@hraness/ghostget 0.18.15 → 0.18.16

package/README.md

@@ -2,7 +2,7 @@
 
 [![Ghostget: precise web capabilities for AI agents](https://ghostget.com/og.png)](https://ghostget.com)
 
-[![skills.sh](https://skills.sh/b/hraness/ghostget)](https://skills.sh/hraness/ghostget)
+[![skills.sh](https://skills.sh/b/hraness/ghostget)](https://www.skills.sh/hraness/ghostget/ghostget)
 
 **Give agents bounded access to pages, media, and connected accounts.**
 
@@ -79,7 +79,7 @@ The protocol and [Agent Skill](skills/ghostget/SKILL.md) describe the handoff.
 
 ## Built-in provider catalog
 
-This v0.18.15 source tree supports executable actions for 20 services: Beeper,
+This v0.18.16 source tree supports executable actions for 20 services: Beeper,
 Bluesky, ClasificadosOnline, Facebook, Facebook Groups, Facebook Marketplace,
 GitHub, Gmail, Hacker News, Instagram, iMessage, LinkedIn, Reddit, Substack,
 Threads, TikTok, Twitch, WhatsApp, X, and YouTube.
@@ -158,9 +158,9 @@ The optional npm mirror can follow later without delaying canonical delivery.
 Install the single Ghostget Agent Skill with either runner:
 
 ```sh
-npx skills add hraness/ghostget#v0.18.15
+npx skills add hraness/ghostget#v0.18.16
 # or
-bunx skills add hraness/ghostget#v0.18.15
+bunx skills add hraness/ghostget#v0.18.16
 ```
 
 The skill teaches Codex, Claude Code, Cursor, and other compatible coding
@@ -170,7 +170,7 @@ install the CLI if it is missing. Start a new agent session after installation.
 After the matching immutable Release exists, install this exact canonical archive:
 
 ```sh
-bun add --global https://github.com/hraness/ghostget/releases/download/v0.18.15/hraness-ghostget-0.18.15.tgz
+bun add --global https://github.com/hraness/ghostget/releases/download/v0.18.16/hraness-ghostget-0.18.16.tgz
 ghostget adapter sync-bundled --json
 ghostget doctor
 ```
@@ -198,7 +198,7 @@ For that same released coordinate, install Ghostget in an agent or application
 that owns its own model, planning, tool loop, approvals, and interface:
 
 ```sh
-bun add https://github.com/hraness/ghostget/releases/download/v0.18.15/hraness-ghostget-0.18.15.tgz
+bun add https://github.com/hraness/ghostget/releases/download/v0.18.16/hraness-ghostget-0.18.16.tgz
 ```
 
 ```ts

package/dist/apple-photos-client.js

@@ -1,7 +1,7 @@
 // @bun
 import {
   GHOSTGET_VERSION
-} from "./index-4tsyncva.js";
+} from "./index-km75a0bm.js";
 import {
   canonicalJson,
   sha256

package/dist/beeper-client.js

@@ -4,7 +4,7 @@ import {
 } from "./index-26yq8q16.js";
 import {
   GHOSTGET_VERSION
-} from "./index-4tsyncva.js";
+} from "./index-km75a0bm.js";
 import {
   canonicalJson,
   sha256

package/dist/{imessage-direct-install-5nftwc6p.js → imessage-direct-install-akfrgtpc.js}

@@ -2,11 +2,11 @@
 import {
   ensureImsgNativeResources,
   verifyImsgNativeResources
-} from "./index-kaav16fd.js";
+} from "./index-k2m73ke6.js";
 import {
   ensurePrivateStateDirectory,
   ghostgetStateHome
-} from "./index-yq6maz71.js";
+} from "./index-wwtk6nnt.js";
 import"./index-gwk7rbyj.js";
 import"./index-z1w83f81.js";
 

package/dist/{index-kaav16fd.js → index-k2m73ke6.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   ensurePrivateStateDirectory
-} from "./index-yq6maz71.js";
+} from "./index-wwtk6nnt.js";
 import {
   __require
 } from "./index-z1w83f81.js";
@@ -162,11 +162,11 @@ async function installBundledMessagingRuntime(provider, environment = process.en
       await file.close();
     }
     if (provider === "imessage") {
-      const { installReviewedImsgBinary } = await import("./imessage-direct-install-5nftwc6p.js");
+      const { installReviewedImsgBinary } = await import("./imessage-direct-install-akfrgtpc.js");
       const result = await installReviewedImsgBinary(path, environment);
       return { version: result.version, sha256: result.executableSha256, alreadyPresent: result.alreadyPresent };
     }
-    const { installReviewedWhatsAppAutomationBinary } = await import("./whatsapp-automation-runtime-ke1dx91p.js");
+    const { installReviewedWhatsAppAutomationBinary } = await import("./whatsapp-automation-runtime-zp2fx46r.js");
     return await installReviewedWhatsAppAutomationBinary(path, environment);
   } finally {
     await unlink(path);

package/dist/{index-4tsyncva.js → index-km75a0bm.js}

@@ -1,5 +1,5 @@
 // @bun
 // src/version.ts
-var GHOSTGET_VERSION = "0.18.15";
+var GHOSTGET_VERSION = "0.18.16";
 
 export { GHOSTGET_VERSION };

package/dist/{index-yq6maz71.js → index-wwtk6nnt.js}

@@ -12,12 +12,12 @@ import {
   mkdtempSync,
   openSync,
   opendirSync,
-  readSync,
   realpathSync,
   rmSync,
   writeFileSync
 } from "fs";
 import { spawnSync } from "child_process";
+import { readOwnedFileStableSync } from "@hraness/local-custody/private-paths";
 import { homedir, tmpdir } from "os";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "path";
 import { fileURLToPath } from "url";
@@ -368,21 +368,6 @@ function isWithinPath(root, candidate) {
 function hasCode(error, code) {
   return typeof error === "object" && error !== null && "code" in error && error.code === code;
 }
-function readDescriptorBounded(descriptor, maximumBytes) {
-  const chunks = [];
-  const buffer = Buffer.allocUnsafe(Math.min(64 * 1024, maximumBytes + 1));
-  let total = 0;
-  for (;; ) {
-    const remaining = maximumBytes + 1 - total;
-    const count = readSync(descriptor, buffer, 0, Math.min(buffer.byteLength, remaining), null);
-    if (count === 0)
-      return Buffer.concat(chunks, total);
-    total += count;
-    if (total > maximumBytes)
