@hasna/recordings 0.3.13 → 0.5.0

package/scripts/install_macos_app.sh

@@ -126,18 +126,18 @@ require_absolute_canonical_owned_home() {
   local canonical
   case "$candidate" in
     /*) ;;
-    *) echo "HasnaRecordings.app installation requires HOME to be an absolute canonical path." >&2; exit 1 ;;
+    *) echo "Hasna Recordings.app installation requires HOME to be an absolute canonical path." >&2; exit 1 ;;
   esac
   [ -d "$candidate" ] && [ ! -L "$candidate" ] || {
-    echo "HasnaRecordings.app installation requires HOME to be an absolute canonical path to a non-symlink directory." >&2
+    echo "Hasna Recordings.app installation requires HOME to be an absolute canonical path to a non-symlink directory." >&2
     exit 1
   }
   canonical="$(cd "$candidate" 2>/dev/null && builtin pwd -P)" || {
-    echo "HasnaRecordings.app installation could not resolve HOME canonically." >&2
+    echo "Hasna Recordings.app installation could not resolve HOME canonically." >&2
     exit 1
   }
   [ "$candidate" = "$canonical" ] || {
-    echo "HasnaRecordings.app installation requires HOME to be an absolute canonical path." >&2
+    echo "Hasna Recordings.app installation requires HOME to be an absolute canonical path." >&2
     exit 1
   }
   [ "$("$STAT_EXECUTABLE" -f '%u' "$candidate")" = "$("$ID_EXECUTABLE" -u)" ] || {
@@ -352,7 +352,7 @@ require_absolute_executable "BUN_EXECUTABLE" "$BUN_EXECUTABLE"
 require_absolute_canonical_owned_home
 
 if [ "$("$UNAME_EXECUTABLE" -s)" != "Darwin" ]; then
-  echo "HasnaRecordings.app installation is only supported on macOS." >&2
+  echo "Hasna Recordings.app installation is only supported on macOS." >&2
   exit 1
 fi
 
@@ -546,7 +546,7 @@ fi
 "$BUN_EXECUTABLE" "$ARTIFACT_TOOL" native-fs-guard-check
 DATA_DIR="${HOME}/.hasna/recordings"
 DATA_PARENT="$("$DIRNAME_EXECUTABLE" "$DATA_DIR")"
-MANIFEST_BUNDLE_NAME="HasnaRecordings.app"
+MANIFEST_BUNDLE_NAME="Hasna Recordings.app"
 APP_DEST="${HOME}/Applications/${MANIFEST_BUNDLE_NAME}"
 APP_PARENT="$("$DIRNAME_EXECUTABLE" "$APP_DEST")"
 ROLLBACK_DIR="${DATA_DIR}/rollbacks"
@@ -794,7 +794,7 @@ acquire_install_lock() {
         if kill -0 "$owner_pid" 2>/dev/null; then
           actual_start="$("$PS_EXECUTABLE" -o lstart= -p "$owner_pid" 2>/dev/null | "$TR_EXECUTABLE" -s ' ' | "$SED_EXECUTABLE" 's/^ //;s/ $//' || true)"
           if [ -z "$owner_start" ] || [ -z "$actual_start" ] || [ "$owner_start" = "$actual_start" ]; then
-            echo "Another HasnaRecordings.app installer owns the active install lock." >&2
+            echo "Another Hasna Recordings.app installer owns the active install lock." >&2
             exit 1
           fi
         fi
@@ -807,17 +807,17 @@ acquire_install_lock() {
       now="$("$DATE_EXECUTABLE" +%s)"
       lock_age=$((now - $("$STAT_EXECUTABLE" -f '%m' "$LOCK_DIR")))
       if [ "$lock_age" -lt "$stale_seconds" ]; then
-        echo "HasnaRecordings.app install lock is incomplete and too recent to reclaim safely." >&2
+        echo "Hasna Recordings.app install lock is incomplete and too recent to reclaim safely." >&2
         exit 1
       fi
     fi
     stale_claim="${LOCK_DIR}.stale.$$"
     if ! "$MV_EXECUTABLE" "$LOCK_DIR" "$stale_claim" 2>/dev/null; then
-      echo "HasnaRecordings.app install lock changed during stale-owner recovery." >&2
+      echo "Hasna Recordings.app install lock changed during stale-owner recovery." >&2
       exit 1
     fi
     "$RM_EXECUTABLE" -rf "$stale_claim"
-    "$MKDIR_EXECUTABLE" -m 700 "$LOCK_DIR" || { echo "Could not acquire HasnaRecordings.app install lock." >&2; exit 1; }
+    "$MKDIR_EXECUTABLE" -m 700 "$LOCK_DIR" || { echo "Could not acquire Hasna Recordings.app install lock." >&2; exit 1; }
   fi
   LOCK_OWNED=1
   local start
@@ -1263,13 +1263,13 @@ stop_uncommitted_candidate() {
   done <<< "$remaining"
   "$SLEEP_EXECUTABLE" 0.1
   [ -z "$(pids_for_exact_executable "$expected")" ] || {
-    echo "Uncommitted HasnaRecordings.app process could not be stopped before recovery." >&2
+    echo "Uncommitted Hasna Recordings.app process could not be stopped before recovery." >&2
     return 1
   }
 }
 
