1 files changed, 13 insertions, 9 deletions
diff --git a/packages/meshbay-node/src/meshbay_node/keystore.py b/packages/meshbay-node/src/meshbay_node/keystore.py
index 59fc719..dff443d 100644
--- a/packages/meshbay-node/src/meshbay_node/keystore.py
+++ b/packages/meshbay-node/src/meshbay_node/keystore.py
@@ -31,6 +31,7 @@ import getpass
 import json
 import logging
 import os
+import sys
 from dataclasses import dataclass
 from pathlib import Path
 
@@ -38,6 +39,7 @@ import msgpack
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
 
+from meshbay_node.platform import chmod_private, config_dir
 from meshbay_common.crypto import (
     ARGON2_ITERATIONS,
     ARGON2_LANES,
@@ -57,8 +59,8 @@ from meshbay_common.crypto import (
 log = logging.getLogger(__name__)
 
 KEYSTORE_VERSION = 1
-DEFAULT_KEYSTORE_PATH = Path.home() / ".config" / "meshbay" / "keystore.enc"
-DEFAULT_UNLOCK_FILE   = Path.home() / ".config" / "meshbay" / "unlock.key"
+DEFAULT_KEYSTORE_PATH = config_dir() / "keystore.enc"
+DEFAULT_UNLOCK_FILE   = config_dir() / "unlock.key"
 
 
 @dataclass
@@ -94,12 +96,14 @@ def _resolve_password(unlock_file: Path | None = None) -> str:
     # 2. Unlock key file
     key_file = unlock_file or DEFAULT_UNLOCK_FILE
     if key_file.exists():
-        mode = oct(key_file.stat().st_mode)[-3:]
-        if mode != "600":
-            log.warning(
-                "unlock.key permissions are %s (expected 600) — fix with: chmod 600 %s",
-                mode, key_file,
-            )
+        if sys.platform != "win32":
+            mode = oct(key_file.stat().st_mode)[-3:]
+            if mode != "600":
+                log.warning(
+                    "unlock.key permissions are %s (expected 600) — fix with: "
+                    "chmod 600 %s",
+                    mode, key_file,
+                )
         log.debug("Keystore password from %s", key_file)
         return key_file.read_text().strip()
 
@@ -233,7 +237,7 @@ def _write_keystore(path: Path, keys: NodeKeys, password: str) -> None:
         "ciphertext_b64":  base64.b64encode(ct).decode(),
     }
     path.write_text(json.dumps(envelope, indent=2))
-    path.chmod(0o600)
+    chmod_private(path)
 
 
 def load_or_create_keystore(