@juspay/neurolink 13.8.17 → 13.8.18

package/dist/agent/arithmeticEvaluator.js

@@ -0,0 +1,349 @@
+/**
+ * Arithmetic evaluator for the built-in `calculateMath` tool.
+ *
+ * The expression is MODEL output. It is parsed by a small recursive-descent
+ * parser and evaluated over numbers only: there is no `Function`, no `eval`,
+ * no property access and no identifier that is not on the fixed allow-list
+ * below. Anything the grammar does not cover is reported as an error.
+ *
+ * Grammar (precedence low → high):
+ *
+ *   expression := term (("+" | "-") term)*
+ *   term       := unary (("*" | "/" | "%") unary)*
+ *   unary      := ("-" | "+") unary | power
+ *   power      := primary ("**" unary)?            right-associative
+ *   primary    := number | constant | function "(" args ")" | "(" expression ")"
+ *
+ * Numbers are decimal literals (`12`, `3.5`, `.5`, `1e-3`). Functions and
+ * constants are the listed `Math` members, accepted with or without the
+ * `Math.` prefix. Unary minus binds looser than `**`, so `-2 ** 2` is `-4`,
+ * as in mathematics (JavaScript rejects that spelling outright).
+ */
+/** Longest expression accepted, in characters. */
+const MAX_EXPRESSION_LENGTH = 1_000;
+/** Deepest nesting of parentheses and function calls accepted. */
+const MAX_NESTING_DEPTH = 64;
+/** Most arguments one function call may take. */
+const MAX_FUNCTION_ARGUMENTS = 16;
+const MATH_FUNCTIONS = Object.freeze({
+    abs: { fn: Math.abs, arity: 1 },
+    ceil: { fn: Math.ceil, arity: 1 },
+    floor: { fn: Math.floor, arity: 1 },
+    round: { fn: Math.round, arity: 1 },
+    trunc: { fn: Math.trunc, arity: 1 },
+    sign: { fn: Math.sign, arity: 1 },
+    sqrt: { fn: Math.sqrt, arity: 1 },
+    cbrt: { fn: Math.cbrt, arity: 1 },
+    pow: { fn: Math.pow, arity: 2 },
+    exp: { fn: Math.exp, arity: 1 },
+    log: { fn: Math.log, arity: 1 },
+    log2: { fn: Math.log2, arity: 1 },
+    log10: { fn: Math.log10, arity: 1 },
+    sin: { fn: Math.sin, arity: 1 },
+    cos: { fn: Math.cos, arity: 1 },
+    tan: { fn: Math.tan, arity: 1 },
+    asin: { fn: Math.asin, arity: 1 },
+    acos: { fn: Math.acos, arity: 1 },
+    atan: { fn: Math.atan, arity: 1 },
+    atan2: { fn: Math.atan2, arity: 2 },
+    sinh: { fn: Math.sinh, arity: 1 },
+    cosh: { fn: Math.cosh, arity: 1 },
+    tanh: { fn: Math.tanh, arity: 1 },
+    hypot: { fn: Math.hypot, arity: null },
+    min: { fn: Math.min, arity: null },
+    max: { fn: Math.max, arity: null },
+});
+const MATH_CONSTANTS = Object.freeze({
+    PI: Math.PI,
+    E: Math.E,
+    LN2: Math.LN2,
+    LN10: Math.LN10,
+    LOG2E: Math.LOG2E,
+    LOG10E: Math.LOG10E,
+    SQRT2: Math.SQRT2,
+    SQRT1_2: Math.SQRT1_2,
+});
+/** The names the model may use, for the error text and the tool description. */
+export const ARITHMETIC_FUNCTION_NAMES = Object.freeze(Object.keys(MATH_FUNCTIONS));
+export const ARITHMETIC_CONSTANT_NAMES = Object.freeze(Object.keys(MATH_CONSTANTS));
+class ArithmeticSyntaxError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ArithmeticSyntaxError";
+    }
+}
+const NUMBER_PATTERN = /^(?:\d+\.?\d*|\.\d+)(?:[eE][+-]?\d+)?/;
+const IDENTIFIER_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)*/;
+function tokenize(expression) {
+    const tokens = [];
+    let index = 0;
+    while (index < expression.length) {
+        const char = expression[index];
+        if (char === " " || char === "\t" || char === "\n" || char === "\r") {
+            index++;
+            continue;
+        }
+        const rest = expression.slice(index);
+        const numberMatch = NUMBER_PATTERN.exec(rest);
+        if (numberMatch) {
+            const value = Number(numberMatch[0]);
+            if (!Number.isFinite(value)) {
+                throw new ArithmeticSyntaxError(`Number literal at position ${index} is out of range`);
+            }
