ai-push-hooks 0.1.19 → 0.2.0

package/src/ai_push_hooks/modules/docs.py

@@ -1,24 +1,50 @@
 from __future__ import annotations
 
+import json
+import os
 import pathlib
 import re
 import shutil
+import stat
 from pathlib import PurePosixPath
 from typing import Any
 
 from ..types import CollectorResult, RuntimeContext
-from ..executors.exec import collect_commit_messages_for_ranges, git, run_command
+from ..executors.exec import collect_commit_messages_for_ranges, git, path_matches, run_command
 
 DOC_INCLUDE_PATTERNS = ("README.md", "docs/**/*.md")
 DOC_IGNORE_PATTERNS = ("docs/archive/**",)
+DOC_CONTEXT_LINES = 2
+DOC_MAX_BYTES = 64 * 1024
+DOC_CONTEXT_BUDGET = 32000
+DOC_FALLBACK_FILE_LIMIT = 8
 
 
 def _path_matches(path: str, patterns: tuple[str, ...]) -> bool:
-    pure = PurePosixPath(path)
-    return any(pure.match(pattern) for pattern in patterns)
+    return any(path_matches(path, pattern) for pattern in patterns)
+
+
+def _is_safe_doc_file(repo_root: pathlib.Path, candidate: pathlib.Path) -> bool:
+    """Return whether candidate is a contained, non-link regular file."""
+    try:
+        relative = candidate.relative_to(repo_root)
+        current = repo_root
+        for part in relative.parts:
+            current /= part
+            if stat.S_ISLNK(current.lstat().st_mode):
+                return False
+        candidate_stat = candidate.lstat()
+        if not stat.S_ISREG(candidate_stat.st_mode):
+            return False
+        resolved = candidate.resolve(strict=True)
+        resolved.relative_to(repo_root)
+    except (OSError, RuntimeError, ValueError):
+        return False
+    return True
 
 
 def _expand_doc_files(repo_root: pathlib.Path) -> list[pathlib.Path]:
+    repo_root = repo_root.resolve(strict=True)
     files: list[pathlib.Path] = []
     for candidate in repo_root.rglob("*.md"):
         relative = candidate.relative_to(repo_root).as_posix()
@@ -26,6 +52,8 @@ def _expand_doc_files(repo_root: pathlib.Path) -> list[pathlib.Path]:
             continue
         if _path_matches(relative, DOC_IGNORE_PATTERNS):
             continue
+        if not _is_safe_doc_file(repo_root, candidate):
+            continue
         files.append(candidate)
     return sorted(files)
 
@@ -74,50 +102,142 @@ def _deterministic_seed_queries(diff_text: str, changed_files: list[str]) -> lis
     return deduped[:20]
 
 
-def _parse_rg_line(line: str) -> tuple[str, int, str] | None:
-    match = re.match(r"^(.*?):(\d+):(.*)$", line)
-    if not match:
-        return None
-    return match.group(1), int(match.group(2)), match.group(3)
+def _read_bounded_text(path: pathlib.Path, max_bytes: int | None = None) -> str:
+    if max_bytes is None:
+        max_bytes = DOC_MAX_BYTES
+    flags = os.O_RDONLY | getattr(os, "O_NONBLOCK", 0)
+    if hasattr(os, "O_NOFOLLOW"):
+        flags |= os.O_NOFOLLOW
+    try:
+        descriptor = os.open(path, flags)
+    except OSError:
+        return ""
+    try:
+        file_stat = os.fstat(descriptor)
+        if not stat.S_ISREG(file_stat.st_mode):
+            return ""
+        with os.fdopen(descriptor, "rb") as handle:
+            descriptor = -1
+            return handle.read(max_bytes).decode("utf-8", errors="replace")
+    except (OSError, UnicodeError):
+        return ""
+    finally:
+        if descriptor != -1:
+            os.close(descriptor)
+
+
+def _append_context_chunk(chunks: list[str], chunk: str, budget: int) -> bool:
+    current_size = sum(len(item) for item in chunks) + max(0, len(chunks) - 1)
+    remaining = budget - current_size
+    if remaining <= 0:
+        return False
+    truncated = len(chunk) > remaining
+    if truncated:
+        if chunks:
+            return False
+        chunk = chunk[:remaining]
+    chunks.append(chunk)
+    return not truncated
+
+
+def _fallback_docs_context(repo_root: pathlib.Path, doc_files: list[pathlib.Path]) -> str:
+    snippets: list[str] = []
+    for path in doc_files[:DOC_FALLBACK_FILE_LIMIT]:
+        relative = path.relative_to(repo_root).as_posix()
+        content = _read_bounded_text(path)
+        block = f"--- {relative} ---\n{content}"
+        current_size = len("\n\n".join(snippets))
+        remaining = DOC_CONTEXT_BUDGET - current_size
+        if len(block) > remaining:
+            if not snippets and remaining > 0:
+                snippets.append(block[:remaining])
+            break
+        snippets.append(block)
+    return "\n\n".join(snippets)
 
