@bastani/atomic 0.9.18-alpha.5 → 0.9.18-alpha.6

package/dist/builtin/intercom/broker/send-handler.ts

@@ -1,12 +1,18 @@
 import type net from "node:net";
 import type { BrokerMessage, Message, SessionInfo } from "../types.js";
+import {
+	legacyWorkflowStageTargetMigrationHint,
+	parseLegacyWorkflowStageTarget,
+	parseWorkflowStageTarget,
+} from "../workflow-stage-target.js";
+import { normalizeGroup } from "../group.js";
 import { isMessage } from "./client-message-validation.js";
 import { resolveSessionTarget, sessionTargetFailureReason } from "../session-target.js";
 import { DeliveredMessageCache } from "./delivered-message-cache.js";
 import { buildMessageSendSignature } from "./send-signature.js";
 import { SupervisorChannelCache } from "./supervisor-channel.js";
 import { isVerticalBypass, sameGroup } from "./group-isolation.js";
-import { sessionsShareGroup } from "./group-membership.js";
+import { sessionGroups, sessionsShareGroup } from "./group-membership.js";
 import { PendingQuestionIndex } from "./pending-question-index.js";
 
 export interface BrokerConnectedSession {
@@ -28,11 +34,25 @@ export interface BrokerConnectedSession {
   supervisorOwnerToken?: string;
 }
 
+/** Immutable registration authority plus normalized memberships used when an accepted ask is rebound. */
+export function senderGroupIdentity(session: BrokerConnectedSession): string {
+	return JSON.stringify([
+		normalizeGroup(session.registrationGroup),
+		[...sessionGroups(session.info)].sort((left, right) => left.localeCompare(right)),
+	]);
+}
+
+
+/** Stable recipient authority used independently from the freshly resolved transport ID. */
+export function deliveryTargetIdentity(session: BrokerConnectedSession): string {
+	return session.registrationReturnAddress === undefined
+		? JSON.stringify(["session", session.info.id])
+		: JSON.stringify(["return", session.registrationReturnAddress, normalizeGroup(session.registrationGroup)]);
+}
 export interface PendingStageRoute {
   readonly socket: net.Socket;
   readonly from: BrokerConnectedSession;
-  readonly runId: string;
-  readonly stageKey: string;
+	readonly target: string;
   readonly message: Message;
   readonly attemptId?: string;
 	readonly liveTargetId?: string;
@@ -40,6 +60,11 @@ export interface PendingStageRoute {
 }
 
 export type PendingStageRouter = (route: PendingStageRoute) => boolean;
+export type ConfirmedMessageWriter = (
+	target: net.Socket,
+	message: BrokerMessage,
+	onSettled: (written: boolean) => void,
+) => void;
 
 export type LiveWorkflowStageResolver = (target: string) => BrokerConnectedSession | undefined;
 export type LiveWorkflowStageController = (
@@ -48,15 +73,7 @@ export type LiveWorkflowStageController = (
 	logicalTarget: string,
 ) => boolean;
 
-const WORKFLOW_RUN_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-
-export function parsePendingStageTarget(target: string): { runId: string; stageKey: string } | undefined {
-  const separator = target.indexOf(":");
-  if (separator < 0) return undefined;
-  const runId = target.slice(0, separator);
-  const stageKey = target.slice(separator + 1);
-  return WORKFLOW_RUN_ID_PATTERN.test(runId) && stageKey.length > 0 ? { runId, stageKey } : undefined;
-}
+export type LegacyWorkflowStageTargetResolver = (runId: string, stageKey: string) => string | undefined;
 export const PENDING_STAGE_ASK_REFUSAL =
   "Cannot ask a workflow stage whose session has not initialized. Use send; Atomic will queue the message until the stage session initializes.";
 
