agy-powerline 1.0.0 → 1.0.2

package/CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.2] - 2026-10-11
+
+### Security
+
+- On macOS and Linux, the config, `exec` cache, problem log and payload dump are now readable by your account only, and saving Antigravity's `settings.json` keeps its permissions. Run `agy-powerline init --yes` after updating to apply this to existing files (#11)
+
+## [1.0.1] - 2026-10-11
+
+### Fixed
+
+- WSL: the install notes and the Windows-Node error now recommend Node.js 20+ installed for your user (for example with nvm) instead of Ubuntu's often too old `/usr/bin/node` (#6)
+- The git widget's uncommitted-changes color no longer looks like the caution color in the `light-paper`, `light-sky`, `light-sunset`, `dark-onyx`, `dark-metro` and `colorblind-light` themes (#7)
+
 ## [1.0.0] - 2026-10-11
 
 First release of **agy-powerline**, a statusline for Google Antigravity's CLI (`agy`).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agy-powerline",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Interactive statusline for Google Antigravity",
   "bin": {
     "agy-powerline": "src/index.js"

package/src/cli/init.js

@@ -11,6 +11,7 @@ const {
   readSettingsForUpdate,
   settingsBackupPath,
   writeJsonSafely,
+  restrictPrivateFiles,
   isWindowsNodeOnWsl,
   windowsNodeOnWslMessage,
   cmdBreakingChars,
@@ -81,6 +82,7 @@ async function initCommand(options = {}) {
 
   try {
     fs.mkdirSync(installDir, { recursive: true });
+    restrictPrivateFiles(installDir);
 
     const destStatusline = path.join(installDir, "statusline.js");
     const destConfig = path.join(installDir, "statusline.config.json");

package/src/lib/config.js

@@ -6,7 +6,7 @@ const { resolveColorModeId } = require("./colors");
 const { resolveThemeId } = require("./themes");
 const { stripControl, normalizeClock } = require("./formatters");
 const { normalizePowerline } = require("./powerline");
-const { writeFileAtomic } = require("./paths");
+const { writeFileAtomic, PRIVATE_FILE_MODE } = require("./paths");
 
 // Display text in widget configs is printed as-is, so strip terminal control
 // from it. cmd/command are left alone: they are executed, not printed.
@@ -225,7 +225,9 @@ function saveConfig(config) {
     throw new InvalidConfigError(getConfigPath(), current.error);
   }
 
-  writeFileAtomic(getConfigPath(), JSON.stringify(mergeConfig(config), null, 2) + "\n");
+  writeFileAtomic(getConfigPath(), JSON.stringify(mergeConfig(config), null, 2) + "\n", {
+    mode: PRIVATE_FILE_MODE,
+  });
 }
 
 // Presets set the widget list only; the layout (Pills or Lines) stays the one

package/src/lib/exec.js

@@ -7,6 +7,7 @@ const crypto = require("crypto");
 const { execSync } = require("child_process");
 const { stripControl } = require("./formatters");
 const { logWarning } = require("./log");
+const { PRIVATE_FILE_MODE } = require("./paths");
 
 const DEFAULT_TIMEOUT_MS = 500;
 const DEFAULT_INTERVAL_SEC = 10;
@@ -54,7 +55,8 @@ function loadDiskCache() {
 
 // Several agy windows refresh at once, so the cache is written to a fresh temp
 // file and renamed into place: a reader never sees half a file. "wx" refuses a
-// file that already exists (or a planted link) in a shared temp folder.
+// file that already exists (or a planted link) in a shared temp folder, and the
+// file is owner-only because it holds the output of the user's commands.
 function saveDiskCache(cache) {
   let tmp = "";
   try {
@@ -64,7 +66,11 @@ function saveDiskCache(cache) {
       fs.mkdirSync(dir, { recursive: true });
     }
     tmp = `${file}.${process.pid}.${crypto.randomBytes(4).toString("hex")}.tmp`;
-    fs.writeFileSync(tmp, JSON.stringify(cache), { encoding: "utf8", flag: "wx" });
+    fs.writeFileSync(tmp, JSON.stringify(cache), {
+      encoding: "utf8",
+      flag: "wx",
+      mode: PRIVATE_FILE_MODE,
+    });
     fs.renameSync(tmp, file);
   } catch {
     // The cache is best effort: skip this write rather than risk a torn file.

