@mnemonik/cli 7.109.3 → 7.110.0

package/dist/diagnostics.js

@@ -502,7 +502,9 @@ var require_ignore = __commonJS({
 });
 
 // packages/shared/dist/runtimeSigners.js
+import { lstatSync, mkdirSync, readFileSync, writeFileSync, renameSync, unlinkSync } from "node:fs";
 import { basename, dirname as dirname2, join as join2, resolve, sep, win32 } from "node:path";
+import { createHash, createPublicKey, randomUUID, timingSafeEqual, verify as verifySignature } from "node:crypto";
 import { execFile, execFileSync } from "node:child_process";
 function windowsCommand(file) {
   const root = process.env.SystemRoot;
@@ -510,14 +512,44 @@ function windowsCommand(file) {
     throw new Error("acl_system_root_unavailable");
   return win32.join(root, "System32", file);
 }
-function readIdentity(stdout) {
-  const match = /^"([^"\r\n]+)","(S-1-(?:\d+-)+\d+)"$/.exec(stdout.trim());
-  if (!match?.[1] || !match[2] || stdout.includes("\uFFFD"))
+function readIdentity(stdout2) {
+  const match = /^"([^"\r\n]+)","(S-1-(?:\d+-)+\d+)"$/.exec(stdout2.trim());
+  if (!match?.[1] || !match[2] || stdout2.includes("\uFFFD"))
     throw new Error("acl_identity_unavailable");
   return { name: match[1], sid: match[2] };
 }
+function* readWindowsIdentity() {
+  const user = readIdentity(yield [windowsCommand("whoami.exe"), identityArgs]);
+  if (!ADMINISTRATOR_RID.test(user.sid))
+    return user;
+  const groups = yield [windowsCommand("whoami.exe"), groupArgs];
+  const local = /^"[^"\r\n]*","[^"\r\n]*","S-1-5-113",/m.test(groups);
+  return {
+    ...user,
+    localAdministratorSid: local ? `${user.sid.slice(0, user.sid.lastIndexOf("-"))}-500` : null
+  };
+}
 function windowsCurrentAccountSync() {
-  return currentIdentity ??= readIdentity(hookExecuteSync(windowsCommand("whoami.exe"), identityArgs));
+  if (currentIdentity)
+    return currentIdentity;
+  const commands = readWindowsIdentity();
+  let step = commands.next();
+  while (!step.done)
+    step = commands.next(hookExecuteSync(...step.value));
+  return currentIdentity = step.value;
+}
+async function windowsIdentity(run2) {
+  if (currentIdentity)
+    return currentIdentity;
+  identityPending ??= drive(readWindowsIdentity(), run2).then((identity) => currentIdentity = identity).finally(() => {
+    identityPending = void 0;
+  });
+  return identityPending;
+}
+async function verifyWindowsAcl(path, run2 = hookExecute, state) {
+  const user = await windowsIdentity(run2);
+  if (!privateEntries((await drive(saveAcl(path, false, [path], state), run2)).get(path), user, false))
+    throw new Error("acl_permissions");
 }
 function hookInvocation(file, args2) {
   if (win32.basename(file) === "whoami.exe") {
@@ -537,12 +569,112 @@ function hookExecuteSync(file, args2, input) {
   [file, args2] = hookInvocation(file, args2);
   return execFileSync(file, args2, { ...hookOptions(file, args2), input });
 }
-var identityArgs, currentIdentity, ttl, hookOptions;
+function aclRecords(output, root, paths, onLookup) {
+  const records = /* @__PURE__ */ new Map();
+  const wanted = new Set(paths);
+  const lines = output.replace(/^\uFEFF/, "").trimEnd().split(/\r?\n/);
+  if (lines.length % 2)
+    throw new Error("acl_unavailable");
+  for (let index = 0; index < lines.length; index += 2) {
+    onLookup?.();
+    const relativePath = lines[index];
+    const descriptor = lines[index + 1];
+    if (relativePath === void 0 || descriptor === void 0)
+      throw new Error("acl_unavailable");
+    const path = resolve(dirname2(root), relativePath.replaceAll("\\", sep));
+    if (!wanted.has(path))
+      continue;
+    if (records.has(path))
+      throw new Error("acl_unavailable");
+    const dacl = /^D:(?:P|AI|AR)*((?:\([^()]*\))*)$/.exec(descriptor);
+    records.set(path, dacl?.[1]?.match(/\([^()]*\)/g) ?? []);
+  }
+  return records;
+}
+function privateEntries(entries, user, directory) {
+  if (!entries?.length)
+    throw new Error("acl_unavailable");
