@gajae-code/coding-agent 0.18.11 → 0.19.0

package/src/commit/agentic/agent.ts

@@ -1,7 +1,7 @@
 import { INTENT_FIELD, type ThinkingLevel } from "@gajae-code/agent-core";
 import type { Api, Model } from "@gajae-code/ai/core";
 import { Markdown } from "@gajae-code/tui";
-import { prompt } from "@gajae-code/utils";
+import { prompt, sanitizeText } from "@gajae-code/utils";
 import chalk from "chalk";
 import typesDescriptionPrompt from "../../commit/prompts/types-description.md" with { type: "text" };
 import type { ModelRegistry } from "../../config/model-registry";
@@ -81,7 +81,7 @@ export async function runCommitAgentSession(input: CommitAgentInput): Promise<Co
 	const toolArgsById = new Map<string, { name: string; args?: Record<string, unknown> }>();
 	const writeThinkingLine = (text: string) => {
 		if (!process.stdout.isTTY) return;
-		const line = chalk.dim(`… ${text}`);
+		const line = chalk.dim(`… ${sanitizeText(text)}`);
 		process.stdout.write(`\r\x1b[2K${line}`);
 		thinkingLineActive = true;
 	};
@@ -118,7 +118,7 @@ export async function runCommitAgentSession(input: CommitAgentInput): Promise<Co
 					clearThinkingLine();
 					const assistantMessage = event.message as { stopReason?: string; errorMessage?: string };
 					if (assistantMessage.stopReason === "error" && assistantMessage.errorMessage) {
-						process.stdout.write(`● Error: ${assistantMessage.errorMessage}\n`);
+						process.stdout.write(`● Error: ${sanitizeText(assistantMessage.errorMessage)}\n`);
 					}
 					const messageText = extractMessageText(event.message?.content ?? []);
 					if (messageText) {
@@ -131,10 +131,10 @@ export async function runCommitAgentSession(input: CommitAgentInput): Promise<Co
 				const stored = toolArgsById.get(event.toolCallId) ?? { name: event.toolName };
 				toolArgsById.delete(event.toolCallId);
 				clearThinkingLine();
-				const toolLabel = formatToolLabel(stored.name);
+				const toolLabel = sanitizeText(formatToolLabel(stored.name));
 				const symbol = event.isError ? "" : "";
 				process.stdout.write(`${symbol} ${toolLabel}\n`);
-				const argsLines = formatToolArgs(stored.args);
+				const argsLines = formatToolArgs(stored.args).map(line => sanitizeText(line));
 				if (argsLines.length > 0) {
 					process.stdout.write(`${formatToolArgsBlock(argsLines)}\n`);
 				}
@@ -201,7 +201,7 @@ function extractMessageText(content: Array<{ type: string; text?: string }>): st
 }
 
 function writeAssistantMessage(message: string): void {
-	const lines = renderMarkdownLines(message);
+	const lines = renderMarkdownLines(sanitizeText(message));
 	if (lines.length === 0) return;
 	let firstContentIndex = lines.findIndex(line => line.trim().length > 0);
 	if (firstContentIndex === -1) {

package/src/commit/analysis/conventional.ts

@@ -5,6 +5,7 @@ import { prompt } from "@gajae-code/utils";
 import analysisSystemPrompt from "../../commit/prompts/analysis-system.md" with { type: "text" };
 import analysisUserPrompt from "../../commit/prompts/analysis-user.md" with { type: "text" };
 import type { ConventionalAnalysis } from "../../commit/types";
+import { escapePromptMetadata } from "../../session/messages";
 import { toReasoningEffort } from "../../thinking";
 import { createConventionalAnalysisTool, parseConventionalAnalysisResponse } from "../shared-llm";
 
