@hraness/ghostget 0.18.14 → 0.18.16

package/src/derivation-network-guard.ts

@@ -1,20 +1,13 @@
 import { createHash } from "node:crypto";
-import {
-  chmodSync,
-  closeSync,
-  constants,
-  fchmodSync,
-  fstatSync,
-  fsyncSync,
-  lstatSync,
-  mkdirSync,
-  openSync,
-  readSync,
-  unlinkSync,
-  writeSync,
-} from "node:fs";
+import { chmodSync, mkdirSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { basename, dirname, join } from "node:path";
+
+import {
+  assertOwnedPathSync,
+  readOwnedFileStableSync,
+} from "@hraness/local-custody/private-paths";
+import { createPrivateFileOnceSync } from "@hraness/local-custody/atomic-publish";
 
 import { canonicalJson, sha256 } from "./canonical-json";
 import type { ProcessOwnerIdentity } from "./process-identity";
@@ -141,11 +134,6 @@ type GuardRuntimeCase = {
   readonly ruleId: number;
 };
 
-function currentUserOwns(uid: number | bigint): boolean {
-  const current = typeof process.getuid === "function" ? process.getuid() : undefined;
-  return current === undefined || uid === (typeof uid === "bigint" ? BigInt(current) : current);
-}
-
 function escapeRegex(value: string): string {
   return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
 }
@@ -307,14 +295,11 @@ function extensionIdFromKey(): string {
 
 function inspectDirectory(path: string): GuardDirectoryIdentity {
   try {
-    const stats = lstatSync(path, { bigint: true });
-    if (
-      !stats.isDirectory()
-      || stats.isSymbolicLink()
-      || !currentUserOwns(stats.uid)
-      || (stats.mode & 0o777n) !== 0o700n
-    ) throw new Error("unsafe");
-    return { device: stats.dev.toString(), inode: stats.ino.toString() };
+    const identity = assertOwnedPathSync(path, {
+      kind: "directory",
+      exactMode: 0o700,
+    });
+    return { device: identity.dev.toString(), inode: identity.ino.toString() };
   } catch {
     throw new Error("derivation network guard directory is unavailable or unsafe");
   }
@@ -325,71 +310,18 @@ function sameIdentity(left: GuardDirectoryIdentity, right: GuardDirectoryIdentit
 }
 
 export function writeGuardPrivateFile(path: string, content: string): GuardPrivateFileEvidence {
-  let descriptor: number | null = null;
-  let openedIdentity: GuardDirectoryIdentity | null = null;
-  let completed = false;
   try {
-    descriptor = openSync(
-      path,
-      constants.O_WRONLY
-        | constants.O_CREAT
-        | constants.O_EXCL
-        | ("O_NOFOLLOW" in constants ? constants.O_NOFOLLOW : 0),
-      0o600,
-    );
-    const opened = fstatSync(descriptor, { bigint: true });
-    openedIdentity = { device: opened.dev.toString(), inode: opened.ino.toString() };
-    fchmodSync(descriptor, 0o600);
-    const bytes = Buffer.from(content, "utf8");
-    let offset = 0;
-    while (offset < bytes.byteLength) {
-      offset += writeSync(descriptor, bytes, offset, bytes.byteLength - offset);
-    }
-    fsyncSync(descriptor);
-    const stats = fstatSync(descriptor, { bigint: true });
-    if (
-      !stats.isFile()
-      || !currentUserOwns(stats.uid)
-      || (stats.mode & 0o777n) !== 0o600n
-      || stats.size !== BigInt(bytes.byteLength)
-    ) throw new Error("derivation network guard file could not be secured");
-    const evidence = {
-      device: stats.dev.toString(),
-      inode: stats.ino.toString(),
-      byteLength: bytes.byteLength,
+    const outcome = createPrivateFileOnceSync(dirname(path), basename(path), content);
+    if (outcome !== "created") throw new Error("exists");
+    const identity = assertOwnedPathSync(path, { kind: "file", exactMode: 0o600 });
+    return {
+      device: identity.dev.toString(),
+      inode: identity.ino.toString(),
+      byteLength: Buffer.byteLength(content, "utf8"),
       sha256: sha256(content),
     };
-    completed = true;
-    return evidence;
   } catch {
     throw new Error("derivation network guard file could not be secured");
-  } finally {
-    if (descriptor !== null) {
-      if (!completed && openedIdentity === null) {
-        try {
-          const stats = fstatSync(descriptor, { bigint: true });
-          openedIdentity = { device: stats.dev.toString(), inode: stats.ino.toString() };
-        } catch {
-          // Without an exact identity, preserve the path instead of unlinking.
-        }
-      }
-      try {
-        closeSync(descriptor);
-      } catch {
-        // The categorical write failure below must not expose a local path.
-      }
-    }
-    if (!completed && openedIdentity !== null) {
-      try {
-        const current = lstatSync(path, { bigint: true });
-        if (
-          current.dev.toString() === openedIdentity.device
-          && current.ino.toString() === openedIdentity.inode
-        ) unlinkSync(path);
-      } catch {
-        // A changed path is intentionally preserved.
-      }
-    }
   }
 }
 
