1 files changed, 22 insertions, 0 deletions
diff --git a/scripts/tests/test_seed_pearl_workspace.py b/scripts/tests/test_seed_pearl_workspace.py
index 5f4147e..e52d78a 100644
--- a/scripts/tests/test_seed_pearl_workspace.py
+++ b/scripts/tests/test_seed_pearl_workspace.py
@@ -296,3 +296,25 @@ def test_client_raises_on_graphql_errors():
     client = seed.LinearClient("key", transport=fake)
     with pytest.raises(seed.LinearError, match="bad key"):
         client.execute("query Teams { teams { nodes { id } } }", {})
+
+
+# --- key-file permission warning ----------------------------------------------
+
+def test_warn_key_file_world_readable_warns(tmp_path, capsys):
+    p = tmp_path / "apikey.txt"
+    p.write_text("lin_api_secret")
+    os.chmod(p, 0o644)
+    assert seed.warn_if_key_file_world_readable(str(p)) is True
+    assert "600" in capsys.readouterr().err
+
+
+def test_warn_key_file_mode_600_is_silent(tmp_path, capsys):
+    p = tmp_path / "apikey.txt"
+    p.write_text("lin_api_secret")
+    os.chmod(p, 0o600)
+    assert seed.warn_if_key_file_world_readable(str(p)) is False
+    assert capsys.readouterr().err == ""
+
+
+def test_warn_key_file_absent_is_silent(tmp_path):
+    assert seed.warn_if_key_file_world_readable(str(tmp_path / "nope.txt")) is False