@lef237/hagumi 0.1.0 → 0.1.1

package/README.md

@@ -171,7 +171,7 @@ hagumi は、会話の中で必要に応じてツールを使う。`read`・`wri
 `bash` は、保護対象の保存先を除き、実行したユーザーが読めるディレクトリ外のファイルも読める。個人文書や、作業ディレクトリ内外の `.env` などを自動で隠す仕組みはない。ツールの出力に含まれた内容は、モデルに送られ、セッションログにも残る。
 
 - 変更の前には差分が表示され、`[y]` はい / `[n]` いいえ / `[a]` このセッションでは常に許可、から選ぶ。`a` を選んだあとも、差分は表示される。
-- 既にあるファイルは、hagumi がそのセッションで読んだあとでないと変更できない。承認を待っている間も含め、ファイルの内容や対象が変わった場合は変更を止め、読み直しと再承認を求める。新規作成の承認を待っている間に別の人が同名のファイルを作った場合も、上書きしない。
+- 既にあるファイルは、hagumi がそのセッションで読んだあとでないと変更できない。承認を待っている間にファイルの内容が変わったり、作業ディレクトリの外を指すリンクに差し替えられたりした場合は、変更を止めて読み直しを求める。新規作成の承認を待っている間に別の人が同名のファイルを作った場合も、上書きしない。
 - ハードリンクが複数あるファイルは変更しない。作業ディレクトリ外にある同じファイルまで変えてしまうのを防ぐため。
 - `.git` の中には書き込めない。
 - hagumi の保存ディレクトリには、`read`・`write`・`edit` からもアクセスできない。`HAGUMI_HOME` でプロジェクト内を指定した場合も同じ。
@@ -182,7 +182,7 @@ hagumi は、会話の中で必要に応じてツールを使う。`read`・`wri
 - 書き込めるのは、作業ディレクトリと一時ディレクトリだけ。`.git/hooks` と `.git/config` には書き込めない。
 - ネットワークにはつながらない。
 - 既知の認証情報の保存先（`~/.hagumi`、`~/.ssh`、`~/.aws` など）にはアクセスできない。`HAGUMI_HOME` で保存先を変えた場合も、その場所を保護する。保護対象は `src/sandbox.ts` の `secretPaths` にある。この一覧は、認証情報があり得るすべての場所を網羅してはいない。
-- 環境変数は `PATH` や `HOME` などの最小限だけを渡す。API キーやトークンは渡らない。`PATH` からは、作業・一時ディレクトリ内の項目と相対パスを外す。実行ファイルのリンク先が書き込み可能な場所にある項目も外す。そこにある実行ファイルを使うときは、`./tool` のようにパスを指定する。
+- 環境変数は `PATH` や `HOME` などの最小限だけを渡す。API キーやトークンは渡らない。`PATH` からは、作業・一時ディレクトリ内の項目と相対パスを外す。そこにある実行ファイルを使うときは、`./tool` のようにパスを指定する。
 - サンドボックスが使えない環境では、`bash` そのものを使えないようにする。たとえば macOS と Linux 以外の OS や、bubblewrap が入っていない Linux、非特権ユーザー名前空間が無効な Linux がこれに当たる。
 
 ### コマンドの許可リストと禁止リスト
@@ -272,9 +272,9 @@ Responses 形式のリクエストには `store: false` を送り、応答を後
 すべて `~/.hagumi/` に置く。起動時にこのディレクトリを権限 700 にし、以前からある保存先も同じ権限に整える。環境変数 `HAGUMI_HOME` で場所を変えられる。指定した場所も 700 にするので、保存専用のディレクトリを指定する。
 相対パスを指定した場合は、起動した場所からのパスとして扱い、会話中に作業ディレクトリが変わっても保存先は変わらない。
 
