Commit graph

3 commits

Author SHA1 Message Date
copilot-swe-agent[bot]
1b8d8e670d
fix: enforce 0o600 permissions on sensitive files by unlinking before write
Unlink any existing file before writing in writeFileWithMode so the
mode option is always applied on fresh file creation (Node.js ignores
mode for existing files). This prevents inheriting wrong permissions
on Docker bind-mount filesystems such as Synology NAS where ACLs can
cause SSH key files to be created with 755 instead of 600.

The fs.unlink error is only swallowed for ENOENT (file doesn't exist);
other errors (e.g. EPERM) propagate as before. The chmod call is kept
as an additional safety net against umask effects.

A test for the new-file creation case is added alongside the existing
existing-file rewrite test.

Agent-Logs-Url: https://github.com/mowdep/zerobyte/sessions/2a4ab129-9668-402e-8687-d792f9b9e704

Co-authored-by: mowdep <10937987+mowdep@users.noreply.github.com>
2026-05-10 22:08:51 +00:00
Nico
e2c9ef0518
chore: fixed unused types (#824) 2026-04-22 22:04:46 +02:00
Nicolas Meienberger
95006a7471
chore(core package): re-organize files 2026-04-16 19:07:11 +02:00
Renamed from packages/core/src/utils/fs.ts (Browse further)