(os, || {
let (mut covered, mut rebind_only) = (0, 0);
for node in REGIONS.nodes.iter().filter(|n| n.applies_here()) {
let role = node.role;
let system = role.write_locus >= LocalLocus::SystemIntegrity;
if role.frozen == Frozen::Nothing && !system {
continue;
}
let Some((path, naming, parent)) = naming_probe(&node.matcher) else {
continue;
};
for grant in [naming.as_str(), parent.as_str(), "~/", "/"] {
with_grants(&[(grant, true, true)], || {
let r = classify_region(&path);
assert!(
r.rebind_locus > LocalLocus::Worktree,
"{os}: grant {grant} opens the frozen rebind at {path}"
);
if role.frozen == Frozen::Write || system {
assert!(
r.write_locus > LocalLocus::Worktree,
"{os}: grant {grant} opens the frozen write at {path}"
);
}
});
}
if role.frozen == Frozen::Rebind {
with_grants(&[(naming.as_str(), true, true)], || {
assert!(
classify_region(&path).write_locus <= LocalLocus::Worktree,
"{os}: a rebind-only freeze must still allow writing into {path}"
);
});
}
covered += 1;
if role.frozen == Frozen::Rebind {
rebind_only += 1;
}
}
assert!(covered > 5, "{os}: only {covered} frozen nodes probed - the guard has gone vacuous");
assert!(rebind_only >= 2, "{os}: {rebind_only} rebind-only nodes - the split is untested");
});
}
}
#[test]
fn shields_fold_case_on_macos_so_a_case_variant_cannot_evade_them() {
with_os("macos", || {
assert!(classify_region("~/.AWS/credentials").reads_secret, ".AWS folds to the .aws secret");
assert!(classify_region("~/.SSH/id_rsa").reads_secret, ".SSH folds to the .ssh secret");
assert_eq!(classify_region("~/.AWS/credentials").read_locus, LocalLocus::Machine);
assert_eq!(classify_region("/etc/Master.Passwd").read_locus, LocalLocus::Machine, "system secret folds");
assert!(classify_region(".GIT/hooks/pre-commit").write_locus > LocalLocus::Worktree, ".GIT write frozen");
assert!(classify_region(".Git/hooks/pre-commit").write_locus > LocalLocus::Worktree, "mixed-case .Git frozen");
assert!(classify_region(".ENVRC").write_locus > LocalLocus::Worktree, ".ENVRC write frozen");
with_grants(&[("~/.AWS/", true, false)], || {
assert_eq!(classify_region("~/.AWS/credentials").read_locus, LocalLocus::WorktreeTrusted, "a grant naming the folded secret reaches it");
});
with_grants(&[("~/", true, false)], || {
assert_eq!(classify_region("~/.AWS/credentials").read_locus, LocalLocus::Machine, "a broad grant cannot reach a folded secret");
});
});
}
#[test]
fn case_folding_is_macos_only_so_linux_keeps_distinct_paths() {
with_os("linux", || {
assert_eq!(classify_region(".GIT/hooks/pre-commit").write_locus, LocalLocus::Worktree, "linux: .GIT is an ordinary worktree path");
assert!(!classify_region("~/.AWS/credentials").reads_secret, "linux: .AWS is not the .aws secret");
});
for os in ["macos", "linux"] {
assert!(with_os(os, || classify_region("~/.aws/credentials").reads_secret), "{os}: canonical .aws shielded");
assert!(with_os(os, || classify_region(".git/hooks/pre-commit").write_locus > LocalLocus::Worktree), "{os}: canonical .git frozen");
}
}
#[test]
fn admit_nodes_never_fold_so_a_case_variant_is_not_widened() {
with_os("macos", || {
assert!(classify_region("/tmp/x").write_locus <= LocalLocus::Worktree, "/tmp is scratch (admitted)");
assert_eq!(classify_region("/TMP/x").write_locus, LocalLocus::Machine, "/TMP is not folded into the scratch admit");
});
}
#[test]
fn safe_chains_config_is_read_ok_write_denied_and_ungrantable() {
let cfg = "~/.config/safe-chains.toml";
assert!(classify_region(cfg).read_locus <= LocalLocus::WorktreeTrusted, "read is fine");
assert_eq!(classify_region(cfg).write_locus, LocalLocus::SystemIntegrity, "write denied");
with_grants(&[("~/", true, true)], || {
assert_eq!(classify_region(cfg).write_locus, LocalLocus::SystemIntegrity, "grant can't unlock the config write");
assert!(classify_region(cfg).read_locus <= LocalLocus::WorktreeTrusted);
