harnery 0.40.0 → 0.41.0

package/dist/core/events/v3/support-storage/pack-reader.js

@@ -4,6 +4,7 @@ import { lstat, mkdir, open, realpath, rm, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
 import { StringDecoder } from "node:string_decoder";
 import { createGunzip, createInflateRaw } from "node:zlib";
+import { stateDirMode, stateFileMode } from "../../../storage/modes.js";
 import { logicalEntriesDigestV3, validateEventV3SupportPackManifest, validateEventV3SupportPackRecord, } from "./pack-contract.js";
 const DEFAULT_LIMITS = {
     max_manifest_bytes: 1024 * 1024,
@@ -155,7 +156,7 @@ export async function unpackEventV3SupportPack(manifestPath, destination, limits
         if (error.code !== "ENOENT")
             throw error;
     }
-    await mkdir(target, { recursive: false, mode: 0o700 });
+    await mkdir(target, { recursive: false, mode: stateDirMode() });
     let files = 0;
     let bytes = 0;
     try {
@@ -163,8 +164,8 @@ export async function unpackEventV3SupportPack(manifestPath, destination, limits
             const path = resolve(target, ...record.path.split("/"));
             if (relative(target, path).startsWith(".."))
                 throw new Error("event_v3_support_unpack_path_escape");
-            await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-            await writeFile(path, record.content, { flag: "wx", mode: 0o600 });
+            await mkdir(dirname(path), { recursive: true, mode: stateDirMode() });
+            await writeFile(path, record.content, { flag: "wx", mode: stateFileMode() });
             files += 1;
             bytes += record.bytes;
         }

package/dist/core/events/v3/support-storage/pack-writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pack-writer.d.ts","sourceRoot":"","sources":["../../../../../src/core/events/v3/support-storage/pack-writer.ts"],"names":[],"mappings":"AAQA,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,8BAA8B,EAIpC,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,UAAU,MAAM,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,4BAA4B;IAC3C,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,8BAA8B,CAAC;IAClD,uBAAuB,CAAC,EAAE,UAAU,MAAM,EAAE,CAAC;IAC7C,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACpC,uBAAuB,EAAE,MAAM,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,mCAAmC,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/E;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,0BAA0B,CAAC;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB;AAMD,iGAAiG;AACjG,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,yBAAyB,CAAC,CA2GpC"}
+{"version":3,"file":"pack-writer.d.ts","sourceRoot":"","sources":["../../../../../src/core/events/v3/support-storage/pack-writer.ts"],"names":[],"mappings":"AASA,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,8BAA8B,EAIpC,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,UAAU,MAAM,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,4BAA4B;IAC3C,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,8BAA8B,CAAC;IAClD,uBAAuB,CAAC,EAAE,UAAU,MAAM,EAAE,CAAC;IAC7C,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACpC,uBAAuB,EAAE,MAAM,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,mCAAmC,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/E;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,0BAA0B,CAAC;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB;AAMD,iGAAiG;AACjG,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,yBAAyB,CAAC,CA2GpC"}

package/dist/core/events/v3/support-storage/pack-writer.js

@@ -5,6 +5,7 @@ import { chmod, lstat, mkdir, open, realpath, rename, rm } from "node:fs/promise
 import { basename, isAbsolute, join, relative, resolve } from "node:path";
 import { pipeline } from "node:stream/promises";
 import { createGzip } from "node:zlib";
+import { stateDirMode, stateFileMode } from "../../../storage/modes.js";
 import { canonicalJsonV3 } from "../canonical.js";
 import { EVENT_V3_SUPPORT_FAMILIES, logicalEntriesDigestV3, normalizeEventV3SupportPath, validateEventV3SupportPackManifest, } from "./pack-contract.js";
 /** Write a deterministic gzip-NDJSON support pack without buffering source files or the pack. */
@@ -44,8 +45,8 @@ export async function writeEventV3SupportPack(input) {
         .digest("hex")
         .slice(0, 32)}`;
     const outputDirectory = resolve(input.output_directory);
-    await mkdir(outputDirectory, { recursive: true, mode: 0o700 });
-    await chmod(outputDirectory, 0o700);
+    await mkdir(outputDirectory, { recursive: true, mode: stateDirMode() });
+    await chmod(outputDirectory, stateDirMode());
     const payloadName = `${packId}.ndjson.gz`;
     const payloadPath = join(outputDirectory, payloadName);
     const manifestPath = join(outputDirectory, `${packId}.manifest.json`);
@@ -54,7 +55,7 @@ export async function writeEventV3SupportPack(input) {
     await rejectExisting([payloadPath, manifestPath, payloadPartial, manifestPartial]);
     try {
         await streamPayload(inspected, payloadPartial, authorityReal);
-        await chmod(payloadPartial, 0o600);
+        await chmod(payloadPartial, stateFileMode());
         await rename(payloadPartial, payloadPath);
         const payload = await inspectRegularFile(payloadPath);
         const manifest = validateEventV3SupportPackManifest({
@@ -88,7 +89,7 @@ export async function writeEventV3SupportPack(input) {
             minimum_harnery_version: input.minimum_harnery_version,
             created_at: input.created_at,
         });
-        const handle = await open(manifestPartial, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600);
+        const handle = await open(manifestPartial, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, stateFileMode());
         try {
             await handle.writeFile(`${canonicalJsonV3(manifest)}\n`, "utf8");
             await handle.sync();
@@ -109,7 +110,7 @@ export async function writeEventV3SupportPack(input) {
 }
 async function streamPayload(entries, destination, authorityReal) {
     const gzip = createGzip({ level: 9 });
-    const output = createWriteStream(destination, { flags: "wx", mode: 0o600 });
+    const output = createWriteStream(destination, { flags: "wx", mode: stateFileMode() });
     const completed = pipeline(gzip, output);
     try {
         for (const entry of entries) {

