alvin-bot 4.12.1 → 4.12.3

package/dist/providers/claude-sdk-provider.js

@@ -114,7 +114,10 @@ export class ClaudeSDKProvider {
                     allowDangerouslySkipPermissions: true,
                     env: cleanEnv,
                     settingSources: ["user", "project"],
-                    allowedTools: [
+                    // v4.12.2 — options.allowedTools can override the default full set.
+                    // Used by sub-agents with toolset="readonly"/"research" to restrict
+                    // what Claude can do. Default = full access.
+                    allowedTools: options.allowedTools ?? [
                         "Read", "Write", "Edit", "Bash", "Glob", "Grep",
                         "WebSearch", "WebFetch", "Task",
                     ],

package/dist/services/allowed-users-gate.js

@@ -0,0 +1,56 @@
+/**
+ * ALLOWED_USERS Startup Gate (v4.12.2)
+ *
+ * Pure decision function that runs at startup to decide whether Alvin should
+ * refuse to start because its Telegram bot is configured but has no user
+ * allowlist.
+ *
+ * Before v4.12.2, an empty ALLOWED_USERS with AUTH_MODE=allowlist would only
+ * emit a console.warn and the bot would start anyway. On production this
+ * left a "configured but unguarded" surface — any Telegram user who sends
+ * a DM would reach the bot and could exploit shell/filesystem access via
+ * prompt injection.
+ *
+ * The gate has two explicit escape hatches, both intentional:
+ *   1. AUTH_MODE=open — user explicitly wants a public bot (not recommended)
+ *   2. ALVIN_INSECURE_ACKNOWLEDGED=1 — explicit operator opt-out used for
+ *      test environments and scripted installs where the operator
+ *      acknowledges they know what they're doing.
+ *
+ * Pure: takes config values as args, returns a decision. The actual
+ * process.exit(1) lives in src/index.ts as a thin wrapper.
+ */
+export function checkAllowedUsersGate(input) {
+    // WebUI-only deployments don't have a BOT_TOKEN → nothing to gate
+    if (!input.hasTelegram) {
+        return { allowed: true };
+    }
+    // Telegram is enabled AND allowlist is populated → normal path
+    if (input.allowedUsersCount > 0) {
+        return { allowed: true };
+    }
+    // Telegram enabled but allowlist empty — check escape hatches
+    if (input.authMode === "open") {
+        return {
+            allowed: true,
+            warning: "AUTH_MODE=open explicitly set. Any Telegram user can message the bot. " +
+                "This is NOT recommended for machines with sensitive files or shell access.",
+        };
+    }
+    if (input.insecureAcknowledged) {
+        return {
+            allowed: true,
+            warning: "ALVIN_INSECURE_ACKNOWLEDGED=1 set. Bot starts with empty ALLOWED_USERS. " +
+                "The operator has explicitly opted out of the safety gate.",
+        };
+    }
+    // No escape hatch — refuse to start
+    return {
+        allowed: false,
+        reason: "ALLOWED_USERS is empty but BOT_TOKEN is set. " +
+            "Alvin Bot has full shell/filesystem access on this machine, so starting with " +
+            "an empty allowlist would leave the bot open to anyone who sends it a Telegram message. " +
+            "Fix: set ALLOWED_USERS=<your telegram user id> in ~/.alvin-bot/.env (get your ID from @userinfobot). " +
+            "Explicit opt-out: AUTH_MODE=open OR ALVIN_INSECURE_ACKNOWLEDGED=1.",
+    };
+}

