@gajae-code/coding-agent 0.18.12 → 0.19.0

package/src/gjc-runtime/ralplan-current-final.ts

@@ -0,0 +1,294 @@
+/**
+ * Validate the exact current ralplan final that an execution approval may target.
+ *
+ * The Ultragoal ask guard blocks every `ask` while a goal is incomplete or
+ * review-blocked, which is correct for ordinary questions but also deadlocks the
+ * one question that can legitimately unblock the work: the execution approval for
+ * an already-reviewed ralplan final (issue #6578). Granting that route needs proof
+ * that the final being approved is the current one and that its reviewers really
+ * passed it — never a caller-declared tag.
+ *
+ * The proof is reconstructed from what ralplan already persists:
+ *
+ *   - `<session plans>/ralplan/<run-id>/index.jsonl` rows `{stage, stage_n, path, sha256}`
+ *   - the artifact files those rows name, re-hashed here
+ *   - the run state (`<session state>/ralplan-state.json`) for run id and phase
+ *   - the resolved `autoHandoff` target, which must be `off`
+ *
+ * Anything missing, stale, rewritten, out of order, or outside this session's run
+ * directory is a typed refusal. This module only reads and hashes; it never
+ * mutates state and never grants anything by itself.
+ */
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import { isEnoent } from "@gajae-code/utils";
+import { resolveRalplanAutoHandoff } from "./ralplan-runtime";
+import { modeStatePath, sessionPlansDir } from "./session-layout";
+
+/** Stages that open a consensus iteration; a final is only valid after one. */
+const ITERATION_OPENER_STAGES: ReadonlySet<string> = new Set(["planner", "revision"]);
+
+/** Reviewer stages whose verdicts must join the same iteration as the final. */
+const REVIEW_LANE_STAGES: readonly string[] = ["architect", "critic"];
+
+export interface RalplanIndexRow {
+	stage: string;
+	stageN: number;
+	path: string;
+	sha256: string;
+}
+
+export interface RalplanCurrentFinalDescriptor {
+	/** Run id the final belongs to. */
+	runId: string;
+	/** Absolute path of the final artifact. */
+	finalPath: string;
+	/** sha256 recorded for the final and re-verified against its bytes. */
+	finalSha256: string;
+	/** sha256 of the iteration-opening planner (or revision) artifact. */
+	plannerSha256: string;
+	/** Reviewer verdict hashes that joined this iteration. */
+	reviewerSha256: Record<string, string>;
+	/** Session that owns the run; a foreign session can never be granted. */
+	sessionId: string;
+}
+
+export type RalplanCurrentFinalRefusalCode =
+	| "missing_state"
+	| "run_not_final"
+	| "auto_handoff_enabled"
+	| "missing_index"
+	| "malformed_index"
+	| "no_iteration_opener"
+	| "final_not_last"
+	| "missing_reviewers"
+	| "artifact_missing"
+	| "artifact_outside_run"
+	| "hash_mismatch";
+
+export interface RalplanCurrentFinalRefusal {
+	code: RalplanCurrentFinalRefusalCode;
+	/** Human-readable reason suitable for a guard error message. */
+	reason: string;
+}
+
+export type RalplanCurrentFinalResolution =
+	| { ok: true; descriptor: RalplanCurrentFinalDescriptor }
+	| { ok: false; refusal: RalplanCurrentFinalRefusal };
+
+export interface RalplanCurrentFinalInput {
+	cwd: string;
+	/** Caller session id; the run must belong to it. */
+	sessionId: string;
+	/** Optional agent dir for settings resolution. */
+	agentDir?: string;
+}
+
+/**
+ * Whether the pending `ask` payload selects the ralplan execution-approval gate.
+ *
+ * This is a selector, not authority: it only decides which validation runs. The
+ * descriptor it leads to is the proof.