package/dist/core/events/v3/tool-line-changes.d.ts

@@ -0,0 +1,8 @@
+import type { ParsedPayload } from "../../hooks/adapter/parse.js";
+export interface LineChanges {
+    added: number;
+    removed: number;
+}
+/** Proposed edit counts, captured before execution; publish only on success. */
+export declare function prepareToolLineChanges(payload: ParsedPayload, cwd: string): LineChanges | undefined;
+//# sourceMappingURL=tool-line-changes.d.ts.map

package/dist/core/events/v3/tool-line-changes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-line-changes.d.ts","sourceRoot":"","sources":["../../../../src/core/events/v3/tool-line-changes.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAGlE,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAyDD,gFAAgF;AAChF,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,WAAW,GAAG,SAAS,CAmEzB"}

package/dist/core/events/v3/tool-line-changes.js

@@ -0,0 +1,135 @@
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { stateFileMode } from "../../storage/modes.js";
+// Unknown tools remain unmeasured: a shell, script, or connector can write files.
+const READ_TOOLS = new Set(["Read", "Glob", "Grep", "LS", "view_image"]);
+const MAX_BYTES = 2 * 1024 * 1024;
+function object(value) {
+    if (typeof value === "string") {
+        try {
+            return object(JSON.parse(value));
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function lineCount(text) {
+    return text === "" ? 0 : text.split("\n").length - (text.endsWith("\n") ? 1 : 0);
+}
+function readText(path) {
+    if (statSync(path).size > MAX_BYTES)
+        throw new Error("unmeasured file");
+    const bytes = readFileSync(path);
+    if (bytes.length > MAX_BYTES || bytes.includes(0))
+        throw new Error("unmeasured file");
+    return bytes.toString("utf8");
+}
+/** Use Git's line semantics without retaining file contents in producer state. */
+function compare(before, after) {
+    if (Buffer.byteLength(after) > MAX_BYTES || after.includes("\0"))
+        return;
+    if (before === after)
+        return { added: 0, removed: 0 };
+    const directory = mkdtempSync(join(tmpdir(), "harnery-lines-"));
+    try {
+        const oldPath = join(directory, "before");
+        const newPath = join(directory, "after");
+        writeFileSync(oldPath, before, { mode: stateFileMode() });
+        writeFileSync(newPath, after, { mode: stateFileMode() });
+        const result = spawnSync("git", ["diff", "--no-index", "--no-ext-diff", "--no-textconv", "--numstat", "--", oldPath, newPath], {
+            encoding: "utf8",
+            timeout: 2000,
+            maxBuffer: 4096,
+        });
+        if (result.status !== 0 && result.status !== 1)
+            return;
+        const match = /^(\d+)\t(\d+)\t/.exec(result.stdout);
+        return match ? { added: Number(match[1]), removed: Number(match[2]) } : undefined;
+    }
+    finally {
+        rmSync(directory, { recursive: true, force: true });
+    }
+}
+/** Proposed edit counts, captured before execution; publish only on success. */
+export function prepareToolLineChanges(payload, cwd) {
+    try {
+        const name = payload.tool_name ?? "";
+        if (READ_TOOLS.has(name))
+            return { added: 0, removed: 0 };
+        const input = object(payload.tool_input);
+        if (name === "apply_patch") {
+            const patch = typeof payload.tool_input === "string" && payload.tool_input.startsWith("*** Begin Patch")
+                ? payload.tool_input
+                : (input?.patch ?? input?.input ?? input?.command);
+            if (typeof patch !== "string" ||
+                !patch.startsWith("*** Begin Patch\n") ||
+                !patch.includes("*** End Patch"))
+                return;
+            let added = 0;
+            let removed = 0;
+            let inFile = false;
+            for (const line of patch.split("\n")) {
+                if (line.startsWith("*** Delete File: ")) {
+                    removed += lineCount(readText(resolve(cwd, line.slice(17))));
+                    inFile = false;
+                }
+                else if (/^\*\*\* (?:Add|Update) File: /.test(line)) {
+                    inFile = true;
+                }
+                else if (line === "*** End Patch") {
+                    inFile = false;
+                }
+                else if (inFile && line.startsWith("+"))
