@wrongstack/core 0.306.0 → 0.306.2

package/dist/coordination/mailbox-parse-state.d.ts

@@ -1,16 +1,34 @@
 /**
- * Incremental parse state for the mailbox JSONL file.
+ * Parse state for the legacy mailbox JSONL file.
  *
- * `parseMailboxFile()` is a whole-file operation: it JSON-parses every line and
- * re-projects every message. That is the correct shape for a one-shot read, but
- * the read path is anything but one-shot — `unreadCount()`/`query()` consult the
- * cache on every tool call, and any append by another session invalidates it.
- * On a mailbox holding a day of fleet traffic (~3 MB / ~2.8k lines) that turned
- * into the single largest allocation source in the whole TUI process: ~78% of
- * all bytes allocated while idle, which V8 then let pile up as garbage until a
- * major GC — read as "RAM keeps growing and /clear doesn't help".
+ * ## Where this runs today
  *
- * This module keeps enough state alongside the projections that an APPEND can
+ * ONE caller: `SqliteMailbox.migrateLegacyFiles()` via `parseMailboxFile()`,
+ * i.e. the one-shot import of a pre-SQLite `_mailbox.jsonl` that runs at most
+ * once per project and is then fenced off by the `legacy_files_imported`
+ * marker. Nothing reads JSONL on the live path any more: the detached owner
+ * holds the only handle and every query is SQL.
+ *
+ * The incremental half of this module — `createMailboxParseState` +
+ * `ingestMailboxChunk` called with an appended chunk — has NO production
+ * caller. `parseMailboxFile()` is implemented on top of it (one fold, not
+ * two), so the code runs, but the append path and its invariants (stale-index
+ * tracking, `firstNewIndex`, duplicate-id fan-out) are exercised only by
+ * tests. Treat a change there as unvalidated by production traffic.
+ *
+ * ## Why it was built this way
+ *
+ * Historical, and worth keeping because the fold logic is still the thing
+ * that has to be exact: when the mailbox WAS a JSONL file, the read path was
+ * anything but one-shot — `unreadCount()`/`query()` consulted a cache on every
+ * tool call and any append by another session invalidated it. On a mailbox
+ * holding a day of fleet traffic (~3 MB / ~2.8k lines) a full re-parse per
+ * read became the single largest allocation source in the TUI process: ~78% of
+ * all bytes allocated while idle, piling up as garbage until a major GC — read
+ * as "RAM keeps growing and /clear doesn't help". That pressure is gone with
+ * the store; the exactness requirement is not.
+ *
+ * The module keeps enough state alongside the projections that an APPEND can
  * be folded in without touching the bytes that were already parsed:
  *
  *   - `messages`          — base messages in file order, v1 acks already folded

package/dist/coordination/mailbox-project-server.js

@@ -251,6 +251,14 @@ function makePatternMatcher(pattern) {
   return (e) => e === pattern;
 }
 
+// src/security/file-permissions.ts
+import {
+  restrictDirPermissions,
+  restrictFilePermissions,
+  SECRET_DIR_MODE,
+  SECRET_FILE_MODE
+} from "@wrongstack/persistence";
+
 // src/utils/atomic-write.ts
 import {
   createPersistencePrimitives
@@ -2191,17 +2199,24 @@ function credentialRevoke(db, credentialId, reason, by) {
 function credentialRotate(db, transaction, credentialId, options) {
   const old = credentialGet(db, credentialId);
   if (old === null) return null;
+  if (old.status === "revoked") return null;
   return credentialIssue(db, transaction, {
     principalId: old.principalId,
     projectId: old.projectId ?? options?.projectId,
     kind: old.kind,
     capabilities: options?.capabilities ?? old.capabilities,
-    ttlMs: options?.ttlMs ?? MAX_CREDENTIAL_TTL[old.kind],
+    ttlMs: options?.ttlMs ?? previousCredentialTtlMs(old),
     notBefore: options?.notBefore,
     supersedes: credentialId,
     issuedBy: options?.issuedBy
   });
 }
+function previousCredentialTtlMs(credential) {
+  const issuedAt = new Date(credential.issuedAt).getTime();
+  const expiresAt = new Date(credential.expiresAt).getTime();
+  const ttlMs = expiresAt - issuedAt;
+  return Number.isFinite(ttlMs) && ttlMs > 0 ? ttlMs : MAX_CREDENTIAL_TTL[credential.kind];
+}
 
