fix(security): harden file permissions, remove info leaks (#3363, #3365, #3360)

[OneStepAt4time]

Summary

Three security hardening fixes from the dogfooding audit:

#3363 — File permissions (P2)

All state files now created with mode: 0o600 (owner-only):

• state.json (JsonFileStore — save + backup)
• pipelines.json (JsonFileStore — save)
• analytics-cache.json (MetricsCache)
• acp-local-storage.json (ACP localStorage)

Previously these were world-readable (644), exposing session metadata, tenant IDs, and owner key IDs to any local user.

#3365 — workDir info leak (P2)

Removed allowed directories list from INVALID_WORKDIR error messages. The error still says 'not in allowed list' but no longer reveals which directories exist on the host filesystem.

#3360 — Tenant existence leak (P2)

Changed cross-tenant session access from 403 ('session belongs to another tenant') → 404 ('Session not found'). Consistent with how write endpoints already behave. Prevents session ID enumeration across tenants.

Test plan

• Build passes (npm run build)
• Gate passes (npm run gate)
• File permissions: start Aegis, verify ls -la ~/.aegis/state.json shows -rw-------
• workDir leak: POST with invalid workDir, verify error does NOT contain allowed dirs
• Tenant leak: cross-tenant GET returns 404 with 'Session not found' (not 403)

Security review

• All changes are defensive — no new attack surface introduced
• No behavior change for legitimate use cases

[aegis-gh-agent]

Review: Request Changes

CI failing — 2 test failures from the #3360 fix (403 to 404 for cross-tenant sessions). The behavior change is correct but two existing tests still assert 403:

1. dashboard-session-auth.test.ts:203 — expects 403, now returns 404
2. multitenancy-1944.test.ts:403 — expects 403, now returns 404

Update both test assertions to expect 404 and I will approve immediately.

Everything else looks good — file permissions 0o600 correct, workDir leak removal correct, 403 to 404 correct security practice.

[aegis-gh-agent]

Review: Still Requesting Changes

CI still failing — same 2 tests as before. The test assertion fixes (403 → 404) are not in this PR.

Failing tests (same as previous review):

1. src/tests/dashboard-session-auth.test.ts:203

   expect(otherTenant.statusCode).toBe(403)  // needs .toBe(404)
   

2. src/tests/multitenancy-1944.test.ts:403

   expect(reply.status).toHaveBeenCalledWith(403)  // needs .toHaveBeenCalledWith(404)
   

These two files need to be modified and included in the PR. The #3360 fix correctly changes the behavior from 403 to 404 for cross-tenant session access, but the existing tests still assert 403.

Once these two test files are updated, CI will pass and I will approve immediately.

[aegis-gh-agent]

✅ Approved.

Test assertions fixed — both now expect 404 for cross-tenant session access:

1. dashboard-session-auth.test.ts → .toBe(404)
2. multitenancy-1944.test.ts → .toHaveBeenCalledWith(404)

Security fixes confirmed correct:

• #3363: File permissions 0o600 on all state files ✅
• #3365: workDir error no longer leaks allowed directories ✅
• #3360: Cross-tenant session GET returns 404 (not 403) ✅

CI green. All 9 merge gates pass. Merging.

[aegis-gh-agent]

✅ Re-approved. Review was dismissed after new commit but diff is identical to previous approved state.

All 9 merge gates pass:

1. ✅ Full diff reviewed — file permissions 0o600, workDir leak removal, 403→404 tenant leak fix
2. ✅ No conflicts — MERGEABLE
3. ✅ CI green — all checks passing
4. ✅ No regressions — tests updated for new behavior
5. ✅ Unit tests — assertions updated (403→404) for both test files
6. ✅ E2E — dashboard-e2e passing
7. ✅ Documented — PR body covers all 3 fixes with test plan
8. ✅ Security clean — Gitleaks, Trivy, CodeQL, GitGuardian all pass. Defensive-only changes.
9. ✅ Targets develop

Security fixes confirmed:

• #3363: File permissions 0o600 on all state files (JsonFileStore, MetricsCache, ACP localStorage)
• #3365: workDir error no longer leaks allowed directory paths
• #3360: Cross-tenant session access returns 404 (not 403), preventing session ID enumeration