@nanhara/hara 0.123.1 → 0.124.1

package/dist/config.js

@@ -1,9 +1,8 @@
-import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { join, dirname, resolve } from "node:path";
-import { closeSync, constants, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, realpathSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { existsSync, lstatSync, realpathSync } from "node:fs";
 import { agentMaxRounds, agentRunTimeoutMs } from "./agent/limits.js";
-import { ensurePrivateHaraState } from "./security/private-state.js";
+import { bindPrivateHaraStateFile, ensurePrivateHaraState, readPrivateStateFileSnapshotSync, writePrivateStateFileSync, } from "./security/private-state.js";
 import { readVerifiedRegularFileSnapshotSync } from "./fs-read.js";
 import { projectRepositoryTrustedAtStartup } from "./security/project-trust.js";
 import { isHomeWorkspace } from "./context/workspace-scope.js";
@@ -109,15 +108,11 @@ function configRecord(value) {
 }
 export function readRawConfig() {
     ensurePrivateHaraState();
-    const p = configPath();
-    if (!existsSync(p))
-        return {};
     try {
-        const snapshot = readVerifiedRegularFileSnapshotSync(p, MAX_GLOBAL_CONFIG_BYTES, {
-            action: "read global config",
-            protectSensitive: false,
-            rejectHardLinks: true,
-        });
+        const binding = bindPrivateHaraStateFile(homedir(), [], "config.json");
+        const snapshot = readPrivateStateFileSnapshotSync(binding.path, MAX_GLOBAL_CONFIG_BYTES);
+        if (!snapshot)
+            return {};
         return configRecord(JSON.parse(snapshot.text));
     }
     catch {
@@ -239,91 +234,33 @@ function readProjectConfig(cwd) {
     }
     return {};
 }
-function existingConfigIdentity(path) {
-    try {
-        const info = lstatSync(path);
-        if (info.isSymbolicLink())
-            throw new Error(`refusing global config write: '${path}' is a symbolic link`);
-        if (!info.isFile())
-            throw new Error(`refusing global config write: '${path}' is not a regular file`);
-        if (info.nlink !== 1)
-            throw new Error(`refusing global config write: '${path}' is hard-linked`);
-        return { dev: info.dev, ino: info.ino };
-    }
-    catch (error) {
-        if (error?.code === "ENOENT")
-            return null;
-        throw error;
-    }
-}
-/** Atomically replace the global 0600 config without opening its current directory entry for write. */
-function persistConfig(p, cfg) {
+/** Atomically replace the global 0600 config through the shared private-state CAS boundary. */
+function persistConfig(cfg) {
     ensurePrivateHaraState();
-    const parent = dirname(p);
-    mkdirSync(parent, { recursive: true, mode: 0o700 });
-    const parentInfo = lstatSync(parent);
-    const canonicalParent = realpathSync.native(parent);
-    if (!parentInfo.isDirectory() || parentInfo.isSymbolicLink()) {
-        throw new Error(`refusing global config write: '${parent}' is not a canonical directory`);
-    }
-    const existing = existingConfigIdentity(p);
-    const temp = join(parent, `.config-${process.pid}-${randomUUID()}.tmp`);
-    const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
-    let fd;
-    try {
-        fd = openSync(temp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | noFollow, 0o600);
-        writeFileSync(fd, JSON.stringify(cfg, null, 2) + "\n", "utf8");
-        fsyncSync(fd);
-        const staged = fstatSync(fd);
-        if (!staged.isFile() || staged.nlink !== 1)
-            throw new Error("refusing global config write: unsafe staging inode");
-        closeSync(fd);
-        fd = undefined;
-        const parentAfter = lstatSync(parent);
-        if (!parentAfter.isDirectory() || parentAfter.isSymbolicLink() ||
-            parentAfter.dev !== parentInfo.dev || parentAfter.ino !== parentInfo.ino ||
-            realpathSync.native(parent) !== canonicalParent)
-            throw new Error(`refusing global config write: '${parent}' changed before commit`);
-        const current = existingConfigIdentity(p);
-        if ((existing === null) !== (current === null) || (existing && current && (existing.dev !== current.dev || existing.ino !== current.ino))) {
-            throw new Error(`refusing global config write: '${p}' changed before commit`);
-        }
-        // rename replaces the path entry; it never follows an alias planted after the last identity check.
-        renameSync(temp, p);
-        const committed = lstatSync(p);
-        if (!committed.isFile() || committed.isSymbolicLink() || committed.dev !== staged.dev || committed.ino !== staged.ino || committed.nlink !== 1) {
-            throw new Error(`global config changed during commit: '${p}'`);
-        }
-    }
-    finally {
-        if (fd !== undefined)
-            try {
-                closeSync(fd);
-            }
-            catch { /* preserve original error */ }
-        try {
-            rmSync(temp, { force: true });
-        }
-        catch { /* preserve original error */ }
-    }
+    const binding = bindPrivateHaraStateFile(homedir(), [], "config.json");
+    writePrivateStateFileSync(binding, JSON.stringify(cfg, null, 2) + "\n");
+}
+/** Mutate global config without exposing a second direct-write implementation to feature modules. */
+export function updateRawConfig(mutate) {
+    const config = readRawConfig();
+    const replacement = mutate(config);
+    persistConfig(replacement ?? config);
 }
 export function writeConfigValue(key, value) {
-    const p = configPath();
-    const cfg = readRawConfig();
-    cfg[key] = value;
-    persistConfig(p, cfg);
+    updateRawConfig((config) => {
+        config[key] = value;
+    });
 }
 /** Record (or clear, with cap=null) a confirmed per-model vision capability in `modelVision`. */
 export function setModelVisionOverride(model, cap) {
-    const p = configPath();
-    const cfg = readRawConfig();
-    const map = cfg.modelVision && typeof cfg.modelVision === "object" ? cfg.modelVision : {};
-    if (cap === null)
-        delete map[model];
-    else
-        map[model] = cap;
-    cfg.modelVision = map;
-    persistConfig(p, cfg);
+    updateRawConfig((config) => {
+        const map = config.modelVision && typeof config.modelVision === "object" ? config.modelVision : {};
+        if (cap === null)
+            delete map[model];
+        else
+            map[model] = cap;
+        config.modelVision = map;
+    });
 }
 /**
  * Effective config. Precedence (high→low): env vars > allowed/trusted project `.hara/config.json` >

