superlocalmemory 3.7.8 → 3.8.1

package/src/superlocalmemory/hooks/adapter_base.py

@@ -38,7 +38,11 @@ from typing import Protocol, runtime_checkable
 # ---------------------------------------------------------------------------
 
 HARD_BYTES_CAP = 4096
-COPILOT_SOFT_BYTES = 2048
+# Soft budget for the managed instruction block. Raised 2048 -> 2560 -> 2816 as
+# the block grew to carry the memory, token-optimization, and (compact)
+# bounded-loop protocols; the 4 KB hard cap still bounds total size (recall
+# content is truncated to stay under it).
+COPILOT_SOFT_BYTES = 2816
 TRUNCATION_MARKER = b"\n<!-- truncated -->"
 
 

package/src/superlocalmemory/hooks/auto_recall.py

@@ -10,6 +10,7 @@ import logging
 from typing import Any, Callable
 
 from superlocalmemory.core.injection import InjectableMemory, render_context
+from superlocalmemory.retrieval.temporal_frame import relative_age, temporal_frame
 
 logger = logging.getLogger(__name__)
 
@@ -85,7 +86,13 @@ class AutoRecall:
                 )
                 for r in relevant[:self._max_memories]
             ]
-            return render_context(memories, mode="B", cfg=None, wrap=True)
+            ctx = render_context(memories, mode="B", cfg=None, wrap=True)
+            # T-inject: anchor the injected memories to "now" so a time-blind
+            # model can weigh recency. Prepend a one-line temporal frame.
+            frame = temporal_frame(
+                [getattr(r.fact, "created_at", "") for r in relevant[:self._max_memories]]
+            )
+            return f"{frame}\n\n{ctx}" if ctx else ctx
         except Exception as exc:
             logger.warning("Auto-recall failed: %s", exc)
             return ""
@@ -104,12 +111,17 @@ class AutoRecall:
             response = self._recall(query, self._max_memories)
             if response is None:
                 return []
+            from datetime import datetime as _dt, timezone as _tz
+            _now = _dt.now(_tz.utc)
             results = []
             for r in response.results:
                 if r.score >= self._threshold:
+                    _created = getattr(r.fact, "created_at", "") or ""
                     results.append({
                         "fact_id": r.fact.fact_id,
                         "content": r.fact.content[:300],
+                        "created_at": _created,
+                        "age_label": relative_age(_created, _now),
                         "score": round(r.score, 3),
                         "relevance_score": round(
                             getattr(r, "relevance_score", r.score) or 0.0, 3

package/src/superlocalmemory/hooks/claude_code_hooks.py

@@ -261,6 +261,17 @@ def _hook_definitions(include_gate: bool = False) -> dict[str, list]:
                         "command": _wrap_python_cmd("stop_outcome"),
                         "timeout": 10000,
                     },
+                    # Commit temporal summaries so session decisions survive beyond
+                    # the git-state snapshot written by `slm hook stop`.
+                    {
+                        "type": "command",
+                        "command": (
+                            'cmd /c "slm session close 2>NUL || exit /b 0"'
+                            if sys.platform == "win32"
+                            else "slm session close 2>/dev/null || true"
+                        ),
+                        "timeout": 15000,
+                    },
                 ]
             }
         ],

package/src/superlocalmemory/hooks/codex_assets.py

@@ -7,10 +7,16 @@ import sysconfig
 from pathlib import Path
 
 SKILLS = ("slm-cache", "slm-compress", "slm-graph", "slm-recall", "slm-remember", "slm-session", "slm-status")
-AGENTS = {
-    "slm-memory-advisor.toml": 'name = "slm-memory-advisor"\ndescription = "Use SuperLocalMemory safely: initialize once, recall before remember, and store only durable atomic facts."\ninstructions = "Use SLM for memory discipline only. Check results before claiming success; preserve private scope unless the user explicitly asks to share."\n',
-    "slm-optimize-advisor.toml": 'name = "slm-optimize-advisor"\ndescription = "Analyze SuperLocalMemory retrieval, ingestion, cache, compression, and optimization evidence."\ninstructions = "Inspect real SLM evidence before advising. Separate observed performance from targets and recommend measurable experiments."\n',
-}
+
+# Codex subagent files written to ~/.codex/agents (content built by _agent_files()).
+AGENTS = ("slm-memory-advisor.toml", "slm-optimize-advisor.toml")
+
+_MEMORY_ADVISOR_TOML = (
+    'name = "slm-memory-advisor"\n'
+    'description = "Use SuperLocalMemory safely: initialize once, recall before remember, and store only durable atomic facts."\n'
+    'instructions = "Use SLM for memory discipline only. Check results before claiming success; preserve private scope unless the user explicitly asks to share."\n'
+)
+
 
 def _source_root() -> Path:
     development = Path(__file__).resolve().parents[3] / "plugin-src" / "skills"
@@ -21,6 +27,57 @@ def _source_root() -> Path:
         return installed
     raise FileNotFoundError("Bundled Codex skills were not found in this installation")
 
