harnery 0.40.0 → 0.42.0

package/src/core/servers/net.ts

@@ -0,0 +1,283 @@
+/**
+ * Local socket and process observation for the server registry.
+ *
+ * Linux reads procfs directly (no `ss`/`lsof` dependency, works under WSL).
+ * macOS shells out to `lsof` and `ps`. Other platforms report `unsupported`
+ * so callers can say the scan did not run rather than implying it found
+ * nothing.
+ */
+
+import { spawnSync } from "node:child_process";
+import { readdirSync, readFileSync, readlinkSync } from "node:fs";
+
+export type ScanSupport = "procfs" | "lsof" | "unsupported";
+
+export interface ListeningSocket {
+  pid: number;
+  port: number;
+  address: string;
+}
+
+export interface ProcessInfo {
+  pid: number;
+  ppid: number | null;
+  command: string;
+  cwd: string | null;
+}
+
+export function scanSupport(): ScanSupport {
+  if (process.platform === "linux") return "procfs";
+  if (process.platform === "darwin") return "lsof";
+  return "unsupported";
+}
+
+interface ProcSocketRow {
+  localAddress: string;
+  localPort: number;
+  state: string;
+  inode: string;
+}
+
+/** Parse `/proc/net/tcp` or `/proc/net/tcp6` content. */
+export function parseProcNetTcp(content: string): ProcSocketRow[] {
+  const rows: ProcSocketRow[] = [];
+  for (const line of content.split("\n").slice(1)) {
+    const fields = line.trim().split(/\s+/);
+    if (fields.length < 10) continue;
+    const [address, portHex] = (fields[1] ?? "").split(":");
+    if (!address || !portHex) continue;
+    rows.push({
+      localAddress: decodeProcAddress(address),
+      localPort: Number.parseInt(portHex, 16),
+      state: fields[3] ?? "",
+      inode: fields[9] ?? "",
+    });
+  }
+  return rows;
+}
+
+function decodeProcAddress(hex: string): string {
+  if (hex.length === 8) {
+    const bytes = hex.match(/../g)?.map((pair) => Number.parseInt(pair, 16)) ?? [];
+    return bytes.reverse().join(".");
+  }
+  if (/^0+$/.test(hex)) return "::";
+  if (hex === "00000000000000000000000001000000") return "::1";
+  if (hex.startsWith("0000000000000000FFFF0000")) return decodeProcAddress(hex.slice(24));
+  return `ipv6:${hex.toLowerCase()}`;
+}
+
+function readProcSockets(): ProcSocketRow[] {
+  const rows: ProcSocketRow[] = [];
+  for (const file of ["/proc/net/tcp", "/proc/net/tcp6"]) {
+    try {
+      rows.push(...parseProcNetTcp(readFileSync(file, "utf8")));
+    } catch {
+      // tcp6 is absent on IPv6-disabled kernels.
+    }
+  }
+  return rows;
+}
+
+/** Map socket inodes to the pids holding them (only processes we may read). */
+function socketOwners(inodes: Set<string>): Map<string, number> {
+  const owners = new Map<string, number>();
+  if (inodes.size === 0) return owners;
+  let entries: string[];
+  try {
+    entries = readdirSync("/proc");
+  } catch {
+    return owners;
+  }
+  for (const entry of entries) {
+    if (!/^\d+$/.test(entry)) continue;
+    let fds: string[];
+    try {
+      fds = readdirSync(`/proc/${entry}/fd`);
+    } catch {
+      continue;
+    }
+    for (const fd of fds) {
+      let target: string;
+      try {
+        target = readlinkSync(`/proc/${entry}/fd/${fd}`);
+      } catch {
+        continue;
+      }
+      const match = /^socket:\[(\d+)\]$/.exec(target);
+      if (match?.[1] && inodes.has(match[1]) && !owners.has(match[1])) {
+        owners.set(match[1], Number(entry));
+      }
+    }
+    if (owners.size === inodes.size) break;
+  }
+  return owners;
+}
+
+/** Listening TCP sockets whose owning process this user can see. */
+export function listListeningSockets(): ListeningSocket[] {
+  const support = scanSupport();
+  if (support === "procfs") {
+    const listening = readProcSockets().filter((row) => row.state === "0A");
+    const owners = socketOwners(new Set(listening.map((row) => row.inode)));
+    const seen = new Set<string>();
+    const sockets: ListeningSocket[] = [];
+    for (const row of listening) {
+      const pid = owners.get(row.inode);
+      if (!pid) continue;
+      const key = `${pid}:${row.localPort}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      sockets.push({ pid, port: row.localPort, address: row.localAddress });
+    }
+    return sockets.sort((a, b) => a.port - b.port);
+  }
+  if (support === "lsof") return lsofListeningSockets();
+  return [];
+}
+
+/**
+ * Every listening TCP port on this machine, including ports whose owner this
+ * user cannot see (containers, other users). Used to avoid port collisions.
+ */
+export function listListeningPorts(): Set<number> {
+  const support = scanSupport();
+  if (support === "procfs")
+    return new Set(
+      readProcSockets()
+        .filter((row) => row.state === "0A")
+        .map((row) => row.localPort),
+    );
+  if (support === "lsof") return new Set(listListeningSockets().map((socket) => socket.port));
+  return new Set();
+}
+
+/** Parse `lsof -Fpn` output for listening sockets. */
+export function parseLsofListen(output: string): ListeningSocket[] {
+  const sockets: ListeningSocket[] = [];
+  const seen = new Set<string>();
+  let pid = 0;
