harnery 0.40.0 → 0.42.0

package/dist/core/config.d.ts

@@ -98,16 +98,20 @@ export declare function pinnedBinName(projectRoot: string): string | null;
  * `coordRoot` is resolved via `findCoordRoot()` when not passed.
  */
 export declare function resolveHooksSetupHint(coordRoot?: string | null): string | null;
+export interface CodexWindowsBridgeConfig {
+    /** Command name Windows-native Codex hooks hand off to, or null when not opted in. */
+    entryPoint: string | null;
+    /** Why the configured value was ignored, when it was. */
+    error: string | null;
+}
 /**
- * One project-owned reminder that a supported prompt hook can place immediately
- * before a model response. The value is deliberately project-only: host policy
- * must not follow the user-global config into unrelated repositories. It is
- * emitted directly from config and never copied into coordination state.
- *
- * The reminder must be one non-empty line of at most 500 characters. Invalid
- * values fail closed to no reminder so a malformed optional setting cannot
- * break the prompt hook.
+ * Per-project opt-in that routes Windows-native Codex hooks through a resident
+ * WSL bridge (ADR 0197). Read from the project config only: the value is
+ * written into the committed `.codex/hooks.json`, so a user-level setting
+ * would make `init` output differ between machines. An invalid value is
+ * ignored and reported rather than spliced into a shell command.
  */
+export declare function codexWindowsBridgeConfig(projectRoot: string): CodexWindowsBridgeConfig;
 export declare function hostPromptReminder(coordRoot?: string | null): string | null;
 /**
  * Project-owned prompt-context provider settings. The user-global config is
@@ -157,6 +161,26 @@ export declare function ripgrepAutoInstall(coordRoot?: string | null): boolean;
  * `coordRoot` is resolved via `findCoordRoot()` when not passed.
  */
 export declare function workflowSubscriptionOnly(coordRoot?: string | null): boolean;
+/**
+ * The host's raw worker full-access policy (ADR 0192), validated by
+ * `parseWorkerFullAccessPolicy` in the workflow layer, which knows each
+ * adapter's effort scale.
+ *
+ * `.harnery/config.jsonc`:
+ * `{ "workflow": { "workerFullAccess": { "enabled": true, "floors": { ... } } } }`
+ *
+ * This is a trust boundary, so it comes only from the project config, like
+ * `agents.finalizationRoots`: a user-global file cannot remove the sandbox from
+ * one project's workers. `HARNERY_WORKFLOW_WORKER_FULL_ACCESS=0` turns it off
+ * for one process. There is deliberately no `=1`: an environment variable can
+ * withdraw the grant but never supply it.
+ */
+export declare function workflowWorkerFullAccessConfig(coordRoot?: string | null): unknown;
+/**
+ * How this project's `.harnery/` state is shared: `private` or `group`. `HARNERY_STORAGE_SHARING`
+ * overrides per process; an unrecognized value falls back to `private`, the safer reading.
+ */
+export declare function storageSharing(coordRoot?: string | null): "private" | "group";
 /**
  * Whether cross-machine presence (ADR 0016) is enabled for this repo.
  * Default ON — the transport itself additionally gates on an origin remote
@@ -208,6 +232,15 @@ export declare function eventLedgerArchivePolicy(coordRoot?: string | null): Eve
  * `.harnery/config.jsonc` `web.port`, then the mnemonic built-in default 4276.
  */
 export declare function resolveWebPort(explicitPort?: string, coordRoot?: string | null): number;
+/** The configured inclusive port range for one server type, or null. */
+export declare function serverPortRange(type: string, coordRoot?: string | null): [number, number] | null;
+/** Every configured server port range, keyed by type (invalid entries dropped). */
+export declare function serverPortRanges(coordRoot?: string | null): Record<string, [number, number]>;
+/** Configured `servers gc` windows; undefined fields use the built-in defaults. */
+export declare function serverGcConfig(coordRoot?: string | null): {
+    idle_hours?: number;
+    owner_stale_hours?: number;
+};
 /** Policy for converging independent termination signals on one finalizer. */
 export declare function sessionFinalizationConfig(coordRoot?: string | null): SessionFinalizationConfig;
 /**
@@ -220,12 +253,41 @@ export declare function artifactDefaultRetentionDays(coordRoot?: string | null):
 export declare function artifactMaxBytes(coordRoot?: string | null): number;
 /** Size at which one bundle requires an explicit `artifacts create --big` acknowledgement. */
 export declare function artifactMaxUnitBytes(coordRoot?: string | null): number;
+/**
+ * How long an unexpired workspace must sit idle before a size rule (the
+ * per-bundle ceiling or the repository budget) may delete it. Idle means no
+ * change inside the workspace and no heartbeat from its owner. An agent waiting
+ * on a human reply looks idle, so a short window deletes work someone is still
+ * reviewing. Precedence: `HARNERY_ARTIFACT_IDLE_GRACE_HOURS` ->
+ * `artifacts.idle_grace_hours` -> 24. Expiry never waits for this grace.
+ */
+export declare function artifactIdleGraceHours(coordRoot?: string | null): number;
+/**
+ * Default lifetime of an artifact hold. A hold that is not renewed lapses after
+ * this many days and the workspace returns to ordinary retention. Precedence:
+ * `HARNERY_ARTIFACT_HOLD_DAYS` -> `artifacts.hold_days` -> 14.
+ */
+export declare function artifactHoldDays(coordRoot?: string | null): number;
+/**
+ * Advisory budget for held artifact bytes. Exceeding it produces warnings
+ * only: holds record owner intent, so cleanup never deletes held work.
+ * Precedence: `HARNERY_ARTIFACT_MAX_HELD_BYTES` -> `artifacts.max_held_bytes`
+ * -> 20 GiB.
+ */
+export declare function artifactMaxHeldBytes(coordRoot?: string | null): number;
+/**
+ * Free-disk floor for the artifact store. Below it, artifact commands warn and
+ * `artifacts create --big` refuses unless `--allow-low-disk` is passed.
+ * Precedence: `HARNERY_ARTIFACT_MIN_FREE_BYTES` -> `artifacts.min_free_bytes`
+ * -> 20 GiB. Zero disables the floor.
+ */
+export declare function artifactMinFreeBytes(coordRoot?: string | null): number;
 /**
  * Whether opportunistic cleanup of expired artifact workspaces runs.
  * Precedence: `HARNERY_ARTIFACT_AUTO_CLEAN` (0/false disables) ->
- * `artifacts.auto_clean` -> enabled. The sweep only ever deletes
- * `managed-expired` entries via the same guarded classifier as
- * `artifacts clean --yes`.
+ * `artifacts.auto_clean` -> enabled. The sweep deletes the same
+ * `managed-expired`, `managed-oversize`, and `managed-over-budget` entries as
+ * `artifacts clean --yes`, through the same guarded classifier.
  */
 export declare function artifactAutoCleanEnabled(coordRoot?: string | null): boolean;
 /**

