fix(installer): pin umask and set the 0700 modes the fleet boundary requires (#1236)

Conversation 3 Commits 2 Files Changed 1

+58

2 Commits

Author	SHA1	Message	Date
fredandClaude Opus 5	03eda02c20	fix(installer): warn on a failed credentials/ chmod instead of swallowing it ci/woodpecker/pr/ci Pipeline was successful Details scooby's review flag 1 on #1242. The other three chmods warn; this one was `\|\| true`. It is the one directory holding secrets, so a chmod that fails silently there is the failure most worth a line in the output. Comment-and-warn only. No behaviour change on the success path. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01WYgWocp36goy8hj2ui6ps1	2026-08-15 22:40:47 -05:00
fredandClaude Opus 5	3b4055017e	fix(installer): pin umask and set the 0700 modes the fleet boundary requires (#1236 ) ci/woodpecker/pr/ci Pipeline was canceled Details A greenfield install cannot run `mosaic fleet init --write`. It fails with `unsafe-permissions` on an unnamed `(directory)` and an unhandled Node throw, and every mutating `mosaic fleet` command fails the same way. Measured on a reverted-to-greenfield sandbox VM at CLI 0.0.50-next.2413: `~/.config/mosaic`, `fleet/` and `credentials/` all land at 0775, and 1735 directories under the framework root carry `mode & 022`. Two independent causes, and fixing either one alone leaves it broken. 1. The installer inherited the caller's umask. Debian/Ubuntu ship 002, so every `mkdir -p` produced 0775. Fedora/RHEL ship 022 and produced 0755. The product therefore worked or did not depending on the operator's login shell, with nothing in the install output distinguishing the two. 022 is already what this script assumes it produces — `make_durable_snapshot` restores the ambient umask specifically so "every later sync copy and new framework dir" gets 0644/0755 — so pin it rather than inherit it. 2. Even at a correct 0755, three directories are rejected. The fleet code guards its managed paths with two masks in two languages: `assertPrivateManagedDirectory` (fleet-reconciler.js, `mode & 0o077`) covers MOSAIC_HOME and `fleet/` and runs before the roster lock is taken; `assert_private_directory` (tools/fleet/start-agent-session.sh, `mode & 077`) covers `fleet/agents` and runs before a pane is spawned. Their laxer siblings use `mode & 0o022` and accept 0755. The strict mask wins, so the installer states 0700 outright instead of hoping a umask implies it. The `find -perm /022 -exec chmod go-w` sweep repairs a tree installed before this change, which the umask alone cannot reach. It strips group/other WRITE only — never read or execute — and is scoped to directories, so it corrects the boundary violation without changing who may traverse or read anything. It is not sufficient for `fleet/agents`: stripping write from 0755 yields 0750 and `mode & 077` is still non-zero, which is why that path gets its own chmod. Reported as #1236. The `fleet/agents` half was found by scooby reading start-agent-session.sh; the umask framing is theirs too — my first report blamed the distro rather than the umask. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01WYgWocp36goy8hj2ui6ps1	2026-08-15 22:29:48 -05:00

Author

SHA1

Message

Date

fredandClaude Opus 5

03eda02c20

fix(installer): warn on a failed credentials/ chmod instead of swallowing it

ci/woodpecker/pr/ci Pipeline was successful

Details

scooby's review flag 1 on #1242. The other three chmods warn; this one was
`|| true`. It is the one directory holding secrets, so a chmod that fails
silently there is the failure most worth a line in the output.

Comment-and-warn only. No behaviour change on the success path.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WYgWocp36goy8hj2ui6ps1

2026-08-15 22:40:47 -05:00

fredandClaude Opus 5

3b4055017e

fix(installer): pin umask and set the 0700 modes the fleet boundary requires (#1236 )

ci/woodpecker/pr/ci Pipeline was canceled

Details

A greenfield install cannot run `mosaic fleet init --write`. It fails with
`unsafe-permissions` on an unnamed `(directory)` and an unhandled Node throw,
and every mutating `mosaic fleet` command fails the same way. Measured on a
reverted-to-greenfield sandbox VM at CLI 0.0.50-next.2413: `~/.config/mosaic`,
`fleet/` and `credentials/` all land at 0775, and 1735 directories under the
framework root carry `mode & 022`.

Two independent causes, and fixing either one alone leaves it broken.

1. The installer inherited the caller's umask. Debian/Ubuntu ship 002, so every
   `mkdir -p` produced 0775. Fedora/RHEL ship 022 and produced 0755. The
   product therefore worked or did not depending on the operator's login shell,
   with nothing in the install output distinguishing the two. 022 is already
   what this script assumes it produces — `make_durable_snapshot` restores the
   ambient umask specifically so "every later sync copy and new framework dir"
   gets 0644/0755 — so pin it rather than inherit it.

2. Even at a correct 0755, three directories are rejected. The fleet code
   guards its managed paths with two masks in two languages:
   `assertPrivateManagedDirectory` (fleet-reconciler.js, `mode & 0o077`) covers
   MOSAIC_HOME and `fleet/` and runs before the roster lock is taken;
   `assert_private_directory` (tools/fleet/start-agent-session.sh, `mode & 077`)
   covers `fleet/agents` and runs before a pane is spawned. Their laxer
   siblings use `mode & 0o022` and accept 0755. The strict mask wins, so the
   installer states 0700 outright instead of hoping a umask implies it.

The `find -perm /022 -exec chmod go-w` sweep repairs a tree installed before
this change, which the umask alone cannot reach. It strips group/other WRITE
only — never read or execute — and is scoped to directories, so it corrects the
boundary violation without changing who may traverse or read anything. It is
not sufficient for `fleet/agents`: stripping write from 0755 yields 0750 and
`mode & 077` is still non-zero, which is why that path gets its own chmod.

Reported as #1236. The `fleet/agents` half was found by scooby reading
start-agent-session.sh; the umask framing is theirs too — my first report
blamed the distro rather than the umask.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WYgWocp36goy8hj2ui6ps1

2026-08-15 22:29:48 -05:00

fix(installer): pin umask and set the 0700 modes the fleet boundary requires (#1236) #1242