@haystackeditor/cli 0.15.31 → 0.17.0

package/dist/triage/runner.js

@@ -1,31 +1,30 @@
 /**
- * Triage runner — orchestrates parallel sub-agent execution for pre-PR checks.
+ * Triage runner — runs the pre-PR checkers in parallel and aggregates results.
  *
- * Detects the user's agentic CLI (Claude Code, Codex, Gemini), spawns
- * parallel sub-processes for each checker, and collects structured JSON results.
+ * Each checker (code-review, rules-validator) is one structured Responses API
+ * call to gpt-6-astra at the highest reasoning effort (see astra.ts). A checker
+ * that fails is reported as "<checker> failed: <error>" and never blocks
+ * submit; there is no second reviewer to fall back to.
  */
-import { execSync, spawn } from 'child_process';
-import { existsSync, readFileSync, mkdirSync, rmSync } from 'fs';
+import { execFileSync } from 'child_process';
+import { existsSync, readFileSync, mkdirSync, rmSync, writeFileSync } from 'fs';
 import { join } from 'path';
 import chalk from 'chalk';
-import { buildCodeReviewPrompt, buildRulesValidatorPrompt } from './prompts.js';
+import { buildCodeReviewPrompt, buildRulesValidatorPrompt, CODE_REVIEW_SCHEMA, RULES_VALIDATOR_SCHEMA, } from './prompts.js';
+import { callAstra, TRIAGE_MODEL, TRIAGE_REASONING_EFFORT } from './astra.js';
 import { resolveDiffBaseRef } from '../utils/git.js';
 import { trackError } from '../utils/telemetry.js';
 // ============================================================================
 // Constants
 // ============================================================================
 const TRIAGE_DIR = '.haystack/triage';
-/** Wall-clock timeout per checker. Overridable via .haystack.json triage.timeoutMs or --triage-timeout. */
-const DEFAULT_TIMEOUT_MS = 180_000; // 3 minutes
 /**
- * Default max agentic turns per checker. Overridable via .haystack.json
- * triage.maxTurns or --max-turns. code-review tends to saturate first because
- * it reads the diff line-by-line; 8 is the breakeven we landed on empirically.
+ * Abort a checker when its response stream has been silent this long.
+ * Overridable via .haystack.json triage.timeoutMs or --triage-timeout.
+ * Measured 2026-09-24: a max-effort review of a 20 KB diff streamed its
+ * longest silent gap at 14.6s.
  */
-const DEFAULT_MAX_TURNS = {
-    'code-review': 8,
-    'rules-validator': 10,
-};
+const DEFAULT_STALL_MS = 300_000;
 // ============================================================================
 // Agent policy file discovery
 // ============================================================================
@@ -54,218 +53,53 @@ function discoverAgentPolicyFiles(gitRoot) {
     }
     return results;
 }
-// ============================================================================
-// CLI detection
-// ============================================================================
-/**
- * Detect which agentic CLI is installed.
- * Returns the first one found, or null if none available.
- */
-export function detectAgenticCLI() {
-    const isWindows = process.platform === 'win32';
-    const inCodexSession = Boolean(process.env.CODEX_SHELL || process.env.CODEX_THREAD_ID || process.env.CODEX_CI);
-    const inClaudeSession = Boolean(process.env.CLAUDE_CODE || process.env.CLAUDECODE);
-    const clis = inCodexSession
-        ? ['codex', 'claude', 'gemini']
-        : inClaudeSession
-            ? ['claude', 'codex', 'gemini']
-            : ['claude', 'codex', 'gemini'];
-    for (const name of clis) {
-        try {
-            execSync(isWindows ? `where ${name}` : `which ${name}`, { stdio: 'ignore' });
-            return name;
-        }
-        catch {
-            // Not installed
-        }
-    }
-    return null;
-}
-/**
- * Build the CLI command + args for the detected agentic tool.