 if [ -f "$JOURNAL_PATH" ]; then
-  echo "Recovering incomplete HasnaRecordings.app installation transaction." >&2
+  echo "Recovering incomplete Hasna Recordings.app installation transaction." >&2
   if ! RECOVER_WAS_RUNNING="$("$BUN_EXECUTABLE" "$ARTIFACT_TOOL" journal-get --journal "$JOURNAL_PATH" --field was_running)" || \
      ! RECOVER_PHASE="$("$BUN_EXECUTABLE" "$ARTIFACT_TOOL" journal-get --journal "$JOURNAL_PATH" --field phase)" || \
      ! RECOVER_RUNNING_APP_PATHS_JSON="$("$BUN_EXECUTABLE" "$ARTIFACT_TOOL" journal-get --journal "$JOURNAL_PATH" --field prior_running_app_paths)"; then
@@ -1376,7 +1376,7 @@ if ! "$BUN_EXECUTABLE" -e '
     if ((actual[i] ?? 0) < (minimum[i] ?? 0)) process.exit(1);
   }
 ' "$CURRENT_MACOS" "$MINIMUM_MACOS"; then
-  echo "HasnaRecordings.app requires macOS ${MINIMUM_MACOS} or later; target is ${CURRENT_MACOS}." >&2
+  echo "Hasna Recordings.app requires macOS ${MINIMUM_MACOS} or later; target is ${CURRENT_MACOS}." >&2
   exit 1
 fi
 TARGET_ARCH="$("$UNAME_EXECUTABLE" -m)"
@@ -1386,7 +1386,7 @@ MANIFEST_ARCHITECTURES="$("$BUN_EXECUTABLE" "$ARTIFACT_TOOL" manifest-get \
   --field architectures)"
 case " ${MANIFEST_ARCHITECTURES} " in
   *" ${TARGET_ARCH} "*) ;;
-  *) echo "HasnaRecordings.app artifact does not support target architecture ${TARGET_ARCH}." >&2; exit 1 ;;
+  *) echo "Hasna Recordings.app artifact does not support target architecture ${TARGET_ARCH}." >&2; exit 1 ;;
 esac
 
