blun-king-cli 9.1.479 → 9.1.481

package/bin/glob-pattern-policy.cjs

@@ -0,0 +1,13 @@
+"use strict";
+
+function quotedPattern(pattern) {
+  return `'${pattern.replaceAll("\\", "\\\\").replaceAll("'", "\\'")}'`;
+}
+
+function globPatternError(pattern) {
+  if (typeof pattern !== "string") return "Invalid glob pattern";
+  if (!pattern.replaceAll("\\", "/").split("/").includes("..")) return undefined;
+  return `Path traversal not allowed in glob pattern ${quotedPattern(pattern)}`;
+}
+
+module.exports = { globPatternError };

package/bin/subagent-max-tokens-handoff-policy.cjs

@@ -23,6 +23,19 @@ function shouldRequestSubagentHandoff(stopReason, attempts) {
     && attempts < MAX_SUBAGENT_HANDOFF_ATTEMPTS;
 }
 
+function isSubagentMaxTokensTurnError(error) {
+  if (typeof error !== "object" || error === null) return false;
+  const details = typeof error.details === "object" && error.details !== null
+    ? error.details
+    : {};
+  if (details.emptyResponseKind === "length") return true;
+  if (details.finishReason === "truncated" || details.rawFinishReason === "length") return true;
+
+  const message = typeof error.message === "string" ? error.message : "";
+  return /\bmax[_ -]?tokens?\b/iu.test(message)
+    && /(?:\bno\b|\bwithout\b|did not produce)[^\n.]*\btool(?: call)?\b/iu.test(message);
+}
+
 function boundedPartialHandoff(partialSummary) {
   const normalized = typeof partialSummary === "string" ? partialSummary.trim() : "";
   if (normalized.length <= MAX_PARTIAL_HANDOFF_CHARS) return normalized;
@@ -51,5 +64,6 @@ module.exports = {
   SUBAGENT_MAX_TOKENS_ERROR,
   SUBAGENT_MAX_TOKENS_HANDOFF_PROMPT,
   buildSubagentMaxTokensFailure,
+  isSubagentMaxTokensTurnError,
   shouldRequestSubagentHandoff,
 };

package/bin/user-home-path-policy.cjs

@@ -0,0 +1,13 @@
+"use strict";
+
+function quotedPath(path) {
+  return `'${path.replaceAll("\\", "\\\\").replaceAll("'", "\\'")}'`;
+}
+
+function unsupportedUserHomePathError(path) {
+  if (typeof path !== "string" || !path.startsWith("~")) return undefined;
+  if (path === "~" || path.startsWith("~/") || path.startsWith("~\\")) return undefined;
+  return `Named home-directory paths are not supported: ${quotedPath(path)}. Use '~/' for the current user or './' for a literal path.`;
+}
+
+module.exports = { unsupportedUserHomePathError };

package/blun.mjs

@@ -14,6 +14,8 @@ import agentResumeSnapshot from "./bin/agent-resume-snapshot.cjs";
 import sessionResumeCheckpoint from "./bin/session-resume-checkpoint.cjs";
 import sessionScrollbackArchive from "./bin/session-scrollback-archive.cjs";
 import sessionReplayWindowPolicy from "./bin/session-replay-window-policy.cjs";
+import globPatternPolicy from "./bin/glob-pattern-policy.cjs";
+import userHomePathPolicy from "./bin/user-home-path-policy.cjs";
 import crypto$1, { createHash, randomBytes, randomInt, randomUUID, timingSafeEqual } from "node:crypto";
 import * as fs$16 from "node:fs";
 import Kt, { accessSync, appendFileSync, chmodSync, closeSync, constants, copyFileSync, createReadStream, createWriteStream, existsSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, promises, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
@@ -52,6 +54,8 @@ const { createAgentResumeSnapshot, restoreAgentResumeSnapshot } = agentResumeSna
 const { loadResumeCheckpoint, writeResumeCheckpoint } = sessionResumeCheckpoint;
 const { SessionScrollbackArchive, sessionScrollbackArchiveDirectory } = sessionScrollbackArchive;
 const { replayWindowStartIndex } = sessionReplayWindowPolicy;
+const { globPatternError } = globPatternPolicy;
+const { unsupportedUserHomePathError } = userHomePathPolicy;
 import { EventEmitter as EventEmitter$1 } from "node:events";
 import { StringDecoder } from "node:string_decoder";
 import co from "node:assert";
@@ -77727,6 +77731,8 @@ function relativeOutsideMessage(path, operation) {
 	return `"${path}" is not an absolute path. You must provide an absolute path to ${operation === "write" ? "write or edit a file" : operation === "search" ? "search" : "read a file"} outside the working directory.`;
 }
 function resolvePathAccess(path, cwd, config, options) {
+	const homePathError = unsupportedUserHomePathError(path);
+	if (homePathError !== void 0) throw new PathSecurityError("PATH_INVALID", path, path, homePathError);
 	const pathClass = options.pathClass ?? DEFAULT_PATH_CLASS;
 	const expandedPath = expandUserPath$1(normalizeUserPath(path, pathClass), options.homeDir, pathClass);
 	const rawIsAbsolute = isAbsolute$2(expandedPath);
@@ -252363,6 +252369,7 @@ async function runChildTurnToCompletion(child, signal) {
 	const turnEnded = completion.event;
 	if (turnEnded.reason !== "completed") {
 		if (turnEnded.reason === "filtered") throw new Error("Subagent turn blocked by provider safety policy");
+		if (isSubagentMaxTokensTurnError(turnEnded.error)) return "max_tokens";
 		if (turnEnded.error?.code === ErrorCodes.PROVIDER_RATE_LIMIT) throw providerRateLimitErrorFromPayload(turnEnded.error);
 		if (turnEnded.error === void 0) throw new Error(`Subagent turn ${turnEnded.reason}`);
 		const error = new Error(`[${turnEnded.error.code}] ${turnEnded.error.message}`);
@@ -252406,7 +252413,7 @@ function shouldSuppressQueuedAttemptFailureEvent(options, error) {
 	if (isProviderRateLimitError(error)) return true;
 	return isAbortError$4(error) || options.signal.aborted;
 }
-var DEFAULT_SUBAGENT_TIMEOUT_MS, resolveSubagentTimeoutMs, runAgentWithTimeoutContinuation, buildSubagentUsageDelta, inheritSubagentAllowedTools, inheritSubagentLifecycleTools, SUBAGENT_MAX_TOKENS_ERROR, SUBAGENT_MAX_TOKENS_HANDOFF_PROMPT, buildSubagentMaxTokensFailure, shouldRequestSubagentHandoff, SUMMARY_MIN_LENGTH, SUMMARY_CONTINUATION_ATTEMPTS, HOOK_TEXT_PREVIEW_LENGTH, TOOL_CALL_DISABLED_MESSAGE, SUBAGENT_PROMPT_ORIGIN, SIDE_QUESTION_SYSTEM_REMINDER, SessionSubagentHost;
+var DEFAULT_SUBAGENT_TIMEOUT_MS, resolveSubagentTimeoutMs, runAgentWithTimeoutContinuation, buildSubagentUsageDelta, inheritSubagentAllowedTools, inheritSubagentLifecycleTools, SUBAGENT_MAX_TOKENS_ERROR, SUBAGENT_MAX_TOKENS_HANDOFF_PROMPT, buildSubagentMaxTokensFailure, isSubagentMaxTokensTurnError, shouldRequestSubagentHandoff, SUMMARY_MIN_LENGTH, SUMMARY_CONTINUATION_ATTEMPTS, HOOK_TEXT_PREVIEW_LENGTH, TOOL_CALL_DISABLED_MESSAGE, SUBAGENT_PROMPT_ORIGIN, SIDE_QUESTION_SYSTEM_REMINDER, SessionSubagentHost;
 var init_subagent_host = __esmMin((() => {
 	init_src$4();
 	init_errors$8();
@@ -252425,6 +252432,7 @@ var init_subagent_host = __esmMin((() => {
 		SUBAGENT_MAX_TOKENS_ERROR,
 		SUBAGENT_MAX_TOKENS_HANDOFF_PROMPT,
 		buildSubagentMaxTokensFailure,
+		isSubagentMaxTokensTurnError,
 		shouldRequestSubagentHandoff
 	} = createRequire(import.meta.url)("./bin/subagent-max-tokens-handoff-policy.cjs"));
 	SUMMARY_MIN_LENGTH = 200;
@@ -258611,6 +258619,11 @@ glob_default = "Find files by glob pattern, sorted by modification time with the
 		}
 		async execution(args, signal, searchRoots) {
 			const searchRoot = searchRoots[0] ?? this.workspace.workspaceDir;
+			const patternError = globPatternError(args.pattern);
+			if (patternError !== void 0) return {
+				isError: true,
+				output: patternError
+			};
 			try {
 				if (((await this.kaos.stat(searchRoot)).stMode & S_IFMT$2) !== S_IFDIR$1) return {
 					isError: true,
@@ -517648,6 +517661,7 @@ var BlunTUI = class {
 		const items = this.state.queuedMessages.slice(0, batchEnd < 0 ? this.state.queuedMessages.length : batchEnd);
 		if (items.length === 0) return false;
 		this.state.queuedMessages = this.state.queuedMessages.slice(items.length);
+		this.updateQueueDisplay();
 		const transcriptRendered = items.map((queued) => queued.channelTranscriptRendered === true);
 		const renderTranscripts = () => {
 			items.forEach((queued, index) => {
@@ -517915,6 +517929,7 @@ var BlunTUI = class {
 		}
 		const items = this.state.queuedMessages.slice(0, prefixLength);
 		this.state.queuedMessages = this.state.queuedMessages.slice(prefixLength);
+		this.updateQueueDisplay();
 		const turnId = this.streamingUI.getTurnContext().turnId;
 		const inFlight = {
 			items,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blun-king-cli",
-  "version": "9.1.479",
+  "version": "9.1.481",
   "description": "BLUN CLI - your own AI agent with a Telegram channel. Get it done. With BLUN.",
   "license": "MIT",
   "bin": {

