@pellux/goodvibes-sdk 0.21.27 → 0.21.29

package/dist/_internal/platform/daemon/http-listener.d.ts

@@ -10,6 +10,14 @@ interface HttpListenerConfig {
     serveFactory?: typeof Bun.serve;
     /** Max requests per 60-second window per IP. Default: 60. */
     rateLimit?: number;
+    /** Max POST /login attempts per 60-second window per IP. Default: 5. */
+    loginRateLimit?: number;
+    /**
+     * When true, x-forwarded-for / x-real-ip headers are trusted for client IP
+     * extraction (rate limiting, audit logging). Only enable behind a trusted
+     * reverse proxy. Overrides the httpListener.trustProxy config value when set.
+     */
+    trustProxy?: boolean;
     /** Pre-configured UserAuthManager owned by the runtime service graph. */
     userAuth: UserAuthManager;
 }
@@ -36,6 +44,10 @@ export declare class HttpListener {
     private authToken;
     private userAuth;
     private rateLimiter;
+    /** Dedicated tight rate-limiter for POST /login (SEC-03). */
+    private loginRateLimiter;
+    /** Whether to trust x-forwarded-for / x-real-ip for client IP resolution. */
+    private trustProxy;
     private readonly configManager;
     private readonly serveFactory;
     private tlsState;

package/dist/_internal/platform/daemon/http-listener.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-listener.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/daemon/http-listener.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAMxD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAWrD,UAAU,kBAAkB;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,aAAa,EAAE,aAAa,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,GAAG,CAAC,KAAK,CAAC;IAChC,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAED,UAAU,gBAAgB;IACxB,YAAY,EAAE,OAAO,CAAC;CACvB;AA0ED;;;;;;;;GAQG;AACH,qBAAa,YAAY;IAsBX,OAAO,CAAC,MAAM;IArB1B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAA6C;IAC3D,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,cAAc,CAAW;IACjC,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmB;IAChD,OAAO,CAAC,QAAQ,CAA0C;IAC1D,4EAA4E;IAC5E,OAAO,CAAC,iBAAiB,CAA6B;IACtD,gFAAgF;IAChF,OAAO,CAAC,WAAW,CAAS;IAC5B,sEAAsE;IACtE,OAAO,CAAC,kBAAkB,CAA8B;IACxD,0FAA0F;IAC1F,OAAO,CAAC,aAAa,CAAS;gBAEV,MAAM,EAAE,kBAAkB;IAiB9C;;;;OAIG;IACH,MAAM,CAAC,YAAY,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO;IAU/D;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAsC5B;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAKrC;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB3B;;;OAGG;IACH,OAAO,CAAC,gCAAgC;IAwDxC;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAMD,OAAO,CAAC,SAAS;YAOH,aAAa;YAYb,aAAa;YAsCb,WAAW;YA6BX,aAAa;CAgD5B"}
+{"version":3,"file":"http-listener.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/daemon/http-listener.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAMxD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAWrD,UAAU,kBAAkB;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,aAAa,EAAE,aAAa,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,GAAG,CAAC,KAAK,CAAC;IAChC,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,yEAAyE;IACzE,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAED,UAAU,gBAAgB;IACxB,YAAY,EAAE,OAAO,CAAC;CACvB;AA0ED;;;;;;;;GAQG;AACH,qBAAa,YAAY;IA0BX,OAAO,CAAC,MAAM;IAzB1B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAA6C;IAC3D,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,cAAc,CAAW;IACjC,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,WAAW,CAAc;IACjC,6DAA6D;IAC7D,OAAO,CAAC,gBAAgB,CAAc;IACtC,6EAA6E;IAC7E,OAAO,CAAC,UAAU,CAAU;IAC5B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmB;IAChD,OAAO,CAAC,QAAQ,CAA0C;IAC1D,4EAA4E;IAC5E,OAAO,CAAC,iBAAiB,CAA6B;IACtD,gFAAgF;IAChF,OAAO,CAAC,WAAW,CAAS;IAC5B,sEAAsE;IACtE,OAAO,CAAC,kBAAkB,CAA8B;IACxD,0FAA0F;IAC1F,OAAO,CAAC,aAAa,CAAS;gBAEV,MAAM,EAAE,kBAAkB;IAiC9C;;;;OAIG;IACH,MAAM,CAAC,YAAY,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO;IAU/D;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAsC5B;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAKrC;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAqB3B;;;OAGG;IACH,OAAO,CAAC,gCAAgC;IAwDxC;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAMD,OAAO,CAAC,SAAS;YAOH,aAAa;YAYb,aAAa;YA0Db,WAAW;YA6BX,aAAa;CAgD5B"}

