Audit of 3560327

internal/agents/preview.go

@@ -131,6 +131,10 @@ func (m *Manager) servePreview(port int) error {
 			http.Error(w, err.Error(), http.StatusForbidden)
 			return
 		}
+		if who.Node.IsTagged() {
+			http.Error(w, "tagged nodes are not users", http.StatusForbidden)
+			return
+		}
 		r.Header.Set("Tailscale-User-Login", who.UserProfile.LoginName)
 		r.Header.Set("Tailscale-User-Name", who.UserProfile.DisplayName)
 		proxy.ServeHTTP(w, r)

internal/server/server.go

@@ -42,10 +42,15 @@ type Server struct {
 type ctxKey struct{}
 
 func New(dataDir string, portFirst int, ts *tsnet.Server) (*Server, error) {
-	err := os.MkdirAll(dataDir, 0o755)
+	err := os.MkdirAll(dataDir, 0o700)
 	if err != nil {
 		return nil, err
 	}
+	// Also protect existing installations: descendants include transcripts,
+	// credentials and the bearer URLs used by local agent listeners.
+	if err := os.Chmod(dataDir, 0o700); err != nil {
+		return nil, err
+	}
 
 	terminals, err := terminal.New(filepath.Join(dataDir, "zsh"))
 	if err != nil {