@@ -41,13 +42,21 @@ export async function generateConventionalAnalysis({
 	diff,
 }: ConventionalAnalysisInput): Promise<ConventionalAnalysis> {
 	const userContent = prompt.render(analysisUserPrompt, {
-		context_files: contextFiles && contextFiles.length > 0 ? contextFiles : undefined,
+		context_files:
+			contextFiles && contextFiles.length > 0
+				? contextFiles.map(file => ({
+						path: escapePromptMetadata(file.path),
+						content: escapePromptMetadata(file.content, { preserveNewlines: true }),
+					}))
+				: undefined,
 		user_context: userContext,
 		types_description: typesDescription,
-		recent_commits: recentCommits?.join("\n"),
-		scope_candidates: scopeCandidates,
-		stat,
-		diff,
+		recent_commits: recentCommits
+			?.map(subject => escapePromptMetadata(subject, { preserveNewlines: true }))
+			.join("\n"),
+		scope_candidates: escapePromptMetadata(scopeCandidates, { preserveNewlines: true }),
+		stat: escapePromptMetadata(stat, { preserveNewlines: true }),
+		diff: escapePromptMetadata(diff, { preserveNewlines: true }),
 	});
 
 	const response = await completeSimple(

package/src/commit/changelog/index.ts

@@ -168,11 +168,49 @@ function applyChangelogEntries(
 	if (deletions) {
 		base = applyDeletions(base, deletions);
 	}
-	const merged = mergeEntries(base, entries);
+	const merged = mergeEntries(base, redactPersistedEntries(entries));
 	const sectionLines = renderUnreleasedSections(merged);
 	return [...before, ...sectionLines, ...after].join("\n");
 }
 
+function redactPersistedEntries(entries: Record<string, string[]>): Record<string, string[]> {
+	const redacted: Record<string, string[]> = {};
+	for (const [section, items] of Object.entries(entries)) {
+		redacted[section] = items.map(item => redactChangelogEntry(item));
+	}
+	return redacted;
+}
+
+const AWS_LABELED_KEY =
+	"(?:(?:aws[_-]?)?secret[_-]?access[_-]?key|(?:aws[_-]?)?session[_-]?token|x[_-]?amz[_-]?security[_-]?token)";
+
+export function redactChangelogEntry(text: string): string {
+	let redacted = text.replace(/(^|[^0-9A-Za-z])(?:AKIA|ASIA)[0-9A-Z]{16}(?![0-9A-Za-z])/g, "$1[REDACTED_AWS_KEY_ID]");
+	redacted = redacted.replace(
+		new RegExp(
+			`(^|[^A-Za-z0-9_-])(["']?${AWS_LABELED_KEY}["']?\\s*[=:]\\s*)(\\$?)(["'\`])([^"'\`\\r\\n]{8,})\\4`,
+			"gi",
+		),
+		"$1$2$3$4[REDACTED_SECRET]$4",
+	);
+	redacted = redacted.replace(
+		new RegExp(`(^|[^A-Za-z0-9_-])(["']?${AWS_LABELED_KEY}["']?\\s*[=:]\\s*)[^\\s"'\`,;{}[\\]()&<>#]{8,}`, "gi"),
+		"$1$2[REDACTED_SECRET]",
+	);
+	redacted = redacted.replace(/\b(?:sk|pk|rk|xox[baprs])-[-_A-Za-z0-9]{12,}\b/g, "[REDACTED_TOKEN]");
+	redacted = redacted.replace(/(?<![A-Za-z0-9_-])AIza[0-9A-Za-z_-]{35}(?![A-Za-z0-9_-])/g, "[REDACTED_TOKEN]");
+	redacted = redacted.replace(/\b(?:gh[opsur]_[A-Za-z0-9_]{12,}|github_pat_[A-Za-z0-9_]{12,})\b/g, "[REDACTED_TOKEN]");
+	redacted = redacted.replace(
+		/\b((?:ANTHROPIC|OPENAI|GITHUB|GOOGLE|GEMINI|KAGI|TAVILY|EXA|PERPLEXITY|ZAI|KIMI|BRAVE|SEARXNG|AWS)_[A-Z0-9_]*(?:KEY|TOKEN|SECRET|COOKIE|PASSWORD))\s*=\s*[^\s\n]+/gi,
+		"$1=[REDACTED_SECRET]",
+	);
+	redacted = redacted.replace(
+		/\b(Authorization|Proxy-Authorization)\s*:\s*(?:Bearer|Basic|Token)\s+[^\s\n]+/gi,
+		"$1: [REDACTED_AUTH_HEADER]",
+	);
+	return redacted.replace(/\b(Cookie|Set-Cookie)\s*:\s*[^\n]+/gi, "$1: [REDACTED_COOKIE]");
+}
+
 function applyDeletions(
 	existing: Record<string, string[]>,
 	deletions: Record<string, string[]>,