 
 def _search_docs_context(repo_root: pathlib.Path, doc_files: list[pathlib.Path], queries: list[str]) -> str:
+    repo_root = repo_root.resolve(strict=True)
     if not doc_files:
         return ""
-    if shutil.which("rg") is None or not queries:
-        snippets: list[str] = []
-        budget = 32000
-        for path in doc_files[:8]:
-            relative = path.relative_to(repo_root).as_posix()
-            content = path.read_text(encoding="utf-8")[:4000]
-            block = f"--- {relative} ---\n{content}"
-            if len("\n\n".join(snippets)) + len(block) > budget:
-                break
-            snippets.append(block)
-        return "\n\n".join(snippets)
-
-    files = [str(path) for path in doc_files]
+    if not queries:
+        return _fallback_docs_context(repo_root, doc_files)
+
+    if shutil.which("rg") is None:
+        chunks: list[str] = []
+        seen: set[tuple[str, int]] = set()
+        for query in queries:
+            for path in doc_files:
+                relative = path.relative_to(repo_root).as_posix()
+                lines = _read_bounded_text(path).splitlines()
+                matching_lines = [index for index, line in enumerate(lines) if query in line]
+                for matching_index in matching_lines:
+                    first = max(0, matching_index - DOC_CONTEXT_LINES)
+                    last = min(len(lines), matching_index + DOC_CONTEXT_LINES + 1)
+                    for index in range(first, last):
+                        key = (relative, index + 1)
+                        if key in seen:
+                            continue
+                        seen.add(key)
+                        chunk = f"{relative}:{index + 1}: {lines[index]}"
+                        if not _append_context_chunk(chunks, chunk, DOC_CONTEXT_BUDGET):
+                            return "\n".join(chunks)
+        return "\n".join(chunks) if chunks else _fallback_docs_context(repo_root, doc_files)
+
+    files = [path.relative_to(repo_root).as_posix() for path in doc_files]
+    allowed_files = set(files)
     chunks: list[str] = []
     seen: set[tuple[str, int]] = set()
     for query in queries:
         completed = run_command(
-            ["rg", "--line-number", "--no-heading", "--color=never", "-C", "2", "--", query, *files],
+            [
+                "rg",
+                "--json",
+                "--fixed-strings",
+                "--with-filename",
+                "--color=never",
+                "--context",
+                str(DOC_CONTEXT_LINES),
+                "--max-filesize",
+                str(DOC_MAX_BYTES),
+                "--",
+                query,
+                *files,
+            ],
             cwd=repo_root,
             check=False,
         )
         if completed.returncode not in {0, 1}:
             continue
         for line in completed.stdout.splitlines():
-            parsed = _parse_rg_line(line)
-            if not parsed:
+            try:
+                message = json.loads(line)
+            except json.JSONDecodeError:
+                continue
+            if message.get("type") not in {"match", "context"}:
+                continue
+            data = message.get("data")
+            if not isinstance(data, dict):
+                continue
+            path_data = data.get("path")
+            lines_data = data.get("lines")
+            file_name = path_data.get("text") if isinstance(path_data, dict) else None
+            line_number = data.get("line_number")
+            content = lines_data.get("text") if isinstance(lines_data, dict) else None
+            if (
+                not isinstance(file_name, str)
+                or file_name not in allowed_files
+                or not isinstance(line_number, int)
+                or not isinstance(content, str)
+            ):
                 continue
-            file_name, line_number, content = parsed
             key = (file_name, line_number)
             if key in seen:
                 continue
             seen.add(key)
-            chunks.append(f"{file_name}:{line_number}: {content}")
-            if sum(len(chunk) for chunk in chunks) > 32000:
+            clean_content = content.rstrip("\r\n")
+            chunk = f"{file_name}:{line_number}: {clean_content}"
+            if not _append_context_chunk(chunks, chunk, DOC_CONTEXT_BUDGET):
                 return "\n".join(chunks)
     return "\n".join(chunks)
 