 // src/coordination/sqlite-mailbox-schema.ts
 import * as fs2 from "node:fs";
@@ -2660,9 +2675,14 @@ var SqliteMailbox = class {
     const type = query.type === void 0 ? void 0 : normalizeMailboxMessageType(query.type);
     const priorityRank = { low: 0, normal: 1, high: 2 };
     const minimumRank = query.minPriority === void 0 ? 0 : priorityRank[query.minPriority];
+    if (query.ids !== void 0 && query.ids.length === 0) return [];
     const statuses = query.unreadBy === void 0 ? await this.getAgentStatuses() : void 0;
     const where = [];
     const params = [];
+    if (query.ids !== void 0) {
+      where.push(`id IN (${query.ids.map(() => "?").join(", ")})`);
+      params.push(...query.ids);
+    }
     if (query.to !== void 0) {
       where.push("(to_id = ? OR to_id = ?)");
       params.push(query.to, "*");
@@ -2735,7 +2755,9 @@ var SqliteMailbox = class {
       params.push(query.limit ?? 50);
     }
     const rows = this.stmt(sql).all(...params);
+    const idFilter = query.ids === void 0 ? void 0 : new Set(query.ids);
     const messages = this.materializeMessageRows(rows).filter((message) => {
+      if (idFilter !== void 0 && !idFilter.has(message.id)) return false;
       if (query.to !== void 0 && message.to !== query.to && message.to !== "*") return false;
       if (query.from !== void 0 && message.from !== query.from) return false;
       if (query.sessionId !== void 0 && message.senderSessionId !== query.sessionId)
@@ -2840,11 +2862,76 @@ var SqliteMailbox = class {
     }
     return updated;
   }
+  /**
+   * Count the messages this actor has neither read nor completed.
+   *
+   * Pushed into SQL rather than filtering `readMessages()`. The pre-tool hook
+   * asks for this repeatedly — `mailbox-hooks.ts` throttles it to once a
+   * second, which bounds the frequency but not the cost — and the JS form
+   * materialized EVERY row in `messages`, joined the whole `message_receipts`
+   * table, and folded per-actor receipt state across all of them just to
+   * return an integer.
+   *
+   * The predicate is deliberately the same one {@link query} builds for
+   * `{ unreadBy, incompleteOnly }`, because it has to agree exactly with
+   * `isMessageCompletedForActor` and `isMailboxMessageVisibleTo`:
+   *
+   * - **unread** — no per-actor receipt carrying `read_at`, and no legacy
+   *   `readBy` key. Both are checked: `ackMany` writes the receipt row AND
+   *   mirrors the timestamp into the message's `readBy` JSON.
+   * - **incomplete** — not `legacy_global_completion`, no per-actor receipt
+   *   carrying `completed_at`, and the aggregate `completed` flag counts only
+   *   when the message has no receipts at all (once any actor has a receipt,
+   *   completion is per-actor and the aggregate flag is not authoritative).
+   * - **audience** — `leaders` mail is invisible unless the actor's base
+   *   identity is `leader`. This call path carries no role, matching the
+   *   `isMailboxMessageVisibleTo(message, forAgentId)` it replaces.
+   */
   async unreadCount(forAgentId, sessionId) {
     const sessionAddress = sessionId === void 0 ? void 0 : sessionRecipient(sessionId);
-    return this.readMessages().filter(
-      (message) => (message.to === forAgentId || message.to === "*" || message.to === sessionAddress) && isMailboxMessageVisibleTo(message, forAgentId) && !(forAgentId in message.readBy) && !isMessageCompletedForActor(message, forAgentId) && message.deletedAt === void 0
-    ).length;
+    const where = [];
+    const params = [];
+    const recipients = ["to_id = ?", "to_id = '*'"];
+    params.push(forAgentId);
+    if (sessionAddress !== void 0) {
+      recipients.push("to_id = ?");
+      params.push(sessionAddress);
+    }
+    where.push(`(${recipients.join(" OR ")})`);
+    where.push("deleted_at IS NULL");
+    if (!isMailboxLeader(forAgentId)) {
+      where.push("COALESCE(json_extract(data, '$.audience'), 'all') <> 'leaders'");
+    }
+    where.push(`NOT EXISTS (
+      SELECT 1 FROM message_receipts AS read_receipt
+      WHERE read_receipt.message_id = messages.id
+        AND read_receipt.actor_id = ?
+        AND read_receipt.read_at IS NOT NULL
+    )`);
+    params.push(forAgentId);
+    where.push(`NOT EXISTS (
+      SELECT 1 FROM json_each(json_extract(data, '$.readBy')) AS legacy_read
+      WHERE legacy_read.key = ?
+    )`);
+    params.push(forAgentId);
+    where.push("legacy_global_completion = 0");
+    where.push(`NOT EXISTS (
+      SELECT 1 FROM message_receipts AS completed_receipt
+      WHERE completed_receipt.message_id = messages.id
+        AND completed_receipt.actor_id = ?
+        AND completed_receipt.completed_at IS NOT NULL
+    )`);
+    params.push(forAgentId);
+    where.push(`(
+      completed = 0 OR EXISTS (
+        SELECT 1 FROM message_receipts AS any_receipt
+        WHERE any_receipt.message_id = messages.id
+      )
+    )`);
+    const row = this.stmt(
+      `SELECT COUNT(*) AS total FROM messages WHERE ${where.join(" AND ")}`
+    ).get(...params);
+    return Number(row?.total ?? 0);
   }
   async softDelete(mailId, by) {
     const message = this.findMessage(mailId);
@@ -3402,6 +3489,13 @@ async function writeMetadata() {
   const metadata = { ...serverStatus(), authToken };
   await atomicWrite(metadataPath, `${JSON.stringify(metadata, null, 2)}
 `, { mode: 384 });
+  await restrictFilePermissions(metadataPath, {
+    label: "mailbox-server-metadata",
+    // stdio is 'ignore' for this detached process; stderr is where its other
+    // diagnostics go, so a failed hardening is at least consistent with them.
+    warn: (message) => process.stderr.write(`${message}
+`)
+  });
 }
 async function removeOwnedMetadata() {
   try {

