@pan-sec/notebooklm-mcp 1.4.0 → 1.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (123) hide show
  1. package/README.md +61 -7
  2. package/SECURITY.md +40 -6
  3. package/dist/auth/mcp-auth.d.ts.map +1 -1
  4. package/dist/auth/mcp-auth.js +3 -6
  5. package/dist/auth/mcp-auth.js.map +1 -1
  6. package/dist/compliance/alert-manager.d.ts +120 -0
  7. package/dist/compliance/alert-manager.d.ts.map +1 -0
  8. package/dist/compliance/alert-manager.js +420 -0
  9. package/dist/compliance/alert-manager.js.map +1 -0
  10. package/dist/compliance/breach-detection.d.ts +134 -0
  11. package/dist/compliance/breach-detection.d.ts.map +1 -0
  12. package/dist/compliance/breach-detection.js +456 -0
  13. package/dist/compliance/breach-detection.js.map +1 -0
  14. package/dist/compliance/change-log.d.ts +113 -0
  15. package/dist/compliance/change-log.d.ts.map +1 -0
  16. package/dist/compliance/change-log.js +275 -0
  17. package/dist/compliance/change-log.js.map +1 -0
  18. package/dist/compliance/compliance-logger.d.ts +136 -0
  19. package/dist/compliance/compliance-logger.d.ts.map +1 -0
  20. package/dist/compliance/compliance-logger.js +425 -0
  21. package/dist/compliance/compliance-logger.js.map +1 -0
  22. package/dist/compliance/compliance-tools.d.ts +18 -0
  23. package/dist/compliance/compliance-tools.d.ts.map +1 -0
  24. package/dist/compliance/compliance-tools.js +673 -0
  25. package/dist/compliance/compliance-tools.js.map +1 -0
  26. package/dist/compliance/consent-manager.d.ts +130 -0
  27. package/dist/compliance/consent-manager.d.ts.map +1 -0
  28. package/dist/compliance/consent-manager.js +386 -0
  29. package/dist/compliance/consent-manager.js.map +1 -0
  30. package/dist/compliance/dashboard.d.ts +243 -0
  31. package/dist/compliance/dashboard.d.ts.map +1 -0
  32. package/dist/compliance/dashboard.js +519 -0
  33. package/dist/compliance/dashboard.js.map +1 -0
  34. package/dist/compliance/data-classification.d.ts +117 -0
  35. package/dist/compliance/data-classification.d.ts.map +1 -0
  36. package/dist/compliance/data-classification.js +469 -0
  37. package/dist/compliance/data-classification.js.map +1 -0
  38. package/dist/compliance/data-erasure.d.ts +110 -0
  39. package/dist/compliance/data-erasure.d.ts.map +1 -0
  40. package/dist/compliance/data-erasure.js +501 -0
  41. package/dist/compliance/data-erasure.js.map +1 -0
  42. package/dist/compliance/data-export.d.ts +85 -0
  43. package/dist/compliance/data-export.d.ts.map +1 -0
  44. package/dist/compliance/data-export.js +394 -0
  45. package/dist/compliance/data-export.js.map +1 -0
  46. package/dist/compliance/data-inventory.d.ts +136 -0
  47. package/dist/compliance/data-inventory.d.ts.map +1 -0
  48. package/dist/compliance/data-inventory.js +335 -0
  49. package/dist/compliance/data-inventory.js.map +1 -0
  50. package/dist/compliance/dsar-handler.d.ts +123 -0
  51. package/dist/compliance/dsar-handler.d.ts.map +1 -0
  52. package/dist/compliance/dsar-handler.js +371 -0
  53. package/dist/compliance/dsar-handler.js.map +1 -0
  54. package/dist/compliance/evidence-collector.d.ts +187 -0
  55. package/dist/compliance/evidence-collector.d.ts.map +1 -0
  56. package/dist/compliance/evidence-collector.js +656 -0
  57. package/dist/compliance/evidence-collector.js.map +1 -0
  58. package/dist/compliance/health-monitor.d.ts +111 -0
  59. package/dist/compliance/health-monitor.d.ts.map +1 -0
  60. package/dist/compliance/health-monitor.js +509 -0
  61. package/dist/compliance/health-monitor.js.map +1 -0
  62. package/dist/compliance/incident-manager.d.ts +131 -0
  63. package/dist/compliance/incident-manager.d.ts.map +1 -0
  64. package/dist/compliance/incident-manager.js +418 -0
