fix(state): heal ~/.nemoclaw directory and file permissions on read path

src/lib/state/config-io.test.ts

@@ -137,6 +137,105 @@
     }
   });
 
+  it("readConfigFile repairs a 755 parent directory to 700", () => {
+    const root = makeTempDir();
+    const dir = path.join(root, "loose-dir");
+    fs.mkdirSync(dir, { mode: 0o755 });
+    const file = path.join(dir, "config.json");
+    fs.writeFileSync(file, JSON.stringify({ repaired: true }), { mode: 0o600 });
+
+    const result = readConfigFile(file, null);
+
+    expect(result).toEqual({ repaired: true });
+    expect(fs.statSync(dir).mode & 0o777).toBe(0o700);
+  });
+
+  it("readConfigFile repairs a 644 file to 600", () => {
+    const dir = makeTempDir();
+    fs.chmodSync(dir, 0o700);
+    const file = path.join(dir, "config.json");
+    fs.writeFileSync(file, JSON.stringify({ tight: true }), { mode: 0o644 });
+
+    const result = readConfigFile(file, null);
+
+    expect(result).toEqual({ tight: true });
+    expect(fs.statSync(file).mode & 0o777).toBe(0o600);
+  });
+
+  it("ensureConfigDir heals every root-level file in the dir, not just the one being read (#4546)", () => {
+    // #4546 expects auto-repair across all root-level files. Most of those
+    // files (onboard-session.json, ollama-proxy-token, etc.) are written by
+    // code paths that don't flow through readConfigFile, so the read-time
+    // per-file heal alone misses them. The dir walk in ensureConfigDir is
+    // what covers them — verify by writing several siblings at 644 and
+    // confirming a single read tightens all of them to 600.
+    const dir = makeTempDir();
+    fs.chmodSync(dir, 0o700);
+    const target = path.join(dir, "config.json");
+    fs.writeFileSync(target, JSON.stringify({ ok: true }), { mode: 0o600 });
+
+    const siblings = [
+      "onboard-session.json",
+      "ollama-proxy-token",
+      "ollama-auth-proxy.pid",
+      "usage-notice.json",
+    ];
+    for (const name of siblings) {
+      fs.writeFileSync(path.join(dir, name), "stale", { mode: 0o644 });
+    }
+
+    readConfigFile(target, null);
+
+    for (const name of siblings) {
+      const mode = fs.statSync(path.join(dir, name)).mode & 0o777;
+      expect(mode, `${name} should be tightened to 600`).toBe(0o600);
+    }
+  });
+
+  it("ensureConfigDir skips symlinks during the root-level heal", () => {
+    // A chmod on a symlink follows to the target — if ~/.nemoclaw/X is a
+    // symlink to /etc/passwd, healing must NOT chmod /etc/passwd. lstat
+    // before chmod keeps the heal scoped to real files inside the dir.
+    const dir = makeTempDir();
+    fs.chmodSync(dir, 0o700);
+    const target = path.join(dir, "config.json");
+    fs.writeFileSync(target, JSON.stringify({ ok: true }), { mode: 0o600 });
+
+    const outside = path.join(os.tmpdir(), `nemoclaw-symlink-target-${String(process.pid)}`);
+    fs.writeFileSync(outside, "outside", { mode: 0o644 });
+    const linkPath = path.join(dir, "rogue-link");
+    fs.symlinkSync(outside, linkPath);
+
+    try {
+      readConfigFile(target, null);
+      expect(fs.statSync(outside).mode & 0o777).toBe(0o644);
+    } finally {
+      fs.unlinkSync(linkPath);
+      fs.unlinkSync(outside);
+    }
+  });
+
+  it("readConfigFile does not chmod through a symlink even via the per-file heal", () => {
+    // Defensive duplicate of the symlink check, this time for the per-file
+    // heal in readConfigFile itself (not the dir walk in ensureConfigDir).
+    const dir = makeTempDir();
+    fs.chmodSync(dir, 0o700);
+
+    const outside = path.join(os.tmpdir(), `nemoclaw-symlink-readtarget-${String(process.pid)}`);
+    fs.writeFileSync(outside, JSON.stringify({ outside: true }), { mode: 0o644 });
+    const symlinkPath = path.join(dir, "config.json");
+    fs.symlinkSync(outside, symlinkPath);
+
+    try {
+      // Reading through the symlink should not chmod the target file.
+      readConfigFile(symlinkPath, null);
+      expect(fs.statSync(outside).mode & 0o777).toBe(0o644);
+    } finally {
+      fs.unlinkSync(symlinkPath);
+      fs.unlinkSync(outside);
+    }
+  });
+
   it("supports both rich and legacy constructor forms", () => {
     const rich = new ConfigPermissionError("test error", "/some/path");
     expect(rich.name).toBe("ConfigPermissionError");