- */
-export function buildCommand(cli, prompt, maxTurns) {
-    switch (cli) {
-        case 'claude':
-            return {
-                command: 'claude',
-                args: [
-                    '-p', prompt,
-                    '--dangerously-skip-permissions',
-                    '--max-turns', String(maxTurns),
-                    '--allowedTools', 'Bash', 'Read', 'Glob', 'Grep', 'Write',
-                ],
-            };
-        case 'codex':
-            return {
-                command: 'codex',
-                args: [
-                    '--sandbox', 'workspace-write',
-                    '--ask-for-approval', 'never',
-                    'exec',
-                    '--ephemeral',
-                    prompt,
-                ],
-            };
-        case 'gemini':
-            return {
-                command: 'gemini',
-                args: ['-p', prompt, '-y'],
-            };
-    }
-}
+const CHECKER_LABEL = {
+    'code-review': 'code review',
+    'rules-validator': 'rules validator',
+};
 /**
- * Spawn a sub-agent process and wait for it to complete.
- * Returns the exit code.
+ * Map a schema-conformant reply onto the CheckerResult shape submit consumes.
+ * Strict mode enforces types, enums and required keys but not non-empty
+ * strings; a finding with a blank file or summary is left out and counted in
+ * `malformed` so the runner reports it, without discarding the other findings.
  */
-function spawnChecker(cli, config, cwd, timeoutMs) {
-    return new Promise((resolve) => {
-        const { command, args } = buildCommand(cli, config.prompt, config.maxTurns);
-        let stdout = '';
-        let stderr = '';
-        const proc = spawn(command, args, {
-            cwd,
-            stdio: ['ignore', 'pipe', 'pipe'],
-            env: {
-                ...process.env,
-                CLAUDECODE: undefined,
-            },
-        });
-        proc.stdout?.on('data', (data) => {
-            stdout += data.toString();
-        });
-        proc.stderr?.on('data', (data) => {
-            stderr += data.toString();
-        });
-        // Timeout
-        const timer = setTimeout(() => {
-            proc.kill('SIGTERM');
-            stderr += `\nProcess killed after ${Math.round(timeoutMs / 1000)}s timeout`;
-        }, timeoutMs);
-        proc.on('close', (code) => {
-            clearTimeout(timer);
-            resolve({ exitCode: code ?? 1, output: `${stdout}\n${stderr}`.trim() });
-        });
-        proc.on('error', (err) => {
-            clearTimeout(timer);
-            resolve({ exitCode: 1, output: err.message });
-        });
+function toCheckerResult(name, reply) {
+    const usable = reply.findings.filter(finding => finding.file.trim() && finding.summary.trim());
+    const malformed = reply.findings.length - usable.length;
+    const issues = usable.map((finding) => {
+        const issue = {
+            file: finding.file,
+            severity: finding.severity,
+            message: finding.summary,
+            category: finding.category,
+            failureScenario: finding.failureScenario,
+        };
+        if (typeof finding.line === 'number' && finding.line > 0)
+            issue.line = finding.line;
+        if (finding.rule)
+            issue.rule = finding.rule;
+        return issue;
     });
-}
-/**
- * Classify why a checker failed to produce a valid JSON result.
- *
- * - `max_turns`: the sub-agent exhausted its --max-turns budget. Expected when
- *   the diff is too large for the budget; should not block submit.
- * - `timeout`: we killed the process at the configured wall-clock cap. Also non-blocking.
- * - `error`: anything else (auth failure, crash, malformed output). Blocks.
- *
- * The max-turns markers come from the CLIs themselves (Claude CLI prints
- * "Reached max turns", Codex prints "turn limit"). If a new CLI is added, add
- * its marker here — unknown failures fall through to `error` (safe default).
- */
-function classifyCheckerFailure(output) {
-    const summary = summarizeCheckerFailureOutput(output) ?? '(no output)';
-    // Claude: "Reached max turns (N)". Codex/Gemini variants: "turn limit", "max iterations".
-    if (/reached max turns|max turns reached|turn limit|max iterations/i.test(output)) {
-        return { kind: 'max_turns', summary };
-    }
-    // Our own SIGTERM message from spawnChecker.
-    if (/process killed after \d+s timeout/i.test(output)) {
-        return { kind: 'timeout', summary };
-    }
-    return { kind: 'error', summary };
-}
-function summarizeCheckerFailureOutput(output) {
-    const lines = output
-        .split('\n')
-        .map(line => line.trim())
-        .filter(Boolean);
-    if (lines.length === 0)
-        return null;
-    const priorityPatterns = [
-        /not logged in/i,
-        /stream disconnected|error sending request|failed to refresh available models/i,
-        /operation not permitted|readonly database|permission denied/i,
-        /timeout|timed out/i,
-        /unauthorized|forbidden/i,
-        /^error:/i,
-        /failed/i,
-    ];
-    let summary = lines[lines.length - 1];
-    for (const pattern of priorityPatterns) {
-        const match = lines.find(line => pattern.test(line));
-        if (match) {
-            summary = match;
-            break;
-        }
-    }
-    return summary.length > 220
-        ? `${summary.slice(0, 217)}...`
-        : summary;
-}
-// ============================================================================
-// Result reading
-// ============================================================================
-/**
- * Read and validate a checker result JSON file.
