chore: Don't implicitly override shell rc perms

Author: kiran-4444

README.md

@@ -39,13 +39,13 @@ npx portkey mcp add
 
 Config goes mainly into your shell profile and/or `.claude/` (the wizard explains each choice). Open a **new terminal** (or `source` your profile) after setup, then run `claude` as usual.
 
-> **Shared / committed config (`PORTKEY_API_KEY`).** When you choose a git-tracked destination — `mcp add` → **Repo file (.mcp.json)** or `setup` → **Project (shared)** (`.claude/settings.json`) — the CLI **never** writes your key into the committed file. It writes the reference `"${PORTKEY_API_KEY}"` (Claude Code expands it from the environment at read time) and stores the real key in your shell profile (owner-only, `0600`). Each teammate just exports their own `PORTKEY_API_KEY`:
+> **Shared / committed config (`PORTKEY_API_KEY`).** When you choose a git-tracked destination — `mcp add` → **Repo file (.mcp.json)** or `setup` → **Project (shared)** (`.claude/settings.json`) — the CLI **never** writes your key into the committed file. It writes the reference `"${PORTKEY_API_KEY}"` (Claude Code expands it from the environment at read time) and stores the real key in your shell profile. Each teammate just exports their own `PORTKEY_API_KEY`:
 >
 > ```bash
 > export PORTKEY_API_KEY="pk-..."   # add to ~/.zshrc, ~/.bashrc, or CI secrets
 > ```
 >
-> All files the CLI writes that hold a secret (shell profile, `~/.claude/settings.json`, `~/.codex/config.toml`) are created with `0600` permissions.
+> Config files the CLI creates itself (`~/.claude/settings.json`, `.mcp.json`) are written with owner-only `0600` permissions. Your **shell profile** (`~/.zshrc`, `~/.bashrc`, …) is left untouched — the CLI never changes its permissions — but it **warns** if that file is readable by other users while holding a secret, so you can `chmod 600` it yourself on shared machines.
 
 **Later, from your project folder:**
 

src/commands/claude-code/mcp.js

@@ -16,6 +16,7 @@ import {
   findProjectRoot,
   detectShellRc,
   writeShellRc,
+  warnIfFileGroupOrWorldReadable,
   getMcpFilePath,
   settingsSetMcp,
   settingsRemoveMcp,
@@ -338,6 +339,7 @@ export async function doMcpAdd(args) {
       `.mcp.json references ${c.bold}${PORTKEY_KEY_ENV_REF}${c.reset} (no secret committed). ` +
         `Your key was saved to ${c.bold}${shellRc}${c.reset} — run ${c.bold}source ${shellRc}${c.reset} or open a new terminal.`
     );
+    warnIfFileGroupOrWorldReadable(shellRc, `your ${PORTKEY_KEY_ENV}`);
   } else if (committed) {
     info(
       `.mcp.json references ${c.bold}${PORTKEY_KEY_ENV_REF}${c.reset} — no secret committed. ` +

src/commands/claude-code/setup.js

@@ -25,6 +25,7 @@ import {
   settingsSetKey,
   settingsSetMcp,
   writeShellRc,
+  warnIfFileGroupOrWorldReadable,
   normalizeProvider,
   isClaudeInstalled,
   readExistingConfig,
@@ -843,6 +844,7 @@ export async function doSetup(args) {
       "# ── End Portkey + Codex ──",
     ].join("\n"));
     ok(`PORTKEY_API_KEY written to ${shellRc}`);
+    warnIfFileGroupOrWorldReadable(shellRc, "your PORTKEY_API_KEY");
 
     const reloadCmd = isPwsh ? `. ${shellRc}` : `source ${shellRc}`;
     console.log();
@@ -884,6 +886,7 @@ export async function doSetup(args) {
 
       writeShellRc(targetFile, lines.join("\n"));
       ok(`Gateway config written to ${targetFile}`);
+      warnIfFileGroupOrWorldReadable(targetFile, "your ANTHROPIC_AUTH_TOKEN");
 
     } else {
       // Write to settings.json. "project-shared" is committed to git, so reference
@@ -931,6 +934,7 @@ export async function doSetup(args) {
       } else {
         ok(`Auth token also written to ${shellRc}`);
       }
+      warnIfFileGroupOrWorldReadable(shellRc, `your ${shellVar}`);
     }
 
     // Reload reminder (once, at the end)

src/utils.js

@@ -59,16 +59,37 @@ export function mask(key) {
 // ── Secure write ─────────────────────────────────────────────────────────────
 
