total-recall-brain 3.31.0 → 3.31.2

package/frontend/dist/index.html

@@ -17,7 +17,7 @@
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet" />
     <title>Total Recall — Portable Memory</title>
-    <script type="module" crossorigin src="/assets/index-DGMNZi_1.js"></script>
+    <script type="module" crossorigin src="/assets/index-FOJG4jQh.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-C7_Xpk27.css">
   </head>
   <body>

package/frontend/package.json

@@ -16,7 +16,7 @@
     "react": "^19.2.6",
     "react-dom": "^19.2.6",
     "react-force-graph-3d": "^1.29.1",
-    "react-router-dom": "^7.15.0",
+    "react-router-dom": "^7.18.4",
     "recharts": "^3.9.2",
     "three": "^0.185.1",
     "three-spritetext": "^1.10.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "total-recall-brain",
-  "version": "3.31.0",
+  "version": "3.31.2",
   "description": "Personal AI system — database-free, SSSS-powered intelligence engine deployable to any POSIX host.",
   "type": "module",
   "workspaces": [

package/scaffold/.agent/skills/total-recall/SKILL.md

@@ -16,7 +16,6 @@ repo_scoped: true
 > **Only agent skill in this package.** Implementation helpers live in `modules/` (not skills).
 > Openwiki ships with the brain at `openwiki/`.
 
-
 Welcome to the master control skill for the **Total Recall Autonomous AI OS**. > [!NOTE]
 > **Total Recall Architecture:**
 > The Total Recall memory kernel runs as a standalone REST service. Agents interact with the memory vault, perform semantic searches, and compile rules directly using lightweight, filesystem-native REST API calls via standard shell `curl` commands.
@@ -555,12 +554,6 @@ that dead-ends back at a manual dashboard step.
 
 ---
 
-<!-- BEGIN INJECTED MEMORY: do not edit by hand; rebuilt by total-recall surface -->
-<!-- @route: tfidf, generated_at: 2026-05-21T03:34:14.837Z -->
-
-<!-- END INJECTED MEMORY -->
-
-
 ---
 
 ## 🕸️ MESH / CONTROL SERVER (`mesh` subcommand)

package/src/cli/config.mjs

@@ -2,6 +2,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import yaml from 'yaml';
 import { resolveBrainDir, parseLayerFlag } from './agent-dir.mjs';
+import { writeFileSecure } from '../core/secure-file.mjs';
 
 // Pre-defined mapping of known settings
 const KEY_MAP = {
@@ -224,7 +225,7 @@ export default async function configCommand(args) {
       if (!fs.existsSync(configDir)) {
         fs.mkdirSync(configDir, { recursive: true });
       }
-      fs.writeFileSync(targetPath, yaml.stringify(targetObj), { encoding: 'utf8', mode: 0o600 });
+      writeFileSecure(targetPath, yaml.stringify(targetObj), { encoding: 'utf8', mode: 0o600 });
 
       console.log(`\n  ✅ Success! Config key "${key}" ${layerLabel} set to: ${JSON.stringify(parsedValue)}`);
       console.log(`  📍 Saved in: ${targetPath}\n`);

package/src/cli/deploy-ui.mjs

@@ -19,6 +19,7 @@ import os from 'node:os';
 import path from 'node:path';
 import bcrypt from 'bcrypt';
 import yaml from 'yaml';
+import { writeFileSecure } from '../core/secure-file.mjs';
 import { BCRYPT_COST } from '../server/auth.mjs';
 
 
@@ -175,7 +176,7 @@ export function startDeployUI(port = 3001) {
               if (opts.cloudRegion) current['cfg-cloud-region'] = opts.cloudRegion;
               if (opts.installGlobal !== undefined) current['installGlobal'] = opts.installGlobal;
               if (opts.projectPaths) current['projectPaths'] = opts.projectPaths;
-              fs.writeFileSync(configFile, JSON.stringify(current, null, 2), { encoding: 'utf8', mode: 0o600 });
+              writeFileSecure(configFile, JSON.stringify(current, null, 2), { encoding: 'utf8', mode: 0o600 });
 