- */
-function readCheckerResult(outputPath, checkerName) {
-    if (!existsSync(outputPath)) {
-        return null;
-    }
-    try {
-        const content = readFileSync(outputPath, 'utf-8');
-        const result = JSON.parse(content);
-        // Basic validation
-        if (!result.checker || !Array.isArray(result.issues) || typeof result.passed !== 'boolean') {
-            return null;
-        }
-        // Ensure issues have required fields
-        result.issues = result.issues.filter((issue) => issue.file && issue.message && issue.severity);
-        // Recalculate passed based on issues
-        result.passed = !result.issues.some((i) => i.severity === 'error');
-        return result;
-    }
-    catch {
-        return null;
-    }
+    const passed = !issues.some(issue => issue.severity === 'error');
+    const result = name === 'rules-validator'
+        ? { checker: name, issues, summary: reply.summary, passed, rulesChecked: reply.rulesChecked ?? 0 }
+        : { checker: name, issues, summary: reply.summary, passed };
+    return { result, malformed };
 }
 // ============================================================================
 // Main runner
 // ============================================================================
 /**
- * Run pre-PR triage checks using parallel sub-agent processes.
+ * Run pre-PR triage checks in parallel.
  *
  * @param gitRoot - Absolute path to the git repository root
  * @param baseBranch - The base branch to diff against (e.g., "main")
  * @returns Aggregated triage results
- * @throws If no agentic CLI is detected
  */
 export async function runTriage(gitRoot, baseBranch, options = {}) {
     const startTime = Date.now();
-    // Merge defaults with caller-provided overrides. The caller (submit.ts) is
-    // responsible for layering CLI flags on top of .haystack.json values before
-    // calling us — we just see a flat override map.
-    const maxTurns = { ...DEFAULT_MAX_TURNS };
-    for (const [name, value] of Object.entries(options.maxTurns ?? {})) {
-        if (typeof value === 'number' && value > 0) {
-            maxTurns[name] = value;
-        }
-    }
-    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-    // Detect CLI
-    const cli = detectAgenticCLI();
-    if (!cli) {
-        throw new Error('No agentic CLI found. Install Claude Code (claude), Codex CLI (codex), or Gemini CLI (gemini).');
-    }
-    // Fast-fail in Codex app shells where outbound network is disabled.
-    // Spawning nested `codex exec` will fail after retries; skip triage immediately instead.
-    const codexNetworkDisabled = process.env.CODEX_SANDBOX_NETWORK_DISABLED === '1';
-    if (cli === 'codex' && codexNetworkDisabled) {
-        throw new Error('Codex shell has network disabled (CODEX_SANDBOX_NETWORK_DISABLED=1), so triage sub-agents cannot run. Re-run outside this sandbox or use --force.');
-    }
-    console.log(chalk.dim(`  Using: ${cli}`));
+    const stallMs = options.timeoutMs ?? DEFAULT_STALL_MS;
+    console.log(chalk.dim(`  Reviewer: ${TRIAGE_MODEL} (reasoning effort ${TRIAGE_REASONING_EFFORT})`));
     // Prepare output directory
     const triageDir = join(gitRoot, TRIAGE_DIR);
     if (existsSync(triageDir)) {
@@ -274,123 +108,93 @@ export async function runTriage(gitRoot, baseBranch, options = {}) {
     mkdirSync(triageDir, { recursive: true });
     // Resolve the ref to diff against once. Prefers origin/<base> over the bare
     // local <base> ref (which is often stale and balloons the diff with already-
-    // merged code). Every git read below — the precomputed diff, the agent diff
-    // commands in the prompts use this single resolved ref so they all see the
-    // same fork point.
