fix(installer): warn on a failed credentials/ chmod instead of swallowing it

scooby's review flag 1 on #1242. The other three chmods warn; this one was `|| true`. It is the one directory holding secrets, so a chmod that fails silently there is the failure most worth a line in the output. Comment-and-warn only. No behaviour change on the success path. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01WYgWocp36goy8hj2ui6ps1
2026-08-15 22:40:47 -05:00
parent 3b4055017e
commit 03eda02c20
1 changed files with 5 additions and 1 deletions
@@ -740,7 +740,11 @@ if [[ -d "$TARGET_DIR/fleet/agents" ]]; then
    warn "Could not set 0700 on $TARGET_DIR/fleet/agents — agent sessions will fail to start as unsafe-permissions."
 fi
 # credentials/ holds secrets and was never meant to be group-readable either.
-chmod 700 "$TARGET_DIR/credentials" 2>/dev/null || true
+# It is not on the fleet boundary, so a failure here breaks nothing — but it is
+# the one directory where a silently-failed chmod leaves secrets group-readable,
+# which is precisely the failure worth a line in the output.
+chmod 700 "$TARGET_DIR/credentials" 2>/dev/null || \
+  warn "Could not set 0700 on $TARGET_DIR/credentials — stored secrets may be readable by other users on this host."

 # Repair an existing tree. The umask above only governs directories this run
 # creates, so a host installed under umask 002 before this fix keeps its 0775