 /**
- * Write a file that may contain a secret (API key / auth token) with owner-only
- * permissions (0600). `fs.writeFileSync`'s `mode` only applies when the file is
- * created, so we also `chmod` to tighten any pre-existing file on the default
- * umask (which would otherwise leave it world-readable at 0644).
+ * Write a file the CLI itself authors and that may contain a secret (API key /
+ * auth token) with owner-only permissions (0600). `fs.writeFileSync`'s `mode`
+ * only applies when the file is created, so we also `chmod` to tighten any
+ * pre-existing file on the default umask (which would otherwise leave it
+ * world-readable at 0644).
+ *
+ * Use this only for files we own (e.g. `.mcp.json`, `.claude/settings.json`).
+ * Do NOT use it for user-managed files like shell rc — their permissions are the
+ * user's choice; warn with `warnIfFileGroupOrWorldReadable` instead.
  */
 export function writeFileSecure(filePath, data) {
   fs.writeFileSync(filePath, data, { mode: 0o600 });
   try { fs.chmodSync(filePath, 0o600); } catch {}
 }
 
+/**
+ * Warn (without modifying anything) when a file we just wrote a secret into is
+ * readable by group or other. Intended for user-managed files such as shell rc,
+ * where we deliberately never change permissions implicitly.
+ */
+export function warnIfFileGroupOrWorldReadable(filePath, secretLabel = "a credential") {
+  let mode;
+  try { mode = fs.statSync(filePath).mode & 0o777; } catch { return; }
+  if (mode & 0o077) {
+    warn(
+      `${filePath} is readable by other users (permissions ${mode.toString(8)}) and now contains ${secretLabel}. ` +
+        `On a shared machine, restrict it with: ${c.bold}chmod 600 ${filePath}${c.reset}`
+    );
+  }
+}
+
 // ── JSON helpers ─────────────────────────────────────────────────────────────
 
 export function jsonRead(filePath, keyPath) {
@@ -330,8 +351,10 @@ export function writeShellRc(filePath, block) {
     ""
   );
   content += "\n" + block + "\n";
-  // Shell rc may carry an exported API key — keep it owner-only.
-  writeFileSecure(filePath, content);
+  // Preserve the user's existing permissions — never implicitly chmod a
+  // user-managed shell rc. Callers warn via warnIfFileGroupOrWorldReadable
+  // when the block contains a secret.
+  fs.writeFileSync(filePath, content);
 }
 
 export function removeShellRcBlock(filePath) {

tests/utils.test.js

@@ -1,4 +1,4 @@
-import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
 import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
@@ -16,6 +16,7 @@ import {
   writeShellRc,
   removeShellRcBlock,
   writeFileSecure,
+  warnIfFileGroupOrWorldReadable,
 } from "../src/utils.js";
 
 function mode(file) {
@@ -166,19 +167,51 @@ describe("writeFileSecure", () => {
     expect(mode(file)).toBe("600");
   });
 
-  it("is used by settings/mcp/shellrc writers so secrets are never world-readable", () => {
+  it("is used by CLI-authored settings/mcp writers so secrets are never world-readable", () => {
     const settings = path.join(dir, "settings.json");
     settingsSetEnv(settings, { ANTHROPIC_AUTH_TOKEN: "pk-secret" });
     expect(mode(settings)).toBe("600");
 
     const mcp = path.join(dir, ".mcp.json");
     settingsSetMcp(mcp, { srv: { type: "http", url: "u" } }, { scope: "project" });
     expect(mode(mcp)).toBe("600");
+  });
+});
+
+// ── writeShellRc preserves user-managed permissions ───────────────────────────
+
+describe("writeShellRc permission handling", () => {
+  let dir;
+  beforeEach(() => { dir = tmpDir(); });
+  afterEach(() => { fs.rmSync(dir, { recursive: true, force: true }); });
 
+  it("never changes the permissions of a pre-existing shell rc", () => {
     const rc = path.join(dir, ".bashrc");
     fs.writeFileSync(rc, "# rc", { mode: 0o644 });
     writeShellRc(rc, "export ANTHROPIC_AUTH_TOKEN=pk-secret");
-    expect(mode(rc)).toBe("600");
+    expect(mode(rc)).toBe("644");
+    expect(fs.readFileSync(rc, "utf8")).toContain("pk-secret");
+  });
+
+  it("warns (without chmod) when a world/group-readable file holds a secret", () => {
+    const rc = path.join(dir, ".bashrc");
+    fs.writeFileSync(rc, "# rc", { mode: 0o644 });
+    const calls = [];
+    const spy = vi.spyOn(console, "log").mockImplementation((m) => calls.push(m));
+    warnIfFileGroupOrWorldReadable(rc, "your PORTKEY_API_KEY");
+    spy.mockRestore();
+    expect(mode(rc)).toBe("644");
+    expect(calls.join("\n")).toMatch(/readable by other users/);
+  });
+
+  it("stays silent for an owner-only (0600) file", () => {
+    const rc = path.join(dir, ".bashrc");
+    fs.writeFileSync(rc, "# rc", { mode: 0o600 });
+    const calls = [];
+    const spy = vi.spyOn(console, "log").mockImplementation((m) => calls.push(m));
+    warnIfFileGroupOrWorldReadable(rc, "your PORTKEY_API_KEY");
+    spy.mockRestore();
+    expect(calls).toHaveLength(0);
   });
 });