-      throw new Error("file grew beyond its byte bound");
-    chunks.push(Buffer.from(buffer.subarray(0, count)));
-  }
-}
 function pathInside(root, target) {
   const child = relative(root, target);
   return child === "" || !isAbsolute(child) && child !== ".." && !child.startsWith(`..${sep}`);
@@ -825,25 +810,22 @@ function ownedByCurrentUser(stats) {
   return currentUid === undefined || stats.uid === (typeof stats.uid === "bigint" ? BigInt(currentUid) : currentUid);
 }
 function readStateMarker(path) {
-  const noFollow = "O_NOFOLLOW" in constants ? constants.O_NOFOLLOW : 0;
-  const nonBlocking = "O_NONBLOCK" in constants ? constants.O_NONBLOCK : 0;
-  const descriptor = openSync(path, constants.O_RDONLY | noFollow | nonBlocking);
+  let bytes;
   try {
-    const stats = fstatSync(descriptor);
-    if (!stats.isFile() || stats.size > 256 || !ownedByCurrentUser(stats) || (stats.mode & 63) !== 0) {
-      throw new Error("ghostget state marker must be a private, owned regular file");
-    }
+    bytes = readOwnedFileStableSync(path, 256).bytes;
+  } catch (error) {
+    throw new Error("ghostget state marker must be a private, owned regular file", { cause: error });
+  }
+  {
     const content = new TextDecoder("utf-8", {
       fatal: true,
       ignoreBOM: true
-    }).decode(readDescriptorBounded(descriptor, 256));
+    }).decode(bytes);
     if (content !== stateMarkerText)
       throw new Error("ghostget state marker is malformed");
     const value = JSON.parse(content);
     if (typeof value !== "object" || value === null || Array.isArray(value) || Object.keys(value).sort().join(",") !== "kind,schemaVersion" || !("schemaVersion" in value) || value.schemaVersion !== 1 || !("kind" in value) || value.kind !== "io-state")
       throw new Error("ghostget state marker is malformed");
-  } finally {
-    closeSync(descriptor);
   }
 }
 function hasGhostgetPathIdentity(path) {

package/dist/messaging-automation-api.js

@@ -8,11 +8,11 @@ import {
 
 // src/messaging-automation-api.ts
 async function createMessagingAutomationHost(providers, environment) {
-  const { MessagingAutomationHost } = await import("./messaging-automation-58s1366z.js");
+  const { MessagingAutomationHost } = await import("./messaging-automation-w7n3j4sf.js");
   return new MessagingAutomationHost(providers, environment);
 }
 async function installBundledMessagingRuntime(provider, environment) {
-  return (await import("./messaging-native-install-c90nv501.js")).installBundledMessagingRuntime(provider, environment);
+  return (await import("./messaging-native-install-wk10f605.js")).installBundledMessagingRuntime(provider, environment);
 }
 export {
   installBundledMessagingRuntime,

package/dist/{messaging-automation-58s1366z.js → messaging-automation-w7n3j4sf.js}

@@ -18,7 +18,7 @@ import {
   ensurePrivateStateDirectory,
   ghostgetStateHome,
   snapshotPrivateStateDirectory
-} from "./index-yq6maz71.js";
+} from "./index-wwtk6nnt.js";
 import {
   canonicalJson,
   sha256

package/dist/{messaging-native-install-c90nv501.js → messaging-native-install-wk10f605.js}

@@ -4,8 +4,8 @@ import {
   installBundledMessagingRuntime,
   readBundledMessagingAsset,
   verifyImsgNativeResources
-} from "./index-kaav16fd.js";
-import"./index-yq6maz71.js";
+} from "./index-k2m73ke6.js";
+import"./index-wwtk6nnt.js";
 import"./index-gwk7rbyj.js";
 import"./index-z1w83f81.js";
 export {

package/dist/{whatsapp-automation-runtime-ke1dx91p.js → whatsapp-automation-runtime-zp2fx46r.js}

@@ -10,7 +10,7 @@ import {
   ensurePrivateStateDirectory,
   ghostgetStateHome,
   processOwnerStatus
-} from "./index-yq6maz71.js";
+} from "./index-wwtk6nnt.js";
 import {
   startProviderPluginCleanupTrackedOperation
 } from "./index-n4szk3nw.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hraness/ghostget",
-  "version": "0.18.15",
+  "version": "0.18.16",
   "description": "Open-source CLI and TypeScript SDK for precise web capabilities for AI agents: page capture, verified media archives, encrypted reads, and typed provider operations.",
   "license": "MIT",
   "type": "module",
@@ -91,6 +91,7 @@
     "bunfig.toml",
     "docs/imessage-direct-provider.md",
     "docs/rental-listings.md",
+    "src/accounts-auth.ts",
     "src/args.ts",
     "src/apple-photos-cli.ts",
     "src/apple-photos-client-types.ts",
@@ -621,10 +622,13 @@
     "kb:check": "bunx --bun github:hraness/kb#v0.15.2 check --root kb && bunx --bun github:hraness/kb#v0.15.2 agents check --root kb --repo .",
     "kb:catalog": "bunx --bun github:hraness/kb#v0.15.2 catalog --root kb",
     "prepack": "bun run check",
-    "check:effect": "bun scripts/check-effect-architecture.ts"
+    "check:effect": "bun scripts/check-effect-architecture.ts",
+    "generate:og": "bun scripts/generate-og.tsx"
   },
   "dependencies": {
+    "@hraness/accounts-cli": "github:hraness/accounts-cli#v0.1.3",
     "@hraness/kb": "https://github.com/hraness/kb/releases/download/v0.19.6/hraness-kb-0.19.6.tgz",
+    "@hraness/local-custody": "github:hraness/local-custody#d462900810b042a8b5f34245d0d371cfaa6ee9b3",
     "@hraness/message-like-me": "github:hraness/textbutler#83453cc7c17b49bb53fdfd89ccb69b8b44b30af1",
     "@hraness/support-foundation": "github:hraness/support-foundation#2d034b357680353574411217d68b02b6755b07ed",
     "buffer-from": "1.1.2",
@@ -636,19 +640,22 @@
     "@hraness/desktop-foundation": "https://github.com/hraness/desktop-foundation/releases/download/v0.7.0/hraness-desktop-foundation-0.7.0.tgz"
   },
   "devDependencies": {
-    "@hraness/design-kit": "github:hraness/design-kit#v0.8.0",
