total-recall-brain 3.30.2 → 3.31.2

package/src/server/index.mjs

@@ -18,6 +18,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import zlib from 'node:zlib';
 import fs from 'node:fs';
+import { writeFileSecure } from '../core/secure-file.mjs';
 import {
   apiRateLimiter,
   corsOptions,
@@ -1078,7 +1079,7 @@ if (HOST !== '127.0.0.1' && HOST !== '0.0.0.0') {
           wizardCfg['cfg-dash-url'] = `${tunnelUrl}/dashboard`;
           wizardCfg['cfg-health-url'] = `${tunnelUrl}/health`;
 
-          fs.writeFileSync(configFile, JSON.stringify(wizardCfg, null, 2), { encoding: 'utf8', mode: 0o600 });
+          writeFileSecure(configFile, JSON.stringify(wizardCfg, null, 2), { encoding: 'utf8', mode: 0o600 });
           logger.info('server', `Updated wizard-config.json with active Quick Tunnel URL: ${tunnelUrl}`);
         } else {
           logger.warn('server', 'Could not allocate Quick Tunnel URL. Please check logs in brainDir/logs/cloudflared.log');

package/src/server/routes/collab.mjs

@@ -6,6 +6,7 @@ import bcrypt from 'bcrypt';
 import jwt from 'jsonwebtoken';
 import { WebSocket } from 'ws';
 import { brainDir as configBrainDir } from '../../core/config.mjs';
+import { chmodSecure, writeFileSecure } from '../../core/secure-file.mjs';
 
 // Setup database paths in brainDir
 const DATA_DIR = path.join(configBrainDir, 'collab');
@@ -22,10 +23,13 @@ export function resolveJwtSecret(env = process.env, secretFile = JWT_SECRET_FILE
   if (env.JWT_SECRET) return env.JWT_SECRET;
   try {
     const existing = fs.readFileSync(secretFile, 'utf8').trim();
-    if (existing.length >= 32) return existing;
+    if (existing.length >= 32) {
+      chmodSecure(secretFile);
+      return existing;
+    }
   } catch { /* not created yet */ }
   const generated = crypto.randomBytes(48).toString('base64url');
-  fs.writeFileSync(secretFile, generated, { encoding: 'utf8', mode: 0o600 });
+  writeFileSecure(secretFile, generated, { encoding: 'utf8' });
   return generated;
 }
 const JWT_SECRET = resolveJwtSecret();
@@ -44,7 +48,7 @@ function readJsonFile(filePath, defaultData = []) {
 }
 
 function writeJsonFile(filePath, data) {
-  fs.writeFileSync(filePath, JSON.stringify(data, null, 2), 'utf8');
+  writeFileSecure(filePath, JSON.stringify(data, null, 2), { encoding: 'utf8' });
 }
 
 // ─── Database Helpers ────────────────────────────────────────────────────────

package/src/server/routes/config.mjs

@@ -15,6 +15,7 @@ import yaml from 'yaml';
 import { requireAuth, requireScope, loadSecurityConfig } from '../auth.mjs';
 import { BRAIN_DIR, CONFIG_DIR, AGENT_DIR, serverError, badRequest } from './_shared.mjs';
 import { loadRuntimeConfig } from '../../core/runtime.mjs';
+import { writeFileSecure } from '../../core/secure-file.mjs';
 
 const router = Router();
 
@@ -152,10 +153,10 @@ router.post('/api/config-json', requireAuth, requireScope('config:write'), async
     }
 
     if (security) {
-      fs.writeFileSync(securityPath, yaml.stringify(security), { encoding: 'utf8', mode: 0o600 });
+      writeFileSecure(securityPath, yaml.stringify(security), { encoding: 'utf8', mode: 0o600 });
     }
     if (budget) {
-      fs.writeFileSync(budgetPath, yaml.stringify(budget), { encoding: 'utf8', mode: 0o600 });
+      writeFileSecure(budgetPath, yaml.stringify(budget), { encoding: 'utf8', mode: 0o600 });
     }
     if (brain) {
       let existingBrain = {};
@@ -167,7 +168,7 @@ router.post('/api/config-json', requireAuth, requireScope('config:write'), async
         nextBrain.token = existingBrain.token;
       }
       delete nextBrain.has_token;
-      fs.writeFileSync(brainPath, JSON.stringify(nextBrain, null, 2), { encoding: 'utf8', mode: 0o600 });
+      writeFileSecure(brainPath, JSON.stringify(nextBrain, null, 2), { encoding: 'utf8', mode: 0o600 });
     }
     if (secrets) {
       // Only accept real secret values — ignore masked placeholders from GET /api/config-json.