fix(security): namespace sessions Map by keyId — close cross-key conversation collision

**Bug**: the sessions Map used the raw client-supplied conversationId string as
its key. Two callers with different API keys (or one anonymous + one
authenticated) using the same session_id="default" collided in the Map,
sharing a cli.js subprocess and conversation history — a cross-tenant context leak.

**Fix**: introduce _sessionKey(conversationId, keyName) → "${keyName}|${conversationId}".
Replace every sessions Map site (has / set / get / delete) with the namespaced key.
keyName comes from req._authKeyName (set by auth middleware). Anonymous callers
produce "anon|<id>"; admin produces "admin|<id>"; per-key callers produce
"<keyName>|<id>" — matching the convention used by cacheHash() for per-key cache
isolation (D1, v3.13.0).

**cli.js citation — not applicable**: This PR changes OCP-internal session lifecycle
bookkeeping (the sessions Map that OCP maintains to thread --resume flags across
requests). There is no corresponding cli.js operation to cite. ALIGNMENT.md Rule 2
(limiting OCP to operations cli.js performs) does not constrain in-process state
representation. Same pattern as #75.

**Scope of changes (server.mjs only)**:
- New helper: _sessionKey() — 3 lines after sessions Map declaration
- spawnClaudeProcess(): accepts keyName param; all 4 sessions Map calls → _sessionKey
- handleSessionFailure(): uses sessionKey (not raw conversationId) for sessions.delete
- callClaude(): accepts and forwards keyName to spawnClaudeProcess
- callClaudeStreaming(): forwards authInfo.keyName to spawnClaudeProcess
- Request handler: both callClaude() call sites pass req._authKeyName
- Cleanup interval + GET /health + GET /sessions: strip "keyName|" prefix before log/display

**Smoke test**:
- node --check server.mjs → SYNTAX OK
- npm test → 43/43 passed, 0 failed
- Hand-traced has/set/get/delete paths: cross-key collision absent ✓

Identified during privacy/security positioning brainstorm — `.claude/research/ocp-security-audit.md`

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CHANGELOG.md

@@ -1,31 +1,5 @@
 # Changelog
 
-## v3.14.0 — 2026-05-10
-
-### Features (security hardening)
-
-- **Per-key session isolation** (PR #86, S1) — the `sessions` Map in `server.mjs` is now keyed by `${keyName}|${conversationId}` instead of bare `conversationId`. Before this fix, two clients using distinct API keys but the same `session_id` value (e.g. both defaulting to `"default"`) would share the same `cli.js` subprocess and conversation history, creating a cross-tenant leak path. Post-fix each (key, session) pair is isolated end-to-end, extending the per-key cache isolation shipped in v3.13.0 D1 to the session layer.
-- **On-disk credential file modes 0700/0600** (PR #87, S2) — `setup.mjs` now creates `~/.ocp` at mode 0700 and both `admin-key` and `ocp.db` at mode 0600. An idempotent `reconcileFileModes()` call in `server.mjs` startup tightens any existing installation to these modes automatically on every launch, so existing prod boxes fix themselves without manual `chmod`. Before this fix, all three files were created at the process's default umask (typically world-readable 0644 / 0755), leaving plaintext credentials readable by other local users.
-- **`/api/usage` default scope = self; admin all-keys requires `?all=true`** (PR #88, S3) — the usage endpoint now applies a least-privilege default: anonymous callers receive only their own rows, non-admin authenticated callers receive only their own rows, and admin callers receive only their own rows unless they explicitly pass `?all=true`. When `?all=true` is used, an audit log line is emitted. Before this fix, any admin-token holder could silently enumerate usage data for every key on the server.
-
-### Behavior changes
-
-- **Breaking change for admin tooling**: `/api/usage` no longer returns all-keys data by default. Existing cron jobs, dashboards, or scripts that rely on the admin token seeing all-keys output must add `?all=true` to their request URL after upgrading to v3.14.0.
-- **File mode reconcile at server startup** logs a one-line notice per path when mode is tightened (e.g. `[security] tightened ~/.ocp/ocp.db → 0600`). No action is required from the operator; the reconcile is idempotent and silent when modes are already correct.
-- **`sessions` Map key is now `${keyName}|${conversationId}` internally.** No client-visible wire change — the `session_id` field in request/response is unchanged.
-
-### Verification
-
-- Stress-test pass: 11/11 phases including S1/S2/S3 security regression checks (Phase E, I, J). 35-minute sustained run, 60 calls, 0 errors, 0 timeouts. RSS dropped 51→47 MB across the window. Per-key cache isolation, singleflight, cache_control bypass, quota enforcement, file-mode reconcile, and scope guard against escalation all verified against running code.
-
-### Governance
-
-- All three PRs (#86, #87, #88) include the explicit `cli.js`-citation-not-applicable disclaimer (per PR #75 pattern) since they are OCP-internal access-control, session-state, and file-permission changes with no corresponding `cli.js` operation to cite.
-
-### No new env vars / no public API surface change beyond the documented breaking change
-
-This release adds no new env vars or endpoints. The only externally visible change is the `/api/usage` scope guard (breaking for admin all-keys consumers; see Behavior changes above).
-
 ## v3.13.0 — 2026-05-07
 
