fix: sweep audit low-severity findings

Twelve of the sixteen low findings. Two were already fixed in earlier commits
(the '..' output-dir escape, folded into confineToDir), and two are left
open deliberately (see below).

Credentials and permissions:
- logout claimed "Browser session cleared" and exited 0 while
  credentials.json / login.json still held a live session, so the next start
  logged straight back in. Now reports them and exits non-zero.
- login no longer accepts --password / --otp-secret. argv is world-readable
  via /proc/<pid>/cmdline for the ~5 minute poll and a captured base32 TOTP
  seed is a permanent 2FA bypass. Env vars or login.json instead.
- config dir 0700; session-backup archive 0600 (it holds the cookie jar,
  daemon.token and daemon.lock); IDE config writes carrying a PAT 0600 --
  the atomic rename replaces the inode, resetting any mode the user set.

Correctness:
- sync_base validates planId/diffId. They are interpolated into on-disk
  filenames and join() normalises '..', so diffId "x/../../tools-config"
  overwrote tools-config.json -- which load() merges over a defaultConfig()
  whose activeProfile is 'full'.
- an unverifiable view no longer reads as clean. snapshotViewFiltered is the
  only signal suppressing pruneRecords and was set only when every view's
  filter state was KNOWN, so a getView that threw made a filtered row set
  look complete and mirror could delete real records as false orphans.
- attachment fetch checks r.ok. A 403/404 body was uploaded as the file,
  counted as success, and written into the persisted dedupe map, so a re-run
  skipped the corrupted cell instead of repairing it.
- an unreadable daemon.lock is no longer deleted with no liveness check --
  acquire() publishes it empty and fills it a moment later, so a racer could
  evict a lock a live daemon was mid-write.
- apply.lock expires instead of wedging forever on a recycled pid, and
  APPLY_LOCKED now names the lock path.
- the exit-intent slot only consumes an intent staged during this request.

Performance:
- offsetToPosition memoises line starts and binary-searches instead of
  rescanning from 0 per diagnostic: ')'.repeat(20000) ~1000ms -> 28ms,
  'IF('.repeat(10000) ~3500ms -> 484ms.
- showToolStatus reuses one OutputChannel.

Left open deliberately: createRecords re-resolving the table schema per
chunk, and reapplyViewFilters prefetching view configs the next loop
discards. Both are bounded micro-optimisations the verifier measured as
saving ~1 request per 50 creates and "nearly nothing" respectively; neither
is worth the regression risk in this pass.

Verified: 1451 mcp-server + 421 extension + 162 language-services + 88
webview tests pass, check:tool-sync green at 10/54/72, pnpm build clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: ARHAEEM

packages/extension/src/auto-config/ide-detection.ts

@@ -82,7 +82,10 @@ export async function writeConfigAtomic(filePath: string, config: Record<string,
   const tmp = `${filePath}.${crypto.randomBytes(6).toString('hex')}.tmp`;
   await fs.promises.mkdir(path.dirname(filePath), { recursive: true });
   try {
-    await fs.promises.writeFile(tmp, JSON.stringify(config, null, 2) + '\n', 'utf8');
+    // 0600 — this file carries the Airtable PAT (Authorization: Bearer pat…). The
+    // rename below replaces the destination inode, so without an explicit mode any
+    // restrictive permissions the user had set are reset to 0644. No-op on Windows.
+    await fs.promises.writeFile(tmp, JSON.stringify(config, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
     await fs.promises.rename(tmp, filePath);
   } catch (err) {
     await fs.promises.unlink(tmp).catch(() => {});

packages/extension/src/auto-config/lsp-config.ts

@@ -247,7 +247,8 @@ async function writeTextAtomic(filePath: string, content: string): Promise<void>
   const tmp = `${filePath}.${crypto.randomBytes(6).toString('hex')}.tmp`;
   await fs.promises.mkdir(path.dirname(filePath), { recursive: true });
   try {
-    await fs.promises.writeFile(tmp, content, 'utf8');
+    // 0600 for the same reason as writeConfigAtomic — these configs can carry a token.
+    await fs.promises.writeFile(tmp, content, { encoding: 'utf8', mode: 0o600 });
     await fs.promises.rename(tmp, filePath);
   } catch (err) {
     await fs.promises.unlink(tmp).catch(() => {});

