@gotcos/glasses-server 6.12.1 → 6.12.3

package/.env.example

@@ -38,7 +38,7 @@ BIND_HOST=0.0.0.0
 
 # ── THE LLM (chat) ──────────────────────────────────────────────────────
 # Chat runs through your LOCAL agent CLI — NOT an API key:
-#   Opus / Fable / Sonnet  ->  Claude Code CLI  (https://claude.ai/download, then `claude login`)
+#   Opus / Fable / Sonnet  ->  Claude Code CLI  (https://docs.anthropic.com/en/docs/claude-code/getting-started, then `claude auth login`)
 #   GPT Frontier/Balanced  ->  Codex CLI        (https://developers.openai.com/codex/, then `codex login`)
 # Install at least one. Pick the default model the glasses use:
 # COS_G2_DEFAULT_MODEL=sonnet     # opus | fable | sonnet | codex-frontier | codex-balanced
@@ -55,6 +55,12 @@ BIND_HOST=0.0.0.0
 #
 # Codex remains read-only by default. This is the only broader trust opt-in:
 # COS_CODEX_SANDBOX=workspace-write
+#
+# Claude preserves COS's established trusted-machine behavior by default.
+# Security-conscious installs can remove the permission bypass and restrict
+# Claude to COS's explicit per-query tool allowlist. Undeclared tools fail
+# closed without an interactive prompt:
+# COS_CLAUDE_TRUST_MODE=allowlist
 
 # ── VOICE (optional) ────────────────────────────────────────────────────
 # Local transcription is FREE via whisper.cpp (brew install whisper-cpp; the
@@ -68,3 +74,7 @@ BIND_HOST=0.0.0.0
 # Power users running the COS Starter Kit can point the glasses at their
 # pipeline to inherit live tasks/calendar/people context. Omit for standalone.
 # COS_SCRIPTS_DIR=/path/to/your/cos/operations/scripts
+
+# Telegram session/activity notifications remain OFF even if the COS scripts
+# directory contains .telegram_config.json. Enable export explicitly:
+# COS_TELEGRAM_NOTIFICATIONS=1

package/CHANGELOG.md

@@ -1,5 +1,56 @@
 # Changelog
 
+## 6.12.3
+
+Security hardening from the public launch review, without changing app/server
+wire contracts.
+
+- **Stored prompts never enter a shell command.** Archive title generation now
+  launches Claude with an argument array and sends user content over stdin. A
+  regression test proves command substitutions and backticks remain inert.
+- **Claude can run in a real allowlist mode.** Existing installs retain trusted
+  mode for backward compatibility. Setting `COS_CLAUDE_TRUST_MODE=allowlist`
+  removes the permission bypass, restricts Claude to COS's explicit per-query
+  tools, and denies undeclared tools without an interactive prompt.
+- **Tailscale matching is exact.** Network and CORS policy now accept only the
+  assigned `100.64.0.0/10` CGNAT range rather than every `100.x` address.
+  Localhost and RFC1918 LAN access remain unchanged.
+- **Durable local state is private.** Runtime data and archive directories are
+  repaired to `0700`; atomic state, conversation archives, session logs, and
+  the saved OpenAI key are created or repaired to `0600`. Credential writes use
+  private, exclusive, fsync-backed atomic publication.
+- **Telegram export requires consent.** Merely finding a private
+  `.telegram_config.json` no longer enables activity export. Operators must set
+  the exact `COS_TELEGRAM_NOTIFICATIONS=1` opt-in.
+- **Canonical history remains exact.** Operational previews and provider
+  ledgers keep their existing redaction, while durable prompts/answers are not
+  silently mutated; recovery, retries, and `reference message N` remain intact.
+- **Backward compatible.** Query, prompt recovery, meetings, media, display,
+  diagnostics, transcription, and protocol response shapes are unchanged.
+
+## 6.12.2
+
+First-install hardening for public `npx` users.
+
+- **No nested install inside npm's cache.** The launcher resolves the declared
+  `tsx` dependency from npm's existing `npx` dependency tree and never runs a
+  second `npm install` from the ephemeral package directory.
+- **Permission failures do not spread.** A broken or incomplete package fails
+  closed with a user-owned isolated-cache recovery command. COS never suggests
+  `sudo npm`, broad ownership changes, or writing through a root-owned cache.
+- **Claude Desktop is no longer mistaken for Claude Code.** First-run guidance
+  explicitly requires the terminal CLI, keeps the scoped npm command on one
+  copyable line, forbids `sudo`, and explains the interactive sign-in step.
+- **Known signed-out agents fail before startup.** Installed Claude/Codex
+  binaries are checked before first-query readiness. Older CLI versions whose
+  authentication state cannot be proven show a warning instead of a false
+  signed-in claim.
+- **Local credentials are private.** `~/.cos-glasses` is repaired to `0700`;
+  the token and profile files are repaired to `0600`; symlinked credential
+  paths fail closed; auto-generated tokens are persisted with an atomic write.
+- **Runtime behavior is unchanged.** Query, prompt recovery, meetings, media,
+  diagnostics, transcription, display, and server data contracts are untouched.
+
 ## 6.12.1
 
 Public-safe CLI diagnostics for the COS Glasses Recovery Center.

package/README.md

@@ -8,7 +8,7 @@ API key is pasted into the phone for chat.
 ## Quick start
 
 ```bash
-npx @gotcos/glasses-server
+npx --yes @gotcos/glasses-server@latest
 ```
 
 The launcher checks Node, finds your CLI, checks voice and image processing,
@@ -24,7 +24,10 @@ without silently losing completed replies.
 ## Requirements
 
 - **Node.js 20.11+** — https://nodejs.org
-- **Claude Code CLI** (Opus/Fable/Sonnet) — https://claude.ai/download, then `claude login`
+- **Claude Code CLI** (Opus/Fable/Sonnet). Claude Desktop alone does not install
+  the terminal command. Install it on one line with
+  `npm install -g @anthropic-ai/claude-code` (**never with `sudo`**), then run
+  `claude` and finish the browser sign-in
   _or_ **Codex CLI** (GPT Frontier/Balanced) — https://developers.openai.com/codex/, then `codex login`
 - **Even G2 glasses** + the **COS Glasses** app from the Even Hub
 - `brew install whisper-cpp` for free local voice (the launcher can download the model)
@@ -40,6 +43,10 @@ without silently losing completed replies.
 > Existing `COS_CODEX_MODEL` / `COS_CODEX_REASONING_EFFORT` settings remain
 > supported on the migrated Frontier slot; leave them blank for auto-latest.
 > Codex runs **sandboxed read-only** by default (`COS_CODEX_SANDBOX` to adjust).
+> Claude preserves the established trusted-machine mode for compatibility.
+> Set `COS_CLAUDE_TRUST_MODE=allowlist` to remove Claude's permission bypass
+> and restrict it to COS's explicit per-query tool allowlist; undeclared tools
+> then fail closed without prompting.
 
