harden(#433): keyfile 0600-at-creation, remember input bounds, watcher symlink reject, doctor freshness (#434)

* harden(#433): keyfile 0600-at-creation, remember input bounds, watcher symlink reject, doctor freshness

Defense-in-depth items from the 2026-07-03 CoS deep dive (v2.14.0). No
data-loss or default-build behavior change.

M1 — encryption keyfile permission race (main.rs keygen): the secret key was
written, then chmod'd 0600 in a second step, leaving a brief world-readable
window. Create the file with mode(0o600) via OpenOptions on Unix so the
permission is set at inode creation; keep the explicit set_permissions as a
defense-in-depth retighten for a pre-existing looser path.

L — remember input bounds (tools.rs handle_remember): cap category (256),
key (1024), and body_json (4 MiB). category/key are indexed, hashed for
identity, and fed to FTS, so an unbounded key was a DoS-via-huge-key vector.
Caps sit far above any legitimate use.

L — file-watcher symlink reject (connectors/file_watcher.rs): scan_dir used
is_dir()/is_file(), which follow symlinks — a symlink planted in a watched
dir could escape the configured root despite SECURITY.md's "paths
canonicalized" claim. Skip entries whose own file_type() is a symlink,
before any recursion or read.

N4 — doctor freshness/liveness (main.rs run_doctor): add a "last write N days
ago" line (WARN past 14d) read from plaintext timestamp columns via a
read-only connection (no encryption key needed), so a stale vault (harvest
stopped) is visible instead of silently reported healthy.

Not included here (tracked separately in #433):
  * M2 (bind workspace_hash into the audit-chain hash) needs a chain-format
    version bump + migration — it changes verify semantics for every existing
    chain, so it's not a drop-in defense-in-depth patch.
  * M3 (purge redaction workspace scoping) is already addressed by #417/#426:
    the journal-redaction JOIN is workspace-scoped (JRN_MATCH), with the
    residual default-workspace over-redaction documented and intentional
    (GDPR: never under-redact).
  * L dedup alloc bound: decode is already a bounded streaming decoder
    (SigDecoder, bounded by cand_count) — no unbounded pre-alloc remains.

Tests: remember rejects oversized key/category + accepts normal; watcher
ingests regular files and (unix) skips a symlink escaping the root.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#433): write_all needs &[u8], not &String (cfg(unix) keygen path)

The #[cfg(unix)] keygen branch is only compiled on Unix, so the Windows
MSVC check that validated this PR never saw it. write_all takes &[u8];
generate_key() returns a String, so pass key.as_bytes().

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: tcconnally <hermes@perseus.observer>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: 3 people

src/connectors/file_watcher.rs

@@ -86,6 +86,18 @@ impl FileWatcher {
             let entry = entry.map_err(|e| format!("Dir entry error: {}", e))?;
             let path = entry.path();
 
