@ouro.bot/cli 0.1.0-alpha.816 → 0.1.0-alpha.818

package/dist/heart/daemon/sense-manager.js

@@ -161,6 +161,9 @@ function runtimeConfigUnavailableDetail(agent, runtimeConfig) {
         return `missing vault ${itemName} (${agent})`;
     return `vault ${itemName} unavailable (${compactRuntimeConfigError(agent, runtimeConfig.error)})`;
 }
+function needsMachineRuntimeConfig(agent, sense) {
+    return sense === "bluebubbles" || sense === "voice" || sense === "a2a" || (agent === "sanctuary" && sense === "telegram");
+}
 function senseFactsFromRuntimeConfig(agent, senses, runtimeConfig, machineRuntimeConfig = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent), workbenchHasStaleBundleEntry = false) {
     const base = {
         cli: { configured: true, detail: "local interactive terminal" },
@@ -183,7 +186,14 @@ function senseFactsFromRuntimeConfig(agent, senses, runtimeConfig, machineRuntim
     const integrations = payload.integrations;
     const voice = machinePayload.voice;
     const a2a = machinePayload.a2a;
-    if (senses.telegram.enabled) {
+    if (senses.telegram.enabled && agent === "sanctuary") {
+        const ready = runtimeConfig.ok && machineRuntimeConfig.ok
+            && !Object.hasOwn(payload, "telegramBotToken") && !Object.hasOwn(machinePayload, "telegramBotToken");
+        base.telegram = ready
+            ? { configured: true, detail: "root authority transport; gateway validated at process startup" }
+            : { configured: false, detail: "root authority migration requires available tokenless credential inventories" };
+    }
+    else if (senses.telegram.enabled) {
         const missing = ["telegramBotToken", "telegramAuthorizedUserId", "telegramAuthorizedChatId"]
             .filter((field) => !textField(payload, field));
         base.telegram = missing.length === 0
@@ -355,7 +365,9 @@ function senseRepairHint(agent, sense) {
         return `Agent-runnable: run 'ouro connect a2a --agent ${agent}', then restart with 'ouro up'.`;
     }
     if (sense === "telegram") {
-        return `Agent-runnable: store Telegram bot/user/chat coordinates with 'ouro connect telegram --agent ${agent}', then restart with 'ouro up'.`;
+        return agent === "sanctuary"
+            ? "Agent-runnable: complete or recover the root authority migration; do not restore a resident Telegram token."
+            : `Agent-runnable: store Telegram bot/user/chat coordinates with 'ouro connect telegram --agent ${agent}', then restart with 'ouro up'.`;
     }
     /* v8 ignore next -- Workbench is deliberately not daemon-managed, so getSenseInventory never asks the daemon manager for a repair hint @preserve */
     if (sense === "workbench") {
@@ -655,10 +667,10 @@ class DaemonSenseManager {
         this.configRefreshRetryTimers.delete(name);
         this.configRefreshRetryAttempts.delete(name);
     }
-    shouldRetryConfigRefresh(sense, runtimeConfig, machineRuntimeConfig) {
+    shouldRetryConfigRefresh(agent, sense, runtimeConfig, machineRuntimeConfig) {
         if (!runtimeConfig.ok && runtimeConfig.reason === "unavailable")
             return true;
-        if ((sense === "bluebubbles" || sense === "voice" || sense === "a2a") &&
+        if (needsMachineRuntimeConfig(agent, sense) &&
             !machineRuntimeConfig.ok &&
             machineRuntimeConfig.reason === "unavailable")
             return true;
@@ -668,7 +680,7 @@ class DaemonSenseManager {
         let retryAfterMs = null;
         try {
             const refreshed = await (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(parsed.agent, { preserveCachedOnFailure: true });
-            const machineRefreshed = parsed.sense === "bluebubbles" || parsed.sense === "voice" || parsed.sense === "a2a"
+            const machineRefreshed = needsMachineRuntimeConfig(parsed.agent, parsed.sense)
                 ? await (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(parsed.agent, currentMachineId(), { preserveCachedOnFailure: true })
                 : (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(parsed.agent);
             const context = this.contexts.get(parsed.agent);