-- `auth/<provider>.json`: サインインの情報と API キー。`auth` ディレクトリは権限 700、ファイルは 600 にする。一時ファイルに書き終えてから置き換え、更新途中のデータで以前の認証情報を上書きしない。シンボリックリンクや、ハードリンクが複数ある認証ファイルは使わない。ChatGPT では検証済みのアカウント識別子も保存し、次回以降の再サインインで照合する。検証に失敗した場合、認証情報を置き換えない。
+- `auth/<provider>.json`: サインインの情報と API キー。`auth` ディレクトリは権限 700 で作り、ファイルは前からあるものも含めて 600 にする。検証に失敗した場合、認証情報を置き換えない。
 - `memory/memory.md`: hagumi が覚えていること（[記憶](#記憶)）。
-- `sessions/<id>.jsonl`: やり取りの記録。発言、モデルに送ったリクエスト、受け取ったイベントを、そのまま残す。キーを含むヘッダの値は `<redacted>` に置き換える。`sessions` ディレクトリは権限 700、ログは 600 にし、再開時にも権限を直す。シンボリックリンクや、ハードリンクが複数あるログは使わない。
+- `sessions/<id>.jsonl`: やり取りの記録。発言、モデルに送ったリクエスト、受け取ったイベントを、そのまま残す。キーを含むヘッダの値は `<redacted>` に置き換える。`sessions` ディレクトリとログは、新しく作るときに権限 700 と 600 にする。
 
 ## 開発
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lef237/hagumi",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "A small, playful coding partner that grows with you.",
   "license": "MIT",
   "author": "lef237",

package/src/chatgpt.ts

@@ -13,7 +13,6 @@ const tokenSharing = "chatgpt.tokens.use.direct"
 export type ChatGPTAuth = {
   hostId: string
   clientId: string
-  subject?: string
   accessToken: string
   refreshToken: string
   expiresAt: number
@@ -96,10 +95,9 @@ export async function signIn(showUrl: (url: string) => void): Promise<ChatGPTAut
       redirect_uri: redirect,
     })
     if (!tokens.scope?.split(" ").includes(tokenSharing)) throw new Problem("noTokenSharing")
-    const subject = await checkIdToken(tokens.id_token, clientId, nonce)
-    if (saved?.subject && subject !== saved.subject) throw new Error("ChatGPT returned a different account")
+    await checkIdToken(tokens.id_token, clientId, nonce)
 
-    const auth = toAuth(tokens, { hostId, clientId, subject })
+    const auth = toAuth(tokens, { hostId, clientId })
     await writeSecret(paths.auth("chatgpt"), auth)
     return auth
   } finally {
@@ -144,68 +142,37 @@ async function requestToken(params: Record<string, string>): Promise<TokenRespon
   return (await response.json()) as TokenResponse
 }
 