-    "@hraness/site-footer": "github:hraness/site-footer#v0.13.0",
+    "@hraness/design-kit": "github:hraness/design-kit#v0.10.0",
+    "@hraness/direct": "https://github.com/hraness/direct/releases/download/v0.7.21/hraness-direct-0.7.21.tgz",
+    "@hraness/site-footer": "github:hraness/site-footer#v0.15.0",
     "@hraness/ui": "github:hraness/ui#v0.5.13",
+    "@hraness/web-discovery": "github:hraness/web-discovery#v0.6.0",
+    "@resvg/resvg-js": "2.6.2",
     "@steipete/sweet-cookie": "0.4.3",
+    "@tanstack/react-virtual": "3.14.11",
     "@types/bun": "^1.3.14",
     "@types/react": "19.2.14",
     "@types/react-dom": "19.2.3",
+    "agent-browser": "0.32.3",
     "fast-check": "^4.8.0",
     "react": "19.2.3",
     "react-dom": "19.2.3",
-    "@tanstack/react-virtual": "3.14.11",
-    "@hraness/direct": "https://github.com/hraness/direct/releases/download/v0.7.21/hraness-direct-0.7.21.tgz",
-    "agent-browser": "0.32.3"
+    "satori": "0.33.4"
   },
   "publishConfig": {
     "access": "public",

package/skills/ghostget/references/install.md

@@ -17,34 +17,34 @@ If Bun is missing, stop and direct the user to the official
 [Bun installation guide](https://bun.sh/docs/installation). Do not switch
 package managers or pipe an unreviewed installer into a shell.
 
-This reference is authored for the exact v0.18.15 release coordinate. Use it
+This reference is authored for the exact v0.18.16 release coordinate. Use it
 only from the matching release-bound Agent Skill after its canonical archive and
 immutable GitHub Release exist. If the coordinate is not public, stop instead
 of substituting `main`, another tag, or a different package version. Install
 that exact release and its reviewed bundled adapter manifests:
 
 ```sh
-bun add --global https://github.com/hraness/ghostget/releases/download/v0.18.15/hraness-ghostget-0.18.15.tgz
+bun add --global https://github.com/hraness/ghostget/releases/download/v0.18.16/hraness-ghostget-0.18.16.tgz
 ghostget adapter sync-bundled --json
 ghostget --help
 ghostget doctor --json
 ```
 
-The package is `@hraness/ghostget`; `@hraness/ghostget@0.18.15` is an optional npm
+The package is `@hraness/ghostget`; `@hraness/ghostget@0.18.16` is an optional npm
 mirror only after verified registry publication. Canonical installation does not
 wait for registry publication.
 
 When upgrading from Wrench, use `ghostget` for new commands and
 `GHOSTGET_STATE_HOME` for an explicit state root. Existing state is selected in
 place; do not rename, copy, or delete a state directory as part of the upgrade.
-The [migration guide](https://github.com/hraness/ghostget/blob/v0.18.15/docs/ghostget-migration.md)
+The [migration guide](https://github.com/hraness/ghostget/blob/v0.18.16/docs/ghostget-migration.md)
 explains the retained state aliases and durable protocol names.
 
 Do not clone the repository merely to run the CLI. Importing the SDK is a
 separate project dependency and does not install a global command:
 
 ```sh
-bun add https://github.com/hraness/ghostget/releases/download/v0.18.15/hraness-ghostget-0.18.15.tgz
+bun add https://github.com/hraness/ghostget/releases/download/v0.18.16/hraness-ghostget-0.18.16.tgz
 ```
 
 `ghostget adapter sync-bundled` upgrades exact bundled baselines, including an

package/src/accounts-auth.ts

@@ -0,0 +1,188 @@
+import { join } from "node:path";
+
+import {
+  createCliSession,
+  createEncryptedFileTokenStorage,
+  createKeychainTokenStorage,
+  createMemoryTokenStorage,
+  initiateDeviceLogin,
+  type CliSession,
+  type DeviceLoginResult,
+  type TokenStorage,
+} from "@hraness/accounts-cli";
+import { ghostgetStateHome } from "./storage";
+
+const GHOSTGET_CLIENT_ID = "hraness:ghostget:production:v1";
+const ACCOUNTS_ORIGIN = "https://account.hraness.com";
+const DEVICE_AUTHORIZATION_ENDPOINT =
+  `${ACCOUNTS_ORIGIN}/api/auth/oauth2/device_authorization`;
+const DEVICE_TOKEN_ENDPOINT =
+  `${ACCOUNTS_ORIGIN}/api/auth/oauth2/device/token`;
+const TOKEN_ENDPOINT = `${ACCOUNTS_ORIGIN}/api/auth/oauth2/token`;
+
+export type AccountsAuthResult =
+  | Readonly<{ kind: "success"; message: string }>
+  | Readonly<{ kind: "denied" }>
+  | Readonly<{ kind: "expired" }>
+  | Readonly<{ kind: "error"; message: string }>;
+
+export type AccountsAuthHandlers = Readonly<{
+  onUserCode?: (userCode: string, verificationUri: string) => void;
+  onPending?: () => void;
+  onSlowDown?: (intervalMs: number) => void;
+}>;
+
+export function createGhostgetTokenStorage(
+  environment: Readonly<Record<string, string | undefined>>,
+  storage?: TokenStorage,
+): TokenStorage {
+  if (storage !== undefined) return storage;
+  const keychain = createKeychainTokenStorage(
+    "ghostget",
+    "hraness-accounts",
+  );
+  const stateHome = ghostgetStateHome(environment);
+  const file = createEncryptedFileTokenStorage(
+    join(stateHome, "accounts", "refresh-token.enc"),
+  );
+  return {
+    backend: "keychain",
+    deleteRefreshToken: async () => {
+      await keychain.deleteRefreshToken();
+      await file.deleteRefreshToken();
+    },
+    loadRefreshToken: async () => {
+      const keychainToken = await keychain.loadRefreshToken();
+      if (keychainToken !== null) return keychainToken;
+      return file.loadRefreshToken();
+    },
+    saveRefreshToken: async (token) => {
+      try {
+        await keychain.saveRefreshToken(token);
+      } catch {
+        // Keychain may be unavailable in headless/CI; the encrypted file
+        // fallback still gives a machine-bound local secret.
