@pify/usage 0.12.0 → 0.12.1

package/README.md

@@ -44,7 +44,7 @@ By project (all time)
   D--project-shop-api       $6.60 · 3.6M tok
 ```
 
-`/usage export` writes the history out — `by-model.csv`, `by-day.csv`, `by-project.csv` and `totals.json`, full precision — into a timestamped folder under the OS temp directory (or `PIFY_USAGE_EXPORT_DIR`), never into the repository or your home, and prints the path.
+`/usage export` writes the history out — `by-model.csv`, `by-day.csv`, `by-project.csv` and `totals.json`, full precision — into a timestamped folder under the OS temp directory (or `PIFY_USAGE_EXPORT_DIR`), never into the repository or your home, readable by you only, and prints the path.
 
 The per-file scan cache is also kept on disk (`usage-scan-cache.json` next to pi's other state, keyed by size and mtime, versioned), so a fresh `pi` no longer pays the whole cold scan on its first `/usage`: it is read once before the first scan and rewritten after each completed one; a corrupt or older file is ignored and rebuilt, and only files the latest scan saw are kept.
 

package/extensions/usage.ts

@@ -332,12 +332,16 @@ export default function usage(pi: ExtensionAPI) {
         const now = Date.now();
         const stamp = new Date(now).toISOString().replace(/[:.]/g, "-");
         const dir = join(process.env.PIFY_USAGE_EXPORT_DIR?.trim() || join(tmpdir(), "pify-usage"), stamp);
+        // Spend and project names are the user's business: the folder and
+        // files are readable by the user only, and `wx` never follows a link
+        // someone else placed at the path (pi 1.0.3's own output-file rule).
+        const fileOptions = { mode: 0o600, flag: "wx" } as const;
         try {
-          mkdirSync(dir, { recursive: true });
-          writeFileSync(join(dir, "by-model.csv"), buildByModelCsv(history.byModel));
-          writeFileSync(join(dir, "by-day.csv"), buildByDayCsv(history.byDay));
-          writeFileSync(join(dir, "by-project.csv"), buildByProjectCsv(history.byProject));
-          writeFileSync(join(dir, "totals.json"), buildTotalsJson(history.total, history.files, now));
+          mkdirSync(dir, { recursive: true, mode: 0o700 });
+          writeFileSync(join(dir, "by-model.csv"), buildByModelCsv(history.byModel), fileOptions);
+          writeFileSync(join(dir, "by-day.csv"), buildByDayCsv(history.byDay), fileOptions);
+          writeFileSync(join(dir, "by-project.csv"), buildByProjectCsv(history.byProject), fileOptions);
+          writeFileSync(join(dir, "totals.json"), buildTotalsJson(history.total, history.files, now), fileOptions);
         } catch (err) {
           ctx.ui.notify(`Export failed: ${err instanceof Error ? err.message : String(err)}`, "error");
           return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pify/usage",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "Token and cost reporting for pi sessions: live footer, local-history dashboard with per-project costs, opt-in provider quota",
   "keywords": [
     "pi-package",

package/src/sessions.ts

@@ -65,7 +65,7 @@ export function persistScanCache(file: string): number {
   try {
     mkdirSync(dirname(file), { recursive: true });
     const tmp = `${file}.${process.pid}.tmp`;
-    writeFileSync(tmp, JSON.stringify({ version: SCAN_CACHE_VERSION, entries }));
+    writeFileSync(tmp, JSON.stringify({ version: SCAN_CACHE_VERSION, entries }), { mode: 0o600 });
     renameSync(tmp, file);
   } catch {
     // An unwritable cache costs the next process one cold scan, nothing else.