package/dist/cron/store.js

@@ -7,6 +7,8 @@ import { chmodSync, closeSync, constants, existsSync, fstatSync, fsyncSync, lsta
 import { cronMatches, parseCron, validTz } from "./schedule.js";
 import { compareProcessIdentity, defaultProcessIdentity } from "../process-identity.js";
 import { sleepSync } from "../sync-sleep.js";
+import { optionalPosixOpenFlag } from "../fs-open-flags.js";
+import { sameOpenedFileIdentity } from "../fs-identity.js";
 /** Hard persistence bounds: outages must apply backpressure instead of growing jobs.json forever. */
 export const MAX_CRON_PENDING_NOTIFICATIONS = 64;
 const CRON_RUN_NOTIFICATION_RESERVE = 2;
@@ -43,11 +45,10 @@ function readStoreLockSnapshot(path) {
         const before = lstatSync(path);
         let raw = null;
         if (before.isFile() && before.size <= MAX_STORE_LOCK_BYTES) {
-            const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
-            const fd = openSync(path, constants.O_RDONLY | constants.O_NONBLOCK | noFollow);
+            const fd = openSync(path, constants.O_RDONLY | optionalPosixOpenFlag("O_NONBLOCK") | optionalPosixOpenFlag("O_NOFOLLOW"));
             try {
                 const opened = fstatSync(fd);
-                if (opened.isFile() && opened.dev === before.dev && opened.ino === before.ino && opened.size <= MAX_STORE_LOCK_BYTES) {
+                if (opened.isFile() && sameOpenedFileIdentity(opened, before) && opened.size <= MAX_STORE_LOCK_BYTES) {
                     const buffer = Buffer.alloc(opened.size);
                     let offset = 0;
                     while (offset < buffer.length) {