 ## Connect your phone (the one gotcha)
 
@@ -51,7 +58,9 @@ The glasses app runs on your iPhone and must reach this server on your Mac.
 4. Either way, paste the **API token** the server printed at boot.
 
 To restrict the server to localhost only, set `BIND_HOST=127.0.0.1` in `~/.cos-glasses/.env`.
-The built-in IP allowlist blocks public-internet traffic regardless.
+The built-in IP allowlist blocks public-internet traffic regardless. Its mesh
+range is the exact Tailscale/CGNAT allocation (`100.64.0.0/10`), not all of
+`100.0.0.0/8`; RFC1918 LAN ranges remain supported.
 
 ## What it does
 
@@ -94,6 +103,9 @@ optional except an installed CLI. Highlights: `BIND_HOST`, `PORT`,
 server-owned query recovery), and `COS_MEDIA_ROOT` (optional image-store
 location; default `~/.cos-glasses/data/media`). Your name + transcription vocabulary live in
 `~/.cos-glasses/.cos-profile.json` (see `.cos-profile.example.json`).
+Telegram activity export is disabled by default even when a private COS
+pipeline contains `.telegram_config.json`; enable it only with the explicit
+`COS_TELEGRAM_NOTIFICATIONS=1` opt-in.
 
 ## Run from source
 
@@ -106,9 +118,20 @@ BIND_HOST=0.0.0.0 npm run start:server
 
 ## Troubleshooting
 
+- *Claude Desktop is installed but COS says Claude Code is missing* — Desktop
+  and the terminal CLI are separate. Run
+  `npm install -g @anthropic-ai/claude-code` on one line without `sudo`, then
+  run `claude` and complete sign-in. Verify with `claude --version` before
+  starting COS again.
+- *npm reports EACCES or a root-owned cache* — never run COS or npm with
+  `sudo`, and do not recursively change system ownership. Use a private COS
+  cache instead:
+  `npm_config_cache="$HOME/.cos-glasses/npm-cache" npx --yes @gotcos/glasses-server@latest`.
+  Version 6.12.2+ never runs a second install from inside npm's temporary cache.
 - *Phone can't connect* — check `BIND_HOST=0.0.0.0`, the same Tailscale account on both devices, and the correct `100.x` IP + token.
-- *Safari connects but the app does not* — confirm `npx @gotcos/glasses-server@latest` is 6.6.0+, then use the app's server reconnect/edit control to verify the current URL and token. Do not run a second source or `npx` server alongside it.
-- *AI queries fail* — run `claude --version` / `codex --version`, then `claude login` / `codex login`.
+- *Safari connects but the app does not* — confirm `npx --yes @gotcos/glasses-server@latest` is 6.6.0+, then use the app's server reconnect/edit control to verify the current URL and token. Do not run a second source or `npx` server alongside it.
+- *AI queries fail* — run `claude auth status` / `codex login status`, then
+  `claude auth login` / `codex login` when the provider reports signed out.
 - *Voice getting billed?* — voice is local-only by default in 6.12.0+. Confirm
   `/api/health` reports `capabilities.transcription.mode: "local-only"`. Remove
   `COS_OPENAI_WHISPER_FALLBACK` (or set it to `0`) to disable an earlier opt-in.
@@ -117,7 +140,7 @@ BIND_HOST=0.0.0.0 npm run start:server
   keeps compatible prompt/meeting audio available for retry instead of silently
   sending it to OpenAI.
 - *Photos unavailable?* — install `ffmpeg`, restart the server, and confirm `/api/health` reports `features.mediaProcessingReady: true`.
-- *Prompt recovery unavailable?* — update with `npx @gotcos/glasses-server@latest`, then confirm `/api/health` reports `features.promptRecovery: true`.
+- *Prompt recovery unavailable?* — update with `npx --yes @gotcos/glasses-server@latest`, then confirm `/api/health` reports `features.promptRecovery: true`.
 - *Durable query recovery unavailable?* — build 204+ requires server 6.10.0+ and
   `COS_DURABLE_QUERY_JOBS=1`. Restart once, then confirm `/api/health` reports
   `features.durableQueryJobs: true`, protocol `1`, and state `ready`. To roll

package/bin/cli.cjs

@@ -5,7 +5,17 @@
 // package — there is no clone. Config persists at ~/.cos-glasses/.
 
 const { execSync, spawn } = require('child_process')
-const { existsSync, mkdirSync, statSync, readFileSync, copyFileSync, unlinkSync, renameSync } = require('fs')
+const {
+  existsSync,
+  mkdirSync,
+  statSync,
+  lstatSync,
+  readFileSync,
+  copyFileSync,
+  unlinkSync,
+  renameSync,
+  chmodSync,
+} = require('fs')
 const { join, resolve } = require('path')
 const { homedir } = require('os')
 
