@hearsay-tools/squawk 0.17.0-dev.5723 → 0.17.0-dev.5728

package/dist/delegation/entry-exists.d.ts

@@ -0,0 +1,2 @@
+/** Whether a directory entry exists at `path`, without following a final symlink. Any error but ENOENT throws. */
+export declare function entryExists(path: string): Promise<boolean>;

package/dist/delegation/entry-exists.js

@@ -0,0 +1,10 @@
+import { lstat } from 'node:fs/promises';
+/** Whether a directory entry exists at `path`, without following a final symlink. Any error but ENOENT throws. */
+export async function entryExists(path) {
+    return lstat(path).then(() => true, (error) => {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    });
+}
+//# sourceMappingURL=entry-exists.js.map

package/dist/delegation/entry-exists.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-exists.js","sourceRoot":"","sources":["../../src/delegation/entry-exists.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEzC,kHAAkH;AAClH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY;IAC5C,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,KAA4B,EAAE,EAAE;QACnE,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/delegation/identity-file-store.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Where the ownership policy in `workspace.ts` keeps its identity files: the receipt directory,
+ * receipts, cleanup checkpoints and Git administration markers. The store owns the platform's
+ * safety rules; the policy owns what the files prove (ADR 0032).
+ *
+ * A process entry installs the store for its host. Only entries import the Windows store, so the
+ * policy and its many importers never load it (hearsay-tools/cezarion#3244).
+ */
+export interface IdentityFileStore {
+    /** Create the private receipt directory when `create` is set, and refuse an existing unsafe one. */
+    directory(path: string, create: boolean): Promise<void>;
+    /** Read an identity file of at most `cap` bytes. `privateParent` is false for a marker in Git's admin directory. */
+    read(path: string, cap: number, privateParent: boolean): Promise<string>;
+    /** Create a new private identity file; fail when one exists. */
+    write(path: string, content: string, privateParent: boolean): Promise<void>;
+    /** Replace a private identity file atomically. `assertCurrent` throws when the caller lost ownership. */
+    replace(path: string, content: string, cap: number, assertCurrent?: () => void): Promise<void>;
+}
+/** Install the store for this process; `undefined` restores the host default. */
+export declare function installIdentityFileStore(store: IdentityFileStore | undefined): void;
+/** The installed store, else the POSIX store on a non-Windows host. Windows has no default. */
+export declare function identityFileStore(): IdentityFileStore;

package/dist/delegation/identity-file-store.js

@@ -0,0 +1,16 @@
+import { posixIdentityFileStore } from './posix-workspace-identity.js';
+let installed;
+/** Install the store for this process; `undefined` restores the host default. */
+export function installIdentityFileStore(store) {
+    installed = store;
+}
+/** The installed store, else the POSIX store on a non-Windows host. Windows has no default. */
+export function identityFileStore() {
+    if (installed)
+        return installed;
+    if (process.platform === 'win32') {
+        throw new Error('No workspace identity store is installed: a Windows process entry must call installWindowsIdentityStore');
+    }
+    return posixIdentityFileStore;
+}
+//# sourceMappingURL=identity-file-store.js.map

package/dist/delegation/identity-file-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-file-store.js","sourceRoot":"","sources":["../../src/delegation/identity-file-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAqBvE,IAAI,SAAwC,CAAC;AAE7C,iFAAiF;AACjF,MAAM,UAAU,wBAAwB,CAAC,KAAoC;IAC3E,SAAS,GAAG,KAAK,CAAC;AACpB,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,iBAAiB;IAC/B,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,yGAAyG,CAAC,CAAC;IAC7H,CAAC;IACD,OAAO,sBAAsB,CAAC;AAChC,CAAC"}

package/dist/delegation/posix-workspace-identity.d.ts

@@ -0,0 +1,3 @@
+import type { IdentityFileStore } from './identity-file-store.ts';
+/** Mode bits and no-follow opens: the directory is 0700, each file 0600, and a replace renames a temporary file. */
+export declare const posixIdentityFileStore: IdentityFileStore;