package/dist/desk.js

@@ -4,13 +4,15 @@
 //
 // Credentials live in ~/.hara/desk.json (0600): the desk URL + this agent's token, written once at
 // `hara desk register`. Every later call reads them back. The token is a bearer secret — never logged.
-import { readFileSync, writeFileSync, mkdirSync, chmodSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
-const credsPath = () => join(homedir(), ".hara", "desk.json");
+import { bindPrivateHaraStateFile, readPrivateStateFileSnapshotSync, writePrivateStateFileSync, } from "./security/private-state.js";
 export function loadCreds() {
     try {
-        const c = JSON.parse(readFileSync(credsPath(), "utf8"));
+        const binding = bindPrivateHaraStateFile(homedir(), [], "desk.json");
+        const snapshot = readPrivateStateFileSnapshotSync(binding.path, 1024 * 1024);
+        if (!snapshot)
+            return null;
+        const c = JSON.parse(snapshot.text);
         return c.url && c.token ? c : null;
     }
     catch {
@@ -18,16 +20,8 @@ export function loadCreds() {
     }
 }
 export function saveCreds(c) {
-    const dir = join(homedir(), ".hara");
-    mkdirSync(dir, { recursive: true });
-    const p = credsPath();
-    writeFileSync(p, JSON.stringify(c, null, 2));
-    try {
-        chmodSync(p, 0o600);
-    }
-    catch {
-        /* best-effort on non-posix */
-    }
+    const binding = bindPrivateHaraStateFile(homedir(), [], "desk.json");
+    writePrivateStateFileSync(binding, JSON.stringify(c, null, 2) + "\n");
 }
 /** One HTTP call to the desk. Auth via bearer token when creds are present. Throws on non-2xx with
  *  the server's error message (so the CLI can surface a real reason, not "request failed"). */

package/dist/fs-identity.js

@@ -0,0 +1,11 @@
+/**
+ * Correlate an already-open descriptor with a stat of the same bounded path. Node on Windows may report
+ * a volume-derived `dev` for fstat and `0` for lstat/stat of that exact NTFS file. Its file id (`ino`) stays
+ * stable, and the caller has already fixed the path/parent boundary, so requiring `dev` there rejects valid
+ * files without adding an identity fence. POSIX retains the ordinary device + inode comparison.
+ *
+ * Do not use this to decide whether two arbitrary Windows paths are hard links across unrelated roots.
+ */
+export function sameOpenedFileIdentity(left, right, platform = process.platform) {
+    return left.ino === right.ino && (platform === "win32" || left.dev === right.dev);
+}

package/dist/fs-open-flags.js

@@ -0,0 +1,14 @@
+import { constants } from "node:fs";
+/**
+ * Bun's Windows compatibility layer may expose POSIX-only fs constants even though CreateFileW cannot
+ * consume them. Node documents that Windows supports neither O_DIRECTORY, O_NOFOLLOW nor O_NONBLOCK;
+ * passing Bun's numeric values can turn an otherwise valid create/open into a misleading ENOENT.
+ *
+ * Windows callers retain their lstat/fstat/identity checks and O_CREAT|O_EXCL no-replace semantics.
+ */
+export function optionalPosixOpenFlag(name, platform = process.platform) {
+    if (platform === "win32")
+        return 0;
+    const value = constants[name];
+    return typeof value === "number" ? value : 0;
+}

