intentional-cognition-os 1.5.1 → 1.5.2

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [v1.5.2] - 2026-05-26
+
+- Merge pull request #109 from jeremylongshore/feat/audit-chain-race-fix-lhm (312c2e0)
+- fix(kernel/audit): use FD-based open+fstat+write (CodeQL canonical safe pattern) (d32460a)
+- fix(kernel/audit): drop existsSync check-then-use pattern in writeTrace (ad08dac)
+- fix(kernel/audit): serialize writeTrace under SQLite EXCLUSIVE lock (lhm) (d09d62c)
+
 ## [v1.5.1] - 2026-05-26
 
 - chore(beads): file P4 sweep bead for doc 037 prose polish (GFM table-cell escape semantics) (d870d64)

package/README.md

@@ -152,7 +152,7 @@ Global flags on every command: `--workspace <path>`, `--json`, `--verbose`, `--q
 
 ## Status
 
-**v1.0.5 — stable.** 1.5.1 tests passing across 5 packages. Used daily by the author. Public release on npm.
+**v1.0.5 — stable.** 1.5.2 tests passing across 5 packages. Used daily by the author. Public release on npm.
 
 - **Stable**: all 14 commands, the compilation passes, ask + research + recall + render + promote, the audit chain.
 - **In progress**: post-v1 coverage uplift on compiler + cli packages; mutation-testing baseline.

package/dist/index.js

@@ -4329,11 +4329,15 @@ import { join as join3 } from "path";
 import { randomUUID } from "crypto";
 import {
   appendFileSync,
+  closeSync,
+  constants as fsConstants,
   existsSync as existsSync4,
+  fstatSync,
   mkdirSync as mkdirSync2,
+  openSync,
   readFileSync as readFileSync4,
-  statSync,
-  writeFileSync as writeFileSync2
+  writeFileSync as writeFileSync2,
+  writeSync
 } from "fs";
 import { join as join2 } from "path";
 import { readFileSync as readFileSync3 } from "fs";
@@ -4350,7 +4354,7 @@ import { basename, resolve as resolve4 } from "path";
 import { existsSync as existsSync8, readdirSync as readdirSync4, readFileSync as readFileSync7 } from "fs";
 import { basename as basename2, resolve as resolve5 } from "path";
 import { createHash as createHash3, randomUUID as randomUUID5 } from "crypto";
-import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync8, statSync as statSync2, unlinkSync, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync8, statSync, unlinkSync, writeFileSync as writeFileSync4 } from "fs";
 import { join as join5, relative, resolve as resolve6 } from "path";
 import matter from "gray-matter";
 import matter2 from "gray-matter";
@@ -4364,16 +4368,16 @@ import {
   readdirSync as readdirSync6,
   readFileSync as readFileSync11,
   renameSync as renameSync2,
-  statSync as statSync4,
+  statSync as statSync3,
   writeFileSync as writeFileSync5
 } from "fs";
 import { basename as basename3, join as join9, resolve as resolve7 } from "path";
 import matter4 from "gray-matter";
 import { existsSync as existsSync14, readdirSync as readdirSync7, readFileSync as readFileSync12 } from "fs";
 import { basename as basename4, join as join10 } from "path";
-import { mkdirSync as mkdirSync7, readdirSync as readdirSync8, statSync as statSync5, writeFileSync as writeFileSync6 } from "fs";
+import { mkdirSync as mkdirSync7, readdirSync as readdirSync8, statSync as statSync4, writeFileSync as writeFileSync6 } from "fs";
 import { join as join11 } from "path";
-import { readdirSync as readdirSync9, readFileSync as readFileSync13, statSync as statSync6 } from "fs";
+import { readdirSync as readdirSync9, readFileSync as readFileSync13, statSync as statSync5 } from "fs";
 import { join as join12, resolve as resolve8 } from "path";
 import { load as yamlLoad } from "js-yaml";
 import { randomUUID as randomUUID6 } from "crypto";
@@ -4893,39 +4897,46 @@ function writeTrace(db, workspacePath, eventType, payload, options) {
     const absoluteFilePath = join2(workspacePath, relativeFilePath);
     const tracesDir = join2(workspacePath, "audit", "traces");
     mkdirSync2(tracesDir, { recursive: true });
-    const lastLine = readLastLine(absoluteFilePath);
-    const prev_hash = lastLine !== null ? sha256Hex(lastLine) : null;
-    const envelope = {
-      timestamp,
-      event_type: eventType,
-      event_id,
-      correlation_id,
-      payload: safePayload,
-      prev_hash
-    };
-    const jsonLine = JSON.stringify(envelope);
-    let line_offset = 0;
-    if (existsSync4(absoluteFilePath)) {
-      try {
-        line_offset = statSync(absoluteFilePath).size;
-      } catch {
-        line_offset = 0;
-      }
-    }
-    appendFileSync(absoluteFilePath, jsonLine + "\n", "utf-8");
-    const stmt = db.prepare(
+    const insertStmt = db.prepare(
       `INSERT INTO traces (id, event_type, correlation_id, timestamp, file_path, line_offset, summary)
        VALUES (?, ?, ?, ?, ?, ?, ?)`
     );
-    stmt.run(
-      event_id,
-      eventType,
-      correlation_id,
-      timestamp,
-      relativeFilePath,
-      line_offset,
-      summary
-    );
+    const writeAndIndex = db.transaction(() => {
+      const lastLine = readLastLine(absoluteFilePath);
+      const prev_hash = lastLine !== null ? sha256Hex(lastLine) : null;
+      const envelope2 = {
+        timestamp,
+        event_type: eventType,
+        event_id,
+        correlation_id,
+        payload: safePayload,
+        prev_hash
+      };
+      const jsonLine = JSON.stringify(envelope2);
+      const fd = openSync(
+        absoluteFilePath,
+        fsConstants.O_CREAT | fsConstants.O_APPEND | fsConstants.O_WRONLY,
+        384
+      );
+      let line_offset;
+      try {
+        line_offset = fstatSync(fd).size;
+        writeSync(fd, jsonLine + "\n");
+      } finally {
+        closeSync(fd);
+      }
+      insertStmt.run(
+        event_id,
+        eventType,
+        correlation_id,
+        timestamp,
+        relativeFilePath,
+        line_offset,
+        summary
+      );
+      return envelope2;
+    });
+    const envelope = writeAndIndex.exclusive();
     appendToAuditLog(workspacePath, timestamp, eventType, summary);
     return ok(envelope);
   } catch (e) {
@@ -5674,7 +5685,7 @@ function promoteArtifact(db, workspacePath, input) {
   }
   let fileSize;
   try {
-    fileSize = statSync2(absoluteSource).size;
+    fileSize = statSync(absoluteSource).size;
   } catch {
     return err(new PromotionError("FILE_NOT_FOUND", `Cannot stat source file: ${relativeSource}`));
   }
@@ -6096,7 +6107,7 @@ function atomicWriteSpool(outDirAbs, filename, jsonlBody, candidateIds, emittedA
   try {
     writeFileSync5(spoolTmp, jsonlBody, "utf-8");
     renameSync2(spoolTmp, spoolFile);
-    const bytes = statSync4(spoolFile).size;
+    const bytes = statSync3(spoolFile).size;
     const sha256 = createHash4("sha256").update(jsonlBody, "utf-8").digest("hex");
     const manifest = {
       schemaVersion,
@@ -6425,7 +6436,7 @@ function countFiles(dirPath) {
     const files = [];
     for (const entry of entries) {
       try {
-        const s = statSync5(join11(dirPath, entry));
+        const s = statSync4(join11(dirPath, entry));
         if (s.isFile()) {
           files.push(entry);
         }
@@ -11435,7 +11446,7 @@ function register4(program) {
 }
 
