fix(extensions): preserve config file mode on keep-config restore

Per review: config files can hold secrets, so recreating them with
write_bytes() (default perms) could widen access. Capture the original
st_mode alongside the bytes and re-apply it (permission bits) after
restore, matching the --force path's shutil.copy2 mode preservation.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: jawwad-ali

src/specify_cli/extensions/__init__.py

@@ -1404,7 +1404,11 @@ def install_from_directory(
         # preserved configs and the backup-restore path never runs. Capture
         # them here and write them back after the fresh copytree, mirroring
         # the *-config filter the --force restore path uses.
-        preserved_configs: dict[str, bytes] = {}
+        # Capture (bytes, mode) so we can restore permissions too — config
+        # files may hold secrets (API keys), and recreating them with default
+        # perms could widen access. Mirrors the --force restore's shutil.copy2
+        # (which preserves mode/mtime).
+        preserved_configs: dict[str, tuple[bytes, int]] = {}
         if dest_dir.exists():
             for cfg_file in dest_dir.iterdir():
                 if (
@@ -1415,7 +1419,10 @@ def install_from_directory(
                         or cfg_file.name.endswith("-config.local.yml")
                     )
                 ):
-                    preserved_configs[cfg_file.name] = cfg_file.read_bytes()
+                    preserved_configs[cfg_file.name] = (
+                        cfg_file.read_bytes(),
+                        cfg_file.stat().st_mode,
+                    )
 
         # Install extension (dest_dir computed above during self-install guard)
         if dest_dir.exists():
@@ -1424,11 +1431,17 @@ def install_from_directory(
         ignore_fn = self._load_extensionignore(source_dir)
         shutil.copytree(source_dir, dest_dir, ignore=ignore_fn)
 
-        # Restore configs preserved from a keep-config leftover (see above).
-        # The --force backup-restore below (did_remove) still takes precedence
-        # for that path, which uses .backup/ rather than an in-place leftover.
-        for name, data in preserved_configs.items():
-            (dest_dir / name).write_bytes(data)
+        # Restore configs preserved from a keep-config leftover (see above),
+        # preserving the original file mode. The --force backup-restore below
+        # (did_remove) still takes precedence for that path, which uses
+        # .backup/ rather than an in-place leftover.
+        for name, (data, mode) in preserved_configs.items():
+            dest_cfg = dest_dir / name
+            dest_cfg.write_bytes(data)
+            try:
+                os.chmod(dest_cfg, mode & 0o7777)  # permission bits only
+            except OSError:
+                pass
 
         # Register commands with AI agents
         registered_commands = {}

tests/test_extensions.py

@@ -1568,6 +1568,9 @@ def test_reinstall_preserves_keep_config_leftover(self, extension_dir, project_d
         ext_dir = project_dir / ".specify" / "extensions" / "test-ext"
         config_file = ext_dir / "test-ext-config.yml"
         config_file.write_text("api_key: MY-CUSTOMIZED-VALUE")
+        # Restrictive perms — a config may hold secrets; the restore must not
+        # widen them (POSIX only; Windows chmod ignores group/other bits).
+        config_file.chmod(0o600)
 
         # keep-config removal: registry entry dropped, config left in place.
         assert manager.remove("test-ext", keep_config=True) is True
@@ -1579,6 +1582,9 @@ def test_reinstall_preserves_keep_config_leftover(self, extension_dir, project_d
         # The user's config must survive the reinstall (was silently wiped).
         assert config_file.exists()
         assert "MY-CUSTOMIZED-VALUE" in config_file.read_text()
+        # ...and keep its original (restrictive) mode, not default perms.
+        if platform.system() != "Windows":
+            assert config_file.stat().st_mode & 0o777 == 0o600
 
 
 # ===== CommandRegistrar Tests =====