 verify_secure_parent "$APP_PARENT"
@@ -1412,7 +1412,7 @@ add_unique_app() {
   local existing
   if [ -e "$candidate" ] || [ -L "$candidate" ]; then
     [ -d "$candidate" ] && [ ! -L "$candidate" ] || {
-      echo "HasnaRecordings.app path is not a secure directory: ${candidate}" >&2
+      echo "Hasna Recordings.app path is not a secure directory: ${candidate}" >&2
       exit 1
     }
   fi
@@ -1524,7 +1524,7 @@ stop_old_processes() {
     "$SLEEP_EXECUTABLE" 0.1
   done
   if [ "$remaining" -ne 0 ]; then
-    echo "Existing HasnaRecordings.app process did not stop before replacement." >&2
+    echo "Existing Hasna Recordings.app process did not stop before replacement." >&2
     exit 1
   fi
 }
@@ -1545,7 +1545,7 @@ quiesce_old_processes() {
     fi
     "$SLEEP_EXECUTABLE" 0.1
   done
-  echo "Existing HasnaRecordings.app processes did not remain quiescent before replacement." >&2
+  echo "Existing Hasna Recordings.app processes did not remain quiescent before replacement." >&2
   exit 1
 }
 
@@ -1706,11 +1706,14 @@ fi
 DISCOVERED_APPS=()
 add_unique_app "$APP_DEST"
 add_unique_app "${DATA_DIR}/Recordings.app"
+add_unique_app "${DATA_DIR}/Hasna Recordings.app"
 add_unique_app "${DATA_DIR}/HasnaRecordings.app"
-for candidate in "${HOME}"/Applications/Recordings.app.* "${HOME}"/Applications/HasnaRecordings.app.*; do
+add_unique_app "${HOME}/Applications/HasnaRecordings.app"
+for candidate in "${HOME}"/Applications/Recordings.app.* "${HOME}/Applications/Hasna Recordings.app."* "${HOME}/Applications/HasnaRecordings.app."*; do
   add_unique_app "$candidate"
 done
 add_unique_app "/Applications/Recordings.app"
+add_unique_app "/Applications/Hasna Recordings.app"
 add_unique_app "/Applications/HasnaRecordings.app"
 if [ -x "$MDFIND_EXECUTABLE" ]; then
   while IFS= read -r candidate; do
@@ -1722,12 +1725,12 @@ fi
 MANAGEABLE_APPS=()
 for existing_app in ${DISCOVERED_APPS[@]+"${DISCOVERED_APPS[@]}"}; do
   case "$existing_app" in
-    "$APP_DEST"|"${DATA_DIR}/Recordings.app"|"${DATA_DIR}/HasnaRecordings.app"|"${HOME}/Applications/Recordings.app."*|"${HOME}/Applications/HasnaRecordings.app."*)
+    "$APP_DEST"|"${DATA_DIR}/Recordings.app"|"${DATA_DIR}/Hasna Recordings.app"|"${DATA_DIR}/HasnaRecordings.app"|"${HOME}/Applications/HasnaRecordings.app"|"${HOME}/Applications/Recordings.app."*|"${HOME}/Applications/Hasna Recordings.app."*|"${HOME}/Applications/HasnaRecordings.app."*)
       echo "Duplicate disposition: archive transactionally, remove after activation: ${existing_app}"
       MANAGEABLE_APPS+=("$existing_app")
       ;;
     *)
-      echo "Duplicate HasnaRecordings.app at ${existing_app} is outside the transactional user install paths; archive or remove it before installing." >&2
+      echo "Duplicate Hasna Recordings.app at ${existing_app} is outside the transactional user install paths; archive or remove it before installing." >&2
       exit 1
       ;;
   esac
@@ -1954,7 +1957,7 @@ for ((refresh_attempt = 1; refresh_attempt <= 5; refresh_attempt++)); do
   fi
 done
 [ "$STOPPED_REFRESH_STABLE" -eq 1 ] || {
-  echo "Existing HasnaRecordings.app writers did not remain quiescent around the stopped-state refresh." >&2
+  echo "Existing Hasna Recordings.app writers did not remain quiescent around the stopped-state refresh." >&2
   exit 1
 }
 
