From 742395bca70a3ae384d0df82ac22a52b4058b08c Mon Sep 17 00:00:00 2001
From: WRG <Williamgranger1996@gmail.com>
Date: Sat, 26 Sep 2026 02:14:24 +1000
Subject: [PATCH 1/5] fix(scripts): confine plan-canvas artifact assets and
 escape 404 paths

Serve artifact pages with a sandbox-only CSP mirroring the viewer iframe, fail-closed realpath confinement for sibling assets, and escape the artifact path in the missing-artifact 404. TDD: 4 RED failures (CSP header, 404 escaping, symlink escape) before the fix, 31/31 GREEN after; markdown/sessions/hook suites and ESLint clean.
---
 scripts/lib/plan-canvas/server.js | 42 ++++++++++++++++++++++++-------
 tests/scripts/plan-canvas.test.js | 32 ++++++++++++++++++++++-
 2 files changed, 64 insertions(+), 10 deletions(-)

diff --git a/scripts/lib/plan-canvas/server.js b/scripts/lib/plan-canvas/server.js
index 11b44062a..961dd559c 100644
--- a/scripts/lib/plan-canvas/server.js
+++ b/scripts/lib/plan-canvas/server.js
@@ -15,7 +15,7 @@ const http = require('http');
 const path = require('path');
 
 const { buildAllowedHostnames, isAllowedHostHeader, isAllowedOrigin } = require('../loopback-guard');
-const { renderMarkdown } = require('./markdown');
+const { escapeHtml, renderMarkdown } = require('./markdown');
 const { artifactSdkJs } = require('./sdk');
 const {
   canvasCss,
@@ -101,9 +101,21 @@ function sendJson(res, statusCode, payload) {
   res.end(body);
 }
 
+// Artifact pages render inside a sandboxed iframe (no allow-same-origin) and
+// legitimately run CDN scripts (Mermaid) plus inline loaders, so the default
+// restrictive CSP cannot apply. A sandbox-only CSP mirrors the iframe
+// attribute instead: scripts keep working, but the document gets an opaque
+// origin, which neuters direct-navigation abuse of the loopback API (no CORS
+// reads, JSON POSTs are preflight-blocked) without changing in-iframe
+// behavior. A hostile <meta> CSP in a raw HTML artifact can only narrow this
+// further, never loosen it.
+const ARTIFACT_CSP = 'sandbox allow-scripts allow-forms allow-popups';
+
 function sendHtml(res, statusCode, html, { csp = true } = {}) {
   const headers = { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' };
-  if (csp) {
+  if (csp === 'artifact') {
+    headers['content-security-policy'] = ARTIFACT_CSP;
+  } else if (csp) {
     headers['content-security-policy'] =
       "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-src 'self'";
   }
@@ -493,7 +505,7 @@ function createPlanCanvasServer({
       try {
         content = fs.readFileSync(session.file, 'utf8');
       } catch {
-        return sendHtml(res, 404, `<h1>Artifact missing</h1><p>${session.file} no longer exists.</p>`, { csp: false });
+        return sendHtml(res, 404, `<h1>Artifact missing</h1><p>${escapeHtml(session.file)} no longer exists.</p>`);
       }
       const ext = path.extname(session.file).toLowerCase();
       if (ext === '.md' || ext === '.markdown') {
@@ -501,29 +513,41 @@ function createPlanCanvasServer({
           title: path.basename(session.file),
           sdkSrc: '/sdk.js'
         });
-        return sendHtml(res, 200, html, { csp: false });
+        return sendHtml(res, 200, html, { csp: 'artifact' });
       }
       const sdkTag = '<script src="/sdk.js"></script>';
       const injected = content.includes('</body>')
         ? content.replace('</body>', `${sdkTag}\n</body>`)
         : `${content}\n${sdkTag}`;
-      return sendHtml(res, 200, injected, { csp: false });
+      return sendHtml(res, 200, injected, { csp: 'artifact' });
     }
 
     // Sibling assets resolve relative to the artifact's directory and must
-    // stay confined to it.
+    // stay confined to it. The prefix check alone is insufficient: a symlink
+    // inside the directory can point outside it, so the check is repeated
+    // against the real paths and fails closed when they cannot be resolved.
     const baseDir = path.dirname(session.file);
     const resolved = path.resolve(baseDir, assetPath);
     if (resolved !== baseDir && !resolved.startsWith(baseDir + path.sep)) {
       return sendJson(res, 403, { error: 'asset path escapes artifact directory' });
     }
-    let data;
+    let realTarget;
     try {
-      data = fs.readFileSync(resolved);
+      const realBase = fs.realpathSync(baseDir);
+      realTarget = fs.realpathSync(resolved);
+      if (realTarget !== realBase && !realTarget.startsWith(realBase + path.sep)) {
+        return sendJson(res, 403, { error: 'asset path escapes artifact directory' });
+      }
     } catch {
       return sendJson(res, 404, { error: 'asset not found' });
     }
-    const type = CONTENT_TYPES[path.extname(resolved).toLowerCase()] || 'application/octet-stream';
+    let data;
+    try {
+      data = fs.readFileSync(realTarget);
+    } catch {
+      return sendJson(res, 404, { error: 'asset not found' });
+    }
+    const type = CONTENT_TYPES[path.extname(realTarget).toLowerCase()] || 'application/octet-stream';
     res.writeHead(200, { 'content-type': type, 'cache-control': 'no-store' });
     return res.end(data);
   }
diff --git a/tests/scripts/plan-canvas.test.js b/tests/scripts/plan-canvas.test.js
index 5d1e8745f..152d9c35b 100644
--- a/tests/scripts/plan-canvas.test.js
+++ b/tests/scripts/plan-canvas.test.js
@@ -182,7 +182,7 @@ async function main() {
     assert.ok(res.body.includes('<h1 id="plan-demo">'));
     assert.ok(res.body.includes('<table>'));
     assert.ok(res.body.includes('<script src="/sdk.js">'));
-    assert.strictEqual(res.headers['content-security-policy'], undefined);
+    assert.strictEqual(res.headers['content-security-policy'], 'sandbox allow-scripts allow-forms allow-popups');
     // No diagram in this plan → no Mermaid loader shipped.
     assert.ok(!res.body.includes('mermaid.run'));
   })) passed++; else failed++;
@@ -214,6 +214,36 @@ async function main() {
     assert.strictEqual(escape.statusCode, 403);
   })) passed++; else failed++;
 
+  if (await test('artifact responses carry a sandbox CSP (direct-navigation hardening)', async () => {
+    const md = await request(port, 'GET', `/artifact/${key}/`);
+    assert.strictEqual(md.statusCode, 200);
+    assert.strictEqual(md.headers['content-security-policy'], 'sandbox allow-scripts allow-forms allow-popups');
+    const html = await request(port, 'GET', `/artifact/${htmlKey}/`);
+    assert.strictEqual(html.statusCode, 200);
+    assert.strictEqual(html.headers['content-security-policy'], 'sandbox allow-scripts allow-forms allow-popups');
+  })) passed++; else failed++;
+
+  if (await test('missing-artifact 404 escapes the file path', async () => {
+    const evilFile = path.join(tmp, 'evil<img src=x onerror=alert(1)>.plan.md');
+    fs.writeFileSync(evilFile, '# Evil\n');
+    const opened = jsonBody(await request(port, 'POST', '/api/sessions', { body: { file: evilFile } }));
+    fs.rmSync(evilFile);
+    const res = await request(port, 'GET', `/artifact/${opened.key}/`);
+    assert.strictEqual(res.statusCode, 404);
+    assert.ok(!res.body.includes('<img src=x'), 'raw filename must not appear in the 404 page');
+    assert.ok(res.body.includes('&lt;img'), 'filename must be HTML-escaped in the 404 page');
+  })) passed++; else failed++;
+
+  if (await test('symlinked sibling assets escaping the artifact dir are blocked', async () => {
+    fs.symlinkSync(path.join(outsideDir, 'secret.txt'), path.join(tmp, 'evil-link.txt'));
+    const blocked = await request(port, 'GET', `/artifact/${key}/evil-link.txt`);
+    assert.strictEqual(blocked.statusCode, 403);
+    fs.symlinkSync(path.join(tmp, 'style.css'), path.join(tmp, 'ok-link.css'));
+    const allowed = await request(port, 'GET', `/artifact/${key}/ok-link.css`);
+    assert.strictEqual(allowed.statusCode, 200);
+    assert.ok(allowed.body.includes('color: red'));
+  })) passed++; else failed++;
+
   if (await test('static chrome assets are served', async () => {
     for (const asset of ['/canvas.css', '/client.js', '/sdk.js']) {
       const res = await request(port, 'GET', asset);

