From 4dedd60868cbbfa7d9e28483180b606c69d081c2 Mon Sep 17 00:00:00 2001 From: Krrish Dholakia Date: Thu, 16 Jul 2026 09:03:58 -0700 Subject: [PATCH] fix(cli): write lite up's Claude settings patch with secure_create up() converted every other credential-bearing write (config.yaml, autoroute's settings patch, the backup) to secure_create, but missed its own CLAUDE_SETTINGS_PATH write, which still used plain open() and could land at the umask-derived default (commonly 0644) instead of 0600. --- litellm/proxy/client/cli/commands/up.py | 2 +- tests/test_litellm/proxy/client/cli/test_up_commands.py | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/litellm/proxy/client/cli/commands/up.py b/litellm/proxy/client/cli/commands/up.py index dc9157d7ca4..4b077398b32 100644 --- a/litellm/proxy/client/cli/commands/up.py +++ b/litellm/proxy/client/cli/commands/up.py @@ -221,7 +221,7 @@ def up(ctx: click.Context) -> None: CLAUDE_SETTINGS_PATH.parent.mkdir(exist_ok=True) merged = merge_claude_settings(original_settings, base_url, api_key_helper) - with open(CLAUDE_SETTINGS_PATH, "w") as f: + with secure_create(CLAUDE_SETTINGS_PATH) as f: json.dump(merged, f, indent=2) except (AgentRunError, UpError) as e: raise click.ClickException(str(e)) diff --git a/tests/test_litellm/proxy/client/cli/test_up_commands.py b/tests/test_litellm/proxy/client/cli/test_up_commands.py index 1b182553644..26b00f98365 100644 --- a/tests/test_litellm/proxy/client/cli/test_up_commands.py +++ b/tests/test_litellm/proxy/client/cli/test_up_commands.py @@ -324,6 +324,7 @@ class TestUpCommand: def fake_wait(self, timeout=None): captured["settings"] = json.loads(settings_path.read_text()) captured["backup_existed"] = backup_path.exists() + captured["settings_mode"] = stat.S_IMODE(settings_path.stat().st_mode) return True with ( @@ -346,6 +347,7 @@ class TestUpCommand: assert captured["settings"]["theme"] == "dark" assert captured["settings"]["env"]["ANTHROPIC_BASE_URL"] == "http://localhost:4000" assert captured["settings"]["apiKeyHelper"] == "/usr/local/bin/lite auth print-token" + assert captured["settings_mode"] == 0o600 assert json.loads(settings_path.read_text()) == original assert not backup_path.exists()