fix(daemon): private launcher state and strict integer env parsing

Merged
TH
4h ago
+86-7

Summary

Split out of #4358 at review request (audit findings CONTR2-4, DSRV-4).

  • CONTR2-4: the daemon launcher creates its state dir and log file with private modes (0700/0600) and tightens loose existing ones. The repair never blocks a launch: a foreign-owned path or a mount without chmod keeps its mode with a warn diagnostic.
  • DSRV-4: an empty or non-decimal integer env value (for example AGENT_DEVICE_ā€¦="" or "10s") reads as unset instead of 0 or NaN; an invalid value falls back to the default silently. This parse is stricter than session-idle-expiry.ts.

4 files, +86/āˆ’7. No scope expansion. No CLI surface change.

Validation

  • Tested SHA 6d6245a.
  • pnpm check:affected --run --head 6d6245a (exactCommit): format, lint, typecheck, layering, fallow, build and related tests pass. The unit lane fails only on the 7 known root/chmod tests (container runs as root; BASE-1). CI is authoritative for those.
  • New tests: private create, loose-mode repair, EPERM/EROFS on chmod still launch, and empty/non-decimal env values read as unset.
  • No device-facing change, so no live device run is needed.
  • Risk: low. A user who relied on world-readable daemon logs loses that access.
  • The Coverage failure at e7485d5 was in artifact-tracking.test.ts, outside this diff; this push reruns it.

šŸ¤– Generated with Claude Code

https://claude.ai/code/session_016qAu53rMak1bXMuR5U2gF4

<a href="```'''''''https://backend.blacksmith.sh/track/enable-autofix?expires=1796933818&installation_model_id=447842&pr_number=4369&ref=codesmith_pr_footer&repository=callstack%2Fagent-device&return_to=https%3A%2F%2Fgithub.com%2Fcallstack%2Fagent-device%2Fpull%2F4369&signature=86853535c9462401137b129e22ff3e62b7e0ac342659df01d4b1ce16be0e30ee"&gt;&lt;picture&gt;&lt;source'''''''' media="(prefers-color-scheme: dark)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"&gt;&lt;source media="(prefers-color-scheme: light)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-light.svg"&gt;&lt;img alt="Autofix with [code]smith" src="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark-3x.png" width="190" height="28">``
Open in [code]smith Ā· Need help on this PR? Tag @codesmith-bot with what you need.

<a href="```````'''''https://www.cubic.dev/action/auto-fix/pr/callstack/agent-device/4369?returnTo=https%3A%2F%2Fgithub.com%2Fcallstack%2Fagent-device%2Fpull%2F4369&source=description"'''''''''''' target="_blank" rel="noopener noreferrer" data-no-image-dialog="true">&lt;source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/turn-on-auto-fix-dark.svg"&gt;&lt;source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/turn-on-auto-fix-light.svg"&gt;&lt;img alt="Turn on auto-fix" src="https://www.cubic.dev/buttons/turn-on-auto-fix-light.svg"&gt;

Generated by Claude Code