package/dist/services/async-agent-watcher.js

@@ -26,6 +26,7 @@ import fs from "fs";
 import { dirname } from "path";
 import { parseOutputFileStatus } from "./async-agent-parser.js";
 import { ASYNC_AGENTS_STATE_FILE } from "../paths.js";
+import { getAllSessions } from "./session.js";
 /** How often the polling loop runs against each pending agent. */
 const POLL_INTERVAL_MS = 15_000;
 /** Hard ceiling per agent — 12h. After this, give up and deliver
@@ -81,10 +82,32 @@ export function registerPendingAgent(input) {
         lastCheckedAt: 0,
         giveUpAt: input.giveUpAt ?? now + MAX_AGENT_AGE_MS,
         toolUseId: input.toolUseId,
+        sessionKey: input.sessionKey,
     };
     pending.set(input.agentId, entry);
     saveToDisk();
 }
+/**
+ * v4.12.3 — Decrement the session's pendingBackgroundCount. Called on
+ * every delivery (completed/failed/timeout). Clamped at 0 so drift
+ * scenarios (counter was already 0, or session was reset) never crash.
+ * Missing/unknown sessionKey → no-op. Never throws.
+ */
+function decrementPendingCount(sessionKey) {
+    if (!sessionKey)
+        return;
+    try {
+        const all = getAllSessions();
+        const s = all.get(sessionKey);
+        if (!s)
+            return;
+        s.pendingBackgroundCount = Math.max(0, (s.pendingBackgroundCount ?? 0) - 1);
+    }
+    catch (err) {
+        // Never let a decrement failure break delivery.
+        console.error("[async-watcher] decrement failed:", err);
+    }
+}
 /** Returns a snapshot of in-memory pending agents (for /subagents + diagnostics). */
 export function listPendingAgents() {
     return [...pending.values()];
@@ -167,6 +190,7 @@ async function deliverAsCompleted(entry, output, tokensUsed) {
     catch (err) {
         console.error(`[async-watcher] delivery failed for ${entry.agentId}:`, err);
     }
+    decrementPendingCount(entry.sessionKey);
 }
 async function deliverAsFailure(entry, status, error) {
     const { deliverSubAgentResult } = await import("./subagent-delivery.js");
@@ -194,6 +218,7 @@ async function deliverAsFailure(entry, status, error) {
     catch (err) {
         console.error(`[async-watcher] failure delivery failed for ${entry.agentId}:`, err);
     }
+    decrementPendingCount(entry.sessionKey);
 }
 // ── Test helpers ──────────────────────────────────────────────────
 /** Test-only: drop in-memory state. Doesn't touch disk. */

package/dist/services/cron.js

@@ -124,6 +124,23 @@ async function executeJob(job) {
             }
             case "shell": {
                 const cmd = job.payload.command || "echo 'no command'";
+                // v4.12.2 — Cron shell jobs now go through exec-guard. Before
+                // v4.12.2 cron bypassed the allowlist, which was inconsistent
+                // with the rest of the bot's shell execution policy. With
+                // EXEC_SECURITY=allowlist (default) this rejects jobs with
+                // shell metacharacters or non-allowlisted binaries. Operators
+                // who legitimately need complex shell pipelines in cron set
+                // EXEC_SECURITY=full explicitly.
+                const { checkExecAllowed } = await import("./exec-guard.js");
+                const guard = checkExecAllowed(cmd);
+                if (!guard.allowed) {
+                    const msg = `Cron shell job blocked by exec-guard: ${guard.reason}`;
+                    console.warn(`[cron] ${job.name}: ${msg}`);
+                    if (notifyCallback) {
+                        await notifyCallback(job.target, `🛑 ${job.name}\n${msg}\n\nSet EXEC_SECURITY=full if this is intentional.`);
+                    }
+                    return { output: msg };
+                }
                 // Per-job timeout, default = no timeout (execSync treats timeout=0
                 // or "undefined" as infinite). Users opt in via /cron add … --timeout N.
                 const shellOpts = {