+  for (const line of output.split("\n")) {
+    if (line.startsWith("p")) pid = Number(line.slice(1));
+    else if (line.startsWith("n") && pid > 0) {
+      const match = /^(.*):(\d+)$/.exec(line.slice(1));
+      if (!match?.[2]) continue;
+      const port = Number(match[2]);
+      const key = `${pid}:${port}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      sockets.push({ pid, port, address: (match[1] ?? "").replace(/^\[|\]$/g, "") });
+    }
+  }
+  return sockets.sort((a, b) => a.port - b.port);
+}
+
+/**
+ * Count established server-side connections per local port. A browser tab
+ * holding a live-reload socket or keep-alive connection counts as activity.
+ */
+export function establishedConnectionCounts(ports: number[]): Map<number, number> {
+  const counts = new Map<number, number>();
+  const wanted = new Set(ports.filter((port) => Number.isInteger(port) && port > 0));
+  if (wanted.size === 0) return counts;
+  const support = scanSupport();
+  if (support === "procfs") {
+    for (const row of readProcSockets()) {
+      // 01 ESTABLISHED; 03 SYN_RECV, where a deferred-accept server parks a
+      // connected client until its first bytes arrive.
+      if ((row.state !== "01" && row.state !== "03") || !wanted.has(row.localPort)) continue;
+      counts.set(row.localPort, (counts.get(row.localPort) ?? 0) + 1);
+    }
+    return counts;
+  }
+  if (support === "lsof") return lsofConnectionCounts(wanted);
+  return counts;
+}
+
+/** Listening sockets via `lsof` (the macOS path; also runs wherever lsof exists). */
+export function lsofListeningSockets(): ListeningSocket[] {
+  return parseLsofListen(run("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-Fpn"]));
+}
+
+/** Server-side established connections per wanted local port, via `lsof`. */
+export function lsofConnectionCounts(wanted: Set<number>): Map<number, number> {
+  const counts = new Map<number, number>();
+  const output = run("lsof", ["-nP", "-iTCP", "-sTCP:ESTABLISHED", "-Fn"]);
+  for (const line of output.split("\n")) {
+    const match = /^n.*?:(\d+)->/.exec(line);
+    const port = match?.[1] ? Number(match[1]) : 0;
+    if (wanted.has(port)) counts.set(port, (counts.get(port) ?? 0) + 1);
+  }
+  return counts;
+}
+
+/** Parent, command line, and working directory via `ps` and `lsof` (the macOS path). */
+export function psProcessInfo(pid: number): ProcessInfo | null {
+  const ps = run("ps", ["-o", "ppid=,command=", "-p", String(pid)]).trim();
+  if (!ps) return null;
+  const match = /^(\d+)\s+(.*)$/.exec(ps);
+  const cwdLine = run("lsof", ["-a", "-p", String(pid), "-d", "cwd", "-Fn"])
+    .split("\n")
+    .find((line) => line.startsWith("n"));
+  return {
+    pid,
+    ppid: match?.[1] ? Number(match[1]) : null,
+    command: match?.[2] ?? ps,
+    cwd: cwdLine ? cwdLine.slice(1) : null,
+  };
+}
+
+export function readProcessInfo(pid: number): ProcessInfo | null {
+  if (process.platform === "linux") {
+    try {
+      const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+      const afterComm = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
+      const ppid = Number(afterComm[1]);
+      const command = readFileSync(`/proc/${pid}/cmdline`, "utf8").split("\0").join(" ").trim();
+      let cwd: string | null = null;
+      try {
+        cwd = readlinkSync(`/proc/${pid}/cwd`);
+      } catch {
+        cwd = null;
+      }
+      return { pid, ppid: Number.isInteger(ppid) ? ppid : null, command, cwd };
+    } catch {
+      return null;
+    }
+  }
+  if (process.platform === "darwin") return psProcessInfo(pid);
+  return null;
+}
+
+/** Parse `ps -o etime=` output (`[[dd-]hh:]mm:ss`) into seconds. */
+export function parseElapsed(value: string): number | null {
+  const match = /^\s*(?:(\d+)-)?(?:(\d+):)?(\d+):(\d+)\s*$/.exec(value);
+  if (!match) return null;
+  const [, days, hours, minutes, seconds] = match;
+  return (
+    Number(days ?? 0) * 86_400 + Number(hours ?? 0) * 3_600 + Number(minutes) * 60 + Number(seconds)
+  );
+}
+
+/** When a process started, from its elapsed run time; null when unavailable. */
+export function processStartedAt(pid: number, now = Date.now()): string | null {
+  if (process.platform !== "linux" && process.platform !== "darwin") return null;
+  const elapsed = parseElapsed(run("ps", ["-o", "etime=", "-p", String(pid)]));
+  return elapsed === null ? null : new Date(now - elapsed * 1_000).toISOString();
+}
+
+/** The pid followed by its ancestors, nearest first (bounded). */
+export function ancestry(pid: number, maxHops = 32): number[] {
+  const chain: number[] = [];
+  let current: number | null = pid;
+  while (current && current > 1 && chain.length < maxHops && !chain.includes(current)) {
+    chain.push(current);
+    current = readProcessInfo(current)?.ppid ?? null;
+  }
+  return chain;
+}
+
+function run(command: string, args: string[]): string {
+  const result = spawnSync(command, args, { encoding: "utf8", timeout: 10_000 });
+  return result.status === 0 || result.stdout ? (result.stdout ?? "") : "";
+}