package/dist/_internal/platform/daemon/http-listener.js

@@ -93,6 +93,10 @@ export class HttpListener {
     authToken = null;
     userAuth;
     rateLimiter;
+    /** Dedicated tight rate-limiter for POST /login (SEC-03). */
+    loginRateLimiter;
+    /** Whether to trust x-forwarded-for / x-real-ip for client IP resolution. */
+    trustProxy;
     configManager;
     serveFactory;
     tlsState = null;
@@ -111,9 +115,22 @@ export class HttpListener {
         this.port = config.port ?? resolvedHttpBinding.port;
         this.host = config.host ?? resolvedHttpBinding.host;
         this.allowedOrigins = config.allowedOrigins ?? [];
+        // SEC-07: Refuse to construct when hostMode=network and allowedOrigins is not configured.
+        // An empty allowedOrigins combined with a network-reachable bind is an open CSRF vector —
+        // any browser-initiated cross-origin request will carry an Origin header and be accepted.
+        const effectiveHostMode = this.configManager.get('httpListener.hostMode') ?? 'local';
+        if (effectiveHostMode === 'network' && this.allowedOrigins.length === 0) {
+            throw new Error('SECURITY_UNSAFE_ORIGIN_CONFIG: hostMode=network requires non-empty allowedOrigins to prevent CSRF. '
+                + 'Set config.httpListener.allowedOrigins to a list of trusted origins '
+                + "(e.g. ['https://companion.example.com']).");
+        }
         this.hookDispatcher = config.hookDispatcher ?? null;
         this.userAuth = config.userAuth;
         this.rateLimiter = new RateLimiter(config.rateLimit ?? 60);
+        // SEC-03: /login gets its own tight budget (5 attempts/min per IP) to prevent
+        // scrypt-cost-throttled online brute-force attacks.
+        this.loginRateLimiter = new RateLimiter(config.loginRateLimit ?? 5);
+        this.trustProxy = config.trustProxy ?? Boolean(this.configManager.get('httpListener.trustProxy'));
         this.serveFactory = config.serveFactory ?? Bun.serve;
     }
     /**
@@ -190,8 +207,9 @@ export class HttpListener {
             this._configWatchUnsub?.();
             this._configWatchUnsub = null;
         }
-        // Stop rate limiter sweep interval before tearing down (C5 fix)
+        // Stop rate limiter sweep intervals before tearing down.
         this.rateLimiter.stop();
+        this.loginRateLimiter.stop();
         this.server.stop(true);
         this.server = null;
         this.tlsState = null;
@@ -281,20 +299,35 @@ export class HttpListener {
     // Request handling
     // -------------------------------------------------------------------------
     async handleRequest(req) {
-        // Handle login route before auth check
         const url = new URL(req.url);
+        const clientIp = extractForwardedClientIp(req, this.trustProxy || (this.tlsState?.trustProxy ?? false)) ?? 'unknown';
+        // SEC-07: CORS origin check applies to ALL paths (including /login).
+        // Logic:
+        //   - No Origin header → same-origin or non-browser request → allow.
+        //   - Origin present + allowedOrigins empty → no allowlist configured; block to
+        //     prevent CSRF even when hostMode is not 'network' (e.g. 'auto' with a
+        //     network-reachable bind). Constructor already refuses hostMode=network with
+        //     empty allowedOrigins at startup, but defence-in-depth covers the request path.
+        //   - Origin present + allowedOrigins non-empty → check allowlist.
+        const origin = req.headers.get('origin');
+        if (origin !== null) {
+            if (this.allowedOrigins.length === 0) {
+                return Response.json({ error: 'CORS_NOT_CONFIGURED: no allowedOrigins set' }, { status: 403 });
+            }
+            if (!this.allowedOrigins.includes(origin)) {
+                return Response.json({ error: 'ORIGIN_NOT_ALLOWED' }, { status: 403 });
+            }
+        }
+        // SEC-03: /login route handled AFTER origin check and under its own tight
+        // rate-limit budget (5/min per IP) to prevent online brute-force attacks.
+        // x-forwarded-for is only trustworthy when running behind a trusted reverse proxy.
         if (url.pathname === '/login' && req.method === 'POST') {
+            if (!this.loginRateLimiter.check(clientIp)) {
+                return Response.json({ error: 'Too many requests' }, { status: 429 });
+            }
             return this.handleLogin(req);
         }
-        // CORS origin check when allowedOrigins is configured
-        const origin = req.headers.get('origin') ?? '';
-        if (this.allowedOrigins.length > 0 && origin && !this.allowedOrigins.includes(origin)) {
-            return Response.json({ error: 'Origin not allowed' }, { status: 403 });
-        }
-        // Rate limiting (keyed by a synthetic IP-like string from headers)
-        // Note: x-forwarded-for is only trustworthy when running behind a trusted reverse proxy.
-        // If exposed directly to the internet, clients can spoof this header.
-        const clientIp = extractForwardedClientIp(req, this.tlsState?.trustProxy ?? Boolean(this.configManager.get('httpListener.trustProxy'))) ?? 'unknown';
+        // General rate limiting for all other routes.
         if (!this.rateLimiter.check(clientIp)) {
             return Response.json({ error: 'Too many requests' }, { status: 429 });
         }

