Merge pull request #1426 from kaitranntt/codex/fix-cliproxy-usage-cache-vulnerability

fix(cliproxy): avoid persisting account identifiers and harden usage cache permissions

tests/unit/web-server/cliproxy-usage-syncer.test.ts

@@ -109,6 +109,21 @@ describe('cliproxy usage syncer', () => {
     const snapshotPath = path.join(ccsDir, 'cache', 'cliproxy-usage', 'latest.json');
     expect(fs.existsSync(snapshotPath)).toBe(true);
 
+    const snapshot = JSON.parse(fs.readFileSync(snapshotPath, 'utf-8')) as {
+      details: Array<Record<string, unknown>>;
+    };
+    expect(snapshot.details[0]).not.toHaveProperty('source');
+    expect(snapshot.details[0]).not.toHaveProperty('authIndex');
+
+    if (process.platform !== 'win32') {
+      const cacheDir = path.join(ccsDir, 'cache');
+      const cliproxyCacheDir = path.dirname(snapshotPath);
+      expect(fs.statSync(ccsDir).mode & 0o777).toBe(0o700);
+      expect(fs.statSync(cacheDir).mode & 0o777).toBe(0o700);
+      expect(fs.statSync(cliproxyCacheDir).mode & 0o777).toBe(0o700);
+      expect(fs.statSync(snapshotPath).mode & 0o777).toBe(0o600);
+    }
+
     const cached = await runWithScopedConfigDir(ccsDir, async () => {
       return await loadCachedCliproxyData();
     });

tests/unit/web-server/cliproxy-usage-transformer.test.ts

@@ -109,6 +109,8 @@ describe('cliproxy usage transformer', () => {
     const flat = extractCliproxyUsageHistoryDetails(sampleResponse);
     expect(flat).toHaveLength(4);
     expect(flat[0].provider).toBe('google');
+    expect(flat[0]).not.toHaveProperty('source');
+    expect(flat[0]).not.toHaveProperty('authIndex');
     expect(
       flat.some(
         (entry) =>
@@ -134,6 +136,19 @@ describe('cliproxy usage transformer', () => {
     expect(merged).toHaveLength(details.length);
   });
 
+  it('strips legacy account identifiers when merging persisted history', () => {
+    const details = extractCliproxyUsageHistoryDetails(sampleResponse);
+    const legacyDetail = {
+      ...details[0],
+      source: 'user@example.com',
+      authIndex: 'auth-file-7',
+    };
+    const merged = mergeCliproxyUsageHistoryDetails([legacyDetail], []);
+
+    expect(merged[0]).not.toHaveProperty('source');
+    expect(merged[0]).not.toHaveProperty('authIndex');
+  });
+
   it('preserves legitimate duplicate requests when the incoming batch has more occurrences', () => {
     const details = extractCliproxyUsageHistoryDetails(sampleResponse);
     const repeated = [details[0], { ...details[0] }];