package/dist/coordination/mailbox-types.d.ts

@@ -105,12 +105,14 @@ export { MAILBOX_TYPE_PROPERTIES, type MailboxMessageType, type MailboxTypeCateg
  * 6. **Awareness polling**: `btw` messages intercepted by background
  *    polling are queued via `setBtwNote()` for injection at a safe loop
  *    boundary, not folded inline.
- * 7. **Agent registry**: `getAgentStatuses()` reads the dedicated agent
- *    registry (`_mailbox.registry.json`), not mailbox message content. The
- *    registry is populated by agent heartbeat calls (not by `status`-type
- *    messages). `Mailbox.getAgentStatuses()` derives
- *    a registry snapshot from `status`-type messages as a fallback when no
- *    shared registry file exists.
+ * 7. **Agent registry**: `getAgentStatuses()` reads the dedicated `agents`
+ *    table, not mailbox message content. That table is populated by
+ *    `registerAgent` / `heartbeat` — never by `status`-type messages, which
+ *    are ordinary mail and carry no presence meaning. There is no fallback
+ *    that derives presence from message content: the registry is either the
+ *    owner's table or nothing. (It was `_mailbox.registry.json` before the
+ *    SQLite cutover; both that file and the derive-from-messages fallback are
+ *    gone.)
  * 8. **Request-scoped context**: delivered raw mailbox blocks are removed
  *    after one successful provider evaluation. Durable assistant/tool/task
  *    consequences remain; routine mail does not occupy later requests.
@@ -132,6 +134,26 @@ export type MailboxAudience = 'all' | 'leaders';
 export declare function mailboxIdentityBase(agentId: string): string;
 /** Whether a mailbox identity belongs to the session's main/leader agent. */
 export declare function isMailboxLeader(agentId: string, role?: string): boolean;
+/**
+ * Whether a sender identity belongs to a named agent family.
+ *
+ * Matches the family id exactly, or as the `<family>-<suffix>` prefix that a
+ * spawned worker carries. Both forms occur in practice for the same logical
+ * sender: a pipeline agent may post under its plain id (`dep-watcher`, which
+ * `makeDependencyWatcherConfig` sends as), or a subagent may post under the
+ * name it was spawned with — `host-subagent-factory` sets `ctx.agentId` from
+ * the spawn name, so the tech-stack worker spawned as
+ * `tech-stack-package.json` writes mail from `tech-stack-package.json@<tag>`.
+ * A consumer gating on the plain family id with `===` would silently reject
+ * its own pipeline.
+ *
+ * Same shape as the existing `chimera` / `chimera-*` check in
+ * `applyMailboxSendPolicy` and `host-subagent-factory`.
+ *
+ * Session/process qualifiers are stripped first, so `<family>@<tag>` and
+ * `<family>#<pid>` match too.
+ */
+export declare function isMailboxSenderInFamily(senderId: string, family: string): boolean;
 /** Whether a message may be consumed by the supplied agent identity. */
 export declare function isMailboxMessageVisibleTo(message: Pick<MailboxMessage, 'audience'>, agentId: string, role?: string): boolean;
 /**
@@ -381,6 +403,22 @@ export interface MailboxAgentStatus {
     source?: 'cli' | 'webui' | 'mcp' | 'acp' | 'http' | undefined;
 }
 export interface MailboxQuery {
+    /**
+     * Restrict the result to these message ids.
+     *
+     * Exists so a caller that already knows which messages it cares about can
+     * ask about exactly those instead of pulling a set and scanning it. The
+     * HTTP bridge's per-actor visibility checks did the latter — answering
+     * "is this one message mine?" by materializing every message addressed to
+     * the actor, which on a busy project meant a full table read (plus the
+     * whole receipt table, plus a retention projection per row) for every
+     * single `ack`.
+     *
+     * An empty array matches nothing. Untrusted request codecs deliberately do
+     * NOT accept this field — `validateQuery` whitelists, so it stays a
+     * server-side narrowing rather than something a caller can widen.
+     */
+    ids?: readonly string[] | undefined;
     /** Filter by recipient agent id. */
     to?: string | undefined;
     /** Filter by sender agent id. */