package/dist/_internal/platform/pairing/companion-token.d.ts

@@ -18,19 +18,19 @@ export interface CompanionTokenRecord {
     readonly createdAt: number;
 }
 /**
- * Load the stored companion token for a surface, or generate and persist a new one.
+ * Load the stored companion token, or generate and persist a new one.
+ * Token is always written to <daemonHomeDir>/operator-tokens.json at mode 0600.
  */
-export declare function getOrCreateCompanionToken(surface: string, options?: {
-    basePath?: string;
-    daemonHomeDir?: string;
+export declare function getOrCreateCompanionToken(surface: string, options: {
+    daemonHomeDir: string;
     regenerate?: boolean;
 }): CompanionPairingResult;
 /**
- * Regenerate the companion token for a surface, replacing any existing token.
+ * Regenerate the companion token, replacing any existing token.
+ * Written to <daemonHomeDir>/operator-tokens.json at mode 0600.
  */
-export declare function regenerateCompanionToken(surface: string, options?: {
-    basePath?: string;
-    daemonHomeDir?: string;
+export declare function regenerateCompanionToken(surface: string, options: {
+    daemonHomeDir: string;
 }): CompanionPairingResult;
 /**
  * Build a CompanionConnectionInfo object from raw parameters.

package/dist/_internal/platform/pairing/companion-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"companion-token.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/pairing/companion-token.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AA4CD;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC5E,sBAAsB,CAyBxB;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GACtD,sBAAsB,CAExB;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE;IACpD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,uBAAuB,CAS1B;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,uBAAuB,GAAG,MAAM,CAS7E"}
+{"version":3,"file":"companion-token.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/pairing/companion-token.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAyBD;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GACvD,sBAAsB,CA6BxB;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,GACjC,sBAAsB,CAExB;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE;IACpD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,uBAAuB,CAS1B;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,uBAAuB,GAAG,MAAM,CAS7E"}

