@opengsd/gsd-core 1.10.0 → 1.12.0

package/gsd-core/bin/lib/installer-migrations.cjs

@@ -16,51 +16,61 @@ const node_crypto_1 = __importDefault(require("node:crypto"));
 const installer_migration_authoring_cjs_1 = require("./installer-migration-authoring.cjs");
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 const clock_cjs_1 = require("./clock.cjs");
+const install_scope_cjs_1 = require("./install-scope.cjs");
+// #2874 (ADR-58 cleanup phase): this file is the ~1200-line migration
+// plan/apply/rollback/lock/journal engine — almost none of it is on the
+// installRuntimeArtifacts call tree. Only `readInstallManifest` and
+// `classifyArtifact` are reached (via install-engine.cts's
+// _migrateLegacyOpencodeCommandDir and retired-artifact-cleanup.cts's
+// pruneRetiredRuntimeArtifacts), so only those two entry points — plus their
+// shared `readJsonIfPresent` helper and `classifyArtifact`'s `sha256File`
+// hashing helper — are routed through the injectable seam. Everything else
+// in this file (locking, journal, apply/rollback, migration discovery)
+// keeps using real `fs` directly: it is not reachable from
+// installRuntimeArtifacts, so routing it would grow this seam past what
+// AC2 actually requires. See install-fs-adapter.cts's module doc.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const installFsAdapter = require("./install-fs-adapter.cjs");
+const { installFs } = installFsAdapter;
 const MANIFEST_NAME = 'gsd-file-manifest.json';
 const INSTALL_STATE_NAME = 'gsd-install-state.json';
 const INSTALL_MIGRATION_LOCK_NAME = 'gsd-install-migration.lock';
 const DEFAULT_MIGRATIONS_DIR = node_path_1.default.join(__dirname, 'installer-migrations');
 const DEFAULT_LOCK_TIMEOUT_MS = 30_000;
 const STRICT_JSON = Symbol('strict-json');
+// #2874: routed through installFs()'s openSync/readSync/closeSync trio
+// instead of importing `node:fs` directly, so classifyArtifact — reachable
+// from installRuntimeArtifacts — can be exercised against an injected
+// adapter. This function was briefly converted to a single
+// `installFs().readFileSync` call (buffering the whole file); that broke
+// tests/installer-migrations.test.cjs's "classifies large files without
+// loading the whole file through readFileSync", which monkeypatches real
+// fs.readFileSync to throw for the file under test and asserts hashing still
+// succeeds — an explicit, pre-existing contract that large files must be
+// streamed, not buffered. Restored to the original raw-fd streaming shape,
+// now going through the adapter instead of `node:fs` directly. This is the
+// ONLY call site of sha256File in this file (confirmed by inspection) — no
+// other caller is affected.
 function sha256File(filePath) {
     const hash = node_crypto_1.default.createHash('sha256');
     const buffer = Buffer.allocUnsafe(1024 * 1024);
-    const fd = node_fs_1.default.openSync(filePath, 'r');
+    const fd = installFs().openSync(filePath, 'r');
     try {
         while (true) {
-            const bytesRead = node_fs_1.default.readSync(fd, buffer, 0, buffer.length, null);
+            const bytesRead = installFs().readSync(fd, buffer, 0, buffer.length, null);
             if (bytesRead === 0)
                 break;
             hash.update(buffer.subarray(0, bytesRead));
         }
     }
     finally {
-        node_fs_1.default.closeSync(fd);
+        installFs().closeSync(fd);
     }
     return hash.digest('hex');
 }
 function sha256Text(value) {
     return node_crypto_1.default.createHash('sha256').update(value).digest('hex');
 }
-/**
- * Copy a managed path for the rollback snapshot or the user-facing backup,
- * WITHOUT dereferencing a symlink.
- *
- * `fs.copyFileSync` follows symlinks, so a managed path that has been replaced
- * by a link (tampering, or an unexpected user layout) would have had the
- * LINK TARGET's bytes copied into `gsd-migration-journal/…-backups/` — e.g. a
- * `gsd.cjs` symlinked at `~/.ssh/id_rsa` would land that key's contents in the
- * backup tree. Nothing GSD installs is ever a symlink, so the faithful snapshot
- * of a symlinked managed path is the link itself: recreating it preserves
- * rollback fidelity (restore re-creates the same link) while never reading the
- * referent. Deletion was already safe — `fs.rmSync` unlinks the link, never the
- * target.
