@wirecat/cli-base 0.56.0 → 0.57.0

package/CHANGELOG.md

@@ -8,6 +8,18 @@ Versions before 0.8.0 are in the [git tags](https://github.com/WireCatLabs/cli-b
 Every entry says what changed as a caller sees it, why, and what to watch for — the rules are
 [`docs/dev/CONVENTIONS.md`](docs/dev/CONVENTIONS.md#the-changelog).
 
+## 0.57.0 — 25.10.2026
+
+### Changed — may break callers
+
+- **`saveConfigFile` writes `config.json` as `0600`, owner-only, instead of `0644`.** A config names the owner's
+  accounts, profiles and paths, and cli-core already created the first one as `0600` — so the first `config set`
+  turned a private file into one every user on the computer could read. A save now replaces the file with an
+  owner-only one, whatever mode it had. A folder that already exists keeps its mode; a CLI's `doctor` reports one
+  others can enter. Watch for: anything that reads the config as a different user — a system-wide service, a
+  container running under another uid, a second account sharing the file — can no longer read it after the next
+  save. Run it as the owner, or give it its own config. Windows is unchanged: Node sets only the read-only bit there.
+
 ## 0.56.0 — 25.10.2026
 
 ### Added

package/dist/config.d.ts

@@ -14,5 +14,8 @@ export declare const writeSecurely: (path: string, contents: string | Uint8Array
  * The schema belongs to the host: what a profile holds is the one thing no shared package can know.
  */
 export declare const loadConfigFile: <TSchema extends v.GenericSchema>(path: string, schema: TSchema, fallback: () => v.InferOutput<TSchema>) => v.InferOutput<TSchema>;
-/** Config is not a secret, so it is `0644`; the credential file next to it is not. */
+/**
+ * Owner-only, `0600`: a config names the owner's accounts and paths, and a save replaces a file any
+ * other user could read. A folder that already exists keeps its mode; `doctor` reports an open one.
+ */
 export declare const saveConfigFile: (path: string, config: unknown) => void;

package/dist/config.js

@@ -55,7 +55,10 @@ export const loadConfigFile = (path, schema, fallback) => {
     }
     return result.output;
 };
-/** Config is not a secret, so it is `0644`; the credential file next to it is not. */
+/**
+ * Owner-only, `0600`: a config names the owner's accounts and paths, and a save replaces a file any
+ * other user could read. A folder that already exists keeps its mode; `doctor` reports an open one.
+ */
 export const saveConfigFile = (path, config) => {
-    writeSecurely(path, `${JSON.stringify(config, null, 2)}\n`, 0o644);
+    writeSecurely(path, `${JSON.stringify(config, null, 2)}\n`, 0o600);
 };

package/docs/standards/security.md

@@ -123,10 +123,11 @@ the message store. The owner adds `--allow-any-file` to send one anyway.
 
 ### WC-SECR-10 · Private files are written atomically with private modes
 
-A file that holds a secret or private state is written with `writeSecurely`: atomically, mode `0600`, in a directory
+A file that holds a secret or private state, `config.json` included, is written with `writeSecurely`: atomically, mode `0600`, in a directory
 created with mode `0700`. `writeSecurely` takes text or bytes. A
 temporary credential file is `0600` and removed in `finally`.
-tg's `doctor` reports a wrong mode and prints the `chmod` fix without applying it.
+The shared messenger `doctor` reports a wrong mode, the config file and its folder included, and prints the `chmod`
+fix without applying it.
 
 - **Why:** another user on the same computer must not read the session.
 - **Enforced by:** `src/config.test.ts`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-base",
-  "version": "0.56.0",
+  "version": "0.57.0",
   "description": "The parts every command line tool needs: output modes, terminal rendering, error model, exit codes, credentials, clocks",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",