  65. package/dist/compliance/incident-manager.js.map +1 -0
  66. package/dist/compliance/index.d.ts +32 -0
  67. package/dist/compliance/index.d.ts.map +1 -0
  68. package/dist/compliance/index.js +35 -0
  69. package/dist/compliance/index.js.map +1 -0
  70. package/dist/compliance/policy-docs.d.ts +108 -0
  71. package/dist/compliance/policy-docs.d.ts.map +1 -0
  72. package/dist/compliance/policy-docs.js +464 -0
  73. package/dist/compliance/policy-docs.js.map +1 -0
  74. package/dist/compliance/privacy-notice-text.d.ts +58 -0
  75. package/dist/compliance/privacy-notice-text.d.ts.map +1 -0
  76. package/dist/compliance/privacy-notice-text.js +161 -0
  77. package/dist/compliance/privacy-notice-text.js.map +1 -0
  78. package/dist/compliance/privacy-notice.d.ts +128 -0
  79. package/dist/compliance/privacy-notice.d.ts.map +1 -0
  80. package/dist/compliance/privacy-notice.js +250 -0
  81. package/dist/compliance/privacy-notice.js.map +1 -0
  82. package/dist/compliance/report-generator.d.ts +168 -0
  83. package/dist/compliance/report-generator.d.ts.map +1 -0
  84. package/dist/compliance/report-generator.js +830 -0
  85. package/dist/compliance/report-generator.js.map +1 -0
  86. package/dist/compliance/retention-engine.d.ts +130 -0
  87. package/dist/compliance/retention-engine.d.ts.map +1 -0
  88. package/dist/compliance/retention-engine.js +510 -0
  89. package/dist/compliance/retention-engine.js.map +1 -0
  90. package/dist/compliance/siem-exporter.d.ts +150 -0
  91. package/dist/compliance/siem-exporter.d.ts.map +1 -0
  92. package/dist/compliance/siem-exporter.js +509 -0
  93. package/dist/compliance/siem-exporter.js.map +1 -0
  94. package/dist/compliance/types.d.ts +601 -0
  95. package/dist/compliance/types.d.ts.map +1 -0
  96. package/dist/compliance/types.js +22 -0
  97. package/dist/compliance/types.js.map +1 -0
  98. package/dist/config.d.ts +4 -0
  99. package/dist/config.d.ts.map +1 -1
  100. package/dist/config.js +8 -1
  101. package/dist/config.js.map +1 -1
  102. package/dist/library/notebook-library.d.ts.map +1 -1
  103. package/dist/library/notebook-library.js +2 -1
  104. package/dist/library/notebook-library.js.map +1 -1
  105. package/dist/session/shared-context-manager.d.ts.map +1 -1
  106. package/dist/session/shared-context-manager.js +2 -1
  107. package/dist/session/shared-context-manager.js.map +1 -1
  108. package/dist/utils/audit-logger.d.ts +21 -1
  109. package/dist/utils/audit-logger.d.ts.map +1 -1
  110. package/dist/utils/audit-logger.js +53 -4
  111. package/dist/utils/audit-logger.js.map +1 -1
  112. package/dist/utils/crypto.d.ts.map +1 -1
  113. package/dist/utils/crypto.js +8 -15
  114. package/dist/utils/crypto.js.map +1 -1
  115. package/dist/utils/file-permissions.d.ts +85 -0
  116. package/dist/utils/file-permissions.d.ts.map +1 -0
  117. package/dist/utils/file-permissions.js +180 -0
  118. package/dist/utils/file-permissions.js.map +1 -0
  119. package/dist/utils/settings-manager.d.ts.map +1 -1
  120. package/dist/utils/settings-manager.js +6 -11
  121. package/dist/utils/settings-manager.js.map +1 -1
  122. package/docs/COMPLIANCE-SPEC.md +1452 -0
  123. package/package.json +30 -4
@@ -0,0 +1,85 @@
1
+ /**
2
+ * Cross-Platform File Permissions Utility
3
+ *
4
+ * Provides secure file permission handling across Linux, macOS, and Windows.
5
+ *
6
+ * On Unix systems (Linux/macOS):
7
+ * - Uses standard chmod-style permissions (0o600, 0o700, etc.)
8
+ *
9
+ * On Windows:
10
+ * - Uses icacls to restrict file access to current user only
11
+ * - Falls back gracefully if icacls fails
12
+ *
13
+ * Added by Pantheon Security for cross-platform support.
