@gajae-code/coding-agent 0.18.12 → 0.19.0

package/src/slash-commands/builtin-registry.ts

@@ -57,7 +57,7 @@ import {
 	invalidateSessionTitleGeneration,
 	isSessionTitleGenerationCurrent,
 } from "../utils/session-title-generation";
-import { buildConversationTitleInput, generateSessionTitle } from "../utils/title-generator";
+import { buildConversationTitleInput, generateSessionTitle, titleInputObfuscator } from "../utils/title-generator";
 import { handleAsideAcp } from "./helpers/aside";
 import { buildAutoroutingStatusReport } from "./helpers/autorouting-status";
 import { buildContextReportText } from "./helpers/context-report";
@@ -158,7 +158,9 @@ function toSlashCommandRuntime(runtime: TuiSlashCommandRuntime): SlashCommandRun
 async function regenerateSessionTitle(runtime: SlashCommandRuntime): Promise<SlashCommandResult> {
 	try {
 		const generation = beginSessionTitleGeneration(runtime.sessionManager);
-		const input = buildConversationTitleInput(runtime.session.messages);
+		const activeCwd = runtime.sessionManager.getCwd();
+		const obfuscateText = await titleInputObfuscator(runtime.settings, activeCwd);
+		const input = buildConversationTitleInput(runtime.session.messages, obfuscateText);
 		if (!input) {
 			return usage("Nothing to summarize yet — pass a title: /rename <title>", runtime);
 		}
@@ -170,10 +172,11 @@ async function regenerateSessionTitle(runtime: SlashCommandRuntime): Promise<Sla
 			runtime.session.credentialSessionId,
 			runtime.session.model,
 			provider => runtime.session.agent.metadataForProvider(provider),
+			activeCwd,
 		);
 		if (
 			!isSessionTitleGenerationCurrent(runtime.sessionManager, generation) ||
-			buildConversationTitleInput(runtime.session.messages) !== input
+			buildConversationTitleInput(runtime.session.messages, obfuscateText) !== input
 		)
 			return commandConsumed();
 		if (!generated) {

package/src/slash-commands/helpers/mcp.ts

@@ -1,4 +1,4 @@
-import { getMCPConfigPath } from "@gajae-code/utils";
+import { getMCPConfigPath, sanitizeDisplayLine } from "@gajae-code/utils";
 import { listPrompts, listResources, listTools } from "../../runtime-mcp/client";
 import {
 	addMCPServer,
@@ -19,6 +19,14 @@ import { commandConsumed, errorMessage, parseNamedScopeArgs, parseSubcommand, us
 
 type AcpMcpScope = "user" | "project";
 
+/**
+ * One terminal row for an untrusted MCP server or tool name.
+ * Ordinary names are unchanged. Controls, OSC, and line breaks are not.
+ */
+export function mcpTerminalLabel(value: string): string {
+	return sanitizeDisplayLine(value);
+}
+
 interface ParsedMcpAddArgs {
 	name?: string;
 	scope: AcpMcpScope;
@@ -272,7 +280,7 @@ async function handleTestCommand(rest: string, runtime: SlashCommandRuntime): Pr
 		return await withPreparedMcpConnection(runtime, name, server.config, server.scope, async connection => {
 			const tools = await listTools(connection);
 			const lines = [`Server "${name}" connected (${tools.length} tools).`];
-			for (const tool of tools) lines.push(`  - ${tool.name}`);
+			for (const tool of tools) lines.push(`  - ${mcpTerminalLabel(tool.name)}`);
 			await runtime.output(lines.join("\n"));
 			return commandConsumed();
 		});
@@ -398,7 +406,7 @@ async function handleListCommand(runtime: SlashCommandRuntime): Promise<SlashCom
 					} else {
 						location = (config as { command: string }).command;
 					}
-					return `${name} | ${type} | ${status} | ${location ?? "(unknown)"} [${scope}]`;
+					return `${mcpTerminalLabel(name)} | ${type} | ${status} | ${location ?? "(unknown)"} [${scope}]`;
 				})
 				.join("\n"),
 		);