package/dist/_internal/platform/pairing/companion-token.js

@@ -1,5 +1,5 @@
 import { randomBytes } from 'node:crypto';
-import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs';
+import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 const TOKEN_PREFIX = 'gv_';
 function generateTokenValue() {
@@ -9,41 +9,25 @@ function generatePeerId() {
     return randomBytes(12).toString('hex');
 }
 /**
- * Resolve the token store path.
+ * Resolve the operator token store path.
  *
- * Resolution order (first match wins):
- *   1. daemonHomeDir — daemon-identity-scoped path (0.21.19+, recommended)
- *   2. basePath — workspace-scoped path (0.21.17–0.21.18 layout, legacy fallback)
- *   3. process.cwd() — absolute fallback
+ * The only valid location is <daemonHomeDir>/operator-tokens.json.
+ * Operator tokens are global (daemon-home scoped) since 0.21.28.
+ * No workspace-scoped fallback exists.
  *
- * Storing tokens under daemonHomeDir means workspace swaps never invalidate
- * paired companions — a token paired once works regardless of which working
- * directory the daemon is currently serving.
+ * @throws {Error} when daemonHomeDir is not provided — all callers must supply it.
  */
-function resolveSharedTokenPath(basePath, daemonHomeDir) {
-    if (daemonHomeDir) {
-        return join(daemonHomeDir, 'operator-tokens.json');
-    }
-    const base = basePath ?? process.cwd();
-    return join(base, '.goodvibes', 'operator-tokens.json');
+function resolveSharedTokenPath(daemonHomeDir) {
+    return join(daemonHomeDir, 'operator-tokens.json');
 }
 /**
- * Resolve the path to the companion token file.
- *
- * Always resolves to the shared workspace-level path regardless of surface,
- * so that tokens are portable across TUI-embedded and standalone daemon postures.
- *
- * @deprecated `surface` parameter is ignored; use {@link resolveSharedTokenPath} directly.
- */
-function resolveTokenPath(_surface, basePath, daemonHomeDir) {
-    return resolveSharedTokenPath(basePath, daemonHomeDir);
-}
-/**
- * Load the stored companion token for a surface, or generate and persist a new one.
+ * Load the stored companion token, or generate and persist a new one.
+ * Token is always written to <daemonHomeDir>/operator-tokens.json at mode 0600.
  */
 export function getOrCreateCompanionToken(surface, options) {
-    const tokenPath = resolveTokenPath(surface, options?.basePath, options?.daemonHomeDir);
-    if (!options?.regenerate && existsSync(tokenPath)) {
+    void surface; // surface parameter retained for API compatibility; token path is global
+    const tokenPath = resolveSharedTokenPath(options.daemonHomeDir);
+    if (!options.regenerate && existsSync(tokenPath)) {
         try {
             const raw = readFileSync(tokenPath, 'utf-8');
             const record = JSON.parse(raw);
@@ -60,12 +44,19 @@ export function getOrCreateCompanionToken(surface, options) {
         peerId: generatePeerId(),
         createdAt: Date.now(),
     };
-    mkdirSync(dirname(tokenPath), { recursive: true });
-    writeFileSync(tokenPath, JSON.stringify(record, null, 2), 'utf-8');
+    const dir = dirname(tokenPath);
+    mkdirSync(dir, { recursive: true });
+    // Write with mode 0600 (owner read/write only) and enforce after write
+    writeFileSync(tokenPath, JSON.stringify(record, null, 2), { encoding: 'utf-8', mode: 0o600 });
+    try {
+        chmodSync(tokenPath, 0o600);
+    }
+    catch { /* best-effort */ }
     return { token: record.token, peerId: record.peerId, createdAt: record.createdAt };
 }
 /**
- * Regenerate the companion token for a surface, replacing any existing token.
+ * Regenerate the companion token, replacing any existing token.
+ * Written to <daemonHomeDir>/operator-tokens.json at mode 0600.
  */
 export function regenerateCompanionToken(surface, options) {
     return getOrCreateCompanionToken(surface, { ...options, regenerate: true });

package/dist/_internal/platform/security/user-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-auth.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/security/user-auth.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,cAAc;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAUD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACjD;AAwJD,qBAAa,eAAe;IAC1B,OAAO,CAAC,KAAK,CAA+B;IAC5C,OAAO,CAAC,QAAQ,CAAkC;IAClD,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAS;IACjD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAU;gBAE3B,MAAM,EAAE,cAAc;IAqBlC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAI7C,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI;IAMjE,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAShD,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW;IAY5C,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAUlD,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIrC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAW/C,SAAS,IAAI,cAAc,EAAE;IAS7B,YAAY,IAAI,iBAAiB,EAAE;IAOnC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,GAAE,SAAS,MAAM,EAAc,GAAG,cAAc;IAejG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAarC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAgB5D,OAAO,IAAI,iBAAiB;IAc5B,4BAA4B,IAAI,OAAO;IAMvC,0BAA0B,IAAI,MAAM;IAIpC,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,OAAO;CAIhB"}
+{"version":3,"file":"user-auth.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/security/user-auth.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,cAAc;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAUD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACjD;AAgKD,qBAAa,eAAe;IAC1B,OAAO,CAAC,KAAK,CAA+B;IAC5C,OAAO,CAAC,QAAQ,CAAkC;IAClD,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAS;IACjD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAU;gBAE3B,MAAM,EAAE,cAAc;IAqBlC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAI7C,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI;IAMjE,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAShD,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW;IAY5C,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAUlD,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIrC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAW/C,SAAS,IAAI,cAAc,EAAE;IAS7B,YAAY,IAAI,iBAAiB,EAAE;IAOnC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,GAAE,SAAS,MAAM,EAAc,GAAG,cAAc;IAejG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAarC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAgB5D,OAAO,IAAI,iBAAiB;IAc5B,4BAA4B,IAAI,OAAO;IAMvC,0BAA0B,IAAI,MAAM;IAIpC,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,OAAO;CAIhB"}

