claude-inbox 0.2.0 → 0.3.0

data/lib/claude_inbox/app.rb

@@ -11,23 +11,25 @@ require_relative "terminal"
 require_relative "logs"
 require_relative "peek"
 require_relative "keymap"
+require_relative "remote"
 require_relative "mouse"
 require_relative "new_session_form"
 require_relative "paste"
 require_relative "pull_requests"
+require_relative "reaper"
 require_relative "poller"
 require_relative "rate_limits"
+require_relative "session_request"
 
 module ClaudeInbox
   # Owns the terminal and the key loop. The only class allowed to spawn a
   # child process that takes over the terminal.
   class App
-    # The reaper defaults to off. It is the only thing here that deletes a
-    # session, so switching it on is `bin/claude-inbox`'s job and nothing
-    # reaches it by forgetting an argument.
+    # The reaper deletes sessions and the listener lets other machines in,
+    # so both are off unless `bin/claude-inbox` switches them on.
     def initialize(client: AgentsClient.new, store: Store.new, pull_requests: PullRequests.new,
-      rate_limits: RateLimits.new, reaper: Reaper.disabled, out: $stdout, input: $stdin, color: true,
-      terminal: Terminal.new(out, input))
+      rate_limits: RateLimits.new, reaper: Reaper.disabled, listen: nil, out: $stdout, input: $stdin, color: true,
+      terminal: Terminal.new(out, input), queue: Queue.new)
       @client = client
       @store = store
       @rate_limits = rate_limits
@@ -35,9 +37,10 @@ module ClaudeInbox
       @color = color
       @renderer = Renderer.new(color: color)
       @reader = TTY::Reader.new(input: input, output: out, interrupt: :noop)
-      @queue = Queue.new
+      @queue = queue
       @poller = Poller.new(client: client, store: store, pull_requests: pull_requests,
         reaper: reaper, queue: @queue)
+      @listener = listen ? Remote::Listener.new(client: client, store: store, queue: @queue, jobs_dir: client.jobs_dir, **listen) : Remote::Listener.disabled
       @logs = Logs.new(client)
       @peek = Peek.new(@logs)
       @selected = nil
@@ -60,12 +63,14 @@ module ClaudeInbox
       install_traps
       @terminal.enter
       @poller.start
+      @listener.start
       @logs.start
       main_loop
     ensure
       @poller.stop
       @logs.stop
       @terminal.restore
+      @listener.stop
     end
 
     def step(input = nil)
@@ -113,6 +118,7 @@ module ClaudeInbox
         when :attach then attach(rest[0])
         when :form_started then @modal = nil if @modal.equal?(rest[0])
         when :form_failed then form_failed(*rest)
+        when :remote_started then remote_started(*rest)
         end
       end
     rescue ThreadError
@@ -135,10 +141,13 @@ module ClaudeInbox
     end
 
     # The form takes a paste whole, images included; the one-line editors
-    # take it as typing, so a pasted PR URL lands where it should.
+    # take it as typing, so a pasted PR URL lands where it should. Anywhere
+    # else a paste is dropped: typed out, its letters would be keys, and a
+    # "y" answers a confirm.
     def handle_paste(text)
       return @modal.paste(text) if @modal.is_a?(NewSessionForm)
-      text.each_char { |c| handle_key(c) }
+      typing = @modal ? @modal.is_a?(Dialog::Prompt) : @filter_editing
+      text.each_char { |c| handle_key(c) } if typing
     end
 
     def render
@@ -146,13 +155,14 @@ module ClaudeInbox
       now = Time.now
       sections = filtered(@store.sections(now))
       width, height = @terminal.size
+      body_h = Renderer.body_height(height)
       ensure_selection(sections)
       @tick += 1
       view = Renderer::View.new(
         width: width, height: height, now: now, selected: @selected&.key, top: @top, expanded: @expanded,
-        peek: @peek.view(sections.row(@selected), height), modal: modal_lines(width), screen: screen_lines(width, height),
+        peek: @peek.view(sections.row(@selected), body_h), modal: modal_lines(width), screen: screen_lines(width, body_h),
         status: status_text(now), usage: @rate_limits.windows(now), filter: @filter, filter_editing: @filter_editing,
-        tick: @tick / 2, loading: loading_for
+        tick: @tick / 2, loading: loading_for, listening: @listener.snapshot
       )
       frame = @renderer.frame(sections, view)
       @row_items = frame.items
@@ -202,8 +212,9 @@ module ClaudeInbox
 
