@paradigma-inc/flywheel 0.1.107 → 0.1.108

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paradigma-inc/flywheel",
-  "version": "0.1.107",
+  "version": "0.1.108",
   "description": "One-command setup for Flywheel MCP hosts",
   "type": "module",
   "files": [

package/src/mcp-writer.mjs

@@ -1,6 +1,6 @@
-import { access, mkdir, readFile, writeFile } from "node:fs/promises";
-import path from "node:path";
+import { access, readFile } from "node:fs/promises";
 import { load as loadYaml, dump as dumpYaml } from "js-yaml";
+import { secureFileMode, writeSecureFile } from "./secure-write.mjs";
 
 function stripJsonComments(text) {
   let result = "";
@@ -117,11 +117,7 @@ export async function readJsonConfig(filePath) {
 }
 
 export async function writeJsonConfig(filePath, config) {
-  await mkdir(path.dirname(filePath), { recursive: true });
-  await writeFile(filePath, `${JSON.stringify(config, null, 2)}\n`, {
-    encoding: "utf8",
-    mode: 0o600,
-  });
+  await writeSecureFile(filePath, `${JSON.stringify(config, null, 2)}\n`);
 }
 
 export async function readYamlConfig(filePath) {
@@ -146,11 +142,7 @@ export async function readYamlConfig(filePath) {
 }
 
 export async function writeYamlConfig(filePath, config) {
-  await mkdir(path.dirname(filePath), { recursive: true });
-  await writeFile(filePath, dumpYaml(config, { noRefs: true }), {
-    encoding: "utf8",
-    mode: 0o600,
-  });
+  await writeSecureFile(filePath, dumpYaml(config, { noRefs: true }));
 }
 
 export async function resolveMcpPath(candidates) {
@@ -479,6 +471,7 @@ export async function appendTomlServer(
     // header when the caller explicitly toggled auth mode via `--oauth` or
     // `--api-key`.
     if (!enforceAuthMode || existingEntry.authMode === newAuthMode) {
+      await secureFileMode(filePath);
       return { alreadyExists: true };
     }
   }
@@ -515,11 +508,7 @@ export async function appendTomlServer(
       : existing.length > 0
         ? "\n"
         : "";
-  await mkdir(path.dirname(filePath), { recursive: true });
-  await writeFile(filePath, `${existing}${separator}${block}`, {
-    encoding: "utf8",
-    mode: 0o600,
-  });
+  await writeSecureFile(filePath, `${existing}${separator}${block}`);
   return { alreadyExists: false };
 }
 
@@ -582,7 +571,6 @@ export async function removeCodexTomlServer({ filePath, serverName }) {
   });
   if (!removed) return { changed: false };
 
-  await mkdir(path.dirname(filePath), { recursive: true });
-  await writeFile(filePath, stripped, { encoding: "utf8", mode: 0o600 });
+  await writeSecureFile(filePath, stripped);
   return { changed: true };
 }

package/src/runtime/runtime-config.mjs

@@ -1,6 +1,7 @@
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { readFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
+import { writeSecureFile } from "../secure-write.mjs";
 
 const RUNTIME_BASE_URL_SUFFIX = "/api";
 
@@ -76,9 +77,8 @@ export async function writeRuntimeConfig({
   }
 
   const baseUrl = normalizeRuntimeBaseUrl(origin);
-  await mkdir(path.dirname(configPath), { recursive: true });
   const existing = await readExistingRuntimeConfig(configPath);
   const merged = { ...existing, baseUrl, apiKey: trimmedKey };
-  await writeFile(configPath, `${JSON.stringify(merged, null, 2)}\n`, "utf8");
+  await writeSecureFile(configPath, `${JSON.stringify(merged, null, 2)}\n`);
   return { configPath, baseUrl };
 }

package/src/runtime/vendor/flywheel-cli-dist/generatedProductTelemetryContract.d.ts