 ### Features (cache layer hardening)

README.md

@@ -392,8 +392,6 @@ ocp keys revoke son-ipad   # Revoke a key
 | `shared` | `CLAUDE_AUTH_MODE=shared` + `PROXY_API_KEY=xxx` | Everyone shares one key |
 | `multi` | `CLAUDE_AUTH_MODE=multi` + `OCP_ADMIN_KEY=xxx` | Per-person keys with usage tracking (recommended) |
 
-> **Usage scope (v3.14.0+):** `/api/usage` returns the caller's own rows by default. Admin callers must pass `?all=true` to retrieve data for all keys; doing so emits an audit log line.
-
 ### Anonymous Access (optional)
 
 In `multi` mode, the admin can designate a single well-known "anonymous" key that bypasses `validateKey()` and grants public read/write access. This is useful for letting LAN users (or clients like OpenClaw multi-agent setups) connect without individual per-user keys.
@@ -462,7 +460,6 @@ When a key exceeds its quota, OCP returns HTTP 429 with a structured error:
 - Keys are stored in `~/.ocp/ocp.db` (SQLite, zero external dependencies)
 - Admin key is required for key management API endpoints
 - The dashboard (`/dashboard`) and health check (`/health`) are always public
-- File modes for `~/.ocp` (0700), `admin-key` + `ocp.db` (0600) are auto-tightened at server startup as of v3.14.0
 
 ## Built-in Usage Monitoring
 
@@ -660,7 +657,7 @@ The canonical list lives in [`models.json`](./models.json) — the single source
 | `/api/keys` | GET/POST | List or create API keys (admin only) |
 | `/api/keys/:id` | DELETE | Revoke an API key (admin only) |
 | `/api/keys/:id/quota` | GET/PATCH | View or set per-key quota (admin only) |
-| `/api/usage` | GET | Per-key usage stats (`?since=&until=&hours=&limit=`); returns self only by default — pass `?all=true` (admin only) for all-keys data |
+| `/api/usage` | GET | Per-key usage stats (`?since=&until=&hours=&limit=`) |
 | `/cache/stats` | GET | Cache statistics (admin only) |
 | `/cache` | DELETE | Clear response cache (admin only) |
 

dashboard.html

@@ -55,13 +55,7 @@
 </div>
 
 <div class="section">
-  <div class="flex" style="justify-content: space-between; align-items: center;">
-    <h2 style="margin: 0;">Usage by Key</h2>
-    <label id="usage-scope-toggle" class="flex" style="display:none; gap: 0.4rem; font-size: 0.8rem; color: #94a3b8; cursor: pointer;">
-      <input type="checkbox" id="usage-show-all" style="cursor: pointer;">
-      <span>Show all keys</span>
-    </label>
-  </div>
+  <h2>Usage by Key</h2>
   <table id="key-usage-table">
     <thead><tr><th>Key</th><th>Requests</th><th>OK</th><th>Err</th><th>Avg Time</th><th>Last Request</th></tr></thead>
     <tbody></tbody>
@@ -176,8 +170,7 @@ async function refreshStatus() {
 
 async function refreshUsage() {
   try {
-    const showAll = localStorage.getItem("ocp_usage_show_all") === "1";
-    const data = await api(showAll ? "/api/usage?all=true" : "/api/usage");
+    const data = await api("/api/usage");
     const tbody = document.querySelector("#key-usage-table tbody");
     tbody.innerHTML = (data.byKey || []).map(k => `
       <tr>
@@ -211,8 +204,6 @@ async function refreshKeys() {
   try {
     const data = await api("/api/keys");
     document.getElementById("key-mgmt-section").style.display = "";
-    // Admin-only "Show all keys" toggle for /api/usage scope.
-    document.getElementById("usage-scope-toggle").style.display = "flex";
     const tbody = document.querySelector("#keys-table tbody");
     tbody.innerHTML = (data.keys || []).map(k => `
       <tr>
@@ -249,16 +240,6 @@ async function refreshAll() {
   document.getElementById("refresh-indicator").textContent = `Updated ${new Date().toLocaleTimeString()}`;
 }
 