     # Guard for attach/stop: refuse politely on a terminal or remote row.
     def require_actionable
-      return true if selected_session&.actionable?
-      if (s = selected_session)&.interactive?
+      s = selected_session
+      return true if s&.actionable?
+      if s&.interactive?
         notice(s.remote? ? "that's a remote session — Enter adopts it, w opens it at claude.ai/code" : "that's your own terminal — switch to that window")
       end
       false
@@ -212,8 +223,9 @@ module ClaudeInbox
     # Guard for snooze/wake/alias: anything with a key, since those live in
     # our own store. A terminal you are sitting in is the one exception.
     def require_storable
-      return true if @selected&.row? && !selected_session&.terminal?
-      notice("you're in that terminal right now — nothing to snooze") if selected_session&.terminal?
+      s = selected_session
+      return true if @selected&.row? && !s&.terminal?
+      notice("you're in that terminal right now — nothing to snooze") if s&.terminal?
       false
     end
 
@@ -308,12 +320,13 @@ module ClaudeInbox
       when :refresh then @poller.soon
       when :toggle_peek then toggle_peek
       when :new_session then open_new_session
+      when :remote_pairing then @modal = @listener.pairing_dialog
       when :filter then start_filter
       when :escape then clear_filter
       end
     end
 
-    def page = [@terminal.size[1] - 2, 1].max
+    def page = [Renderer.body_height(@terminal.size[1]), 1].max
 
     def move(delta)
       stops = filtered.selections(@expanded)
@@ -338,7 +351,8 @@ module ClaudeInbox
       name if Store::FOLDABLE_SECTIONS.include?(name)
     end
 
-    def set_expanded(value, name: current_fold_section)
+    def set_expanded(value)
+      name = current_fold_section
       @expanded[name] = value if name
     end
 
@@ -427,14 +441,7 @@ module ClaudeInbox
 
     def open_new_session
       cwd = selected_session&.cwd || Dir.pwd
-      @modal = NewSessionForm.new(cwd: strip_worktree(cwd), pastel: Pastel.new(enabled: @color))
-    end
-
-    # A session's cwd may sit inside a worktree another agent is using; carrying
-    # that into a new prompt would spawn the new agent there too, writing over
-    # the same files. Fall back to the repo the worktree was cut from.
-    def strip_worktree(cwd)
-      cwd.to_s.sub(%r{/\.claude/worktrees/[^/]+(?:/.*)?\z}, "")
+      @modal = NewSessionForm.new(cwd: SessionRequest.strip_worktree(cwd), pastel: Pastel.new(enabled: @color))
     end
 
     # `attach:` hands the terminal over as soon as the session starts. Without
@@ -454,6 +461,13 @@ module ClaudeInbox
       end
     end
 
+    # Someone at the desk may be mid-thought, so a start from another
+    # device never moves the cursor, attaches or closes what is open.
+    def remote_started(id, via)
+      notice("started #{id} from #{via}")
+      @poller.soon
+    end
+
     # A spawn failure hands the form back rather than just logging it, so
     # the composed prompt survives (see NewSessionForm#submission_failed).
     def form_failed(form, message)
@@ -461,9 +475,9 @@ module ClaudeInbox
     end
 
     # The new-session form takes the whole body; a Dialog is a box over it.
-    def screen_lines(width, height)
+    def screen_lines(width, body_h)
       return nil unless @modal.is_a?(NewSessionForm)
-      {lines: @modal.screen(width, height - 2), footer: @modal.footer}
+      {lines: @modal.screen(width, body_h), footer: @modal.footer}
     end
 
     def modal_lines(width)
@@ -486,6 +500,8 @@ module ClaudeInbox
         when :adopt then adopt_session(id)
         end
       when :save then save_prompt
+      when :copy then @listener.copy_pairing_url
+      when :rotate then @listener.rotate
       end
     end
 

data/lib/claude_inbox/config.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require "shellwords"
+
+module ClaudeInbox
+  # Arguments for every launch. They go before the typed ones, so a typed
+  # flag wins.
+  module Config
+    PATH = File.join(Dir.home, ".config", "claude-inbox", "config")
+
+    def self.argv(typed, path: PATH)
+      args(path) + typed
+    end
+
+    def self.args(path)
+      File.readlines(path).flat_map { |line| Shellwords.split(line.sub(/(\A|\s)#.*/, "")) }
+    rescue Errno::ENOENT
+      []
+    rescue ArgumentError => e
+      raise ArgumentError, "#{path}: #{e.message}"
+    end
+    private_class_method :args
+  end
+end

