mixdog 0.7.11 → 0.7.13

package/hooks/session-start.cjs

@@ -8,34 +8,51 @@ const net = require('net');
 const { spawn } = require('child_process');
 const { resolvePluginData } = require(path.join(__dirname, '..', 'lib', 'plugin-paths.cjs'));
 const { readSection } = require(path.join(__dirname, '..', 'lib', 'config-cjs.cjs'));
-
-// Mirror selected stderr lines to a plugin-data log file so cycle1 traces
-// remain inspectable after the host shell scrolls past. Best-effort: any
-// fs error is swallowed so logging never breaks the hook.
+const {
+  isMixdogDebugEnabled,
+  pruneStalePluginDataLogSiblings,
+  appendSessionStartCriticalLog,
+  sessionStartCriticalFallback,
+  DEFAULT_STALE_LOG_SIBLING_MAX,
+} = require(path.join(__dirname, '..', 'lib', 'mixdog-debug.cjs'));
+
+// Verbose tracing → session-start.log (MIXDOG_DEBUG). Ship mode → critical
+// fail-open lines only in bounded session-start-critical.log.
 let _SESSION_START_LOG_PATH = null;
-const SESSION_START_TRACE_ENABLED =
-  process.env.MIXDOG_DEBUG_SESSION_START === '1' ||
-  process.env.MIXDOG_DEBUG_SESSION_START === 'true';
+let _SESSION_START_DATA_DIR = null;
+const MIXDOG_DEBUG_ENABLED = isMixdogDebugEnabled();
+let _sessionStartLogsPruned = false;
+
+function sessionStartDataDir() {
+  if (_SESSION_START_DATA_DIR) return _SESSION_START_DATA_DIR;
+  try {
+    if (typeof DATA_DIR === 'string' && DATA_DIR) {
+      _SESSION_START_DATA_DIR = DATA_DIR;
+      return _SESSION_START_DATA_DIR;
+    }
+  } catch { /* safe before DATA_DIR const init */ }
+  _SESSION_START_DATA_DIR = process.env.CLAUDE_PLUGIN_DATA
+    || path.join(os.homedir(), '.claude', 'plugins', 'data', 'mixdog-trib-plugin');
+  return _SESSION_START_DATA_DIR;
+}
+
 function sessionStartLogPath() {
   if (_SESSION_START_LOG_PATH) return _SESSION_START_LOG_PATH;
-  const base = (typeof DATA_DIR === 'string' && DATA_DIR)
-    ? DATA_DIR
-    : path.join(os.homedir(), '.claude', 'plugins', 'data', 'mixdog-trib-plugin');
-  _SESSION_START_LOG_PATH = path.join(base, 'session-start.log');
+  _SESSION_START_LOG_PATH = path.join(sessionStartDataDir(), 'session-start.log');
   return _SESSION_START_LOG_PATH;
 }
-// Always append to session-start.log so fail-open reasons (skip / cycle1
-// failure / missing-dirs / null dispatch) stay diagnosable without requiring
-// MIXDOG_DEBUG_SESSION_START to be pre-set. Stderr output remains gated by
-// the trace flag — log file is the durable record, stderr is the live tail.
-// Size-based rotation: when the log exceeds LOG_MAX_BYTES, head-trim down to
-// LOG_KEEP_BYTES so a long-running daemon doesn't grow it unbounded.
 const SESSION_START_LOG_MAX_BYTES = 256 * 1024;
 const SESSION_START_LOG_KEEP_BYTES = 64 * 1024;
-function teeStderr(line) {
+
+function appendVerboseSessionStartLog(line) {
   try {
+    const dir = sessionStartDataDir();
     const p = sessionStartLogPath();
-    fs.mkdirSync(path.dirname(p), { recursive: true });
+    fs.mkdirSync(dir, { recursive: true });
+    if (!_sessionStartLogsPruned) {
+      _sessionStartLogsPruned = true;
+      pruneStalePluginDataLogSiblings(dir, DEFAULT_STALE_LOG_SIBLING_MAX);
+    }
     try {
       const st = fs.statSync(p);
       if (st.size > SESSION_START_LOG_MAX_BYTES) {
@@ -45,9 +62,19 @@ function teeStderr(line) {
     } catch {}
     fs.appendFileSync(p, line);
   } catch {}
-  if (SESSION_START_TRACE_ENABLED) {
+}
+
+function teeStderr(line, opts = {}) {
+  const critical = opts.critical === true
+    || (opts.critical !== false && sessionStartCriticalFallback(line));
+  if (!MIXDOG_DEBUG_ENABLED) {
+    if (!critical) return;
+    appendSessionStartCriticalLog(sessionStartDataDir(), line);
     try { process.stderr.write(line); } catch {}
+    return;
   }
+  appendVerboseSessionStartLog(line);
+  try { process.stderr.write(line); } catch {}
 }
 