package/dist/core/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAQH,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,wCAAwC,EAAE,MAAM,gCAAgC,CAAC;AAE1F,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAEvC,yFAAyF;AACzF,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C,2EAA2E;AAC3E,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD,MAAM,WAAW,yBAAyB;IACxC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,wBAAwB,EAAE,MAAM,CAAC;CAClC;AAED,eAAO,MAAM,mCAAmC,EAAE,yBAMjD,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,KAAK,GAAG,QAAQ,CAAC;AAE5D,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,4BAA4B,CAAC;CAC3C;AAsID,8FAA8F;AAC9F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAqCvD;AA0CD,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,8EAA8E;IAC9E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,SAAS,CAAC,2BAA2B,EAAE,2BAA2B,CAAC,CAAC;CAC7E;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,sBAAsB,CAa3E;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,2BAA2B,CAqBrF;AAmFD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAShE;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGhE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAK9E;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAU3E;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,mBAAmB,GAAG,IAAI,CAI7F;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAO/E;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,qBAAqB,EAAE,CAY1F;AAED,gFAAgF;AAChF,wBAAgB,sBAAsB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAIxE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAOrE;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAO3E;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAOlE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAWzE;AAQD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CASvE;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAG9E;AAMD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,0EAA0E;AAC1E,wBAAgB,wBAAwB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,wBAAwB,CA+B5F;AAUD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAcvF;AAED,8EAA8E;AAC9E,wBAAgB,yBAAyB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,yBAAyB,CA0B9F;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAe9E;AAKD,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CASlE;AAED,8FAA8F;AAC9F,wBAAgB,oBAAoB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAStE;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAM3E;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAM7E;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,IAAI,MAAM,CAOvD;AA4BD,6EAA6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,YAAY,CA0CpE;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAS3C"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAQH,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,wCAAwC,EAAE,MAAM,gCAAgC,CAAC;AAE1F,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAEvC,yFAAyF;AACzF,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C,2EAA2E;AAC3E,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD,MAAM,WAAW,yBAAyB;IACxC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,wBAAwB,EAAE,MAAM,CAAC;CAClC;AAED,eAAO,MAAM,mCAAmC,EAAE,yBAMjD,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,KAAK,GAAG,QAAQ,CAAC;AAE5D,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,4BAA4B,CAAC;CAC3C;AA6JD,8FAA8F;AAC9F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAqCvD;AA0CD,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,8EAA8E;IAC9E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,SAAS,CAAC,2BAA2B,EAAE,2BAA2B,CAAC,CAAC;CAC7E;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,sBAAsB,CAa3E;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,2BAA2B,CAqBrF;AAmFD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAShE;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGhE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAK9E;AAeD,MAAM,WAAW,wBAAwB;IACvC,sFAAsF;IACtF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,yDAAyD;IACzD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,wBAAwB,CAiBtF;AAED,wBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAU3E;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,mBAAmB,GAAG,IAAI,CAI7F;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAO/E;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,qBAAqB,EAAE,CAY1F;AAED,gFAAgF;AAChF,wBAAgB,sBAAsB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAIxE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAOrE;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAO3E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAKjF;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAO7E;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAOlE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAWzE;AAQD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CASvE;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAG9E;AAMD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,0EAA0E;AAC1E,wBAAgB,wBAAwB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,wBAAwB,CA+B5F;AAUD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAcvF;AAED,wEAAwE;AACxE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAQhG;AAED,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAS5F;AAED,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAWA;AAED,8EAA8E;AAC9E,wBAAgB,yBAAyB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,yBAAyB,CA0B9F;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAe9E;AAKD,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CASlE;AAED,8FAA8F;AAC9F,wBAAgB,oBAAoB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAStE;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CASxE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CASlE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAStE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAStE;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAM3E;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAM7E;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,IAAI,MAAM,CAOvD;AA4BD,6EAA6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,YAAY,CA0CpE;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAS3C"}