package/dist/delegation/posix-workspace-identity.js

@@ -0,0 +1,68 @@
+import { randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { lstat, mkdir, open, realpath, rename, rm } from 'node:fs/promises';
+import { entryExists as exists } from './entry-exists.js';
+async function directory(dir, create) {
+    if (create)
+        await mkdir(dir, { mode: 0o700 }).catch((error) => {
+            if (error.code !== 'EEXIST')
+                throw error;
+        });
+    if (await exists(dir)) {
+        const info = await lstat(dir);
+        if (!info.isDirectory() || info.isSymbolicLink() || await realpath(dir) !== dir || (info.mode & 0o077) !== 0) {
+            throw new Error('Unsafe owned workspace receipt directory');
+        }
+    }
+}
+async function read(path, cap) {
+    const info = await lstat(path);
+    if (!info.isFile() || info.isSymbolicLink())
+        throw new Error('Unsafe owned workspace identity file');
+    const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const opened = await file.stat();
+        if (!opened.isFile() || opened.size > cap || (opened.mode & 0o077) !== 0)
+            throw new Error('Unsafe owned workspace identity file');
+        const buffer = Buffer.alloc(cap + 1);
+        const { bytesRead } = await file.read(buffer, 0, buffer.length, 0);
+        if (bytesRead > cap)
+            throw new Error('Oversized owned workspace identity file');
+        return buffer.subarray(0, bytesRead).toString('utf8');
+    }
+    finally {
+        await file.close();
+    }
+}
+async function write(path, content) {
+    const file = await open(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+    try {
+        await file.writeFile(content);
+        await file.sync();
+    }
+    finally {
+        await file.close();
+    }
+}
+async function replace(path, content, cap, assertCurrent) {
+    if (await exists(path))
+        await read(path, cap);
+    assertCurrent?.();
+    const temporary = `${path}.${randomUUID()}.tmp`;
+    await write(temporary, content);
+    try {
+        assertCurrent?.();
+        await rename(temporary, path);
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+}
+/** Mode bits and no-follow opens: the directory is 0700, each file 0600, and a replace renames a temporary file. */
+export const posixIdentityFileStore = {
+    directory,
+    read: (path, cap) => read(path, cap),
+    write: (path, content) => write(path, content),
+    replace,
+};
+//# sourceMappingURL=posix-workspace-identity.js.map

package/dist/delegation/posix-workspace-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"posix-workspace-identity.js","sourceRoot":"","sources":["../../src/delegation/posix-workspace-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAE5E,OAAO,EAAE,WAAW,IAAI,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE1D,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,MAAe;IACnD,IAAI,MAAM;QAAE,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAA4B,EAAE,EAAE;YACnF,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QAC3C,CAAC,CAAC,CAAC;IACH,IAAI,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7G,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;AACH,CAAC;AACD,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,GAAW;IAC3C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACrG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAChG,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAClI,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACrC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACnE,IAAI,SAAS,GAAG,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAChF,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC;YAAS,CAAC;QAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACnC,CAAC;AACD,KAAK,UAAU,KAAK,CAAC,IAAY,EAAE,OAAe;IAChD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACvH,IAAI,CAAC;QAAC,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AAC3F,CAAC;AACD,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,OAAe,EAAE,GAAW,EAAE,aAA0B;IAC3F,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9C,aAAa,EAAE,EAAE,CAAC;IAClB,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;IAChD,MAAM,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC;QAAC,aAAa,EAAE,EAAE,CAAC;QAAC,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AAC7G,CAAC;AAED,oHAAoH;AACpH,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD,SAAS;IACT,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC;IACpC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC;IAC9C,OAAO;CACR,CAAC"}