From d237e1972f7f803dd90c2d0872d9487ab8bcb996 Mon Sep 17 00:00:00 2001
From: WRG <Williamgranger1996@gmail.com>
Date: Sat, 26 Sep 2026 02:39:42 +1000
Subject: [PATCH 2/5] fix(scripts): sandbox HTML siblings, link-name MIME,
 portable fixtures

Review follow-ups: serve text/html sibling assets under the artifact sandbox CSP (direct navigation no longer bypasses it); resolve MIME from the request name first with target extension as fallback; make security fixtures cross-platform (no angle brackets in filenames, skip when symlink creation is denied). Residual check-then-read TOCTOU documented as accepted for the loopback-local threat model. Tests 33/33 GREEN, ESLint clean.
---
 scripts/lib/plan-canvas/server.js | 17 ++++++++++++--
 tests/scripts/plan-canvas.test.js | 37 ++++++++++++++++++++++++++-----
 2 files changed, 47 insertions(+), 7 deletions(-)

diff --git a/scripts/lib/plan-canvas/server.js b/scripts/lib/plan-canvas/server.js
index 961dd559c..87998b9dd 100644
--- a/scripts/lib/plan-canvas/server.js
+++ b/scripts/lib/plan-canvas/server.js
@@ -541,14 +541,27 @@ function createPlanCanvasServer({
     } catch {
       return sendJson(res, 404, { error: 'asset not found' });
     }
+    // Residual TOCTOU note: the confinement check and the read below are
+    // separate operations, so a local actor racing a symlink swap between
+    // them could redirect the read. Accepted for a loopback-local dev tool:
+    // anyone able to win that race already has arbitrary local file write,
+    // and served HTML is sandboxed (see below) while other types are inert.
     let data;
     try {
       data = fs.readFileSync(realTarget);
     } catch {
       return sendJson(res, 404, { error: 'asset not found' });
     }
-    const type = CONTENT_TYPES[path.extname(realTarget).toLowerCase()] || 'application/octet-stream';
-    res.writeHead(200, { 'content-type': type, 'cache-control': 'no-store' });
+    // MIME comes from the link/request name first so a symlinked asset keeps
+    // the type the page asked for; the target extension is the fallback.
+    const type = CONTENT_TYPES[path.extname(resolved).toLowerCase()]
+      || CONTENT_TYPES[path.extname(realTarget).toLowerCase()]
+      || 'application/octet-stream';
+    const headers = { 'content-type': type, 'cache-control': 'no-store' };
+    if (type.startsWith('text/html')) {
+      headers['content-security-policy'] = ARTIFACT_CSP;
+    }
+    res.writeHead(200, headers);
     return res.end(data);
   }
 
diff --git a/tests/scripts/plan-canvas.test.js b/tests/scripts/plan-canvas.test.js
index 152d9c35b..2ab43ec1f 100644
--- a/tests/scripts/plan-canvas.test.js
+++ b/tests/scripts/plan-canvas.test.js
@@ -224,26 +224,53 @@ async function main() {
   })) passed++; else failed++;
 
   if (await test('missing-artifact 404 escapes the file path', async () => {
-    const evilFile = path.join(tmp, 'evil<img src=x onerror=alert(1)>.plan.md');
+    // Quotes and ampersands are escapable on every platform (Windows
+    // rejects < > in filenames, so angle brackets stay out of fixtures).
+    const evilFile = path.join(tmp, `evil'b&xss.plan.md`);
     fs.writeFileSync(evilFile, '# Evil\n');
     const opened = jsonBody(await request(port, 'POST', '/api/sessions', { body: { file: evilFile } }));
     fs.rmSync(evilFile);
     const res = await request(port, 'GET', `/artifact/${opened.key}/`);
     assert.strictEqual(res.statusCode, 404);
-    assert.ok(!res.body.includes('<img src=x'), 'raw filename must not appear in the 404 page');
-    assert.ok(res.body.includes('&lt;img'), 'filename must be HTML-escaped in the 404 page');
+    assert.ok(!res.body.includes(`evil'b&xss`), 'raw filename must not appear in the 404 page');
+    assert.ok(res.body.includes('evil&#39;b&amp;xss'), 'filename must be HTML-escaped in the 404 page');
   })) passed++; else failed++;
 
   if (await test('symlinked sibling assets escaping the artifact dir are blocked', async () => {
-    fs.symlinkSync(path.join(outsideDir, 'secret.txt'), path.join(tmp, 'evil-link.txt'));
+    try {
+      fs.symlinkSync(path.join(outsideDir, 'secret.txt'), path.join(tmp, 'evil-link.txt'));
+      fs.symlinkSync(path.join(tmp, 'style.css'), path.join(tmp, 'ok-link.css'));
+    } catch {
+      console.log('    SKIP: symlink creation unavailable on this platform');
+      return;
+    }
     const blocked = await request(port, 'GET', `/artifact/${key}/evil-link.txt`);
     assert.strictEqual(blocked.statusCode, 403);
-    fs.symlinkSync(path.join(tmp, 'style.css'), path.join(tmp, 'ok-link.css'));
     const allowed = await request(port, 'GET', `/artifact/${key}/ok-link.css`);
     assert.strictEqual(allowed.statusCode, 200);
     assert.ok(allowed.body.includes('color: red'));
   })) passed++; else failed++;
 
+  if (await test('served HTML siblings carry the sandbox CSP', async () => {
+    fs.writeFileSync(path.join(tmp, 'note.html'), '<!DOCTYPE html><html><body><p>hi</p></body></html>');
+    const res = await request(port, 'GET', `/artifact/${key}/note.html`);
+    assert.strictEqual(res.statusCode, 200);
+    assert.strictEqual(res.headers['content-security-policy'], 'sandbox allow-scripts allow-forms allow-popups');
+  })) passed++; else failed++;
+
+  if (await test('symlinked assets take their MIME from the link name', async () => {
+    try {
+      fs.writeFileSync(path.join(tmp, 'realfile'), 'body { color: blue }');
+      fs.symlinkSync(path.join(tmp, 'realfile'), path.join(tmp, 'theme.css'));
+    } catch {
+      console.log('    SKIP: symlink creation unavailable on this platform');
+      return;
+    }
+    const res = await request(port, 'GET', `/artifact/${key}/theme.css`);
+    assert.strictEqual(res.statusCode, 200);
+    assert.ok(String(res.headers['content-type']).startsWith('text/css'));
+  })) passed++; else failed++;
+
   if (await test('static chrome assets are served', async () => {
     for (const asset of ['/canvas.css', '/client.js', '/sdk.js']) {
       const res = await request(port, 'GET', asset);

From dbeb7232187c45d2ed6fc20030bf27322a2791cc Mon Sep 17 00:00:00 2001
From: affaan-m <124439313+affaan-m@users.noreply.github.com>
Date: Sun, 27 Sep 2026 22:23:33 -0400
Subject: [PATCH 3/5] fix(plan-canvas): bind bounded artifact reads to verified
 descriptors

---
 scripts/lib/plan-canvas/server.js | 126 +++++++++++++--
 tests/scripts/plan-canvas.test.js | 252 ++++++++++++++++++++++++++++++
 2 files changed, 362 insertions(+), 16 deletions(-)

diff --git a/scripts/lib/plan-canvas/server.js b/scripts/lib/plan-canvas/server.js
index 7e41774bb..ae0a83468 100644
--- a/scripts/lib/plan-canvas/server.js
+++ b/scripts/lib/plan-canvas/server.js
@@ -123,6 +123,112 @@ function sendHtml(res, statusCode, html, { csp = true } = {}) {
   res.end(html);
 }
 