+  return entries.every((line) => {
+    const ace = /^\(([AD]);((?:OI|CI|NP|IO|ID|SA|FA)*);[A-Za-z0-9]+;;;((?:S-1-(?:\d+-)+\d+)|[A-Z]{2})\)$/.exec(line);
+    if (!ace)
+      throw new Error("acl_unavailable");
+    const sid = ace[3] === "LA" ? user.localAdministratorSid : ace[3];
+    return (!directory || !ace[2]?.includes("ID")) && (ace[1] === "D" || sid === user.sid);
+  });
+}
+function* prepareAclDirectory(state) {
+  const directory = join2(state, "audit-tmp");
+  if (auditDirectories.has(directory)) {
+    const stat2 = lstatSync(directory);
+    if (!stat2.isDirectory() || stat2.isSymbolicLink())
+      throw new Error("acl_permissions");
+    return directory;
+  }
+  let created = false;
+  try {
+    mkdirSync(directory, { mode: 448 });
+    created = true;
+  } catch (error) {
+    if (error.code !== "EEXIST")
+      throw error;
+  }
+  const stat = lstatSync(directory);
+  if (!stat.isDirectory() || stat.isSymbolicLink())
+    throw new Error("acl_permissions");
+  if (!auditDirectories.has(directory)) {
+    currentIdentity ??= yield* readWindowsIdentity();
+    yield [windowsCommand("icacls.exe"), aclArgs(directory, currentIdentity.sid, created)];
+    if (!created) {
+      const temp = join2(directory, `.acl-${randomUUID()}.tmp`);
+      writeFileSync(temp, "", { flag: "wx", mode: 384 });
+      try {
+        yield [windowsCommand("icacls.exe"), [directory, "/save", temp, "/l"]];
+        if (!privateEntries(aclRecords(readFileSync(temp, "utf16le"), directory, [directory]).get(directory), currentIdentity, true))
+          throw new Error("acl_permissions");
+      } finally {
+        unlinkSync(temp);
+      }
+    }
+    auditDirectories.add(directory);
+  }
+  return directory;
+}
+function* saveAcl(path, recursive, paths = [path], state = lstatSync(path).isDirectory() ? path : dirname2(path)) {
+  const directory = yield* prepareAclDirectory(state);
+  const temp = join2(directory, `.acl-${randomUUID()}.tmp`);
+  writeFileSync(temp, "", { flag: "wx", mode: 384 });
+  try {
+    yield [windowsCommand("icacls.exe"), [path, "/save", temp, ...recursive ? ["/t"] : [], "/l"]];
+    return aclRecords(readFileSync(temp, "utf16le"), path, paths.filter((item) => item !== directory && !item.startsWith(directory + sep)));
+  } finally {
+    unlinkSync(temp);
+  }
+}
+async function drive(commands, run2) {
+  try {
+    let step = commands.next();
+    while (!step.done)
+      step = commands.next(stdout(await run2(...step.value)));
+    return step.value;
+  } finally {
+    commands.return(void 0);
+  }
+}
+var identityArgs, groupArgs, ADMINISTRATOR_RID, currentIdentity, ttl, identityPending, aclArgs, hookOptions, hookExecute, stdout, auditDirectories;
 var init_runtimeSigners = __esm({
   "packages/shared/dist/runtimeSigners.js"() {
     "use strict";
     identityArgs = ["/user", "/fo", "csv", "/nh"];
+    groupArgs = ["/groups", "/fo", "csv", "/nh"];
+    ADMINISTRATOR_RID = /^S-1-5-21-\d+-\d+-\d+-500$/;
     ttl = 10 * 6e4;
+    aclArgs = (path, sid, created = false) => [
+      path,
+      "/inheritance:r",
+      "/grant:r",
+      `*${sid}:(OI)(CI)F`,
+      ...created ? ["/remove:g", "*S-1-5-32-544", "*S-1-5-18"] : []
+    ];
     hookOptions = (file, args2) => ({
       encoding: args2.includes("/u") ? "utf16le" : "utf8",
       timeout: win32.basename(file) === "powershell.exe" ? 3e4 : 5e3,
@@ -550,6 +682,22 @@ var init_runtimeSigners = __esm({
       maxBuffer: 16 * 1024 * 1024,
       windowsVerbatimArguments: win32.basename(file) === "cmd.exe"
     });
+    hookExecute = (file, args2, input) => {
+      const treeListing = win32.basename(file) === "icacls.exe" && args2.includes("/t") || win32.basename(file) === "cmd.exe" && args2.some((arg) => arg.startsWith("dir /q /a /s "));
+      [file, args2] = hookInvocation(file, args2);
+      const options = hookOptions(file, args2);
+      if (treeListing)
+        options.timeout = 3e4;
+      return new Promise((resolve3, reject) => {
