@gotcos/glasses-server 6.12.3 → 6.12.5

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## 6.12.5
+
+Extends the file-permission hardening to the remaining append-only logs that
+the launch review named.
+
+- **Run ledgers and the token-audit log are private at the file level.** The
+  Claude and Codex run ledgers and the token-audit JSONL now create with mode
+  0600 and repair existing files with chmod, matching the session-log and
+  atomic-fs writers. They already sat under the 0700 data directory; this
+  closes the file-level bit for defense in depth and covers the token-audit log
+  specifically, which lives beside the data directory rather than inside it.
+
+## 6.12.4
+
+Completes the public launch security review with a constant-time token check.
+
+- **API tokens compare in constant time.** The `/api` middleware and the
+  OpenAI-compatible `/v1/chat/completions` Bearer check no longer use a plain
+  `!==` string compare, which short-circuits on the first differing byte and
+  leaks token bytes through response timing. Both now hash each side to a fixed
+  SHA-256 digest and compare with `crypto.timingSafeEqual`. Missing headers,
+  duplicated headers, and length-mismatched tokens fail closed without throwing.
+  A new `token-auth` test pins the behavior. 401 responses are otherwise
+  unchanged.
+
 ## 6.12.3
 
 Security hardening from the public launch review, without changing app/server

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.12.3",
+  "version": "6.12.5",
   "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by your local Claude Code or Codex CLI",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -57,6 +57,7 @@ import {
   isAllowedNetworkOrigin,
   isTailscaleIpv4,
 } from './lib/network-policy.js'
+import { timingSafeTokenEqual } from './lib/token-auth.js'
 
 const app = express()
 const PORT = parseInt(process.env.PORT ?? '3141', 10)
@@ -128,7 +129,7 @@ app.use('/api', (req, res, next) => {
     req.path === '/diag/client' ||
     req.path === '/diag/health'
   ) return next()
-  if (req.headers['x-cos-token'] !== API_TOKEN) {
+  if (!timingSafeTokenEqual(req.headers['x-cos-token'], API_TOKEN)) {
     return res.status(401).json({ error: 'unauthorized' })
   }
   next()

package/server/lib/claude-run-ledger.ts

@@ -1,5 +1,5 @@
 import crypto from 'node:crypto'
-import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs'
+import { appendFileSync, chmodSync, existsSync, mkdirSync, readFileSync } from 'node:fs'
 import { dirname, resolve } from 'node:path'
 import { COS_SCRIPTS_DIR } from './python-bridge.js'
 import { dataPath } from './data-dir.js'
@@ -118,7 +118,8 @@ function appendEvent(event: ClaudeRunEvent): void {
   try {
     const path = getClaudeLedgerPath()
     mkdirSync(dirname(path), { recursive: true })
-    appendFileSync(path, JSON.stringify(event) + '\n')
+    appendFileSync(path, JSON.stringify(event) + '\n', { encoding: 'utf8', mode: 0o600 })
+    chmodSync(path, 0o600)
   } catch (err) {
     console.warn('[claude-run-ledger] write skipped:', err)
   }

package/server/lib/codex-run-ledger.ts

@@ -1,5 +1,5 @@
 import crypto from 'node:crypto'
-import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs'
+import { appendFileSync, chmodSync, existsSync, mkdirSync, readFileSync } from 'node:fs'
 import { dirname, resolve } from 'node:path'
 import { COS_SCRIPTS_DIR } from './python-bridge.js'
 import { cosBrainDir } from './launch-dir.js'
@@ -140,7 +140,8 @@ function appendEvent(event: CodexRunEvent): void {
   try {
     const path = getCodexLedgerPath()
     mkdirSync(dirname(path), { recursive: true })
-    appendFileSync(path, JSON.stringify(event) + '\n')
+    appendFileSync(path, JSON.stringify(event) + '\n', { encoding: 'utf8', mode: 0o600 })
+    chmodSync(path, 0o600)
   } catch (err) {
     console.warn('[codex-run-ledger] write skipped:', err)
   }

package/server/lib/token-audit.ts

@@ -2,7 +2,7 @@
 // Both Python (COS scripts) and TypeScript (G2 glasses) write to the same JSONL.
 // No LLM calls. Pure file append.
 
-import { appendFileSync } from 'node:fs'
+import { appendFileSync, chmodSync } from 'node:fs'
 import { resolve } from 'node:path'
 import { homedir } from 'node:os'
 
@@ -43,7 +43,8 @@ export function logTokenAudit(entry: TokenAuditEntry): void {
     caller: entry.caller,
   }
   try {
-    appendFileSync(AUDIT_FILE, JSON.stringify(record) + '\n')
+    appendFileSync(AUDIT_FILE, JSON.stringify(record) + '\n', { encoding: 'utf8', mode: 0o600 })
+    chmodSync(AUDIT_FILE, 0o600)
   } catch {
     // Never let logging break the actual call
   }

package/server/lib/token-auth.ts

@@ -0,0 +1,26 @@
+// Constant-time API-token comparison for the public server.
+
+import { createHash, timingSafeEqual } from 'node:crypto'
+
+/**
+ * Compare a client-supplied API token against the expected token without
+ * leaking token bytes through response timing.
+ *
+ * A plain `provided !== expected` string compare short-circuits at the first
+ * differing byte, so an attacker measuring response latency can recover the
+ * token one byte at a time. Hashing both sides to a fixed 32-byte SHA-256
+ * digest before `timingSafeEqual` keeps the comparison constant time
+ * regardless of input length, and avoids `timingSafeEqual` throwing on
+ * length-mismatched buffers.
+ *
+ * Non-string input (missing header, duplicated header parsed as an array) and
+ * an empty expected token never match.
+ */
+export function timingSafeTokenEqual(provided: unknown, expected: string): boolean {
+  if (typeof provided !== 'string' || typeof expected !== 'string' || expected.length === 0) {
+    return false
+  }
+  const a = createHash('sha256').update(provided).digest()
+  const b = createHash('sha256').update(expected).digest()
+  return timingSafeEqual(a, b)
+}

package/server/routes/openai-compat.ts

@@ -13,6 +13,7 @@ import {
 } from '../lib/codex-model-catalog.js'
 import { tryInstantResponse } from '../lib/response-cache.js'
 import crypto from 'node:crypto'
+import { timingSafeTokenEqual } from '../lib/token-auth.js'
 
 export const openaiCompatRouter = Router()
 
@@ -66,7 +67,7 @@ function validateAuth(req: any, res: any): boolean {
   }
 
   const token = auth.slice(7)
-  if (token !== cosToken) {
+  if (!timingSafeTokenEqual(token, cosToken)) {
     res.status(401).json({ error: { message: 'Invalid token', type: 'invalid_request_error' } })
     return false
   }