Hongming Wang fc2720c1fe fix(git-token-helper): close TOCTOU window + stop swallowing chmod errors (closes #1552) ... The token-cache helper had three #1552 findings, all in the mode-600-after-the-fact pattern: 1. _write_cache writes .tmp with default umask (typically 022 → 644 on disk) and then chmod 600's after the mv. A concurrent reader in that microsecond-wide window sees the token at mode 644. 2. Each chmod was swallowed via `|| true` — if it ever fails, the tokens stay world-readable with no operator signal. 3. _refresh_gh's gh_token_file write has the same shape and same two issues. Hardening: - Wrap the .tmp creates in a `umask 077` block so the files are 600 from creation. Restore the previous umask before return so callers aren't perturbed. - Replace `chmod ... 2>/dev/null || true` with `if ! chmod ...; then echo WARN ...; fi`. A chmod failure is a real signal worth grep'ing. - Apply the same pattern to the _refresh_gh gh_token_file path. `local` is illegal in a top-level case branch, so use a uniquely- named global (_gh_prev_umask) and unset it after. Verified `bash -n` clean and `shellcheck` clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>		2026-04-26 08:22:29 -07:00
..
gh-wrapper.sh	ci(gh-wrapper): translate --assignee @me → --label team:<role>	2026-04-24 00:34:21 -07:00
molecule-gh-token-refresh.sh	fix(workspace): credential helper security hardening (#1797)	2026-04-23 18:14:55 +00:00
molecule-git-token-helper.sh	fix(git-token-helper): close TOCTOU window + stop swallowing chmod errors (closes #1552)	2026-04-26 08:22:29 -07:00