package/dist/services/exec-guard.js

@@ -30,12 +30,37 @@ function extractBinary(command) {
     // Strip path: /usr/bin/curl -> curl
     return first.split("/").pop() || first;
 }
+/**
+ * v4.12.2 — Reject shell metacharacters in allowlist mode.
+ *
+ * The pre-v4.12.2 allowlist check only inspected the first word of the
+ * command. That was trivially bypassable via:
+ *   - ";" chaining:       "echo safe; rm -rf /"
+ *   - "&&" / "||" chains:  "echo hi && cat /etc/passwd"
+ *   - pipe:                "cat /etc/passwd | head"
+ *   - substitution:        "echo $(whoami)" or "`whoami`"
+ *   - redirect:            "echo hi > /etc/passwd"
+ *   - backgrounding:       "... &"
+ *
+ * Strategy: in allowlist mode, any command containing any of these
+ * metachars is rejected outright. Users who need shell pipelines opt in
+ * explicitly via EXEC_SECURITY=full.
+ */
+const SHELL_METACHAR_PATTERN = /[;&|`$(){}<>]/;
 export function checkExecAllowed(command) {
     if (config.execSecurity === "full")
         return { allowed: true };
     if (config.execSecurity === "deny")
         return { allowed: false, reason: "Shell execution is disabled" };
-    // allowlist mode
+    // allowlist mode — v4.12.2 metachar guard
+    if (SHELL_METACHAR_PATTERN.test(command)) {
+        return {
+            allowed: false,
+            reason: `Command contains shell metacharacters (pipes, redirects, substitution, chaining). ` +
+                `Allowlist mode only permits simple binary invocations. ` +
+                `Set EXEC_SECURITY=full if you need shell pipelines.`,
+        };
+    }
     const binary = extractBinary(command);
     if (SAFE_BINS.includes(binary))
         return { allowed: true };

package/dist/services/fallback-order.js

@@ -10,6 +10,7 @@
  */
 import fs from "fs";
 import { FALLBACK_FILE, ENV_FILE, DATA_DIR } from "../paths.js";
+import { writeSecure } from "./file-permissions.js";
 // ── Public API ──────────────────────────────────────────────────────────────
 /**
  * Get the current fallback order.
@@ -143,7 +144,9 @@ function syncToEnv(primary, fallbacks) {
         else {
             env += `\nFALLBACK_PROVIDERS=${fallbackStr}`;
         }
-        fs.writeFileSync(ENV_FILE, env);
+        // v4.12.2 — writeSecure enforces 0o600 on .env so other users on the
+        // machine can't read tokens/API keys.
+        writeSecure(ENV_FILE, env);
     }
     catch (err) {
         console.error("Failed to sync fallback order to .env:", err);