package/dist/fs-read.js

@@ -4,12 +4,35 @@ import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, realpat
 import { open } from "node:fs/promises";
 import { StringDecoder } from "node:string_decoder";
 import { sensitiveFileError } from "./security/sensitive-files.js";
+import { optionalPosixOpenFlag } from "./fs-open-flags.js";
+import { sameOpenedFileIdentity } from "./fs-identity.js";
 export class BinaryFileError extends Error {
     constructor(path) {
         super(`${path} appears to be binary (NUL byte detected)`);
         this.name = "BinaryFileError";
     }
 }
+export class InvalidUtf8FileError extends Error {
+    code = "HARA_INVALID_UTF8";
+    constructor(path) {
+        super(`${path} is not valid UTF-8; refusing a lossy text operation. ` +
+            "Use a binary-aware tool or explicitly transcode the file first");
+        this.name = "InvalidUtf8FileError";
+    }
+}
+/** Decode a complete text-file snapshot without replacing invalid bytes or dropping a UTF-8 BOM. */
+export function decodeUtf8Strict(bytes, path) {
+    if (bytes.includes(0))
+        throw new BinaryFileError(path);
+    try {
+        // ignoreBOM=true means the BOM is emitted as U+FEFF. A later UTF-8 rewrite therefore preserves the
+        // original bytes instead of silently stripping the marker while editing otherwise valid text.
+        return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
+    }
+    catch {
+        throw new InvalidUtf8FileError(path);
+    }
+}
 export class NonRegularFileError extends Error {
     code = "HARA_NOT_REGULAR_FILE";
     constructor(path) {
@@ -44,7 +67,7 @@ export class ProtectedContextFileError extends Error {
 export class HardLinkedFileError extends Error {
     code = "HARA_HARD_LINKED_FILE";
     constructor(path) {
-        super(`${path} has multiple hard links; its protected identity cannot be established safely`);
+        super(`${path} is hard-linked (has multiple hard links); its protected identity cannot be established safely`);
         this.name = "HardLinkedFileError";
     }
 }
@@ -79,10 +102,8 @@ export function verifyOpenedRegularFileSync(path, opened, options = {}) {
     const currentLink = lstatSync(path);
     const currentTarget = statSync(canonical);
     if (currentLink.isSymbolicLink()
-        || currentLink.dev !== opened.dev
-        || currentLink.ino !== opened.ino
-        || currentTarget.dev !== opened.dev
-        || currentTarget.ino !== opened.ino) {
+        || !sameOpenedFileIdentity(currentLink, opened)
+        || !sameOpenedFileIdentity(currentTarget, opened)) {
         throw new Error(`refusing to access ${path}: path changed while opening it`);
     }
     return canonical;
@@ -97,8 +118,7 @@ export async function openVerifiedRegularFileNoFollow(path, options = {}) {
     const before = lstatSync(path);
     if (before.isSymbolicLink())
         throw new NonRegularFileError(path);
-    const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
-    const handle = await open(path, constants.O_RDONLY | constants.O_NONBLOCK | noFollow);
+    const handle = await open(path, constants.O_RDONLY | optionalPosixOpenFlag("O_NONBLOCK") | optionalPosixOpenFlag("O_NOFOLLOW"));
     try {
         const info = await handle.stat();
         const canonicalPath = verifyOpenedRegularFileSync(path, info, options);
@@ -143,7 +163,7 @@ export async function readVerifiedRegularFileSnapshot(path, maxBytes = MAX_EDIT_
             || latest.ctimeMs !== info.ctimeMs)
             throw new Error(`refusing to read ${path}: file changed while reading it`);
         return {
-            text: Buffer.concat(chunks, total).toString("utf8"),
+            text: decodeUtf8Strict(Buffer.concat(chunks, total), path),
             dev: info.dev,
             ino: info.ino,
             mode: info.mode & 0o777,
@@ -168,8 +188,7 @@ export function readVerifiedRegularFileSnapshotSync(path, maxBytes = MAX_EDIT_RE
     const before = lstatSync(path);
     if (before.isSymbolicLink())
         throw new NonRegularFileError(path);
-    const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
-    const fd = openSync(path, constants.O_RDONLY | constants.O_NONBLOCK | noFollow);
+    const fd = openSync(path, constants.O_RDONLY | optionalPosixOpenFlag("O_NONBLOCK") | optionalPosixOpenFlag("O_NOFOLLOW"));
     try {
         const info = fstatSync(fd);
         verifyOpenedRegularFileSync(path, info, {
@@ -196,7 +215,7 @@ export function readVerifiedRegularFileSnapshotSync(path, maxBytes = MAX_EDIT_RE
             || latest.ctimeMs !== info.ctimeMs)
             throw new Error(`refusing to read ${path}: file changed while reading it`);
         return {
-            text: bytes.toString("utf8"),
+            text: decodeUtf8Strict(bytes, path),
             dev: info.dev,
             ino: info.ino,
             mode: info.mode & 0o777,
@@ -222,11 +241,10 @@ function withVerifiedContextFdSync(path, read) {
         throw new ProtectedContextFileError(denied);
     // O_NOFOLLOW is not exposed on every platform. The before/after lstat checks retain fail-closed symlink
     // behaviour there; on POSIX O_NOFOLLOW makes the critical open itself atomic.
-    const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
     const before = lstatSync(path);
     if (before.isSymbolicLink())
         throw new NonRegularFileError(path);
-    const fd = openSync(path, constants.O_RDONLY | constants.O_NONBLOCK | noFollow);
+    const fd = openSync(path, constants.O_RDONLY | optionalPosixOpenFlag("O_NONBLOCK") | optionalPosixOpenFlag("O_NOFOLLOW"));
     try {
         const info = fstatSync(fd);
         verifyOpenedRegularFileSync(path, info, {
@@ -278,9 +296,7 @@ export function readModelContextFileSync(path, maxBytes) {
         const bytes = readFdBytesSync(fd, Math.min(limit + 1, size + 1));
         if (bytes.length > limit)
             throw new FileReadLimitError(path, limit);
-        if (bytes.includes(0))
-            throw new BinaryFileError(path);
-        return bytes.toString("utf8");
+        return decodeUtf8Strict(bytes, path);
     });
 }
 /** Safe bounded-prefix counterpart for @file expansion; it never materializes the remainder of a huge file. */
@@ -361,19 +377,18 @@ async function readRegularFileSnapshotWithFlags(path, maxBytes, flags) {
         }
         if (total > limit)
             throw new FileReadLimitError(path, limit);
-        return { text: Buffer.concat(chunks, total).toString("utf8"), dev: info.dev, ino: info.ino, mode: info.mode & 0o777, nlink: info.nlink };
+        return { text: decodeUtf8Strict(Buffer.concat(chunks, total), path), dev: info.dev, ino: info.ino, mode: info.mode & 0o777, nlink: info.nlink };
     }
     finally {
         await handle.close().catch(() => { });
     }
 }
 export async function readRegularFileSnapshot(path, maxBytes = MAX_EDIT_READ_BYTES) {
-    return readRegularFileSnapshotWithFlags(path, maxBytes, constants.O_RDONLY | constants.O_NONBLOCK);
+    return readRegularFileSnapshotWithFlags(path, maxBytes, constants.O_RDONLY | optionalPosixOpenFlag("O_NONBLOCK"));
 }
 /** Quarantine/transaction reader: reject a symlink at open(2), then validate/read that same fd. */
 export async function readRegularFileSnapshotNoFollow(path, maxBytes = MAX_EDIT_READ_BYTES) {
-    const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
-    return readRegularFileSnapshotWithFlags(path, maxBytes, constants.O_RDONLY | constants.O_NONBLOCK | noFollow);
+    return readRegularFileSnapshotWithFlags(path, maxBytes, constants.O_RDONLY | optionalPosixOpenFlag("O_NONBLOCK") | optionalPosixOpenFlag("O_NOFOLLOW"));
 }
 export async function readRegularFileText(path, maxBytes = MAX_EDIT_READ_BYTES) {
     return (await readRegularFileSnapshot(path, maxBytes)).text;
@@ -383,7 +398,7 @@ export function readTextPrefixSync(path, maxChars) {
     const requested = Number.isFinite(maxChars) ? Math.floor(maxChars) : MAX_PREFIX_CHARS;
     const chars = Math.min(MAX_PREFIX_CHARS, Math.max(0, requested));
     // O_NONBLOCK makes opening a FIFO return immediately; fstat on this exact fd then rejects it before read.
-    const fd = openSync(path, constants.O_RDONLY | constants.O_NONBLOCK);
+    const fd = openSync(path, constants.O_RDONLY | optionalPosixOpenFlag("O_NONBLOCK"));
     try {
         const info = fstatSync(fd);
         if (!info.isFile())
@@ -485,7 +500,8 @@ export async function streamFileSlice(path, offset = 1, limit = 300, options = {
     const verified = options.protectSensitive
         ? await openVerifiedRegularFileNoFollow(path, { action: "read", rejectHardLinks: true, protectSensitive: true })
         : null;
-    const handle = verified?.handle ?? await open(path, constants.O_RDONLY | constants.O_NONBLOCK);
+    const handle = verified?.handle
+        ?? await open(path, constants.O_RDONLY | optionalPosixOpenFlag("O_NONBLOCK"));
     let stream;
     try {
         const info = verified?.info ?? await handle.stat();