+    // merged code).
     const diffBaseRef = resolveDiffBaseRef(baseBranch);
     if (diffBaseRef !== baseBranch) {
         console.log(chalk.dim(`  Diff base: ${diffBaseRef}`));
     }
-    // Pre-compute the diff once so sub-agents don't waste turns running git diff.
-    // Includes 10 lines of context around each hunk for reviewability.
-    let precomputedDiff = null;
+    // 10 lines of context per hunk: the reviewer sees only the diff. argv, not a
+    // shell string: the ref comes from a branch name.
+    let diff;
     try {
-        const diffOutput = execSync(`git diff ${diffBaseRef}...HEAD -U10`, { cwd: gitRoot, encoding: 'utf-8', maxBuffer: 5 * 1024 * 1024 }).trim();
-        // Only inline if the diff is under 100K chars — beyond that, let the agent
-        // run git diff itself (it can paginate or review file-by-file).
-        if (diffOutput.length > 0 && diffOutput.length <= 100_000) {
-            precomputedDiff = diffOutput;
-        }
+        diff = execFileSync('git', ['diff', '-U10', '--end-of-options', `${diffBaseRef}...HEAD`], { cwd: gitRoot, encoding: 'utf-8', maxBuffer: 64 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'] }).trim();
     }
-    catch {
-        // git diff failed — agents will run it themselves
+    catch (err) {
+        const stderr = err?.stderr?.toString().trim();
+        const cause = stderr || (err instanceof Error ? err.message : String(err));
+        throw new Error(`Could not compute the triage diff against ${diffBaseRef}: ${cause}`);
     }
+    writeFileSync(join(triageDir, 'diff.patch'), diff);
     // Build checker configs
     const checkers = [];
     // 1. Code review (always runs)
-    const codeReviewOutput = join(triageDir, 'code-review.json');
     checkers.push({
         name: 'code-review',
-        prompt: buildCodeReviewPrompt(diffBaseRef, codeReviewOutput, maxTurns['code-review'], timeoutMs, precomputedDiff),
-        outputFile: codeReviewOutput,
-        maxTurns: maxTurns['code-review'],
+        prompt: buildCodeReviewPrompt(diffBaseRef, diff),
+        schema: CODE_REVIEW_SCHEMA,
+        outputFile: join(triageDir, 'code-review.json'),
     });
     // 2. Rules validator (if pr-rules.yml or agent instruction files exist)
     const rulesPath = join(gitRoot, '.haystack', 'pr-rules.yml');
-    const hasRulesYaml = existsSync(rulesPath);
-    const rulesYaml = hasRulesYaml ? readFileSync(rulesPath, 'utf-8') : '';
-    const agentPolicyFiles = discoverAgentPolicyFiles(gitRoot);
-    if (hasRulesYaml || agentPolicyFiles.length > 0) {
-        const rulesValidatorOutput = join(triageDir, 'rules-validator.json');
-        const rulesPrompt = buildRulesValidatorPrompt(diffBaseRef, rulesYaml, rulesValidatorOutput, maxTurns['rules-validator'], timeoutMs, agentPolicyFiles, precomputedDiff);
-        if (rulesPrompt) {
-            checkers.push({
-                name: 'rules-validator',
-                prompt: rulesPrompt,
-                outputFile: rulesValidatorOutput,
-                maxTurns: maxTurns['rules-validator'],
-            });
-        }
+    const rulesYaml = existsSync(rulesPath) ? readFileSync(rulesPath, 'utf-8') : '';
+    const rulesPrompt = buildRulesValidatorPrompt(diffBaseRef, rulesYaml, diff, discoverAgentPolicyFiles(gitRoot));
+    if (rulesPrompt) {
+        checkers.push({
+            name: 'rules-validator',
+            prompt: rulesPrompt,
+            schema: RULES_VALIDATOR_SCHEMA,
+            outputFile: join(triageDir, 'rules-validator.json'),
+        });
     }
-    // Log what we're running
-    const checkerNames = checkers.map(c => c.name);
-    console.log(chalk.dim(`  Checkers: ${checkerNames.join(', ')}`));
+    console.log(chalk.dim(`  Checkers: ${checkers.map(c => c.name).join(', ')}`));
     console.log(chalk.dim(`  Running ${checkers.length} checker(s) in parallel...\n`));
-    // Spawn all checkers in parallel
-    const spawnResults = await Promise.allSettled(checkers.map(async (checker) => {
-        const startLabel = chalk.dim(`  [${checker.name}]`);
-        console.log(`${startLabel} Starting...`);
-        const result = await spawnChecker(cli, checker, gitRoot, timeoutMs);
-        if (result.exitCode === 0) {
-            console.log(`${startLabel} ${chalk.green('Done')}`);
