@tonyclaw/agent-inspector 3.0.29 → 3.0.31

package/src/proxy/logImportUpload.ts

@@ -0,0 +1,128 @@
+import { DEFAULT_LOG_IMPORT_LIMITS } from "./logImporter";
+
+const MAX_MULTIPART_OVERHEAD_BYTES = 1024 * 1024;
+
+export const MAX_LOG_IMPORT_REQUEST_BYTES =
+  DEFAULT_LOG_IMPORT_LIMITS.maxCompressedBytes + MAX_MULTIPART_OVERHEAD_BYTES;
+
+export type BoundedLogImportUpload =
+  | {
+      ok: true;
+      fileName: string;
+      data: Uint8Array;
+    }
+  | {
+      ok: false;
+      status: 400 | 413;
+      message: string;
+    };
+
+type BoundedBody =
+  | { ok: true; data: ArrayBuffer }
+  | { ok: false; status: 400 | 413; message: string };
+
+function declaredContentLength(value: string | null): number | null | "invalid" {
+  if (value === null) return null;
+  if (!/^[0-9]+$/.test(value)) return "invalid";
+  const parsed = Number.parseInt(value, 10);
+  return Number.isSafeInteger(parsed) ? parsed : "invalid";
+}
+
+async function readBoundedBody(request: Request, maxBytes: number): Promise<BoundedBody> {
+  const declaredBytes = declaredContentLength(request.headers.get("content-length"));
+  if (declaredBytes === "invalid") {
+    return { ok: false, status: 400, message: "Invalid Content-Length header" };
+  }
+  if (declaredBytes !== null && declaredBytes > maxBytes) {
+    return {
+      ok: false,
+      status: 413,
+      message: `Import request exceeds maximum size of ${String(maxBytes)} bytes.`,
+    };
+  }
+
+  const body = request.body;
+  if (body === null) {
+    return { ok: false, status: 400, message: "Expected multipart form data" };
+  }
+
+  const reader = body.getReader();
+  const chunks: Uint8Array[] = [];
+  let totalBytes = 0;
+  while (true) {
+    try {
+      const result = await reader.read();
+      if (result.done) break;
+
+      totalBytes += result.value.byteLength;
+      if (totalBytes > maxBytes) {
+        await reader.cancel();
+        return {
+          ok: false,
+          status: 413,
+          message: `Import request exceeds maximum size of ${String(maxBytes)} bytes.`,
+        };
+      }
+      chunks.push(result.value);
+    } catch {
+      return { ok: false, status: 400, message: "Failed to read import request" };
+    }
+  }
+
+  const data = new Uint8Array(totalBytes);
+  let offset = 0;
+  for (const chunk of chunks) {
+    data.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return { ok: true, data: data.buffer };
+}
+
+function isUploadedFile(value: FormDataEntryValue | null): value is File {
+  return value instanceof File;
+}
+
+export async function readBoundedLogImportUpload(
+  request: Request,
+  options: {
+    maxFileBytes?: number;
+    maxRequestBytes?: number;
+  } = {},
+): Promise<BoundedLogImportUpload> {
+  const contentType = request.headers.get("content-type");
+  if (contentType === null || !contentType.toLowerCase().startsWith("multipart/form-data")) {
+    return { ok: false, status: 400, message: "Expected multipart form data" };
+  }
+
+  const maxFileBytes = options.maxFileBytes ?? DEFAULT_LOG_IMPORT_LIMITS.maxCompressedBytes;
+  const maxRequestBytes = options.maxRequestBytes ?? MAX_LOG_IMPORT_REQUEST_BYTES;
+  const body = await readBoundedBody(request, maxRequestBytes);
+  if (!body.ok) return body;
+
+  let formData: FormData;
+  try {
+    formData = await new Response(body.data, {
+      headers: { "content-type": contentType },
+    }).formData();
+  } catch {
+    return { ok: false, status: 400, message: "Expected multipart form data" };
+  }
+
+  const upload = formData.get("file");
+  if (!isUploadedFile(upload)) {
+    return { ok: false, status: 400, message: "Missing import file" };
+  }
+  if (upload.size > maxFileBytes) {
+    return {
+      ok: false,
+      status: 413,
+      message: `Import file exceeds maximum size of ${String(maxFileBytes)} bytes.`,
+    };
+  }
+
+  return {
+    ok: true,
+    fileName: upload.name,
+    data: new Uint8Array(await upload.arrayBuffer()),
+  };
+}

package/src/proxy/logImporter.ts

@@ -15,16 +15,29 @@ import { analyzeToolSchemaWarnings } from "./toolSchemaWarnings";
 
 export type ImportedLogDraft = Omit<CapturedLog, "id">;
 
