fix: use stable ~/.specify/auth.json in rate-limit message, skip POSIX permission check on Windows

Agent-Logs-Url: https://github.com/github/spec-kit/sessions/4636bcdb-87ae-45d6-9545-a40e4effd617

Co-authored-by: mnriem <15701806+mnriem@users.noreply.github.com>

Author: Copilot

src/specify_cli/__init__.py

@@ -1721,7 +1721,6 @@ def _fetch_latest_release_tag() -> tuple[str | None, str | None]:
     On anything else — including a malformed response body — the exception
     propagates; there is no catch-all (research D-006).
     """
-    from .authentication.config import _default_config_path as _auth_config_path
     from .authentication.http import open_url
 
     try:
@@ -1739,7 +1738,7 @@ def _fetch_latest_release_tag() -> tuple[str | None, str | None]:
         # Order matters: HTTPError is a subclass of URLError.
         if e.code == 403:
             return None, (
-                f"rate limited (configure {_auth_config_path()} with a GitHub token)"
+                "rate limited (configure ~/.specify/auth.json with a GitHub token)"
             )
         return None, f"HTTP {e.code}"
     except (urllib.error.URLError, OSError):

src/specify_cli/authentication/config.py

@@ -8,6 +8,7 @@
 from __future__ import annotations
 
 import json
+import os
 import stat
 from dataclasses import dataclass
 from fnmatch import fnmatch
@@ -53,21 +54,22 @@ def load_auth_config(
     if not config_path.is_file():
         return []
 
-    # Warn (but don't fail) if the file is world-readable.
-    try:
-        mode = config_path.stat().st_mode
-        if mode & (stat.S_IRGRP | stat.S_IROTH):
-            import warnings
-
-            warnings.warn(
-                f"{config_path} is readable by group/others. "
-                "Consider restricting with: chmod 600 "
-                f"{config_path}",
-                UserWarning,
-                stacklevel=2,
-            )
-    except OSError:
-        pass  # stat failed — skip permission check
+    # Warn (but don't fail) if the file is world-readable (POSIX only).
+    if os.name != "nt":
+        try:
+            mode = config_path.stat().st_mode
+            if mode & (stat.S_IRGRP | stat.S_IROTH):
+                import warnings
+
+                warnings.warn(
+                    f"{config_path} is readable by group/others. "
+                    "Consider restricting with: chmod 600 "
+                    f"{config_path}",
+                    UserWarning,
+                    stacklevel=2,
+                )
+        except OSError:
+            pass  # stat failed — skip permission check
 
     raw = json.loads(config_path.read_text(encoding="utf-8"))
 

tests/test_upgrade.py

@@ -23,8 +23,6 @@
     _normalize_tag,
     app,
 )
-from specify_cli.authentication.config import _default_config_path
-
 from tests.conftest import strip_ansi
 
 runner = CliRunner()
@@ -33,7 +31,7 @@
 SENTINEL_GITHUB_TOKEN = "SENTINEL-GITHUB-TOKEN-VALUE"
 
 _RATE_LIMITED_REASON = (
-    f"rate limited (configure {_default_config_path()} with a GitHub token)"
+    "rate limited (configure ~/.specify/auth.json with a GitHub token)"
 )
 
 
@@ -279,7 +277,7 @@ def test_failure_prints_installed_plus_one_line_reason(
         assert "Installed: 0.7.4" in output
         if expected_reason == _RATE_LIMITED_REASON:
             assert "Could not check latest release: rate limited" in output
-            assert str(_default_config_path()) in output
+            assert "~/.specify/auth.json" in output
         else:
             assert f"Could not check latest release: {expected_reason}" in output