[AUTOMATION] fix(clawpatch): keep Claude settings artifacts private

[michiosw]

Where We Are

Claude hook install and uninstall were writing backup and rewritten settings files with broader permissions than the original settings file. A user can start with ~/.claude/settings.json at 0600 and end up with backup artifacts readable by other local users.

Where We Want To Go

Keep every Claude settings artifact private. Existing settings, rewritten settings, and generated backups should all stay at private file modes.

How do we get there

Preserve private permissions when backing up and rewriting Claude settings files, and default new settings files to 0600. Add focused CLI tests that assert the rewritten settings file and backup file are not group or world readable.

Validation:

• go test ./...
• go vet ./...
• npm exec --yes --package pnpm@10.0.0 -- pnpm install --frozen-lockfile
• npm exec --yes --package pnpm@10.0.0 -- pnpm --dir web/guard-dashboard typecheck
• git diff --check

[michiosw]

• [AUTOMATION] fix(clawpatch): keep Claude settings artifacts private #249 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Greptile Summary

This PR makes Claude settings artifacts private when Guard hooks are installed or removed. The main changes are:

• Adds a shared private file mode for Claude settings writes.
• Preserves private owner permissions when creating backup files.
• Defaults newly created Claude settings files to private permissions.
• Adds CLI tests for private rewritten settings and backup artifacts.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
internal/guard/cli/cli.go	Hardens Claude settings and backup file permissions without changing hook install or uninstall behavior.
internal/guard/cli/cli_test.go	Adds focused coverage for private settings and backup file modes.

_{Reviews (1): Last reviewed commit: "fix(clawpatch): keep Claude settings art..." | Re-trigger Greptile}