package/src/commit/map-reduce/index.ts

@@ -23,9 +23,9 @@ export interface MapReduceInput {
 	model: Model<Api>;
 	apiKey: string;
 	thinkingLevel?: ThinkingLevel;
-	smolModel: Model<Api>;
-	smolApiKey: string;
-	smolThinkingLevel?: ThinkingLevel;
+	secondaryModel: Model<Api>;
+	secondaryApiKey: string;
+	secondaryThinkingLevel?: ThinkingLevel;
 	diff: string;
 	stat: string;
 	scopeCandidates: string;
@@ -45,15 +45,15 @@ export function shouldUseMapReduce(diff: string, settings?: MapReduceSettings):
 }
 
 /**
- * Run map-reduce analysis for large diffs using smol + primary models.
+ * Run map-reduce analysis for large diffs using the secondary (map) and primary (reduce) models.
  */
 
 export async function runMapReduceAnalysis(input: MapReduceInput): Promise<ConventionalAnalysis> {
 	const fileDiffs = parseFileDiffs(input.diff).filter(file => !isExcludedFile(file.filename));
 	const observations = await runMapPhase({
-		model: input.smolModel,
-		apiKey: input.smolApiKey,
-		thinkingLevel: input.smolThinkingLevel,
+		model: input.secondaryModel,
+		apiKey: input.secondaryApiKey,
+		thinkingLevel: input.secondaryThinkingLevel,
 		files: fileDiffs,
 		config: input.settings,
 	});

package/src/commit/message.ts

@@ -1,9 +1,16 @@
+import { redactCrashSecrets } from "@gajae-code/utils";
+import { redactChangelogEntry } from "./changelog";
 import type { ConventionalAnalysis } from "./types";
 
+/** Same order as generated task messages, so a second pass stays stable. */
+function redactCommitText(text: string): string {
+	return redactCrashSecrets(redactChangelogEntry(text));
+}
+
 export function formatCommitMessage(analysis: ConventionalAnalysis, summary: string): string {
-	const scopePart = analysis.scope ? `(${analysis.scope})` : "";
-	const header = `${analysis.type}${scopePart}: ${summary}`;
-	const bodyLines = analysis.details.map(detail => `- ${detail.text.trim()}`);
+	const scopePart = analysis.scope ? `(${redactCommitText(analysis.scope)})` : "";
+	const header = `${analysis.type}${scopePart}: ${redactCommitText(summary)}`;
+	const bodyLines = analysis.details.map(detail => `- ${redactCommitText(detail.text.trim())}`);
 	if (bodyLines.length === 0) {
 		return header;
 	}

package/src/commit/pipeline.ts

@@ -53,9 +53,9 @@ async function runLegacyCommitCommand(args: CommitCommandArgs): Promise<void> {
 		thinkingLevel: primaryThinkingLevel,
 	} = await resolvePrimaryModel(args.model, settings, modelRegistry);
 	const {
-		model: smolModel,
-		apiKey: smolApiKey,
-		thinkingLevel: smolThinkingLevel,
+		model: secondaryModel,
+		apiKey: secondaryApiKey,
+		thinkingLevel: secondaryThinkingLevel,
 	} = await resolveSecondaryCommitModel(settings, modelRegistry, primaryModel, primaryApiKey);
 
 	let stagedFiles = await git.diff.changedFiles(cwd, { cached: true });
@@ -102,9 +102,9 @@ async function runLegacyCommitCommand(args: CommitCommandArgs): Promise<void> {
 		primaryModel,
 		primaryApiKey,
 		primaryThinkingLevel,
-		smolModel,
-		smolApiKey,
-		smolThinkingLevel,
+		secondaryModel,
+		secondaryApiKey,
+		secondaryThinkingLevel,
 		commitSettings,
 	});
 