+                    added++;
+                else if (inFile && line.startsWith("-"))
+                    removed++;
+            }
+            return { added, removed };
+        }
+        if (!["Write", "Edit", "StrReplace", "MultiEdit"].includes(name) || !input)
+            return;
+        const path = input.file_path ?? input.path;
+        if (typeof path !== "string")
+            return;
+        let before;
+        try {
+            before = readText(resolve(cwd, path));
+        }
+        catch (error) {
+            if (name !== "Write" || error.code !== "ENOENT")
+                return;
+            before = "";
+        }
+        if (name === "Write")
+            return typeof input.content === "string" ? compare(before, input.content) : undefined;
+        let after = before;
+        const edits = name === "MultiEdit" ? input.edits : [input];
+        if (!Array.isArray(edits))
+            return;
+        for (const entry of edits) {
+            const edit = object(entry);
+            if (!edit ||
+                typeof edit.old_string !== "string" ||
+                typeof edit.new_string !== "string" ||
+                !edit.old_string)
+                return;
+            const occurrences = after.split(edit.old_string).length - 1;
+            if (occurrences === 0 || (occurrences > 1 && edit.replace_all !== true))
+                return;
+            after =
+                edit.replace_all === true
+                    ? after.split(edit.old_string).join(edit.new_string)
+                    : after.replace(edit.old_string, () => edit.new_string);
+        }
+        return compare(before, after);
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/core/events/v3/writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"writer.d.ts","sourceRoot":"","sources":["../../../../src/core/events/v3/writer.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAa7C,eAAO,MAAM,6BAA6B,EAAG,qBAA8B,CAAC;AAE5E,MAAM,MAAM,sBAAsB,GAAG,WAAW,GAAG,OAAO,CAAC;AAE3D,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,sBAAsB,GAAG,gBAAgB,CAAC;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,UAAU,MAAM,EAAE,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,kBAAkB,CAAC;CACtC;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,OAAO,MAAM,EAAE,CAAC;IACpC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7D;AAED,MAAM,MAAM,gBAAgB,GACxB,oBAAoB,GACpB,iBAAiB,GACjB,sBAAsB,GACtB,qBAAqB,GACrB,oBAAoB,GACpB,mBAAmB,GACnB,iBAAiB,CAAC;AAEtB;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,mBAAwB,GAChC,kBAAkB,CAoDpB;AAED,sEAAsE;AACtE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB,GAAG,MAAM,CAK/F;AAED,wBAAgB,sBAAsB,CAAC,CAAC,EACtC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,mBAAmB,EAC5B,SAAS,EAAE,MAAM,CAAC,GACjB,CAAC,CAoBH;AAED,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,EACtC,OAAO,GAAE,mBAAwB,GAChC,MAAM,CA4DR;AAkID,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM;;;;;;;;;;EAc7C;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM;;;;;;;;;;EA8BpD"}
+{"version":3,"file":"writer.d.ts","sourceRoot":"","sources":["../../../../src/core/events/v3/writer.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAa7C,eAAO,MAAM,6BAA6B,EAAG,qBAA8B,CAAC;AAE5E,MAAM,MAAM,sBAAsB,GAAG,WAAW,GAAG,OAAO,CAAC;AAE3D,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,sBAAsB,GAAG,gBAAgB,CAAC;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,UAAU,MAAM,EAAE,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,kBAAkB,CAAC;CACtC;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,OAAO,MAAM,EAAE,CAAC;IACpC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7D;AAED,MAAM,MAAM,gBAAgB,GACxB,oBAAoB,GACpB,iBAAiB,GACjB,sBAAsB,GACtB,qBAAqB,GACrB,oBAAoB,GACpB,mBAAmB,GACnB,iBAAiB,CAAC;AAEtB;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,mBAAwB,GAChC,kBAAkB,CAoDpB;AAED,sEAAsE;AACtE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB,GAAG,MAAM,CAK/F;AAED,wBAAgB,sBAAsB,CAAC,CAAC,EACtC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,mBAAmB,EAC5B,SAAS,EAAE,MAAM,CAAC,GACjB,CAAC,CAoBH;AAED,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,EACtC,OAAO,GAAE,mBAAwB,GAChC,MAAM,CA4DR;AAkID,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM;;;;;;;;;;EAc7C;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM;;;;;;;;;;EA8BpD"}