@@ -2004,7 +2007,7 @@ for ((move_index = 0; move_index < MOVED_ORIGINAL_COUNT; move_index++)); do
   existing_app="${MOVED_ORIGINALS[$move_index]}"
   moved_path="${MOVED_PATHS[$move_index]}"
   [ "$("$BUN_EXECUTABLE" "$ARTIFACT_TOOL" tree-digest --path "$existing_app")" = "${MOVED_DIGESTS[$move_index]}" ] || {
-    echo "Installed HasnaRecordings.app changed after transactional backup planning." >&2
+    echo "Installed Hasna Recordings.app changed after transactional backup planning." >&2
     exit 1
   }
   RECORDINGS_TEST_INSTALLER_PID="$$" \
@@ -2117,7 +2120,7 @@ if [ "$LAUNCH_APP" -eq 1 ] || [ "$was_running" -eq 1 ]; then
 fi
 
 if [ "$ARTIFACT_POLICY" = "local_only" ]; then
-  echo "Installed local-only HasnaRecordings.app for ${APPROVED_TARGET}; this artifact is ad-hoc signed and non-notarized."
+  echo "Installed local-only Hasna Recordings.app for ${APPROVED_TARGET}; this artifact is ad-hoc signed and non-notarized."
   if [ "$identity_migration" -eq 1 ]; then
     # Not a maybe: the designated requirement did change, under an explicit approval.
     echo "Code identity changed under --allow-adhoc-identity-migration; the Microphone and Accessibility grants held by the replaced app no longer apply and must be reauthorized."
@@ -2127,5 +2130,5 @@ if [ "$ARTIFACT_POLICY" = "local_only" ]; then
 elif [ "$identity_migration" -eq 1 ]; then
   echo "Installed a new signing identity; macOS will require one-time permission approval for this migration."
 else
-  echo "Installed verified HasnaRecordings.app release artifact: ${APP_DEST}"
+  echo "Installed verified Hasna Recordings.app release artifact: ${APP_DEST}"
 fi

package/scripts/macos_artifact.ts

@@ -183,7 +183,7 @@ export type BuildProvenance = {
 
 export type MacOSArtifactManifest = BuildProvenance & {
   artifact_type: "recordings-macos-app";
-  /// The top-level bundle directory name inside the artifact (HasnaRecordings.app for
+  /// The top-level bundle directory name inside the artifact (Hasna Recordings.app for
   /// both the full app and the bar variant per the fleet naming rule).
   bundle_name: string;
   app_sha256: string;
@@ -843,6 +843,7 @@ function manifestVariant(manifest: MacOSArtifactManifest): ArtifactVariant {
 }
 
 function manifestBundleName(manifest: MacOSArtifactManifest): string {
+  // Manifests predating explicit bundle names describe the original unspaced bundle.
   return manifest.bundle_name ?? "HasnaRecordings.app";
 }
 
