@gotcos/glasses-server 6.12.2 → 6.12.4

package/.env.example

@@ -55,6 +55,12 @@ BIND_HOST=0.0.0.0
 #
 # Codex remains read-only by default. This is the only broader trust opt-in:
 # COS_CODEX_SANDBOX=workspace-write
+#
+# Claude preserves COS's established trusted-machine behavior by default.
+# Security-conscious installs can remove the permission bypass and restrict
+# Claude to COS's explicit per-query tool allowlist. Undeclared tools fail
+# closed without an interactive prompt:
+# COS_CLAUDE_TRUST_MODE=allowlist
 
 # ── VOICE (optional) ────────────────────────────────────────────────────
 # Local transcription is FREE via whisper.cpp (brew install whisper-cpp; the
@@ -68,3 +74,7 @@ BIND_HOST=0.0.0.0
 # Power users running the COS Starter Kit can point the glasses at their
 # pipeline to inherit live tasks/calendar/people context. Omit for standalone.
 # COS_SCRIPTS_DIR=/path/to/your/cos/operations/scripts
+
+# Telegram session/activity notifications remain OFF even if the COS scripts
+# directory contains .telegram_config.json. Enable export explicitly:
+# COS_TELEGRAM_NOTIFICATIONS=1

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # Changelog
 
+## 6.12.4
+
+Completes the public launch security review with a constant-time token check.
+
+- **API tokens compare in constant time.** The `/api` middleware and the
+  OpenAI-compatible `/v1/chat/completions` Bearer check no longer use a plain
+  `!==` string compare, which short-circuits on the first differing byte and
+  leaks token bytes through response timing. Both now hash each side to a fixed
+  SHA-256 digest and compare with `crypto.timingSafeEqual`. Missing headers,
+  duplicated headers, and length-mismatched tokens fail closed without throwing.
+  A new `token-auth` test pins the behavior. 401 responses are otherwise
+  unchanged.
+
+## 6.12.3
+
+Security hardening from the public launch review, without changing app/server
+wire contracts.
+
+- **Stored prompts never enter a shell command.** Archive title generation now
+  launches Claude with an argument array and sends user content over stdin. A
+  regression test proves command substitutions and backticks remain inert.
+- **Claude can run in a real allowlist mode.** Existing installs retain trusted
+  mode for backward compatibility. Setting `COS_CLAUDE_TRUST_MODE=allowlist`
+  removes the permission bypass, restricts Claude to COS's explicit per-query
+  tools, and denies undeclared tools without an interactive prompt.
+- **Tailscale matching is exact.** Network and CORS policy now accept only the
+  assigned `100.64.0.0/10` CGNAT range rather than every `100.x` address.
+  Localhost and RFC1918 LAN access remain unchanged.
+- **Durable local state is private.** Runtime data and archive directories are
+  repaired to `0700`; atomic state, conversation archives, session logs, and
+  the saved OpenAI key are created or repaired to `0600`. Credential writes use
+  private, exclusive, fsync-backed atomic publication.
+- **Telegram export requires consent.** Merely finding a private
+  `.telegram_config.json` no longer enables activity export. Operators must set
+  the exact `COS_TELEGRAM_NOTIFICATIONS=1` opt-in.
+- **Canonical history remains exact.** Operational previews and provider
+  ledgers keep their existing redaction, while durable prompts/answers are not
+  silently mutated; recovery, retries, and `reference message N` remain intact.
+- **Backward compatible.** Query, prompt recovery, meetings, media, display,
+  diagnostics, transcription, and protocol response shapes are unchanged.
+
 ## 6.12.2
 
 First-install hardening for public `npx` users.

package/README.md

@@ -43,6 +43,10 @@ without silently losing completed replies.
 > Existing `COS_CODEX_MODEL` / `COS_CODEX_REASONING_EFFORT` settings remain
 > supported on the migrated Frontier slot; leave them blank for auto-latest.
 > Codex runs **sandboxed read-only** by default (`COS_CODEX_SANDBOX` to adjust).
+> Claude preserves the established trusted-machine mode for compatibility.
+> Set `COS_CLAUDE_TRUST_MODE=allowlist` to remove Claude's permission bypass
+> and restrict it to COS's explicit per-query tool allowlist; undeclared tools
+> then fail closed without prompting.
 