package/dist/services/file-permissions.js

@@ -0,0 +1,93 @@
+/**
+ * File Permissions Hardening (v4.12.2)
+ *
+ * On multi-user dev servers, Alvin's sensitive files (.env, sessions.json,
+ * memory files, cron-jobs.json) were previously written with the default
+ * umask — typically 0o644 on Linux/macOS, meaning any other user on the
+ * same machine could read API keys, conversation history, cron job
+ * definitions, etc.
+ *
+ * This module provides:
+ *   - writeSecure(path, content) — atomic write with mode 0o600
+ *   - ensureSecureMode(path) — chmod-repair an existing file if it's too permissive
+ *   - auditSensitiveFiles(paths[]) — batch-audit a list of files and repair
+ *
+ * The handler strategy:
+ *   - NEW writes: use writeSecure() or pass `{ mode: 0o600 }` to writeFileSync
+ *   - STARTUP: call auditSensitiveFiles() once with the list of known-sensitive
+ *     files to chmod-repair anything that was written pre-v4.12.2
+ *
+ * Pure file-system operations — no grammy, no session, testable in isolation.
+ */
+import fs from "fs";
+/** Strict mode for all sensitive files: owner read/write only. */
+export const SECURE_MODE = 0o600;
+/**
+ * Atomically write a file with mode 0o600.
+ *
+ * Uses fs.writeFileSync's built-in `mode` option for initial creation, then
+ * an explicit fs.chmodSync to handle the case where the file already exists
+ * (in which case the mode arg to writeFileSync is ignored).
+ */
+export function writeSecure(path, content) {
+    fs.writeFileSync(path, content, { mode: SECURE_MODE });
+    // writeFileSync's mode is only applied on initial create. If the file
+    // already existed with a looser mode, we need to explicitly chmod it.
+    try {
+        fs.chmodSync(path, SECURE_MODE);
+    }
+    catch {
+        // Best effort — some filesystems (e.g. FAT) don't support chmod
+    }
+}
+/**
+ * Ensure a file is at most as permissive as SECURE_MODE (0o600). If it's
+ * already 0o600 or stricter (e.g. 0o400), leave it alone. If it's more
+ * permissive (e.g. 0o644, 0o666), repair it to 0o600.
+ *
+ * Returns a report of what happened — used by auditSensitiveFiles().
+ */
+export function ensureSecureMode(path) {
+    let stat;
+    try {
+        stat = fs.statSync(path);
+    }
+    catch (err) {
+        const e = err;
+        if (e.code === "ENOENT") {
+            return { path, status: "missing" };
+        }
+        return { path, status: "error", error: e.message };
+    }
+    const currentMode = stat.mode & 0o777;
+    // If the file is already at SECURE_MODE or stricter (fewer bits), leave it.
+    // We use bitwise AND: if (currentMode & ~SECURE_MODE) === 0 then all set bits
+    // are within SECURE_MODE's bits — i.e. the file is not MORE permissive.
+    if ((currentMode & ~SECURE_MODE) === 0) {
+        return { path, status: "already-secure" };
+    }
+    // File is more permissive than 0o600 — repair.
+    try {
+        fs.chmodSync(path, SECURE_MODE);
+        return {
+            path,
+            status: "repaired",
+            previousMode: currentMode.toString(8),
+        };
+    }
+    catch (err) {
+        return {
+            path,
+            status: "error",
+            error: err instanceof Error ? err.message : String(err),
+        };
+    }
+}
+/**
+ * Audit + repair a list of sensitive file paths. Returns a report per file.
+ * Called once at bot startup with the list of known-sensitive files so that
+ * any file written pre-v4.12.2 (with default 0o644/0o666 umask) gets repaired.
+ */
+export function auditSensitiveFiles(paths) {
+    return paths.map(p => ensureSecureMode(p));
+}

package/dist/services/session-persistence.js

@@ -21,6 +21,7 @@
 import fs from "fs";
 import { dirname } from "path";
 import { SESSIONS_STATE_FILE } from "../paths.js";
+import { SECURE_MODE } from "./file-permissions.js";
 import { getAllSessions, getTelegramWorkspacesMap, } from "./session.js";
 /** History entries to keep in the persisted snapshot (per session). */
 const MAX_PERSISTED_HISTORY = 50;
@@ -85,9 +86,20 @@ export async function flushSessions() {
             sessions: out,
             telegramWorkspaces: tgWorkspaces,
         };
-        // Atomic write: tmp + rename
+        // Atomic write: tmp + rename. v4.12.2 — mode 0o600 enforced so other
+        // users on the same machine can't read conversation history or tokens.
         const tmpFile = `${SESSIONS_STATE_FILE}.tmp`;
-        fs.writeFileSync(tmpFile, JSON.stringify(envelope, null, 2), "utf-8");
+        fs.writeFileSync(tmpFile, JSON.stringify(envelope, null, 2), {
+            encoding: "utf-8",
+            mode: SECURE_MODE,
+        });
+        // Belt-and-suspenders: chmod in case the tmp file already existed with
+        // looser permissions (writeFileSync's mode option is only applied on
+        // initial create).
+        try {
+            fs.chmodSync(tmpFile, SECURE_MODE);
+        }
+        catch { /* fs may not support */ }
         fs.renameSync(tmpFile, SESSIONS_STATE_FILE);
     }
     catch (err) {
@@ -179,6 +191,11 @@ export function loadPersistedSessions() {
             compactionCount: 0,
             checkpointHintsInjected: 0,
             sdkSubTaskCount: 0,
+            // v4.12.3 — Don't persist pendingBackgroundCount. On restart, the
+            // async-agent-watcher re-hydrates its own state file and polls each
+            // pending agent's outputFile, which handles delivery independently.
+            // Starting at 0 avoids stale counters surviving a crash.
+            pendingBackgroundCount: 0,
             history: Array.isArray(persisted.history) ? persisted.history : [],
             language: persisted.language ?? "en",
             messageQueue: [],