package/dist/coordination/package-outdated-watcher.d.ts

@@ -58,7 +58,21 @@ export interface PackageOutdatedWatcherOptions {
     pollIntervalMs?: number | undefined;
     /** Agent id that runs this watcher. Default: 'pkg-outdated-watcher'. */
     watcherAgentId?: string | undefined;
-    /** Agent id of the tech-stack agent to watch for results. Default: 'tech-stack'. */
+    /**
+     * The only sender whose `result` messages this watcher acts on. Default:
+     * `'tech-stack'`. Matched as an agent family, so the worker the tech-stack
+     * consumer spawns as `tech-stack-<manifest>` also passes — `ctx.agentId`
+     * comes from the spawn name, so its mail arrives from
+     * `tech-stack-package.json@<tag>`, not from a bare `tech-stack`.
+     *
+     * This option was declared and documented from the start but never read:
+     * it appeared exactly once in the codebase, in this interface. The watcher
+     * therefore acted on a `result` addressed to it from ANY sender, and the
+     * body chose both the package names and — through `getPackageAuthor` —
+     * whether the resulting HIGH-priority notification went to one agent or was
+     * broadcast to `*`. Any agent on the project could use it to push
+     * attacker-chosen text to everyone, under a watcher's identity.
+     */
     techStackAgentId?: string | undefined;
     /** Called to send a notification to an agent. */
     onNotify: (msg: OutdatedNotifyMessage) => Promise<void>;

package/dist/coordination/sqlite-mailbox-credentials.d.ts

@@ -29,6 +29,32 @@ export declare function credentialIssue(db: DatabaseSync, transaction: <T>(run:
  */
 export declare function credentialVerify(db: DatabaseSync, credentialId: string, secret: string): CredentialValidation;
 export declare function credentialRevoke(db: DatabaseSync, credentialId: string, reason?: string, by?: string): boolean;
+/**
+ * Rotate a credential: mint a successor for the same principal and mark the
+ * predecessor `rotated_out` with an overlap window.
+ *
+ * Two rules that are easy to get wrong, and were:
+ *
+ * 1. **A revoked credential is not rotatable.** Rotation has the same
+ *    capability requirement as issuance, so this is not a privilege boundary —
+ *    but it IS an audit and intent boundary. Rotating a revoked credential
+ *    minted a fresh ACTIVE credential carrying the revoked one's principal and
+ *    capabilities, and recorded it as an ordinary rotation
+ *    (`supersedes: <revoked-id>`). Revocation is the emergency lever; undoing
+ *    it must be an explicit re-issue that reads like one in the log, not a
+ *    rotate that reads like routine hygiene. `rotated_out` and expired-but-
+ *    active credentials stay rotatable: "my credential lapsed, roll it" is a
+ *    legitimate flow, and neither state asserts that the holder was distrusted.
+ *
+ * 2. **Rotation preserves the credential's lifetime**, it does not reset it to
+ *    the maximum for the kind. Defaulting to `MAX_CREDENTIAL_TTL` meant a
+ *    deliberately short-lived credential — a 5-minute agent token minted for
+ *    one task — silently became a 7-day one the first time it was rotated,
+ *    with nothing in the call expressing that intent. The original duration is
+ *    recoverable from the record (`expiresAt - issuedAt`), and
+ *    `createMailboxCredential` still clamps it to the per-kind maximum, so
+ *    preserving it can only ever narrow the grant.
+ */
 export declare function credentialRotate(db: DatabaseSync, transaction: <T>(run: () => T) => T, credentialId: string, options?: Partial<IssueCredentialOptions>): {
     credential: MailboxCredential;
     secret: string;