+
+def _agents_source_root() -> Path | None:
+    development = Path(__file__).resolve().parents[3] / "plugin-src" / "agents"
+    if development.exists():
+        return development
+    installed = Path(sysconfig.get_path("data")) / "share" / "superlocalmemory" / "codex" / "agents"
+    return installed if installed.exists() else None
+
+
+def _optimize_advisor_toml() -> str:
+    """Build the optimize-advisor TOML from the canonical advisor doc so Codex
+    ships the FULL decision rules (the 8-rule tree), not a one-line stub. Falls
+    back to a short instruction only if the source doc is unavailable.
+    """
+    description = (
+        "Apply SuperLocalMemory's no-proxy context-optimization rules — reversible "
+        "compression of large tool output and KV-caching of repeated reads/searches."
+    )
+    body = ""
+    root = _agents_source_root()
+    if root is not None:
+        src = root / "slm-optimize-advisor.md"
+        if src.exists():
+            text = src.read_text(encoding="utf-8")
+            if text.startswith("---"):  # strip YAML frontmatter, keep the guidance body
+                end = text.find("\n---", 3)
+                if end != -1:
+                    text = text[end + 4:]
+            body = text.strip()
+    if not body:
+        body = (
+            "Reduce context-window pressure with the Surface-B tools (reversible CCR "
+            "compression + a per-agent KV cache); fail-open — never block the task."
+        )
+    # TOML literal multi-line string ('''...'''): no escape processing, and the
+    # advisor body contains no ''' sequence.
+    return (
+        'name = "slm-optimize-advisor"\n'
+        f'description = "{description}"\n'
+        f"instructions = '''\n{body}\n'''\n"
+    )
+
+
+def _agent_files() -> dict:
+    """Return {filename: TOML content} for the Codex subagents."""
+    return {
+        "slm-memory-advisor.toml": _MEMORY_ADVISOR_TOML,
+        "slm-optimize-advisor.toml": _optimize_advisor_toml(),
+    }
+
+
 def install_assets(*, home: Path | None = None, dry_run: bool = False) -> dict:
     """Copy only named SLM assets; never rewrite user-owned assets."""
     home = home or Path.home()
@@ -37,10 +94,11 @@ def install_assets(*, home: Path | None = None, dry_run: bool = False) -> dict:
         target = skills_root / skill
         target.mkdir(parents=True, exist_ok=True)
         shutil.copy2(source / skill / "SKILL.md", target / "SKILL.md")
-    for filename, content in AGENTS.items():
+    for filename, content in _agent_files().items():
         (agents_root / filename).write_text(content, encoding="utf-8")
     return {"success": True, "skills": list(SKILLS), "agents": list(AGENTS), "dry_run": False}
 
+
 def remove_assets(*, home: Path | None = None, dry_run: bool = False) -> dict:
     """Remove only the known SLM directories and files."""
     home = home or Path.home()
@@ -52,6 +110,7 @@ def remove_assets(*, home: Path | None = None, dry_run: bool = False) -> dict:
             shutil.rmtree(target) if target.is_dir() else target.unlink()
     return {"success": True, "removed": [str(x) for x in existing], "dry_run": dry_run}
 
+
 def status_assets(*, home: Path | None = None) -> dict:
     home = home or Path.home()
     skills = [x for x in SKILLS if (home / ".agents" / "skills" / x / "SKILL.md").exists()]

package/src/superlocalmemory/hooks/hook_daemon.py

@@ -25,6 +25,7 @@ import json
 import logging
 import os
 import socket
+import sys
 import threading
 import time
 from pathlib import Path
@@ -35,6 +36,12 @@ logger = logging.getLogger(__name__)
 
 _DEFAULT_SOCK_NAME = "hook_daemon.sock"
 