 // ---------------------------------------------------------------------------
@@ -82,6 +109,9 @@ function parseArgs(argv) {
 const ARGS = parseArgs(process.argv);
 let PART = ARGS.part;
 
+const DATA_DIR = resolvePluginData();
+const PLUGIN_ROOT = process.env.CLAUDE_PLUGIN_ROOT;
+
 let _event = {};
 const IS_DAEMON_REQUIRE = !!process.env.MIXDOG_SKIP_TOP_STDIN;
 // In-daemon `require()` would otherwise read fd 0 (the daemon's MCP stdio
@@ -115,8 +145,6 @@ if (_event.kind && _event.kind !== 'interactive') {
   process.exit(0);
 }
 
-const DATA_DIR = resolvePluginData();
-const PLUGIN_ROOT = process.env.CLAUDE_PLUGIN_ROOT;
 const SESSION_START_CYCLE1_TIMEOUT_MS = Number.parseInt(process.env.MIXDOG_SESSION_START_CYCLE1_TIMEOUT_MS || '110000', 10);
 const MIXDOG_RUNTIME_ROOT = process.env.MIXDOG_RUNTIME_ROOT
   ? path.resolve(process.env.MIXDOG_RUNTIME_ROOT)
@@ -709,7 +737,7 @@ async function pollActiveInstance(graceMs) {
       if (result) {
         teeStderr(`[session-start] pollActiveInstance done elapsed=${Date.now() - _pollStart}ms port=${result.httpPort} via=${via}\n`);
       } else {
-        teeStderr(`[session-start] pollActiveInstance end elapsed=${Date.now() - _pollStart}ms result=null\n`);
+        teeStderr(`[session-start] pollActiveInstance end elapsed=${Date.now() - _pollStart}ms result=null\n`, { critical: true });
       }
       resolve(result);
     };
@@ -785,7 +813,7 @@ async function awaitMemoryPort(graceMs) {
     await sleepMs(Math.min(200, Math.max(0, deadline - Date.now())));
   }
 
-  teeStderr(`[session-start] awaitMemoryPort end elapsed=${Date.now() - _t0}ms result=null\n`);
+  teeStderr(`[session-start] awaitMemoryPort end elapsed=${Date.now() - _t0}ms result=null\n`, { critical: true });
   return null;
 }
 

