@tonyclaw/agent-inspector 3.0.29 → 3.0.30

package/src/proxy/providerSecretStore.ts

@@ -1,18 +1,15 @@
 import { createCipheriv, createDecipheriv, randomBytes, timingSafeEqual } from "node:crypto";
 import { Buffer } from "node:buffer";
-import {
-  chmodSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  renameSync,
-  rmSync,
-  writeFileSync,
-} from "node:fs";
-import { join } from "node:path";
+import { existsSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
 import { z } from "zod";
 import { readJsonFile } from "../lib/jsonFile";
 import { logger } from "./logger";
+import {
+  ensurePrivateDirectorySync,
+  PRIVATE_FILE_MODE,
+  securePrivateFileSync,
+} from "./privateDataPath";
 
 const SECRET_REFERENCE_PREFIX = "secret:provider:";
 const SECRET_FILE_VERSION = 1;
@@ -38,21 +35,32 @@ function emptySecretFile(): SecretFile {
   return { version: SECRET_FILE_VERSION, secrets: {} };
 }
 
-function readSecretFile(path: string): SecretFile {
+function readSecretFile(path: string): SecretFile | null {
   if (!existsSync(path)) return emptySecretFile();
+  if (!securePrivateFileSync(path)) {
+    logger.error(`[provider-secrets] Refusing secret file with unsafe permissions at ${path}`);
+    return null;
+  }
   const result = readJsonFile(path, SecretFileSchema);
   if (result.ok) return result.data;
-  logger.warn(`[provider-secrets] Ignoring invalid secret file ${path} (${result.reason})`);
-  return emptySecretFile();
+  logger.error(`[provider-secrets] Refusing invalid secret file ${path} (${result.reason})`);
+  return null;
 }
 
 function writePrivateFile(path: string, content: string): boolean {
   const temporaryPath = `${path}.${String(process.pid)}.tmp`;
   try {
-    writeFileSync(temporaryPath, content, { encoding: "utf8", mode: 0o600 });
-    chmodSync(temporaryPath, 0o600);
+    if (!ensurePrivateDirectorySync(dirname(path))) return false;
+    writeFileSync(temporaryPath, content, { encoding: "utf8", mode: PRIVATE_FILE_MODE });
+    if (!securePrivateFileSync(temporaryPath, true)) {
+      rmSync(temporaryPath, { force: true });
+      return false;
+    }
     renameSync(temporaryPath, path);
-    chmodSync(path, 0o600);
+    if (!securePrivateFileSync(path)) {
+      rmSync(path, { force: true });
+      return false;
+    }
     return true;
   } catch (error) {
     rmSync(temporaryPath, { force: true });
@@ -64,6 +72,10 @@ function writePrivateFile(path: string, content: string): boolean {
 function readKey(path: string): Buffer | null {
   try {
     if (!existsSync(path)) return null;
+    if (!securePrivateFileSync(path, true)) {
+      logger.error(`[provider-secrets] Refusing encryption key with unsafe permissions at ${path}`);
+      return null;
+    }
     const key = Buffer.from(readFileSync(path, "utf8").trim(), "base64");
     if (key.byteLength === KEY_BYTES) return key;
     logger.error(`[provider-secrets] Invalid encryption key at ${path}`);
@@ -126,9 +138,25 @@ function providerIdFromReference(reference: string): string | null {
 }
 
 export function createProviderSecretStore(directory: string): ProviderSecretStore {
-  mkdirSync(directory, { recursive: true });
   const keyPath = join(directory, "provider-secrets.key");
   const secretsPath = join(directory, "provider-secrets.json");
+  let existingFilesSecured = false;
+
+  function storageDirectoryIsPrivate(): boolean {
+    if (!ensurePrivateDirectorySync(directory)) {
+      logger.error(`[provider-secrets] Could not secure provider secret directory ${directory}`);
+      return false;
+    }
+    if (existingFilesSecured) return true;
+    for (const path of [keyPath, secretsPath]) {
+      if (existsSync(path) && !securePrivateFileSync(path, true)) {
+        logger.error(`[provider-secrets] Could not secure existing provider secret file ${path}`);
+        return false;
+      }
+    }
+    existingFilesSecured = true;
+    return true;
+  }
 