package/standard-skills/translate-native/SKILL.md

@@ -7,7 +7,7 @@ description: Translate, localize, rewrite, and review user-visible language with
 
 Use this skill for every translation, localization, translated rewrite, translation review, or user-visible internationalization edit.
 
-This bundled adaptation is based on translate-native 6.41.1. Read [references/native-translation-standard.md](references/native-translation-standard.md) and [references/evaluation-protocol.md](references/evaluation-protocol.md) for the full quality contract. For structured data, also read [references/structured-content.md](references/structured-content.md).
+This bundled adaptation is based on translate-native 6.42.13. Read [references/native-translation-standard.md](references/native-translation-standard.md) and [references/evaluation-protocol.md](references/evaluation-protocol.md) for the full quality contract. For structured data, also read [references/structured-content.md](references/structured-content.md).
 
 ## Seven-pass review
 

package/standard-skills/translate-native/VERSION

@@ -1 +1 @@
-6.41.1
+6.42.13

package/standard-skills/translate-native/provenance.json

@@ -1,7 +1,7 @@
 {
   "name": "translate-native",
-  "version": "6.41.1",
-  "sourceCommit": "047aa2b4ba4c6a7b4797be8ed8ea6b7fd60728f0",
+  "version": "6.42.13",
+  "sourceCommit": "6430ce30e235c1a9d1ebcd1b646d62edce510605",
   "sourceRepository": "https://github.com/Maykbiletti/translate-native",
   "adaptation": "BLUN host policy replaces client-specific deployment text"
 }

package/standard-skills/translate-native/references/native-translation-standard.md

@@ -68,7 +68,7 @@ A large dataset is not automatically authoritative. It may contain machine trans
 
 Useful starting points:
 
-- FLORES+ multilingual benchmark dataset
+- FLORES+: <https://huggingface.co/datasets/openlanguagedata/flores_plus>
 - OPUS: <https://opus.nlpl.eu/>
 - Leipzig Corpora Collection: <https://cls.corpora.uni-leipzig.de/>
 - Unicode CLDR: <https://cldr.unicode.org/>

package/standard-skills/translate-native/scripts/blun_language_guard.py

@@ -95,7 +95,21 @@ LANGUAGE_CHARACTER_PROFILES = {
 ASCII_FOLDING_PROFILES = {
     # Conventional transliterations whose density is measurable without a dictionary.
     # Thresholds deliberately avoid treating one ordinary letter sequence as proof.
-    "de": {"patterns": (r"ae", r"oe", r"ue"), "native": "äöüÄÖÜ", "minimum": 3},
+    # German ``ue`` is also a native vowel sequence in words such as ``neue``
+    # and ``Abenteuer`` and in the productive loan suffix ``-uell``. Count it
+    # only where the surrounding letters still make an ASCII-folded umlaut
+    # plausible. The short-stem exception deliberately keeps ``Muell`` and
+    # similar folded forms measurable while accepting ``aktuell`` and
+    # ``individuell``.
+    "de": {
+        "patterns": (
+            r"ae",
+            r"oe",
+            r"(?<![aeiouyäöüq])(?:(?<![A-Za-zÄÖÜäöüß]{3})ue(?=ll)|ue(?!ll))",
+        ),
+        "native": "äöüÄÖÜ",
+        "minimum": 3,
+    },
     "sv": {"patterns": (r"aa", r"ae", r"oe"), "native": "åäöÅÄÖ", "minimum": 1},
     "da": {"patterns": (r"aa", r"ae", r"oe"), "native": "åæøÅÆØ", "minimum": 1},
     "no": {"patterns": (r"aa", r"ae", r"oe"), "native": "åæøÅÆØ", "minimum": 1},
@@ -117,10 +131,7 @@ def _service_token() -> str:
         return direct
     if not SERVICE_TOKEN_FILE:
         return ""
-    token = Path(SERVICE_TOKEN_FILE).read_text(encoding="utf-8-sig").strip()
-    if len(token) < 32:
-        raise SERVICE_CLIENT.GuardServiceError("guard service token is invalid")
-    return token
+    return SERVICE_CLIENT.load_service_token(Path(SERVICE_TOKEN_FILE))
 
 
 def _isolated_release(task_kind: str, arguments: dict[str, Any]) -> dict[str, Any] | None:

package/standard-skills/translate-native/scripts/guard_service_client.py

@@ -4,17 +4,199 @@
 from __future__ import annotations
 
 import json
+import os
 import socket
-from typing import Any
+import stat
+from contextlib import contextmanager
+from pathlib import Path
+from typing import Any, Iterator
 