package/dist/services/session.js

@@ -94,6 +94,7 @@ export function getSession(key) {
             compactionCount: 0,
             checkpointHintsInjected: 0,
             sdkSubTaskCount: 0,
+            pendingBackgroundCount: 0,
             history: [],
             language: "en",
             messageQueue: [],
@@ -122,6 +123,7 @@ export function resetSession(key) {
     session.compactionCount = 0;
     session.checkpointHintsInjected = 0;
     session.sdkSubTaskCount = 0;
+    session.pendingBackgroundCount = 0;
     session.history = [];
     session.lastSdkHistoryIndex = -1;
     session.startedAt = Date.now();

package/dist/services/subagents.js

@@ -250,12 +250,30 @@ async function runSubAgent(id, agentConfig, abort, resolvedName) {
             ? agentConfig.workingDir || os.homedir()
             : os.homedir();
         const systemPrompt = `You are a sub-agent named "${resolvedName}". Complete the following task autonomously and report your results clearly when done. Working directory: ${effectiveCwd}`;
+        // v4.12.2 — Map the toolset preset to an explicit allowedTools list.
+        // The provider honors this override (see src/providers/claude-sdk-provider.ts
+        // line ~140). Passing undefined = full access (provider default).
+        const allowedToolsForToolset = (preset) => {
+            switch (preset) {
+                case "readonly":
+                    // Read, analyze, search — no writes, no shell, no network.
+                    return ["Read", "Glob", "Grep"];
+                case "research":
+                    // Same as readonly + web access for research tasks.
+                    return ["Read", "Glob", "Grep", "WebSearch", "WebFetch"];
+                case "full":
+                default:
+                    // undefined → provider uses its full default set.
+                    return undefined;
+            }
+        };
         for await (const chunk of registry.queryWithFallback({
             prompt: agentConfig.prompt,
             systemPrompt,
             workingDir: effectiveCwd,
             effort: "high",
             abortSignal: abort.signal,
+            allowedTools: allowedToolsForToolset(agentConfig.toolset ?? "full"),
         })) {
             if (chunk.type === "text") {
                 // Both SDK providers emit `text` as the accumulated string.
@@ -483,12 +501,12 @@ export function spawnSubAgent(agentConfig) {
     if (depth > MAX_SUBAGENT_DEPTH) {
         return Promise.reject(new Error(`Sub-agent depth limit reached (${MAX_SUBAGENT_DEPTH}). Agents can only spawn ${MAX_SUBAGENT_DEPTH} level(s) of nested agents.`));
     }
-    // G1: toolset preset. Only "full" is supported. The literal type blocks
-    // wrong values at compile time; the runtime check catches callers that
-    // bypass TypeScript (e.g. plugin code loaded at runtime).
+    // G1: toolset preset (v4.12.2 — extended with readonly + research).
+    // The literal type constrains at compile time; the runtime check catches
+    // callers that bypass TypeScript (e.g. plugin code loaded at runtime).
     const toolset = agentConfig.toolset ?? "full";
-    if (toolset !== "full") {
-        return Promise.reject(new Error(`Invalid toolset "${toolset}". Only "full" is supported in this version.`));
+    if (toolset !== "full" && toolset !== "readonly" && toolset !== "research") {
+        return Promise.reject(new Error(`Invalid toolset "${toolset}". Valid presets: full, readonly, research.`));
     }
     const maxParallel = getMaxParallelAgents();
     const queueCap = getQueueCap();