- *
- * Windows note: `fs.symlinkSync` can throw EPERM for unprivileged users. That
- * surfaces as an apply failure and triggers the normal rollback path, which is
- * the correct outcome — refusing to proceed beats silently copying referent
- * bytes.
- */
 /**
  * Evaluate and, if safe, perform a `remove-empty-dir` action against `fullPath`.
  *
@@ -133,23 +143,54 @@ function evaluateRemoveEmptyDir(configDir, fullPath) {
         return 'left-in-place';
     }
 }
+/**
+ * Copy a managed path for the rollback snapshot or the user-facing backup,
+ * WITHOUT dereferencing a symlink.
+ *
+ * `fs.copyFileSync` follows symlinks, so a managed path that has been replaced
+ * by a link (tampering, or an unexpected user layout) would have had the
+ * LINK TARGET's bytes copied into `gsd-migration-journal/…-backups/` — e.g. a
+ * `gsd.cjs` symlinked at `~/.ssh/id_rsa` would land that key's contents in the
+ * backup tree. Nothing GSD installs is ever a symlink, so the faithful snapshot
+ * of a symlinked managed path is the link itself: recreating it preserves
+ * rollback fidelity (restore re-creates the same link) while never reading the
+ * referent. Deletion was already safe — `fs.rmSync` unlinks the link, never the
+ * target.
+ *
+ * Windows note: `fs.symlinkSync` can throw EPERM for unprivileged users. That
+ * surfaces as an apply failure and triggers the normal rollback path, which is
+ * the correct outcome — refusing to proceed beats silently copying referent
+ * bytes.
+ *
+ * #2875 (epic #2866 Phase 6): all five fs calls routed through `installFs()`
+ * so this primitive can be reused on the routed install path (by
+ * user-artifact-staging.cts) without punching a hole through the seam Phase 5
+ * built. Every EXISTING caller of this function is on the migration
+ * plan/apply/rollback tree, which never wraps a call in `withInstallFs` — the
+ * ambient adapter there resolves to real `node:fs` by default, so this
+ * routing is behavior-preserving for them (test-matrix D2).
+ */
 function copyPreservingSymlink(srcPath, destPath) {
-    if (node_fs_1.default.lstatSync(srcPath).isSymbolicLink()) {
+    if (installFs().lstatSync(srcPath).isSymbolicLink()) {
         // symlinkSync fails with EEXIST on an occupied path, so clear it first.
         // Scoped to this branch on purpose: the regular-file path below keeps
         // copyFileSync's overwrite-in-place, so a mid-restore failure cannot leave
         // the destination destroyed.
-        node_fs_1.default.rmSync(destPath, { force: true });
-        node_fs_1.default.symlinkSync(node_fs_1.default.readlinkSync(srcPath), destPath);
+        installFs().rmSync(destPath, { force: true });
+        installFs().symlinkSync(installFs().readlinkSync(srcPath), destPath);
         return;
     }
-    node_fs_1.default.copyFileSync(srcPath, destPath);
+    installFs().copyFileSync(srcPath, destPath);
 }
+// Shared by readInstallManifest (on the installRuntimeArtifacts call tree —
+// routed) and readInstallState/readJson (not on that call tree — the
+// ambient default resolves to real fs for those, unchanged). Routing once
+// here is safe for all three callers.
 function readJsonIfPresent(filePath, fallback) {
-    if (!node_fs_1.default.existsSync(filePath))
+    if (!installFs().existsSync(filePath))
         return fallback;
     try {
-        return JSON.parse(node_fs_1.default.readFileSync(filePath, 'utf8'));
+        return JSON.parse(installFs().readFileSync(filePath, 'utf8'));
     }
     catch (error) {
         if (fallback === STRICT_JSON) {
@@ -158,17 +199,81 @@ function readJsonIfPresent(filePath, fallback) {
         return fallback;
     }
 }
+/** Lowest manifest schema version that records `runtime`/`scope` (#2872). */
+const MANIFEST_SCHEMA_VERSION = 2;
+/**
+ * Longest `runtime` string this reader will report. Real runtime ids are
+ * registry keys (`claude`, `antigravity`, `kimi-code` — 11 chars at the
+ * longest), so this loses nothing legitimate; it exists because the manifest
+ * is attacker-influenceable (a project-local one lives inside a repository a
+ * user may merely have cloned) and the value reaches a consumer that renders
+ * it. Same 64-char convention as `truncatePostureValue`
+ * (`agent-install-check.cts`), deliberately, so the subsystem caps reported
+ * values one way.