@@ -80,12 +97,20 @@ export function handleBrokerSend(
 	currentId: string | null,
 	sessions: Map<string, BrokerConnectedSession>,
 	deliveredMessages: DeliveredMessageCache,
-	write: (target: net.Socket, message: BrokerMessage) => void,
+	/**
+	 * Hand one frame to a socket. Returns whether the frame was actually written.
+	 * Durable acceptance is reserved before this call to close the restart window;
+	 * a `false` answer removes that exact reservation, while only `true` is
+	 * acknowledged to the sender.
+	 */
+	write: (target: net.Socket, message: BrokerMessage) => boolean,
 	supervisorCache: SupervisorChannelCache = new SupervisorChannelCache(),
 	pendingQuestions: PendingQuestionIndex = new PendingQuestionIndex(),
 	routePendingStage?: PendingStageRouter,
 	resolveLiveWorkflowStage?: LiveWorkflowStageResolver,
 	canControlLiveWorkflowStage?: LiveWorkflowStageController,
+	resolveLegacyWorkflowStageTarget?: LegacyWorkflowStageTargetResolver,
+	writeConfirmed?: ConfirmedMessageWriter,
 ): void {
   const message = clientMessage.message;
   const messageId = wireMessageId(message);
@@ -99,15 +124,30 @@ export function handleBrokerSend(
     return;
   }
   const attemptId = typeof clientMessage.attemptId === "string" ? clientMessage.attemptId : undefined;
+  const hasLogicalTarget = Object.prototype.hasOwnProperty.call(clientMessage, "logicalTarget");
+  if (hasLogicalTarget && typeof clientMessage.logicalTarget !== "string") {
+    write(socket, { type: "delivery_failed", messageId, attemptId, reason: "Invalid logicalTarget format" });
+    return;
+  }
   if (typeof clientMessage.to !== "string" || !isMessage(message)) {
     write(socket, { type: "delivery_failed", messageId, attemptId, reason: "Invalid message format" });
     return;
   }
+  const hasRequirePendingReply = Object.prototype.hasOwnProperty.call(clientMessage, "requirePendingReply");
+  if (hasRequirePendingReply && clientMessage.requirePendingReply !== true) {
+    write(socket, { type: "delivery_failed", messageId, attemptId, reason: "Invalid requirePendingReply format" });
+    return;
+  }
+  const requirePendingReply = clientMessage.requirePendingReply === true;
   if (Object.prototype.hasOwnProperty.call(clientMessage, "channel")) {
     write(socket, { type: "delivery_failed", messageId: message.id, attemptId, reason: "Invalid channel" });
     return;
   }
   const supervisorSend = clientMessage.type === "supervisor_send";
+  if (requirePendingReply && (supervisorSend || message.replyTo === undefined || message.expectsReply === true)) {
+    write(socket, { type: "delivery_failed", messageId, attemptId, reason: "Invalid requirePendingReply message" });
+    return;
+  }
 