+# AF_UNIX is absent on Windows builds < 10.0.17063 and on Python < 3.9. When it
+# is unavailable the hook daemon does not start and callers fall back to the
+# subprocess recall path. Detect it explicitly (once, with a log) instead of
+# relying on an AttributeError being swallowed by a broad except.
+_AF_UNIX = getattr(socket, "AF_UNIX", None)
+
 
 def _default_sock_path() -> Path:
     return state_path(_DEFAULT_SOCK_NAME)
@@ -77,7 +84,13 @@ class HookDaemon:
         from superlocalmemory.core.recall_queue import RecallQueue
         self._queue = RecallQueue(self._queue_db_path)
 
-        self._server_sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+        if _AF_UNIX is None:
+            logger.info(
+                "HookDaemon: AF_UNIX unavailable on %s; hook recall uses the "
+                "subprocess fallback", sys.platform,
+            )
+            raise RuntimeError("AF_UNIX unavailable on this platform")
+        self._server_sock = socket.socket(_AF_UNIX, socket.SOCK_STREAM)
         self._server_sock.bind(str(self._sock_path))
         self._server_sock.listen(8)
         self._server_sock.settimeout(1.0)
@@ -226,9 +239,11 @@ def try_socket_recall(
     path = sock_path or _default_sock_path()
     if not path.exists():
         return None
+    if _AF_UNIX is None:
+        return None
 
     try:
-        client = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+        client = socket.socket(_AF_UNIX, socket.SOCK_STREAM)
         client.settimeout(timeout)
         client.connect(str(path))
 
@@ -259,10 +274,12 @@ def ensure_hook_daemon(
 ) -> HookDaemon | None:
     """Start hook daemon if not already running. Returns daemon or None."""
     path = sock_path or _default_sock_path()
+    if _AF_UNIX is None:
+        return None
 
     if path.exists():
         try:
-            test = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+            test = socket.socket(_AF_UNIX, socket.SOCK_STREAM)
             test.settimeout(1.0)
             test.connect(str(path))
             test.close()

package/src/superlocalmemory/hooks/hook_handlers.py

@@ -26,6 +26,8 @@ import urllib.error
 import urllib.request
 from pathlib import Path
 
+from superlocalmemory import __version__
+
 # ---------------------------------------------------------------------------
 # Cross-platform temp paths
 # ---------------------------------------------------------------------------
@@ -221,7 +223,10 @@ def _codex_mcp_session_init(project_dir: str, payload: dict) -> dict:
         proc.stdin.write(json.dumps({
             "jsonrpc": "2.0", "id": 1, "method": "initialize",
             "params": {"protocolVersion": "2024-11-05", "capabilities": {},
-                       "clientInfo": {"name": "superlocalmemory-codex-hook", "version": "3.7"}},
+                       "clientInfo": {
+                           "name": "superlocalmemory-codex-hook",
+                           "version": __version__,
+                       }},
         }) + "\n")
         proc.stdin.flush()
         proc.stdout.readline()

package/src/superlocalmemory/hooks/memory_protocol.py

@@ -93,6 +93,58 @@ def memory_protocol_markdown() -> str:
         "learned>\", \"tags\": \"<comma-separated kebab-case keywords>\"}`.\n"
         "- A \"substantial task\" is anything you would write a commit "
         "message or handoff note about — not every tool call.\n"
+        "\n"
+        + optimize_protocol_markdown()
+        + "\n"
+        + loop_protocol_markdown()
+    )
+
+
+def optimize_protocol_markdown() -> str:
+    """Return the agent-facing token-optimization protocol block (cache/compress).
+
+    Proxy-free: these MCP tools let the agent losslessly shrink large tool output
+    and reuse repeated reads through the same surface, so an agent on any
+    front-end (not just Claude Code) can save tokens without a proxy. Fail-open —
+    a non-ok result means "use the original and continue".
+    """
+    return (
+        "## Runtime token-optimization protocol (fail-open)\n"
+        "SLM can losslessly compress large tool output and cache repeated reads "
+        "through the same MCP surface — no proxy required. These calls only save "
+        "tokens; if one returns `ok: false`, use the original and continue.\n\n"
+        "- **Large tool output (>2000 chars)** → `hub__call_tool` with "
+        "`tool=\"slm__slm_compress\"` and `arguments={\"content\": \"<text>\", "
+        "\"mode\": \"auto\", \"reversible\": true}`; keep the returned `ccr_id` "
+        "and call `tool=\"slm__slm_retrieve\"` if you later need the full "
+        "original.\n"
+        "- **Repeated reads/searches** → `hub__call_tool` with "
+        "`tool=\"slm__slm_cache_get\"` and `arguments={\"key\": \"file:<path>\"}` "
+        "first; on a miss, store the result with `tool=\"slm__slm_cache_set\"` "
+        "(ttl ~1800).\n"
+        "- **Never compress or cache**: code you will edit, JSON you will parse, "
+        "secrets, ccr_ids, or anything under ~500 chars.\n"
+    )
+
+
+def loop_protocol_markdown() -> str:
+    """Return the agent-facing bounded-loop protocol block.
+
+    Bounded loops make an agent stop when an INDEPENDENT gate passes — not when
+    the agent claims it is done. Persisting each lap to SLM memory makes a run
+    auditable and resumable. This block is appended to the shared memory
+    protocol so any connected front-end (Claude Code, Codex, Antigravity,
+    Cursor, and other IDEs) learns the feature exists and how to reach it.
+    """
+    return (
+        "## Runtime bounded-loop protocol\n"
+        "For a task with a checkable gate (tests, schema, lint, reconciliation), "
+        "run a *bounded loop*: iterate until an INDEPENDENT gate passes — never "
+        "on the agent's own claim, which is advisory only. Try `slm loop demo`; "
+        "inspect with `slm loop history` / `slm loop show <run_id>` (each lap "
+        "persists as SLM memory, tag `loop:<name>`). Statuses: DONE / HALT / "
+        "PAUSE / KILLED / ERROR — report exactly, never as success unless DONE. "
+        "Full guide: the slm-loop skill.\n"
     )
 
