troxy-cli 1.4.21 → 1.4.22

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +1 -1
  2. package/src/config.js +8 -2
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "troxy-cli",
3
- "version": "1.4.21",
3
+ "version": "1.4.22",
4
4
  "description": "AI payment control — protect your agent's payments with policies",
5
5
  "type": "module",
6
6
  "bin": {
package/src/config.js CHANGED
@@ -14,6 +14,12 @@ export function loadConfig() {
14
14
  }
15
15
 
16
16
  export function saveConfig(data) {
17
- fs.mkdirSync(CONFIG_DIR, { recursive: true });
18
- fs.writeFileSync(CONFIG_FILE, JSON.stringify(data, null, 2));
17
+ // Owner-only permissions on dir + file — matches what AWS CLI does with
18
+ // ~/.aws/credentials. Stops other users on the same machine from reading
19
+ // the API key. mkdirSync's `mode` is only honoured for newly-created dirs,
20
+ // so we chmod afterwards too to also fix existing pre-secured installs.
21
+ fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
22
+ try { fs.chmodSync(CONFIG_DIR, 0o700); } catch {}
23
+ fs.writeFileSync(CONFIG_FILE, JSON.stringify(data, null, 2), { mode: 0o600 });
24
+ try { fs.chmodSync(CONFIG_FILE, 0o600); } catch {}
19
25
  }