@anthropic-ai/sdk 0.123.0 → 0.125.0

package/src/resources/models.ts

@@ -1,5 +1,3 @@
-// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
-
 import { APIResource } from '../core/resource';
 import * as BetaAPI from './beta/beta';
 import { APIPromise } from '../core/api-promise';
@@ -14,17 +12,25 @@ export class Models extends APIResource {
    *
    * The Models API response can be used to determine information about a specific
    * model or resolve a model alias to a model ID.
+   *
+   * @example
+   * ```ts
+   * const modelInfo = await client.models.retrieve('model_id');
+   * ```
    */
   retrieve(
     modelID: string,
     params: ModelRetrieveParams | null | undefined = {},
     options?: RequestOptions,
   ): APIPromise<ModelInfo> {
-    const { betas } = params ?? {};
+    const { betas, workspace_id } = params ?? {};
     return this._client.get(path`/v1/models/${modelID}`, {
       ...options,
       headers: buildHeaders([
-        { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+        {
+          ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined),
+          ...(workspace_id != null ? { 'anthropic-workspace-id': workspace_id } : undefined),
+        },
         options?.headers,
       ]),
     });
@@ -35,17 +41,28 @@ export class Models extends APIResource {
    *
    * The Models API response can be used to determine which models are available for
    * use in the API. More recently released models are listed first.
+   *
+   * @example
+   * ```ts
+   * // Automatically fetches more pages as needed.
+   * for await (const modelInfo of client.models.list()) {
+   *   // ...
+   * }
+   * ```
    */
   list(
     params: ModelListParams | null | undefined = {},
     options?: RequestOptions,
   ): PagePromise<ModelInfosPage, ModelInfo> {
-    const { betas, ...query } = params ?? {};
+    const { betas, workspace_id, ...query } = params ?? {};
     return this._client.getAPIList('/v1/models', Page<ModelInfo>, {
       query,
       ...options,
       headers: buildHeaders([
-        { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+        {
+          ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined),
+          ...(workspace_id != null ? { 'anthropic-workspace-id': workspace_id } : undefined),
+        },
         options?.headers,
       ]),
     });
@@ -249,6 +266,16 @@ export interface ModelRetrieveParams {
    * Optional header to specify the beta version(s) you want to use.
    */
   betas?: Array<BetaAPI.AnthropicBeta>;
+
+  /**
+   * Optional header to select the Workspace for this request. The value is a
+   * Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`).
+   *
+   * Only needed for credentials that can act on more than one Workspace. A
+   * credential that belongs to a specific Workspace may omit it; if sent, it must
+   * match that Workspace.
+   */
+  workspace_id?: string;
 }
 
 export interface ModelListParams extends PageParams {
@@ -256,6 +283,16 @@ export interface ModelListParams extends PageParams {
    * Header param: Optional header to specify the beta version(s) you want to use.
    */
   betas?: Array<BetaAPI.AnthropicBeta>;
+
+  /**
+   * Header param: Optional header to select the Workspace for this request. The
+   * value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`).
+   *
+   * Only needed for credentials that can act on more than one Workspace. A
+   * credential that belongs to a specific Workspace may omit it; if sent, it must
+   * match that Workspace.
+   */
+  workspace_id?: string;
 }
 
 export declare namespace Models {

package/src/resources/shared.ts

@@ -1,5 +1,3 @@
-// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
-
 export interface APIErrorObject {
   message: string;
 

package/src/resources/skills/index.ts

@@ -1,12 +1,12 @@
-// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
-
 export {
   Skills,
   type DeletedSkill,
   type Skill,
   type SkillSource,
   type SkillCreateParams,
+  type SkillRetrieveParams,
   type SkillListParams,
+  type SkillDeleteParams,
   type SkillsPageCursor,
 } from './skills';
 export {

package/src/resources/skills/skills.ts

@@ -1,5 +1,3 @@
-// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
-
 import { APIResource } from '../../core/resource';
 import * as VersionsAPI from './versions';
 import {
@@ -15,6 +13,7 @@ import {
 import { APIPromise } from '../../core/api-promise';
 import { PageCursor, type PageCursorParams, PagePromise } from '../../core/pagination';
 import { type Uploadable } from '../../core/uploads';
+import { buildHeaders } from '../../internal/headers';
 import { RequestOptions } from '../../internal/request-options';
 import { multipartFormRequestOptions } from '../../internal/uploads';
 import { path } from '../../internal/utils/path';
@@ -24,36 +23,103 @@ export class Skills extends APIResource {
 