+// Sibling assets have an explicit 64 MiB resource limit (413 above it), separate
+// from request-body limits. Reads use at most the sampled size plus one sentinel.
+const MAX_ARTIFACT_ASSET_BYTES = 64 * 1024 * 1024;
+
+function assetReadError(code = 'EARTIFACT_UNSAFE') {
+  return Object.assign(new Error('Artifact sibling read refused'), { code });
+}
+
+function sameAssetIdentity(before, after) {
+  return before.dev === after.dev && before.ino === after.ino && before.mode === after.mode;
+}
+
+function sameAssetFile(before, after) {
+  return after.isFile() && sameAssetIdentity(before, after) && before.size === after.size
+    && (before.mtimeNs ?? before.mtimeMs) === (after.mtimeNs ?? after.mtimeMs)
+    && (before.ctimeNs ?? before.ctimeMs) === (after.ctimeNs ?? after.ctimeMs);
+}
+
+function assetByteLength(stats) {
+  if (typeof stats.size !== 'bigint' && !Number.isSafeInteger(stats.size)) throw assetReadError();
+  const size = BigInt(stats.size);
+  if (size < 0n) throw assetReadError();
+  if (size > BigInt(MAX_ARTIFACT_ASSET_BYTES)) throw assetReadError('EARTIFACT_TOO_LARGE');
+  return Number(size);
+}
+
+function snapshotAssetChain(realTarget) {
+  const root = path.parse(realTarget).root;
+  const parts = path.relative(root, realTarget).split(path.sep).filter(Boolean);
+  const paths = [root];
+  for (const part of parts) paths.push(path.join(paths[paths.length - 1], part));
+  return paths.map((entryPath, index) => {
+    const stats = fs.lstatSync(entryPath, { bigint: true });
+    const leaf = index === paths.length - 1;
+    if (stats.isSymbolicLink() || !(leaf ? stats.isFile() : stats.isDirectory())) throw assetReadError();
+    return { path: entryPath, stats, leaf };
+  });
+}
+
+function revalidateAssetPath({ baseDir, resolved, realBase, realTarget, chain }) {
+  if (fs.realpathSync(baseDir) !== realBase || fs.realpathSync(resolved) !== realTarget) throw assetReadError();
+  for (const entry of chain) {
+    const current = fs.lstatSync(entry.path, { bigint: true });
+    if (current.isSymbolicLink() || !(entry.leaf ? sameAssetFile(entry.stats, current)
+      : current.isDirectory() && sameAssetIdentity(entry.stats, current))) throw assetReadError();
+  }
+}
+
+function readAssetDescriptor(fd, size) {
+  const buffer = Buffer.alloc(size + 1);
+  let bytes = 0;
+  while (bytes < buffer.length) {
+    const requested = buffer.length - bytes;
+    const count = fs.readSync(fd, buffer, bytes, requested, bytes);
+    if (!Number.isInteger(count) || count < 0 || count > requested) throw assetReadError();
+    if (count === 0) break;
+    bytes += count;
+  }
+  if (bytes !== size) throw assetReadError();
+  return buffer.subarray(0, bytes);
+}
+
+// Canonical ancestors are sampled from the filesystem root, not just realBase.
+// Revalidation detects observed replacements, but portable pathname operations
+// are not atomic openat confinement: repeated swap/restore or same-inode content
+// races can evade observations. This helper covers siblings only, not the direct
+// session.file read. O_NOFOLLOW protects the leaf only where the flag exists.
+function readSiblingAsset(baseDir, resolved) {
+  const realBase = fs.realpathSync(baseDir);
+  const realTarget = fs.realpathSync(resolved);
+  const relative = path.relative(realBase, realTarget);
+  if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) throw assetReadError();
+  const chain = snapshotAssetChain(realTarget);
+  const expected = chain[chain.length - 1].stats;
+  const size = assetByteLength(expected);
+  const snapshot = { baseDir, resolved, realBase, realTarget, chain };
+  revalidateAssetPath(snapshot);
+  const flags = fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0) | (fs.constants.O_NONBLOCK || 0);
+  let fd;
+  try {
+    fd = fs.openSync(realTarget, flags);
+  } catch (error) {
+    if (error.code === 'ELOOP' || error.code === 'ENOTDIR') throw assetReadError();
+    throw error;
+  }
+  let primaryError;
+  let data;
+  try {
+    if (!sameAssetFile(expected, fs.fstatSync(fd, { bigint: true }))) throw assetReadError();
+    revalidateAssetPath(snapshot);
+    data = readAssetDescriptor(fd, size);
+    if (!sameAssetFile(expected, fs.fstatSync(fd, { bigint: true }))) throw assetReadError();
+    revalidateAssetPath(snapshot);
+  } catch (error) {
+    primaryError = error;
+  } finally {
+    try { fs.closeSync(fd); } catch (error) {
+      // A close error may mean the fd is already released; never retry it or
+      // replace the primary read/validation failure. Close-only failure refuses.
+      if (!primaryError) primaryError = error;
+    }
+  }
+  if (primaryError) throw primaryError;
+  return { data, realTarget };
+}
+
 function createPlanCanvasServer({
   store,
   host = DEFAULT_HOST,
@@ -532,24 +638,12 @@ function createPlanCanvasServer({
       return sendJson(res, 403, { error: 'asset path escapes artifact directory' });
     }
     let realTarget;
-    try {
-      const realBase = fs.realpathSync(baseDir);
-      realTarget = fs.realpathSync(resolved);
-      if (realTarget !== realBase && !realTarget.startsWith(realBase + path.sep)) {
-        return sendJson(res, 403, { error: 'asset path escapes artifact directory' });
-      }
-    } catch {
-      return sendJson(res, 404, { error: 'asset not found' });
-    }
-    // Residual TOCTOU note: the confinement check and the read below are
-    // separate operations. A local writer able to replace the target or its
-    // parent directory entries can still redirect the read between them.
-    // Static confinement assumes trusted local directory writers; it is not
-    // race-free. The document sandbox below is a separate origin boundary.
     let data;
     try {
-      data = fs.readFileSync(realTarget);
-    } catch {
+      ({ data, realTarget } = readSiblingAsset(baseDir, resolved));
+    } catch (error) {
+      if (error.code === 'EARTIFACT_TOO_LARGE') return sendJson(res, 413, { error: 'asset too large' });
+      if (error.code === 'EARTIFACT_UNSAFE') return sendJson(res, 403, { error: 'asset changed or unsafe' });
       return sendJson(res, 404, { error: 'asset not found' });
     }
     // MIME comes from the link/request name first so a symlinked asset keeps
diff --git a/tests/scripts/plan-canvas.test.js b/tests/scripts/plan-canvas.test.js
index 9b8e760df..bd4ee362b 100644
--- a/tests/scripts/plan-canvas.test.js
+++ b/tests/scripts/plan-canvas.test.js
@@ -202,6 +202,257 @@ async function artifactSecurityTests(test) {
   });
 }
 