package/src/ssh/ssh-executor.ts

@@ -1,6 +1,6 @@
 import { logger, ptree } from "@gajae-code/utils";
 import { Settings } from "../config/settings";
-import { OutputSink } from "../session/streaming-output";
+import { OutputSink, type TerminalArtifactPublisher } from "../session/streaming-output";
 import { resolveOutputMaxColumns, resolveOutputSinkHeadBytes } from "../tools/output-meta";
 import { buildRemoteCommand, ensureConnection, ensureHostInfo, type SSHConnectionTarget } from "./connection-manager";
 import { hasSshfs, mountRemote } from "./sshfs-mount";
@@ -21,6 +21,8 @@ export interface SSHExecutorOptions {
 	/** Artifact path/id for full output storage */
 	artifactPath?: string;
 	artifactId?: string;
+	/** Session-owned publisher for managed sessions without a writable artifact path. */
+	artifactPublisher?: TerminalArtifactPublisher;
 }
 
 export interface SSHResult {
@@ -40,8 +42,12 @@ export interface SSHResult {
 	outputLines: number;
 	/** Number of bytes included in the output text */
 	outputBytes: number;
-	/** Artifact ID if full output was saved to artifact storage */
+	/** Artifact ID if output was saved to artifact storage. */
 	artifactId?: string;
+	/** Bytes omitted from artifact storage after its hard cap was reached. */
+	artifactTruncatedBytes?: number;
+	/** Bounded diagnostic when artifact storage failed. */
+	artifactFailureDiagnostic?: string;
 }
 
 function quoteForCompatShell(command: string): string {
@@ -92,6 +98,7 @@ export async function executeSSH(
 		onChunk: options?.onChunk,
 		artifactPath: options?.artifactPath,
 		artifactId: options?.artifactId,
+		artifactPublisher: options?.artifactPublisher,
 		headBytes: resolveOutputSinkHeadBytes(settings),
 		maxColumns: resolveOutputMaxColumns(settings),
 	});

package/src/stt/recorder.ts

@@ -1,7 +1,7 @@
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
-import { $which, logger, Snowflake } from "@gajae-code/utils";
+import { $which, logger } from "@gajae-code/utils";
 import { $ } from "bun";
 
 export interface RecordingHandle {
@@ -212,10 +212,29 @@ if (Test-Path $outPath) {
 }
 `;
 
+async function writePowerShellRecordingScript(): Promise<{ tempDir: string; scriptPath: string }> {
+	// Random directory plus an exclusive create: a preexisting symlink under the
+	// shared temp directory is not opened, and the script is not left world-readable.
+	const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "gjc-stt-record-"));
+	try {
+		if (process.platform !== "win32") await fs.chmod(tempDir, 0o700);
+		const scriptPath = path.join(tempDir, "record.ps1");
+		const handle = await fs.open(scriptPath, "wx", 0o600);
+		try {
+			await handle.writeFile(PS_RECORD_SCRIPT);
+		} finally {
+			await handle.close();
+		}
+		if (process.platform !== "win32") await fs.chmod(scriptPath, 0o600);
+		return { tempDir, scriptPath };
+	} catch (error) {
+		await fs.rm(tempDir, { recursive: true, force: true });
+		throw error;
+	}
+}
+
 async function startPowerShellRecording(outputPath: string): Promise<RecordingHandle> {
-	// Write script to temp file — avoids quoting/escaping issues with -Command
-	const scriptPath = path.join(os.tmpdir(), `gjc-stt-record-${Snowflake.next()}.ps1`);
-	await Bun.write(scriptPath, PS_RECORD_SCRIPT);
+	const { tempDir, scriptPath } = await writePowerShellRecordingScript();
 
 	const proc = Bun.spawn(["powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-File", scriptPath, outputPath], {
 		stdin: "pipe",
@@ -224,7 +243,7 @@ async function startPowerShellRecording(outputPath: string): Promise<RecordingHa
 	});
 
 	proc.exited.then(() => {
-		fs.unlink(scriptPath).catch(() => {});
+		fs.rm(tempDir, { recursive: true, force: true }).catch(() => {});
 	});
 