             } catch (e) {
               console.error('Failed to auto-persist install options on disk:', e);
@@ -572,7 +573,7 @@ export function startDeployUI(port = 3001) {
             }
 
             const updated = { ...current, ...data };
-            fs.writeFileSync(configFile, JSON.stringify(updated, null, 2), { encoding: 'utf8', mode: 0o600 });
+            writeFileSecure(configFile, JSON.stringify(updated, null, 2), { encoding: 'utf8', mode: 0o600 });
             syncInstallOptionsFromDisk();
 
             res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -1114,7 +1115,7 @@ export function startDeployUI(port = 3001) {
             }
             current['cfg-github-token'] = token;
             current['backupRepo'] = backupUrl;
-            fs.writeFileSync(configFile, JSON.stringify(current, null, 2), { encoding: 'utf8', mode: 0o600 });
+            writeFileSecure(configFile, JSON.stringify(current, null, 2), { encoding: 'utf8', mode: 0o600 });
 
             log('✅ Encryption keys and tokens written.');
 
@@ -1735,7 +1736,7 @@ console.log("REMOTE_PASS_OK");
       if (_installOptions.dashboardPassword) {
         current['cfg-dashboard-password'] = _installOptions.dashboardPassword;
       }
-      fs.writeFileSync(configFile, JSON.stringify(current, null, 2), { encoding: 'utf8', mode: 0o600 });
+      writeFileSecure(configFile, JSON.stringify(current, null, 2), { encoding: 'utf8', mode: 0o600 });
     } catch (e) {
       console.error('Failed to auto-persist remote install options on disk:', e);
     }

package/src/cli/deploy.mjs

@@ -43,6 +43,7 @@ import yaml from 'yaml';
 import bcrypt from 'bcrypt';
 import crypto from 'node:crypto';
 import { BCRYPT_COST } from '../server/auth.mjs';
+import { writeFileSecure } from '../core/secure-file.mjs';
 
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -407,7 +408,7 @@ function hardenSecurityConfig(dryRun, dashboardPassword = null) {
     log('  🔑 Dashboard credentials left unconfigured. You will set your admin password on first dashboard access.');
   }
 
-  fs.writeFileSync(securityPath, yaml.stringify(config), { encoding: 'utf8', mode: 0o600 });
+  writeFileSecure(securityPath, yaml.stringify(config), { encoding: 'utf8', mode: 0o600 });
   logOk('Security config hardened: HTTPS required, Express bound to localhost, no public health, no legacy local PAT');
 }
 
@@ -1095,7 +1096,7 @@ export default async function deploy(args) {
           if (wizardOpts.dashboardPassword) {
             current['cfg-dashboard-password'] = wizardOpts.dashboardPassword;
           }
-          fs.writeFileSync(configFile, JSON.stringify(current, null, 2), { encoding: 'utf8', mode: 0o600 });
+          writeFileSecure(configFile, JSON.stringify(current, null, 2), { encoding: 'utf8', mode: 0o600 });
         } catch (e) {
           console.error('Failed to auto-persist cloud install options on disk:', e);
         }

package/src/cli/init.mjs

@@ -31,6 +31,7 @@ import os from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { exec, spawn, spawnSync } from 'node:child_process';
 import { projectSkillsForScope, detectActiveSkillTargets } from './skill-projection.mjs';
+import { writeFileSecure } from '../core/secure-file.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT = path.join(__dirname, '..', '..');
@@ -408,10 +409,10 @@ export default async function init(args) {
       }
 
       if (!config.dashboard.password_hash) {
-        fs.writeFileSync(securityPath, yaml.stringify(config), { encoding: "utf8", mode: 0o600 });
+        writeFileSecure(securityPath, yaml.stringify(config), { encoding: "utf8", mode: 0o600 });
         passwordMessage = "\n  🔑 Dashboard Access: Unconfigured\n     (You will be prompted to set your password upon first browser access)";
       } else {
-        fs.writeFileSync(securityPath, yaml.stringify(config), { encoding: 'utf8', mode: 0o600 });
+        writeFileSecure(securityPath, yaml.stringify(config), { encoding: 'utf8', mode: 0o600 });
         passwordMessage = '\n  🔑 Dashboard credentials preserved (custom password hash already configured)';
       }
     } catch (err) {
@@ -586,7 +587,7 @@ export default async function init(args) {
       current['cfg-health-url'] = 'http://localhost:3000/health';
     }
 
