Keep first-run access details confined to the active process console and remove development credentials from managed application logs.
Treat notification delivery settings as sensitive during backup and restore, preserve private file access across creation and updates, and align the WebUI guidance with the new boundary.
Use a local-only default while preserving saved operator choices and keeping broader network access available from the settings panel.
Treat enabled encrypted transport as a startup requirement and present a dismissible notice when remote browser access is not protected.
Enforce a global log quota with configurable retention and observable degradation. Add authenticated storage reporting and safe cleanup controls to the settings UI. Protect active stream transfers and isolate parallel test resources.
Route selected backup entries through owner-owned config parsers before any filesystem write. Reject unsupported paths, mismatched encodings, malformed base64, lossy normalization, invalid effective overlays, and decoded payloads larger than 32 MiB.
Treat WebUI state, private keys, and every OneBot config as a single sensitive group. Skip unselected sensitive entries without inspecting their contents, preserve recognized migrations, and assign restrictive modes to credential files.
Adversarial Wave A2 pass, 3 MAJORs:
- #3/#3b: the allowlist missed per-account config/onebot_<uin>.json (the file
that actually carries each account's network config + OneBot access token).
Add it via an /^onebot_\d+\.json$/ pattern; classify ALL onebot config
(global + per-uin) as credential since it holds the access token — a
no-credentials backup no longer leaks tokens. Export scans config/ for them.
- #6: GET export could carry the private key/hash; add Cache-Control: no-store
+ Pragma so the response is never cached.
- #4: refactor applyBackup → pure planRestore + a two-phase atomic restore in
server.ts (snapshot → stage all .tmp → rename all), so a staging failure
leaves the live config untouched; clean up stray tmp on failure.
DrSmoothl