Synced from monorepo

Changes:
- Classify clipboard delivery confidence
- Add durable session update append
- Scope the xAI session bearer to first-party memory embedding endpoints
- Persist subagent outputs to disk and bound long-lived agent state
- Add MiniSweAgent:bash for mini-swe-agent parity
- Revert taking local sessions off the persistent shell
- Contextual tip recommending grok wrap on SSH sessions
- Voice STT bearer from model BYOK env_key/api_key
- Define exact website policies for sandbox
- Gate unsafe shell environments
- Shared pin hoist; single require_sha gate for marketplace plugins
- Server-signed is-managed claim (closes sidecar-removal downgrade)
- Optional require_sha pin for remote plugin installs
- Show session title and last exchange in the exit resume hint
- Gate shell output redirects
- Warn when fail_closed is present but not a boolean
- Add canonical text editing core (ratatui-textarea)
- Keep execution state out of goal scratch
- Add acknowledged persistence primitives
- Inherit child network restrictions in sandbox
- Fail closed when hook matchers fail to recompile
- Add MCP setup preferences for plugin MCPs
- Gate sourced shell scripts
- Gate file-typed project hooks
- grok wrap: restore terminal modes on child death
- Harden owner-only permissions on auth and MCP credentials
- Create crash dump files with owner-only permissions
- Write the agent_id cache owner-only (0600)
- SessionMetrics mode skips Mixpanel profile sync
- Dashboard: slim live-tail peek
- Yank full queued prompt text, not (+N lines)
- Defeat clock-rollback on the signed managed-config cache
- Stop early session/cancel from overtaking the prompt and wedging the turn slot
- Self-heal a diverged agent entrypoint on startup
- Add matched inference expectations in test-support
- Add AuthSingleFlight cancel/successor gap tests
- Remove consumer from external OTEL allowlist and pin scrub coverage
- Enable /copy in minimal mode
- Surface capacity and API-key detail on 429 errors
- Single-flight interactive auth
- Fix PageUp/PageDown skipping lines behind sticky prompt header

crates/codegen/xai-crash-handler/src/handler.rs

@@ -451,16 +451,24 @@ mod imp {
             Ok(p) => p,
             Err(_) => return false,
         };
+        // Owner-only: crash blobs hold stack IPs / fault addresses.
         let fd = unsafe {
             libc::open(
                 c_path.as_ptr(),
                 libc::O_WRONLY | libc::O_CREAT | libc::O_TRUNC,
-                0o644,
+                0o600,
             )
         };
         if fd < 0 {
             return false;
         }
+        // open's mode is create-only; tighten upgrades of older 0644 blobs.
+        if unsafe { libc::fchmod(fd, 0o600) } != 0 {
+            unsafe {
+                libc::close(fd);
+            }
+            return false;
+        }
         CRASH_FD.store(fd, Ordering::Relaxed);
 
         // Store version string.
@@ -920,4 +928,55 @@ mod tests {
             "full install should replace the minimal handler"
         );
     }
+
+    #[test]
+    fn install_creates_owner_only_crash_blob() {
+        use std::os::unix::fs::PermissionsExt;
+
+        let _guard = SIGNAL_STATE_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+        let dir = std::env::temp_dir().join(format!(
+            "xai-crash-handler-test-0600-{}",
+            std::process::id()
+        ));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).expect("create crash dir");
+
+        assert!(super::install(&dir, "test-version"));
+        let path = dir.join("last-crash.bin");
+        let mode = std::fs::metadata(&path).expect("meta").permissions().mode();
+        assert_eq!(mode & 0o777, 0o600, "new last-crash.bin must be owner-only");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn install_tightens_preexisting_0644_crash_blob() {
+        use std::os::unix::fs::PermissionsExt;
+
+        let _guard = SIGNAL_STATE_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+        let dir = std::env::temp_dir().join(format!(
+            "xai-crash-handler-test-tighten-{}",
+            std::process::id()
+        ));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).expect("create crash dir");
+
+        let path = dir.join("last-crash.bin");
+        std::fs::write(&path, b"old").expect("seed");
+        let mut perms = std::fs::metadata(&path).expect("meta").permissions();
+        perms.set_mode(0o644);
+        std::fs::set_permissions(&path, perms).expect("set 0644");
+        assert_eq!(
+            std::fs::metadata(&path).expect("meta").permissions().mode() & 0o777,
+            0o644
+        );
+
+        assert!(super::install(&dir, "test-version"));
+        let mode = std::fs::metadata(&path).expect("meta").permissions().mode();
+        assert_eq!(
+            mode & 0o777,
+            0o600,
+            "install must fchmod preexisting 0644 blobs to owner-only"
+        );
+        let _ = std::fs::remove_dir_all(&dir);
+    }
 }

crates/codegen/xai-crash-handler/src/lib.rs

@@ -121,9 +121,9 @@ pub fn check_previous_crash(crash_dir: &Path) -> Option<CrashReport> {
     let frames = symbolicate::resolve_frames(&blob);
     let report_text = symbolicate::format_report(&blob, &frames);
 
