plugin: harden storage permissions to 0700/0600

Cherry-picked from PR #143 (parts 1+2 of 3; part 3 superseded by the
finer-grained stripUnsafeProjectConfigFields already on master). Resolved
import conflicts against the NODE_ENV=test isolation backstop.

context.db holds raw conversation history. The storage dir + models cache
dir are created/chmod'd 0700 and context.db/-wal/-shm chmod'd 0600.
Best-effort with try/catch, skipped on win32.

Co-authored-by: Alfonso [Magic Context] <288211368+alfonso-magic-context@users.noreply.github.com>

Author: 2 people

packages/plugin/src/features/magic-context/memory/embedding-local.ts

@@ -1,4 +1,4 @@
-import { mkdirSync } from "node:fs";
+import { chmodSync, mkdirSync } from "node:fs";
 import { open, stat, unlink, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -455,7 +455,17 @@ export class LocalEmbeddingProvider implements EmbeddingProvider {
                 // or buffer" failures. Using our own storage dir survives plugin updates too.
                 const modelCacheDir = join(getMagicContextStorageDir(), "models");
                 try {
-                    mkdirSync(modelCacheDir, { recursive: true });
+                    // Owner-only: the cache lives under the same storage tree as
+                    // memories/history. mkdir's mode is masked by umask, so chmod
+                    // afterwards (no-op on Windows, where POSIX modes are ignored).
+                    mkdirSync(modelCacheDir, { recursive: true, mode: 0o700 });
+                    if (process.platform !== "win32") {
+                        try {
+                            chmodSync(modelCacheDir, 0o700);
+                        } catch {
+                            // Non-fatal — leave default perms if chmod is rejected.
+                        }
+                    }
                     env.cacheDir = modelCacheDir;
                 } catch {
                     // Non-fatal — fall back to library default if we can't create the dir

packages/plugin/src/features/magic-context/storage-db.test.ts

@@ -1,9 +1,17 @@
 /// <reference types="bun-types" />
 
 import { afterEach, describe, expect, it } from "bun:test";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import {
+    existsSync,
+    mkdirSync,
+    mkdtempSync,
+    readFileSync,
+    rmSync,
+    statSync,
+    writeFileSync,
+} from "node:fs";
 import { homedir, tmpdir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { Database } from "../../shared/sqlite";
 import { closeQuietly } from "../../shared/sqlite-helpers";
 import {
@@ -63,6 +71,26 @@ describe("storage-db", () => {
             expect(isDatabasePersisted(db)).toBe(true);
         });
 
+        it("#when called first time #then restricts storage dir to 0o700 and DB files to 0o600", () => {
+            // POSIX-only: chmod is a no-op on Windows (modes are not honored).
+            if (process.platform === "win32") return;
+            const dataHome = useTempDataHome("storage-db-perms-");
+
+            openDatabase();
+
+            const dbPath = resolveDbPath(dataHome);
+            const dbDir = dirname(dbPath);
+            // Low 9 permission bits only (mask off file-type/setuid bits).
+            expect(statSync(dbDir).mode & 0o777).toBe(0o700);
+            expect(statSync(dbPath).mode & 0o777).toBe(0o600);
+            for (const suffix of ["-wal", "-shm"]) {
+                const sidecar = `${dbPath}${suffix}`;
+                if (existsSync(sidecar)) {
+                    expect(statSync(sidecar).mode & 0o777).toBe(0o600);
+                }
+            }
+        });
+
         it("#when called first time #then creates required tables", () => {
             useTempDataHome("storage-db-tables-");
 

packages/plugin/src/features/magic-context/storage-db.ts

@@ -1,4 +1,4 @@
-import { copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync } from "node:fs";
+import { chmodSync, copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import {
@@ -40,6 +40,52 @@ export function getSchemaFenceRejection(): {
 
 export const LATEST_SUPPORTED_VERSION = 41;
 
+// chmod is meaningless on Windows (POSIX modes are not honored), so all
+// permission tightening is skipped there. mkdir's `mode` is likewise ignored.
+const PERMISSIONS_ENFORCEABLE = process.platform !== "win32";
+
+/**
+ * Create `dir` (recursively) owner-only and tighten an existing dir to 0o700.
+ *
+ * The storage tree holds project memories, raw conversation history, and
+ * embeddings. Created with the default umask these can be group/world-readable,
+ * leaking that content to other local users. We create with mode 0o700 and
+ * additionally chmod (mkdir's `mode` is masked by umask and a no-op when the
+ * dir already exists). Best-effort: a chmod failure is logged, not fatal.
+ */
+function ensureSecureStorageDir(dir: string): void {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    if (!PERMISSIONS_ENFORCEABLE) return;
+    try {
+        chmodSync(dir, 0o700);
+    } catch (error) {
+        log(
+            `[magic-context] could not restrict storage dir permissions on ${dir}: ${getErrorMessage(error)}`,
+        );
+    }
+}
+
+/**
+ * Restrict the SQLite DB file and its WAL/SHM sidecars to owner-only (0o600).
+ * They are created with the process umask, which can be group/world-readable;
+ * since they hold the same durable state as the storage dir, tighten them once
+ * they exist. Best-effort per file.
+ */
+function restrictDatabaseFilePermissions(dbPath: string): void {
+    if (!PERMISSIONS_ENFORCEABLE) return;
+    for (const suffix of ["", "-wal", "-shm"]) {
+        const file = `${dbPath}${suffix}`;
+        if (!existsSync(file)) continue;
+        try {
+            chmodSync(file, 0o600);
+        } catch (error) {
+            log(
+                `[magic-context] could not restrict DB file permissions on ${file}: ${getErrorMessage(error)}`,
+            );
+        }
+    }
+}
+
 export interface OpenDatabaseOptions {
     dbPath?: string;
     latestSupportedVersion?: number;
@@ -153,7 +199,7 @@ function migrateLegacyStorageIfNeeded(targetDbPath: string, targetDbDir: string)
     log(
         `[magic-context] migrating legacy plugin storage: ${legacyDir} -> ${targetDbDir} (legacy left in place as backup)`,
     );
-    mkdirSync(targetDbDir, { recursive: true });
+    ensureSecureStorageDir(targetDbDir);
 
     // Fold the legacy WAL into the main DB FIRST so the copied target is one
     // crash-consistent file. Copying .db/-wal/-shm as three separate files is
@@ -1455,7 +1501,7 @@ export function openDatabase(dbPathOrOptions?: string | OpenDatabaseOptions): Da
         if (!explicitDbPath) {
             migrateLegacyStorageIfNeeded(dbPath, dbDir);
         }
-        mkdirSync(dbDir, { recursive: true });
+        ensureSecureStorageDir(dbDir);
 
         const db = new Database(dbPath);
         if (!enforceSchemaFence(db, dbPath, latestSupportedVersion)) {
@@ -1507,6 +1553,9 @@ export function openDatabase(dbPathOrOptions?: string | OpenDatabaseOptions): Da
         // sidebar regression report.
         setToolDefinitionDatabase(db);
         loadToolDefinitionMeasurements(db);
+        // Tighten the DB + WAL/SHM sidecars to owner-only now that WAL mode has
+        // created the sidecars; best-effort, never fatal.
+        restrictDatabaseFilePermissions(dbPath);
         databases.set(dbPath, db);
         pathByDatabase.set(db, dbPath);
         persistenceByDatabase.set(db, true);