@runweave/server-linux-x64 0.1.4 → 0.1.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runweave/server-linux-x64",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "license": "MIT",
   "repository": {
     "type": "git",

package/payload/app-server/build-info.json

@@ -1,8 +1,8 @@
 {
   "version": "0.1.0",
-  "buildId": "20261107T223214246Z-f6afc191",
-  "sourceRevision": "f6afc191b5f9be76aa35a6ee494a0d752c21af08",
+  "buildId": "20261108T113257171Z-480c12d6",
+  "sourceRevision": "480c12d6f84124b98d7908b6317fc1a067480bbb",
   "sourceDirty": false,
-  "builtAt": "2026-11-07T22:32:14.246Z",
-  "contentSha256": "c391a00b597ca25406e1b3afa7654d2fa4ecc180b3a685c649dbd2acd40c8900"
+  "builtAt": "2026-11-08T11:32:57.171Z",
+  "contentSha256": "9d35815d7ecbf345ce1ff15eaae37eb2b88f6df5289e67f3991b156aac3e2c62"
 }

package/payload/app-server/index.cjs

@@ -1,4 +1,4 @@
-/* runweave:build-info */var __RUNWEAVE_BUILD_INFO__={"version":"0.1.0","buildId":"20261107T223214246Z-f6afc191","sourceRevision":"f6afc191b5f9be76aa35a6ee494a0d752c21af08","sourceDirty":false,"builtAt":"2026-11-07T22:32:14.246Z","contentSha256":"c391a00b597ca25406e1b3afa7654d2fa4ecc180b3a685c649dbd2acd40c8900"};
+/* runweave:build-info */var __RUNWEAVE_BUILD_INFO__={"version":"0.1.0","buildId":"20261108T113257171Z-480c12d6","sourceRevision":"480c12d6f84124b98d7908b6317fc1a067480bbb","sourceDirty":false,"builtAt":"2026-11-08T11:32:57.171Z","contentSha256":"9d35815d7ecbf345ce1ff15eaae37eb2b88f6df5289e67f3991b156aac3e2c62"};
 const __IMPORT_META_URL__ = require('url').pathToFileURL(__filename).href;
 "use strict";
 var __create = Object.create;
@@ -34557,21 +34557,57 @@ var ConfigurationError = class extends Error {
 
 // packages/config-node/src/private-file.ts
 var import_node_fs4 = require("node:fs");
+
+// packages/config-node/src/windows-permissions.ts
+var import_node_child_process = require("node:child_process");
+function assertWindowsPrivatePath(file) {
+  if (process.platform !== "win32") return;
+  const script = `
+$ErrorActionPreference = 'Stop'
+# Use .NET directly: a parent pwsh may export a PSModulePath incompatible with Windows PowerShell.
+$acl = if ([IO.Directory]::Exists($env:RUNWEAVE_PRIVATE_PATH)) {
+  [IO.Directory]::GetAccessControl($env:RUNWEAVE_PRIVATE_PATH)
+} else { [IO.File]::GetAccessControl($env:RUNWEAVE_PRIVATE_PATH) }
+$sid = [Security.Principal.WindowsIdentity]::GetCurrent().User
+$allowed = @($sid.Value, 'S-1-5-18', 'S-1-5-32-544')
+if ($acl.GetOwner([Security.Principal.SecurityIdentifier]).Value -notin $allowed) { throw 'owner' }
+foreach ($rule in $acl.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier])) {
+  if ($rule.AccessControlType -eq 'Allow' -and $rule.IdentityReference.Value -notin $allowed) { throw 'access' }
+}
+`;
+  try {
+    (0, import_node_child_process.execFileSync)("powershell.exe", ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], {
+      env: { ...process.env, RUNWEAVE_PRIVATE_PATH: file },
+      stdio: "ignore",
+      timeout: 1e4,
+      windowsHide: true
+    });
+  } catch {
+    throw new ConfigurationError("CONFIG_WINDOWS_ACL_NOT_PRIVATE", [file]);
+  }
+}
+
+// packages/config-node/src/private-file.ts
 function assertPrivateDirectory(directory) {
   const stat3 = (0, import_node_fs4.lstatSync)(directory);
-  if (!stat3.isDirectory() || stat3.isSymbolicLink() || stat3.mode & 63 || typeof process.getuid === "function" && stat3.uid !== process.getuid()) throw new ConfigurationError("CONFIG_ROOT_PERMISSIONS_INVALID");