package/src/lib/log.js

@@ -9,7 +9,7 @@
 const fs = require("fs");
 const os = require("os");
 const path = require("path");
-const { writeFileAtomic, readInstallMeta } = require("./paths");
+const { writeFileAtomic, readInstallMeta, PRIVATE_FILE_MODE } = require("./paths");
 const { stripControl } = require("./formatters");
 
 const LOG_NAME = "agy-powerline.log";
@@ -246,7 +246,7 @@ function logEvent(level, code, details = {}) {
       lines = lines.slice(1);
     }
 
-    writeFileAtomic(file, lines.join("\n") + "\n");
+    writeFileAtomic(file, lines.join("\n") + "\n", { mode: PRIVATE_FILE_MODE });
   } catch {
     // Read-only disk, full disk, permissions: the bar matters more.
   }

package/src/lib/paths.js

@@ -28,17 +28,25 @@ const RUNTIME_FILES = [
   path.join("layouts", "pills.js"),
 ];
 
+// Files that can hold the user's commands, their output or session details.
+// They are written readable by the owner only, so other accounts on a shared
+// machine can't read them (Windows profile folders are private already).
+const PRIVATE_FILES = [
+  "statusline.config.json",
+  ".exec-cache.json",
+  "last-payload.json",
+  // LOG_NAME in log.js, spelled out because log.js requires this file.
+  "agy-powerline.log",
+];
+const PRIVATE_FILE_MODE = 0o600;
+
 // Everything init or the runtime may create in the install dir. uninstall
 // --delete removes only these, never the whole directory tree.
 const INSTALLED_FILES = [
   "statusline.js",
   "statusline.cmd",
   INSTALL_META_NAME,
-  "statusline.config.json",
-  ".exec-cache.json",
-  "last-payload.json",
-  // LOG_NAME in log.js, spelled out because log.js requires this file.
-  "agy-powerline.log",
+  ...PRIVATE_FILES,
   ...RUNTIME_FILES,
 ];
 
@@ -81,9 +89,9 @@ function windowsNodeOnWslMessage(execPath = process.execPath) {
     "This Node binary is the Windows build (a /mnt/c/... path).",
     `  ${execPath}`,
     "Antigravity on Ubuntu/WSL needs Linux Node, or settings will get a Windows command.",
-    "Re-run with Linux Node:",
-    "  /usr/bin/node src/index.js init --yes",
-    "  /usr/bin/node $(which agy-powerline) init --yes",
+    "Install Node.js 20 or newer inside WSL (for example with nvm), then re-run:",
+    "  npm install -g agy-powerline",
+    "  agy-powerline init --yes",
   ].join("\n");
 }
 
@@ -238,11 +246,24 @@ function writeJsonSafely(file, data) {
 }
 
 // Writes via temp file + rename so an interrupted write cannot leave a
-// truncated file behind.
-function writeFileAtomic(file, body) {
+// truncated file behind. The new file gets `mode` when given, otherwise the
+// mode the existing file had, so rewriting a file never widens who can read
+// it (the rename would otherwise reset it to the default).
+function writeFileAtomic(file, body, { mode } = {}) {
   fs.mkdirSync(path.dirname(file), { recursive: true });
   const tmp = `${file}.${process.pid}.tmp`;
-  fs.writeFileSync(tmp, body, "utf8");
+  const target = process.platform === "win32" ? undefined : (mode ?? existingMode(file));
+  fs.writeFileSync(tmp, body, { encoding: "utf8", mode: target ?? 0o666 });
+  if (target !== undefined) {
+    // The mode passed to writeFileSync is reduced by the umask; set it exactly.
+    // Some filesystems (e.g. Windows drives under WSL) refuse chmod; the write
+    // still matters more.
+    try {
+      fs.chmodSync(tmp, target);
+    } catch {
+      // Keep the mode writeFileSync gave it.
+    }
+  }
 
   try {
     fs.renameSync(tmp, file);
@@ -253,6 +274,29 @@ function writeFileAtomic(file, body) {
   }
 }
 
