Excluded from #155 deliberately — pre-existing pattern, not introduced there.
_get_or_create_studio_token in spacepilot/core/config.py does write_text() and then chmod(0o600). Between those two calls the file exists at the process umask, typically 0644.
Why it is worth closing rather than shrugging at
That token is not a session cookie. It gates every compute route via require_token, and it authorises the /api/gpu/inspect/shell websocket — the one route in this repo that reaches a remote SSH shell on a running GPU box. Anything that can read the file during that window holds that capability.
The window is short and the file lands in a per-user directory, so this is low severity and not urgent. But the correct pattern costs nothing: create with os.open(path, O_CREAT|O_EXCL|O_WRONLY, 0o600) and write through that descriptor, so the file is never observable at a wider mode. save_config already does the right thing via a mkstemp + chmod + os.replace dance — worth matching.
Related
#157 made $SPACEPILOT_STUDIO_TOKEN short-circuit the file entirely, so a caller that supplies its own token never opens this window. That reduces exposure but does not close the default path.
Provenance
2026-09-22 train, raised by an independent reviewer on #155 and named in that PR's body as deliberately out of scope.
Excluded from #155 deliberately — pre-existing pattern, not introduced there.
_get_or_create_studio_tokeninspacepilot/core/config.pydoeswrite_text()and thenchmod(0o600). Between those two calls the file exists at the process umask, typically0644.Why it is worth closing rather than shrugging at
That token is not a session cookie. It gates every compute route via
require_token, and it authorises the/api/gpu/inspect/shellwebsocket — the one route in this repo that reaches a remote SSH shell on a running GPU box. Anything that can read the file during that window holds that capability.The window is short and the file lands in a per-user directory, so this is low severity and not urgent. But the correct pattern costs nothing: create with
os.open(path, O_CREAT|O_EXCL|O_WRONLY, 0o600)and write through that descriptor, so the file is never observable at a wider mode.save_configalready does the right thing via amkstemp+chmod+os.replacedance — worth matching.Related
#157 made
$SPACEPILOT_STUDIO_TOKENshort-circuit the file entirely, so a caller that supplies its own token never opens this window. That reduces exposure but does not close the default path.Provenance
2026-09-22 train, raised by an independent reviewer on #155 and named in that PR's body as deliberately out of scope.