[Bug]: Tokens written to colab.log in plain text; token.json/colab.log created with default (umask) permissions #177

Version: google-colab-cli 0.7.4 (PyPI), Linux, --auth oauth2.

1. setup_logging() (common.py) sets the root logger and urllib3 to DEBUG and always attaches a file handler at ~/.config/colab-cli/colab.log. As a result:

   • requests_oauthlib.oauth2_session logs Obtained token {...}, including the refresh token;
   • colab_cli.client logs Request Headers: ... (client.py:224), including Authorization: Bearer <access token> on every API call.

   After one sign-in and a couple of commands, the log held about a dozen lines with token values.

2. token.json is written with open(path, "w") (auth.py:146) and the log by logging.FileHandler, so both take the process umask: 0664 under umask 0002, 0644 under the more common 0022. The config directory is created 0775/0755. On a shared machine, other local users can read the refresh token.

3. The log is never rotated, so tokens accumulate.

Why it matters: the refresh token is long-lived and carries the cloud-platform scope, so it reaches the user's Google Cloud projects, not just Colab. Log files are also what people paste into bug reports and hand to coding agents when debugging.

Suggested fixes:

• Scope DEBUG to colab_cli only, behind a flag such as --debug, rather than setting the root logger.
• Redact Authorization headers and token responses before logging.
• Create the directory with mode 0o700, and write token.json via os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600).
• Consider a RotatingFileHandler for the log.

Workaround: chmod 700 ~/.config/colab-cli && chmod 600 ~/.config/colab-cli/token.json, and clear the log after signing in.

Found by my Claude Code agent while setting up the CLI; the details above were checked against the 0.7.4 source and my own log (with tokens redacted).