 ## Connect your phone (the one gotcha)
 
@@ -54,7 +58,9 @@ The glasses app runs on your iPhone and must reach this server on your Mac.
 4. Either way, paste the **API token** the server printed at boot.
 
 To restrict the server to localhost only, set `BIND_HOST=127.0.0.1` in `~/.cos-glasses/.env`.
-The built-in IP allowlist blocks public-internet traffic regardless.
+The built-in IP allowlist blocks public-internet traffic regardless. Its mesh
+range is the exact Tailscale/CGNAT allocation (`100.64.0.0/10`), not all of
+`100.0.0.0/8`; RFC1918 LAN ranges remain supported.
 
 ## What it does
 
@@ -97,6 +103,9 @@ optional except an installed CLI. Highlights: `BIND_HOST`, `PORT`,
 server-owned query recovery), and `COS_MEDIA_ROOT` (optional image-store
 location; default `~/.cos-glasses/data/media`). Your name + transcription vocabulary live in
 `~/.cos-glasses/.cos-profile.json` (see `.cos-profile.example.json`).
+Telegram activity export is disabled by default even when a private COS
+pipeline contains `.telegram_config.json`; enable it only with the explicit
+`COS_TELEGRAM_NOTIFICATIONS=1` opt-in.
 
 ## Run from source
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.12.2",
+  "version": "6.12.4",
   "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by your local Claude Code or Codex CLI",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -52,6 +52,12 @@ import {
   queryJobCoordinator,
   shutdownQueryJobRuntime,
 } from './lib/query-job-runtime.js'
+import {
+  isAllowedNetworkIp,
+  isAllowedNetworkOrigin,
+  isTailscaleIpv4,
+} from './lib/network-policy.js'
+import { timingSafeTokenEqual } from './lib/token-auth.js'
 
 const app = express()
 const PORT = parseInt(process.env.PORT ?? '3141', 10)
@@ -94,15 +100,7 @@ if (API_TOKEN_AUTO) {
 // local + meshnet (Tailscale/CGNAT) + LAN consumers working.
 app.use((req, res, next) => {
   const ip = req.ip || req.socket.remoteAddress || ''
-  // Normalize IPv6-mapped IPv4 (::ffff:127.0.0.1 → 127.0.0.1)
-  const cleanIp = ip.replace(/^::ffff:/, '')
-  const allowed =
-    cleanIp === '127.0.0.1' || cleanIp === '::1' ||               // localhost
-    /^100\./.test(cleanIp) ||                                       // meshnet (CGNAT)
-    /^10\./.test(cleanIp) ||                                        // private 10.x
-    /^172\.(1[6-9]|2\d|3[01])\./.test(cleanIp) ||                  // private 172.16-31.x
-    /^192\.168\./.test(cleanIp)                                     // private 192.168.x
-  if (!allowed) {
+  if (!isAllowedNetworkIp(ip)) {
     res.status(403).json({ error: 'forbidden — not on allowed network' })
     return
   }
@@ -114,10 +112,7 @@ app.use(cors({
   origin: (origin, cb) => {
     // Allow requests with no origin (same-origin, curl, SSE) or "null" origin (file:// WebViews like Even Hub)
     if (!origin || origin === 'null') return cb(null, true)
-    // Allow localhost variants
-    if (/^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(origin)) return cb(null, true)
-    // Allow private network IPs (10.x.x.x, 172.16-31.x.x, 192.168.x.x, 100.x.x.x for Meshnet/CGNAT)
-    if (/^https?:\/\/(10|172\.(1[6-9]|2\d|3[01])|192\.168|100)(\.\d+){2,3}(:\d+)?$/.test(origin)) return cb(null, true)
+    if (isAllowedNetworkOrigin(origin)) return cb(null, true)
     cb(new Error('CORS blocked'))
   },
 }))
@@ -134,7 +129,7 @@ app.use('/api', (req, res, next) => {
     req.path === '/diag/client' ||
     req.path === '/diag/health'
   ) return next()
-  if (req.headers['x-cos-token'] !== API_TOKEN) {
+  if (!timingSafeTokenEqual(req.headers['x-cos-token'], API_TOKEN)) {
     return res.status(401).json({ error: 'unauthorized' })
   }
   next()
@@ -274,7 +269,7 @@ listenRequiredServers(listeners).then(() => {
     for (const [name, infos] of Object.entries(nets)) {
       for (const info of infos ?? []) {
         if (info.family !== 'IPv4' || info.internal) continue
-        const isTailscale = info.address.startsWith('100.') || name.startsWith('utun') || name.startsWith('tailscale')
+        const isTailscale = isTailscaleIpv4(info.address) || name.startsWith('tailscale')
         addrs.push({ ip: info.address, label: isTailscale ? 'Tailscale — works from anywhere' : `${name} — same Wi-Fi only` })
       }
     }