   function writeSecrets(data: SecretFile): boolean {
     return writePrivateFile(secretsPath, JSON.stringify(data, null, 2));
@@ -137,29 +165,40 @@ export function createProviderSecretStore(directory: string): ProviderSecretStor
   return {
     isReference: (value) => providerIdFromReference(value) !== null,
     write: (providerId, secret) => {
+      if (!storageDirectoryIsPrivate()) return null;
       const key = readOrCreateKey(keyPath, secretsPath);
       if (key === null) return null;
       const encrypted = encrypt(secret, key);
       if (encrypted === null) return null;
       const data = readSecretFile(secretsPath);
+      if (data === null) return null;
       const next = {
         ...data,
         secrets: { ...data.secrets, [providerId]: encrypted },
       };
       if (!writeSecrets(next)) return null;
-      return `${SECRET_REFERENCE_PREFIX}${providerId}`;
+      const reference = `${SECRET_REFERENCE_PREFIX}${providerId}`;
+      const persistedSecret = readSecretFile(secretsPath)?.secrets[providerId];
+      if (persistedSecret === undefined || decrypt(persistedSecret, key) !== secret) {
+        logger.error("[provider-secrets] Could not verify persisted provider secret");
+        return null;
+      }
+      return reference;
     },
     read: (reference) => {
+      if (!storageDirectoryIsPrivate()) return null;
       const providerId = providerIdFromReference(reference);
       if (providerId === null) return null;
       const key = readKey(keyPath);
       if (key === null) return null;
-      const encrypted = readSecretFile(secretsPath).secrets[providerId];
+      const encrypted = readSecretFile(secretsPath)?.secrets[providerId];
       if (encrypted === undefined) return null;
       return decrypt(encrypted, key);
     },
     delete: (providerId) => {
+      if (!storageDirectoryIsPrivate()) return;
       const data = readSecretFile(secretsPath);
+      if (data === null) return;
       if (data.secrets[providerId] === undefined) return;
       const nextSecrets = { ...data.secrets };
       delete nextSecrets[providerId];

package/src/proxy/providers.ts

@@ -1,16 +1,21 @@
 import { z } from "zod";
 import Conf from "conf";
 import { randomUUID } from "crypto";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { maskApiKey } from "../lib/mask";
 import { logger } from "./logger";
 import { getDataDir, hasExplicitDataDir } from "./dataDir";
 import {
   ProviderConfigSchema,
-  ProviderModelMetadataSchema,
+  ProviderModelMetadataListSchema,
+  ProviderModelNameSchema,
+  ProviderModelsSchema,
+  toRedactedProviderDto,
+  toRedactedProviderDtos,
   type ProviderConfig,
   type ProviderModelMetadata,
+  type RedactedProviderDto,
 } from "../lib/providerContract";
 import { withBuiltinProviderModelMetadata } from "../lib/providerModelMetadata";
 import {
@@ -18,6 +23,11 @@ import {
   secretValuesEqual,
   type ProviderSecretStore,
 } from "./providerSecretStore";
+import {
+  ensurePrivateDirectorySync,
+  PRIVATE_FILE_MODE,
+  securePrivateFileSync,
+} from "./privateDataPath";
 
