[diegosouzapw]

Closes #12572

Root cause

open-sse/services/adobeFireflySession.ts and open-sse/services/adobeFireflyBrowserLogin.ts persist Adobe Firefly session state — including a live IMS Bearer JWT (accessToken) and the full Adobe cookie jar — to disk via mkdirSync(dir, { recursive: true }) and writeFileSync(path, ..., "utf8") with no mode argument, so the directory/file inherit the process umask (0755/0644 typically) instead of the restrictive 0700/0600 pattern already established in this repo for the analogous case (src/lib/vncSession/service.ts::createProfileDir).

The Notion half of the original report is a confirmed false positive (notionThreadSessions.ts's ThreadSessionEntry never persists a cookie/token) and is intentionally out of scope, per the plan-file analysis.

Fix

• Added a shared open-sse/utils/secureFileWrite.ts (ensureSecureDir / writeSecureFile) mirroring the vncSession/service.ts::createProfileDir pattern (mkdirSync(..., mode: 0o700) + chmodSync(..., 0o700) for dirs; writeFileSync(..., mode: 0o600) for files) so a future browser-login integration can't reintroduce the unhardened pattern.
• adobeFireflySession.ts: sessionFilePath() directory creation, the markAdobeFireflyArpSuccess() disk-fallback write, and saveDiskSession() now go through the shared helper.
• adobeFireflyBrowserLogin.ts: adobeBrowserCookieJarPath() directory creation and saveAdobeBrowserCookies() now go through the shared helper.

Regression test

tests/unit/adobe-firefly-session-file-perms.test.ts (TDD, reusing the plan-file's proven-red repro mechanics):

• markAdobeFireflyArpSuccess() on a fresh DATA_DIR creates adobe-firefly-sessions/ at mode 0700.
• ensureSecureDir() tightens an already-existing 0777 directory back to 0700.
• writeSecureFile() writes files at mode 0600.

The plan-file's own repro (markAdobeFireflyArpSuccess on a fresh mkdtemp DATA_DIR) was already proven RED against the current release/v3.8.51 tip (910f58c): AssertionError: expected adobe-firefly-sessions dir to be 0700 ..., got mode 775. The same call path is exercised by the new test suite above, now GREEN against the fix.

node --import tsx/esm --test tests/unit/adobe-firefly-session-file-perms.test.ts
✔ Adobe Firefly session dir/file are created with restrictive permissions (0700/0600)
✔ ensureSecureDir tightens an already-existing looser directory to 0700
✔ writeSecureFile writes files with 0600 permissions
ℹ tests 3, pass 3, fail 0

Gates run

• node scripts/check/check-file-size.mjs → OK (no violations attributable to changed files)
• node scripts/check/check-complexity.mjs → OK — 2798 violations (baseline 3218)
• node scripts/check/check-cognitive-complexity.mjs → OK — 1265 violations (baseline 1437)
• npm run typecheck:core → exit 0
• npx eslint --suppressions-location config/quality/eslint-suppressions.json <changed files> → clean
• New regression test: 3/3 pass
• Existing Adobe Firefly test suites (adobe-firefly.test.ts, adobe-firefly-browser-login.test.ts, adobe-firefly-security.test.ts): 68/68 pass, unaffected

Scope

Out of scope per the plan-file (maintainer-confirmed): notionThreadSessions.ts (false positive, no credential fields persisted) and src/lib/db/core.ts DATA_DIR hardening (related but separate, lower-priority gap).

⚠️ base-red inherited: #12732 — unit #12058, integration codex-cache, package-artifact, tarball-smoke, agent-skills-sync