+      }
+      await file.saveRefreshToken(token);
+    },
+  };
+}
+
+export async function runAccountsDeviceLogin(
+  environment: Readonly<Record<string, string | undefined>>,
+  handlers: AccountsAuthHandlers = {},
+  storage?: TokenStorage,
+  signal?: AbortSignal,
+): Promise<AccountsAuthResult> {
+  if (signal?.aborted) {
+    return { kind: "error", message: "Login was cancelled." };
+  }
+  const tokenStorage = createGhostgetTokenStorage(environment, storage);
+  const session = createCliSession({
+    clientId: GHOSTGET_CLIENT_ID,
+    storage: tokenStorage,
+    tokenEndpoint: TOKEN_ENDPOINT,
+  });
+
+  const deviceHandlers: {
+    onUserCode?: (userCode: string, verificationUri: string) => void;
+    onPending?: () => void;
+    onSlowDown?: (intervalMs: number) => void;
+  } = {};
+  if (handlers.onUserCode !== undefined) {
+    deviceHandlers.onUserCode = handlers.onUserCode;
+  }
+  if (handlers.onPending !== undefined) {
+    deviceHandlers.onPending = handlers.onPending;
+  }
+  if (handlers.onSlowDown !== undefined) {
+    deviceHandlers.onSlowDown = handlers.onSlowDown;
+  }
+
+  const device = await initiateDeviceLogin(
+    {
+      deviceAuthorizationEndpoint: DEVICE_AUTHORIZATION_ENDPOINT,
+      deviceTokenEndpoint: DEVICE_TOKEN_ENDPOINT,
+    },
+    {
+      clientId: GHOSTGET_CLIENT_ID,
+      scopes: ["openid", "profile", "email", "offline_access"],
+    },
+    deviceHandlers,
+  );
+
+  const abortPromise = new Promise<never>((_resolve, reject) => {
+    if (signal === undefined) return;
+    if (signal.aborted) {
+      reject(new Error("Login was cancelled."));
+      return;
+    }
+    signal.addEventListener("abort", () => {
+      reject(new Error("Login was cancelled."));
+    }, { once: true });
+  });
+
+  try {
+    const result = (await Promise.race([device.poll(), abortPromise])) as DeviceLoginResult;
+    return handlePollResult(result, session);
+  } catch (error) {
+    return {
+      kind: "error",
+      message: error instanceof Error ? error.message : String(error),
+    };
+  }
+}
+
+function handlePollResult(
+  result: DeviceLoginResult,
+  session: CliSession,
+): AccountsAuthResult {
+  switch (result.kind) {
+    case "token":
+      void session.saveRefreshToken(result.refreshToken);
+      return {
+        kind: "success",
+        message: "Signed in to Hraness Accounts. You can return to your terminal.",
+      };
+    case "access_denied":
+      return { kind: "denied" };
+    case "expired_token":
+      return { kind: "expired" };
+    case "error":
+      return {
+        kind: "error",
+        message: result.errorDescription ?? result.error,
+      };
+    default: {
+      const _exhaustive: never = result;
+      return { kind: "error", message: `unknown login result: ${_exhaustive}` };
+    }
+  }
+}
+
+export function loadAccountsSession(
+  environment: Readonly<Record<string, string | undefined>>,
+  storage?: TokenStorage,
+): CliSession {
+  const tokenStorage = createGhostgetTokenStorage(environment, storage);
+  return createCliSession({
+    clientId: GHOSTGET_CLIENT_ID,
+    storage: tokenStorage,
+    tokenEndpoint: TOKEN_ENDPOINT,
+  });
+}
+
+export async function runAccountsSignOut(
+  environment: Readonly<Record<string, string | undefined>>,
+  storage?: TokenStorage,
+): Promise<void> {
+  await loadAccountsSession(environment, storage).signOut();
+}
+
+export const accountsAuthInternals = {
+  DEVICE_AUTHORIZATION_ENDPOINT,
+  DEVICE_TOKEN_ENDPOINT,
+  TOKEN_ENDPOINT,
+  GHOSTGET_CLIENT_ID,
+  createMemoryTokenStorage,
+};

package/src/args.ts

@@ -36,6 +36,8 @@ type MessagingArguments = {
 
 export type GhostgetArguments =
   | { readonly command: "help" }
+  | { readonly command: "login"; readonly json: boolean }
+  | { readonly command: "logout"; readonly json: boolean }
   | { readonly command: "messaging-automation-serve" }
   | { readonly command: "whatsapp-automation-install"; readonly binary?: string; readonly json: boolean }
   | { readonly command: "clip"; readonly arguments: readonly string[] }
@@ -777,6 +779,18 @@ export function parseGhostgetArguments(raw: readonly string[]): ParseGhostgetRes
     if (raw.length > 1) return { ok: false, message: "help accepts no arguments" };
     return { ok: true, value: { command: "help" } };
   }
+  if (raw[0] === "login") {
+    const json = simpleJsonOptions(raw.slice(1), "login");
+    return typeof json === "boolean"
+      ? { ok: true, value: { command: "login", json } }
+      : json;
+  }
+  if (raw[0] === "logout") {
+    const json = simpleJsonOptions(raw.slice(1), "logout");
+    return typeof json === "boolean"
+      ? { ok: true, value: { command: "logout", json } }
+      : json;
+  }
   const first = raw[0] ?? "";
   if (/^https?:\/\//iu.test(first)) return { ok: true, value: { command: "clip", arguments: raw } };
   if (first === "clip" || first === "capture") return { ok: true, value: { command: "clip", arguments: raw.slice(1) } };

package/src/beeper-client-types.ts

@@ -96,7 +96,7 @@ export type BeeperContactInteractionExportReceipt = Readonly<{