@@ -30,11 +40,11 @@ if (process.argv.includes('--help') || process.argv.includes('-h')) {
   console.log(bold('  COS Glasses Server'))
   console.log('')
   console.log('  Usage:')
-  console.log('    npx @gotcos/glasses-server')
+  console.log('    npx --yes @gotcos/glasses-server@latest')
   console.log('')
   console.log('  Requirements:')
   console.log('    - Node.js 20.11+')
-  console.log('    - Claude Code CLI (Opus / Fable / Sonnet) or Codex CLI (GPT Frontier / Balanced)')
+  console.log('    - Claude Code CLI (not Claude Desktop) or Codex CLI')
   console.log('    - Even G2 smart glasses + the COS Glasses app (Even Hub)')
   console.log('')
   console.log('  No API key is needed for chat — it runs through your installed CLI.')
@@ -72,52 +82,142 @@ function normalizeCodexVersion(raw) {
   const line = raw.split('\n').map((s) => s.trim()).find((s) => /^codex(?:-cli)?\s+/i.test(s)) || raw.split('\n')[0].trim()
   return line.replace(/^codex(?:-cli)?\s*/i, '') || line
 }
+function commandResult(command) {
+  try {
+    return {
+      ok: true,
+      output: execSync(`${command} 2>&1`, { shell: '/bin/sh', stdio: 'pipe', timeout: 5000 }).toString().trim(),
+    }
+  } catch (err) {
+    return {
+      ok: false,
+      output: (err.stdout?.toString() || err.stderr?.toString() || '').trim(),
+    }
+  }
+}
+function claudeAuthState() {
+  const result = commandResult('claude auth status --json')
+  try {
+    const parsed = JSON.parse(result.output)
+    if (parsed.loggedIn === true) return 'ready'
+    if (parsed.loggedIn === false) return 'signed-out'
+  } catch { /* older CLIs may not support JSON status */ }
+  if (/not logged in|logged out|sign[ -]?in required/i.test(result.output)) return 'signed-out'
+  return 'unknown'
+}
+function codexAuthState() {
+  const result = commandResult('codex login status')
+  if (/logged in/i.test(result.output) && !/not logged in/i.test(result.output)) return 'ready'
+  if (/not logged in|logged out|sign[ -]?in required/i.test(result.output)) return 'signed-out'
+  return 'unknown'
+}
 const claudeVersion = getCliVersion('claude')
 const codexVersion = getCliVersion('codex')
+const claudeAuth = claudeVersion ? claudeAuthState() : null
+const codexAuth = codexVersion ? codexAuthState() : null
 if (claudeVersion) {
-  console.log(green('  ✓') + ` Claude Code ${claudeVersion} ` + dim('(Opus / Fable / Sonnet)'))
+  if (claudeAuth === 'signed-out') {
+    console.log(yellow('  ⚠') + ` Claude Code ${claudeVersion} installed — sign-in required`)
+    console.log('    Run: ' + bold('claude auth login'))
+  } else if (claudeAuth === 'unknown') {
+    console.log(yellow('  ⚠') + ` Claude Code ${claudeVersion} installed — sign-in status unavailable`)
+    console.log('    Verify: ' + bold('claude auth status'))
+  } else {
+    console.log(green('  ✓') + ` Claude Code ${claudeVersion} ` + dim('(Opus / Fable / Sonnet)'))
+  }
 } else {
   console.log(yellow('  ⚠') + ' Claude Code CLI not found ' + dim('— Opus/Fable/Sonnet unavailable'))
-  console.log('    Install: ' + bold('https://claude.ai/download'))
+  console.log('    Claude Desktop does not install the terminal CLI.')
+  console.log('    Install (no sudo): ' + bold('npm install -g @anthropic-ai/claude-code'))
+  console.log('    Then run:          ' + bold('claude') + ' and finish sign-in')
 }
 if (codexVersion) {
-  console.log(green('  ✓') + ` Codex CLI ${normalizeCodexVersion(codexVersion)} ` + dim('(GPT Frontier / Balanced)'))
+  if (codexAuth === 'signed-out') {
+    console.log(yellow('  ⚠') + ` Codex CLI ${normalizeCodexVersion(codexVersion)} installed — sign-in required`)
+    console.log('    Run: ' + bold('codex login'))
+  } else if (codexAuth === 'unknown') {
+    console.log(yellow('  ⚠') + ` Codex CLI ${normalizeCodexVersion(codexVersion)} installed — sign-in status unavailable`)
+    console.log('    Verify: ' + bold('codex login status'))
+  } else {
+    console.log(green('  ✓') + ` Codex CLI ${normalizeCodexVersion(codexVersion)} ` + dim('(GPT Frontier / Balanced)'))
+  }
 } else {
   console.log(yellow('  ⚠') + ' Codex CLI not found ' + dim('— GPT Frontier/Balanced unavailable'))
 }
-if (!claudeVersion && !codexVersion) {
+const hasUsableAgent = (claudeVersion && claudeAuth !== 'signed-out') || (codexVersion && codexAuth !== 'signed-out')
+if (!hasUsableAgent) {
   console.log('')
-  console.log(red('  ✗ No supported agent CLI found'))
-  console.log('    Install Claude Code: ' + bold('https://claude.ai/download'))
+  console.log(red('  ✗ No signed-in agent CLI is ready'))
+  console.log('    Claude Desktop alone is not enough; COS needs a terminal CLI.')
+  console.log('    Install Claude Code (no sudo): ' + bold('npm install -g @anthropic-ai/claude-code'))
+  console.log('    Then run:                       ' + bold('claude auth login'))
   console.log('    or Codex CLI:        ' + bold('https://developers.openai.com/codex/') + ' then ' + bold('codex login'))
+  console.log('    Setup help:          ' + bold('https://www.gotcos.com/wizard/'))
   console.log('')
   process.exit(1)
 }
 
-// Step 3: dependencies — only when run from a git clone without node_modules.
-// `npx` already installed the package's deps alongside it.
-if (!existsSync(join(PKG_ROOT, 'node_modules'))) {
+// Step 3: resolve the dependency npm already installed. With `npx`, dependency
+// packages are siblings in npm's temporary node_modules tree rather than under
+// PKG_ROOT/node_modules. Running a second `npm install` from inside that cache
+// is both unnecessary and unsafe: a prior sudo-based npm install can make the
+// shared cache root-owned and turn an otherwise valid first launch into EACCES.
+let tsxImport
+try {
+  tsxImport = require.resolve('tsx/esm', { paths: [PKG_ROOT] })
+} catch {
   console.log('')
-  console.log(`  ${yellow('⟳')} Installing dependencies...`)
-  try {
-    execSync('npm install', { cwd: PKG_ROOT, stdio: 'pipe', timeout: 300000 })
-    console.log(green('  ✓') + ' Dependencies installed')
-  } catch (err) {
-    console.log(red('  ✗ npm install failed'))
-    console.log(`    ${err.stderr?.toString().slice(0, 200) || err.message}`)
-    process.exit(1)
-  }
+  console.log(red('  ✗ COS package dependencies are incomplete'))
+  console.log('    Do not use sudo. Retry with an isolated user-owned npm cache:')
+  console.log('    ' + bold('npm_config_cache="$HOME/.cos-glasses/npm-cache" npx --yes @gotcos/glasses-server@latest'))
+  console.log('    Source installs only: run ' + bold('npm install') + ' in the cloned repository.')
+  process.exit(1)
 }
 