packages/extension/src/extension.ts

@@ -161,6 +161,13 @@ export async function activate(context: vscode.ExtensionContext): Promise<void>
     // Live-stream debug events to the VS Code Output panel
     const debugOutput = vscode.window.createOutputChannel('Airtable Formula: Debug Log');
     context.subscriptions.push(debugOutput);
+
+    // Created once here, not per invocation: VS Code mints a DISTINCT channel per
+    // createOutputChannel call, so creating it inside the showToolStatus handler
+    // left one identically-named entry in the Output dropdown per invocation and
+    // never disposed any of them.
+    const toolStatusChannel = vscode.window.createOutputChannel('Airtable Formula: MCP Tools', 'markdown');
+    context.subscriptions.push(toolStatusChannel);
     debugCollector.onEvent = (ev) => {
         const time = ev.ts.slice(11, 23); // HH:MM:SS.mmm
         const tag = `[${ev.source}] ${ev.event}`;
@@ -565,7 +572,11 @@ export async function activate(context: vscode.ExtensionContext): Promise<void>
             dashboardProvider.refresh();
         }),
         vscode.commands.registerCommand('airtable-formula.showToolStatus', async () => {
-            const channel = vscode.window.createOutputChannel('Airtable Formula: MCP Tools', 'markdown');
+            // Created once and reused. VS Code mints a DISTINCT channel per
+            // createOutputChannel call, so doing this inside the handler left N
+            // identically-named entries in the Output dropdown with no way to tell
+            // which was current — the channel.clear() below shows reuse was intended.
+            const channel = toolStatusChannel;
             channel.clear();
             channel.appendLine(toolProfileManager.renderStatusReport());
             channel.show();

packages/extension/src/mcp/session-backup.ts

@@ -22,11 +22,15 @@ const MAX_UNZIPPED_BYTES    = 500 * 1024 * 1024;    // 500 MB post-extraction
 export async function backupSession(destPath: string, password?: string): Promise<void> {
   const zipBuffer = await createZipBuffer(CONFIG_DIR);
 
+  // 0600: the archive contains the Chrome cookie jar, daemon.token and daemon.lock
+  // (both hold the plaintext bearer). Those files are hardened individually and
+  // secureDirectory() runs after RESTORE — but not after backup, so the archive was
+  // created 0666&~umask. No-op on Windows.
   if (password) {
     const encrypted = encrypt(zipBuffer, password);
-    await fs.writeFile(destPath, encrypted);
+    await fs.writeFile(destPath, encrypted, { mode: 0o600 });
   } else {
-    await fs.writeFile(destPath, zipBuffer);
+    await fs.writeFile(destPath, zipBuffer, { mode: 0o600 });
   }
 }
 

packages/language-services/src/engines/formula/diagnostics.ts

@@ -21,13 +21,40 @@ import {
 // Position helpers (replace document.positionAt / new vscode.Range)
 // ---------------------------------------------------------------------------
 
+/**
+ * Line-start offsets for one document, memoised on the document text.
+ *
+ * offsetToPosition used to walk from offset 0 on EVERY call, and makeRange calls it
+ * twice per diagnostic — so emitting N diagnostics cost O(N x document). Measured
+ * before: `')'.repeat(20000)` took ~1.0s and `'IF('.repeat(10000)` ~3.5s. Only one
+ * document is ever in flight per call, so a single-entry cache is enough; keeping it
+ * keyed on the text means a stale entry is impossible.
+ */
+let lineStartsText: string | null = null;
+let lineStartsCache: number[] = [];
+
+function lineStarts(text: string): number[] {
+  if (lineStartsText === text) return lineStartsCache;
+  const starts = [0];
+  for (let i = 0; i < text.length; i++) {
+    if (text[i] === '\n') starts.push(i + 1);
+  }
+  lineStartsText = text;
+  lineStartsCache = starts;
+  return starts;
+}
+
 function offsetToPosition(text: string, offset: number): { line: number; character: number } {
-  let line = 0;
-  let lastNewline = -1;
-  for (let i = 0; i < offset && i < text.length; i++) {
-    if (text[i] === '\n') { line++; lastNewline = i; }
+  const starts = lineStarts(text);
+  // Binary search for the last line start <= offset.
+  let lo = 0;
+  let hi = starts.length - 1;
+  while (lo < hi) {
+    const mid = (lo + hi + 1) >> 1;
+    if (starts[mid] <= offset) lo = mid;
+    else hi = mid - 1;
   }
-  return { line, character: offset - lastNewline - 1 };
+  return { line: lo, character: offset - starts[lo] };
 }
 