package/lib/mixdog-debug.cjs

@@ -0,0 +1,163 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+/** Truthy env: 1, true, yes, on (case-insensitive). */
+function isTruthyEnv(value) {
+  if (value == null || value === '') return false;
+  const s = String(value).trim().toLowerCase();
+  return s === '1' || s === 'true' || s === 'yes' || s === 'on';
+}
+
+/**
+ * Ship-mode gate: verbose hook/daemon tracing. Default OFF.
+ * MIXDOG_DEBUG_SESSION_START remains a legacy alias.
+ */
+function isMixdogDebugEnabled() {
+  return (
+    isTruthyEnv(process.env.MIXDOG_DEBUG) ||
+    isTruthyEnv(process.env.MIXDOG_DEBUG_SESSION_START)
+  );
+}
+
+/** Canonical / live logs — never subject to sibling GC. */
+const CANONICAL_PLUGIN_LOG_NAMES = new Set([
+  'boot.log',
+  'crash.log',
+  'drop-trace.log',
+  'event.log',
+  'channels-worker.log',
+  'memory-worker.log',
+  'mcp-debug.log',
+  'pg.log',
+  'schedule.log',
+  'session-start.log',
+  'session-start-critical.log',
+  'webhook.log',
+  'perf.log',
+]);
+
+/**
+ * Per-process sibling logs (stale accumulators). Matches channels worker GC.
+ * Only these may be count-pruned.
+ */
+const STALE_PLUGIN_LOG_SIBLING_RE = [
+  /^(channels|memory)-worker\.\d+\.\d+\.log$/,
+  /^mcp-debug\.\d+\.\d+\.log$/,
+  /^supervisor\.\d+\.log$/,
+];
+
+const DEFAULT_STALE_LOG_SIBLING_MAX = 50;
+const DEFAULT_STALE_LOG_MIN_AGE_MS = 5 * 60 * 1000;
+
+function isStalePluginLogSibling(name) {
+  if (!name || !name.endsWith('.log')) return false;
+  if (CANONICAL_PLUGIN_LOG_NAMES.has(name)) return false;
+  return STALE_PLUGIN_LOG_SIBLING_RE.some((re) => re.test(name));
+}
+
+/**
+ * Drop oldest stale per-worker / per-PID log siblings only. Skips canonical logs
+ * and files touched within minAgeMs (likely live writers). Best-effort; no throw.
+ */
+function pruneStalePluginDataLogSiblings(
+  dataDir,
+  maxSiblings = DEFAULT_STALE_LOG_SIBLING_MAX,
+  minAgeMs = DEFAULT_STALE_LOG_MIN_AGE_MS,
+) {
+  if (!dataDir || maxSiblings < 1) return { removed: 0, kept: 0 };
+  const now = Date.now();
+  let entries;
+  try {
+    entries = fs.readdirSync(dataDir, { withFileTypes: true })
+      .filter((e) => e.isFile() && isStalePluginLogSibling(e.name));
+  } catch {
+    return { removed: 0, kept: 0 };
+  }
+  const candidates = [];
+  for (const e of entries) {
+    const p = path.join(dataDir, e.name);
+    try {
+      const st = fs.statSync(p);
+      if (now - st.mtimeMs < minAgeMs) continue;
+      candidates.push({ path: p, mtimeMs: st.mtimeMs });
+    } catch { /* skip */ }
+  }
+  if (candidates.length <= maxSiblings) {
+    return { removed: 0, kept: candidates.length };
+  }
+  candidates.sort((a, b) => a.mtimeMs - b.mtimeMs);
+  const toRemove = candidates.length - maxSiblings;
+  let removed = 0;
+  for (let i = 0; i < toRemove; i++) {
+    try {
+      fs.unlinkSync(candidates[i].path);
+      removed++;
+    } catch { /* skip */ }
+  }
+  return { removed, kept: candidates.length - removed };
+}
+
+/** @deprecated use pruneStalePluginDataLogSiblings */
+function prunePluginDataLogFiles(dataDir, maxFiles) {
+  return pruneStalePluginDataLogSiblings(dataDir, maxFiles);
+}
+
+const SESSION_START_CRITICAL_LOG = 'session-start-critical.log';
+const SESSION_START_CRITICAL_MAX_BYTES = 64 * 1024;