data/lib/claude_inbox/dialog.rb

@@ -10,6 +10,8 @@ module ClaudeInbox
   # the details read off the dialog afterwards. `frame(width)` is the box
   # Renderer overlays. Pure: nothing here touches the store or the client.
   class Dialog
+    WIDTH = 44
+
     attr_reader :kind, :id
 
     def initialize(kind, id)
@@ -18,7 +20,7 @@ module ClaudeInbox
     end
 
     def frame(width, caret = nil)
-      box = [width - 4, 44].min
+      box = [width - 4, self.class::WIDTH].min
       TTY::Box.frame(lines(box - 4, caret).join("\n"), title: {top_left: title}, padding: [0, 1], width: box)
         .split("\n")
     end

data/lib/claude_inbox/images.rb

@@ -1,11 +1,13 @@
 # frozen_string_literal: true
 
 require "fileutils"
+require "securerandom"
 require_relative "subprocess"
 
 module ClaudeInbox
-  # Images a prompt can carry: a dropped file, or whatever is on the
-  # clipboard. Both come back as a path for a TextBuffer chip to hold.
+  # Images a prompt can carry: a dropped file, whatever is on the
+  # clipboard, or the bytes a request sent. Each comes back as a path for
+  # the prompt to mention.
   module Images
     DEFAULT_DIR = File.join(Dir.home, ".config", "claude-inbox", "images")
     EXTENSIONS = %w[.png .jpg .jpeg .gif .webp .bmp .svg].freeze
@@ -14,9 +16,19 @@ module ClaudeInbox
 
     Clipboard = Struct.new(:image, :text)
 
-    # Saved images are pruned here, on the way in, because nothing else
-    # knows when a session stopped needing its image. macOS only: osascript
-    # ships with the OS, and PNG is the flavor a screenshot puts there.
+    class Unsupported < StandardError; end
+
+    # Bytes from a request carry no file name worth trusting, so the type
+    # comes from the magic number at the front.
+    MAGIC = {
+      ".png" => /\A\x89PNG/n,
+      ".jpg" => /\A\xFF\xD8\xFF/n,
+      ".gif" => /\AGIF8/n,
+      ".webp" => /\ARIFF.{4}WEBP/mn
+    }.freeze
+
+    # macOS only: osascript ships with the OS, and PNG is the flavor a
+    # screenshot puts there.
     def self.from_clipboard(dir: DEFAULT_DIR, now: Time.now, run: Subprocess.method(:capture))
       FileUtils.mkdir_p(dir)
       prune(dir, now)
@@ -26,6 +38,23 @@ module ClaudeInbox
       Clipboard.new(nil, (text.success? && !text.out.empty?) ? text.out : nil)
     end
 
+    # `index` orders the images one request brings; the random part keeps
+    # two requests saving in the same millisecond apart. Readable by the
+    # owner only: a photo can be anything.
+    def self.save(bytes, dir: DEFAULT_DIR, now: Time.now, index: 1)
+      data = bytes.b
+      ext = extension(data)
+      raise Unsupported, "not a PNG, JPEG, GIF or WebP image" unless ext
+      FileUtils.mkdir_p(dir)
+      prune(dir, now)
+      path = File.join(dir, "#{now.strftime("%Y%m%d-%H%M%S-%L")}-#{index}-#{SecureRandom.hex(3)}#{ext}")
+      File.open(path, File::WRONLY | File::CREAT | File::EXCL | File::BINARY, 0o600) { |f| f.write(data) }
+      path
+    end
+
+    # ".png", ".jpg", ".gif" or ".webp" by the magic number, or nil.
+    def self.extension(bytes) = MAGIC.find { |_, magic| magic.match?(bytes.b) }&.first
+
     CLIPBOARD_PNG = <<~APPLESCRIPT
       on run argv
         set png to the clipboard as «class PNGf»
@@ -46,8 +75,10 @@ module ClaudeInbox
       File.file?(path) ? path : nil
     end
 