package/dist/services/timing-safe-bearer.js

@@ -0,0 +1,51 @@
+/**
+ * Timing-Safe Bearer Token Comparison (v4.12.2)
+ *
+ * Replaces naive `authHeader !== "Bearer " + token` comparison with
+ * crypto.timingSafeEqual so that token comparison time doesn't leak
+ * character-level information via side-channel.
+ *
+ * Real-world exploitability over network is low due to network jitter,
+ * but this is the right tool regardless — defense in depth.
+ *
+ * Behavior:
+ *   - Strict "Bearer <token>" format required (exactly one space)
+ *   - Empty expected token always rejects (prevents accidental auth bypass)
+ *   - Different-length tokens compared via timingSafeEqual on padded buffers
+ *     so timing doesn't leak whether the prefix matched
+ *   - Unicode-safe: Buffer.from uses UTF-8 encoding
+ */
+import { timingSafeEqual } from "crypto";
+export function timingSafeBearerMatch(authHeader, expectedToken) {
+    // Empty expected token → always reject. Prevents a misconfig where
+    // config.webhookToken is "" from accidentally allowing any "Bearer "
+    // or empty Authorization header.
+    if (!expectedToken || expectedToken.length === 0)
+        return false;
+    // Missing or non-string header
+    if (!authHeader || typeof authHeader !== "string")
+        return false;
+    // Strict format: "Bearer <token>" with exactly one space. Anything else
+    // (double space, leading whitespace, wrong prefix) is rejected. We do
+    // this via startsWith + exact-length check, not split, so attackers
+    // can't use whitespace variations to confuse the parser.
+    const prefix = "Bearer ";
+    if (!authHeader.startsWith(prefix))
+        return false;
+    const providedToken = authHeader.slice(prefix.length);
+    // timingSafeEqual requires equal-length buffers. If lengths differ,
+    // we return false — but we still touch both strings symbolically so
+    // the compare itself is constant-time relative to the shorter one.
+    // (A length leak through string.length check is acceptable; what we
+    // actually care about is that the character-by-character comparison
+    // doesn't leak.)
+    const expectedBuf = Buffer.from(expectedToken, "utf-8");
+    const providedBuf = Buffer.from(providedToken, "utf-8");
+    if (expectedBuf.length !== providedBuf.length) {
+        // Do a dummy comparison so total time is closer to constant.
+        // Not perfect but better than early-return alone.
+        timingSafeEqual(expectedBuf, expectedBuf);
+        return false;
+    }
+    return timingSafeEqual(expectedBuf, providedBuf);
+}

package/dist/web/doctor-api.js

@@ -12,6 +12,7 @@ import fs from "fs";
 import { resolve, dirname } from "path";
 import { execSync } from "child_process";
 import { BOT_ROOT, ENV_FILE, BACKUP_DIR, DATA_DIR, MEMORY_DIR, MEMORY_FILE, SOUL_FILE, SOUL_EXAMPLE, TOOLS_MD, TOOLS_JSON, CUSTOM_MODELS, CRON_FILE, MCP_CONFIG } from "../paths.js";
+import { writeSecure } from "../services/file-permissions.js";
 // Files to include in backups (absolute paths)
 const BACKUP_FILES = [
     { src: ENV_FILE, label: ".env" },
@@ -222,9 +223,14 @@ function autoRepair(action) {
                 const exampleFile = resolve(BOT_ROOT, ".env.example");
                 if (fs.existsSync(exampleFile)) {
                     fs.copyFileSync(exampleFile, ENV_FILE);
+                    // v4.12.2 — enforce 0o600 on fresh .env
+                    try {
+                        fs.chmodSync(ENV_FILE, 0o600);
+                    }
+                    catch { /* fs may not support */ }
                     return { ok: true, message: ".env created from .env.example" };
                 }
-                fs.writeFileSync(ENV_FILE, "BOT_TOKEN=\nALLOWED_USERS=\nPRIMARY_PROVIDER=claude-sdk\n");
+                writeSecure(ENV_FILE, "BOT_TOKEN=\nALLOWED_USERS=\nPRIMARY_PROVIDER=claude-sdk\n");
                 return { ok: true, message: "Default .env created (BOT_TOKEN still needs to be set)" };
             }
             case "create-docs": {
@@ -272,7 +278,7 @@ function autoRepair(action) {
                     const lines = fs.readFileSync(ENV_FILE, "utf-8").split("\n");
                     if (lineIdx >= 0 && lineIdx < lines.length) {
                         lines[lineIdx] = "# " + lines[lineIdx]; // Comment out broken line
-                        fs.writeFileSync(ENV_FILE, lines.join("\n"));
+                        writeSecure(ENV_FILE, lines.join("\n"));
                         return { ok: true, message: `Line ${lineIdx + 1} commented out` };
                     }
                 }

