git-watchtower 2.1.15 → 2.1.17

package/bin/git-watchtower.js

@@ -576,6 +576,18 @@ async function checkCliAuth(cmd) {
 }
 
 // Bulk-fetch PR statuses for all branches (parsing delegated to src/git/pr.js)
+//
+// PR_LIST_LIMIT is the cap passed to `gh pr list` / `glab mr list`. The
+// previous values (200 for gh, glab's default of 30) silently truncated
+// on any active OSS repo — branches whose PR was outside the most recent
+// N rendered with no inline indicator and never sorted as merged.
+// 1000 covers virtually any real-world repo while still keeping the
+// single API call fast (gh streams JSON, no pagination overhead). If
+// your repo somehow exceeds 1000 active PRs, the truncation is back —
+// but at that scale the inline indicator is the smallest of your UX
+// concerns.
+const PR_LIST_LIMIT = '1000';
+
 async function fetchAllPrStatuses() {
   if (!cachedEnv) return null;
   const { platform, hasGh, ghAuthed, hasGlab, glabAuthed } = cachedEnv;
@@ -584,7 +596,7 @@ async function fetchAllPrStatuses() {
     try {
       const { stdout } = await execCli('gh', [
         'pr', 'list', '--state', 'all',
-        '--json', 'headRefName,number,title,state', '--limit', '200',
+        '--json', 'headRefName,number,title,state', '--limit', PR_LIST_LIMIT,
       ]);
       return parseGitHubPrList(JSON.parse(stdout));
     } catch (e) { /* gh error */ }
@@ -594,6 +606,7 @@ async function fetchAllPrStatuses() {
     try {
       const { stdout } = await execCli('glab', [
         'mr', 'list', '--state', 'all', '--output', 'json',
+        '--per-page', PR_LIST_LIMIT,
       ]);
       return parseGitLabMrList(JSON.parse(stdout));
     } catch (e) { /* glab error */ }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-watchtower",
-  "version": "2.1.15",
+  "version": "2.1.17",
   "description": "Terminal-based Git branch monitor with activity sparklines and optional dev server with live reload",
   "main": "bin/git-watchtower.js",
   "bin": {

package/src/server/coordinator.js

@@ -81,11 +81,28 @@ const LOCK_FILE = path.join(WATCHTOWER_DIR, 'web.lock');
 const SOCKET_PATH = path.join(WATCHTOWER_DIR, 'web.sock');
 
 /**
- * Ensure the ~/.watchtower directory exists.
+ * Ensure the ~/.watchtower directory exists, restricted to the owner.
+ *
+ * The directory hosts the lock file and the Unix-domain IPC socket;
+ * both should only be reachable by the user running git-watchtower.
+ * On Linux, connect() to a Unix socket requires read+execute on the
+ * containing directory, so 0o700 is sufficient defense-in-depth even
+ * when the socket file itself ends up world-readable due to umask.
+ *
+ * mkdirSync's mode argument only applies when the directory is being
+ * created — it has no effect on a pre-existing dir. We chmod after
+ * the create check so installs that ran before this fix get migrated
+ * to the tighter mode on next launch.
  */
 function ensureDir() {
   if (!fs.existsSync(WATCHTOWER_DIR)) {
-    fs.mkdirSync(WATCHTOWER_DIR, { recursive: true });
+    fs.mkdirSync(WATCHTOWER_DIR, { recursive: true, mode: 0o700 });
+  }
+  try {
+    fs.chmodSync(WATCHTOWER_DIR, 0o700);
+  } catch (e) {
+    // chmod may fail on Windows or filesystems without POSIX perms; the
+    // permission semantics don't apply there anyway, so silently skip.
   }
 }
 
@@ -290,6 +307,20 @@ class Coordinator {
       });
 
       this.ipcServer.listen(this.socketPath, () => {
+        // Defense-in-depth: tighten the socket file's own perms after
+        // bind. Node's net.Server.listen() creates the socket file with
+        // perms derived from umask, which on shared workstations
+        // (umask 0022) yields 0o755 — world-readable. Linux ignores
+        // socket-file perms for connect() (the directory's perms are
+        // authoritative), but BSD honours them and other tooling may
+        // surface them in audit reports. Setting 0o600 explicitly
+        // matches the 0o700 directory perms set in ensureDir().
+        try {
+          fs.chmodSync(this.socketPath, 0o600);
+        } catch (e) {
+          // Non-POSIX filesystem or Windows — perm semantics don't
+          // apply, skip silently.
+        }
         resolve();
       });
     });

package/src/utils/monitor-lock.js

@@ -52,8 +52,16 @@ function lockFilePath(repoRoot) {
 }
 
 function ensureDir() {
+  // 0o700 keeps lock files (which contain pids and the cwd of running
+  // git-watchtower instances) unreadable to other local users. See
+  // src/server/coordinator.js for the rationale and Windows note.
   if (!fs.existsSync(WATCHTOWER_DIR)) {
-    fs.mkdirSync(WATCHTOWER_DIR, { recursive: true });
+    fs.mkdirSync(WATCHTOWER_DIR, { recursive: true, mode: 0o700 });
+  }
+  try {
+    fs.chmodSync(WATCHTOWER_DIR, 0o700);
+  } catch (e) {
+    // chmod may fail on Windows / non-POSIX filesystems; skip silently.
   }
 }