+const SESSION_START_CRITICAL_KEEP_BYTES = 64 * 1024;
+
+function rotateBoundedLog(filePath, maxBytes, keepBytes) {
+  try {
+    const st = fs.statSync(filePath);
+    if (st.size > maxBytes) {
+      const buf = fs.readFileSync(filePath);
+      fs.writeFileSync(filePath, buf.subarray(Math.max(0, buf.length - keepBytes)));
+    }
+  } catch { /* missing file ok */ }
+}
+
+/**
+ * Ship-mode durable fail-open record (size-capped). No-op when line empty.
+ */
+function appendSessionStartCriticalLog(dataDir, line) {
+  if (!dataDir || !line) return;
+  try {
+    const p = path.join(dataDir, SESSION_START_CRITICAL_LOG);
+    fs.mkdirSync(dataDir, { recursive: true });
+    rotateBoundedLog(p, SESSION_START_CRITICAL_MAX_BYTES, SESSION_START_CRITICAL_KEEP_BYTES);
+    fs.appendFileSync(p, line.endsWith('\n') ? line : `${line}\n`);
+  } catch { /* best-effort */ }
+}
+
+/**
+ * Fallback when call sites omit `{ critical: true }`.
+ */
+function sessionStartCriticalFallback(line) {
+  const s = String(line || '');
+  if (/reason=ok\b/.test(s)) return false;
+  if (/\[session-start\] skip\b/.test(s) && /reason=/.test(s)) return true;
+  if (/result=null/.test(s)) return true;
+  if (/owner route unavailable/.test(s)) return true;
+  if (/memory_port unavailable/.test(s)) return true;
+  if (/\baborted\b/i.test(s)) return true;
+  if (/\bcycle1\b/.test(s) && /reason=/.test(s) && !/reason=ok\b/.test(s)) return true;
+  if (/\b(exception|failed|abort|err=|non-200|missing-dirs|catch endpoint)\b/i.test(s)) {
+    return true;
+  }
+  return false;
+}
+
+module.exports = {
+  isTruthyEnv,
+  isMixdogDebugEnabled,
+  isStalePluginLogSibling,
+  pruneStalePluginDataLogSiblings,
+  prunePluginDataLogFiles,
+  appendSessionStartCriticalLog,
+  sessionStartCriticalFallback,
+  DEFAULT_STALE_LOG_SIBLING_MAX,
+  DEFAULT_PLUGIN_LOG_MAX_FILES: DEFAULT_STALE_LOG_SIBLING_MAX,
+  SESSION_START_CRITICAL_LOG,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.7.11",
+  "version": "0.7.13",
   "description": "Claude Code all-in-one bridge plugin: role-based bridge workers, continuous memory, and syntax-aware code editing.",
   "author": "mixdog contributors <dev@tribgames.com>",
   "license": "MIT",
@@ -67,6 +67,8 @@
     "test:all": "bun run test:fault-inject && bun run test:large-file && bun run test:stress",
     "ci:core": "bun run check:syntax && bun run check:json && bun scripts/doctor.mjs && bun scripts/guard-smoke.mjs && node scripts/hidden-role-schema-smoke.mjs && bun scripts/permission-eval-smoke.mjs && bun scripts/perf-hook-smoke.mjs && bun scripts/edit-normalize-smoke.mjs && bun scripts/edit-normalize-fuzz.mjs && bun scripts/builtin-utils-smoke.mjs && bun scripts/mutation-io-smoke.mjs && node scripts/io-complex-smoke.mjs && bun run smoke:io-routes && bun scripts/webhook-selfheal-smoke.mjs && node scripts/config-preserve-smoke.mjs && node scripts/statusline-launcher-smoke.mjs && bun run check:tools-sync",
     "ci": "bun run ci:core && bun audit",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
     "prepublishOnly": "bun run build:tools"
   },
   "overrides": {
@@ -104,5 +106,10 @@
     "keytar",
     "onnxruntime-node",
     "protobufjs"
-  ]
+  ],
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "eslint": "^10.5.0",
+    "globals": "^17.6.0"
+  }
 }