   implementation: Readonly<{
     producer: Readonly<{
       package: "@hraness/ghostget";
-      version: "0.18.15";
+      version: "0.18.16";
     }>;
     officialCli: Readonly<{
       implementation: "github.com/beeper/cli";

package/src/derivation-network-guard.ts

@@ -1,20 +1,13 @@
 import { createHash } from "node:crypto";
-import {
-  chmodSync,
-  closeSync,
-  constants,
-  fchmodSync,
-  fstatSync,
-  fsyncSync,
-  lstatSync,
-  mkdirSync,
-  openSync,
-  readSync,
-  unlinkSync,
-  writeSync,
-} from "node:fs";
+import { chmodSync, mkdirSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { basename, dirname, join } from "node:path";
+
+import {
+  assertOwnedPathSync,
+  readOwnedFileStableSync,
+} from "@hraness/local-custody/private-paths";
+import { createPrivateFileOnceSync } from "@hraness/local-custody/atomic-publish";
 
 import { canonicalJson, sha256 } from "./canonical-json";
 import type { ProcessOwnerIdentity } from "./process-identity";
@@ -141,11 +134,6 @@ type GuardRuntimeCase = {
   readonly ruleId: number;
 };
 
-function currentUserOwns(uid: number | bigint): boolean {
-  const current = typeof process.getuid === "function" ? process.getuid() : undefined;
-  return current === undefined || uid === (typeof uid === "bigint" ? BigInt(current) : current);
-}
-
 function escapeRegex(value: string): string {
   return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
 }
@@ -307,14 +295,11 @@ function extensionIdFromKey(): string {
 
 function inspectDirectory(path: string): GuardDirectoryIdentity {
   try {
-    const stats = lstatSync(path, { bigint: true });
-    if (
-      !stats.isDirectory()
-      || stats.isSymbolicLink()
-      || !currentUserOwns(stats.uid)
-      || (stats.mode & 0o777n) !== 0o700n
-    ) throw new Error("unsafe");
-    return { device: stats.dev.toString(), inode: stats.ino.toString() };
+    const identity = assertOwnedPathSync(path, {
+      kind: "directory",
+      exactMode: 0o700,
+    });
+    return { device: identity.dev.toString(), inode: identity.ino.toString() };
   } catch {
     throw new Error("derivation network guard directory is unavailable or unsafe");
   }
@@ -325,71 +310,18 @@ function sameIdentity(left: GuardDirectoryIdentity, right: GuardDirectoryIdentit
 }
 
 export function writeGuardPrivateFile(path: string, content: string): GuardPrivateFileEvidence {
-  let descriptor: number | null = null;
-  let openedIdentity: GuardDirectoryIdentity | null = null;
-  let completed = false;
   try {
-    descriptor = openSync(
-      path,
-      constants.O_WRONLY
-        | constants.O_CREAT
-        | constants.O_EXCL
-        | ("O_NOFOLLOW" in constants ? constants.O_NOFOLLOW : 0),
-      0o600,
-    );
-    const opened = fstatSync(descriptor, { bigint: true });
-    openedIdentity = { device: opened.dev.toString(), inode: opened.ino.toString() };
-    fchmodSync(descriptor, 0o600);
-    const bytes = Buffer.from(content, "utf8");
-    let offset = 0;
-    while (offset < bytes.byteLength) {
-      offset += writeSync(descriptor, bytes, offset, bytes.byteLength - offset);
-    }
-    fsyncSync(descriptor);
-    const stats = fstatSync(descriptor, { bigint: true });
-    if (
-      !stats.isFile()
-      || !currentUserOwns(stats.uid)
-      || (stats.mode & 0o777n) !== 0o600n
-      || stats.size !== BigInt(bytes.byteLength)
-    ) throw new Error("derivation network guard file could not be secured");
-    const evidence = {
-      device: stats.dev.toString(),
-      inode: stats.ino.toString(),
-      byteLength: bytes.byteLength,
+    const outcome = createPrivateFileOnceSync(dirname(path), basename(path), content);
+    if (outcome !== "created") throw new Error("exists");
+    const identity = assertOwnedPathSync(path, { kind: "file", exactMode: 0o600 });
+    return {
+      device: identity.dev.toString(),
+      inode: identity.ino.toString(),
+      byteLength: Buffer.byteLength(content, "utf8"),
       sha256: sha256(content),
     };
-    completed = true;
-    return evidence;
   } catch {
     throw new Error("derivation network guard file could not be secured");
-  } finally {
-    if (descriptor !== null) {
-      if (!completed && openedIdentity === null) {
-        try {
-          const stats = fstatSync(descriptor, { bigint: true });
-          openedIdentity = { device: stats.dev.toString(), inode: stats.ino.toString() };
-        } catch {
-          // Without an exact identity, preserve the path instead of unlinking.
-        }
-      }
-      try {
-        closeSync(descriptor);
-      } catch {
-        // The categorical write failure below must not expose a local path.
-      }
-    }
-    if (!completed && openedIdentity !== null) {
-      try {
-        const current = lstatSync(path, { bigint: true });
-        if (
-          current.dev.toString() === openedIdentity.device
-          && current.ino.toString() === openedIdentity.inode
-        ) unlinkSync(path);
-      } catch {
-        // A changed path is intentionally preserved.