package/dist/core/config.js

@@ -292,6 +292,34 @@ export function resolveHooksSetupHint(coordRoot) {
  * values fail closed to no reminder so a malformed optional setting cannot
  * break the prompt hook.
  */
+/** A plain Windows command name, so it is safe to splice into a PowerShell hook command. */
+const CODEX_WINDOWS_BRIDGE_ENTRY_POINT = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+/**
+ * Per-project opt-in that routes Windows-native Codex hooks through a resident
+ * WSL bridge (ADR 0197). Read from the project config only: the value is
+ * written into the committed `.codex/hooks.json`, so a user-level setting
+ * would make `init` output differ between machines. An invalid value is
+ * ignored and reported rather than spliced into a shell command.
+ */
+export function codexWindowsBridgeConfig(projectRoot) {
+    const raw = readProjectConfig(projectRoot).hooks?.codexWindowsBridge;
+    if (raw === undefined)
+        return { entryPoint: null, error: null };
+    const entryPoint = isPlainObject(raw) ? raw.entryPoint : undefined;
+    if (typeof entryPoint !== "string") {
+        return {
+            entryPoint: null,
+            error: "hooks.codexWindowsBridge.entryPoint must be a command name",
+        };
+    }
+    if (!CODEX_WINDOWS_BRIDGE_ENTRY_POINT.test(entryPoint)) {
+        return {
+            entryPoint: null,
+            error: `hooks.codexWindowsBridge.entryPoint ${JSON.stringify(entryPoint)} is not a plain command name`,
+        };
+    }
+    return { entryPoint, error: null };
+}
 export function hostPromptReminder(coordRoot) {
     const root = coordRoot ?? findCoordRoot();
     if (!root)
@@ -408,6 +436,42 @@ export function workflowSubscriptionOnly(coordRoot) {
         return false;
     return readConfig(root).workflow?.subscriptionOnly === true;
 }
+/**
+ * The host's raw worker full-access policy (ADR 0192), validated by
+ * `parseWorkerFullAccessPolicy` in the workflow layer, which knows each
+ * adapter's effort scale.
+ *
+ * `.harnery/config.jsonc`:
+ * `{ "workflow": { "workerFullAccess": { "enabled": true, "floors": { ... } } } }`
+ *
+ * This is a trust boundary, so it comes only from the project config, like
+ * `agents.finalizationRoots`: a user-global file cannot remove the sandbox from
+ * one project's workers. `HARNERY_WORKFLOW_WORKER_FULL_ACCESS=0` turns it off
+ * for one process. There is deliberately no `=1`: an environment variable can
+ * withdraw the grant but never supply it.
+ */
+export function workflowWorkerFullAccessConfig(coordRoot) {
+    if (coordEnv("WORKFLOW_WORKER_FULL_ACCESS") === "0")
+        return { enabled: false };
+    const root = coordRoot ?? findCoordRoot();
+    if (!root)
+        return undefined;
+    return readProjectConfig(root).workflow?.workerFullAccess;
+}
+/**
+ * How this project's `.harnery/` state is shared: `private` or `group`. `HARNERY_STORAGE_SHARING`
+ * overrides per process; an unrecognized value falls back to `private`, the safer reading.
+ */
+export function storageSharing(coordRoot) {
+    const env = coordEnv("STORAGE_SHARING");
+    if (env === "group" || env === "private")
+        return env;
+    const root = coordRoot ?? findCoordRoot();
+    if (!root)
+        return "private";
+    // Project file only: a user-global "group" would loosen every project that user touches.
+    return readProjectConfig(root).storage?.sharing === "group" ? "group" : "private";
+}
 /**
  * Whether cross-machine presence (ADR 0016) is enabled for this repo.
  * Default ON — the transport itself additionally gates on an origin remote
@@ -528,6 +592,40 @@ export function resolveWebPort(explicitPort, coordRoot) {
     }
     return DEFAULT_WEB_PORT;
 }
+/** The configured inclusive port range for one server type, or null. */
+export function serverPortRange(type, coordRoot) {
+    const root = coordRoot ?? findCoordRoot();
+    const value = root ? readConfig(root).servers?.port_ranges?.[type] : undefined;
+    if (!Array.isArray(value) || value.length !== 2)
+        return null;
+    const [low, high] = value;
+    const valid = (n) => Number.isInteger(n) && n > 0 && n < 65536;
+    return valid(low) && valid(high) && low <= high ? [low, high] : null;
+}
+/** Every configured server port range, keyed by type (invalid entries dropped). */
+export function serverPortRanges(coordRoot) {
+    const root = coordRoot ?? findCoordRoot();
+    const ranges = root ? readConfig(root).servers?.port_ranges : undefined;
+    const out = {};
+    for (const type of Object.keys(ranges ?? {})) {
+        const range = serverPortRange(type, root);
+        if (range)
+            out[type] = range;
+    }
+    return out;
+}
+/** Configured `servers gc` windows; undefined fields use the built-in defaults. */
+export function serverGcConfig(coordRoot) {
+    const root = coordRoot ?? findCoordRoot();
+    const configured = root ? readConfig(root).servers : undefined;
+    const positive = (n) => typeof n === "number" && Number.isFinite(n) && n > 0;
+    return {
+        ...(positive(configured?.idle_hours) ? { idle_hours: configured.idle_hours } : {}),
+        ...(positive(configured?.owner_stale_hours)
+            ? { owner_stale_hours: configured.owner_stale_hours }
+            : {}),
+    };
+}
 /** Policy for converging independent termination signals on one finalizer. */
 export function sessionFinalizationConfig(coordRoot) {
     const root = coordRoot ?? findCoordRoot();
@@ -579,12 +677,53 @@ export function artifactMaxUnitBytes(coordRoot) {
     const root = coordRoot ?? findCoordRoot();
     return integerSetting(coordEnv("ARTIFACT_MAX_UNIT_BYTES"), root ? readConfig(root).artifacts?.max_unit_bytes : undefined, 16 * 1024 * 1024, 1024 * 1024 * 1024 * 1024, DEFAULT_ARTIFACT_MAX_UNIT_BYTES);
 }
+/**
+ * How long an unexpired workspace must sit idle before a size rule (the
+ * per-bundle ceiling or the repository budget) may delete it. Idle means no
+ * change inside the workspace and no heartbeat from its owner. An agent waiting
+ * on a human reply looks idle, so a short window deletes work someone is still
+ * reviewing. Precedence: `HARNERY_ARTIFACT_IDLE_GRACE_HOURS` ->
+ * `artifacts.idle_grace_hours` -> 24. Expiry never waits for this grace.
+ */
+export function artifactIdleGraceHours(coordRoot) {
+    const root = coordRoot ?? findCoordRoot();
+    return integerSetting(coordEnv("ARTIFACT_IDLE_GRACE_HOURS"), root ? readConfig(root).artifacts?.idle_grace_hours : undefined, 1, 24 * 365, 24);
+}
+/**
+ * Default lifetime of an artifact hold. A hold that is not renewed lapses after
+ * this many days and the workspace returns to ordinary retention. Precedence:
+ * `HARNERY_ARTIFACT_HOLD_DAYS` -> `artifacts.hold_days` -> 14.
+ */
+export function artifactHoldDays(coordRoot) {
+    const root = coordRoot ?? findCoordRoot();
+    return integerSetting(coordEnv("ARTIFACT_HOLD_DAYS"), root ? readConfig(root).artifacts?.hold_days : undefined, 1, 365, 14);
+}
+/**
+ * Advisory budget for held artifact bytes. Exceeding it produces warnings
+ * only: holds record owner intent, so cleanup never deletes held work.
+ * Precedence: `HARNERY_ARTIFACT_MAX_HELD_BYTES` -> `artifacts.max_held_bytes`
+ * -> 20 GiB.
+ */
+export function artifactMaxHeldBytes(coordRoot) {
+    const root = coordRoot ?? findCoordRoot();
+    return integerSetting(coordEnv("ARTIFACT_MAX_HELD_BYTES"), root ? readConfig(root).artifacts?.max_held_bytes : undefined, 64 * 1024 * 1024, 1024 * 1024 * 1024 * 1024, DEFAULT_ARTIFACT_MAX_BYTES);
+}
+/**
+ * Free-disk floor for the artifact store. Below it, artifact commands warn and
+ * `artifacts create --big` refuses unless `--allow-low-disk` is passed.
+ * Precedence: `HARNERY_ARTIFACT_MIN_FREE_BYTES` -> `artifacts.min_free_bytes`
+ * -> 20 GiB. Zero disables the floor.
+ */
+export function artifactMinFreeBytes(coordRoot) {
+    const root = coordRoot ?? findCoordRoot();
+    return integerSetting(coordEnv("ARTIFACT_MIN_FREE_BYTES"), root ? readConfig(root).artifacts?.min_free_bytes : undefined, 0, 1024 * 1024 * 1024 * 1024 * 1024, 20 * 1024 * 1024 * 1024);
+}
 /**
  * Whether opportunistic cleanup of expired artifact workspaces runs.
  * Precedence: `HARNERY_ARTIFACT_AUTO_CLEAN` (0/false disables) ->
- * `artifacts.auto_clean` -> enabled. The sweep only ever deletes
- * `managed-expired` entries via the same guarded classifier as
- * `artifacts clean --yes`.
+ * `artifacts.auto_clean` -> enabled. The sweep deletes the same
+ * `managed-expired`, `managed-oversize`, and `managed-over-budget` entries as
+ * `artifacts clean --yes`, through the same guarded classifier.
  */
 export function artifactAutoCleanEnabled(coordRoot) {
     const env = coordEnv("ARTIFACT_AUTO_CLEAN");

