openfused 0.4.0 → 0.4.1

package/dist/wasm-core.js

@@ -4,7 +4,7 @@
 // Networking (sync, registry, watch) stays in Node.js.
 import { WASI } from "node:wasi";
 import { readFileSync } from "node:fs";
-import { readFile, writeFile, mkdtemp, rm } from "node:fs/promises";
+import { readFile, mkdtemp, rm } from "node:fs/promises";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { tmpdir } from "node:os";
@@ -23,11 +23,13 @@ function getModule() {
 }
 async function callWasm(storeRoot, args) {
     // Create a temp file to capture stdout (node:wasi doesn't support piping stdout directly)
+    // Restrictive permissions: 0o700 dir + 0o600 file — prevents other users from reading
+    // WASM output which may contain decrypted messages, keys, or config data.
     const tmpDir = await mkdtemp(join(tmpdir(), "openfuse-wasi-"));
+    const { chmodSync, openSync, closeSync } = await import("node:fs");
+    chmodSync(tmpDir, 0o700);
     const stdoutPath = join(tmpDir, "stdout");
-    await writeFile(stdoutPath, "");
-    const { openSync, closeSync } = await import("node:fs");
-    const fd = openSync(stdoutPath, "w");
+    const fd = openSync(stdoutPath, "w", 0o600);
     try {
         const wasi = new WASI({
             version: "preview1",
@@ -70,7 +72,7 @@ async function callWasm(storeRoot, args) {
 async function callWasmJson(storeRoot, args) {
     const { stdout, exitCode } = await callWasm(storeRoot, args);
     if (!stdout) {
-        throw new Error(`WASM returned empty output for: ${args.join(" ")}`);
+        throw new Error(`WASM returned empty output for command: ${args[0] ?? "unknown"}`);
     }
     const parsed = JSON.parse(stdout);
     if (exitCode !== 0 && parsed.error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openfused",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "The file protocol for AI agent context. Encrypted, signed, peer-to-peer.",
   "license": "MIT",
   "type": "module",
@@ -36,7 +36,7 @@
   },
   "devDependencies": {
     "@types/node": "^25.5.0",
-    "typescript": "^5.9.3"
+    "typescript": "^6.0.2"
   },
   "engines": {
     "node": ">=20"