+    # Pruned on the way in, because nothing else knows when a session
+    # stopped needing its image.
     def self.prune(dir, now)
-      Dir.glob(File.join(dir, "*.png")).each do |f|
+      Dir.glob(EXTENSIONS.map { |ext| File.join(dir, "*#{ext}") }).each do |f|
         File.delete(f) if now - File.mtime(f) > KEEP_FOR
       rescue SystemCallError
         nil

data/lib/claude_inbox/job_state.rb

@@ -50,7 +50,7 @@ module ClaudeInbox
       nil
     end
 
-    attr_reader :detail, :needs, :result, :tempo, :kinds, :tasks, :pr_urls, :color, :intent, :bridge_id, :flags
+    attr_reader :detail, :needs, :result, :pr_urls, :color, :intent, :bridge_id
 
     def initialize(hash)
       @detail = hash["detail"]
@@ -70,16 +70,22 @@ module ClaudeInbox
     # a wake, are the only record of Remote Control being on it.
     def remote_control? = flags.include?("--remote-control")
 
-    # The agent itself is not thinking. On its own this means little — a
-    # session whose process died leaves the same reading behind — so it only
-    # says something paired with work still in flight.
-    def agent_idle? = tempo == "idle"
-
-    def in_flight? = tasks.positive?
-
     # True when the agent has stopped and is only waiting on what it started.
     def waiting_on_work? = agent_idle? && in_flight?
 
+    # What the session needs while blocked, what it produced once done,
+    # otherwise its status line; nil before it has said anything.
+    def summary(state)
+      line =
+        case state
+        when "blocked" then needs || detail
+        when "done" then result || detail
+        else detail
+        end
+      line = line.to_s.gsub(/\s+/, " ").strip
+      line.empty? ? nil : line
+    end
+
     # "1 shell", "2 agents · 1 shell". Falls back to a bare count for a state
     # file that counts the open tasks without naming them.
     def in_flight_label
@@ -90,6 +96,15 @@ module ClaudeInbox
 
     private
 
+    attr_reader :tempo, :kinds, :tasks, :flags
+
+    # The agent itself is not thinking. On its own this means little — a
+    # session whose process died leaves the same reading behind — so it only
+    # says something paired with work still in flight.
+    def agent_idle? = tempo == "idle"
+
+    def in_flight? = tasks.positive?
+
     def count_label = "#{tasks} #{plural("task", tasks)}"
 
     def plural(word, n) = (n == 1) ? word : "#{word}s"

data/lib/claude_inbox/keymap.rb

@@ -27,7 +27,7 @@ module ClaudeInbox
       "s" => :snooze, "u" => :wake, "a" => :alias, "x" => :settle, "X" => :stop,
       :ctrl_x => :delete,
       "o" => :open_pr, "P" => :link_pr, "t" => :toggle_pin, "w" => :open_remote,
-      "R" => :refresh, "p" => :toggle_peek, "n" => :new_session,
+      "R" => :refresh, "p" => :toggle_peek, "n" => :new_session, "N" => :remote_pairing,
       :tab => :next_section, :back_tab => :prev_section,
       "/" => :filter, :escape => :escape,
       "q" => :quit, :ctrl_c => :quit

data/lib/claude_inbox/new_session_form.rb

@@ -2,6 +2,7 @@
 
 require_relative "agents_client"
 require_relative "images"
+require_relative "session_request"
 require_relative "settings"
 require_relative "slash_commands"
 require_relative "text"
@@ -17,15 +18,18 @@ module ClaudeInbox
     # string on :choice ones — `kind` says which.
     Field = Struct.new(:key, :label, :kind, :value, :choices)
 
-    # "default" stays the internal value so spawn_args leaves the flag off;
-    # the screen shows what that resolves to instead.
+    # The screen shows what "default" resolves to; `values` makes it nil.
     DEFAULT = "default"
 