-    fs.writeFileSync(configFile, JSON.stringify(current, null, 2), { encoding: 'utf8', mode: 0o600 });
+    writeFileSecure(configFile, JSON.stringify(current, null, 2), { encoding: 'utf8', mode: 0o600 });
     logOk('UI deploy configuration persisted to wizard-config.json!');
   }
 
@@ -670,7 +671,7 @@ export default async function init(args) {
     fs.mkdirSync(cfgDir, { recursive: true });
     const brainCfg = { url: opts.brain };
     if (opts.token) brainCfg.token = opts.token;
-    fs.writeFileSync(path.join(cfgDir, 'brain.json'), JSON.stringify(brainCfg, null, 2), { mode: 0o600 });
+    writeFileSecure(path.join(cfgDir, 'brain.json'), JSON.stringify(brainCfg, null, 2), { mode: 0o600 });
     logOk(`Registered brain at ${opts.brain}. Run \`npx total-recall sync\` to pull instructions.`);
   } else {
     // Zero-config bootstrap: auto-generate localhost brain.json and valid Developer PAT out-of-the-box
@@ -696,7 +697,7 @@ export default async function init(args) {
         const keyData = issueKey('Default Local Developer Key', { scopes: ['*'] });
         brainCfg.url = brainCfg.url || 'http://localhost:3000';
         brainCfg.token = brainCfg.token || keyData.token;
-        fs.writeFileSync(brainJsonPath, JSON.stringify(brainCfg, null, 2), { mode: 0o600 });
+        writeFileSecure(brainJsonPath, JSON.stringify(brainCfg, null, 2), { mode: 0o600 });
         logOk(`Bootstrap configuration successfully generated and pre-authorized at ${brainCfg.url}`);
       } catch (err) {
         logWarn(`Could not auto-generate bootstrap developer key: ${err.message}`);
@@ -786,7 +787,7 @@ export default async function init(args) {
           current['cfg-dash-url'] = `${tunnelUrl}/`;
           current['cfg-health-url'] = `${tunnelUrl}/health`;
           
-          fs.writeFileSync(configFile, JSON.stringify(current, null, 2), { encoding: 'utf8', mode: 0o600 });
+          writeFileSecure(configFile, JSON.stringify(current, null, 2), { encoding: 'utf8', mode: 0o600 });
           logOk('Registered Quick Tunnel URL in wizard-config.json!');
           dashboardUrl = `${tunnelUrl}/`;
         } else {

package/src/cli/reset-password.mjs

@@ -5,6 +5,7 @@ import bcrypt from 'bcrypt';
 import yaml from 'yaml';
 import { BCRYPT_COST } from '../server/auth.mjs';
 import { brainDir } from '../core/config.mjs';
+import { writeFileSecure } from '../core/secure-file.mjs';
 
 /**
  * Read a password without echoing it, and without it ever becoming an argv
@@ -128,7 +129,7 @@ export default async function resetPassword(args) {
   const isDefault = password === 'totalrecall';
   config.dashboard.force_password_reset = isDefault;
 
-  fs.writeFileSync(securityPath, yaml.stringify(config), { encoding: 'utf8', mode: 0o600 });
+  writeFileSecure(securityPath, yaml.stringify(config), { encoding: 'utf8', mode: 0o600 });
 
   // Never echo the password back. The operator just typed it; repeating it to
   // stdout puts it into scrollback, into any log capturing this command, and

package/src/cli/uninstall.mjs

@@ -30,6 +30,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { spawnSync, execFileSync } from 'node:child_process';
 import backup from './backup.mjs';
+import { writeFileSecure } from '../core/secure-file.mjs';
 