14
+ */
15
+ /**
16
+ * Platform detection
17
+ */
18
+ export declare const isWindows: boolean;
19
+ export declare const isMacOS: boolean;
20
+ export declare const isLinux: boolean;
21
+ export declare const isUnix: boolean;
22
+ /**
23
+ * Common permission modes (Unix-style)
24
+ */
25
+ export declare const PERMISSION_MODES: {
26
+ /** Owner read/write only (files with sensitive data) */
27
+ readonly OWNER_READ_WRITE: 384;
28
+ /** Owner read/write/execute only (directories, executables) */
29
+ readonly OWNER_FULL: 448;
30
+ /** Owner read/write, group/others read (less sensitive files) */
31
+ readonly OWNER_WRITE_ALL_READ: 420;
32
+ /** Owner full, group/others read+execute (less sensitive directories) */
33
+ readonly OWNER_FULL_ALL_READ_EXECUTE: 493;
34
+ };
35
+ /**
36
+ * Set secure file permissions (owner-only access)
37
+ *
38
+ * @param filePath - Path to the file
39
+ * @param mode - Unix permission mode (default: 0o600)
40
+ * @returns true if permissions were set successfully
41
+ */
42
+ export declare function setSecureFilePermissions(filePath: string, mode?: number): boolean;
43
+ /**
44
+ * Set secure directory permissions (owner-only access)
45
+ *
46
+ * @param dirPath - Path to the directory
47
+ * @param mode - Unix permission mode (default: 0o700)
48
+ * @returns true if permissions were set successfully
49
+ */
50
+ export declare function setSecureDirectoryPermissions(dirPath: string, mode?: number): boolean;
51
+ /**
52
+ * Create a directory with secure permissions
53
+ *
54
+ * @param dirPath - Path to create
55
+ * @param mode - Unix permission mode (default: 0o700)
56
+ */
57
+ export declare function mkdirSecure(dirPath: string, mode?: number): void;
58
+ /**
59
+ * Write a file with secure permissions
60
+ *
61
+ * @param filePath - Path to write
62
+ * @param content - Content to write
63
+ * @param mode - Unix permission mode (default: 0o600)
64
+ */
65
+ export declare function writeFileSecure(filePath: string, content: string | Buffer, mode?: number): void;
66
+ /**
67
+ * Append to a file with secure permissions
68
+ *
69
+ * @param filePath - Path to append to
70
+ * @param content - Content to append
71
+ * @param mode - Unix permission mode (default: 0o600)
72
+ */
73
+ export declare function appendFileSecure(filePath: string, content: string | Buffer, mode?: number): void;
74
+ /**
75
+ * Get platform information for logging/debugging
76
+ */
77
+ export declare function getPlatformInfo(): {
78
+ platform: string;
79
+ isWindows: boolean;
80
+ isMacOS: boolean;
81
+ isLinux: boolean;
82
+ supportsUnixPermissions: boolean;
83
+ supportsWindowsACLs: boolean;
84
+ };
85
+ //# sourceMappingURL=file-permissions.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"file-permissions.d.ts","sourceRoot":"","sources":["../../src/utils/file-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH;;GAEG;AACH,eAAO,MAAM,SAAS,SAA+B,CAAC;AACtD,eAAO,MAAM,OAAO,SAAgC,CAAC;AACrD,eAAO,MAAM,OAAO,SAA+B,CAAC;AACpD,eAAO,MAAM,MAAM,SAAa,CAAC;AAEjC;;GAEG;AACH,eAAO,MAAM,gBAAgB;IAC3B,wDAAwD;;IAExD,+DAA+D;;IAE/D,iEAAiE;;IAEjE,yEAAyE;;CAEjE,CAAC;AAEX;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,MAA0C,GAC/C,OAAO,CAYT;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,MAAoC,GACzC,OAAO,CAYT;AAqCD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,MAAoC,GAAG,IAAI,CAU7F;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,IAAI,GAAE,MAA0C,GAC/C,IAAI,CAYN;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,IAAI,GAAE,MAA0C,GAC/C,IAAI,CAQN;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,uBAAuB,EAAE,OAAO,CAAC;IACjC,mBAAmB,EAAE,OAAO,CAAC;CAC9B,CASA"}
@@ -0,0 +1,180 @@
1
+ /**
2
+ * Cross-Platform File Permissions Utility
3
+ *
4
+ * Provides secure file permission handling across Linux, macOS, and Windows.
