harnery 0.40.0 → 0.41.0

package/dist/core/storage/durable-history.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"durable-history.d.ts","sourceRoot":"","sources":["../../../src/core/storage/durable-history.ts"],"names":[],"mappings":"AAuBA,eAAO,MAAM,8BAA8B,EAAG,4BAAqC,CAAC;AAEpF,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,2BAA2B,KAAK,IAAI,CAAC;IACxD,wEAAwE;IACxE,UAAU,CAAC,EAAE,uBAAuB,CAAC;CACtC;AAED,MAAM,MAAM,uBAAuB,GAAG,CACpC,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,KACX,MAAM,CAAC;AAEZ,MAAM,MAAM,2BAA2B,GACnC,sBAAsB,GACtB,eAAe,GACf,0BAA0B,GAC1B,yBAAyB,GACzB,uBAAuB,CAAC;AAE5B,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,OAAO,8BAA8B,CAAC;IAC9C,OAAO,EAAE,QAAQ,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,IAAI,CAAC;CACd;AAED,MAAM,WAAW,yBAAyB;IACxC,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB,CAAC,CAAC;IACrC,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC;CACX;AAED,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,qBAAqB,GAC7B,2BAA2B,CA+B7B;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,OAAO,EACf,cAAc,EAAE,MAAM,EACtB,KAAK,CAAC,EAAE,qBAAqB,CAAC,OAAO,CAAC,GACrC,MAAM,CAQR;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,qBAAqB,GAC7B,2BAA2B,CA8B7B;AAED,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,CAAC,EAC3C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,yBAAyB,EAClC,MAAM,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,KAAK,oBAAoB,CAAC,CAAC,CAAC,EAC1D,KAAK,CAAC,EAAE,qBAAqB,CAAC,OAAO,CAAC,GACrC,CAAC,CAcH;AAED,wBAAuB,oBAAoB,CAAC,CAAC,EAC3C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,yBAAyB,GACjC,cAAc,CAAC,CAAC,CAAC,CAYnB;AAED,wBAAgB,sBAAsB,CAAC,CAAC,EACtC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,yBAAyB,GACjC,CAAC,EAAE,CAgBL;AAED,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG,CAAC,EAAE,CAgB/F;AAED,wBAAgB,0BAA0B,CAAC,CAAC,EAC1C,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,yBAAyB,GACjC,CAAC,EAAE,CAwBL;AAED,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,SAAS,OAAO,EAAE,EAC3B,cAAc,EAAE,MAAM,EACtB,KAAK,CAAC,EAAE,qBAAqB,CAAC,OAAO,CAAC,GACrC,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAqB/D"}
+{"version":3,"file":"durable-history.d.ts","sourceRoot":"","sources":["../../../src/core/storage/durable-history.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,8BAA8B,EAAG,4BAAqC,CAAC;AAEpF,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,2BAA2B,KAAK,IAAI,CAAC;IACxD,wEAAwE;IACxE,UAAU,CAAC,EAAE,uBAAuB,CAAC;CACtC;AAED,MAAM,MAAM,uBAAuB,GAAG,CACpC,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,KACX,MAAM,CAAC;AAEZ,MAAM,MAAM,2BAA2B,GACnC,sBAAsB,GACtB,eAAe,GACf,0BAA0B,GAC1B,yBAAyB,GACzB,uBAAuB,CAAC;AAE5B,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,OAAO,8BAA8B,CAAC;IAC9C,OAAO,EAAE,QAAQ,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,IAAI,CAAC;CACd;AAED,MAAM,WAAW,yBAAyB;IACxC,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB,CAAC,CAAC;IACrC,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC;CACX;AAED,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,qBAAqB,GAC7B,2BAA2B,CA+B7B;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,OAAO,EACf,cAAc,EAAE,MAAM,EACtB,KAAK,CAAC,EAAE,qBAAqB,CAAC,OAAO,CAAC,GACrC,MAAM,CAQR;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,qBAAqB,GAC7B,2BAA2B,CA8B7B;AAED,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,CAAC,EAC3C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,yBAAyB,EAClC,MAAM,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,KAAK,oBAAoB,CAAC,CAAC,CAAC,EAC1D,KAAK,CAAC,EAAE,qBAAqB,CAAC,OAAO,CAAC,GACrC,CAAC,CAcH;AAED,wBAAuB,oBAAoB,CAAC,CAAC,EAC3C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,yBAAyB,GACjC,cAAc,CAAC,CAAC,CAAC,CAYnB;AAED,wBAAgB,sBAAsB,CAAC,CAAC,EACtC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,yBAAyB,GACjC,CAAC,EAAE,CAgBL;AAED,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG,CAAC,EAAE,CAgB/F;AAED,wBAAgB,0BAA0B,CAAC,CAAC,EAC1C,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,yBAAyB,GACjC,CAAC,EAAE,CAwBL;AAED,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,SAAS,OAAO,EAAE,EAC3B,cAAc,EAAE,MAAM,EACtB,KAAK,CAAC,EAAE,qBAAqB,CAAC,OAAO,CAAC,GACrC,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAqB/D"}

package/dist/core/storage/durable-history.js

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import { closeSync, existsSync, constants as fsConstants, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, readSync, realpathSync, renameSync, rmSync, statSync, writeSync, } from "node:fs";
 import { open, rename, rm } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative } from "node:path";
+import { stateDirMode, stateFileMode } from "./modes.js";
 export const HARNERY_DURABLE_HISTORY_SCHEMA = "harnery.durable-history/v1";
 export function appendDurableHistoryRecord(objectDir, record, options) {
     validateOptions(options);
@@ -174,7 +175,7 @@ export async function rewriteCrashSafeJsonlFile(path, records, maxRecordBytes, f
     rejectExistingSymlink(path);
     const temp = `${path}.rewrite-${process.pid}`;
     await withLeaseAsync(`${path}.lease`, async () => {
-        const handle = await open(temp, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollowFlag(), 0o600);
+        const handle = await open(temp, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollowFlag(), stateFileMode());
         try {
             await writeAll(handle, Buffer.from(body, "utf8"));
             await handle.sync();
@@ -220,7 +221,7 @@ export function durableHistoryPaths(objectDir) {
 function appendAndSync(path, line, fault, writer = nativeWriteSync) {
     const parent = captureDirectoryIdentity(dirname(path));
     rejectExistingSymlink(path);
-    const fd = openSync(path, fsConstants.O_RDWR | fsConstants.O_APPEND | fsConstants.O_CREAT | noFollowFlag(), 0o600);
+    const fd = openSync(path, fsConstants.O_RDWR | fsConstants.O_APPEND | fsConstants.O_CREAT | noFollowFlag(), stateFileMode());
     try {
         assertOpenFileIdentity(path, fd, parent);
         assertCompleteTail(fd, path);
@@ -235,7 +236,7 @@ function appendAndSync(path, line, fault, writer = nativeWriteSync) {
     }
 }
 function ensurePrivateDirectory(path) {
-    mkdirSync(path, { recursive: true, mode: 0o700 });
+    mkdirSync(path, { recursive: true, mode: stateDirMode() });
     return captureDirectoryIdentity(path);
 }
 function regularFileBytes(path) {
@@ -395,7 +396,7 @@ function acquireLease(lease) {
         };
         let claimed;
         try {
-            mkdirSync(lease, { mode: 0o700 });
+            mkdirSync(lease, { mode: stateDirMode() });
             assertDirectoryWithinParent(lease, parent);
             claimed = captureDirectoryIdentity(lease);
             writeOwner(join(lease, "owner.json"), owner);
@@ -421,7 +422,7 @@ function acquireLease(lease) {
 }
 function writeOwner(path, owner) {
     const parent = captureDirectoryIdentity(dirname(path));
-    const fd = openSync(path, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollowFlag(), 0o600);
+    const fd = openSync(path, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollowFlag(), stateFileMode());
     try {
         assertOpenFileIdentity(path, fd, parent);
         writeAllSync(fd, Buffer.from(`${JSON.stringify(owner)}\n`, "utf8"), nativeWriteSync);