   /**
    * Create Skill
+   *
+   * @example
+   * ```ts
+   * const skill = await client.skills.create({
+   *   files: [fs.createReadStream('path/to/file')],
+   * });
+   * ```
    */
-  create(body: SkillCreateParams, options?: RequestOptions): APIPromise<Skill> {
+  create(params: SkillCreateParams, options?: RequestOptions): APIPromise<Skill> {
+    const { workspace_id, ...body } = params;
     return this._client.post(
       '/v1/skills',
-      multipartFormRequestOptions({ body, ...options }, this._client, false),
+      multipartFormRequestOptions(
+        {
+          body,
+          ...options,
+          headers: buildHeaders([
+            { ...(workspace_id != null ? { 'anthropic-workspace-id': workspace_id } : undefined) },
+            options?.headers,
+          ]),
+        },
+        this._client,
+        false,
+      ),
     );
   }
 
   /**
    * Get Skill
+   *
+   * @example
+   * ```ts
+   * const skill = await client.skills.retrieve('skill_id');
+   * ```
    */
-  retrieve(skillID: string, options?: RequestOptions): APIPromise<Skill> {
-    return this._client.get(path`/v1/skills/${skillID}`, options);
+  retrieve(
+    skillID: string,
+    params: SkillRetrieveParams | null | undefined = {},
+    options?: RequestOptions,
+  ): APIPromise<Skill> {
+    const { workspace_id } = params ?? {};
+    return this._client.get(path`/v1/skills/${skillID}`, {
+      ...options,
+      headers: buildHeaders([
+        { ...(workspace_id != null ? { 'anthropic-workspace-id': workspace_id } : undefined) },
+        options?.headers,
+      ]),
+    });
   }
 
   /**
    * List Skills
+   *
+   * @example
+   * ```ts
+   * // Automatically fetches more pages as needed.
+   * for await (const skill of client.skills.list()) {
+   *   // ...
+   * }
+   * ```
    */
   list(
-    query: SkillListParams | null | undefined = {},
+    params: SkillListParams | null | undefined = {},
     options?: RequestOptions,
   ): PagePromise<SkillsPageCursor, Skill> {
-    return this._client.getAPIList('/v1/skills', PageCursor<Skill>, { query, ...options });
+    const { workspace_id, ...query } = params ?? {};
+    return this._client.getAPIList('/v1/skills', PageCursor<Skill>, {
+      query,
+      ...options,
+      headers: buildHeaders([
+        { ...(workspace_id != null ? { 'anthropic-workspace-id': workspace_id } : undefined) },
+        options?.headers,
+      ]),
+    });
   }
 
   /**
    * Delete Skill
+   *
+   * @example
+   * ```ts
+   * const deletedSkill = await client.skills.delete('skill_id');
+   * ```
    */
-  delete(skillID: string, options?: RequestOptions): APIPromise<DeletedSkill> {
-    return this._client.delete(path`/v1/skills/${skillID}`, options);
+  delete(
+    skillID: string,
+    params: SkillDeleteParams | null | undefined = {},
+    options?: RequestOptions,
+  ): APIPromise<DeletedSkill> {
+    const { workspace_id } = params ?? {};
+    return this._client.delete(path`/v1/skills/${skillID}`, {
+      ...options,
+      headers: buildHeaders([
+        { ...(workspace_id != null ? { 'anthropic-workspace-id': workspace_id } : undefined) },
+        options?.headers,
+      ]),
+    });
   }
 }
 
@@ -142,7 +208,7 @@ export interface SkillSource {
 
 export interface SkillCreateParams {
   /**
-   * Files to upload for the skill.
+   * Body param: Files to upload for the skill.
    *
    * All files must be in the same top-level directory and must include a SKILL.md
    * file at the root of that directory.
@@ -150,16 +216,38 @@ export interface SkillCreateParams {
   files: Array<Uploadable>;
 