 
@@ -101,4 +153,6 @@ __all__ = (
     "SLM_MARKER_END",
     "strip_slm_block",
     "memory_protocol_markdown",
+    "optimize_protocol_markdown",
+    "loop_protocol_markdown",
 )

package/src/superlocalmemory/hooks/portable_kit.py

@@ -139,7 +139,7 @@ IDE_MATRIX: dict[str, IDEDescriptor] = {
         mcp_path_project=".mcp.json",
         server_key="mcpServers",
         fmt="json",
-        agents_md_path=None,
+        agents_md_path=".junie/AGENTS.md",  # Junie guidelines file (GA) — carries memory + optimize protocol
         server_block={"command": "slm", "args": ["mcp"], "type": "stdio"},
         caveats="path per product [CN-ONLINE]",
     ),
@@ -240,11 +240,12 @@ def connect_ide(
     here: bool = False,
     profile: str | None = None,
     agents_md_source: Callable[[], str] | None = None,
+    dry_run: bool = False,
 ) -> dict[str, Any]:
     """Wire SLM into the target IDE config via merge-not-clobber.
 
     Returns a result dict:
-        {ide, mcp_config: wrote|merged|unchanged|skipped|error,
+        {ide, mcp_config: wrote|merged|unchanged|would_write|skipped|error,
          mcp_path, agents_md: wrote|skipped(...)|unchanged|error,
          servers_preserved: int, error: str|None}
     """
@@ -265,6 +266,13 @@ def connect_ide(
         )
         return result
 
+    if ide_id == "vscode-copilot" and not here:
+        result["error"] = (
+            "VS Code / Copilot integration is project-scoped. "
+            "Run `slm connect vscode-copilot --here` from the project root."
+        )
+        return result
+
     # Step 1a — claude-code short-circuit (AC6)
     if desc.fmt == "":
         print(CLAUDE_CODE_PLUGIN_POINTER)
@@ -325,7 +333,28 @@ def connect_ide(
         result["servers_preserved"] = max(0, pre_count - (0 if pre_slm is None else 1))
         result["mcp_config"] = mcp_status
 
-    # Step 6 — atomic write
+    # Step 6 — atomic write. A dry run deliberately exercises the merge and
+    # packaged-asset lookup path without touching a user-owned IDE config.
+    if dry_run:
+        result["mcp_config"] = "would_write"
+        if desc.agents_md_path is None:
+            result["agents_md"] = "skipped(unsupported)"
+        elif agents_md_source is None:
+            result["agents_md"] = "skipped(no-source)"
+        else:
+            try:
+                source_content = agents_md_source()
+            except Exception as exc:
+                result["agents_md"] = "error(source-unavailable)"
+                result["error"] = f"AGENTS.md asset lookup failed: {exc}"
+                return result
+            if not isinstance(source_content, str) or not source_content.strip():
+                result["agents_md"] = "error(empty-source)"
+                result["error"] = "AGENTS.md asset is empty"
+                return result
+            result["agents_md"] = "would_write"
+        return result
+
     try:
         _atomic_write(config_path, data, desc.fmt)
     except Exception as exc:
@@ -347,6 +376,54 @@ def connect_ide(
     return result
 