 
 MAX_RESPONSE_BYTES = 8 * 1024 * 1024
+MAX_SERVICE_TOKEN_BYTES = 64 * 1024
 
 
 class GuardServiceError(RuntimeError):
     """Raised when the isolated guard cannot evaluate a request safely."""
 
 
+def _token_file_identity(details: os.stat_result) -> tuple[int, int, int, int, int, int]:
+    return (
+        details.st_dev,
+        details.st_ino,
+        details.st_nlink,
+        details.st_size,
+        details.st_ctime_ns,
+        details.st_mtime_ns,
+    )
+
+
+def _token_directory_identity(
+    details: os.stat_result,
+) -> tuple[int, int, int, int, int]:
+    return (
+        details.st_dev,
+        details.st_ino,
+        details.st_mode,
+        details.st_uid,
+        details.st_gid,
+    )
+
+
+def _validate_token_directory(path: Path, details: os.stat_result) -> None:
+    if not stat.S_ISDIR(details.st_mode) or stat.S_ISLNK(details.st_mode):
+        raise GuardServiceError(f"guard service token directory is invalid: {path}")
+    if os.name != "nt" and stat.S_IMODE(details.st_mode) & 0o022:
+        raise GuardServiceError(
+            f"guard service token directory is writable outside its owner: {path}"
+        )
+    if hasattr(os, "getuid") and details.st_uid != os.getuid():
+        raise GuardServiceError(f"guard service token directory has the wrong owner: {path}")
+
+
+def _existing_token_directory_anchor(path: Path) -> Path:
+    candidate = path
+    while True:
+        try:
+            candidate.lstat()
+            return candidate
+        except FileNotFoundError:
+            parent = candidate.parent
+            if parent == candidate:
+                raise GuardServiceError(
+                    f"guard service token directory has no existing anchor: {path}"
+                )
+            candidate = parent
+
+
+def _assert_token_directory_unchanged(
+    path: Path, expected: tuple[int, int, int, int, int],
+) -> None:
+    try:
+        current = path.lstat()
+    except OSError as error:
+        raise GuardServiceError(
+            f"guard service token directory cannot be rechecked: {path}"
+        ) from error
+    _validate_token_directory(path, current)
+    if _token_directory_identity(current) != expected:
+        raise GuardServiceError(
+            f"guard service token directory changed during read: {path}"
+        )
+
+
+@contextmanager
+def _open_token_directory(path: Path) -> Iterator[int | None]:
+    if os.name == "nt":
+        yield None
+        return
+    anchor = Path.home()
+    try:
+        relative = path.parent.relative_to(anchor)
+    except ValueError:
+        anchor = _existing_token_directory_anchor(path.parent)
+        relative = path.parent.relative_to(anchor)
+    flags = (
+        os.O_RDONLY
+        | getattr(os, "O_BINARY", 0)
+        | getattr(os, "O_DIRECTORY", 0)
+        | getattr(os, "O_NOFOLLOW", 0)
+    )
+    descriptor = None
+    current_path = anchor
+    try:
+        try:
+            descriptor = os.open(anchor, flags)
+            _validate_token_directory(anchor, os.fstat(descriptor))
+            for component in relative.parts:
+                current_path = current_path / component
+                child = os.open(component, flags, dir_fd=descriptor)
+                try:
+                    _validate_token_directory(current_path, os.fstat(child))
+                except Exception:
+                    os.close(child)
+                    raise
+                os.close(descriptor)
+                descriptor = child
+            expected = _token_directory_identity(os.fstat(descriptor))
+        except (FileNotFoundError, GuardServiceError):
+            raise
+        except OSError as error:
+            raise GuardServiceError(
+                f"guard service token directory cannot be opened safely: {current_path}"
+            ) from error
+        try:
+            yield descriptor
+        finally:
+            _assert_token_directory_unchanged(path.parent, expected)
+    finally:
+        if descriptor is not None:
+            os.close(descriptor)
+
+
+def _validate_token_file(details: os.stat_result) -> None:
+    if not stat.S_ISREG(details.st_mode) or stat.S_ISLNK(details.st_mode):
+        raise GuardServiceError("guard service token must be a regular file")
+    if details.st_nlink != 1:
+        raise GuardServiceError("guard service token must not have additional hard links")
+    if details.st_size < 32 or details.st_size > MAX_SERVICE_TOKEN_BYTES:
+        raise GuardServiceError("guard service token has an invalid size")
+    if os.name != "nt" and stat.S_IMODE(details.st_mode) & 0o077:
+        raise GuardServiceError("guard service token permissions must be owner-only")
+    if hasattr(os, "getuid") and details.st_uid != os.getuid():
+        raise GuardServiceError("guard service token has the wrong owner")
+
+
+def _token_lstat(path: Path, directory: int | None) -> os.stat_result:
+    if directory is None:
+        return os.lstat(path)
+    return os.stat(path.name, dir_fd=directory, follow_symlinks=False)
+
+
+def _open_token_file(path: Path, directory: int | None) -> int:
+    flags = os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0)
+    if directory is None:
+        return os.open(path, flags)
+    return os.open(path.name, flags, dir_fd=directory)
+
+
+def _token_fstat(descriptor: int) -> os.stat_result:
+    return os.fstat(descriptor)
+
+
+def load_service_token(path: Path) -> str:
+    """Read a bounded owner-only service token without following a replaced file."""
+    with _open_token_directory(path) as directory:
+        before = _token_lstat(path, directory)
+        _validate_token_file(before)
+        descriptor = _open_token_file(path, directory)
+        try:
+            opened = _token_fstat(descriptor)
+            _validate_token_file(opened)
+            if _token_file_identity(opened) != _token_file_identity(before):
+                raise GuardServiceError("guard service token changed while opening")
+            with os.fdopen(descriptor, "rb", closefd=False) as handle:
+                raw = handle.read(MAX_SERVICE_TOKEN_BYTES + 1)
+            after = _token_fstat(descriptor)
+            after_path = _token_lstat(path, directory)
+            if (
+                _token_file_identity(after) != _token_file_identity(opened)
+                or _token_file_identity(after_path) != _token_file_identity(opened)
+            ):
+                raise GuardServiceError("guard service token changed while reading")
+        finally:
+            os.close(descriptor)
+    if len(raw) > MAX_SERVICE_TOKEN_BYTES:
+        raise GuardServiceError("guard service token has an invalid size")
+    try:
+        token = raw.decode("utf-8-sig").strip()
+    except UnicodeDecodeError as error:
+        raise GuardServiceError("guard service token is not valid UTF-8") from error
+    if len(token) < 32:
+        raise GuardServiceError("guard service token is invalid")
+    return token
+
+
 def parse_endpoint(endpoint: str) -> tuple[str, str | tuple[str, int]]:
     value = str(endpoint or "").strip()
     if value.startswith("unix:") and value[5:]:

package/standard-skills/translate-native/scripts/language_quality.py

@@ -4,11 +4,13 @@
 from __future__ import annotations
 
 import base64
+import contextlib
 import hashlib
 import hmac
 import json
 import os
 import re
+import stat
 import time
 import unicodedata
 from pathlib import Path
@@ -16,6 +18,7 @@ from typing import Any
 
 
 VERSION = "6.20.0"
+MAX_SIGNING_KEY_BYTES = 64 * 1024
 DANGEROUS_BIDI = {"\u202a", "\u202b", "\u202c", "\u202d", "\u202e"}
 ISOLATE_OPENERS = {"\u2066", "\u2067", "\u2068"}
 ISOLATE_CLOSER = "\u2069"
@@ -53,19 +56,221 @@ def _b64decode(data: str) -> bytes:
     return base64.urlsafe_b64decode(data + "=" * (-len(data) % 4))
 
 
+def _validate_signing_key_stat(details: os.stat_result) -> None:
+    if not stat.S_ISREG(details.st_mode) or stat.S_ISLNK(details.st_mode):
+        raise ValueError("signing key must be a regular file")
+    if details.st_nlink != 1:
+        raise ValueError("signing key must have exactly one hard link")
+    if details.st_size < 32 or details.st_size > MAX_SIGNING_KEY_BYTES:
+        raise ValueError("signing key has an invalid size")
+    if os.name != "nt" and stat.S_IMODE(details.st_mode) & 0o077:
+        raise ValueError("signing key permissions must be owner-only")
+    if hasattr(os, "getuid") and details.st_uid != os.getuid():
+        raise ValueError("signing key has the wrong owner")
+
+
+def _signing_key_identity(details: os.stat_result) -> tuple[int, int, int, int, int, int]:
+    return (
+        details.st_dev,
+        details.st_ino,
+        details.st_nlink,
+        details.st_size,
+        details.st_ctime_ns,
+        details.st_mtime_ns,
+    )
+
+
+def _signing_key_directory_identity(
+    details: os.stat_result,
+) -> tuple[int, int, int, int, int]:
+    return (
+        details.st_dev,
+        details.st_ino,
+        details.st_mode,
+        details.st_uid,
+        details.st_gid,
+    )
+
+
+def _validate_signing_key_directory(path: Path, details: os.stat_result) -> None:
+    if not stat.S_ISDIR(details.st_mode) or stat.S_ISLNK(details.st_mode):
+        raise ValueError(f"signing-key directory is not a directory: {path}")
+    if stat.S_IMODE(details.st_mode) & 0o022:
+        raise ValueError(f"signing-key directory is writable outside its owner: {path}")
+    if hasattr(os, "getuid") and details.st_uid != os.getuid():
+        raise ValueError(f"signing-key directory has the wrong owner: {path}")
+
+
+def _assert_signing_key_directory_unchanged(
+    path: Path, expected: tuple[int, int, int, int, int],
+) -> None:
+    try:
+        current = path.lstat()
+    except OSError as error:
+        raise ValueError(f"signing-key directory cannot be rechecked: {path}") from error
+    _validate_signing_key_directory(path, current)
+    if _signing_key_directory_identity(current) != expected:
+        raise ValueError(f"signing-key directory changed during operation: {path}")
+
+
+def _existing_signing_key_directory_anchor(path: Path) -> Path:
+    candidate = path
+    while True:
+        try:
+            candidate.lstat()
+            return candidate
+        except FileNotFoundError:
+            parent = candidate.parent
+            if parent == candidate:
+                raise ValueError(f"signing-key directory has no existing anchor: {path}")
+            candidate = parent
+
+
+@contextlib.contextmanager
+def _open_signing_key_directory(path: Path, *, create: bool):
+    if os.name == "nt":
+        if create:
+            path.parent.mkdir(parents=True, exist_ok=True)
+        yield None
+        return
+    anchor = Path.home()
+    try:
+        relative = path.parent.relative_to(anchor)
+    except ValueError:
+        anchor = _existing_signing_key_directory_anchor(path.parent)
+        relative = path.parent.relative_to(anchor)
+    flags = (
+        os.O_RDONLY
+        | getattr(os, "O_BINARY", 0)
+        | getattr(os, "O_DIRECTORY", 0)
+        | getattr(os, "O_NOFOLLOW", 0)
+    )
+    descriptor = None
+    current_path = anchor
+    try:
+        try:
+            descriptor = os.open(anchor, flags)
+            _validate_signing_key_directory(
+                anchor, os.fstat(descriptor),
+            )
+            for component in relative.parts:
+                current_path = current_path / component
+                try:
+                    child = os.open(component, flags, dir_fd=descriptor)
+                except FileNotFoundError:
+                    if not create:
+                        raise
+                    try:
+                        os.mkdir(component, mode=0o700, dir_fd=descriptor)
+                    except FileExistsError:
+                        pass
+                    child = os.open(component, flags, dir_fd=descriptor)
+                try:
+                    _validate_signing_key_directory(
+                        current_path, os.fstat(child),
+                    )
+                except Exception:
+                    os.close(child)
+                    raise
+                os.close(descriptor)
+                descriptor = child
+            expected = _signing_key_directory_identity(
+                os.fstat(descriptor),
+            )
+        except ValueError:
+            raise
+        except FileNotFoundError:
+            raise
+        except OSError as error:
+            raise ValueError(
+                f"cannot safely open signing-key directory: {current_path}"
+            ) from error
+        try:
+            yield descriptor
+        finally:
+            _assert_signing_key_directory_unchanged(path.parent, expected)
+    finally:
+        if descriptor is not None:
+            os.close(descriptor)
+
+
+def _signing_key_lstat(path: Path, directory: int | None) -> os.stat_result:
+    if directory is None:
+        return os.lstat(path)
+    return os.stat(path.name, dir_fd=directory, follow_symlinks=False)
+
+
+def _open_signing_key_file(
+    path: Path, directory: int | None, flags: int, mode: int = 0o600,
+) -> int:
+    if directory is None:
+        return os.open(path, flags, mode)
+    return os.open(path.name, flags, mode, dir_fd=directory)
+
+
+def _signing_key_fstat(descriptor: int) -> os.stat_result:
+    return os.fstat(descriptor)
+
+
+def _load_existing_key_at(path: Path, directory: int | None) -> bytes:
+    before = _signing_key_lstat(path, directory)
+    _validate_signing_key_stat(before)
+    descriptor = _open_signing_key_file(
+        path,
+        directory,
+        os.O_RDONLY | getattr(os, "O_BINARY", 0) | getattr(os, "O_NOFOLLOW", 0),
+    )
+    try:
+        opened = _signing_key_fstat(descriptor)
+        _validate_signing_key_stat(opened)
+        if _signing_key_identity(opened) != _signing_key_identity(before):
+            raise ValueError("signing key changed while opening")
+        with os.fdopen(descriptor, "rb", closefd=False) as handle:
+            key = handle.read(MAX_SIGNING_KEY_BYTES + 1)
+        after = _signing_key_fstat(descriptor)
+        if _signing_key_identity(after) != _signing_key_identity(opened):
+            raise ValueError("signing key changed while reading")
+    finally:
+        os.close(descriptor)
+    if len(key) < 32 or len(key) > MAX_SIGNING_KEY_BYTES:
+        raise ValueError("signing key has an invalid size")
+    return key
+
+
+def load_existing_key(path: Path) -> bytes:
+    with _open_signing_key_directory(path, create=False) as directory:
+        return _load_existing_key_at(path, directory)
+
+
 def load_or_create_key(path: Path) -> bytes:
     env_key = os.environ.get("BLUN_LANGUAGE_GUARD_KEY")
     if env_key:
         return hashlib.sha256(env_key.encode("utf-8")).digest()
-    path.parent.mkdir(parents=True, exist_ok=True)
-    if path.exists():
-        return path.read_bytes()
-    key = os.urandom(32)
-    temporary = path.with_suffix(".tmp")
-    temporary.write_bytes(key)
-    os.chmod(temporary, 0o600)
-    temporary.replace(path)
-    return key
+    with _open_signing_key_directory(path, create=True) as directory:
+        try:
+            return _load_existing_key_at(path, directory)
+        except FileNotFoundError:
+            pass
+        key = os.urandom(32)
+        flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL | getattr(os, "O_NOFOLLOW", 0)
+        try:
+            descriptor = _open_signing_key_file(path, directory, flags)
+        except FileExistsError:
+            return _load_existing_key_at(path, directory)
+        try:
+            with os.fdopen(descriptor, "wb", closefd=False) as handle:
+                handle.write(key)
+                handle.flush()
+                os.fsync(descriptor)
+            opened = _signing_key_fstat(descriptor)
+            _validate_signing_key_stat(opened)
+            installed = _signing_key_lstat(path, directory)
+            _validate_signing_key_stat(installed)
+            if _signing_key_identity(installed) != _signing_key_identity(opened):
+                raise ValueError("signing key changed while creating")
+        finally:
+            os.close(descriptor)
+        return key
 