@@ -148,9 +148,9 @@ async function generateAnalysis(input: {
 	primaryModel: Model<Api>;
 	primaryApiKey: string;
 	primaryThinkingLevel?: ThinkingLevel;
-	smolModel: Model<Api>;
-	smolApiKey: string;
-	smolThinkingLevel?: ThinkingLevel;
+	secondaryModel: Model<Api>;
+	secondaryApiKey: string;
+	secondaryThinkingLevel?: ThinkingLevel;
 	commitSettings: {
 		mapReduceEnabled: boolean;
 		mapReduceMinFiles: number;
@@ -172,9 +172,9 @@ async function generateAnalysis(input: {
 			model: input.primaryModel,
 			apiKey: input.primaryApiKey,
 			thinkingLevel: input.primaryThinkingLevel,
-			smolModel: input.smolModel,
-			smolApiKey: input.smolApiKey,
-			smolThinkingLevel: input.smolThinkingLevel,
+			secondaryModel: input.secondaryModel,
+			secondaryApiKey: input.secondaryApiKey,
+			secondaryThinkingLevel: input.secondaryThinkingLevel,
 			diff: input.diff,
 			stat: input.stat,
 			scopeCandidates: input.scopeCandidates,

package/src/config/autorouting-tier-map.ts

@@ -44,7 +44,8 @@ type NormalizedAutoroutingCuratedTierMap = {
 export const TIER_MAP_VERSION = 1;
 
 export const CURATED_TIER_LABELS = {
-	"anthropic/claude-haiku-4-5": [{ tier: "fast", rank: 1 }],
+	"anthropic/claude-haiku-5-5": [{ tier: "fast", rank: 1 }],
+	"anthropic/claude-haiku-4-5": [{ tier: "fast", rank: 2 }],
 	"anthropic/claude-sonnet-5-5": [{ tier: "balanced", rank: 1 }],
 	"anthropic/claude-sonnet-5": [{ tier: "balanced", rank: 2 }],
 	"anthropic/claude-sonnet-4-6": [{ tier: "balanced", rank: 3 }],
@@ -77,15 +78,63 @@ export const CURATED_TIER_LABELS = {
 
 /** Generated from packages/ai/src/models.json at feature land: 3936 in-scope baseline skips. */
 export const TIER_MAP_SKIP_LIST = {
+	"amazon-bedrock/anthropic.claude-haiku-5-5": {
+		rationale: "Haiku 5.5 Bedrock catalog addition; not yet curated",
+	},
+	"amazon-bedrock/au.anthropic.claude-haiku-5-5": {
+		rationale: "Haiku 5.5 Bedrock catalog addition; not yet curated",
+	},
+	"amazon-bedrock/eu.anthropic.claude-haiku-5-5": {
+		rationale: "Haiku 5.5 Bedrock catalog addition; not yet curated",
+	},
+	"amazon-bedrock/global.anthropic.claude-haiku-5-5": {
+		rationale: "Haiku 5.5 Bedrock catalog addition; not yet curated",
+	},
+	"amazon-bedrock/jp.anthropic.claude-haiku-5-5": {