-    // Write the human-readable report.
+    // Write the human-readable report (owner-only when the OS supports it).
     let report_path = crash_dir.join("last-crash-report.txt");
-    let _ = std::fs::write(&report_path, &report_text);
+    let _ = write_owner_only(&report_path, report_text.as_bytes());
 
     // Archive to history/ (keep last MAX_HISTORY).
     archive_report(crash_dir, &report_text, blob.timestamp);
@@ -142,12 +142,42 @@ pub fn check_previous_crash(crash_dir: &Path) -> Option<CrashReport> {
     })
 }
 
+/// Write `contents` with owner-only permissions when the platform allows it.
+///
+/// Crash reports may include source paths and backtraces; when they land under
+/// `$GROK_HOME` they must not be world-readable.
+fn write_owner_only(path: &Path, contents: &[u8]) -> std::io::Result<()> {
+    #[cfg(unix)]
+    {
+        use std::io::Write;
+        use std::os::unix::fs::{OpenOptionsExt, PermissionsExt};
+        let mut file = std::fs::OpenOptions::new()
+            .write(true)
+            .create(true)
+            .truncate(true)
+            .mode(0o600)
+            .open(path)?;
+        // mode() only applies on create — force owner-only before writing so a
+        // preexisting 0644 file never holds sensitive content while world-readable.
+        let mut perms = file.metadata()?.permissions();
+        perms.set_mode(0o600);
+        file.set_permissions(perms)?;
+        file.write_all(contents)?;
+        file.flush()?;
+        Ok(())
+    }
+    #[cfg(not(unix))]
+    {
+        std::fs::write(path, contents)
+    }
+}
+
 fn archive_report(crash_dir: &Path, report_text: &str, timestamp: u64) {
     let history_dir = crash_dir.join("history");
     let _ = std::fs::create_dir_all(&history_dir);
 
     let filename = format!("crash-{}.txt", timestamp);
-    let _ = std::fs::write(history_dir.join(&filename), report_text);
+    let _ = write_owner_only(&history_dir.join(&filename), report_text.as_bytes());
 
     // Prune old reports beyond MAX_HISTORY.
     if let Ok(mut entries) = std::fs::read_dir(&history_dir) {
@@ -175,4 +205,55 @@ mod tests {
         let dir = PathBuf::from("/tmp/xai-crash-handler-test-nonexistent");
         assert!(check_previous_crash(&dir).is_none());
     }
+
+    #[cfg(unix)]
+    fn unique_tmp_dir(label: &str) -> PathBuf {
+        let dir = std::env::temp_dir().join(format!(
+            "xai-crash-handler-{label}-{}-{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .map(|d| d.as_nanos())
+                .unwrap_or(0)
+        ));
+        std::fs::create_dir_all(&dir).expect("create tmp dir");
+        dir
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn write_owner_only_creates_0600() {
+        use std::os::unix::fs::PermissionsExt;
+
+        let dir = unique_tmp_dir("create-0600");
+        let path = dir.join("report.txt");
+        write_owner_only(&path, b"secret").expect("write");
+        let mode = std::fs::metadata(&path).expect("meta").permissions().mode();
+        assert_eq!(mode & 0o777, 0o600, "new file must be owner-only");
+        assert_eq!(std::fs::read(&path).expect("read"), b"secret");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn write_owner_only_tightens_preexisting_0644() {
+        use std::os::unix::fs::PermissionsExt;
+
+        let dir = unique_tmp_dir("tighten-0644");
+        let path = dir.join("report.txt");
+        std::fs::write(&path, b"old").expect("seed");
+        let mut perms = std::fs::metadata(&path).expect("meta").permissions();
+        perms.set_mode(0o644);
+        std::fs::set_permissions(&path, perms).expect("set 0644");
+        assert_eq!(
+            std::fs::metadata(&path).expect("meta").permissions().mode() & 0o777,
+            0o644
+        );
+
+        write_owner_only(&path, b"new-secret").expect("overwrite");
+        let mode = std::fs::metadata(&path).expect("meta").permissions().mode();
+        assert_eq!(mode & 0o777, 0o600, "overwrite must tighten to owner-only");
+        assert_eq!(std::fs::read(&path).expect("read"), b"new-secret");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
 }