ai-agent-config 2.7.0 → 2.7.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-agent-config",
-  "version": "2.7.0",
+  "version": "2.7.1",
   "description": "Universal skill & workflow manager for AI coding assistants with bi-directional GitHub sync",
   "main": "index.js",
   "bin": {

package/scripts/mcp-installer.js

@@ -167,6 +167,15 @@ function writeMcpToPlatformConfig(configPath, servers, options = {}) {
             fs.mkdirSync(configDir, { recursive: true });
         }
         fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
+        // Set restrictive permissions (owner read/write only) to protect secrets
+        // Only on Unix-like systems (macOS, Linux) - Windows uses ACL instead
+        if (process.platform !== "win32") {
+            try {
+                fs.chmodSync(configPath, 0o600);
+            } catch (e) {
+                console.warn(`⚠️  Warning: Could not set file permissions on ${configPath}: ${e.message}`);
+            }
+        }
     }
 
     return { added, skipped };
@@ -291,6 +300,15 @@ function writeMcpWithSecretsToPlatformConfig(configPath, servers, resolvedSecret
             fs.mkdirSync(configDir, { recursive: true });
         }
         fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
+        // Set restrictive permissions (owner read/write only) to protect secrets
+        // Only on Unix-like systems (macOS, Linux) - Windows uses ACL instead
+        if (process.platform !== "win32") {
+            try {
+                fs.chmodSync(configPath, 0o600);
+            } catch (e) {
+                console.warn(`⚠️  Warning: Could not set file permissions on ${configPath}: ${e.message}`);
+            }
+        }
     }
 
     return { installed, servers: serverResults };

package/scripts/postinstall.js

@@ -7,6 +7,26 @@
 
 const platforms = require("./platforms");
 
+// Bitwarden MCP: Tools to disable (org management, device approval, sends, etc.)
+const BITWARDEN_DISABLED_TOOLS = [
+  "lock", "sync", "status", "confirm",
+  "create_org_collection", "edit_org_collection", "edit_item_collections", "move",
+  "device_approval_list", "device_approval_approve", "device_approval_approve_all",
+  "device_approval_deny", "device_approval_deny_all",
+  "create_text_send", "create_file_send", "list_send", "get_send",
+  "edit_send", "delete_send", "remove_send_password",
+  "create_attachment",
+  "list_org_collections", "get_org_collection", "update_org_collection", "delete_org_collection",
+  "list_org_members", "get_org_member", "get_org_member_groups",
+  "invite_org_member", "update_org_member", "update_org_member_groups",
+  "remove_org_member", "reinvite_org_member",
+  "list_org_groups", "get_org_group", "get_org_group_members",
+  "create_org_group", "update_org_group", "delete_org_group", "update_org_group_members",
+  "list_org_policies", "get_org_policy", "update_org_policy",
+  "get_org_events", "get_org_subscription", "update_org_subscription",
+  "import_org_users_and_groups"
+];
+
 function main() {
   console.log("\n╔═══════════════════════════════════════════════════════════════╗");
   console.log("║               AI Agent Config Installed!                      ║");
@@ -73,24 +93,7 @@ function main() {
             BW_CLIENT_ID: "${BW_CLIENT_ID}",
             BW_CLIENT_SECRET: "${BW_CLIENT_SECRET}",
           },
-          disabledTools: [
-            "lock", "sync", "status", "confirm",
-            "create_org_collection", "edit_org_collection", "edit_item_collections", "move",
-            "device_approval_list", "device_approval_approve", "device_approval_approve_all",
-            "device_approval_deny", "device_approval_deny_all",
-            "create_text_send", "create_file_send", "list_send", "get_send",
-            "edit_send", "delete_send", "remove_send_password",
-            "create_attachment",
-            "list_org_collections", "get_org_collection", "update_org_collection", "delete_org_collection",
-            "list_org_members", "get_org_member", "get_org_member_groups",
-            "invite_org_member", "update_org_member", "update_org_member_groups",
-            "remove_org_member", "reinvite_org_member",
-            "list_org_groups", "get_org_group", "get_org_group_members",
-            "create_org_group", "update_org_group", "delete_org_group", "update_org_group_members",
-            "list_org_policies", "get_org_policy", "update_org_policy",
-            "get_org_events", "get_org_subscription", "update_org_subscription",
-            "import_org_users_and_groups"
-          ],
+          disabledTools: BITWARDEN_DISABLED_TOOLS,
         };
         changed = true;
         console.log("🔐 Bitwarden MCP server added to Antigravity (✓ enabled)");
@@ -110,24 +113,7 @@ function main() {
 
         // Phase 4: Add disabledTools if not present (don't override if user customized)
         if (!bw.disabledTools) {
-          bw.disabledTools = [
-            "lock", "sync", "status", "confirm",
-            "create_org_collection", "edit_org_collection", "edit_item_collections", "move",
-            "device_approval_list", "device_approval_approve", "device_approval_approve_all",
-            "device_approval_deny", "device_approval_deny_all",
-            "create_text_send", "create_file_send", "list_send", "get_send",
-            "edit_send", "delete_send", "remove_send_password",
-            "create_attachment",
-            "list_org_collections", "get_org_collection", "update_org_collection", "delete_org_collection",
-            "list_org_members", "get_org_member", "get_org_member_groups",
-            "invite_org_member", "update_org_member", "update_org_member_groups",
-            "remove_org_member", "reinvite_org_member",
-            "list_org_groups", "get_org_group", "get_org_group_members",
-            "create_org_group", "update_org_group", "delete_org_group", "update_org_group_members",
-            "list_org_policies", "get_org_policy", "update_org_policy",
-            "get_org_events", "get_org_subscription", "update_org_subscription",
-            "import_org_users_and_groups"
-          ];
+          bw.disabledTools = BITWARDEN_DISABLED_TOOLS;
           changed = true;
           console.log("🎛️  Bitwarden MCP: Added tool filters (disabled org-management tools)");
         }

package/scripts/secret-manager.js

@@ -124,13 +124,14 @@ async function promptPassword() {
 /**
  * Unlock Bitwarden vault with password
  * Returns session key or null if failed
- * Uses spawnSync to avoid shell injection
+ * Uses --passwordenv to pass password securely (not visible in process list)
  */
 function unlockBitwarden(password) {
     try {
-        // Use positional password argument for compatibility with older Bitwarden CLI versions
-        // Since we use spawnSync without shell: true, the password doesn't leak into shell history
-        const result = spawnSync("bw", ["unlock", password, "--raw"], {
+        // Use --passwordenv to avoid leaking password in /proc/<pid>/cmdline
+        // Set password in env only for this child process
+        const result = spawnSync("bw", ["unlock", "--passwordenv", "BW_UNLOCK_PASSWORD", "--raw"], {
+            env: { ...process.env, BW_UNLOCK_PASSWORD: password },
             encoding: "utf-8",
         });