@@ -677,7 +689,7 @@ class DaemonSenseManager {
                 return;
             context.facts = senseFactsFromRuntimeConfig(parsed.agent, context.senses, refreshed, machineRefreshed, context.workbenchHasStaleBundleEntry);
             if (!context.facts[parsed.sense].configured) {
-                if (this.shouldRetryConfigRefresh(parsed.sense, refreshed, machineRefreshed)) {
+                if (this.shouldRetryConfigRefresh(parsed.agent, parsed.sense, refreshed, machineRefreshed)) {
                     retryAfterMs = this.nextConfigRetryDelayMs(name);
                 }
                 else {
@@ -723,13 +735,11 @@ class DaemonSenseManager {
             /* v8 ignore next -- periodic refresh work only exists when a managed background sense is enabled @preserve */
             if (enabledManagedSenses.length === 0)
                 return;
-            /* v8 ignore start -- periodic freshness refresh uses the same runtime readers covered by startup integration tests @preserve */
             const runtimeConfig = await (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(agent, { preserveCachedOnFailure: true });
-            const needsMachineConfig = enabledManagedSenses.some((sense) => sense === "bluebubbles" || sense === "voice" || sense === "a2a");
+            const needsMachineConfig = enabledManagedSenses.some((sense) => needsMachineRuntimeConfig(agent, sense));
             const machineRuntimeConfig = needsMachineConfig
                 ? await (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(agent, currentMachineId(), { preserveCachedOnFailure: true })
                 : (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent);
-            /* v8 ignore stop */
             context.facts = senseFactsFromRuntimeConfig(agent, context.senses, runtimeConfig, machineRuntimeConfig, context.workbenchHasStaleBundleEntry);
         });
         await Promise.all(refreshes);
@@ -835,7 +845,7 @@ class DaemonSenseManager {
             return null;
         const managedName = `${parsed.agent}:${parsed.sense}`;
         const runtimeConfig = await (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(parsed.agent, { preserveCachedOnFailure: true });
-        const needsMachineConfig = parsed.sense === "bluebubbles" || parsed.sense === "voice" || parsed.sense === "a2a";
+        const needsMachineConfig = needsMachineRuntimeConfig(parsed.agent, parsed.sense);
         const machineRuntimeConfig = needsMachineConfig
             ? await (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(parsed.agent, currentMachineId(), { preserveCachedOnFailure: true })
             : (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(parsed.agent);

package/dist/repertoire/tools-sanctuary-host.js

@@ -0,0 +1,202 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rootHostToolDefinition = exports.RootHostAuthorizationError = void 0;
+exports.authorizeRootHostContext = authorizeRootHostContext;
+exports.validateRootHostToolArguments = validateRootHostToolArguments;
+exports.selectRootHostTool = selectRootHostTool;
+exports.authorizeRootHostToolInvocation = authorizeRootHostToolInvocation;
+const path = __importStar(require("node:path"));
+const node_util_1 = require("node:util");
+const runtime_1 = require("../nerves/runtime");
+const sanctuary_host_authority_1 = require("../heart/daemon/sanctuary-host-authority");
+const session_events_1 = require("../heart/session-events");
+const shared_turn_1 = require("../senses/shared-turn");
+const relationship_authorization_1 = require("./relationship-authorization");
+const tool_arguments_1 = require("./tool-arguments");
+const NAME = "sanctuary_host_execute";
+const bindings = new WeakMap();
+const selections = new WeakMap();
+class RootHostAuthorizationError extends Error {
+}
+exports.RootHostAuthorizationError = RootHostAuthorizationError;
+function requireOwner(condition) {
+    if (!condition)
+        throw new RootHostAuthorizationError("Sanctuary root host authorization denied");
+}
+function ownerFriend(friend, port) {
+    requireOwner(friend?.admissionState === "active" && friend.trustLevel === "family"