-// Maximum compressed size for a ZIP import (200 MB). Legitimate exports are
-// well under this; anything larger is almost certainly malicious.
-const MAX_ZIP_COMPRESSED_BYTES = 200 * 1024 * 1024;
-
-// Maximum total decompressed bytes within a single ZIP (500 MB). Prevents a
-// small "ZIP bomb" archive (a few MB compressed → hundreds of GB decompressed)
-// from exhausting memory. The ratio is checked against the compressed size of
-// the *archive*, not per-entry, since the archive size is the only hard cap
-// available before decompression begins.
-const MAX_ZIP_DECOMPRESSED_BYTES = 500 * 1024 * 1024;
+export type LogImportLimits = {
+  maxCompressedBytes: number;
+  maxEntries: number;
+  maxEntryUncompressedBytes: number;
+  maxTotalUncompressedBytes: number;
+  maxExpansionRatio: number;
+};
+
+export const DEFAULT_LOG_IMPORT_LIMITS: Readonly<LogImportLimits> = {
+  maxCompressedBytes: 200 * 1024 * 1024,
+  maxEntries: 10_000,
+  maxEntryUncompressedBytes: 128 * 1024 * 1024,
+  maxTotalUncompressedBytes: 500 * 1024 * 1024,
+  maxExpansionRatio: 100,
+};
+
+const ZIP_END_OF_CENTRAL_DIRECTORY_SIGNATURE = 0x06054b50;
+const ZIP_CENTRAL_DIRECTORY_SIGNATURE = 0x02014b50;
+const ZIP_END_OF_CENTRAL_DIRECTORY_BYTES = 22;
+const ZIP_CENTRAL_DIRECTORY_HEADER_BYTES = 46;
+const ZIP_MAX_COMMENT_BYTES = 0xffff;
+const ZIP_16_BIT_SENTINEL = 0xffff;
+const ZIP_32_BIT_SENTINEL = 0xffffffff;
 
 export type ParsedLogImport =
   | {
@@ -58,6 +71,17 @@ const StreamingChunksImportSchema = z.object({
 
 type ParsedManifest = z.infer<typeof ManifestSchema>;
 
+type ZipBudget = {
+  remainingBytes: number;
+  decompressedBytes: number;
+  compressedBytes: number;
+  limits: Readonly<LogImportLimits>;
+};
+
+type ZipTextResult = { ok: true; text: string | null } | { ok: false; message: string };
+
+type ZipDirectoryInspection = { ok: true } | { ok: false; message: string };
+
 const SEMVER_MAJOR_PATTERN = /^([0-9]+)\.[0-9]+\.[0-9]+(?:[-+].*)?$/;
 
 function readRecordProperty(value: unknown, name: string): unknown {
@@ -300,33 +324,249 @@ function legacyDraftFromParts(input: {
   });
 }
 