package/src/core/servers/tunnels.ts

@@ -0,0 +1,39 @@
+/**
+ * Tunnels as registry services.
+ *
+ * `tunnel up` and `tunnel reload` register the instance; `tunnel down`
+ * removes it. Tunnels started before the registry existed are adopted the next
+ * time the registry is read, so a long-lived tunnel never shows as an
+ * unregistered listener.
+ */
+
+import { resolve } from "node:path";
+import { gateLogFile, type TunnelState } from "../../lib/tunnel/state.ts";
+import { resolveBinName } from "../config.ts";
+import type { RegisterServerInput } from "./index.ts";
+
+export function tunnelServerId(name: string): string {
+  return `tunnel-${name.toLowerCase().replace(/[^a-z0-9._-]+/g, "-")}`;
+}
+
+/** The registry input for one tunnel instance. */
+export function tunnelServerInput(state: TunnelState, coordRoot: string): RegisterServerInput {
+  const helpers = [state.cloudflared_pid, state.provider_pid].filter(
+    (pid): pid is number => typeof pid === "number" && pid > 0,
+  );
+  return {
+    id: tunnelServerId(state.name),
+    kind: "service",
+    type: "tunnel",
+    label: `Tunnel ${state.name} → ${state.target}${state.vhost ? ` (${state.vhost})` : ""}`,
+    url: state.url,
+    port: state.gate_port,
+    pid: state.gate_pid,
+    ...(helpers.length ? { pids: helpers } : {}),
+    log: resolve(coordRoot, ".cache", "tunnel", gateLogFile(state.name)),
+    cwd: coordRoot,
+    stop_argv: [resolveBinName(coordRoot), "tunnel", "down", "--name", state.name],
+    started_at: state.started_at,
+    owner: null,
+  };
+}

package/src/core/storage/atomic-json.ts

@@ -1,13 +1,17 @@
 import { chmodSync, mkdirSync, renameSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
+import { stateDirMode, stateFileMode } from "./modes.ts";
 