package/server/lib/archive.ts

@@ -3,17 +3,16 @@
 // Each day's archive contains one or more "chats" (split by context breaks)
 // Summaries are generated via `claude -p --model sonnet`, budget-capped per day.
 
-import { mkdirSync, readdirSync } from 'node:fs'
+import { chmodSync, mkdirSync, readdirSync } from 'node:fs'
 import { resolve, dirname } from 'node:path'
 import { fileURLToPath } from 'node:url'
-import { exec } from 'node:child_process'
-import { promisify } from 'node:util'
+import { spawn } from 'node:child_process'
 import { logTokenAudit } from './token-audit.js'
 import { atomicWriteFileSync, loadJsonOrQuarantine } from './atomic-fs.js'
 import { consumeArchiveLLMBudget } from './archive-budget.js'
 import { mergeMediaAttachmentRefs, type MediaAttachmentRef } from '../../shared/media-attachment.js'
+import { secureExistingPrivateFile } from './secure-user-config.js'
 
-const execAsync = promisify(exec)
 import type { Exchange } from './conversation.js'
 
 import { dataPath } from './data-dir.js'
@@ -65,7 +64,8 @@ export interface SessionToArchive {
 // ── Directory management ────────────────────────────────────
 
 function ensureArchiveDir(): string {
-  mkdirSync(ARCHIVE_DIR, { recursive: true })
+  mkdirSync(ARCHIVE_DIR, { recursive: true, mode: 0o700 })
+  chmodSync(ARCHIVE_DIR, 0o700)
   return ARCHIVE_DIR
 }
 
@@ -76,7 +76,9 @@ function archivePath(date: string): string {
 // ── Read/Write ──────────────────────────────────────────────
 
 export function loadArchive(date: string): DailyArchive | null {
-  const result = loadJsonOrQuarantine<DailyArchive>(archivePath(date))
+  const path = archivePath(date)
+  secureExistingPrivateFile(path)
+  const result = loadJsonOrQuarantine<DailyArchive>(path)
   if (result.status === 'corrupt') {
     // Loud — a silent return masked archive corruption as "day unavailable"
     console.error(
@@ -178,6 +180,54 @@ function fallbackDaySummary(chats: ArchivedChat[]): string {
   return summaries.slice(0, 2).join(', ').slice(0, 60) || 'Day activity'
 }
 