+        const child = execFile(file, args2, options, (error, stdout2) => error ? reject(error) : resolve3({ stdout: stdout2 }));
+        if (input !== void 0) {
+          child.stdin?.on("error", reject);
+          child.stdin?.end(input);
+        }
+      });
+    };
+    stdout = (value) => value.stdout;
+    auditDirectories = /* @__PURE__ */ new Set();
   }
 });
 
@@ -2197,14 +2345,14 @@ var require_proper_lockfile = __commonJS({
 });
 
 // packages/cli/src/diagnostics.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { execFile as nodeExecFile2 } from "node:child_process";
 import { lstat as lstat2, mkdir as mkdir3, readFile as readFile2 } from "node:fs/promises";
-import { dirname as dirname5, join as join6 } from "node:path";
+import { dirname as dirname5, join as join7 } from "node:path";
 
 // packages/credentials/dist/index.js
 import { createHmac, randomBytes } from "node:crypto";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 
 // packages/shared/dist/instructions.js
 var INSTRUCTIONS_CONTENT = `Mnemonik provides persistent project memory: decisions, rationale, tasks, and policies across sessions. If no block begins "PROJECT_CONTEXT schemaVersion=", session_bootstrap({ cwd }) loads project context when cwd is the real absolute path of the project root; a placeholder or relative path fails. With that block, context is loaded and no session_bootstrap call is needed. Code and docs show current artifacts, git shows changes, and memory carries the why; memory_search recalls rationale or intent, then Grep or Read verifies current source.
@@ -6399,7 +6547,7 @@ init_repositoryRoot();
 // packages/local-setup/dist/storage.js
 init_hookRuntime();
 init_hookRuntime();
-import { createHash, randomUUID } from "node:crypto";
+import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
 import { execFile as nodeExecFile } from "node:child_process";
 import fs2 from "node:fs";
 import { open, rename, readFile, mkdir, lstat, chmod, writeFile, unlink, rmdir } from "node:fs/promises";
@@ -6462,6 +6610,9 @@ async function windowsCurrentUserAcl(path, directory = false, options = {}, crea
     });
   });
 }
+async function verifyWindowsCurrentUserOnly(path, state, run2) {
+  await verifyWindowsAcl(path, run2, state);
+}
 async function protectStateFile(path, platform = process.platform, aclOptions) {
   if (platform === "win32")
     await windowsCurrentUserAcl(path, false, aclOptions);
@@ -6471,7 +6622,7 @@ async function protectStateFile(path, platform = process.platform, aclOptions) {
 }
 async function atomicWrite(path, bytes, fault, assertOwned) {
   await assertOwned?.();
-  const temp = `${path}.${randomUUID()}.tmp`;
+  const temp = `${path}.${randomUUID2()}.tmp`;
   const fd = await open(temp, "wx", 384);
   let permissionStatus;
   try {
@@ -6493,7 +6644,7 @@ async function atomicWrite(path, bytes, fault, assertOwned) {
 async function withLock(path, waitMs, work) {
   const lockfile = await sharedLockfile();
   await mkdir(dirname3(path), { recursive: true, mode: 448 });
-  const generation = randomUUID();
+  const generation = randomUUID2();
   const owner = join3(`${path}.lock`, "owner");
   let compromised = false;
   let acquired = false;
@@ -6558,6 +6709,100 @@ async function withLock(path, waitMs, work) {
   }
 }
 
+// packages/local-setup/dist/automaticUpdate.js
+import { spawn as nodeSpawn } from "node:child_process";
+import { realpathSync } from "node:fs";
+import { stat as nodeStat, utimes } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import { join as join4 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+var DAY_MS = 864e5;
+var statePath = (stateDir) => join4(stateDir, "automatic-update.json");
+function cliLauncherPath(options = {}) {
+  const platform = options.platform ?? process.platform;
+  const home = options.home ?? homedir2();
+  return platform === "win32" ? join4(options.env?.LOCALAPPDATA || join4(home, "AppData", "Local"), "Mnemonik", "bin", "mnemonik.cmd") : join4(home, ".local", "bin", "mnemonik");
