@pellux/goodvibes-sdk 0.21.28 → 0.21.29

package/dist/_internal/platform/daemon/http-listener.d.ts

@@ -10,6 +10,14 @@ interface HttpListenerConfig {
     serveFactory?: typeof Bun.serve;
     /** Max requests per 60-second window per IP. Default: 60. */
     rateLimit?: number;
+    /** Max POST /login attempts per 60-second window per IP. Default: 5. */
+    loginRateLimit?: number;
+    /**
+     * When true, x-forwarded-for / x-real-ip headers are trusted for client IP
+     * extraction (rate limiting, audit logging). Only enable behind a trusted
+     * reverse proxy. Overrides the httpListener.trustProxy config value when set.
+     */
+    trustProxy?: boolean;
     /** Pre-configured UserAuthManager owned by the runtime service graph. */
     userAuth: UserAuthManager;
 }
@@ -36,6 +44,10 @@ export declare class HttpListener {
     private authToken;
     private userAuth;
     private rateLimiter;
+    /** Dedicated tight rate-limiter for POST /login (SEC-03). */
+    private loginRateLimiter;
+    /** Whether to trust x-forwarded-for / x-real-ip for client IP resolution. */
+    private trustProxy;
     private readonly configManager;
     private readonly serveFactory;
     private tlsState;

package/dist/_internal/platform/daemon/http-listener.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-listener.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/daemon/http-listener.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAMxD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAWrD,UAAU,kBAAkB;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,aAAa,EAAE,aAAa,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,GAAG,CAAC,KAAK,CAAC;IAChC,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAED,UAAU,gBAAgB;IACxB,YAAY,EAAE,OAAO,CAAC;CACvB;AA0ED;;;;;;;;GAQG;AACH,qBAAa,YAAY;IAsBX,OAAO,CAAC,MAAM;IArB1B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAA6C;IAC3D,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,cAAc,CAAW;IACjC,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmB;IAChD,OAAO,CAAC,QAAQ,CAA0C;IAC1D,4EAA4E;IAC5E,OAAO,CAAC,iBAAiB,CAA6B;IACtD,gFAAgF;IAChF,OAAO,CAAC,WAAW,CAAS;IAC5B,sEAAsE;IACtE,OAAO,CAAC,kBAAkB,CAA8B;IACxD,0FAA0F;IAC1F,OAAO,CAAC,aAAa,CAAS;gBAEV,MAAM,EAAE,kBAAkB;IAiB9C;;;;OAIG;IACH,MAAM,CAAC,YAAY,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO;IAU/D;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAsC5B;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAKrC;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB3B;;;OAGG;IACH,OAAO,CAAC,gCAAgC;IAwDxC;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAMD,OAAO,CAAC,SAAS;YAOH,aAAa;YAYb,aAAa;YAsCb,WAAW;YA6BX,aAAa;CAgD5B"}
+{"version":3,"file":"http-listener.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/daemon/http-listener.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAMxD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAWrD,UAAU,kBAAkB;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,aAAa,EAAE,aAAa,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,GAAG,CAAC,KAAK,CAAC;IAChC,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,yEAAyE;IACzE,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAED,UAAU,gBAAgB;IACxB,YAAY,EAAE,OAAO,CAAC;CACvB;AA0ED;;;;;;;;GAQG;AACH,qBAAa,YAAY;IA0BX,OAAO,CAAC,MAAM;IAzB1B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAA6C;IAC3D,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,cAAc,CAAW;IACjC,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,WAAW,CAAc;IACjC,6DAA6D;IAC7D,OAAO,CAAC,gBAAgB,CAAc;IACtC,6EAA6E;IAC7E,OAAO,CAAC,UAAU,CAAU;IAC5B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmB;IAChD,OAAO,CAAC,QAAQ,CAA0C;IAC1D,4EAA4E;IAC5E,OAAO,CAAC,iBAAiB,CAA6B;IACtD,gFAAgF;IAChF,OAAO,CAAC,WAAW,CAAS;IAC5B,sEAAsE;IACtE,OAAO,CAAC,kBAAkB,CAA8B;IACxD,0FAA0F;IAC1F,OAAO,CAAC,aAAa,CAAS;gBAEV,MAAM,EAAE,kBAAkB;IAiC9C;;;;OAIG;IACH,MAAM,CAAC,YAAY,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO;IAU/D;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAsC5B;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAKrC;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAqB3B;;;OAGG;IACH,OAAO,CAAC,gCAAgC;IAwDxC;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAMD,OAAO,CAAC,SAAS;YAOH,aAAa;YAYb,aAAa;YA0Db,WAAW;YA6BX,aAAa;CAgD5B"}