@@ -397,55 +329,23 @@ export function readGuardPrivateFile(
   path: string,
   maximumBytes = 4 * 1024 * 1024,
 ): { readonly content: string; readonly evidence: GuardPrivateFileEvidence } {
-  let descriptor: number | null = null;
   try {
-    descriptor = openSync(
-      path,
-      constants.O_RDONLY | ("O_NOFOLLOW" in constants ? constants.O_NOFOLLOW : 0),
-    );
-    const before = fstatSync(descriptor, { bigint: true });
-    if (
-      !before.isFile()
-      || !currentUserOwns(before.uid)
-      || (before.mode & 0o777n) !== 0o600n
-      || before.size < 1n
-      || before.size > BigInt(maximumBytes)
-    ) throw new Error("derivation network guard file is unavailable or unsafe");
-    const bytes = Buffer.alloc(Number(before.size));
-    let offset = 0;
-    while (offset < bytes.byteLength) {
-      const count = readSync(descriptor, bytes, offset, bytes.byteLength - offset, null);
-      if (count === 0) throw new Error("derivation network guard file changed size");
-      offset += count;
-    }
-    const after = fstatSync(descriptor, { bigint: true });
-    if (
-      before.dev !== after.dev
-      || before.ino !== after.ino
-      || before.size !== after.size
-      || before.mtimeNs !== after.mtimeNs
-      || before.ctimeNs !== after.ctimeNs
-    ) throw new Error("derivation network guard file changed while reading");
-    const content = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    const read = readOwnedFileStableSync(path, maximumBytes, {
+      exactMode: 0o600,
+      minimumBytes: 1n,
+    });
+    const content = new TextDecoder("utf-8", { fatal: true }).decode(read.bytes);
     return {
       content,
       evidence: {
-        device: before.dev.toString(),
-        inode: before.ino.toString(),
-        byteLength: bytes.byteLength,
+        device: read.dev.toString(),
+        inode: read.ino.toString(),
+        byteLength: read.bytes.byteLength,
         sha256: sha256(content),
       },
     };
   } catch {
     throw new Error("derivation network guard file is unavailable or unsafe");
-  } finally {
-    if (descriptor !== null) {
-      try {
-        closeSync(descriptor);
-      } catch {
-        // Keep diagnostics categorical and path-free.
-      }
-    }
   }
 }
 