package/dist/core/events/v3/writer.js

@@ -2,6 +2,7 @@ import { createHash, randomUUID } from "node:crypto";
 import { chmodSync, closeSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, readSync, renameSync, statSync, truncateSync, unlinkSync, writeFileSync, writeSync, } from "node:fs";
 import { hostname } from "node:os";
 import { join, resolve } from "node:path";
+import { stateDirMode, stateFileMode, stateModeTooOpen } from "../../storage/modes.js";
 import { fsyncParentDirectory } from "../../workflow/durable-record.js";
 import { acquireNoClobberLease } from "../../workflow/workspaces/leases.js";
 import { canonicalJsonV3, sha256V3 } from "./canonical.js";
@@ -129,7 +130,7 @@ export function drainReadyEventsUnderLeaseV3(paths, options = {}) {
     }), checkpoint?.genesis_id ? checkpoint : undefined);
     if (readyRows.length === 0)
         return 0;
-    const activeFd = openSync(paths.active, "a", 0o600);
+    const activeFd = openSync(paths.active, "a", stateFileMode());
     let committed = 0;
     try {
         for (const { readyName, readyPath, row } of readyRows) {
@@ -285,13 +286,13 @@ export function ensureEventV3Layout(coordRoot) {
         paths.segments,
         paths.authorityOutbox,
     ]) {
-        mkdirSync(path, { recursive: true, mode: 0o700 });
-        chmodSync(path, 0o700);
+        mkdirSync(path, { recursive: true, mode: stateDirMode() });
+        chmodSync(path, stateDirMode());
     }
     if (!existsSync(paths.active)) {
         let fd;
         try {
-            fd = openSync(paths.active, "wx", 0o600);
+            fd = openSync(paths.active, "wx", stateFileMode());
             fsyncSync(fd);
             fsyncParentDirectory(paths.active);
         }
@@ -305,8 +306,8 @@ export function ensureEventV3Layout(coordRoot) {
         }
     }
     const active = lstatSync(paths.active);
-    if (!active.isFile() || active.isSymbolicLink() || (active.mode & 0o077) !== 0) {
-        throw new Error("active V3 ledger must be an owner-only regular file");
+    if (!active.isFile() || active.isSymbolicLink() || stateModeTooOpen(active.mode)) {
+        throw new Error("active V3 ledger must be a regular file closed to other users");
     }
     return paths;
 }
@@ -314,7 +315,7 @@ function writeReadyRecord(spool, readyPath, row, eventId, onStep) {
     const temporary = join(spool, `.tmp-${process.pid}-${randomUUID()}`);
     let fd;
     try {
-        fd = openSync(temporary, "wx", 0o600);
+        fd = openSync(temporary, "wx", stateFileMode());
         writeFileSync(fd, row, "utf8");
         fsyncSync(fd);
         onStep?.("ready_temp_flushed", eventId);

package/dist/core/governor/planning.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"planning.d.ts","sourceRoot":"","sources":["../../../src/core/governor/planning.ts"],"names":[],"mappings":"AAcA,OAAO,EAEL,KAAK,UAAU,EAQhB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAIL,KAAK,mBAAmB,EAUzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAYjD,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,GAAG,OAAO,GAAG,aAAa,GAAG,aAAa,CAAC,CAAC;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CAsM9B;AAkMD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,mBAAmB,CAkHtB;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,mBAAmB,CAYtB;AAED;;;;;;;;gEAQgE;AAChE,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,mBAAmB,CAoBtB;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,mBAAmB,CA4CtB"}
+{"version":3,"file":"planning.d.ts","sourceRoot":"","sources":["../../../src/core/governor/planning.ts"],"names":[],"mappings":"AAeA,OAAO,EAEL,KAAK,UAAU,EAQhB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAIL,KAAK,mBAAmB,EAUzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAYjD,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,GAAG,OAAO,GAAG,aAAa,GAAG,aAAa,CAAC,CAAC;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CAsM9B;AAkMD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,mBAAmB,CAkHtB;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,mBAAmB,CAYtB;AAED;;;;;;;;gEAQgE;AAChE,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,mBAAmB,CAoBtB;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,mBAAmB,CA4CtB"}

package/dist/core/governor/planning.js

@@ -2,6 +2,7 @@ import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { chmodSync, existsSync, linkSync, mkdirSync, readFileSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { appendSegmentedJsonlFile } from "../storage/durable-history.js";
+import { stateDirMode, stateFileMode } from "../storage/modes.js";
 import { createWorkItem, readWorkItem } from "../work/index.js";
 import { digestResult, readWorkflowProof, runWorkflow, WorkflowParkedError, workflowScriptDigest, } from "../workflow/index.js";
 import { readGovernorPlan, readGovernorPlanReviewReceipt, readGovernorPlans } from "./plan-read.js";
@@ -512,8 +513,8 @@ function createPlanRequest(coordRoot, record, sequence, triggerFingerprint, trig
     };
     const script = plannerScript(coordRoot, record, planId, trigger);
     const dir = planDir(coordRoot, record.intent.id, planId);
-    mkdirSync(dir, { recursive: true, mode: 0o700 });
-    chmodSync(dir, 0o700);
+    mkdirSync(dir, { recursive: true, mode: stateDirMode() });
+    chmodSync(dir, stateDirMode());
     writeExclusiveJson(join(dir, "request.json"), request, "governor plan request");
     writeExclusive(join(dir, "planner.mjs"), script, "governor planner script");
     return request;
@@ -1282,10 +1283,10 @@ function writeExclusive(path, body, label) {
     if (Buffer.byteLength(body) > MAX_RECORD_BYTES) {
         throw new Error(`${label} exceeds ${MAX_RECORD_BYTES} bytes`);
     }
-    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    mkdirSync(dirname(path), { recursive: true, mode: stateDirMode() });
     const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
     try {
-        writeFileSync(temporary, body, { encoding: "utf8", flag: "wx", mode: 0o600 });
+        writeFileSync(temporary, body, { encoding: "utf8", flag: "wx", mode: stateFileMode() });
         try {
             linkSync(temporary, path);
         }
@@ -1296,7 +1297,7 @@ function writeExclusive(path, body, label) {
             if (existing !== body)
                 throw new Error(`${label} already exists with different content`);
         }
-        chmodSync(path, 0o600);
+        chmodSync(path, stateFileMode());
     }
     finally {
         try {