package/dist/delegation/routes.d.ts

@@ -27,6 +27,18 @@ export declare function delegationFailure(error: unknown): {
 export declare function createDelegationRoutes(service: DelegationService, credentials: CredentialRegistry): import("hono/hono-base").HonoBase<Env, {
     "/list": {
         $get: {
+            output: {
+                error: string;
+                code?: "invalid_input" | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+            input: {
+                query: {
+                    offset?: string | undefined;
+                };
+            };
+        } | {
             output: {
                 workers: {
                     workerId: string;
@@ -64,24 +76,21 @@ export declare function createDelegationRoutes(service: DelegationService, crede
                     offset?: string | undefined;
                 };
             };
-        } | {
-            output: {
-                error: string;
-                code?: "invalid_input" | undefined;
-            };
-            outputFormat: "json";
-            status: 400;
-            input: {
-                query: {
-                    offset?: string | undefined;
-                };
-            };
         };
     };
 } & {
     "/discover": {
         $post: {
             output: {
+                scope: "host-default-account";
+                runners: {
+                    status: "connected" | "disconnected" | "not-installed" | "unknown";
+                    enabled?: boolean | undefined;
+                    hint?: string | undefined;
+                    authFailureId?: string | undefined;
+                    runner: "claude" | "codex" | "cursor" | "omp" | "opencode" | "pi";
+                }[];
+            } | {
                 tasks: {
                     id: string;
                     title: string;
@@ -93,15 +102,6 @@ export declare function createDelegationRoutes(service: DelegationService, crede
                     reason?: string | undefined;
                 }[];
                 nextOffset?: number | undefined;
-            } | {
-                scope: "host-default-account";
-                runners: {
-                    status: "connected" | "disconnected" | "not-installed" | "unknown";
-                    enabled?: boolean | undefined;
-                    hint?: string | undefined;
-                    authFailureId?: string | undefined;
-                    runner: "claude" | "codex" | "cursor" | "omp" | "opencode" | "pi";
-                }[];
             } | {
                 runner: "claude" | "codex" | "cursor" | "omp" | "opencode" | "pi";
                 models: {
@@ -221,13 +221,13 @@ export declare function createDelegationRoutes(service: DelegationService, crede
             status: 200;
             input: {
                 json: {
-                    requestIds: string[];
-                    mode?: "all" | "any" | "one" | undefined;
-                    timeoutSeconds?: number | undefined;
-                } | {
                     workerIds: string[];
                     timeoutSeconds?: number | undefined;
                     mode?: "all" | "any" | "one" | undefined;
+                } | {
+                    requestIds: string[];
+                    mode?: "all" | "any" | "one" | undefined;
+                    timeoutSeconds?: number | undefined;
                 } | {
                     peerIds: string[];
                     timeoutSeconds?: number | undefined;
@@ -613,6 +613,18 @@ export declare function createDelegationRoutes(service: DelegationService, crede
 } & {
     "/:workerId": {
         $get: {
+            output: {
+                error: string;
+                code?: "invalid_input" | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+            input: {
+                param: {
+                    workerId: string;
+                };
+            };
+        } | {
             output: {
                 workerId: string;
                 parentRunId: string;
@@ -716,7 +728,11 @@ export declare function createDelegationRoutes(service: DelegationService, crede
                     workerId: string;
                 };
             };
-        } | {
+        };
+    };
+} & {
+    "/:workerId/collect": {
+        $post: {
             output: {
                 error: string;
                 code?: "invalid_input" | undefined;
@@ -727,12 +743,10 @@ export declare function createDelegationRoutes(service: DelegationService, crede
                 param: {
                     workerId: string;
                 };
+            } & {
+                json: Record<string, never>;
             };
-        };
-    };
-} & {
-    "/:workerId/collect": {
-        $post: {
+        } | {
             output: {
                 workerId: string;
                 parentRunId: string;
@@ -834,7 +848,11 @@ export declare function createDelegationRoutes(service: DelegationService, crede
             } & {
                 json: Record<string, never>;
             };
-        } | {
+        };
+    };
+} & {
+    "/:workerId/steer": {
+        $post: {
             output: {
                 error: string;
                 code?: "invalid_input" | undefined;
@@ -846,13 +864,11 @@ export declare function createDelegationRoutes(service: DelegationService, crede
                     workerId: string;
                 };
             } & {
-                json: Record<string, never>;
+                json: {
+                    text: string;
+                };
             };
-        };
-    };
-} & {
-    "/:workerId/steer": {
-        $post: {
+        } | {
             output: {
                 workerId: string;
                 state: "delivered" | "queued";
@@ -868,7 +884,11 @@ export declare function createDelegationRoutes(service: DelegationService, crede
                     text: string;
                 };
             };
-        } | {
+        };
+    };
+} & {
+    "/:workerId/stop": {
+        $post: {
             output: {
                 error: string;
                 code?: "invalid_input" | undefined;
@@ -880,15 +900,9 @@ export declare function createDelegationRoutes(service: DelegationService, crede
                     workerId: string;
                 };
             } & {
-                json: {
-                    text: string;
-                };
+                json: Record<string, never>;
             };
-        };
-    };
-} & {
-    "/:workerId/stop": {
-        $post: {
+        } | {
             output: {
                 workerId: string;
                 state: "stopping" | "terminated";
@@ -902,7 +916,11 @@ export declare function createDelegationRoutes(service: DelegationService, crede
             } & {
                 json: Record<string, never>;
             };
-        } | {
+        };
+    };
+} & {
+    "/:workerId/destroy": {
+        $post: {
             output: {
                 error: string;
                 code?: "invalid_input" | undefined;
@@ -916,11 +934,7 @@ export declare function createDelegationRoutes(service: DelegationService, crede
             } & {
                 json: Record<string, never>;
             };
-        };
-    };
-} & {
-    "/:workerId/destroy": {
-        $post: {
+        } | {
             output: {
                 workerId: string;
                 state: "complete" | "incomplete";
@@ -943,20 +957,6 @@ export declare function createDelegationRoutes(service: DelegationService, crede
             } & {
                 json: Record<string, never>;
             };
-        } | {
-            output: {
-                error: string;
-                code?: "invalid_input" | undefined;
-            };
-            outputFormat: "json";
-            status: 400;
-            input: {
-                param: {
-                    workerId: string;
-                };
-            } & {
-                json: Record<string, never>;
-            };
         } | {
             output: {
                 workerId: string;
@@ -986,13 +986,11 @@ export declare function createDelegationRoutes(service: DelegationService, crede
     "/:workerId/diff": {
         $get: {
             output: {
-                workerId: string;
-                baselineSha: string;
-                diff: string;
-                truncated: boolean;
+                error: string;
+                code?: "invalid_input" | undefined;
             };
             outputFormat: "json";
-            status: 200;
+            status: 400;
             input: {
                 param: {
                     workerId: string;
@@ -1000,11 +998,13 @@ export declare function createDelegationRoutes(service: DelegationService, crede
             };
         } | {
             output: {
-                error: string;
-                code?: "invalid_input" | undefined;
+                workerId: string;
+                baselineSha: string;
+                diff: string;
+                truncated: boolean;
             };
             outputFormat: "json";
-            status: 400;
+            status: 200;
             input: {
                 param: {
                     workerId: string;