 // Step 4: persistent config at ~/.cos-glasses/ (survives npx cache churn)
-mkdirSync(CONFIG_DIR, { recursive: true })
+function securePrivateDirectory(dir) {
+  mkdirSync(dir, { recursive: true, mode: 0o700 })
+  const stats = lstatSync(dir)
+  if (stats.isSymbolicLink() || !stats.isDirectory()) {
+    throw new Error(`${dir} must be a private directory, not a symlink`)
+  }
+  chmodSync(dir, 0o700)
+}
+
+function securePrivateFile(file) {
+  if (!existsSync(file)) return
+  const stats = lstatSync(file)
+  if (stats.isSymbolicLink() || !stats.isFile()) {
+    throw new Error(`${file} must be a regular file, not a symlink`)
+  }
+  chmodSync(file, 0o600)
+}
+
+try {
+  securePrivateDirectory(CONFIG_DIR)
+} catch (err) {
+  console.log('')
+  console.log(red('  ✗ COS config directory is unsafe'))
+  console.log(`    ${err.message}`)
+  console.log('    Move it aside and rerun COS; do not use sudo or broad ownership changes.')
+  process.exit(1)
+}
 const ENV_FILE = join(CONFIG_DIR, '.env')
 const ENV_EXAMPLE = join(PKG_ROOT, '.env.example')
 if (!existsSync(ENV_FILE) && existsSync(ENV_EXAMPLE)) {
   copyFileSync(ENV_EXAMPLE, ENV_FILE)
+  chmodSync(ENV_FILE, 0o600)
   console.log(green('  ✓') + ` Created config at ${dim(ENV_FILE)}`)
 }
 if (existsSync(ENV_FILE)) {
+  try {
+    securePrivateFile(ENV_FILE)
+  } catch (err) {
+    console.log('')
+    console.log(red('  ✗ COS config file is unsafe'))
+    console.log(`    ${err.message}`)
+    process.exit(1)
+  }
   try {
     for (const line of readFileSync(ENV_FILE, 'utf-8').split('\n')) {
       const m = line.match(/^\s*([A-Z_][A-Z0-9_]*)=(.*)$/)
@@ -130,6 +230,15 @@ const PROFILE_FILE = join(CONFIG_DIR, '.cos-profile.json')
 const PROFILE_EXAMPLE = join(PKG_ROOT, '.cos-profile.example.json')
 if (!existsSync(PROFILE_FILE) && existsSync(PROFILE_EXAMPLE)) {
   copyFileSync(PROFILE_EXAMPLE, PROFILE_FILE)
+  chmodSync(PROFILE_FILE, 0o600)
+}
+try {
+  securePrivateFile(PROFILE_FILE)
+} catch (err) {
+  console.log('')
+  console.log(red('  ✗ COS profile is unsafe'))
+  console.log(`    ${err.message}`)
+  process.exit(1)
 }
 if (!process.env.COS_PROFILE_PATH) process.env.COS_PROFILE_PATH = PROFILE_FILE
 
@@ -156,14 +265,15 @@ function isValidWhisperModel(p) {
 }
 const whisperCliPath = findWhisperCli()
 const hasValidModel = isValidWhisperModel(WHISPER_MODEL_PATH)
+let localVoiceReady = Boolean(whisperCliPath && hasValidModel)
 if (whisperCliPath && hasValidModel) {
   console.log(green('  ✓') + ' whisper.cpp + model ready ' + dim('— voice = local (FREE)'))
 } else if (whisperCliPath && !hasValidModel) {
   if (existsSync(WHISPER_MODEL_PATH)) { try { unlinkSync(WHISPER_MODEL_PATH) } catch {} }
   if (existsSync(WHISPER_MODEL_PARTIAL)) { try { unlinkSync(WHISPER_MODEL_PARTIAL) } catch {} }
   console.log(yellow('  ⚠') + ' whisper.cpp installed but model missing')
-  console.log('    ' + dim('Downloading ggml-large-v3-turbo (~1.5 GB). Ctrl-C to skip (voice remains unavailable by default).'))
-  console.log('    ' + dim('Skip permanently: SKIP_WHISPER_DOWNLOAD=1 npx @gotcos/glasses-server'))
+  console.log('    ' + dim('Downloading ggml-large-v3-turbo (~1.5 GB).'))
+  console.log('    ' + dim('Skip: SKIP_WHISPER_DOWNLOAD=1 npx --yes @gotcos/glasses-server@latest'))
   if (process.env.SKIP_WHISPER_DOWNLOAD === '1') {
     console.log(yellow('  ⚠') + ' SKIP_WHISPER_DOWNLOAD=1 — local voice unavailable')
   } else {
@@ -173,6 +283,7 @@ if (whisperCliPath && hasValidModel) {
       const stats = statSync(WHISPER_MODEL_PARTIAL)
       if (stats.size < WHISPER_MODEL_MIN_BYTES) throw new Error(`Downloaded file too small: ${stats.size} bytes`)
       renameSync(WHISPER_MODEL_PARTIAL, WHISPER_MODEL_PATH)
+      localVoiceReady = true
       console.log(green('  ✓') + ' Model downloaded ' + dim('— voice = local (FREE)'))
     } catch (err) {
       try { unlinkSync(WHISPER_MODEL_PARTIAL) } catch {}
@@ -215,17 +326,23 @@ try {
     console.log(green('  ✓') + ` COS detected in ${dim(ld)} — glasses chat will load its brain`)
   }
 } catch { /* detection is best-effort */ }
+if (!localVoiceReady) {
+  console.log('')
+  console.log(yellow('  ⚠ LOCAL VOICE NOT READY'))
+  console.log('    Text chat can start. Under the default local-only policy, voice prompts remain unavailable.')
+  console.log('    Install: ' + bold('brew install whisper-cpp'))
+  console.log('    Then stop COS with Ctrl-C and rerun: ' + bold('npx --yes @gotcos/glasses-server@latest'))
+}
 console.log('')
 console.log(dim('  Starting server...'))
 console.log('')
 const serverProc = spawn(
   process.execPath,
-  ['--import', 'tsx/esm', 'server/index.ts'],
+  ['--import', tsxImport, 'server/index.ts'],
   { cwd: PKG_ROOT, stdio: 'inherit', env: { ...process.env } }
 )
 serverProc.on('error', (err) => {
   console.error(red(`  Server failed to start: ${err.message}`))
-  if (err.message.includes('tsx')) console.error('  Try: cd ' + PKG_ROOT + ' && npm install')
   process.exit(1)
 })
 serverProc.on('exit', (code) => process.exit(code ?? 0))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.12.1",
+  "version": "6.12.3",
   "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by your local Claude Code or Codex CLI",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -7,7 +7,7 @@ import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { createServer as createHttpsServer } from 'node:https'
 import { createServer as createHttpServer } from 'node:http'
-import { readFileSync, existsSync, appendFileSync, mkdirSync } from 'node:fs'
+import { readFileSync, existsSync } from 'node:fs'
 import { networkInterfaces, homedir } from 'node:os'
 import { join } from 'node:path'
 import { execSync } from 'node:child_process'
@@ -44,6 +44,7 @@ import { getMediaStore } from './lib/media-store.js'
 import { listenRequiredServers, type RequiredListener } from './lib/listener-startup.js'
 import { serverMetrics } from './lib/server-metrics.js'
 import { initializeServerInstanceId } from './lib/server-instance-id.js'
+import { appendPrivateEnvBlock, UnsafeUserConfigPathError } from './lib/secure-user-config.js'
 import { createQueryJobsRouter } from './routes/query-jobs.js'
 import {
   initQueryJobRuntime,
@@ -51,6 +52,11 @@ import {
   queryJobCoordinator,
   shutdownQueryJobRuntime,
 } from './lib/query-job-runtime.js'
+import {
+  isAllowedNetworkIp,
+  isAllowedNetworkOrigin,
+  isTailscaleIpv4,
+} from './lib/network-policy.js'
 