@@ -484,48 +384,20 @@ export function verifyGuardPrivateFile(
   expected: GuardPrivateFileEvidence,
   expectedContent: string,
 ): void {
-  let descriptor: number | null = null;
   try {
-    descriptor = openSync(
-      path,
-      constants.O_RDONLY | ("O_NOFOLLOW" in constants ? constants.O_NOFOLLOW : 0),
-    );
-    const before = fstatSync(descriptor, { bigint: true });
+    const read = readOwnedFileStableSync(path, expected.byteLength, {
+      exactMode: 0o600,
+      minimumBytes: 1n,
+    });
     if (
-      !before.isFile()
-      || !currentUserOwns(before.uid)
-      || (before.mode & 0o777n) !== 0o600n
-      || before.dev.toString() !== expected.device
-      || before.ino.toString() !== expected.inode
-      || before.size !== BigInt(expected.byteLength)
-    ) throw new Error("derivation network guard file changed identity");
-    const bytes = Buffer.alloc(expected.byteLength);
-    let offset = 0;
-    while (offset < bytes.byteLength) {
-      const count = readSync(descriptor, bytes, offset, bytes.byteLength - offset, null);
-      if (count === 0) throw new Error("derivation network guard file changed size");
-      offset += count;
-    }
-    const after = fstatSync(descriptor, { bigint: true });
-    if (
-      before.dev !== after.dev
-      || before.ino !== after.ino
-      || before.size !== after.size
-      || before.mtimeNs !== after.mtimeNs
-      || before.ctimeNs !== after.ctimeNs
-      || bytes.toString("utf8") !== expectedContent
+      read.dev.toString() !== expected.device
+      || read.ino.toString() !== expected.inode
+      || read.bytes.byteLength !== expected.byteLength
+      || read.bytes.toString("utf8") !== expectedContent
       || sha256(expectedContent) !== expected.sha256
-    ) throw new Error("derivation network guard file changed content");
+    ) throw new Error("derivation network guard file changed");
   } catch {
     throw new Error("derivation network guard file changed or is unavailable");
-  } finally {
-    if (descriptor !== null) {
-      try {
-        closeSync(descriptor);
-      } catch {
-        // Keep diagnostics categorical and path-free.
-      }
-    }
   }
 }
 

package/src/derivation-network-proxy-helper.ts

@@ -1,17 +1,17 @@
 #!/usr/bin/env bun
 import {
   chmodSync,
-  closeSync,
-  constants,
-  fstatSync,
   lstatSync,
-  openSync,
-  readSync,
   rmdirSync,
   unlinkSync,
 } from "node:fs";
 import { createServer, type Server, type Socket } from "node:net";
 
+import {
+  assertOwnedPathSync,
+  readOwnedFileStableSync,
+} from "@hraness/local-custody/private-paths";
+
 import {
   DERIVATION_GUARD_PROXY_CONFIG,
   DERIVATION_GUARD_PROXY_READY,
@@ -39,11 +39,6 @@ function injectFailureForTest(stage: HelperFailureStage): void {
   ) throw new Error("injected derivation proxy helper failure");
 }
 
-function currentUserOwns(uid: number | bigint): boolean {
-  const current = typeof process.getuid === "function" ? process.getuid() : undefined;
-  return current === undefined || uid === (typeof uid === "bigint" ? BigInt(current) : current);
-}
-
 function sameIdentity(left: GuardDirectoryIdentity, right: GuardDirectoryIdentity): boolean {
   return left.device === right.device && left.inode === right.inode;
 }
@@ -95,25 +90,23 @@ function provisionalReadyFileIsAbsent(): boolean {
 }
 
 function inspectPrivateDirectory(path: string): GuardDirectoryIdentity {
-  const stats = lstatSync(path, { bigint: true });
-  if (
-    !stats.isDirectory()
-    || stats.isSymbolicLink()
-    || !currentUserOwns(stats.uid)
-    || (stats.mode & 0o777n) !== 0o700n
-  ) throw new Error("derivation proxy directory is unavailable or unsafe");
-  return { device: stats.dev.toString(), inode: stats.ino.toString() };
+  let identity: { readonly dev: number; readonly ino: number };
+  try {
+    identity = assertOwnedPathSync(path, { kind: "directory", exactMode: 0o700 });
+  } catch {
+    throw new Error("derivation proxy directory is unavailable or unsafe");
+  }
+  return { device: identity.dev.toString(), inode: identity.ino.toString() };
 }
 
