[Duplicate Code] Bounded ingress capability file writer is duplicated

[github-actions]

Duplicate Code Opportunity

Summary

• Pattern: The bounded-agent and bounded-query ingress code writes the same capability file structure with the same openSync/writeSync/fchmodSync/closeSync flow.
• Locations: src/bounded-agent/manager.ts lines 172-189; src/bounded-query/manager.ts lines 165-182.
• Impact: ~35 duplicated lines in a security-sensitive file-creation path; the abstraction is straightforward and would keep inode/permission handling identical.

Evidence

// src/bounded-agent/manager.ts
function writeSbxIngressCapabilities(paths: BoundedAgentPaths): void {
  const capabilities: SbxIngressCapabilities = {
    version: 1,
    query: crypto.randomBytes(32).toString('hex'),
    probe: crypto.randomBytes(32).toString('hex'),
  };
  const fd = fs.openSync(
    paths.capabilityPath,
    fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_NOFOLLOW,
    0o600,
  );
  try {
    fs.writeSync(fd, JSON.stringify(capabilities));
    fs.fchmodSync(fd, 0o600);
  } finally {
    fs.closeSync(fd);
  }
}

// src/bounded-query/manager.ts
function writeSbxIngressCapabilities(paths: BoundedQueryPaths): void {
  const capabilities: SbxIngressCapabilities = {
    version: 1,
    query: crypto.randomBytes(32).toString('hex'),
    probe: crypto.randomBytes(32).toString('hex'),
  };
  const fd = fs.openSync(
    paths.capabilityPath,
    fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_NOFOLLOW,
    0o600,
  );
  try {
    fs.writeSync(fd, JSON.stringify(capabilities));
    fs.fchmodSync(fd, 0o600);
  } finally {
    fs.closeSync(fd);
  }
}

Suggested Refactoring

• Extract a shared writeSbxIngressCapabilities(path) helper in a common bounded-runtime utility module.
• Keep the capability payload generation at the call site only if the surrounding types differ, but centralize the atomic file write and permission hardening.

Affected Files

• src/bounded-agent/manager.ts — lines 172-189
• src/bounded-query/manager.ts — lines 165-182

Effort Estimate

Low

---

Detected by Duplicate Code Detector workflow. Run date: 2026-08-05

Generated by Duplicate Code Detector · gpt54mini · 5.25 AIC · ⊞ 26.1K · ◷

• expires on Sep 4, 2026, 6:32 AM UTC