+/**
+ * Run the archive summarizer without invoking a shell.
+ *
+ * The archived query text is user-controlled. It must travel over stdin, never
+ * through a command string, so shell metacharacters remain inert data.
+ */
+function runClaudeArchiveSummary(input: string, instruction: string): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const proc = spawn('claude', ['-p', '--model', 'sonnet', instruction], {
+      stdio: ['pipe', 'pipe', 'pipe'],
+    })
+
+    let stdout = ''
+    let stderr = ''
+    let settled = false
+
+    const finish = (error?: Error) => {
+      if (settled) return
+      settled = true
+      clearTimeout(timer)
+      if (error) reject(error)
+      else resolve(stdout)
+    }
+
+    const timer = setTimeout(() => {
+      proc.kill('SIGTERM')
+      finish(new Error('Archive summary timed out'))
+    }, 15_000)
+    timer.unref?.()
+
+    proc.stdout.on('data', (chunk: Buffer) => {
+      if (stdout.length < 16_384) stdout += chunk.toString().slice(0, 16_384 - stdout.length)
+    })
+    proc.stderr.on('data', (chunk: Buffer) => {
+      if (stderr.length < 4_096) stderr += chunk.toString().slice(0, 4_096 - stderr.length)
+    })
+    proc.on('error', error => finish(error))
+    proc.on('close', code => {
+      if (code === 0) finish()
+      else finish(new Error(`Archive summary exited ${code}: ${stderr.trim()}`))
+    })
+
+    // Ignore EPIPE here; the close/error handlers above own the final outcome.
+    proc.stdin.on('error', () => {})
+    proc.stdin.end(input)
+  })
+}
+
 /** Generate a <60 char summary for a single chat via claude -p.
  *  Budget-capped: if MAX_DAILY_ARCHIVE_LLM_CALLS is exhausted or `skipLLM` is
  *  passed, returns a deterministic string fallback. */
@@ -196,9 +246,9 @@ export async function generateChatSummary(exchanges: Exchange[], skipLLM = false
 
   const startMs = Date.now()
   try {
-    const { stdout } = await execAsync(
-      `echo ${JSON.stringify(userQueries)} | claude -p --model sonnet "Summarize these COS Glasses queries into a single title under 60 characters. Just the title, no quotes, no explanation."`,
-      { timeout: 15_000 }
+    const stdout = await runClaudeArchiveSummary(
+      userQueries,
+      'Summarize these COS Glasses queries into a single title under 60 characters. Just the title, no quotes, no explanation.',
     )
     const result = stdout.trim()
 
@@ -237,9 +287,9 @@ export async function generateDaySummary(chats: ArchivedChat[], skipLLM = false)
 
   const startMs = Date.now()
   try {
-    const { stdout } = await execAsync(
-      `echo ${JSON.stringify(allQueries)} | claude -p --model sonnet "Summarize these COS Glasses queries from one day into a daily title under 60 characters. Just the title, no quotes."`,
-      { timeout: 15_000 }
+    const stdout = await runClaudeArchiveSummary(
+      allQueries,
+      'Summarize these COS Glasses queries from one day into a daily title under 60 characters. Just the title, no quotes.',
     )
     const result = stdout.trim()
 

package/server/lib/atomic-fs.ts

@@ -9,6 +9,7 @@
 
 import {
   closeSync,
+  chmodSync,
   constants,
   existsSync,
   fchmodSync,
@@ -23,9 +24,12 @@ import { randomBytes } from 'node:crypto'
 import { basename, dirname, join } from 'node:path'
 
 export function atomicWriteFileSync(path: string, data: string | Buffer, options: { mode?: number } = {}): void {
+  const mode = options.mode ?? 0o600
   const tmp = `${path}.tmp`
-  writeFileSync(tmp, data, options.mode === undefined ? undefined : { mode: options.mode })
+  writeFileSync(tmp, data, { mode })
+  chmodSync(tmp, mode)
   renameSync(tmp, path)
+  chmodSync(path, mode)
 }
 
 /**

package/server/lib/claude-bridge.ts

@@ -48,6 +48,7 @@ import {
   type MediaAttachmentRef,
 } from '../../shared/media-attachment.js'
 import { terminalProviderAuthFailure } from './provider-terminal-error.js'
+import { claudePermissionArgs, getClaudeTrustMode } from './claude-permissions.js'
 
