zerobyte/packages/core
copilot-swe-agent[bot] 1b8d8e670d
fix: enforce 0o600 permissions on sensitive files by unlinking before write
Unlink any existing file before writing in writeFileWithMode so the
mode option is always applied on fresh file creation (Node.js ignores
mode for existing files). This prevents inheriting wrong permissions
on Docker bind-mount filesystems such as Synology NAS where ACLs can
cause SSH key files to be created with 755 instead of 600.

The fs.unlink error is only swallowed for ENOENT (file doesn't exist);
other errors (e.g. EPERM) propagate as before. The chmod call is kept
as an additional safety net against umask effects.

A test for the new-file creation case is added alongside the existing
existing-file rewrite test.

Agent-Logs-Url: https://github.com/mowdep/zerobyte/sessions/2a4ab129-9668-402e-8687-d792f9b9e704

Co-authored-by: mowdep <10937987+mowdep@users.noreply.github.com>
2026-05-10 22:08:51 +00:00
..
src fix: enforce 0o600 permissions on sensitive files by unlinking before write 2026-05-10 22:08:51 +00:00
test feat(agents): create agent registry and service (#849) 2026-05-05 19:34:10 +02:00
.gitignore refactor: extract restic in core package (#651) 2026-03-11 21:56:07 +01:00
package.json fix(deps): update bun minor and patch dependencies (#865) 2026-05-07 17:11:53 +02:00
README.md chore: migrate toolchain to vite-plus (#762) 2026-04-09 17:57:19 +02:00
tsconfig.json feat(agent): add standalone agent runtime (#761) 2026-04-08 20:47:15 +02:00
vitest.config.ts test: move test runner from Bun to Vitest (#727) 2026-04-01 20:05:54 +02:00

core

To install dependencies:

vp install

To run:

bun run index.ts

This project was created using bun init in bun v1.3.10. Bun is a fast all-in-one JavaScript runtime.