 	// Wait for "RECORDING" on stdout to confirm it started
@@ -250,8 +269,7 @@ async function startPowerShellRecording(outputPath: string): Promise<RecordingHa
 		if (proc.stderr && typeof proc.stderr !== "number") {
 			stderrText = await new Response(proc.stderr as ReadableStream).text();
 		}
-		// Clean up temp script
-		fs.unlink(scriptPath).catch(() => {});
+		fs.rm(tempDir, { recursive: true, force: true }).catch(() => {});
 		throw new Error(
 			`PowerShell audio recording failed to start: ${stderrText.trim() || output.trim() || "(no output)"}`,
 		);
@@ -269,8 +287,7 @@ async function startPowerShellRecording(outputPath: string): Promise<RecordingHa
 			const killTimer = setTimeout(() => proc.kill(), 8000);
 			await proc.exited;
 			clearTimeout(killTimer);
-			// Clean up temp script
-			fs.unlink(scriptPath).catch(() => {});
+			fs.rm(tempDir, { recursive: true, force: true }).catch(() => {});
 		},
 	};
 }

package/src/system-prompt.ts

@@ -75,6 +75,31 @@ function sanitizeEmbeddedPromptContent(content: string): string {
 	return escapePromptMetadata(content, { preserveNewlines: true });
 }
 
+const UNTRUSTED_CONTENT_OPEN_LINE = "<untrusted-content>\n";
+const UNTRUSTED_CONTENT_CLOSE_LINE = "\n</untrusted-content>";
+
+/**
+ * Encode an inventory description. MCP descriptions already include a host-owned
+ * untrusted-content fence; keep those delimiters and encode only the body.
+ * A body that still contains a closing fence is not that wrapper, so encode the whole value.
+ */
+function escapeInventoryDescription(description: string): string {
+	const openLength = UNTRUSTED_CONTENT_OPEN_LINE.length;
+	const closeLength = UNTRUSTED_CONTENT_CLOSE_LINE.length;
+	if (
+		description.startsWith(UNTRUSTED_CONTENT_OPEN_LINE) &&
+		description.endsWith(UNTRUSTED_CONTENT_CLOSE_LINE) &&
+		description.length >= openLength + closeLength
+	) {
+		const body = description.slice(openLength, -closeLength);
+		if (!/<\/untrusted-content>/i.test(body)) {
+			const encodedBody = escapePromptMetadata(body, { preserveNewlines: true });
+			return `${UNTRUSTED_CONTENT_OPEN_LINE}${encodedBody}${UNTRUSTED_CONTENT_CLOSE_LINE}`;
+		}
+	}
+	return escapePromptMetadata(description, { preserveNewlines: true });
+}
+
 function firstNonEmpty(...values: (string | undefined | null)[]): string | null {
 	for (const value of values) {
 		const trimmed = value?.trim();
@@ -345,8 +370,9 @@ export async function loadProjectContextFiles(
 }
 
 /**
- * Load the effective system prompt customization from SYSTEM.md.
- * Project-level SYSTEM.md overrides user-level SYSTEM.md.
+ * Load the user system prompt customization from SYSTEM.md.
+ * A repository SYSTEM.md is untrusted project text. It must not replace the
+ * user file or become the customization block.
  */
 export async function loadSystemPromptFiles(options: LoadContextFilesOptions = {}): Promise<string | null> {
 	const resolvedCwd = options.cwd ?? getProjectDir();
@@ -359,11 +385,6 @@ export async function loadSystemPromptFiles(options: LoadContextFilesOptions = {
 
 	if (result.items.length === 0) return null;
 