 function inspectPrivateControlSocket(path: string): GuardDirectoryIdentity {
-  const stats = lstatSync(path, { bigint: true });
-  if (
-    !stats.isSocket()
-    || stats.isSymbolicLink()
-    || !currentUserOwns(stats.uid)
-    || (stats.mode & 0o777n) !== 0o600n
-  ) throw new Error("derivation proxy control socket is unavailable or unsafe");
-  return { device: stats.dev.toString(), inode: stats.ino.toString() };
+  let identity: { readonly dev: number; readonly ino: number };
+  try {
+    identity = assertOwnedPathSync(path, { kind: "socket", exactMode: 0o600 });
+  } catch {
+    throw new Error("derivation proxy control socket is unavailable or unsafe");
+  }
+  return { device: identity.dev.toString(), inode: identity.ino.toString() };
 }
 
 function unlinkExactControlSocket(
@@ -147,38 +140,16 @@ function waitForSocketClose(socket: Socket): Promise<void> {
 }
 
 function readPrivateConfig(): unknown {
-  const descriptor = openSync(
-    DERIVATION_GUARD_PROXY_CONFIG,
-    constants.O_RDONLY | ("O_NOFOLLOW" in constants ? constants.O_NOFOLLOW : 0),
-  );
+  let read: ReturnType<typeof readOwnedFileStableSync>;
   try {
-    const before = fstatSync(descriptor, { bigint: true });
-    if (
-      !before.isFile()
-      || !currentUserOwns(before.uid)
-      || (before.mode & 0o777n) !== 0o600n
-      || before.size < 1n
-      || before.size > BigInt(MAX_CONFIG_BYTES)
-    ) throw new Error("derivation proxy config is unavailable or unsafe");
-    const bytes = Buffer.alloc(Number(before.size));
-    let offset = 0;
-    while (offset < bytes.byteLength) {
-      const count = readSync(descriptor, bytes, offset, bytes.byteLength - offset, null);
-      if (count === 0) throw new Error("derivation proxy config changed size");
-      offset += count;
-    }
-    const after = fstatSync(descriptor, { bigint: true });
-    if (
-      before.dev !== after.dev
-      || before.ino !== after.ino
-      || before.size !== after.size
-      || before.mtimeNs !== after.mtimeNs
-      || before.ctimeNs !== after.ctimeNs
-    ) throw new Error("derivation proxy config changed while reading");
-    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes)) as unknown;
-  } finally {
-    closeSync(descriptor);
+    read = readOwnedFileStableSync(DERIVATION_GUARD_PROXY_CONFIG, MAX_CONFIG_BYTES, {
+      exactMode: 0o600,
+      minimumBytes: 1n,
+    });
+  } catch {
+    throw new Error("derivation proxy config is unavailable or unsafe");
   }
+  return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(read.bytes)) as unknown;
 }
 
 function exactKeys(record: Record<string, unknown>, expected: readonly string[]): boolean {

package/src/derive.ts

@@ -22,6 +22,7 @@ import {
 } from "@hraness/kb/clip/acquire";
 import { isPrivateAddress, isPrivateHostname } from "@hraness/kb/clip/network";
 import type { StrictCookie } from "@hraness/kb/clip/cookies";
+import { assertOwnedPathSync } from "@hraness/local-custody/private-paths";
 import type { GhostgetAuth } from "./auth";
 import {
   agentBrowserFailure,
@@ -234,14 +235,14 @@ function ownedByCurrentUser(uid: number | bigint): boolean {
 }
 
 function inspectDirectoryIdentity(path: string): DirectoryIdentity {
-  const stats = lstatSync(path, { bigint: true });
-  if (
-    !stats.isDirectory()
-    || stats.isSymbolicLink()
-    || !ownedByCurrentUser(stats.uid)
-    || (stats.mode & 0o777n) !== 0o700n
-  ) throw new Error("derivation session directory is unsafe");
-  return { device: stats.dev.toString(), inode: stats.ino.toString() };
+  let identity: { readonly dev: number; readonly ino: number };
+  try {
+    identity = assertOwnedPathSync(path, { kind: "directory", exactMode: 0o700 });
+  } catch (error) {
+    if (hasErrorCode(error, "ENOENT")) throw error;
+    throw new Error("derivation session directory is unsafe", { cause: error });
+  }
+  return { device: identity.dev.toString(), inode: identity.ino.toString() };
 }
 
