[quickbeard]

Ran the full local suite (bun turbo test, bun turbo typecheck, oxlint, app Playwright e2e, packages/client check:generated, packages/opencode test:httpapi, storybook build) and fixed the two failures it surfaced. Both were environment assumptions in the tests rather than product bugs.

tool.write > sets file permissions when writing sensitive data

Asserted stats.mode & 0o777 === 0o644. The write tool never chmods — it calls fs.writeWithDirs — so the mode is just the 0o666 creation default masked by the process umask. 0o644 silently encodes the umask 022 that CI runners happen to use; on a developer machine with the equally common umask 002 the file lands at 0o664 and the test fails.

Now derives the expectation from process.umask(). It still pins the tool to the platform default, so a stray chmod would break it, but it no longer hardcodes one runner's umask. Verified passing under both umask 002 and umask 022.

HttpApi SDK > matches generated SDK instance read routes

Timed out at exactly the 30s harness default during a full-suite run. It drives sixteen read routes in one test, several of which shell out to git/ripgrep or probe the formatter and LSP — ~5s unloaded, but well over 30s when the rest of the suite is competing for the machine.

Passes an explicit 120_000 from that file's own serverPathParity helper. Applying it in the helper rather than at the call site keeps every upstream call site byte-identical, so the change is a 5-line diff instead of a ~55-line reindent on an upstream file. Headroom only — a genuine hang still exceeds the bound.

DIVERGENCES.md gets a new row for the umask change and an extension of the existing slow-runner-headroom row for the timeout.

Verification

Gate	Result
bun turbo test	9/9 tasks, 0 failures (opencode 3197 pass, core 1085, app 619+31, session-ui 75, ui 14)
bun turbo typecheck	32/32 tasks pass
bun --cwd packages/app test:e2e:local	93 passed
packages/client bun run check:generated	clean
packages/opencode bun run test:httpapi	all three exerciser modes pass
bun --cwd packages/storybook build	succeeds
bun run lint	unchanged from main — 4740 warnings + 1 pre-existing error (see below)

Pre-existing lint error, not fixed here

oxlint reports one error on main, untouched by this PR: packages/session-ui/src/v2/components/prompt-input/index.tsx:159 writes a zero-width space into a Tailwind arbitrary value as content-['\200B'] inside a JSX class string, where the backslash-200 is parsed as a JS octal escape. The class that actually reaches the DOM therefore holds U+0080 followed by B, not the four literal characters Tailwind generated its rule from, so the selector never matches and the placeholder is dead.

It came in with the upstream v1.18.4 sync and lint is not wired into CI, so fixing it belongs in a separate change: there is no escaping that satisfies both the JS string literal and Tailwind's raw-source scanner at once, so the fix needs a different approach plus visual verification and its own DIVERGENCES.md row.

🤖 Generated with Claude Code