fix: keep private settings files private when saving and backing up

- Saving ccstatusline's settings writes a temp file and renames it over
  settings.json, so the file took the temp file's default permissions:
  one the user had made 0600 came back 0644. The temp file is now created
  with the permissions of the file it replaces.
- The .bak and .orig backups of Claude Code's settings.json were created
  0644 whatever settings.json's permissions were, and that file can hold
  secrets (env, apiKeyHelper). Backups now get settings.json's
  permissions. An existing backup is removed first, since overwriting a
  file keeps its old permissions.

Author: eric-engberg

src/utils/__tests__/claude-settings.test.ts

@@ -489,6 +489,23 @@ describe('backup and error handling behavior', () => {
         expect(orig.statusLine?.command).toBe('old-command');
     });
 
+    // settings.json can hold secrets (env, apiKeyHelper), so its backups must
+    // not be readable by anyone who can't read it
+    it.skipIf(process.platform === 'win32')('gives .bak and .orig backups the permissions of a private settings file', async () => {
+        writeRawClaudeSettings(JSON.stringify({ effortLevel: 'high' }));
+        const settingsPath = getClaudeSettingsPath();
+        fs.chmodSync(settingsPath, 0o600);
+        // A backup left from before keeps its own permissions when overwritten
+        fs.writeFileSync(`${settingsPath}.bak`, '{}', 'utf-8');
+        fs.chmodSync(`${settingsPath}.bak`, 0o644);
+
+        await installStatusLine({ commandMode: 'auto-npx' });
+
+        expect(fs.statSync(settingsPath).mode & 0o777).toBe(0o600);
+        expect(fs.statSync(`${settingsPath}.orig`).mode & 0o777).toBe(0o600);
+        expect(fs.statSync(`${settingsPath}.bak`).mode & 0o777).toBe(0o600);
+    });
+
     it('loadClaudeSettings should return empty object when settings file is missing', async () => {
         await expect(loadClaudeSettings()).resolves.toEqual({});
     });

src/utils/__tests__/config.test.ts

@@ -423,6 +423,19 @@ describe('config utilities', () => {
         expect(leftovers).toEqual([]);
     });
 
+    // Custom commands can carry credentials, so a save must not open up a
+    // settings file the user made private
+    it.skipIf(process.platform === 'win32')('keeps a private settings file private when saving', async () => {
+        const { settingsPath, configDir } = getSettingsPaths();
+        fs.mkdirSync(configDir, { recursive: true });
+        fs.writeFileSync(settingsPath, JSON.stringify({ version: CURRENT_VERSION, lines: [[], [], []] }), 'utf-8');
+        fs.chmodSync(settingsPath, 0o600);
+
+        await saveSettings({ ...DEFAULT_SETTINGS });
+
+        expect(fs.statSync(settingsPath).mode & 0o777).toBe(0o600);
+    });
+
     it('saves through a symlinked settings file without replacing the link', async () => {
         const { settingsPath, configDir } = getSettingsPaths();
         const targetDir = path.join(MOCK_HOME_DIR, 'dotfiles', 'ccstatusline');

src/utils/claude-settings.ts

@@ -25,6 +25,8 @@ export type { ClaudeSettings };
 const readFile = fs.promises.readFile;
 const writeFile = fs.promises.writeFile;
 const mkdir = fs.promises.mkdir;
+const stat = fs.promises.stat;
+const unlink = fs.promises.unlink;
 
 export const CCSTATUSLINE_COMMANDS = {
     AUTO_NPX: 'npx -y ccstatusline@latest',
@@ -140,6 +142,16 @@ export function getClaudeSettingsPath(): string {
     return path.join(getClaudeConfigDir(), 'settings.json');
 }
 
+async function removeIfExists(filePath: string): Promise<void> {
+    try {
+        await unlink(filePath);
+    } catch (error) {
+        if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
+            throw error;
+        }
+    }
+}
+
 /**
  * Creates a backup of the current Claude settings file.
  */
@@ -149,7 +161,12 @@ async function backupClaudeSettings(suffix = '.bak'): Promise<string | null> {
     try {
         if (fs.existsSync(settingsPath)) {
             const content = await readFile(settingsPath, 'utf-8');
-            await writeFile(backupPath, content, 'utf-8');
+            // The backup holds the same secrets (env, apiKeyHelper) as the
+            // settings, so it gets their permissions. It's recreated because
+            // an existing file keeps its own permissions when overwritten.
+            const mode = (await stat(settingsPath)).mode & 0o777;
+            await removeIfExists(backupPath);
+            await writeFile(backupPath, content, { encoding: 'utf-8', mode });
             return backupPath;
         }
     } catch (error) {

src/utils/config.ts

@@ -26,6 +26,7 @@ const unlink = fs.promises.unlink;
 const lstat = fs.promises.lstat;
 const readlink = fs.promises.readlink;
 const realpath = fs.promises.realpath;
+const stat = fs.promises.stat;
 
 const DEFAULT_SETTINGS_PATH = path.join(os.homedir(), '.config', 'ccstatusline', 'settings.json');
 
@@ -111,6 +112,16 @@ async function resolveAtomicWriteTarget(paths: SettingsPaths): Promise<AtomicWri
     }
 }
 
+// The permissions of the file a save replaces, so a private settings file
+// stays private; a new file gets the usual default
+async function getReplacedFileMode(filePath: string): Promise<number> {
+    try {
+        return (await stat(filePath)).mode & 0o777;
+    } catch {
+        return 0o666;
+    }
+}
+
 async function writeSettingsJson(settings: unknown, paths: SettingsPaths): Promise<void> {
     await mkdir(paths.configDir, { recursive: true });
 
@@ -123,8 +134,9 @@ async function writeSettingsJson(settings: unknown, paths: SettingsPaths): Promi
         writeTarget.tempDir,
         `${path.basename(writeTarget.targetPath)}.${process.pid}.${Date.now()}.tmp`
     );
+    const mode = await getReplacedFileMode(writeTarget.targetPath);
     try {
-        await writeFile(tempPath, JSON.stringify(settings, null, 2), 'utf-8');
+        await writeFile(tempPath, JSON.stringify(settings, null, 2), { encoding: 'utf-8', mode });
         await rename(tempPath, writeTarget.targetPath);
     } catch (error) {
         try {