@@ -1,9 +1,9 @@
 export declare const PRODUCT_TELEMETRY_CONTRACT_VERSION: "2026-05-18.2";
-export declare const PRODUCT_TELEMETRY_EVENT_NAMES: readonly ["api_client_operation_recorded", "api_route_behavior_recorded", "cli_command_behavior_recorded", "credits_checkout_started", "mcp_tool_behavior_recorded", "message_sent", "node_created", "node_link_disabled", "node_link_enabled", "node_public_disabled", "node_public_enabled", "product_demand_signal_recorded", "server_workflow_behavior_recorded", "subscription_checkout_started", "user_session_started", "web_app_opened", "web_artifact_payload_batch", "web_artifact_payload_failed", "web_artifact_payload_loaded", "web_artifact_payload_retried", "web_artifact_section_opened", "web_artifact_unrenderable_seen", "web_asset_deleted", "web_asset_note_saved", "web_asset_operation_failed", "web_asset_panel_opened", "web_asset_uploaded", "web_collaboration_action_completed", "web_collaboration_action_failed", "web_graph_layout_changed", "web_graph_load_failed", "web_graph_loaded", "web_graph_mutation_completed", "web_graph_mutation_failed", "web_graph_mutation_started", "web_graph_node_focused", "web_graph_opened", "web_graph_partial_notice_shown", "web_graph_search_changed", "web_graph_search_empty", "web_node_closed", "web_node_edit_cancelled", "web_node_edit_failed", "web_node_edit_saved", "web_node_edit_started", "web_node_hydration_completed", "web_node_hydration_failed", "web_node_lease_acquired", "web_node_lease_failed", "web_node_lease_heartbeat_failed", "web_node_lease_released", "web_node_opened", "web_node_stage_committed", "web_node_stage_created", "web_node_stage_discarded", "web_node_stage_failed", "web_node_stage_rebased", "web_settings_opened", "web_temp_node_commit_completed", "web_temp_node_commit_failed"];
+export declare const PRODUCT_TELEMETRY_EVENT_NAMES: readonly ["api_client_operation_recorded", "api_route_behavior_recorded", "cli_command_behavior_recorded", "credits_checkout_started", "mcp_tool_behavior_recorded", "message_sent", "node_created", "node_link_disabled", "node_link_enabled", "node_public_disabled", "node_public_enabled", "product_demand_signal_recorded", "server_workflow_behavior_recorded", "subscription_checkout_started", "user_session_started", "web_app_opened", "web_artifact_payload_batch", "web_artifact_payload_failed", "web_artifact_payload_loaded", "web_artifact_payload_retried", "web_artifact_section_opened", "web_artifact_unrenderable_seen", "web_asset_deleted", "web_asset_note_saved", "web_asset_operation_failed", "web_asset_panel_opened", "web_asset_uploaded", "web_collaboration_action_completed", "web_collaboration_action_failed", "web_graph_filter_panel_closed", "web_graph_filter_panel_opened", "web_graph_filter_visibility_changed", "web_graph_layout_changed", "web_graph_load_failed", "web_graph_loaded", "web_graph_mutation_completed", "web_graph_mutation_failed", "web_graph_mutation_started", "web_graph_node_focused", "web_graph_opened", "web_graph_partial_notice_shown", "web_graph_search_changed", "web_graph_search_empty", "web_node_closed", "web_node_edit_cancelled", "web_node_edit_failed", "web_node_edit_saved", "web_node_edit_started", "web_node_hydration_completed", "web_node_hydration_failed", "web_node_lease_acquired", "web_node_lease_failed", "web_node_lease_heartbeat_failed", "web_node_lease_released", "web_node_opened", "web_node_stage_committed", "web_node_stage_created", "web_node_stage_discarded", "web_node_stage_failed", "web_node_stage_rebased", "web_settings_opened", "web_temp_node_commit_completed", "web_temp_node_commit_failed"];
