@wrongstack/core 0.7.4 → 0.7.6

package/dist/types/index.js

@@ -424,7 +424,9 @@ var DefaultSecretVault = class {
     try {
       const buf = fs2.readFileSync(this.keyFile);
       if (buf.length !== KEY_BYTES) {
-        throw new Error(`SecretVault: key file ${this.keyFile} has wrong size`);
+        throw new Error(
+          `SecretVault: key file ${this.keyFile} is ${buf.length} bytes (expected ${KEY_BYTES}). Remove it manually to generate a new key.`
+        );
       }
       this.key = buf;
       return this.key;
@@ -439,7 +441,9 @@ var DefaultSecretVault = class {
       if (err.code !== "EEXIST") throw err;
       const buf = fs2.readFileSync(this.keyFile);
       if (buf.length !== KEY_BYTES) {
-        throw new Error(`SecretVault: key file ${this.keyFile} has wrong size`);
+        throw new Error(
+          `SecretVault: key file ${this.keyFile} is ${buf.length} bytes (expected ${KEY_BYTES}). Remove it manually to generate a new key.`
+        );
       }
       this.key = buf;
       return this.key;
@@ -500,10 +504,7 @@ async function rewriteConfigEncrypted(configPath, vault, patch) {
   const encrypted = encryptConfigSecrets(merged, vault);
   await fs.mkdir(path4.dirname(configPath), { recursive: true });
   await atomicWrite(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
-  try {
-    await fs.chmod(configPath, 384);
-  } catch {
-  }
+  await restrictFilePermissions(configPath);
 }
 async function migratePlaintextSecrets(configPath, vault) {
   let raw;
@@ -522,12 +523,26 @@ async function migratePlaintextSecrets(configPath, vault) {
   const migrated = walkCount(parsed, vault, counter);
   if (counter.n === 0) return { migrated: 0, file: configPath };
   await atomicWrite(configPath, JSON.stringify(migrated, null, 2), { mode: 384 });
-  try {
-    await fs.chmod(configPath, 384);
-  } catch {
-  }
+  await restrictFilePermissions(configPath);
   return { migrated: counter.n, file: configPath };
 }
+async function restrictFilePermissions(filePath) {
+  if (process.platform === "win32") {
+    try {
+      const { execFile } = await import('child_process');
+      const { promisify } = await import('util');
+      const execFileAsync = promisify(execFile);
+      await execFileAsync("icacls", [filePath, "/inheritance:r", "/grant:r", `${process.env.USERNAME}:(F)`]);
+    } catch {
+      console.warn(`[secret-vault] Could not restrict permissions on ${filePath} \u2014 config file may be readable by other users on this system.`);
+    }
+  } else {
+    try {
+      await fs.chmod(filePath, 384);
+    } catch {
+    }
+  }
+}
 function walkCount(node, vault, counter) {
   if (node === null || node === void 0) return node;
   if (typeof node !== "object") return node;