git-watchtower 2.1.15 → 2.1.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-watchtower",
-  "version": "2.1.15",
+  "version": "2.1.16",
   "description": "Terminal-based Git branch monitor with activity sparklines and optional dev server with live reload",
   "main": "bin/git-watchtower.js",
   "bin": {

package/src/server/coordinator.js

@@ -81,11 +81,28 @@ const LOCK_FILE = path.join(WATCHTOWER_DIR, 'web.lock');
 const SOCKET_PATH = path.join(WATCHTOWER_DIR, 'web.sock');
 
 /**
- * Ensure the ~/.watchtower directory exists.
+ * Ensure the ~/.watchtower directory exists, restricted to the owner.
+ *
+ * The directory hosts the lock file and the Unix-domain IPC socket;
+ * both should only be reachable by the user running git-watchtower.
+ * On Linux, connect() to a Unix socket requires read+execute on the
+ * containing directory, so 0o700 is sufficient defense-in-depth even
+ * when the socket file itself ends up world-readable due to umask.
+ *
+ * mkdirSync's mode argument only applies when the directory is being
+ * created — it has no effect on a pre-existing dir. We chmod after
+ * the create check so installs that ran before this fix get migrated
+ * to the tighter mode on next launch.
  */
 function ensureDir() {
   if (!fs.existsSync(WATCHTOWER_DIR)) {
-    fs.mkdirSync(WATCHTOWER_DIR, { recursive: true });
+    fs.mkdirSync(WATCHTOWER_DIR, { recursive: true, mode: 0o700 });
+  }
+  try {
+    fs.chmodSync(WATCHTOWER_DIR, 0o700);
+  } catch (e) {
+    // chmod may fail on Windows or filesystems without POSIX perms; the
+    // permission semantics don't apply there anyway, so silently skip.
   }
 }
 
@@ -290,6 +307,20 @@ class Coordinator {
       });
 
       this.ipcServer.listen(this.socketPath, () => {
+        // Defense-in-depth: tighten the socket file's own perms after
+        // bind. Node's net.Server.listen() creates the socket file with
+        // perms derived from umask, which on shared workstations
+        // (umask 0022) yields 0o755 — world-readable. Linux ignores
+        // socket-file perms for connect() (the directory's perms are
+        // authoritative), but BSD honours them and other tooling may
+        // surface them in audit reports. Setting 0o600 explicitly
+        // matches the 0o700 directory perms set in ensureDir().
+        try {
+          fs.chmodSync(this.socketPath, 0o600);
+        } catch (e) {
+          // Non-POSIX filesystem or Windows — perm semantics don't
+          // apply, skip silently.
+        }
         resolve();
       });
     });

package/src/utils/monitor-lock.js

@@ -52,8 +52,16 @@ function lockFilePath(repoRoot) {
 }
 
 function ensureDir() {
+  // 0o700 keeps lock files (which contain pids and the cwd of running
+  // git-watchtower instances) unreadable to other local users. See
+  // src/server/coordinator.js for the rationale and Windows note.
   if (!fs.existsSync(WATCHTOWER_DIR)) {
-    fs.mkdirSync(WATCHTOWER_DIR, { recursive: true });
+    fs.mkdirSync(WATCHTOWER_DIR, { recursive: true, mode: 0o700 });
+  }
+  try {
+    fs.chmodSync(WATCHTOWER_DIR, 0o700);
+  } catch (e) {
+    // chmod may fail on Windows / non-POSIX filesystems; skip silently.
   }
 }