fix: set IPC socket permissions to 0600 for security

Cargo.toml

@@ -67,6 +67,7 @@ fuzzy-matcher = "0.3.7"
 
 [target.'cfg(unix)'.dependencies]
 exec = "0.3"
+libc = "0.2"
 
 [dev-dependencies]
 tempfile = "3"

src/ipc/server.rs

@@ -20,7 +20,20 @@ impl IpcServer {
         let opts = ListenerOptions::new().name(fs_name("main")?);
         debug!("Listening on {}", env::IPC_SOCK_MAIN.display());
         let (tx, rx) = tokio::sync::mpsc::channel(1);
+
+        // Set restrictive umask before creating socket to avoid TOCTOU race condition.
+        // This ensures the socket is created with 0600 permissions from the start.
+        #[cfg(unix)]
+        let old_umask = unsafe { libc::umask(0o077) };
+
         let listener = opts.create_tokio().into_diagnostic()?;
+
+        // Restore original umask
+        #[cfg(unix)]
+        unsafe {
+            libc::umask(old_umask);
+        }
+
         tokio::spawn(async move {
             loop {
                 if let Err(err) = Self::listen(&listener, tx.clone()).await {