BYOK API key stored in plaintext in world-readable (0644) config.yaml

[superbigcup325]

mcode 0.4.12, npm install, Linux, Node v26.8.2

BYOK API keys are stored in plaintext in ~/.minimax/config.yaml with mode
0644 (world-readable), despite provider add --api-key-env suggesting the key
stays referenced by environment variable name:

$ stat -c '%a %n' ~/.minimax/config.yaml
644 /home/cyanthus/.minimax/config.yaml

$ grep -A2 'custom_provider:' ~/.minimax/config.yaml
custom_provider:
  atria:
    ...
    options:
      apiKey: atr_...   # plaintext value, not "ATRIA_API_KEY"

The adjacent auth/ directory is created 0700, so the intent is clearly
there — config.yaml just doesn't get the same treatment.

For comparison:

• Claude Code stores OAuth credentials with mode 0600 on Linux (Keychain on
  macOS), documented in its auth docs
• Gemini CLI had a dedicated fix (fix(core): restrict oauth_creds.json file permissions google-gemini/gemini-cli#5245) to set
  secure permissions on oauth_creds.json

SECURITY.md also tells users to "Restrict local access" on the data
directory — hard to follow when the provider config is 644 under a 755
parent.

Suggestion (any of):

1. chmod 0600 on config.yaml at creation and on write
2. store the env var name (the CLI already accepts --api-key-env) and
   resolve at runtime instead of storing the value
3. keychain where available

Happy to provide more details if useful.

[hetaoBackend]

The permissions fix is in #170. It restricts credential-bearing config files, atomic temporary files and migration backups to owner access on POSIX, including existing files with overly broad permissions. It also clarifies that --api-key-env persists the variable's value, rather than an environment-variable reference.

Local verification passed, but the current Windows CI job failed, so I am following that up in the existing fix task before treating the PR as ready. This change does not add encryption, keychain storage or Windows ACL guarantees. The PR has not been merged or released.

[hetaoBackend]

CI follow-up for #170 at unchanged head 373439d: merge conflicts are resolved, and the complete local 14-gate verification, Linux and macOS checks passed. Windows remains blocked: the first attempt timed out in three smoke children; a retry without code changes failed earlier in five capability tests across three storage/queue/verifier suites, before smoke ran. Those three files pass all 189 tests locally, as do all six proxy smoke cases.

This points toward Windows execution-time variability, but the underlying runner cause is not confirmed. Details and both attempt results are recorded in the PR; no timeouts were relaxed. CI run. The fix remains unmerged and unreleased, and the issue stays open.

[hetaoBackend]

The CI blocker is now resolved in #170 at head 79a69b8. Windows runs Vitest files serially to reduce filesystem contention while retaining the default per-test deadlines. Full-runtime smoke children have a 30-second Windows startup budget matching ACP; one case took 17.9 seconds and completed successfully, beyond the old 15-second limit.

The complete local 14-gate verification passed. GitHub verification now passes on Linux, macOS and Windows, including the aggregate check; release audit also passed. The downloaded Windows report records all 11 applicable gates passing in 7m39s. No tests or network-audit assertions were disabled.

The PR has no merge conflicts and is awaiting maintainer review. It remains unmerged and unreleased, so this issue stays open.

[hetaoBackend]

Review follow-up: #170 is now at 9ce8e562a0a0d731e8449a59a12562f895ae846a. It preserves already-private read-only configs on load, warns rather than aborting when an old backup cannot be inspected or repaired, and checks config before starting auth watchers so an unsafe, unrepairable main config exits with an error instead of hanging.

The local full pnpm verify passed all 14 gates; 33 permission tests and built-CLI checks with real macOS immutable files passed. Linux, macOS and Windows GitHub verification, the aggregate check and release audit now pass for this updated PR (11 successful checks, 2 expected skips).

The Windows test-worker/startup-budget changes have been extracted into #181, whose CI also passes independently. #170 has since merged as 0f4b6b1cab4e60997d2caf8c5bffe52424936276, and #181 as 4c0d8297c7e2865352a8786994b3e3b090cb35a8. This confirms source integration, not npm release delivery. Plaintext storage and the Windows ACL limitation remain as documented.