+		rationale: "Haiku 5.5 Bedrock catalog addition; not yet curated",
+	},
+	"amazon-bedrock/us.anthropic.claude-haiku-5-5": {
+		rationale: "Haiku 5.5 Bedrock catalog addition; not yet curated",
+	},
 	"amazon-bedrock/au.anthropic.claude-sonnet-5-5": {
 		rationale: "Sonnet 5.5 catalog addition (#6111); not yet curated",
 	},
+	"amazon-bedrock/in.anthropic.claude-haiku-4-5-20251001-v1:0": {
+		rationale: "India-region Bedrock Anthropic catalog addition (#6731); not yet curated",
+	},
+	"amazon-bedrock/in.anthropic.claude-opus-5": {
+		rationale: "India-region Bedrock Anthropic catalog addition (#6731); not yet curated",
+	},
+	"amazon-bedrock/in.anthropic.claude-sonnet-5": {
+		rationale: "India-region Bedrock Anthropic catalog addition (#6731); not yet curated",
+	},
 	"amazon-bedrock/jp.anthropic.claude-sonnet-5-5": {
 		rationale: "Sonnet 5.5 catalog addition (#6111); not yet curated",
 	},
 	"amazon-bedrock/us.anthropic.claude-sonnet-5-5": {
 		rationale: "Sonnet 5.5 catalog addition (#6111); not yet curated",
 	},
+	"github-copilot/gemini-4-argon": {
+		rationale: "Gemini 4 Argon provider catalog addition (#6731); not yet curated",
+	},
+	"google/gemini-4-argon": {
+		rationale: "Gemini 4 Argon catalog addition (#6731); tier ordering not yet reviewed",
+	},
+	"kilo/google/gemini-4-argon": {
+		rationale: "Gemini 4 Argon provider catalog addition (#6731); not yet curated",
+	},
+	"opencode-zen/gemini-4-argon": {
+		rationale: "Gemini 4 Argon provider catalog addition (#6731); not yet curated",
+	},
+	"openrouter/google/gemini-4-argon": {
+		rationale: "Gemini 4 Argon provider catalog addition (#6731); not yet curated",
+	},
+	"openrouter/google/gemini-4-argon:batch": {
+		rationale: "Gemini 4 Argon batch provider catalog addition (#6731); not yet curated",
+	},
+	"vercel-ai-gateway/google/gemini-4-argon": {
+		rationale: "Gemini 4 Argon provider catalog addition (#6731); not yet curated",
+	},
 	"kiro/claude-opus-5-5": { rationale: "post-rebase catalog addition from dev; not yet curated" },
 	"kiro/claude-opus-5.5": { rationale: "post-rebase catalog addition from dev; not yet curated" },
 	"alibaba-token-plan/qwen3.8-flash": { rationale: "post-rebase catalog addition from dev; not yet curated" },

