dsh-agy-link 0.4.86 → 0.4.88

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.4.88 (2026-10-29)
+
+### English
+
+- **Security(media): add `X-Content-Type-Options: nosniff` and a CSP sandbox to served media/assets.**
+  - The media and asset routes serve local image/SVG files from the DSH origin. They now send `X-Content-Type-Options: nosniff` (no MIME sniffing) and `Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox`, so an operator-supplied SVG cannot execute scripts if opened/navigated directly. Adds header assertions to the media test.
+
+### 中文
+
+- **安全(media)：媒体/静态资源响应增加 `X-Content-Type-Options: nosniff` 与 CSP sandbox。**
+  - 媒体与静态资源路由从 DSH 同源提供本地图片/SVG。现附加 `X-Content-Type-Options: nosniff`（禁止 MIME 嗅探）与 `Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox`，使运维提供的 SVG 即使被直接打开/导航也无法执行脚本。为媒体测试补充响应头断言。
+
+**Full Changelog**: https://github.com/amlyczz/dsh-agy-link/compare/v0.4.87...v0.4.88
+
+## 0.4.87 (2026-10-29)
+
+### English
+
+- **Security(doctor): tighten existing diagnostics dir/file to 0700/0600 on every write.**
+  - v0.4.86 set `mode` only at creation, so a pre-existing `diagnostics/` directory (0755 from an older version) stayed world-readable, and an overwritten report kept its old mode. `writeDoctorReport()` now `chmod`s the dir to `0700` and the file to `0600` after writing (best-effort). Adds a regression test.
+
+### 中文
+
+- **安全(doctor)：每次写入都把已存在的诊断目录/文件收紧到 0700/0600。**
+  - 0.4.86 只在创建时设 `mode`，因此已存在的 `diagnostics/`（旧版本创建的 0755）仍可被他人读取，覆盖写同名报告也保留旧权限。现 `writeDoctorReport()` 写完后显式 `chmod` 目录为 `0700`、文件为 `0600`（best-effort）。补充回归测试。
+
+**Full Changelog**: https://github.com/amlyczz/dsh-agy-link/compare/v0.4.86...v0.4.87
+
 ## 0.4.86 (2026-10-29)
 
 ### English

package/dist/index.js

@@ -32452,11 +32452,17 @@ function writeDoctorReport(deps) {
 		recursive: true,
 		mode: 448
 	});
+	try {
+		chmodSync(dir, 448);
+	} catch {}
 	const file = join(dir, "doctor-" + (/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/g, "").slice(0, 14) + ".md");
 	writeFileSync(file, lines.join("\n"), {
 		encoding: "utf8",
 		mode: 384
 	});
+	try {
+		chmodSync(file, 384);
+	} catch {}
 	return file;
 }
 //#endregion
@@ -35120,7 +35126,9 @@ function handleMediaRequest(req, res, opts = {}) {
 			"Content-Length": st.size,
 			"Cache-Control": "public, max-age=3600",
 			"Access-Control-Allow-Origin": "*",
-			"Content-Disposition": "inline"
+			"Content-Disposition": "inline",
+			"X-Content-Type-Options": "nosniff",
+			"Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; sandbox"
 		});
 		const stream = createReadStream(filePath);
 		stream.on("error", () => {
@@ -35167,7 +35175,9 @@ function handleAssetRequest(req, res, assetDir) {
 			"Content-Type": contentType,
 			"Content-Length": st.size,
 			"Cache-Control": "public, max-age=86400",
-			"Access-Control-Allow-Origin": "*"
+			"Access-Control-Allow-Origin": "*",
+			"X-Content-Type-Options": "nosniff",
+			"Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; sandbox"
 		});
 		const stream = createReadStream(filePath);
 		stream.on("error", () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-agy-link",
-  "version": "0.4.86",
+  "version": "0.4.88",
   "description": "Google Antigravity (agy CLI) models for DeepSeek Harness — stream Gemini/Claude/GPT-OSS subscriptions into DSH with thinking, tool activity, token usage and in-GUI Google OAuth login.",
   "type": "module",
   "license": "MIT",