   /**
-   * Human-readable, single-line label for the Skill. Maximum 255 characters. Always
-   * set: derived from the SKILL.md frontmatter `name` when omitted at creation. Not
-   * unique.
+   * Body param: Human-readable, single-line label for the Skill. Maximum 255
+   * characters. Always set: derived from the SKILL.md frontmatter `name` when
+   * omitted at creation. Not unique.
    */
   display_name?: string | null;
+
+  /**
+   * Header param: Optional header to select the Workspace for this request. The
+   * value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`).
+   *
+   * Only needed for credentials that can act on more than one Workspace. A
+   * credential that belongs to a specific Workspace may omit it; if sent, it must
+   * match that Workspace.
+   */
+  workspace_id?: string;
+}
+
+export interface SkillRetrieveParams {
+  /**
+   * Optional header to select the Workspace for this request. The value is a
+   * Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`).
+   *
+   * Only needed for credentials that can act on more than one Workspace. A
+   * credential that belongs to a specific Workspace may omit it; if sent, it must
+   * match that Workspace.
+   */
+  workspace_id?: string;
 }
 
 export interface SkillListParams extends PageCursorParams {
   /**
-   * Filter skills by source.
+   * Query param: Filter skills by source.
    *
    * If provided, only skills from the specified source will be returned:
    *
@@ -167,6 +255,28 @@ export interface SkillListParams extends PageCursorParams {
    * - `"anthropic"`: only return Anthropic-created skills
    */
   source?: string | null;
+
+  /**
+   * Header param: Optional header to select the Workspace for this request. The
+   * value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`).
+   *
+   * Only needed for credentials that can act on more than one Workspace. A
+   * credential that belongs to a specific Workspace may omit it; if sent, it must
+   * match that Workspace.
+   */
+  workspace_id?: string;
+}
+
+export interface SkillDeleteParams {
+  /**
+   * Optional header to select the Workspace for this request. The value is a
+   * Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`).
+   *
+   * Only needed for credentials that can act on more than one Workspace. A
+   * credential that belongs to a specific Workspace may omit it; if sent, it must
+   * match that Workspace.
+   */
+  workspace_id?: string;
 }
 
 Skills.Versions = Versions;
@@ -178,7 +288,9 @@ export declare namespace Skills {
     type SkillSource as SkillSource,
     type SkillsPageCursor as SkillsPageCursor,
     type SkillCreateParams as SkillCreateParams,
+    type SkillRetrieveParams as SkillRetrieveParams,
     type SkillListParams as SkillListParams,
+    type SkillDeleteParams as SkillDeleteParams,
   };
 
   export {

package/src/resources/skills/versions.ts

@@ -1,9 +1,8 @@
-// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
-
 import { APIResource } from '../../core/resource';
 import { APIPromise } from '../../core/api-promise';
 import { PageCursor, type PageCursorParams, PagePromise } from '../../core/pagination';
 import { type Uploadable } from '../../core/uploads';
+import { buildHeaders } from '../../internal/headers';
 import { RequestOptions } from '../../internal/request-options';
 import { multipartFormRequestOptions } from '../../internal/uploads';
 import { path } from '../../internal/utils/path';
@@ -11,50 +10,113 @@ import { path } from '../../internal/utils/path';
 export class Versions extends APIResource {
   /**
    * Create Skill Version
+   *
+   * @example
+   * ```ts
+   * const skillVersion = await client.skills.versions.create(
+   *   'skill_id',
+   *   { files: [fs.createReadStream('path/to/file')] },
+   * );
+   * ```
    */
-  create(skillID: string, body: VersionCreateParams, options?: RequestOptions): APIPromise<SkillVersion> {
+  create(skillID: string, params: VersionCreateParams, options?: RequestOptions): APIPromise<SkillVersion> {
+    const { workspace_id, ...body } = params;
     return this._client.post(
       path`/v1/skills/${skillID}/versions`,
-      multipartFormRequestOptions({ body, ...options }, this._client, false),
+      multipartFormRequestOptions(
+        {
+          body,
+          ...options,
+          headers: buildHeaders([
+            { ...(workspace_id != null ? { 'anthropic-workspace-id': workspace_id } : undefined) },
+            options?.headers,
+          ]),
+        },
+        this._client,
+        false,
+      ),
     );
   }
 