+function zipEntryLimitMessage(path: string, maxBytes: number): string {
+  return `Archive entry "${path}" exceeds maximum uncompressed size of ${String(maxBytes)} bytes.`;
+}
+
+function zipTotalLimitMessage(maxBytes: number): string {
+  return `Archive exceeds maximum total uncompressed size of ${String(maxBytes)} bytes.`;
+}
+
+function zipExpansionLimitMessage(maxRatio: number): string {
+  return `Archive exceeds maximum expansion ratio of ${String(maxRatio)}:1.`;
+}
+
+function exceedsExpansionRatio(
+  uncompressedBytes: number,
+  compressedBytes: number,
+  maxRatio: number,
+): boolean {
+  if (uncompressedBytes === 0) return false;
+  if (compressedBytes === 0) return true;
+  return uncompressedBytes > compressedBytes * maxRatio;
+}
+
+function findEndOfCentralDirectory(data: Uint8Array, view: DataView): number | null {
+  const firstCandidate = Math.max(
+    0,
+    data.byteLength - ZIP_END_OF_CENTRAL_DIRECTORY_BYTES - ZIP_MAX_COMMENT_BYTES,
+  );
+  for (
+    let offset = data.byteLength - ZIP_END_OF_CENTRAL_DIRECTORY_BYTES;
+    offset >= firstCandidate;
+    offset -= 1
+  ) {
+    if (view.getUint32(offset, true) !== ZIP_END_OF_CENTRAL_DIRECTORY_SIGNATURE) continue;
+    const commentBytes = view.getUint16(offset + 20, true);
+    if (offset + ZIP_END_OF_CENTRAL_DIRECTORY_BYTES + commentBytes === data.byteLength) {
+      return offset;
+    }
+  }
+  return null;
+}
+
 /**
- * Reads a file from the ZIP as UTF-8 text. Decrements `remaining.bytes` by the
- * decoded byte size; callers check `remaining.bytes < 0` after the call to
- * detect that the cumulative decompressed size has blown the budget (a
- * zip-bomb signal). We do NOT throw on budget exceeded because the project's
- * lint rules forbid throwing inside non-CLI modules — using a mutable
- * counter keeps the budget check declarative at every call site.
+ * JSZip does not expose declared entry sizes. Inspect the central directory so
+ * hostile archives are rejected before an inflater or JSON parser runs.
  */
-async function readZipText(
-  zip: JSZip,
-  path: string,
-  remaining: { bytes: number },
-): Promise<string | null> {
+function inspectZipDirectory(
+  data: Uint8Array,
+  limits: Readonly<LogImportLimits>,
+): ZipDirectoryInspection {
+  if (data.byteLength < ZIP_END_OF_CENTRAL_DIRECTORY_BYTES) {
+    return { ok: false, message: "Invalid ZIP archive: central directory was not found." };
+  }
+
+  const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+  const endOffset = findEndOfCentralDirectory(data, view);
+  if (endOffset === null) {
+    return { ok: false, message: "Invalid ZIP archive: central directory was not found." };
+  }
+
+  const diskNumber = view.getUint16(endOffset + 4, true);
+  const centralDirectoryDisk = view.getUint16(endOffset + 6, true);
+  const entriesOnDisk = view.getUint16(endOffset + 8, true);
+  const entryCount = view.getUint16(endOffset + 10, true);
+  const directoryBytes = view.getUint32(endOffset + 12, true);
+  const directoryOffset = view.getUint32(endOffset + 16, true);
+
+  if (
+    diskNumber !== 0 ||
+    centralDirectoryDisk !== 0 ||
+    entriesOnDisk !== entryCount ||
+    entryCount === ZIP_16_BIT_SENTINEL ||
+    directoryBytes === ZIP_32_BIT_SENTINEL ||
+    directoryOffset === ZIP_32_BIT_SENTINEL
+  ) {
+    return { ok: false, message: "ZIP64 and split archives are not supported for log import." };
+  }
+  if (entryCount > limits.maxEntries) {
+    return {
+      ok: false,
+      message: `Archive contains more than ${String(limits.maxEntries)} entries.`,
+    };
+  }
+
+  const directoryEnd = directoryOffset + directoryBytes;
+  if (directoryEnd > endOffset || directoryEnd > data.byteLength) {
+    return { ok: false, message: "Invalid ZIP archive: central directory is out of bounds." };
+  }
+
+  let offset = directoryOffset;
+  let totalCompressedBytes = 0;
+  let totalUncompressedBytes = 0;
+  for (let index = 0; index < entryCount; index += 1) {
+    if (
+      offset + ZIP_CENTRAL_DIRECTORY_HEADER_BYTES > directoryEnd ||
+      view.getUint32(offset, true) !== ZIP_CENTRAL_DIRECTORY_SIGNATURE
+    ) {
+      return { ok: false, message: "Invalid ZIP archive: malformed central directory entry." };
+    }
+
+    const flags = view.getUint16(offset + 8, true);
+    const compressedBytes = view.getUint32(offset + 20, true);
+    const uncompressedBytes = view.getUint32(offset + 24, true);
+    const fileNameBytes = view.getUint16(offset + 28, true);
+    const extraBytes = view.getUint16(offset + 30, true);
