Move require_run_user to lib.rs and make blacklist module private

src/blacklist.rs

@@ -42,10 +42,7 @@ pub fn resolve_overlays(ctx: &PathContext) -> Result<BlacklistOverlays, SandboxE
 
 pub fn resolve_path_context() -> Result<PathContext, SandboxError> {
     let home = crate::require_home()?;
-    let run_user = std::env::var("XDG_RUNTIME_DIR")
-        .ok()
-        .or_else(resolve_run_user_from_proc)
-        .ok_or(SandboxError::RunUserNotFound)?;
+    let run_user = crate::require_run_user()?;
     Ok(PathContext { home, run_user })
 }
 
@@ -88,17 +85,6 @@ fn is_under_tmpfs_dir(path: &Path, tmpfs_dirs: &[PathBuf]) -> bool {
     tmpfs_dirs.iter().any(|dir| path.starts_with(dir))
 }
 
-fn resolve_run_user_from_proc() -> Option<String> {
-    let status = fs::read_to_string("/proc/self/status").ok()?;
-    for line in status.lines() {
-        if let Some(rest) = line.strip_prefix("Uid:") {
-            let uid = rest.split_whitespace().next()?;
-            return Some(format!("/run/user/{uid}"));
-        }
-    }
-    None
-}
-
 // ---------------------------------------------------------------------------
 // Curated sensitive paths from firejail disable-common.inc + disable-programs.inc.
 // Goal: protect secrets, credentials, and session tokens from agentic access.

src/lib.rs

@@ -1,5 +1,5 @@
 mod agents;
-pub mod blacklist;
+mod blacklist;
 mod errors;
 mod preflight;
 mod sandbox;
@@ -8,6 +8,7 @@ pub use errors::SandboxError;
 
 use std::env;
 use std::ffi::OsString;
+use std::fs;
 use std::os::unix::process::CommandExt;
 use std::path::PathBuf;
 
@@ -35,6 +36,24 @@ pub fn require_home() -> Result<String, SandboxError> {
         .ok_or(SandboxError::HomeNotSet)
 }
 
+pub fn require_run_user() -> Result<String, SandboxError> {
+    env::var("XDG_RUNTIME_DIR")
+        .ok()
+        .or_else(resolve_run_user_from_proc)
+        .ok_or(SandboxError::RunUserNotFound)
+}
+
+fn resolve_run_user_from_proc() -> Option<String> {
+    let status = fs::read_to_string("/proc/self/status").ok()?;
+    for line in status.lines() {
+        if let Some(rest) = line.strip_prefix("Uid:") {
+            let uid = rest.split_whitespace().next()?;
+            return Some(format!("/run/user/{uid}"));
+        }
+    }
+    None
+}
+
 pub fn run(config: SandboxConfig) -> Result<(), SandboxError> {
     preflight::check(&config)?;