+        && friend.initiativePolicy === "proactive" && friend.capabilityProfileId === "sanctuary-owner");
+    const identities = friend.externalIds.filter((identity) => identity.provider === "telegram-user" && identity.tenantId === port.pins.expectedBotId);
+    requireOwner(identities.length === 1 && identities[0].externalId === port.pins.expectedOwnerUserId);
+}
+function currentCoordinates(ctx) {
+    const root = ctx.rootHost;
+    const relationship = ctx.relationshipAuthorization;
+    const actor = relationship?.actor;
+    const session = ctx.currentSession;
+    const friend = ctx.context?.friend;
+    requireOwner(ctx.agentName === "sanctuary" && typeof ctx.agentRoot === "string" && path.isAbsolute(ctx.agentRoot)
+        && path.resolve(ctx.agentRoot) === ctx.agentRoot && path.basename(ctx.agentRoot) === "sanctuary.ouro");
+    requireOwner(root && root.port.isHealthy() && !ctx.currentExternalEvent);
+    requireOwner(relationship?.profileId === "sanctuary-owner" && relationship.advertisedToolNames?.includes(NAME));
+    ownerFriend(friend, root.port);
+    requireOwner(actor && actor.trustLevel === "family" && actor.friendId === friend.id && session?.friendId === friend.id
+        && session.channel === "telegram" && ctx.context.channel.channel === "telegram");
+    requireOwner([friend.id, actor.sessionEventId, relationship.requestId, session.key].every((value) => typeof value === "string" && value.trim().length > 0));
+    const sessionPath = (0, shared_turn_1.getSenseSessionPath)("sanctuary", friend.id, "telegram", session.key, ctx.agentRoot);
+    requireOwner(session.sessionPath === sessionPath && sessionPath.startsWith(`${ctx.agentRoot}${path.sep}`));
+    const envelope = (0, session_events_1.loadSessionEnvelopeFile)(sessionPath);
+    const latest = envelope && (0, session_events_1.selectEffectiveSessionEvents)(envelope.events).findLast((event) => event.role === "user");
+    requireOwner(latest && latest.id === actor.sessionEventId && latest.relations.references.includes(relationship.requestId));
+    const profile = (0, relationship_authorization_1.loadRelationshipCapabilityRegistry)(ctx.agentRoot).profiles["sanctuary-owner"];
+    requireOwner(profile && Number.isSafeInteger(profile.version) && profile.version >= 9 && profile.toolNames.includes(NAME));
+    return {
+        agentRoot: ctx.agentRoot, friendId: friend.id, requestId: relationship.requestId, sessionKey: session.key,
+        sessionPath, sessionEventId: actor.sessionEventId, profileId: "sanctuary-owner", profileVersion: profile.version,
+        keyId: root.port.pins.expectedKeyId, publicKeyDigest: root.port.pins.expectedPublicKeyDigest, targetHost: root.port.pins.expectedTargetHost,
+    };
+}
+function observationAccepted(ctx) {
+    const root = ctx.rootHost;
+    return !!root.observation && root.port.acceptsObservation(root.observation)
+        && root.observation.keyId === root.port.pins.expectedKeyId
+        && root.observation.publicKeyDigest === root.port.pins.expectedPublicKeyDigest
+        && root.observation.targetHost === root.port.pins.expectedTargetHost;
+}
+async function authorizeRootHostContext(ctx, expected) {
+    const previous = ctx.rootHost?.binding;
+    const provenance = previous && bindings.get(previous);
+    if (previous)
+        bindings.delete(previous);
+    const coordinates = currentCoordinates(ctx);
+    const root = ctx.rootHost;
+    const port = root.port;
+    const relationship = ctx.relationshipAuthorization;
+    const store = ctx.friendStore;
+    requireOwner(store && (expected ? (0, node_util_1.isDeepStrictEqual)(coordinates, expected) : observationAccepted(ctx)));
+    const friend = await store.get(coordinates.friendId);
+    ownerFriend(friend, port);
+    requireOwner(friend.id === coordinates.friendId);
+    const decision = await relationship.authorizeTool(NAME, {});
+    requireOwner(decision.allowed && decision.profileId === coordinates.profileId && decision.profileVersion === coordinates.profileVersion
+        && decision.friendId === coordinates.friendId && decision.requestId === coordinates.requestId