+            tokens.push({ kind: "number", value, at: index });
+            index += numberMatch[0].length;
+            continue;
+        }
+        const identifierMatch = IDENTIFIER_PATTERN.exec(rest);
+        if (identifierMatch) {
+            tokens.push({ kind: "identifier", name: identifierMatch[0], at: index });
+            index += identifierMatch[0].length;
+            continue;
+        }
+        if (rest.startsWith("**")) {
+            tokens.push({ kind: "operator", value: "**", at: index });
+            index += 2;
+            continue;
+        }
+        if (char === "+" ||
+            char === "-" ||
+            char === "*" ||
+            char === "/" ||
+            char === "%") {
+            tokens.push({ kind: "operator", value: char, at: index });
+            index++;
+            continue;
+        }
+        if (char === "(" || char === ")") {
+            tokens.push({ kind: "paren", value: char, at: index });
+            index++;
+            continue;
+        }
+        if (char === ",") {
+            tokens.push({ kind: "comma", at: index });
+            index++;
+            continue;
+        }
+        throw new ArithmeticSyntaxError(`Unexpected character "${char}" at position ${index}`);
+    }
+    tokens.push({ kind: "end", at: expression.length });
+    return tokens;
+}
+/** `Math.sqrt` and `sqrt` name the same function; anything else is refused. */
+function resolveName(name) {
+    return name.startsWith("Math.") ? name.slice("Math.".length) : name;
+}
+class Parser {
+    tokens;
+    position = 0;
+    depth = 0;
+    constructor(tokens) {
+        this.tokens = tokens;
+    }
+    parse() {
+        const value = this.parseExpression();
+        const token = this.peek();
+        if (token.kind !== "end") {
+            throw new ArithmeticSyntaxError(`Unexpected input at position ${token.at}`);
+        }
+        return value;
+    }
+    peek() {
+        return this.tokens[this.position];
+    }
+    next() {
+        const token = this.tokens[this.position];
+        this.position++;
+        return token;
+    }
+    isOperator(token, value) {
+        return token.kind === "operator" && token.value === value;
+    }
+    enter() {
+        this.depth++;
+        if (this.depth > MAX_NESTING_DEPTH) {
+            throw new ArithmeticSyntaxError(`Expression nests deeper than ${MAX_NESTING_DEPTH} levels`);
+        }
+    }
+    leave() {
+        this.depth--;
+    }
+    parseExpression() {
+        let left = this.parseTerm();
+        for (;;) {
+            const token = this.peek();
+            if (this.isOperator(token, "+")) {
+                this.next();
+                left += this.parseTerm();
+            }
+            else if (this.isOperator(token, "-")) {
+                this.next();
+                left -= this.parseTerm();
+            }
+            else {
+                return left;
+            }
+        }
+    }
+    parseTerm() {
+        let left = this.parseUnary();
+        for (;;) {
+            const token = this.peek();
+            if (this.isOperator(token, "*")) {
+                this.next();
+                left *= this.parseUnary();
+            }
+            else if (this.isOperator(token, "/")) {
+                this.next();
+                left /= this.parseUnary();
+            }
+            else if (this.isOperator(token, "%")) {
+                this.next();
+                left %= this.parseUnary();
+            }
+            else {
+                return left;
+            }
+        }
+    }
+    parseUnary() {
+        const token = this.peek();
+        if (this.isOperator(token, "-")) {
+            this.next();
+            this.enter();
+            const value = -this.parseUnary();
+            this.leave();
+            return value;
+        }
+        if (this.isOperator(token, "+")) {