+ */
+const MAX_REPORTED_RUNTIME_LENGTH = 64;
+/**
+ * A manifest's `runtime` is reported as a FACT about the file — it is
+ * deliberately NOT validated against the capability registry, because an
+ * unregistered id is exactly the kind of mismatch the Installed Surface
+ * Resolver exists to surface (#2872 design row B8). It is, however, LENGTH
+ * bounded: "report the fact" never required "report unbounded bytes".
+ */
+function normalizeReportedRuntime(raw) {
+    if (typeof raw !== 'string')
+        return null;
+    if (raw.trim() === '')
+        return null;
+    return raw.length > MAX_REPORTED_RUNTIME_LENGTH
+        ? `${raw.slice(0, MAX_REPORTED_RUNTIME_LENGTH)}…`
+        : raw;
+}
+/**
+ * Normalize a raw `manifestVersion`. Only a finite integer >= 1 is a version
+ * claim; everything else (absent, `"2"`, `0`, `-1`, `2.5`, `NaN`, `Infinity`)
+ * reads as `1` — a pre-#2872 manifest. Liberal in what it accepts, but the
+ * normalization is a stated value rather than a silent guess: a caller can
+ * always tell v1 (`1`) from "no manifest at all" (`null`).
+ */
+function normalizeManifestVersion(raw) {
+    if (typeof raw !== 'number')
+        return 1;
+    if (!Number.isInteger(raw))
+        return 1;
+    if (raw < 1)
+        return 1;
+    return raw;
+}
 function readInstallManifest(configDir) {
     const manifest = readJsonIfPresent(node_path_1.default.join(configDir, MANIFEST_NAME), null);
-    if (!manifest || typeof manifest !== 'object') {
-        return { version: null, timestamp: null, mode: null, files: {} };
+    // `typeof [] === 'object'` in JS, so a bare `typeof !== 'object'` guard lets
+    // a top-level JSON array (valid JSON, but not the manifest's documented
+    // object shape) fall through to the field reads below — `m.manifestVersion`
+    // reads `undefined` off an array, which `normalizeManifestVersion` then
+    // reports as `1` (a v1 manifest), misclassifying "not an object" as
+    // "installed". `Array.isArray` closes that gap explicitly rather than
+    // relying on the object-shape checks below to catch it incidentally.
+    if (!manifest || typeof manifest !== 'object' || Array.isArray(manifest)) {
+        return {
+            version: null,
+            timestamp: null,
+            mode: null,
+            files: {},
+            manifestVersion: null,
+            runtime: null,
+            scope: null,
+        };
     }
     const m = manifest;
+    const rawRuntime = m.runtime;
     return {
         version: typeof m.version === 'string' ? m.version : null,
         timestamp: typeof m.timestamp === 'string' ? m.timestamp : null,
         mode: typeof m.mode === 'string' ? m.mode : null,
         files: m.files && typeof m.files === 'object' ? m.files : {},
+        manifestVersion: normalizeManifestVersion(m.manifestVersion),
+        runtime: normalizeReportedRuntime(rawRuntime),
+        scope: (0, install_scope_cjs_1.isInstallScopeId)(m.scope) ? m.scope : null,
     };
 }
 function readInstallState(configDir) {
@@ -235,7 +340,7 @@ function classifyArtifact(configDir, relPath, manifest) {
     const normalized = normalizeRelPath(relPath);
     const originalHash = manifest.files[normalized] || null;
     const fullPath = node_path_1.default.join(configDir, normalized);
-    if (!node_fs_1.default.existsSync(fullPath)) {
+    if (!installFs().existsSync(fullPath)) {
         return { classification: originalHash ? 'managed-missing' : 'missing', originalHash, currentHash: null };
     }
     const currentHash = sha256File(fullPath);
@@ -400,17 +505,20 @@ function acquireInstallMigrationLock(configDir, { timeoutMs = DEFAULT_LOCK_TIMEO
         let lockCreatedByUs = false;
         try {
             fd = node_fs_1.default.openSync(lockPath, 'wx');
-            // Close the open descriptor before writing so the file handle is
-            // released on Windows before the release closure unlinks it.
