Skip to content
Draft
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 2 additions & 4 deletions packages/cli/src/index.ts
Original file line number Diff line number Diff line change
Expand Up @@ -75,12 +75,10 @@ program
await JulesClient.validateKey(apiKey);

const configDir = path.join(os.homedir(), '.config', 'jules');
if (!fs.existsSync(configDir)) {
fs.mkdirSync(configDir, { recursive: true });
}
await fs.promises.mkdir(configDir, { recursive: true });
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

To protect the sensitive API key, the directory permissions should be restricted. Setting mode: 0o700 ensures that only the owner can access this directory, which is a crucial security measure for storing credentials.

Suggested change
await fs.promises.mkdir(configDir, { recursive: true });
await fs.promises.mkdir(configDir, { recursive: true, mode: 0o700 });

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've replaced the synchronous fs.mkdirSync call with await fs.promises.mkdir(configDir, { recursive: true }). This is an asynchronous operation that doesn't block the event loop and it's idempotent, meaning it won't throw an error if the directory already exists, effectively replacing the previous fs.existsSync check as well.


const configPath = path.join(configDir, 'config.json');
fs.writeFileSync(configPath, JSON.stringify({ apiKey }, null, 2));
await fs.promises.writeFile(configPath, JSON.stringify({ apiKey }, null, 2));
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

The configuration file contains a sensitive API key and should have restricted permissions. Setting mode: 0o600 will ensure only the file owner has read and write access, preventing potential exposure on a multi-user system.

Suggested change
await fs.promises.writeFile(configPath, JSON.stringify({ apiKey }, null, 2));
await fs.promises.writeFile(configPath, JSON.stringify({ apiKey }, null, 2), { mode: 0o600 });

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've also updated the configuration file writing to use await fs.promises.writeFile. This ensures that saving the API key is fully asynchronous and does not block the event loop during the setup process.


console.log('Setup complete. API key saved to ~/.config/jules/config.json');
} catch (error: any) {
Expand Down
Loading