package/dist/web/server.js

@@ -28,6 +28,8 @@ import { handleDoctorAPI } from "./doctor-api.js";
 import { handleOpenAICompat } from "./openai-compat.js";
 import { addCanvasClient } from "./canvas.js";
 import { BOT_ROOT, ENV_FILE, PUBLIC_DIR, MEMORY_DIR, MEMORY_FILE, SOUL_FILE, DATA_DIR, MCP_CONFIG, SKILLS_DIR } from "../paths.js";
+import { writeSecure } from "../services/file-permissions.js";
+import { timingSafeBearerMatch } from "../services/timing-safe-bearer.js";
 import { broadcast } from "../services/broadcast.js";
 import { BOT_VERSION } from "../version.js";
 import { decideNextBindAction } from "./bind-strategy.js";
@@ -106,8 +108,9 @@ async function handleAPI(req, res, urlPath, body) {
             res.end(JSON.stringify({ error: "Webhooks disabled" }));
             return;
         }
-        const authHeader = req.headers.authorization || "";
-        if (authHeader !== `Bearer ${config.webhookToken}`) {
+        // v4.12.2 — timing-safe bearer token comparison. Previously used
+        // naive !== which leaks comparison position via timing side-channel.
+        if (!timingSafeBearerMatch(req.headers.authorization, config.webhookToken ?? "")) {
             res.writeHead(401);
             res.end(JSON.stringify({ error: "Unauthorized" }));
             return;
@@ -1041,7 +1044,8 @@ async function handleAPI(req, res, urlPath, body) {
             else {
                 envContent = envContent.trimEnd() + `\n${key}=${value}\n`;
             }
-            fs.writeFileSync(ENV_FILE, envContent);
+            // v4.12.2 — enforce 0o600 on .env
+            writeSecure(ENV_FILE, envContent);
             res.end(JSON.stringify({ ok: true, note: "Restart required for changes to take effect" }));
         }
         catch {

package/dist/web/setup-api.js

@@ -13,6 +13,7 @@ import { getRegistry } from "../engine.js";
 import { listJobs, createJob, deleteJob, toggleJob, updateJob, runJobNow, formatNextRun, humanReadableSchedule } from "../services/cron.js";
 import { storePassword, revokePassword, getSudoStatus, verifyPassword, sudoExec, requestAdminViaDialog, openSystemSettings } from "../services/sudo.js";
 import { ENV_FILE, CUSTOM_MODELS as CUSTOM_MODELS_FILE, BOT_ROOT, WHATSAPP_AUTH } from "../paths.js";
+import { writeSecure } from "../services/file-permissions.js";
 // ── Env Helpers ─────────────────────────────────────────
 function readEnv() {
     if (!fs.existsSync(ENV_FILE))
@@ -36,14 +37,16 @@ function writeEnvVar(key, value) {
     else {
         content = content.trimEnd() + `\n${key}=${value}\n`;
     }
-    fs.writeFileSync(ENV_FILE, content);
+    // v4.12.2 — .env contains all secrets (bot tokens, API keys). Enforce
+    // 0o600 so other users on the machine can't read it.
+    writeSecure(ENV_FILE, content);
 }
 function removeEnvVar(key) {
     if (!fs.existsSync(ENV_FILE))
         return;
     let content = fs.readFileSync(ENV_FILE, "utf-8");
     content = content.replace(new RegExp(`^${key}=.*\n?`, "m"), "");
-    fs.writeFileSync(ENV_FILE, content);
+    writeSecure(ENV_FILE, content);
 }
 function loadCustomModels() {
     try {