+    const settled = await Promise.allSettled(checkers.map(async (checker) => {
+        const label = chalk.dim(`  [${checker.name}]`);
+        console.log(`${label} Starting...`);
+        try {
+            const reply = await callAstra({
+                instructions: checker.prompt.instructions,
+                input: checker.prompt.input,
+                schemaName: checker.name.replace('-', '_'),
+                schema: checker.schema,
+                stallMs,
+            });
+            const mapped = toCheckerResult(checker.name, reply);
+            writeFileSync(checker.outputFile, JSON.stringify(mapped.result, null, 2));
+            console.log(`${label} ${chalk.green('Done')}`);
+            return mapped;
         }
-        else {
-            console.log(`${startLabel} ${chalk.yellow(`Exited with code ${result.exitCode}`)}`);
+        catch (err) {
+            console.log(`${label} ${chalk.yellow('Failed')}`);
+            throw err;
         }
-        return { checker, result };
     }));
-    // Collect results
     const results = [];
     const errors = [];
-    const warnings = [];
-    for (const spawnResult of spawnResults) {
-        if (spawnResult.status === 'rejected') {
-            errors.push(`Checker failed: ${spawnResult.reason}`);
-            trackError('triage_checker_failed', {
-                checker: 'unknown',
-                kind: 'spawn_rejected',
-                cli,
-                reason: String(spawnResult.reason),
-            });
-            continue;
-        }
-        const { checker, result } = spawnResult.value;
-        const checkerResult = readCheckerResult(checker.outputFile, checker.name);
-        if (checkerResult) {
-            results.push(checkerResult);
-            continue;
-        }
-        // Sub-agent didn't produce valid output — classify as warning vs hard error.
-        const classification = classifyCheckerFailure(result.output);
-        if (classification.kind === 'max_turns') {
-            warnings.push(`${checker.name}: hit max turns (${checker.maxTurns}) — raise via --max-turns or .haystack.json triage.maxTurns, or split the PR into smaller changes`);
-        }
-        else if (classification.kind === 'timeout') {
-            warnings.push(`${checker.name}: wall-clock timeout after ${Math.round(timeoutMs / 1000)}s — consider splitting the PR`);
-        }
-        else {
-            const exitPart = result.exitCode !== 0 ? ` (exit ${result.exitCode})` : '';
-            errors.push(`${checker.name}: ${classification.summary}${exitPart}`);
+    settled.forEach((outcome, index) => {
+        const checker = checkers[index];
+        if (outcome.status === 'fulfilled') {
+            results.push(outcome.value.result);
+            if (outcome.value.malformed > 0) {
+                errors.push(`${CHECKER_LABEL[checker.name]} returned ${outcome.value.malformed} finding(s) with an empty file or summary; they were left out`);
+            }
+            return;
         }
-        // Emit telemetry for every failed checker so we can tune defaults empirically.
+        const message = outcome.reason instanceof Error ? outcome.reason.message : String(outcome.reason);
+        errors.push(`${CHECKER_LABEL[checker.name]} failed: ${message}`);
         trackError('triage_checker_failed', {
             checker: checker.name,
-            kind: classification.kind,
-            cli,
-            max_turns: checker.maxTurns,
-            timeout_ms: timeoutMs,
-            exit_code: result.exitCode,
-            summary: classification.summary,
+            model: TRIAGE_MODEL,
+            stall_ms: stallMs,
+            summary: message.slice(0, 220),
         });
-    }
-    // Warnings are non-blocking by design — they're expected outcomes of the
-    // turn/time caps, not signs of real problems.
-    const passed = results.every(r => r.passed) && errors.length === 0;
+    });
+    // A checker that failed to run gives no signal either way; only findings
+    // with severity "error" fail triage.
     return {
-        passed,
+        passed: results.every(r => r.passed),
         results,
         errors,
-        warnings,
         duration: Date.now() - startTime,
     };
 }

package/dist/triage/types.js

@@ -1,7 +1,7 @@
 /**
  * Types for the pre-PR triage system.