package/dist/_internal/platform/security/user-auth.js

@@ -1,5 +1,5 @@
 import { randomBytes, scryptSync, timingSafeEqual } from 'crypto';
-import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { logger } from '../utils/logger.js';
 const DEFAULT_SESSION_TTL_MS = 3_600_000;
@@ -48,26 +48,39 @@ function readBootstrapUsers(filePath) {
         return null;
     }
 }
-function writeBootstrapUsers(filePath, users) {
+/**
+ * Write secret file content atomically at 0600 (owner read/write only).
+ * Uses write-to-tmp-then-rename for atomicity; chmod applied at both
+ * sides to defeat filesystem-reset behaviour on rename (observed on
+ * some Linux fs drivers).
+ */
+function atomicWriteSecretFile(filePath, content) {
     mkdirSync(dirname(filePath), { recursive: true });
+    const tmpPath = filePath + '.tmp';
+    writeFileSync(tmpPath, content, { encoding: 'utf-8', mode: 0o600 });
+    try {
+        chmodSync(tmpPath, 0o600);
+    }
+    catch { /* best-effort */ }
+    renameSync(tmpPath, filePath);
+    try {
+        chmodSync(filePath, 0o600);
+    }
+    catch { /* best-effort */ }
+}
+function writeBootstrapUsers(filePath, users) {
+    // SEC-01: auth-user store contains scrypt password hashes — must be 0600.
     const payload = { version: 1, users };
-    writeFileSync(filePath, `${JSON.stringify(payload, null, 2)}\n`, 'utf-8');
+    atomicWriteSecretFile(filePath, `${JSON.stringify(payload, null, 2)}\n`);
 }
 function writeBootstrapCredentialFile(filePath, username, password) {
-    mkdirSync(dirname(filePath), { recursive: true });
-    writeFileSync(filePath, [
+    atomicWriteSecretFile(filePath, [
         'GoodVibes bootstrap auth',
         `username=${username}`,
         `password=${password}`,
         'purpose=Use these credentials only for local daemon/http listener /login routes when those surfaces are enabled.',
         'note=Normal SDK host usage does not require these credentials.',
-    ].join('\n') + '\n', 'utf-8');
-    try {
-        chmodSync(filePath, 0o600);
-    }
-    catch {
-        // best-effort only
-    }
+    ].join('\n') + '\n');
 }
 function loadOrBootstrapUsers(filePath, credentialPath) {
     const existing = readBootstrapUsers(filePath);

package/dist/_internal/platform/version.js

@@ -1,6 +1,6 @@
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
-let version = '0.21.27';
+let version = '0.21.29';
 try {
     const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', '..', 'package.json'), 'utf-8'));
     version = pkg.version ?? version;

package/dist/_internal/platform/workspace/daemon-home.d.ts

@@ -18,7 +18,8 @@
  *   - If ~/.goodvibes/daemon/ does not exist:
  *     - ~/.goodvibes/tui/auth-users.json → ~/.goodvibes/daemon/auth-users.json
  *     - ~/.goodvibes/tui/auth-bootstrap.txt → ~/.goodvibes/daemon/auth-bootstrap.txt
- *     - <cwd>/.goodvibes/operator-tokens.json → ~/.goodvibes/daemon/operator-tokens.json (F3 revision)
+ *   - Operator tokens are global-only: read/written exclusively at
+ *     <daemonHomeDir>/operator-tokens.json. No workspace-scoped paths.
  *   - Old paths are left intact (never deleted) to avoid breaking older binaries.
  */
 import type { RuntimeEventBus } from '../runtime/events/index.js';
@@ -31,8 +32,6 @@ export interface DaemonHomeDirs {
 export interface DaemonHomeOptions {
     /** Value of --daemon-home CLI flag, if provided. */
     readonly daemonHomeArg?: string | undefined;
-    /** Current working directory, used as base for operator-tokens migration. */
-    readonly cwd?: string;
     /** Override process.env for testing. */
     readonly env?: NodeJS.ProcessEnv;
 }
@@ -48,14 +47,36 @@ export interface DaemonHomeMigrationDeps {
  * Resolve the daemon home directory from CLI flag, environment variable, or default.
  */
 export declare function resolveDaemonHomeDir(options?: DaemonHomeOptions): string;
+/**
+ * Returns the single canonical path for operator tokens.
+ * All reads and writes MUST use this path. No workspace-scoped fallback exists.
+ */
+export declare function resolveOperatorTokenPath(daemonHomeDir: string): string;
 /**
  * Run migration if the daemon home directory does not yet exist.
  * Creates the directory and copies identity files from legacy paths if found.
  * Old files are NOT deleted.
  *
+ * Operator tokens are NOT migrated from workspace-scoped paths — the global
+ * daemon-home path is canonical since 0.21.28. If tokens are missing,
+ * the first pairing operation will create them at the global path.
+ *
  * Returns `freshInstall: true` when migration ran, `false` when the dir already existed.
  */
 export declare function runDaemonHomeMigration(daemonHomeDir: string, options?: DaemonHomeOptions, deps?: DaemonHomeMigrationDeps): DaemonHomeDirs;
+/**
+ * Write operator tokens to the global daemon-home path with mode 0600.
+ * All token provisioning MUST go through this function.
+ *
+ * Uses a write-to-tmp-then-rename pattern for atomicity.
+ * Applies chmod 0600 after rename so the file is never world-readable.
+ */
+export declare function writeOperatorTokenFile(daemonHomeDir: string, content: string): void;
+/**
+ * Read operator tokens from the global daemon-home path.
+ * Returns undefined when the file does not exist or cannot be parsed.
+ */
+export declare function readOperatorTokenFile(daemonHomeDir: string): string | undefined;
 /**
  * Read a single key from daemon-settings.json, or return undefined if missing.
  */