5
+ *
6
+ * On Unix systems (Linux/macOS):
7
+ * - Uses standard chmod-style permissions (0o600, 0o700, etc.)
8
+ *
9
+ * On Windows:
10
+ * - Uses icacls to restrict file access to current user only
11
+ * - Falls back gracefully if icacls fails
12
+ *
13
+ * Added by Pantheon Security for cross-platform support.
14
+ */
15
+ import fs from "fs";
16
+ import path from "path";
17
+ import { execSync } from "child_process";
18
+ /**
19
+ * Platform detection
20
+ */
21
+ export const isWindows = process.platform === "win32";
22
+ export const isMacOS = process.platform === "darwin";
23
+ export const isLinux = process.platform === "linux";
24
+ export const isUnix = !isWindows;
25
+ /**
26
+ * Common permission modes (Unix-style)
27
+ */
28
+ export const PERMISSION_MODES = {
29
+ /** Owner read/write only (files with sensitive data) */
30
+ OWNER_READ_WRITE: 0o600,
31
+ /** Owner read/write/execute only (directories, executables) */
32
+ OWNER_FULL: 0o700,
33
+ /** Owner read/write, group/others read (less sensitive files) */
34
+ OWNER_WRITE_ALL_READ: 0o644,
35
+ /** Owner full, group/others read+execute (less sensitive directories) */
36
+ OWNER_FULL_ALL_READ_EXECUTE: 0o755,
37
+ };
38
+ /**
39
+ * Set secure file permissions (owner-only access)
40
+ *
41
+ * @param filePath - Path to the file
42
+ * @param mode - Unix permission mode (default: 0o600)
43
+ * @returns true if permissions were set successfully
44
+ */
45
+ export function setSecureFilePermissions(filePath, mode = PERMISSION_MODES.OWNER_READ_WRITE) {
46
+ try {
47
+ if (isWindows) {
48
+ return setWindowsFilePermissions(filePath, true);
49
+ }
50
+ else {
51
+ fs.chmodSync(filePath, mode);
52
+ return true;
53
+ }
54
+ }
55
+ catch {
56
+ // Silently fail - permissions are best-effort on some systems
57
+ return false;
58
+ }
59
+ }
60
+ /**
61
+ * Set secure directory permissions (owner-only access)
62
+ *
63
+ * @param dirPath - Path to the directory
64
+ * @param mode - Unix permission mode (default: 0o700)
65
+ * @returns true if permissions were set successfully
66
+ */
67
+ export function setSecureDirectoryPermissions(dirPath, mode = PERMISSION_MODES.OWNER_FULL) {
68
+ try {
69
+ if (isWindows) {
70
+ return setWindowsFilePermissions(dirPath, true);
71
+ }
72
+ else {
73
+ fs.chmodSync(dirPath, mode);
74
+ return true;
75
+ }
76
+ }
77
+ catch {
78
+ // Silently fail - permissions are best-effort on some systems
79
+ return false;
80
+ }
81
+ }
82
+ /**
83
+ * Set Windows file/directory permissions using icacls
84
+ *
85
+ * @param targetPath - Path to the file or directory
86
+ * @param ownerOnly - If true, restrict to current user only
87
+ * @returns true if permissions were set successfully
88
+ */
89
+ function setWindowsFilePermissions(targetPath, ownerOnly) {
90
+ if (!isWindows)
91
+ return false;
92
+ try {
93
+ const username = process.env.USERNAME || process.env.USER;
94
+ if (!username) {
95
+ return false;
96
+ }
97
+ if (ownerOnly) {
98
+ // Remove inherited permissions and grant full control only to current user
99
+ // /inheritance:r - Remove inherited ACLs
100
+ // /grant:r - Replace existing permissions with specified ones
101
+ // (F) - Full control
102
+ execSync(`icacls "${targetPath}" /inheritance:r /grant:r "${username}:(F)" /q`, { stdio: "pipe" });
103
+ }
104
+ return true;
105
+ }
106
+ catch {
107
+ // icacls may not be available or may fail - this is not critical
108
+ // The file is still created, just without restricted permissions
109
+ return false;
110
+ }
111
+ }
112
+ /**
113
+ * Create a directory with secure permissions
114
+ *
115
+ * @param dirPath - Path to create
116
+ * @param mode - Unix permission mode (default: 0o700)
117
+ */
118
+ export function mkdirSecure(dirPath, mode = PERMISSION_MODES.OWNER_FULL) {
119
+ if (!fs.existsSync(dirPath)) {
120
+ if (isWindows) {
121
+ // On Windows, create directory first then set permissions
122
+ fs.mkdirSync(dirPath, { recursive: true });
123
+ setWindowsFilePermissions(dirPath, true);
124
+ }
125
+ else {
126
+ fs.mkdirSync(dirPath, { recursive: true, mode });
127
+ }