 export { ProviderConfigSchema };
 export type { ProviderConfig };
@@ -55,8 +65,8 @@ const LegacyProviderConfigSchema = z.object({
   type: z.enum(["anthropic", "openai"]).optional(),
   format: z.enum(["anthropic", "openai"]).optional(),
   apiKey: z.string().optional(),
-  model: z.string().optional(),
-  models: z.array(z.string()).optional(),
+  model: ProviderModelNameSchema.optional(),
+  models: ProviderModelsSchema.optional(),
   baseUrl: z.string().optional(),
   anthropicBaseUrl: z.string().optional(),
   openaiBaseUrl: z.string().optional(),
@@ -64,7 +74,7 @@ const LegacyProviderConfigSchema = z.object({
   authHeader: z.enum(["bearer", "x-api-key"]).optional(),
   apiDocsUrl: z.string().optional(),
   modelMetadataUrl: z.string().optional(),
-  modelMetadata: z.array(ProviderModelMetadataSchema).optional(),
+  modelMetadata: ProviderModelMetadataListSchema.optional(),
   source: z.enum(["company", "personal"]).optional(),
   createdAt: z.string().optional(),
   updatedAt: z.string().optional(),
@@ -152,7 +162,10 @@ function migrateFromDataDirConfig(targetStore: Conf<ProvidersStore>, dataDirPath
     }
     if (migrated.length === 0) return;
 
-    targetStore.set("providers", migrated);
+    if (!persistProviders(migrated)) {
+      logger.warn(`[providers] Data-dir config migration left ${targetStore.path} unchanged`);
+      return;
+    }
     logger.info(
       `[providers] Migrated ${migrated.length} provider(s) from ${legacyConfigPath} to ${targetStore.path}`,
     );
@@ -189,10 +202,13 @@ function migrateFromLegacyConfLocation(targetStore: Conf<ProvidersStore>): void
     const legacyProviders = legacyStore.get("providers", []);
     if (legacyProviders.length === 0) return;
     const now = new Date().toISOString();
-    targetStore.set(
-      "providers",
-      legacyProviders.map((provider) => withBuiltinProviderModelMetadata(provider, now)),
+    const migrated = legacyProviders.map((provider) =>
+      withBuiltinProviderModelMetadata(provider, now),
     );
+    if (!persistProviders(migrated)) {
+      logger.warn(`[providers] Legacy migration left ${targetStore.path} unchanged`);
+      return;
+    }
     logger.info(
       `[providers] Migrated ${legacyProviders.length} provider(s) from ${legacyStore.path} to ${targetStore.path}`,
     );
@@ -210,11 +226,11 @@ const configPath = process.env["AGENT_INSPECTOR_CONFIG_PATH"];
 // We pass `cwd` so conf writes the file as `<cwd>/<configName>.<ext>`,
 // i.e. `<dataDir>/providers.json`. The runtime config lives at
 // `<dataDir>/config.json`; the different filenames keep the two stores
-// from overwriting each other. `mkdirSync(..., { recursive: true })` is
-// a no-op when the directory already exists.
+// from overwriting each other.
 const dataDir = getDataDir();
-if (configPath === undefined) {
-  mkdirSync(dataDir, { recursive: true });
+const providerDataDir = configPath === undefined ? dataDir : dirname(configPath);
+if (!ensurePrivateDirectorySync(providerDataDir)) {
+  logger.error(`[providers] Could not secure provider data directory ${providerDataDir}`);
 }
 
 export const store = new Conf<ProvidersStore>({
@@ -228,8 +244,39 @@ export const store = new Conf<ProvidersStore>({
 
 const providerSecretStore: ProviderSecretStore = createProviderSecretStore(dirname(store.path));
 