 
   const fromSession = currentId ? sessions.get(currentId) : undefined;
@@ -115,22 +155,16 @@ export function handleBrokerSend(
     write(socket, { type: "delivery_failed", messageId: message.id, attemptId, reason: "Sender session not found" });
     return;
   }
-	const signature = buildMessageSendSignature(clientMessage.to, message, fromSession.info.id);
-	const deliveredMatch = deliveredMessages.lookup(message.id, signature);
-	if (deliveredMatch === "match") {
-		write(socket, { type: "delivered", messageId: message.id, attemptId });
-		return;
-	}
-	if (deliveredMatch === "conflict") {
-		write(socket, {
-			type: "delivery_failed",
-			messageId: message.id,
-			attemptId,
-			reason: `Intercom message ID '${message.id}' was already delivered with a different target or payload`,
-			reasonCode: "message_id_conflict",
-		});
-		return;
-	}
+	const senderIdentity = fromSession.registrationReturnAddress ?? fromSession.info.id;
+	const logicalTarget = typeof clientMessage.logicalTarget === "string" ? clientMessage.logicalTarget : clientMessage.to;
+	const baseSignature = buildMessageSendSignature(logicalTarget, message, senderIdentity);
+	const signature = requirePendingReply
+		? JSON.stringify({
+				requirePendingReply: true,
+				senderGroupIdentity: senderGroupIdentity(fromSession),
+				baseSignature,
+			})
+		: baseSignature;
   const trimmedTo = clientMessage.to.trim();
   if (supervisorSend && !fromSession.supervisorId) {
     write(socket, { type: "delivery_failed", messageId: message.id, attemptId, reason: "Supervisor channel is not authorized" });
@@ -140,6 +174,30 @@ export function handleBrokerSend(
     write(socket, { type: "delivery_failed", messageId: message.id, attemptId, reason: "Supervisor target does not match the authorized relationship" });
     return;
   }
+	const workflowTarget = parseWorkflowStageTarget(trimmedTo);
+	// Slice 3 (D3): asks to pattern/future stage targets stay refused; `send` is queued
+	// sticky by the workflow host, so the refusal must happen before any live delivery.
+	if (workflowTarget !== undefined && workflowTarget.kind !== "path" && message.expectsReply === true) {
+		write(socket, {
+			type: "delivery_failed",
+			messageId: message.id,
+			...(attemptId ? { attemptId } : {}),
+			reason: PENDING_STAGE_ASK_REFUSAL,
+		});
+		return;
+	}
+	const legacyTarget = parseLegacyWorkflowStageTarget(trimmedTo);
+	if (legacyTarget !== undefined) {
+		write(socket, {
+			type: "delivery_failed",
+			messageId: message.id,
+			...(attemptId ? { attemptId } : {}),
+			reason: legacyWorkflowStageTargetMigrationHint(
+				resolveLegacyWorkflowStageTarget?.(legacyTarget.runId, legacyTarget.stageKey),
+			),
+		});
+		return;
+	}
 