 function parseDirectoryIdentity(value: unknown): DirectoryIdentity {
@@ -1101,25 +1102,21 @@ function inspectPrivateFile(
   maximumBytes: number,
   label: string,
 ): Omit<PrivateFileEvidence, "sha256"> {
-  const stats = (() => {
-    try {
-      return lstatSync(path, { bigint: true });
-    } catch (error) {
-      throw new Error(`${label} is unavailable or unsafe`, { cause: error });
-    }
-  })();
-  if (
-    !stats.isFile()
-    || stats.isSymbolicLink()
-    || !ownedByCurrentUser(stats.uid)
-    || (stats.mode & 0o077n) !== 0n
-    || stats.size < 1n
-    || stats.size > BigInt(maximumBytes)
-  ) throw new Error(`${label} is unavailable or unsafe`);
+  let identity: { readonly dev: number; readonly ino: number; readonly size: number };
+  try {
+    identity = assertOwnedPathSync(path, {
+      kind: "file",
+      ownerOnly: true,
+      minimumBytes: 1n,
+      maximumBytes: BigInt(maximumBytes),
+    });
+  } catch (error) {
+    throw new Error(`${label} is unavailable or unsafe`, { cause: error });
+  }
   return {
-    device: stats.dev.toString(),
-    inode: stats.ino.toString(),
-    byteLength: Number(stats.size),
+    device: identity.dev.toString(),
+    inode: identity.ino.toString(),
+    byteLength: identity.size,
   };
 }
 
@@ -1444,18 +1441,20 @@ function inspectCapturedHar(path: string): {
   readonly inode: string;
   readonly byteLength: number;
 } {
-  const stats = lstatSync(path, { bigint: true });
-  if (
-    !stats.isFile()
-    || stats.isSymbolicLink()
-    || !ownedByCurrentUser(stats.uid)
-    || stats.size < 1n
-    || stats.size > BigInt(MAX_HAR_BYTES)
-  ) throw new Error("derivation review HAR is unavailable or unsafe");
+  let identity: { readonly dev: number; readonly ino: number; readonly size: number };
+  try {
+    identity = assertOwnedPathSync(path, {
+      kind: "file",
+      minimumBytes: 1n,
+      maximumBytes: BigInt(MAX_HAR_BYTES),
+    });
+  } catch (error) {
+    throw new Error("derivation review HAR is unavailable or unsafe", { cause: error });
+  }
   return {
-    device: stats.dev.toString(),
-    inode: stats.ino.toString(),
-    byteLength: Number(stats.size),
+    device: identity.dev.toString(),
+    inode: identity.ino.toString(),
+    byteLength: identity.size,
   };
 }
 

package/src/ghostget.ts

@@ -22,6 +22,7 @@ import {
   saveAuth,
   type GhostgetAuth,
 } from "./auth";
+import { runAccountsDeviceLogin, runAccountsSignOut } from "./accounts-auth";
 import {
   isPublicWebSessionInvocationAuthority,
   type InvocationAuthority,
@@ -1983,6 +1984,48 @@ async function runCommand(
     output.stdout(renderGhostgetUsage());
     return 0;
   }
+  if (arguments_.command === "login") {
+    const result = await runAccountsDeviceLogin(
+      environment,
+      {
+        onUserCode: (userCode, verificationUri) => {
+          output.stderr(
+            `Open ${safe(verificationUri)} in a browser where you are already signed in to Hraness Accounts and enter code: ${safe(userCode)}\n`,
+          );
+        },
+        onPending: () => {
+          output.stderr("Waiting for browser approval...\n");
+        },
+        onSlowDown: () => {
+          output.stderr("Polling more slowly...\n");
+        },
+      },
+      undefined,
+      signal,
+    );
+    if (arguments_.json) {
+      output.stdout(exactTerminalJson({ ok: result.kind === "success", ...result }));
+    } else if (result.kind === "success") {
+      output.stdout(`${safe(result.message)}\n`);
+    } else if (result.kind === "denied") {
+      output.stderr("Login was denied in the browser.\n");
+    } else if (result.kind === "expired") {
+      output.stderr("The sign-in code expired. Run 'ghostget login' again.\n");
+    } else {
+      output.stderr(`Login failed: ${safe(result.message)}\n`);
+    }
+    return result.kind === "success" ? 0 : 3;
+  }
+  if (arguments_.command === "logout") {
+    await runAccountsSignOut(environment);
+    const message = "Signed out of Hraness Accounts.";
+    if (arguments_.json) {
+      output.stdout(exactTerminalJson({ ok: true, message }));
+    } else {
+      output.stdout(`${message}\n`);
+    }
+    return 0;
+  }
   if (arguments_.command === "whatsapp-automation-install") {
     const { installReviewedWhatsAppAutomationBinary } = await import("./providers/whatsapp-automation-runtime");
     const installed = arguments_.binary === undefined