+            this.next();
+            this.enter();
+            const value = this.parseUnary();
+            this.leave();
+            return value;
+        }
+        return this.parsePower();
+    }
+    parsePower() {
+        const base = this.parsePrimary();
+        if (this.isOperator(this.peek(), "**")) {
+            this.next();
+            this.enter();
+            const exponent = this.parseUnary();
+            this.leave();
+            return base ** exponent;
+        }
+        return base;
+    }
+    parsePrimary() {
+        const token = this.next();
+        if (token.kind === "number") {
+            return token.value;
+        }
+        if (token.kind === "paren" && token.value === "(") {
+            this.enter();
+            const value = this.parseExpression();
+            this.leave();
+            this.expectClosingParen();
+            return value;
+        }
+        if (token.kind === "identifier") {
+            return this.parseIdentifier(token.name, token.at);
+        }
+        if (token.kind === "end") {
+            throw new ArithmeticSyntaxError("Expression ended unexpectedly");
+        }
+        throw new ArithmeticSyntaxError(`Unexpected token at position ${token.at}`);
+    }
+    expectClosingParen() {
+        const token = this.next();
+        if (token.kind !== "paren" || token.value !== ")") {
+            throw new ArithmeticSyntaxError(`Expected ")" at position ${token.at}`);
+        }
+    }
+    parseIdentifier(name, at) {
+        const resolved = resolveName(name);
+        const following = this.peek();
+        const isCall = following.kind === "paren" && following.value === "(";
+        if (isCall) {
+            const definition = Object.prototype.hasOwnProperty.call(MATH_FUNCTIONS, resolved)
+                ? MATH_FUNCTIONS[resolved]
+                : undefined;
+            if (!definition) {
+                throw new ArithmeticSyntaxError(`Unknown function "${name}" at position ${at}. Allowed: ${ARITHMETIC_FUNCTION_NAMES.join(", ")}`);
+            }
+            this.next();
+            this.enter();
+            const args = this.parseArguments();
+            this.leave();
+            if (definition.arity !== null && args.length !== definition.arity) {
+                throw new ArithmeticSyntaxError(`"${name}" takes ${definition.arity} argument(s), got ${args.length}`);
+            }
+            return definition.fn(...args);
+        }
+        if (Object.prototype.hasOwnProperty.call(MATH_CONSTANTS, resolved)) {
+            return MATH_CONSTANTS[resolved];
+        }
+        throw new ArithmeticSyntaxError(`Unknown identifier "${name}" at position ${at}. Allowed constants: ${ARITHMETIC_CONSTANT_NAMES.join(", ")}`);
+    }
+    /** Called after the opening parenthesis has been consumed. */
+    parseArguments() {
+        const args = [];
+        if (this.peek().kind === "paren") {
+            this.expectClosingParen();
+            return args;
+        }
+        for (;;) {
+            args.push(this.parseExpression());
+            if (args.length > MAX_FUNCTION_ARGUMENTS) {
+                throw new ArithmeticSyntaxError(`A function call may take at most ${MAX_FUNCTION_ARGUMENTS} arguments`);
+            }
+            const token = this.next();
+            if (token.kind === "comma") {
+                continue;
+            }
+            if (token.kind === "paren" && token.value === ")") {
+                return args;
+            }
+            throw new ArithmeticSyntaxError(`Expected "," or ")" at position ${token.at}`);
+        }
+    }
+}
+/**
+ * Evaluate an arithmetic expression without executing it as code.
+ *
+ * Total: every failure — unsupported syntax, an unknown name, a result that is
+ * not a finite number — comes back as `{ ok: false, error }`, never a throw.
