From ab2c6207a2131b10a223be0dde5bc8d2e4d30346 Mon Sep 17 00:00:00 2001 From: merlinmiao <820962493@qq.com> Date: Tue, 7 Apr 2026 10:08:00 +0800 Subject: [PATCH] fix(agent): use picoclaw home dir for history file instead of /tmp Security fix for issue #2234: - HistoryFile was hardcoded to os.TempDir() which is world-readable - Now uses internal.GetPicoclawHome() which respects $PICOCLAW_HOME - Creates the home directory if it doesn't exist with proper permissions Co-Authored-By: Claude Opus 4.6 --- cmd/picoclaw/internal/agent/helpers.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/cmd/picoclaw/internal/agent/helpers.go b/cmd/picoclaw/internal/agent/helpers.go index 23227d56a..0afa50293 100644 --- a/cmd/picoclaw/internal/agent/helpers.go +++ b/cmd/picoclaw/internal/agent/helpers.go @@ -82,9 +82,14 @@ func agentCmd(message, sessionKey, model string, debug bool) error { func interactiveMode(agentLoop *agent.AgentLoop, sessionKey string) { prompt := fmt.Sprintf("%s You: ", internal.Logo) + historyFile := filepath.Join(internal.GetPicoclawHome(), ".picoclaw_history") + if err := os.MkdirAll(internal.GetPicoclawHome(), 0700); err != nil { + fmt.Printf("Error creating picoclaw home directory: %v\n", err) + } + rl, err := readline.NewEx(&readline.Config{ Prompt: prompt, - HistoryFile: filepath.Join(os.TempDir(), ".picoclaw_history"), + HistoryFile: historyFile, HistoryLimit: 100, InterruptPrompt: "^C", EOFPrompt: "exit",