[shuv1337]

Problem

Desktop Clerk stored sign-in tokens with @clerk/electron storage({ path: stateDir }). That adapter uses electron-store, and conf writes clerk-tokens.json with configFileMode 0o666, so the process umask never tightens it and the next write restores 0666. Another local user could read or replace the file.

This is a narrow security cherry-pick of upstream pingdotgg/t3code#22190 (bd9cc0a901). It is the first step in the phased plan, before any broader nightly sync (upstream v0.1.6-nightly.20261031.3956 @ d92c437 is not included). Do not merge this as part of a full upstream sync.

Change

Cherry-picked -x only bd9cc0a901 onto current main (42c296b48, Phase B through nightly 20261030.3940 / #343).

The store now lives in <stateDir>/clerk, created at 0700. Startup moves an existing clerk-tokens.json into that directory and sets it to 0600. The same mode is applied again after every storage read, write, and delete. A symlink directory or token file is rejected so chmod cannot follow it.

Fork desktop identity is preserved. The only conflict was createDesktopClerkBridge: this fork already passes environment.appVersion into the desktop scheme, and the security fix also needs userDataPath. Both arguments are kept. Publishable-key handling, product paths (shuv2code-v2), and deep-link schemes (shuv2code-dev / s2code-dev) are unchanged.

Files

• apps/desktop/src/app/ClerkTokenStore.ts (new)
• apps/desktop/src/app/ClerkTokenStore.test.ts (new)
• apps/desktop/src/app/DesktopClerk.ts
• apps/desktop/src/app/DesktopClerk.test.ts

Scope and approval

Security-only cherry-pick of the already-merged upstream fix for pingdotgg#22190 / pingdotgg#15143. No release, update, or desktop-identity changes, and no other nightly commits.

Verification

• vp test run apps/desktop/src/app/ClerkTokenStore.test.ts apps/desktop/src/app/DesktopClerk.test.ts: 2 files, 27 passed (Linux). Upstream reported 25; this fork has two extra DesktopClerk cases.
• vp fmt --check and vp lint on the four files: passed.
• tsc --noEmit for @t3tools/desktop and @t3tools/scripts: passed (vp run check:changed typecheck).
• vp run check:changed: format, lint, typecheck, and the two tests passed. Knip failed on pre-existing unused files/exports that are not in this diff (scripts/resolve-nightly-release.ts, marketing @fontsource-variable/inter, and unused exports in desktop/server/web/shared identity helpers).

Limitations, same as upstream: the mode unit test skips on win32, where Node's file mode only toggles the read-only attribute. electron-store still applies 0666 during the write; 0600 is restored immediately afterward, and the 0700 directory covers that interval. Checked on Linux only.

Model and harness: Grok 4.7 in a Cursor Cloud Agent.