+    const commentBytes = view.getUint16(offset + 32, true);
+    const localHeaderOffset = view.getUint32(offset + 42, true);
+    const entryEnd =
+      offset + ZIP_CENTRAL_DIRECTORY_HEADER_BYTES + fileNameBytes + extraBytes + commentBytes;
+
+    if (
+      compressedBytes === ZIP_32_BIT_SENTINEL ||
+      uncompressedBytes === ZIP_32_BIT_SENTINEL ||
+      localHeaderOffset === ZIP_32_BIT_SENTINEL
+    ) {
+      return { ok: false, message: "ZIP64 archives are not supported for log import." };
+    }
+    if ((flags & 0x1) !== 0) {
+      return { ok: false, message: "Encrypted ZIP entries are not supported for log import." };
+    }
+    if (entryEnd > directoryEnd || localHeaderOffset >= directoryOffset) {
+      return { ok: false, message: "Invalid ZIP archive: entry metadata is out of bounds." };
+    }
+    if (uncompressedBytes > limits.maxEntryUncompressedBytes) {
+      return {
+        ok: false,
+        message: zipEntryLimitMessage(
+          `entry ${String(index + 1)}`,
+          limits.maxEntryUncompressedBytes,
+        ),
+      };
+    }
+    if (exceedsExpansionRatio(uncompressedBytes, compressedBytes, limits.maxExpansionRatio)) {
+      return { ok: false, message: zipExpansionLimitMessage(limits.maxExpansionRatio) };
+    }
+
+    totalCompressedBytes += compressedBytes;
+    totalUncompressedBytes += uncompressedBytes;
+    if (totalUncompressedBytes > limits.maxTotalUncompressedBytes) {
+      return { ok: false, message: zipTotalLimitMessage(limits.maxTotalUncompressedBytes) };
+    }
+    if (
+      exceedsExpansionRatio(totalUncompressedBytes, totalCompressedBytes, limits.maxExpansionRatio)
+    ) {
+      return { ok: false, message: zipExpansionLimitMessage(limits.maxExpansionRatio) };
+    }
+
+    offset = entryEnd;
+  }
+
+  if (offset !== directoryEnd) {
+    return { ok: false, message: "Invalid ZIP archive: central directory size is inconsistent." };
+  }
+  return { ok: true };
+}
+
+function bufferFromZipChunk(chunk: unknown): Buffer | null {
+  if (Buffer.isBuffer(chunk)) return chunk;
+  if (chunk instanceof Uint8Array) return Buffer.from(chunk);
+  return null;
+}
+
+async function readZipText(zip: JSZip, path: string, budget: ZipBudget): Promise<ZipTextResult> {
   const file = zip.file(path);
-  if (file === null) return null;
-  const text = await file.async("text");
-  remaining.bytes -= Buffer.byteLength(text, "utf8");
-  return text;
+  if (file === null) return { ok: true, text: null };
+
+  return await new Promise((resolve) => {
+    const chunks: Buffer[] = [];
+    const stream = file.nodeStream("nodebuffer");
+    let entryBytes = 0;
+    let settled = false;
+
+    const settle = (result: ZipTextResult): void => {
+      if (settled) return;
+      settled = true;
+      resolve(result);
+    };
+
+    stream.on("data", (chunk: unknown) => {
+      if (settled) return;
+      const buffer = bufferFromZipChunk(chunk);
+      if (buffer === null) {
+        stream.pause();
+        settle({ ok: false, message: `Archive entry "${path}" produced invalid data.` });
+        return;
+      }
+
+      entryBytes += buffer.byteLength;
+      if (entryBytes > budget.limits.maxEntryUncompressedBytes) {
+        stream.pause();
+        settle({
+          ok: false,
+          message: zipEntryLimitMessage(path, budget.limits.maxEntryUncompressedBytes),
+        });
+        return;
+      }
+      if (buffer.byteLength > budget.remainingBytes) {
+        stream.pause();
+        settle({
+          ok: false,
+          message: zipTotalLimitMessage(budget.limits.maxTotalUncompressedBytes),
+        });
+        return;
+      }
+      const decompressedBytes = budget.decompressedBytes + buffer.byteLength;
+      if (
+        exceedsExpansionRatio(
+          decompressedBytes,
+          budget.compressedBytes,
+          budget.limits.maxExpansionRatio,
+        )
+      ) {
+        stream.pause();
+        settle({
+          ok: false,
+          message: zipExpansionLimitMessage(budget.limits.maxExpansionRatio),
+        });
+        return;
+      }
+
+      budget.remainingBytes -= buffer.byteLength;
+      budget.decompressedBytes = decompressedBytes;
+      chunks.push(buffer);
+    });
+    stream.on("error", (error: unknown) => {
+      settle({
+        ok: false,
+        message: error instanceof Error ? error.message : `Failed to decompress "${path}".`,
+      });
+    });
+    stream.on("end", () => {
+      settle({ ok: true, text: Buffer.concat(chunks, entryBytes).toString("utf8") });
+    });
+  });
 }
 