+ */
+export function selectsRalplanApprovalGate(pendingQuestions: unknown): boolean {
+	const questions = (pendingQuestions as { questions?: unknown } | undefined)?.questions;
+	if (!Array.isArray(questions)) return false;
+	return questions.some(question => {
+		if (!question || typeof question !== "object" || Array.isArray(question)) return false;
+		const gate = (question as { workflowGate?: unknown }).workflowGate;
+		if (!gate || typeof gate !== "object" || Array.isArray(gate)) return false;
+		const record = gate as { stage?: unknown; kind?: unknown };
+		return record.stage === "ralplan" && record.kind === "approval";
+	});
+}
+
+function refusal(code: RalplanCurrentFinalRefusalCode, reason: string): RalplanCurrentFinalRefusal {
+	return { code, reason };
+}
+
+function parseIndexRow(line: string): RalplanIndexRow | undefined {
+	const trimmed = line.trim();
+	if (!trimmed) return undefined;
+	let parsed: unknown;
+	try {
+		parsed = JSON.parse(trimmed);
+	} catch {
+		return undefined;
+	}
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return undefined;
+	const record = parsed as Record<string, unknown>;
+	const { stage, path: artifactPath, sha256 } = record;
+	const stageN = record.stage_n;
+	if (typeof stage !== "string" || !stage.trim()) return undefined;
+	if (typeof stageN !== "number" || !Number.isInteger(stageN) || stageN <= 0) return undefined;
+	if (typeof artifactPath !== "string" || !artifactPath.trim()) return undefined;
+	if (typeof sha256 !== "string" || !/^[0-9a-f]{64}$/i.test(sha256)) return undefined;
+	return { stage: stage.trim(), stageN, path: artifactPath.trim(), sha256: sha256.toLowerCase() };
+}
+
+async function readRunState(statePath: string): Promise<{ runId: string; phase: string } | RalplanCurrentFinalRefusal> {
+	let text: string;
+	try {
+		text = await fs.readFile(statePath, "utf-8");
+	} catch (error) {
+		if (isEnoent(error)) return refusal("missing_state", `no ralplan run state at ${statePath}`);
+		return refusal("missing_state", `failed to read ralplan run state at ${statePath}`);
+	}
+	let parsed: unknown;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		return refusal("malformed_index", `ralplan run state at ${statePath} is not valid JSON`);
+	}
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+		return refusal("malformed_index", `ralplan run state at ${statePath} is not an object`);
+	}
+	const record = parsed as Record<string, unknown>;
+	const runId = typeof record.run_id === "string" ? record.run_id.trim() : "";
+	const phase = typeof record.current_phase === "string" ? record.current_phase.trim().toLowerCase() : "";
+	if (!runId) return refusal("malformed_index", `ralplan run state at ${statePath} has no run_id`);
+	return { runId, phase };
+}
+
+/**
+ * Resolve and verify the current ralplan final for `sessionId`.
+ *
+ * Fails closed: every check returns a refusal instead of degrading to a weaker
+ * proof, because the caller uses a success to lift the Ultragoal ask guard.
+ */
+export async function resolveRalplanCurrentFinal(
+	input: RalplanCurrentFinalInput,
+): Promise<RalplanCurrentFinalResolution> {
+	const sessionId = input.sessionId.trim();
+	if (!sessionId) return { ok: false, refusal: refusal("missing_state", "no caller session id") };
+
+	const state = await readRunState(modeStatePath(input.cwd, sessionId, "ralplan"));
+	if (!("runId" in state)) return { ok: false, refusal: state };
+	if (state.phase !== "final" && state.phase !== "handoff") {
+		return {
+			ok: false,
+			refusal: refusal("run_not_final", `ralplan run ${state.runId} is in phase "${state.phase}", not final`),
+		};
+	}
+
+	// A final that would hand off automatically is not waiting for approval.