 /** Write one private JSON projection without exposing a partial frame to readers. */
 export function writePrivateJsonAtomic(path: string, value: unknown): void {
-  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  mkdirSync(dirname(path), { recursive: true, mode: stateDirMode() });
   const temporary = `${path}.tmp.${process.pid}.${Date.now()}`;
-  writeFileSync(temporary, `${JSON.stringify(value)}\n`, { encoding: "utf8", mode: 0o600 });
+  writeFileSync(temporary, `${JSON.stringify(value)}\n`, {
+    encoding: "utf8",
+    mode: stateFileMode(),
+  });
   try {
-    chmodSync(temporary, 0o600);
+    chmodSync(temporary, stateFileMode());
   } catch {
     // Windows does not expose POSIX modes. The atomic write still applies.
   }

package/src/core/storage/builtins.ts

@@ -476,6 +476,7 @@ function cacheFamilies(): HarneryStorageFamily[] {
     ["pid-map-cache", ".harnery/pid-map", "active native process observations"],
     ["remote-presence-cache", ".harnery/presence/remote", "presence relay observations"],
     ["event-v3-live-display", ".harnery/live/v3", "Event Ledger V3 canonical events"],
+    ["local-server-registry", ".harnery/servers", "running local server processes"],
   ] as const;
   return [
     ...definitions.map(([id, root, source]) =>

package/src/core/storage/durable-history.ts

@@ -20,6 +20,7 @@ import {
 import type { FileHandle } from "node:fs/promises";
 import { open, rename, rm } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative } from "node:path";
+import { stateDirMode, stateFileMode } from "./modes.ts";
 
 export const HARNERY_DURABLE_HISTORY_SCHEMA = "harnery.durable-history/v1" as const;
 
@@ -271,7 +272,7 @@ export async function rewriteCrashSafeJsonlFile(
     const handle = await open(
       temp,
       fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollowFlag(),
-      0o600,
+      stateFileMode(),
     );
     try {
       await writeAll(handle, Buffer.from(body, "utf8"));
@@ -325,7 +326,7 @@ function appendAndSync(
   const fd = openSync(
     path,
     fsConstants.O_RDWR | fsConstants.O_APPEND | fsConstants.O_CREAT | noFollowFlag(),
-    0o600,
+    stateFileMode(),
   );
   try {
     assertOpenFileIdentity(path, fd, parent);
@@ -348,7 +349,7 @@ interface DirectoryIdentity {
 }
 
 function ensurePrivateDirectory(path: string): DirectoryIdentity {
-  mkdirSync(path, { recursive: true, mode: 0o700 });
+  mkdirSync(path, { recursive: true, mode: stateDirMode() });
   return captureDirectoryIdentity(path);
 }
 
@@ -522,7 +523,7 @@ function acquireLease(lease: string): LeaseOwner {
     };
     let claimed: DirectoryIdentity | undefined;
     try {
-      mkdirSync(lease, { mode: 0o700 });
+      mkdirSync(lease, { mode: stateDirMode() });
       assertDirectoryWithinParent(lease, parent);
       claimed = captureDirectoryIdentity(lease);
       writeOwner(join(lease, "owner.json"), owner);
@@ -549,7 +550,7 @@ function writeOwner(path: string, owner: LeaseOwner): void {
   const fd = openSync(
     path,
     fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollowFlag(),
-    0o600,
+    stateFileMode(),
   );
   try {
     assertOpenFileIdentity(path, fd, parent);

package/src/core/storage/maintenance-providers.ts

@@ -12,6 +12,7 @@ import {
   readMaintenanceTransaction,
   runAutomaticMaintenanceSlice,
 } from "./maintenance.ts";
+import { stateFileMode } from "./modes.ts";
 
 const STALE_RUNNING_CLAIM_MS = 10 * 60 * 1_000;
 