 // ╔══════════════════════════════════════════════════════════════════════════╗
 // ║  FORBIDDEN FLAGS — These patterns must NEVER be accepted as arguments  ║
@@ -531,7 +532,7 @@ export default async function uninstall(args = []) {
       
       if (Object.keys(secretsObj).length > 0) {
         fs.mkdirSync(agentDir, { recursive: true });
-        fs.writeFileSync(
+        writeFileSecure(
           path.join(agentDir, 'secrets.enc'),
           JSON.stringify(secretsObj, null, 2),
           { encoding: 'utf8', mode: 0o600 }

package/src/core/project-brain.mjs

@@ -19,6 +19,7 @@ import fs from 'fs';
 import path from 'path';
 import { fileURLToPath } from 'url';
 import YAML from 'yaml';
+import { writeFileSecure } from './secure-file.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT = path.resolve(__dirname, '../..');
@@ -162,7 +163,7 @@ export function writeBrainIdentity(brainDir, { name, role = 'project', tags = []
     updated_at: new Date().toISOString(),
     created_at: current.created_at || new Date().toISOString(),
   };
-  fs.writeFileSync(brainJsonPath, JSON.stringify(next, null, 2), { encoding: 'utf8', mode: 0o600 });
+  writeFileSecure(brainJsonPath, JSON.stringify(next, null, 2), { encoding: 'utf8', mode: 0o600 });
   return next;
 }
 

package/src/core/secrets-store.mjs

@@ -13,6 +13,7 @@ import os from 'os';
 import YAML from 'yaml';
 import { encryptSecrets, decryptSecrets, encryptSecretsSync, decryptSecretsSync } from './crypto.mjs';
 import { DEFAULT_KEYCHAIN_SERVICE, readKeychainPassword } from './secrets-keychain.mjs';
+import { writeFileSecure, appendFileSecure } from './secure-file.mjs';
 
 const META_KEY = '__tr_secrets_meta';
 
@@ -170,7 +171,7 @@ export function saveSecretsSync(brainDir, obj) {
   const password = secretsPassword();
   if (!password) throw new Error('TR_SECRETS_PASSWORD or TR_MASTER_PASSWORD is required to write secrets');
   const buf = encryptSecretsSync(obj, password);
-  fs.writeFileSync(filePath, buf, { mode: 0o600 });
+  writeFileSecure(filePath, buf, { mode: 0o600 });
 }
 
 /**
@@ -221,7 +222,7 @@ export async function saveSecrets(brainDir, secrets) {
 
   if (!password) throw new Error('TR_SECRETS_PASSWORD or TR_MASTER_PASSWORD is required to write secrets');
   const buf = await encryptSecrets(secrets, password);
-  fs.writeFileSync(filePath, buf, { mode: 0o600 });
+  writeFileSecure(filePath, buf, { mode: 0o600 });
 }
 
 /**
@@ -314,7 +315,7 @@ function appendAudit(brainDir, event) {
     ...event,
     // never include values
   });
-  fs.appendFileSync(auditPath, line + '\n', { mode: 0o600 });
+  appendFileSecure(auditPath, line + '\n', { mode: 0o600 });
 }
 
 /**
@@ -983,7 +984,7 @@ export function recordUsage(brainDir, event) {
     source: event.source || 'cli',
     key_ref: event.key_ref || null, // secret *name* only, never value
   };
-  fs.appendFileSync(usagePath, JSON.stringify(row) + '\n', { mode: 0o600 });
+  appendFileSecure(usagePath, JSON.stringify(row) + '\n', { mode: 0o600 });
   return row;
 }
 