 
+def connect_many(
+    ide_ids: list[str],
+    *,
+    home: Path | None = None,
+    project: Path | None = None,
+    here: bool = False,
+    profile: str | None = None,
+    agents_md_source: Callable[[], str] | None = None,
+) -> list[dict[str, Any]]:
+    """Wire SLM into multiple IDE configs via non-destructive merge.
+
+    Iterates over ``ide_ids`` and calls :func:`connect_ide` for each entry.
+    Each IDE is processed independently — a failure on one IDE does NOT abort
+    the remaining targets.
+
+    The underlying :func:`connect_ide` is MERGE-NOT-CLOBBER:
+    - Only the ``superlocalmemory`` server key is touched.
+    - All other MCP servers + top-level keys are preserved byte-for-byte.
+    - Writes are atomic (.tmp + os.replace).
+
+    Args:
+        ide_ids: IDE ids to wire (from :data:`IDE_MATRIX`).  Pass an empty
+            list to no-op.  Unknown ids produce error entries in the output.
+        home: Override ``$HOME`` (test hook).
+        project: Project root for ``here=True`` installs.
+        here: When True, write to project-relative path instead of global.
+        profile: Inject ``SLM_MCP_PROFILE`` env-var into every server block.
+        agents_md_source: Callable returning AGENTS.md content to append.
+
+    Returns:
+        List of per-IDE result dicts, one per input id.  Each dict has the
+        same shape as :func:`connect_ide`'s return value::
+
+            {ide, mcp_config, mcp_path, agents_md, servers_preserved, error}
+    """
+    return [
+        connect_ide(
+            ide_id,
+            home=home,
+            project=project,
+            here=here,
+            profile=profile,
+            agents_md_source=agents_md_source,
+        )
+        for ide_id in ide_ids
+    ]
+
+
 # ---------------------------------------------------------------------------
 # Internal helpers
 # ---------------------------------------------------------------------------
@@ -480,6 +557,9 @@ def _handle_agents_md(
     except Exception as exc:
         logger.warning("agents_md_source() failed: %s — skipping AGENTS.md write", exc)
         return "skipped(source-error)"
+    if not isinstance(source_content, str) or not source_content.strip():
+        logger.warning("agents_md_source() returned no content — skipping AGENTS.md write")
+        return "skipped(no-source-content)"
 
     # Read existing content
     existing = ""
@@ -504,3 +584,68 @@ def _handle_agents_md(
     _tmp.write_text(existing + section, encoding="utf-8")
     os.replace(_tmp, agents_path)
     return "wrote"
+
+
+# ---------------------------------------------------------------------------
+# __main__ — `python -m superlocalmemory.hooks.portable_kit [ids...]`
+#
+# Used by the npm installer to execute non-destructive IDE connects when
+# Python is available at postinstall time. If Python / the package is not
+# importable the installer records a pending_ide_connections.json instead.
+# ---------------------------------------------------------------------------
+
+if __name__ == "__main__":  # pragma: no cover
+    import argparse as _argparse
+
+    _parser = _argparse.ArgumentParser(
+        description="SLM IDE connector — non-destructive merge-not-clobber."
+    )
+    _parser.add_argument(
+        "ide_ids",
+        nargs="*",
+        metavar="IDE",
+        help=(
+            "IDE ids to connect.  Pass 'all' to connect every supported IDE "
+            "(excluding claude-code which uses the WP-06 plugin)."
+        ),
+    )
+    _parser.add_argument("--home", help="Override home directory (test hook).")
+    _parser.add_argument("--profile", help="SLM_MCP_PROFILE to inject.")
+    _parser.add_argument(
+        "--list", action="store_true",
+        help="Print supported IDE ids with display names and exit.",
+    )
+    _args = _parser.parse_args()
+
+    if _args.list:
+        for _id, _desc in IDE_MATRIX.items():
+            _flag = "[OUT]" if not _desc.fmt else ""
+            print(f"  {_id:22s} {_desc.display} {_flag}".rstrip())
+        sys.exit(0)
+
+    _home = Path(_args.home) if _args.home else None
+
+    # Resolve targets: "all" → every MCP-capable IDE (fmt != ""), else explicit list.
+    if "all" in _args.ide_ids:
+        _targets = [k for k, d in IDE_MATRIX.items() if d.fmt]
+    else:
+        _targets = [t for t in _args.ide_ids if t]
+
+    if not _targets:
+        print("No IDE ids given. Pass ide ids or 'all'. Use --list to see options.")
+        sys.exit(0)
+
+    _results = connect_many(_targets, home=_home, profile=_args.profile)
+    _ok = 0
+    _fail = 0
+    for _r in _results:
+        _err = _r.get("error")
+        _status = _r.get("mcp_config", "error")
+        if _err:
+            print(f"  ERROR     {_r['ide']}: {_err}", file=sys.stderr)
+            _fail += 1
+        else:
+            print(f"  {_status.upper():9s} {_r['ide']} → {_r.get('mcp_path', '')}")
+            _ok += 1
+    print(f"\n{_ok} connected, {_fail} errors.")
+    sys.exit(0 if _fail == 0 else 1)