-	const projectLevel = result.items.find(item => item.level === "project");
-	if (projectLevel) {
-		return projectLevel.content;
-	}
-
 	const userLevel = result.items.find(item => item.level === "user");
 	return userLevel?.content ?? null;
 }
@@ -745,18 +766,31 @@ export async function buildSystemPrompt(options: BuildSystemPromptOptions = {}):
 	const toolPromptNames = new Map<string, string>(toolNames.map(name => [name, tools?.get(name)?.wireName ?? name]));
 	const toolRefs = Object.fromEntries(toolPromptNames.entries());
 	const hasHiddenToolDiscoveryTool = Object.hasOwn(toolRefs, "search_tool_bm25");
-	const toolInfo = toolNames.map(name => ({
-		name: toolPromptNames.get(name) ?? name,
-		internalName: name,
-		label: tools?.get(name)?.label ?? "",
-		description: tools?.get(name)?.description ?? "",
-	}));
+	// The inventory template is compiled with noEscape. Encode tool metadata here so a
+	// tools/list label or description cannot close <inventory> or insert a system block.
+	// Repeated MCP descriptions keep the host <untrusted-content> fence; only the body is encoded.
+	// The `tools` list stays raw so {{#has}} still matches the call name.
+	const toolInfo = toolNames.map(name => {
+		const meta = tools?.get(name);
+		return {
+			name: escapePromptMetadata(toolPromptNames.get(name) ?? name),
+			internalName: escapePromptMetadata(name),
+			label: escapePromptMetadata(meta?.label ?? ""),
+			description: escapeInventoryDescription(meta?.description ?? ""),
+		};
+	});
 
-	const effectiveSystemPromptCustomization = dedupePromptSource(systemPromptCustomization, [
+	const rawSystemPromptCustomization = dedupePromptSource(systemPromptCustomization, [
 		resolvedCustomPrompt,
 		resolvedAppendPrompt,
 	]);
-	const promptSources = [effectiveSystemPromptCustomization, resolvedCustomPrompt, resolvedAppendPrompt];
+	// Encode after dedupe so rule matching still sees the file text. The customization
+	// template is noEscape; the same encoder used for context files keeps a file from
+	// closing <system-prompt-customization> or forging a sibling marker.
+	const effectiveSystemPromptCustomization = rawSystemPromptCustomization
+		? sanitizeEmbeddedPromptContent(rawSystemPromptCustomization)
+		: "";
+	const promptSources = [rawSystemPromptCustomization, resolvedCustomPrompt, resolvedAppendPrompt];
 	const injectedAlwaysApplyRules = dedupeAlwaysApplyRules(alwaysApplyRules, promptSources);
 
 	const environment = await logger.time("getEnvironmentInfo", getEnvironmentInfo);
@@ -771,6 +805,17 @@ export async function buildSystemPrompt(options: BuildSystemPromptOptions = {}):
 		path: escapePromptMetadata(rule.path),
 		content: sanitizeEmbeddedPromptContent(rule.content),
 	}));
+	// Both rulebook templates compile with noEscape. Encode the fields they interpolate
+	// so repository frontmatter cannot close <rules> or the name attribute.
+	const sanitizedRulebookRules = (rules ?? []).map(rule => ({
+		...rule,
+		name: escapePromptMetadata(rule.name),
+		description:
+			rule.description === undefined
+				? undefined
+				: escapePromptMetadata(rule.description, { preserveNewlines: true }),
+		globs: rule.globs?.map(glob => escapePromptMetadata(glob)),
+	}));
 	const data = {
 		systemPromptCustomization: effectiveSystemPromptCustomization,
 		customPrompt: resolvedCustomPrompt,
@@ -784,7 +829,7 @@ export async function buildSystemPrompt(options: BuildSystemPromptOptions = {}):
 		contextFiles: sanitizedContextFiles,
 		agentsMdSearch: { files: agentsMdFiles.map(file => escapePromptMetadata(file)) },
 		workspaceTree,
-		rules: rules ?? [],
+		rules: sanitizedRulebookRules,
 		alwaysApplyRules: sanitizedAlwaysApplyRules,
 		cwd: promptCwd,
 		intentTracing: !!intentField,

