dsh-agy-link 0.4.85 → 0.4.87

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 0.4.87 (2026-10-29)
+
+### English
+
+- **Security(doctor): tighten existing diagnostics dir/file to 0700/0600 on every write.**
+  - v0.4.86 set `mode` only at creation, so a pre-existing `diagnostics/` directory (0755 from an older version) stayed world-readable, and an overwritten report kept its old mode. `writeDoctorReport()` now `chmod`s the dir to `0700` and the file to `0600` after writing (best-effort). Adds a regression test.
+
+### 中文
+
+- **安全(doctor)：每次写入都把已存在的诊断目录/文件收紧到 0700/0600。**
+  - 0.4.86 只在创建时设 `mode`，因此已存在的 `diagnostics/`（旧版本创建的 0755）仍可被他人读取，覆盖写同名报告也保留旧权限。现 `writeDoctorReport()` 写完后显式 `chmod` 目录为 `0700`、文件为 `0600`（best-effort）。补充回归测试。
+
+**Full Changelog**: https://github.com/amlyczz/dsh-agy-link/compare/v0.4.86...v0.4.87
+
+## 0.4.86 (2026-10-29)
+
+### English
+
+- **Security(doctor): write the diagnostic report owner-only (dir 0700, file 0600).**
+  - `/agy doctor` wrote its (redacted) report with the default umask (typically 0644), so another local user could read config paths and any residual log text. The diagnostics dir is now `0700` and the report `0600`.
+- **Docs(spec): add the spec index and the security-hardening invariants.**
+  - `.spec/README.md` indexes the project's truth sources; `.spec/security-hardening.md` records the MCP bridge / HTTP / doctor / media / parser security invariants and the exact test that guards each one, so future changes cannot silently relax them.
+
+### 中文
+
+- **安全(doctor)：诊断报告改为仅本人可读（目录 0700、文件 0600）。**
+  - `/agy doctor` 之前按默认 umask 写（通常 0644），同机其他用户可读到配置路径与残留日志。现目录 `0700`、报告 `0600`。
+- **文档(spec)：新增 spec 索引与安全不变式文档。**
+  - `.spec/README.md` 作为真相源索引；`.spec/security-hardening.md` 记录 MCP 桥接 / HTTP / doctor / media / parser 的安全不变式与对应测试，防止后续改动静默放宽。
+
+**Full Changelog**: https://github.com/amlyczz/dsh-agy-link/compare/v0.4.85...v0.4.86
+
 ## 0.4.85 (2026-10-29)
 
 ### English

package/dist/index.js

@@ -32448,9 +32448,21 @@ function writeDoctorReport(deps) {
 	lines.push("```");
 	lines.push("");
 	const dir = join(stateDir(), "diagnostics");
-	mkdirSync(dir, { recursive: true });
+	mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+	try {
+		chmodSync(dir, 448);
+	} catch {}
 	const file = join(dir, "doctor-" + (/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/g, "").slice(0, 14) + ".md");
-	writeFileSync(file, lines.join("\n"), "utf8");
+	writeFileSync(file, lines.join("\n"), {
+		encoding: "utf8",
+		mode: 384
+	});
+	try {
+		chmodSync(file, 384);
+	} catch {}
 	return file;
 }
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-agy-link",
-  "version": "0.4.85",
+  "version": "0.4.87",
   "description": "Google Antigravity (agy CLI) models for DeepSeek Harness — stream Gemini/Claude/GPT-OSS subscriptions into DSH with thinking, tool activity, token usage and in-GUI Google OAuth login.",
   "type": "module",
   "license": "MIT",