-// This one provider uses RS256. Fetch its public keys fresh at each sign-in; never trust a token's key URL.
+// Checked as OpenAI's guide for open-source apps asks: the signature against OpenAI's published keys, fetched
+// fresh at each sign-in so that no cache is needed, then who issued the token, for whom, for this sign-in, and when.
 // https://developers.openai.com/siwc/token-sharing-open-source/sign-in
-export async function checkIdToken(idToken: string | undefined, clientId: string, nonce: string): Promise<string> {
-  try {
-    if (typeof idToken !== "string") throw new Error()
-    const parts = idToken.split(".")
-    if (parts.length !== 3 || parts.some((part) =>
-      !/^[A-Za-z0-9_-]+$/.test(part) || Buffer.from(part, "base64url").toString("base64url") !== part)) throw new Error()
-    const [head = "", body = "", signature = ""] = parts
-    const decode = (part: string): Record<string, unknown> => {
-      const value: unknown = JSON.parse(Buffer.from(part, "base64url").toString("utf8"))
-      if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error()
-      return value as Record<string, unknown>
-    }
-    const header = decode(head)
-    if (header.alg !== "RS256" || typeof header.kid !== "string" || !header.kid ||
-      header.crit !== undefined || header.b64 !== undefined) throw new Error()
-    const response = await fetch(`${issuer}/.well-known/jwks.json`, {
-      redirect: "error", signal: AbortSignal.timeout(10_000), headers: { "User-Agent": userAgent },
-    })
-    if (!response.ok) throw new Error()
-    const { keys } = await response.json() as { keys: (webcrypto.JsonWebKey & { kid?: string })[] }
-    if (!Array.isArray(keys)) throw new Error()
-    const matching = keys.filter((key) => key?.kid === header.kid)
-    const jwk = matching[0]
-    if (matching.length !== 1 || !jwk || jwk.kty !== "RSA" || jwk.d !== undefined ||
-      (jwk.alg !== undefined && jwk.alg !== "RS256") || (jwk.use !== undefined && jwk.use !== "sig")) throw new Error()
-    const rsa = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }
-    const key = await crypto.subtle.importKey("jwk", jwk, rsa, false, ["verify"])
-    if ((key.algorithm as webcrypto.RsaKeyAlgorithm).modulusLength < 2048 ||
-      !await crypto.subtle.verify(rsa, key, Buffer.from(signature, "base64url"), new TextEncoder().encode(`${head}.${body}`))) throw new Error()
-    const claims = decode(body)
-    const audience = typeof claims.aud === "string" ? [claims.aud] : claims.aud
-    const numeric = (value: unknown): value is number => typeof value === "number" && Number.isFinite(value)
-    const now = Date.now() / 1000
-    if (claims.iss !== issuer || claims.nonce !== nonce || typeof claims.sub !== "string" || !claims.sub ||
-      !Array.isArray(audience) || !audience.every((value) => typeof value === "string" && value.length > 0) ||
-      !audience.includes(clientId) ||
-      ((audience.length > 1 || claims.azp !== undefined) && claims.azp !== clientId) ||
-      !numeric(claims.exp) || !numeric(claims.iat) || claims.exp <= now - 5 ||
-      claims.iat > now + 5 || claims.iat >= claims.exp ||
-      (claims.nbf !== undefined && (!numeric(claims.nbf) || claims.nbf > now + 5))) throw new Error()
-    return claims.sub
-  } catch {
-    // Do not expose token contents or key-server response bodies through errors.
-    throw new Error("ChatGPT ID token verification failed")
+export async function checkIdToken(idToken: string | undefined, clientId: string, nonce: string): Promise<void> {
+  const [head = "", body = "", signature = ""] = (idToken ?? "").split(".")
+  const decode = (part: string) => { try { return JSON.parse(Buffer.from(part, "base64url").toString()) } catch { return {} } }
+  const header = decode(head)
+  const response = await fetch(`${issuer}/.well-known/jwks.json`, { signal: AbortSignal.timeout(10_000) })
+  if (!response.ok) throw new Error(`Could not get OpenAI's signing keys: ${response.status}`)
+  const { keys } = (await response.json()) as { keys: (webcrypto.JsonWebKey & { kid?: string })[] }
+  const jwk = keys.find((key) => key.kid === header.kid)
+  const rsa = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }
+  const key = header.alg === "RS256" && jwk && (await crypto.subtle.importKey("jwk", jwk, rsa, false, ["verify"]))
+  const signed = key && (await crypto.subtle.verify(rsa, key, Buffer.from(signature, "base64url"), Buffer.from(`${head}.${body}`)))
+  const claims = decode(body)
+  const now = Date.now() / 1000
+  if (!signed || claims.iss !== issuer || ![claims.aud].flat().includes(clientId) || claims.nonce !== nonce ||
+    !(claims.exp > now - 5) || !(claims.iat < now + 5) || !claims.sub) {
+    throw new Error("ChatGPT returned an invalid ID token")
   }
 }
 
-function toAuth(tokens: TokenResponse, previous: Pick<ChatGPTAuth, "hostId" | "clientId" | "subject"> & { refreshToken?: string }) {
-  const refreshToken = tokens.refresh_token === undefined ? previous.refreshToken : tokens.refresh_token
-  const expiresIn = tokens.expires_in === undefined ? 3600 : tokens.expires_in
-  const expiresAt = Date.now() + expiresIn * 1000
-  if (typeof tokens.access_token !== "string" || !tokens.access_token || typeof refreshToken !== "string" || !refreshToken ||
-    typeof expiresIn !== "number" || !Number.isFinite(expiresIn) || expiresIn <= 0 || !Number.isFinite(expiresAt)) throw new Error("ChatGPT returned invalid credentials")
+function toAuth(tokens: TokenResponse, previous: Pick<ChatGPTAuth, "hostId" | "clientId"> & { refreshToken?: string }) {
+  const refreshToken = tokens.refresh_token ?? previous.refreshToken
+  if (!refreshToken) throw new Error("ChatGPT returned no refresh token")
   return {
     hostId: previous.hostId,
     clientId: previous.clientId,
-    subject: previous.subject,
     accessToken: tokens.access_token,
     refreshToken,
-    expiresAt,
+    expiresAt: Date.now() + (tokens.expires_in ?? 3600) * 1000,
   } satisfies ChatGPTAuth
 }
 

package/src/log.ts

@@ -1,5 +1,4 @@
-import { constants } from "node:fs"
-import { type FileHandle, mkdir, open } from "node:fs/promises"
+import { appendFile, mkdir } from "node:fs/promises"
 import { dirname } from "node:path"
 import { paths } from "./app"
 