 const app = express()
 const PORT = parseInt(process.env.PORT ?? '3141', 10)
@@ -76,10 +82,16 @@ let API_TOKEN_PERSISTED = false
 if (API_TOKEN_AUTO) {
   try {
     const envDir = join(homedir(), '.cos-glasses')
-    mkdirSync(envDir, { recursive: true })
-    appendFileSync(join(envDir, '.env'), `\n# auto-generated by the server so the app token survives restarts\nCOS_API_TOKEN=${API_TOKEN}\n`)
+    appendPrivateEnvBlock(
+      join(envDir, '.env'),
+      `# auto-generated by the server so the app token survives restarts\nCOS_API_TOKEN=${API_TOKEN}\n`,
+    )
     API_TOKEN_PERSISTED = true
-  } catch { /* read-only home — token stays per-session */ }
+  } catch (error) {
+    // Read-only homes may continue with a per-session token, but an unsafe
+    // symlinked credential path must fail closed instead of being ignored.
+    if (error instanceof UnsafeUserConfigPathError) throw error
+  }
 }
 
 // IP allowlist — only accept connections from localhost, meshnet, and private networks.
@@ -87,15 +99,7 @@ if (API_TOKEN_AUTO) {
 // local + meshnet (Tailscale/CGNAT) + LAN consumers working.
 app.use((req, res, next) => {
   const ip = req.ip || req.socket.remoteAddress || ''
-  // Normalize IPv6-mapped IPv4 (::ffff:127.0.0.1 → 127.0.0.1)
-  const cleanIp = ip.replace(/^::ffff:/, '')
-  const allowed =
-    cleanIp === '127.0.0.1' || cleanIp === '::1' ||               // localhost
-    /^100\./.test(cleanIp) ||                                       // meshnet (CGNAT)
-    /^10\./.test(cleanIp) ||                                        // private 10.x
-    /^172\.(1[6-9]|2\d|3[01])\./.test(cleanIp) ||                  // private 172.16-31.x
-    /^192\.168\./.test(cleanIp)                                     // private 192.168.x
-  if (!allowed) {
+  if (!isAllowedNetworkIp(ip)) {
     res.status(403).json({ error: 'forbidden — not on allowed network' })
     return
   }
@@ -107,10 +111,7 @@ app.use(cors({
   origin: (origin, cb) => {
     // Allow requests with no origin (same-origin, curl, SSE) or "null" origin (file:// WebViews like Even Hub)
     if (!origin || origin === 'null') return cb(null, true)
-    // Allow localhost variants
-    if (/^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(origin)) return cb(null, true)
-    // Allow private network IPs (10.x.x.x, 172.16-31.x.x, 192.168.x.x, 100.x.x.x for Meshnet/CGNAT)
-    if (/^https?:\/\/(10|172\.(1[6-9]|2\d|3[01])|192\.168|100)(\.\d+){2,3}(:\d+)?$/.test(origin)) return cb(null, true)
+    if (isAllowedNetworkOrigin(origin)) return cb(null, true)
     cb(new Error('CORS blocked'))
   },
 }))
@@ -267,7 +268,7 @@ listenRequiredServers(listeners).then(() => {
     for (const [name, infos] of Object.entries(nets)) {
       for (const info of infos ?? []) {
         if (info.family !== 'IPv4' || info.internal) continue
-        const isTailscale = info.address.startsWith('100.') || name.startsWith('utun') || name.startsWith('tailscale')
+        const isTailscale = isTailscaleIpv4(info.address) || name.startsWith('tailscale')
         addrs.push({ ip: info.address, label: isTailscale ? 'Tailscale — works from anywhere' : `${name} — same Wi-Fi only` })
       }
     }
@@ -294,7 +295,7 @@ listenRequiredServers(listeners).then(() => {
     claudeAvailable = true
     console.log('[COS API] Claude Code CLI detected')
   } catch {
-    console.warn('[COS API] Claude Code CLI not found — install from https://claude.ai/download')
+    console.warn('[COS API] Claude Code CLI not found — install from https://docs.anthropic.com/en/docs/claude-code/getting-started')
     console.warn('[COS API]   Claude models unavailable; Codex models still work when Codex CLI is installed')
   }
 

package/server/lib/archive.ts

@@ -3,17 +3,16 @@
 // Each day's archive contains one or more "chats" (split by context breaks)
 // Summaries are generated via `claude -p --model sonnet`, budget-capped per day.
 