+  if (!stat3.isDirectory() || stat3.isSymbolicLink() || process.platform !== "win32" && stat3.mode & 63 || typeof process.getuid === "function" && stat3.uid !== process.getuid()) throw new ConfigurationError("CONFIG_ROOT_PERMISSIONS_INVALID");
+  assertWindowsPrivatePath(directory);
 }
-function assertPrivateDescriptor(fd, maxBytes = 1024 * 1024) {
+function assertPrivateDescriptor(fd, maxBytes = 1024 * 1024, file) {
   const stat3 = (0, import_node_fs4.fstatSync)(fd);
   if (!stat3.isFile() || stat3.nlink !== 1) throw new ConfigurationError("CONFIG_FILE_NOT_PRIVATE_REGULAR");
   if (typeof process.getuid === "function" && stat3.uid !== process.getuid()) throw new ConfigurationError("CONFIG_FILE_OWNER_MISMATCH");
-  if (stat3.mode & 63) throw new ConfigurationError("CONFIG_FILE_PERMISSIONS_INVALID");
+  if (process.platform !== "win32" && stat3.mode & 63) throw new ConfigurationError("CONFIG_FILE_PERMISSIONS_INVALID");
+  if (process.platform === "win32") {
+    if (!file) throw new ConfigurationError("CONFIG_PRIVATE_PATH_REQUIRED");
+    assertWindowsPrivatePath(file);
+  }
   if (stat3.size > maxBytes) throw new ConfigurationError("CONFIG_FILE_TOO_LARGE");
 }
 function readPrivateFile(file, maxBytes = 1024 * 1024) {
   const fd = (0, import_node_fs4.openSync)(file, import_node_fs4.constants.O_RDONLY | import_node_fs4.constants.O_NOFOLLOW);
   try {
-    assertPrivateDescriptor(fd, maxBytes);
+    assertPrivateDescriptor(fd, maxBytes, file);
     const source = (0, import_node_fs4.readFileSync)(fd, "utf8");
     if (Buffer.byteLength(source) > maxBytes) throw new ConfigurationError("CONFIG_FILE_TOO_LARGE");
     return source;
@@ -34646,15 +34682,27 @@ function assertOwnedPath(context, value) {
   }
 }
 
-// packages/config-node/src/owner.ts
+// packages/config-node/src/platform.ts
 var import_node_fs6 = require("node:fs");
+function syncDirectory(directory) {
+  if (process.platform === "win32") return;
+  const fd = (0, import_node_fs6.openSync)(directory, "r");
+  try {
+    (0, import_node_fs6.fsyncSync)(fd);
+  } finally {
+    (0, import_node_fs6.closeSync)(fd);
+  }
+}
+
+// packages/config-node/src/owner.ts
+var import_node_fs7 = require("node:fs");
 var import_node_path4 = __toESM(require("node:path"), 1);
 var import_node_os2 = __toESM(require("node:os"), 1);
 var import_node_crypto3 = require("node:crypto");
 var import_fs_native_extensions = require("fs-native-extensions");
 function ownerDirectory(context) {
   const directory = context.kind === "stable" ? import_node_path4.default.join(import_node_os2.default.userInfo().homedir, ".runweave", "runtime") : import_node_path4.default.join(context.configRoot, "runtime");
-  (0, import_node_fs6.mkdirSync)(directory, { recursive: true, mode: 448 });
+  (0, import_node_fs7.mkdirSync)(directory, { recursive: true, mode: 448 });
   assertPrivateDirectory(import_node_path4.default.dirname(directory));
   assertPrivateDirectory(directory);
   return directory;
@@ -34663,11 +34711,11 @@ function registerStableConfigurationRoot(context) {
   if (context.kind !== "stable") return;
   const directory = ownerDirectory(context);
   const registry = import_node_path4.default.join(directory, "stable-root.json");
-  const registryFd = (0, import_node_fs6.openSync)(import_node_path4.default.join(directory, "stable-root.lock"), import_node_fs6.constants.O_CREAT | import_node_fs6.constants.O_RDWR | import_node_fs6.constants.O_NOFOLLOW, 384);
+  const registryFd = (0, import_node_fs7.openSync)(import_node_path4.default.join(directory, "stable-root.lock"), import_node_fs7.constants.O_CREAT | import_node_fs7.constants.O_RDWR | import_node_fs7.constants.O_NOFOLLOW, 384);
