@askalf/dario - npm Package Compare versions

Comparing version 5.4.21 to 5.4.22

dist/live-fingerprint.js

@@ -344,6 +344,16 @@ /**
 function atomicWriteJson(targetPath, data) {
-    mkdirSync(dirname(targetPath), { recursive: true });
+    // 0700: whichever code path creates ~/.dario first decides that directory's
+    // permissions, and this one runs at startup, before any credential write.
+    // Without a mode it lands 755 on Linux, which makes every non-0600 file inside
+    // world-readable. The credential paths already create their dirs 0700; this was
+    // the one that could get there first and did not.
+    mkdirSync(dirname(targetPath), { recursive: true, mode: 0o700 });
     const tmp = `${targetPath}.${process.pid}.tmp`;
     try {
-        writeFileSync(tmp, JSON.stringify(data, null, 2));
+        // 0600: this file holds the UNSCRUBBED live capture. Verified on the Linux
+        // deployment to contain `# Environment` (cwd, OS, platform) and `gitStatus:`
+        // (branch, modified files, recent commits); structurally it can also carry
+        // `# claudeMd`, `# userEmail` and `# auto memory` — the scrub list exists
+        // because CC emits them. Credentials beside it are 0600; this was 0644.
+        writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 0o600 });
         renameSync(tmp, targetPath);
@@ -350,0 +360,0 @@ }

package.json

 {
   "name": "@askalf/dario",
-  "version": "5.4.21",
+  "version": "5.4.22",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
@@ -5,0 +5,0 @@ "type": "module",

New alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

1735742

0.08%

Lines of code

28747

0.06%

No dependency changes