  *
- * Sub-agents write results as JSON files matching these schemas.
- * The runner reads and aggregates them.
+ * Each checker is one structured gpt-6-astra call (see astra.ts); the runner
+ * maps its findings onto these shapes and aggregates them.
  */
 export {};

package/dist/types.js

@@ -117,7 +117,6 @@ export const AI_REVIEWER_BOT_USERNAMES = {
     codereviewer: 'codereviewbot[bot]',
     codium: 'codiumai[bot]',
 };
-const AIReviewerSourceSchema = z.enum(AI_REVIEWER_SOURCES);
 const MergeQueueConfigSchema = z.object({
     /** Enable the Haystack auto-merge queue */
     merge_queue: z.boolean().optional(),
@@ -272,11 +271,8 @@ const SecretDeclarationSchema = z.object({
 // =============================================================================
 // TRIAGE CONFIGURATION
 // =============================================================================
-const TriageCheckerNameSchema = z.enum(['code-review', 'rules-validator']);
 const TriageConfigSchema = z.object({
-    /** Per-checker max agentic turns. Unspecified checkers use built-in defaults. */
-    maxTurns: z.record(TriageCheckerNameSchema, z.number().int().positive()).optional(),
-    /** Wall-clock timeout per checker, in milliseconds. */
+    /** Abort a checker when its model stream has been silent this long, in milliseconds. */
     timeoutMs: z.number().int().positive().optional(),
 });
 // =============================================================================
@@ -322,6 +318,6 @@ export const HaystackConfigSchema = z.object({
     secrets: z.record(z.string(), SecretDeclarationSchema).optional(),
     /** Merge queue configuration for autonomous PR maintenance */
     merge_queue: MergeQueueConfigSchema.optional(),
-    /** Pre-PR triage configuration (turn budgets, timeouts) */
+    /** Pre-PR triage configuration (stall timeout) */
     triage: TriageConfigSchema.optional(),
 });

package/dist/utils/auth.js

@@ -18,6 +18,15 @@ const TOKEN_FILE_DISPLAY = '~/.haystack/credentials.json';
  */
 export const HEADLESS_TOKEN_FILE = path.join(CONFIG_DIR, 'cli-token');
 const HEADLESS_TOKEN_FILE_DISPLAY = '~/.haystack/cli-token';
+const HEADLESS_TOKEN_PREFIX = 'hsk_live_';
+/**
+ * True for a Haystack headless token (`hsk_live_*`). These authenticate to
+ * Haystack only: they must never be sent to api.github.com or used as a git
+ * push password, where they would leak to GitHub and fail anyway.
+ */
+export function isHeadlessToken(token) {
+    return token.startsWith(HEADLESS_TOKEN_PREFIX);
+}
 const GITHUB_LOGIN_PATTERN = /^[A-Za-z\d](?:[A-Za-z\d]|-(?=[A-Za-z\d])){0,38}$/;
 function emptyStore() {
     return {
@@ -362,13 +371,13 @@ export class NotLoggedInError extends Error {
  *  on-disk file so CI can override without touching the home directory. */
 export async function readHeadlessToken() {
     const envToken = process.env.HAYSTACK_CLI_TOKEN;
-    if (envToken && envToken.startsWith('hsk_live_')) {
+    if (envToken && isHeadlessToken(envToken)) {
         return { token: envToken, label: 'env:HAYSTACK_CLI_TOKEN' };
     }
     try {
         const raw = await fs.readFile(HEADLESS_TOKEN_FILE, 'utf8');
         const parsed = JSON.parse(raw);
-        if (typeof parsed.token === 'string' && parsed.token.startsWith('hsk_live_')) {
+        if (typeof parsed.token === 'string' && isHeadlessToken(parsed.token)) {
             return parsed;
         }
         return null;
@@ -385,6 +394,9 @@ export async function writeHeadlessToken(record) {
     await fs.writeFile(HEADLESS_TOKEN_FILE, JSON.stringify(record, null, 2) + '\n', {
         mode: 0o600,
     });
+    // writeFile's mode only applies when it creates the file; tighten an
+    // existing file too, as saveStore does.
+    await fs.chmod(HEADLESS_TOKEN_FILE, 0o600);
     return HEADLESS_TOKEN_FILE_DISPLAY;
 }
 export async function clearHeadlessToken() {