+	const autoHandoff = await resolveRalplanAutoHandoff(input.cwd, { agentDir: input.agentDir });
+	if (autoHandoff.effectiveTarget !== "off") {
+		return {
+			ok: false,
+			refusal: refusal(
+				"auto_handoff_enabled",
+				`ralplan autoHandoff is "${autoHandoff.effectiveTarget}"; a current final is only approvable while handoff is off`,
+			),
+		};
+	}
+
+	const runDir = path.join(sessionPlansDir(input.cwd, sessionId), "ralplan", state.runId);
+	const indexPath = path.join(runDir, "index.jsonl");
+	let indexText: string;
+	try {
+		indexText = await fs.readFile(indexPath, "utf-8");
+	} catch (error) {
+		if (isEnoent(error)) return { ok: false, refusal: refusal("missing_index", `no ralplan index at ${indexPath}`) };
+		return { ok: false, refusal: refusal("missing_index", `failed to read ralplan index at ${indexPath}`) };
+	}
+
+	const rows: RalplanIndexRow[] = [];
+	for (const line of indexText.split("\n")) {
+		if (!line.trim()) continue;
+		const row = parseIndexRow(line);
+		if (!row) {
+			return { ok: false, refusal: refusal("malformed_index", `malformed ralplan index row in ${indexPath}`) };
+		}
+		rows.push(row);
+	}
+	if (rows.length === 0)
+		return { ok: false, refusal: refusal("missing_index", `ralplan index ${indexPath} is empty`) };
+
+	const finalRow = rows.reduce((latest, row) => (row.stageN > latest.stageN ? row : latest));
+	if (finalRow.stage !== "final") {
+		return {
+			ok: false,
+			refusal: refusal("final_not_last", `the newest ralplan stage is "${finalRow.stage}", not "final"`),
+		};
+	}
+
+	const earlierRows = rows.filter(row => row.stageN < finalRow.stageN);
+	const opener = earlierRows
+		.filter(row => ITERATION_OPENER_STAGES.has(row.stage))
+		.reduce<RalplanIndexRow | undefined>(
+			(latest, row) => (!latest || row.stageN > latest.stageN ? row : latest),
+			undefined,
+		);
+	if (!opener) {
+		return {
+			ok: false,
+			refusal: refusal("no_iteration_opener", "the final has no planner or revision stage before it"),
+		};
+	}
+
+	const reviewers: Record<string, string> = {};
+	for (const lane of REVIEW_LANE_STAGES) {
+		const laneRow = earlierRows
+			.filter(row => row.stage === lane && row.stageN > opener.stageN)
+			.reduce<RalplanIndexRow | undefined>(
+				(latest, row) => (!latest || row.stageN > latest.stageN ? row : latest),
+				undefined,
+			);
+		if (!laneRow) {
+			return {
+				ok: false,
+				refusal: refusal(
+					"missing_reviewers",
+					`no ${lane} verdict between the ${opener.stage} stage and the final; the final is not reviewed`,
+				),
+			};
+		}
+		reviewers[lane] = laneRow.sha256;
+	}
+
+	// Hash every referenced artifact and require it to live inside this run.
+	for (const row of rows) {
+		const resolved = path.resolve(row.path);
+		const relative = path.relative(runDir, resolved);
+		if (relative.startsWith("..") || path.isAbsolute(relative)) {
+			return {
+				ok: false,
+				refusal: refusal("artifact_outside_run", `ralplan stage artifact ${row.path} is outside ${runDir}`),
+			};
+		}
+		let bytes: Buffer;
+		try {
+			bytes = await Bun.file(resolved)
+				.arrayBuffer()
+				.then(buffer => Buffer.from(buffer));
+		} catch (error) {
+			if (isEnoent(error)) {
+				return { ok: false, refusal: refusal("artifact_missing", `ralplan stage artifact ${row.path} is missing`) };
+			}
+			return { ok: false, refusal: refusal("artifact_missing", `cannot read ralplan stage artifact ${row.path}`) };
+		}
+		const actual = new Bun.CryptoHasher("sha256").update(bytes).digest("hex");
+		if (actual !== row.sha256) {
+			return {
+				ok: false,
+				refusal: refusal(
+					"hash_mismatch",
+					`ralplan stage artifact ${path.basename(row.path)} does not match its recorded hash`,
+				),
+			};
+		}
+	}
+
+	return {
+		ok: true,
+		descriptor: {
+			runId: state.runId,
+			finalPath: path.resolve(finalRow.path),
+			finalSha256: finalRow.sha256,
+			plannerSha256: opener.sha256,
+			reviewerSha256: reviewers,
+			sessionId,
+		},
+	};
+}

package/src/gjc-runtime/ralplan-runtime.ts

@@ -4,6 +4,7 @@ import * as fssync from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { isSettingsInitialized, Settings } from "../config/settings";
+import { sanitizeImportedString } from "../session-import/redact";
 import { syncSkillActiveState } from "../skill-state/active-state";
 import { buildRalplanHudSummary } from "../skill-state/workflow-hud";
 import { WORKFLOW_STATE_VERSION } from "../skill-state/workflow-state-contract";
@@ -2319,6 +2320,97 @@ function buildIndexedReviewArtifacts(indexText: string | undefined): Map<string,
 	return map;
 }
 
+function scrubImported(value: string): string {
+	return sanitizeImportedString(value);
+}
+
+/** Scrub, then trim the same way the disposition parser does. An empty result is not an id. */
+function canonicalDispositionId(value: string): string {
+	const canonical = scrubImported(value).trim();
+	if (canonical === "") {
+		throw new RalplanCommandError(
+			2,
+			"refusing to persist ralplan disposition: credential scrub removed an identifier",
+		);
+	}
+	return canonical;
+}
+
+/**
+ * Scrub a validated disposition, then rebuild conflict ids from the scrubbed
+ * finding and target ids. Only `sourceReceipt.path` and `sourceReceipt.sha256`
+ * stay literal. A result that no longer parses is refused instead of stored.