-      }
-    }
   }
 }
 
@@ -397,55 +329,23 @@ export function readGuardPrivateFile(
   path: string,
   maximumBytes = 4 * 1024 * 1024,
 ): { readonly content: string; readonly evidence: GuardPrivateFileEvidence } {
-  let descriptor: number | null = null;
   try {
-    descriptor = openSync(
-      path,
-      constants.O_RDONLY | ("O_NOFOLLOW" in constants ? constants.O_NOFOLLOW : 0),
-    );
-    const before = fstatSync(descriptor, { bigint: true });
-    if (
-      !before.isFile()
-      || !currentUserOwns(before.uid)
-      || (before.mode & 0o777n) !== 0o600n
-      || before.size < 1n
-      || before.size > BigInt(maximumBytes)
-    ) throw new Error("derivation network guard file is unavailable or unsafe");
-    const bytes = Buffer.alloc(Number(before.size));
-    let offset = 0;
-    while (offset < bytes.byteLength) {
-      const count = readSync(descriptor, bytes, offset, bytes.byteLength - offset, null);
-      if (count === 0) throw new Error("derivation network guard file changed size");
-      offset += count;
-    }
-    const after = fstatSync(descriptor, { bigint: true });
-    if (
-      before.dev !== after.dev
-      || before.ino !== after.ino
-      || before.size !== after.size
-      || before.mtimeNs !== after.mtimeNs
-      || before.ctimeNs !== after.ctimeNs
-    ) throw new Error("derivation network guard file changed while reading");
-    const content = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    const read = readOwnedFileStableSync(path, maximumBytes, {
+      exactMode: 0o600,
+      minimumBytes: 1n,
+    });
+    const content = new TextDecoder("utf-8", { fatal: true }).decode(read.bytes);
     return {
       content,
       evidence: {
-        device: before.dev.toString(),
-        inode: before.ino.toString(),
-        byteLength: bytes.byteLength,
+        device: read.dev.toString(),
+        inode: read.ino.toString(),
+        byteLength: read.bytes.byteLength,
         sha256: sha256(content),
       },
     };
   } catch {
     throw new Error("derivation network guard file is unavailable or unsafe");
-  } finally {
-    if (descriptor !== null) {
-      try {
-        closeSync(descriptor);
-      } catch {
-        // Keep diagnostics categorical and path-free.
-      }
-    }
   }
 }
 
@@ -484,48 +384,20 @@ export function verifyGuardPrivateFile(
   expected: GuardPrivateFileEvidence,
   expectedContent: string,
 ): void {
-  let descriptor: number | null = null;
   try {
-    descriptor = openSync(
-      path,
-      constants.O_RDONLY | ("O_NOFOLLOW" in constants ? constants.O_NOFOLLOW : 0),
-    );
-    const before = fstatSync(descriptor, { bigint: true });
+    const read = readOwnedFileStableSync(path, expected.byteLength, {
+      exactMode: 0o600,
+      minimumBytes: 1n,
+    });
     if (
-      !before.isFile()
-      || !currentUserOwns(before.uid)
-      || (before.mode & 0o777n) !== 0o600n
-      || before.dev.toString() !== expected.device
-      || before.ino.toString() !== expected.inode
-      || before.size !== BigInt(expected.byteLength)
-    ) throw new Error("derivation network guard file changed identity");
-    const bytes = Buffer.alloc(expected.byteLength);
-    let offset = 0;
-    while (offset < bytes.byteLength) {
-      const count = readSync(descriptor, bytes, offset, bytes.byteLength - offset, null);
-      if (count === 0) throw new Error("derivation network guard file changed size");
-      offset += count;
-    }
-    const after = fstatSync(descriptor, { bigint: true });
-    if (
-      before.dev !== after.dev
-      || before.ino !== after.ino
-      || before.size !== after.size
-      || before.mtimeNs !== after.mtimeNs
-      || before.ctimeNs !== after.ctimeNs
-      || bytes.toString("utf8") !== expectedContent
+      read.dev.toString() !== expected.device
+      || read.ino.toString() !== expected.inode
+      || read.bytes.byteLength !== expected.byteLength
+      || read.bytes.toString("utf8") !== expectedContent
       || sha256(expectedContent) !== expected.sha256
-    ) throw new Error("derivation network guard file changed content");
+    ) throw new Error("derivation network guard file changed");
   } catch {
     throw new Error("derivation network guard file changed or is unavailable");
-  } finally {
-    if (descriptor !== null) {
-      try {
-        closeSync(descriptor);
-      } catch {
-        // Keep diagnostics categorical and path-free.
-      }
-    }
   }
 }
 

package/src/derivation-network-proxy-helper.ts

@@ -1,17 +1,17 @@
 #!/usr/bin/env bun
 import {
   chmodSync,
-  closeSync,
-  constants,
-  fstatSync,
   lstatSync,
-  openSync,
-  readSync,
   rmdirSync,
   unlinkSync,
 } from "node:fs";
 import { createServer, type Server, type Socket } from "node:net";
 
+import {
+  assertOwnedPathSync,
+  readOwnedFileStableSync,
+} from "@hraness/local-custody/private-paths";
+
 import {
   DERIVATION_GUARD_PROXY_CONFIG,
   DERIVATION_GUARD_PROXY_READY,
@@ -39,11 +39,6 @@ function injectFailureForTest(stage: HelperFailureStage): void {
   ) throw new Error("injected derivation proxy helper failure");
 }
 
-function currentUserOwns(uid: number | bigint): boolean {
-  const current = typeof process.getuid === "function" ? process.getuid() : undefined;
-  return current === undefined || uid === (typeof uid === "bigint" ? BigInt(current) : current);
-}
-
 function sameIdentity(left: GuardDirectoryIdentity, right: GuardDirectoryIdentity): boolean {
   return left.device === right.device && left.inode === right.inode;
 }
@@ -95,25 +90,23 @@ function provisionalReadyFileIsAbsent(): boolean {
 }
 
 function inspectPrivateDirectory(path: string): GuardDirectoryIdentity {
-  const stats = lstatSync(path, { bigint: true });
-  if (
-    !stats.isDirectory()
-    || stats.isSymbolicLink()
-    || !currentUserOwns(stats.uid)
-    || (stats.mode & 0o777n) !== 0o700n
-  ) throw new Error("derivation proxy directory is unavailable or unsafe");
-  return { device: stats.dev.toString(), inode: stats.ino.toString() };
+  let identity: { readonly dev: number; readonly ino: number };
+  try {
