v1.13.38 (2026-07-15)
-
Fix: Fixed a crash on macOS where
permissionFile.getData()could return a raw boolean (written by the mac native location helper without string coercion) instead of the expected string, causing an uncaught.localeCompare is not a functionTypeError.permissionfile.jsnow normalizes on read and write so already-corrupted SQLite data self-heals;listeners.jscomparisons and the mac branch's error handling are also hardened as defense in depth. (SoraKenji) -
Fix: Fixed two startup crashes on Windows:
countLinesLoggerRestartsnow wraps its file read in a try-catch to prevent an uncaught EPERM whenprey_restarts.logis locked or has missing permissions; thestorage_fns.setcheck-then-insert pattern is replaced with a singleINSERT OR REPLACEto eliminate the TOCTOU race that produced "Already registered" errors forpreyconfandshouldPreyCFileduring concurrent agent initialization. (SoraKenji) -
Fix: Fixed a TypeError crash when
daemon.set_watcheris invoked through the CLIrunhelper:runalways calls commands ascommand(values, cb), butset_watcheronly accepts(cb), so the parsed CLIvaluesobject landed in the callback slot. Because the object is truthy, the!cbguard was bypassed and the object propagated through the full call chain, crashing as "done/cb is not a function" at the upgrade and fresh-install paths inprey_owl.js. The CLI registration now wraps the call to forward only the real callback. Callback guards inprey_owl.jsare also standardised fromcb && cb(...)totypeof cb === 'function' && cb(...)for consistency. (SoraKenji) -
Fix: Fixed a double-callback crash in the macOS geo location socket layer:
tryToSendNewcould firecbAttachedon already-completed messages, causing a second callback invocation after the socket response was processed. The optionaltimeparameter is now forwarded throughwriteMessagetoaddAndWaitso callers can override the default 7 s timeout (the darwin provider passes 65 s). A null guard oninFlightCallbacksincallSocketis added as defense in depth. (SoraKenji)