-import { mkdirSync, readdirSync } from 'node:fs'
+import { chmodSync, mkdirSync, readdirSync } from 'node:fs'
 import { resolve, dirname } from 'node:path'
 import { fileURLToPath } from 'node:url'
-import { exec } from 'node:child_process'
-import { promisify } from 'node:util'
+import { spawn } from 'node:child_process'
 import { logTokenAudit } from './token-audit.js'
 import { atomicWriteFileSync, loadJsonOrQuarantine } from './atomic-fs.js'
 import { consumeArchiveLLMBudget } from './archive-budget.js'
 import { mergeMediaAttachmentRefs, type MediaAttachmentRef } from '../../shared/media-attachment.js'
+import { secureExistingPrivateFile } from './secure-user-config.js'
 
-const execAsync = promisify(exec)
 import type { Exchange } from './conversation.js'
 
 import { dataPath } from './data-dir.js'
@@ -65,7 +64,8 @@ export interface SessionToArchive {
 // ── Directory management ────────────────────────────────────
 
 function ensureArchiveDir(): string {
-  mkdirSync(ARCHIVE_DIR, { recursive: true })
+  mkdirSync(ARCHIVE_DIR, { recursive: true, mode: 0o700 })
+  chmodSync(ARCHIVE_DIR, 0o700)
   return ARCHIVE_DIR
 }
 
@@ -76,7 +76,9 @@ function archivePath(date: string): string {
 // ── Read/Write ──────────────────────────────────────────────
 
 export function loadArchive(date: string): DailyArchive | null {
-  const result = loadJsonOrQuarantine<DailyArchive>(archivePath(date))
+  const path = archivePath(date)
+  secureExistingPrivateFile(path)
+  const result = loadJsonOrQuarantine<DailyArchive>(path)
   if (result.status === 'corrupt') {
     // Loud — a silent return masked archive corruption as "day unavailable"
     console.error(
@@ -178,6 +180,54 @@ function fallbackDaySummary(chats: ArchivedChat[]): string {
   return summaries.slice(0, 2).join(', ').slice(0, 60) || 'Day activity'
 }
 
+/**
+ * Run the archive summarizer without invoking a shell.
+ *
+ * The archived query text is user-controlled. It must travel over stdin, never
+ * through a command string, so shell metacharacters remain inert data.
+ */
+function runClaudeArchiveSummary(input: string, instruction: string): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const proc = spawn('claude', ['-p', '--model', 'sonnet', instruction], {
+      stdio: ['pipe', 'pipe', 'pipe'],
+    })
+
+    let stdout = ''
+    let stderr = ''
+    let settled = false
+
+    const finish = (error?: Error) => {
+      if (settled) return
+      settled = true
+      clearTimeout(timer)
+      if (error) reject(error)
+      else resolve(stdout)
+    }
+
+    const timer = setTimeout(() => {
+      proc.kill('SIGTERM')
+      finish(new Error('Archive summary timed out'))
+    }, 15_000)
+    timer.unref?.()
+
+    proc.stdout.on('data', (chunk: Buffer) => {
+      if (stdout.length < 16_384) stdout += chunk.toString().slice(0, 16_384 - stdout.length)
+    })
+    proc.stderr.on('data', (chunk: Buffer) => {
+      if (stderr.length < 4_096) stderr += chunk.toString().slice(0, 4_096 - stderr.length)
+    })
+    proc.on('error', error => finish(error))
+    proc.on('close', code => {
+      if (code === 0) finish()
+      else finish(new Error(`Archive summary exited ${code}: ${stderr.trim()}`))
+    })
+
+    // Ignore EPIPE here; the close/error handlers above own the final outcome.
+    proc.stdin.on('error', () => {})
+    proc.stdin.end(input)
+  })
+}
+
 /** Generate a <60 char summary for a single chat via claude -p.
  *  Budget-capped: if MAX_DAILY_ARCHIVE_LLM_CALLS is exhausted or `skipLLM` is
  *  passed, returns a deterministic string fallback. */
@@ -196,9 +246,9 @@ export async function generateChatSummary(exchanges: Exchange[], skipLLM = false
 
   const startMs = Date.now()
   try {
-    const { stdout } = await execAsync(
-      `echo ${JSON.stringify(userQueries)} | claude -p --model sonnet "Summarize these COS Glasses queries into a single title under 60 characters. Just the title, no quotes, no explanation."`,
-      { timeout: 15_000 }
+    const stdout = await runClaudeArchiveSummary(
+      userQueries,
+      'Summarize these COS Glasses queries into a single title under 60 characters. Just the title, no quotes, no explanation.',
     )
     const result = stdout.trim()
 
@@ -237,9 +287,9 @@ export async function generateDaySummary(chats: ArchivedChat[], skipLLM = false)
 
   const startMs = Date.now()
   try {
-    const { stdout } = await execAsync(
-      `echo ${JSON.stringify(allQueries)} | claude -p --model sonnet "Summarize these COS Glasses queries from one day into a daily title under 60 characters. Just the title, no quotes."`,
-      { timeout: 15_000 }
+    const stdout = await runClaudeArchiveSummary(
+      allQueries,
+      'Summarize these COS Glasses queries from one day into a daily title under 60 characters. Just the title, no quotes.',
     )
     const result = stdout.trim()
 

package/server/lib/atomic-fs.ts

@@ -9,6 +9,7 @@
 
 import {
   closeSync,
+  chmodSync,
   constants,
   existsSync,
   fchmodSync,
@@ -23,9 +24,12 @@ import { randomBytes } from 'node:crypto'
 import { basename, dirname, join } from 'node:path'
 
 export function atomicWriteFileSync(path: string, data: string | Buffer, options: { mode?: number } = {}): void {
+  const mode = options.mode ?? 0o600
   const tmp = `${path}.tmp`
-  writeFileSync(tmp, data, options.mode === undefined ? undefined : { mode: options.mode })
+  writeFileSync(tmp, data, { mode })
+  chmodSync(tmp, mode)
   renameSync(tmp, path)
+  chmodSync(path, mode)
 }
 
 /**

package/server/lib/claude-bridge.ts

@@ -48,6 +48,7 @@ import {
   type MediaAttachmentRef,
 } from '../../shared/media-attachment.js'
 import { terminalProviderAuthFailure } from './provider-terminal-error.js'
+import { claudePermissionArgs, getClaudeTrustMode } from './claude-permissions.js'
 