@@ -1094,23 +1095,23 @@ function assertCanonicalZipEntries(entries: Array<{ name: string; isDirectory: b
     const components = logicalPath.split("/");
     if (
       !logicalPath ||
-      components[0] !== "HasnaRecordings.app" ||
+      components[0] !== "Hasna Recordings.app" ||
       components.some((component) => !component || component === "." || component === "..")
     ) {
-      throw new Error("release ZIP contains an entry outside the canonical HasnaRecordings.app tree");
+      throw new Error("release ZIP contains an entry outside the canonical Hasna Recordings.app tree");
     }
     const collisionKey = canonicalZipCollisionKey(logicalPath);
     if (logicalPaths.has(collisionKey)) {
       throw new Error("release ZIP contains duplicate, file/directory, case-fold, or Unicode-colliding entries");
     }
     logicalPaths.set(collisionKey, { name: logicalPath, isDirectory: entry.isDirectory });
-    if (logicalPath === "HasnaRecordings.app") {
-      if (!entry.isDirectory) throw new Error("release ZIP HasnaRecordings.app root is not a directory entry");
+    if (logicalPath === "Hasna Recordings.app") {
+      if (!entry.isDirectory) throw new Error("release ZIP Hasna Recordings.app root is not a directory entry");
       rootDirectoryCount += 1;
     }
   }
   if (rootDirectoryCount !== 1) {
-      throw new Error("release ZIP must contain exactly one canonical HasnaRecordings.app root entry");
+      throw new Error("release ZIP must contain exactly one canonical Hasna Recordings.app root entry");
   }
   for (const { name } of logicalPaths.values()) {
     const components = name.split("/");
@@ -1384,41 +1385,48 @@ export function verifyAndExtractArchiveDescriptors(
     throw new Error("artifact verifier archive digest mismatch");
   }
   const entries = inspectZipArchiveBytes(archive);
-  const outputRoot = `/dev/fd/${outputDirectoryDescriptor}`;
-  if (readdirSync(outputRoot).length !== 0) {
-    throw new Error("artifact verifier output directory must be empty");
-  }
-  const ordered = [...entries].sort((left, right) => {
-    const depth = left.name.split("/").length - right.name.split("/").length;
-    if (depth !== 0) return depth;
-    if (left.isDirectory !== right.isDirectory) return left.isDirectory ? -1 : 1;
-    return compareUnsignedUtf8(left.name, right.name);
-  });
-  for (const entry of ordered) {
-    const leaf = entry.isDirectory ? entry.name.slice(0, -1) : entry.name;
-    const target = join(outputRoot, ...leaf.split("/"));
-    const mode = entry.unixMode & 0o777;
-    if (entry.isDirectory) {
-      mkdirSync(target, { mode });
-      chmodSync(target, mode);
-      continue;
-    }
-    const descriptor = openSync(
-      target,
-      constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW,
-      mode,
-    );
-    try {
-      const payload = zipEntryPayload(archive, entry);
-      let offset = 0;
-      while (offset < payload.length) offset += writeSync(descriptor, payload, offset);
-      fchmodSync(descriptor, mode);
-      fsyncSync(descriptor);
-    } finally {
-      closeSync(descriptor);
+  // /dev/fd/<directory>/child is not traversable on Darwin. Keep all
+  // extraction relative to the borrowed capability, including every ancestor.
+  const guard = nativeFsGuard();
+  const outputRoot = guard.duplicateDirectoryDescriptor(outputDirectoryDescriptor);
+  try {
+    if (guard.readDir(outputRoot).length !== 0) {
+      throw new Error("artifact verifier output directory must be empty");
+    }
+    const ordered = [...entries].sort((left, right) => {
+      const depth = left.name.split("/").length - right.name.split("/").length;
+      if (depth !== 0) return depth;
+      if (left.isDirectory !== right.isDirectory) return left.isDirectory ? -1 : 1;
+      return compareUnsignedUtf8(left.name, right.name);
+    });
+    for (const entry of ordered) {
+      const parts = (entry.isDirectory ? entry.name.slice(0, -1) : entry.name).split("/");
+      const leaf = parts.pop()!;
+      let parent = outputRoot;
+      try {
+        // Close each ancestor as we descend; even a large ZIP keeps only a
+        // bounded number of descriptors open. openDirAt refuses symlinks.
+        for (const component of parts) {
+          const ancestor = parent;
+          parent = guard.openDirAt(ancestor, component);
+          if (ancestor !== outputRoot) guard.close(ancestor);
+        }
+        const mode = entry.unixMode & 0o777;
+        if (entry.isDirectory) {
+          const directory = guard.mkdirAt(parent, leaf, mode);
+          guard.close(directory);
+        } else {
+          guard.writeFileAt(parent, leaf, zipEntryPayload(archive, entry), mode);
+        }
+        guard.fsyncHandle(parent);
+      } finally {
+        if (parent !== outputRoot) guard.close(parent);
+      }
     }
+    guard.fsyncHandle(outputRoot);
+  } finally {
+    guard.close(outputRoot);
   }
-  fsyncSync(outputDirectoryDescriptor);
 }
 