package/dist/coordination/sqlite-mailbox.d.ts

@@ -33,6 +33,31 @@ export declare class SqliteMailbox implements Mailbox {
     query(query: MailboxQuery): Promise<MailboxMessage[]>;
     ack(input: MailboxAckInput): Promise<MailboxMessage | null>;
     ackMany(input: MailboxAckBatchInput): Promise<MailboxMessage[]>;
+    /**
+     * Count the messages this actor has neither read nor completed.
+     *
+     * Pushed into SQL rather than filtering `readMessages()`. The pre-tool hook
+     * asks for this repeatedly — `mailbox-hooks.ts` throttles it to once a
+     * second, which bounds the frequency but not the cost — and the JS form
+     * materialized EVERY row in `messages`, joined the whole `message_receipts`
+     * table, and folded per-actor receipt state across all of them just to
+     * return an integer.
+     *
+     * The predicate is deliberately the same one {@link query} builds for
+     * `{ unreadBy, incompleteOnly }`, because it has to agree exactly with
+     * `isMessageCompletedForActor` and `isMailboxMessageVisibleTo`:
+     *
+     * - **unread** — no per-actor receipt carrying `read_at`, and no legacy
+     *   `readBy` key. Both are checked: `ackMany` writes the receipt row AND
+     *   mirrors the timestamp into the message's `readBy` JSON.
+     * - **incomplete** — not `legacy_global_completion`, no per-actor receipt
+     *   carrying `completed_at`, and the aggregate `completed` flag counts only
+     *   when the message has no receipts at all (once any actor has a receipt,
+     *   completion is per-actor and the aggregate flag is not authoritative).
+     * - **audience** — `leaders` mail is invisible unless the actor's base
+     *   identity is `leader`. This call path carries no role, matching the
+     *   `isMailboxMessageVisibleTo(message, forAgentId)` it replaces.
+     */
     unreadCount(forAgentId: string, sessionId?: string): Promise<number>;
     softDelete(mailId: string, by: string): Promise<MailboxMessage | null>;
     restore(mailId: string): Promise<MailboxMessage | null>;

package/dist/coordination/techstack-mailbox-consumer.d.ts

@@ -24,6 +24,23 @@ export interface TechStackConsumerOptions {
     }>;
     /** Agent id that the consumer watches for. Default: 'tech-stack'. */
     targetAgent?: string | undefined;
+    /**
+     * The only sender whose `assign` messages may spawn an agent. Default:
+     * `'dep-watcher'` — the `watcherAgentId` default of
+     * {@link attachDepWatcherBridge}, which is the pipeline this consumer exists
+     * to serve. Matched on the base identity, so a session-qualified
+     * `dep-watcher@<tag>` also passes.
+     *
+     * Without this the consumer acted on an `assign` addressed to `tech-stack`
+     * from ANY sender. The mailbox is a shared bus: every agent on the project
+     * can send one with `mail_send`, and so can any external credential holding
+     * `mail.send.actionable` when the HTTP bridge is enabled. The message body
+     * then chose a file path and was pasted verbatim into the task of a freshly
+     * spawned subagent holding `read`, `fetch` and `mailbox` — a peer-writable
+     * path into an agent that can read files, reach the network, and broadcast
+     * to everyone. Restricting the sender is what makes the spawn intentional.
+     */
+    senderAgentId?: string | undefined;
     /** Agent id that sends the completion ack. Default: 'tech-stack-consumer'. */
     consumerAgentId?: string | undefined;
     /** Polling interval in ms. Default: 5000. */