 
   // Exact-id targeting always resolves against the full pool so a cross-group id
@@ -159,16 +217,65 @@ export function handleBrokerSend(
   if (resolution.kind === "resolved") {
     const target = sessions.get(resolution.session.id);
     if (!target) {
-      write(socket, { type: "delivery_failed", messageId: message.id, attemptId, reason: "Session not found" });
+      write(socket, {
+        type: "delivery_failed",
+        messageId: message.id,
+        attemptId,
+        reason: "Session not found",
+        ...(requirePendingReply ? { reasonCode: "session_not_found" as const } : {}),
+      });
       return;
     }
     if (target.info.id === fromSession.info.id) {
       write(socket, { type: "delivery_failed", messageId: message.id, attemptId, reason: "Cannot message the current session" });
       return;
     }
+	const targetIdentity = deliveryTargetIdentity(target);
+	const deliveredMatch = deliveredMessages.lookupForTarget(message.id, signature, targetIdentity);
+	if (requirePendingReply && deliveredMatch === "match") {
+		write(socket, { type: "delivered", messageId: message.id, attemptId });
+		return;
+	}
+	if (requirePendingReply && deliveredMatch === "conflict") {
+		write(socket, {
+			type: "delivery_failed",
+			messageId: message.id,
+			attemptId,
+			reason: `Intercom message ID '${message.id}' was already delivered with a different target or payload`,
+			reasonCode: "message_id_conflict",
+		});
+		return;
+	}
+	if (requirePendingReply && deliveredMatch === "invalid") {
+		write(socket, {
+			type: "delivery_failed",
+			messageId: message.id,
+			attemptId,
+			reason: "Intercom accepted-delivery authority is invalid; refusing possible duplicate delivery",
+		});
+		return;
+	}
+	if (requirePendingReply && deliveredMatch === "uncertain") {
+		write(socket, {
+			type: "delivery_failed",
+			messageId: message.id,
+			attemptId,
+			reason: "Intercom cannot prove whether this reserved operation reached its recipient; refusing redelivery",
+		});
+		return;
+	}
 	const correlatedReply =
 		message.replyTo !== undefined &&
 		pendingQuestions.matchesReply(fromSession.info.id, target.info.id, message.replyTo);
+	if (requirePendingReply && !correlatedReply) {
+		write(socket, {
+			type: "delivery_failed",
+			messageId: message.id,
+			attemptId,
+			reason: "Pending question route does not authorize this public reply",
+		});
+		return;
+	}
 	const bypass =
 		supervisorSend ||
 		isVerticalBypass({
@@ -188,14 +295,62 @@ export function handleBrokerSend(
       });
       return;
     }
-		const liveTarget = parsePendingStageTarget(trimmedTo);
+	if (deliveredMatch === "match") {
+		if (message.expectsReply === true) {
+			const acceptedQuestionTarget = deliveredMessages.lookupQuestionTarget(
+				message.id,
+				signature,
+				senderGroupIdentity(fromSession),
+			);
+			if (acceptedQuestionTarget === undefined) {
+				write(socket, {
+					type: "delivery_failed",
+					messageId: message.id,
+					attemptId,
+					reason: "Accepted Intercom question route could not be securely rebound",
+				});
+				return;
+			}
+			pendingQuestions.record(fromSession.info.id, target.info.id, message.id);
+		}
+		write(socket, { type: "delivered", messageId: message.id, attemptId });
+		return;
+	}
+	if (deliveredMatch === "conflict") {
+		write(socket, {
+			type: "delivery_failed",
+			messageId: message.id,
+			attemptId,
+			reason: `Intercom message ID '${message.id}' was already delivered with a different target or payload`,
+			reasonCode: "message_id_conflict",
+		});
+		return;
+	}
+	if (deliveredMatch === "invalid") {
+		write(socket, {
+			type: "delivery_failed",
+			messageId: message.id,
+			attemptId,
+			reason: "Intercom accepted-delivery authority is invalid; refusing possible duplicate delivery",
+		});
+		return;
+	}
+	if (deliveredMatch === "uncertain") {
+		write(socket, {
+			type: "delivery_failed",
+			messageId: message.id,
+			attemptId,
+			reason: "Intercom cannot prove whether this reserved operation reached its recipient; refusing redelivery",
+		});
+		return;
+	}
 		if (
 			liveWorkflowTarget !== undefined &&
-			liveTarget !== undefined &&
+			workflowTarget !== undefined &&
 			routePendingStage?.({
 				socket,
 				from: fromSession,
-				...liveTarget,
+				target: trimmedTo,
 				message,
 				...(attemptId ? { attemptId } : {}),
 				liveTargetId: target.info.id,
@@ -204,33 +359,137 @@ export function handleBrokerSend(
 		) {
 			return;
 		}
-    write(target.socket, supervisorSend
-      ? { type: "message", from: fromSession.info, message, channel: "supervisor" }
-      : { type: "message", from: fromSession.info, message });
-    deliveredMessages.record(message.id, signature);
-    if (message.expectsReply === true) {
-      pendingQuestions.record(fromSession.info.id, target.info.id, message.id);
-    }
-    if (message.replyTo !== undefined) {
-      pendingQuestions.clearReply(fromSession.info.id, target.info.id, message.replyTo);
+    const outbound = supervisorSend