package/dist/fs-write.js

@@ -5,6 +5,8 @@ import { basename, dirname, join, resolve } from "node:path";
 import { constants, linkSync, lstatSync, readlinkSync, realpathSync, renameSync, symlinkSync, unlinkSync } from "node:fs";
 import { lstat, mkdir, open, realpath, rmdir, stat } from "node:fs/promises";
 import { NonRegularFileError, readRegularFileSnapshotNoFollow } from "./fs-read.js";
+import { optionalPosixOpenFlag } from "./fs-open-flags.js";
+import { sameOpenedFileIdentity } from "./fs-identity.js";
 import { canonicalizeProspectivePath, lexicalSensitiveFileReason, sensitiveFileError, } from "./security/sensitive-files.js";
 export class FileChangedError extends Error {
     code = "HARA_FILE_CHANGED";
@@ -296,7 +298,7 @@ async function syncDirectory(path) {
     try {
         // The directory name can be exchanged after rename. O_NONBLOCK plus fstat on this exact descriptor
         // keeps best-effort durability from hanging forever on a replacement FIFO/device.
-        const handle = await open(path, constants.O_RDONLY | constants.O_NONBLOCK);
+        const handle = await open(path, constants.O_RDONLY | optionalPosixOpenFlag("O_NONBLOCK"));
         try {
             if (!(await handle.stat()).isDirectory())
                 return;
@@ -508,8 +510,7 @@ export async function atomicWriteText(path, content, options = {}) {
                 verifyCommitParent();
                 const current = lstatSync(temp);
                 if (current.isFile()
-                    && current.dev === writtenIdentity.dev
-                    && current.ino === writtenIdentity.ino)
+                    && sameOpenedFileIdentity(current, writtenIdentity))
                     unlinkSync(temp);
             }
             catch {

