security: apply-pm2-caps now uses mktemp + trap-unlink for pm2 jlist (was leaking secrets to /tmp)

c65b01bcb8223513713e94c290101493e2c516d5 · 2026-05-11 09:58:40 -0700 · Steve Abrams

Files touched

M scripts/apply-pm2-caps.sh

Diff

commit c65b01bcb8223513713e94c290101493e2c516d5
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon May 11 09:58:40 2026 -0700

    security: apply-pm2-caps now uses mktemp + trap-unlink for pm2 jlist (was leaking secrets to /tmp)
---
 scripts/apply-pm2-caps.sh | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/apply-pm2-caps.sh b/scripts/apply-pm2-caps.sh
index 8238ce8..e822085 100644
--- a/scripts/apply-pm2-caps.sh
+++ b/scripts/apply-pm2-caps.sh
@@ -45,7 +45,12 @@ log() { echo "[$(date -u +%H:%M:%S)] $*" | tee -a "$LOG"; }
 
 log "mode=$MODE  sister-cap=$SISTER_CAP  llm-cap=$LLM_CAP"
 
-"$PM2_BIN" jlist 2>/dev/null > "/tmp/pm2-jlist-${TS}.json" || {
+# pm2 jlist contains ALL env vars including real API keys/secrets the shell had
+# at proc-start time. NEVER write it to a long-lived path. Use a temp file and
+# trap-unlink on exit so it's nuked even if the script crashes.
+JLIST_TMP="$(mktemp -t pm2-jlist.XXXXXX)"
+trap 'rm -f "$JLIST_TMP"' EXIT
+"$PM2_BIN" jlist 2>/dev/null > "$JLIST_TMP" || {
   log "ERROR: pm2 jlist failed"
   exit 3
 }
@@ -55,7 +60,7 @@ CAPS_SISTER="$SISTER_CAP" \
 CAPS_LLM="$LLM_CAP" \
 CAPS_LOG="$LOG" \
 CAPS_PM2="$PM2_BIN" \
-CAPS_JLIST="/tmp/pm2-jlist-${TS}.json" \
+CAPS_JLIST="$JLIST_TMP" \
 /usr/bin/python3 <<'PYEOF'
 import json, os, sys, subprocess, time

← b5c8459 security: apply-pm2-caps now whitelists env (was leaking GOD · back to Cncp Mcp · security: cncp-refresh keeps newest 5 backups, deletes the r ae1c6b7 →