fix(audit): cycle 001 P1 security fixes

main.js

@@ -3,7 +3,7 @@ const path = require('path');
 const { createRegistry } = require('./src/providers/registry');
 const { UsageStore } = require('./src/main/usage-store');
 const { CollectorScheduler } = require('./src/main/scheduler');
-const { getHistory, settings } = require('./src/main/store');
+const { getHistory, isSecretSettingsKey, redactSettingsForRenderer, settings } = require('./src/main/store');
 const { providerLogoUrl } = require('./src/main/assets');
 const { createTray } = require('./src/main/tray');
 const { AlertManager } = require('./src/main/alerts');
@@ -48,6 +48,7 @@ let lastWidgetProviderCount = 1;
 
 function mergeSettingsPatch(patch = {}) {
   for (const [key, value] of Object.entries(patch)) {
+    if (isSecretSettingsKey(key)) continue;
     if (key === 'floatingWidget' && value && typeof value === 'object') {
       const prev = settings.get('floatingWidget') || {};
       const merged = {
@@ -144,7 +145,7 @@ function applySettingsPatch(patch) {
 }
 
 function broadcastSettings() {
-  const payload = settings.store;
+  const payload = redactSettingsForRenderer(settings.store);
   for (const win of BrowserWindow.getAllWindows()) {
     if (!win.isDestroyed()) {
       win.webContents.send('settings:updated', payload);
@@ -242,10 +243,10 @@ function registerIpc() {
       throw err;
     }
   });
-  ipcMain.handle('settings:get', () => settings.store);
+  ipcMain.handle('settings:get', () => redactSettingsForRenderer(settings.store));
   ipcMain.handle('settings:update', (_e, patch) => {
     applySettingsPatch(patch || {});
-    return settings.store;
+    return redactSettingsForRenderer(settings.store);
   });
 
   ipcMain.on('window:minimize', (e) => {

package.json

@@ -30,7 +30,7 @@
   "scripts": {
     "start": "electron .",
     "postinstall": "electron-builder install-app-deps",
-    "test": "node --test tests/**/*.test.js",
+    "test": "node scripts/run-tests.mjs",
     "icons:generate": "node scripts/generate-icons.js",
     "screenshots": "node scripts/capture-readme-screenshots.mjs",
     "build": "electron-builder",
@@ -48,7 +48,7 @@
     "koffi": "^3.0.2"
   },
   "devDependencies": {
-    "electron": "^28.3.3",
+    "electron": "^34.0.0",
     "electron-builder": "^24.9.1",
     "playwright": "^1.60.0"
   },

scripts/run-tests.mjs

@@ -0,0 +1,27 @@
+import { readdirSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+
+const root = join(dirname(fileURLToPath(import.meta.url)), '..');
+
+function collectTests(dir) {
+  const files = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...collectTests(full));
+      continue;
+    }
+    if (entry.name.endsWith('.test.js')) files.push(full);
+  }
+  return files;
+}
+
+const tests = collectTests(join(root, 'tests'));
+const result = spawnSync(process.execPath, ['--test', ...tests], {
+  cwd: root,
+  stdio: 'inherit',
+});
+
+process.exit(result.status ?? 1);

src/main/store.js

@@ -33,6 +33,22 @@ const settings = new Store({
   },
 });
 
+const SECRET_KEY_PATTERN = /^secret_/;
+const SECRET_META_KEY_PATTERN = /^secret_meta_/;
+
+function isSecretSettingsKey(key) {
+  return SECRET_KEY_PATTERN.test(key) || SECRET_META_KEY_PATTERN.test(key);
+}
+
+function redactSettingsForRenderer(storeObject = {}) {
+  const redacted = {};
+  for (const [key, value] of Object.entries(storeObject)) {
+    if (isSecretSettingsKey(key)) continue;
+    redacted[key] = value;
+  }
+  return redacted;
+}
+
 function secretMetaKey(key) {
   return `secret_meta_${key}`;
 }
@@ -44,9 +60,7 @@ function setSecret(key, value) {
     return;
   }
   if (!safeStorage.isEncryptionAvailable()) {
-    settings.set(`secret_${key}`, value);
-    settings.set(secretMetaKey(key), 'plain');
-    return;
+    throw new Error('safeStorage encryption is not available; refusing to persist secret');
   }
   settings.set(`secret_${key}`, safeStorage.encryptString(String(value)).toString('base64'));
   settings.set(secretMetaKey(key), 'enc');
@@ -95,6 +109,8 @@ function getHistory(providerId) {
 
 module.exports = {
   settings,
+  isSecretSettingsKey,
+  redactSettingsForRenderer,
   setSecret,
   getSecret,
   setProviderDisconnected,

tests/main/settings-security.test.js

@@ -0,0 +1,36 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+const root = path.join(path.dirname(fileURLToPath(import.meta.url)), '../..');
+const mainSrc = readFileSync(path.join(root, 'main.js'), 'utf8');
+const storeSrc = readFileSync(path.join(root, 'src/main/store.js'), 'utf8');
+
+test('isSecretSettingsKey matches secret_ and secret_meta_ store keys', () => {
+  assert.match(storeSrc, /function isSecretSettingsKey/);
+  assert.match(storeSrc, /SECRET_KEY_PATTERN = \/\^secret_\//);
+  assert.match(storeSrc, /SECRET_META_KEY_PATTERN = \/\^secret_meta_\//);
+});
+
+test('redactSettingsForRenderer strips secret keys before renderer IPC', () => {
+  assert.match(storeSrc, /function redactSettingsForRenderer/);
+  assert.match(storeSrc, /isSecretSettingsKey\(key\)/);
+});
+
+test('settings:get and broadcastSettings redact secrets for renderer', () => {
+  assert.match(mainSrc, /redactSettingsForRenderer\(settings\.store\)/);
+  assert.match(mainSrc, /settings:get.*redactSettingsForRenderer/s);
+  assert.match(mainSrc, /function broadcastSettings/);
+  assert.match(mainSrc, /settings:updated.*payload/s);
+});
+
+test('mergeSettingsPatch rejects secret_ patch keys', () => {
+  assert.match(mainSrc, /isSecretSettingsKey\(key\)/);
+  assert.match(mainSrc, /if \(isSecretSettingsKey\(key\)\) continue/);
+});
+
+test('setSecret fails closed when safeStorage is unavailable', () => {
+  assert.match(storeSrc, /safeStorage encryption is not available; refusing to persist secret/);
+  assert.doesNotMatch(storeSrc, /settings\.set\(`secret_\$\{key\}`, value\)/);
+});