128
+ }
129
+ }
130
+ /**
131
+ * Write a file with secure permissions
132
+ *
133
+ * @param filePath - Path to write
134
+ * @param content - Content to write
135
+ * @param mode - Unix permission mode (default: 0o600)
136
+ */
137
+ export function writeFileSecure(filePath, content, mode = PERMISSION_MODES.OWNER_READ_WRITE) {
138
+ // Ensure parent directory exists
139
+ const dir = path.dirname(filePath);
140
+ mkdirSecure(dir);
141
+ if (isWindows) {
142
+ // On Windows, write file first then set permissions
143
+ fs.writeFileSync(filePath, content);
144
+ setWindowsFilePermissions(filePath, true);
145
+ }
146
+ else {
147
+ fs.writeFileSync(filePath, content, { mode });
148
+ }
149
+ }
150
+ /**
151
+ * Append to a file with secure permissions
152
+ *
153
+ * @param filePath - Path to append to
154
+ * @param content - Content to append
155
+ * @param mode - Unix permission mode (default: 0o600)
156
+ */
157
+ export function appendFileSecure(filePath, content, mode = PERMISSION_MODES.OWNER_READ_WRITE) {
158
+ if (!fs.existsSync(filePath)) {
159
+ // If file doesn't exist, create with secure permissions
160
+ writeFileSecure(filePath, content, mode);
161
+ }
162
+ else {
163
+ // File exists, just append (permissions already set)
164
+ fs.appendFileSync(filePath, content);
165
+ }
166
+ }
167
+ /**
168
+ * Get platform information for logging/debugging
169
+ */
170
+ export function getPlatformInfo() {
171
+ return {
172
+ platform: process.platform,
173
+ isWindows,
174
+ isMacOS,
175
+ isLinux,
176
+ supportsUnixPermissions: isUnix,
177
+ supportsWindowsACLs: isWindows,
178
+ };
179
+ }
180
+ //# sourceMappingURL=file-permissions.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"file-permissions.js","sourceRoot":"","sources":["../../src/utils/file-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AACtD,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;AACrD,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AACpD,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,SAAS,CAAC;AAEjC;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,wDAAwD;IACxD,gBAAgB,EAAE,KAAK;IACvB,+DAA+D;IAC/D,UAAU,EAAE,KAAK;IACjB,iEAAiE;IACjE,oBAAoB,EAAE,KAAK;IAC3B,yEAAyE;IACzE,2BAA2B,EAAE,KAAK;CAC1B,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,OAAe,gBAAgB,CAAC,gBAAgB;IAEhD,IAAI,CAAC;QACH,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,yBAAyB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAe,EACf,OAAe,gBAAgB,CAAC,UAAU;IAE1C,IAAI,CAAC;QACH,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAAC,UAAkB,EAAE,SAAkB;IACvE,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,2EAA2E;YAC3E,yCAAyC;YACzC,8DAA8D;YAC9D,qBAAqB;YACrB,QAAQ,CACN,WAAW,UAAU,8BAA8B,QAAQ,UAAU,EACrE,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,iEAAiE;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,OAAe,gBAAgB,CAAC,UAAU;IACrF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,IAAI,SAAS,EAAE,CAAC;YACd,0DAA0D;YAC1D,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3C,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,OAAwB,EACxB,OAAe,gBAAgB,CAAC,gBAAgB;IAEhD,iCAAiC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,WAAW,CAAC,GAAG,CAAC,CAAC;IAEjB,IAAI,SAAS,EAAE,CAAC;QACd,oDAAoD;QACpD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpC,yBAAyB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,OAAwB,EACxB,OAAe,gBAAgB,CAAC,gBAAgB;IAEhD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,wDAAwD;QACxD,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,qDAAqD;QACrD,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAQ7B,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS;QACT,OAAO;QACP,OAAO;QACP,uBAAuB,EAAE,MAAM;QAC/B,mBAAmB,EAAE,SAAS;KAC/B,CAAC;AACJ,CAAC"}
@@ -1 +1 @@
1
- {"version":3,"file":"settings-manager.d.ts","sourceRoot":"","sources":["../../src/utils/settings-manager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAE1D,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,WAAW,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACtC;AA8BD,qBAAa,eAAe;IAC1B,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAW;;IAQ3B;;OAEG;IACH,OAAO,CAAC,YAAY;IAsBpB;;OAEG;IACG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IASjE;;OAEG;IACH,oBAAoB,IAAI,QAAQ;IAmBhC;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE;IAmBrC,eAAe,IAAI,MAAM;IAIzB,WAAW,IAAI,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;CAG7C"}
