agenticmail 0.5.32 → 0.5.34

package/dist/cli.js

@@ -4235,6 +4235,10 @@ function fail2(msg) {
 function info2(msg) {
   console.log(`  ${c2.dim(msg)}`);
 }
+function maskSecret(secret) {
+  if (secret.length <= 12) return "****";
+  return secret.slice(0, 4) + "\u2026" + secret.slice(-4);
+}
 var SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
 var LOADING_MESSAGES = {
   docker: [
@@ -4510,12 +4514,15 @@ async function startApiServer(config) {
 }
 async function killProcessOnPort(port) {
   try {
-    const { execSync } = await import("child_process");
-    const pids = execSync(`lsof -ti :${port}`, { timeout: 5e3, stdio: ["ignore", "pipe", "ignore"] }).toString().trim().split("\n").filter(Boolean);
+    const { execFileSync } = await import("child_process");
+    const pids = execFileSync("lsof", ["-ti", `:${port}`], { timeout: 5e3, stdio: ["ignore", "pipe", "ignore"] }).toString().trim().split("\n").filter(Boolean);
     for (const pid of pids) {
-      try {
-        process.kill(parseInt(pid, 10), "SIGTERM");
-      } catch {
+      const n = parseInt(pid, 10);
+      if (!isNaN(n) && n > 0) {
+        try {
+          process.kill(n, "SIGTERM");
+        } catch {
+        }
       }
     }
   } catch {
@@ -4821,7 +4828,7 @@ async function cmdSetup() {
           log2("");
           info2("You can set up email later by running: " + c2.green("npx agenticmail setup"));
           log2("");
-          log2(`  ${c2.dim("Your secret key:")}  ${c2.yellow(result.config.masterKey)}`);
+          log2(`  ${c2.dim("Your secret key:")}  ${c2.yellow(maskSecret(result.config.masterKey))}`);
           log2(`  ${c2.dim("Settings saved:")}   ${c2.cyan(result.configPath)}`);
           log2("");
           process.exit(0);
@@ -4975,7 +4982,7 @@ function printSummary(result, exitAfter) {
   log2("");
   log2(`  Here are your details (save these somewhere safe):`);
   log2("");
-  log2(`  ${c2.dim("Your secret key:")}  ${c2.yellow(result.config.masterKey)}`);
+  log2(`  ${c2.dim("Your secret key:")}  ${c2.yellow(maskSecret(result.config.masterKey))}`);
   log2(`  ${c2.dim("Settings saved:")}   ${c2.cyan(result.configPath)}`);
   log2(`  ${c2.dim("Server address:")}   ${c2.cyan(`http://${result.config.api.host}:${result.config.api.port}`)}`);
   log2("");
@@ -5211,7 +5218,7 @@ async function setupRelay(config, previous) {
         log2("");
         ok2(`Your AI agent ${c2.bold('"' + data.agent.name + '"')} is ready!`);
         log2(`    ${c2.dim("Agent email:")} ${c2.cyan(data.agent.subAddress)}`);
-        log2(`    ${c2.dim("Agent key:")}   ${c2.yellow(data.agent.apiKey)}`);
+        log2(`    ${c2.dim("Agent key:")}   ${c2.yellow(maskSecret(data.agent.apiKey))}`);
         log2("");
         info2("People can email your agent at the address above.");
         await sendWelcomeEmail(apiBase, data.agent.apiKey, relayInfo.email, data.agent.name, data.agent.subAddress);
@@ -6173,9 +6180,9 @@ async function cmdOpenClaw() {
     log2(`  ${c2.dim("Agent:")}       ${c2.bold(agentName)} (${c2.cyan(agentEmail)})`);
   }
   if (agentApiKey) {
-    log2(`  ${c2.dim("API Key:")}     ${c2.yellow(agentApiKey)}`);
+    log2(`  ${c2.dim("API Key:")}     ${c2.yellow(maskSecret(agentApiKey))}`);
   }
-  log2(`  ${c2.dim("Master Key:")}  ${c2.yellow(config.masterKey)}`);
+  log2(`  ${c2.dim("Master Key:")}  ${c2.yellow(maskSecret(config.masterKey))}`);
   log2(`  ${c2.dim("Server:")}      ${c2.cyan(apiBase)}`);
   let smsPhone = "";
   if (agentApiKey) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agenticmail",
-  "version": "0.5.32",
+  "version": "0.5.34",
   "description": "Email and SMS infrastructure for AI agents \u2014 the first platform to give agents real email addresses and phone numbers",
   "type": "module",
   "main": "dist/index.js",

package/scripts/uninstall.mjs

@@ -10,7 +10,7 @@
  */
 
 import { execSync, execFileSync } from 'node:child_process';
-import { readFileSync, writeFileSync, existsSync, rmSync, unlinkSync } from 'node:fs';
+import { readFileSync, writeFileSync, existsSync, rmSync, unlinkSync, lstatSync, realpathSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir, platform } from 'node:os';
 
@@ -91,8 +91,22 @@ if (existsSync(openclawConfig)) {
 
 const dataDir = join(home, '.agenticmail');
 if (existsSync(dataDir)) {
-  log('Removing ~/.agenticmail/ ...');
-  try { rmSync(dataDir, { recursive: true, force: true }); } catch { /* ignore */ }
+  // Safety: verify it's not a symlink pointing outside home (symlink attack prevention)
+  try {
+    const stat = lstatSync(dataDir);
+    if (stat.isSymbolicLink()) {
+      const realPath = realpathSync(dataDir);
+      if (!realPath.startsWith(home)) {
+        log(`WARNING: ~/.agenticmail is a symlink to ${realPath} (outside home dir) — skipping removal`);
+      } else {
+        log('Removing ~/.agenticmail/ (symlink) ...');
+        try { rmSync(dataDir, { recursive: true, force: true }); } catch { /* ignore */ }
+      }
+    } else {
+      log('Removing ~/.agenticmail/ ...');
+      try { rmSync(dataDir, { recursive: true, force: true }); } catch { /* ignore */ }
+    }
+  } catch { /* stat failed — skip */ }
 }
 
 log('Uninstall complete.');