package/dist/core/storage/maintenance-providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"maintenance-providers.d.ts","sourceRoot":"","sources":["../../../src/core/storage/maintenance-providers.ts"],"names":[],"mappings":"AAGA,OAAO,EAAwB,KAAK,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAGhF,OAAO,EAEL,KAAK,iCAAiC,EACtC,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAGhC,MAAM,kBAAkB,CAAC;AAI1B,eAAO,MAAM,gCAAgC,EAAE,wBAI7C,CAAC;AAEH,MAAM,WAAW,2BAA2B;IAC1C,OAAO,IAAI,OAAO,CAAC;IACnB,MAAM,IAAI,OAAO,CAAC;IAClB,SAAS,IAAI,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,qBAAqB,CAAC;IAC/B,SAAS,EAAE,SAAS,0BAA0B,EAAE,CAAC;CAClD;AAED,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,2BAA2B,GACpC,SAAS,0BAA0B,EAAE,CAMvC;AAED,mFAAmF;AACnF,wBAAgB,uCAAuC,CACrD,OAAO,EAAE,qBAAqB,GAC7B,SAAS,0BAA0B,EAAE,CAYvC;AAED,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,2BAA2B,GACpC,+BAA+B,CAMjC;AAED;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC/C,WAAW,EAAE,+BAA+B,EAC5C,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,wBAAwB,CAAA;CAAO,GAC9D,OAAO,CAAC,iCAAiC,CAAC,CAS5C"}
+{"version":3,"file":"maintenance-providers.d.ts","sourceRoot":"","sources":["../../../src/core/storage/maintenance-providers.ts"],"names":[],"mappings":"AAGA,OAAO,EAAwB,KAAK,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAGhF,OAAO,EAEL,KAAK,iCAAiC,EACtC,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAGhC,MAAM,kBAAkB,CAAC;AAK1B,eAAO,MAAM,gCAAgC,EAAE,wBAI7C,CAAC;AAEH,MAAM,WAAW,2BAA2B;IAC1C,OAAO,IAAI,OAAO,CAAC;IACnB,MAAM,IAAI,OAAO,CAAC;IAClB,SAAS,IAAI,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,qBAAqB,CAAC;IAC/B,SAAS,EAAE,SAAS,0BAA0B,EAAE,CAAC;CAClD;AAED,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,2BAA2B,GACpC,SAAS,0BAA0B,EAAE,CAMvC;AAED,mFAAmF;AACnF,wBAAgB,uCAAuC,CACrD,OAAO,EAAE,qBAAqB,GAC7B,SAAS,0BAA0B,EAAE,CAYvC;AAED,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,2BAA2B,GACpC,+BAA+B,CAMjC;AAED;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC/C,WAAW,EAAE,+BAA+B,EAC5C,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,wBAAwB,CAAA;CAAO,GAC9D,OAAO,CAAC,iCAAiC,CAAC,CAS5C"}

package/dist/core/storage/maintenance-providers.js

@@ -5,6 +5,7 @@ import { createStorageCatalog } from "./catalog.js";
 import { HARNERY_STRUCTURED_LOG_PROVIDER_ID } from "./contract.js";
 import { createStructuredLogRetentionProvider } from "./log-retention.js";
 import { HARNERY_MAINTENANCE_CURSOR_SCHEMA, readMaintenanceTransaction, runAutomaticMaintenanceSlice, } from "./maintenance.js";
+import { stateFileMode } from "./modes.js";
 const STALE_RUNNING_CLAIM_MS = 10 * 60 * 1_000;
 export const SESSION_START_MAINTENANCE_BUDGET = Object.freeze({
     max_duration_ms: 250,
@@ -133,7 +134,7 @@ function recoverInterruptedDailyClaim(coordRoot, now) {
 }
 function atomicCursor(path, cursor) {
     const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
-    writeFileSync(temporary, `${JSON.stringify(cursor, null, 2)}\n`, { mode: 0o600 });
+    writeFileSync(temporary, `${JSON.stringify(cursor, null, 2)}\n`, { mode: stateFileMode() });
     renameSync(temporary, path);
 }
 function disabledResult() {