package/dist/core/governor/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/core/governor/service.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,KAAK,gBAAgB,EAAmB,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGlG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAe,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,KAAK,cAAc,EAAgB,MAAM,YAAY,CAAC;AAE/D,eAAO,MAAM,sCAAsC,EAAG,CAAU,CAAC;AACjE,eAAO,MAAM,uCAAuC,EAAG,CAAU,CAAC;AAClE,eAAO,MAAM,sCAAsC,EAAG,CAAU,CAAC;AAOjE,MAAM,WAAW,2BAA2B;IAC1C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iBAAiB,EAAE,OAAO,CAAC;IAC3B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,OAAO,sCAAsC,CAAC;IAC9D,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,MAAM,EAAE,2BAA2B,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC,2BAA2B,CAAC,CAAC;CAC/C;AAED,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG,SAAS,GAAG,iBAAiB,CAAC;AAE9E,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,wBAAwB,CAAC;IAChC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,OAAO,uCAAuC,CAAC;IAC/D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;CACnD;AAED,MAAM,MAAM,2BAA2B,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAE1F,MAAM,WAAW,2BAA2B;IAC1C,cAAc,EAAE,OAAO,sCAAsC,CAAC;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,2BAA2B,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,2BAA2B,CAAC;IACrC,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,OAAO,CAAC,EAAE,sBAAsB,CAAC;CAClC;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,2BAA2B,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,MAAM,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,aAAa,GAAG,aAAa,CAAC,CAAC;IACvF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,cAAc,CAAC;IACjE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzD,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,aAAa,GAAG,aAAa,CAAC,CAAC;IACtF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AASD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,6BAA6B,GACnC,qBAAqB,CAiDvB;AAED,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,qBAAqB,CAQrF;AAED,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,MAAM,GACnB,sBAAsB,GAAG,SAAS,CAkBpC;AAED,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,qBAAqB,CAkBrF;AAED,wBAAsB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAyC/F;AAED,wBAAgB,0BAA0B,CAAC,YAAY,EAAE,MAAM,GAAG,qBAAqB,CAgBtF;AAED,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,0BAA0B,CAAC,CAwIrC;AAED,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,2BAA2B,CAAC,CA6GtC;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAKhE;AAiPD,wBAAgB,+BAA+B,CAC7C,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,QAAQ,GAAG,QAAQ,CAgBrB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/core/governor/service.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,KAAK,gBAAgB,EAAmB,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAIlG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAe,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,KAAK,cAAc,EAAgB,MAAM,YAAY,CAAC;AAE/D,eAAO,MAAM,sCAAsC,EAAG,CAAU,CAAC;AACjE,eAAO,MAAM,uCAAuC,EAAG,CAAU,CAAC;AAClE,eAAO,MAAM,sCAAsC,EAAG,CAAU,CAAC;AAOjE,MAAM,WAAW,2BAA2B;IAC1C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iBAAiB,EAAE,OAAO,CAAC;IAC3B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,OAAO,sCAAsC,CAAC;IAC9D,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,MAAM,EAAE,2BAA2B,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC,2BAA2B,CAAC,CAAC;CAC/C;AAED,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG,SAAS,GAAG,iBAAiB,CAAC;AAE9E,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,wBAAwB,CAAC;IAChC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,OAAO,uCAAuC,CAAC;IAC/D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;CACnD;AAED,MAAM,MAAM,2BAA2B,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAE1F,MAAM,WAAW,2BAA2B;IAC1C,cAAc,EAAE,OAAO,sCAAsC,CAAC;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,2BAA2B,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,2BAA2B,CAAC;IACrC,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,OAAO,CAAC,EAAE,sBAAsB,CAAC;CAClC;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,2BAA2B,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,MAAM,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,aAAa,GAAG,aAAa,CAAC,CAAC;IACvF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,cAAc,CAAC;IACjE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzD,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,aAAa,GAAG,aAAa,CAAC,CAAC;IACtF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AASD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,6BAA6B,GACnC,qBAAqB,CAiDvB;AAED,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,qBAAqB,CAQrF;AAED,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,MAAM,GACnB,sBAAsB,GAAG,SAAS,CAkBpC;AAED,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,qBAAqB,CAkBrF;AAED,wBAAsB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAyC/F;AAED,wBAAgB,0BAA0B,CAAC,YAAY,EAAE,MAAM,GAAG,qBAAqB,CAgBtF;AAED,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,0BAA0B,CAAC,CAwIrC;AAED,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,2BAA2B,CAAC,CA6GtC;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAKhE;AAiPD,wBAAgB,+BAA+B,CAC7C,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,QAAQ,GAAG,QAAQ,CAgBrB"}