 // src/commands/ingest.ts
-import { copyFileSync, existsSync as existsSync24, mkdirSync as mkdirSync9, readdirSync as readdirSync12, statSync as statSync3 } from "fs";
+import { copyFileSync, existsSync as existsSync24, mkdirSync as mkdirSync9, readdirSync as readdirSync12, statSync as statSync2 } from "fs";
 import { basename as basename6, extname, join as join16, relative as relative3 } from "path";
 import { createInterface } from "readline";
 var SIZE_LIMITS = {
@@ -11504,7 +11515,7 @@ function runIngest(filePath, ingestOpts, globalOpts) {
   }
   let fileSize;
   try {
-    fileSize = statSync3(filePath).size;
+    fileSize = statSync2(filePath).size;
   } catch (e) {
     return { ok: false, error: e instanceof Error ? e : new Error(String(e)) };
   }
@@ -11665,7 +11676,7 @@ function register5(program) {
       ...globalOpts.workspace !== void 0 && { workspace: globalOpts.workspace }
     };
     const skipConfirm = opts.yes === true || globalOpts.yes === true;
-    const pathStat = statSync3(filePath, { throwIfNoEntry: false });
+    const pathStat = statSync2(filePath, { throwIfNoEntry: false });
     if (pathStat?.isDirectory()) {
       const files = scanDirectory(filePath);
       if (files.length === 0) {
@@ -11683,7 +11694,7 @@ function register5(program) {
         if (!skipConfirm && process.stdin.isTTY) {
           let fileSize = 0;
           try {
-            fileSize = statSync3(file).size;
+            fileSize = statSync2(file).size;
           } catch {
           }
           const previewType = detectSourceType2(file);
@@ -11729,7 +11740,7 @@ function register5(program) {
       }
       let fileSize = 0;
       try {
-        fileSize = statSync3(filePath).size;
+        fileSize = statSync2(filePath).size;
       } catch {
       }
       const previewType = detectSourceType2(filePath);