package/dist/gateway/outbound-files.js

@@ -6,6 +6,8 @@ import { chmodSync, constants, lstatSync, mkdirSync, readdirSync, realpathSync,
 import { open } from "node:fs/promises";
 import { basename, dirname, extname, join, resolve } from "node:path";
 import { openVerifiedRegularFileNoFollow, verifyOpenedRegularFileSync } from "../fs-read.js";
+import { optionalPosixOpenFlag } from "../fs-open-flags.js";
+import { sameOpenedFileIdentity } from "../fs-identity.js";
 export const OUTBOUND_FILE_MAX_BYTES = 20 * 1024 * 1024;
 export const OUTBOUND_BATCH_MAX_BYTES = 20 * 1024 * 1024;
 export const OUTBOUND_BATCH_MAX_FILES = 4;
@@ -90,17 +92,15 @@ async function appendOutbox(outbox, snapshot, signal) {
         if (error?.code !== "ENOENT")
             throw error;
     }
-    const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
-    const handle = await open(path, constants.O_WRONLY | constants.O_APPEND | constants.O_CREAT | noFollow, 0o600);
+    const handle = await open(path, constants.O_WRONLY | constants.O_APPEND | constants.O_CREAT | optionalPosixOpenFlag("O_NOFOLLOW"), 0o600);
     try {
         const info = await handle.stat();
         const current = lstatSync(path);
         if (!info.isFile()
             || info.nlink > 1
             || current.isSymbolicLink()
-            || current.dev !== info.dev
-            || current.ino !== info.ino
-            || (before && (before.dev !== info.dev || before.ino !== info.ino))
+            || !sameOpenedFileIdentity(current, info)
+            || (before && !sameOpenedFileIdentity(before, info))
             || !ownedByProcess(path))
             throw new Error(`unsafe gateway outbox: ${outbox}`);
         await handle.chmod(0o600);
@@ -251,7 +251,7 @@ async function readOutbox(outbox) {
         await verified?.handle.close().catch(() => { });
         try {
             const current = lstatSync(resolve(outbox));
-            if (verified && !current.isSymbolicLink() && current.dev === verified.info.dev && current.ino === verified.info.ino) {
+            if (verified && !current.isSymbolicLink() && sameOpenedFileIdentity(current, verified.info)) {
                 unlinkSync(resolve(outbox));
             }
         }
@@ -380,8 +380,7 @@ export function cleanupOutboundSnapshot(path) {
             && entry.isFile()
             && !entry.isSymbolicLink()
             && entry.nlink === 1
-            && entry.dev === expected.dev
-            && entry.ino === expected.ino
+            && sameOpenedFileIdentity(entry, expected)
             && ownedByProcess(candidate))
             unlinkSync(candidate);
         if (readdirSync(dir).length === 0)