+// Deterministic filesystem boundaries, using private regular files only. Native
+// descriptors are owned here even when a spy returns a different private file.
+async function withAssetIo(asset, overrides, callback) {
+  const target = fs.realpathSync(asset);
+  const methods = ['openSync', 'fstatSync', 'lstatSync', 'readSync', 'closeSync'];
+  const original = Object.fromEntries(methods.map(name => [name, fs[name]]));
+  const live = new Set();
+  const calls = { opens: 0, reads: 0, closes: 0, fstats: 0, requested: [], returned: 0, flags: [] };
+  fs.openSync = function (candidate, flags, ...rest) {
+    if (typeof candidate !== 'string' || path.resolve(candidate) !== target) return original.openSync(candidate, flags, ...rest);
+    calls.opens++;
+    calls.flags.push(flags);
+    const fd = overrides.open
+      ? overrides.open({ candidate, flags, original, calls })
+      : original.openSync(candidate, flags, ...rest);
+    live.add(fd);
+    return fd;
+  };
+  fs.fstatSync = function (fd, ...rest) {
+    const stats = original.fstatSync(fd, ...rest);
+    if (!live.has(fd)) return stats;
+    calls.fstats++;
+    return overrides.fstat ? overrides.fstat(stats, calls) : stats;
+  };
+  fs.lstatSync = function (candidate, ...rest) {
+    const stats = original.lstatSync(candidate, ...rest);
+    return overrides.lstat ? overrides.lstat(path.resolve(candidate), stats, calls) : stats;
+  };
+  fs.readSync = function (fd, buffer, offset, length, position) {
+    if (!live.has(fd)) return original.readSync(fd, buffer, offset, length, position);
+    calls.reads++;
+    calls.requested.push({ length, position, capacity: buffer.length });
+    const count = overrides.read
+      ? overrides.read({ fd, buffer, offset, length, position, original, calls })
+      : original.readSync(fd, buffer, offset, length, position);
+    calls.returned += count;
+    return count;
+  };
+  fs.closeSync = function (fd) {
+    if (!live.has(fd)) return original.closeSync(fd);
+    calls.closes++;
+    // Close the actual fixture descriptor before optionally simulating a close
+    // error. The test never leaks an fd to imitate an ambiguous OS error.
+    original.closeSync(fd);
+    live.delete(fd);
+    if (overrides.close) overrides.close(calls);
+  };
+  try {
+    await callback(calls);
+    assert.strictEqual(live.size, 0, 'All returned descriptors must close');
+  } finally {
+    for (const name of methods) fs[name] = original[name];
+    // Cleanup after a failing assertion/implementation; leaks still fail above.
+    for (const fd of live) original.closeSync(fd);
+  }
+}
+
+function changedStats(stats, changes) {
+  return Object.assign(Object.create(Object.getPrototypeOf(stats)), stats, changes);
+}
+
+function assertAssetRefusal(response, status, base, outside) {
+  assert.strictEqual(response.statusCode, status);
+  assert.ok(!response.body.includes('private-fixture-secret'));
+  assert.ok(!response.body.includes(base));
+  assert.ok(!response.body.includes(outside));
+}
+
+async function artifactRaceTests(test) {
+  const withFile = callback => withArtifactHandler(async value => {
+    const parent = path.join(value.base, 'nested');
+    fs.mkdirSync(parent);
+    const asset = path.join(parent, 'asset.txt');
+    fs.writeFileSync(asset, 'inert');
+    fs.writeFileSync(path.join(value.outside, 'asset.txt'), 'private-fixture-secret');
+    await callback({ ...value, parent, asset, fetch: () => value.get('nested/asset.txt') });
+  });
+  await test('sibling reads use one guarded descriptor and at most size plus one bytes', () => withFile(async ({ asset, fetch }) => {
+    await withAssetIo(asset, {}, async calls => {
+      const response = await fetch();
+      assert.strictEqual(response.statusCode, 200);
+      assert.strictEqual(response.body, 'inert');
+      assert.deepStrictEqual([calls.opens, calls.closes], [1, 1]);
+      assert.ok(calls.fstats >= 2);
+      assert.strictEqual(typeof calls.flags[0], 'number');
+      for (const flag of [fs.constants.O_NOFOLLOW || 0, fs.constants.O_NONBLOCK || 0]) {
+        assert.strictEqual(calls.flags[0] & flag, flag);
+      }
+      assert.ok(calls.requested.length > 0);
+      assert.ok(calls.requested.every(call => call.capacity === 6 && call.length <= 6 && Number.isInteger(call.position)));
+      assert.strictEqual(calls.returned, 5);
+    });
+  }));
+  await test('a leaf symlink replacement before native open never reads outside bytes', () => withFile(async ({ asset, base, outside, fetch }) => {
+    const probe = path.join(base, 'probe');
+    createTestSymlink(path.join(outside, 'asset.txt'), probe);
+    fs.unlinkSync(probe);
+    await withAssetIo(asset, { open({ candidate, flags, original }) {
+      fs.unlinkSync(asset);
+      fs.symlinkSync(path.join(outside, 'asset.txt'), asset, 'file');
+      return original.openSync(candidate, flags);
+    } }, async calls => {
+      assertAssetRefusal(await fetch(), 403, base, outside);
+      assert.strictEqual(calls.reads, 0);
+      assert.ok(calls.closes === 0 || calls.closes === 1);
+    });
+  }));
+  await test('a substituted descriptor is rejected even with an unchanged pathname', () => withFile(async ({ asset, base, outside, fetch }) => {
+    await withAssetIo(asset, { open({ original }) {
+      return original.openSync(path.join(outside, 'asset.txt'), fs.constants.O_RDONLY);
+    } }, async calls => {
+      assertAssetRefusal(await fetch(), 403, base, outside);
+      assert.deepStrictEqual([calls.reads, calls.closes], [0, 1]);
+    });
+  }));
+  await test('an intermediate directory symlink swap before open never reads outside bytes', () => withFile(async ({ asset, parent, base, outside, fetch }) => {
+    const probe = path.join(base, 'probe');
+    createTestSymlink(outside, probe, 'dir');
+    fs.unlinkSync(probe);
+    await withAssetIo(asset, { open({ candidate, flags, original }) {
+      fs.renameSync(parent, `${parent}.saved`);
+      fs.symlinkSync(outside, parent, 'dir');
+      return original.openSync(candidate, flags);
+    } }, async calls => {
+      assertAssetRefusal(await fetch(), 403, base, outside);
+      assert.deepStrictEqual([calls.reads, calls.closes], [0, 1]);
+    });
+  }));
+  await test('parent replacement is refused even with the same leaf inode and simulated stable leaf metadata', () => withFile(async ({ asset, parent, base, outside, fetch }) => {
+    const before = fs.statSync(asset, { bigint: true });
+    const stable = stats => changedStats(stats, { mtimeNs: before.mtimeNs, ctimeNs: before.ctimeNs });
+    await withAssetIo(asset, {
+      open({ candidate, flags, original }) {
+        fs.renameSync(parent, `${parent}.saved`);
+        fs.mkdirSync(parent);
+        fs.renameSync(path.join(`${parent}.saved`, 'asset.txt'), asset);
+        const current = fs.statSync(asset, { bigint: true });
+        assert.deepStrictEqual([current.dev, current.ino], [before.dev, before.ino]);
+        return original.openSync(candidate, flags);
+      },
+      fstat: stable,
+      lstat(candidate, stats) { return candidate === asset ? stable(stats) : stats; }
+    }, async calls => {
+      assertAssetRefusal(await fetch(), 403, base, outside);
+      assert.deepStrictEqual([calls.reads, calls.closes], [0, 1]);
+    });
+  }));
+  await test('simulated ancestor replacement above the artifact base is refused before read', () => withFile(async ({ asset, base, outside, fetch }) => {
+    await withAssetIo(asset, { lstat(candidate, stats, calls) {
+      return calls.opens > 0 && candidate === path.dirname(base)
+        ? changedStats(stats, { ino: stats.ino + 1n }) : stats;
+    } }, async calls => {
+      assertAssetRefusal(await fetch(), 403, base, outside);
+      assert.deepStrictEqual([calls.reads, calls.closes], [0, 1]);
+    });
+  }));
+  for (const change of ['descriptor metadata', 'ancestor identity']) {
+    await test(`simulated ${change} change after reading discards the buffered body`, () => withFile(async ({ asset, parent, base, outside, fetch }) => {
+      await withAssetIo(asset, {
+        fstat(stats, calls) { return change === 'descriptor metadata' && calls.reads > 0
+          ? changedStats(stats, { mtimeNs: stats.mtimeNs + 1n }) : stats; },
+        lstat(candidate, stats, calls) { return change === 'ancestor identity' && calls.reads > 0 && candidate === parent
+          ? changedStats(stats, { ino: stats.ino + 1n }) : stats; }
+      }, async calls => {
+        assertAssetRefusal(await fetch(), 403, base, outside);
+        assert.ok(calls.reads > 0);
+        assert.strictEqual(calls.closes, 1);
+      });
+    }));
+  }
+  await test('retargeting an in-root alias after read discards buffered bytes', () => withFile(async ({ asset, base, outside, get }) => {
+    const alias = path.join(base, 'alias.txt');
+    const other = path.join(base, 'other.txt');
+    fs.writeFileSync(other, 'other');
+    createTestSymlink(asset, alias);
+    await withAssetIo(asset, { read({ fd, buffer, offset, length, position, original, calls }) {
+      const count = original.readSync(fd, buffer, offset, length, position);
+      if (calls.reads === 1) { fs.unlinkSync(alias); fs.symlinkSync(other, alias, 'file'); }
+      return count;
+    } }, async calls => {
+      assertAssetRefusal(await get('alias.txt'), 403, base, outside);
+      assert.strictEqual(calls.closes, 1);
+    });
+  }));
+  for (const size of [67108865n, -1n, 1.5, Infinity]) {
+    await test(`invalid or over-limit sampled size ${size} is refused before open`, () => withFile(async ({ asset, base, outside, fetch }) => {
+      await withAssetIo(asset, { lstat(candidate, stats) { return candidate === asset ? changedStats(stats, { size }) : stats; } }, async calls => {
+        const status = size === 67108865n ? 413 : 403;
+        const response = await fetch();
+        assertAssetRefusal(response, status, base, outside);
+        if (status === 413) assert.deepStrictEqual(JSON.parse(response.body), { error: 'asset too large' });
+        assert.deepStrictEqual([calls.opens, calls.reads, calls.closes], [0, 0, 0]);
+      });
+    }));
+  }
+  await test('non-regular opened descriptors are refused without reading', () => withFile(async ({ asset, base, outside, fetch }) => {
+    await withAssetIo(asset, { fstat(stats) { return changedStats(stats, { isFile: () => false }); } }, async calls => {
+      assertAssetRefusal(await fetch(), 403, base, outside);
+      assert.deepStrictEqual([calls.reads, calls.closes], [0, 1]);
+    });
+  }));
+  for (const kind of ['growth sentinel', 'early EOF']) {
+    await test(`bounded read refuses ${kind}`, () => withFile(async ({ asset, base, outside, fetch }) => {
+      await withAssetIo(asset, { read({ buffer, offset, length }) {
+        if (kind === 'early EOF') return 0;
+        buffer.fill(97, offset, offset + length);
+        return length;
+      } }, async calls => {
+        assertAssetRefusal(await fetch(), 403, base, outside);
+        assert.ok(calls.returned <= 6);
+        assert.ok(calls.requested.every(call => call.length <= 6 && call.capacity === 6));
+        assert.strictEqual(calls.closes, 1);
+      });
+    }));
+  }
+  for (const boundary of ['open', 'fstat', 'read', 'close', 'read and close']) {
+    await test(`${boundary} failure closes only acquired descriptors once and returns no body`, () => withFile(async ({ asset, base, outside, fetch }) => {
+      const failure = code => Object.assign(new Error(`private failure at ${asset}`), { code });
+      const overrides = {};
+      if (boundary === 'open') overrides.open = () => { throw failure('EACCES'); };
+      if (boundary === 'fstat') overrides.fstat = () => { throw failure('EIO'); };
+      if (boundary.includes('read')) overrides.read = () => { throw failure('EIO'); };
+      if (boundary.includes('close')) overrides.close = () => { throw failure(boundary === 'read and close' ? 'ELOOP' : 'EIO'); };
+      await withAssetIo(asset, overrides, async calls => {
+        assertAssetRefusal(await fetch(), 404, base, outside);
+        assert.strictEqual(calls.closes, boundary === 'open' ? 0 : 1);
+      });
+    }));
+  }
+  await test('primary descriptor validation refusal survives a secondary close error', () => withFile(async ({ asset, base, outside, fetch }) => {
+    await withAssetIo(asset, {
+      open({ original }) { return original.openSync(path.join(outside, 'asset.txt'), fs.constants.O_RDONLY); },
+      close() { throw Object.assign(new Error('secondary close error'), { code: 'EIO' }); }
+    }, async calls => {
+      assertAssetRefusal(await fetch(), 403, base, outside);
+      assert.deepStrictEqual([calls.reads, calls.closes], [0, 1]);
+    });
+  }));
+  await test('empty sibling files and static in-root directory aliases remain supported', () => withFile(async ({ asset, parent, base, get }) => {
+    fs.writeFileSync(asset, '');
+    createTestSymlink(parent, path.join(base, 'inside'), 'dir');
+    await withAssetIo(asset, {}, async calls => {
+      const response = await get('inside/asset.txt');
+      assert.strictEqual(response.statusCode, 200);
+      assert.strictEqual(response.body, '');
+      assert.deepStrictEqual([calls.opens, calls.closes, calls.returned], [1, 1, 0]);
+      assert.ok(calls.requested.every(call => call.capacity === 1));
+    });
+  }));
+}
+
 function request(port, method, requestPath, { body = null, headers = {} } = {}) {
   return new Promise((resolve, reject) => {
     const payload = body === null ? null : JSON.stringify(body);
@@ -286,6 +537,7 @@ async function main() {
   const suite = createTestRunner();
   const { test } = suite;
   await artifactSecurityTests(test);
+  await artifactRaceTests(test);
   if (process.argv.includes('--artifact-security-only')) {
     printResults(suite.results);
     return;

