v3.4.1 — Security patch (CodeQL #65–#68)

[Jovancoding]

Security Fixes

CodeQL #65–#68 (HIGH) — Insecure temporary file (CWE-377, CWE-378)

All four alerts flagged writeFileSync calls in lib/locked-blackboard.ts where CodeQL traced a taint path from os.tmpdir() through basePath to the written file.

Changes in lib/locked-blackboard.ts:

1. path.resolve(basePath) in constructor — absolute path resolution normalizes all derived paths (blackboardPath, pendingDir, lockPath)
2. mode: 0o600 on all writeFileSync calls — files are owner-read/write only; no world or group access (directly addresses CWE-377/CWE-378)
3. mode: 0o700 on all mkdirSync calls — directories are owner-only

Affected write sites:

• Line 368 — writeInitialBlackboard()
• Line 469 — persistToDisk() (locked path)
• Line 483 — savePendingChange()
• Line 497 — archivePendingChange()
• Line 900 — persistToDiskInternal()

---

Compatibility

100% backward compatible — no API changes, no behavior changes.
497 tests passing (64/64 priority tests verified post-fix).

---

Full changelog

See CHANGELOG.md for complete history.

---

This discussion was created from the release v3.4.1 — Security patch (CodeQL #65–#68).