@@ -191,7 +192,7 @@ function recoverInterruptedDailyClaim(coordRoot: string, now: Date): void {
 
 function atomicCursor(path: string, cursor: DailyCursor): void {
   const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
-  writeFileSync(temporary, `${JSON.stringify(cursor, null, 2)}\n`, { mode: 0o600 });
+  writeFileSync(temporary, `${JSON.stringify(cursor, null, 2)}\n`, { mode: stateFileMode() });
   renameSync(temporary, path);
 }
 

package/src/core/storage/maintenance.ts

@@ -20,6 +20,7 @@ import {
   HARNERY_STRUCTURED_LOG_PROVIDER_ID,
   type HarneryRegisteredStorageFamily,
 } from "./contract.ts";
+import { stateDirMode, stateFileMode } from "./modes.ts";
 
 export const HARNERY_MAINTENANCE_TRANSACTION_SCHEMA =
   "harnery.storage-maintenance-transaction/v1" as const;
@@ -641,7 +642,7 @@ function writeReceipt(
     committed_at: now.toISOString(),
   };
   const path = receiptPath(coordRoot, transactionId, action.action_id);
-  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  mkdirSync(dirname(path), { recursive: true, mode: stateDirMode() });
   writeExclusiveDurable(path, `${JSON.stringify(receipt, null, 2)}\n`);
 }
 
@@ -678,7 +679,7 @@ function writeRunOutcome(
   now: Date,
 ): void {
   const root = join(resolve(coordRoot), ".harnery", "logs", "storage-maintenance");
-  mkdirSync(root, { recursive: true, mode: 0o700 });
+  mkdirSync(root, { recursive: true, mode: stateDirMode() });
   const active = join(root, "active.jsonl");
   if (existsSync(active) && statSync(active).size > 1_048_576) {
     renameSync(active, join(root, `sealed-${now.toISOString().replaceAll(/[:.]/g, "-")}.jsonl`));
@@ -686,7 +687,7 @@ function writeRunOutcome(
   appendFileSync(
     active,
     `${JSON.stringify({ ts: now.toISOString(), transaction_id: transaction.transaction_id, state: transaction.state, actions: transaction.actions.length, files: transaction.actions.reduce((n, action) => n + action.files, 0), bytes: transaction.actions.reduce((n, action) => n + action.bytes, 0), reason_codes: transaction.reason_codes })}\n`,
-    { encoding: "utf8", mode: 0o600 },
+    { encoding: "utf8", mode: stateFileMode() },
   );
 }
 
@@ -871,9 +872,9 @@ function readJsonFile(path: string): unknown {
 }
 
 function atomicJson(path: string, value: unknown, fsync: boolean): void {
-  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  mkdirSync(dirname(path), { recursive: true, mode: stateDirMode() });
   const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
-  const fd = openSync(temporary, "wx", 0o600);
+  const fd = openSync(temporary, "wx", stateFileMode());
   try {
     writeFileSync(fd, `${JSON.stringify(value, null, 2)}\n`, "utf8");
     if (fsync) fsyncSync(fd);
@@ -884,7 +885,7 @@ function atomicJson(path: string, value: unknown, fsync: boolean): void {
 }
 
 function writeExclusiveDurable(path: string, value: string): void {
-  const fd = openSync(path, "wx", 0o600);
+  const fd = openSync(path, "wx", stateFileMode());
   try {
     writeFileSync(fd, value, "utf8");
     fsyncSync(fd);

package/src/core/storage/metrics.ts

@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { stateFileMode } from "./modes.ts";
 
 export interface HarneryLogMetricsDelta {
   accepted?: number;
@@ -109,7 +110,10 @@ export function mergeMetricsSidecar(
   const merged = mergeMetrics(current, delta, now);
   const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
   try {
-    writeFileSync(temporary, `${JSON.stringify(merged)}\n`, { encoding: "utf8", mode: 0o600 });
+    writeFileSync(temporary, `${JSON.stringify(merged)}\n`, {
+      encoding: "utf8",
+      mode: stateFileMode(),
+    });
     renameSync(temporary, path);
     return { merged: true, generation_reset: generationReset };
   } catch {