+function providerMetadataStorageIsPrivate(forceFile = false): boolean {
+  if (!ensurePrivateDirectorySync(dirname(store.path))) return false;
+  if (!existsSync(store.path)) return true;
+  return securePrivateFileSync(store.path, forceFile);
+}
+
+function writeProviderMetadata(providers: readonly ProviderConfig[]): boolean {
+  if (!providerMetadataStorageIsPrivate()) {
+    logger.error(`[providers] Refusing provider metadata write to unsafe path ${store.path}`);
+    return false;
+  }
+  try {
+    store.set("providers", [...providers]);
+  } catch (error) {
+    logger.error(`[providers] Could not persist provider metadata: ${String(error)}`);
+    return false;
+  }
+  if (securePrivateFileSync(store.path, true)) return true;
+  logger.error(`[providers] Could not secure provider metadata at ${store.path}`);
+  return false;
+}
+
+if (!providerMetadataStorageIsPrivate(true)) {
+  logger.error(`[providers] Provider metadata path is not private: ${store.path}`);
+}
+
 function providerWithResolvedSecret(provider: ProviderConfig): ProviderConfig | null {
-  if (!providerSecretStore.isReference(provider.apiKey)) return provider;
+  if (!providerSecretStore.isReference(provider.apiKey)) {
+    logger.error(
+      `[providers] Refusing plaintext secret for provider ${provider.id}; secure migration is required`,
+    );
+    return null;
+  }
   const apiKey = providerSecretStore.read(provider.apiKey);
   if (apiKey !== null) return { ...provider, apiKey };
   logger.error(`[providers] Secret is missing or unreadable for provider "${provider.name}"`);
@@ -239,7 +286,7 @@ function providerWithResolvedSecret(provider: ProviderConfig): ProviderConfig |
 function persistProviders(
   providers: readonly ProviderConfig[],
   removedProviderIds: ReadonlySet<string> = new Set(),
-): void {
+): boolean {
   const existingReferences = new Map<string, string>();
   const unresolvedRecords = new Map<string, ProviderConfig>();
   for (const candidate of store.get("providers", [])) {
@@ -252,41 +299,108 @@ function persistProviders(
     }
   }
 
-  const persisted = providers.map((provider) => {
+  const persisted: ProviderConfig[] = [];
+  for (const provider of providers) {
     const existingReference = existingReferences.get(provider.id);
     if (existingReference !== undefined) {
       const existingSecret = providerSecretStore.read(existingReference);
       if (existingSecret !== null && secretValuesEqual(existingSecret, provider.apiKey)) {
-        return { ...provider, apiKey: existingReference };
+        persisted.push({ ...provider, apiKey: existingReference });
+        continue;
       }
     }
 
     const reference = providerSecretStore.write(provider.id, provider.apiKey);
-    if (reference !== null) return { ...provider, apiKey: reference };
+    if (reference !== null) {
+      persisted.push({ ...provider, apiKey: reference });
+      continue;
+    }
     logger.error(
-      `[providers] SecretStore unavailable; provider "${provider.name}" remains in the legacy storage format`,
+      `[providers] Secret store unavailable; refusing to persist provider ${provider.id}`,
     );
-    return provider;
-  });
+    return false;
+  }
   const persistedIds = new Set(persisted.map((provider) => provider.id));
   for (const [id, provider] of unresolvedRecords) {
     if (!persistedIds.has(id) && !removedProviderIds.has(id)) persisted.push(provider);
   }
-  store.set("providers", persisted);
+  return writeProviderMetadata(persisted);
 }
 