From 57841ab3e6a0abc1b58a97b6abcfcd9881aeb2a6 Mon Sep 17 00:00:00 2001
From: affaan-m <124439313+affaan-m@users.noreply.github.com>
Date: Sun, 27 Sep 2026 22:47:46 -0400
Subject: [PATCH 4/5] test(plan-canvas): canonicalize temporary fixture paths

---
 tests/scripts/plan-canvas.test.js | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/tests/scripts/plan-canvas.test.js b/tests/scripts/plan-canvas.test.js
index bd4ee362b..a5ef1d3a0 100644
--- a/tests/scripts/plan-canvas.test.js
+++ b/tests/scripts/plan-canvas.test.js
@@ -272,12 +272,14 @@ function assertAssetRefusal(response, status, base, outside) {
 
 async function artifactRaceTests(test) {
   const withFile = callback => withArtifactHandler(async value => {
-    const parent = path.join(value.base, 'nested');
+    const base = fs.realpathSync(value.base);
+    const outside = fs.realpathSync(value.outside);
+    const parent = path.join(base, 'nested');
     fs.mkdirSync(parent);
     const asset = path.join(parent, 'asset.txt');
     fs.writeFileSync(asset, 'inert');
-    fs.writeFileSync(path.join(value.outside, 'asset.txt'), 'private-fixture-secret');
-    await callback({ ...value, parent, asset, fetch: () => value.get('nested/asset.txt') });
+    fs.writeFileSync(path.join(outside, 'asset.txt'), 'private-fixture-secret');
+    await callback({ ...value, base, outside, parent, asset, fetch: () => value.get('nested/asset.txt') });
   });
   await test('sibling reads use one guarded descriptor and at most size plus one bytes', () => withFile(async ({ asset, fetch }) => {
     await withAssetIo(asset, {}, async calls => {

From 83f19dee141b7363e6a54a4fec4c0a584d229b81 Mon Sep 17 00:00:00 2001
From: affaan-m <124439313+affaan-m@users.noreply.github.com>
Date: Sun, 27 Sep 2026 23:08:21 -0400
Subject: [PATCH 5/5] test(plan-canvas): isolate filesystem fixtures and
 cleanup failures

---
 tests/scripts/plan-canvas.test.js | 350 ++++++++++++++++++++++++------
 1 file changed, 278 insertions(+), 72 deletions(-)

diff --git a/tests/scripts/plan-canvas.test.js b/tests/scripts/plan-canvas.test.js
index a5ef1d3a0..972c16ee5 100644
--- a/tests/scripts/plan-canvas.test.js
+++ b/tests/scripts/plan-canvas.test.js
@@ -13,6 +13,8 @@ const fs = require('fs');
 const http = require('http');
 const os = require('os');
 const path = require('path');
+const { compileFunction } = require('node:vm');
+const { createRequire } = require('node:module');
 
 const { createSessionStore } = require('../../scripts/lib/plan-canvas/sessions');
 const { createPlanCanvasServer } = require('../../scripts/lib/plan-canvas/server');
@@ -60,12 +62,56 @@ function printResults(results) {
   process.exitCode = results.failed > 0 ? 1 : 0;
 }
 