   try {
-    assertPrivateDescriptor(registryFd);
+    assertPrivateDescriptor(registryFd, void 0, import_node_path4.default.join(directory, "stable-root.lock"));
     if (!(0, import_fs_native_extensions.tryLock)(registryFd)) throw new ConfigurationError("CONFIG_ROOT_REGISTRATION_BUSY");
-    if ((0, import_node_fs6.existsSync)(registry)) {
+    if ((0, import_node_fs7.existsSync)(registry)) {
       let stored;
       try {
         stored = JSON.parse(readPrivateFile(registry));
@@ -34677,34 +34725,29 @@ function registerStableConfigurationRoot(context) {
       if (!stored || typeof stored !== "object" || !("root" in stored) || stored.root !== canonicalPath(context.configRoot)) throw new ConfigurationError("CONFIG_STABLE_ROOT_CONFLICT");
     } else {
       const temporary = `${registry}.${(0, import_node_crypto3.randomUUID)()}.tmp`;
-      const file = (0, import_node_fs6.openSync)(temporary, "wx", 384);
-      try {
-        (0, import_node_fs6.writeFileSync)(file, JSON.stringify({ root: canonicalPath(context.configRoot) }));
-        (0, import_node_fs6.fsyncSync)(file);
-      } finally {
-        (0, import_node_fs6.closeSync)(file);
-      }
-      (0, import_node_fs6.renameSync)(temporary, registry);
-      const parent = (0, import_node_fs6.openSync)(directory, "r");
+      const file = (0, import_node_fs7.openSync)(temporary, "wx", 384);
       try {
-        (0, import_node_fs6.fsyncSync)(parent);
+        (0, import_node_fs7.writeFileSync)(file, JSON.stringify({ root: canonicalPath(context.configRoot) }));
+        (0, import_node_fs7.fsyncSync)(file);
       } finally {
-        (0, import_node_fs6.closeSync)(parent);
+        (0, import_node_fs7.closeSync)(file);
       }
+      (0, import_node_fs7.renameSync)(temporary, registry);
+      syncDirectory(directory);
     }
   } finally {
-    (0, import_node_fs6.closeSync)(registryFd);
+    (0, import_node_fs7.closeSync)(registryFd);
   }
 }
 function withUpgradeGate(context, shared, run) {
   const directory = ownerDirectory(context);
-  const fd = (0, import_node_fs6.openSync)(import_node_path4.default.join(directory, "configuration-upgrade.lock"), import_node_fs6.constants.O_CREAT | import_node_fs6.constants.O_RDWR | import_node_fs6.constants.O_NOFOLLOW, 384);
+  const fd = (0, import_node_fs7.openSync)(import_node_path4.default.join(directory, "configuration-upgrade.lock"), import_node_fs7.constants.O_CREAT | import_node_fs7.constants.O_RDWR | import_node_fs7.constants.O_NOFOLLOW, 384);
   try {
-    assertPrivateDescriptor(fd);
+    assertPrivateDescriptor(fd, void 0, import_node_path4.default.join(directory, "configuration-upgrade.lock"));
     if (!(0, import_fs_native_extensions.tryLock)(fd, 0, 0, { shared })) throw new ConfigurationError("CONFIG_UPGRADE_BUSY");
     return run();
   } finally {
-    (0, import_node_fs6.closeSync)(fd);
+    (0, import_node_fs7.closeSync)(fd);
   }
 }
 function withConfigurationUpgradeOwnership(context, run, ignoredRoles = []) {
@@ -34712,16 +34755,16 @@ function withConfigurationUpgradeOwnership(context, run, ignoredRoles = []) {
     const directory = ownerDirectory(context);
     const held = [];
     try {
-      for (const file of (0, import_node_fs6.readdirSync)(directory).filter((name) => name.endsWith(".owner.lock"))) {
+      for (const file of (0, import_node_fs7.readdirSync)(directory).filter((name) => name.endsWith(".owner.lock"))) {
         if (ignoredRoles.includes(file.replace(/\.owner\.lock$/, ""))) continue;