 // Inactivity = no stdout data for this long → kill (catches stalls)
 const INACTIVITY_BY_MODEL: Record<ClaudeModelPreference, number> = {
@@ -214,7 +215,7 @@ export async function preWarmCLI(): Promise<void> {
       '--effort', getClaudeEffortLevel(),
       '--output-format', 'stream-json',
       '--verbose',
-      '--dangerously-skip-permissions',
+      ...claudePermissionArgs(getClaudeTrustMode(), null),
       '--system-prompt', buildPrewarmSystemPrompt(),
     ], {
       stdio: ['pipe', 'pipe', 'pipe'],
@@ -493,20 +494,19 @@ export async function callClaudeStreaming(
     '--effort', cliEffortFlag,
     '--output-format', 'stream-json',
     '--verbose',  // Required: stream-json requires --verbose
-    '--dangerously-skip-permissions',  // Required: headless CLI mode with no TTY for user prompts
     '--system-prompt', systemPrompt,
   ]
 
   // Full COS path gets tools + partial messages; lightweight gets web search only
   if (options?.lightweight) {
     if (imagePaths.length > 0) {
-      args.push('--allowedTools', tools)
+      args.push(...claudePermissionArgs(getClaudeTrustMode(), tools))
     } else {
       // Lightweight: web search for general questions, no Bash/Read/Write (saves 5-10s)
-      args.push('--allowedTools', 'WebSearch,WebFetch')
+      args.push(...claudePermissionArgs(getClaudeTrustMode(), 'WebSearch,WebFetch'))
     }
   } else {
-    args.push('--allowedTools', tools, '--include-partial-messages')
+    args.push(...claudePermissionArgs(getClaudeTrustMode(), tools), '--include-partial-messages')
   }
 
   if (existingCliSession) {

package/server/lib/claude-permissions.ts

@@ -0,0 +1,40 @@
+export type ClaudeTrustMode = 'trusted' | 'allowlist'
+
+/**
+ * Claude Code historically ran COS in trusted mode so headless sessions could
+ * use the operator's existing tools without stopping for an interactive
+ * permission prompt. Keep that behavior for compatibility, while allowing
+ * security-conscious installs to opt into a strict, non-interactive allowlist.
+ */
+export function getClaudeTrustMode(
+  env: NodeJS.ProcessEnv = process.env,
+): ClaudeTrustMode {
+  return env.COS_CLAUDE_TRUST_MODE?.trim().toLowerCase() === 'allowlist'
+    ? 'allowlist'
+    : 'trusted'
+}
+
+/**
+ * Build only Claude's permission-related CLI arguments.
+ *
+ * - trusted: preserves the established COS behavior.
+ * - allowlist: denies undeclared tools without prompting and restricts the
+ *   available built-ins to the explicit per-query list.
+ */
+export function claudePermissionArgs(
+  mode: ClaudeTrustMode,
+  allowedTools: string | null,
+): string[] {
+  if (mode === 'trusted') {
+    return allowedTools === null
+      ? ['--dangerously-skip-permissions']
+      : ['--dangerously-skip-permissions', '--allowedTools', allowedTools]
+  }
+
+  const tools = allowedTools ?? ''
+  return [
+    '--permission-mode', 'dontAsk',
+    '--tools', tools,
+    '--allowedTools', tools,
+  ]
+}

package/server/lib/conversation.ts

@@ -14,6 +14,7 @@ import { atomicWriteFileSync, durableAtomicWriteFileSync, loadJsonOrQuarantine }
 import { localDay } from './local-day.js'
 import { normalizeModelPreference, type ModelPreference } from '../../shared/model-preference.js'
 import { parseMediaAttachmentRefs, type MediaAttachmentRef } from '../../shared/media-attachment.js'
+import { secureExistingPrivateFile } from './secure-user-config.js'
 
 export type { ModelPreference }
 
@@ -119,6 +120,7 @@ function matchesJobIdentity(exchange: Exchange, identity: ExchangeJobIdentity):
 }
 
 function loadFromDisk(): void {
+  secureExistingPrivateFile(SESSION_FILE)
   const result = loadJsonOrQuarantine<SessionsFile>(SESSION_FILE)
   if (result.status === 'missing') return // fresh start
 

package/server/lib/data-dir.ts

@@ -1,6 +1,6 @@
 import { homedir } from 'node:os'
 import { join, resolve } from 'node:path'
-import { mkdirSync } from 'node:fs'
+import { chmodSync, mkdirSync } from 'node:fs'
 