package/dist/core/storage/maintenance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"maintenance.d.ts","sourceRoot":"","sources":["../../../src/core/storage/maintenance.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAM1D,eAAO,MAAM,sCAAsC,EACjD,4CAAqD,CAAC;AACxD,eAAO,MAAM,kCAAkC,EAAG,wCAAiD,CAAC;AACpG,eAAO,MAAM,iCAAiC,EAAG,uCAAgD,CAAC;AAClG,eAAO,MAAM,mCAAmC,EAAG,6BAAsC,CAAC;AAO1F,MAAM,WAAW,wBAAwB;IACvC,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,OAAO,mCAAmC,CAAC;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,SAAS,4BAA4B,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,OAAO,CAAC;IACrB,gGAAgG;IAChG,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mEAAmE;IACnE,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,EAAE;QACV,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,4BAA4B,CAAC;QACvC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,wBAAwB,CAAC;QACjC,GAAG,EAAE,IAAI,CAAC;KACX,GAAG,8BAA8B,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC7E,KAAK,CAAC,KAAK,EAAE;QACX,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,EAAE,MAAM,CAAC;QACvB,MAAM,EAAE,wBAAwB,CAAC;QACjC,GAAG,EAAE,IAAI,CAAC;KACX,GAAG,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,SAAS,GAAG,iBAAiB,GAAG,SAAS,CAAC;IACnD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,OAAO,sCAAsC,CAAC;IACtD,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;IAClE,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,6BAA6B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChE,MAAM,EAAE,wBAAwB,CAAC;IACjC,OAAO,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAC7C,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,OAAO,kCAAkC,CAAC;IAClD,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,0BAA0B,CAAC,SAAS,CAAC,CAAC;IAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iCAAiC;IAChD,GAAG,EAAE,OAAO,CAAC;IACb,MAAM,EAAE,UAAU,GAAG,aAAa,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,WAAW,CAAC;IACrF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,0BAA0B,EAAE,wBAIvC,CAAC;AAEH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,qBAAqB,EAC9B,SAAS,EAAE,SAAS,0BAA0B,EAAE,EAChD,QAAQ,EAAE,6BAA6B,EACvC,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;CACpB,GACL,OAAO,CAAC,6BAA6B,CAAC,CAoGxC;AAED,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,qBAAqB,EAC9B,SAAS,EAAE,SAAS,0BAA0B,EAAE,EAChD,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE;IAAE,GAAG,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IAAC,iCAAiC,CAAC,EAAE,OAAO,CAAA;CAAE,GACjF,OAAO,CAAC,6BAA6B,CAAC,CAsFxC;AAED,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,qBAAqB,EAC9B,SAAS,EAAE,SAAS,0BAA0B,EAAE,EAChD,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GACjF,OAAO,CAAC,iCAAiC,CAAC,CAyE5C;AAED,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,GACpB,6BAA6B,CAM/B;AAED,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,6BAA6B,EAAE,CAO9F;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,6BAA6B,GACrC,IAAI,CAGN;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,6BAA6B,GAAG,SAAS,CAMhG;AA0cD,qBAAa,uBAAwB,SAAQ,KAAK;IAE9C,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAKlB"}
+{"version":3,"file":"maintenance.d.ts","sourceRoot":"","sources":["../../../src/core/storage/maintenance.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAO1D,eAAO,MAAM,sCAAsC,EACjD,4CAAqD,CAAC;AACxD,eAAO,MAAM,kCAAkC,EAAG,wCAAiD,CAAC;AACpG,eAAO,MAAM,iCAAiC,EAAG,uCAAgD,CAAC;AAClG,eAAO,MAAM,mCAAmC,EAAG,6BAAsC,CAAC;AAO1F,MAAM,WAAW,wBAAwB;IACvC,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,OAAO,mCAAmC,CAAC;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,SAAS,4BAA4B,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,OAAO,CAAC;IACrB,gGAAgG;IAChG,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mEAAmE;IACnE,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,EAAE;QACV,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,4BAA4B,CAAC;QACvC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,wBAAwB,CAAC;QACjC,GAAG,EAAE,IAAI,CAAC;KACX,GAAG,8BAA8B,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC7E,KAAK,CAAC,KAAK,EAAE;QACX,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,EAAE,MAAM,CAAC;QACvB,MAAM,EAAE,wBAAwB,CAAC;QACjC,GAAG,EAAE,IAAI,CAAC;KACX,GAAG,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,SAAS,GAAG,iBAAiB,GAAG,SAAS,CAAC;IACnD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,OAAO,sCAAsC,CAAC;IACtD,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;IAClE,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,6BAA6B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChE,MAAM,EAAE,wBAAwB,CAAC;IACjC,OAAO,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAC7C,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,OAAO,kCAAkC,CAAC;IAClD,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,0BAA0B,CAAC,SAAS,CAAC,CAAC;IAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iCAAiC;IAChD,GAAG,EAAE,OAAO,CAAC;IACb,MAAM,EAAE,UAAU,GAAG,aAAa,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,WAAW,CAAC;IACrF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,0BAA0B,EAAE,wBAIvC,CAAC;AAEH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,qBAAqB,EAC9B,SAAS,EAAE,SAAS,0BAA0B,EAAE,EAChD,QAAQ,EAAE,6BAA6B,EACvC,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;CACpB,GACL,OAAO,CAAC,6BAA6B,CAAC,CAoGxC;AAED,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,qBAAqB,EAC9B,SAAS,EAAE,SAAS,0BAA0B,EAAE,EAChD,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE;IAAE,GAAG,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IAAC,iCAAiC,CAAC,EAAE,OAAO,CAAA;CAAE,GACjF,OAAO,CAAC,6BAA6B,CAAC,CAsFxC;AAED,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,qBAAqB,EAC9B,SAAS,EAAE,SAAS,0BAA0B,EAAE,EAChD,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GACjF,OAAO,CAAC,iCAAiC,CAAC,CAyE5C;AAED,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,GACpB,6BAA6B,CAM/B;AAED,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,6BAA6B,EAAE,CAO9F;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,6BAA6B,GACrC,IAAI,CAGN;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,6BAA6B,GAAG,SAAS,CAMhG;AA0cD,qBAAa,uBAAwB,SAAQ,KAAK;IAE9C,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAKlB"}

package/dist/core/storage/maintenance.js

@@ -3,6 +3,7 @@ import { appendFileSync, closeSync, existsSync, fsyncSync, lstatSync, mkdirSync,
 import { basename, dirname, join, resolve } from "node:path";
 import { acquireNoClobberLease } from "../workflow/workspaces/leases.js";
 import { HARNERY_STRUCTURED_LOG_PROVIDER_ID, } from "./contract.js";
+import { stateDirMode, stateFileMode } from "./modes.js";
 export const HARNERY_MAINTENANCE_TRANSACTION_SCHEMA = "harnery.storage-maintenance-transaction/v1";
 export const HARNERY_MAINTENANCE_RECEIPT_SCHEMA = "harnery.storage-maintenance-receipt/v1";
 export const HARNERY_MAINTENANCE_CURSOR_SCHEMA = "harnery.storage-maintenance-cursor/v1";
@@ -413,7 +414,7 @@ function writeReceipt(coordRoot, transactionId, action, mutation, now) {
         committed_at: now.toISOString(),
     };
     const path = receiptPath(coordRoot, transactionId, action.action_id);
-    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    mkdirSync(dirname(path), { recursive: true, mode: stateDirMode() });
     writeExclusiveDurable(path, `${JSON.stringify(receipt, null, 2)}\n`);
 }
 function writeTransaction(coordRoot, transaction, replace) {
@@ -434,12 +435,12 @@ function updateTransaction(transaction, now, state, reasonCodes = transaction.re
 }
 function writeRunOutcome(coordRoot, transaction, now) {
     const root = join(resolve(coordRoot), ".harnery", "logs", "storage-maintenance");
-    mkdirSync(root, { recursive: true, mode: 0o700 });
+    mkdirSync(root, { recursive: true, mode: stateDirMode() });
     const active = join(root, "active.jsonl");
     if (existsSync(active) && statSync(active).size > 1_048_576) {
         renameSync(active, join(root, `sealed-${now.toISOString().replaceAll(/[:.]/g, "-")}.jsonl`));
     }
-    appendFileSync(active, `${JSON.stringify({ ts: now.toISOString(), transaction_id: transaction.transaction_id, state: transaction.state, actions: transaction.actions.length, files: transaction.actions.reduce((n, action) => n + action.files, 0), bytes: transaction.actions.reduce((n, action) => n + action.bytes, 0), reason_codes: transaction.reason_codes })}\n`, { encoding: "utf8", mode: 0o600 });
+    appendFileSync(active, `${JSON.stringify({ ts: now.toISOString(), transaction_id: transaction.transaction_id, state: transaction.state, actions: transaction.actions.length, files: transaction.actions.reduce((n, action) => n + action.files, 0), bytes: transaction.actions.reduce((n, action) => n + action.bytes, 0), reason_codes: transaction.reason_codes })}\n`, { encoding: "utf8", mode: stateFileMode() });
 }
 function readDailyCursor(coordRoot) {
     const path = join(resolve(coordRoot), ".harnery", "maintenance", "cursors", "daily.json");
@@ -554,9 +555,9 @@ function readJsonFile(path) {
     return JSON.parse(readFileSync(path, "utf8"));
 }
 function atomicJson(path, value, fsync) {
-    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    mkdirSync(dirname(path), { recursive: true, mode: stateDirMode() });
     const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
-    const fd = openSync(temporary, "wx", 0o600);
+    const fd = openSync(temporary, "wx", stateFileMode());
     try {
         writeFileSync(fd, `${JSON.stringify(value, null, 2)}\n`, "utf8");
         if (fsync)
@@ -568,7 +569,7 @@ function atomicJson(path, value, fsync) {
     renameSync(temporary, path);
 }
 function writeExclusiveDurable(path, value) {
-    const fd = openSync(path, "wx", 0o600);
+    const fd = openSync(path, "wx", stateFileMode());
     try {
         writeFileSync(fd, value, "utf8");
         fsyncSync(fd);

