Repository navigation
fix(cli): write the account credential with private file modes - #1834
Open
ethicnology-agent wants to merge 1 commit into
Open
ethicnology-agent wants to merge 1 commit into
ethicnology-agent wants to merge 1 commit into
Conversation
~/.happy and ~/.happy/access.key were created with no explicit mode, so under the common umask 022 they landed as 0755 and 0644. The file holds the account bearer token and, in the dataKey variant, the machine RPC key, so on a multi-user host any other local account could read it. Three other writers of the same class of material in this repository already set 0700/0600, including packages/happy-agent/src/credentials.ts. Pass the mode at creation and chmod unconditionally afterwards: writeFile's mode option only applies when it creates the file, so existing installations would otherwise keep their current permissions forever.
ethicnology-agent
force-pushed
the
fix/cli-credential-file-modes
branch
from
October 1, 2026 19:02
3eb071c to
70eaae6
Compare
Author
|
Rebased onto current |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the third defect reported in #1830.
Problem
~/.happyand~/.happy/access.keyare created with no explicit mode. Under the commonumask 022that yields directory0755and file0644, measured on macOS. The file holds the account bearer token and, in the dataKey variant, the machine RPC key — so on any host with more than one local account, or on a shared build machine, another account can read it and use it.Three writers of the same class of material in this repository already do this correctly, notably
packages/happy-agent/src/credentials.ts, which uses0700/0600.What this changes
packages/happy-cli/src/persistence.ts— both credential writers passmodeonmkdir/writeFileand thenchmodunconditionally.packages/happy-cli/src/configuration.ts—~/.happyis created0700at startup.packages/happy-cli/src/persistence.test.ts— two cases, one per credential variant.The unconditional
chmodis the part that matters for existing users:writeFile'smodeoption only applies when it creates the file, so without it every installation already on disk would keep0644forever. The test covers exactly that — it loosens the modes to0755/0644, writes again, and asserts they come back to0700/0600.Verified red/green on the audited tree: without the source change the two new cases fail with
expected 493 to be 448(0o755vs0o700); with it,src/persistence.test.tspasses 26/26.What this deliberately does not change
~/.happy/sessions.jsonalso holds per-session encryption keys and is written with no mode. Same class of problem, but it is a different writer and a different call path, so it belongs in its own change rather than widening this diff. Happy to follow up.~/.happy/logs/anddaemon.state.jsonare untouched.Alternative considered
Setting
process.umask()at startup would fix every writer at once, but it silently changes the mode of unrelated files the CLI creates and is invisible at the call site. Explicit modes at the two places that write the credential are easier to review and to keep correct.