+        && typeof decision.receiptId === "string" && decision.receiptId.trim().length > 0);
+    requireOwner(ctx.rootHost === root && root.port === port && root.binding === previous && ctx.relationshipAuthorization === relationship && ctx.friendStore === store
+        && (0, node_util_1.isDeepStrictEqual)(coordinates, currentCoordinates(ctx)) && (expected !== undefined || observationAccepted(ctx)));
+    const binding = previous && provenance?.port === root.port && provenance.recovery === (expected !== undefined) && (0, node_util_1.isDeepStrictEqual)(previous, coordinates)
+        ? previous : Object.freeze(coordinates);
+    bindings.set(binding, { port: root.port, recovery: expected !== undefined });
+    root.binding = binding;
+    return binding;
+}
+const printable = (maximum) => ({ type: "string", minLength: 1, maxLength: maximum, pattern: "^[\\x20-\\x7e]+$" });
+const argumentsSchema = { type: "array", maxItems: 64, items: printable(512) };
+exports.rootHostToolDefinition = (0, tool_arguments_1.freezeToolValue)({
+    tool: {
+        type: "function",
+        function: {
+            name: NAME,
+            description: "Propose one exact Sanctuary host command for root-owned owner approval. Nothing executes until root approval and signed permit verification. verification is optional and defaults to null.",
+            parameters: {
+                type: "object", additionalProperties: false,
+                required: ["targetHost", "targetResource", "command", "workingDirectoryProfile", "environmentProfile", "timeoutMs"],
+                properties: {
+                    targetHost: printable(256), targetResource: printable(256),
+                    command: {
+                        oneOf: [
+                            { type: "object", additionalProperties: false, required: ["kind", "executable", "arguments"], properties: {
+                                    kind: { const: "executable" }, executable: printable(512), arguments: argumentsSchema,
+                                } },
+                            { type: "object", additionalProperties: false, required: ["kind", "interpreter", "arguments", "script"], properties: {
+                                    kind: { const: "script" }, interpreter: printable(512), arguments: argumentsSchema,
+                                    script: { type: "string", minLength: 1, maxLength: 2048, pattern: "^[\\x0a\\x20-\\x7e]+$" },
+                                } },
+                        ],
+                    },
+                    workingDirectoryProfile: { const: "host.root.v1" }, environmentProfile: { const: "host.clean.v1" },
+                    timeoutMs: { type: "integer", minimum: 1000, maximum: 900000 },
+                    verification: {
+                        type: "object", nullable: true, additionalProperties: false, required: ["profile", "expectedStateDigest"],
+                        properties: { profile: { const: "file.digest.v1" }, expectedStateDigest: { type: "string", pattern: "^sha256:[a-f0-9]{64}$" } },
+                    },
+                },
+            },
+        },
+    },
+    requiredCapability: "approval-continuation",
+    summaryKeys: ["targetHost", "targetResource"],
+    riskProfile: { risk: "high", mutates: "external_side_effect", reason: "owner-approved arbitrary host command" },
+    approvalPolicy: () => ({ kind: "required", policyId: "sanctuary.host.owner-approved.v1", actionClass: "owner_approved_arbitrary_host", requiresSoleCall: true }),
+    handler: () => { throw new Error("Sanctuary host execution requires the root approval continuation; resident execution is forbidden"); },
+});
+function validateRootHostToolArguments(args, targetHost) {
+    requireOwner(!Object.hasOwn(args, "ownerObservation"));
+    const proposal = {
+        ...args, verification: args.verification === undefined ? null : args.verification,
+        ownerObservation: { digest: `sha256:${"0".repeat(64)}`, updateId: 0, userId: "1", chatId: "1", messageId: "1" },
+    };
+    // S4 owns command canonicalization. This placeholder only validates the model-owned fields.