package/src/core/storage/modes.ts

@@ -0,0 +1,53 @@
+/**
+ * The permission modes for everything Harnery writes as project state under `.harnery/`.
+ *
+ * `private` (the default) is owner-only: 0700 directories and 0600 files, exactly as before this
+ * module existed. `group` is for a project several Unix users share through one group, such as a
+ * workspace that several people's agents work in at once: 2770 (setgid) and 0660, with nothing ever granted
+ * to other users. Every state write takes its mode from here, and every integrity check that
+ * rejects a loosely permissioned file asks `stateModeTooOpen`, so the two cannot disagree.
+ *
+ * Personal state outside the project (browser cookies, sessions, pacing ledgers in the user's home)
+ * is not project state and stays owner-only regardless.
+ */
+import { storageSharing } from "../config.ts";
+
+let resolved: "private" | "group" | undefined;
+
+/** The sharing mode for this process, resolved once. Tests reset it with `resetStorageSharing`. */
+export function stateSharing(): "private" | "group" {
+  if (resolved === undefined) {
+    resolved = storageSharing();
+    // A umask that strips group bits would quietly turn every group file back into an owner-only
+    // one, and the next user's write would fail. Keep the process's other-bits mask as it was.
+    if (resolved === "group" && typeof process.umask === "function")
+      process.umask(process.umask() & ~0o070);
+  }
+  return resolved;
+}
+
+export function resetStorageSharing(): void {
+  resolved = undefined;
+}
+
+/**
+ * Mode for a directory of project state. Group mode includes setgid: Harnery chmods directories
+ * after creating them, and a plain 0770 would clear the bit, so files made inside would take the
+ * writer's own group instead of the project's, and other users could not read them.
+ */
+export function stateDirMode(): number {
+  return stateSharing() === "group" ? 0o2770 : 0o700;
+}
+
+/** Mode for a file of project state. */
+export function stateFileMode(): number {
+  return stateSharing() === "group" ? 0o660 : 0o600;
+}
+
+/**
+ * True when a state file or directory is readable or writable by someone it should not be: anyone
+ * but the owner in private mode, anyone outside the owner and group in group mode.
+ */
+export function stateModeTooOpen(mode: number): boolean {
+  return (mode & (stateSharing() === "group" ? 0o007 : 0o077)) !== 0;
+}

package/src/core/storage/process-log.ts

@@ -12,6 +12,7 @@ import {
 import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createStorageCatalog } from "./catalog.ts";
+import { stateDirMode, stateFileMode } from "./modes.ts";
 import { familyLogDirectory } from "./segments.ts";
 
 export interface RotatingTextSinkOptions {
@@ -79,7 +80,7 @@ export class RotatingTextSink {
   append(text: string): void {
     if (this.#closed) throw new Error("text sink is closed");
     const bytes = Buffer.from(text, "utf8");
-    mkdirSync(dirname(this.#options.path), { recursive: true, mode: 0o700 });
+    mkdirSync(dirname(this.#options.path), { recursive: true, mode: stateDirMode() });
     let offset = 0;
     while (offset < bytes.byteLength) {
       let current = existsSync(this.#options.path) ? statSync(this.#options.path).size : 0;
@@ -88,7 +89,7 @@ export class RotatingTextSink {
         current = 0;
       }
       const length = Math.min(bytes.byteLength - offset, this.#options.max_bytes - current);
-      const fd = openSync(this.#options.path, "a", 0o600);
+      const fd = openSync(this.#options.path, "a", stateFileMode());
       try {
         writeSync(fd, bytes.subarray(offset, offset + length));
         if (this.#options.durable) fdatasyncSync(fd);

package/src/core/storage/receipts.ts

@@ -18,6 +18,7 @@ import {
   HarneryMaintenanceError,
   type HarneryMaintenanceReceipt,
 } from "./maintenance.ts";
+import { stateDirMode, stateFileMode } from "./modes.ts";
 