+ */
+function scrubDispositionDocument(normalized: string): string {
+	const doc = parseReviewConflictDocument(normalized);
+	const findingIds = new Map(
+		doc.findings.map(finding => [finding.findingId, canonicalDispositionId(finding.findingId)]),
+	);
+	const targetIds = new Map<string, string>();
+	const originalsByScrubbedTarget = new Map<string, string>();
+	for (const finding of doc.findings) {
+		const canonical = canonicalDispositionId(finding.targetId);
+		const prior = originalsByScrubbedTarget.get(canonical);
+		if (prior !== undefined && prior !== finding.targetId) {
+			throw new RalplanCommandError(
+				2,
+				"refusing to persist ralplan disposition: distinct target ids collapse after credential scrub",
+			);
+		}
+		originalsByScrubbedTarget.set(canonical, finding.targetId);
+		targetIds.set(finding.targetId, canonical);
+	}
+	const priorConflicts = doc.conflicts.map(conflict => ({
+		conflictId: conflict.conflictId,
+		targetId: conflict.targetId,
+		findingIds: [...conflict.findingIds] as [string, string],
+	}));
+	for (const finding of doc.findings) {
+		finding.findingId = findingIds.get(finding.findingId) ?? finding.findingId;
+		finding.targetId = targetIds.get(finding.targetId) ?? finding.targetId;
+		finding.evidence = scrubImported(finding.evidence);
+		if (finding.proposedOwner !== undefined) finding.proposedOwner = scrubImported(finding.proposedOwner);
+	}
+	for (const disposition of doc.dispositions) {
+		const prior = priorConflicts.find(conflict => conflict.conflictId === disposition.conflictId);
+		if (!prior) {
+			throw new RalplanCommandError(2, "refusing to persist ralplan disposition: conflict id did not survive scrub");
+		}
+		const targetId = targetIds.get(prior.targetId) ?? canonicalDispositionId(prior.targetId);
+		const mapped = prior.findingIds.map(id => findingIds.get(id) ?? canonicalDispositionId(id));
+		const [left, right] = mapped[0]! <= mapped[1]! ? [mapped[0]!, mapped[1]!] : [mapped[1]!, mapped[0]!];
+		disposition.conflictId = `conflict:${targetId}:${left}:${right}`;
+		disposition.rationale = scrubImported(disposition.rationale);
+		disposition.decisionOwner = scrubImported(disposition.decisionOwner);
+		disposition.affectedSections = disposition.affectedSections.map(section => scrubImported(section));
+		if (disposition.dispositionedAt !== undefined)
+			disposition.dispositionedAt = scrubImported(disposition.dispositionedAt);
+	}
+	const raw = JSON.parse(serializeReviewConflictDocument(doc)) as Record<string, unknown>;
+	delete raw.conflicts;
+	let rewritten: ReturnType<typeof parseReviewConflictDocument>;
+	try {
+		rewritten = parseReviewConflictDocument(`${JSON.stringify(raw, null, 2)}\n`);
+	} catch (error) {
+		throw new RalplanCommandError(
+			2,
+			`refusing to persist ralplan disposition: credential scrub broke the document (${error instanceof Error ? error.message : String(error)})`,
+		);
+	}
+	return serializeReviewConflictDocument(rewritten);
+}
+
+/**
+ * Credential scrub for a ralplan stage body. The result is what
+ * `gjc ralplan --write` hashes and stores.