 // Runtime state directory. Defaults to ~/.cos-glasses/data — a writable location
 // that survives `npx` cache churn and works on global/Docker installs. (Writing
@@ -11,7 +11,8 @@ export const DATA_DIR = process.env.COS_DATA_DIR
   : join(homedir(), '.cos-glasses', 'data')
 
 try {
-  mkdirSync(DATA_DIR, { recursive: true })
+  mkdirSync(DATA_DIR, { recursive: true, mode: 0o700 })
+  chmodSync(DATA_DIR, 0o700)
 } catch { /* best effort — individual writers also tolerate a missing dir */ }
 
 /** Build a path under the runtime data directory. */

package/server/lib/network-policy.ts

@@ -0,0 +1,42 @@
+/** Network ranges accepted by the public server before API-token auth runs. */
+
+function parseIpv4(value: string): number[] | null {
+  const parts = value.split('.')
+  if (parts.length !== 4) return null
+  const octets = parts.map(part => Number(part))
+  if (octets.some((octet, index) => !/^\d{1,3}$/.test(parts[index]) || octet < 0 || octet > 255)) {
+    return null
+  }
+  return octets
+}
+
+export function normalizeRemoteIp(value: string): string {
+  return value.replace(/^::ffff:/, '')
+}
+
+export function isTailscaleIpv4(value: string): boolean {
+  const octets = parseIpv4(normalizeRemoteIp(value))
+  return !!octets && octets[0] === 100 && octets[1] >= 64 && octets[1] <= 127
+}
+
+export function isAllowedNetworkIp(value: string): boolean {
+  const clean = normalizeRemoteIp(value)
+  if (clean === '127.0.0.1' || clean === '::1') return true
+  if (isTailscaleIpv4(clean)) return true
+
+  const octets = parseIpv4(clean)
+  if (!octets) return false
+  return octets[0] === 10 ||
+    (octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31) ||
+    (octets[0] === 192 && octets[1] === 168)
+}
+
+export function isAllowedNetworkOrigin(origin: string): boolean {
+  try {
+    const url = new URL(origin)
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') return false
+    return url.hostname === 'localhost' || isAllowedNetworkIp(url.hostname)
+  } catch {
+    return false
+  }
+}

package/server/lib/openai-key.ts

@@ -20,6 +20,7 @@ import { existsSync, readFileSync } from 'node:fs'
 import { dirname, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { COS_SCRIPTS_DIR } from './python-bridge.js'
+import { secureExistingPrivateFile } from './secure-user-config.js'
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
 
@@ -61,6 +62,7 @@ export function clearCachedKey(): void {
 function readConfigFile(): KeyConfigFile | null {
   if (!existsSync(KEY_FILE_PATH)) return null
   try {
+    secureExistingPrivateFile(KEY_FILE_PATH)
     const raw = readFileSync(KEY_FILE_PATH, 'utf-8')
     const parsed = JSON.parse(raw) as Partial<KeyConfigFile>
     if (!parsed || typeof parsed.key !== 'string' || !parsed.key.trim()) return null

package/server/lib/session-log.ts

@@ -2,7 +2,7 @@
 // so COS can query Glasses sessions by original UUID, date, domain, or content.
 // Fires on: TTL expiry, explicit /api/sessions/:id/end, server shutdown.
 
-import { appendFileSync, mkdirSync } from 'node:fs'
+import { appendFileSync, chmodSync, mkdirSync } from 'node:fs'
 import { resolve, dirname } from 'node:path'
 import type { Exchange } from './conversation.js'
 