+}
+async function readState(path) {
+  const bytes = await readBytes(path);
+  if (!bytes)
+    return {};
+  const value = JSON.parse(bytes.toString());
+  if (!value || typeof value !== "object" || value.lastAttempt !== void 0 && (!Number.isFinite(value.lastAttempt) || value.lastAttempt < 0))
+    throw new Error("automatic_update_state_invalid");
+  return value.lastAttempt === void 0 ? {} : { lastAttempt: value.lastAttempt };
+}
+async function maybeStartAutomaticUpdate(options = {}) {
+  const stateDir = options.stateDir ?? stateDirectory(options.platform, options.env, options.home);
+  const path = statePath(stateDir);
+  try {
+    const now = (options.now ?? Date.now)();
+    const stat = options.stat ?? nodeStat;
+    try {
+      if (now - (await stat(path)).mtimeMs < DAY_MS)
+        return false;
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        throw error;
+    }
+    if (!options.spawn && !(await stat(cliLauncherPath(options))).isFile())
+      return false;
+    return await withLock(path, 0, async (assertOwned) => {
+      const state = await readState(path);
+      if (state.lastAttempt !== void 0 && now - state.lastAttempt < DAY_MS)
+        return false;
+      await atomicWrite(path, Buffer.from(`${JSON.stringify({ lastAttempt: now })}
+`), void 0, assertOwned);
+      await utimes(path, now / 1e3, now / 1e3);
+      const platform = options.platform ?? process.platform;
+      const launcher = cliLauncherPath(options);
+      const command = platform === "win32" ? {
+        file: options.env?.ComSpec || "cmd.exe",
+        args: ["/d", "/s", "/c", `""${launcher}" update --automatic"`],
+        windowsVerbatimArguments: true
+      } : platform === "linux" && (options.env ?? process.env).INVOCATION_ID ? {
+        // detached creates a process group, not a new systemd cgroup. An
+        // updater spawned by the scanner must survive stopping that service.
+        file: "systemd-run",
+        args: [
+          "--user",
+          "--collect",
+          "--quiet",
+          `--setenv=MNEMONIK_STATE_DIR=${stateDir}`,
+          "--",
+          launcher,
+          "update",
+          "--automatic"
+        ]
+      } : { file: launcher, args: ["update", "--automatic"] };
+      const child = (options.spawn ?? nodeSpawn)(command.file, command.args, {
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true,
+        ..."windowsVerbatimArguments" in command ? { windowsVerbatimArguments: command.windowsVerbatimArguments } : {}
+      });
+      child.once("error", () => {
+      });
+      child.unref();
+      return true;
+    });
+  } catch {
+    return false;
+  }
+}
+var HELPER_FLAG = "--mnemonik-automatic-update";
+function isHelperInvocation() {
+  if (process.argv[2] !== HELPER_FLAG || !process.argv[3] || !process.argv[1])
+    return false;
+  try {
+    return realpathSync(process.argv[1]) === realpathSync(fileURLToPath2(import.meta.url));
+  } catch {
+    return false;
+  }
+}
+if (isHelperInvocation())
+  void maybeStartAutomaticUpdate({ stateDir: process.argv[3] });
+
 // packages/local-setup/dist/index.js
 var MAX_ORIGINAL_BYTES = 64 * 1024;
 
@@ -6573,10 +6818,10 @@ var CredentialSessionUnavailableError = class extends Error {
 };
 
 // packages/credentials/dist/storage.js
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import { lstat as nodeLstat, mkdir as mkdir2, open as open2, readdir, rmdir as rmdir2, unlink as unlink2 } from "node:fs/promises";
 import { constants } from "node:fs";
-import { basename as basename2, dirname as dirname4, isAbsolute, join as join4, parse, relative, resolve as resolve2, sep as sep2 } from "node:path";
+import { basename as basename2, dirname as dirname4, isAbsolute, join as join5, parse, relative, resolve as resolve2, sep as sep2 } from "node:path";
 var CredentialError = class extends Error {
   reason;
   constructor(reason) {