-        const fd = (0, import_node_fs6.openSync)(import_node_path4.default.join(directory, file), import_node_fs6.constants.O_RDWR | import_node_fs6.constants.O_NOFOLLOW);
+        const fd = (0, import_node_fs7.openSync)(import_node_path4.default.join(directory, file), import_node_fs7.constants.O_RDWR | import_node_fs7.constants.O_NOFOLLOW);
         held.push(fd);
-        assertPrivateDescriptor(fd);
+        assertPrivateDescriptor(fd, void 0, import_node_path4.default.join(directory, file));
         if (!(0, import_fs_native_extensions.tryLock)(fd)) throw new ConfigurationError("CONFIG_UPGRADE_CONSUMER_RUNNING", [file.replace(/\.owner\.lock$/, "")]);
       }
       return run();
     } finally {
-      for (const fd of held) (0, import_node_fs6.closeSync)(fd);
+      for (const fd of held) (0, import_node_fs7.closeSync)(fd);
     }
   });
 }
@@ -34730,16 +34773,16 @@ function acquireConfigurationOwner(context, role) {
 }
 function acquireOwner(context, role) {
   const directory = ownerDirectory(context);
-  const fd = (0, import_node_fs6.openSync)(import_node_path4.default.join(directory, `${role}.owner.lock`), import_node_fs6.constants.O_CREAT | import_node_fs6.constants.O_RDWR | import_node_fs6.constants.O_NOFOLLOW, 384);
+  const fd = (0, import_node_fs7.openSync)(import_node_path4.default.join(directory, `${role}.owner.lock`), import_node_fs7.constants.O_CREAT | import_node_fs7.constants.O_RDWR | import_node_fs7.constants.O_NOFOLLOW, 384);
   let closed = false;
   const release = () => {
     if (!closed) {
       closed = true;
-      (0, import_node_fs6.closeSync)(fd);
+      (0, import_node_fs7.closeSync)(fd);
     }
   };
   try {
-    assertPrivateDescriptor(fd);
+    assertPrivateDescriptor(fd, void 0, import_node_path4.default.join(directory, `${role}.owner.lock`));
     if (!(0, import_fs_native_extensions.tryLock)(fd)) throw new ConfigurationError("CONFIG_INSTANCE_ALREADY_RUNNING", [role]);
     registerStableConfigurationRoot(context);
     return { release };
@@ -35062,7 +35105,7 @@ function migrateConfigurationDocument(document2) {
 }
 
 // packages/config-node/src/store.ts
-var import_node_fs7 = require("node:fs");
+var import_node_fs8 = require("node:fs");
 var import_node_path6 = __toESM(require("node:path"), 1);
 var import_node_crypto4 = require("node:crypto");
 var import_yaml = __toESM(require_dist(), 1);
@@ -35256,10 +35299,11 @@ function parseConfigurationYaml(source, context) {
   return { document: document2, value, digest: (0, import_node_crypto4.createHash)("sha256").update(source).digest("hex"), issues: validateDomains(value, context) };
 }
 function assertPrivateFile(file, fd) {
-  const stat3 = fd === void 0 ? (0, import_node_fs7.lstatSync)(file) : (0, import_node_fs7.fstatSync)(fd);
+  const stat3 = fd === void 0 ? (0, import_node_fs8.lstatSync)(file) : (0, import_node_fs8.fstatSync)(fd);
   if (!stat3.isFile() || stat3.isSymbolicLink() || stat3.nlink !== 1) throw new ConfigurationError("CONFIG_FILE_NOT_PRIVATE_REGULAR");
   if (typeof process.getuid === "function" && stat3.uid !== process.getuid()) throw new ConfigurationError("CONFIG_FILE_OWNER_MISMATCH");
-  if ((stat3.mode & 63) !== 0) throw new ConfigurationError("CONFIG_FILE_PERMISSIONS_INVALID");
+  if (process.platform !== "win32" && (stat3.mode & 63) !== 0) throw new ConfigurationError("CONFIG_FILE_PERMISSIONS_INVALID");
+  assertWindowsPrivatePath(file);
   if (stat3.size > MAX_BYTES) throw new ConfigurationError("CONFIG_FILE_TOO_LARGE", [], { line: 1, column: 1 });
 }
 var ConfigurationStore = class {
@@ -35269,30 +35313,29 @@ var ConfigurationStore = class {
   }
   file;
   read() {
