@aion0/forge 0.10.3 → 0.10.4

package/RELEASE_NOTES.md

@@ -1,11 +1,11 @@
-# Forge v0.10.3
+# Forge v0.10.4
 
 Released: 2026-05-30
 
-## Changes since v0.10.2
+## Changes since v0.10.3
 
 ### Other
-- fix(settings): unmask apiProfiles.*.apiKey on POST (regression in v0.10.0)
+- fix(migrate): backup raw settings.yaml bytes (don't leak plaintext secrets)
 
 
-**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.10.2...v0.10.3
+**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.10.3...v0.10.4

package/lib/agents/migrate.ts

@@ -24,9 +24,8 @@
  * no-op (returns false, no save).
  */
 
-import { writeFileSync } from 'node:fs';
+import { copyFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
-import YAML from 'yaml';
 import { getDataDir } from '../dirs';
 import type { Settings } from '../settings';
 
@@ -130,23 +129,17 @@ function detectsLegacyShape(settings: Settings): boolean {
   return false;
 }
 
-function writeBackup(settings: Settings): void {
+function writeBackup(_settings: Settings): void {
+  // Raw byte copy of settings.yaml — never re-serialize the decrypted
+  // in-memory form. v0.10.x shipped a YAML.stringify(settings) backup
+  // that leaked plaintext API tokens + ANTHROPIC_AUTH_TOKEN into the
+  // data dir. Fixed in v0.10.4+.
   try {
+    const src = join(getDataDir(), 'settings.yaml');
+    if (!existsSync(src)) return;
     const ts = Date.now();
     const backupPath = join(getDataDir(), `settings.backup.agents-${ts}.yaml`);
-    const slice = {
-      _backup_note: 'Pre-migration snapshot of agent-related settings. Safe to delete after verifying migration worked.',
-      _backup_ts: new Date(ts).toISOString(),
-      agents: settings.agents,
-      defaultAgent: settings.defaultAgent,
-      chatAgent: settings.chatAgent,
-      telegramAgent: settings.telegramAgent,
-      docsAgent: settings.docsAgent,
-      telegramModel: settings.telegramModel,
-      taskModel: settings.taskModel,
-      pipelineModel: settings.pipelineModel,
-    };
-    writeFileSync(backupPath, YAML.stringify(slice), 'utf-8');
+    copyFileSync(src, backupPath);
     console.log(`[migrate-agents] backup → ${backupPath}`);
   } catch (err) {
     console.warn('[migrate-agents] backup write failed (continuing anyway):', err instanceof Error ? err.message : err);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aion0/forge",
-  "version": "0.10.3",
+  "version": "0.10.4",
   "description": "Unified AI workflow platform — multi-model task orchestration, persistent sessions, web terminal, remote access",
   "type": "module",
   "scripts": {