package/src/providers/x-web-runtime.ts

@@ -153,8 +153,8 @@ const viewerEvidence = Object.freeze({
   operationName: "Viewer",
   operationType: "query" as const,
   queryId: "9t128XgFic52jPUEkJMf6w",
-  sourceChunk: "main.59435dbf6f40166da.js",
-  observedOn: "2026-09-13",
+  sourceChunk: "main.52fc4dd0aada586aa.js",
+  observedOn: "2026-09-17",
 });
 
 function isRecord(value: unknown): value is JsonRecord {
@@ -722,10 +722,10 @@ async function currentChunkText(bootstrap: XBootstrap, sourceChunk: string): Pro
 }
 
 const articleRichContractEvidence = Object.freeze({
-  uploader: "shared~bundle.LoggedInMain~ondemand.HoverCard~loader.AudioDock~loader.Dock~bundle.BookmarkFolders~bundle.Book.a9bac6ba.js",
-  entities: "shared~bundle.TwitterArticles~ondemand.Verified~bundle.SettingsExtendedProfile~bundle.WorkHistory.d1314bba.js",
-  converter: "shared~bundle.Grok~bundle.GrokDrawer~bundle.ReaderMode~bundle.Birdwatch~bundle.TwitterArticles~bundle.Compose.02f6dc7a.js",
-  observedOn: "2026-08-14",
+  uploader: "shared~bundle.LoggedInMain~ondemand.HoverCard~loader.AudioDock~loader.Dock~bundle.BookmarkFolders~bundle.Book.9549529d09fb73baa.js",
+  entities: "shared~bundle.TwitterArticles~ondemand.Verified~bundle.SettingsExtendedProfile~bundle.WorkHistory.f5f6edfb2fe9ac4ca.js",
+  converter: "shared~bundle.Grok~bundle.GrokDrawer~bundle.ReaderMode~bundle.Birdwatch~bundle.TwitterArticles~bundle.Compose.c851d723cd517177a.js",
+  observedOn: "2026-09-17",
 });
 
 function requireCurrentBundleTokens(text: string, tokens: readonly string[], label: string): void {
@@ -743,10 +743,10 @@ async function assertCurrentArticleRichContract(
     currentChunkText(bootstrap, articleRichContractEvidence.converter),
   ]);
   requireCurrentBundleTokens(entities, [
-    'createEntity(w.Sg,"MUTABLE",{url:',
+    'createEntity(E.Sg,"MUTABLE",{url:',
   ], "Article entity");
   requireCurrentBundleTokens(converter, [
-    'mutability:s[r.mutability]',
+    'mutability:s[i.mutability]',
     'inline_style_ranges:',
   ], "Article content converter");
   if (!includeImages) return;
@@ -767,12 +767,12 @@ async function assertCurrentArticleRichContract(
     'TwitterArticle:"twitter_article"',
   ], "media uploader");
   requireCurrentBundleTokens(entities, [
-    'createEntity(p.LA.MEDIA,p.Ei.IMMUTABLE',
-    'mediaCategory:E(e)',
+    'createEntity(g.LA.MEDIA,g.Ei.IMMUTABLE',
+    'mediaCategory:K(e)',
     'mediaId:e.uploadId',
   ], "Article entity");
   requireCurrentBundleTokens(converter, [
-    'media_items:r.data?.mediaItems?.map',
+    'media_items:i.data?.mediaItems?.map',
     'media_category:e.mediaCategory',
   ], "Article content converter");
 }