-    if (!(0, import_node_fs7.existsSync)(this.file)) throw new ConfigurationError("CONFIG_MIGRATION_REQUIRED");
-    const root = (0, import_node_fs7.lstatSync)(this.context.configRoot);
-    if (!root.isDirectory() || root.isSymbolicLink() || root.mode & 63 || typeof process.getuid === "function" && root.uid !== process.getuid()) throw new ConfigurationError("CONFIG_ROOT_PERMISSIONS_INVALID");
+    if (!(0, import_node_fs8.existsSync)(this.file)) throw new ConfigurationError("CONFIG_MIGRATION_REQUIRED");
+    assertPrivateDirectory(this.context.configRoot);
     assertPrivateFile(this.file);
-    const fd = (0, import_node_fs7.openSync)(this.file, import_node_fs7.constants.O_RDONLY | import_node_fs7.constants.O_NOFOLLOW);
+    const fd = (0, import_node_fs8.openSync)(this.file, import_node_fs8.constants.O_RDONLY | import_node_fs8.constants.O_NOFOLLOW);
     try {
       assertPrivateFile(this.file, fd);
-      return parseConfigurationYaml((0, import_node_fs7.readFileSync)(fd, "utf8"), this.context);
+      return parseConfigurationYaml((0, import_node_fs8.readFileSync)(fd, "utf8"), this.context);
     } finally {
-      (0, import_node_fs7.closeSync)(fd);
+      (0, import_node_fs8.closeSync)(fd);
     }
   }
   locked(run) {
-    (0, import_node_fs7.mkdirSync)(this.context.configRoot, { recursive: true, mode: 448 });
-    const dirStat = (0, import_node_fs7.lstatSync)(this.context.configRoot);
+    (0, import_node_fs8.mkdirSync)(this.context.configRoot, { recursive: true, mode: 448 });
+    const dirStat = (0, import_node_fs8.lstatSync)(this.context.configRoot);
     if (!dirStat.isDirectory() || dirStat.isSymbolicLink() || typeof process.getuid === "function" && dirStat.uid !== process.getuid()) throw new ConfigurationError("CONFIG_ROOT_OWNER_MISMATCH");
-    if ((dirStat.mode & 63) !== 0) throw new ConfigurationError("CONFIG_ROOT_PERMISSIONS_INVALID");
-    const fd = (0, import_node_fs7.openSync)(import_node_path6.default.join(this.context.configRoot, "settings.lock"), import_node_fs7.constants.O_CREAT | import_node_fs7.constants.O_RDWR | import_node_fs7.constants.O_NOFOLLOW, 384);
+    assertPrivateDirectory(this.context.configRoot);
+    const fd = (0, import_node_fs8.openSync)(import_node_path6.default.join(this.context.configRoot, "settings.lock"), import_node_fs8.constants.O_CREAT | import_node_fs8.constants.O_RDWR | import_node_fs8.constants.O_NOFOLLOW, 384);
     try {
       assertPrivateFile(import_node_path6.default.join(this.context.configRoot, "settings.lock"), fd);
       if (!(0, import_fs_native_extensions2.tryLock)(fd)) throw new ConfigurationError("CONFIG_WRITE_BUSY");
       return run();
     } finally {
-      (0, import_node_fs7.closeSync)(fd);
+      (0, import_node_fs8.closeSync)(fd);
     }
   }
   publish(document2, previous, backupId) {
@@ -35302,41 +35345,35 @@ var ConfigurationStore = class {
     const temporary = `${this.file}.${(0, import_node_crypto4.randomUUID)()}.tmp`;
     if (previous !== void 0) {
       const backupRoot = import_node_path6.default.join(this.context.configRoot, "config-backups");
-      (0, import_node_fs7.mkdirSync)(backupRoot, { recursive: true, mode: 448 });
-      const backupStat = (0, import_node_fs7.lstatSync)(backupRoot);
-      if (!backupStat.isDirectory() || backupStat.isSymbolicLink() || backupStat.mode & 63 || typeof process.getuid === "function" && backupStat.uid !== process.getuid()) throw new ConfigurationError("CONFIG_BACKUP_ROOT_INVALID");
+      (0, import_node_fs8.mkdirSync)(backupRoot, { recursive: true, mode: 448 });
+      assertPrivateDirectory(backupRoot);