     MENU_ROWS = 6
 
-    def initialize(cwd:, pastel:, theme: Theme.new(enabled: pastel.enabled), home: Dir.home, clipboard: Images.method(:from_clipboard))
+    # Keys a :choice field answers to, as the step through its choices; an
+    # editable field spends these on its own text instead.
+    CYCLE = {:left => -1, :right => 1, "h" => -1, "l" => 1, " " => 1}.freeze
+
+    def initialize(cwd:, pastel:, home: Dir.home, clipboard: Images.method(:from_clipboard))
       @p = pastel
-      @theme = theme
+      @theme = Theme.new(enabled: pastel.enabled)
       @home = home
       @clipboard = clipboard
       @fields = [
@@ -36,7 +40,7 @@ module ClaudeInbox
         Field.new(:effort, "Effort", :choice, DEFAULT, AgentsClient::EFFORTS),
         Field.new(:permission_mode, "Permissions", :choice, DEFAULT, AgentsClient::PERMISSION_MODES),
         Field.new(:worktree, "Worktree", :choice, "no", %w[no yes]),
-        Field.new(:remote, "Remote Control", :choice, "no", %w[no yes])
+        Field.new(:remote, "Remote Control", :choice, DEFAULT, [DEFAULT, "no", "yes"])
       ]
       @focus = 0
       @error = nil
@@ -114,19 +118,18 @@ module ClaudeInbox
     def picked = menu&.fetch(@pick.clamp(0, menu.size - 1))
 
     def values
-      @fields.to_h { |f| [f.key, f.value.to_s] }.tap do |v|
-        v[:prompt] = field(:prompt).value.expand { |chip| AgentsClient.mention(chip.path) }.strip
-        v[:worktree] = v[:worktree] == "yes"
-        v[:remote] = v[:remote] == "yes"
-        v[:name] = nil if v[:name].strip.empty?
-        v[:cwd] = File.expand_path(v[:cwd].strip.empty? ? "." : v[:cwd].strip)
-      end
+      v = @fields.to_h { |f| [f.key, (f.kind == :choice && f.value == DEFAULT) ? nil : f.value.to_s] }
+      v[:prompt] = field(:prompt).value.expand { |chip| AgentsClient.mention(chip.path) }.strip
+      v[:worktree] = v[:worktree] == "yes"
+      v[:name] = nil if v[:name].strip.empty?
+      v[:cwd] = directory
+      v[:remote] = SessionRequest::FLAGS[v[:remote]]
+      SessionRequest.resolve(v, defaults(v[:cwd]))
     end
 
     # Settings resolve against the directory the session will run in, so
     # they follow the Directory field.
-    def defaults
-      cwd = values[:cwd]
+    def defaults(cwd = directory)
       return @defaults if @defaults_for == cwd
       @defaults_for = cwd
       @defaults = Settings.defaults(cwd, home: @home)
@@ -135,7 +138,7 @@ module ClaudeInbox
     # Project commands live under the Directory field's path, so they
     # follow it as the defaults do.
     def commands
-      cwd = values[:cwd]
+      cwd = directory
       return @commands if @commands_for == cwd
       @commands_for = cwd
       @commands = SlashCommands.list(cwd: cwd, home: @home)
@@ -344,38 +347,25 @@ module ClaudeInbox
 
     def field(key) = @fields.find { |f| f.key == key }
 
+    def directory
+      path = field(:cwd).value.to_s.strip
+      File.expand_path(path.empty? ? "." : path)
+    end
+
     def focus_on(key) = @focus = @fields.index { |f| f.key == key }
 
-    # Keys a :choice field answers to; an editable field spends these on its
-    # own text instead.
     def choose(name, raw)
-      case name
-      when :left then cycle(-1)
-      when :right then cycle(1)
-      else
-        case raw
-        when "h" then cycle(-1)
-        when "l", " " then cycle(1)
-        end
-      end
-    end
-
-    def cycle(d)
+      d = CYCLE[name] || CYCLE[raw]
+      return unless d
       f = focused
-      return unless f.kind == :choice
       f.value = f.choices[(f.choices.index(f.value) + d) % f.choices.size]
     end
 
     def submit(attach:)
-      v = values
-      if v[:prompt].empty?
-        @error = "a prompt is required"
-        focus_on(:prompt)
-        return :changed
-      end
-      unless File.directory?(v[:cwd])
-        @error = "no such directory: #{v[:cwd]}"
-        focus_on(:cwd)
+      field, message = SessionRequest.problem(values)
+      if field
+        @error = message
+        focus_on(field)
         return :changed
       end
       @busy = true

