Michał Pierzchała 4f95ca8881 fix(daemon): timing-safe token comparison, daemon.json hardening, shell-quote CVE (#731) ...

* fix(daemon): timing-safe token comparison and daemon.json permission hardening

Use crypto.timingSafeEqual (via SHA-256 digests, length-independent) for the
three daemon token checks, and chmod daemon.json to 0600 after writes since
writeFileSync only applies mode on creation.

https://claude.ai/code/session_01LXZXzxi55sZ11DSyqWyBA2

* fix(deps): clear CVE-2026-9277 by overriding shell-quote to >=1.8.4 in test-app

Override added to examples/test-app/pnpm-workspace.yaml (package.json-level
overrides are silently ignored for this nested app, see the comment there).
Lockfile change is limited to shell-quote 1.8.3 -> 1.8.4; pnpm audit is clean.

https://claude.ai/code/session_01LXZXzxi55sZ11DSyqWyBA2

---------

Co-authored-by: Claude <noreply@anthropic.com>

2026-06-10 11:00:19 +02:00

..

test-app

fix(daemon): timing-safe token comparison, daemon.json hardening, shell-quote CVE (#731)

2026-06-10 11:00:19 +02:00