       const backup = import_node_path6.default.join(backupRoot, backupId ?? `${Date.now()}-${(0, import_node_crypto4.randomUUID)()}.yaml`);
-      const fd2 = (0, import_node_fs7.openSync)(backup, "wx", 384);
+      const fd2 = (0, import_node_fs8.openSync)(backup, "wx", 384);
       try {
-        (0, import_node_fs7.writeFileSync)(fd2, previous);
-        (0, import_node_fs7.fsyncSync)(fd2);
+        (0, import_node_fs8.writeFileSync)(fd2, previous);
+        (0, import_node_fs8.fsyncSync)(fd2);
       } finally {
-        (0, import_node_fs7.closeSync)(fd2);
+        (0, import_node_fs8.closeSync)(fd2);
       }
     }
-    const fd = (0, import_node_fs7.openSync)(temporary, "wx", 384);
+    const fd = (0, import_node_fs8.openSync)(temporary, "wx", 384);
     try {
-      (0, import_node_fs7.writeFileSync)(fd, source);
-      (0, import_node_fs7.fsyncSync)(fd);
+      (0, import_node_fs8.writeFileSync)(fd, source);
+      (0, import_node_fs8.fsyncSync)(fd);
     } finally {
-      (0, import_node_fs7.closeSync)(fd);
+      (0, import_node_fs8.closeSync)(fd);
     }
     try {
-      (0, import_node_fs7.renameSync)(temporary, this.file);
-      const parent = (0, import_node_fs7.openSync)(this.context.configRoot, "r");
-      try {
-        (0, import_node_fs7.fsyncSync)(parent);
-      } finally {
-        (0, import_node_fs7.closeSync)(parent);
-      }
+      (0, import_node_fs8.renameSync)(temporary, this.file);
+      syncDirectory(this.context.configRoot);
     } finally {
-      if ((0, import_node_fs7.existsSync)(temporary)) (0, import_node_fs7.unlinkSync)(temporary);
+      if ((0, import_node_fs8.existsSync)(temporary)) (0, import_node_fs8.unlinkSync)(temporary);
     }
     return checked;
   }
   initialize(value) {
     return this.locked(() => {
-      if ((0, import_node_fs7.existsSync)(this.file)) throw new ConfigurationError("CONFIG_ALREADY_EXISTS");
+      if ((0, import_node_fs8.existsSync)(this.file)) throw new ConfigurationError("CONFIG_ALREADY_EXISTS");
       validateEnvelope(value, this.context);
       const issues = validateDomains(value, this.context);
       if (Object.keys(issues).length) throw new ConfigurationError("CONFIG_VALIDATION_FAILED", Object.values(issues).flat().map((item) => item.path));
@@ -35376,9 +35413,9 @@ var ConfigurationStore = class {
   }
   backups() {
     const root = import_node_path6.default.join(this.context.configRoot, "config-backups");
-    if (!(0, import_node_fs7.existsSync)(root)) return [];
+    if (!(0, import_node_fs8.existsSync)(root)) return [];
     assertPrivateDirectory(root);
-    return (0, import_node_fs7.readdirSync)(root).filter((id) => /^\d+-[a-f0-9-]+\.yaml$/.test(id)).sort().reverse().map((id) => {
+    return (0, import_node_fs8.readdirSync)(root).filter((id) => /^\d+-[a-f0-9-]+\.yaml$/.test(id)).sort().reverse().map((id) => {
       try {
         const backup = this.readBackup(id);
         return { id, revision: backup.value.revision, schemaVersion: backup.value.schemaVersion, compatible: true };
@@ -35456,23 +35493,18 @@ var ConfigurationStore = class {
   recordUpgrade(value) {
     const file = import_node_path6.default.join(this.context.configRoot, "config-upgrade.json");
     const temporary = `${file}.${(0, import_node_crypto4.randomUUID)()}.tmp`;
-    const fd = (0, import_node_fs7.openSync)(temporary, "wx", 384);
+    const fd = (0, import_node_fs8.openSync)(temporary, "wx", 384);
     try {
-      (0, import_node_fs7.writeFileSync)(fd, JSON.stringify(value, null, 2) + "\n");
-      (0, import_node_fs7.fsyncSync)(fd);