-// Capture the real dispatcher without binding a socket. Artifact bodies are
-// only compared as inert response bytes, never executed in a browser.
-async function withArtifactHandler(callback) {
+// Compile the exact trusted module privately; this is not a security sandbox.
+// Relative dependencies retain normal resolution, without rewriting source or
+// changing module loaders, shared exports, or require.cache.
+const artifactServerFilename = require.resolve('../../scripts/lib/plan-canvas/server');
+const artifactServerSource = fs.readFileSync(artifactServerFilename, 'utf8');
+const artifactRequire = createRequire(artifactServerFilename);
+
+function loadArtifactServer(filesystem, localHttp) {
+  const localRequire = name => {
+    if (name === 'fs' || name === 'node:fs') return filesystem;
+    if (name === 'http' || name === 'node:http') return localHttp;
+    return artifactRequire(name);
+  };
+  const localModule = { exports: {} };
+  const evaluate = compileFunction(artifactServerSource,
+    ['require', 'module', 'exports', '__filename', '__dirname'], { filename: artifactServerFilename });
+  evaluate.call(localModule.exports, localRequire, localModule, localModule.exports,
+    artifactServerFilename, path.dirname(artifactServerFilename));
+  return localModule.exports;
+}
+
+// Preserve arbitrary primary thrown values, including falsy values. Secondary
+// cleanup diagnostics are intentionally discarded when a primary exists.
+async function withFixtureCleanup(callback, cleanups) {
+  let didThrow = false;
+  let primary;
+  let result;
+  try { result = await callback(); } catch (error) { didThrow = true; primary = error; }
+  let cleanupThrew = false;
+  let firstCleanup;
+  for (const cleanup of cleanups()) {
+    try { await cleanup(); } catch (error) {
+      if (!cleanupThrew) { cleanupThrew = true; firstCleanup = error; }
+    }
+  }
+  if (didThrow) throw primary;
+  if (cleanupThrew) throw firstCleanup;
+  return result;
+}
+
+// Capture fresh real dispatchers without binding sockets. Each request captures
+// its own filesystem facade; the fixture owns those canvases until teardown.
+// Artifact bodies are inert response bytes, never executed in a browser.
+async function withArtifactHandler(callback, {
+  closeCanvas = canvas => canvas.close(),
+  removeRoot = root => fs.rmSync(root, { recursive: true, force: true })
+} = {}) {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'plan-canvas-artifact-'));
-  let canvas;
-  try {
+  const canvases = [];
+  return withFixtureCleanup(async () => {
     const base = path.join(root, 'artifacts');
     const outside = path.join(root, 'outside');
     fs.mkdirSync(base);
@@ -73,21 +119,20 @@ async function withArtifactHandler(callback) {
     const session = { key: '0123456789ab', file: path.join(base, 'main.md') };
     fs.writeFileSync(session.file, '# Inert fixture\n');
     fs.writeFileSync(path.join(outside, 'secret.txt'), 'private-fixture-secret');
-    let handler;
-    const originalCreateServer = http.createServer;
-    http.createServer = requestHandler => {
-      handler = requestHandler;
-      return {
-        listen() { throw new Error('Artifact tests must not open a listener'); },
-        close(done) { done(); }
-      };
-    };
-    try {
-      canvas = createPlanCanvasServer({ store: { get: key => key === session.key ? session : null }, idleTimeoutMs: 0 });
-    } finally {
-      http.createServer = originalCreateServer;
-    }
-    const get = asset => new Promise(resolve => {
+    const get = (asset, filesystem = fs) => new Promise(resolve => {
+      let handler;
+      const localHttp = Object.freeze({ ...http, createServer(requestHandler) {
+        handler = requestHandler;
+        return {
+          listen() { throw new Error('Artifact tests must not open a listener'); },
+          close(done) { done(); }
+        };
+      } });
+      const localServer = loadArtifactServer(filesystem, localHttp);
+      const canvas = localServer.createPlanCanvasServer({
+        store: { get: key => key === session.key ? session : null }, idleTimeoutMs: 0
+      });
+      canvases.push(canvas);
       const response = { headersSent: false };
       response.writeHead = (statusCode, headers) => {
         response.statusCode = statusCode;
@@ -97,11 +142,8 @@ async function withArtifactHandler(callback) {
       response.end = data => resolve({ statusCode: response.statusCode, headers: response.headers, body: String(data || '') });
       handler({ method: 'GET', headers: { host: '127.0.0.1' }, url: `/artifact/${session.key}/${asset}` }, response);
     });
-    await callback({ base, outside, session, get });
-  } finally {
-    if (canvas) await canvas.close();
-    fs.rmSync(root, { recursive: true, force: true });
-  }
+    return callback({ base, outside, session, get });
+  }, () => [...canvases.map(canvas => () => closeCanvas(canvas)), () => removeRoot(root)]);
 }
 
 async function artifactSecurityTests(test) {
@@ -204,13 +246,13 @@ async function artifactSecurityTests(test) {
 
 // Deterministic filesystem boundaries, using private regular files only. Native
 // descriptors are owned here even when a spy returns a different private file.
-async function withAssetIo(asset, overrides, callback) {
+async function withAssetIo(asset, overrides, callback, { cleanupClose = fs.closeSync } = {}) {
   const target = fs.realpathSync(asset);
   const methods = ['openSync', 'fstatSync', 'lstatSync', 'readSync', 'closeSync'];
   const original = Object.fromEntries(methods.map(name => [name, fs[name]]));
   const live = new Set();
   const calls = { opens: 0, reads: 0, closes: 0, fstats: 0, requested: [], returned: 0, flags: [] };
-  fs.openSync = function (candidate, flags, ...rest) {
+  const filesystem = Object.freeze({ ...fs, openSync(candidate, flags, ...rest) {
     if (typeof candidate !== 'string' || path.resolve(candidate) !== target) return original.openSync(candidate, flags, ...rest);
     calls.opens++;
     calls.flags.push(flags);
@@ -219,18 +261,18 @@ async function withAssetIo(asset, overrides, callback) {
       : original.openSync(candidate, flags, ...rest);
     live.add(fd);
     return fd;
-  };
-  fs.fstatSync = function (fd, ...rest) {
+  },
+  fstatSync(fd, ...rest) {
     const stats = original.fstatSync(fd, ...rest);
     if (!live.has(fd)) return stats;
     calls.fstats++;
     return overrides.fstat ? overrides.fstat(stats, calls) : stats;
-  };
-  fs.lstatSync = function (candidate, ...rest) {
+  },
+  lstatSync(candidate, ...rest) {
     const stats = original.lstatSync(candidate, ...rest);
     return overrides.lstat ? overrides.lstat(path.resolve(candidate), stats, calls) : stats;
-  };
-  fs.readSync = function (fd, buffer, offset, length, position) {
+  },
+  readSync(fd, buffer, offset, length, position) {
     if (!live.has(fd)) return original.readSync(fd, buffer, offset, length, position);
     calls.reads++;
     calls.requested.push({ length, position, capacity: buffer.length });
@@ -239,24 +281,33 @@ async function withAssetIo(asset, overrides, callback) {
       : original.readSync(fd, buffer, offset, length, position);
     calls.returned += count;
     return count;
-  };
-  fs.closeSync = function (fd) {
+  },
+  closeSync(fd) {
     if (!live.has(fd)) return original.closeSync(fd);
     calls.closes++;
     // Close the actual fixture descriptor before optionally simulating a close
     // error. The test never leaks an fd to imitate an ambiguous OS error.
-    original.closeSync(fd);
     live.delete(fd);
+    original.closeSync(fd);
     if (overrides.close) overrides.close(calls);
-  };
-  try {
-    await callback(calls);
+  } });
+  return withFixtureCleanup(async () => {
+    await callback(calls, filesystem);
+    // Assert BEFORE fallback cleanup: closing a leaked fd cannot make it pass.
     assert.strictEqual(live.size, 0, 'All returned descriptors must close');
-  } finally {
-    for (const name of methods) fs[name] = original[name];
-    // Cleanup after a failing assertion/implementation; leaks still fail above.
-    for (const fd of live) original.closeSync(fd);
+  }, () => [() => closeOwnedDescriptors(live, cleanupClose)]);
+}
+
+function closeOwnedDescriptors(owned, close) {
+  let didThrow = false;
+  let first;
+  for (const fd of owned) {
+    owned.delete(fd); // An ambiguous close result must never cause a retry.
+    try { close(fd); } catch (error) {
+      if (!didThrow) { didThrow = true; first = error; }
+    }
   }
+  if (didThrow) throw first;
 }
 