-            // Write payload via writeFileSync with the path (not the fd) so we
-            // don't hold an open fd across the lifetime of the lock.
-            node_fs_1.default.closeSync(fd);
-            fd = null;
             lockCreatedByUs = true; // we own the file; clean it up on any subsequent error
-            node_fs_1.default.writeFileSync(lockPath, JSON.stringify({
+            // Write the payload through the exclusively-created descriptor: a
+            // second open-by-path here would be a TOCTOU window (CWE-367) where a
+            // co-writer of the directory could symlink-swap the just-created empty
+            // lock file before the payload lands.
+            node_fs_1.default.writeFileSync(fd, JSON.stringify({
                 pid: process.pid,
                 acquiredAt: new Date().toISOString(),
             }) + '\n');
+            // Close before returning so no handle stays open across the lock's
+            // lifetime — Windows cannot unlink a file with an open handle when the
+            // release closure runs.
+            node_fs_1.default.closeSync(fd);
+            fd = null;
             lockCreatedByUs = false; // release closure owns cleanup from here
             return () => {
                 const failures = [];
@@ -937,8 +1045,10 @@ module.exports = {
     acquireInstallMigrationLock,
     applyInstallerMigrationPlan,
     classifyArtifact,
+    copyPreservingSymlink,
     discoverInstallerMigrations,
     evaluateRemoveEmptyDir,
+    MANIFEST_SCHEMA_VERSION,
     migrationChecksum,
     planInstallerMigrations,
     readInstallManifest,

package/gsd-core/bin/lib/intel.cjs

@@ -23,6 +23,9 @@ const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs")
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const capabilityStateMod = require("./capability-state.cjs");
 const { isCapabilityActive } = capabilityStateMod;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const ioMod = require("./io.cjs");
+const { formatDiagnosticToken } = ioMod;
 // ─── Constants ───────────────────────────────────────────────────────────────
 const INTEL_DIR = '.planning/intel';
 const INTEL_FILES = {
@@ -32,6 +35,16 @@ const INTEL_FILES = {
     arch: 'arch-decisions.json',
     stack: 'stack.json',
 };
+/**
+ * ADR-3473 §8.5 / #3885: recursion bound for the intel JSON search walk.
+ * Restored from the retired SDK lineage (`sdk/src/query/intel.ts` at `11918dcc3^`),
+ * lost in the ADR-0174 consolidation. Unlike the original, hitting the ceiling is
+ * NOT reported as a silent "no match" — the walk that stops early sets a
+ * `truncated` flag threaded back up to `intelQuery`'s result (Decision 4: a
+ * routine that discards an input says so). The bound is on DEPTH only; breadth
+ * (sibling count at any given depth) is unaffected.
+ */
+const MAX_JSON_SEARCH_DEPTH = 48;
 // ─── Internal helpers ────────────────────────────────────────────────────────
 /**
  * Ensure the intel directory exists under the given planning dir.
@@ -71,16 +84,42 @@ function intelFilePath(planningDir, filename) {
 }
 /**
  * Safely read and parse a JSON intel file.
- * Returns null if file doesn't exist or can't be parsed.
+ *
+ * Returns null for THREE distinct on-disk states, only one of which is a
+ * "quiet" case (#3885, ADR-3473 §8.5):
+ *   - ABSENT (ENOENT, via platformReadSync returning null): silent — not
+ *     every project has every intel file, and callers already loop over
+ *     the full INTEL_FILES set expecting misses. Never pushed to `errors`.
+ *   - UNREADABLE (EACCES/EIO/... — platformReadSync rethrows anything that
+ *     isn't ENOENT): surfaced, naming the file, when `errors` is supplied.
+ *   - MALFORMED (JSON.parse throws on a file that WAS read successfully):
+ *     also surfaced, naming the file — a corrupt intel file used to read
+ *     identically to "no matches", which is the same defect one layer down.
+ *
+ * `errors` is an optional accumulator so callers that want to thread the
+ * outcome into their own result shape can pass an array and read it back
+ * after the call; callers that omit it keep the prior fold-to-null shape.
