kubeagent 0.1.14 → 0.1.16

package/dist/auth.js

@@ -1,4 +1,4 @@
-import { readFileSync, writeFileSync, existsSync, mkdirSync, unlinkSync } from "node:fs";
+import { readFileSync, writeFileSync, existsSync, mkdirSync, unlinkSync, chmodSync } from "node:fs";
 import { join } from "node:path";
 import { createServer } from "node:http";
 import { randomBytes } from "node:crypto";
@@ -31,8 +31,18 @@ export function loadAuth() {
 export function saveAuth(auth) {
     const dir = configDir();
     if (!existsSync(dir))
-        mkdirSync(dir, { recursive: true });
-    writeFileSync(authPath(), JSON.stringify(auth, null, 2));
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const path = authPath();
+    // Write with mode 0600 so only the owning user can read the file.
+    // This is the fallback for platforms where a system keychain is unavailable.
+    // To use the OS keychain instead (recommended for production), install `keytar`
+    // and store auth.token and auth.apiKey there, keeping only non-secret fields here.
+    writeFileSync(path, JSON.stringify(auth, null, 2), { mode: 0o600 });
+    // Ensure permissions even if the file already existed with looser permissions.
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch { /* non-POSIX platforms ignore this */ }
 }
 export function clearAuth() {
     const path = authPath();

package/dist/orchestrator.js

@@ -11,6 +11,7 @@ import { renderMarkdown, sectionHeader, commandBox } from "./render.js";
 import { broadcastQuestion } from "./notify/index.js";
 import readline from "node:readline";
 const MAX_ATTEMPTS = 3;
+let localChannelWarningShown = false;
 const issueHistory = new Map();
 function issueKey(issue) {
     return `${issue.kind}:${issue.namespace ?? ""}:${issue.resource ?? ""}`;
@@ -115,6 +116,15 @@ export async function handleIssues(issues, config, clusterContext, noInteractive
     }
     if (actionableIssues.length === 0)
         return;
+    // Warn once if user still has local notification channels configured
+    if (config.notifications.channels.length && !localChannelWarningShown) {
+        localChannelWarningShown = true;
+        console.log(chalk.yellow("⚠")
+            + " Local notification channels detected in config. "
+            + "These are no longer used — configure notifications on your dashboard instead: "
+            + chalk.cyan("https://app.kubeagent.net/dashboard"));
+    }
+    // Dispatch via server when authenticated (SaaS-managed integrations)
     const auth = loadAuth();
     if (auth?.apiKey) {
         await notifyViaServer(auth, actionableIssues, clusterContext);

package/dist/telemetry.js

@@ -8,16 +8,16 @@ export function sendTelemetry(cliVersion) {
     // Only fire once per machine
     if (existsSync(SENT_FILE))
         return;
-    // Mark as sent immediately to avoid duplicate attempts
+    // Ensure directory exists
     try {
         if (!existsSync(TELEMETRY_DIR))
             mkdirSync(TELEMETRY_DIR, { recursive: true });
-        writeFileSync(SENT_FILE, new Date().toISOString());
     }
     catch {
         return;
     }
     // Fire-and-forget — never block the CLI
+    // Only mark as sent after successful delivery
     const payload = JSON.stringify({
         event: "cli_first_run",
         cliVersion,
@@ -30,5 +30,9 @@ export function sendTelemetry(cliVersion) {
         headers: { "Content-Type": "application/json" },
         body: payload,
         signal: AbortSignal.timeout(5000),
+    }).then((res) => {
+        if (res.ok) {
+            writeFileSync(SENT_FILE, new Date().toISOString());
+        }
     }).catch(() => { });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kubeagent",
-  "version": "0.1.14",
+  "version": "0.1.16",
   "description": "AI-powered Kubernetes management CLI",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",