package/dist/core/context/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/context/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAG7C,eAAO,MAAM,sBAAsB,EAAG,CAAU,CAAC;AACjD,eAAO,MAAM,iBAAiB,QAAY,CAAC;AAI3C,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,cAAc,GAAG,QAAQ,GAAG,YAAY,GAAG,UAAU,CAAC;AACjG,MAAM,MAAM,uBAAuB,GAAG,OAAO,GAAG,UAAU,GAAG,WAAW,CAAC;AACzE,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,cAAc,GAAG,WAAW,GAAG,UAAU,CAAC;AACnF,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,UAAU,GAAG,aAAa,GAAG,aAAa,CAAC;AAErF,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,UAAU,EAAE,uBAAuB,CAAC;IACpC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,OAAO,sBAAsB,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,YAAY,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,OAAO,sBAAsB,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,OAAO,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE;QACJ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,oBAAoB,CAAC,EAAE,OAAO,CAAC;KAChC,CAAC;IACF,IAAI,EAAE,YAAY,CAAC;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,gBAAgB,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,iBAAiB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,sBAAsB,CAAC;IAC9B,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,sBAAsB,CAAC;IAC9B,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,sBAAsB,CAAC;IAC9B,OAAO,EAAE,iBAAiB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAQD,mFAAmF;AACnF,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,EAAE,2BAA2B,GACnC,aAAa,GAAG,IAAI,CAqDtB;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,aAAa,GACpB;IAAE,KAAK,EAAE,sBAAsB,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAcrD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,sBAAsB,GAC5B,uBAAuB,CAoDzB;AAED,8EAA8E;AAC9E,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5D,uBAAuB,GAAG,IAAI,CAqBhC;AAED,uFAAuF;AACvF,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC/C,sBAAsB,CAexB;AAED,kFAAkF;AAClF,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACpE,sBAAsB,CAiBxB;AAED,iFAAiF;AACjF,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5D,oBAAoB,CAatB;AAED,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,sBAAsB,GAAG,IAAI,CAE/B;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAIhG;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,YAAY,GAAG,MAAM,CA+BjG;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAoBtD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/context/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAI7C,eAAO,MAAM,sBAAsB,EAAG,CAAU,CAAC;AACjD,eAAO,MAAM,iBAAiB,QAAY,CAAC;AAI3C,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,cAAc,GAAG,QAAQ,GAAG,YAAY,GAAG,UAAU,CAAC;AACjG,MAAM,MAAM,uBAAuB,GAAG,OAAO,GAAG,UAAU,GAAG,WAAW,CAAC;AACzE,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,cAAc,GAAG,WAAW,GAAG,UAAU,CAAC;AACnF,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,UAAU,GAAG,aAAa,GAAG,aAAa,CAAC;AAErF,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,UAAU,EAAE,uBAAuB,CAAC;IACpC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,OAAO,sBAAsB,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,YAAY,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,OAAO,sBAAsB,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,OAAO,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE;QACJ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,oBAAoB,CAAC,EAAE,OAAO,CAAC;KAChC,CAAC;IACF,IAAI,EAAE,YAAY,CAAC;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,gBAAgB,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,iBAAiB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,sBAAsB,CAAC;IAC9B,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,sBAAsB,CAAC;IAC9B,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,sBAAsB,CAAC;IAC9B,OAAO,EAAE,iBAAiB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAQD,mFAAmF;AACnF,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,EAAE,2BAA2B,GACnC,aAAa,GAAG,IAAI,CAqDtB;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,aAAa,GACpB;IAAE,KAAK,EAAE,sBAAsB,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAcrD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,sBAAsB,GAC5B,uBAAuB,CAoDzB;AAED,8EAA8E;AAC9E,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5D,uBAAuB,GAAG,IAAI,CAqBhC;AAED,uFAAuF;AACvF,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC/C,sBAAsB,CAexB;AAED,kFAAkF;AAClF,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACpE,sBAAsB,CAiBxB;AAED,iFAAiF;AACjF,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5D,oBAAoB,CAatB;AAED,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,sBAAsB,GAAG,IAAI,CAE/B;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAIhG;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,YAAY,GAAG,MAAM,CA+BjG;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAoBtD"}

package/dist/core/context/index.js

@@ -9,6 +9,7 @@ import { createHash, randomUUID } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { readLiveCoordinationRow } from "../agents/state/live-coordination-view.js";
+import { stateFileMode } from "../storage/modes.js";
 export const CONTEXT_SCHEMA_VERSION = 1;
 export const MAX_CAPSULE_BYTES = 32 * 1024;
 const MAX_SNAPSHOT_PATHS = 15;
@@ -319,7 +320,7 @@ function writeBoundedJson(path, value, maxBytes) {
     }
     mkdirSync(dirname(path), { recursive: true });
     const temp = `${path}.tmp.${process.pid}.${randomUUID()}`;
-    writeFileSync(temp, text, { encoding: "utf8", mode: 0o600 });
+    writeFileSync(temp, text, { encoding: "utf8", mode: stateFileMode() });
     renameSync(temp, path);
 }
 function readJson(path) {

package/dist/core/conversations/archive.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive.d.ts","sourceRoot":"","sources":["../../../src/core/conversations/archive.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,2BAA2B,EAEjC,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EACV,6BAA6B,EAC7B,uCAAuC,EACvC,2BAA2B,EAC3B,2BAA2B,EAC3B,iCAAiC,EAClC,MAAM,eAAe,CAAC;AAGvB,eAAO,MAAM,oCAAoC,EAAG,kCAA2C,CAAC;AAEhG,MAAM,WAAW,kCAAkC;IACjD,MAAM,EAAE,OAAO,oCAAoC,CAAC;IACpD,cAAc,EAAE,yBAAyB,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,iCAAiC,CAAC,cAAc,CAAC,CAAC;IAChE,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,UAAU,MAAM,EAAE,CAAC;IACtC,cAAc,EAAE,uCAAuC,CAAC;IACxD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,6BAA6B,CAAC;IAC3C,cAAc,EAAE,uCAAuC,CAAC;IACxD,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,KAAK,CAAC,EAAE,CACN,QAAQ,EACJ,2BAA2B,GAC3B,qBAAqB,GACrB,yBAAyB,GACzB,wBAAwB,KACzB,IAAI,CAAC;CACX;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,UAAU,GAAG,aAAa,GAAG,UAAU,CAAC;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,QAAQ,CAAC,EAAE,kCAAkC,CAAC;CAC/C;AAED,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,2BAA2B,EACrC,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,yBAAyB,CAAC,CAoEpC;AAED,wBAAgB,uBAAuB,CACrC,oBAAoB,EAAE,MAAM,EAC5B,UAAU,CAAC,EAAE,MAAM,EACnB,cAAc,CAAC,EAAE,MAAM,GACtB,2BAA2B,EAAE,CAS/B;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,iCAAiC,CAAC;IAC5C,cAAc,EAAE,uCAAuC,CAAC;IACxD,GAAG,EAAE,IAAI,CAAC;CACX,GAAG,kCAAkC,CAcrC;AAED,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GACrB,kCAAkC,GAAG,SAAS,CAUhD;AAED,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GACrB,MAAM,CAIR"}
+{"version":3,"file":"archive.d.ts","sourceRoot":"","sources":["../../../src/core/conversations/archive.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,2BAA2B,EAEjC,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EACV,6BAA6B,EAC7B,uCAAuC,EACvC,2BAA2B,EAC3B,2BAA2B,EAC3B,iCAAiC,EAClC,MAAM,eAAe,CAAC;AAGvB,eAAO,MAAM,oCAAoC,EAAG,kCAA2C,CAAC;AAEhG,MAAM,WAAW,kCAAkC;IACjD,MAAM,EAAE,OAAO,oCAAoC,CAAC;IACpD,cAAc,EAAE,yBAAyB,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,iCAAiC,CAAC,cAAc,CAAC,CAAC;IAChE,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,UAAU,MAAM,EAAE,CAAC;IACtC,cAAc,EAAE,uCAAuC,CAAC;IACxD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,6BAA6B,CAAC;IAC3C,cAAc,EAAE,uCAAuC,CAAC;IACxD,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,KAAK,CAAC,EAAE,CACN,QAAQ,EACJ,2BAA2B,GAC3B,qBAAqB,GACrB,yBAAyB,GACzB,wBAAwB,KACzB,IAAI,CAAC;CACX;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,UAAU,GAAG,aAAa,GAAG,UAAU,CAAC;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,QAAQ,CAAC,EAAE,kCAAkC,CAAC;CAC/C;AAED,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,2BAA2B,EACrC,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,yBAAyB,CAAC,CAoEpC;AAED,wBAAgB,uBAAuB,CACrC,oBAAoB,EAAE,MAAM,EAC5B,UAAU,CAAC,EAAE,MAAM,EACnB,cAAc,CAAC,EAAE,MAAM,GACtB,2BAA2B,EAAE,CAS/B;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,iCAAiC,CAAC;IAC5C,cAAc,EAAE,uCAAuC,CAAC;IACxD,GAAG,EAAE,IAAI,CAAC;CACX,GAAG,kCAAkC,CAcrC;AAED,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GACrB,kCAAkC,GAAG,SAAS,CAUhD;AAED,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GACrB,MAAM,CAIR"}