 
 def issue_receipt(

package/standard-skills/translate-native/scripts/pre_output_guard.py

@@ -7,7 +7,6 @@ import hashlib
 import importlib.util
 import json
 import os
-import stat
 import sys
 from pathlib import Path
 
@@ -25,17 +24,15 @@ def load_verification_key(path: Path) -> bytes:
     if environment_key:
         return hashlib.sha256(environment_key.encode("utf-8")).digest()
     try:
-        mode = stat.S_IMODE(path.stat().st_mode)
-        if os.name != "nt" and mode & 0o077:
-            raise ValueError("signing key permissions are broader than owner-only")
-        key = path.read_bytes()
+        return QUALITY.load_existing_key(path)
     except FileNotFoundError as error:
         raise ValueError("signing key is missing; verification fails closed") from error
     except OSError as error:
         raise ValueError("signing key cannot be read") from error
-    if len(key) < 32:
-        raise ValueError("signing key is invalid")
-    return key
+    except ValueError as error:
+        if "permissions" in str(error):
+            raise ValueError("signing key permissions are broader than owner-only") from error
+        raise ValueError("signing key is invalid") from error
 
 
 def main() -> int:

package/standard-tools/language-guard/blun_language_guard.py

@@ -95,21 +95,21 @@ LANGUAGE_CHARACTER_PROFILES = {
 ASCII_FOLDING_PROFILES = {
     # Conventional transliterations whose density is measurable without a dictionary.
     # Thresholds deliberately avoid treating one ordinary letter sequence as proof.
-    # German ``ue`` is also a native vowel sequence in words such as ``neue``
-    # and ``Abenteuer`` and in the productive loan suffix ``-uell``. Count it
-    # only where the surrounding letters still make an ASCII-folded umlaut
-    # plausible. The short-stem exception deliberately keeps ``Muell`` and
-    # similar folded forms measurable while accepting ``aktuell`` and
-    # ``individuell``.
-    "de": {
-        "patterns": (
-            r"ae",
-            r"oe",
-            r"(?<![aeiouyäöüq])(?:(?<![A-Za-zÄÖÜäöüß]{3})ue(?=ll)|ue(?!ll))",
-        ),
-        "native": "äöüÄÖÜ",
-        "minimum": 3,
-    },
+    # German ``ue`` is also a native vowel sequence in words such as ``neue``
+    # and ``Abenteuer`` and in the productive loan suffix ``-uell``. Count it
+    # only where the surrounding letters still make an ASCII-folded umlaut
+    # plausible. The short-stem exception deliberately keeps ``Muell`` and
+    # similar folded forms measurable while accepting ``aktuell`` and
+    # ``individuell``.
+    "de": {
+        "patterns": (
+            r"ae",
+            r"oe",
+            r"(?<![aeiouyäöüq])(?:(?<![A-Za-zÄÖÜäöüß]{3})ue(?=ll)|ue(?!ll))",
+        ),
+        "native": "äöüÄÖÜ",
+        "minimum": 3,
+    },
     "sv": {"patterns": (r"aa", r"ae", r"oe"), "native": "åäöÅÄÖ", "minimum": 1},
     "da": {"patterns": (r"aa", r"ae", r"oe"), "native": "åæøÅÆØ", "minimum": 1},
     "no": {"patterns": (r"aa", r"ae", r"oe"), "native": "åæøÅÆØ", "minimum": 1},
@@ -131,10 +131,7 @@ def _service_token() -> str:
         return direct
     if not SERVICE_TOKEN_FILE:
         return ""
-    token = Path(SERVICE_TOKEN_FILE).read_text(encoding="utf-8-sig").strip()
-    if len(token) < 32:
-        raise SERVICE_CLIENT.GuardServiceError("guard service token is invalid")
-    return token
+    return SERVICE_CLIENT.load_service_token(Path(SERVICE_TOKEN_FILE))
 
 
 def _isolated_release(task_kind: str, arguments: dict[str, Any]) -> dict[str, Any] | None:
@@ -173,14 +170,13 @@ def _languages_for(text: str, language: str) -> tuple[str, ...]:
     return (base,) if base in DIACRITICS.RULES else ()
 
