🛡️ Sentinel: [MEDIUM] Fix insecure file permissions on lockfile

🚨 Severity: MEDIUM
💡 Vulnerability: The `ProfileLock` struct creates lock files and their parent directories using default system permissions (`fs::create_dir_all` and `fs::OpenOptions::new()`), which could expose sensitive config paths or metadata on shared systems.
🎯 Impact: Local privilege escalation or info leakage of profile presence/metadata if executed on a shared multi-user machine.
🔧 Fix: Updated `ProfileLock::acquire` to use `crate::paths::create_secure_dir_all` (mode `0o700`) for the parent directory and explicitly set mode `0o600` for the lockfile itself via `OpenOptionsExt` on Unix platforms. Also cleaned up `cargo fmt` errors across codebase.
✅ Verification: `cargo test`, `cargo clippy`, and `cargo fmt` execute successfully. Check `.lock` file permissions after running the CLI.

Co-authored-by: bitcoiner-dev <75873427+bitcoiner-dev@users.noreply.github.com>

Author: google-labs-jules[bot]

src/commands/account.rs

@@ -1,8 +1,8 @@
 use crate::cli::{AccountAction, AccountArgs, Cli};
 use crate::error::AppError;
+use crate::output::CommandOutput;
 use crate::wallet_service::{now_unix, AccountState};
 use crate::{load_wallet_session, profile_path, read_profile, write_profile};
-use crate::output::CommandOutput;
 use zinc_core::Account;
 
 pub async fn run(cli: &Cli, args: &AccountArgs) -> Result<CommandOutput, AppError> {

src/commands/address.rs

@@ -1,8 +1,8 @@
 use crate::cli::{AddressArgs, AddressKind, Cli};
 use crate::error::AppError;
+use crate::output::CommandOutput;
 use crate::wallet_service::map_wallet_error;
 use crate::{load_wallet_session, persist_wallet_session};
-use crate::output::CommandOutput;
 
 pub async fn run(cli: &Cli, args: &AddressArgs) -> Result<CommandOutput, AppError> {
     let mut session = load_wallet_session(cli)?;

src/commands/doctor.rs

@@ -1,7 +1,7 @@
 use crate::cli::Cli;
 use crate::error::AppError;
-use crate::{profile_path, read_profile};
 use crate::output::CommandOutput;
+use crate::{profile_path, read_profile};
 use zinc_core::{OrdClient, ZincWallet};
 
 pub async fn run(cli: &Cli) -> Result<CommandOutput, AppError> {

src/commands/inscription.rs

@@ -12,11 +12,7 @@ pub async fn run(cli: &Cli, _args: &InscriptionArgs) -> Result<CommandOutput, Ap
     let display_items = if !cli.thumb_enabled() {
         None
     } else {
-        Some(get_inscription_display_items(
-            &session.profile.ord_url,
-            &sorted_inscriptions,
-        )
-        .await)
+        Some(get_inscription_display_items(&session.profile.ord_url, &sorted_inscriptions).await)
     };
 
     Ok(CommandOutput::InscriptionList {

src/commands/lock.rs

@@ -1,8 +1,8 @@
 use crate::cli::{Cli, LockAction, LockArgs};
 use crate::error::AppError;
+use crate::output::CommandOutput;
 use crate::wallet_service::now_unix;
 use crate::{confirm, profile_lock_path, read_lock_metadata};
-use crate::output::CommandOutput;
 use std::fs;
 
 pub async fn run(cli: &Cli, args: &LockArgs) -> Result<CommandOutput, AppError> {

src/commands/mod.rs

@@ -12,6 +12,6 @@ pub mod setup;
 pub mod snapshot;
 pub mod sync;
 pub mod tx;
+pub mod version;
 pub mod wait;
 pub mod wallet;
-pub mod version;

src/commands/scenario.rs

@@ -1,9 +1,9 @@
 use crate::cli::{Cli, ScenarioAction, ScenarioArgs};
 use crate::error::AppError;
+use crate::output::CommandOutput;
 use crate::utils::run_bitcoin_cli;
 use crate::wallet_service::NetworkArg;
 use crate::{confirm, load_wallet_session, persist_wallet_session, snapshot_dir};
-use crate::output::CommandOutput;
 use std::fs;
 
 pub async fn run(cli: &Cli, args: &ScenarioArgs) -> Result<CommandOutput, AppError> {
@@ -121,9 +121,7 @@ pub async fn run(cli: &Cli, args: &ScenarioArgs) -> Result<CommandOutput, AppErr
                 }
             }
 
-            CommandOutput::ScenarioReset {
-                removed,
-            }
+            CommandOutput::ScenarioReset { removed }
         }
     };
 

src/commands/wallet.rs

@@ -79,7 +79,11 @@ pub async fn run(cli: &Cli, args: &WalletArgs) -> Result<CommandOutput, AppError
                 bitcoin_cli: default_bitcoin_cli(),
                 bitcoin_cli_args: default_bitcoin_cli_args().join(" "),
                 phrase,
-                words: if cli.reveal || !cli.agent { Some(wallet.words.len()) } else { None },
+                words: if cli.reveal || !cli.agent {
+                    Some(wallet.words.len())
+                } else {
+                    None
+                },
             })
         }
         WalletAction::Import {
@@ -133,7 +137,11 @@ pub async fn run(cli: &Cli, args: &WalletArgs) -> Result<CommandOutput, AppError
                 scheme: scheme_arg.to_string(),
                 account_index: 0,
                 imported: true,
-                phrase: if cli.reveal || !cli.agent { Some(mnemonic.to_string()) } else { None },
+                phrase: if cli.reveal || !cli.agent {
+                    Some(mnemonic.to_string())
+                } else {
+                    None
+                },
             })
         }
         WalletAction::Info => {

src/dashboard.rs

@@ -175,12 +175,7 @@ fn activate_session(
     state.network = Some(resolved_network.value);
     state.profile_name = Some(resolved_profile);
 
-    state.ordinals_address = Some(
-        session
-            .wallet
-            .peek_taproot_address(0)
-            .to_string(),
-    );
+    state.ordinals_address = Some(session.wallet.peek_taproot_address(0).to_string());
     state.payment_address = session
         .wallet
         .peek_payment_address(0)

src/lock.rs

@@ -22,14 +22,21 @@ impl ProfileLock {
         let lock_path = profile_path.with_extension("lock");
 
         if let Some(parent) = lock_path.parent() {
-            fs::create_dir_all(parent).map_err(|e| {
+            crate::paths::create_secure_dir_all(parent).map_err(|e| {
                 crate::error::AppError::Config(format!("failed to create lock dir: {e}"))
             })?;
         }
 
-        let file = fs::OpenOptions::new()
-            .write(true)
-            .create_new(true)
+        let mut options = fs::OpenOptions::new();
+        options.write(true).create_new(true);
+
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::OpenOptionsExt;
+            options.mode(0o600);
+        }
+
+        let file = options
             .open(&lock_path)
             .map_err(|_| AppError::Config("profile is locked by another instance".to_string()))?;