package/dist/core/conversations/archive.js

@@ -1,6 +1,7 @@
 import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { appendDurableHistoryRecord, readDurableHistorySync, } from "../storage/durable-history.js";
+import { stateDirMode, stateFileMode } from "../storage/modes.js";
 import { digest, normalizeConversationRecord } from "./normalize.js";
 export const HARNERY_CONVERSATION_MANIFEST_SCHEMA = "harnery.conversation-manifest/v1";
 export async function captureProviderConversation(provider, options) {
@@ -9,10 +10,10 @@ export async function captureProviderConversation(provider, options) {
     if (options.access_mode === "source")
         return result("source-only");
     const objectDir = conversationArchiveDir(options.coord_root, provider.capabilities.provider_id, options.conversation_id);
-    mkdirSync(objectDir, { recursive: true, mode: 0o700 });
+    mkdirSync(objectDir, { recursive: true, mode: stateDirMode() });
     const lease = join(objectDir, ".capture.lease");
     try {
-        mkdirSync(lease, { mode: 0o700 });
+        mkdirSync(lease, { mode: stateDirMode() });
     }
     catch {
         throw new Error(`conversation capture lease busy: ${options.conversation_id}`);
@@ -123,7 +124,7 @@ function manifestFor(records, snapshot, authorityMode, now) {
 function publishManifest(objectDir, manifest) {
     const path = join(objectDir, "manifest.json");
     const temp = `${path}.tmp-${process.pid}`;
-    writeFileSync(temp, `${JSON.stringify(manifest, null, 2)}\n`, { mode: 0o600 });
+    writeFileSync(temp, `${JSON.stringify(manifest, null, 2)}\n`, { mode: stateFileMode() });
     renameSync(temp, path);
 }
 function opaque(value) {

package/dist/core/diagnostics/bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../../../src/core/diagnostics/bundle.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,aAAa,EACb,sBAAsB,EAEvB,MAAM,uBAAuB,CAAC;AAwB/B,OAAO,EASL,KAAK,wBAAwB,EAG7B,KAAK,sBAAsB,EAE3B,KAAK,iBAAiB,EAItB,KAAK,yBAAyB,EAC/B,MAAM,eAAe,CAAC;AA2BvB,MAAM,WAAW,4BAA4B;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,wBAAwB,CAAC;IACnC,OAAO,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IACzD,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,4BAA4B;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IACzD,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,MAAM,EACnB,KAAK,GAAE,4BAAiC,GACvC,wBAAwB,CAwG1B;AAkCD,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,GACV,yBAAyB,CAsB3B;AAED,gFAAgF;AAChF,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,yBAAyB,CAK3B;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,yBAAyB,CAE7F;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,uBAAuB,EAAE,CA0BjF;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,GAAG,4BAA4B,EAAE,CA4C/F;AAqCD,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,GAAG,OAAa,GACf,sBAAsB,CAgBxB"}
+{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../../../src/core/diagnostics/bundle.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,aAAa,EACb,sBAAsB,EAEvB,MAAM,uBAAuB,CAAC;AA0B/B,OAAO,EASL,KAAK,wBAAwB,EAG7B,KAAK,sBAAsB,EAE3B,KAAK,iBAAiB,EAItB,KAAK,yBAAyB,EAC/B,MAAM,eAAe,CAAC;AA2BvB,MAAM,WAAW,4BAA4B;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,wBAAwB,CAAC;IACnC,OAAO,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IACzD,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,4BAA4B;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IACzD,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,MAAM,EACnB,KAAK,GAAE,4BAAiC,GACvC,wBAAwB,CAwG1B;AAkCD,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,GACV,yBAAyB,CAsB3B;AAED,gFAAgF;AAChF,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,yBAAyB,CAK3B;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,yBAAyB,CAE7F;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,uBAAuB,EAAE,CA0BjF;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,GAAG,4BAA4B,EAAE,CA4C/F;AAqCD,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,GAAG,OAAa,GACf,sBAAsB,CAgBxB"}

package/dist/core/diagnostics/bundle.js

@@ -1,8 +1,9 @@
 import { chmodSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, } from "node:fs";
 import { dirname, join, resolve, sep } from "node:path";
-import { ARTIFACT_MANIFEST, artifactsRoot, configuredArtifactRetentionDays, createArtifact, inventoryArtifacts, parseArtifactManifest, releaseArtifact, resolveArtifactRef, } from "../artifacts/index.js";
+import { ARTIFACT_MANIFEST, artifactHoldState, artifactsRoot, configuredArtifactRetentionDays, createArtifact, inventoryArtifacts, parseArtifactManifest, releaseArtifact, resolveArtifactRef, } from "../artifacts/index.js";
 import { currentHarneryRuntimeBuild } from "../events/v3/runtime-build.js";
 import { writePrivateJsonAtomic } from "../storage/atomic-json.js";
+import { stateDirMode } from "../storage/modes.js";
 import { SUPERVISOR_DIAGNOSTIC_LIMITS, SUPERVISOR_EXPLANATION_SCHEMA_VERSION, SUPERVISOR_FINDING_POLICY, SUPERVISOR_FINDING_SCHEMA_VERSION, SUPERVISOR_RESOURCE_BUDGET, SUPERVISOR_TIMELINE_SCHEMA_VERSION, } from "../supervisor/contract.js";
 import { readWorkflowProof } from "../workflow/proof.js";
 import { DIAGNOSTIC_ADVICE_SCHEMA_VERSION, DIAGNOSTIC_BUNDLE_FILES, DIAGNOSTIC_BUNDLE_SCHEMA_VERSION, DIAGNOSTIC_COMMAND_SCHEMA_VERSION, DIAGNOSTIC_EXPECTED_SCHEMA_VERSION, DIAGNOSTIC_INPUT_SCHEMA_VERSION, DIAGNOSTIC_SUMMARY_SCHEMA_VERSION, PRESSURE_ASSESSMENT_SCHEMA_VERSION, PRESSURE_POLICY, } from "./contract.js";
@@ -68,8 +69,8 @@ export function captureDiagnosticBundle(repoRootRaw, input = {}) {
         now,
     });
     const inputsPath = join(created.path, "inputs");
-    mkdirSync(inputsPath, { recursive: true, mode: 0o700 });
-    tryChmod(inputsPath, 0o700);
+    mkdirSync(inputsPath, { recursive: true, mode: stateDirMode() });
+    tryChmod(inputsPath, stateDirMode());
     const payloads = {
         "inputs/observations.json": observations,
         "inputs/thresholds.json": thresholds,
@@ -286,7 +287,7 @@ function candidateArtifactId(artifactPath) {
     }
 }
 function candidateClassification(manifest) {
-    if (manifest.holds.length > 0)
+    if (artifactHoldState(manifest).active.length > 0)
         return "managed-held";
     if (!manifest.released_at)
         return "managed-active";