package/src/task/executor.ts

@@ -76,6 +76,7 @@ import { buildNamedToolChoiceResult } from "../utils/tool-choice";
 import type { WorkspaceTree } from "../workspace-tree";
 import { validateAllocatedTaskId } from "./id";
 import { classifyProviderRetryFromTransport, providerNameFromModel } from "./provider-retry-status";
+import { containSubagentRoleBody } from "./role-body";
 import { subprocessToolRegistry } from "./subprocess-tool-registry";
 import { persistTaskTokenLog, taskTokenLogFromUsage } from "./token-log";
 import {
@@ -2086,14 +2087,15 @@ export async function runSubprocessOnce(options: ExecutorOptions): Promise<Singl
 					promptTemplates: options.promptTemplates,
 					workspaceTree: options.workspaceTree,
 					systemPrompt: defaultPrompt => {
-						const subagentPrompt = prompt.render(subagentSystemPromptTemplate, {
-							agent: prompt.render(agent.systemPrompt, {
-								// Typed executionMode wins; assignment text is compatibility-only (#2698 / #2456).
-								ultragoalRedTeam: resolveUltragoalRedTeamActivation({
-									executionMode: options.executionMode,
-									assignment: options.assignment ?? task,
-								}),
+						const renderedRole = prompt.render(agent.systemPrompt, {
+							// Typed executionMode wins; assignment text is compatibility-only (#2698 / #2456).
+							ultragoalRedTeam: resolveUltragoalRedTeamActivation({
+								executionMode: options.executionMode,
+								assignment: options.assignment ?? task,
 							}),
+						});
+						const subagentPrompt = prompt.render(subagentSystemPromptTemplate, {
+							agent: containSubagentRoleBody(renderedRole),
 							context: options.context?.trim() ?? "",
 							worktree: worktree ?? "",
 							outputSchema: normalizedOutputSchema,
@@ -2209,7 +2211,9 @@ export async function runSubprocessOnce(options: ExecutorOptions): Promise<Singl
 			const parentOwnedToolNames = new Set(["todo_write"]);
 			const filteredSubagentTools = subagentToolNames.filter(name => !parentOwnedToolNames.has(name));
 			if (filteredSubagentTools.length !== subagentToolNames.length) {
-				await awaitAbortable(session.setActiveToolsByName(filteredSubagentTools));
+				await awaitAbortable(
+					session.setActiveToolsByName(filteredSubagentTools, { explicit: false, persistMCPSelection: false }),
+				);
 			}
 
 			if (!options.preflightProbe && !options.preflightDurable) {

package/src/task/role-body.ts

@@ -0,0 +1,84 @@
+/**
+ * Keep a subagent role body inside the host [ROLE] block.
+ *
+ * The body is the agent instruction. It is inserted between host [ROLE] and
+ * [/ROLE]. A literal framing tag would end that block early. Only the four
+ * host framing names are rewritten; other brackets stay literal.
+ *
+ * One left-to-right scan: a gap run, a slash only when it is present, then
+ * one more gap run, then the word. A non-matching "[" does not hide a later tag.
+ */
+
+const WORDS = ["completion", "context", "role", "coop"] as const;
+
+function isGap(code: number): boolean {
+	return (
+		code === 0x09 ||
+		code === 0x0a ||
+		code === 0x0b ||
+		code === 0x0c ||
+		code === 0x0d ||
+		code === 0x20 ||
+		code === 0xa0 ||
+		code === 0x200b ||
+		code === 0x200c ||
+		code === 0x200d ||
+		code === 0x1680 ||
+		(code >= 0x2000 && code <= 0x200a) ||
+		code === 0x2028 ||
+		code === 0x2029 ||
+		code === 0x202f ||
+		code === 0x205f ||
+		code === 0x3000 ||
+		code === 0xfeff
+	);
+}
+
+function wordLengthAt(body: string, index: number): number {
+	const slice = body.slice(index, index + 10).toLowerCase();
+	for (const word of WORDS) {
+		if (!slice.startsWith(word)) continue;
+		const after = body.charCodeAt(index + word.length);
+		if (Number.isNaN(after) || isGap(after) || after === 0x5d) return word.length;
+	}
+	return 0;
+}
+
+/** End index of a framing tag starting at "[", or -1. */
+function framingTagEnd(body: string, start: number): number {
+	let index = start + 1;
+	while (index < body.length && isGap(body.charCodeAt(index))) index++;
+	if (body.charCodeAt(index) === 0x2f) {
+		index++;
+		while (index < body.length && isGap(body.charCodeAt(index))) index++;
+	}
+	const wordLength = wordLengthAt(body, index);
+	if (wordLength === 0) return -1;
+	index += wordLength;
+	while (index < body.length && isGap(body.charCodeAt(index))) index++;
+	return body.charCodeAt(index) === 0x5d ? index + 1 : -1;
+}
+
+export function containSubagentRoleBody(body: string): string {
+	const parts: string[] = [];
+	let plainStart = 0;
+	let index = 0;
+	while (index < body.length) {
+		if (body.charCodeAt(index) !== 0x5b) {
+			index++;
+			continue;
+		}
+		const end = framingTagEnd(body, index);
+		if (end < 0) {
+			index++;
+			continue;
+		}
+		if (plainStart < index) parts.push(body.slice(plainStart, index));
+		parts.push(body.slice(index, end).replaceAll("[", "［").replaceAll("]", "］"));
+		index = end;
+		plainStart = index;
+	}
+	if (plainStart === 0) return body;
+	if (plainStart < body.length) parts.push(body.slice(plainStart));
+	return parts.join("");
+}