 function changedStats(stats, changes) {
@@ -279,11 +330,11 @@ async function artifactRaceTests(test) {
     const asset = path.join(parent, 'asset.txt');
     fs.writeFileSync(asset, 'inert');
     fs.writeFileSync(path.join(outside, 'asset.txt'), 'private-fixture-secret');
-    await callback({ ...value, base, outside, parent, asset, fetch: () => value.get('nested/asset.txt') });
+    await callback({ ...value, base, outside, parent, asset, fetch: filesystem => value.get('nested/asset.txt', filesystem) });
   });
   await test('sibling reads use one guarded descriptor and at most size plus one bytes', () => withFile(async ({ asset, fetch }) => {
-    await withAssetIo(asset, {}, async calls => {
-      const response = await fetch();
+    await withAssetIo(asset, {}, async (calls, filesystem) => {
+      const response = await fetch(filesystem);
       assert.strictEqual(response.statusCode, 200);
       assert.strictEqual(response.body, 'inert');
       assert.deepStrictEqual([calls.opens, calls.closes], [1, 1]);
@@ -305,8 +356,8 @@ async function artifactRaceTests(test) {
       fs.unlinkSync(asset);
       fs.symlinkSync(path.join(outside, 'asset.txt'), asset, 'file');
       return original.openSync(candidate, flags);
-    } }, async calls => {
-      assertAssetRefusal(await fetch(), 403, base, outside);
+    } }, async (calls, filesystem) => {
+      assertAssetRefusal(await fetch(filesystem), 403, base, outside);
       assert.strictEqual(calls.reads, 0);
       assert.ok(calls.closes === 0 || calls.closes === 1);
     });
@@ -314,8 +365,8 @@ async function artifactRaceTests(test) {
   await test('a substituted descriptor is rejected even with an unchanged pathname', () => withFile(async ({ asset, base, outside, fetch }) => {
     await withAssetIo(asset, { open({ original }) {
       return original.openSync(path.join(outside, 'asset.txt'), fs.constants.O_RDONLY);
-    } }, async calls => {
-      assertAssetRefusal(await fetch(), 403, base, outside);
+    } }, async (calls, filesystem) => {
+      assertAssetRefusal(await fetch(filesystem), 403, base, outside);
       assert.deepStrictEqual([calls.reads, calls.closes], [0, 1]);
     });
   }));
@@ -327,8 +378,8 @@ async function artifactRaceTests(test) {
       fs.renameSync(parent, `${parent}.saved`);
       fs.symlinkSync(outside, parent, 'dir');
       return original.openSync(candidate, flags);
-    } }, async calls => {
-      assertAssetRefusal(await fetch(), 403, base, outside);
+    } }, async (calls, filesystem) => {
+      assertAssetRefusal(await fetch(filesystem), 403, base, outside);
       assert.deepStrictEqual([calls.reads, calls.closes], [0, 1]);
     });
   }));
@@ -346,8 +397,8 @@ async function artifactRaceTests(test) {
       },
       fstat: stable,
       lstat(candidate, stats) { return candidate === asset ? stable(stats) : stats; }
-    }, async calls => {
-      assertAssetRefusal(await fetch(), 403, base, outside);
+    }, async (calls, filesystem) => {
+      assertAssetRefusal(await fetch(filesystem), 403, base, outside);
       assert.deepStrictEqual([calls.reads, calls.closes], [0, 1]);
     });
   }));
@@ -355,8 +406,8 @@ async function artifactRaceTests(test) {
     await withAssetIo(asset, { lstat(candidate, stats, calls) {
       return calls.opens > 0 && candidate === path.dirname(base)
         ? changedStats(stats, { ino: stats.ino + 1n }) : stats;
-    } }, async calls => {
-      assertAssetRefusal(await fetch(), 403, base, outside);
+    } }, async (calls, filesystem) => {
+      assertAssetRefusal(await fetch(filesystem), 403, base, outside);
       assert.deepStrictEqual([calls.reads, calls.closes], [0, 1]);
     });
   }));
@@ -367,8 +418,8 @@ async function artifactRaceTests(test) {
           ? changedStats(stats, { mtimeNs: stats.mtimeNs + 1n }) : stats; },
         lstat(candidate, stats, calls) { return change === 'ancestor identity' && calls.reads > 0 && candidate === parent
           ? changedStats(stats, { ino: stats.ino + 1n }) : stats; }
-      }, async calls => {
-        assertAssetRefusal(await fetch(), 403, base, outside);
+      }, async (calls, filesystem) => {
+        assertAssetRefusal(await fetch(filesystem), 403, base, outside);
         assert.ok(calls.reads > 0);
         assert.strictEqual(calls.closes, 1);
       });
@@ -383,16 +434,16 @@ async function artifactRaceTests(test) {
       const count = original.readSync(fd, buffer, offset, length, position);
       if (calls.reads === 1) { fs.unlinkSync(alias); fs.symlinkSync(other, alias, 'file'); }
       return count;
-    } }, async calls => {
-      assertAssetRefusal(await get('alias.txt'), 403, base, outside);
+    } }, async (calls, filesystem) => {
+      assertAssetRefusal(await get('alias.txt', filesystem), 403, base, outside);
       assert.strictEqual(calls.closes, 1);
     });
   }));
   for (const size of [67108865n, -1n, 1.5, Infinity]) {
     await test(`invalid or over-limit sampled size ${size} is refused before open`, () => withFile(async ({ asset, base, outside, fetch }) => {
-      await withAssetIo(asset, { lstat(candidate, stats) { return candidate === asset ? changedStats(stats, { size }) : stats; } }, async calls => {
+      await withAssetIo(asset, { lstat(candidate, stats) { return candidate === asset ? changedStats(stats, { size }) : stats; } }, async (calls, filesystem) => {
         const status = size === 67108865n ? 413 : 403;
-        const response = await fetch();
+        const response = await fetch(filesystem);
         assertAssetRefusal(response, status, base, outside);
         if (status === 413) assert.deepStrictEqual(JSON.parse(response.body), { error: 'asset too large' });
         assert.deepStrictEqual([calls.opens, calls.reads, calls.closes], [0, 0, 0]);
@@ -400,8 +451,8 @@ async function artifactRaceTests(test) {
     }));
   }
   await test('non-regular opened descriptors are refused without reading', () => withFile(async ({ asset, base, outside, fetch }) => {
-    await withAssetIo(asset, { fstat(stats) { return changedStats(stats, { isFile: () => false }); } }, async calls => {
-      assertAssetRefusal(await fetch(), 403, base, outside);
+    await withAssetIo(asset, { fstat(stats) { return changedStats(stats, { isFile: () => false }); } }, async (calls, filesystem) => {
+      assertAssetRefusal(await fetch(filesystem), 403, base, outside);
       assert.deepStrictEqual([calls.reads, calls.closes], [0, 1]);
     });
   }));
@@ -411,8 +462,8 @@ async function artifactRaceTests(test) {
         if (kind === 'early EOF') return 0;
         buffer.fill(97, offset, offset + length);
         return length;
-      } }, async calls => {
-        assertAssetRefusal(await fetch(), 403, base, outside);
+      } }, async (calls, filesystem) => {
+        assertAssetRefusal(await fetch(filesystem), 403, base, outside);
         assert.ok(calls.returned <= 6);
         assert.ok(calls.requested.every(call => call.length <= 6 && call.capacity === 6));
         assert.strictEqual(calls.closes, 1);
@@ -427,8 +478,8 @@ async function artifactRaceTests(test) {
       if (boundary === 'fstat') overrides.fstat = () => { throw failure('EIO'); };
       if (boundary.includes('read')) overrides.read = () => { throw failure('EIO'); };
       if (boundary.includes('close')) overrides.close = () => { throw failure(boundary === 'read and close' ? 'ELOOP' : 'EIO'); };
-      await withAssetIo(asset, overrides, async calls => {
-        assertAssetRefusal(await fetch(), 404, base, outside);
+      await withAssetIo(asset, overrides, async (calls, filesystem) => {
+        assertAssetRefusal(await fetch(filesystem), 404, base, outside);
         assert.strictEqual(calls.closes, boundary === 'open' ? 0 : 1);
       });
     }));
@@ -437,16 +488,16 @@ async function artifactRaceTests(test) {
     await withAssetIo(asset, {
       open({ original }) { return original.openSync(path.join(outside, 'asset.txt'), fs.constants.O_RDONLY); },
       close() { throw Object.assign(new Error('secondary close error'), { code: 'EIO' }); }
-    }, async calls => {
-      assertAssetRefusal(await fetch(), 403, base, outside);
+    }, async (calls, filesystem) => {
+      assertAssetRefusal(await fetch(filesystem), 403, base, outside);
       assert.deepStrictEqual([calls.reads, calls.closes], [0, 1]);
     });
   }));
   await test('empty sibling files and static in-root directory aliases remain supported', () => withFile(async ({ asset, parent, base, get }) => {
     fs.writeFileSync(asset, '');
     createTestSymlink(parent, path.join(base, 'inside'), 'dir');
-    await withAssetIo(asset, {}, async calls => {
-      const response = await get('inside/asset.txt');
+    await withAssetIo(asset, {}, async (calls, filesystem) => {
+      const response = await get('inside/asset.txt', filesystem);
       assert.strictEqual(response.statusCode, 200);
       assert.strictEqual(response.body, '');
       assert.deepStrictEqual([calls.opens, calls.closes, calls.returned], [1, 1, 0]);
@@ -455,6 +506,160 @@ async function artifactRaceTests(test) {
   }));
 }
 