+            // #433 L: reject symlinked entries. `is_dir()`/`is_file()` follow
+            // symlinks, so a symlink planted inside a watched directory could
+            // point outside the configured root (SECURITY.md claims watched
+            // paths are canonicalized). `entry.file_type()` reports the link
+            // itself without traversing it, so we can skip it before any
+            // recursion or read.
+            match entry.file_type() {
+                Ok(ft) if ft.is_symlink() => continue,
+                Ok(_) => {}
+                Err(_) => continue,
+            }
+
             if path.is_dir() {
                 // Skip hidden dirs and common non-content dirs
                 let name = path.file_name().and_then(|n| n.to_str()).unwrap_or("");
@@ -159,3 +171,57 @@ impl Connector for FileWatcher {
         &self.last_sync
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn cfg_for(dir: &std::path::Path) -> FileWatcherConfig {
+        FileWatcherConfig {
+            enabled: true,
+            paths: vec![dir.to_string_lossy().to_string()],
+            extensions: vec![".md".to_string()],
+            debounce_ms: 0,
+        }
+    }
+
+    #[test]
+    fn scan_ingests_regular_files() {
+        let dir = std::env::temp_dir().join(format!("pv-fw-reg-{}", uuid::Uuid::new_v4()));
+        std::fs::create_dir_all(&dir).unwrap();
+        std::fs::write(dir.join("note.md"), "hello").unwrap();
+        let fw = FileWatcher::new(cfg_for(&dir));
+        let docs = fw.fetch().expect("fetch");
+        assert_eq!(docs.len(), 1);
+        assert!(docs[0].body_json.contains("hello"));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    // #433 L: a symlink planted in a watched dir must be skipped, not followed
+    // out of the configured root.
+    #[cfg(unix)]
+    #[test]
+    fn scan_skips_symlinked_files() {
+        use std::os::unix::fs::symlink;
+        let root = std::env::temp_dir().join(format!("pv-fw-link-{}", uuid::Uuid::new_v4()));
+        let outside = std::env::temp_dir().join(format!("pv-fw-out-{}", uuid::Uuid::new_v4()));
+        std::fs::create_dir_all(&root).unwrap();
+        std::fs::create_dir_all(&outside).unwrap();
+        // Secret target lives OUTSIDE the watched root.
+        let secret = outside.join("secret.md");
+        std::fs::write(&secret, "TOP SECRET").unwrap();
+        // Symlink inside the watched root points at it.
+        symlink(&secret, root.join("link.md")).unwrap();
+        // A real file that must still be ingested.
+        std::fs::write(root.join("real.md"), "ok").unwrap();
+
+        let fw = FileWatcher::new(cfg_for(&root));
+        let docs = fw.fetch().expect("fetch");
+        assert_eq!(docs.len(), 1, "only the real file, not the symlink");
+        assert!(docs[0].body_json.contains("ok"));
+        assert!(!docs.iter().any(|d| d.body_json.contains("TOP SECRET")));
+
+        let _ = std::fs::remove_dir_all(&root);
+        let _ = std::fs::remove_dir_all(&outside);
+    }
+}

src/main.rs

@@ -786,6 +786,32 @@ fn print_json<T: serde::Serialize>(value: &T) {
 /// #272: `perseus-vault doctor` — validate the local install + config and report
 /// which MCP clients Perseus Vault works with. ASCII-only output (cross-platform
 /// console safe).
+/// #433 N4: age in days since the most recent entity/journal write, or `None`
+/// when the DB is empty or unreadable. Uses a read-only connection and
+/// plaintext timestamp columns, so it needs no encryption key.
+fn latest_write_age_days(db_path: &str) -> Option<f64> {
+    let conn = rusqlite::Connection::open_with_flags(
+        db_path,
+        rusqlite::OpenFlags::SQLITE_OPEN_READ_ONLY,
+    )
+    .ok()?;
+    let max_of = |sql: &str| -> Option<i64> {
+        conn.query_row(sql, [], |r| r.get::<_, Option<i64>>(0))
+            .ok()
+            .flatten()
+    };
+    let ent =
+        max_of("SELECT MAX(COALESCE(recorded_at_unix_ms, created_at_unix_ms)) FROM entities");
+    let jrn = max_of("SELECT MAX(created_at_unix_ms) FROM journal");
+    let latest = [ent, jrn].into_iter().flatten().max()?;
+    let now = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .ok()?
+        .as_millis() as i64;
+    let age_ms = (now - latest).max(0);
+    Some(age_ms as f64 / (1000.0 * 60.0 * 60.0 * 24.0))
+}
+
 fn run_doctor(db_path: &str) {
     println!("perseus-vault doctor — v{}", env!("CARGO_PKG_VERSION"));
     match std::env::current_exe() {
@@ -802,6 +828,22 @@ fn run_doctor(db_path: &str) {
     };
     println!("  database: {} ({})", db_path, db_status);
 
+    // #433 N4: freshness/liveness — surface a stale vault instead of silently
+    // reporting "healthy" while the harvest/writer has quietly stopped. Reads
+    // the most recent write timestamp from plaintext columns, so it needs no
+    // encryption key.
+    if dbp.exists() {
+        const STALE_AFTER_DAYS: f64 = 14.0;
+        match latest_write_age_days(db_path) {
+            Some(days) if days > STALE_AFTER_DAYS => println!(
+                "  freshness: [WARN] last write {:.1} days ago (> {:.0} days) — is the harvest/writer running?",
+                days, STALE_AFTER_DAYS
+            ),
+            Some(days) => println!("  freshness: last write {:.1} days ago", days),
+            None => println!("  freshness: (no writes recorded yet)"),
+        }
+    }
+
     println!("\nMCP stdio config (identical for every client below):");
     println!("  command: perseus-vault");
     println!("  args:    [\"serve\", \"--db\", \"{}\"]", db_path);
@@ -1214,9 +1256,34 @@ fn main() {
             }
 