-// Wire "Show all keys" toggle (visibility gated to admin via refreshKeys()).
-(function setupUsageScopeToggle() {
-  const cb = document.getElementById("usage-show-all");
-  cb.checked = localStorage.getItem("ocp_usage_show_all") === "1";
-  cb.addEventListener("change", () => {
-    localStorage.setItem("ocp_usage_show_all", cb.checked ? "1" : "0");
-    refreshUsage();
-  });
-})();
-
 refreshAll();
 setInterval(refreshAll, 30000);
 </script>

keys.mjs

@@ -3,13 +3,11 @@
 import { DatabaseSync } from "node:sqlite";
 import { randomBytes, createHash } from "node:crypto";
 import { join } from "node:path";
-import { mkdirSync, chmodSync } from "node:fs";
+import { mkdirSync } from "node:fs";
 import { homedir } from "node:os";
 
 const OCP_DIR = join(homedir(), ".ocp");
-mkdirSync(OCP_DIR, { recursive: true, mode: 0o700 });
-// Tighten the directory mode in case it already existed with broader permissions.
-try { chmodSync(OCP_DIR, 0o700); } catch { /* ignore EPERM on pre-existing dirs */ }
+mkdirSync(OCP_DIR, { recursive: true });
 const DB_PATH = join(OCP_DIR, "ocp.db");
 
 let db;
@@ -20,8 +18,6 @@ export function getDb() {
     db.exec("PRAGMA journal_mode = WAL");
     db.exec("PRAGMA foreign_keys = ON");
     initSchema();
-    // Tighten mode on the DB file (0600) after creation / first open.
-    try { chmodSync(DB_PATH, 0o600); } catch { /* ignore — same-user access still works */ }
   }
   return db;
 }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-claude-proxy",
-  "version": "3.14.0",
+  "version": "3.13.0",
   "description": "OCP (Open Claude Proxy) — use your Claude Pro/Max subscription as an OpenAI-compatible API for any IDE. Works with Cline, OpenCode, Aider, Continue.dev, OpenClaw, and more.",
   "type": "module",
   "bin": {

server.mjs

@@ -30,7 +30,7 @@
 import { createServer } from "node:http";
 import { spawn, execFileSync } from "node:child_process";
 import { randomUUID, timingSafeEqual } from "node:crypto";
-import { readFileSync, readdirSync, accessSync, existsSync, constants, chmodSync, statSync } from "node:fs";
+import { readFileSync, readdirSync, accessSync, existsSync, constants } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
 import { homedir } from "node:os";
@@ -167,44 +167,6 @@ function logEvent(level, event, data = {}) {
   }
 }
 
-// ── Startup file-mode reconciliation ───────────────────────────────────
-// Idempotently tightens OCP credential-bearing files to 700/600 so that
-// existing installs (created before this fix) are hardened on next restart.
-// Wrapped in try/catch — chmod failure must never crash startup.
-// Does NOT touch systemd units or launchd plists; those are managed by setup.mjs.
-function _tightenFileModesIfPossible() {
-  const ocpDir = join(homedir(), ".ocp");
-  const targets = [
-    { path: ocpDir,                      mode: 0o700, label: "~/.ocp (dir)" },
-    { path: join(ocpDir, "admin-key"),   mode: 0o600, label: "~/.ocp/admin-key" },
-    { path: join(ocpDir, "ocp.db"),      mode: 0o600, label: "~/.ocp/ocp.db" },
-  ];
-  let tightened = 0;
-  let alreadyOk = 0;
-  for (const { path, mode, label } of targets) {
-    try {
-      const st = statSync(path);
-      const current = st.mode & 0o777;
-      if (current !== mode) {
-        chmodSync(path, mode);
-        tightened++;
-      } else {
-        alreadyOk++;
-      }
-    } catch (e) {
-      if (e.code !== "ENOENT") {
-        // File exists but chmod failed (e.g. EPERM) — log and move on
-        logEvent("warn", "file_mode_tighten_failed", { path: label, error: e.message });
-      }
-      // ENOENT is fine — file doesn't exist yet
-    }
-  }
-  if (tightened > 0) {
-    logEvent("info", "file_modes_tightened", { tightened, alreadyOk });
-  }
-}
-_tightenFileModesIfPossible();
-
 // ── Circuit breaker (DISABLED) ──────────────────────────────────────────
 // Disabled: CLI proxy has its own retry logic, and the breaker was causing
 // cascading failures — once API got briefly slow, ALL agents lost connectivity
@@ -1672,45 +1634,14 @@ const server = createServer(async (req, res) => {
   }
 