-function migratePlaintextProviderSecrets(): void {
+function migratePlaintextProviderSecrets(): boolean {
   const raw = store.get("providers", []);
   let changed = false;
-  const migrated = raw.map((candidate) => {
+  const migrated: ProviderConfig[] = [];
+  for (const candidate of raw) {
     const parsed = ProviderConfigSchema.safeParse(candidate);
-    if (!parsed.success || providerSecretStore.isReference(parsed.data.apiKey)) return candidate;
+    if (!parsed.success) {
+      migrated.push(candidate);
+      continue;
+    }
+    if (providerSecretStore.isReference(parsed.data.apiKey)) {
+      migrated.push(parsed.data);
+      continue;
+    }
     const reference = providerSecretStore.write(parsed.data.id, parsed.data.apiKey);
-    if (reference === null) return candidate;
+    if (reference === null) {
+      logger.error(
+        `[providers] Could not migrate provider ${parsed.data.id} to secure storage; leaving the existing file unchanged`,
+      );
+      return false;
+    }
     changed = true;
-    return { ...parsed.data, apiKey: reference };
-  });
-  if (changed) store.set("providers", migrated);
+    migrated.push({ ...parsed.data, apiKey: reference });
+  }
+  if (!changed) return true;
+  if (writeProviderMetadata(migrated)) return true;
+  logger.error("[providers] Could not finish provider secret migration");
+  return false;
+}
+
+function sanitizeProviderBackupValue(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(sanitizeProviderBackupValue);
+  if (value === null || typeof value !== "object") return value;
+
+  return Object.fromEntries(
+    Object.entries(value).map(([key, entry]) => {
+      if (key === "apiKey" && typeof entry === "string") {
+        return [key, "redacted"];
+      }
+      return [key, sanitizeProviderBackupValue(entry)];
+    }),
+  );
+}
+
+function sanitizeProviderBackup(): void {
+  const backupPath = `${store.path}.bak`;
+  if (!existsSync(backupPath)) return;
+
+  const temporaryPath = `${backupPath}.${String(process.pid)}.tmp`;
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(backupPath, "utf-8"));
+    const sanitized = sanitizeProviderBackupValue(parsed);
+    writeFileSync(temporaryPath, JSON.stringify(sanitized, null, 2), {
+      encoding: "utf8",
+      mode: PRIVATE_FILE_MODE,
+    });
+    if (!securePrivateFileSync(temporaryPath, true)) {
+      rmSync(temporaryPath, { force: true });
+      rmSync(backupPath, { force: true });
+      logger.error("[providers] Removed provider backup after temporary permission failure");
+      return;
+    }
+    renameSync(temporaryPath, backupPath);
+    if (!securePrivateFileSync(backupPath, true)) {
+      rmSync(backupPath, { force: true });
+      logger.error("[providers] Removed provider backup after permission failure");
+    }
+  } catch (error) {
+    rmSync(temporaryPath, { force: true });
+    rmSync(backupPath, { force: true });
+    logger.error(
+      `[providers] Removed provider backup that could not be sanitized: ${String(error)}`,
+    );
+  }
 }
 
 // Older builds stored providers in `<dataDir>/config.json`. Migrate that
@@ -297,6 +411,8 @@ migrateFromDataDirConfig(store, dataDir);
 // already has data, when the user has set AGENT_INSPECTOR_CONFIG_PATH or
 // an explicit data dir, or when the legacy file is empty.
 migrateFromLegacyConfLocation(store);
+sanitizeProviderBackup();
+const providerSecretsReady = migratePlaintextProviderSecrets();
 
 /**
  * Expands the old `{ format, baseUrl }` representation into the matching
@@ -325,17 +441,17 @@ export function migrateProvider(p: ProviderConfig): ProviderConfig {
  * Migrates existing provider configs to preserve Anthropic and OpenAI routing URLs.
  */
 function migrateProviders(): void {
-  const providers = store.get("providers", []);
+  const providers = getProviders();
   const updated = providers.map(migrateProvider);
   const migrated = updated.some((p, i) => JSON.stringify(p) !== JSON.stringify(providers[i]));
 
   if (migrated) {
-    store.set("providers", updated);
+    void persistProviders(updated);
   }
 }
 
 // Run migration on module load
-migrateProviders();
+if (providerSecretsReady) migrateProviders();
 
 /**
  * Migrate: merge providers with identical API key and routing URLs.
@@ -343,7 +459,7 @@ migrateProviders();
  * value promoted to `models: [model]`.
  */
 function migrateMultiModel(): void {
-  const providers = store.get("providers", []);
+  const providers = getProviders();
   if (providers.length === 0) return;
   let changed = false;
 
@@ -400,18 +516,21 @@ function migrateMultiModel(): void {
   if (changed && merged.length > 0) {
     // Safety backup before writing
     try {
-      writeFileSync(`${store.path}.bak`, readFileSync(store.path, "utf-8"));
+      writeFileSync(`${store.path}.bak`, readFileSync(store.path, "utf-8"), {
+        mode: PRIVATE_FILE_MODE,
+      });
+      sanitizeProviderBackup();
     } catch {
       // best-effort, ignore
     }
-    store.set("providers", merged);
+    void persistProviders(merged);
   }
 }
 