package/dist/core/storage/metrics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../../src/core/storage/metrics.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,wBAAwB,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,EAAE;QACR,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,EAAE,MAAM,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,KAAK,CAAC,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC;CACzC;AAID,qBAAa,qBAAqB;;IAIhC,SAAS,CAAC,CAAC,SAAS,MAAM,sBAAsB,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,SAAI,GAAG,IAAI;IAO3E,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,SAAI,GAAG,IAAI;IAMzC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI;IAUnE,cAAc,CAAC,IAAI,EAAE,mBAAmB,GAAG,kBAAkB,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAI1F,IAAI,IAAI,sBAAsB;CAM/B;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,sBAAsB,EAC7B,GAAG,OAAa,GACf;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAA;CAAE,CAqBhD;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAOhF"}
+{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../../src/core/storage/metrics.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,wBAAwB,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,EAAE;QACR,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,EAAE,MAAM,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,KAAK,CAAC,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC;CACzC;AAID,qBAAa,qBAAqB;;IAIhC,SAAS,CAAC,CAAC,SAAS,MAAM,sBAAsB,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,SAAI,GAAG,IAAI;IAO3E,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,SAAI,GAAG,IAAI;IAMzC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI;IAUnE,cAAc,CAAC,IAAI,EAAE,mBAAmB,GAAG,kBAAkB,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAI1F,IAAI,IAAI,sBAAsB;CAM/B;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,sBAAsB,EAC7B,GAAG,OAAa,GACf;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAA;CAAE,CAwBhD;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAOhF"}

package/dist/core/storage/metrics.js

@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { stateFileMode } from "./modes.js";
 const HISTOGRAM_BUCKETS = [1, 2, 5, 10, 25, 50, 100, 250, 500, 1_000, 5_000];
 export class LogMetricsAccumulator {
     #delta = {};
@@ -54,7 +55,10 @@ export function mergeMetricsSidecar(path, delta, now = new Date()) {
     const merged = mergeMetrics(current, delta, now);
     const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
     try {
-        writeFileSync(temporary, `${JSON.stringify(merged)}\n`, { encoding: "utf8", mode: 0o600 });
+        writeFileSync(temporary, `${JSON.stringify(merged)}\n`, {
+            encoding: "utf8",
+            mode: stateFileMode(),
+        });
         renameSync(temporary, path);
         return { merged: true, generation_reset: generationReset };
     }

package/dist/core/storage/modes.d.ts

@@ -0,0 +1,17 @@
+/** The sharing mode for this process, resolved once. Tests reset it with `resetStorageSharing`. */
+export declare function stateSharing(): "private" | "group";
+export declare function resetStorageSharing(): void;
+/**
+ * Mode for a directory of project state. Group mode includes setgid: Harnery chmods directories
+ * after creating them, and a plain 0770 would clear the bit, so files made inside would take the
+ * writer's own group instead of the project's, and other users could not read them.
+ */
+export declare function stateDirMode(): number;
+/** Mode for a file of project state. */
+export declare function stateFileMode(): number;
+/**
+ * True when a state file or directory is readable or writable by someone it should not be: anyone
+ * but the owner in private mode, anyone outside the owner and group in group mode.
+ */
+export declare function stateModeTooOpen(mode: number): boolean;
+//# sourceMappingURL=modes.d.ts.map

package/dist/core/storage/modes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"modes.d.ts","sourceRoot":"","sources":["../../../src/core/storage/modes.ts"],"names":[],"mappings":"AAgBA,mGAAmG;AACnG,wBAAgB,YAAY,IAAI,SAAS,GAAG,OAAO,CASlD;AAED,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,wCAAwC;AACxC,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD"}

package/dist/core/storage/modes.js

@@ -0,0 +1,47 @@
+/**
+ * The permission modes for everything Harnery writes as project state under `.harnery/`.
+ *
+ * `private` (the default) is owner-only: 0700 directories and 0600 files, exactly as before this
+ * module existed. `group` is for a project several Unix users share through one group, such as a
+ * workspace that several people's agents work in at once: 2770 (setgid) and 0660, with nothing ever granted
+ * to other users. Every state write takes its mode from here, and every integrity check that
+ * rejects a loosely permissioned file asks `stateModeTooOpen`, so the two cannot disagree.
+ *
+ * Personal state outside the project (browser cookies, sessions, pacing ledgers in the user's home)
+ * is not project state and stays owner-only regardless.
+ */
+import { storageSharing } from "../config.js";
+let resolved;
+/** The sharing mode for this process, resolved once. Tests reset it with `resetStorageSharing`. */
+export function stateSharing() {
+    if (resolved === undefined) {
+        resolved = storageSharing();
+        // A umask that strips group bits would quietly turn every group file back into an owner-only
+        // one, and the next user's write would fail. Keep the process's other-bits mask as it was.
+        if (resolved === "group" && typeof process.umask === "function")
+            process.umask(process.umask() & ~0o070);
+    }
+    return resolved;
+}
+export function resetStorageSharing() {
+    resolved = undefined;
+}
+/**
+ * Mode for a directory of project state. Group mode includes setgid: Harnery chmods directories
+ * after creating them, and a plain 0770 would clear the bit, so files made inside would take the
+ * writer's own group instead of the project's, and other users could not read them.
+ */
+export function stateDirMode() {
+    return stateSharing() === "group" ? 0o2770 : 0o700;
+}
+/** Mode for a file of project state. */
+export function stateFileMode() {
+    return stateSharing() === "group" ? 0o660 : 0o600;
+}
+/**
+ * True when a state file or directory is readable or writable by someone it should not be: anyone
+ * but the owner in private mode, anyone outside the owner and group in group mode.
+ */
+export function stateModeTooOpen(mode) {
+    return (mode & (stateSharing() === "group" ? 0o007 : 0o077)) !== 0;
+}

package/dist/core/storage/process-log.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-log.d.ts","sourceRoot":"","sources":["../../../src/core/storage/process-log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAoB,MAAM,oBAAoB,CAAC;AAgBzE,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,4BAA4B;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAKD,kFAAkF;AAClF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,MAAM,CAcnF;AAED,qBAAa,gBAAgB;;gBAIf,OAAO,EAAE,uBAAuB;IAa5C,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAuB1B,eAAe,IAAI,IAAI;IAKvB,KAAK,IAAI,IAAI;IACb,KAAK,IAAI,IAAI;CAWd;AAED,6FAA6F;AAC7F,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,sBAAsB,GAAG,YAAY,CAqBlF;AAED,mFAAmF;AACnF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,sBAAsB,GAAG,MAAM,GAAG,IAAI,CAgBrF"}
+{"version":3,"file":"process-log.d.ts","sourceRoot":"","sources":["../../../src/core/storage/process-log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAoB,MAAM,oBAAoB,CAAC;AAiBzE,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,4BAA4B;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAKD,kFAAkF;AAClF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,MAAM,CAcnF;AAED,qBAAa,gBAAgB;;gBAIf,OAAO,EAAE,uBAAuB;IAa5C,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAuB1B,eAAe,IAAI,IAAI;IAKvB,KAAK,IAAI,IAAI;IACb,KAAK,IAAI,IAAI;CAWd;AAED,6FAA6F;AAC7F,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,sBAAsB,GAAG,YAAY,CAqBlF;AAED,mFAAmF;AACnF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,sBAAsB,GAAG,MAAM,GAAG,IAAI,CAgBrF"}