package/dist/delegation/transport.d.ts

@@ -57,6 +57,15 @@ export declare function createDelegationApp(routes: DelegationRoutes): import("h
     "/discover": {
         $post: {
             output: {
+                scope: "host-default-account";
+                runners: {
+                    status: "connected" | "disconnected" | "not-installed" | "unknown";
+                    enabled?: boolean | undefined;
+                    hint?: string | undefined;
+                    authFailureId?: string | undefined;
+                    runner: "claude" | "codex" | "cursor" | "omp" | "opencode" | "pi";
+                }[];
+            } | {
                 runner: "claude" | "codex" | "cursor" | "omp" | "opencode" | "pi";
                 models: {
                     id: string;
@@ -67,15 +76,6 @@ export declare function createDelegationApp(routes: DelegationRoutes): import("h
                 source: "cache" | "live" | "unavailable";
                 stale: boolean;
                 reason?: string | undefined;
-            } | {
-                scope: "host-default-account";
-                runners: {
-                    status: "connected" | "disconnected" | "not-installed" | "unknown";
-                    enabled?: boolean | undefined;
-                    hint?: string | undefined;
-                    authFailureId?: string | undefined;
-                    runner: "claude" | "codex" | "cursor" | "omp" | "opencode" | "pi";
-                }[];
             } | {
                 tasks: {
                     id: string;
@@ -196,13 +196,13 @@ export declare function createDelegationApp(routes: DelegationRoutes): import("h
             status: 200;
             input: {
                 json: {
-                    workerIds: string[];
-                    timeoutSeconds?: number | undefined;
-                    mode?: "all" | "any" | "one" | undefined;
-                } | {
                     requestIds: string[];
                     mode?: "all" | "any" | "one" | undefined;
                     timeoutSeconds?: number | undefined;
+                } | {
+                    workerIds: string[];
+                    timeoutSeconds?: number | undefined;
+                    mode?: "all" | "any" | "one" | undefined;
                 } | {
                     peerIds: string[];
                     timeoutSeconds?: number | undefined;