-migrateMultiModel();
+if (providerSecretsReady) migrateMultiModel();
 
 function migrateBuiltinModelMetadata(): void {
-  const providers = store.get("providers", []);
+  const providers = getProviders();
   if (providers.length === 0) return;
 
   const now = new Date().toISOString();
@@ -421,11 +540,11 @@ function migrateBuiltinModelMetadata(): void {
   );
 
   if (changed) {
-    store.set("providers", updated);
+    void persistProviders(updated);
   }
 }
 
-migrateBuiltinModelMetadata();
+if (providerSecretsReady) migrateBuiltinModelMetadata();
 
 // Override with JSON env var if provided (for testing)
 const providersJson = process.env["AGENT_INSPECTOR_PROVIDERS_JSON"];
@@ -438,17 +557,13 @@ if (providersJson !== undefined) {
       const migrated = parsed.data
         .map(migrateProvider)
         .map((provider) => withBuiltinProviderModelMetadata(provider, now));
-      store.set("providers", migrated);
+      void persistProviders(migrated);
     }
   } catch {
     // Ignore invalid JSON
   }
 }
 
-// One-time, backwards-compatible migration. Existing plaintext keys are moved
-// out of providers.json; records retain only opaque references.
-migratePlaintextProviderSecrets();
-
 export function getProviders(): ProviderConfig[] {
   const raw = store.get("providers", []);
   // Validate the on-disk store entry-by-entry so a single corrupted record
@@ -480,15 +595,12 @@ export function getProvider(id: string): ProviderConfig | undefined {
   return providers.find((p) => p.id === id);
 }
 
-export function redactProvider(provider: ProviderConfig): ProviderConfig {
-  return {
-    ...provider,
-    apiKey: "configured",
-  };
+export function redactProvider(provider: ProviderConfig): RedactedProviderDto {
+  return toRedactedProviderDto(provider);
 }
 
-export function redactProviders(providers: readonly ProviderConfig[]): ProviderConfig[] {
-  return providers.map(redactProvider);
+export function redactProviders(providers: readonly ProviderConfig[]): RedactedProviderDto[] {
+  return toRedactedProviderDtos(providers);
 }
 
 /**
@@ -512,7 +624,7 @@ export function addProvider(
   modelMetadataUrl?: string,
   modelMetadata?: ProviderModelMetadata[],
   openaiResponsesBaseUrl?: string,
-): ProviderConfig {
+): ProviderConfig | null {
   const providers = getProviders();
   const normalizedKey = normalizeApiKey(apiKey);
   const resolvedAnthropicUrl =
@@ -546,7 +658,7 @@ export function addProvider(
     if (existingIndex >= 0) {
       providers[existingIndex] = enriched;
     }
-    persistProviders(providers);
+    if (!persistProviders(providers)) return null;
     return enriched;
   }
 
@@ -578,7 +690,7 @@ export function addProvider(
     now,
   );
   providers.push(newProvider);
-  persistProviders(providers);
+  if (!persistProviders(providers)) return null;
   return newProvider;
 }
 
@@ -626,7 +738,7 @@ export function updateProvider(
   );
   const index = providers.findIndex((p) => p.id === id);
   providers[index] = updated;
-  persistProviders(providers);
+  if (!persistProviders(providers)) return null;
   return updated;
 }
 
@@ -635,7 +747,7 @@ export function deleteProvider(id: string): boolean {
   const filtered = providers.filter((p) => p.id !== id);
   if (filtered.length === providers.length) return false;
 
-  persistProviders(filtered, new Set([id]));
+  if (!persistProviders(filtered, new Set([id]))) return false;
   providerSecretStore.delete(id);
   return true;
 }
@@ -733,12 +845,17 @@ export function importProviders(json: string): { imported: number; errors: strin
 
       newProviders.push(newProvider);
       existingKeys.add(key);
-      imported++;
     }
 
     // Single write: append all new providers at once
     if (newProviders.length > 0) {
-      persistProviders([...existingProviders, ...newProviders]);
+      if (!persistProviders([...existingProviders, ...newProviders])) {
+        return {
+          imported: 0,
+          errors: ["Secure provider storage is unavailable; no providers were imported"],
+        };
+      }
+      imported = newProviders.length;
     }
   } catch (err) {
     return {