package/dist/core/storage/process-log.js

@@ -3,6 +3,7 @@ import { closeSync, existsSync, fdatasyncSync, mkdirSync, openSync, renameSync,
 import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createStorageCatalog } from "./catalog.js";
+import { stateDirMode, stateFileMode } from "./modes.js";
 import { familyLogDirectory } from "./segments.js";
 const DEFAULT_PROCESS_LOG_BYTES = 5 * 1024 * 1024;
 const DEFAULT_PROCESS_LOG_BACKUPS = 3;
@@ -40,7 +41,7 @@ export class RotatingTextSink {
         if (this.#closed)
             throw new Error("text sink is closed");
         const bytes = Buffer.from(text, "utf8");
-        mkdirSync(dirname(this.#options.path), { recursive: true, mode: 0o700 });
+        mkdirSync(dirname(this.#options.path), { recursive: true, mode: stateDirMode() });
         let offset = 0;
         while (offset < bytes.byteLength) {
             let current = existsSync(this.#options.path) ? statSync(this.#options.path).size : 0;
@@ -49,7 +50,7 @@ export class RotatingTextSink {
                 current = 0;
             }
             const length = Math.min(bytes.byteLength - offset, this.#options.max_bytes - current);
-            const fd = openSync(this.#options.path, "a", 0o600);
+            const fd = openSync(this.#options.path, "a", stateFileMode());
             try {
                 writeSync(fd, bytes.subarray(offset, offset + length));
                 if (this.#options.durable)

package/dist/core/storage/receipts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"receipts.d.ts","sourceRoot":"","sources":["../../../src/core/storage/receipts.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,uCAAuC,EAClD,gDAAyD,CAAC;AAE5D,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,OAAO,uCAAuC,CAAC;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACtB,GACL,+BAA+B,GAAG,SAAS,CAyD7C"}
+{"version":3,"file":"receipts.d.ts","sourceRoot":"","sources":["../../../src/core/storage/receipts.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,uCAAuC,EAClD,gDAAyD,CAAC;AAE5D,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,OAAO,uCAAuC,CAAC;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACtB,GACL,+BAA+B,GAAG,SAAS,CAyD7C"}

package/dist/core/storage/receipts.js

@@ -2,6 +2,7 @@ import { createHash, randomUUID } from "node:crypto";
 import { closeSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
 import { dirname, join, relative, resolve, sep } from "node:path";
 import { HARNERY_MAINTENANCE_RECEIPT_SCHEMA, HarneryMaintenanceError, } from "./maintenance.js";
+import { stateDirMode, stateFileMode } from "./modes.js";
 export const HARNERY_RECEIPT_SEGMENT_MANIFEST_SCHEMA = "harnery.storage-maintenance-receipt-segment/v1";
 /**
  * Losslessly packs immutable maintenance receipts. The default is a pure plan;
@@ -45,7 +46,7 @@ export function consolidateMutationReceipts(coordRoot, options = {}) {
         throw new HarneryMaintenanceError("confirmation_required", "receipt replacement requires an exact consolidation id and --yes");
     }
     const segments = join(root, "segments");
-    mkdirSync(segments, { recursive: true, mode: 0o700 });
+    mkdirSync(segments, { recursive: true, mode: stateDirMode() });
     const payloadPath = join(segments, `${segmentId}.jsonl`);
     const manifestPath = join(segments, `${segmentId}.manifest.json`);
     writeExclusiveDurable(payloadPath, payload);
@@ -98,9 +99,9 @@ function readReceipt(path) {
     return { path, bytes: bytes.byteLength, digest: sha256(bytes), receipt };
 }
 function writeExclusiveDurable(path, bytes) {
-    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    mkdirSync(dirname(path), { recursive: true, mode: stateDirMode() });
     const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
-    const fd = openSync(temporary, "wx", 0o600);
+    const fd = openSync(temporary, "wx", stateFileMode());
     try {
         writeFileSync(fd, bytes, "utf8");
         fsyncSync(fd);

package/dist/core/storage/segments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"segments.d.ts","sourceRoot":"","sources":["../../../src/core/storage/segments.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,eAAe,CAAC;AAEpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAG3D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,yBAAyB,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,8BAA8B,CAAC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,oBAAoB,EAAE,MAAM,CAAC;IAC7B,iEAAiE;IACjE,uBAAuB,EAAE,MAAM,CAAC;IAChC,2EAA2E;IAC3E,6BAA6B,EAAE,MAAM,CAAC;IACtC,6EAA6E;IAC7E,2BAA2B,EAAE,MAAM,CAAC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,qBAAqB,CAAC,EAAE,MAAM,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,8BAA8B,CAAC;IACvC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED,MAAM,MAAM,gBAAgB,GAAG,CAC7B,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,KACX,MAAM,CAAC;AAEZ,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACjB;AAcD,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,eAAe;gBAAlD,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,eAAe,EAC3D,OAAO,EAAE,MAAM;CAKlB;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,8BAA8B,GAAG,MAAM,CAMjF;AAED,qBAAa,eAAe;;gBAGd,OAAO,EAAE,oBAAoB;IAmBnC,MAAM,CACV,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,GAAE,sBAA2B,EACpC,OAAO,UAAQ,EACf,GAAG,OAAa,GACf,OAAO,CAAC,mBAAmB,CAAC;CA4ChC;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,8BAA8B,GACtC,oBAAoB,CAyCtB;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,CAE7E;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,SAAS,GAAG,iBAAiB,CAAC,CAuExC;AAED,wBAAsB,eAAe,CAAC,CAAC,EACrC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE;IAAE,gBAAgB,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,EACpF,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAC9B,OAAO,CAAC,CAAC,CAAC,CAkCZ"}
+{"version":3,"file":"segments.d.ts","sourceRoot":"","sources":["../../../src/core/storage/segments.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,eAAe,CAAC;AAEpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAI3D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,yBAAyB,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,8BAA8B,CAAC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,oBAAoB,EAAE,MAAM,CAAC;IAC7B,iEAAiE;IACjE,uBAAuB,EAAE,MAAM,CAAC;IAChC,2EAA2E;IAC3E,6BAA6B,EAAE,MAAM,CAAC;IACtC,6EAA6E;IAC7E,2BAA2B,EAAE,MAAM,CAAC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,qBAAqB,CAAC,EAAE,MAAM,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,8BAA8B,CAAC;IACvC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED,MAAM,MAAM,gBAAgB,GAAG,CAC7B,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,KACX,MAAM,CAAC;AAEZ,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACjB;AAcD,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,eAAe;gBAAlD,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,eAAe,EAC3D,OAAO,EAAE,MAAM;CAKlB;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,8BAA8B,GAAG,MAAM,CAMjF;AAED,qBAAa,eAAe;;gBAGd,OAAO,EAAE,oBAAoB;IAmBnC,MAAM,CACV,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,GAAE,sBAA2B,EACpC,OAAO,UAAQ,EACf,GAAG,OAAa,GACf,OAAO,CAAC,mBAAmB,CAAC;CA4ChC;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,8BAA8B,GACtC,oBAAoB,CAyCtB;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,CAE7E;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,SAAS,GAAG,iBAAiB,CAAC,CAuExC;AAED,wBAAsB,eAAe,CAAC,CAAC,EACrC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE;IAAE,gBAAgB,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,EACpF,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAC9B,OAAO,CAAC,CAAC,CAAC,CAkCZ"}

