zenmux-usage-cli/internal/config/perm_unix.go

//go:build !windows

package config

import (
	"fmt"
	"io"
	"os"
)

// WarnIfLooseMode prints a one-line warning to w if path has any of the
// group- or world-readable bits set (0044). POSIX only; no-op on Windows.
// A missing file or stat error is silently ignored — callers have already
// succeeded or failed on the file itself by this point.
func WarnIfLooseMode(path string, w io.Writer) {
	if w == nil || path == "" {
		return
	}
	info, err := os.Stat(path)
	if err != nil {
		return
	}
	mode := info.Mode().Perm()
	if mode&0o044 != 0 {
		fmt.Fprintf(w,
			"zenmux-usage: warning: config file %s has mode %04o; run `chmod 600 %s` to protect your API keys\n",
			path, mode, path)
	}
}