1
+ {"version":3,"file":"settings-manager.d.ts","sourceRoot":"","sources":["../../src/utils/settings-manager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAG1D,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,WAAW,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACtC;AA8BD,qBAAa,eAAe;IAC1B,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAW;;IAQ3B;;OAEG;IACH,OAAO,CAAC,YAAY;IAiBpB;;OAEG;IACG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAajE;;OAEG;IACH,oBAAoB,IAAI,QAAQ;IAmBhC;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE;IAmBrC,eAAe,IAAI,MAAM;IAIzB,WAAW,IAAI,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;CAG7C"}
@@ -4,11 +4,11 @@
4
4
  * Handles persistent configuration for the NotebookLM MCP Server.
5
5
  * Manages profiles, disabled tools, and environment variable overrides.
6
6
  */
7
- import fs from "fs/promises";
8
- import { existsSync, mkdirSync } from "fs";
7
+ import { existsSync, readFileSync } from "fs";
9
8
  import path from "path";
10
9
  import { CONFIG } from "../config.js";
11
10
  import { log } from "./logger.js";
11
+ import { mkdirSecure, writeFileSecure, PERMISSION_MODES } from "./file-permissions.js";
12
12
  const DEFAULT_SETTINGS = {
13
13
  profile: "full",
14
14
  disabledTools: [],
@@ -48,17 +48,12 @@ export class SettingsManager {
48
48
  */
49
49
  loadSettings() {
50
50
  try {
51
- // Ensure config dir exists
51
+ // Ensure config dir exists with secure permissions
52
52
  if (!existsSync(CONFIG.configDir)) {
53
- mkdirSync(CONFIG.configDir, { recursive: true });
53
+ mkdirSecure(CONFIG.configDir, PERMISSION_MODES.OWNER_FULL);
54
54
  }
55
55
  if (existsSync(this.settingsPath)) {
56
- // Use fs.readFileSync for synchronous initialization in constructor if needed,
57
- // but here we used async fs in imports. For simplicity in constructor,
58
- // we'll assume the file is read when needed or require explicit init.
59
- // Actually, to keep it simple, let's use require/import or readFileSync.
60
- const fsSync = require("fs");
61
- const data = fsSync.readFileSync(this.settingsPath, "utf-8");
56
+ const data = readFileSync(this.settingsPath, "utf-8");
62
57
  return { ...DEFAULT_SETTINGS, ...JSON.parse(data) };
63
58
  }
64
59
  }
@@ -73,7 +68,7 @@ export class SettingsManager {
73
68
  async saveSettings(newSettings) {
74
69
  this.settings = { ...this.settings, ...newSettings };
75
70
  try {
76
- await fs.writeFile(this.settingsPath, JSON.stringify(this.settings, null, 2), "utf-8");
71
+ writeFileSecure(this.settingsPath, JSON.stringify(this.settings, null, 2), PERMISSION_MODES.OWNER_READ_WRITE);
77
72
  }
78
73
  catch (error) {
79
74
  throw new Error(`Failed to save settings: ${error}`);
@@ -1 +1 @@
1
- {"version":3,"file":"settings-manager.js","sourceRoot":"","sources":["../../src/utils/settings-manager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,aAAa,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC3C,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAWlC,MAAM,gBAAgB,GAAa;IACjC,OAAO,EAAE,MAAM;IACf,aAAa,EAAE,EAAE;CAClB,CAAC;AAEF,MAAM,QAAQ,GAAkC;IAC9C,OAAO,EAAE;QACP,cAAc;QACd,YAAY;QACZ,gBAAgB;QAChB,iBAAiB;QACjB,cAAc,CAAC,sCAAsC;KACtD;IACD,QAAQ,EAAE;QACR,cAAc;QACd,YAAY;QACZ,gBAAgB;QAChB,iBAAiB;QACjB,cAAc;QACd,YAAY;QACZ,eAAe;QACf,cAAc;QACd,iBAAiB;QACjB,kBAAkB;KACnB;IACD,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,YAAY;CACzB,CAAC;AAEF,MAAM,OAAO,eAAe;IAClB,YAAY,CAAS;IACrB,QAAQ,CAAW;IAE3B;QACE,+DAA+D;QAC/D,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACK,YAAY;QAClB,IAAI,CAAC;YACH,2BAA2B;YAC3B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClC,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,CAAC;YAED,IAAI,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBAClC,gFAAgF;gBAChF,wEAAwE;gBACxE,uEAAuE;gBACvE,yEAAyE;gBACzE,MAAM,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;gBAC7D,OAAO,EAAE,GAAG,gBAAgB,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,OAAO,CAAC,gCAAgC,KAAK,mBAAmB,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,EAAE,GAAG,gBAAgB,EAAE,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,WAA8B;QAC/C,IAAI,CAAC,QAAQ,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,WAAW,EAAE,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,oBAAoB;QAClB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAiC,CAAC;QACjE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;QAE1D,MAAM,gBAAgB,GAAG,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAEnG,IAAI,iBAAiB,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,eAAe,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAClE,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,iBAAiB,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QAC/E,CAAC;QAED,OAAO;YACL,OAAO,EAAE,gBAAgB;YACzB,aAAa,EAAE,iBAAiB;YAChC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc;SAC7C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,QAAgB;QAC1B,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC/D,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAEvC,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;YAC5B,mEAAmE;YACnE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrE,OAAO,KAAK,CAAC;YACf,CAAC;YAED,kCAAkC;YAClC,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtC,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,WAAW;QACT,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}
1
+ {"version":3,"file":"settings-manager.js","sourceRoot":"","sources":["../../src/utils/settings-manager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAUvF,MAAM,gBAAgB,GAAa;IACjC,OAAO,EAAE,MAAM;IACf,aAAa,EAAE,EAAE;CAClB,CAAC;AAEF,MAAM,QAAQ,GAAkC;IAC9C,OAAO,EAAE;QACP,cAAc;QACd,YAAY;QACZ,gBAAgB;QAChB,iBAAiB;QACjB,cAAc,CAAC,sCAAsC;KACtD;IACD,QAAQ,EAAE;QACR,cAAc;QACd,YAAY;QACZ,gBAAgB;QAChB,iBAAiB;QACjB,cAAc;QACd,YAAY;QACZ,eAAe;QACf,cAAc;QACd,iBAAiB;QACjB,kBAAkB;KACnB;IACD,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,YAAY;CACzB,CAAC;AAEF,MAAM,OAAO,eAAe;IAClB,YAAY,CAAS;IACrB,QAAQ,CAAW;IAE3B;QACE,+DAA+D;QAC/D,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACK,YAAY;QAClB,IAAI,CAAC;YACH,mDAAmD;YACnD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClC,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAC7D,CAAC;YAED,IAAI,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;gBACtD,OAAO,EAAE,GAAG,gBAAgB,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,OAAO,CAAC,gCAAgC,KAAK,mBAAmB,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,EAAE,GAAG,gBAAgB,EAAE,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,WAA8B;QAC/C,IAAI,CAAC,QAAQ,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,WAAW,EAAE,CAAC;QACrD,IAAI,CAAC;YACH,eAAe,CACb,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EACtC,gBAAgB,CAAC,gBAAgB,CAClC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,oBAAoB;QAClB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAiC,CAAC;QACjE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;QAE1D,MAAM,gBAAgB,GAAG,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAEnG,IAAI,iBAAiB,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,eAAe,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAClE,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,iBAAiB,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QAC/E,CAAC;QAED,OAAO;YACL,OAAO,EAAE,gBAAgB;YACzB,aAAa,EAAE,iBAAiB;YAChC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc;SAC7C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,QAAgB;QAC1B,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC/D,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAEvC,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;YAC5B,mEAAmE;YACnE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrE,OAAO,KAAK,CAAC;YACf,CAAC;YAED,kCAAkC;YAClC,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtC,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,WAAW;QACT,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}