package/dist/core/storage/segments.js

@@ -4,6 +4,7 @@ import { basename, dirname, isAbsolute, join, relative } from "node:path";
 import { gzipSync } from "node:zlib";
 import { parseLogRecord } from "./jsonl.js";
 import { mergeMetricsSidecar } from "./metrics.js";
+import { stateDirMode, stateFileMode } from "./modes.js";
 export class HarneryLogLeaseError extends Error {
     reason;
     constructor(reason, message) {
@@ -46,7 +47,7 @@ export class FileSegmentSink {
                 rotated = true;
             }
             rejectExistingSymlink(active);
-            const fd = openSync(active, fsConstants.O_RDWR | fsConstants.O_APPEND | fsConstants.O_CREAT | noFollowFlag(), 0o600);
+            const fd = openSync(active, fsConstants.O_RDWR | fsConstants.O_APPEND | fsConstants.O_CREAT | noFollowFlag(), stateFileMode());
             let bytes = 0;
             try {
                 assertOpenFileIdentity(active, fd, directory);
@@ -190,7 +191,7 @@ export async function withFamilyLease(directory, policy, operation) {
     let owner;
     while (true) {
         try {
-            mkdirSync(lease, { mode: 0o700 });
+            mkdirSync(lease, { mode: stateDirMode() });
             const leaseIdentity = captureDirectoryIdentity(lease);
             owner = {
                 owner_id: randomUUID(),
@@ -245,7 +246,7 @@ function sealActive(active, options, now) {
     const sequence = manifest.next_sequence;
     const name = `${now.toISOString().slice(0, 10).replaceAll("-", "")}-${String(sequence).padStart(8, "0")}.jsonl.gz`;
     const target = join(directory, "segments", name);
-    mkdirSync(dirname(target), { recursive: true, mode: 0o700 });
+    mkdirSync(dirname(target), { recursive: true, mode: stateDirMode() });
     const temporary = `${target}.tmp-${process.pid}-${randomUUID()}`;
     const compressed = gzipSync(content);
     writeNewFile(temporary, compressed);
@@ -273,7 +274,7 @@ function sealActive(active, options, now) {
         ],
     };
     const sealedManifest = join(directory, "manifests", `${String(sequence).padStart(8, "0")}.json`);
-    mkdirSync(dirname(sealedManifest), { recursive: true, mode: 0o700 });
+    mkdirSync(dirname(sealedManifest), { recursive: true, mode: stateDirMode() });
     writeNewFile(sealedManifest, Buffer.from(`${JSON.stringify(next)}\n`));
     atomicJson(join(directory, "manifest.json"), next);
     truncateRegularFile(active);
@@ -371,7 +372,7 @@ function processIsAlive(pid) {
     }
 }
 function ensurePrivateDirectory(path) {
-    mkdirSync(path, { recursive: true, mode: 0o700 });
+    mkdirSync(path, { recursive: true, mode: stateDirMode() });
     return captureDirectoryIdentity(path);
 }
 function captureDirectoryIdentity(path) {
@@ -458,7 +459,7 @@ function readRegularFile(path, maximumBytes) {
 }
 function writeNewFile(path, content) {
     const parent = captureDirectoryIdentity(dirname(path));
-    const fd = openSync(path, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollowFlag(), 0o600);
+    const fd = openSync(path, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollowFlag(), stateFileMode());
     try {
         assertOpenFileIdentity(path, fd, parent);
         writeAllSync(fd, content, nativeWriteSync);

package/dist/core/supervisor/hook-health.d.ts

@@ -1,3 +1,4 @@
+import { type EventAdapterIdV3 } from "../events/v3/adapter-id.js";
 import { type HookHealthOutcome } from "../hooks/health.js";
 import type { HarneryLogRecordV1 } from "../storage/jsonl.js";
 import type { SupervisorLogFeed } from "./contract.js";
@@ -12,7 +13,7 @@ export interface CompletedHookHealth {
     id: string;
     observed_at: string;
     hook_name: string;
-    adapter: "claude-code" | "codex" | "cursor" | "unknown";
+    adapter: EventAdapterIdV3 | "unknown";
     outcome: HookHealthOutcome;
     duration_ms: number;
     rss_start_bytes: number;

package/dist/core/supervisor/hook-health.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hook-health.d.ts","sourceRoot":"","sources":["../../../src/core/supervisor/hook-health.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD,eAAO,MAAM,qCAAqC,EAAG,CAAU,CAAC;AAChE,eAAO,MAAM,mCAAmC,KAAK,CAAC;AACtD,eAAO,MAAM,sCAAsC,KAAK,CAAC;AACzD,eAAO,MAAM,iCAAiC,QAAS,CAAC;AACxD,eAAO,MAAM,wCAAwC,QAAoB,CAAC;AAC1E,eAAO,MAAM,mCAAmC,IAAI,CAAC;AACrD,eAAO,MAAM,uCAAuC,QAAa,CAAC;AAElE,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,aAAa,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;IACxD,OAAO,EAAE,iBAAiB,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACxC,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,OAAO,qCAAqC,CAAC;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE;QACV,WAAW,EAAE,mBAAmB,CAAC;QACjC,KAAK,EAAE,WAAW,GAAG,SAAS,GAAG,aAAa,CAAC;QAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE;QACP,gBAAgB,EAAE,MAAM,CAAC;QACzB,cAAc,EAAE,MAAM,CAAC;QACvB,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;QACnB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,UAAU,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC3C,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACxC;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,OAAa,GAAG,oBAAoB,CAiDjG;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,kBAAkB,GACzB,mBAAmB,GAAG,SAAS,CA2DjC"}
+{"version":3,"file":"hook-health.d.ts","sourceRoot":"","sources":["../../../src/core/supervisor/hook-health.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,gBAAgB,EAA6B,MAAM,4BAA4B,CAAC;AAC9F,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD,eAAO,MAAM,qCAAqC,EAAG,CAAU,CAAC;AAChE,eAAO,MAAM,mCAAmC,KAAK,CAAC;AACtD,eAAO,MAAM,sCAAsC,KAAK,CAAC;AACzD,eAAO,MAAM,iCAAiC,QAAS,CAAC;AACxD,eAAO,MAAM,wCAAwC,QAAoB,CAAC;AAC1E,eAAO,MAAM,mCAAmC,IAAI,CAAC;AACrD,eAAO,MAAM,uCAAuC,QAAa,CAAC;AAElE,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACtC,OAAO,EAAE,iBAAiB,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACxC,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,OAAO,qCAAqC,CAAC;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE;QACV,WAAW,EAAE,mBAAmB,CAAC;QACjC,KAAK,EAAE,WAAW,GAAG,SAAS,GAAG,aAAa,CAAC;QAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE;QACP,gBAAgB,EAAE,MAAM,CAAC;QACzB,cAAc,EAAE,MAAM,CAAC;QACvB,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;QACnB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,UAAU,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC3C,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACxC;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,OAAa,GAAG,oBAAoB,CAiDjG;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,kBAAkB,GACzB,mBAAmB,GAAG,SAAS,CA2DjC"}

