Audit of 3560327

internal/server/server.go

@@ -42,10 +42,15 @@ type Server struct {
 type ctxKey struct{}
 
 func New(dataDir string, portFirst int, ts *tsnet.Server) (*Server, error) {
-	err := os.MkdirAll(dataDir, 0o755)
+	err := os.MkdirAll(dataDir, 0o700)
 	if err != nil {
 		return nil, err
 	}
+	// Also protect existing installations: descendants include transcripts,
+	// credentials and the bearer URLs used by local agent listeners.
+	if err := os.Chmod(dataDir, 0o700); err != nil {
+		return nil, err
+	}
 
 	terminals, err := terminal.New(filepath.Join(dataDir, "zsh"))
 	if err != nil {