@launchfile/macos-dev 0.9.0 → 0.11.0

package/dist/state.js

@@ -4,10 +4,36 @@
  * Persists secrets, ports, and resource state in .launchfile/state.json
  * so credentials and ports are stable across restarts.
  */
-import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { readFile, writeFile, mkdir, chmod } from "node:fs/promises";
 import { join } from "node:path";
 import { createHash } from "node:crypto";
 import { registerSecrets } from "./redact.js";
+/** The `db` use keys → index map `up` recorded on a resource: `db` from `dbIndex`, `db.<name>` from `namedDbIndexes`. */
+export function recordedDbIndexes(res) {
+    const indexes = {};
+    if (res.dbIndex !== undefined)
+        indexes.db = res.dbIndex;
+    for (const [name, index] of Object.entries(res.namedDbIndexes ?? {})) {
+        indexes[`db.${name}`] = index;
+    }
+    return indexes;
+}
+/** `res` with the allocated `db` indexes recorded — the inverse of {@link recordedDbIndexes}. Records nothing for an empty allocation. */
+export function withRecordedDbIndexes(res, indexes) {
+    const named = {};
+    let dbIndex;
+    for (const [key, index] of Object.entries(indexes)) {
+        if (key === "db")
+            dbIndex = index;
+        else
+            named[key.slice("db.".length)] = index;
+    }
+    return {
+        ...res,
+        ...(dbIndex !== undefined ? { dbIndex } : {}),
+        ...(Object.keys(named).length > 0 ? { namedDbIndexes: named } : {}),
+    };
+}
 const STATE_DIR = ".launchfile";
 const STATE_FILE = "state.json";
 function stateDir(projectDir) {
@@ -64,8 +90,15 @@ export async function saveState(projectDir, state) {
 /** Ensure .launchfile directories exist */
 export async function ensureDirs(projectDir) {
     const dirs = ["storage", "tmp", "logs", "data", "env"];
-    // Security: restrict permissions — these dirs contain secrets, logs, env files
-    await Promise.all(dirs.map((d) => mkdir(join(projectDir, STATE_DIR, d), { recursive: true, mode: 0o700 })));
+    // Security: these dirs hold secrets, logs, and env files. mkdir applies the
+    // mode only when it creates the directory, so chmod unconditionally — a dir
+    // left by an earlier version or a looser umask must not stay world-readable
+    // (CWE-276). Mirrors packages/launchfile/src/state/errors.ts.
+    await Promise.all(dirs.map(async (d) => {
+        const dir = join(projectDir, STATE_DIR, d);
+        await mkdir(dir, { recursive: true, mode: 0o700 });
+        await chmod(dir, 0o700);
+    }));
     // Safety net: write a .gitignore inside .launchfile/ so secrets aren't
     // accidentally committed even if the project's .gitignore doesn't exclude it.
     await writeFile(join(projectDir, STATE_DIR, ".gitignore"), "*\n", { mode: 0o644 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@launchfile/macos-dev",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "macOS dev provider for Launchfile — run apps locally via brew services and native runtimes",
   "os": [
     "darwin"
@@ -36,7 +36,7 @@
     "directory": "providers/macos-dev"
   },
   "dependencies": {
-    "@launchfile/sdk": "^0.9.0",
+    "@launchfile/sdk": "^0.11.0",
     "semver": "^7.7.4"
   },
   "devDependencies": {