fix: restrict config.toml permissions to 0600 on save

[Frankie-Xu]

Problem

he config writes API keys into ~/.he/config.toml with whatever mode the process umask produces. On typical Unix setups that is 0644, so group and other users can read the file.

Fix

On POSIX, after a successful save, chmod the config file to 0600 (owner read/write only). Loading a file that is still group- or world-readable only logs a warning and still succeeds, so existing configs are not bricked; the next save tightens the mode. Windows chmod failures are swallowed and do not raise. This is file-mode restriction only — not Keychain, and not encryption. Keys remain plaintext on disk.

Tests

tests/cli/test_config.py uses tmp_path. Dummy keys are sk-test / sk-x only. POSIX asserts mode 0600 after save and a warning (without the key plaintext) on load of a 0644 file. Windows skips mode assertions but must not throw.

Compatibility

Config is still plaintext on disk. Environment variables still override stored keys. Rebased onto current main, which includes #83.

Made with Cursor

[yifanfeng97]

Merged — good security hygiene, and the migration path is thoughtful: warn (without leaking the key) on load, tighten to 0600 on the next save, Windows best-effort. Thanks!