 async function readManifest(
   zip: JSZip,
-  remaining: { bytes: number },
-): Promise<ParsedManifest | null> {
-  const text = await readZipText(zip, "manifest.json", remaining);
-  const parsed = ManifestSchema.safeParse(parseJson(text));
-  return parsed.success ? parsed.data : null;
+  budget: ZipBudget,
+): Promise<{ ok: true; manifest: ParsedManifest | null } | { ok: false; message: string }> {
+  const result = await readZipText(zip, "manifest.json", budget);
+  if (!result.ok) return result;
+  const parsed = ManifestSchema.safeParse(parseJson(result.text));
+  return { ok: true, manifest: parsed.success ? parsed.data : null };
 }
 
 function versionMajor(version: string): number | null {
@@ -387,24 +627,25 @@ function validateManifestVersion(manifest: ParsedManifest | null):
   return { ok: true, warning: null };
 }
 
-function bombError(warnings: string[] = []): ParsedLogImport {
-  return {
-    ok: false,
-    message: `Archive decompresses to more than ${MAX_ZIP_DECOMPRESSED_BYTES} bytes.`,
-    warnings,
-  };
-}
-
-async function parseZipLogImport(data: Uint8Array): Promise<ParsedLogImport> {
+async function parseZipLogImport(
+  data: Uint8Array,
+  limits: Readonly<LogImportLimits>,
+): Promise<ParsedLogImport> {
   const warnings: string[] = [];
-  const zip = await JSZip.loadAsync(data);
+  const inspection = inspectZipDirectory(data, limits);
+  if (!inspection.ok) return { ...inspection, warnings };
 
-  // Tracks remaining budget for decompressed bytes. Decremented on every read;
-  // any read that pushes it below zero marks the archive as a zip bomb.
-  const remaining = { bytes: MAX_ZIP_DECOMPRESSED_BYTES };
+  const zip = await JSZip.loadAsync(data);
+  const budget: ZipBudget = {
+    remainingBytes: limits.maxTotalUncompressedBytes,
+    decompressedBytes: 0,
+    compressedBytes: data.byteLength,
+    limits,
+  };
 
-  const manifest = await readManifest(zip, remaining);
-  if (remaining.bytes < 0) return bombError();
+  const manifestResult = await readManifest(zip, budget);
+  if (!manifestResult.ok) return { ...manifestResult, warnings };
+  const manifest = manifestResult.manifest;
   const versionCheck = validateManifestVersion(manifest);
   if (!versionCheck.ok) {
     return {
@@ -422,28 +663,30 @@ async function parseZipLogImport(data: Uint8Array): Promise<ParsedLogImport> {
     warnings.push("Imported redacted export. Secrets and some replay details may be unavailable.");
   }
 
-  const metadataText = await readZipText(zip, "logs.json", remaining);
-  if (remaining.bytes < 0) return bombError(warnings);
-  const metadataLogs = metadataText === null ? null : parseJsonLogs(metadataText);
+  const metadataResult = await readZipText(zip, "logs.json", budget);
+  if (!metadataResult.ok) return { ...metadataResult, warnings };
+  const metadataLogs = metadataResult.text === null ? null : parseJsonLogs(metadataResult.text);
   const logs: ImportedLogDraft[] = [];
   let skipped = 0;
 
   if (metadataLogs !== null) {
     for (const log of metadataLogs) {
-      const requestText = await readZipText(zip, `#${String(log.id)}.Request.json`, remaining);
-      const responseText = await readZipText(zip, `#${String(log.id)}.Response.json`, remaining);
-      const streamingText = await readZipText(
+      const requestResult = await readZipText(zip, `#${String(log.id)}.Request.json`, budget);
+      if (!requestResult.ok) return { ...requestResult, warnings };
+      const responseResult = await readZipText(zip, `#${String(log.id)}.Response.json`, budget);
+      if (!responseResult.ok) return { ...responseResult, warnings };
+      const streamingResult = await readZipText(
         zip,
         `#${String(log.id)}.SSE.Response.json`,
-        remaining,
+        budget,
       );
-      if (remaining.bytes < 0) return bombError(warnings);
+      if (!streamingResult.ok) return { ...streamingResult, warnings };
       logs.push(
         draftFromCapturedLog(
           log,
-          requestText,
-          responseText,
-          streamingChunksFromText(streamingText),
+          requestResult.text,
+          responseResult.text,
+          streamingChunksFromText(streamingResult.text),
         ),
       );
     }
@@ -451,24 +694,30 @@ async function parseZipLogImport(data: Uint8Array): Promise<ParsedLogImport> {
   }
 