+ */
+export function evaluateArithmetic(expression) {
+    if (typeof expression !== "string") {
+        return { ok: false, error: "Expression must be a string" };
+    }
+    if (expression.trim().length === 0) {
+        return { ok: false, error: "Expression is empty" };
+    }
+    if (expression.length > MAX_EXPRESSION_LENGTH) {
+        return {
+            ok: false,
+            error: `Expression is ${expression.length} characters long; the limit is ${MAX_EXPRESSION_LENGTH}`,
+        };
+    }
+    try {
+        const value = new Parser(tokenize(expression)).parse();
+        if (!Number.isFinite(value)) {
+            return {
+                ok: false,
+                error: Number.isNaN(value)
+                    ? "Result is not a number"
+                    : "Result is not a finite number",
+            };
+        }
+        return { ok: true, value };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            error: error instanceof Error ? error.message : "Could not parse expression",
+        };
+    }
+}

package/dist/agent/directTools.d.ts

@@ -104,21 +104,15 @@ export declare function createDirectAgentTools(policy: FileToolRootPolicy): {
     }, {
         success: boolean;
         error: string;
-        expression?: undefined;
+        expression: string;
         result?: undefined;
         type?: undefined;
     } | {
         success: boolean;
         expression: string;
-        result: any;
-        type: "string" | "number" | "bigint" | "boolean" | "symbol" | "undefined" | "object" | "function";
+        result: number;
+        type: string;
         error?: undefined;
-    } | {
-        success: boolean;
-        error: string;
-        expression: string;
-        result?: undefined;
-        type?: undefined;
     }>;
     writeFile: Tool;
     analyzeCSV: Tool;
@@ -232,21 +226,15 @@ export declare const directAgentTools: {
     }, {
         success: boolean;
         error: string;
-        expression?: undefined;
+        expression: string;
         result?: undefined;
         type?: undefined;
     } | {
         success: boolean;
         expression: string;
-        result: any;
-        type: "string" | "number" | "bigint" | "boolean" | "symbol" | "undefined" | "object" | "function";
+        result: number;
+        type: string;
         error?: undefined;
-    } | {
-        success: boolean;
-        error: string;
-        expression: string;
-        result?: undefined;
-        type?: undefined;
     }>;
     writeFile: Tool;
     analyzeCSV: Tool;

package/dist/agent/directTools.js

@@ -5,6 +5,7 @@ import { execFile } from "child_process";
 import { logger } from "../utils/logger.js";
 import { CSVProcessor } from "../utils/csvProcessor.js";
 import { shouldEnableBashTool } from "../utils/toolUtils.js";
+import { ARITHMETIC_CONSTANT_NAMES, ARITHMETIC_FUNCTION_NAMES, evaluateArithmetic, } from "./arithmeticEvaluator.js";
 import { tool } from "../utils/tool.js";
 import { withTimeout } from "../utils/async/withTimeout.js";
 import { resolvePathWithinRoot, resolveWithinRoot, } from "../utils/pathSandbox.js";
@@ -689,11 +690,11 @@ const policyFreeTools = {
         },
     }),
     calculateMath: tool({
-        description: "Perform mathematical calculations safely",
+        description: "Evaluate an arithmetic expression: numbers, + - * / % **, parentheses and Math functions such as sqrt, pow, sin, log, min, max (with or without the Math. prefix). Not a JavaScript evaluator.",
         inputSchema: z.object({
             expression: z
                 .string()
-                .describe('Mathematical expression to evaluate (e.g., "2 + 2", "Math.sqrt(16)")'),
+                .describe('Arithmetic expression to evaluate (e.g., "2 + 2", "Math.sqrt(16)", "pow(2, 10) % 7")'),
             precision: z
                 .number()
                 .optional()
@@ -701,64 +702,24 @@ const policyFreeTools = {
                 .default(2),
         }),
         execute: async ({ expression, precision }) => {
-            try {
-                // Simple safe evaluation - only allow basic math operations
-                const sanitizedExpression = expression.replace(/[^0-9+\-*/().\s]/g, "");
-                if (sanitizedExpression !== expression) {
-                    // Try Math functions for more complex operations
-                    const allowedMathFunctions = [
-                        "Math.abs",
-                        "Math.ceil",
-                        "Math.floor",
-                        "Math.round",
-                        "Math.sqrt",
-                        "Math.pow",
-                        "Math.sin",
-                        "Math.cos",
-                        "Math.tan",
-                        "Math.log",
-                        "Math.exp",
-                        "Math.PI",
-                        "Math.E",