package/scripts/builtin-utils-smoke.mjs

@@ -11,7 +11,7 @@ import { mkdirSync, rmSync, writeFileSync } from 'node:fs';
 
 const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
 process.env.CLAUDE_PLUGIN_ROOT ||= ROOT;
-process.env.CLAUDE_PLUGIN_DATA ||= join(tmpdir(), `mixdog-builtin-utils-smoke-data-${process.pid}`);
+process.env.CLAUDE_PLUGIN_DATA = join(tmpdir(), `mixdog-builtin-utils-smoke-data-${process.pid}`);
 process.env.MIXDOG_HINT_LEVEL ||= 'normal';
 
 const {
@@ -86,9 +86,10 @@ if (!unknownToolHint.includes('Did you mean "grep"') || unknownToolHint.includes
 }
 
 // ── normalizeInputPath / normalizeOutputPath ───────────────────────────────
-// Path normalization round-trips: Windows forward-slash and backslash
-// representations of the same path collapse to one form; POSIX-style
-// `/c/Users/...` drive paths decode back to Windows drive form.
+// Path normalization round-trips. On Windows, forward-slash and backslash
+// representations of the same path collapse to one form, and POSIX-style
+// `/c/Users/...` drive paths decode back to Windows drive form. On POSIX,
+// those spellings are ordinary strings and must stay byte-preserved.
 // Output normalization is the inverse — the user-facing form mixdog
 // always emits regardless of how it received the path.
 const pathCases = [
@@ -114,13 +115,18 @@ if (typeof out1 !== 'string') fail('path-out:windows', `expected string, got ${t
 const out2 = normalizeOutputPath('src/foo.js');
 if (typeof out2 !== 'string') fail('path-out:relative', `expected string, got ${typeof out2}`);
 
-// posixPathToWindowsPath: `/c/Users/foo` → drive-letter prefix.
-// Accept either case for the drive letter (POSIX `/c/` doesn't carry case).
+// posixPathToWindowsPath is intentionally Windows-only. On POSIX hosts, `/c/...`
+// is a legal absolute path, not a Windows drive alias, so assert identity there.
 const winFromPosix = posixPathToWindowsPath('/c/Users/foo');
 if (typeof winFromPosix !== 'string') {
     fail('posix-to-win:basic', `expected string, got ${typeof winFromPosix}`);
-} else if (!/^[a-zA-Z]:/.test(winFromPosix)) {
-    fail('posix-to-win:basic', `expected drive-letter prefix, got ${JSON.stringify(winFromPosix)}`);
+} else if (process.platform === 'win32') {
+    // Accept either case for the drive letter (POSIX `/c/` doesn't carry case).
+    if (!/^[a-zA-Z]:/.test(winFromPosix)) {
+        fail('posix-to-win:basic', `expected drive-letter prefix, got ${JSON.stringify(winFromPosix)}`);
+    }
+} else if (winFromPosix !== '/c/Users/foo') {
+    fail('posix-to-win:basic', `expected POSIX identity, got ${JSON.stringify(winFromPosix)}`);
 }
 
 // ── read cache key shape ───────────────────────────────────────────────────

package/scripts/bump.mjs

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+// bump.mjs — single source of truth for the mixdog release version.
+//
+// Bumps the THREE version surfaces in lockstep so the npm and marketplace
+// channels can never drift again:
+//   1. package.json                       version  (npm channel)
+//   2. .claude-plugin/plugin.json         version  (Claude Code plugin / marketplace update trigger)
+//   3. .claude-plugin/marketplace.json    plugin source `ref` -> `v<new>` (pins marketplace to the tagged release)
+//
+// Run by the gated release.yml pipeline, or locally:
+//   node scripts/bump.mjs <patch|minor|major|X.Y.Z>
+//
+// Invariant-based (no heuristic fallback): any inconsistent on-disk state
+// throws and aborts the release rather than guessing.
+
+import { readFileSync, writeFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+const PKG = join(ROOT, 'package.json');
+const PLUGIN = join(ROOT, '.claude-plugin', 'plugin.json');
+const MARKET = join(ROOT, '.claude-plugin', 'marketplace.json');
+
+const SEMVER = /^(\d+)\.(\d+)\.(\d+)$/;
+
+function readJson(p) {
+  return JSON.parse(readFileSync(p, 'utf8'));
+}
+function writeJson(p, obj) {
+  writeFileSync(p, JSON.stringify(obj, null, 2) + '\n');
+}
+
+function nextVersion(current, arg) {
+  const m = SEMVER.exec(current);
+  if (!m) throw new Error(`package.json version is not X.Y.Z: "${current}"`);
+  const [major, minor, patch] = m.slice(1).map(Number);
+  if (arg === 'major') return `${major + 1}.0.0`;
+  if (arg === 'minor') return `${major}.${minor + 1}.0`;
+  if (arg === 'patch') return `${major}.${minor}.${patch + 1}`;
+  if (SEMVER.test(arg)) return arg;
+  throw new Error(`bump arg must be patch|minor|major|X.Y.Z, got: "${arg}"`);
+}
+
+const arg = process.argv[2];
+if (!arg) throw new Error('usage: node scripts/bump.mjs <patch|minor|major|X.Y.Z>');
+
+const pkg = readJson(PKG);
+const plugin = readJson(PLUGIN);
+const market = readJson(MARKET);
+
+if (typeof pkg.version !== 'string') throw new Error('package.json has no version string');
+if (typeof plugin.version !== 'string') throw new Error('plugin.json has no version string');
+
+const current = pkg.version;
+const next = nextVersion(current, arg);
+const tag = `v${next}`;
+
+const entry = (market.plugins || []).find((p) => p.name === plugin.name);
+if (!entry) throw new Error(`marketplace.json has no plugin entry named "${plugin.name}"`);
+if (!entry.source || typeof entry.source !== 'object') {
+  throw new Error('marketplace plugin entry is missing a source object');
+}
+
+// All three surfaces move together or not at all.
+pkg.version = next;
+plugin.version = next;
+entry.source.ref = tag;
+
+writeJson(PKG, pkg);
+writeJson(PLUGIN, plugin);
+writeJson(MARKET, market);
+
+console.log(`bump: ${current} -> ${next} (tag ${tag})`);
+console.log('  updated package.json, .claude-plugin/plugin.json, marketplace source ref');
+
+// Expose results to GitHub Actions when running in CI.
+if (process.env.GITHUB_OUTPUT) {
+  writeFileSync(process.env.GITHUB_OUTPUT, `version=${next}\ntag=${tag}\n`, { flag: 'a' });
+}