package/dist/core/events/legacy-storage/canary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"canary.d.ts","sourceRoot":"","sources":["../../../../src/core/events/legacy-storage/canary.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,uBAAuB,EAAmC,MAAM,eAAe,CAAC;AAG9F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,uBAAuB,CAAC;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,IAAI,CAAC;IACvB,mBAAmB,EAAE,KAAK,CAAC;CAC5B;AAED,iFAAiF;AACjF,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,uBAAuB,EAAE,MAAM,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAyFhC;AAED,wBAAgB,iCAAiC,IAAI,KAAK,CAEzD"}
+{"version":3,"file":"canary.d.ts","sourceRoot":"","sources":["../../../../src/core/events/legacy-storage/canary.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,KAAK,uBAAuB,EAAmC,MAAM,eAAe,CAAC;AAG9F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,uBAAuB,CAAC;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,IAAI,CAAC;IACvB,mBAAmB,EAAE,KAAK,CAAC;CAC5B;AAED,iFAAiF;AACjF,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,uBAAuB,EAAE,MAAM,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAyFhC;AAED,wBAAgB,iCAAiC,IAAI,KAAK,CAEzD"}

package/dist/core/events/legacy-storage/canary.js

@@ -4,6 +4,7 @@ import { chmod, lstat, mkdir, open, rename, rm } from "node:fs/promises";
 import { basename, join, resolve } from "node:path";
 import { pipeline } from "node:stream/promises";
 import { createGzip } from "node:zlib";
+import { stateDirMode, stateFileMode } from "../../storage/modes.js";
 import { canonicalJsonV3 } from "../v3/canonical.js";
 import { verifyLegacyV1HardFence } from "./fence.js";
 import { validateLegacyV1SegmentManifest } from "./manifest.js";
@@ -29,15 +30,15 @@ export async function writeLegacyV1Canary(input) {
         .digest("hex")
         .slice(0, 32)}`;
     const outputDirectory = resolve(input.output_directory);
-    await mkdir(outputDirectory, { recursive: true, mode: 0o700 });
-    await chmod(outputDirectory, 0o700);
+    await mkdir(outputDirectory, { recursive: true, mode: stateDirMode() });
+    await chmod(outputDirectory, stateDirMode());
     const payloadPath = join(outputDirectory, `${segmentId}.ndjson.gz`);
     const manifestPath = join(outputDirectory, `${segmentId}.manifest.json`);
     const partialPayload = `${payloadPath}.partial`;
     const partialManifest = `${manifestPath}.partial`;
     await rejectExisting([payloadPath, manifestPath, partialPayload, partialManifest]);
     try {
-        await pipeline(createReadStream(source), createGzip({ level: 9 }), createWriteStream(partialPayload, { flags: "wx", mode: 0o600 }));
+        await pipeline(createReadStream(source), createGzip({ level: 9 }), createWriteStream(partialPayload, { flags: "wx", mode: stateFileMode() }));
         await rename(partialPayload, payloadPath);
         const payloadStat = await lstat(payloadPath);
         const manifest = validateLegacyV1SegmentManifest({
@@ -61,7 +62,7 @@ export async function writeLegacyV1Canary(input) {
             minimum_harnery_version: input.minimum_harnery_version,
             created_at: input.created_at,
         });
-        const handle = await open(partialManifest, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600);
+        const handle = await open(partialManifest, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, stateFileMode());
         try {
             await handle.writeFile(`${canonicalJsonV3(manifest)}\n`, "utf8");
             await handle.sync();

package/dist/core/events/legacy-storage/compression.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compression.d.ts","sourceRoot":"","sources":["../../../../src/core/events/legacy-storage/compression.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAW/E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,YAAY,CAAC;IACjD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,8BAA8B,CAClD,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3B,OAAO,CAAC,wBAAwB,EAAE,CAAC,CA0FrC"}
+{"version":3,"file":"compression.d.ts","sourceRoot":"","sources":["../../../../src/core/events/legacy-storage/compression.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAY/E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,YAAY,CAAC;IACjD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,8BAA8B,CAClD,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3B,OAAO,CAAC,wBAAwB,EAAE,CAAC,CA0FrC"}

package/dist/core/events/legacy-storage/compression.js

@@ -4,6 +4,7 @@ import { chmod, lstat, rename, rm } from "node:fs/promises";
 import { basename } from "node:path";
 import { pipeline } from "node:stream/promises";
 import { createGzip } from "node:zlib";
+import { stateFileMode } from "../../storage/modes.js";
 import { verifyLegacyV1HardFence } from "./fence.js";
 import { inventoryLegacyV1Segments } from "./inventory.js";
 import { streamLegacyV1Rows } from "./reader.js";
@@ -66,7 +67,7 @@ export async function compressSealedLegacyV1Segments(coordRoot, opts = {}) {
                 if (error.code !== "ENOENT")
                     throw error;
             }
-            await pipeline(createReadStream(row.path), createGzip({ level: 9 }), createWriteStream(temporary, { flags: "wx", mode: 0o600 }));
+            await pipeline(createReadStream(row.path), createGzip({ level: 9 }), createWriteStream(temporary, { flags: "wx", mode: stateFileMode() }));
             await proveRowParity(row.path, temporary);
             const unchanged = (await inventoryLegacyV1Segments(coordRoot)).find((entry) => entry.path === row.path);
             if (!unchanged ||

package/dist/core/events/v3/adapter-id.d.ts

@@ -1,6 +1,14 @@
-import type { Adapter } from "../../adapter.js";
+import { type Adapter, type AdapterFallbackOptions } from "../../adapter.js";
 /** Harness identities that may produce or describe Event Ledger V3 evidence. */
 export type EventAdapterIdV3 = Adapter | "openclaw";
 /** Canonical event-adapter census. Workflow launch adapters remain in core/adapter.ts. */
-export declare const EVENT_ADAPTER_IDS_V3: readonly ["claude-code", "codex", "cursor", "openclaw"];
+export declare const EVENT_ADAPTER_IDS_V3: readonly ["claude-code", "codex", "cursor", "opencode", "openclaw"];
+/** Strict event-adapter normalizer: a known id or `null`. */
+export declare function normalizeEventAdapterIdV3(value: unknown): EventAdapterIdV3 | null;
+/**
+ * Heartbeat `platform` to an event adapter id, substituting `DEFAULT_ADAPTER`
+ * and reporting the substitution. Use this wherever a row must be attributed
+ * to some adapter; use `normalizeEventAdapterIdV3` when `null` is acceptable.
+ */
+export declare function eventAdapterIdV3FromPlatform(value: unknown, options?: AdapterFallbackOptions): EventAdapterIdV3;
 //# sourceMappingURL=adapter-id.d.ts.map