@@ -13,60 +12,24 @@ export type SessionLog = {
 }
 
 // Append-only JSONL: every message, every request sent to a model, and every event received, as they were.
-// Opening an existing session continues it.
+// Opening an existing session continues it. Logs hold conversations and code, so only the user can read new ones.
 export async function openSessionLog(id: string = crypto.randomUUID()): Promise<SessionLog> {
+  // The id names a file, so one given with --session must not reach outside the sessions directory.
   if (!/^[A-Za-z0-9_-]+$/.test(id)) throw new Error("Invalid session id")
   const path = paths.session(id)
-  const existing = await privateLog(path, constants.O_RDONLY)
-  await existing?.close()
+  await mkdir(dirname(path), { recursive: true, mode: 0o700 })
   return {
     id,
     path,
-    async append(entry) {
-      const file = (await privateLog(path, constants.O_WRONLY | constants.O_APPEND | constants.O_CREAT))!
-      try {
-        await file.appendFile(`${JSON.stringify({ at: new Date().toISOString(), ...entry })}\n`)
-      } finally {
-        await file.close()
-      }
-    },
+    append: (entry) => appendFile(path, `${JSON.stringify({ at: new Date().toISOString(), ...entry })}\n`, { mode: 0o600 }),
     async read() {
-      const file = await privateLog(path, constants.O_RDONLY)
-      if (!file) return []
-      try {
-        const text = await file.readFile("utf8")
-        return text.split("\n").filter(Boolean).map((line) => JSON.parse(line) as LogEntry)
-      } finally {
-        await file.close()
-      }
+      const file = Bun.file(path)
+      if (!(await file.exists())) return []
+      const text = await file.text()
+      return text
+        .split("\n")
+        .filter(Boolean)
+        .map((line) => JSON.parse(line) as LogEntry)
     },
   }
 }
-
-// Tighten an existing log before reading or appending. Work on the opened file, never a link's target.
-async function privateLog(path: string, flags: number): Promise<FileHandle | undefined> {
-  const dir = dirname(path)
-  await mkdir(dir, { recursive: true, mode: 0o700 })
-  const directory = await open(dir, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW)
-  try {
-    await directory.chmod(0o700)
-  } finally {
-    await directory.close()
-  }
-  let file: FileHandle
-  try {
-    file = await open(path, flags | constants.O_NOFOLLOW | constants.O_NONBLOCK, 0o600)
-  } catch (error) {
-    if (!(flags & constants.O_CREAT) && (error as NodeJS.ErrnoException).code === "ENOENT") return
-    throw error
-  }
-  try {
-    const stat = await file.stat()
-    if (!stat.isFile() || stat.nlink !== 1) throw new Error("Session log must be a regular file with one link")
-    await file.chmod(0o600)
-    return file
-  } catch (error) {
-    await file.close()
-    throw error
-  }
-}

package/src/sandbox.ts

@@ -7,7 +7,6 @@ import { realpath } from "node:fs/promises"
 import { homedir, tmpdir } from "node:os"
 import { delimiter, isAbsolute, join, relative, sep } from "node:path"
 import { storageHome } from "./app"
-import { analyze } from "./shell"
 
 // What a command may touch, decided once for every platform.
 export type Limits = {
@@ -78,7 +77,7 @@ export async function runSandboxed(options: {
     cwd: workspace,
     env: {
       ...Object.fromEntries(passedEnvironment.flatMap((name) => (process.env[name] ? [[name, process.env[name]]] : []))),
-      PATH: await searchPath([...limits.writable, "/private/tmp", "/dev"], options.command),
+      PATH: await searchPath([...limits.writable, "/private/tmp", "/dev"]),
     },
     stdin: "ignore",
     stdout: "pipe",
@@ -93,32 +92,22 @@ export async function runSandboxed(options: {
   return { exitCode, stdout, stderr, timedOut: child.signalCode !== null }
 }
 