+    identity = assertOwnedPathSync(path, { kind: "directory", exactMode: 0o700 });
+  } catch {
+    throw new Error("derivation proxy directory is unavailable or unsafe");
+  }
+  return { device: identity.dev.toString(), inode: identity.ino.toString() };
 }
 
 function inspectPrivateControlSocket(path: string): GuardDirectoryIdentity {
-  const stats = lstatSync(path, { bigint: true });
-  if (
-    !stats.isSocket()
-    || stats.isSymbolicLink()
-    || !currentUserOwns(stats.uid)
-    || (stats.mode & 0o777n) !== 0o600n
-  ) throw new Error("derivation proxy control socket is unavailable or unsafe");
-  return { device: stats.dev.toString(), inode: stats.ino.toString() };
+  let identity: { readonly dev: number; readonly ino: number };
+  try {
+    identity = assertOwnedPathSync(path, { kind: "socket", exactMode: 0o600 });
+  } catch {
+    throw new Error("derivation proxy control socket is unavailable or unsafe");
+  }
+  return { device: identity.dev.toString(), inode: identity.ino.toString() };
 }
 
 function unlinkExactControlSocket(
@@ -147,38 +140,16 @@ function waitForSocketClose(socket: Socket): Promise<void> {
 }
 
 function readPrivateConfig(): unknown {
-  const descriptor = openSync(
-    DERIVATION_GUARD_PROXY_CONFIG,
-    constants.O_RDONLY | ("O_NOFOLLOW" in constants ? constants.O_NOFOLLOW : 0),
-  );
+  let read: ReturnType<typeof readOwnedFileStableSync>;
   try {
-    const before = fstatSync(descriptor, { bigint: true });
-    if (
-      !before.isFile()
-      || !currentUserOwns(before.uid)
-      || (before.mode & 0o777n) !== 0o600n
-      || before.size < 1n
-      || before.size > BigInt(MAX_CONFIG_BYTES)
-    ) throw new Error("derivation proxy config is unavailable or unsafe");
-    const bytes = Buffer.alloc(Number(before.size));
-    let offset = 0;
-    while (offset < bytes.byteLength) {
-      const count = readSync(descriptor, bytes, offset, bytes.byteLength - offset, null);
-      if (count === 0) throw new Error("derivation proxy config changed size");
-      offset += count;
-    }
-    const after = fstatSync(descriptor, { bigint: true });
-    if (
-      before.dev !== after.dev
-      || before.ino !== after.ino
-      || before.size !== after.size
-      || before.mtimeNs !== after.mtimeNs
-      || before.ctimeNs !== after.ctimeNs
-    ) throw new Error("derivation proxy config changed while reading");
-    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes)) as unknown;
-  } finally {
-    closeSync(descriptor);
+    read = readOwnedFileStableSync(DERIVATION_GUARD_PROXY_CONFIG, MAX_CONFIG_BYTES, {
+      exactMode: 0o600,
+      minimumBytes: 1n,
+    });
+  } catch {
+    throw new Error("derivation proxy config is unavailable or unsafe");
   }
+  return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(read.bytes)) as unknown;
 }
 
 function exactKeys(record: Record<string, unknown>, expected: readonly string[]): boolean {

package/src/derive.ts

@@ -22,6 +22,7 @@ import {
 } from "@hraness/kb/clip/acquire";
 import { isPrivateAddress, isPrivateHostname } from "@hraness/kb/clip/network";
 import type { StrictCookie } from "@hraness/kb/clip/cookies";
+import { assertOwnedPathSync } from "@hraness/local-custody/private-paths";
 import type { GhostgetAuth } from "./auth";
 import {
   agentBrowserFailure,
@@ -234,14 +235,14 @@ function ownedByCurrentUser(uid: number | bigint): boolean {
 }
 
 function inspectDirectoryIdentity(path: string): DirectoryIdentity {
-  const stats = lstatSync(path, { bigint: true });
-  if (
-    !stats.isDirectory()
-    || stats.isSymbolicLink()
-    || !ownedByCurrentUser(stats.uid)
-    || (stats.mode & 0o777n) !== 0o700n
-  ) throw new Error("derivation session directory is unsafe");
-  return { device: stats.dev.toString(), inode: stats.ino.toString() };
+  let identity: { readonly dev: number; readonly ino: number };
+  try {
+    identity = assertOwnedPathSync(path, { kind: "directory", exactMode: 0o700 });
+  } catch (error) {
+    if (hasErrorCode(error, "ENOENT")) throw error;
+    throw new Error("derivation session directory is unsafe", { cause: error });
+  }
+  return { device: identity.dev.toString(), inode: identity.ino.toString() };
 }
 
 function parseDirectoryIdentity(value: unknown): DirectoryIdentity {
@@ -1101,25 +1102,21 @@ function inspectPrivateFile(
   maximumBytes: number,
   label: string,
 ): Omit<PrivateFileEvidence, "sha256"> {
-  const stats = (() => {
-    try {
-      return lstatSync(path, { bigint: true });
-    } catch (error) {
-      throw new Error(`${label} is unavailable or unsafe`, { cause: error });
-    }
-  })();
-  if (
-    !stats.isFile()
-    || stats.isSymbolicLink()
-    || !ownedByCurrentUser(stats.uid)
-    || (stats.mode & 0o077n) !== 0n
-    || stats.size < 1n
-    || stats.size > BigInt(maximumBytes)
-  ) throw new Error(`${label} is unavailable or unsafe`);
+  let identity: { readonly dev: number; readonly ino: number; readonly size: number };
+  try {
+    identity = assertOwnedPathSync(path, {
+      kind: "file",
+      ownerOnly: true,
+      minimumBytes: 1n,
+      maximumBytes: BigInt(maximumBytes),
+    });
+  } catch (error) {
+    throw new Error(`${label} is unavailable or unsafe`, { cause: error });
+  }
   return {
-    device: stats.dev.toString(),
-    inode: stats.ino.toString(),
-    byteLength: Number(stats.size),
+    device: identity.dev.toString(),
+    inode: identity.ino.toString(),
+    byteLength: identity.size,
   };
 }
 
@@ -1444,18 +1441,20 @@ function inspectCapturedHar(path: string): {
   readonly inode: string;
   readonly byteLength: number;
 } {
-  const stats = lstatSync(path, { bigint: true });
-  if (
-    !stats.isFile()
-    || stats.isSymbolicLink()
-    || !ownedByCurrentUser(stats.uid)
-    || stats.size < 1n
-    || stats.size > BigInt(MAX_HAR_BYTES)
-  ) throw new Error("derivation review HAR is unavailable or unsafe");
+  let identity: { readonly dev: number; readonly ino: number; readonly size: number };
+  try {
+    identity = assertOwnedPathSync(path, {
+      kind: "file",
+      minimumBytes: 1n,
+      maximumBytes: BigInt(MAX_HAR_BYTES),