package/src/ai_push_hooks/modules/pr.py

@@ -4,17 +4,32 @@ from typing import Any
 
 from ..executors.exec import (
     collect_commit_messages_for_ranges,
-    current_branch,
     env_bool,
+    initial_pr_defer_reason,
     is_feature_branch,
     lookup_open_pr_url,
+    resolve_github_repository,
 )
 from ..types import CollectorResult, RuntimeContext
 
 
 def collect_pr_context(context: RuntimeContext, state: Any) -> CollectorResult:
-    branch_name = current_branch(context.repo_root)
+    branch_name = str(context.cache.get("branch_name", ""))
+    branch_selection_reason = str(
+        context.cache.get("branch_selection_reason", "no pushed branch updates")
+    )
     base_branch = context.config.general.base_branch.strip() or "main"
+    if not branch_name:
+        return CollectorResult(
+            artifacts={
+                "pr-context.txt": (
+                    f"branch=\nbase_branch={base_branch}\n"
+                    f"branch_selection_reason={branch_selection_reason}\n"
+                )
+            },
+            skip_module=True,
+            skip_reason=branch_selection_reason,
+        )
     flag_env = ""
     for step in state.module.steps:
         if step.when_env:
@@ -26,15 +41,42 @@ def collect_pr_context(context: RuntimeContext, state: Any) -> CollectorResult:
             skip_module=True,
             skip_reason="PR create env flag is not enabled",
         )
-    if not branch_name or branch_name in {"HEAD", base_branch} or not is_feature_branch(branch_name):
+    if branch_name in {"HEAD", base_branch} or not is_feature_branch(branch_name):
         return CollectorResult(
             artifacts={"pr-context.txt": f"branch={branch_name}\n"},
             skip_module=True,
             skip_reason="branch does not require PR creation",
         )
+    initial_push = bool(context.cache.get("branch_is_new", False))
+    if initial_push:
+        reason = initial_pr_defer_reason(branch_name, base_branch)
+        context.logger.warn("pr.create_deferred", reason, branch=branch_name)
+        return CollectorResult(
+            artifacts={
+                "pr-context.txt": (
+                    f"branch={branch_name}\nbase_branch={base_branch}\n"
+                    "initial_push=true\n"
+                    f"defer_reason={reason}\n"
+                ),
+                "deferred-result.json": {
+                    "skipped": True,
+                    "pr_url": "",
+                    "deferred_until_remote": True,
+                    "reason": reason,
+                },
+            },
+            skip_module=True,
+            skip_reason=reason,
+            metadata={"deferred_until_remote": True, "reason": reason},
+        )
+    repository = resolve_github_repository(
+        context.repo_root, context.remote_name, context.remote_url
+    )
     existing_pr_url = ""
     try:
-        existing_pr_url = lookup_open_pr_url(context.repo_root, branch_name)
+        existing_pr_url = lookup_open_pr_url(
+            context.repo_root, branch_name, base_branch, repository
+        )
     except Exception:  # noqa: BLE001
         existing_pr_url = ""
     if existing_pr_url:
@@ -45,9 +87,11 @@ def collect_pr_context(context: RuntimeContext, state: Any) -> CollectorResult:
             metadata={"existing_pr_url": existing_pr_url},
         )
 
-    ranges = context.cache.get("ranges", [])
-    changed_files = context.cache.get("changed_files", [])
-    diff_text = context.cache.get("diff_text", "")
+    ranges = context.cache.get("branch_ranges", context.cache.get("ranges", []))
+    changed_files = context.cache.get(
+        "branch_changed_files", context.cache.get("changed_files", [])
+    )
+    diff_text = context.cache.get("branch_diff_text", context.cache.get("diff_text", ""))
     commits = collect_commit_messages_for_ranges(context.repo_root, ranges) if ranges else []
     commit_lines = []
     for commit in commits:
@@ -64,6 +108,8 @@ def collect_pr_context(context: RuntimeContext, state: Any) -> CollectorResult:
                     f"branch={branch_name}",
                     f"base_branch={base_branch}",
                     f"remote_name={context.remote_name or 'origin'}",
+                    f"repository={repository}",
+                    f"initial_push={'true' if initial_push else 'false'}",
                 ]
             )
             + "\n",