package/dist/core/index.js

@@ -1505,24 +1505,34 @@ var RemoteMailbox = class {
   }
   publishHqRegistryEvent(event, payload) {
     const publisher = this.hqPublisher;
-    if (!publisher || !event.startsWith("mailbox.agent_") && !event.startsWith("mailbox.client_")) {
+    if (!publisher || this.closed || !event.startsWith("mailbox.agent_") && !event.startsWith("mailbox.client_")) {
       return;
     }
     const mailboxId = `${path5.basename(this.projectDir)}:mailbox`;
     const record = typeof payload === "object" && payload !== null ? payload : {};
     const agentId = typeof record["agentId"] === "string" ? record["agentId"] : void 0;
     const action = event === "mailbox.agent_registered" ? "agent.registered" : event === "mailbox.agent_heartbeat" ? "agent.heartbeat" : event === "mailbox.agent_deregistered" ? "agent.deregistered" : void 0;
-    void this.getAgentStatuses().then((statuses) => {
-      const agent = agentId ? statuses.find((candidate) => candidate.agentId === agentId) : void 0;
+    if (action !== "agent.registered") {
       if (action) {
         publisher.publishMailboxEvent({
           mailboxId,
           action,
-          ...agent ? { agent } : {},
           ...agentId ? { summary: agentId } : {}
         });
       }
       if (action !== "agent.heartbeat") this.scheduleHqSnapshot(mailboxId);
+      return;
+    }
+    void this.getAgentStatuses().then((statuses) => {
+      if (this.closed) return;
+      const agent = agentId ? statuses.find((candidate) => candidate.agentId === agentId) : void 0;
+      publisher.publishMailboxEvent({
+        mailboxId,
+        action,
+        ...agent ? { agent } : {},
+        ...agentId ? { summary: agentId } : {}
+      });
+      this.scheduleHqSnapshot(mailboxId);
     }).catch(() => {
     });
   }
@@ -1654,7 +1664,12 @@ import * as syncFs from "node:fs";
 import * as path7 from "node:path";
 
 // src/security/file-permissions.ts
-var SECRET_FILE_MODE = 384;
+import {
+  restrictDirPermissions,
+  restrictFilePermissions,
+  SECRET_DIR_MODE,
+  SECRET_FILE_MODE
+} from "@wrongstack/persistence";
 
 // src/utils/pid.ts
 function isPidAlive(pid) {
@@ -7389,6 +7404,24 @@ function deriveCachePrefixKey(systemPrompt) {
   return key;
 }
 
+// src/utils/memory-evidence-fence.ts
+var MEMORY_EVIDENCE_TAG = "memory_evidence";
+var FENCE_DELIMITER = /\[[ \t]*\/?[ \t]*memory_evidence\b[^\]\n]*\]/gi;
+function sanitizeMemoryEvidenceBody(text) {
+  return text.replace(FENCE_DELIMITER, (match) => `(${match.slice(1, -1)})`);
+}
+function sanitizeMemoryEvidenceSource(source) {
+  const collapsed = source.replace(/[^a-z0-9_.-]+/gi, "-").replace(/^-+|-+$/g, "").slice(0, 80).replace(/-+$/, "");
+  return collapsed || "memory";
+}
+function formatMemoryEvidenceBlock(source, body) {
+  const label = sanitizeMemoryEvidenceSource(source);
+  const safe = sanitizeMemoryEvidenceBody(body);
+  return `[${MEMORY_EVIDENCE_TAG} source="${label}"]
+${safe}
+[/${MEMORY_EVIDENCE_TAG}]`;
+}
+
 // src/utils/message-invariants.ts
 function repairToolUseAdjacency(messages) {
   const removedToolUses = [];
@@ -8014,15 +8047,9 @@ function buildMemoryEvidenceBlocks(ctx) {
     if (remaining <= 0) break;
     const text = entry.text.trim();
     if (!text) continue;
-    const source = entry.source.replace(/[^a-z0-9_.-]+/gi, "-").slice(0, 80) || "memory";
     const bounded = text.slice(0, remaining);
     remaining -= bounded.length;
-    blocks.push({
-      type: "text",
-      text: `[memory_evidence source="${source}"]
-${bounded}
-[/memory_evidence]`
-    });
+    blocks.push({ type: "text", text: formatMemoryEvidenceBlock(entry.source, bounded) });
   }
   return blocks;
 }

package/dist/defaults/index.js

@@ -9820,45 +9820,12 @@ import * as fsp17 from "node:fs/promises";
 import * as path23 from "node:path";
 
