fix(proxy): avoid exposing local auth token in daemon argv (#1230)

tests/unit/proxy/proxy-daemon-state.test.ts

@@ -3,11 +3,16 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 import {
+  getOpenAICompatProxyDir,
   getLegacyOpenAICompatProxySessionPath,
   getOpenAICompatProxyPidPath,
   getOpenAICompatProxySessionPath,
 } from '../../../src/proxy/proxy-daemon-paths';
-import { listOpenAICompatProxyProfileNames } from '../../../src/proxy/proxy-daemon-state';
+import {
+  listOpenAICompatProxyProfileNames,
+  removeOpenAICompatProxyAuthTokenFile,
+  writeOpenAICompatProxyAuthTokenFile,
+} from '../../../src/proxy/proxy-daemon-state';
 
 let originalCcsHome: string | undefined;
 let tempDir: string;
@@ -51,3 +56,24 @@ describe('listOpenAICompatProxyProfileNames', () => {
     expect(listOpenAICompatProxyProfileNames()).toEqual(['ccg']);
   });
 });
+
+describe('writeOpenAICompatProxyAuthTokenFile', () => {
+  it('writes a private token file under the CCS proxy dir and removes it', () => {
+    const authToken = 'proxy-token-regression-secret';
+    const tokenPath = writeOpenAICompatProxyAuthTokenFile('ccg', authToken);
+    const proxyDir = getOpenAICompatProxyDir();
+
+    expect(path.dirname(tokenPath)).toBe(proxyDir);
+    expect(tokenPath.startsWith(`${proxyDir}${path.sep}`)).toBe(true);
+    expect(fs.readFileSync(tokenPath, 'utf8')).toBe(authToken);
+
+    if (process.platform !== 'win32') {
+      expect(fs.statSync(proxyDir).mode & 0o777).toBe(0o700);
+      expect(fs.statSync(tokenPath).mode & 0o777).toBe(0o600);
+    }
+
+    removeOpenAICompatProxyAuthTokenFile(tokenPath);
+
+    expect(fs.existsSync(tokenPath)).toBe(false);
+  });
+});