package/dist/_internal/platform/daemon/http-listener.js

@@ -93,6 +93,10 @@ export class HttpListener {
     authToken = null;
     userAuth;
     rateLimiter;
+    /** Dedicated tight rate-limiter for POST /login (SEC-03). */
+    loginRateLimiter;
+    /** Whether to trust x-forwarded-for / x-real-ip for client IP resolution. */
+    trustProxy;
     configManager;
     serveFactory;
     tlsState = null;
@@ -111,9 +115,22 @@ export class HttpListener {
         this.port = config.port ?? resolvedHttpBinding.port;
         this.host = config.host ?? resolvedHttpBinding.host;
         this.allowedOrigins = config.allowedOrigins ?? [];
+        // SEC-07: Refuse to construct when hostMode=network and allowedOrigins is not configured.
+        // An empty allowedOrigins combined with a network-reachable bind is an open CSRF vector —
+        // any browser-initiated cross-origin request will carry an Origin header and be accepted.
+        const effectiveHostMode = this.configManager.get('httpListener.hostMode') ?? 'local';
+        if (effectiveHostMode === 'network' && this.allowedOrigins.length === 0) {
+            throw new Error('SECURITY_UNSAFE_ORIGIN_CONFIG: hostMode=network requires non-empty allowedOrigins to prevent CSRF. '
+                + 'Set config.httpListener.allowedOrigins to a list of trusted origins '
+                + "(e.g. ['https://companion.example.com']).");
+        }
         this.hookDispatcher = config.hookDispatcher ?? null;
         this.userAuth = config.userAuth;
         this.rateLimiter = new RateLimiter(config.rateLimit ?? 60);
+        // SEC-03: /login gets its own tight budget (5 attempts/min per IP) to prevent
+        // scrypt-cost-throttled online brute-force attacks.
+        this.loginRateLimiter = new RateLimiter(config.loginRateLimit ?? 5);
+        this.trustProxy = config.trustProxy ?? Boolean(this.configManager.get('httpListener.trustProxy'));
         this.serveFactory = config.serveFactory ?? Bun.serve;
     }
     /**
@@ -190,8 +207,9 @@ export class HttpListener {
             this._configWatchUnsub?.();
             this._configWatchUnsub = null;
         }
-        // Stop rate limiter sweep interval before tearing down (C5 fix)
+        // Stop rate limiter sweep intervals before tearing down.
         this.rateLimiter.stop();
+        this.loginRateLimiter.stop();
         this.server.stop(true);
         this.server = null;
         this.tlsState = null;
@@ -281,20 +299,35 @@ export class HttpListener {
     // Request handling
     // -------------------------------------------------------------------------
     async handleRequest(req) {
-        // Handle login route before auth check
         const url = new URL(req.url);
+        const clientIp = extractForwardedClientIp(req, this.trustProxy || (this.tlsState?.trustProxy ?? false)) ?? 'unknown';
+        // SEC-07: CORS origin check applies to ALL paths (including /login).
+        // Logic:
+        //   - No Origin header → same-origin or non-browser request → allow.
+        //   - Origin present + allowedOrigins empty → no allowlist configured; block to
+        //     prevent CSRF even when hostMode is not 'network' (e.g. 'auto' with a
+        //     network-reachable bind). Constructor already refuses hostMode=network with
+        //     empty allowedOrigins at startup, but defence-in-depth covers the request path.
+        //   - Origin present + allowedOrigins non-empty → check allowlist.
+        const origin = req.headers.get('origin');
+        if (origin !== null) {
+            if (this.allowedOrigins.length === 0) {
+                return Response.json({ error: 'CORS_NOT_CONFIGURED: no allowedOrigins set' }, { status: 403 });
+            }
+            if (!this.allowedOrigins.includes(origin)) {
+                return Response.json({ error: 'ORIGIN_NOT_ALLOWED' }, { status: 403 });
+            }
+        }
+        // SEC-03: /login route handled AFTER origin check and under its own tight
+        // rate-limit budget (5/min per IP) to prevent online brute-force attacks.
+        // x-forwarded-for is only trustworthy when running behind a trusted reverse proxy.
         if (url.pathname === '/login' && req.method === 'POST') {
+            if (!this.loginRateLimiter.check(clientIp)) {
+                return Response.json({ error: 'Too many requests' }, { status: 429 });
+            }
             return this.handleLogin(req);
         }
-        // CORS origin check when allowedOrigins is configured
-        const origin = req.headers.get('origin') ?? '';
-        if (this.allowedOrigins.length > 0 && origin && !this.allowedOrigins.includes(origin)) {
-            return Response.json({ error: 'Origin not allowed' }, { status: 403 });
-        }
-        // Rate limiting (keyed by a synthetic IP-like string from headers)
-        // Note: x-forwarded-for is only trustworthy when running behind a trusted reverse proxy.
-        // If exposed directly to the internet, clients can spoof this header.
-        const clientIp = extractForwardedClientIp(req, this.tlsState?.trustProxy ?? Boolean(this.configManager.get('httpListener.trustProxy'))) ?? 'unknown';
+        // General rate limiting for all other routes.
         if (!this.rateLimiter.check(clientIp)) {
             return Response.json({ error: 'Too many requests' }, { status: 429 });
         }