   for (const originalId of manifest?.logIds ?? []) {
-    const requestText = await readZipText(zip, `#${String(originalId)}.Request.json`, remaining);
-    const responseText = await readZipText(zip, `#${String(originalId)}.Response.json`, remaining);
-    const streamingText = await readZipText(
+    const requestResult = await readZipText(zip, `#${String(originalId)}.Request.json`, budget);
+    if (!requestResult.ok) return { ...requestResult, warnings };
+    const responseResult = await readZipText(zip, `#${String(originalId)}.Response.json`, budget);
+    if (!responseResult.ok) return { ...responseResult, warnings };
+    const streamingResult = await readZipText(
       zip,
       `#${String(originalId)}.SSE.Response.json`,
-      remaining,
+      budget,
     );
-    if (remaining.bytes < 0) return bombError(warnings);
-    if (requestText === null && responseText === null && streamingText === null) {
+    if (!streamingResult.ok) return { ...streamingResult, warnings };
+    if (
+      requestResult.text === null &&
+      responseResult.text === null &&
+      streamingResult.text === null
+    ) {
       skipped += 1;
       continue;
     }
     logs.push(
       legacyDraftFromParts({
         exportedAt,
-        requestText,
-        responseText,
-        streamingChunks: streamingChunksFromText(streamingText),
+        requestText: requestResult.text,
+        responseText: responseResult.text,
+        streamingChunks: streamingChunksFromText(streamingResult.text),
       }),
     );
   }
@@ -521,23 +770,25 @@ function parseTextLogImport(text: string): ParsedLogImport {
 export async function parseImportedLogFile(input: {
   fileName: string;
   data: Uint8Array;
+  limits?: Readonly<LogImportLimits>;
 }): Promise<ParsedLogImport> {
+  const limits = input.limits ?? DEFAULT_LOG_IMPORT_LIMITS;
   try {
     if (looksLikeZip(input.data, input.fileName)) {
-      if (input.data.byteLength > MAX_ZIP_COMPRESSED_BYTES) {
+      if (input.data.byteLength > limits.maxCompressedBytes) {
         return {
           ok: false,
-          message: `Archive exceeds maximum size of ${MAX_ZIP_COMPRESSED_BYTES} bytes.`,
+          message: `Archive exceeds maximum compressed size of ${String(limits.maxCompressedBytes)} bytes.`,
           warnings: [],
         };
       }
-      return await parseZipLogImport(input.data);
+      return await parseZipLogImport(input.data, limits);
     }
 
-    if (input.data.byteLength > MAX_ZIP_COMPRESSED_BYTES) {
+    if (input.data.byteLength > limits.maxCompressedBytes) {
       return {
         ok: false,
-        message: `Import file exceeds maximum size of ${MAX_ZIP_COMPRESSED_BYTES} bytes.`,
+        message: `Import file exceeds maximum size of ${String(limits.maxCompressedBytes)} bytes.`,
         warnings: [],
       };
     }

package/src/proxy/logIndex.ts

@@ -1,4 +1,4 @@
-import { readFile, writeFile, stat, readdir, mkdir } from "node:fs/promises";
+import { readFile, writeFile, stat, readdir } from "node:fs/promises";
 import { createReadStream, existsSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { createInterface } from "node:readline";
@@ -14,6 +14,11 @@ import {
   syncSqliteLogIndexEntries,
   upsertSqliteLogIndexEntry,
 } from "./sqliteLogIndex";
+import {
+  ensurePrivateDirectorySync,
+  PRIVATE_FILE_MODE,
+  securePrivateFileSync,
+} from "./privateDataPath";
 
 export type LogIndexSummary = {
   id: number;
@@ -176,14 +181,19 @@ export async function saveIndex(index: LogIndex): Promise<void> {
   const indexPath = getIndexPath();
   const dir = dirname(indexPath);
 
-  try {
-    await mkdir(dir, { recursive: true });
-  } catch {
-    // Ignore
+  if (!ensurePrivateDirectorySync(dir)) {
+    logger.error("[logIndex] Failed to secure index directory:", dir);
+    return;
   }
 
   try {
-    await writeFile(indexPath, JSON.stringify(index), "utf-8");
+    await writeFile(indexPath, JSON.stringify(index), {
+      encoding: "utf-8",
+      mode: PRIVATE_FILE_MODE,
+    });
+    if (!securePrivateFileSync(indexPath)) {
+      logger.error("[logIndex] Failed to secure index file:", indexPath);
+    }
   } catch (err) {
     logger.error("[logIndex] Failed to save index:", String(err));
   }