package/dist/core/governor/service.js

@@ -6,6 +6,7 @@ import { dirname, join, resolve } from "node:path";
 import { coordEnv } from "../../lib/env.js";
 import { normalizePolicy } from "../policy/index.js";
 import { closeProcessLoggers, legacyLogFields, processLogger } from "../storage/logger.js";
+import { stateDirMode, stateFileMode } from "../storage/modes.js";
 import { RotatingTextSink } from "../storage/process-log.js";
 import { runGovernor } from "./runner.js";
 import { readGovernor } from "./state.js";
@@ -46,8 +47,8 @@ export function configureGovernorService(input) {
         created_at: new Date().toISOString(),
     };
     const dir = serviceDir(coordRoot);
-    mkdirSync(dir, { recursive: true, mode: 0o700 });
-    chmodSync(dir, 0o700);
+    mkdirSync(dir, { recursive: true, mode: stateDirMode() });
+    chmodSync(dir, stateDirMode());
     writePrivateJsonAtomic(serviceConfigPath(coordRoot), config);
     return readGovernorServiceConfig(coordRoot);
 }
@@ -101,11 +102,11 @@ export async function spawnGovernorService(coordRootRaw) {
     if (current.running) {
         throw new Error(`governor service is already running under pid ${current.record?.pid}`);
     }
-    mkdirSync(serviceDir(coordRoot), { recursive: true, mode: 0o700 });
+    mkdirSync(serviceDir(coordRoot), { recursive: true, mode: stateDirMode() });
     const sharedLogs = coordEnv("SHARED_LOGS") !== "0";
-    const logFd = sharedLogs ? undefined : openSync(serviceLogPath(coordRoot), "a", 0o600);
+    const logFd = sharedLogs ? undefined : openSync(serviceLogPath(coordRoot), "a", stateFileMode());
     if (logFd !== undefined)
-        chmodSync(serviceLogPath(coordRoot), 0o600);
+        chmodSync(serviceLogPath(coordRoot), stateFileMode());
     const harnBin = new URL("../../../bin/harn", import.meta.url).pathname;
     if (!existsSync(harnBin)) {
         if (logFd !== undefined)
@@ -510,7 +511,7 @@ function normalizeIsolation(value) {
 }
 function acquireServiceLease(coordRoot) {
     const path = serviceLeasePath(coordRoot);
-    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    mkdirSync(dirname(path), { recursive: true, mode: stateDirMode() });
     const owner = {
         pid: process.pid,
         host: hostname(),
@@ -519,7 +520,7 @@ function acquireServiceLease(coordRoot) {
     };
     const acquire = () => {
         try {
-            const fd = openSync(path, "wx", 0o600);
+            const fd = openSync(path, "wx", stateFileMode());
             try {
                 writeFileSync(fd, `${JSON.stringify(owner)}\n`, "utf8");
             }
@@ -666,12 +667,12 @@ function writePrivateJsonAtomic(path, value) {
     if (Buffer.byteLength(body) > MAX_FILE_BYTES) {
         throw new Error(`governor service file exceeds ${MAX_FILE_BYTES} bytes`);
     }
-    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-    chmodSync(dirname(path), 0o700);
+    mkdirSync(dirname(path), { recursive: true, mode: stateDirMode() });
+    chmodSync(dirname(path), stateDirMode());
     const temporary = `${path}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`;
-    writeFileSync(temporary, body, { encoding: "utf8", flag: "wx", mode: 0o600 });
+    writeFileSync(temporary, body, { encoding: "utf8", flag: "wx", mode: stateFileMode() });
     renameSync(temporary, path);
-    chmodSync(path, 0o600);
+    chmodSync(path, stateFileMode());
 }
 function serviceDir(coordRoot) {
     return join(resolve(coordRoot), ".harnery", "governor-service");