  */
-function safeReadJson(filePath) {
+function safeReadJson(filePath, errors) {
+    let raw;
+    try {
+        raw = (0, shell_command_projection_cjs_1.platformReadSync)(filePath);
+    }
+    catch (err) {
+        if (errors) {
+            errors.push(`Could not read ${formatDiagnosticToken(filePath)}: ${formatDiagnosticToken(err?.message ?? String(err))}`);
+        }
+        return null;
+    }
+    if (raw === null)
+        return null; // ENOENT — genuinely absent, not an error.
     try {
-        const raw = (0, shell_command_projection_cjs_1.platformReadSync)(filePath);
-        if (raw === null)
-            return null;
         return JSON.parse(raw);
     }
-    catch {
+    catch (err) {
+        if (errors) {
+            errors.push(`Could not parse ${formatDiagnosticToken(filePath)}: ${formatDiagnosticToken(err?.message ?? String(err))}`);
+        }
         return null;
     }
 }
@@ -101,16 +140,17 @@ function hashFile(filePath) {
 }
 /**
  * Search for a term (case-insensitive) in a JSON object's keys and string values.
- * Returns an array of matching entries.
+ * Returns matching entries plus whether the walk hit MAX_JSON_SEARCH_DEPTH.
  */
 function searchJsonEntries(data, term) {
     if (!data || typeof data !== 'object')
-        return [];
+        return { matches: [], truncated: false };
     const entries = data.entries || data;
     if (!entries || typeof entries !== 'object')
-        return [];
+        return { matches: [], truncated: false };
     const lowerTerm = term.toLowerCase();
     const matches = [];
+    const state = { truncated: false };
     for (const [key, value] of Object.entries(entries)) {
         if (key === '_meta')
             continue;
@@ -119,25 +159,40 @@ function searchJsonEntries(data, term) {
             matches.push({ key, value });
             continue;
         }
-        // Check string value match (recursive for objects)
-        if (matchesInValue(value, lowerTerm)) {
+        // Check string value match (recursive for objects/arrays, bounded by depth)
+        if (matchesInValue(value, lowerTerm, 0, state)) {
             matches.push({ key, value });
         }
     }
-    return matches;
+    return { matches, truncated: state.truncated };
 }
 /**
  * Recursively check if a term appears in any string value.
+ *
+ * `depth` counts container unwraps already performed (starts at 0 for the
+ * entry's own value). Strings never fail the ceiling check themselves — only
+ * a container (object/array) refuses to recurse one level deeper once
+ * `depth > MAX_JSON_SEARCH_DEPTH`, at which point `state.truncated` is set so
+ * the caller can report "I stopped looking" rather than a bare "no match".
+ * The bound is on nesting depth only, never on sibling breadth.
  */
-function matchesInValue(value, lowerTerm) {
+function matchesInValue(value, lowerTerm, depth, state) {
     if (typeof value === 'string') {
         return value.toLowerCase().includes(lowerTerm);
     }
     if (Array.isArray(value)) {
-        return value.some(v => matchesInValue(v, lowerTerm));
+        if (depth > MAX_JSON_SEARCH_DEPTH) {
+            state.truncated = true;
+            return false;
+        }
+        return value.some(v => matchesInValue(v, lowerTerm, depth + 1, state));
     }
     if (value && typeof value === 'object') {
-        return Object.values(value).some(v => matchesInValue(v, lowerTerm));
+        if (depth > MAX_JSON_SEARCH_DEPTH) {
+            state.truncated = true;
+            return false;
+        }
+        return Object.values(value).some(v => matchesInValue(v, lowerTerm, depth + 1, state));
     }
     return false;
 }
@@ -150,19 +205,23 @@ function intelQuery(term, planningDir) {
         return disabledResponse();
     const matches = [];
     let total = 0;
+    let truncated = false;
+    const readErrors = [];
     // Search all JSON intel files
     for (const [_key, filename] of Object.entries(INTEL_FILES)) {
         const filePath = intelFilePath(planningDir, filename);
-        const data = safeReadJson(filePath);
+        const data = safeReadJson(filePath, readErrors);
         if (!data)
             continue;
-        const found = searchJsonEntries(data, term);
+        const { matches: found, truncated: fileTruncated } = searchJsonEntries(data, term);
+        if (fileTruncated)
+            truncated = true;
         if (found.length > 0) {
             matches.push({ source: filename, entries: found });
             total += found.length;
         }
     }
-    return { matches, term, total };
+    return { matches, term, total, truncated, read_errors: readErrors };
 }
 /**
  * Report status and staleness of each intel file.