@@ -6585,22 +6830,22 @@ var CredentialError = class extends Error {
     this.name = "CredentialError";
   }
 };
-var digest = (value) => createHash2("sha256").update(value).digest("hex");
+var digest = (value) => createHash3("sha256").update(value).digest("hex");
 function credentialPaths(stateDir = stateDirectory(), familyId) {
-  const root = join4(stateDir, "credentials");
+  const root = join5(stateDir, "credentials");
   const familyName = familyId ? digest(familyId) : "";
   return {
     root,
-    records: join4(root, "records"),
-    secrets: join4(root, "secrets"),
-    cliRecord: join4(root, "records", "cli.json"),
-    cliSecret: join4(root, "secrets", "cli.json"),
-    rootRecord: join4(root, "records", "root-binding.json"),
-    rootSecret: join4(root, "secrets", "root-binding.key"),
-    familyRecords: join4(root, "records", "families"),
-    familySecrets: join4(root, "secrets", "families"),
-    record: join4(root, "records", "families", `${familyName}.json`),
-    secret: join4(root, "secrets", "families", `${familyName}.json`)
+    records: join5(root, "records"),
+    secrets: join5(root, "secrets"),
+    cliRecord: join5(root, "records", "cli.json"),
+    cliSecret: join5(root, "secrets", "cli.json"),
+    rootRecord: join5(root, "records", "root-binding.json"),
+    rootSecret: join5(root, "secrets", "root-binding.key"),
+    familyRecords: join5(root, "records", "families"),
+    familySecrets: join5(root, "secrets", "families"),
+    record: join5(root, "records", "families", `${familyName}.json`),
+    secret: join5(root, "secrets", "families", `${familyName}.json`)
   };
 }
 var codeIs2 = (error, code) => error.code === code;
@@ -6612,6 +6857,7 @@ var SecureFiles = class {
   fault;
   execFile;
   username;
+  aclRun;
   constructor(options = {}) {
     this.stateDir = resolve2(options.stateDir ?? stateDirectory());
     this.platform = options.platform ?? process.platform;
@@ -6620,6 +6866,7 @@ var SecureFiles = class {
     this.fault = options.fault;
     this.execFile = options.execFile;
     this.username = options.username;
+    this.aclRun = options.aclRun;
   }
   assertInsideState(path) {
     const absolute = resolve2(path);
@@ -6635,7 +6882,7 @@ var SecureFiles = class {
     const result = [];
     let current = root;
     for (const part of parts2) {
-      current = join4(current, part);
+      current = join5(current, part);
       result.push(current);
     }
     return result;
@@ -6654,20 +6901,34 @@ var SecureFiles = class {
       if (value.isSymbolicLink())
         throw new CredentialError("symlink_rejected");
       const protectedComponent = component === this.stateDir || component.startsWith(`${this.stateDir}${sep2}`);
-      if (!protectedComponent || this.platform === "win32")
+      if (!protectedComponent)
         continue;
-      if (this.uid !== void 0 && value.uid !== this.uid)
-        throw new CredentialError("wrong_owner");
       const final = component === absolute;
-      const allowed = final && expectFile ? 384 : 448;
-      if ((value.mode & 511 & ~allowed) !== 0)
-        throw new CredentialError("weak_permissions");
+      if (this.platform === "win32") {
+        if (final)
+          await this.verifyWindowsPrivate(component);
+      } else {
+        if (this.uid !== void 0 && value.uid !== this.uid)
+          throw new CredentialError("wrong_owner");
+        const allowed = final && expectFile ? 384 : 448;
+        if ((value.mode & 511 & ~allowed) !== 0)
+          throw new CredentialError("weak_permissions");
+      }
       if (final && expectFile && !value.isFile())
         throw new CredentialError("not_regular_file");
       if (final && !expectFile && !value.isDirectory())
         throw new CredentialError("not_regular_file");
     }
   }
+  async verifyWindowsPrivate(path) {
+    try {
+      await verifyWindowsCurrentUserOnly(path, this.stateDir, this.aclRun);
+    } catch (error) {
+      if (error.message === "acl_permissions")
