From b27fdac0f914202b10506af1f549484be444aaa4 Mon Sep 17 00:00:00 2001
From: ezl-keygraph <ezhil@keygraph.io>
Date: Tue, 17 Mar 2026 03:22:03 +0530
Subject: [PATCH] fix: skip POSIX permission check on Windows

writeFileSync mode option is ignored on Windows, so config.toml
gets 0o666 and the guard rejects it.
---
 apps/cli/src/config/resolver.ts | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/apps/cli/src/config/resolver.ts b/apps/cli/src/config/resolver.ts
index a6715cd..45dad35 100644
--- a/apps/cli/src/config/resolver.ts
+++ b/apps/cli/src/config/resolver.ts
@@ -79,12 +79,15 @@ function loadTOML(): TOMLConfig | null {
   const configPath = getConfigFile();
   if (!fs.existsSync(configPath)) return null;
 
-  // Config contains secrets — refuse to read if group or others have any access
-  const mode = fs.statSync(configPath).mode;
-  if (mode & 0o077) {
-    const actual = (mode & 0o777).toString(8).padStart(3, '0');
-    console.error(`\nInsecure permissions (${actual}) on ${configPath}. Run: chmod 600 ${configPath}\n`);
-    process.exit(1);
+  // Config contains secrets — refuse to read if group or others have any access.
+  // Skip on Windows where POSIX permissions are not supported.
+  if (process.platform !== 'win32') {
+    const mode = fs.statSync(configPath).mode;
+    if (mode & 0o077) {
+      const actual = (mode & 0o777).toString(8).padStart(3, '0');
+      console.error(`\nInsecure permissions (${actual}) on ${configPath}. Run: chmod 600 ${configPath}\n`);
+      process.exit(1);
+    }
   }
 
   try {