   if (req.url?.startsWith("/api/usage") && req.method === "GET") {
-    // Least-privilege scope rules (security audit follow-up):
-    //   - non-admin authenticated key  → only own rows
-    //   - anonymous (PROXY_ANONYMOUS_KEY) → only "anonymous" rows; ?all=true ignored
-    //   - admin without ?all=true       → only own ("admin") rows
-    //   - admin with    ?all=true       → full byKey/recent (legacy behavior); audited
-    // Authenticated callers are required (anyone reaching here passed the auth gate above);
-    // remote+no-auth requests would have been rejected before this point.
+    if (!isAdmin) return jsonResponse(res, 403, { error: "Admin access required" });
     const url = new URL(req.url, `http://${BIND_ADDRESS}:${PORT}`);
     const since = url.searchParams.get("since");
     const until = url.searchParams.get("until");
-    const wantAll = url.searchParams.get("all") === "true";
-    const callerName = req._authKeyName;
-
-    // Anonymous callers may never opt into all-keys view, even if they pass ?all=true.
-    const isAnonCaller = callerName === "anonymous";
-    const fullScope = isAdmin && wantAll && !isAnonCaller;
-
-    // scopeName === null when fullScope is true (no filter); otherwise the key_name to filter by.
-    const scopeName = fullScope ? null : callerName;
-
-    if (fullScope) {
-      logEvent("info", "admin_usage_full_scope", { caller: callerName, ip: req.socket.remoteAddress || null });
-    }
-
-    const byKeyAll = getUsageByKey({ since, until });
-    const recentAll = getRecentUsage(Math.min(parseInt(url.searchParams.get("limit") || "50", 10), 500));
-    const timeline = getUsageTimeline({
-      keyName: scopeName || undefined,
-      hours: Math.min(parseInt(url.searchParams.get("hours") || "24", 10), 720),
-    });
-
-    const byKey = scopeName ? byKeyAll.filter((row) => row.key_name === scopeName) : byKeyAll;
-    const recent = scopeName ? recentAll.filter((row) => row.key_name === scopeName) : recentAll;
-
     return jsonResponse(res, 200, {
-      byKey,
-      timeline,
-      recent,
-      scope: { self: scopeName, all: fullScope },
+      byKey: getUsageByKey({ since, until }),
+      timeline: getUsageTimeline({ hours: Math.min(parseInt(url.searchParams.get("hours") || "24", 10), 720) }),
+      recent: getRecentUsage(Math.min(parseInt(url.searchParams.get("limit") || "50", 10), 500)),
     });
   }
 

setup.mjs

@@ -12,7 +12,7 @@
  *   4. Creates start.sh for easy launch
  *   5. Optionally starts the proxy
  */
-import { readFileSync, writeFileSync, existsSync, mkdirSync, unlinkSync, readdirSync, chmodSync } from "node:fs";
+import { readFileSync, writeFileSync, existsSync, mkdirSync, unlinkSync, readdirSync } from "node:fs";
 import { execSync } from "node:child_process";
 import { join, dirname } from "node:path";
 import { homedir } from "node:os";
@@ -425,8 +425,7 @@ if (!DRY_RUN) {
 `;
 
     writeFileSync(plistPath, plistXml);
-    chmodSync(plistPath, 0o600);
-    log(`Plist written: ${plistPath} (mode 600)`);
+    log(`Plist written: ${plistPath}`);
 
     // Bootout first (in case it was already loaded) then bootstrap
     try { execSync(`launchctl bootout gui/$(id -u) "${plistPath}" 2>/dev/null`); } catch { /* ignore */ }
@@ -460,8 +459,7 @@ WantedBy=default.target
 `;
 
     writeFileSync(servicePath, serviceUnit);
-    chmodSync(servicePath, 0o600);
-    log(`Service file written: ${servicePath} (mode 600)`);
+    log(`Service file written: ${servicePath}`);
 
     execSync(`systemctl --user daemon-reload`);
     execSync(`systemctl --user enable ocp-proxy`);