+    (0, sanctuary_host_authority_1.validateHostProposalRequest)(proposal, targetHost);
+    const { ownerObservation: _observation, ...command } = proposal;
+    return structuredClone(command);
+}
+function selectRootHostTool(ctx, capabilities) {
+    try {
+        const binding = ctx?.rootHost?.binding;
+        const provenance = binding && bindings.get(binding);
+        if (!ctx || !binding || !provenance || provenance.port !== ctx.rootHost.port || !capabilities?.has("approval-continuation")
+            || !(0, node_util_1.isDeepStrictEqual)(binding, currentCoordinates(ctx)) || (!provenance.recovery && !observationAccepted(ctx)))
+            return undefined;
+        const selected = Object.freeze({ ...exports.rootHostToolDefinition });
+        selections.set(selected, { binding, capabilities });
+        return selected;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function authorizeRootHostToolInvocation(ctx, definition, args) {
+    const selected = definition && selections.get(definition);
+    requireOwner(ctx && selected && ctx.rootHost?.binding === selected.binding && ctx.toolSelection?.ordinary.includes(definition));
+    if (!ctx.rootHost.port.isHealthy() && !await ctx.rootHost.port.refresh())
+        throw new Error("Sanctuary root host authority is unavailable");
+    requireOwner(selectRootHostTool(ctx, selected.capabilities));
+    const provenance = bindings.get(selected.binding);
+    await authorizeRootHostContext(ctx, provenance.recovery ? selected.binding : undefined);
+    requireOwner(selectRootHostTool(ctx, selected.capabilities));
+    validateRootHostToolArguments(args, selected.binding.targetHost);
+    (0, runtime_1.emitNervesEvent)({ component: "repertoire", event: "repertoire.sanctuary_host_invocation_admitted", message: "Owner host-tool invocation admitted to the root approval path" });
+}

package/dist/repertoire/tools.js

@@ -39,6 +39,7 @@ const tools_steward_policy_1 = require("./tools-steward-policy");
 const steward_policy_1 = require("../heart/steward-policy");
 const relationship_authorization_1 = require("./relationship-authorization");
 const tool_approval_1 = require("../heart/tool-approval");
+const tools_sanctuary_host_1 = require("./tools-sanctuary-host");
 function safeGetAgentRoot() {
     try {
         return (0, identity_1.getAgentRoot)();
@@ -120,7 +121,7 @@ function selectToolsForChannel(capabilities, toolPreferences, _context, provider
     const mcp = mcpManager ? (0, mcp_tools_1.mcpToolsAsDefinitions)(mcpManager) : [];
     const native = [...tools_base_1.baseToolDefinitions, ...additionalDefinitions];
     assertUniqueToolSchemas([
-        ...native.map((definition) => definition.tool), ...mcp.map((definition) => definition.tool),
+        ...native.map((definition) => definition.tool), tools_sanctuary_host_1.rootHostToolDefinition.tool, ...mcp.map((definition) => definition.tool),
         tools_flow_1.ponderTool, tools_flow_1.restTool, tools_flow_1.observeTool, tools_flow_1.settleTool, tools_flow_1.speakTool,
     ]);
     let ordinary;
@@ -148,6 +149,11 @@ function selectToolsForChannel(capabilities, toolPreferences, _context, provider
             ...integrations, ...mcp,
         ];
     }
+    const hostTool = capabilities?.channel === "telegram"
+        ? (0, tools_sanctuary_host_1.selectRootHostTool)({ ...context, context: _context ?? context?.context }, providerCapabilities)
+        : undefined;
+    if (hostTool)
+        ordinary.push(hostTool);
     const inner = capabilities?.channel === "inner";
     const habit = context?.habitSession;
     if (inner) {
@@ -166,7 +172,7 @@ function selectToolsForChannel(capabilities, toolPreferences, _context, provider
     ].filter((tool) => (!sanctuary || (knownSanctuaryProfile && tool.function.name !== "observe"))
         && (!relationship || relationship.advertisedToolNames.includes(tool.function.name)));
     return Object.freeze({
-        ordinary: Object.freeze(ordinary.map((definition) => Object.freeze({