@@ -179,13 +238,14 @@ function intelStatus(planningDir) {
         const filePath = intelFilePath(planningDir, filename);
         const exists = node_fs_1.default.existsSync(filePath);
         if (!exists) {
-            files[filename] = { exists: false, updated_at: null, stale: true };
+            files[filename] = { exists: false, updated_at: null, stale: true, read_error: null };
             overallStale = true;
             continue;
         }
         let updatedAt = null;
         // All intel files are JSON — read _meta.updated_at
-        const data = safeReadJson(filePath);
+        const readErrors = [];
+        const data = safeReadJson(filePath, readErrors);
         if (data && data._meta && data._meta.updated_at) {
             updatedAt = data._meta.updated_at;
         }
@@ -196,7 +256,7 @@ function intelStatus(planningDir) {
         }
         if (stale)
             overallStale = true;
-        files[filename] = { exists: true, updated_at: updatedAt, stale };
+        files[filename] = { exists: true, updated_at: updatedAt, stale, read_error: readErrors[0] ?? null };
     }
     return { files, overall_stale: overallStale };
 }
@@ -207,9 +267,15 @@ function intelDiff(planningDir) {
     if (!isIntelCapabilityActive(planningDir))
         return disabledResponse();
     const snapshotPath = intelFilePath(planningDir, '.last-refresh.json');
-    const snapshot = safeReadJson(snapshotPath);
+    const readErrors = [];
+    const snapshot = safeReadJson(snapshotPath, readErrors);
     if (!snapshot) {
-        return { no_baseline: true };
+        // #3885 (ADR-3473 §8.5): `no_baseline: true` stays true for BOTH a
+        // genuinely-never-snapshotted project (ENOENT, read_error stays null)
+        // AND a present-but-unreadable/malformed snapshot — collapsing those
+        // two into a bare `no_baseline: true` would manufacture "you've never
+        // run a refresh" out of a read failure. `read_error` names which one.
+        return { no_baseline: true, read_error: readErrors[0] ?? null };
     }
     const prevHashes = snapshot.hashes || {};
     const changed = [];
@@ -374,7 +440,9 @@ function intelApiSurface(planningDir) {
     const intelPath = ensureIntelDir(planningDir);
     const apiMapPath = node_path_1.default.join(intelPath, INTEL_FILES.apis);
     const outputPath = node_path_1.default.join(intelPath, 'API-SURFACE.md');
-    const data = safeReadJson(apiMapPath);
+    const readErrors = [];
+    const data = safeReadJson(apiMapPath, readErrors);
+    const readError = readErrors[0] ?? null;
     const entries = (data && data.entries && typeof data.entries === 'object')
         ? Object.entries(data.entries)
         : [];
@@ -392,7 +460,14 @@ function intelApiSurface(planningDir) {
     lines.push('> Generated from `.planning/intel/api-map.json`. Do not edit by hand.');
     lines.push('');
     if (symbolCount === 0) {
-        lines.push('> **Incomplete:** api-map.json has no entries (intel extraction is regex/JS-only or not yet populated).');
+        if (readError) {
+            // #3885: a read/parse failure is NOT "not yet populated" — say so,
+            // rather than manufacturing the wrong reason for the empty surface.
+            lines.push(`> **Incomplete:** ${readError}`);
+        }
+        else {
+            lines.push('> **Incomplete:** api-map.json has no entries (intel extraction is regex/JS-only or not yet populated).');
+        }
         lines.push('> Treat absence here as "unknown", not "does not exist".');
         lines.push('');
     }
@@ -414,7 +489,7 @@ function intelApiSurface(planningDir) {
         }
     }
     (0, shell_command_projection_cjs_1.platformWriteSync)(outputPath, lines.join('\n'));
-    return { written: outputPath, symbolCount, stale };
+    return { written: outputPath, symbolCount, stale, read_error: readError };
 }
 /**
  * Patch _meta.updated_at in a JSON intel file to the current timestamp.