chore(release): move dev version line past the published channel

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bitkyc08/opencodex",
-  "version": "2.24.2",
+  "version": "2.27.0",
   "description": "Universal provider proxy for OpenAI Codex & Claude Code — use any LLM with Codex CLI/App/SDK and Claude Code",
   "type": "module",
   "main": "./bin/package-main.mjs",

src/service.ts

@@ -1960,13 +1960,38 @@ function uninstallLaunchd(): void {
  *
  * The explicit `chmodSync` is not redundant: `mode` only applies when the file is
  * created, so an install over a definition left at 0644 by an earlier version would keep
- * the loose mode. On Windows the POSIX bits are advisory, so the real ACL is applied
- * there the same way the token file does it.
+ * the loose mode.
+ *
+ * On Windows the POSIX bits are advisory, so the ACL is the real boundary — and whether it
+ * may soft-fail depends on what the definition actually contains. A definition carrying a
+ * proxy credential is a secret publication and fails closed like the API token and the
+ * install state do; one carrying only paths and a port is not worth refusing an install
+ * over, since before #2107 these files had no hardening at all and a failure here would
+ * regress a user who has no credential to protect.
  */
 export function writeServiceDefinitionFile(path: string, content: string, encoding: "utf8" | "utf16le"): void {
   writeFileSync(path, content, { encoding, mode: 0o600 });
-  try { chmodSync(path, 0o600); } catch { /* best-effort; the Windows ACL below is authoritative */ }
-  if (process.platform === "win32") hardenSecretPath(path, { required: false });
+  try { chmodSync(path, 0o600); } catch { /* superseded by the Windows ACL below */ }
+  if (process.platform === "win32") {
+    hardenSecretPath(path, { required: definitionCarriesCredential(content) });
+  }
+}
+
+/**
+ * Does this service definition embed a credential-bearing proxy URL?
+ *
+ * Only the userinfo form leaks something: `http://user:pass@host` in any of the four proxy
+ * variables. A bare `http://127.0.0.1:7890` is not a secret, and treating it as one would
+ * make an icacls stall fail an install that had nothing to protect.
+ *
+ * The scan is over any URL in the rendered definition rather than over a `KEY=value` shape,
+ * because the three formats render differently — systemd writes `Environment="K=V"`, the
+ * plist writes `<key>K</key><string>V</string>`, and the Windows wrapper writes
+ * `set "K=V"`. Keying on the assignment syntax silently missed the plist.
+ */
+export function definitionCarriesCredential(content: string): boolean {
+  // A userinfo authority: scheme, then anything that is not a delimiter, then '@'.
+  return /[a-z][a-z0-9+.-]*:\/\/[^\s"'<>/@]+@/i.test(content);
 }
 
 // ── Windows (Task Scheduler) ──

tests/service.test.ts

@@ -7,7 +7,7 @@ import { saveConfig } from "../src/config";
 import { windowsEnvIndirectBatchValue } from "../src/lib/win-paths";
 import { assertServiceAuthEnvironment, assertServiceEnvironmentMatchesInstall, bakedServicePathsDiagnostic, confirmServiceServing, launchdListenPort, systemdListenPort, buildPlist, buildUnit, buildWindowsLauncherVbs, buildWindowsSchtasksCreateArgs, buildWindowsSchtasksCreateArgsForXml, buildWindowsServiceScript, buildWindowsTaskXml, deriveWindowsServiceDiagnostic, installFreshWindowsSchedulerSafely, installServiceSafely, launchctlLoadFailed, launchdJobMatchesPlist, normalizeServiceSubcommand, parseServiceInstallState, prepareServiceInstall, readWindowsSchedulerXmlState, registerFreshWindowsSchedulerTask, removeNativeWindowsServiceForScheduler, repairService, resolveServiceListenPort, runLaunchctl, serviceLogPath, serviceStartableFromTray, serviceStatusReport, serviceRetryCommand, serviceStatusSummary, systemdNeedsDaemonReload, windowsListenPort, winswListenPort, startLaunchd, windowsTaskRegistrationHealthy } from "../src/service";
 import type { ServiceDiagnostic } from "../src/service";
-import { resolvedProxyEnv, writeServiceDefinitionFile } from "../src/service";
+import { definitionCarriesCredential, resolvedProxyEnv, writeServiceDefinitionFile } from "../src/service";
 import { buildWinswXml } from "../src/lib/winsw";
 import { CONFIG_OWNER_FILE, CONFIG_UNINSTALL_MANIFEST, recordOwnedConfigPath, removeOwnedConfigState } from "../src/lib/config-ownership";
 import { serviceApiTokenFilePath } from "../src/lib/service-secrets";
@@ -2220,3 +2220,37 @@ describe("service definitions are not world-readable", () => {
     }
   });
 });
+
+// A pre-promotion audit flagged that this file's proxy-credential write used a soft-failing
+// Windows ACL while the two adjacent secret writes — the API token and the install state —
+// both fail closed. On Windows the POSIX mode bits are advisory, so a soft ACL failure can
+// leave a proxy password readable by other local principals.
+describe("credential-bearing definitions harden the Windows ACL strictly", () => {
+  test("a proxy URL with userinfo is treated as a secret publication", () => {
+    // `pw@chatgpt.com` is the repo's existing URL-userinfo fixture: the privacy scanner
+    // reads "pw@host" as an email otherwise, and this exact pair is already allowlisted for
+    // tests/ (scripts/privacy-scan.ts:102). The shape under test is the userinfo authority,
+    // not the particular credential.
+    const unit = buildUnit(resolvedProxyEnv({ HTTPS_PROXY: "https://user:pw@chatgpt.com:8080" }));
+
+    expect(definitionCarriesCredential(unit)).toBe(true);
+  });
+
+  test("a bare proxy URL is not a secret, so an icacls stall must not fail the install", () => {
+    // Before #2107 these files had no hardening at all; refusing an install over a stall
+    // would regress a user who has nothing to protect.
+    const unit = buildUnit(resolvedProxyEnv({ HTTP_PROXY: "http://127.0.0.1:7890", NO_PROXY: "localhost" }));
+
+    expect(definitionCarriesCredential(unit)).toBe(false);
+  });
+
+  test("lower-case spellings and the plist form are covered too", () => {
+    const plist = buildPlist(resolvedProxyEnv({ all_proxy: "socks5://u:p@127.0.0.1:1080" }));
+
+    expect(definitionCarriesCredential(plist)).toBe(true);
+  });
+
+  test("a definition with no proxy env at all carries no credential", () => {
+    expect(definitionCarriesCredential(buildUnit(resolvedProxyEnv({})))).toBe(false);
+  });
+});