+// Fixture-only regressions: real private files, direct dispatch, no listener.
+async function fixtureIsolationTests(test) {
+  const methods = ['openSync', 'fstatSync', 'lstatSync', 'readSync', 'closeSync'];
+  const native = Object.fromEntries(methods.map(name => [name, fs[name]]));
+  const createServer = http.createServer;
+  const normalModule = require('../../scripts/lib/plan-canvas/server');
+  function assertSharedIdentity() {
+    for (const name of methods) assert.strictEqual(fs[name], native[name], `shared fs.${name} changed`);
+    assert.strictEqual(http.createServer, createServer, 'shared HTTP factory changed');
+    assert.strictEqual(require('../../scripts/lib/plan-canvas/server'), normalModule);
+  }
+  async function capture(callback) {
+    try { await callback(); return { didThrow: false }; }
+    catch (error) { return { didThrow: true, error }; }
+  }
+  const withAsset = callback => withArtifactHandler(async value => {
+    const asset = path.join(fs.realpathSync(value.base), 'isolation.txt');
+    fs.writeFileSync(asset, 'isolated');
+    await callback({ ...value, asset });
+  });
+
+  await test('fixture overrides never replace shared modules, even during an awaited callback', () => withAsset(async ({ asset, get }) => {
+    await withAssetIo(asset, {}, async (calls, filesystem = fs) => {
+      assertSharedIdentity();
+      assert.ok(Object.isFrozen(filesystem), 'case filesystem facade must be frozen');
+      assert.strictEqual((await get('isolation.txt', filesystem)).body, 'isolated');
+      assert.strictEqual(calls.opens, 1);
+      await Promise.resolve();
+      assertSharedIdentity();
+    });
+    assertSharedIdentity();
+    const primary = Object.freeze(new Error('frozen callback failure'));
+    const caught = await capture(() => withAssetIo(asset, {}, async (_calls, filesystem = fs) => {
+      await get('isolation.txt', filesystem);
+      assertSharedIdentity();
+      throw primary;
+    }));
+    assert.strictEqual(caught.didThrow, true);
+    assert.strictEqual(caught.error, primary);
+    assertSharedIdentity();
+  }));
+
+  await test('interleaved private handlers consume only their own filesystem facades', () => withAsset(async ({ asset, get }) => {
+    await withAssetIo(asset, {}, async (left, leftFs = fs) => {
+      await withAssetIo(asset, {}, async (right, rightFs = fs) => {
+        assert.notStrictEqual(leftFs, rightFs, 'simultaneously active fixtures need distinct facades');
+        assert.strictEqual((await get('isolation.txt', leftFs)).body, 'isolated');
+        assert.deepStrictEqual([left.opens, right.opens], [1, 0]);
+        assert.strictEqual((await get('isolation.txt', rightFs)).body, 'isolated');
+        assert.deepStrictEqual([left.opens, right.opens], [1, 1]);
+        assert.strictEqual((await get('isolation.txt', leftFs)).body, 'isolated');
+        assert.deepStrictEqual([left.opens, right.opens, left.closes, right.closes], [2, 1, 2, 1]);
+        assertSharedIdentity();
+      });
+    });
+  }));
+
+  await test('private CommonJS loader uses exact source and leaves the normal module identity intact', () => {
+    const filename = require.resolve('../../scripts/lib/plan-canvas/server');
+    const before = fs.readFileSync(filename, 'utf8');
+    const localHttp = Object.freeze({ ...http, createServer() { assertSharedIdentity(); throw new Error('local factory'); } });
+    const isolated = loadArtifactServer(fs, localHttp);
+    assert.notStrictEqual(isolated, normalModule);
+    assert.notStrictEqual(isolated.createPlanCanvasServer, normalModule.createPlanCanvasServer);
+    assert.strictEqual(artifactServerSource, before, 'compile the unchanged on-disk source');
+    assert.throws(() => isolated.createPlanCanvasServer({ store: { get() {} }, idleTimeoutMs: 0 }), /local factory/);
+    assert.strictEqual(fs.readFileSync(filename, 'utf8'), before);
+    assertSharedIdentity();
+  });
+
+  for (const primary of [Object.freeze(new Error('primary fixture failure')), 0, false, null, undefined]) {
+    await test(`descriptor fallback preserves exact ${String(primary)} and attempts all owned fds`, () => withAsset(async ({ asset }) => {
+      const fds = [];
+      const attempts = [];
+      const secondary = new Error('secondary cleanup');
+      const caught = await capture(() => withAssetIo(asset, {}, (_calls, filesystem = fs) => {
+        fds.push(filesystem.openSync(asset, 'r'), filesystem.openSync(asset, 'r'));
+        throw primary;
+      }, { cleanupClose(fd) {
+        attempts.push(fd);
+        native.closeSync(fd);
+        if (attempts.length === 1) throw secondary;
+      } }));
+      assert.strictEqual(caught.didThrow, true);
+      assert.ok(Object.is(caught.error, primary), 'cleanup must preserve the exact arbitrary thrown value');
+      assert.deepStrictEqual(attempts, fds, 'each remaining descriptor gets one cleanup attempt');
+      for (const fd of fds) assert.throws(() => native.fstatSync(fd), error => error.code === 'EBADF');
+      assertSharedIdentity();
+    }));
+  }
+
+  await test('fallback cleanup cannot turn a leaked-descriptor assertion into a pass', () => withAsset(async ({ asset }) => {
+    const fds = [];
+    const attempts = [];
+    const secondary = new Error('cleanup after leak assertion');
+    const caught = await capture(() => withAssetIo(asset, {}, (_calls, filesystem = fs) => {
+      fds.push(filesystem.openSync(asset, 'r'), filesystem.openSync(asset, 'r'));
+    }, { cleanupClose(fd) { attempts.push(fd); native.closeSync(fd); throw secondary; } }));
+    assert.strictEqual(caught.didThrow, true);
+    assert.match(caught.error.message, /All returned descriptors must close/);
+    assert.notStrictEqual(caught.error, secondary);
+    assert.deepStrictEqual(attempts, fds);
+    for (const fd of fds) assert.throws(() => native.fstatSync(fd), error => error.code === 'EBADF');
+  }));
+
+  await test('descriptor cleanup alone removes ownership before each single attempt and reports its first failure', () => withAsset(async ({ asset }) => {
+    const fds = [native.openSync(asset, 'r'), native.openSync(asset, 'r')];
+    const owned = new Set(fds);
+    const attempts = [];
+    const first = new Error('first cleanup failure');
+    try {
+      const caught = await capture(() => closeOwnedDescriptors(owned, fd => {
+        assert.ok(!owned.has(fd), 'ownership must be removed before ambiguous close');
+        attempts.push(fd);
+        native.closeSync(fd);
+        throw attempts.length === 1 ? first : new Error('later cleanup failure');
+      }));
+      assert.strictEqual(caught.didThrow, true);
+      assert.strictEqual(caught.error, first);
+      assert.deepStrictEqual(attempts, fds);
+      assert.strictEqual(owned.size, 0);
+    } finally {
+      // Safety cleanup only for an unimplemented/broken helper in RED. Entries
+      // already attempted must have been removed and are never retried.
+      for (const fd of owned) { owned.delete(fd); native.closeSync(fd); }
+    }
+    for (const fd of fds) assert.throws(() => native.fstatSync(fd), error => error.code === 'EBADF');
+  }));
+
+  for (const state of ['frozen primary', 'falsy primary', 'cleanup only']) {
+    await test(`canvas and root cleanup preserve ${state} and attempt every stage`, async () => {
+      const primary = state === 'frozen primary' ? Object.freeze(new Error('primary canvas callback')) : 0;
+      const closeFailure = new Error('canvas cleanup failure');
+      const rootFailure = new Error('root cleanup failure');
+      const stages = [];
+      let fixtureRoot;
+      const caught = await capture(() => withArtifactHandler(async ({ base, get }) => {
+        fixtureRoot = path.dirname(base);
+        await get('');
+        await get('');
+        if (state !== 'cleanup only') throw primary;
+      }, {
+        async closeCanvas(canvas) { stages.push('close'); await canvas.close(); throw closeFailure; },
+        removeRoot(root) { stages.push('root'); fs.rmSync(root, { recursive: true, force: true }); throw rootFailure; }
+      }));
+      assert.strictEqual(caught.didThrow, true);
+      assert.ok(Object.is(caught.error, state === 'cleanup only' ? closeFailure : primary));
+      assert.deepStrictEqual(stages, ['close', 'close', 'root']);
+      assert.strictEqual(fs.existsSync(fixtureRoot), false);
+      assertSharedIdentity();
+    });
+  }
+}
+
 function request(port, method, requestPath, { body = null, headers = {} } = {}) {
   return new Promise((resolve, reject) => {
     const payload = body === null ? null : JSON.stringify(body);
@@ -540,6 +745,7 @@ async function main() {
   const { test } = suite;
   await artifactSecurityTests(test);
   await artifactRaceTests(test);
+  await fixtureIsolationTests(test);
   if (process.argv.includes('--artifact-security-only')) {
     printResults(suite.results);
     return;