package/dist/gateway/runtime-state.js

@@ -13,6 +13,8 @@ import { atomicWriteText, bindHaraPrivateStateWritePath, FileChangedError } from
 import { ensurePrivateStateSubdirectory, readPrivateStateFileSnapshot, } from "../security/private-state.js";
 import { sleepSync } from "../sync-sleep.js";
 import { compareProcessIdentity, defaultProcessIdentity } from "../process-identity.js";
+import { optionalPosixOpenFlag } from "../fs-open-flags.js";
+import { sameOpenedFileIdentity } from "../fs-identity.js";
 const PLATFORM = /^[a-z0-9][a-z0-9_-]{0,63}$/;
 const LOCK_BYTES = 4 * 1024;
 const LOCK_WAIT_MS = 5_000;
@@ -100,13 +102,11 @@ function leaseStagingPath(path, record) {
     return `${path}.${record.pid}.${record.token}.pending`;
 }
 function readLease(path, platform) {
-    const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
-    const nonBlock = typeof constants.O_NONBLOCK === "number" ? constants.O_NONBLOCK : 0;
     let fd;
     try {
         // O_NONBLOCK is inert for regular files and prevents a hostile FIFO/device at the lock path from hanging
         // gateway startup before fstat can reject it.
-        fd = openSync(path, constants.O_RDONLY | noFollow | nonBlock);
+        fd = openSync(path, constants.O_RDONLY | optionalPosixOpenFlag("O_NOFOLLOW") | optionalPosixOpenFlag("O_NONBLOCK"));
     }
     catch (error) {
         if (errorCode(error) === "ENOENT")
@@ -175,8 +175,7 @@ function readLease(path, platform) {
         if (!staging.isFile()
             || staging.isSymbolicLink()
             || staging.nlink !== 2
-            || staging.dev !== info.dev
-            || staging.ino !== info.ino)
+            || !sameOpenedFileIdentity(staging, info))
             throw new Error(`refusing malformed gateway instance lock: ${path}`);
         return { record, dev: info.dev, ino: info.ino, stagingPath };
     }
@@ -187,8 +186,7 @@ function readLease(path, platform) {
 function sameLease(left, right) {
     return Boolean(left
         && right
-        && left.dev === right.dev
-        && left.ino === right.ino
+        && sameOpenedFileIdentity(left, right)
         && left.record.pid === right.record.pid
         && left.record.token === right.record.token);
 }
@@ -198,8 +196,7 @@ function unlinkLease(path, expected) {
         || current.isSymbolicLink()
         || current.nlink < 1
         || current.nlink > 2
-        || current.dev !== expected.dev
-        || current.ino !== expected.ino)
+        || !sameOpenedFileIdentity(current, expected))
         throw new Error(`gateway instance lock changed before removal: ${path}`);
     if (current.nlink === 2) {
         if (!expected.stagingPath)
@@ -208,30 +205,26 @@ function unlinkLease(path, expected) {
         if (!staging.isFile()
             || staging.isSymbolicLink()
             || staging.nlink !== 2
-            || staging.dev !== expected.dev
-            || staging.ino !== expected.ino)
+            || !sameOpenedFileIdentity(staging, expected))
             throw new Error(`gateway instance lock changed before removal: ${path}`);
         unlinkSync(expected.stagingPath);
         current = lstatSync(path);
         if (!current.isFile()
             || current.isSymbolicLink()
             || current.nlink !== 1
-            || current.dev !== expected.dev
-            || current.ino !== expected.ino)
+            || !sameOpenedFileIdentity(current, expected))
             throw new Error(`gateway instance lock changed before removal: ${path}`);
     }
     unlinkSync(path);
 }
 function writeLease(path, record) {
-    const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
-    const nonBlock = typeof constants.O_NONBLOCK === "number" ? constants.O_NONBLOCK : 0;
     const stagingPath = leaseStagingPath(path, record);
     let fd;
     let published = false;
     try {
         // Never expose an empty/partial owner record at the canonical path. The private staging inode is fully
         // written + fsynced first; link(2) then publishes it atomically and refuses to replace an existing owner.
-        fd = openSync(stagingPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | noFollow | nonBlock, 0o600);
+        fd = openSync(stagingPath, "wx", 0o600);
         writeFileSync(fd, JSON.stringify(record), "utf8");
         fsyncSync(fd);
         closeSync(fd);
@@ -853,8 +846,7 @@ export class GatewayFlowRunStore {
         if (!current.isFile()
             || current.isSymbolicLink()
             || current.nlink !== 1
-            || current.dev !== snapshot.dev
-            || current.ino !== snapshot.ino)
+            || !sameOpenedFileIdentity(current, snapshot))
             throw new Error(`gateway flow run changed before removal: ${path}`);
         unlinkSync(path);
     }
@@ -1172,8 +1164,7 @@ export class GatewayRunOutcomeStore {
         if (!current.isFile()
             || current.isSymbolicLink()
             || current.nlink !== 1
-            || current.dev !== snapshot.dev
-            || current.ino !== snapshot.ino)
+            || !sameOpenedFileIdentity(current, snapshot))
             throw new Error(`gateway run outcome changed before removal: ${path}`);
         unlinkSync(path);
     }