 // Inactivity = no stdout data for this long → kill (catches stalls)
 const INACTIVITY_BY_MODEL: Record<ClaudeModelPreference, number> = {
@@ -214,7 +215,7 @@ export async function preWarmCLI(): Promise<void> {
       '--effort', getClaudeEffortLevel(),
       '--output-format', 'stream-json',
       '--verbose',
-      '--dangerously-skip-permissions',
+      ...claudePermissionArgs(getClaudeTrustMode(), null),
       '--system-prompt', buildPrewarmSystemPrompt(),
     ], {
       stdio: ['pipe', 'pipe', 'pipe'],
@@ -493,20 +494,19 @@ export async function callClaudeStreaming(
     '--effort', cliEffortFlag,
     '--output-format', 'stream-json',
     '--verbose',  // Required: stream-json requires --verbose
-    '--dangerously-skip-permissions',  // Required: headless CLI mode with no TTY for user prompts
     '--system-prompt', systemPrompt,
   ]
 
   // Full COS path gets tools + partial messages; lightweight gets web search only
   if (options?.lightweight) {
     if (imagePaths.length > 0) {
-      args.push('--allowedTools', tools)
+      args.push(...claudePermissionArgs(getClaudeTrustMode(), tools))
     } else {
       // Lightweight: web search for general questions, no Bash/Read/Write (saves 5-10s)
-      args.push('--allowedTools', 'WebSearch,WebFetch')
+      args.push(...claudePermissionArgs(getClaudeTrustMode(), 'WebSearch,WebFetch'))
     }
   } else {
-    args.push('--allowedTools', tools, '--include-partial-messages')
+    args.push(...claudePermissionArgs(getClaudeTrustMode(), tools), '--include-partial-messages')
   }
 
   if (existingCliSession) {

package/server/lib/claude-permissions.ts

@@ -0,0 +1,40 @@
+export type ClaudeTrustMode = 'trusted' | 'allowlist'
+
+/**
+ * Claude Code historically ran COS in trusted mode so headless sessions could
+ * use the operator's existing tools without stopping for an interactive
+ * permission prompt. Keep that behavior for compatibility, while allowing
+ * security-conscious installs to opt into a strict, non-interactive allowlist.
+ */
+export function getClaudeTrustMode(
+  env: NodeJS.ProcessEnv = process.env,
+): ClaudeTrustMode {
+  return env.COS_CLAUDE_TRUST_MODE?.trim().toLowerCase() === 'allowlist'
+    ? 'allowlist'
+    : 'trusted'
+}
+
+/**
+ * Build only Claude's permission-related CLI arguments.
+ *
+ * - trusted: preserves the established COS behavior.
+ * - allowlist: denies undeclared tools without prompting and restricts the
+ *   available built-ins to the explicit per-query list.
+ */
+export function claudePermissionArgs(
+  mode: ClaudeTrustMode,
+  allowedTools: string | null,
+): string[] {
+  if (mode === 'trusted') {
+    return allowedTools === null
+      ? ['--dangerously-skip-permissions']
+      : ['--dangerously-skip-permissions', '--allowedTools', allowedTools]
+  }
+
+  const tools = allowedTools ?? ''
+  return [
+    '--permission-mode', 'dontAsk',
+    '--tools', tools,
+    '--allowedTools', tools,
+  ]
+}

package/server/lib/conversation.ts

@@ -14,6 +14,7 @@ import { atomicWriteFileSync, durableAtomicWriteFileSync, loadJsonOrQuarantine }
 import { localDay } from './local-day.js'
 import { normalizeModelPreference, type ModelPreference } from '../../shared/model-preference.js'
 import { parseMediaAttachmentRefs, type MediaAttachmentRef } from '../../shared/media-attachment.js'
+import { secureExistingPrivateFile } from './secure-user-config.js'
 
 export type { ModelPreference }
 
@@ -119,6 +120,7 @@ function matchesJobIdentity(exchange: Exchange, identity: ExchangeJobIdentity):
 }
 
 function loadFromDisk(): void {
+  secureExistingPrivateFile(SESSION_FILE)
   const result = loadJsonOrQuarantine<SessionsFile>(SESSION_FILE)
   if (result.status === 'missing') return // fresh start
 

package/server/lib/data-dir.ts

@@ -1,6 +1,6 @@
 import { homedir } from 'node:os'
 import { join, resolve } from 'node:path'
-import { mkdirSync } from 'node:fs'
+import { chmodSync, mkdirSync } from 'node:fs'
 
 // Runtime state directory. Defaults to ~/.cos-glasses/data — a writable location
 // that survives `npx` cache churn and works on global/Docker installs. (Writing
@@ -11,7 +11,8 @@ export const DATA_DIR = process.env.COS_DATA_DIR
   : join(homedir(), '.cos-glasses', 'data')
 
 try {
-  mkdirSync(DATA_DIR, { recursive: true })
+  mkdirSync(DATA_DIR, { recursive: true, mode: 0o700 })
+  chmodSync(DATA_DIR, 0o700)
 } catch { /* best effort — individual writers also tolerate a missing dir */ }
 
 /** Build a path under the runtime data directory. */

package/server/lib/network-policy.ts

@@ -0,0 +1,42 @@
+/** Network ranges accepted by the public server before API-token auth runs. */
+
+function parseIpv4(value: string): number[] | null {
+  const parts = value.split('.')
+  if (parts.length !== 4) return null
+  const octets = parts.map(part => Number(part))
+  if (octets.some((octet, index) => !/^\d{1,3}$/.test(parts[index]) || octet < 0 || octet > 255)) {
+    return null
+  }
+  return octets
+}
+
+export function normalizeRemoteIp(value: string): string {
+  return value.replace(/^::ffff:/, '')
+}
+
+export function isTailscaleIpv4(value: string): boolean {
+  const octets = parseIpv4(normalizeRemoteIp(value))
+  return !!octets && octets[0] === 100 && octets[1] >= 64 && octets[1] <= 127
+}
+
+export function isAllowedNetworkIp(value: string): boolean {
+  const clean = normalizeRemoteIp(value)
+  if (clean === '127.0.0.1' || clean === '::1') return true
+  if (isTailscaleIpv4(clean)) return true
+
+  const octets = parseIpv4(clean)
+  if (!octets) return false
+  return octets[0] === 10 ||
+    (octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31) ||
+    (octets[0] === 192 && octets[1] === 168)
+}
+
+export function isAllowedNetworkOrigin(origin: string): boolean {
+  try {
+    const url = new URL(origin)
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') return false
+    return url.hostname === 'localhost' || isAllowedNetworkIp(url.hostname)
+  } catch {
+    return false
+  }
+}

package/server/lib/openai-key.ts

@@ -20,6 +20,7 @@ import { existsSync, readFileSync } from 'node:fs'
 import { dirname, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { COS_SCRIPTS_DIR } from './python-bridge.js'
+import { secureExistingPrivateFile } from './secure-user-config.js'
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
 