 
-def validate_text(
-    text: str,
-    language: str = "auto",
-    glossary: dict[str, Any] | None = None,
-    content_type: str = "prose",
-    short_text_reviewed: bool = False,
-    require_character_profile: bool = True,
-) -> dict[str, Any]:
+def validate_text(
+    text: str,
+    language: str = "auto",
+    glossary: dict[str, Any] | None = None,
+    content_type: str = "prose",
+    short_text_reviewed: bool = False,
+) -> dict[str, Any]:
     findings: list[Finding] = []
     if not text.strip():
         findings.append(Finding("empty-target", "Target text is empty."))
@@ -200,12 +196,7 @@ def validate_text(
     base_language = language.casefold().replace("_", "-").split("-", 1)[0]
     profile = LANGUAGE_CHARACTER_PROFILES.get(base_language)
     profile_prose = DIACRITICS.mask_technical_text(text)
-    if (
-        require_character_profile
-        and profile
-        and len(profile_prose) >= 200
-        and not any(character in profile for character in profile_prose)
-    ):
+    if profile and len(profile_prose) >= 200 and not any(character in profile for character in profile_prose):
         findings.append(Finding(
             "missing-language-character-profile",
             f"Long {base_language} text contains none of the language's characteristic native characters; possible wholesale ASCII folding.",
@@ -392,14 +383,13 @@ def release_response(arguments: dict[str, Any]) -> dict[str, Any]:
         and language.casefold() not in {"auto", "all"}
         and EXACT_LANGUAGE_TAG.fullmatch(language) is not None
     )
-    report = validate_text(
-        target if target_is_text else "",
-        language if isinstance(language, str) else "",
-        arguments.get("glossary"),
-        arguments.get("content_type", "prose"),
-        arguments.get("short_text_reviewed") is True,
-        False,
-    )
+    report = validate_text(
+        target if target_is_text else "",
+        language if isinstance(language, str) else "",
+        arguments.get("glossary"),
+        arguments.get("content_type", "prose"),
+        arguments.get("short_text_reviewed") is True,
+    )
     report["checks"].append("agent-response-native-orthography")
     if not target_is_text:
         report["findings"].append(
@@ -670,13 +660,8 @@ def handle_message(message: dict[str, Any]) -> dict[str, Any] | None:
     }
 
 
-def serve() -> int:
-    # MCP stdio is UTF-8; Windows otherwise decodes it using the system code page.
-    for stream in (sys.stdin, sys.stdout):
-        reconfigure = getattr(stream, "reconfigure", None)
-        if reconfigure is not None:
-            reconfigure(encoding="utf-8")
-    for line in sys.stdin:
+def serve() -> int:
+    for line in sys.stdin:
         if not line.strip():
             continue
         try:

package/standard-tools/language-guard/guard_service_client.py

@@ -4,17 +4,199 @@
 from __future__ import annotations
 
 import json
+import os
 import socket
-from typing import Any
+import stat
+from contextlib import contextmanager
+from pathlib import Path
+from typing import Any, Iterator
 
 
 MAX_RESPONSE_BYTES = 8 * 1024 * 1024
+MAX_SERVICE_TOKEN_BYTES = 64 * 1024
 
 
 class GuardServiceError(RuntimeError):
     """Raised when the isolated guard cannot evaluate a request safely."""
 
 
+def _token_file_identity(details: os.stat_result) -> tuple[int, int, int, int, int, int]:
+    return (
+        details.st_dev,
+        details.st_ino,
+        details.st_nlink,
+        details.st_size,
+        details.st_ctime_ns,
+        details.st_mtime_ns,
+    )
+
+
+def _token_directory_identity(
+    details: os.stat_result,
+) -> tuple[int, int, int, int, int]:
+    return (
+        details.st_dev,
+        details.st_ino,
+        details.st_mode,
+        details.st_uid,
+        details.st_gid,
+    )
+
+
+def _validate_token_directory(path: Path, details: os.stat_result) -> None:
+    if not stat.S_ISDIR(details.st_mode) or stat.S_ISLNK(details.st_mode):
+        raise GuardServiceError(f"guard service token directory is invalid: {path}")
+    if os.name != "nt" and stat.S_IMODE(details.st_mode) & 0o022:
+        raise GuardServiceError(
+            f"guard service token directory is writable outside its owner: {path}"
+        )
+    if hasattr(os, "getuid") and details.st_uid != os.getuid():
+        raise GuardServiceError(f"guard service token directory has the wrong owner: {path}")
+
+
+def _existing_token_directory_anchor(path: Path) -> Path:
+    candidate = path
+    while True:
+        try:
+            candidate.lstat()
+            return candidate
+        except FileNotFoundError:
+            parent = candidate.parent
+            if parent == candidate:
+                raise GuardServiceError(
+                    f"guard service token directory has no existing anchor: {path}"
+                )
+            candidate = parent
+
+
+def _assert_token_directory_unchanged(
+    path: Path, expected: tuple[int, int, int, int, int],
+) -> None:
+    try:
+        current = path.lstat()
+    except OSError as error:
+        raise GuardServiceError(
+            f"guard service token directory cannot be rechecked: {path}"
+        ) from error
+    _validate_token_directory(path, current)
+    if _token_directory_identity(current) != expected:
+        raise GuardServiceError(
+            f"guard service token directory changed during read: {path}"
+        )
+
+
+@contextmanager
+def _open_token_directory(path: Path) -> Iterator[int | None]:
+    if os.name == "nt":
+        yield None
+        return
+    anchor = Path.home()
+    try:
+        relative = path.parent.relative_to(anchor)
+    except ValueError:
+        anchor = _existing_token_directory_anchor(path.parent)
+        relative = path.parent.relative_to(anchor)
+    flags = (
+        os.O_RDONLY
+        | getattr(os, "O_BINARY", 0)
+        | getattr(os, "O_DIRECTORY", 0)
+        | getattr(os, "O_NOFOLLOW", 0)
+    )
+    descriptor = None
+    current_path = anchor
+    try:
+        try:
+            descriptor = os.open(anchor, flags)
+            _validate_token_directory(anchor, os.fstat(descriptor))
+            for component in relative.parts:
+                current_path = current_path / component
+                child = os.open(component, flags, dir_fd=descriptor)
+                try:
+                    _validate_token_directory(current_path, os.fstat(child))
+                except Exception:
+                    os.close(child)
+                    raise
+                os.close(descriptor)
+                descriptor = child
+            expected = _token_directory_identity(os.fstat(descriptor))
+        except (FileNotFoundError, GuardServiceError):
+            raise
+        except OSError as error:
+            raise GuardServiceError(
+                f"guard service token directory cannot be opened safely: {current_path}"
+            ) from error
+        try:
+            yield descriptor
+        finally:
+            _assert_token_directory_unchanged(path.parent, expected)
+    finally:
+        if descriptor is not None:
+            os.close(descriptor)
+
+
+def _validate_token_file(details: os.stat_result) -> None:
+    if not stat.S_ISREG(details.st_mode) or stat.S_ISLNK(details.st_mode):
+        raise GuardServiceError("guard service token must be a regular file")
+    if details.st_nlink != 1:
+        raise GuardServiceError("guard service token must not have additional hard links")
+    if details.st_size < 32 or details.st_size > MAX_SERVICE_TOKEN_BYTES:
+        raise GuardServiceError("guard service token has an invalid size")
+    if os.name != "nt" and stat.S_IMODE(details.st_mode) & 0o077:
+        raise GuardServiceError("guard service token permissions must be owner-only")
+    if hasattr(os, "getuid") and details.st_uid != os.getuid():
+        raise GuardServiceError("guard service token has the wrong owner")
+
+
+def _token_lstat(path: Path, directory: int | None) -> os.stat_result:
+    if directory is None:
+        return os.lstat(path)
+    return os.stat(path.name, dir_fd=directory, follow_symlinks=False)
+
+
+def _open_token_file(path: Path, directory: int | None) -> int:
+    flags = os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0)
+    if directory is None:
+        return os.open(path, flags)
+    return os.open(path.name, flags, dir_fd=directory)
+
+
+def _token_fstat(descriptor: int) -> os.stat_result:
+    return os.fstat(descriptor)
+
+
+def load_service_token(path: Path) -> str:
+    """Read a bounded owner-only service token without following a replaced file."""
+    with _open_token_directory(path) as directory:
+        before = _token_lstat(path, directory)
+        _validate_token_file(before)
+        descriptor = _open_token_file(path, directory)
+        try:
+            opened = _token_fstat(descriptor)
+            _validate_token_file(opened)
+            if _token_file_identity(opened) != _token_file_identity(before):
+                raise GuardServiceError("guard service token changed while opening")
+            with os.fdopen(descriptor, "rb", closefd=False) as handle:
+                raw = handle.read(MAX_SERVICE_TOKEN_BYTES + 1)
+            after = _token_fstat(descriptor)
+            after_path = _token_lstat(path, directory)
+            if (
+                _token_file_identity(after) != _token_file_identity(opened)
+                or _token_file_identity(after_path) != _token_file_identity(opened)
+            ):
+                raise GuardServiceError("guard service token changed while reading")
+        finally:
+            os.close(descriptor)
+    if len(raw) > MAX_SERVICE_TOKEN_BYTES:
+        raise GuardServiceError("guard service token has an invalid size")
+    try:
+        token = raw.decode("utf-8-sig").strip()
+    except UnicodeDecodeError as error:
+        raise GuardServiceError("guard service token is not valid UTF-8") from error
+    if len(token) < 32:
+        raise GuardServiceError("guard service token is invalid")
+    return token
+
+
 def parse_endpoint(endpoint: str) -> tuple[str, str | tuple[str, int]]:
     value = str(endpoint or "").strip()
     if value.startswith("unix:") and value[5:]:

package/standard-tools/language-guard/language_quality.py

@@ -4,11 +4,13 @@
 from __future__ import annotations
 
 import base64
+import contextlib
 import hashlib
 import hmac
 import json
 import os
 import re
+import stat
 import time
 import unicodedata
 from pathlib import Path
@@ -16,6 +18,7 @@ from typing import Any
 
 
 VERSION = "6.20.0"
+MAX_SIGNING_KEY_BYTES = 64 * 1024
 DANGEROUS_BIDI = {"\u202a", "\u202b", "\u202c", "\u202d", "\u202e"}
 ISOLATE_OPENERS = {"\u2066", "\u2067", "\u2068"}
 ISOLATE_CLOSER = "\u2069"
@@ -53,19 +56,221 @@ def _b64decode(data: str) -> bytes:
     return base64.urlsafe_b64decode(data + "=" * (-len(data) % 4))
 
 
+def _validate_signing_key_stat(details: os.stat_result) -> None:
+    if not stat.S_ISREG(details.st_mode) or stat.S_ISLNK(details.st_mode):
+        raise ValueError("signing key must be a regular file")
+    if details.st_nlink != 1:
+        raise ValueError("signing key must have exactly one hard link")
+    if details.st_size < 32 or details.st_size > MAX_SIGNING_KEY_BYTES:
+        raise ValueError("signing key has an invalid size")
+    if os.name != "nt" and stat.S_IMODE(details.st_mode) & 0o077:
+        raise ValueError("signing key permissions must be owner-only")
+    if hasattr(os, "getuid") and details.st_uid != os.getuid():
+        raise ValueError("signing key has the wrong owner")
+
+
+def _signing_key_identity(details: os.stat_result) -> tuple[int, int, int, int, int, int]:
+    return (
+        details.st_dev,
+        details.st_ino,
+        details.st_nlink,
+        details.st_size,
+        details.st_ctime_ns,
+        details.st_mtime_ns,
+    )
+
+
+def _signing_key_directory_identity(
+    details: os.stat_result,
+) -> tuple[int, int, int, int, int]:
+    return (
+        details.st_dev,
+        details.st_ino,
+        details.st_mode,
+        details.st_uid,
+        details.st_gid,
+    )
+
+
+def _validate_signing_key_directory(path: Path, details: os.stat_result) -> None:
+    if not stat.S_ISDIR(details.st_mode) or stat.S_ISLNK(details.st_mode):
+        raise ValueError(f"signing-key directory is not a directory: {path}")
+    if stat.S_IMODE(details.st_mode) & 0o022:
+        raise ValueError(f"signing-key directory is writable outside its owner: {path}")
+    if hasattr(os, "getuid") and details.st_uid != os.getuid():
+        raise ValueError(f"signing-key directory has the wrong owner: {path}")
+
+
+def _assert_signing_key_directory_unchanged(
+    path: Path, expected: tuple[int, int, int, int, int],
+) -> None:
+    try:
+        current = path.lstat()
+    except OSError as error:
+        raise ValueError(f"signing-key directory cannot be rechecked: {path}") from error
+    _validate_signing_key_directory(path, current)
+    if _signing_key_directory_identity(current) != expected:
+        raise ValueError(f"signing-key directory changed during operation: {path}")
+
+
+def _existing_signing_key_directory_anchor(path: Path) -> Path:
+    candidate = path
+    while True:
+        try:
+            candidate.lstat()
+            return candidate
+        except FileNotFoundError:
+            parent = candidate.parent
+            if parent == candidate:
+                raise ValueError(f"signing-key directory has no existing anchor: {path}")
+            candidate = parent
+
+
+@contextlib.contextmanager
+def _open_signing_key_directory(path: Path, *, create: bool):
+    if os.name == "nt":
+        if create:
+            path.parent.mkdir(parents=True, exist_ok=True)
+        yield None
+        return
+    anchor = Path.home()
+    try:
+        relative = path.parent.relative_to(anchor)
+    except ValueError:
+        anchor = _existing_signing_key_directory_anchor(path.parent)
+        relative = path.parent.relative_to(anchor)
+    flags = (
+        os.O_RDONLY
+        | getattr(os, "O_BINARY", 0)
+        | getattr(os, "O_DIRECTORY", 0)
+        | getattr(os, "O_NOFOLLOW", 0)
+    )
+    descriptor = None
+    current_path = anchor
+    try:
+        try:
+            descriptor = os.open(anchor, flags)
+            _validate_signing_key_directory(
+                anchor, os.fstat(descriptor),
+            )
+            for component in relative.parts:
+                current_path = current_path / component
+                try:
+                    child = os.open(component, flags, dir_fd=descriptor)
+                except FileNotFoundError:
+                    if not create:
+                        raise
+                    try:
+                        os.mkdir(component, mode=0o700, dir_fd=descriptor)
+                    except FileExistsError:
+                        pass
+                    child = os.open(component, flags, dir_fd=descriptor)
+                try:
+                    _validate_signing_key_directory(
+                        current_path, os.fstat(child),
+                    )
+                except Exception:
+                    os.close(child)
+                    raise
+                os.close(descriptor)
+                descriptor = child
+            expected = _signing_key_directory_identity(
