3 Commits

Author	SHA1	Message	Date
Ziang Xie	9698307f27	fix(adapters): harden credential file storage in pairing.ts ... Three security improvements for adapters.json storage: - Use crypto.randomBytes for temp filename instead of predictable Date.now(), preventing TOCTOU symlink race during atomic write. - Enforce 0o600 permissions on adapters.json via writeFileSync mode option to prevent credential leakage via permissive umask. - Enforce 0o700 permissions on ~/.claude/ config directory via mkdirSync mode option. adapters.json contains sensitive credentials including Feishu app secrets and Telegram bot tokens.	2026-05-02 00:40:44 +08:00
程序员阿江(Relakkes)	158f2de13e	fix(security): add rate limiting, default-closed mode, extract isAllowedUser ... - Rate limit: max 5 failed pairing attempts per user per 5 minutes - Default closed: reject all users when no allowedUsers/pairedUsers configured - Extract isAllowedUser() to common/pairing.ts to eliminate duplication Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-08 20:51:30 +08:00
程序员阿江(Relakkes)	4bcac9d25f	feat(pairing): implement core pairing logic module ... Add adapters/common/pairing.ts with generatePairingCode(), isPaired(), and tryPair() — one-time-use 6-char code flow with atomic config writes. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-08 20:07:44 +08:00