 export function withPrivatelyExtractedArchiveApp<T>(
@@ -1426,7 +1434,7 @@ export function withPrivatelyExtractedArchiveApp<T>(
   operation: (appPath: string) => T,
   platformArchiveTool = "/usr/bin/ditto",
   expectedArchiveSha256?: string,
-  expectedBundleName = "HasnaRecordings.app",
+  expectedBundleName = "Hasna Recordings.app",
 ): T {
   const privateRoot = mkdtempSync(join(tmpdir(), "recordings-artifact-extract-"));
   chmodSync(privateRoot, 0o700);
@@ -1751,8 +1759,8 @@ export function assertManifestShape(manifest: MacOSArtifactManifest): void {
     manifest.container?.type !== "zip" ||
     JSON.stringify(manifest.container.install_locations) !== JSON.stringify(
       artifactPolicy === "release"
-        ? ["/Applications/HasnaRecordings.app"]
-        : ["~/Applications/HasnaRecordings.app"],
+        ? ["/Applications/Hasna Recordings.app"]
+        : ["~/Applications/Hasna Recordings.app"],
     )
   ) {
     throw new Error("manifest has an unexpected container install policy");
@@ -2516,7 +2524,7 @@ export function assertVersionTransition(
   assertManifestShape(manifest);
   if (compareVersions(manifest.bundle_version, installedVersion) < 0) {
     throw new Error(
-      `refusing to downgrade HasnaRecordings.app from ${installedVersion} to ${manifest.bundle_version}`,
+      `refusing to downgrade Hasna Recordings.app from ${installedVersion} to ${manifest.bundle_version}`,
     );
   }
   if (compareVersions(manifest.bundle_version, installedVersion) === 0) {
@@ -2981,7 +2989,7 @@ function readJournal(path: string): InstallJournal {
   if (resolve(path) !== resolve(join(expectedParent, ".Recordings-install-transaction.json"))) {
     throw new Error("install transaction journal is outside the expected app parent");
   }
-  if (resolve(journal.app_destination) !== resolve(join(expectedParent, "HasnaRecordings.app"))) {
+  if (!["Hasna Recordings.app", "HasnaRecordings.app"].some((name) => resolve(journal.app_destination) === resolve(join(expectedParent, name)))) {
     throw new Error("install transaction journal has an unexpected app destination");
   }
   const expectedDataDir = resolve(join(dirname(expectedParent), ".hasna", "recordings"));
@@ -2999,9 +3007,12 @@ function readJournal(path: string): InstallJournal {
     return (
       resolved === resolve(journal.app_destination) ||
       resolved === resolve(join(journal.data_dir, "Recordings.app")) ||
+      resolved === resolve(join(journal.data_dir, "Hasna Recordings.app")) ||
       resolved === resolve(join(journal.data_dir, "HasnaRecordings.app")) ||
+      resolved === resolve(join(journal.app_parent, "HasnaRecordings.app")) ||
       resolved.startsWith(`${resolve(journal.app_parent)}/Recordings.app.`) ||
-      resolved.startsWith(`${resolve(journal.app_parent)}/HasnaRecordings.app.`)
+      resolved.startsWith(`${resolve(journal.app_parent)}/HasnaRecordings.app.`) ||
+      resolved.startsWith(`${resolve(journal.app_parent)}/Hasna Recordings.app.`)
     );
   };
   if (!journal.originals.every((entry) => allowedOriginal(entry.path))) {
@@ -3939,7 +3950,7 @@ function openRecoveryCapabilities(
   const homePath = resolve(dirname(appParent));
   if (
     basename(appParent) !== "Applications" ||
-    resolve(journal.app_destination) !== resolve(join(appParent, "HasnaRecordings.app")) ||
+    !["Hasna Recordings.app", "HasnaRecordings.app"].some((name) => resolve(journal.app_destination) === resolve(join(appParent, name))) ||
     resolve(journal.data_dir) !== resolve(join(homePath, ".hasna", "recordings")) ||
     dirname(resolve(journal.transaction_dir)) !== appParent
   ) {
@@ -4573,16 +4584,16 @@ function originalDestinationCapability(
   }
   if (
     dirname(resolved) === resolve(journal.data_dir) &&
-    (basename(resolved) === "Recordings.app" || basename(resolved) === "HasnaRecordings.app")
+    ["Recordings.app", "Hasna Recordings.app", "HasnaRecordings.app"].includes(basename(resolved))
   ) {
     // Install site inside the state data directory: the legacy pre-rename
-    // Recordings.app and the renamed HasnaRecordings.app are both recognized and
+    // Recordings.app and the renamed Hasna Recordings.app are both recognized and
     // preserved, never treated as the canonical Applications destination.
     return { parent: capabilities.data, leaf: basename(resolved) };
   }
   if (
     dirname(resolved) === resolve(journal.app_parent) &&
-    /^(?:Hasna)?Recordings\.app\.[A-Za-z0-9._-]+$/.test(basename(resolved))
+    (basename(resolved) === "HasnaRecordings.app" || /^(?:Hasna ?)?Recordings\.app\.[A-Za-z0-9._-]+$/.test(basename(resolved)))
   ) {
     return { parent: capabilities.applications, leaf: basename(resolved) };
   }