-// Bare command names must not select executables the model can replace. Check directories and executable links;
-// relative entries would also change their meaning after cd. Local tools can still run by an explicit path.
-async function searchPath(writable: string[], command: string): Promise<string> {
+// Bare command names must not pick a program the model could have put in place: directories it can write to leave
+// PATH, and so do relative entries, whose meaning changes with cd. Programs there still run by their path.
+async function searchPath(writable: string[]): Promise<string> {
   const outside = (target: string) => writable.every((root) => {
     const fromRoot = relative(root, target)
     return fromRoot === ".." || fromRoot.startsWith(`..${sep}`) || isAbsolute(fromRoot)
   })
-  const programs = [...new Set(analyze(command).commands.flatMap(([program]) => program && !program.includes("/") ? [program] : []))]
   const entries = await Promise.all((process.env.PATH ?? "/usr/bin:/bin").split(delimiter).map(async (entry) => {
-    if (!isAbsolute(entry)) return undefined
-    const target = await realpath(entry).catch(() => undefined)
-    if (!target || !outside(target)) return undefined
-    const executables = await Promise.all(programs.map((program) => existingPath(join(target, program)))).catch(() => undefined)
-    return executables?.every((executable) => executable === undefined || outside(executable)) ? target : undefined
+    const target = isAbsolute(entry) ? await realpath(entry).catch(() => undefined) : undefined
+    return target && outside(target) ? target : undefined
   }))
   const path = [...new Set(entries.filter((entry) => entry !== undefined))].join(delimiter)
   if (!path) throw new Error("PATH has no command directories outside the writable locations")
   return path
 }
 
-// A dangling executable link is unsafe too: its target could be created inside the workspace before execution.
-async function existingPath(path: string): Promise<string | undefined> {
-  try { lstatSync(path) } catch { return undefined }
-  return realpath(path)
-}
-
 // The real path where it exists; a path that does not exist yet has nothing to resolve.
 function real(path: string): Promise<string> {
   return realpath(path).catch(() => path)

package/src/store.ts

@@ -1,6 +1,5 @@
-import { constants } from "node:fs"
-import { lstat, mkdir, open, rename, unlink, writeFile } from "node:fs/promises"
-import { basename, dirname, join } from "node:path"
+import { chmod, mkdir, writeFile } from "node:fs/promises"
+import { dirname } from "node:path"
 
 export async function readJson<T>(path: string): Promise<T | undefined> {
   const file = Bun.file(path)
@@ -12,35 +11,9 @@ export async function writeJson(path: string, value: unknown): Promise<void> {
   await writeFile(path, `${JSON.stringify(value, null, 2)}\n`)
 }
 
-// Finish and sync a private file before atomically replacing the old credentials.
+// Secrets are readable by the user only, including files that already existed.
 export async function writeSecret(path: string, value: unknown): Promise<void> {
-  const text = JSON.stringify(value, null, 2)
-  if (text === undefined) throw new Error("Credentials must be JSON data")
-  const dir = dirname(path)
-  await mkdir(dir, { recursive: true, mode: 0o700 })
-  const directory = await open(dir, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW)
-  try {
-    await directory.chmod(0o700)
-  } finally {
-    await directory.close()
-  }
-  const existing = await lstat(path).catch((error) => {
-    if (error.code === "ENOENT") return undefined
-    throw error
-  })
-  if (existing && (!existing.isFile() || existing.nlink !== 1)) throw new Error("Credentials must be a regular file with one link")
-  const temporary = join(dir, `.${basename(path)}.${crypto.randomUUID()}.tmp`)
-  const file = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600)
-  try {
-    try {
-      await file.chmod(0o600)
-      await file.writeFile(`${text}\n`)
-      await file.sync()
-    } finally {
-      await file.close()
-    }
-    await rename(temporary, path)
-  } finally {
-    await unlink(temporary).catch((error) => { if (error.code !== "ENOENT") throw error })
-  }
+  await mkdir(dirname(path), { recursive: true, mode: 0o700 })
+  await writeFile(path, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 })
+  await chmod(path, 0o600)
 }

package/src/tools/change.ts

@@ -1,18 +1,12 @@
 // Changes to files: planned by a tool, approved by the user, then written here.
-import { type BigIntStats, constants, fstatSync, ftruncateSync, readFileSync, statSync, writeSync } from "node:fs"
-import { type FileHandle, mkdir, open, realpath } from "node:fs/promises"
+import { constants } from "node:fs"
+import { mkdir, open, realpath, stat } from "node:fs/promises"
 import { dirname, relative, sep } from "node:path"
 import type { ToolContext } from "."
 import { fingerprint, resolveInWorkspace } from "./workspace"
 
 // `before` is undefined for a new file.
-export type Change = { path: string; target: string; before: string | undefined; version?: string; after: string }
-
-// A file's identity and revision, without losing precision for inode numbers or timestamps.
-function version(state: BigIntStats): string {
-  if (!state.isFile() || state.nlink !== 1n) throw new Error("Changes require a regular file with only one hard link")
-  return `${state.dev}:${state.ino}:${state.size}:${state.mtimeNs}:${state.ctimeNs}`
-}
+export type Change = { path: string; target: string; before: string | undefined; after: string }
 
