[spark-compete] fix: set restrictive permissions on generated .env files

[ifeoluwaaj]

spark-compete Packet

{
  "schema": "spark-compete-hotfix-v1",
  "event": "hotfix.submitted",
  "submission_mode": "pull_request",
  "submission_target_url": "https://github.com/vibeforge1111/spark-cli/pull/693",
  "team": {
    "name": "Sequence",
    "members": [
      "ifeoluwaaj",
      "micc9ee",
      "londitshabalala"
    ],
    "device_holder_github": "ifeoluwaaj",
    "device_holder_llm": "ifesn"
  },
  "target_repo": "vibeforge1111/spark-cli",
  "issue": {
    "severity": "MEDIUM",
    "category": "bug",
    "description": "Generated .env files containing secrets are created with default umask permissions, making them world-readable on multi-user systems."
  },
  "evidence": {
    "type": "code_review",
    "files": [],
    "forbidden": [
      "No secrets, tokens, or credentials in code or PR body",
      "No proprietary or confidential information disclosed",
      "No destructive actions performed on production systems"
    ]
  },
  "proposed_fix": {
    "summary": ".env files with secrets should be created with 0o600 permissions (owner read/write only).",
    "files_changed": []
  },
  
    "actual_behavior": "Generated .env files containing secrets are created with default umask permissions, making them world-readable on multi-user systems.",
    "files_expected": ["src/spark_cli/cli.py, src/spark_cli/sandbox/access.py"],
"pr": {
    "url": "https://github.com/vibeforge1111/spark-cli/pull/693",
    "branch": "fix/pr-693"
  },
  "review_claim": {
    "duplicate": false,
    "security_safe": true,
    "public_safe": true
  }
}

Team: Sequence

Bug Summary

Generated .env files containing secrets are created with default umask permissions, making them world-readable on multi-user systems.

Root Cause

Generated .env files containing secrets are created with default umask permissions, making them world-readable on multi-user systems.

Fix

Added os.chmod(path, 0o600) after write_text in write_generated_env() and write_env_file()

Before (The Bug)

Generated .env files containing secrets are created with default umask permissions, making them world-readable on multi-user systems.

After (The Fix)

Fix prevents the issue from occurring.

Testing

Verified: generated .env files now have 0o600 permissions

Before (The Bug)

# See diff for actual code change

After (The Fix)

# See diff for actual code change

Files Changed

src/spark_cli/cli.py, src/spark_cli/sandbox/access.py

Duplicate Notes

No existing PR covers this specific issue. This fix addresses a distinct bug not covered by other submissions.

Risk Notes

Minimal risk - security hardening only. 0o600 is standard for secret files. Existing files retain old permissions until rewritten.