+        throw new CredentialError("weak_permissions");
+      throw error;
+    }
+  }
   async makeDirectory(path) {
     let created = false;
     try {
@@ -6721,7 +6982,7 @@ var SecureFiles = class {
       const prefix = `${basename2(absolute)}.`;
       for (const name2 of await this.list(dirname4(absolute))) {
         if (name2.startsWith(prefix) && name2.endsWith(".tmp"))
-          await this.remove(join4(dirname4(absolute), name2));
+          await this.remove(join5(dirname4(absolute), name2));
       }
       throw error;
     }
@@ -7256,7 +7517,7 @@ function createCredentialAdapter(options = {}) {
     const cli = await readRecord(paths.cliRecord, "cli-oauth");
     const componentFamilyIds = [];
     for (const name2 of await files.list(paths.familyRecords)) {
-      const recordPath2 = join5(paths.familyRecords, name2);
+      const recordPath2 = join6(paths.familyRecords, name2);
       const record = await readRecord(recordPath2, "component");
       if (!record)
         continue;
@@ -7313,10 +7574,10 @@ var DiagnosticsError = class extends Error {
   }
   code;
 };
-var digest2 = (bytes) => createHash3("sha256").update(bytes).digest("hex");
+var digest2 = (bytes) => createHash4("sha256").update(bytes).digest("hex");
 var validId = (id) => /^diag-[A-Za-z0-9._-]{1,120}$/u.test(id);
 async function scannerConfig(stateDir) {
-  const state = JSON.parse(await readFile2(join6(stateDir, "scanner", "state.json"), "utf8"));
+  const state = JSON.parse(await readFile2(join7(stateDir, "scanner", "state.json"), "utf8"));
   if (typeof state.config?.serverUrl !== "string" || typeof state.config.credentialFamilyId !== "string")
     throw new DiagnosticsError("scanner_credential_missing");
   return {
@@ -7345,7 +7606,7 @@ async function previewDiagnostics(out2, dependencies = {}) {
   const stateDir = dependencies.stateDir ?? stateDirectory();
   const binary2 = dependencies.scannerBinary ? await dependencies.scannerBinary() : (await new RuntimeStore(stateDir).verifyRuntime("scanner")).entry;
   const args2 = ["diagnostics", "diagnostics", "bundle", ...out2 ? ["--out", out2] : [], "--json"];
-  const stdout = await new Promise((resolve3, reject) => {
+  const stdout2 = await new Promise((resolve3, reject) => {
     (dependencies.execFile ?? nodeExecFile2)(
       binary2,
       args2,
@@ -7358,14 +7619,14 @@ async function previewDiagnostics(out2, dependencies = {}) {
   });
   let result;
   try {
-    result = JSON.parse(stdout);
+    result = JSON.parse(stdout2);
   } catch {
     throw new DiagnosticsError("diagnostics_preview_invalid");
   }
   if (!validId(result.manifest?.bundleId) || !/^[a-f0-9]{64}$/u.test(result.sha256) || typeof result.path !== "string")
     throw new DiagnosticsError("diagnostics_preview_invalid");
   const receipt = { schemaVersion: 1, ...result };
-  const receiptPath = join6(stateDir, "diagnostics", `${result.manifest.bundleId}.json`);
+  const receiptPath = join7(stateDir, "diagnostics", `${result.manifest.bundleId}.json`);
   await mkdir3(dirname5(receiptPath), { recursive: true, mode: 448 });
   await atomicWrite(receiptPath, Buffer.from(`${JSON.stringify(receipt)}
 `));
@@ -7390,7 +7651,7 @@ async function uploadDiagnosticsBundle(serverUrl, token, bundleId, sha256, bytes
 async function sendDiagnostics(bundleId, dependencies = {}) {
   if (!validId(bundleId)) throw new DiagnosticsError("bundle_id_invalid");
   const stateDir = dependencies.stateDir ?? stateDirectory();
-  const receiptPath = join6(stateDir, "diagnostics", `${bundleId}.json`);
+  const receiptPath = join7(stateDir, "diagnostics", `${bundleId}.json`);
   const receipt = JSON.parse(await readFile2(receiptPath, "utf8"));
   if (receipt.schemaVersion !== 1 || receipt.manifest?.bundleId !== bundleId || !/^[a-f0-9]{64}$/u.test(receipt.sha256) || typeof receipt.path !== "string" || !(await lstat2(receipt.path)).isFile())
     throw new DiagnosticsError("diagnostics_preview_invalid");