 // src/security/file-permissions.ts
-import { chmod } from "node:fs/promises";
-var SECRET_FILE_MODE = 384;
-async function restrictFilePermissions(filePath, opts) {
-  const label = opts?.label ?? "file-permissions";
-  const warn = opts?.warn ?? ((msg) => console.warn(msg));
-  if (process.platform === "win32") {
-    try {
-      const { execFile: execFile2 } = await import("node:child_process");
-      const { promisify: promisify2 } = await import("node:util");
-      const execFileAsync = promisify2(execFile2);
-      const user = windowsAccountName();
-      if (!user) {
-        warn(
-          `[${label}] Could not determine the current Windows user for ${filePath}; skipping icacls hardening.`
-        );
-        return;
-      }
-      await execFileAsync("icacls", [filePath, "/inheritance:r", "/grant:r", `${user}:(F)`], {
-        windowsHide: true
-      });
-    } catch {
-      warn(
-        `[${label}] Could not restrict permissions on ${filePath} \u2014 it may be readable by other users on this system.`
-      );
-    }
-  } else {
-    try {
-      await chmod(filePath, SECRET_FILE_MODE);
-    } catch {
-    }
-  }
-}
-function windowsAccountName() {
-  const username = process.env.USERNAME || process.env.USER;
-  if (!username || username.includes("\0")) return void 0;
-  const domain = process.env.USERDOMAIN;
-  if (domain && !domain.includes("\0")) return `${domain}\\${username}`;
-  return username;
-}
+import {
+  restrictDirPermissions,
+  restrictFilePermissions,
+  SECRET_DIR_MODE,
+  SECRET_FILE_MODE
+} from "@wrongstack/persistence";
 
 // src/security/secret-scrubber.ts
 var PATTERNS = [

package/dist/execution/index.js

@@ -7270,7 +7270,12 @@ import { dirname as dirname3 } from "node:path";
 import { createInterface } from "node:readline";
 
 // src/security/file-permissions.ts
-var SECRET_FILE_MODE = 384;
+import {
+  restrictDirPermissions,
+  restrictFilePermissions,
+  SECRET_DIR_MODE,
+  SECRET_FILE_MODE
+} from "@wrongstack/persistence";
 
 // src/coordination/brain-ledger.ts
 var QUESTION_MAX = 200;

package/dist/hq/index.js

@@ -2050,45 +2050,12 @@ import * as fs3 from "node:fs/promises";
 import * as path4 from "node:path";
 
 // src/security/file-permissions.ts
-import { chmod } from "node:fs/promises";
-var SECRET_FILE_MODE = 384;
-async function restrictFilePermissions(filePath, opts) {
-  const label = opts?.label ?? "file-permissions";
-  const warn = opts?.warn ?? ((msg) => console.warn(msg));
-  if (process.platform === "win32") {
-    try {
-      const { execFile } = await import("node:child_process");
-      const { promisify } = await import("node:util");
-      const execFileAsync = promisify(execFile);
-      const user = windowsAccountName();
-      if (!user) {
-        warn(
-          `[${label}] Could not determine the current Windows user for ${filePath}; skipping icacls hardening.`
-        );
-        return;
-      }
-      await execFileAsync("icacls", [filePath, "/inheritance:r", "/grant:r", `${user}:(F)`], {
-        windowsHide: true
-      });
-    } catch {
-      warn(
-        `[${label}] Could not restrict permissions on ${filePath} \u2014 it may be readable by other users on this system.`
-      );
-    }
-  } else {
-    try {
-      await chmod(filePath, SECRET_FILE_MODE);
-    } catch {
-    }
-  }
-}
-function windowsAccountName() {
-  const username = process.env.USERNAME || process.env.USER;
-  if (!username || username.includes("\0")) return void 0;
-  const domain = process.env.USERDOMAIN;
-  if (domain && !domain.includes("\0")) return `${domain}\\${username}`;
-  return username;
-}
+import {
+  restrictDirPermissions,
+  restrictFilePermissions,
+  SECRET_DIR_MODE,
+  SECRET_FILE_MODE
+} from "@wrongstack/persistence";
 
 // src/utils/pid.ts
 function isPidAlive(pid) {