             let key = crate::encryption::EncryptionManager::generate_key();
-            match std::fs::write(&expanded, &key) {
+            // #433 M1: create the key file with 0600 *at creation time* so the
+            // secret is never briefly world-readable in the window between the
+            // write and a follow-up chmod. On Unix, OpenOptions::mode applies
+            // the permission when the inode is created (umask can only remove
+            // bits, never widen past 0600).
+            let write_result: std::io::Result<()> = {
+                #[cfg(unix)]
+                {
+                    use std::io::Write;
+                    use std::os::unix::fs::OpenOptionsExt;
+                    std::fs::OpenOptions::new()
+                        .write(true)
+                        .create(true)
+                        .truncate(true)
+                        .mode(0o600)
+                        .open(&expanded)
+                        .and_then(|mut f| f.write_all(key.as_bytes()))
+                }
+                #[cfg(not(unix))]
+                {
+                    std::fs::write(&expanded, &key)
+                }
+            };
+            match write_result {
                 Ok(_) => {
-                    // Set restrictive permissions (owner read-only)
+                    // Defense-in-depth: if the path already existed with looser
+                    // perms, create+truncate does not retighten it, so re-assert
+                    // 0600 explicitly.
                     #[cfg(unix)]
                     {
                         use std::os::unix::fs::PermissionsExt;

src/tools.rs

@@ -477,6 +477,34 @@ pub fn handle_remember(db: &Database, args: Value) -> Result<String, String> {
         return Err(format!("body_json is not valid JSON: {}", e));
     }
 
+    // #433 L: bound input sizes. category/key are indexed, hashed for identity
+    // (category, key, workspace_hash), and fed to FTS — an unbounded key is a
+    // DoS-via-huge-key vector. These caps sit far above any legitimate use.
+    const MAX_CATEGORY_LEN: usize = 256;
+    const MAX_KEY_LEN: usize = 1024;
+    const MAX_BODY_LEN: usize = 4 * 1024 * 1024; // 4 MiB
+    if a.category.len() > MAX_CATEGORY_LEN {
+        return Err(format!(
+            "category too long: {} bytes (max {})",
+            a.category.len(),
+            MAX_CATEGORY_LEN
+        ));
+    }
+    if a.key.len() > MAX_KEY_LEN {
+        return Err(format!(
+            "key too long: {} bytes (max {})",
+            a.key.len(),
+            MAX_KEY_LEN
+        ));
+    }
+    if a.body_json.len() > MAX_BODY_LEN {
+        return Err(format!(
+            "body_json too long: {} bytes (max {})",
+            a.body_json.len(),
+            MAX_BODY_LEN
+        ));
+    }
+
     // Merge recall_when into body_json if provided
     let body = if a.recall_when.is_empty() {
         a.body_json
@@ -4607,6 +4635,45 @@ mod tests {
         );
         let _ = std::fs::remove_file(&path);
     }
+
+    // ─── #433 L: input length bounds on remember ─────────────────
+
+    #[test]
+    fn remember_rejects_oversized_key() {
+        let (db, path) = temp_db();
+        let huge_key = "k".repeat(2000); // > MAX_KEY_LEN (1024)
+        let err = handle_remember(
+            &db,
+            json!({"category": "facts", "key": huge_key, "body_json": "{}"}),
+        )
+        .expect_err("oversized key must be rejected");
+        assert!(err.contains("key too long"), "unexpected error: {err}");
+        let _ = std::fs::remove_file(&path);
+    }
+
+    #[test]
+    fn remember_rejects_oversized_category() {
+        let (db, path) = temp_db();
+        let huge_cat = "c".repeat(500); // > MAX_CATEGORY_LEN (256)
+        let err = handle_remember(
+            &db,
+            json!({"category": huge_cat, "key": "k", "body_json": "{}"}),
+        )
+        .expect_err("oversized category must be rejected");
+        assert!(err.contains("category too long"), "unexpected error: {err}");
+        let _ = std::fs::remove_file(&path);
+    }
+
+    #[test]
+    fn remember_accepts_normal_sizes() {
+        let (db, path) = temp_db();
+        handle_remember(
+            &db,
+            json!({"category": "facts", "key": "normal-key", "body_json": "{\"a\":1}"}),
+        )
+        .expect("normally-sized remember must succeed");
+        let _ = std::fs::remove_file(&path);
+    }
 }