package/dist/delegation/windows-identity-store.d.ts

@@ -0,0 +1,5 @@
+import { type IdentityFileStore } from './identity-file-store.ts';
+/** Protected ACLs through the native helper (ADR 0032); a replace overwrites in place, atomically. */
+export declare const windowsIdentityFileStore: IdentityFileStore;
+/** Called by each process entry that reaches `workspace.ts`; installs the Windows store on a Windows host only. */
+export declare function installWindowsIdentityStore(platform?: NodeJS.Platform): void;

package/dist/delegation/windows-identity-store.js

@@ -0,0 +1,15 @@
+import { installIdentityFileStore } from './identity-file-store.js';
+import { windowsIdentityDirectory, windowsReadIdentity, windowsWriteIdentity } from './windows-workspace-identity.js';
+/** Protected ACLs through the native helper (ADR 0032); a replace overwrites in place, atomically. */
+export const windowsIdentityFileStore = {
+    directory: async (path, create) => { windowsIdentityDirectory(path, create); },
+    read: async (path, cap, privateParent) => windowsReadIdentity(path, cap, privateParent),
+    write: async (path, content, privateParent) => { windowsWriteIdentity(path, content, false, privateParent); },
+    replace: async (path, content) => { windowsWriteIdentity(path, content, true); },
+};
+/** Called by each process entry that reaches `workspace.ts`; installs the Windows store on a Windows host only. */
+export function installWindowsIdentityStore(platform = process.platform) {
+    if (platform === 'win32')
+        installIdentityFileStore(windowsIdentityFileStore);
+}
+//# sourceMappingURL=windows-identity-store.js.map

package/dist/delegation/windows-identity-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windows-identity-store.js","sourceRoot":"","sources":["../../src/delegation/windows-identity-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAA0B,MAAM,0BAA0B,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAEtH,sGAAsG;AACtG,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9E,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,aAAa,CAAC;IACvF,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IAC7G,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;CACjF,CAAC;AAEF,mHAAmH;AACnH,MAAM,UAAU,2BAA2B,CAAC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IACtF,IAAI,QAAQ,KAAK,OAAO;QAAE,wBAAwB,CAAC,wBAAwB,CAAC,CAAC;AAC/E,CAAC"}

