openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-21 19:25:25 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

[PR #164] [MERGED] fix(cli): secure config file permissions #276

New Issue
Closed
opened 2026-02-15 17:16:37 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:16:37 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/openclaw/clawhub/pull/164
Author: @aronchick
Created: 2/7/2026
Status: ✅ Merged
Merged: 2/13/2026
Merged by: @steipete

Base: main ← Head: fix/secure-config-file-permissions

📝 Commits (2)

  • 752ab32 fix(cli): secure config file permissions and reduce duplication
  • 69b3294 fix(cli): tolerate unsupported chmod errors for config

📊 Changes

2 files changed (+121 additions, -23 deletions)

View changed files

➕ packages/clawdhub/src/config.test.ts (+73 -0)
📝 packages/clawdhub/src/config.ts (+48 -23)

📄 Description

Problem

Config files containing API tokens are created with default permissions (often 0644), making them readable by other users on shared systems.

Solution

  1. Security: Set restrictive file permissions

    • Config files: 0600 (owner read/write only)
    • Config directories: 0700 (owner only)
    • Explicit chmod call for existing files

  2. Maintainability: Extract resolveConfigPath() helper

    • Reduces duplicate 5-line blocks (4x → 1x)
    • Same legacy fallback logic in one place

Changes

  • packages/clawdhub/src/config.ts: Add chmod import, extract helper, secure writeGlobalConfig

Testing

clawhub login
ls -la ~/.config/clawhub/
# Should show: -rw------- config.json (0600)

Greptile Overview

Greptile Summary

This PR updates the CLI global config handling in packages/clawdhub/src/config.ts by (1) centralizing the legacy clawdhub→clawhub fallback logic into resolveConfigPath(), and (2) attempting to harden config persistence by creating the config directory with 0o700, writing the config file with 0o600, and chmod-ing the file on non-Windows platforms after write.

Overall, it aligns config path resolution across macOS/XDG/Windows/default locations and improves token file protection, but the directory-permission hardening is not fully enforced for pre-existing directories.

Confidence Score: 4/5

  • This PR is mostly safe to merge, but directory permission hardening is incomplete for existing config directories.
  • The file-permission changes are straightforward and scoped, and path-resolution refactor is equivalent to the prior logic. The main concern is that directory permissions are only set on creation (and can be affected by umask), so the PR’s stated security guarantees aren’t met when the directory already exists with broader permissions.
  • packages/clawdhub/src/config.ts

(4/5) You can add custom instructions or style guidelines for the agent here!

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/openclaw/clawhub/pull/164 **Author:** [@aronchick](https://github.com/aronchick) **Created:** 2/7/2026 **Status:** ✅ Merged **Merged:** 2/13/2026 **Merged by:** [@steipete](https://github.com/steipete) **Base:** `main` ← **Head:** `fix/secure-config-file-permissions` --- ### 📝 Commits (2) - [`752ab32`](https://github.com/openclaw/clawhub/commit/752ab32a8badafd9db58ba05ac0cb6b3820889af) fix(cli): secure config file permissions and reduce duplication - [`69b3294`](https://github.com/openclaw/clawhub/commit/69b3294e45f2ece7e4b518d95569c6bfa10f711e) fix(cli): tolerate unsupported chmod errors for config ### 📊 Changes **2 files changed** (+121 additions, -23 deletions) <details> <summary>View changed files</summary> ➕ `packages/clawdhub/src/config.test.ts` (+73 -0) 📝 `packages/clawdhub/src/config.ts` (+48 -23) </details> ### 📄 Description ## Problem Config files containing API tokens are created with default permissions (often 0644), making them readable by other users on shared systems. ## Solution 1. **Security:** Set restrictive file permissions - Config files: `0600` (owner read/write only) - Config directories: `0700` (owner only) - Explicit `chmod` call for existing files 2. **Maintainability:** Extract `resolveConfigPath()` helper - Reduces duplicate 5-line blocks (4x → 1x) - Same legacy fallback logic in one place ## Changes - `packages/clawdhub/src/config.ts`: Add chmod import, extract helper, secure writeGlobalConfig ## Testing ```bash clawhub login ls -la ~/.config/clawhub/ # Should show: -rw------- config.json (0600) ``` <!-- greptile_comment --> <h2>Greptile Overview</h2> <h3>Greptile Summary</h3> This PR updates the CLI global config handling in `packages/clawdhub/src/config.ts` by (1) centralizing the legacy `clawdhub`→`clawhub` fallback logic into `resolveConfigPath()`, and (2) attempting to harden config persistence by creating the config directory with `0o700`, writing the config file with `0o600`, and `chmod`-ing the file on non-Windows platforms after write. Overall, it aligns config path resolution across macOS/XDG/Windows/default locations and improves token file protection, but the directory-permission hardening is not fully enforced for pre-existing directories. <h3>Confidence Score: 4/5</h3> - This PR is mostly safe to merge, but directory permission hardening is incomplete for existing config directories. - The file-permission changes are straightforward and scoped, and path-resolution refactor is equivalent to the prior logic. The main concern is that directory permissions are only set on creation (and can be affected by umask), so the PR’s stated security guarantees aren’t met when the directory already exists with broader permissions. - packages/clawdhub/src/config.ts <!-- greptile_other_comments_section --> <sub>(4/5) You can add custom instructions or style guidelines for the agent [here](https://app.greptile.com/review/github)!</sub> <!-- /greptile_comment --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-15 17:16:37 -05:00
yindo closed this issue 2026-02-15 17:16:37 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#276
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?