package/dist/core/governor/state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../../src/core/governor/state.ts"],"names":[],"mappings":"AAeA,OAAO,EAA8B,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAG9E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAEtE,OAAO,EACL,KAAK,6BAA6B,EAElC,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAI9B,MAAM,iBAAiB,CAAC;AAEzB,eAAO,MAAM,8BAA8B,EAAG,CAAU,CAAC;AAyBzD,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,eAAe,EAAE,OAAO,CAAC;IACzB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,OAAO,8BAA8B,CAAC;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;IACvD,MAAM,EAAE,cAAc,CAAC;IACvB,UAAU,EAAE,wBAAwB,CAAC;IACrC,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GACrB,OAAO,GACP,SAAS,GACT,oBAAoB,GACpB,SAAS,GACT,kBAAkB,GAClB,WAAW,CAAC;AAEhB,MAAM,MAAM,kBAAkB,GAC1B,KAAK,GACL,cAAc,GACd,kBAAkB,GAClB,QAAQ,GACR,OAAO,GACP,QAAQ,GACR,cAAc,GACd,gBAAgB,GAChB,aAAa,GACb,YAAY,GACZ,MAAM,CAAC;AAEX,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,kBAAkB,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB;;sEAEkE;IAClE,qBAAqB,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxE,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAClD;;;;;;;;;OASG;IACH,kBAAkB,CAAC,EAAE;QACnB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,mBAAmB,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,cAAc,CAAC;IACvB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,KAAK,EAAE,kBAAkB,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,QAAQ,EAAE,mBAAmB,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,0BAA0B,CAAC;IACrC,UAAU,CAAC,EAAE,6BAA6B,CAAC;CAC5C;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CAiDzE;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CAE9E;AAED,8EAA8E;AAC9E,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CAE3F;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,EAAE,CAEjE;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,CAmB/E;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,EAAE,CAcvF;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAErD;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,CA0ClF"}
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../../src/core/governor/state.ts"],"names":[],"mappings":"AAgBA,OAAO,EAA8B,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAG9E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAEtE,OAAO,EACL,KAAK,6BAA6B,EAElC,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAI9B,MAAM,iBAAiB,CAAC;AAEzB,eAAO,MAAM,8BAA8B,EAAG,CAAU,CAAC;AAyBzD,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,eAAe,EAAE,OAAO,CAAC;IACzB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,OAAO,8BAA8B,CAAC;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;IACvD,MAAM,EAAE,cAAc,CAAC;IACvB,UAAU,EAAE,wBAAwB,CAAC;IACrC,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GACrB,OAAO,GACP,SAAS,GACT,oBAAoB,GACpB,SAAS,GACT,kBAAkB,GAClB,WAAW,CAAC;AAEhB,MAAM,MAAM,kBAAkB,GAC1B,KAAK,GACL,cAAc,GACd,kBAAkB,GAClB,QAAQ,GACR,OAAO,GACP,QAAQ,GACR,cAAc,GACd,gBAAgB,GAChB,aAAa,GACb,YAAY,GACZ,MAAM,CAAC;AAEX,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,kBAAkB,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB;;sEAEkE;IAClE,qBAAqB,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxE,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAClD;;;;;;;;;OASG;IACH,kBAAkB,CAAC,EAAE;QACnB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,mBAAmB,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,cAAc,CAAC;IACvB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,KAAK,EAAE,kBAAkB,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,QAAQ,EAAE,mBAAmB,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,0BAA0B,CAAC;IACrC,UAAU,CAAC,EAAE,6BAA6B,CAAC;CAC5C;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CAiDzE;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CAE9E;AAED,8EAA8E;AAC9E,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CAE3F;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,EAAE,CAEjE;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,CAmB/E;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,EAAE,CAcvF;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAErD;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,CA0ClF"}

package/dist/core/governor/state.js

@@ -2,6 +2,7 @@ import { randomBytes, randomUUID } from "node:crypto";
 import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
 import { hostname } from "node:os";
 import { dirname, isAbsolute, join, resolve } from "node:path";
+import { stateDirMode, stateFileMode } from "../storage/modes.js";
 import { assertWorkId, readWorkItem } from "../work/read.js";
 import { workflowScriptDigest } from "../workflow/run-state.js";
 import { normalizeWorkflowSpecialists } from "../workflow/specialists.js";
@@ -68,8 +69,8 @@ export function createGovernor(input) {
         created_at: new Date().toISOString(),
     };
     const path = governorIntentPath(coordRoot, id);
-    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-    chmodSync(dirname(path), 0o700);
+    mkdirSync(dirname(path), { recursive: true, mode: stateDirMode() });
+    chmodSync(dirname(path), stateDirMode());
     writePrivateJson(path, intent);
     return readGovernor(coordRoot, id);
 }
@@ -143,14 +144,14 @@ export function acquireGovernorLease(coordRoot, goalId) {
     };
     const acquire = () => {
         try {
-            const fd = openSync(path, "wx", 0o600);
+            const fd = openSync(path, "wx", stateFileMode());
             try {
                 writeFileSync(fd, `${JSON.stringify(owner)}\n`, "utf8");
             }
             finally {
                 closeSync(fd);
             }
-            chmodSync(path, 0o600);
+            chmodSync(path, stateFileMode());
             return true;
         }
         catch (error) {
@@ -946,8 +947,8 @@ function writePrivateJson(path, value) {
     if (Buffer.byteLength(body) > MAX_INTENT_BYTES) {
         throw new Error(`governor intent exceeds ${MAX_INTENT_BYTES} bytes`);
     }
-    writeFileSync(path, body, { encoding: "utf8", flag: "wx", mode: 0o600 });
-    chmodSync(path, 0o600);
+    writeFileSync(path, body, { encoding: "utf8", flag: "wx", mode: stateFileMode() });
+    chmodSync(path, stateFileMode());
 }
 function bounded(value, field, max) {
     if (typeof value !== "string")

package/dist/core/guard/evaluator.js

@@ -145,6 +145,7 @@ function attestedContextSource(adapter, source, confidence) {
         "claude-code": ["hook", "native_event", "result"],
         codex: ["native_event", "result", "transcript"],
         cursor: ["native_event"],
+        opencode: ["native_event", "result"],
     };
     return !!source && (allowed[adapter] ?? []).includes(source);
 }