+                os.fstat(descriptor),
+            )
+        except ValueError:
+            raise
+        except FileNotFoundError:
+            raise
+        except OSError as error:
+            raise ValueError(
+                f"cannot safely open signing-key directory: {current_path}"
+            ) from error
+        try:
+            yield descriptor
+        finally:
+            _assert_signing_key_directory_unchanged(path.parent, expected)
+    finally:
+        if descriptor is not None:
+            os.close(descriptor)
+
+
+def _signing_key_lstat(path: Path, directory: int | None) -> os.stat_result:
+    if directory is None:
+        return os.lstat(path)
+    return os.stat(path.name, dir_fd=directory, follow_symlinks=False)
+
+
+def _open_signing_key_file(
+    path: Path, directory: int | None, flags: int, mode: int = 0o600,
+) -> int:
+    if directory is None:
+        return os.open(path, flags, mode)
+    return os.open(path.name, flags, mode, dir_fd=directory)
+
+
+def _signing_key_fstat(descriptor: int) -> os.stat_result:
+    return os.fstat(descriptor)
+
+
+def _load_existing_key_at(path: Path, directory: int | None) -> bytes:
+    before = _signing_key_lstat(path, directory)
+    _validate_signing_key_stat(before)
+    descriptor = _open_signing_key_file(
+        path,
+        directory,
+        os.O_RDONLY | getattr(os, "O_BINARY", 0) | getattr(os, "O_NOFOLLOW", 0),
+    )
+    try:
+        opened = _signing_key_fstat(descriptor)
+        _validate_signing_key_stat(opened)
+        if _signing_key_identity(opened) != _signing_key_identity(before):
+            raise ValueError("signing key changed while opening")
+        with os.fdopen(descriptor, "rb", closefd=False) as handle:
+            key = handle.read(MAX_SIGNING_KEY_BYTES + 1)
+        after = _signing_key_fstat(descriptor)
+        if _signing_key_identity(after) != _signing_key_identity(opened):
+            raise ValueError("signing key changed while reading")
+    finally:
+        os.close(descriptor)
+    if len(key) < 32 or len(key) > MAX_SIGNING_KEY_BYTES:
+        raise ValueError("signing key has an invalid size")
+    return key
+
+
+def load_existing_key(path: Path) -> bytes:
+    with _open_signing_key_directory(path, create=False) as directory:
+        return _load_existing_key_at(path, directory)
+
+
 def load_or_create_key(path: Path) -> bytes:
     env_key = os.environ.get("BLUN_LANGUAGE_GUARD_KEY")
     if env_key:
         return hashlib.sha256(env_key.encode("utf-8")).digest()
-    path.parent.mkdir(parents=True, exist_ok=True)
-    if path.exists():
-        return path.read_bytes()
-    key = os.urandom(32)
-    temporary = path.with_suffix(".tmp")
-    temporary.write_bytes(key)
-    os.chmod(temporary, 0o600)
-    temporary.replace(path)
-    return key
+    with _open_signing_key_directory(path, create=True) as directory:
+        try:
+            return _load_existing_key_at(path, directory)
+        except FileNotFoundError:
+            pass
+        key = os.urandom(32)
+        flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL | getattr(os, "O_NOFOLLOW", 0)
+        try:
+            descriptor = _open_signing_key_file(path, directory, flags)
+        except FileExistsError:
+            return _load_existing_key_at(path, directory)
+        try:
+            with os.fdopen(descriptor, "wb", closefd=False) as handle:
+                handle.write(key)
+                handle.flush()
+                os.fsync(descriptor)
+            opened = _signing_key_fstat(descriptor)
+            _validate_signing_key_stat(opened)
+            installed = _signing_key_lstat(path, directory)
+            _validate_signing_key_stat(installed)
+            if _signing_key_identity(installed) != _signing_key_identity(opened):
+                raise ValueError("signing key changed while creating")
+        finally:
+            os.close(descriptor)
+        return key
 
 
 def issue_receipt(

package/standard-tools/language-guard/provenance.json

@@ -0,0 +1,13 @@
+{
+  "name": "blun-language-guard",
+  "version": "6.42.13",
+  "sourceCommit": "6430ce30e235c1a9d1ebcd1b646d62edce510605",
+  "sourceRepository": "https://github.com/Maykbiletti/translate-native",
+  "files": {
+    "blun_language_guard.py": "37ec76a20ac0656397e7923cd5b40800054cc95119de73e2fe6f437d760dda01",
+    "check_diacritics.py": "96d7a0faa4f6a8c827bcf6fe065975fc803389fa4a5363108383da4b9bbc995b",
+    "guard_service_client.py": "e3c000f2e5994738cb219cc82d14466d558206e7c7dd6a0e7d184071d8791f48",
+    "language_quality.py": "46fe4f2b22205d6d5514bc1d0d7354ae862395f53134c7d82d892440b98e8529",
+    "translation_guard.py": "56e74c2432aeeaecabfd58ba30ec507aab1d42c3e32fa1b39307c1043c8c7ac2"
+  }
+}

package/standard-tools/manifest.json

@@ -18,7 +18,7 @@
     "blun-language-guard": {
       "owner": "user-mcp",
       "version": "host-provisioned",
-      "skillVersion": "6.41.1",
+      "skillVersion": "6.42.13",
       "detectTokens": ["blun-language-guard", "blun_language_guard.py"],
       "provisioning": "The npm package provides the zero-dependency Python runtime files.",
       "config": {