 // Resolves where a change would land, and what is there now.
 export async function current(path: string, context: ToolContext): Promise<Omit<Change, "after">> {
@@ -20,58 +14,34 @@ export async function current(path: string, context: ToolContext): Promise<Omit<
   // Git runs hooks from here; nothing the model writes should land in it.
   const fromRoot = relative(await realpath(context.workspace), target)
   if (fromRoot.split(sep).includes(".git")) throw new Error(`${path} is inside .git`)
-  const file = await open(target, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK).catch((error) => {
-    if (error.code === "ENOENT") return undefined
-    throw error
-  })
-  if (!file) return { path, target, before: undefined }
+  const file = Bun.file(target)
+  if (!(await file.exists())) return { path, target, before: undefined }
+  // Another hard link to the file may live outside the workspace, and would change with it.
+  if ((await stat(target)).nlink > 1) throw new Error(`${path} has more than one hard link`)
 
   // A file is changed only as the model last read it, so that no one's edits are lost.
-  try {
-    const stamp = version(await file.stat({ bigint: true }))
-    const before = await file.readFile("utf8")
-    if (target !== await resolveInWorkspace(path, context.workspace) || version(statSync(target, { bigint: true })) !== stamp ||
-        version(await file.stat({ bigint: true })) !== stamp || context.seen.get(target) !== fingerprint(before)) {
-      throw new Error(`Read ${path} first: it has not been read in this session, or it changed since`)
-    }
-    return { path, target, before, version: stamp }
-  } finally {
-    await file.close()
+  const before = await file.text()
+  if (context.seen.get(target) !== fingerprint(before)) {
+    throw new Error(`Read ${path} first: it has not been read in this session, or it changed since`)
   }
+  return { path, target, before }
 }
 
 export async function apply(change: Change, context: ToolContext): Promise<string> {
-  const changed = () => new Error(`Read ${change.path} again: it changed while awaiting approval`)
-  let file: FileHandle | undefined
+  // Approval can take a while. Look again, so that edits made meanwhile are kept,
+  // and a file swapped for a link meanwhile is not followed outside the workspace.
+  const latest = await current(change.path, context)
+  if (latest.target !== change.target || latest.before !== change.before) {
+    throw new Error(`Read ${change.path} again: it changed while awaiting approval`)
+  }
+  await mkdir(dirname(change.target), { recursive: true })
+  // Never through a link put in place at the last moment, and a new file must still be new.
+  const flags = constants.O_WRONLY | constants.O_NOFOLLOW | (change.before === undefined ? constants.O_CREAT | constants.O_EXCL : constants.O_TRUNC)
+  const file = await open(change.target, flags)
   try {
-    const latest = await current(change.path, context)
-    if (latest.target !== change.target || latest.before !== change.before || latest.version !== change.version) throw changed()
-    await mkdir(dirname(change.target), { recursive: true })
-    if (await resolveInWorkspace(change.path, context.workspace) !== change.target) throw changed()
-
-    // Never truncate on open. A new file must not exist; an existing file must still be the approved inode.
-    const flags = constants.O_RDWR | constants.O_NOFOLLOW | constants.O_NONBLOCK |
-      (change.before === undefined ? constants.O_CREAT | constants.O_EXCL : 0)
-    file = await open(change.target, flags)
-    if (await resolveInWorkspace(change.path, context.workspace) !== change.target) throw changed()
-    const state = fstatSync(file.fd, { bigint: true })
-    const stamp = version(state)
-    if (change.before === undefined ? state.size !== 0n : stamp !== change.version || readFileSync(file.fd, "utf8") !== change.before) throw changed()
-    if (version(fstatSync(file.fd, { bigint: true })) !== stamp || version(statSync(change.target, { bigint: true })) !== stamp) throw changed()
-
-    // Write to the checked descriptor at explicit offsets, with no async gap after the final checks.
-    const content = Buffer.from(change.after)
-    for (let offset = 0; offset < content.length;) {
-      const written = writeSync(file.fd, content, offset, content.length - offset, offset)
-      if (written === 0) throw new Error(`Could not finish writing ${change.path}`)
-      offset += written
-    }
-    ftruncateSync(file.fd, content.length)
-  } catch (error) {
-    context.seen.delete(change.target)
-    throw error
+    await file.writeFile(change.after)
   } finally {
-    await file?.close()
+    await file.close()
   }
   context.seen.set(change.target, fingerprint(change.after))
   const lines = change.after.split("\n").length