+ */
+export function scrubRalplanPersistedBody(stage: string, content: string): string {
+	const normalized = content.endsWith("\n") ? content : `${content}\n`;
+	if (stage === "disposition") return scrubDispositionDocument(normalized);
+	const scrubbed = sanitizeImportedString(normalized);
+	return scrubbed.endsWith("\n") ? scrubbed : `${scrubbed}\n`;
+}
+
 async function handleArtifactWrite(
 	args: readonly string[],
 	cwd: string,
@@ -2380,7 +2472,9 @@ async function handleArtifactWrite(
 		resolved.stage === "disposition"
 			? normalizeDispositionArtifact(resolved.artifact, resolved.stageN, indexLoad.rawText)
 			: resolved.artifact;
-	const content = normalizedArtifact.endsWith("\n") ? normalizedArtifact : `${normalizedArtifact}\n`;
+	// Scrub before the content hash. The ledger, dedupe, and pending-approval copy
+	// all trust this digest, so it has to name the bytes that actually land on disk.
+	const content = scrubRalplanPersistedBody(resolved.stage, normalizedArtifact);
 	const sha256 = createHash("sha256").update(content).digest("hex");
 
 	// Duplicate-write guard: a second `--write` for the same (stage, stage_n) must not

package/src/gjc-runtime/state-writer.ts

@@ -1158,10 +1158,113 @@ export async function updateJsonAtomic<T = unknown>(
 	);
 }
 
+async function assertAppendRegularFile(filePath: string): Promise<void> {
+	try {
+		const stat = await fs.lstat(filePath);
+		if (stat.isSymbolicLink() || !stat.isFile()) throw new Error("state append path is not a regular file");
+	} catch (error) {
+		if (!isErrno(error, "ENOENT")) throw error;
+	}
+}
+
+/**
+ * Append bytes the same way `appendAuditEntry` opens its log: mode 0600, `O_NOFOLLOW`
+ * when the path already exists, and `O_EXCL` when it does not. An existing mode 0666
+ * file, and any other group or other permission bits, is tightened to 0600 before the write.
+ */
+async function tightenReadOnlyAppendMode(filePath: string): Promise<void> {
+	if (process.platform === "win32") return;
+	const noFollow = fsConstants.O_NOFOLLOW ?? 0;
+	const initialStat = await fs.lstat(filePath, { bigint: true });
+	if (initialStat.isSymbolicLink() || !initialStat.isFile())
+		throw new Error("state append path is not a regular file");
+	// A duplicate idempotent append must not require a writable file. Owner-only
+	// modes such as 0400 stay as they are; only group or other bits are tightened.
+	const handle = await fs.open(filePath, fsConstants.O_RDONLY | noFollow);
+	try {
+		const openedStat = await handle.stat({ bigint: true });
+		const pathStat = await fs.lstat(filePath, { bigint: true });
+		const sameObject = (left: nodeFs.BigIntStats, right: nodeFs.BigIntStats) =>
+			left.dev === right.dev && left.ino === right.ino && left.nlink === right.nlink;
+		if (
+			openedStat.isSymbolicLink() ||
+			!openedStat.isFile() ||
+			pathStat.isSymbolicLink() ||
+			!pathStat.isFile() ||
+			!sameObject(initialStat, openedStat) ||
+			!sameObject(openedStat, pathStat)
+		)
+			throw new Error("state append path identity changed before append");
+		if ((Number(openedStat.mode) & 0o077) === 0) return;
+		await handle.chmod(0o600);
+		const tightened = await handle.stat({ bigint: true });
+		if ((Number(tightened.mode) & 0o777) !== 0o600)
+			throw new Error("state append path could not be tightened to mode 0600");
+	} finally {
+		await handle.close();
+	}
+}
+
+async function appendOwnerOnlyText(filePath: string, text: string): Promise<void> {
+	await fs.mkdir(path.dirname(filePath), { recursive: true });
+	await assertAppendRegularFile(filePath);
+	const noFollow = process.platform === "win32" ? 0 : (fsConstants.O_NOFOLLOW ?? 0);
+	let handle: fs.FileHandle | undefined;
+	let initialStat: nodeFs.BigIntStats | undefined;
+	// O_EXCL matches appendAuditEntry for a missing path. Concurrent appends can
+	// create the same file together, so an EEXIST loser retries the existing-file
+	// open, which carries O_NOFOLLOW and will not follow a symlink.
