feat(auth): chmod parent dir 0700 on every save (not just on create)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: akoso

src/auth/credentials-store.test.ts

@@ -39,6 +39,12 @@ describe('credentials store', () => {
         expect(stats.mode & 0o777).toBe(0o600)
     })
 
+    test('saveCredentials chmods parent dir 0700', async () => {
+        await saveCredentials(sampleCreds)
+        const dirStats = await stat(join(tmpHome, 'mna'))
+        expect(dirStats.mode & 0o777).toBe(0o700)
+    })
+
     test('saveCredentials then loadCredentials roundtrips', async () => {
         await saveCredentials(sampleCreds)
         const loaded = await loadCredentials()

src/auth/credentials-store.ts

@@ -32,6 +32,7 @@ export async function loadCredentials(): Promise<Credentials | null> {
 export async function saveCredentials(creds: Credentials): Promise<void> {
     const path = credentialsPath()
     await mkdir(dirname(path), { recursive: true, mode: 0o700 })
+    await chmod(dirname(path), 0o700)
     await writeFile(path, `${JSON.stringify(creds, null, 2)}\n`, { mode: 0o600 })
     await chmod(path, 0o600)
 }