data/lib/claude_inbox/painter.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+require "tty-cursor"
+
+module ClaudeInbox
+  # Diffs successive frames and writes only changed rows. No erase-to-end-of-
+  # line after a row: in the terminal's last column the cursor stays put
+  # (pending wrap), so EL would eat the glyph just drawn.
+  class Painter
+    def initialize(out, cursor: TTY::Cursor)
+      @out = out
+      @cursor = cursor
+      @prev = []
+    end
+
+    def paint(lines)
+      buf = +""
+      lines.each_with_index do |line, i|
+        next if @prev[i] == line
+        buf << @cursor.move_to(0, i) << line
+      end
+      if @prev.size > lines.size
+        (lines.size...@prev.size).each { |i| buf << @cursor.move_to(0, i) << @cursor.clear_line }
+      end
+      @out.print buf unless buf.empty?
+      @out.flush
+      @prev = lines
+    end
+
+    def invalidate = @prev = []
+  end
+end

data/lib/claude_inbox/palette.rb

@@ -17,13 +17,10 @@ module ClaudeInbox
 
     INDEXED = {"orange" => 208, "pink" => 205}.freeze
 
-    RESET = "\e[39m"
+    SEQUENCES = ANSI.transform_values { |n| "\e[#{n}m" }
+      .merge(INDEXED.transform_values { |n| "\e[38;5;#{n}m" }).freeze
 
-    def self.sequence(name)
-      return "\e[#{ANSI[name]}m" if ANSI.key?(name)
-      return "\e[38;5;#{INDEXED[name]}m" if INDEXED.key?(name)
-      nil
-    end
+    RESET = "\e[39m"
 
     def initialize(enabled: true)
       @enabled = enabled
@@ -31,7 +28,7 @@ module ClaudeInbox
 
     def paint(text, name)
       return text unless @enabled
-      seq = self.class.sequence(name)
+      seq = SEQUENCES[name]
       seq ? seq + text + RESET : text
     end
   end

data/lib/claude_inbox/peek.rb

@@ -44,9 +44,9 @@ module ClaudeInbox
 
     # `row` is the selected row as the frame shows it, or nil when nothing is
     # selected. Answers nil when there is no pane to paint.
-    def view(row, height)
+    def view(row, body_h)
       return nil unless @open && @selected&.row?
-      View.new(scrolled(body(row), height - 2), row&.label || @selected.key, subtitle(row))
+      View.new(scrolled(body(row), body_h), row&.label || @selected.key, subtitle(row))
     end
 
     private

data/lib/claude_inbox/poller.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require_relative "reaper"
 require_relative "sessions"
 
 module ClaudeInbox
@@ -35,8 +34,10 @@ module ClaudeInbox
 
     def stop = @thread&.kill
 
-    # Skips the poll rather than the timer, so nothing forks `claude` while
-    # another process holds the terminal. A poll already under way finishes.
+    # Only skips polls while another process holds the terminal; a poll
+    # already under way finishes. Forking from another thread meanwhile, as
+    # a remote start does, is fine: Subprocess puts every child in its own
+    # session, away from the tty.
     def pause = @lock.synchronize { @paused = true }
 
     def resume

data/lib/claude_inbox/pull_requests.rb

@@ -85,11 +85,6 @@ module ClaudeInbox
       [fresh, changed]
     end
 
-    # Best known state for a url without asking gh.
-    def known(url)
-      @mutex.synchronize { @known[url] ||= seed(url) }
-    end
-
     # Best known state for a url, refreshed through gh when due.
     def status(url)
       @mutex.synchronize do
@@ -119,6 +114,11 @@ module ClaudeInbox
 
     private
 
+    # Best known state for a url without asking gh.
+    def known(url)
+      @mutex.synchronize { @known[url] ||= seed(url) }
+    end
+
     def due?(url)
       @gh && @clock.call.to_i - @checked_at.fetch(url, 0) >= REFRESH_AFTER
     end

data/lib/claude_inbox/records.rb

@@ -18,10 +18,15 @@ module ClaudeInbox
       {}
     end
 
-    def save(path, data)
+    # `perm` is set on the temp file before anything is written to it, so
+    # a secret is never readable at a wider mode, not even briefly.
+    def save(path, data, perm: nil)
       FileUtils.mkdir_p(File.dirname(path))
       tmp = File.join(File.dirname(path), ".#{File.basename(path)}.#{Process.pid}.tmp")
-      File.write(tmp, JSON.pretty_generate(data))
+      File.open(tmp, "w", perm || 0o666) do |f|
+        f.chmod(perm) if perm
+        f.write(JSON.pretty_generate(data))
+      end
       File.rename(tmp, path)
     end
   end