+        ordinary: Object.freeze(ordinary.map((definition) => definition === hostTool ? definition : Object.freeze({
             ...definition,
             tool: (0, tool_arguments_1.freezeToolValue)(structuredClone(definition.tool)),
             ...(definition.riskProfile && typeof definition.riskProfile !== "function"
@@ -328,6 +334,8 @@ async function preflightToolCall(name, args, ctx) {
             (0, runtime_1.emitNervesEvent)({ level: "error", event: "tool.error", component: "tools", message: "unknown or unselected tool requested", meta: { name } });
             return { kind: "rejected_before_handler", text: `unknown: ${name}` };
         }
+        if (name === tools_sanctuary_host_1.rootHostToolDefinition.tool.function.name)
+            await (0, tools_sanctuary_host_1.authorizeRootHostToolInvocation)(ctx, def, args);
         if (selection || ctx?.relationshipAuthorization) {
             const validation = (0, tool_arguments_1.validateAdvertisedToolArguments)(JSON.stringify(args), schema.function.parameters ?? {});
             if (!validation.ok)
@@ -338,7 +346,7 @@ async function preflightToolCall(name, args, ctx) {
             return { kind: "rejected_before_handler", text: (0, tools_base_1.routineActionDenied)(ctx.routineActionSelection.reason) };
         }
         const relationship = ctx?.relationshipAuthorization;
-        const decision = await relationship?.authorizeTool(name, args);
+        const decision = name === tools_sanctuary_host_1.rootHostToolDefinition.tool.function.name ? undefined : await relationship?.authorizeTool(name, args);
         if (decision && (!decision.allowed || !relationship.advertisedToolNames.includes(name)
             || (decision.profileId !== undefined && decision.profileId !== relationship.profileId))) {
             const reason = decision.allowed ? "current relationship selection changed" : decision.reason;
@@ -349,9 +357,10 @@ async function preflightToolCall(name, args, ctx) {
             return { kind: "rejected_before_handler", text: `relationship authorization required: ${reason}` };
         }
         const currentSelection = ctx?.selectCurrentTools?.()
-            ?? (relationship?.profileId?.startsWith("sanctuary-") || (relationship && ctx?.agentName === "sanctuary")
-                ? selectToolsForChannel(undefined, undefined, undefined, undefined, undefined, undefined, ctx)
-                : undefined);
+            ?? (name === tools_sanctuary_host_1.rootHostToolDefinition.tool.function.name ? selection
+                : relationship?.profileId?.startsWith("sanctuary-") || (relationship && ctx?.agentName === "sanctuary")
+                    ? selectToolsForChannel(undefined, undefined, undefined, undefined, undefined, undefined, ctx)
+                    : undefined);
         const current = currentSelection ? findDefinition(name, currentSelection) : def?.mcpBinding ? def : findDefinition(name);
         const currentSchema = current?.tool ?? currentSelection?.engine.find((tool) => tool.function.name === name)
             ?? (!currentSelection ? selection?.engine.find((tool) => tool.function.name === name) : undefined);

package/dist/senses/private-runtime.js

@@ -491,14 +491,14 @@ function privateTurnExecutionPath(decision) {
 }
 function claimPrivateTurnExecution(decision, now) {
     const executionPath = privateTurnExecutionPath(decision);
-    fs.mkdirSync(path.dirname(executionPath), { recursive: true });
+    fs.mkdirSync(path.dirname(executionPath), { recursive: true, mode: 0o700 });
     try {
         fs.writeFileSync(executionPath, JSON.stringify({
             receiptId: decision.receiptId,
             idempotencyKey: decision.idempotencyKey,
             requestFingerprint: decision.requestFingerprint,
             claimedAt: now().toISOString(),
-        }), { encoding: "utf-8", flag: "wx" });
+        }), { encoding: "utf-8", flag: "wx", mode: 0o600 });
         return true;
     }
     catch (error) {