// Loaded only in private fixture children; audit config access without real HOME.
const fs = require('node:fs');
const path = require('node:path');
const { syncBuiltinESMExports } = require('node:module');
const root = process.env.HYB_RELEASE_FIXTURE_ROOT;
const original = fs.readFileSync;
fs.readFileSync = function(file, ...args) {
  const text = String(file);
  if (text.endsWith('/.ssh/config') || /\/\.env(?:$|\.)/.test(text)) {
    if (text !== path.join(root, 'bin/home/.ssh/config')) throw Error('fixture_config_read_forbidden');
    fs.appendFileSync(path.join(root, 'artifacts/commands.jsonl'), JSON.stringify({ name: 'config-read', args: ['synthetic-ssh'] }) + '\n');
  }
  return original.call(this, file, ...args);
};
syncBuiltinESMExports();