package/dist/_internal/platform/security/user-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-auth.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/security/user-auth.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,cAAc;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAUD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACjD;AAwJD,qBAAa,eAAe;IAC1B,OAAO,CAAC,KAAK,CAA+B;IAC5C,OAAO,CAAC,QAAQ,CAAkC;IAClD,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAS;IACjD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAU;gBAE3B,MAAM,EAAE,cAAc;IAqBlC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAI7C,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI;IAMjE,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAShD,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW;IAY5C,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAUlD,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIrC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAW/C,SAAS,IAAI,cAAc,EAAE;IAS7B,YAAY,IAAI,iBAAiB,EAAE;IAOnC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,GAAE,SAAS,MAAM,EAAc,GAAG,cAAc;IAejG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAarC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAgB5D,OAAO,IAAI,iBAAiB;IAc5B,4BAA4B,IAAI,OAAO;IAMvC,0BAA0B,IAAI,MAAM;IAIpC,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,OAAO;CAIhB"}
+{"version":3,"file":"user-auth.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/security/user-auth.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,cAAc;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAUD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACjD;AAgKD,qBAAa,eAAe;IAC1B,OAAO,CAAC,KAAK,CAA+B;IAC5C,OAAO,CAAC,QAAQ,CAAkC;IAClD,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAS;IACjD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAU;gBAE3B,MAAM,EAAE,cAAc;IAqBlC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAI7C,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI;IAMjE,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAShD,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW;IAY5C,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAUlD,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIrC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAW/C,SAAS,IAAI,cAAc,EAAE;IAS7B,YAAY,IAAI,iBAAiB,EAAE;IAOnC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,GAAE,SAAS,MAAM,EAAc,GAAG,cAAc;IAejG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAarC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAgB5D,OAAO,IAAI,iBAAiB;IAc5B,4BAA4B,IAAI,OAAO;IAMvC,0BAA0B,IAAI,MAAM;IAIpC,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,OAAO;CAIhB"}

package/dist/_internal/platform/security/user-auth.js

@@ -1,5 +1,5 @@
 import { randomBytes, scryptSync, timingSafeEqual } from 'crypto';
-import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { logger } from '../utils/logger.js';
 const DEFAULT_SESSION_TTL_MS = 3_600_000;
@@ -48,26 +48,39 @@ function readBootstrapUsers(filePath) {
         return null;
     }
 }
-function writeBootstrapUsers(filePath, users) {
+/**
+ * Write secret file content atomically at 0600 (owner read/write only).
+ * Uses write-to-tmp-then-rename for atomicity; chmod applied at both
+ * sides to defeat filesystem-reset behaviour on rename (observed on
+ * some Linux fs drivers).
+ */
+function atomicWriteSecretFile(filePath, content) {
     mkdirSync(dirname(filePath), { recursive: true });
+    const tmpPath = filePath + '.tmp';
+    writeFileSync(tmpPath, content, { encoding: 'utf-8', mode: 0o600 });
+    try {
+        chmodSync(tmpPath, 0o600);
+    }
+    catch { /* best-effort */ }
+    renameSync(tmpPath, filePath);
+    try {
+        chmodSync(filePath, 0o600);
+    }
+    catch { /* best-effort */ }
+}
+function writeBootstrapUsers(filePath, users) {
+    // SEC-01: auth-user store contains scrypt password hashes — must be 0600.
     const payload = { version: 1, users };
-    writeFileSync(filePath, `${JSON.stringify(payload, null, 2)}\n`, 'utf-8');
+    atomicWriteSecretFile(filePath, `${JSON.stringify(payload, null, 2)}\n`);
 }
 function writeBootstrapCredentialFile(filePath, username, password) {
-    mkdirSync(dirname(filePath), { recursive: true });
-    writeFileSync(filePath, [
+    atomicWriteSecretFile(filePath, [
         'GoodVibes bootstrap auth',
         `username=${username}`,
         `password=${password}`,
         'purpose=Use these credentials only for local daemon/http listener /login routes when those surfaces are enabled.',
         'note=Normal SDK host usage does not require these credentials.',
-    ].join('\n') + '\n', 'utf-8');
-    try {
-        chmodSync(filePath, 0o600);
-    }
-    catch {
-        // best-effort only
-    }
+    ].join('\n') + '\n');
 }
 function loadOrBootstrapUsers(filePath, credentialPath) {
     const existing = readBootstrapUsers(filePath);