package/dist/core/supervisor/hook-health.js

@@ -1,3 +1,4 @@
+import { normalizeEventAdapterIdV3 } from "../events/v3/adapter-id.js";
 import { HOOK_HEALTH_EVENT, HOOK_HEALTH_RECEIPT_VERSION, } from "../hooks/health.js";
 export const SUPERVISOR_HOOK_HEALTH_SCHEMA_VERSION = 1;
 export const SUPERVISOR_HOOK_HEALTH_RECENT_LIMIT = 50;
@@ -177,9 +178,9 @@ function token(value) {
         : undefined;
 }
 function adapterValue(value) {
-    return value === "claude-code" || value === "codex" || value === "cursor" || value === "unknown"
-        ? value
-        : undefined;
+    if (value === "unknown")
+        return value;
+    return normalizeEventAdapterIdV3(value) ?? undefined;
 }
 function outcomeValue(value) {
     return value === "completed" || value === "skipped" || value === "degraded" || value === "faulted"

package/dist/core/supervisor/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/core/supervisor/service.ts"],"names":[],"mappings":"AA+BA,OAAO,EAML,KAAK,6BAA6B,EAElC,KAAK,gBAAgB,EACtB,MAAM,eAAe,CAAC;AAsBvB,eAAO,MAAM,8BAA8B,OAAQ,CAAC;AACpD,eAAO,MAAM,+BAA+B,QAAa,CAAC;AAe1D,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,KAAK,EAAE,SAAS,GAAG,SAAS,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAC1D;IAAE,KAAK,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtE,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9E,OAAO,CAAC,gBAAgB,CAAC,CAwD3B;AAED,wBAAsB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAahG;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,gBAAgB,CAiB5E;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,6BAA6B,CAAC,CAyQxC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/core/supervisor/service.ts"],"names":[],"mappings":"AAgCA,OAAO,EAML,KAAK,6BAA6B,EAElC,KAAK,gBAAgB,EACtB,MAAM,eAAe,CAAC;AAsBvB,eAAO,MAAM,8BAA8B,OAAQ,CAAC;AACpD,eAAO,MAAM,+BAA+B,QAAa,CAAC;AAe1D,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,KAAK,EAAE,SAAS,GAAG,SAAS,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAC1D;IAAE,KAAK,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtE,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9E,OAAO,CAAC,gBAAgB,CAAC,CAwD3B;AAED,wBAAsB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAahG;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,gBAAgB,CAiB5E;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,6BAA6B,CAAC,CAyQxC"}

package/dist/core/supervisor/service.js

@@ -17,6 +17,7 @@ import { readResourceServiceStatus } from "../resources/service-status.js";
 import { resourcePaths } from "../resources/storage.js";
 import { writePrivateJsonAtomic } from "../storage/atomic-json.js";
 import { closeProcessLoggers, legacyLogFields, processLogger } from "../storage/logger.js";
+import { stateDirMode, stateFileMode } from "../storage/modes.js";
 import { collectSupervisorActivitySnapshot } from "./activity.js";
 import { SUPERVISOR_PRESSURE_SCHEMA_VERSION, SUPERVISOR_SNAPSHOT_SCHEMA_VERSION, SUPERVISOR_STATUS_SCHEMA_VERSION, } from "./contract.js";
 import { explainSupervisorFinding } from "./explanations.js";
@@ -47,7 +48,7 @@ export async function spawnSupervisor(coordRootRaw, options = {}) {
     const intervalMs = normalizeInterval(options.intervalMs);
     const idleExitMs = normalizeIdleExit(options.idleExitMs);
     const paths = supervisorPaths(coordRoot);
-    mkdirSync(paths.root, { recursive: true, mode: 0o700 });
+    mkdirSync(paths.root, { recursive: true, mode: stateDirMode() });
     rmSync(paths.stop, { force: true });
     const cliPath = fileURLToPath(new URL(import.meta.url.endsWith(".ts") ? "../../cli.ts" : "../../cli.js", import.meta.url));
     if (!existsSync(cliPath))
@@ -112,7 +113,7 @@ export function requestSupervisorStop(coordRootRaw) {
     const coordRoot = resolve(coordRootRaw);
     const paths = supervisorPaths(coordRoot);
     const status = readSupervisorStatus(coordRoot);
-    mkdirSync(paths.root, { recursive: true, mode: 0o700 });
+    mkdirSync(paths.root, { recursive: true, mode: stateDirMode() });
     writePrivateJsonAtomic(paths.stop, {
         requested_at: new Date().toISOString(),
         requested_by_pid: process.pid,
@@ -294,8 +295,8 @@ export async function runSupervisor(input) {
                     });
                 }
                 pressureHysteresis = assessment.hysteresis;
-                mkdirSync(paths.timelines, { recursive: true, mode: 0o700 });
-                mkdirSync(paths.explanations, { recursive: true, mode: 0o700 });
+                mkdirSync(paths.timelines, { recursive: true, mode: stateDirMode() });
+                mkdirSync(paths.explanations, { recursive: true, mode: stateDirMode() });
                 const projectionUpdates = [
                     ...findings.active.filter((finding) => !priorActiveFindingIds.has(finding.id)),
                     ...findings.transitions.filter((finding) => !priorTransitionKeys.has(`${finding.id}:${finding.state}`)),
@@ -426,7 +427,7 @@ function observeLedgerControlState(coordRoot, now) {
 }
 function acquireLease(coordRoot, now) {
     const paths = supervisorPaths(coordRoot);
-    mkdirSync(paths.root, { recursive: true, mode: 0o700 });
+    mkdirSync(paths.root, { recursive: true, mode: stateDirMode() });
     for (let attempt = 0; attempt < 2; attempt++) {
         const startToken = processStartToken(process.pid);
         const lease = {
@@ -437,7 +438,7 @@ function acquireLease(coordRoot, now) {
             created_at: now.toISOString(),
         };
         try {
-            const fd = openSync(paths.lease, "wx", 0o600);
+            const fd = openSync(paths.lease, "wx", stateFileMode());
             try {
                 writeFileSync(fd, `${JSON.stringify(lease)}\n`, "utf8");
             }