   /**
    * Get Skill Version
+   *
+   * @example
+   * ```ts
+   * const skillVersion = await client.skills.versions.retrieve(
+   *   'version',
+   *   { skill_id: 'skill_id' },
+   * );
+   * ```
    */
   retrieve(
     version: string,
     params: VersionRetrieveParams,
     options?: RequestOptions,
   ): APIPromise<SkillVersion> {
-    const { skill_id } = params;
-    return this._client.get(path`/v1/skills/${skill_id}/versions/${version}`, options);
+    const { skill_id, workspace_id } = params;
+    return this._client.get(path`/v1/skills/${skill_id}/versions/${version}`, {
+      ...options,
+      headers: buildHeaders([
+        { ...(workspace_id != null ? { 'anthropic-workspace-id': workspace_id } : undefined) },
+        options?.headers,
+      ]),
+    });
   }
 
   /**
    * List Skill Versions
+   *
+   * @example
+   * ```ts
+   * // Automatically fetches more pages as needed.
+   * for await (const skillVersion of client.skills.versions.list(
+   *   'skill_id',
+   * )) {
+   *   // ...
+   * }
+   * ```
    */
   list(
     skillID: string,
-    query: VersionListParams | null | undefined = {},
+    params: VersionListParams | null | undefined = {},
     options?: RequestOptions,
   ): PagePromise<SkillVersionsPageCursor, SkillVersion> {
+    const { workspace_id, ...query } = params ?? {};
     return this._client.getAPIList(path`/v1/skills/${skillID}/versions`, PageCursor<SkillVersion>, {
       query,
       ...options,
+      headers: buildHeaders([
+        { ...(workspace_id != null ? { 'anthropic-workspace-id': workspace_id } : undefined) },
+        options?.headers,
+      ]),
     });
   }
 
   /**
    * Delete Skill Version
+   *
+   * @example
+   * ```ts
+   * const deletedSkillVersion =
+   *   await client.skills.versions.delete('version', {
+   *     skill_id: 'skill_id',
+   *   });
+   * ```
    */
   delete(
     version: string,
     params: VersionDeleteParams,
     options?: RequestOptions,
   ): APIPromise<DeletedSkillVersion> {
-    const { skill_id } = params;
-    return this._client.delete(path`/v1/skills/${skill_id}/versions/${version}`, options);
+    const { skill_id, workspace_id } = params;
+    return this._client.delete(path`/v1/skills/${skill_id}/versions/${version}`, {
+      ...options,
+      headers: buildHeaders([
+        { ...(workspace_id != null ? { 'anthropic-workspace-id': workspace_id } : undefined) },
+        options?.headers,
+      ]),
+    });
   }
 }
 
@@ -119,32 +181,72 @@ export interface SkillVersion {
 
 export interface VersionCreateParams {
   /**
-   * Files to upload for the skill.
+   * Body param: Files to upload for the skill.
    *
    * All files must be in the same top-level directory and must include a SKILL.md
    * file at the root of that directory.
    */
   files: Array<Uploadable>;
+
+  /**
+   * Header param: Optional header to select the Workspace for this request. The
+   * value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`).
+   *
+   * Only needed for credentials that can act on more than one Workspace. A
+   * credential that belongs to a specific Workspace may omit it; if sent, it must
+   * match that Workspace.
+   */
+  workspace_id?: string;
 }
 
 export interface VersionRetrieveParams {
   /**
-   * Unique identifier for the skill.
+   * Path param: Unique identifier for the skill.
    *
    * The format and length of IDs may change over time.
    */
   skill_id: string;
+
+  /**
+   * Header param: Optional header to select the Workspace for this request. The
+   * value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`).
+   *
+   * Only needed for credentials that can act on more than one Workspace. A
+   * credential that belongs to a specific Workspace may omit it; if sent, it must
+   * match that Workspace.
+   */
+  workspace_id?: string;
 }
 