package/dist/core/events/v3/adapter-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter-id.d.ts","sourceRoot":"","sources":["../../../../src/core/events/v3/adapter-id.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEhD,gFAAgF;AAChF,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,UAAU,CAAC;AAEpD,0FAA0F;AAC1F,eAAO,MAAM,oBAAoB,yDAKe,CAAC"}
+{"version":3,"file":"adapter-id.d.ts","sourceRoot":"","sources":["../../../../src/core/events/v3/adapter-id.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,sBAAsB,EAI5B,MAAM,kBAAkB,CAAC;AAE1B,gFAAgF;AAChF,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,UAAU,CAAC;AAEpD,0FAA0F;AAC1F,eAAO,MAAM,oBAAoB,qEAMe,CAAC;AAMjD,6DAA6D;AAC7D,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,GAAG,IAAI,CAEjF;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,sBAAsB,GAC/B,gBAAgB,CAElB"}

package/dist/core/events/v3/adapter-id.js

@@ -1,7 +1,23 @@
+import { DEFAULT_ADAPTER, normalizeAdapterId, resolveAdapterId, } from "../../adapter.js";
 /** Canonical event-adapter census. Workflow launch adapters remain in core/adapter.ts. */
 export const EVENT_ADAPTER_IDS_V3 = [
     "claude-code",
     "codex",
     "cursor",
+    "opencode",
     "openclaw",
 ];
+const eventAdapterIdsComplete = true;
+void eventAdapterIdsComplete;
+/** Strict event-adapter normalizer: a known id or `null`. */
+export function normalizeEventAdapterIdV3(value) {
+    return normalizeAdapterId(value, EVENT_ADAPTER_IDS_V3);
+}
+/**
+ * Heartbeat `platform` to an event adapter id, substituting `DEFAULT_ADAPTER`
+ * and reporting the substitution. Use this wherever a row must be attributed
+ * to some adapter; use `normalizeEventAdapterIdV3` when `null` is acceptable.
+ */
+export function eventAdapterIdV3FromPlatform(value, options) {
+    return resolveAdapterId(value, EVENT_ADAPTER_IDS_V3, DEFAULT_ADAPTER, options);
+}

package/dist/core/events/v3/authority-outbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authority-outbox.d.ts","sourceRoot":"","sources":["../../../../src/core/events/v3/authority-outbox.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAK7C,MAAM,WAAW,qBAAqB;IACpC,wEAAwE;IACxE,iBAAiB,CAAC,EAAE,OAAO,MAAM,EAAE,CAAC;CACrC;AAQD,MAAM,MAAM,mBAAmB,GAC3B;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,KAAK,GAAG,SAAS,CAAC;IACzB,gBAAgB,CAAC,EAAE,UAAU,MAAM,EAAE,CAAC;CACvC,GACD;IACE,IAAI,EAAE,sBAAsB,CAAC;IAC7B,KAAK,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACD;IACE,IAAI,EAAE,kBAAkB,CAAC;IACzB,SAAS,EAAE,UAAU,GAAG,UAAU,CAAC;IACnC,kBAAkB,EAAE,UAAU,MAAM,EAAE,CAAC;IACvC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B,GACD;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACrB,GACD;IACE,IAAI,EAAE,kBAAkB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,UAAU,GAAG,QAAQ,GAAG,UAAU,CAAC;CAC7C,GACD;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EACL,YAAY,GACZ,UAAU,GACV,UAAU,GACV,gBAAgB,GAChB,YAAY,GACZ,WAAW,CAAC;CACjB,GACD;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EACH,WAAW,GACX,QAAQ,GACR,WAAW,GACX,WAAW,GACX,QAAQ,GACR,aAAa,GACb,SAAS,CAAC;CACf,CAAC;AAEN,MAAM,WAAW,kCAAkC;IACjD,cAAc,CAAC,EAAE,OAAO,MAAM,EAAE,CAAC;IACjC,2BAA2B,EAAE,UAAU,MAAM,EAAE,CAAC;IAChD,oBAAoB,EAAE,UAAU,MAAM,EAAE,CAAC;IACzC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,wCAAwC,CAAC;IACjD,cAAc,EAAE,CAAC,CAAC;IAClB,cAAc,EAAE,OAAO,MAAM,EAAE,CAAC;IAChC,2BAA2B,EAAE,UAAU,MAAM,EAAE,CAAC;IAChD,oBAAoB,EAAE,UAAU,MAAM,EAAE,CAAC;IACzC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,oCAAoC,CAAC;IAC7C,cAAc,EAAE,CAAC,CAAC;IAClB,cAAc,EAAE,OAAO,MAAM,EAAE,CAAC;IAChC,kBAAkB,EAAE,UAAU,MAAM,EAAE,CAAC;IACvC,oBAAoB,EAAE,UAAU,MAAM,EAAE,CAAC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,UAAU,MAAM,EAAE,CAAC;IACrC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,MAAM,UAAU,MAAM,EAAE,CAAC;IAC1C,KAAK,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,KAAK,IAAI,CAAC;IACtE,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wFAAwF;AACxF,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,kCAAkC,GACxC,sBAAsB,CAExB;AAED,kFAAkF;AAClF,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,kCAAkC,GACxC,sBAAsB,CAgBxB;AAED,qFAAqF;AACrF,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,sBAAsB,EACnC,KAAK,GAAE,qBAA0B,GAChC,sBAAsB,CAuBxB;AAED,sGAAsG;AACtG,wBAAgB,+BAA+B,CAC7C,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,UAAU,EAAE,qBAAqB,EACjC,KAAK,GAAE,qBAA0B,GAChC,kBAAkB,CA2CpB;AAED,wBAAgB,kCAAkC,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB,EAAE,CAO9F;AAED,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAG9F;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,sBAAsB,CAa/E;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAavE"}
+{"version":3,"file":"authority-outbox.d.ts","sourceRoot":"","sources":["../../../../src/core/events/v3/authority-outbox.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAK7C,MAAM,WAAW,qBAAqB;IACpC,wEAAwE;IACxE,iBAAiB,CAAC,EAAE,OAAO,MAAM,EAAE,CAAC;CACrC;AAQD,MAAM,MAAM,mBAAmB,GAC3B;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,KAAK,GAAG,SAAS,CAAC;IACzB,gBAAgB,CAAC,EAAE,UAAU,MAAM,EAAE,CAAC;CACvC,GACD;IACE,IAAI,EAAE,sBAAsB,CAAC;IAC7B,KAAK,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACD;IACE,IAAI,EAAE,kBAAkB,CAAC;IACzB,SAAS,EAAE,UAAU,GAAG,UAAU,CAAC;IACnC,kBAAkB,EAAE,UAAU,MAAM,EAAE,CAAC;IACvC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B,GACD;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACrB,GACD;IACE,IAAI,EAAE,kBAAkB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,UAAU,GAAG,QAAQ,GAAG,UAAU,CAAC;CAC7C,GACD;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EACL,YAAY,GACZ,UAAU,GACV,UAAU,GACV,gBAAgB,GAChB,YAAY,GACZ,WAAW,CAAC;CACjB,GACD;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EACH,WAAW,GACX,QAAQ,GACR,WAAW,GACX,WAAW,GACX,QAAQ,GACR,aAAa,GACb,SAAS,CAAC;CACf,CAAC;AAEN,MAAM,WAAW,kCAAkC;IACjD,cAAc,CAAC,EAAE,OAAO,MAAM,EAAE,CAAC;IACjC,2BAA2B,EAAE,UAAU,MAAM,EAAE,CAAC;IAChD,oBAAoB,EAAE,UAAU,MAAM,EAAE,CAAC;IACzC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,wCAAwC,CAAC;IACjD,cAAc,EAAE,CAAC,CAAC;IAClB,cAAc,EAAE,OAAO,MAAM,EAAE,CAAC;IAChC,2BAA2B,EAAE,UAAU,MAAM,EAAE,CAAC;IAChD,oBAAoB,EAAE,UAAU,MAAM,EAAE,CAAC;IACzC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,oCAAoC,CAAC;IAC7C,cAAc,EAAE,CAAC,CAAC;IAClB,cAAc,EAAE,OAAO,MAAM,EAAE,CAAC;IAChC,kBAAkB,EAAE,UAAU,MAAM,EAAE,CAAC;IACvC,oBAAoB,EAAE,UAAU,MAAM,EAAE,CAAC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,UAAU,MAAM,EAAE,CAAC;IACrC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,MAAM,UAAU,MAAM,EAAE,CAAC;IAC1C,KAAK,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,KAAK,IAAI,CAAC;IACtE,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wFAAwF;AACxF,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,kCAAkC,GACxC,sBAAsB,CAExB;AAED,kFAAkF;AAClF,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,kCAAkC,GACxC,sBAAsB,CAgBxB;AAED,qFAAqF;AACrF,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,sBAAsB,EACnC,KAAK,GAAE,qBAA0B,GAChC,sBAAsB,CAuBxB;AAED,sGAAsG;AACtG,wBAAgB,+BAA+B,CAC7C,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,UAAU,EAAE,qBAAqB,EACjC,KAAK,GAAE,qBAA0B,GAChC,kBAAkB,CA2CpB;AAED,wBAAgB,kCAAkC,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB,EAAE,CAO9F;AAED,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAG9F;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,sBAAsB,CAa/E;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAavE"}