package/src/ai_push_hooks/paths.py

@@ -0,0 +1,182 @@
+from __future__ import annotations
+
+import os
+import pathlib
+import stat
+import tempfile
+import unicodedata
+
+from .types import HookError
+
+PRIVATE_FILE_MODE = 0o600
+PRIVATE_DIRECTORY_MODE = 0o700
+ORDINARY_FILE_MODE_MASK = 0o777
+
+
+def relative_path_parts(raw: str, label: str) -> tuple[str, ...]:
+    if not isinstance(raw, str) or not raw.strip():
+        raise HookError(f"{label} must be a non-empty relative path")
+    if "\x00" in raw or any(ord(character) < 32 for character in raw):
+        raise HookError(f"{label} contains invalid control characters")
+
+    normalized = raw.replace("\\", "/")
+    windows_path = pathlib.PureWindowsPath(raw)
+    if normalized.startswith("/") or windows_path.is_absolute() or windows_path.drive:
+        raise HookError(f"{label} must be relative: {raw}")
+
+    raw_parts = normalized.split("/")
+    if any(part == ".." for part in raw_parts):
+        raise HookError(f"{label} must not contain '..': {raw}")
+    parts = tuple(part for part in raw_parts if part not in {"", "."})
+    if not parts:
+        raise HookError(f"{label} must be a non-empty relative path")
+    return parts
+
+
+def validate_path_component(raw: str, label: str) -> str:
+    parts = relative_path_parts(raw, label)
+    if len(parts) != 1 or "/" in raw or "\\" in raw or parts[0] in {".", ".."}:
+        raise HookError(f"{label} must be a single path component: {raw}")
+    return parts[0]
+
+
+def is_path_within(path: pathlib.Path, root: pathlib.Path) -> bool:
+    try:
+        path.relative_to(root)
+        return True
+    except ValueError:
+        return False
+
+
+def normalized_component(value: str) -> str:
+    return unicodedata.normalize("NFKC", value).casefold()
+
+
+def sanitize_file_mode(mode: int) -> int:
+    return mode & ORDINARY_FILE_MODE_MASK
+
+
+def path_is_link_or_reparse(path: pathlib.Path) -> bool:
+    try:
+        metadata = path.lstat()
+    except FileNotFoundError:
+        return False
+    reparse_flag = getattr(stat, "FILE_ATTRIBUTE_REPARSE_POINT", 0x400)
+    return stat.S_ISLNK(metadata.st_mode) or bool(
+        getattr(metadata, "st_file_attributes", 0) & reparse_flag
+    )
+
+
+def path_has_symlink(root: pathlib.Path, path: pathlib.Path) -> bool:
+    lexical_root = pathlib.Path(os.path.abspath(root))
+    lexical_path = pathlib.Path(os.path.abspath(path))
+    try:
+        relative = lexical_path.relative_to(lexical_root)
+    except ValueError:
+        return True
+    current = lexical_root
+    if path_is_link_or_reparse(current):
+        return True
+    for part in relative.parts:
+        current = current / part
+        if path_is_link_or_reparse(current):
+            return True
+        if not current.exists():
+            break
+    return False
+
+
+def resolve_contained_path(base: pathlib.Path, raw: str, label: str) -> pathlib.Path:
+    parts = relative_path_parts(raw, label)
+    lexical_base = pathlib.Path(os.path.abspath(base))
+    lexical_candidate = lexical_base.joinpath(*parts)
+    if not is_path_within(lexical_candidate, lexical_base):
+        raise HookError(f"{label} escapes its intended directory: {raw}")
+    if path_has_symlink(lexical_base, lexical_candidate):
+        raise HookError(f"{label} traverses a symlink or reparse point: {raw}")
+
+    resolved_base = lexical_base.resolve(strict=False)
+    resolved_candidate = lexical_candidate.resolve(strict=False)