-export interface VersionListParams extends PageCursorParams {}
+export interface VersionListParams extends PageCursorParams {
+  /**
+   * Header param: Optional header to select the Workspace for this request. The
+   * value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`).
+   *
+   * Only needed for credentials that can act on more than one Workspace. A
+   * credential that belongs to a specific Workspace may omit it; if sent, it must
+   * match that Workspace.
+   */
+  workspace_id?: string;
+}
 
 export interface VersionDeleteParams {
   /**
-   * Unique identifier for the skill.
+   * Path param: Unique identifier for the skill.
    *
    * The format and length of IDs may change over time.
    */
   skill_id: string;
+
+  /**
+   * Header param: Optional header to select the Workspace for this request. The
+   * value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`).
+   *
+   * Only needed for credentials that can act on more than one Workspace. A
+   * credential that belongs to a specific Workspace may omit it; if sent, it must
+   * match that Workspace.
+   */
+  workspace_id?: string;
 }
 
 export declare namespace Versions {

package/src/resources/skills.ts

@@ -1,3 +1 @@
-// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
-
 export * from './skills/index';

package/src/tools/agent-toolset/fs-util.ts

@@ -11,10 +11,13 @@ import { ToolError } from '../../lib/tools/ToolError';
 
 const fs = nodefs.promises;
 
-/** Mode for directories the file tools create — not world-writable under a 0 umask. */
-export const DIR_CREATE_MODE = 0o755;
-/** Mode for files the file tools create. */
-export const FILE_CREATE_MODE = 0o644;
+/** Mode for directories the file tools create: owner-only under any umask, like the memory tool. */
+export const DIR_CREATE_MODE = 0o700;
+/**
+ * Mode for files the file tools create: owner-only, so other local users can't
+ * read what an agent wrote. A file that already exists keeps its own mode.
+ */
+export const FILE_CREATE_MODE = 0o600;
 
 /** True when `p` is `root` itself or lexically contained within it. */
 export function isWithin(root: string, p: string): boolean {
@@ -138,13 +141,22 @@ export async function confineToRoot(
  * Atomically write `content` to `targetPath`: write a sibling temp file, fsync
  * it, then rename over the target. The rename is atomic on most filesystems, so
  * a crash mid-write never leaves the target half-written.
+ *
+ * A new file is created {@link FILE_CREATE_MODE}; an existing one keeps its
+ * permission bits (the rename replaces the inode, so they are copied onto the
+ * temp file first) — an edit must not strip `+x` or sharing the owner chose.
  */
 export async function atomicWriteFile(targetPath: string, content: string): Promise<void> {
   const dir = path.dirname(targetPath);
   const tempPath = path.join(dir, `.tmp-${process.pid}-${crypto.randomUUID()}`);
+  const existingMode = await fs.stat(targetPath).then(
+    (st) => st.mode & 0o777,
+    () => undefined,
+  );
   let handle: FileHandle | undefined;
   try {
     handle = await fs.open(tempPath, 'wx', FILE_CREATE_MODE);
+    if (existingMode !== undefined) await handle.chmod(existingMode);
     await handle.writeFile(content, 'utf-8');
     await handle.sync();
     await handle.close();

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = '0.123.0'; // x-release-please-version
+export const VERSION = '0.125.0'; // x-release-please-version

package/tools/agent-toolset/fs-util.d.mts

@@ -4,10 +4,13 @@
  * error messages. Kept out of `node.ts` so the tool implementations stay focused
  * and these helpers can be reused by every file tool.
  */
-/** Mode for directories the file tools create — not world-writable under a 0 umask. */
-export declare const DIR_CREATE_MODE = 493;
-/** Mode for files the file tools create. */
-export declare const FILE_CREATE_MODE = 420;
+/** Mode for directories the file tools create: owner-only under any umask, like the memory tool. */
+export declare const DIR_CREATE_MODE = 448;
+/**
+ * Mode for files the file tools create: owner-only, so other local users can't
+ * read what an agent wrote. A file that already exists keeps its own mode.
+ */
+export declare const FILE_CREATE_MODE = 384;
 /** True when `p` is `root` itself or lexically contained within it. */
 export declare function isWithin(root: string, p: string): boolean;
 /**
@@ -62,6 +65,10 @@ export declare function confineToRoot(root: string, p: string, opts?: {
  * Atomically write `content` to `targetPath`: write a sibling temp file, fsync
  * it, then rename over the target. The rename is atomic on most filesystems, so
  * a crash mid-write never leaves the target half-written.
+ *
+ * A new file is created {@link FILE_CREATE_MODE}; an existing one keeps its
+ * permission bits (the rename replaces the inode, so they are copied onto the
+ * temp file first) — an edit must not strip `+x` or sharing the owner chose.
  */
 export declare function atomicWriteFile(targetPath: string, content: string): Promise<void>;
 /**