 function makeRange(text: string, start: number, end: number): LsRange {

packages/mcp-server/CHANGELOG.md

@@ -2,6 +2,44 @@
 
 ## [Unreleased]
 
+### Fixed (2026-08-01 — audit low-severity sweep)
+
+- **Credentials.** `logout` wiped the browser profile, printed "Browser session cleared." and exited
+  0 while `credentials.json` / `login.json` still held a live session — the next server start read
+  them and was logged straight back in. It now reports those files and exits non-zero rather than
+  claiming a cleared session (they are user-authored, so it does not delete them). `login` no longer
+  accepts `--password` / `--otp-secret`: argv lands in world-readable `/proc/<pid>/cmdline` and shell
+  history for the ~5-minute login poll, and a captured base32 TOTP seed is a permanent 2FA bypass —
+  use the env vars or `login.json`. The config directory is created 0700 (it holds those files), and
+  the session-backup archive 0600 (it contains the cookie jar, `daemon.token` and `daemon.lock`).
+  IDE config writes that carry an Airtable PAT are 0600 — the atomic rename replaces the destination
+  inode, so without a mode any restrictive permissions the user had set were reset. All no-ops on Windows.
+- **`sync_base` ids are validated.** `planId`/`diffId` are interpolated into on-disk filenames and
+  `join()` normalises `..`, so `diffId: "x/../../tools-config"` overwrote
+  `~/.airtable-user-mcp/tools-config.json` — which `ToolConfigManager.load()` then merges over a
+  `defaultConfig()` whose `activeProfile` is `full`.
+- **An unverifiable view no longer reads as "clean".** `snapshotViewFiltered` is the only signal that
+  suppresses `pruneRecords`, and it was set only when every candidate view's filter state was KNOWN —
+  a `getView` that threw left the view `unknown` and the row set was treated as complete, so mirror
+  could delete real records as false orphans. Unverified picks are now flagged (`unverified: true`).
+- **Attachment fetch checks `r.ok`.** A 403/404 body was uploaded to the destination cell as the file,
+  counted as success, and written into the persisted dedupe map — so a re-run SKIPPED the corrupted
+  cell instead of repairing it. Source signed URLs expire mid-job, which is exactly when this happened.
+- **An unreadable `daemon.lock` is no longer deleted.** `acquire()` publishes the file with
+  `openSync(...,'wx')` and fills it a moment later, so it legitimately exists with zero bytes in
+  between — and the parse-failure branch removed it with no liveness check, letting a racing acquirer
+  evict a lock a live daemon was mid-write. It now fails the attempt and lets the retry loop re-probe.
+- **`apply.lock` no longer wedges forever on a recycled pid**, and the `APPLY_LOCKED` error finally
+  names the lock file's path.
+- **The daemon exit-intent slot** only consumes an intent staged during the current request, so a
+  concurrent `/mcp` response no longer truncates a stop/restart caller's confirmation. (Narrowed, not
+  closed — see the `ponytail:` note; the exact fix needs request identity threaded through.)
+- **`offsetToPosition` no longer rescans from offset 0 for every diagnostic.** `makeRange` calls it
+  twice per diagnostic, so N diagnostics cost O(N x document). Line starts are memoised per document
+  and binary-searched: `')'.repeat(20000)` **~1000 ms → 28 ms**, `'IF('.repeat(10000)` **~3500 ms → 484 ms**.
+- **`showToolStatus` reuses one OutputChannel** instead of minting a new identically-named one per
+  invocation and never disposing it.
+
 ### Changed (2026-08-01 — new `local-write` category; read-only is 12 → 10 tools)
 
 - **`download_formula_field` and `download_base_formulas` moved out of `read` into a new

packages/mcp-server/src/cli.js

@@ -203,6 +203,30 @@ export async function runCli(args) {
     } catch {
       // ignore
     }
+
+    // The browser profile is only ONE of the credential sources. In byo /
+    // direct-login mode the session lives in credentials.json / login.json, which
+    // nothing here ever removed — so logout wiped a profile those modes never used,
+    // printed "Browser session cleared." and exited 0, and the next server start
+    // read the file and was logged straight back in. These are user-authored files,
+    // so deleting them silently would destroy input the user typed; report them
+    // instead, and do not claim the session is cleared while one still resolves.
+    const stillLive = [];
+    for (const name of ['credentials.json', 'login.json']) {
+      const p = path.join(getConfigDir(), name);
+      try {
+        await (await import('node:fs/promises')).access(p);
+        stillLive.push(p);
+      } catch { /* absent — nothing to report */ }
+    }
+    if (stillLive.length) {
+      process.stdout.write(
+        '\nThese files still hold live credentials and were NOT removed:\n' +
+        stillLive.map((p) => `  ${p}\n`).join('') +
+        'You are still logged in through them. Delete them to finish logging out.\n',
+      );
+      process.exitCode = 1;
+    }
     return true;
   }
 

packages/mcp-server/src/daemon/lockfile.js

@@ -24,7 +24,7 @@ export function acquire(record, options = {}) {
   const lockPath = options.lockPath ?? getLockfilePath();
   const normalized = normalizeRecord(record);
 