+function existingMode(file) {
+  try {
+    return fs.statSync(file).mode & 0o777;
+  } catch {
+    return undefined;
+  }
+}
+
+// Installs made before the private-file change left these files readable by
+// everyone; init narrows them. Best effort: a file we can't chmod stays as is.
+function restrictPrivateFiles(installDir) {
+  if (process.platform === "win32") {
+    return;
+  }
+  for (const name of PRIVATE_FILES) {
+    try {
+      fs.chmodSync(path.join(installDir, name), PRIVATE_FILE_MODE);
+    } catch {
+      // Missing file, or not ours to change.
+    }
+  }
+}
+
 function removeSettingsFile(file = AGY_SETTINGS) {
   if (fs.existsSync(file)) {
     fs.copyFileSync(file, settingsBackupPath(file));
@@ -305,6 +349,9 @@ module.exports = {
   INSTALL_META_NAME,
   RUNTIME_FILES,
   INSTALLED_FILES,
+  PRIVATE_FILES,
+  PRIVATE_FILE_MODE,
+  restrictPrivateFiles,
   resolveInstallDir,
   isTrustedInstallDir,
   statuslineCommand,

package/src/lib/payload-dump.js

@@ -7,9 +7,9 @@
 // branch names become placeholders. A field Antigravity adds later is left
 // out until it is listed here.
 
-const fs = require("fs");
 const path = require("path");
 const { stripControl } = require("./formatters");
+const { writeFileAtomic, PRIVATE_FILE_MODE } = require("./paths");
 
 const NUMBER = "number";
 const BOOL = "boolean";
@@ -160,9 +160,9 @@ function writePayloadDump(target, rawInput) {
   }
 
   try {
-    const resolved = path.resolve(target);
-    fs.mkdirSync(path.dirname(resolved), { recursive: true });
-    fs.writeFileSync(resolved, JSON.stringify(body, null, 2) + "\n", "utf8");
+    writeFileAtomic(path.resolve(target), JSON.stringify(body, null, 2) + "\n", {
+      mode: PRIVATE_FILE_MODE,
+    });
   } catch {
     // Best-effort debug write; the bar matters more.
   }

package/src/lib/themes.js

@@ -10,11 +10,12 @@ const { parseColor } = require("./colors");
 // Most dark-* and light-* colors come from VS Code's default themes (Dark+
 // and Light+ syntax, git decorations, warning/error and terminal colors);
 // nocturne, onyx, metro and cream take their palettes from community themes
-// (credited below). A few colors are darkened or lightened, same hue, where
-// the contrast checks need it.
+// (credited below). A few colors are adjusted where the checks below need
+// it: darkened or lightened for contrast, and gitDirty moved toward orange so
+// a dirty branch never looks like the caution state.
 // Palettes are checked by tests/shared/themes.test.js: pill text and lines
-// text reach WCAG AA (4.5:1), and the ok / caution / danger states are
-// clearly different from each other.
+// text reach WCAG AA (4.5:1), the ok / caution / danger states are clearly
+// different from each other, and so are gitDirty and caution.
 //
 // Color roles:
 //   text      pill text                  track     empty dots in lines meters
@@ -152,7 +153,7 @@ const THEMES = {
     thirdParty: "#d19a66",
     context: "#61afef",
     git: "#abb2bf",
-    gitDirty: "#d19a66",
+    gitDirty: "#e88a50",
     meta: "#abb2bf",
     caution: "#e5c07b",
     warn: "#e1727b",
@@ -168,7 +169,7 @@ const THEMES = {
     thirdParty: "#ff9e64",
     context: "#7aa2f7",
     git: "#73daca",
-    gitDirty: "#ff9e64",
+    gitDirty: "#ff8b52",
     meta: "#a9b1d6",
     caution: "#e0af68",
     warn: "#f7768e",
@@ -183,7 +184,7 @@ const THEMES = {
     thirdParty: "#795e26",
     context: "#0451a5",
     git: "#001080",
-    gitDirty: "#895503",
+    gitDirty: "#b04a00",
     meta: "#3b3b3b",
     caution: "#8d6503",
     warn: "#cd3131",
@@ -198,7 +199,7 @@ const THEMES = {
     thirdParty: "#0070c1",
     context: "#005fb8",
     git: "#001080",
-    gitDirty: "#895503",
+    gitDirty: "#b04a00",
     meta: "#3b3b3b",
     caution: "#8d6503",
     warn: "#cd3131",
@@ -213,7 +214,7 @@ const THEMES = {
     thirdParty: "#795e26",
     context: "#0451a5",
     git: "#bc05bc",
-    gitDirty: "#895503",
+    gitDirty: "#b04a00",
     meta: "#616161",
     caution: "#8d6503",
     warn: "#cd3131",
@@ -268,7 +269,7 @@ const THEMES = {
       thirdParty: "#8a5200",
       context: "#2856a8",
       git: "#4e4596",
-      gitDirty: "#8a5200",
+      gitDirty: "#a64800",
       meta: "#4b5466",
       caution: "#876900",
       warn: "#87002d",