+      (0, import_node_fs8.writeFileSync)(fd, JSON.stringify(value, null, 2) + "\n");
+      (0, import_node_fs8.fsyncSync)(fd);
     } finally {
-      (0, import_node_fs7.closeSync)(fd);
+      (0, import_node_fs8.closeSync)(fd);
     }
     try {
-      (0, import_node_fs7.renameSync)(temporary, file);
-      const parent = (0, import_node_fs7.openSync)(this.context.configRoot, "r");
-      try {
-        (0, import_node_fs7.fsyncSync)(parent);
-      } finally {
-        (0, import_node_fs7.closeSync)(parent);
-      }
+      (0, import_node_fs8.renameSync)(temporary, file);
+      syncDirectory(this.context.configRoot);
     } finally {
-      if ((0, import_node_fs7.existsSync)(temporary)) (0, import_node_fs7.unlinkSync)(temporary);
+      if ((0, import_node_fs8.existsSync)(temporary)) (0, import_node_fs8.unlinkSync)(temporary);
     }
   }
   upgrade(expected) {
@@ -35481,7 +35513,7 @@ var ConfigurationStore = class {
       if (preview.expectedRevision !== expected.revision || preview.expectedDigest !== expected.digest) throw new ConfigurationError("CONFIG_REVISION_CONFLICT");
       if (!preview.changed) {
         const receiptFile = import_node_path6.default.join(this.context.configRoot, "config-upgrade.json");
-        if ((0, import_node_fs7.existsSync)(receiptFile)) {
+        if ((0, import_node_fs8.existsSync)(receiptFile)) {
           const receipt = JSON.parse(readPrivateFile(receiptFile));
           if (isConfigurationObject(receipt) && receipt.phase === "prepared" && receipt.plannedDigest === expected.digest)
             this.recordUpgrade({ ...receipt, phase: "committed", savedRevision: expected.revision, digest: expected.digest });
@@ -35515,9 +35547,9 @@ var ConfigurationStore = class {
   previous(keys) {
     const current = this.read();
     const root = import_node_path6.default.join(this.context.configRoot, "config-backups");
-    if (!(0, import_node_fs7.existsSync)(root)) throw new ConfigurationError("CONFIG_BACKUP_UNAVAILABLE");
+    if (!(0, import_node_fs8.existsSync)(root)) throw new ConfigurationError("CONFIG_BACKUP_UNAVAILABLE");
     assertPrivateDirectory(root);
-    const candidates = (0, import_node_fs7.readdirSync)(root).filter((file) => /^\d+-[a-f0-9-]+\.yaml$/.test(file)).sort().reverse();
+    const candidates = (0, import_node_fs8.readdirSync)(root).filter((file) => /^\d+-[a-f0-9-]+\.yaml$/.test(file)).sort().reverse();
     for (const candidate of candidates) {
       const file = import_node_path6.default.join(root, candidate);
       const previous = parseConfigurationYaml(readPrivateFile(file), this.context);
@@ -35529,7 +35561,7 @@ var ConfigurationStore = class {
   }
   migrate(value, expected) {
     return this.locked(() => {
-      const current = (0, import_node_fs7.existsSync)(this.file) ? this.read() : null;
+      const current = (0, import_node_fs8.existsSync)(this.file) ? this.read() : null;
       if (current ? !expected || current.value.revision !== expected.revision || current.digest !== expected.digest : expected !== null) throw new ConfigurationError("CONFIG_REVISION_CONFLICT");
       validateEnvelope(value, this.context);
       const issues = validateDomains(value, this.context);
@@ -35743,7 +35775,7 @@ function configurationPath(key, relativeDefault) {
 }
 
 // packages/config-node/src/runtime-status.ts
-var import_node_fs8 = require("node:fs");
+var import_node_fs9 = require("node:fs");
 var import_node_path8 = __toESM(require("node:path"), 1);
 
 // packages/shared/src/monitoring/runtime-version.ts
@@ -35796,23 +35828,23 @@ function readInstalledRuntimeBuild(entry) {