package/dist/core/events/v3/authority-outbox.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { closeSync, existsSync, fsyncSync, linkSync, openSync, readdirSync, readFileSync, unlinkSync, writeFileSync, } from "node:fs";
 import { join } from "node:path";
+import { stateFileMode } from "../../storage/modes.js";
 import { fsyncParentDirectory } from "../../workflow/durable-record.js";
 import { canonicalJsonV3, sha256V3 } from "./canonical.js";
 import { liveGenesisIdV3 } from "./control.js";
@@ -382,7 +383,7 @@ function publishExclusive(path, serialized) {
     const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
     let fd;
     try {
-        fd = openSync(temporary, "wx", 0o600);
+        fd = openSync(temporary, "wx", stateFileMode());
         writeFileSync(fd, serialized, "utf8");
         fsyncSync(fd);
         closeSync(fd);

package/dist/core/events/v3/bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../../../src/core/events/v3/bootstrap.ts"],"names":[],"mappings":"AAsBA,OAAO,EAOL,KAAK,mBAAmB,EAEzB,MAAM,cAAc,CAAC;AAStB,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,UAAU,MAAM,EAAE,CAAC;IACjC,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,QAAQ,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC,mBAAmB,EAAE;QAAE,KAAK,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,sCAAsC;IACrD,KAAK,EAAE,SAAS,GAAG,WAAW,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC,mBAAmB,EAAE;QAAE,KAAK,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;CAC5D;AAkBD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,gBAAgB,SAAiC,GAChD,OAAO,CAAC,mBAAmB,EAAE;IAAE,KAAK,EAAE,QAAQ,CAAA;CAAE,CAAC,CAenD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,4BAA4B,GAClC,6BAA6B,CAE/B;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,MAAM,GAChB,sCAAsC,CAgCxC;AAED,MAAM,WAAW,0CAA0C;IACzD,KAAK,EAAE,UAAU,GAAG,cAAc,GAAG,aAAa,CAAC;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,mBAAmB,CAAC;CAC9B;AAED,iFAAiF;AACjF,eAAO,MAAM,8CAA8C,EACzD,uCAAgD,CAAC;AAEnD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oCAAoC,CAClD,SAAS,EAAE,MAAM,GAChB,0CAA0C,CA6B5C;AAWD,MAAM,WAAW,kCAAkC;IACjD,KAAK,EAAE,SAAS,GAAG,eAAe,GAAG,YAAY,GAAG,UAAU,CAAC;IAC/D,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC,mBAAmB,EAAE;QAAE,KAAK,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;CAC7D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,4BAA4B,CAC1C,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAO,GACxC,kCAAkC,CA8DpC"}
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../../../src/core/events/v3/bootstrap.ts"],"names":[],"mappings":"AAuBA,OAAO,EAOL,KAAK,mBAAmB,EAEzB,MAAM,cAAc,CAAC;AAStB,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,UAAU,MAAM,EAAE,CAAC;IACjC,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,QAAQ,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC,mBAAmB,EAAE;QAAE,KAAK,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,sCAAsC;IACrD,KAAK,EAAE,SAAS,GAAG,WAAW,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC,mBAAmB,EAAE;QAAE,KAAK,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;CAC5D;AAkBD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,gBAAgB,SAAiC,GAChD,OAAO,CAAC,mBAAmB,EAAE;IAAE,KAAK,EAAE,QAAQ,CAAA;CAAE,CAAC,CAenD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,4BAA4B,GAClC,6BAA6B,CAE/B;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,MAAM,GAChB,sCAAsC,CAgCxC;AAED,MAAM,WAAW,0CAA0C;IACzD,KAAK,EAAE,UAAU,GAAG,cAAc,GAAG,aAAa,CAAC;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,mBAAmB,CAAC;CAC9B;AAED,iFAAiF;AACjF,eAAO,MAAM,8CAA8C,EACzD,uCAAgD,CAAC;AAEnD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oCAAoC,CAClD,SAAS,EAAE,MAAM,GAChB,0CAA0C,CA6B5C;AAWD,MAAM,WAAW,kCAAkC;IACjD,KAAK,EAAE,SAAS,GAAG,eAAe,GAAG,YAAY,GAAG,UAAU,CAAC;IAC/D,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC,mBAAmB,EAAE;QAAE,KAAK,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;CAC7D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,4BAA4B,CAC1C,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAO,GACxC,kCAAkC,CA8DpC"}