package/src/config/config-file.ts

@@ -1,18 +1,121 @@
+import { randomBytes } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { getAgentDir, isEnoent, logger } from "@gajae-code/utils";
+import { renameNoReplacePath } from "@gajae-code/natives";
+import { getAgentDir, isEnoent, isFsError, logger } from "@gajae-code/utils";
 import { JSONC, YAML } from "bun";
 import type { ZodType } from "zod/v4";
 
+// Volumes without hard links fail `link`. Windows maps FAT ERROR_INVALID_FUNCTION to EISDIR.
+const HARD_LINK_UNAVAILABLE = new Set(["EACCES", "EISDIR", "ENOSYS", "ENOTSUP", "EOPNOTSUPP", "EPERM", "EXDEV"]);
+
 /** Minimal subset of the AJV ConfigSchemaError shape this module actually relies on. */
 interface ConfigSchemaError {
 	instancePath: string;
 	message: string | undefined;
 }
 
+/** True when the final path component exists, including a dangling symlink. */
+function ymlPathPresent(ymlPath: string): boolean {
+	try {
+		fs.lstatSync(ymlPath);
+		return true;
+	} catch (error) {
+		if (isEnoent(error)) return false;
+		throw error;
+	}
+}
+
+function hardLinkUnavailable(error: unknown): boolean {
+	return isFsError(error) && HARD_LINK_UNAVAILABLE.has(error.code);
+}
+
+function stagedRegularFile(tmpPath: string): boolean {
+	try {
+		return fs.lstatSync(tmpPath).isFile();
+	} catch {
+		return false;
+	}
+}
+
+function discardStaged(tmpPath: string): void {
+	try {
+		fs.unlinkSync(tmpPath);
+	} catch {
+		// Unpublished, or the no-replace rename already moved this name.
+	}
+}
+
+/** Publish the completed private file when `link` is not supported. Never replaces `ymlPath`. */
+function publishStagedWithoutHardLink(tmpPath: string, ymlPath: string): void {
+	const published = renameNoReplacePath(tmpPath, ymlPath);
+	if (!published.ok && published.reason !== "destination_exists") {
+		discardStaged(tmpPath);
+		throw new Error(`config migration could not publish without a hard link (${published.reason})`);
+	}
+	discardStaged(tmpPath);
+}
+
+/**
+ * Publish a new regular file as mode 0600. The bytes go to a private inode
+ * opened with O_EXCL and O_NOFOLLOW. `link` then attaches that inode to
+ * `ymlPath` and fails when the name exists, so a final-component symlink is
+ * not followed and an existing file is not replaced. A volume without hard
+ * links publishes that same completed file with a no-replace rename. The
+ * destination name stays absent until the bytes are complete.
+ */
+function writeNewOwnerOnlyNoFollow(ymlPath: string, content: string): void {
+	// Ancestor symlinks only. The final component stays unresolved so no-follow still applies.
+	ymlPath = path.join(fs.realpathSync(path.dirname(ymlPath)), path.basename(ymlPath));
+	const noFollow = process.platform === "win32" ? 0 : (fs.constants.O_NOFOLLOW ?? 0);
+	const tmpPath = path.join(
+		path.dirname(ymlPath),
+		`.${path.basename(ymlPath)}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`,
+	);
+	let fd: number | undefined;
+	try {
+		fd = fs.openSync(tmpPath, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | noFollow, 0o600);
+		if (process.platform !== "win32") fs.fchmodSync(fd, 0o600);
+		fs.writeFileSync(fd, content);
+		fs.fsyncSync(fd);
+		fs.closeSync(fd);
+		fd = undefined;
+	} catch (error) {
+		if (fd !== undefined) {
+			try {
+				fs.closeSync(fd);
+			} catch {
+				// The original failure is the one that must surface.
+			}
+			try {
+				fs.unlinkSync(tmpPath);
+			} catch {
+				// The destination name was not published.
+			}
+		}
+		throw error;
+	}
+	try {
+		fs.linkSync(tmpPath, ymlPath);
+	} catch (error) {
+		// The name is already present: a finished peer publish, or a file or symlink we must not replace.
+		if (isFsError(error) && (error.code === "EEXIST" || error.code === "ELOOP")) {
+			discardStaged(tmpPath);
+			return;
+		}
+		if (hardLinkUnavailable(error) && stagedRegularFile(tmpPath)) {
+			publishStagedWithoutHardLink(tmpPath, ymlPath);
+			return;
+		}
+		discardStaged(tmpPath);
+		throw error;
+	}
+	discardStaged(tmpPath);
+}
+
 function migrateJsonToYml(jsonPath: string, ymlPath: string) {
 	try {
-		if (fs.existsSync(ymlPath)) return;
+		if (ymlPathPresent(ymlPath)) return;
 		if (!fs.existsSync(jsonPath)) return;
 
 		const content = fs.readFileSync(jsonPath, "utf-8");
@@ -21,7 +124,7 @@ function migrateJsonToYml(jsonPath: string, ymlPath: string) {
 			logger.warn("migrateJsonToYml: invalid json structure", { path: jsonPath });
 			return;
 		}
-		fs.writeFileSync(ymlPath, YAML.stringify(parsed, null, 2));
+		writeNewOwnerOnlyNoFollow(ymlPath, YAML.stringify(parsed, null, 2));
 	} catch (error) {
 		logger.warn("migrateJsonToYml: migration failed", { error: String(error) });
 	}