src/lib/state/config-io.ts

@@ -145,6 +145,39 @@ export function rejectSymlinksOnPath(dirPath: string): void {
   }
 }
 
+/**
+ * Tighten group/world bits on every regular file directly inside `dirPath`.
+ * Symlinks are skipped (we use `lstat`; a chmod on a symlink follows to the
+ * target, which would mutate something outside the config dir). Subdirectories
+ * are skipped — this is intentionally root-level only, matching the issue's
+ * acceptance criteria (#4546). Best-effort: a single file's chmod failure
+ * does not abort the walk.
+ */
+function healRootLevelFiles(dirPath: string): void {
+  let entries: fs.Dirent[];
+  try {
+    entries = fs.readdirSync(dirPath, { withFileTypes: true });
+  } catch {
+    // If we can't list (e.g. dir does not exist), nothing to heal.
+    return;
+  }
+  for (const entry of entries) {
+    if (entry.isSymbolicLink() || !entry.isFile()) continue;
+    const full = path.join(dirPath, entry.name);
+    try {
+      // lstat (not stat) so a TOCTOU-swapped symlink between readdir and
+      // chmod doesn't trick us into chmodding a target outside the dir.
+      const st = fs.lstatSync(full);
+      if (!st.isFile()) continue;
+      if ((st.mode & 0o077) !== 0) {
+        fs.chmodSync(full, 0o600);
+      }
+    } catch {
+      // Best effort — keep walking.
+    }
+  }
+}
+
 export function ensureConfigDir(dirPath: string): void {
   // SECURITY: Block symlink attacks before creating or writing to the directory.
   rejectSymlinksOnPath(dirPath);
@@ -181,11 +214,45 @@ export function ensureConfigDir(dirPath: string): void {
     }
     throw error;
   }
+
+  // Heal every root-level file in the dir, not just the one being read.
+  // Issue #4546 expects auto-repair across all root-level files
+  // (sandboxes.json, onboard-session.json, ollama-auth-proxy.pid,
+  // ollama-proxy-token, usage-notice.json, etc.) — most of which are written
+  // by code paths that don't flow through readConfigFile/writeConfigFile.
+  // Doing the walk here means every nemoclaw invocation that touches the
+  // config dir restores the entire root level to mode 600.
+  healRootLevelFiles(dirPath);
 }
 
 export function readConfigFile<T>(filePath: string, fallback: T): T {
   try {
-    return parseJson<T>(fs.readFileSync(filePath, "utf-8"));
+    ensureConfigDir(path.dirname(filePath));
+  } catch (error) {
+    if (error instanceof ConfigPermissionError) {
+      throw error;
+    }
+    // Directory doesn't exist and can't be created — fall through to let
+    // readFileSync produce the appropriate ENOENT / fallback path.
+  }
+
+  try {
+    const content = parseJson<T>(fs.readFileSync(filePath, "utf-8"));
+
+    // Heal file-level permission drift: tighten group/world bits.
+    // lstat (not stat) so we don't chmod through a symlink to a target
+    // outside the config dir — defensive duplicate of healRootLevelFiles
+    // for read paths whose dirname differs from what ensureConfigDir saw.
+    try {
+      const st = fs.lstatSync(filePath);
+      if (st.isFile() && (st.mode & 0o077) !== 0) {
+        fs.chmodSync(filePath, 0o600);
+      }
+    } catch {
+      // Best effort — don't fail the read if we can't heal permissions.
+    }
+
+    return content;
   } catch (error) {
     const errnoError = error instanceof Error ? error : null;
     if (isPermissionError(errnoError)) {