Harden autobrowse: restrict trace artifacts to owner-only permissions

[shubh24]

What

Autobrowse writes trace artifacts (trace.json, messages.json, summary.md, and screenshots/) for each run. These can contain sensitive material captured during an authenticated browsing session: session cookies, Authorization/bearer tokens, passwords from form POSTs, private URLs with embedded tokens, and screenshots of logged-in pages.

These files were written with default fs.writeFileSync / fs.mkdirSync permissions, which inherit the process umask — typically 0644 for files and 0755 for directories. That makes the whole trace tree readable by other local users and processes.

What we're preventing against

On a shared filesystem, anything with a different UID on the same host could read the trace contents:

• CI runners where another job/tenant shares the workspace
• Shared dev boxes with multiple user accounts
• Multi-tenant container hosts with shared mounts
• Traces accidentally swept into downloadable CI artifacts

In those environments, world-readable traces mean another party could lift live session tokens, credentials, and screenshots of authenticated pages belonging to whatever the bot logged into.

Change

Restrict trace artifacts to the owner:

• Run dir + screenshots/ created with mode 0700; the run dir is also chmod'd explicitly, since mkdirSync's mode only applies to directories it actually creates (a pre-existing parent could otherwise remain traversable).
• trace.json / messages.json / summary.md written with mode 0600.
• lockDownTrace() sweeps the run dir at the end to cover files written by subprocesses (screenshots from the browse CLI, .o11y artifacts) whose creation mode we don't control. The latest symlink is skipped.

0700/0600 are not widened by the process umask, so behavior is consistent across hosts.

Impact on the loop: none

The owner — the same user the self-improvement loop runs as — keeps full read/write. The inner agent writing traces, the outer loop reading them to update strategy.md, the latest symlink, and multi-iteration runs all work unchanged. Only cross-user access is removed.

Verification

Tested the write/read sequence + the lockdown sweep against a reproduced trace tree:

• Under both umask 022 and umask 000, all artifacts (including the subprocess-written screenshot) end up 0700/0600; no group/other-readable paths remain.
• Full owner flow verified across two consecutive runs: incremental trace.json re-read/rewrite mid-run, traversing + listing the run and screenshots/ dirs, reading every artifact, reading through the latest symlink, and getNextRunNumber advancing run-001 → run-002.

🤖 Generated with Claude Code

---

Note

Low Risk
Filesystem permission hardening only; same-user read/write for the autobrowse loop is unchanged, with no auth or runtime logic changes.

Overview
Hardens trace output permissions in evaluate.mjs so run artifacts (JSON traces, messages, summaries, screenshots) are only readable by the owning user.

Run directories and screenshots/ are created with mode 0700, with an explicit chmod on the run dir when a parent already existed with looser perms. trace.json, messages.json, and summary.md are written with 0600, including incremental trace.json updates mid-run.

A new lockDownTrace() recursively applies 0700/0600 under the run directory after the run finishes, covering files from subprocesses (e.g. browse screenshots, .o11y) whose modes aren't controlled at write time. Symlinks (including latest) are skipped.

^{Reviewed by Cursor Bugbot for commit ab767a6. Bugbot is set up for automated code reviews on this repo. Configure here.}