package/dist/_internal/platform/version.js

@@ -1,6 +1,6 @@
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
-let version = '0.21.28';
+let version = '0.21.29';
 try {
     const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', '..', 'package.json'), 'utf-8'));
     version = pkg.version ?? version;

package/dist/_internal/platform/workspace/daemon-home.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon-home.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/workspace/daemon-home.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAwB,MAAM,4BAA4B,CAAC;AAOxF,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,iFAAiF;IACjF,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,wCAAwC;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC;CACvC;AAMD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,iBAAsB,GAAG,MAAM,CAiB5E;AAMD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAEtE;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,iBAAsB,EAC/B,IAAI,GAAE,uBAA4B,GACjC,cAAc,CA+BhB;AAMD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CASnF;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQ/E;AAMD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAWxF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAc1F"}
+{"version":3,"file":"daemon-home.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/workspace/daemon-home.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAwB,MAAM,4BAA4B,CAAC;AAOxF,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,iFAAiF;IACjF,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,wCAAwC;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC;CACvC;AAMD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,iBAAsB,GAAG,MAAM,CAiB5E;AAMD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAEtE;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,iBAAsB,EAC/B,IAAI,GAAE,uBAA4B,GACjC,cAAc,CAgChB;AAMD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CASnF;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQ/E;AAMD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAWxF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAiB1F"}

package/dist/_internal/platform/workspace/daemon-home.js

@@ -82,14 +82,15 @@ export function runDaemonHomeMigration(daemonHomeDir, options = {}, deps = {}) {
     mkdirSync(daemonHomeDir, { recursive: true });
     const userGoodVibesRoot = join(homedir(), '.goodvibes');
     // Migrate auth-users.json from tui surface path
+    // SEC-02: credential-bearing files must land at 0600 regardless of source perms.
     const legacyAuthUsers = join(userGoodVibesRoot, 'tui', 'auth-users.json');
     if (existsSync(legacyAuthUsers)) {
-        safeCopy(legacyAuthUsers, join(daemonHomeDir, 'auth-users.json'));
+        safeCopyIdentity(legacyAuthUsers, join(daemonHomeDir, 'auth-users.json'));
     }
     // Migrate auth-bootstrap.txt from tui surface path
     const legacyBootstrap = join(userGoodVibesRoot, 'tui', 'auth-bootstrap.txt');
     if (existsSync(legacyBootstrap)) {
-        safeCopy(legacyBootstrap, join(daemonHomeDir, 'auth-bootstrap.txt'));
+        safeCopyIdentity(legacyBootstrap, join(daemonHomeDir, 'auth-bootstrap.txt'));
     }
     // NOTE: Operator tokens are NOT migrated from legacy workspace-scoped paths.
     // The canonical path is <daemonHomeDir>/operator-tokens.json (global, set at 0600).
@@ -175,8 +176,17 @@ export function writeDaemonSetting(daemonHomeDir, key, value) {
             // Overwrite corrupt file
         }
     }
-    writeFileSync(tmpPath, JSON.stringify({ ...existing, [key]: value }, null, 2), 'utf-8');
+    // SEC-12: daemon-settings.json may contain sensitive pairing state; write at 0600.
+    writeFileSync(tmpPath, JSON.stringify({ ...existing, [key]: value }, null, 2), { encoding: 'utf-8', mode: 0o600 });
+    try {
+        chmodSync(tmpPath, 0o600);
+    }
+    catch { /* best-effort */ }
     renameSync(tmpPath, settingsPath);
+    try {
+        chmodSync(settingsPath, 0o600);
+    }
+    catch { /* best-effort */ }
 }
 // ---------------------------------------------------------------------------
 // Helpers
@@ -199,3 +209,25 @@ function safeCopy(src, dest) {
         return false;
     }
 }
+/**
+ * Copy a credential-bearing identity file from src to dest and force mode 0600.
+ *
+ * SEC-02: `copyFileSync` preserves source permissions. Legacy TUI files may be
+ * 0644 (world-readable). Calling `chmodSync` after copy ensures the new
+ * canonical path is always owner-only regardless of the source's permissions.
+ * Never throws — failures are logged at warn level.
+ */
+function safeCopyIdentity(src, dest) {
+    if (!safeCopy(src, dest))
+        return false;
+    try {
+        chmodSync(dest, 0o600);
+    }
+    catch (err) {
+        logger.warn('daemon-home: safeCopyIdentity chmod failed (best-effort)', {
+            dest,
+            error: err instanceof Error ? err.message : String(err),
+        });
+    }
+    return true;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-sdk",
-  "version": "0.21.28",
+  "version": "0.21.29",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/mgd34msu/goodvibes-sdk.git"