       const root = entry.slice(0, index);
       const relative = entry.slice(index + marker.length).split(import_node_path8.default.sep).slice(1);
       const pointer = import_node_path8.default.join(root, "current.json");
-      if ((0, import_node_fs8.existsSync)(pointer)) {
-        const selected = JSON.parse((0, import_node_fs8.readFileSync)(pointer, "utf8"));
+      if ((0, import_node_fs9.existsSync)(pointer)) {
+        const selected = JSON.parse((0, import_node_fs9.readFileSync)(pointer, "utf8"));
         if (!/^[a-zA-Z0-9._-]+$/.test(selected.releaseId) || [".", ".."].includes(selected.releaseId)) return null;
         entry = import_node_path8.default.join(root, "releases", selected.releaseId, ...relative);
       }
     }
-    fd = (0, import_node_fs8.openSync)(entry, "r");
+    fd = (0, import_node_fs9.openSync)(entry, "r");
     const buffer = Buffer.alloc(8192);
-    const length = (0, import_node_fs8.readSync)(fd, buffer, 0, buffer.length, 0);
+    const length = (0, import_node_fs9.readSync)(fd, buffer, 0, buffer.length, 0);
     const match = buffer.subarray(0, length).toString("utf8").split("\n", 1)[0]?.match(/var __RUNWEAVE_BUILD_INFO__=(\{.*\});/);
     const metadata = import_node_path8.default.join(import_node_path8.default.dirname(entry), "release.json");
-    const value = match ? JSON.parse(match[1]) : JSON.parse((0, import_node_fs8.readFileSync)((0, import_node_fs8.existsSync)(metadata) ? metadata : import_node_path8.default.join(import_node_path8.default.dirname(entry), "build-info.json"), "utf8"));
+    const value = match ? JSON.parse(match[1]) : JSON.parse((0, import_node_fs9.readFileSync)((0, import_node_fs9.existsSync)(metadata) ? metadata : import_node_path8.default.join(import_node_path8.default.dirname(entry), "build-info.json"), "utf8"));
     return typeof value.version === "string" && typeof value.buildId === "string" ? value : null;
   } catch {
     return null;
   } finally {
-    if (fd !== void 0) (0, import_node_fs8.closeSync)(fd);
+    if (fd !== void 0) (0, import_node_fs9.closeSync)(fd);
   }
 }
 
@@ -36940,8 +36972,8 @@ var CodexQuotaService = class {
 };
 
 // app-server/src/codex/client.ts
-var import_node_child_process = require("node:child_process");
-var import_node_fs9 = require("node:fs");
+var import_node_child_process2 = require("node:child_process");
+var import_node_fs10 = require("node:fs");
 var import_node_os4 = __toESM(require("node:os"), 1);
 var import_node_path15 = __toESM(require("node:path"), 1);
 
@@ -37202,7 +37234,7 @@ var CodexAppServerClient = class {
     this.stdoutBuffer = "";
     this.stderrBuffer = "";
     const launchPlan = resolveCodexLaunchPlan(process.env);
-    this.child = (0, import_node_child_process.spawn)(launchPlan.command, launchPlan.args, {
+    this.child = (0, import_node_child_process2.spawn)(launchPlan.command, launchPlan.args, {
       env: buildCodexProcessEnv(process.env, launchPlan),
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -37331,7 +37363,7 @@ function resolveCodexBinaryCandidates(env) {
 }
 function resolveNvmCodexCandidates(nodeVersionsDir) {
   try {
-    return (0, import_node_fs9.readdirSync)(nodeVersionsDir).map((entry) => import_node_path15.default.join(nodeVersionsDir, entry, "bin", "codex")).sort((left, right) => readMtimeMs(right) - readMtimeMs(left));
+    return (0, import_node_fs10.readdirSync)(nodeVersionsDir).map((entry) => import_node_path15.default.join(nodeVersionsDir, entry, "bin", "codex")).sort((left, right) => readMtimeMs(right) - readMtimeMs(left));
   } catch {
     return [];
   }