package/src/task/token-log-mode.test.ts

@@ -0,0 +1,162 @@
+import { afterAll, describe, expect, it } from "bun:test";
+import * as fs from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import { persistTaskTokenLog, taskTokenLogFromChat } from "./token-log";
+
+// Mode bits and final-component symlinks are POSIX. Windows ACLs are out of scope.
+const skipPosix = process.platform === "win32";
+const skipOwnerReadOnly = skipPosix || process.getuid?.() === 0;
+const tempRoots: string[] = [];
+
+async function tempDir(): Promise<string> {
+	const dir = await fs.mkdtemp(path.join(os.tmpdir(), "gjc-token-log-mode-"));
+	tempRoots.push(dir);
+	return dir;
+}
+
+afterAll(async () => {
+	await Promise.all(tempRoots.splice(0).map(dir => fs.rm(dir, { recursive: true, force: true })));
+});
+
+function entry(id: string) {
+	return taskTokenLogFromChat(
+		{ inputTokens: 1, outputTokens: 2, cachedInputTokens: 0, cacheWriteTokens: 0 },
+		{ subagentId: id, turn: 1, at: "2026-01-01T00:00:00.000Z" },
+	);
+}
+
+async function modeOf(filePath: string): Promise<number> {
+	return (await fs.lstat(filePath)).mode & 0o777;
+}
+
+describe("task token log mode", () => {
+	it.skipIf(skipPosix)("refuses a symlink token-log.jsonl", async () => {
+		const root = await tempDir();
+		const outside = path.join(root, "outside.jsonl");
+		await fs.writeFile(outside, "kept");
+		const dir = path.join(root, "logs");
+		await fs.mkdir(dir);
+		const link = path.join(dir, "token-log.jsonl");
+		await fs.symlink(outside, link);
+
+		await expect(persistTaskTokenLog(entry("root"), { dir })).rejects.toThrow(/not a regular file/);
+		expect(await fs.readFile(outside, "utf8")).toBe("kept");
+		expect((await fs.lstat(link)).isSymbolicLink()).toBe(true);
+	});
+
+	it.skipIf(skipPosix)("refuses a symlink token-log directory", async () => {
+		const root = await tempDir();
+		const outside = path.join(root, "outside");
+		await fs.mkdir(outside);
+		const dir = path.join(root, "token-logs");
+		await fs.symlink(outside, dir);
+
+		await expect(persistTaskTokenLog(entry("root"), { dir })).rejects.toThrow(/not a directory/);
+		expect(await fs.readdir(outside)).toEqual([]);
+		expect((await fs.lstat(dir)).isSymbolicLink()).toBe(true);
+	});
+
+	it.skipIf(skipPosix)("creates a token log as mode 0600 under a permissive umask", async () => {
+		const previous = process.umask(0);
+		try {
+			const root = await tempDir();
+			const dir = path.join(root, "logs");
+			await persistTaskTokenLog(entry("root"), { dir });
+			expect(await modeOf(dir)).toBe(0o700);
+			expect(await modeOf(path.join(dir, "token-log.jsonl"))).toBe(0o600);
+		} finally {
+			process.umask(previous);
+		}
+	});
+
+	it.skipIf(skipPosix)("tightens an existing mode 0666 token log to 0600", async () => {
+		const root = await tempDir();
+		const dir = path.join(root, "logs");
+		await fs.mkdir(dir, { mode: 0o700 });
+		const file = path.join(dir, "token-log.jsonl");
+		await fs.writeFile(file, "", { mode: 0o666 });
+		await fs.chmod(file, 0o666);
+
+		await persistTaskTokenLog(entry("root"), { dir });