package/dist/core/guard/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../../src/core/guard/storage.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,WAAW,WAAW;IAC1B,cAAc,EAAE,CAAC,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,kBAAkB,GAAG,IAAI,CAE3B;AAED,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,IAAiB,GACrB,kBAAkB,GAAG,IAAI,CAG3B;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAErE;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAI5F;AAED,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,kBAAkB,EAC5B,KAAK,EAAE,MAAM,GACZ,IAAI,CAIN;AAED,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,IAAI,EACT,YAAY,EAAE,MAAM,GACnB,cAAc,GAAG,IAAI,CAoBvB;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAK7E;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAQ5E;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAcpF;AAED,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,OAAO,GAC3B,IAAI,CAaN"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../../src/core/guard/storage.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,WAAW,WAAW;IAC1B,cAAc,EAAE,CAAC,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,kBAAkB,GAAG,IAAI,CAE3B;AAED,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,IAAiB,GACrB,kBAAkB,GAAG,IAAI,CAG3B;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAErE;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAI5F;AAED,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,kBAAkB,EAC5B,KAAK,EAAE,MAAM,GACZ,IAAI,CAIN;AAED,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,IAAI,EACT,YAAY,EAAE,MAAM,GACnB,cAAc,GAAG,IAAI,CAoBvB;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAK7E;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAQ5E;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAcpF;AAED,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,OAAO,GAC3B,IAAI,CAaN"}

package/dist/core/guard/storage.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { closeSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
 import { dirname, join } from "node:path";
+import { stateFileMode } from "../storage/modes.js";
 export function guardDir(coordRoot) {
     return join(coordRoot, ".harnery", "guard");
 }
@@ -86,7 +87,7 @@ export function writeAtomicJson(path, value, nonce, beforeRename) {
     try {
         writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, {
             encoding: "utf8",
-            mode: 0o600,
+            mode: stateFileMode(),
         });
         if (beforeRename && !beforeRename())
             throw new Error("run_quality_lock_stolen");
@@ -100,7 +101,7 @@ export function writeAtomicJson(path, value, nonce, beforeRename) {
 function createExclusive(path, value) {
     let fd;
     try {
-        fd = openSync(path, "wx", 0o600);
+        fd = openSync(path, "wx", stateFileMode());
         writeFileSync(fd, `${JSON.stringify(value)}\n`, "utf8");
         return true;
     }

package/dist/core/hooks/adapter/behaviors/claude-code.d.ts

@@ -0,0 +1,4 @@
+import type { AdapterBehavior } from "./types.js";
+/** Claude Code: the reference adapter; host-default labels, full effect set. */
+export declare const claudeCodeBehavior: AdapterBehavior;
+//# sourceMappingURL=claude-code.d.ts.map

package/dist/core/hooks/adapter/behaviors/claude-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code.d.ts","sourceRoot":"","sources":["../../../../../src/core/hooks/adapter/behaviors/claude-code.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,EAAE,eA6BhC,CAAC"}

package/dist/core/hooks/adapter/behaviors/claude-code.js

@@ -0,0 +1,31 @@
+/** Claude Code: the reference adapter; host-default labels, full effect set. */
+export const claudeCodeBehavior = {
+    id: "claude-code",
+    sessionStartPlatformLabel: undefined,
+    soundEffects: true,
+    journalMaintenance: true,
+    sessionTelemetrySync: true,
+    promptPresenceDetection: true,
+    promptContextNudges: {
+        taskNudge: false,
+        hostPromptReminder: false,
+        statusFooterNudge: false,
+        turnRitualNudge: "claude-code",
+    },
+    completedResponseEvent: undefined,
+    sessionIdentityOnStartOnly: false,
+    nativeTurnIdOptional: false,
+    tracksExecutionMode: false,
+    shellOperationDedup: false,
+    promptMayPrecedeSessionStart: false,
+    promptContinuesOpenTurn: false,
+    turnRecovery: true,
+    nativeTelemetryOnly: false,
+    runtimeContextTranscriptOptional: false,
+    runtimeContextRetry: false,
+    effortAttestation: "payload",
+    transcriptTuningRefresh: true,
+    modelProvider: "anthropic",
+    runtimeContextAvailable: () => true,
+    bridgeFor: () => undefined,
+};

package/dist/core/hooks/adapter/behaviors/codex.d.ts

@@ -0,0 +1,15 @@
+import type { ParsedPayload } from "../parse.js";
+import type { AdapterBehavior } from "./types.js";
+/**
+ * Privacy-safe environment and recovery provenance for Codex mid-flight
+ * onboarding. WSLENV values are never recorded, only normalized variable
+ * names, and the native session identifier itself remains fingerprinted.
+ */
+export declare function codexMidFlightDiagnosticContext(payload: ParsedPayload, env?: NodeJS.ProcessEnv): Record<string, string | boolean>;
+/**
+ * Codex: hook payloads omit `transcript_path`, so the rollout is discovered by
+ * session id; effort is probed from the rollout; a Windows-native Codex over a
+ * WSL UNC workspace is the one bridged deployment Harnery knows about.
+ */
+export declare const codexBehavior: AdapterBehavior;
+//# sourceMappingURL=codex.d.ts.map

package/dist/core/hooks/adapter/behaviors/codex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../../../../src/core/hooks/adapter/behaviors/codex.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,aAAa,EACtB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CA0BlC;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa,EAAE,eA0C3B,CAAC"}