+	for (let attempt = 0; attempt < 2; attempt++) {
+		initialStat = undefined;
+		try {
+			initialStat = await fs.lstat(filePath, { bigint: true });
+			if (initialStat.isSymbolicLink() || !initialStat.isFile())
+				throw new Error("state append path is not a regular file");
+		} catch (error) {
+			if (!isErrno(error, "ENOENT")) throw error;
+		}
+		const flags = initialStat
+			? fsConstants.O_WRONLY | fsConstants.O_APPEND | noFollow
+			: fsConstants.O_WRONLY | fsConstants.O_APPEND | fsConstants.O_CREAT | fsConstants.O_EXCL;
+		try {
+			handle = await fs.open(filePath, flags, 0o600);
+			break;
+		} catch (error) {
+			if (isErrno(error, "ELOOP")) throw new Error("state append path is not a regular file");
+			if (initialStat === undefined && isErrno(error, "EEXIST") && attempt === 0) continue;
+			throw error;
+		}
+	}
+	if (!handle) throw new Error("state append path identity changed before append");
+	try {
+		const openedStat = await handle.stat({ bigint: true });
+		const pathStat = await fs.lstat(filePath, { bigint: true });
+		const sameObject = (left: nodeFs.BigIntStats, right: nodeFs.BigIntStats) =>
+			left.dev === right.dev && left.ino === right.ino && left.nlink === right.nlink;
+		if (
+			openedStat.isSymbolicLink() ||
+			!openedStat.isFile() ||
+			pathStat.isSymbolicLink() ||
+			!pathStat.isFile() ||
+			(initialStat !== undefined && !sameObject(initialStat, openedStat)) ||
+			!sameObject(openedStat, pathStat)
+		)
+			throw new Error("state append path identity changed before append");
+		if (process.platform !== "win32" && (Number(openedStat.mode) & 0o077) !== 0) {
+			await handle.chmod(0o600);
+			const tightened = await handle.stat({ bigint: true });
+			if ((Number(tightened.mode) & 0o777) !== 0o600)
+				throw new Error("state append path could not be tightened to mode 0600");
+		}
+		await handle.writeFile(text, "utf-8");
+	} finally {
+		await handle?.close();
+	}
+}
+
 export async function appendJsonl(targetPath: string, entry: unknown, options?: StateWriterOptions): Promise<string> {
 	const filePath = resolveGjcTarget(targetPath, cwdForOptions(options));
-	await fs.mkdir(path.dirname(filePath), { recursive: true });
-	await fs.appendFile(filePath, `${JSON.stringify(entry)}\n`, "utf-8");
+	await appendOwnerOnlyText(filePath, `${JSON.stringify(entry)}\n`);
 	await maybeAudit(filePath, options);
 	return filePath;
 }
@@ -1259,12 +1362,14 @@ export async function appendJsonlIdempotent(
 	return lockResolvedWorkflowTarget(
 		filePath,
 		async () => {
+			await assertAppendRegularFile(filePath);
 			const existing = await readJsonlEntries(filePath);
 			const duplicate = findJsonlDuplicate(existing, entry, options);
 			if (duplicate !== undefined) {
+				await tightenReadOnlyAppendMode(filePath);
 				return { path: filePath, appended: false, duplicate };
 			}
-			await fs.appendFile(filePath, `${JSON.stringify(entry)}\n`, "utf-8");
+			await appendOwnerOnlyText(filePath, `${JSON.stringify(entry)}\n`);
 			await maybeAudit(filePath, options);
 			return { path: filePath, appended: true };
 		},
@@ -1274,8 +1379,7 @@ export async function appendJsonlIdempotent(
 
 export async function appendText(targetPath: string, text: string, options?: StateWriterOptions): Promise<string> {
 	const filePath = resolveGjcTarget(targetPath, cwdForOptions(options));
-	await fs.mkdir(path.dirname(filePath), { recursive: true });
-	await fs.appendFile(filePath, text, "utf-8");
+	await appendOwnerOnlyText(filePath, text);
 	await maybeAudit(filePath, options);
 	return filePath;
 }