-                    ];
-                    let safeExpression = expression;
-                    for (const func of allowedMathFunctions) {
-                        safeExpression = safeExpression.replace(new RegExp(func, "g"), func);
-                    }
-                    // Remove remaining non-safe characters except Math functions
-                    const mathSafe = /^[0-9+\-*/().\s]|Math\.(abs|ceil|floor|round|sqrt|pow|sin|cos|tan|log|exp|PI|E)/g;
-                    if (!safeExpression
-                        .split("")
-                        .every((char) => mathSafe.test(char) ||
-                        char === "(" ||
-                        char === ")" ||
-                        char === "," ||
-                        char === " ")) {
-                        return {
-                            success: false,
-                            error: `Unsafe expression: Only basic math operations and Math functions are allowed`,
-                        };
-                    }
-                }
-                // Use Function constructor for safe evaluation
-                const result = new Function(`'use strict'; return (${expression})`)();
-                const roundedResult = typeof result === "number"
-                    ? Number(result.toFixed(precision))
-                    : result;
-                return {
-                    success: true,
-                    expression,
-                    result: roundedResult,
-                    type: typeof result,
-                };
-            }
-            catch (error) {
+            // The expression is model output. It is parsed and evaluated by
+            // `evaluateArithmetic` — a recursive-descent parser over numbers and a
+            // fixed list of Math functions — never run as JavaScript.
+            const evaluation = evaluateArithmetic(expression);
+            if (!evaluation.ok) {
                 return {
                     success: false,
-                    error: error instanceof Error ? error.message : String(error),
+                    error: `${evaluation.error}. Only numbers, + - * / % ** parentheses and the Math functions ${ARITHMETIC_FUNCTION_NAMES.join(", ")} (constants ${ARITHMETIC_CONSTANT_NAMES.join(", ")}) are supported.`,
                     expression,
                 };
             }
+            const digits = Math.min(Math.max(Math.trunc(precision ?? 2), 0), 100);
+            return {
+                success: true,
+                expression,
+                result: Number(evaluation.value.toFixed(digits)),
+                type: "number",
+            };
         },
     }),
     websearchGrounding: tool({
@@ -907,7 +868,7 @@ export function createDirectAgentTools(policy) {
  */
 export function createBashTool(policy) {
     return tool({
-        description: "Execute a bash/shell command and return stdout, stderr, and exit code. Supports full shell syntax including pipes, redirects, and variable expansion. Requires HITL confirmation when enabled. The command runs with the full privileges of the process: tool roots constrain only its starting directory (cwd), not where the command itself can reach.",
+        description: "Execute a bash/shell command and return stdout, stderr, and exit code. Supports full shell syntax including pipes, redirects, and variable expansion. When HITL is enabled on the NeuroLink instance, every call waits for a human to approve it before it runs. The command runs with the full privileges of the process: tool roots constrain only its starting directory (cwd), not where the command itself can reach.",
         inputSchema: z.object({
             command: z
                 .string()

package/dist/artifacts/artifactStore.d.ts

@@ -46,8 +46,13 @@ export declare class LocalTempArtifactStore implements ArtifactStore {
     private readonly dir;
     private readonly index;
     private readonly rehydrateFromDisk;
+    /** Resolves once the directory has been created and judged ours. */
+    private dirReady;
     /**
-     * @param dir - Storage directory; defaults to `tmpdir()/neurolink-artifacts`
+     * @param dir - Storage directory; defaults to
+     *   `tmpdir()/neurolink-artifacts-<uid>` (per unix user, so two accounts on
+     *   one host never share a directory; plain `neurolink-artifacts` where the
+     *   platform has no uid)
      * @param options - `rehydrateFromDisk` (default true) lets `retrieve()` and
      *   `delete()` fall back to the on-disk sidecar index on an in-memory miss,
      *   which makes artifacts READABLE AND DELETABLE ACROSS PROCESSES sharing
@@ -58,6 +63,17 @@ export declare class LocalTempArtifactStore implements ArtifactStore {
     constructor(dir?: string, options?: {
         rehydrateFromDisk?: boolean;
     });
+    /**
+     * Create the directory if needed and refuse one this user does not own.