+    if not is_path_within(resolved_candidate, resolved_base):
+        raise HookError(f"{label} escapes its intended directory through a symlink: {raw}")
+    return resolved_candidate
+
+
+def ensure_private_directory(
+    path: pathlib.Path,
+    *,
+    private_root: pathlib.Path | None = None,
+) -> pathlib.Path:
+    target = pathlib.Path(os.path.abspath(path))
+    if private_root is None:
+        missing: list[pathlib.Path] = []
+        current = target
+        while not current.exists() and not path_is_link_or_reparse(current):
+            missing.append(current)
+            current = current.parent
+        if path_is_link_or_reparse(current) or not current.is_dir():
+            raise HookError(f"Private runtime directory has an unsafe parent: {path}")
+        for directory in reversed(missing):
+            directory.mkdir(mode=PRIVATE_DIRECTORY_MODE)
+            os.chmod(directory, PRIVATE_DIRECTORY_MODE)
+        if path_is_link_or_reparse(target) or not target.is_dir():
+            raise HookError(f"Private runtime directory is unsafe: {path}")
+        os.chmod(target, PRIVATE_DIRECTORY_MODE)
+        return target
+
+    root = pathlib.Path(os.path.abspath(private_root))
+    if not is_path_within(target, root):
+        raise HookError(f"Private runtime directory escapes its namespace: {path}")
+    if path_is_link_or_reparse(root.parent) or not root.parent.is_dir():
+        raise HookError(f"Private runtime namespace has an unsafe parent: {root}")
+    directories = [root]
+    current = root
+    for part in target.relative_to(root).parts:
+        current = current / part
+        directories.append(current)
+    for directory in directories:
+        if path_is_link_or_reparse(directory):
+            raise HookError(
+                f"Private runtime directory traverses a symlink or reparse point: {directory}"
+            )
+        if not directory.exists():
+            directory.mkdir(mode=PRIVATE_DIRECTORY_MODE)
+        if not directory.is_dir():
+            raise HookError(f"Private runtime path is not a directory: {directory}")
+        os.chmod(directory, PRIVATE_DIRECTORY_MODE)
+    return target
+
+
+def atomic_write_bytes(
+    path: pathlib.Path,
+    content: bytes,
+    *,
+    mode: int = PRIVATE_FILE_MODE,
+) -> None:
+    parent = path.parent.resolve(strict=True)
+    target = parent / path.name
+    if path_is_link_or_reparse(target):
+        raise HookError(f"Refusing to replace symlink or reparse point: {target}")
+    descriptor, temporary_name = tempfile.mkstemp(prefix=".ai-push-hooks-", dir=parent)
+    temporary_path = pathlib.Path(temporary_name)
+    try:
+        with os.fdopen(descriptor, "wb") as handle:
+            descriptor = -1
+            handle.write(content)
+            handle.flush()
+            os.fsync(handle.fileno())
+        os.chmod(temporary_path, sanitize_file_mode(mode))
+        if path_is_link_or_reparse(target):
+            raise HookError(f"Refusing to replace symlink or reparse point: {target}")
+        os.replace(temporary_path, target)
+    finally:
+        if descriptor >= 0:
+            os.close(descriptor)
+        try:
+            temporary_path.unlink()
+        except FileNotFoundError:
+            pass
+
+
+def write_text_no_follow(path: pathlib.Path, content: str, *, encoding: str = "utf-8") -> None:
+    atomic_write_bytes(path, content.encode(encoding))