package/dist/_internal/platform/workspace/daemon-home.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon-home.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/workspace/daemon-home.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAwB,MAAM,4BAA4B,CAAC;AAOxF,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,iFAAiF;IACjF,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC;CACvC;AAMD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,iBAAsB,GAAG,MAAM,CAiB5E;AAMD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,iBAAsB,EAC/B,IAAI,GAAE,uBAA4B,GACjC,cAAc,CAoFhB;AAMD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAWxF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAc1F"}
+{"version":3,"file":"daemon-home.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/workspace/daemon-home.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAwB,MAAM,4BAA4B,CAAC;AAOxF,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,iFAAiF;IACjF,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,wCAAwC;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC;CACvC;AAMD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,iBAAsB,GAAG,MAAM,CAiB5E;AAMD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAEtE;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,iBAAsB,EAC/B,IAAI,GAAE,uBAA4B,GACjC,cAAc,CAgChB;AAMD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CASnF;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQ/E;AAMD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAWxF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAiB1F"}

package/dist/_internal/platform/workspace/daemon-home.js

@@ -18,10 +18,11 @@
  *   - If ~/.goodvibes/daemon/ does not exist:
  *     - ~/.goodvibes/tui/auth-users.json → ~/.goodvibes/daemon/auth-users.json
  *     - ~/.goodvibes/tui/auth-bootstrap.txt → ~/.goodvibes/daemon/auth-bootstrap.txt
- *     - <cwd>/.goodvibes/operator-tokens.json → ~/.goodvibes/daemon/operator-tokens.json (F3 revision)
+ *   - Operator tokens are global-only: read/written exclusively at
+ *     <daemonHomeDir>/operator-tokens.json. No workspace-scoped paths.
  *   - Old paths are left intact (never deleted) to avoid breaking older binaries.
  */
-import { existsSync, mkdirSync, copyFileSync, readFileSync, writeFileSync, renameSync, readdirSync } from 'node:fs';
+import { existsSync, mkdirSync, copyFileSync, readFileSync, writeFileSync, renameSync, chmodSync } from 'node:fs';
 import { join, isAbsolute, resolve, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import { logger } from '../utils/logger.js';
@@ -49,6 +50,16 @@ export function resolveDaemonHomeDir(options = {}) {
     return join(homedir(), '.goodvibes', 'daemon');
 }
 // ---------------------------------------------------------------------------
+// Global operator token path
+// ---------------------------------------------------------------------------
+/**
+ * Returns the single canonical path for operator tokens.
+ * All reads and writes MUST use this path. No workspace-scoped fallback exists.
+ */
+export function resolveOperatorTokenPath(daemonHomeDir) {
+    return join(daemonHomeDir, 'operator-tokens.json');
+}
+// ---------------------------------------------------------------------------
 // One-time migration
 // ---------------------------------------------------------------------------
 /**
@@ -56,6 +67,10 @@ export function resolveDaemonHomeDir(options = {}) {
  * Creates the directory and copies identity files from legacy paths if found.
  * Old files are NOT deleted.
  *
+ * Operator tokens are NOT migrated from workspace-scoped paths — the global
+ * daemon-home path is canonical since 0.21.28. If tokens are missing,
+ * the first pairing operation will create them at the global path.
+ *
  * Returns `freshInstall: true` when migration ran, `false` when the dir already existed.
  */
 export function runDaemonHomeMigration(daemonHomeDir, options = {}, deps = {}) {
@@ -66,78 +81,63 @@ export function runDaemonHomeMigration(daemonHomeDir, options = {}, deps = {}) {
     // Create the daemon home directory tree
     mkdirSync(daemonHomeDir, { recursive: true });
     const userGoodVibesRoot = join(homedir(), '.goodvibes');
-    const cwd = options.cwd ?? process.cwd();