 export type ProductTelemetryEventName = (typeof PRODUCT_TELEMETRY_EVENT_NAMES)[number];
 export declare const PRODUCT_TELEMETRY_SURFACES: readonly ["api", "api_client", "cli", "mcp", "server", "webui"];
 export type ProductTelemetrySurface = (typeof PRODUCT_TELEMETRY_SURFACES)[number];
-export declare const WEBUI_PRODUCT_TELEMETRY_EVENT_NAMES: readonly ["web_app_opened", "web_artifact_payload_batch", "web_artifact_payload_failed", "web_artifact_payload_loaded", "web_artifact_payload_retried", "web_artifact_section_opened", "web_artifact_unrenderable_seen", "web_asset_deleted", "web_asset_note_saved", "web_asset_operation_failed", "web_asset_panel_opened", "web_asset_uploaded", "web_collaboration_action_completed", "web_collaboration_action_failed", "web_graph_layout_changed", "web_graph_load_failed", "web_graph_loaded", "web_graph_mutation_completed", "web_graph_mutation_failed", "web_graph_mutation_started", "web_graph_node_focused", "web_graph_opened", "web_graph_partial_notice_shown", "web_graph_search_changed", "web_graph_search_empty", "web_node_closed", "web_node_edit_cancelled", "web_node_edit_failed", "web_node_edit_saved", "web_node_edit_started", "web_node_hydration_completed", "web_node_hydration_failed", "web_node_lease_acquired", "web_node_lease_failed", "web_node_lease_heartbeat_failed", "web_node_lease_released", "web_node_opened", "web_node_stage_committed", "web_node_stage_created", "web_node_stage_discarded", "web_node_stage_failed", "web_node_stage_rebased", "web_settings_opened", "web_temp_node_commit_completed", "web_temp_node_commit_failed"];
+export declare const WEBUI_PRODUCT_TELEMETRY_EVENT_NAMES: readonly ["web_app_opened", "web_artifact_payload_batch", "web_artifact_payload_failed", "web_artifact_payload_loaded", "web_artifact_payload_retried", "web_artifact_section_opened", "web_artifact_unrenderable_seen", "web_asset_deleted", "web_asset_note_saved", "web_asset_operation_failed", "web_asset_panel_opened", "web_asset_uploaded", "web_collaboration_action_completed", "web_collaboration_action_failed", "web_graph_filter_panel_closed", "web_graph_filter_panel_opened", "web_graph_filter_visibility_changed", "web_graph_layout_changed", "web_graph_load_failed", "web_graph_loaded", "web_graph_mutation_completed", "web_graph_mutation_failed", "web_graph_mutation_started", "web_graph_node_focused", "web_graph_opened", "web_graph_partial_notice_shown", "web_graph_search_changed", "web_graph_search_empty", "web_node_closed", "web_node_edit_cancelled", "web_node_edit_failed", "web_node_edit_saved", "web_node_edit_started", "web_node_hydration_completed", "web_node_hydration_failed", "web_node_lease_acquired", "web_node_lease_failed", "web_node_lease_heartbeat_failed", "web_node_lease_released", "web_node_opened", "web_node_stage_committed", "web_node_stage_created", "web_node_stage_discarded", "web_node_stage_failed", "web_node_stage_rebased", "web_settings_opened", "web_temp_node_commit_completed", "web_temp_node_commit_failed"];
 export type WebuiProductTelemetryEventName = (typeof WEBUI_PRODUCT_TELEMETRY_EVENT_NAMES)[number];
 export declare const WEBUI_NODE_WORKFLOW_FAMILIES: readonly ["artifacts", "assets", "bulk_graph_actions", "canvas", "commit", "context_menu", "graph_layout", "hooks", "lease", "minimap", "node_focus", "node_hydration", "node_open", "node_selection", "node_view_editing", "partial_graph_preview", "radial_view", "share_policy", "staged_edit", "tags", "timeline_layout"];
 export type WebuiNodeWorkflowFamily = (typeof WEBUI_NODE_WORKFLOW_FAMILIES)[number];