From 602e48cb01f553595d79fc5b69244d0b6a97aae3 Mon Sep 17 00:00:00 2001 From: Administrator Date: Fri, 19 Jun 2026 17:57:39 +0200 Subject: [PATCH] fix(gateway): write the token registry with owner-only permissions (0600) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit registry.json holds each server's bearer token (the connection secret). It was written with the process default umask, leaving it group/world-readable on POSIX multi-user hosts. Write with mode 0o600 and chmod the existing file (writeFile only applies mode on creation). No-op on Windows (NTFS uses ACLs, and the file already sits under the user profile and is gitignored), effective on Linux/macOS where the gateway may run. Gateway-only change — not part of the app installer or auto-updater, so no version bump. Co-Authored-By: Claude Opus 4.8 (1M context) --- gateway/registry.js | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/gateway/registry.js b/gateway/registry.js index de948d9..70df937 100644 --- a/gateway/registry.js +++ b/gateway/registry.js @@ -1,4 +1,4 @@ -import { readFile, writeFile } from 'node:fs/promises'; +import { readFile, writeFile, chmod } from 'node:fs/promises'; import { fileURLToPath } from 'node:url'; import { dirname, join } from 'node:path'; @@ -20,7 +20,8 @@ export async function loadRegistry() { export async function saveRegistry(registry) { const data = registry && typeof registry === 'object' ? registry : {}; - await writeFile(REGISTRY_PATH, JSON.stringify(data, null, 2) + '\n', 'utf8'); + await writeFile(REGISTRY_PATH, JSON.stringify(data, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 }); + try { await chmod(REGISTRY_PATH, 0o600); } catch {} } export async function upsertEntry(entry) {