package/src/config/config-hot-reload-trust.ts

@@ -0,0 +1,148 @@
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+
+const PRIVATE_DIRECTORY_MASK = 0o077;
+const GROUP_OTHER_WRITE_MASK = 0o022;
+const STICKY_BIT = 0o1000;
+
+interface DirectorySnapshot {
+	readonly dev: number;
+	readonly ino: number;
+	readonly uid: number;
+	readonly mode: number;
+}
+
+interface CheckedFilePath {
+	readonly filePath: string;
+	readonly lexicalParent: string;
+	readonly canonicalParent: string;
+	readonly canonicalTarget: string | undefined;
+}
+
+function isStrictDescendant(parent: string, candidate: string): boolean {
+	const relative = path.relative(parent, candidate);
+	return (
+		relative.length > 0 && !path.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path.sep}`)
+	);
+}
+
+function directoryAncestors(directory: string): string[] {
+	const absolute = path.resolve(directory);
+	const root = path.parse(absolute).root;
+	const ancestors = [root];
+	let current = root;
+	for (const component of path.relative(root, absolute).split(path.sep).filter(Boolean)) {
+		current = path.join(current, component);
+		ancestors.push(current);
+	}
+	return ancestors;
+}
+
+function hasExpectedOwner(uid: number, owner: number): boolean {
+	return owner === 0 || owner === uid;
+}
+
+async function inspectFilePath(filePath: string): Promise<CheckedFilePath> {
+	if (!path.isAbsolute(filePath)) throw new Error("Configuration paths must be absolute");
+	const absolutePath = path.resolve(filePath);
+	const lexicalParent = path.dirname(absolutePath);
+	const canonicalParent = await fs.realpath(lexicalParent);
+	let canonicalTarget: string | undefined;
+	try {
+		await fs.lstat(absolutePath);
+		canonicalTarget = await fs.realpath(absolutePath);
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+	}
+	return { filePath: absolutePath, lexicalParent, canonicalParent, canonicalTarget };
+}
+
+/**
+ * Hot reload requires a privacy check that only Linux can perform: its
+ * directory modes include the POSIX ACL mask, so denying group/other access
+ * also denies named ACL grants. Node does not expose enough ACL state on other
+ * platforms to establish equivalent privacy, so they do not watch at all.
+ */
+export function isConfigHotReloadSupported(): boolean {
+	return process.platform === "linux" && typeof process.getuid === "function";
+}
+
+/** Returns whether both configuration paths live in private, safely owned directories. */
+export async function isConfigHotReloadTrusted(paths: {
+	readonly configPath: string;
+	readonly modelsPath: string;
+}): Promise<boolean> {
+	if (process.platform !== "linux" || typeof process.getuid !== "function") return false;
+	const uid = process.getuid();
+	try {
+		const checkedPaths = await Promise.all([inspectFilePath(paths.configPath), inspectFilePath(paths.modelsPath)]);
+		const effectiveDirectories = new Set<string>();
+		const directoriesToCheck = new Set<string>();
+		for (const checked of checkedPaths) {
+			effectiveDirectories.add(checked.canonicalParent);
+			directoriesToCheck.add(checked.lexicalParent);
+			directoriesToCheck.add(checked.canonicalParent);
+			if (checked.canonicalTarget) {
+				const targetParent = path.dirname(checked.canonicalTarget);
+				effectiveDirectories.add(targetParent);
+				directoriesToCheck.add(targetParent);
+			}
+		}
+		for (const directory of [...directoriesToCheck]) {
+			for (const ancestor of directoryAncestors(directory)) directoriesToCheck.add(ancestor);
+		}
+
+		const snapshots = new Map<string, DirectorySnapshot>();
+		for (const directory of directoriesToCheck) {
+			const stat = await fs.stat(directory);
+			if (!stat.isDirectory()) return false;
+			snapshots.set(directory, { dev: stat.dev, ino: stat.ino, uid: stat.uid, mode: stat.mode });
+		}
+
+		for (const directory of effectiveDirectories) {
+			const snapshot = snapshots.get(directory);
+			if (!snapshot || snapshot.uid !== uid || (snapshot.mode & PRIVATE_DIRECTORY_MASK) !== 0) return false;
+		}
+
+		for (const directory of directoriesToCheck) {
+			const snapshot = snapshots.get(directory)!;
+			if (!hasExpectedOwner(uid, snapshot.uid)) return false;
+			if ((snapshot.mode & GROUP_OTHER_WRITE_MASK) === 0) continue;
+			const safelyContainsPrivateLeaf =
+				snapshot.uid === 0 &&
+				(snapshot.mode & STICKY_BIT) !== 0 &&
+				[...effectiveDirectories].some(leaf => isStrictDescendant(directory, leaf));
+			if (!safelyContainsPrivateLeaf) return false;
+		}
+
+		// Confirm symlink resolution and directory identity stayed stable while checking metadata.
+		for (const checked of checkedPaths) {
+			if ((await fs.realpath(checked.lexicalParent)) !== checked.canonicalParent) return false;
+			try {
+				await fs.lstat(checked.filePath);
+			} catch (error) {
+				if ((error as NodeJS.ErrnoException).code !== "ENOENT" || checked.canonicalTarget !== undefined) {
+					return false;
+				}
+				continue;
+			}
+			if (checked.canonicalTarget === undefined) return false;
+			if ((await fs.realpath(checked.filePath)) !== checked.canonicalTarget) return false;
+		}
+		for (const [directory, snapshot] of snapshots) {
+			const stat = await fs.stat(directory);
+			if (
+				!stat.isDirectory() ||
+				stat.dev !== snapshot.dev ||
+				stat.ino !== snapshot.ino ||
+				stat.uid !== snapshot.uid ||
+				stat.mode !== snapshot.mode
+			) {
+				return false;
+			}
+		}
+		return true;
+	} catch {
+		return false;
+	}
+}