package/tools/agent-toolset/fs-util.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"fs-util.d.mts","sourceRoot":"","sources":["../../src/tools/agent-toolset/fs-util.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,uFAAuF;AACvF,eAAO,MAAM,eAAe,MAAQ,CAAC;AACrC,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB,MAAQ,CAAC;AAEtC,uEAAuE;AACvE,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAGzD;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAK1G;AAKD,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAG1D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA8B/D;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,CAAC,EAAE,MAAM,EACT,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC1C,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBxF;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAwBjE"}
+{"version":3,"file":"fs-util.d.mts","sourceRoot":"","sources":["../../src/tools/agent-toolset/fs-util.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,oGAAoG;AACpG,eAAO,MAAM,eAAe,MAAQ,CAAC;AACrC;;;GAGG;AACH,eAAO,MAAM,gBAAgB,MAAQ,CAAC;AAEtC,uEAAuE;AACvE,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAGzD;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAK1G;AAKD,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAG1D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA8B/D;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,CAAC,EAAE,MAAM,EACT,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC1C,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBxF;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAwBjE"}

package/tools/agent-toolset/fs-util.d.ts

@@ -4,10 +4,13 @@
  * error messages. Kept out of `node.ts` so the tool implementations stay focused
  * and these helpers can be reused by every file tool.
  */
-/** Mode for directories the file tools create — not world-writable under a 0 umask. */
-export declare const DIR_CREATE_MODE = 493;
-/** Mode for files the file tools create. */
-export declare const FILE_CREATE_MODE = 420;
+/** Mode for directories the file tools create: owner-only under any umask, like the memory tool. */
+export declare const DIR_CREATE_MODE = 448;
+/**
+ * Mode for files the file tools create: owner-only, so other local users can't
+ * read what an agent wrote. A file that already exists keeps its own mode.
+ */
+export declare const FILE_CREATE_MODE = 384;
 /** True when `p` is `root` itself or lexically contained within it. */
 export declare function isWithin(root: string, p: string): boolean;
 /**
@@ -62,6 +65,10 @@ export declare function confineToRoot(root: string, p: string, opts?: {
  * Atomically write `content` to `targetPath`: write a sibling temp file, fsync
  * it, then rename over the target. The rename is atomic on most filesystems, so
  * a crash mid-write never leaves the target half-written.
+ *
+ * A new file is created {@link FILE_CREATE_MODE}; an existing one keeps its
+ * permission bits (the rename replaces the inode, so they are copied onto the
+ * temp file first) — an edit must not strip `+x` or sharing the owner chose.
  */
 export declare function atomicWriteFile(targetPath: string, content: string): Promise<void>;
 /**

package/tools/agent-toolset/fs-util.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs-util.d.ts","sourceRoot":"","sources":["../../src/tools/agent-toolset/fs-util.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,uFAAuF;AACvF,eAAO,MAAM,eAAe,MAAQ,CAAC;AACrC,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB,MAAQ,CAAC;AAEtC,uEAAuE;AACvE,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAGzD;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAK1G;AAKD,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAG1D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA8B/D;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,CAAC,EAAE,MAAM,EACT,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC1C,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBxF;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAwBjE"}
+{"version":3,"file":"fs-util.d.ts","sourceRoot":"","sources":["../../src/tools/agent-toolset/fs-util.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,oGAAoG;AACpG,eAAO,MAAM,eAAe,MAAQ,CAAC;AACrC;;;GAGG;AACH,eAAO,MAAM,gBAAgB,MAAQ,CAAC;AAEtC,uEAAuE;AACvE,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAGzD;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAK1G;AAKD,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAG1D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA8B/D;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,CAAC,EAAE,MAAM,EACT,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC1C,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBxF;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAwBjE"}