package/scripts/migrate.ts

@@ -29,32 +29,16 @@ async function runPublishedEntrypoint(): Promise<boolean> {
 async function main() {
   // Published packages ship the compiled server but intentionally omit src/.
   if (await runPublishedEntrypoint()) return;
-  const {
-    closeCloud,
-    getCloudPg,
-    migrateCloudSchema,
-    pingCloudConnectivity,
-    resolveDatabaseUrl,
-  } = await import("../src/server/cloud.js");
-  const { assertCloudSchemaContract } = await import("../src/server/cloud-readiness.js");
-  const { runCloudMigration } = await import("../src/server/migrate-command.js");
-  const url = resolveDatabaseUrl();
-  if (!url) {
+  const { closeCloud, resolveMigrationDatabaseUrl, runRecordedMigration } = await import("../src/server/cloud.js");
+  if (!resolveMigrationDatabaseUrl()) {
     console.error(
-      "migrate: no database URL (HASNA_RECORDINGS_DATABASE_URL / RECORDINGS_DATABASE_URL / DATABASE_URL)",
+      "migrate: no database URL (HASNA_RECORDINGS_MIGRATE_DATABASE_URL / RECORDINGS_MIGRATE_DATABASE_URL / HASNA_RECORDINGS_DATABASE_URL / RECORDINGS_DATABASE_URL / DATABASE_URL)",
     );
     process.exitCode = 2;
     return;
   }
   console.log("migrate: connecting…");
-  await runCloudMigration({
-    pingConnectivity: pingCloudConnectivity,
-    applyMigrations: async () => {
-      console.log("migrate: applying schema (recordings tables + api_keys)…");
-      await migrateCloudSchema();
-    },
-    validateContract: () => assertCloudSchemaContract(getCloudPg()),
-  });
+  await runRecordedMigration();
   console.log("migrate: done");
   await closeCloud();
 }

package/scripts/native/recordings_fs_guard.c

@@ -5,6 +5,7 @@
 #include <dirent.h>
 #include <errno.h>
 #include <fcntl.h>
+#include <limits.h>
 #include <stdint.h>
 #include <stdbool.h>
 #include <signal.h>
@@ -314,6 +315,32 @@ static napi_value open_trusted_home(napi_env env, napi_callback_info info) {
   return make_handle(env, fd);
 }
 
