chore(scripts): warn when apikey.txt is group/other-readable

The seed script reads the Linear key from the environment, but the README sources it from a gitignored `apikey.txt` that was landing at mode 644. `main` now warns on startup when that file is group- or other-accessible, so a loose key file gets flagged instead of sitting silently exposed. The warning points at `chmod 600`.

1 files changed, 22 insertions, 0 deletions

diff --git a/scripts/tests/test_seed_pearl_workspace.py b/scripts/tests/test_seed_pearl_workspace.py
index 5f4147e..e52d78a 100644
--- a/scripts/tests/test_seed_pearl_workspace.py
+++ b/scripts/tests/test_seed_pearl_workspace.py
@@ -296,3 +296,25 @@ def test_client_raises_on_graphql_errors():
     client = seed.LinearClient("key", transport=fake)
     with pytest.raises(seed.LinearError, match="bad key"):
         client.execute("query Teams { teams { nodes { id } } }", {})
+
+
+# --- key-file permission warning ----------------------------------------------
+
+def test_warn_key_file_world_readable_warns(tmp_path, capsys):
+    p = tmp_path / "apikey.txt"
+    p.write_text("lin_api_secret")
+    os.chmod(p, 0o644)
+    assert seed.warn_if_key_file_world_readable(str(p)) is True
+    assert "600" in capsys.readouterr().err
+
+
+def test_warn_key_file_mode_600_is_silent(tmp_path, capsys):
+    p = tmp_path / "apikey.txt"
+    p.write_text("lin_api_secret")
+    os.chmod(p, 0o600)
+    assert seed.warn_if_key_file_world_readable(str(p)) is False
+    assert capsys.readouterr().err == ""
+
+
+def test_warn_key_file_absent_is_silent(tmp_path):
+    assert seed.warn_if_key_file_world_readable(str(tmp_path / "nope.txt")) is False