+      ? ({ type: "message", from: fromSession.info, message, channel: "supervisor" } as const)
+      : ({ type: "message", from: fromSession.info, message } as const);
+    const failDelivery = (): void => {
+	  if (reservation === "recorded") deliveredMessages.forget(message.id, signature);
+      write(socket, {
+        type: "delivery_failed",
+        messageId: message.id,
+        attemptId,
+        reason: "Session not found",
+        ...(requirePendingReply ? { reasonCode: "session_not_found" as const } : {}),
+      });
+    };
+	const reservation = message.expectsReply === true
+		? deliveredMessages.reserveQuestion(
+			message.id,
+			signature,
+			{
+				targetSessionId: target.info.id,
+				senderGroupIdentity: senderGroupIdentity(fromSession),
+			},
+			Date.now(),
+			targetIdentity,
+		)
+		: deliveredMessages.reserve(message.id, signature, Date.now(), targetIdentity);
+	if (reservation === "match") {
+		if (
+			message.expectsReply === true &&
+			deliveredMessages.lookupQuestionTarget(
+				message.id,
+				signature,
+				senderGroupIdentity(fromSession),
+			) === undefined
+		) {
+			write(socket, {
+				type: "delivery_failed",
+				messageId: message.id,
+				attemptId,
+				reason: "Accepted Intercom question route could not be securely rebound",
+			});
+			return;
+		}
+		if (message.expectsReply === true) pendingQuestions.record(fromSession.info.id, target.info.id, message.id);
+		write(socket, { type: "delivered", messageId: message.id, attemptId });
+		return;
+	}
+	if (reservation !== "recorded") {
+		write(socket, {
+			type: "delivery_failed",
+			messageId: message.id,
+			attemptId,
+			reason: reservation === "capacity"
+				? "Intercom accepted-delivery capacity is full; refusing delivery without evicting live retry authority"
+				: reservation === "uncertain"
+					? "Intercom cannot prove whether this reserved operation reached its recipient; refusing redelivery"
+					: "Intercom accepted-delivery authority changed before forwarding; refusing possible duplicate delivery",
+			...(reservation === "conflict" ? { reasonCode: "message_id_conflict" as const } : {}),
+		});
+		return;
+	}
+    const finishDelivery = (): void => {
+	  let accepted: ReturnType<DeliveredMessageCache["accept"]>;
+	  try {
+		accepted = deliveredMessages.accept(message.id, signature, targetIdentity);
+	  } catch {
+		write(socket, {
+			type: "delivery_failed",
+			messageId: message.id,
+			attemptId,
+			reason: "Intercom could not durably confirm the forwarded operation; refusing a possibly unsafe retry",
+		});
+		return;
+	  }
+	  if (accepted !== "accepted") {
+		write(socket, {
+			type: "delivery_failed",
+			messageId: message.id,
+			attemptId,
+			reason: "Intercom could not durably confirm the forwarded operation; refusing a possibly unsafe retry",
+			...(accepted === "conflict" ? { reasonCode: "message_id_conflict" as const } : {}),
+		});
+		return;
+	  }
+      if (message.expectsReply === true) {
+        pendingQuestions.record(fromSession.info.id, target.info.id, message.id);
+	  }
+      if (message.replyTo !== undefined) {
+        pendingQuestions.clearReply(fromSession.info.id, target.info.id, message.replyTo);
+      }
+      if (supervisorSend) supervisorCache.record(message.id, fromSession.info.id, target.info.id);
+      write(socket, { type: "delivered", messageId: message.id, attemptId });
+    };
+    if (writeConfirmed !== undefined) {
+      writeConfirmed(target.socket, outbound, (written) => {
+        if (written) finishDelivery();
+        else failDelivery();
+      });
+      return;
     }
-    if (supervisorSend) supervisorCache.record(message.id, fromSession.info.id, target.info.id);
-    write(socket, { type: "delivered", messageId: message.id, attemptId });
-    return;
-  }
-  if (resolution.kind === "not_found" && !supervisorSend && routePendingStage !== undefined) {
-    const pendingTarget = parsePendingStageTarget(trimmedTo);
-    if (
-      pendingTarget !== undefined &&
-      routePendingStage({ socket, from: fromSession, ...pendingTarget, message, ...(attemptId ? { attemptId } : {}) })
-    ) {
+    if (!write(target.socket, outbound)) {
+      // Nothing was written, so the message id and reply authorization remain
+      // available for an honest retry.
+      failDelivery();
       return;
     }
+    finishDelivery();
+    return;
   }
+	if (
+		resolution.kind === "not_found" &&
+		!supervisorSend &&
+		routePendingStage !== undefined &&
+		workflowTarget !== undefined &&
+		routePendingStage({
+			socket,
+			from: fromSession,
+			target: trimmedTo,
+			message,
+			...(attemptId ? { attemptId } : {}),
+			signature,
+		})
+	) {
+		return;
+	}
   write(socket, {
     type: "delivery_failed",
     messageId: message.id,
     attemptId,
     reason: sessionTargetFailureReason(clientMessage.to, resolution),
+		...(requirePendingReply && resolution.kind === "not_found"
+			? { reasonCode: "session_not_found" as const }
+			: {}),
   });
 }

