Summary

Two resource management issues that could impact reliability:

1. Exec-Approvals Non-Atomic Write (dist/exec-approvals-BF_Qfdq8.js:651)

The exec-approvals file (controls command execution permissions, contains socket auth tokens) is written with bare writeFileSync without atomic temp+rename:

fs.writeFileSync(filePath, `${JSON.stringify(file, null, 2)}\n`, { mode: 384 });

A crash mid-write produces a corrupt file, potentially disabling security controls.

2. Unbounded Transcript Read (dist/gateway-cli-Dsd9gHBa.js:12283, 31883)

Entire transcript files are read into memory synchronously:

const lines = fs.readFileSync(transcriptPath, "utf-8").split(/\r?\n/);

Transcripts grow unboundedly over long sessions. Used for idempotency checks (line 12283) and compaction (line 31883).

Impact

1. Corrupted exec-approvals → security controls disabled or permissive defaults
2. Large transcripts → significant memory pressure or OOM, denial of service

Suggested Fix

1. Exec-approvals: Atomic write (temp file + rename())
2. Transcripts: Use streaming reads (readline) instead of readFileSync. Add size limit check.