package/scripts/doctor.mjs

@@ -24,6 +24,11 @@ const require = createRequire(import.meta.url);
 // ---------------------------------------------------------------------------
 const PLUGIN_ROOT = process.env.CLAUDE_PLUGIN_ROOT || dirname(__dirname);
 
+// Claude config base — honours CLAUDE_CONFIG_DIR (matches settings-loader / statusline).
+function claudeConfigBase() {
+  return process.env.CLAUDE_CONFIG_DIR || join(homedir(), '.claude');
+}
+
 function resolvePluginData() {
   if (process.env.CLAUDE_PLUGIN_DATA) return process.env.CLAUDE_PLUGIN_DATA;
   const dirName = basename(PLUGIN_ROOT);
@@ -31,7 +36,7 @@ function resolvePluginData() {
   if (/^\d+\.\d+\.\d+/.test(dirName)) {
     const pluginName = basename(join(PLUGIN_ROOT, '..'));
     const marketplace = basename(join(PLUGIN_ROOT, '..', '..'));
-    return join(homedir(), '.claude', 'plugins', 'data', `${pluginName}-${marketplace}`);
+    return join(claudeConfigBase(), 'plugins', 'data', `${pluginName}-${marketplace}`);
   }
   // Marketplace layout: root IS the plugin dir
   const marketplace = dirName;
@@ -40,7 +45,7 @@ function resolvePluginData() {
     const manifest = JSON.parse(readFileSync(join(PLUGIN_ROOT, '.claude-plugin', 'plugin.json'), 'utf8'));
     if (typeof manifest?.name === 'string' && manifest.name.trim()) pluginName = manifest.name.trim();
   } catch { /* fall through */ }
-  return join(homedir(), '.claude', 'plugins', 'data', `${pluginName}-${marketplace}`);
+  return join(claudeConfigBase(), 'plugins', 'data', `${pluginName}-${marketplace}`);
 }
 
 const PLUGIN_DATA = resolvePluginData();
@@ -271,7 +276,7 @@ await (async function checkHookPipe() {
 // Check 6: Cache layout - ~/.claude/plugins/cache/trib-plugin/mixdog/<ver>/
 // ---------------------------------------------------------------------------
 (function checkCacheLayout() {
-  const cacheBase = join(homedir(), '.claude', 'plugins', 'cache', 'trib-plugin', 'mixdog');
+  const cacheBase = join(claudeConfigBase(), 'plugins', 'cache', 'trib-plugin', 'mixdog');
   if (!existsSync(cacheBase)) {
     warn('Cache layout', `cache dir not found: ${cacheBase}`);
     return;

package/scripts/ensure-deps.mjs

@@ -8,10 +8,10 @@ import * as os from 'os';
 import { dirname, join } from 'path';
 import { assertSafeOwnedDir } from '../src/shared/user-data-guard.mjs';
 