@@ -61,6 +62,7 @@ export function clearCachedKey(): void {
 function readConfigFile(): KeyConfigFile | null {
   if (!existsSync(KEY_FILE_PATH)) return null
   try {
+    secureExistingPrivateFile(KEY_FILE_PATH)
     const raw = readFileSync(KEY_FILE_PATH, 'utf-8')
     const parsed = JSON.parse(raw) as Partial<KeyConfigFile>
     if (!parsed || typeof parsed.key !== 'string' || !parsed.key.trim()) return null

package/server/lib/secure-user-config.ts

@@ -0,0 +1,64 @@
+import {
+  chmodSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync,
+} from 'node:fs'
+import { basename, dirname, join } from 'node:path'
+
+export class UnsafeUserConfigPathError extends Error {
+  constructor(message: string) {
+    super(message)
+    this.name = 'UnsafeUserConfigPathError'
+  }
+}
+
+export function securePrivateDirectory(dir: string): void {
+  mkdirSync(dir, { recursive: true, mode: 0o700 })
+  const stats = lstatSync(dir)
+  if (stats.isSymbolicLink() || !stats.isDirectory()) {
+    throw new UnsafeUserConfigPathError(`${dir} must be a private directory, not a symlink`)
+  }
+  chmodSync(dir, 0o700)
+}
+
+export function secureExistingPrivateFile(file: string): void {
+  if (!existsSync(file)) return
+  const stats = lstatSync(file)
+  if (stats.isSymbolicLink() || !stats.isFile()) {
+    throw new UnsafeUserConfigPathError(`${file} must be a regular file, not a symlink`)
+  }
+  chmodSync(file, 0o600)
+}
+
+/**
+ * Append an env block without ever following a symlink or exposing a partially
+ * written credential file. The replacement is created beside the destination
+ * at 0600 and atomically renamed into place.
+ */
+export function appendPrivateEnvBlock(file: string, block: string): void {
+  const dir = dirname(file)
+  securePrivateDirectory(dir)
+  secureExistingPrivateFile(file)
+
+  const current = existsSync(file) ? readFileSync(file, 'utf8') : ''
+  const separator = current.length > 0 && !current.endsWith('\n') ? '\n' : ''
+  const temp = join(dir, `.${basename(file)}.${process.pid}.${Date.now()}.tmp`)
+  try {
+    writeFileSync(temp, `${current}${separator}${block}`, {
+      encoding: 'utf8',
+      flag: 'wx',
+      mode: 0o600,
+    })
+    chmodSync(temp, 0o600)
+    renameSync(temp, file)
+    chmodSync(file, 0o600)
+  } catch (error) {
+    try { unlinkSync(temp) } catch { /* best-effort cleanup */ }
+    throw error
+  }
+}

package/server/lib/session-log.ts

@@ -2,7 +2,7 @@
 // so COS can query Glasses sessions by original UUID, date, domain, or content.
 // Fires on: TTL expiry, explicit /api/sessions/:id/end, server shutdown.
 
-import { appendFileSync, mkdirSync } from 'node:fs'
+import { appendFileSync, chmodSync, mkdirSync } from 'node:fs'
 import { resolve, dirname } from 'node:path'
 import type { Exchange } from './conversation.js'
 
@@ -143,7 +143,8 @@ export function writeSessionLog(entry: SessionLogEntry): boolean {
 
   try {
     mkdirSync(dirname(logPath), { recursive: true })
-    appendFileSync(logPath, JSON.stringify(entry) + '\n')
+    appendFileSync(logPath, JSON.stringify(entry) + '\n', { encoding: 'utf8', mode: 0o600 })
+    chmodSync(logPath, 0o600)
     console.log(`[session-log] Logged session ${entry.session_id} (${entry.end_reason}, ${entry.duration_minutes}m, ${entry.total_message_count} msgs)`)
     return true
   } catch (err) {

package/server/lib/telegram-notify.ts

@@ -13,7 +13,14 @@ interface TelegramConfig {
 
 let config: TelegramConfig | null = null
 
+export function telegramNotificationsEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  return env.COS_TELEGRAM_NOTIFICATIONS === '1'
+}
+
 function loadConfig(): TelegramConfig | null {
+  // A credential file is not consent to export conversation activity. Require
+  // the same kind of explicit opt-in used by cloud transcription fallback.
+  if (!telegramNotificationsEnabled()) return null
   if (config) return config
   if (!COS_SCRIPTS_DIR) return null
 

package/server/routes/openai-key.ts

@@ -15,11 +15,12 @@
 // of pretending the saved value is in use.
 
 import { Router } from 'express'
-import { existsSync, mkdirSync, unlinkSync } from 'node:fs'
+import { existsSync, unlinkSync } from 'node:fs'
 import { dirname } from 'node:path'
 import { errMsg } from '../lib/utils.js'
-import { atomicWriteFileSync } from '../lib/atomic-fs.js'
+import { durableAtomicWriteFileSync } from '../lib/atomic-fs.js'
 import { KEY_FILE_PATH, clearCachedKey, getKeyStatus } from '../lib/openai-key.js'
+import { securePrivateDirectory } from '../lib/secure-user-config.js'
 
 export const openaiKeyRouter = Router()
 
@@ -79,9 +80,9 @@ openaiKeyRouter.post('/openai-key/set', async (req, res) => {
     // Ensure parent dir exists (server/data/ is gitignored but may not exist
     // on a fresh checkout that's never run a budget write).
     const parent = dirname(KEY_FILE_PATH)
-    if (!existsSync(parent)) mkdirSync(parent, { recursive: true })
+    securePrivateDirectory(parent)
 
-    atomicWriteFileSync(KEY_FILE_PATH, payload)
+    durableAtomicWriteFileSync(KEY_FILE_PATH, payload, { mode: 0o600 })
     clearCachedKey()
 
     const status = getKeyStatus()