package/src/superlocalmemory/infra/backup.py

@@ -266,7 +266,18 @@ class BackupManager:
 
         A safety snapshot of the current state is taken first.
         """
-        backup_path = self.backup_dir / filename
+        # Containment: filename must be a bare .db name inside backup_dir — no
+        # path separators or traversal. Prevents restoring (and thus copying
+        # over memory.db) an arbitrary file the daemon user can read.
+        if (not filename or "/" in filename or "\\" in filename
+                or ".." in filename or not filename.endswith(".db")):
+            logger.error("Restore rejected: invalid backup filename: %r", filename)
+            return False
+        backup_dir = self.backup_dir.resolve()
+        backup_path = (self.backup_dir / filename).resolve()
+        if backup_path.parent != backup_dir:
+            logger.error("Restore rejected: path escapes backup dir: %r", filename)
+            return False
         if not backup_path.exists():
             logger.error("Backup not found: %s", filename)
             return False

package/src/superlocalmemory/infra/daemon_identity.py

@@ -14,8 +14,11 @@ import getpass
 import hashlib
 import hmac
 import json
+import logging
 import os
 import secrets
+import subprocess
+import sys
 import time
 import uuid
 from dataclasses import asdict, dataclass
@@ -30,6 +33,8 @@ DAEMON_SERVICE = "superlocalmemory-daemon"
 _NAMESPACE_DOMAIN = b"superlocalmemory-daemon-namespace-v1\0"
 _CAPABILITY_DOMAIN = b"superlocalmemory-daemon-capability-v1\0"
 
+logger = logging.getLogger(__name__)
+
 
 def _canonical_path(value: str | Path) -> Path:
     expanded = Path(value).expanduser().resolve(strict=False)
@@ -144,6 +149,40 @@ def descriptor_path(data_root: str | Path | None = None) -> Path:
     return root / "daemon.json"
 
 
+def _restrict_to_owner(path: Path) -> None:
+    """Restrict a sensitive file to the current user on every platform.
+
+    ``daemon.json`` holds the capability token that authorizes write requests.
+    POSIX gets a 0600 chmod. On Windows chmod is a no-op, so use icacls to strip
+    inherited ACEs and grant the current user only — otherwise the token can be
+    read by other local accounts (privilege escalation on shared machines).
+    Files under %USERPROFILE% usually inherit user-only ACLs already; this is
+    defense-in-depth. Fail-soft — a hardening failure warns, never crashes.
+    """
+    if sys.platform == "win32":
+        try:
+            user = getpass.getuser()
+            subprocess.run(
+                ["icacls", str(path), "/inheritance:r"],
+                check=False, capture_output=True,
+            )
+            if user:
+                subprocess.run(
+                    ["icacls", str(path), "/grant:r", f"{user}:F"],
+                    check=False, capture_output=True,
+                )
+        except Exception as exc:  # noqa: BLE001
+            logger.warning(
+                "could not restrict ACL on %s (%s); the capability token may be "
+                "readable by other local users", path, exc,
+            )
+    else:
+        try:
+            os.chmod(path, 0o600)
+        except OSError as exc:
+            logger.warning("could not chmod %s to 0600: %s", path, exc)
+
+
 def write_descriptor(
     descriptor: DaemonDescriptor,
     *,
@@ -162,10 +201,7 @@ def write_descriptor(
             stream.flush()
             os.fsync(stream.fileno())
         os.replace(temporary, destination)
-        try:
-            os.chmod(destination, 0o600)
-        except OSError:
-            pass
+        _restrict_to_owner(destination)
     finally:
         temporary.unlink(missing_ok=True)
     return destination