-  mkdirSync(dirname(lockPath), { recursive: true });
+  mkdirSync(dirname(lockPath), { recursive: true, mode: 0o700 });
 
   for (let attempt = 0; attempt < 2; attempt++) {
     let fd;
@@ -65,12 +65,14 @@ function tryReclaimStale(lockPath) {
   try {
     existing = read({ lockPath });
   } catch {
-    try {
-      rmSync(lockPath, { force: true });
-      return true;
-    } catch {
-      return false;
-    }
+    // Do NOT delete an unreadable lockfile. `acquire()` publishes the file with
+    // openSync(...,'wx') and only fills it a moment later, so between those two
+    // steps it legitimately exists with ZERO bytes — and read() throws on that.
+    // Deleting here (with no liveness check at all) let a racing acquirer evict a
+    // lock that a live daemon was in the middle of writing, so both callers
+    // returned true. Fail this attempt instead and let startDaemon's existing
+    // retry loop re-probe once the winner has finished writing.
+    return false;
   }
   if (!isStale(existing)) {
     return false;
@@ -121,7 +123,7 @@ export function replace(record, options = {}) {
     }
   }
 
-  mkdirSync(dirname(lockPath), { recursive: true });
+  mkdirSync(dirname(lockPath), { recursive: true, mode: 0o700 });
   safeAtomicWriteFileSync(lockPath, serialize(normalized), { encoding: 'utf8', mode: 0o600 });
   applyPrivatePermissions(lockPath);
   return true;

packages/mcp-server/src/daemon/server.js

@@ -19,7 +19,7 @@ import { AirtableClient } from '../client.js';
 import { ToolConfigManager } from '../tool-config.js';
 import { withToolDispatchContext } from '../page-scheduler.js';
 import { ensureToken, rotateToken, getTokenPath, onTokenRotate } from './token.js';
-import { takeDaemonExit } from './exit-intent.js';
+import { takeDaemonExit, peekDaemonExit } from './exit-intent.js';
 import { clearStopSentinel, writeStopSentinel } from './stop-sentinel.js';
 import { setInjectedCredentials } from './cred-store.js';
 import { getTunnelProvider, writeTunnelSettings } from './tunnel-providers/index.js';
@@ -745,9 +745,23 @@ export async function startDaemonServer(options = {}) {
       // only point at which shutting the process down cannot truncate the answer
       // the model is waiting for. Registered BEFORE handleRequest so it is armed
       // no matter how fast the handler completes; a no-op when nothing staged.
+      // Only consume an intent that appeared DURING this request. The slot is a
+      // process-global single slot with no association to the request that staged
+      // it, so a concurrent /mcp response finishing in the window between
+      // stageExit() and the stop/restart caller's own flush ran the exit on the
+      // wrong hook and truncated the stop caller's confirmation.
+      // ponytail: comparing against the pre-handler snapshot closes the common case
+      // (an intent staged before we started is not ours) but not the exact one — a
+      // request that began earlier still wins a same-instant stage. Threading the
+      // request identity through requestDaemonExit (AsyncLocalStorage) is the real
+      // fix; the residual window is sub-millisecond and browser-mode stop() awaits
+      // Chromium teardown before touching activeMcpClosers, so the response wins.
+      const intentBefore = peekDaemonExit();
       res.on('finish', () => {
-        const intent = takeDaemonExit();
-        if (intent) void runExitIntent(intent);
+        const intent = peekDaemonExit();
+        if (intent && intent !== intentBefore) {
+          void runExitIntent(takeDaemonExit());
+        }
       });
 
       const mcpServer = new Server(

packages/mcp-server/src/daemon/token.js

@@ -84,7 +84,10 @@ export function rotateToken(options = {}) {
 function writeToken(record, options = {}) {
   const tokenPath = options.tokenPath ?? getTokenPath();
   const normalized = normalizeRecord(record);
-  mkdirSync(dirname(tokenPath), { recursive: true });
+  // 0700: this directory holds the daemon token AND the hand-authored
+  // credentials.json / login.json. The files are chmod 0600 individually, but the
+  // containing directory was created traversable. No-op on Windows.
+  mkdirSync(dirname(tokenPath), { recursive: true, mode: 0o700 });
   const tmp = tokenPath + '.tmp';
   writeFileSync(tmp, JSON.stringify(normalized, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
   renameSync(tmp, tokenPath);