+     *
+     * The OS temp directory is shared, so a pre-existing path with our name may
+     * have been planted by another local account: a symlink to somewhere we
+     * would then write into, or a directory they can read. Judge the directory
+     * with `lstat` (never following a link), require a real directory owned by
+     * this uid, and tighten its mode to 0o700 when it is ours but looser. Done
+     * once per instance, before the first write or read.
+     */
+    private ensureOwnedDir;
     generatePreview(payload: string): string;
     store(payload: string, meta: Omit<ArtifactMeta, "createdAt">): Promise<ArtifactRef>;
     retrieve(id: string): Promise<string | null>;
@@ -83,5 +99,10 @@ export declare class LocalTempArtifactStore implements ArtifactStore {
      * now that a miss probes `join(dir, id + ext)` the id — which arrives from
      * the model — reaches the path layer. See `isSafeArtifactId`.
      */
+    /**
+     * `rehydrate` after the directory has been judged ours: a sidecar in a
+     * directory another account controls is not a record to trust.
+     */
+    private rehydrateChecked;
     private rehydrate;
 }

package/dist/artifacts/artifactStore.js

@@ -19,7 +19,7 @@
  * @module artifacts/artifactStore
  */
 import { randomUUID } from "node:crypto";
-import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { lstat, mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { logger } from "../utils/logger.js";
@@ -27,6 +27,15 @@ import { generateArtifactPreview, isSafeArtifactId } from "./artifactReader.js";
 // ---------------------------------------------------------------------------
 // LocalTempArtifactStore
 // ---------------------------------------------------------------------------
+/**
+ * `tmpdir()/neurolink-artifacts-<uid>`: a per-user directory name, so two
+ * accounts on one host never contend for — or read — the same path. Where the
+ * platform has no uid the old shared name is kept.
+ */
+function defaultArtifactDir() {
+    const uid = typeof process.getuid === "function" ? process.getuid() : -1;
+    return join(tmpdir(), uid >= 0 ? `neurolink-artifacts-${uid}` : "neurolink-artifacts");
+}
 /**
  * Sidecar written beside every payload so a process that never called
  * `store()` can still resolve the id (see the index-miss path in `retrieve`).
@@ -103,8 +112,13 @@ export class LocalTempArtifactStore {
     dir;
     index = new Map();
     rehydrateFromDisk;
+    /** Resolves once the directory has been created and judged ours. */
+    dirReady;
     /**
-     * @param dir - Storage directory; defaults to `tmpdir()/neurolink-artifacts`
+     * @param dir - Storage directory; defaults to
+     *   `tmpdir()/neurolink-artifacts-<uid>` (per unix user, so two accounts on
+     *   one host never share a directory; plain `neurolink-artifacts` where the
+     *   platform has no uid)
      * @param options - `rehydrateFromDisk` (default true) lets `retrieve()` and
      *   `delete()` fall back to the on-disk sidecar index on an in-memory miss,
      *   which makes artifacts READABLE AND DELETABLE ACROSS PROCESSES sharing
@@ -113,16 +127,48 @@ export class LocalTempArtifactStore {
      *   isolation: ids not stored by this process resolve to nothing.