     // Migrate auth-users.json from tui surface path
+    // SEC-02: credential-bearing files must land at 0600 regardless of source perms.
     const legacyAuthUsers = join(userGoodVibesRoot, 'tui', 'auth-users.json');
     if (existsSync(legacyAuthUsers)) {
-        safeCopy(legacyAuthUsers, join(daemonHomeDir, 'auth-users.json'));
+        safeCopyIdentity(legacyAuthUsers, join(daemonHomeDir, 'auth-users.json'));
     }
     // Migrate auth-bootstrap.txt from tui surface path
     const legacyBootstrap = join(userGoodVibesRoot, 'tui', 'auth-bootstrap.txt');
     if (existsSync(legacyBootstrap)) {
-        safeCopy(legacyBootstrap, join(daemonHomeDir, 'auth-bootstrap.txt'));
-    }
-    // Migrate operator-tokens.json — search multiple legacy paths (F3 revision).
-    // 0.21.17 used <cwd>/.goodvibes/operator-tokens.json (workspace-scoped).
-    // 0.21.16 and earlier used surface-scoped ~/.goodvibes/<surface>/companion-token.json.
-    // 0.21.19+ canonical path is <daemonHomeDir>/operator-tokens.json.
-    const destTokenPath = join(daemonHomeDir, 'operator-tokens.json');
-    if (!existsSync(destTokenPath)) {
-        // Priority 1: workspace-scoped path from 0.21.17
-        const legacyWorkspaceTokens = join(cwd, '.goodvibes', 'operator-tokens.json');
-        // Priority 2: surface-scoped legacy tokens from 0.21.16 and earlier
-        const legacySurfaceToken = join(userGoodVibesRoot, 'tui', 'companion-token.json');
-        // Priority 3: XDG data home if set
-        const xdgDataHome = options.env?.['XDG_DATA_HOME'];
-        const xdgToken = xdgDataHome ? join(xdgDataHome, 'goodvibes', 'operator-tokens.json') : null;
-        // Scan for any surface-scoped companion-token.json files under ~/.goodvibes/
-        const surfaceScopedTokens = [];
-        try {
-            const entries = readdirSync(userGoodVibesRoot, { withFileTypes: true });
-            for (const entry of entries) {
-                if (entry.isDirectory()) {
-                    const candidate = join(userGoodVibesRoot, entry.name, 'companion-token.json');
-                    if (existsSync(candidate))
-                        surfaceScopedTokens.push(candidate);
-                }
-            }
-        }
-        catch {
-            // Best-effort scan
-        }
-        const tokenSources = [
-            legacyWorkspaceTokens,
-            ...(xdgToken ? [xdgToken] : []),
-            legacySurfaceToken,
-            ...surfaceScopedTokens,
-        ];
-        for (const src of tokenSources) {
-            if (!existsSync(src))
-                continue;
-            // Validate JSON before copying — corrupt JSON must not be migrated.
-            try {
-                JSON.parse(readFileSync(src, 'utf-8'));
-            }
-            catch (parseErr) {
-                const reason = parseErr instanceof Error ? parseErr.message : String(parseErr);
-                logger.warn('daemon-home: skipping corrupt token file during migration', {
-                    sourcePath: src,
-                    reason,
-                });
-                _emitMigrationEvent(deps.runtimeBus, { type: 'WORKSPACE_IDENTITY_MIGRATION_FAILED', sourcePath: src, reason });
-                safeCopy(src, destTokenPath, { skipIfInvalid: true });
-                continue;
-            }
-            if (safeCopy(src, destTokenPath)) {
-                logger.info('daemon-home: migrated operator token', { from: src, to: destTokenPath });
-                _emitMigrationEvent(deps.runtimeBus, { type: 'WORKSPACE_IDENTITY_MIGRATED', from: src, to: destTokenPath });
-            }
-            break; // First valid source wins
-        }
+        safeCopyIdentity(legacyBootstrap, join(daemonHomeDir, 'auth-bootstrap.txt'));
     }
+    // NOTE: Operator tokens are NOT migrated from legacy workspace-scoped paths.
+    // The canonical path is <daemonHomeDir>/operator-tokens.json (global, set at 0600).
+    // If no token file exists at the canonical path, the first pairing call will
+    // create it via getOrCreateCompanionToken (companion-token.ts).
+    void deps; // deps.runtimeBus reserved for future migration event emission
     return { daemonHomeDir, freshInstall: true };
 }
 // ---------------------------------------------------------------------------