package/src/core/secure-file.mjs

@@ -0,0 +1,71 @@
+/**
+ * Secure file writes for credential-bearing files.
+ *
+ * `fs.writeFileSync`/`fs.appendFileSync` only apply their `mode` option when the
+ * file is CREATED. Rewriting a file that already exists silently preserves the
+ * old permissions, so a security.yml or secrets.enc that was ever created under
+ * a loose umask (or restored from a backup, or copied by a sync) stays
+ * world-readable forever no matter how many times it is rewritten with
+ * `{ mode: 0o600 }`.
+ *
+ * Observed live: config/security.yml at mode 644 while holding the dashboard
+ * bcrypt password_hash.
+ *
+ * Every writer of a file containing hashes, tokens, or key material must go
+ * through here so the mode is re-asserted on every write, not just the first.
+ */
+
+import fs from 'fs';
+
+export const SECRET_FILE_MODE = 0o600;
+
+/**
+ * Re-assert permissions on an existing file.
+ *
+ * @param {string} filePath
+ * @param {number} [mode]
+ * @returns {boolean} true when the mode was applied
+ */
+export function chmodSecure(filePath, mode = SECRET_FILE_MODE) {
+  try {
+    fs.chmodSync(filePath, mode);
+    return true;
+  } catch {
+    // Best effort: chmod can fail on non-POSIX filesystems.
+    return false;
+  }
+}
+
+function requireSecureMode(filePath, mode) {
+  if (!chmodSecure(filePath, mode)) {
+    throw new Error(`Could not secure file permissions: ${filePath}`);
+  }
+}
+
+/**
+ * writeFileSync that actually enforces `mode` on rewrite.
+ *
+ * @param {string} filePath
+ * @param {string|Buffer} data
+ * @param {object} [options] same as fs.writeFileSync; `mode` defaults to 0o600
+ */
+export function writeFileSecure(filePath, data, options = {}) {
+  const { mode = SECRET_FILE_MODE, ...rest } = options;
+  if (fs.existsSync(filePath)) requireSecureMode(filePath, SECRET_FILE_MODE);
+  fs.writeFileSync(filePath, data, { ...rest, mode });
+  requireSecureMode(filePath, mode);
+}
+
+/**
+ * appendFileSync that actually enforces `mode` on an existing file.
+ *
+ * @param {string} filePath
+ * @param {string|Buffer} data
+ * @param {object} [options] same as fs.appendFileSync; `mode` defaults to 0o600
+ */
+export function appendFileSecure(filePath, data, options = {}) {
+  const { mode = SECRET_FILE_MODE, ...rest } = options;
+  if (fs.existsSync(filePath)) requireSecureMode(filePath, SECRET_FILE_MODE);
+  fs.appendFileSync(filePath, data, { ...rest, mode });
+  requireSecureMode(filePath, mode);
+}

package/src/core/webauthn-store.mjs

@@ -9,6 +9,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
+import { writeFileSecure } from './secure-file.mjs';
 import {
   generateRegistrationOptions,
   verifyRegistrationResponse,
@@ -49,7 +50,7 @@ function loadStore(brainDir) {
 function saveStore(brainDir, store) {
   const filePath = resolveWebAuthnPath(brainDir);
   fs.mkdirSync(path.dirname(filePath), { recursive: true });
-  fs.writeFileSync(filePath, JSON.stringify(store, null, 2) + '\n', {
+  writeFileSecure(filePath, JSON.stringify(store, null, 2) + '\n', {
     encoding: 'utf8',
     mode: 0o600,
   });

package/src/server/auth.mjs

@@ -11,6 +11,7 @@ import { findValidKeyByToken, keyHasAnyScope, recordKeyUsage } from './keys.mjs'
 import { logger } from '../core/logger.mjs';
 
 import { agentDir, brainDir, sessionSecret, nodeEnv } from '../core/config.mjs';
+import { writeFileSecure } from '../core/secure-file.mjs';
 
 const BRAIN_DIR = brainDir;
 const CONFIG_FILE = path.join(BRAIN_DIR, 'config', 'security.yml');
@@ -26,7 +27,7 @@ try {
   JWT_SECRET = crypto.randomBytes(32).toString('hex');
   try {
     fs.mkdirSync(path.dirname(JWT_SECRET_PATH), { recursive: true });
-    fs.writeFileSync(JWT_SECRET_PATH, JWT_SECRET, { mode: 0o600 });
+    writeFileSecure(JWT_SECRET_PATH, JWT_SECRET, { mode: 0o600 });
   } catch { /* non-fatal — will regenerate on next restart */ }
 }
 
@@ -450,7 +451,7 @@ export async function changePasswordHandler(req, res) {
   config.dashboard.password_hash = hash;
   config.dashboard.force_password_reset = false;
 
-  fs.writeFileSync(CONFIG_FILE, yaml.stringify(config));
+  writeFileSecure(CONFIG_FILE, yaml.stringify(config), { encoding: 'utf8', mode: 0o600 });
 
   // Dynamically update the backup secrets.enc file to preserve the password hash
   try {

package/src/server/index.mjs

@@ -18,6 +18,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import zlib from 'node:zlib';
 import fs from 'node:fs';
+import { writeFileSecure } from '../core/secure-file.mjs';
 import {
   apiRateLimiter,
   corsOptions,
@@ -1078,7 +1079,7 @@ if (HOST !== '127.0.0.1' && HOST !== '0.0.0.0') {
           wizardCfg['cfg-dash-url'] = `${tunnelUrl}/dashboard`;
           wizardCfg['cfg-health-url'] = `${tunnelUrl}/health`;
 