package/dist/builtin/intercom/broker/send-signature.ts

@@ -8,7 +8,9 @@ export interface LogicalSendOptions {
   replyError?: string;
 }
 
-function normalizeAttachments(attachments: Attachment[] | undefined): Array<Record<string, string>> | undefined {
+export function canonicalizeAttachmentsForSendSignature(
+	attachments: readonly Attachment[] | undefined,
+): Array<Record<string, string>> | undefined {
   return attachments?.map((attachment) => ({
     type: attachment.type,
     name: attachment.name,
@@ -22,7 +24,7 @@ export function buildSendSignature(to: string, options: LogicalSendOptions): str
   return JSON.stringify({
     to,
     text: options.text,
-    attachments: normalizeAttachments(options.attachments) ?? [],
+    attachments: canonicalizeAttachmentsForSendSignature(options.attachments) ?? [],
     replyTo: options.replyTo ?? null,
     expectsReply: options.expectsReply ?? false,
     replyError: options.replyError ?? null,

package/dist/builtin/intercom/broker/socket-writes.ts

@@ -0,0 +1,103 @@
+import type net from "node:net";
+import type { BrokerMessage } from "../types.js";
+import { writeMessage } from "./framing.js";
+
+/**
+ * Broker-side socket writes.
+ *
+ * `socket.write()` on a socket whose writable side has already ended does not
+ * throw: it returns `false`, hands `ERR_STREAM_WRITE_AFTER_END` to the write
+ * callback, **destroys the socket synchronously**, and only then emits
+ * `'error'`. A caller-side `try`/`catch` is therefore dead code, and a
+ * writability snapshot taken anywhere other than immediately before the write
+ * can go stale — the broker stores sender sockets in its pending-acknowledgment
+ * maps and writes to them up to ten seconds later.
+ *
+ * So the check lives *inside* the write. Every broker write goes through
+ * `writeMessageIfOpen`, which reports whether the frame was actually handed to
+ * the socket. Callers whose next step claims a delivery — recording it in the
+ * delivered-message cache, opening a reply authorization, answering
+ * `delivered` — must branch on that answer instead of assuming it.
+ *
+ * `destroyed || writableEnded` is the whole test, matching the pre-existing
+ * guards in `broker.ts`. `!socket.writable` is deliberately not part of it: it
+ * is `undefined` on the socket doubles the broker unit suites inject, so adding
+ * it would classify every fake as dead. Failing open on an unknown shape is the
+ * safe direction here — a real ended socket always sets one of the two flags.
+ */
+
+/** True while `socket` can still accept a frame. */
+export function isSocketOpenForWrite(socket: net.Socket): boolean {
+	return !socket.destroyed && !socket.writableEnded;
+}
+
+/**
+ * Frames the broker writes to a client socket.
+ *
+ * `BrokerMessage` is the client-validated union. Two frames the broker already
+ * emits are absent from it — `sticky_live_delivered`, and `queued` carrying
+ * `notInKnownSet` — because `writeMessage` accepts `unknown` and never checked
+ * them. Widening the shared union is a separate change, so they are named here
+ * rather than typed away with a cast.
+ */
+export type BrokerOutboundFrame =
+	| BrokerMessage
+	| {
+			type: "sticky_live_delivered";
+			runId: string;
+			messageId: string;
+			target: string;
+			deliveredTargets: string[];
+	  }
+	| {
+			type: "queued";
+			messageId: string;
+			attemptId?: string;
+			target: string;
+			position: number;
+			notInKnownSet?: true;
+	  };
+
+/**
+ * Write one broker frame unless the socket's writable side is already gone.
+ *
+ * Returns `true` only when the frame was handed to the socket. A `false` answer
+ * means nothing was written and nothing may be recorded as delivered; it never
+ * means the peer acknowledged anything. The converse under-approximates on
+ * purpose: a `true` answer is not proof of receipt either, which is why the
+ * sender-side send timeout remains the terminal authority.
+ */
+export function writeMessageIfOpen(socket: net.Socket, message: BrokerOutboundFrame): boolean {
+	if (!isSocketOpenForWrite(socket)) return false;
+	writeMessage(socket, message);
+	return true;
+}
+
+/**
+ * Write one broker frame and report the socket write callback's outcome.
+ *
+ * Delivery-producing paths use this instead of treating `socket.write()`'s
+ * synchronous return as success. That return only reports backpressure; an
+ * immediate peer reset is reported asynchronously to the callback.
+ */
+export function writeMessageWithOutcome(
+	socket: net.Socket,
+	message: BrokerOutboundFrame,
+	onSettled: (written: boolean) => void,
+): void {
+	if (!isSocketOpenForWrite(socket)) {
+		onSettled(false);
+		return;
+	}
+	let settled = false;
+	const finish = (written: boolean): void => {
+		if (settled) return;
+		settled = true;
+		onSettled(written);
+	};
+	try {
+		writeMessage(socket, message, (error) => finish(error == null));
+	} catch {
+		finish(false);
+	}
+}