+    });
+  } catch (error) {
+    throw new Error("derivation review HAR is unavailable or unsafe", { cause: error });
+  }
   return {
-    device: stats.dev.toString(),
-    inode: stats.ino.toString(),
-    byteLength: Number(stats.size),
+    device: identity.dev.toString(),
+    inode: identity.ino.toString(),
+    byteLength: identity.size,
   };
 }
 

package/src/ghostget.ts

@@ -22,6 +22,7 @@ import {
   saveAuth,
   type GhostgetAuth,
 } from "./auth";
+import { runAccountsDeviceLogin, runAccountsSignOut } from "./accounts-auth";
 import {
   isPublicWebSessionInvocationAuthority,
   type InvocationAuthority,
@@ -1983,6 +1984,48 @@ async function runCommand(
     output.stdout(renderGhostgetUsage());
     return 0;
   }
+  if (arguments_.command === "login") {
+    const result = await runAccountsDeviceLogin(
+      environment,
+      {
+        onUserCode: (userCode, verificationUri) => {
+          output.stderr(
+            `Open ${safe(verificationUri)} in a browser where you are already signed in to Hraness Accounts and enter code: ${safe(userCode)}\n`,
+          );
+        },
+        onPending: () => {
+          output.stderr("Waiting for browser approval...\n");
+        },
+        onSlowDown: () => {
+          output.stderr("Polling more slowly...\n");
+        },
+      },
+      undefined,
+      signal,
+    );
+    if (arguments_.json) {
+      output.stdout(exactTerminalJson({ ok: result.kind === "success", ...result }));
+    } else if (result.kind === "success") {
+      output.stdout(`${safe(result.message)}\n`);
+    } else if (result.kind === "denied") {
+      output.stderr("Login was denied in the browser.\n");
+    } else if (result.kind === "expired") {
+      output.stderr("The sign-in code expired. Run 'ghostget login' again.\n");
+    } else {
+      output.stderr(`Login failed: ${safe(result.message)}\n`);
+    }
+    return result.kind === "success" ? 0 : 3;
+  }
+  if (arguments_.command === "logout") {
+    await runAccountsSignOut(environment);
+    const message = "Signed out of Hraness Accounts.";
+    if (arguments_.json) {
+      output.stdout(exactTerminalJson({ ok: true, message }));
+    } else {
+      output.stdout(`${message}\n`);
+    }
+    return 0;
+  }
   if (arguments_.command === "whatsapp-automation-install") {
     const { installReviewedWhatsAppAutomationBinary } = await import("./providers/whatsapp-automation-runtime");
     const installed = arguments_.binary === undefined

package/src/storage.ts

@@ -10,7 +10,6 @@ import {
   mkdtempSync,
   openSync,
   opendirSync,
-  readSync,
   realpathSync,
   rmSync,
   writeFileSync,
@@ -18,6 +17,7 @@ import {
   type Dirent,
 } from "node:fs";
 import { spawnSync } from "node:child_process";
+import { readOwnedFileStableSync } from "@hraness/local-custody/private-paths";
 import { homedir, tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -363,20 +363,6 @@ function hasCode(error: unknown, code: string): boolean {
   return typeof error === "object" && error !== null && "code" in error && error.code === code;
 }
 
-function readDescriptorBounded(descriptor: number, maximumBytes: number): Buffer {
-  const chunks: Buffer[] = [];
-  const buffer = Buffer.allocUnsafe(Math.min(64 * 1024, maximumBytes + 1));
-  let total = 0;
-  for (;;) {
-    const remaining = maximumBytes + 1 - total;
-    const count = readSync(descriptor, buffer, 0, Math.min(buffer.byteLength, remaining), null);
-    if (count === 0) return Buffer.concat(chunks, total);
-    total += count;
-    if (total > maximumBytes) throw new Error("file grew beyond its byte bound");
-    chunks.push(Buffer.from(buffer.subarray(0, count)));
-  }
-}
-
 function pathInside(root: string, target: string): boolean {
   const child = relative(root, target);
   return child === "" || (!isAbsolute(child) && child !== ".." && !child.startsWith(`..${sep}`));
@@ -1037,18 +1023,17 @@ function ownedByCurrentUser(stats: { readonly uid: number | bigint }): boolean {
 }
 
 function readStateMarker(path: string): void {
-  const noFollow = "O_NOFOLLOW" in constants ? constants.O_NOFOLLOW : 0;
-  const nonBlocking = "O_NONBLOCK" in constants ? constants.O_NONBLOCK : 0;
-  const descriptor = openSync(path, constants.O_RDONLY | noFollow | nonBlocking);
+  let bytes: Buffer;
   try {
-    const stats = fstatSync(descriptor);
-    if (!stats.isFile() || stats.size > 256 || !ownedByCurrentUser(stats) || (stats.mode & 0o077) !== 0) {
-      throw new Error("ghostget state marker must be a private, owned regular file");
-    }
+    bytes = readOwnedFileStableSync(path, 256).bytes;
+  } catch (error) {
+    throw new Error("ghostget state marker must be a private, owned regular file", { cause: error });
+  }
+  {
     const content = new TextDecoder("utf-8", {
       fatal: true,
       ignoreBOM: true,
-    }).decode(readDescriptorBounded(descriptor, 256));
+    }).decode(bytes);
     if (content !== stateMarkerText) throw new Error("ghostget state marker is malformed");
     const value = JSON.parse(content) as unknown;
     if (
@@ -1061,8 +1046,6 @@ function readStateMarker(path: string): void {
       || !("kind" in value)
       || value.kind !== "io-state"
     ) throw new Error("ghostget state marker is malformed");
-  } finally {
-    closeSync(descriptor);
   }
 }
 

package/src/usage.ts

@@ -6,6 +6,8 @@
  * optional provider runtime is broken.
  */
 export const ghostgetUsage = `Usage:
+  ghostget login [--json]                             Sign in to Hraness Accounts
+  ghostget logout [--json]                            Sign out of Hraness Accounts
   ghostget --version                                  Print the exact Ghostget release version
   ghostget support [--json]                           View optional product updates and support
   ghostget support protocol --json                    Read the optional agent closeout protocol

package/src/version.ts

@@ -1,2 +1,2 @@
 /** Canonical immutable Ghostget package release identity. */
-export const GHOSTGET_VERSION = "0.18.15" as const;
+export const GHOSTGET_VERSION = "0.18.16" as const;