-          fs.writeFileSync(configFile, JSON.stringify(wizardCfg, null, 2), { encoding: 'utf8', mode: 0o600 });
+          writeFileSecure(configFile, JSON.stringify(wizardCfg, null, 2), { encoding: 'utf8', mode: 0o600 });
           logger.info('server', `Updated wizard-config.json with active Quick Tunnel URL: ${tunnelUrl}`);
         } else {
           logger.warn('server', 'Could not allocate Quick Tunnel URL. Please check logs in brainDir/logs/cloudflared.log');

package/src/server/routes/collab.mjs

@@ -6,6 +6,7 @@ import bcrypt from 'bcrypt';
 import jwt from 'jsonwebtoken';
 import { WebSocket } from 'ws';
 import { brainDir as configBrainDir } from '../../core/config.mjs';
+import { chmodSecure, writeFileSecure } from '../../core/secure-file.mjs';
 
 // Setup database paths in brainDir
 const DATA_DIR = path.join(configBrainDir, 'collab');
@@ -22,10 +23,13 @@ export function resolveJwtSecret(env = process.env, secretFile = JWT_SECRET_FILE
   if (env.JWT_SECRET) return env.JWT_SECRET;
   try {
     const existing = fs.readFileSync(secretFile, 'utf8').trim();
-    if (existing.length >= 32) return existing;
+    if (existing.length >= 32) {
+      chmodSecure(secretFile);
+      return existing;
+    }
   } catch { /* not created yet */ }
   const generated = crypto.randomBytes(48).toString('base64url');
-  fs.writeFileSync(secretFile, generated, { encoding: 'utf8', mode: 0o600 });
+  writeFileSecure(secretFile, generated, { encoding: 'utf8' });
   return generated;
 }
 const JWT_SECRET = resolveJwtSecret();
@@ -44,7 +48,7 @@ function readJsonFile(filePath, defaultData = []) {
 }
 
 function writeJsonFile(filePath, data) {
-  fs.writeFileSync(filePath, JSON.stringify(data, null, 2), 'utf8');
+  writeFileSecure(filePath, JSON.stringify(data, null, 2), { encoding: 'utf8' });
 }
 
 // ─── Database Helpers ────────────────────────────────────────────────────────

package/src/server/routes/config.mjs

@@ -15,6 +15,7 @@ import yaml from 'yaml';
 import { requireAuth, requireScope, loadSecurityConfig } from '../auth.mjs';
 import { BRAIN_DIR, CONFIG_DIR, AGENT_DIR, serverError, badRequest } from './_shared.mjs';
 import { loadRuntimeConfig } from '../../core/runtime.mjs';
+import { writeFileSecure } from '../../core/secure-file.mjs';
 
 const router = Router();
 
@@ -152,10 +153,10 @@ router.post('/api/config-json', requireAuth, requireScope('config:write'), async
     }
 
     if (security) {
-      fs.writeFileSync(securityPath, yaml.stringify(security), { encoding: 'utf8', mode: 0o600 });
+      writeFileSecure(securityPath, yaml.stringify(security), { encoding: 'utf8', mode: 0o600 });
     }
     if (budget) {
-      fs.writeFileSync(budgetPath, yaml.stringify(budget), { encoding: 'utf8', mode: 0o600 });
+      writeFileSecure(budgetPath, yaml.stringify(budget), { encoding: 'utf8', mode: 0o600 });
     }
     if (brain) {
       let existingBrain = {};
@@ -167,7 +168,7 @@ router.post('/api/config-json', requireAuth, requireScope('config:write'), async
         nextBrain.token = existingBrain.token;
       }
       delete nextBrain.has_token;
-      fs.writeFileSync(brainPath, JSON.stringify(nextBrain, null, 2), { encoding: 'utf8', mode: 0o600 });
+      writeFileSecure(brainPath, JSON.stringify(nextBrain, null, 2), { encoding: 'utf8', mode: 0o600 });
     }
     if (secrets) {
       // Only accept real secret values — ignore masked placeholders from GET /api/config-json.