});
}
#[test]
fn a_grant_does_not_widen_hidden_files_or_system_secrets() {
with_grants(&[("~/", true, true)], || {
assert_eq!(classify_region("~/projects/foo/main.rs").write_locus, LocalLocus::Worktree);
for p in ["~/.git-credentials", "~/.npmrc", "~/.config/gh/hosts.yml", "~/.pgpass"] {
assert_eq!(classify_region(p).read_locus, LocalLocus::Machine, "shielded, not widened: {p}");
}
assert_eq!(
with_os("macos", || classify_region("~/.SSH/id_rsa").read_locus),
LocalLocus::Machine,
"macos: the case variant is the same directory, so the shield must fold onto it"
);
assert_eq!(
with_os("linux", || classify_region("~/.SSH/id_rsa").read_locus),
LocalLocus::User,
"linux: ~/.SSH is not ~/.ssh, and an unlisted dotfile is an ordinary home read"
);
});
with_grants(&[("/", true, true)], || {
assert_eq!(classify_region("/etc/ssl/private/server.key").read_locus, LocalLocus::Machine);
assert_eq!(with_os("linux", || classify_region("/etc/shadow").read_locus), LocalLocus::Machine);
});
with_grants(&[("~/.runner-scripts/", true, true)], || {
assert_eq!(classify_region("~/.runner-scripts/deploy.sh").write_locus, LocalLocus::Worktree);
});
with_grants(&[("~/", true, true)], || {
for p in [
"~/Library/Keychains/login.keychain-db",
"~/Library/Cookies/Cookies.binarycookies",
"~/Library/Application Support/Firefox/Profiles/x.default/logins.json",
"~/Library/Application Support/Google/Chrome/Default/Login Data",
"~/.config/git/credentials",
] {
assert_eq!(with_os("macos", || classify_region(p).read_locus), LocalLocus::Machine, "shield: {p}");
}
});
}
#[test]
fn a_broad_grant_never_reaches_a_secret_carveout() {
with_grants(&[("~/", true, true)], || {
let r = classify_region("~/.ssh/id_rsa");
assert_eq!(r.read_locus, LocalLocus::Machine, "a ~/ grant does not name ~/.ssh, so it does not reach it");
assert!(r.reads_secret);
});
}
#[test]
fn a_grant_that_names_a_secret_store_opens_it_for_reading() {
with_grants(&[("~/.ssh", true, false)], || {
let r = classify_region("~/.ssh/id_rsa");
assert!(!r.reads_secret, "the grant named ~/.ssh, so the shield yields to it");
assert!(r.read_locus <= LocalLocus::WorktreeTrusted, "and the locus is granted too");
});
with_grants(&[("~/.ssh/config", true, false)], || {
assert!(!classify_region("~/.ssh/config").reads_secret, "the named file opens");
assert!(
classify_region("~/.ssh/id_rsa").reads_secret,
"a sibling the grant did not name stays shielded"
);
});
with_grants(&[("~/.ssh", false, true)], || {
let r = classify_region("~/.ssh/id_rsa");
assert!(r.reads_secret, "write = true is not a statement about reading");
});
}
#[test]
fn grant_takes_effect_end_to_end() {
with_grants(&[("~/projects/", true, true)], || {
assert!(crate::is_safe_command("cat ~/projects/sibling/notes.txt"));
assert!(crate::is_safe_command("cp ./a ~/projects/sibling/b"));
assert!(crate::is_safe_command("echo hi > ~/projects/sibling/out.txt"));
});
}
#[test]
fn a_home_grant_matches_both_tilde_and_absolute_spellings() {
let Some(home) = std::env::var_os("HOME").and_then(|h| h.into_string().ok()) else {
return;
};
with_grants(&[("~/work/", true, true)], || {
assert!(classify_region("~/work/a.txt").write_locus == LocalLocus::Worktree);
assert!(classify_region(&format!("{home}/work/a.txt")).write_locus == LocalLocus::Worktree);
});
}
#[test]
fn every_region_carries_provenance_and_a_valid_role() {
let src = include_str!("../../../regions/default.toml");
let file: RegionsFile = toml::from_str(src).expect("valid TOML");
for r in &file.region {
assert!(!r.note.trim().is_empty(), "region `{}` is missing a note", r.path);
assert!(!r.researched.trim().is_empty(), "region `{}` is missing a researched date", r.path);
assert!(file.role.contains_key(&r.role), "region `{}` names undefined role `{}`", r.path, r.role);
}
assert!(file.region.len() > 10, "region set unexpectedly small ({})", file.region.len());
}
}