-const RENAME_RETRY_CODES = new Set(['EPERM', 'EACCES', 'EBUSY', 'EEXIST']);
+export const RENAME_RETRY_CODES = new Set(['EPERM', 'EACCES', 'EBUSY', 'EEXIST']);
 const RENAME_BACKOFFS_MS = Object.freeze([25, 50, 100, 200, 400, 800, 1200, 1600]);
 
-function sleepSync(ms) {
+export function sleepSync(ms) {
   try {
     const buf = new SharedArrayBuffer(4);
     Atomics.wait(new Int32Array(buf), 0, 0, Math.max(1, Number(ms) || 1));

package/scripts/mutation-io-smoke.mjs

@@ -70,7 +70,23 @@ async function warmRead(path, scope, offset = 0, limit = 20) {
 }
 
 async function rmTree(path) {
-  await rm(path, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 });
+  // Windows CI occasionally keeps a just-used temp file locked briefly after the
+  // owning JS/native subprocess exits (EACCES/EBUSY/EPERM). Cleanup is not part
+  // of the smoke invariant, so retry with backoff and make final teardown
+  // best-effort instead of turning a passed mutation suite red.
+  const delays = [50, 100, 200, 400, 800];
+  let lastErr = null;
+  for (let i = 0; i <= delays.length; i++) {
+    try {
+      await rm(path, { recursive: true, force: true, maxRetries: 3, retryDelay: 50 });
+      return;
+    } catch (err) {
+      lastErr = err;
+      if (!['EACCES', 'EBUSY', 'EPERM', 'ENOTEMPTY'].includes(err?.code)) break;
+      if (i < delays.length) await new Promise((resolve) => setTimeout(resolve, delays[i]));
+    }
+  }
+  console.warn(`mutation-io smoke cleanup warning: failed to remove ${path}: ${lastErr?.code || ''} ${lastErr?.message || lastErr}`);
 }
 
 try {

package/scripts/permission-eval-smoke.mjs

@@ -10,6 +10,23 @@ import path from 'path';
 import { createRequire } from 'module';
 import { fileURLToPath } from 'url';
 
+// The evaluator intentionally merges user-global Claude settings. Local dev
+// machines commonly have defaultMode=bypassPermissions, which made this smoke
+// pass locally while CI's empty user config exercised stricter defaults. Pin
+// the user tier to a throwaway Claude config dir so the smoke is hermetic and
+// still verifies the intended invariant: hard-deny and explicit list rules win
+// before bypass mode.
+const smokeHome = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'perm-smoke-home-')));
+const smokeConfigDir = path.join(smokeHome, '.claude');
+fs.mkdirSync(smokeConfigDir, { recursive: true });
+fs.writeFileSync(
+  path.join(smokeConfigDir, 'settings.json'),
+  JSON.stringify({ permissions: { defaultMode: 'bypassPermissions' } }),
+);
+process.env.HOME = smokeHome;
+process.env.USERPROFILE = smokeHome;
+process.env.CLAUDE_CONFIG_DIR = smokeConfigDir;
+
 const _require = createRequire(import.meta.url);
 const evalPath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../hooks/lib/permission-evaluator.cjs');
 const { evaluatePermission } = _require(evalPath);
@@ -21,7 +38,7 @@ const { loadPermissions, clearSettingsCache } = _require(loaderPath);
 let pass = 0, fail = 0;
 
 function makeProject(settings = {}) {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'perm-smoke-'));
+  const dir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'perm-smoke-')));
   fs.mkdirSync(path.join(dir, '.claude'), { recursive: true });
   if (Object.keys(settings).length) {
     fs.writeFileSync(