+
+		expect(await modeOf(file)).toBe(0o600);
+		expect(await fs.readFile(file, "utf8")).toContain('"subagentId":"root"');
+	});
+
+	it.skipIf(skipPosix)("tightens an existing mode 0777 token-log directory to 0700", async () => {
+		const root = await tempDir();
+		const dir = path.join(root, "logs");
+		await fs.mkdir(dir, { mode: 0o777 });
+		await fs.chmod(dir, 0o777);
+
+		await persistTaskTokenLog(entry("root"), { dir });
+
+		expect(await modeOf(dir)).toBe(0o700);
+		expect(await modeOf(path.join(dir, "token-log.jsonl"))).toBe(0o600);
+	});
+
+	it("still allows a second append to a regular token log", async () => {
+		const root = await tempDir();
+		const dir = path.join(root, "logs");
+		await persistTaskTokenLog(entry("one"), { dir });
+		await persistTaskTokenLog(entry("two"), { dir });
+		const text = await fs.readFile(path.join(dir, "token-log.jsonl"), "utf8");
+		expect(text).toContain('"subagentId":"one"');
+		expect(text).toContain('"subagentId":"two"');
+	});
+
+	it.skipIf(skipPosix)("still allows a token log through a symlinked parent", async () => {
+		const root = await tempDir();
+		const realParent = path.join(root, "real");
+		await fs.mkdir(realParent);
+		const via = path.join(root, "via");
+		await fs.symlink(realParent, via);
+		const dir = path.join(via, "token-logs");
+
+		await persistTaskTokenLog(entry("via"), { dir });
+
+		expect(await fs.readFile(path.join(realParent, "token-logs", "token-log.jsonl"), "utf8")).toContain(
+			'"subagentId":"via"',
+		);
+	});
+
+	it.skipIf(skipPosix)("keeps owner mode 0600 when appending a token log", async () => {
+		const root = await tempDir();
+		const dir = path.join(root, "logs");
+		await fs.mkdir(dir, { mode: 0o700 });
+		const file = path.join(dir, "token-log.jsonl");
+		await fs.writeFile(file, "", { mode: 0o600 });
+
+		await persistTaskTokenLog(entry("root"), { dir });
+
+		expect(await modeOf(file)).toBe(0o600);
+		expect(await fs.readFile(file, "utf8")).toContain('"subagentId":"root"');
+	});
+
+	it.skipIf(skipOwnerReadOnly)("still allows a token log in a mode 0300 directory", async () => {
+		const root = await tempDir();
+		const dir = path.join(root, "logs");
+		await fs.mkdir(dir, { mode: 0o700 });
+		await fs.chmod(dir, 0o300);
+		try {
+			await persistTaskTokenLog(entry("root"), { dir });
+			expect(await fs.readFile(path.join(dir, "token-log.jsonl"), "utf8")).toContain('"subagentId":"root"');
+		} finally {
+			await fs.chmod(dir, 0o700);
+		}
+	});
+
+	it.skipIf(skipOwnerReadOnly)("leaves a mode 0400 token log unchanged when the append cannot write", async () => {
+		const root = await tempDir();
+		const dir = path.join(root, "logs");
+		await fs.mkdir(dir, { mode: 0o700 });
+		const file = path.join(dir, "token-log.jsonl");
+		await fs.writeFile(file, "kept\n", { mode: 0o600 });
+		await fs.chmod(file, 0o400);
+
+		await expect(persistTaskTokenLog(entry("root"), { dir })).rejects.toThrow(/EACCES/);
+		expect(await fs.readFile(file, "utf8")).toBe("kept\n");
+		expect(await modeOf(file)).toBe(0o400);
+	});
+});