@@ -143,7 +143,8 @@ export function writeSessionLog(entry: SessionLogEntry): boolean {
 
   try {
     mkdirSync(dirname(logPath), { recursive: true })
-    appendFileSync(logPath, JSON.stringify(entry) + '\n')
+    appendFileSync(logPath, JSON.stringify(entry) + '\n', { encoding: 'utf8', mode: 0o600 })
+    chmodSync(logPath, 0o600)
     console.log(`[session-log] Logged session ${entry.session_id} (${entry.end_reason}, ${entry.duration_minutes}m, ${entry.total_message_count} msgs)`)
     return true
   } catch (err) {

package/server/lib/telegram-notify.ts

@@ -13,7 +13,14 @@ interface TelegramConfig {
 
 let config: TelegramConfig | null = null
 
+export function telegramNotificationsEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  return env.COS_TELEGRAM_NOTIFICATIONS === '1'
+}
+
 function loadConfig(): TelegramConfig | null {
+  // A credential file is not consent to export conversation activity. Require
+  // the same kind of explicit opt-in used by cloud transcription fallback.
+  if (!telegramNotificationsEnabled()) return null
   if (config) return config
   if (!COS_SCRIPTS_DIR) return null
 

package/server/lib/token-auth.ts

@@ -0,0 +1,26 @@
+// Constant-time API-token comparison for the public server.
+
+import { createHash, timingSafeEqual } from 'node:crypto'
+
+/**
+ * Compare a client-supplied API token against the expected token without
+ * leaking token bytes through response timing.
+ *
+ * A plain `provided !== expected` string compare short-circuits at the first
+ * differing byte, so an attacker measuring response latency can recover the
+ * token one byte at a time. Hashing both sides to a fixed 32-byte SHA-256
+ * digest before `timingSafeEqual` keeps the comparison constant time
+ * regardless of input length, and avoids `timingSafeEqual` throwing on
+ * length-mismatched buffers.
+ *
+ * Non-string input (missing header, duplicated header parsed as an array) and
+ * an empty expected token never match.
+ */
+export function timingSafeTokenEqual(provided: unknown, expected: string): boolean {
+  if (typeof provided !== 'string' || typeof expected !== 'string' || expected.length === 0) {
+    return false
+  }
+  const a = createHash('sha256').update(provided).digest()
+  const b = createHash('sha256').update(expected).digest()
+  return timingSafeEqual(a, b)
+}

package/server/routes/openai-compat.ts

@@ -13,6 +13,7 @@ import {
 } from '../lib/codex-model-catalog.js'
 import { tryInstantResponse } from '../lib/response-cache.js'
 import crypto from 'node:crypto'
+import { timingSafeTokenEqual } from '../lib/token-auth.js'
 
 export const openaiCompatRouter = Router()
 
@@ -66,7 +67,7 @@ function validateAuth(req: any, res: any): boolean {
   }
 
   const token = auth.slice(7)
-  if (token !== cosToken) {
+  if (!timingSafeTokenEqual(token, cosToken)) {
     res.status(401).json({ error: { message: 'Invalid token', type: 'invalid_request_error' } })
     return false
   }

package/server/routes/openai-key.ts

@@ -15,11 +15,12 @@
 // of pretending the saved value is in use.
 
 import { Router } from 'express'
-import { existsSync, mkdirSync, unlinkSync } from 'node:fs'
+import { existsSync, unlinkSync } from 'node:fs'
 import { dirname } from 'node:path'
 import { errMsg } from '../lib/utils.js'
-import { atomicWriteFileSync } from '../lib/atomic-fs.js'
+import { durableAtomicWriteFileSync } from '../lib/atomic-fs.js'
 import { KEY_FILE_PATH, clearCachedKey, getKeyStatus } from '../lib/openai-key.js'
+import { securePrivateDirectory } from '../lib/secure-user-config.js'
 
 export const openaiKeyRouter = Router()
 
@@ -79,9 +80,9 @@ openaiKeyRouter.post('/openai-key/set', async (req, res) => {
     // Ensure parent dir exists (server/data/ is gitignored but may not exist
     // on a fresh checkout that's never run a budget write).
     const parent = dirname(KEY_FILE_PATH)
-    if (!existsSync(parent)) mkdirSync(parent, { recursive: true })
+    securePrivateDirectory(parent)
 
-    atomicWriteFileSync(KEY_FILE_PATH, payload)
+    durableAtomicWriteFileSync(KEY_FILE_PATH, payload, { mode: 0o600 })
     clearCachedKey()
 
     const status = getKeyStatus()