[msadig]

Problem

skills/setup/scripts/github-device-fetch.sh creates $STATE_DIR and the cookie jar under the caller's umask, and only runs chmod 0600 on the env file once it's been written. github-device-poll.sh runs umask 0077 only after its polling loop, so the cookie jar curl rewrites while polling (which by then holds the admin coder_session_token) and github-device.resp are created under the default umask too.

With a typical umask of 022, the fetch step leaves this behind:

drwxr-xr-x  coder-install/
-rw-------  coder-install/github-device.env
-rw-r--r--  coder-install/github-device.jar

Fix

Add umask 0077 right after set -euo pipefail in both scripts, so every scratch file and directory is owner-only when it's created. Remove the separate chmod 0600 and the late umask they replace.

With the patch, from the same umask 022:

drwx------  coder-install/
-rw-------  coder-install/github-device.env
-rw-------  coder-install/github-device.jar

Testing

• Ran github-device-fetch.sh before and after the change against a local stub that mimics the callback 307 + Set-Cookie and the /device JSON. The permissions shown above come from those runs.
• shellcheck passes on both scripts.
• I didn't run the poll script end to end (it needs a real GitHub device login). Its change only moves the existing umask 0077 earlier.

https://claude.ai/code/session_012e1sTYKpjcPyQfVzSh6bmQ