package/dist/builtin/intercom/broker/spawn.ts

@@ -1,5 +1,5 @@
 import { spawn } from "child_process";
-import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync, statSync, unlinkSync, writeFileSync } from "fs";
+import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync, statSync, unlinkSync, writeFileSync } from "fs";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 import { createRequire } from "module";
@@ -37,6 +37,11 @@ const BROKER_PID = getBrokerPidPath();
 const BROKER_SPAWN_LOCK = getBrokerSpawnLockPath();
 const BROKER_LOG = getBrokerLogPath();
 
+function ensurePrivateDirectory(path: string): void {
+  mkdirSync(path, { recursive: true, mode: 0o700 });
+  if (process.platform !== "win32") chmodSync(path, 0o700);
+}
+
 /**
  * How much of the broker startup log is read back into an error message.
  *
@@ -182,7 +187,7 @@ function writeWindowsHiddenLauncher(
   commandLine: string,
   launcherPath: string = getWindowsHiddenLauncherPath(),
 ): string {
-  mkdirSync(dirname(launcherPath), { recursive: true });
+  ensurePrivateDirectory(dirname(launcherPath));
   writeFileSync(launcherPath, getWindowsHiddenLauncherScript(commandLine), "utf-8");
   return launcherPath;
 }
@@ -254,7 +259,7 @@ export function getBrokerSpawnOptions(
 
 /** Truncate (or create) the broker log so each spawn starts from a bounded, current file. */
 function resetBrokerLog(logPath: string = BROKER_LOG): void {
-  mkdirSync(dirname(logPath), { recursive: true });
+  ensurePrivateDirectory(dirname(logPath));
   closeSync(openSync(logPath, "w"));
 }
 
@@ -295,7 +300,7 @@ function toError(error: unknown): Error {
 }
 
 export async function spawnBrokerIfNeeded(brokerCommand: string, brokerArgs: string[]): Promise<void> {
-  mkdirSync(INTERCOM_DIR, { recursive: true });
+  ensurePrivateDirectory(INTERCOM_DIR);
 
   if (await isBrokerRunning()) {
     return;