package/src/ai_push_hooks/prompts_builtin.py

@@ -32,10 +32,14 @@ Rules:
 BEADS_PLAN_PROMPT = """Check the attached branch context and output a JSON object describing Beads alignment work.
 
 Return keys:
-- commands: array of non-interactive bd command strings to run
+- commands: array containing only these exact non-interactive command forms:
+  - bd update <issue-id> [<issue-id> ...] --status <open|in_progress|blocked>
+  - bd close <issue-id> [<issue-id> ...] [--reason <text>]
 - unresolved: boolean
 - report_markdown: markdown string or empty
 
+Do not return global flags or any other bd subcommands.
+
 Return JSON only.
 """
 
@@ -68,7 +72,7 @@ base_branch = "main"
 
 [llm]
 runner = "opencode"
-model = "openai/gpt-5.5"
+model = "openai/gpt-5.6-terra"
 variant = ""
 timeout_seconds = 800
 max_parallel = 2

package/src/ai_push_hooks/types.py

@@ -1,7 +1,9 @@
 from __future__ import annotations
 
 import json
+import os
 import pathlib
+import stat
 import sys
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
@@ -11,12 +13,54 @@ READ_ONLY_STEP_TYPES = frozenset({"collect", "llm"})
 PROMPTABLE_STEP_TYPES = frozenset({"llm", "apply"})
 SUPPORTED_STEP_TYPES = frozenset({"collect", "llm", "apply", "exec", "assert"})
 FEATURE_BRANCH_PREFIXES = ("feat/", "feature/")
+ZERO_OID_LENGTHS = frozenset({40, 64})
 
 
 class HookError(RuntimeError):
     pass
 
 
+def is_zero_oid(value: str) -> bool:
+    return len(value) in ZERO_OID_LENGTHS and not value.strip("0")
+
+
+@dataclass(frozen=True)
+class PushRefUpdate:
+    local_ref: str
+    local_sha: str
+    remote_ref: str
+    remote_sha: str
+
+    @property
+    def ref_kind(self) -> str:
+        if self.remote_ref.startswith("refs/heads/"):
+            return "branch"
+        if self.remote_ref.startswith("refs/tags/"):
+            return "tag"
+        return "other"
+
+    @property
+    def operation(self) -> str:
+        if is_zero_oid(self.local_sha):
+            return "delete"
+        if is_zero_oid(self.remote_sha):
+            return "create"
+        return "update"
+
+    @property
+    def branch_name(self) -> str | None:
+        if self.ref_kind != "branch" or self.operation == "delete":
+            return None
+        return self.remote_ref.removeprefix("refs/heads/")
+
+
+@dataclass(frozen=True)
+class PushRevisionRange:
+    update: PushRefUpdate
+    expression: str
+    strategy: str
+
+
 @dataclass(frozen=True)
 class GeneralConfig:
     enabled: bool = True
@@ -29,7 +73,7 @@ class GeneralConfig:
 @dataclass(frozen=True)
 class LlmConfig:
     runner: str = "opencode"
-    model: str = "openai/gpt-5.5"
+    model: str = "openai/gpt-5.6-terra"
     variant: str = ""
     timeout_seconds: int = 800
     max_parallel: int = 2
@@ -177,8 +221,43 @@ class HookLogger:
             return
         record = {"ts": stamp, "level": level, "event": event, "message": message, **fields}
         try:
-            with self.jsonl_path.open("a", encoding="utf-8") as handle:
-                handle.write(json.dumps(record, ensure_ascii=True) + "\n")
+            try:
+                initial_metadata = self.jsonl_path.lstat()
+            except FileNotFoundError:
+                initial_metadata = None
+            if initial_metadata is not None:
+                reparse_flag = getattr(stat, "FILE_ATTRIBUTE_REPARSE_POINT", 0x400)
+                if stat.S_ISLNK(initial_metadata.st_mode) or bool(
+                    getattr(initial_metadata, "st_file_attributes", 0) & reparse_flag
+                ):
+                    raise HookError(
+                        "JSONL log target must not be a symlink or reparse point: "
+                        f"{self.jsonl_path}"
+                    )
+            flags = os.O_WRONLY | os.O_APPEND | os.O_CREAT | getattr(os, "O_CLOEXEC", 0)
+            flags |= getattr(os, "O_NOFOLLOW", 0)
+            descriptor = os.open(self.jsonl_path, flags, 0o600)
+            try:
+                descriptor_metadata = os.fstat(descriptor)
+                path_metadata = self.jsonl_path.lstat()
+                reparse_flag = getattr(stat, "FILE_ATTRIBUTE_REPARSE_POINT", 0x400)
+                if (
+                    not stat.S_ISREG(descriptor_metadata.st_mode)
+                    or stat.S_ISLNK(path_metadata.st_mode)
+                    or bool(
+                        getattr(path_metadata, "st_file_attributes", 0) & reparse_flag
+                    )
+                    or (descriptor_metadata.st_dev, descriptor_metadata.st_ino)
+                    != (path_metadata.st_dev, path_metadata.st_ino)
+                ):
+                    raise HookError(f"JSONL log target is not a regular file: {self.jsonl_path}")
+                os.fchmod(descriptor, 0o600)
+                os.write(
+                    descriptor,
+                    (json.dumps(record, ensure_ascii=True) + "\n").encode("utf-8"),
+                )
+            finally:
+                os.close(descriptor)
         except Exception as exc:  # noqa: BLE001
             self.jsonl_write_failed = True
             sys.stderr.write(f"[ai-push-hooks] JSONL logging disabled after write failure: {exc}\n")