package/dist/delegation/workspace.js

@@ -1,11 +1,12 @@
 import { projectPaths, fallbackProjectWriteError } from '../project-paths.js';
 import { inspectGeneration } from './process-liveness.js';
 import { waitForTestAppWatcher, withIdleTestApp } from './idle-test-app.js';
-import { windowsIdentityDirectory, windowsReadIdentity, windowsWriteIdentity } from './windows-workspace-identity.js';
+import { identityFileStore } from './identity-file-store.js';
+import { entryExists as exists } from './entry-exists.js';
 import { execFile } from 'node:child_process';
 import { createHash, randomUUID } from 'node:crypto';
 import { constants } from 'node:fs';
-import { lstat, mkdir, mkdtemp, open, readdir, realpath, rename, rm } from 'node:fs/promises';
+import { mkdtemp, open, readdir, realpath, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { dirname, join, normalize } from 'node:path';
 import { z } from 'zod';
@@ -17,8 +18,6 @@ import { resolveTaskDiffBase } from '../git-diff-base.js';
 import { isSafeGitRef } from '../git-refs.js';
 import { DelegationPolicyError } from './policy.js';
 const RECEIPT_CAP = 16_384;
-// Filesystem primitives belong to the host that loaded this module.
-const windowsIdentities = process.platform === 'win32';
 // Identify owned branches by tip and reflog contents, not inode identity.
 // Keep file/logFile fields for older strict checkpoint readers.
 const fileIdentitySchema = z.object({ dev: z.number(), ino: z.number(), birthtimeMs: z.number() }).strict();
@@ -67,22 +66,7 @@ async function writeCleanup(path, value, assertCurrent) {
 }
 async function replaceIdentityFile(path, content, assertCurrent) {
     assertCurrent?.();
-    if (windowsIdentities) {
-        windowsWriteIdentity(path, content, true);
-        return;
-    }
-    if (await exists(path))
-        await readIdentityFile(path, RECEIPT_CAP);
-    assertCurrent?.();
-    const temporary = `${path}.${randomUUID()}.tmp`;
-    await writeIdentityFile(temporary, content);
-    try {
-        assertCurrent?.();
-        await rename(temporary, path);
-    }
-    finally {
-        await rm(temporary, { force: true });
-    }
+    await identityFileStore().replace(path, content, RECEIPT_CAP, assertCurrent);
 }
 function git(cwd, args, index, maxBuffer = 32 * 1024 * 1024) {
     return new Promise((done) => {
@@ -104,13 +88,6 @@ async function checkedGit(cwd, args, index) {
 export async function gitCommonDir(cwd) {
     return realpath(await checkedGit(cwd, ['rev-parse', '--path-format=absolute', '--git-common-dir']));
 }
-async function exists(path) {
-    return lstat(path).then(() => true, (error) => {
-        if (error.code === 'ENOENT')
-            return false;
-        throw error;
-    });
-}
 /** Reads only committed state in the server-known parent cwd; never flushes its edits. */
 export async function resolveWorkerBaseline(repoRoot, parentCwd, baseline) {
     try {
@@ -164,21 +141,7 @@ async function receiptLocation(repoRoot, workspace, create = false) {
 }
 async function receiptDirectory(repoRoot, create) {
     const dir = join(await gitCommonDir(repoRoot), 'cezar-owned-workspaces');
-    if (windowsIdentities) {
-        windowsIdentityDirectory(dir, create);
-        return dir;
-    }
-    if (create)
-        await mkdir(dir, { mode: 0o700 }).catch((error) => {
-            if (error.code !== 'EEXIST')
-                throw error;
-        });
-    if (await exists(dir)) {
-        const info = await lstat(dir);
-        if (!info.isDirectory() || info.isSymbolicLink() || await realpath(dir) !== dir || (info.mode & 0o077) !== 0) {
-            throw new Error('Unsafe owned workspace receipt directory');
-        }
-    }
+    await identityFileStore().directory(dir, create);
     return dir;
 }
 /** The receipt and cleanup checkpoint files in the repository's shared receipt directory, checked
@@ -197,40 +160,11 @@ export function readOwnedWorkspaceRecord(path) {
 export function replaceOwnedWorkspaceRecord(path, content) {
     return replaceIdentityFile(path, content);
 }
-async function readIdentityFile(path, cap, privateParent = true) {
-    if (windowsIdentities)
-        return windowsReadIdentity(path, cap, privateParent);
-    const info = await lstat(path);
-    if (!info.isFile() || info.isSymbolicLink())
-        throw new Error('Unsafe owned workspace identity file');
-    const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
-    try {
-        const opened = await file.stat();
-        if (!opened.isFile() || opened.size > cap || (opened.mode & 0o077) !== 0)
-            throw new Error('Unsafe owned workspace identity file');
-        const buffer = Buffer.alloc(cap + 1);
-        const { bytesRead } = await file.read(buffer, 0, buffer.length, 0);
-        if (bytesRead > cap)
-            throw new Error('Oversized owned workspace identity file');
-        return buffer.subarray(0, bytesRead).toString('utf8');
-    }
-    finally {
-        await file.close();
-    }
+function readIdentityFile(path, cap, privateParent = true) {
+    return identityFileStore().read(path, cap, privateParent);
 }
-async function writeIdentityFile(path, content, privateParent = true) {
-    if (windowsIdentities) {
-        windowsWriteIdentity(path, content, false, privateParent);
-        return;
-    }
-    const file = await open(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
-    try {
-        await file.writeFile(content);
-        await file.sync();
-    }
-    finally {
-        await file.close();
-    }
+function writeIdentityFile(path, content, privateParent = true) {
+    return identityFileStore().write(path, content, privateParent);
 }
 async function readReceipt(path) {
     if (!await exists(path))