package/dist/core/work/state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../../src/core/work/state.ts"],"names":[],"mappings":"AA0BA,eAAO,MAAM,0BAA0B,EAAG,CAAU,CAAC;AACrD,eAAO,MAAM,yBAAyB,EAAG,CAAU,CAAC;AAwBpD,MAAM,MAAM,SAAS,GACjB,SAAS,GACT,OAAO,GACP,SAAS,GACT,mBAAmB,GACnB,WAAW,GACX,SAAS,GACT,WAAW,GACX,WAAW,CAAC;AAEhB,MAAM,MAAM,cAAc,GACtB,uBAAuB,GACvB,KAAK,GACL,cAAc,GACd,kBAAkB,GAClB,QAAQ,GACR,OAAO,GACP,QAAQ,GACR,MAAM,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,OAAO,CAAC;AAErD,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,OAAO,0BAA0B,CAAC;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB;;;0DAGsD;IACtD,sBAAsB,EAAE,MAAM,CAAC;IAC/B,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,iBAAiB,GACjB,iBAAiB,GACjB,iBAAiB,GACjB,eAAe,GACf,gBAAgB,GAChB,eAAe,CAAC;AAEpB,MAAM,WAAW,SAAS;IACxB,cAAc,EAAE,OAAO,yBAAyB,CAAC;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,aAAa,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B;gFAC4E;IAC5E,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACjC,mEAAmE;IACnE,YAAY,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACxC,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,WAAW,CAAC,EAAE,cAAc,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,GAAG,UAAU,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,GAAG,MAAM,GAAG,uBAAuB,CAAC;IACzF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;4EAEwE;IACxE,SAAS,CAAC,EAAE,aAAa,GAAG,UAAU,GAAG,UAAU,CAAC;IACpD;6EACyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,cAAc,CAAC;IAC5B,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB;gEAC4D;IAC5D,aAAa,EAAE,MAAM,CAAC;IACtB;;6DAEyD;IACzD,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;0DAGsD;IACtD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,UAAU,CAmErE;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAI1E;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,EAAE,CAE7D;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,CAmB3E;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,CAmC/F;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE,CAIrF;AAED,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE;IACL,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,YAAY,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;CAC7C,GACL,UAAU,CAEZ;AAED,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9C,UAAU,CAQZ;AAED,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAO,GAC5E,UAAU,CAQZ;AAED;+DAC+D;AAC/D,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,mBAAmB,EAAE,CAAA;CAAE,CAepD;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAEjD;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAwfD,kEAAkE;AAClE,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,MAAM,GACZ,IAAI,CA4BN;AAED,kEAAkE;AAClE,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,GAAG,KAAK,GAAG,IAAI,CAAC,GAClE,SAAS,CAOX;AA+DD,kEAAkE;AAClE,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAIvF;AAuJD,kEAAkE;AAClE,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAMhE;AAkBD,kEAAkE;AAClE,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,CAE9E;AAED,+CAA+C;AAC/C,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,CAOnF;AAiKD,kEAAkE;AAClE,wBAAgB,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,SAAa,GAAG,MAAM,CAE1E"}
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../../src/core/work/state.ts"],"names":[],"mappings":"AA2BA,eAAO,MAAM,0BAA0B,EAAG,CAAU,CAAC;AACrD,eAAO,MAAM,yBAAyB,EAAG,CAAU,CAAC;AAwBpD,MAAM,MAAM,SAAS,GACjB,SAAS,GACT,OAAO,GACP,SAAS,GACT,mBAAmB,GACnB,WAAW,GACX,SAAS,GACT,WAAW,GACX,WAAW,CAAC;AAEhB,MAAM,MAAM,cAAc,GACtB,uBAAuB,GACvB,KAAK,GACL,cAAc,GACd,kBAAkB,GAClB,QAAQ,GACR,OAAO,GACP,QAAQ,GACR,MAAM,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,OAAO,CAAC;AAErD,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,OAAO,0BAA0B,CAAC;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB;;;0DAGsD;IACtD,sBAAsB,EAAE,MAAM,CAAC;IAC/B,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,iBAAiB,GACjB,iBAAiB,GACjB,iBAAiB,GACjB,eAAe,GACf,gBAAgB,GAChB,eAAe,CAAC;AAEpB,MAAM,WAAW,SAAS;IACxB,cAAc,EAAE,OAAO,yBAAyB,CAAC;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,aAAa,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B;gFAC4E;IAC5E,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACjC,mEAAmE;IACnE,YAAY,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACxC,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,WAAW,CAAC,EAAE,cAAc,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,GAAG,UAAU,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,GAAG,MAAM,GAAG,uBAAuB,CAAC;IACzF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;4EAEwE;IACxE,SAAS,CAAC,EAAE,aAAa,GAAG,UAAU,GAAG,UAAU,CAAC;IACpD;6EACyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,cAAc,CAAC;IAC5B,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB;gEAC4D;IAC5D,aAAa,EAAE,MAAM,CAAC;IACtB;;6DAEyD;IACzD,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;0DAGsD;IACtD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,UAAU,CAmErE;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAI1E;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,EAAE,CAE7D;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,CAmB3E;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,CAmC/F;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE,CAIrF;AAED,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE;IACL,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,YAAY,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;CAC7C,GACL,UAAU,CAEZ;AAED,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9C,UAAU,CAQZ;AAED,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAO,GAC5E,UAAU,CAQZ;AAED;+DAC+D;AAC/D,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,mBAAmB,EAAE,CAAA;CAAE,CAepD;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAEjD;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAwfD,kEAAkE;AAClE,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,MAAM,GACZ,IAAI,CA4BN;AAED,kEAAkE;AAClE,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,GAAG,KAAK,GAAG,IAAI,CAAC,GAClE,SAAS,CAOX;AA+DD,kEAAkE;AAClE,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAIvF;AAuJD,kEAAkE;AAClE,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAMhE;AAkBD,kEAAkE;AAClE,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,CAE9E;AAED,+CAA+C;AAC/C,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,CAOnF;AAiKD,kEAAkE;AAClE,wBAAgB,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,SAAa,GAAG,MAAM,CAE1E"}

package/dist/core/work/state.js

@@ -3,6 +3,7 @@ import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readdirSync, rea
 import { hostname } from "node:os";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import { appendSegmentedJsonlFile, readSegmentedJsonlFileSync, } from "../storage/durable-history.js";
+import { stateDirMode, stateFileMode } from "../storage/modes.js";
 import { readWorkflowApproval } from "../workflow/approvals.js";
 import { stableDigest } from "../workflow/durable-record.js";
 import { readWorkflowProof } from "../workflow/proof.js";
@@ -77,9 +78,9 @@ export function createWorkItem(input) {
         created_at: new Date().toISOString(),
     };
     const dir = workDir(coordRoot, id);
-    mkdirSync(dirname(dir), { recursive: true, mode: 0o700 });
-    mkdirSync(dir, { mode: 0o700 });
-    chmodSync(dir, 0o700);
+    mkdirSync(dirname(dir), { recursive: true, mode: stateDirMode() });
+    mkdirSync(dir, { mode: stateDirMode() });
+    chmodSync(dir, stateDirMode());
     writePrivateJson(join(dir, "intent.json"), intent, MAX_INTENT_BYTES);
     const release = acquireWorkLease(coordRoot, id);
     try {
@@ -897,14 +898,14 @@ function acquireWorkFileLease(coordRoot, workId, filename, activeMessage) {
     };
     const acquire = () => {
         try {
-            const fd = openSync(path, "wx", 0o600);
+            const fd = openSync(path, "wx", stateFileMode());
             try {
                 writeFileSync(fd, `${JSON.stringify(owner)}\n`, "utf8");
             }
             finally {
                 closeSync(fd);
             }
-            chmodSync(path, 0o600);
+            chmodSync(path, stateFileMode());
             return true;
         }
         catch (error) {
@@ -982,8 +983,8 @@ function writePrivateJson(path, value, maxBytes) {
     const body = `${JSON.stringify(value, null, 2)}\n`;
     if (Buffer.byteLength(body) > maxBytes)
         throw new Error(`private record exceeds ${maxBytes} bytes`);
-    writeFileSync(path, body, { encoding: "utf8", flag: "wx", mode: 0o600 });
-    chmodSync(path, 0o600);
+    writeFileSync(path, body, { encoding: "utf8", flag: "wx", mode: stateFileMode() });
+    chmodSync(path, stateFileMode());
 }
 function readBoundedLines(path, maxBytes, maxRecordBytes, field) {
     const size = statSync(path).size;