 export const HARNERY_RECEIPT_SEGMENT_MANIFEST_SCHEMA =
   "harnery.storage-maintenance-receipt-segment/v1" as const;
@@ -85,7 +86,7 @@ export function consolidateMutationReceipts(
     );
   }
   const segments = join(root, "segments");
-  mkdirSync(segments, { recursive: true, mode: 0o700 });
+  mkdirSync(segments, { recursive: true, mode: stateDirMode() });
   const payloadPath = join(segments, `${segmentId}.jsonl`);
   const manifestPath = join(segments, `${segmentId}.manifest.json`);
   writeExclusiveDurable(payloadPath, payload);
@@ -144,9 +145,9 @@ function readReceipt(path: string): {
 }
 
 function writeExclusiveDurable(path: string, bytes: string): void {
-  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  mkdirSync(dirname(path), { recursive: true, mode: stateDirMode() });
   const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
-  const fd = openSync(temporary, "wx", 0o600);
+  const fd = openSync(temporary, "wx", stateFileMode());
   try {
     writeFileSync(fd, bytes, "utf8");
     fsyncSync(fd);

package/src/core/storage/segments.ts

@@ -23,6 +23,7 @@ import type { HarneryRegisteredStorageFamily } from "./contract.ts";
 import { parseLogRecord } from "./jsonl.ts";
 import type { HarneryLogMetricsDelta } from "./metrics.ts";
 import { mergeMetricsSidecar } from "./metrics.ts";
+import { stateDirMode, stateFileMode } from "./modes.ts";
 
 export interface HarneryLogSegmentV1 {
   sequence: number;
@@ -165,7 +166,7 @@ export class FileSegmentSink {
       const fd = openSync(
         active,
         fsConstants.O_RDWR | fsConstants.O_APPEND | fsConstants.O_CREAT | noFollowFlag(),
-        0o600,
+        stateFileMode(),
       );
       let bytes = 0;
       try {
@@ -337,7 +338,7 @@ export async function withFamilyLease<T>(
   let owner: LeaseOwner | undefined;
   while (true) {
     try {
-      mkdirSync(lease, { mode: 0o700 });
+      mkdirSync(lease, { mode: stateDirMode() });
       const leaseIdentity = captureDirectoryIdentity(lease);
       owner = {
         owner_id: randomUUID(),
@@ -397,7 +398,7 @@ function sealActive(active: string, options: ResolvedSegmentOptions, now: Date):
   const sequence = manifest.next_sequence;
   const name = `${now.toISOString().slice(0, 10).replaceAll("-", "")}-${String(sequence).padStart(8, "0")}.jsonl.gz`;
   const target = join(directory, "segments", name);
-  mkdirSync(dirname(target), { recursive: true, mode: 0o700 });
+  mkdirSync(dirname(target), { recursive: true, mode: stateDirMode() });
   const temporary = `${target}.tmp-${process.pid}-${randomUUID()}`;
   const compressed = gzipSync(content);
   writeNewFile(temporary, compressed);
@@ -425,7 +426,7 @@ function sealActive(active: string, options: ResolvedSegmentOptions, now: Date):
     ],
   };
   const sealedManifest = join(directory, "manifests", `${String(sequence).padStart(8, "0")}.json`);
-  mkdirSync(dirname(sealedManifest), { recursive: true, mode: 0o700 });
+  mkdirSync(dirname(sealedManifest), { recursive: true, mode: stateDirMode() });
   writeNewFile(sealedManifest, Buffer.from(`${JSON.stringify(next)}\n`));
   atomicJson(join(directory, "manifest.json"), next);
   truncateRegularFile(active);
@@ -539,7 +540,7 @@ interface DirectoryIdentity {
 }
 
 function ensurePrivateDirectory(path: string): DirectoryIdentity {
-  mkdirSync(path, { recursive: true, mode: 0o700 });
+  mkdirSync(path, { recursive: true, mode: stateDirMode() });
   return captureDirectoryIdentity(path);
 }
 
@@ -632,7 +633,7 @@ function writeNewFile(path: string, content: Buffer): void {
   const fd = openSync(
     path,
     fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollowFlag(),
-    0o600,
+    stateFileMode(),
   );
   try {
     assertOpenFileIdentity(path, fd, parent);