      */
     constructor(dir, options) {
-        this.dir = dir ?? join(tmpdir(), "neurolink-artifacts");
+        this.dir = dir ?? defaultArtifactDir();
         this.rehydrateFromDisk =
             options?.rehydrateFromDisk ??
                 process.env.NEUROLINK_ARTIFACT_REHYDRATE !== "false";
     }
+    /**
+     * Create the directory if needed and refuse one this user does not own.
+     *
+     * The OS temp directory is shared, so a pre-existing path with our name may
+     * have been planted by another local account: a symlink to somewhere we
+     * would then write into, or a directory they can read. Judge the directory
+     * with `lstat` (never following a link), require a real directory owned by
+     * this uid, and tighten its mode to 0o700 when it is ours but looser. Done
+     * once per instance, before the first write or read.
+     */
+    ensureOwnedDir() {
+        this.dirReady ??= (async () => {
+            await mkdir(this.dir, { recursive: true, mode: 0o700 });
+            const info = await lstat(this.dir);
+            if (info.isSymbolicLink() || !info.isDirectory()) {
+                throw new Error(`[ArtifactStore] refusing to use "${this.dir}": not a plain directory`);
+            }
+            const uid = typeof process.getuid === "function" ? process.getuid() : -1;
+            if (uid >= 0 && info.uid !== uid) {
+                throw new Error(`[ArtifactStore] refusing to use "${this.dir}": owned by uid ${info.uid}, not ${uid}`);
+            }
+            if (uid >= 0 && (info.mode & 0o077) !== 0) {
+                const { chmod } = await import("node:fs/promises");
+                await chmod(this.dir, 0o700);
+            }
+        })().catch((error) => {
+            // Let the next call retry rather than caching a transient failure.
+            this.dirReady = undefined;
+            throw error;
+        });
+        return this.dirReady;
+    }
     generatePreview(payload) {
         return generateArtifactPreview(payload);
     }
     async store(payload, meta) {
-        await mkdir(this.dir, { recursive: true, mode: 0o700 });
+        await this.ensureOwnedDir();
         const id = randomUUID();
         const ext = meta.contentType === "json" ? ".json" : ".txt";
         const filePath = join(this.dir, `${id}${ext}`);
@@ -145,7 +191,7 @@ export class LocalTempArtifactStore {
     }
     async retrieve(id) {
         const entry = this.index.get(id) ??
-            (this.rehydrateFromDisk ? await this.rehydrate(id) : undefined);
+            (this.rehydrateFromDisk ? await this.rehydrateChecked(id) : undefined);
         if (!entry) {
             logger.debug(`[ArtifactStore] Artifact ${id} not found on disk`);
             return null;
@@ -162,7 +208,7 @@ export class LocalTempArtifactStore {
     }
     async delete(id) {
         const entry = this.index.get(id) ??
-            (this.rehydrateFromDisk ? await this.rehydrate(id) : undefined);
+            (this.rehydrateFromDisk ? await this.rehydrateChecked(id) : undefined);
         if (!entry) {
             return;
         }
@@ -222,6 +268,20 @@ export class LocalTempArtifactStore {
      * now that a miss probes `join(dir, id + ext)` the id — which arrives from
      * the model — reaches the path layer. See `isSafeArtifactId`.
      */
+    /**
+     * `rehydrate` after the directory has been judged ours: a sidecar in a
+     * directory another account controls is not a record to trust.
+     */
+    async rehydrateChecked(id) {
+        try {
+            await this.ensureOwnedDir();
+        }
+        catch (error) {
+            logger.warn(`[ArtifactStore] ${error instanceof Error ? error.message : String(error)}`);
+            return undefined;
+        }
+        return this.rehydrate(id);
+    }
     async rehydrate(id) {
         if (!isSafeArtifactId(id)) {
             logger.debug(`[ArtifactStore] Rejected unsafe artifact id "${id}"`);