+static napi_value duplicate_directory_descriptor(napi_env env, napi_callback_info info) {
+  napi_value argv[1];
+  size_t argc = 1;
+  double descriptor;
+  if (!check_napi(env, napi_get_cb_info(env, info, &argc, argv, NULL, NULL), "duplicateDirectoryDescriptor args") || argc != 1 ||
+      !check_napi(env, napi_get_value_double(env, argv[0], &descriptor), "read directory descriptor")) return NULL;
+  if (!(descriptor >= 0 && descriptor <= INT_MAX) || descriptor != (int)descriptor) {
+    throw_message(env, "INVALID_DESCRIPTOR", "directory descriptor must be a non-negative integer");
+    return NULL;
+  }
+  // Borrow the caller's capability, never its path or ownership of the fd.
+  int fd = fcntl((int)descriptor, F_DUPFD_CLOEXEC, 0);
+  if (fd < 0) { throw_errno(env, "duplicate directory descriptor"); return NULL; }
+  struct stat details;
+  if (fstat(fd, &details) != 0) {
+    int saved_errno = errno;
+    close(fd); errno = saved_errno; throw_errno(env, "stat duplicated directory"); return NULL;
+  }
+  if (!S_ISDIR(details.st_mode)) {
+    close(fd);
+    throw_message(env, "INVALID_DESCRIPTOR", "descriptor must reference a directory");
+    return NULL;
+  }
+  return make_handle(env, fd);
+}
+
 static napi_value open_dir_at(napi_env env, napi_callback_info info) {
   napi_value argv[2];
   size_t argc = 2;
@@ -370,8 +397,13 @@ static napi_value read_dir(napi_env env, napi_callback_info info) {
   if (stream == NULL) { close(iterator_fd); throw_errno(env, "open directory stream"); return NULL; }
   if (!check_napi(env, napi_create_array(env, &array), "create directory array")) { closedir(stream); return NULL; }
   uint32_t index = 0;
-  errno = 0;
-  for (struct dirent *entry = readdir(stream); entry != NULL; entry = readdir(stream)) {
+  int saved_errno = 0;
+  for (;;) {
+    /* EOF preserves errno. Successful N-API work in the preceding iteration
+     * need not preserve it, so only the immediately following read owns it. */
+    errno = 0;
+    struct dirent *entry = readdir(stream);
+    if (entry == NULL) { saved_errno = errno; break; }
     if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0) continue;
     if (!valid_leaf(entry->d_name)) {
       closedir(stream);
@@ -385,7 +417,6 @@ static napi_value read_dir(napi_env env, napi_callback_info info) {
       return NULL;
     }
   }
-  int saved_errno = errno;
   closedir(stream);
   if (saved_errno != 0) { errno = saved_errno; throw_errno(env, "read directory capability"); return NULL; }
   return array;
@@ -717,7 +748,7 @@ static napi_value write_file_at(napi_env env, napi_callback_info info) {
     }
     offset += (size_t)count;
   }
-  if (fsync(fd) != 0) {
+  if (fchmod(fd, (mode_t)(mode & 0777)) != 0 || fsync(fd) != 0) {
     saved_errno = errno; close(fd); errno = saved_errno; throw_errno(env, "fsync written file"); return NULL;
   }
   if (close(fd) != 0) { throw_errno(env, "close written file"); return NULL; }
@@ -1132,6 +1163,7 @@ static napi_value unlink_file_handle_at(napi_env env, napi_callback_info info) {
 
 static napi_value init(napi_env env, napi_value exports) {
   const napi_property_descriptor properties[] = {
+    { "duplicateDirectoryDescriptor", NULL, duplicate_directory_descriptor, NULL, NULL, NULL, napi_default, NULL },
     { "openTrustedHome", NULL, open_trusted_home, NULL, NULL, NULL, napi_default, NULL },
     { "openDirAt", NULL, open_dir_at, NULL, NULL, NULL, napi_default, NULL },
     { "openRegularAt", NULL, open_regular_at, NULL, NULL, NULL, napi_default, NULL },