@kendoo.agentdesk/agentdesk 0.6.5 → 0.6.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/cli/login.mjs +5 -5
  2. package/package.json +1 -1
package/cli/login.mjs CHANGED
@@ -104,8 +104,8 @@ export async function runLogin() {
104
104
 
105
105
  if (apiKey) {
106
106
  // Save credentials
107
- if (!existsSync(CONFIG_DIR)) mkdirSync(CONFIG_DIR, { recursive: true });
108
- writeFileSync(CREDENTIALS_PATH, JSON.stringify({ apiKey, name, savedAt: Date.now() }, null, 2));
107
+ if (!existsSync(CONFIG_DIR)) mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
108
+ writeFileSync(CREDENTIALS_PATH, JSON.stringify({ apiKey, name, savedAt: Date.now() }, null, 2), { mode: 0o600 });
109
109
 
110
110
  res.writeHead(200, { "Content-Type": "text/html" });
111
111
  res.end(`<html><body style="background:#0f172a;color:#e2e8f0;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0"><div style="text-align:center"><h2 style="color:#2dd4bf">Logged in to AgentDesk</h2><p>You can close this tab and return to your terminal.</p></div></body></html>`);
@@ -145,11 +145,11 @@ export async function runLogin() {
145
145
  console.log("");
146
146
  console.log(" Waiting for authentication...");
147
147
 
148
- // Open browser
149
- const { exec } = await import("child_process");
148
+ // Open browser (use execFile to avoid shell injection)
149
+ const { execFile } = await import("child_process");
150
150
  const platform = process.platform;
151
151
  const cmd = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open";
152
- exec(`${cmd} "${loginUrl}"`);
152
+ execFile(cmd, [loginUrl], () => {});
153
153
 
154
154
  // Timeout after 5 minutes
155
155
  setTimeout(() => {
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@kendoo.agentdesk/agentdesk",
3
- "version": "0.6.5",
3
+ "version": "0.6.6",
4
4
  "description": "AI team orchestrator for Claude Code — run collaborative agent sessions from your terminal",
5
5
  "type": "module",
6
6
  "bin": {