+// Operator token file write (global-only, mode 0600)
+// ---------------------------------------------------------------------------
+/**
+ * Write operator tokens to the global daemon-home path with mode 0600.
+ * All token provisioning MUST go through this function.
+ *
+ * Uses a write-to-tmp-then-rename pattern for atomicity.
+ * Applies chmod 0600 after rename so the file is never world-readable.
+ */
+export function writeOperatorTokenFile(daemonHomeDir, content) {
+    const tokenPath = resolveOperatorTokenPath(daemonHomeDir);
+    mkdirSync(dirname(tokenPath), { recursive: true });
+    const tmpPath = tokenPath + '.tmp';
+    writeFileSync(tmpPath, content, { encoding: 'utf-8', mode: 0o600 });
+    chmodSync(tmpPath, 0o600);
+    renameSync(tmpPath, tokenPath);
+    // Apply chmod again after rename — some filesystems reset permissions on rename
+    try {
+        chmodSync(tokenPath, 0o600);
+    }
+    catch { /* best-effort */ }
+}
+/**
+ * Read operator tokens from the global daemon-home path.
+ * Returns undefined when the file does not exist or cannot be parsed.
+ */
+export function readOperatorTokenFile(daemonHomeDir) {
+    const tokenPath = resolveOperatorTokenPath(daemonHomeDir);
+    if (!existsSync(tokenPath))
+        return undefined;
+    try {
+        return readFileSync(tokenPath, 'utf-8');
+    }
+    catch {
+        return undefined;
+    }
+}
+// ---------------------------------------------------------------------------
 // Daemon settings persistence
 // ---------------------------------------------------------------------------
 /**
@@ -176,36 +176,26 @@ export function writeDaemonSetting(daemonHomeDir, key, value) {
             // Overwrite corrupt file
         }
     }
-    writeFileSync(tmpPath, JSON.stringify({ ...existing, [key]: value }, null, 2), 'utf-8');
+    // SEC-12: daemon-settings.json may contain sensitive pairing state; write at 0600.
+    writeFileSync(tmpPath, JSON.stringify({ ...existing, [key]: value }, null, 2), { encoding: 'utf-8', mode: 0o600 });
+    try {
+        chmodSync(tmpPath, 0o600);
+    }
+    catch { /* best-effort */ }
     renameSync(tmpPath, settingsPath);
+    try {
+        chmodSync(settingsPath, 0o600);
+    }
+    catch { /* best-effort */ }
 }
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
-/**
- * Emit a workspace migration event on the runtime bus.
- * Never throws — bus emission must not interrupt migration.
- */
-function _emitMigrationEvent(bus, payload) {
-    if (!bus)
-        return;
-    try {
-        const envelope = createEventEnvelope(payload.type, payload, { sessionId: '', source: 'daemon-home-migration' });
-        bus.emit('workspace', 
-        // WorkspaceEvent discriminated-union member; single widening cast is safe.
-        envelope);
-    }
-    catch {
-        // Swallow — never let event emission break migration
-    }
-}
 /**
  * Copy src to dest. Returns true on success, false on failure.
  * Failures are logged at warn level. Never throws.
  */
-function safeCopy(src, dest, opts) {
-    if (opts?.skipIfInvalid)
-        return false;
+function safeCopy(src, dest) {
     try {
         copyFileSync(src, dest);
         return true;
@@ -219,3 +209,25 @@ function safeCopy(src, dest, opts) {
         return false;
     }
 }
+/**
+ * Copy a credential-bearing identity file from src to dest and force mode 0600.
+ *
+ * SEC-02: `copyFileSync` preserves source permissions. Legacy TUI files may be
+ * 0644 (world-readable). Calling `chmodSync` after copy ensures the new
+ * canonical path is always owner-only regardless of the source's permissions.
+ * Never throws — failures are logged at warn level.
+ */
+function safeCopyIdentity(src, dest) {
+    if (!safeCopy(src, dest))
+        return false;
+    try {
+        chmodSync(dest, 0o600);
+    }
+    catch (err) {
+        logger.warn('daemon-home: safeCopyIdentity chmod failed (best-effort)', {
+            dest,
+            error: err instanceof Error ? err.message : String(err),
+        });
+    }
+    return true;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-sdk",
-  "version": "0.21.27",
+  "version": "0.21.29",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/mgd34msu/goodvibes-sdk.git"