[Feature Request] Write tool should respect umask or allow configurable file mode

[Feature Request] Write tool should respect umask or allow configurable file mode

Summary

The Write tool hardcodes file permissions to 0600 when creating new files, ignoring the system umask. This prevents viable multi-user setups where Claude runs as a dedicated user for security isolation.

Current Behavior

When creating a new file, the Write tool explicitly sets mode: 384 (decimal for 0o600):

// From cli.js (bundled)
if(!G) Y.mode = B.mode ?? 384;  // 384 = 0o600

This means all new files are created with -rw------- permissions regardless of umask settings.

Problem

Running Claude Code as a separate OS user is a reasonable security practice - it provides filesystem-level isolation so Claude can only access explicitly permitted directories. However, with hardcoded 0600 permissions:

1. Files Claude creates are owned by the claude user
2. The primary user cannot read or modify these files without sudo
3. Workarounds require ACLs with default inheritance on every working directory

Use Case

# Create dedicated claude user for isolation
sudo useradd -m claude

# Run Claude as that user (with appropriate directory access)
sudo -u claude claude

# Problem: files Claude creates are inaccessible
ls -la newfile.py
# -rw------- claude claude newfile.py

# Primary user can't access their own project files
cat newfile.py
# Permission denied

Proposed Solutions

Option A (minimal): Respect umask when no explicit mode is specified

// Instead of:
Y.mode = B.mode ?? 384;

// Use:
Y.mode = B.mode;  // Let filesystem apply umask

Option B (configurable): Add a setting for default file mode

{
  "permissions": {
    "defaultFileMode": "0644"
  }
}

Option C (environment variable):

CLAUDE_CODE_FILE_MODE=0644 claude

Workaround

Currently requires setting up ACL default inheritance on every directory Claude might write to:

setfacl -R -d -m u:myuser:rwX ~/projects

This works but is cumbersome and easy to forget when creating new directories.

Environment

• Claude Code version: 2.0.76
• OS: Linux (Fedora 43)
• Installation: npm via Nix

Related

This issue was identified in Jonathan Chang's "Claude Daemon" blog post about running Claude as a separate user for security isolation.