Development record
2026-10-04 — Decided without a question by abcd-50 (one defensible answer), on the security review of the home-mode fix (iss-2610032205304585): an existing abcd home keeps the mode it has, because every home-scope writer's contract is that a level which already exists keeps its mode (fsutil.EnsureHomeScope, fsutil.EnsureRealDir) and re-moding a folder on the person's machine is a change the issue did not ask for; the two records an earlier version wrote 0o644 (the path-entry record and the registry's index) are narrowed to 0o600 at their next write instead (the bootstrap re-stamps path-entry at every provision, the registry rewrites its index at every registration), so on an existing 0o755 home the residual is that other accounts can list the folder's names, never read a record abcd keeps there. Not chosen: chmod an existing home to 0o700 when the account owns it.
2026-10-04 — Decided without a question by abcd-50 (one defensible answer), on the security review of the home-mode fix (iss-2610032205304585): an existing abcd home keeps the mode it has, because every home-scope writer's contract is that a level which already exists keeps its mode (fsutil.EnsureHomeScope, fsutil.EnsureRealDir) and re-moding a folder on the person's machine is a change the issue did not ask for; the two records an earlier version wrote 0o644 (the path-entry record and the registry's index) are narrowed to 0o600 at their next write instead (the bootstrap re-stamps path-entry at every provision, the registry rewrites its index at every registration), so on an existing 0o755 home the residual is that other accounts can list the folder's names, never read a record abcd keeps there. Not chosen: chmod an existing home to 0o700 when the account owns it.
Frontmatter
| id | dcn-2610040000000007 |
|---|---|
| type | decision |
| date | 2026-10-04 |
.abcd/work/decisions/dcn-2610040000000007-decided-without-a-question-by-abcd-50.md
open on GitHub ↗ · commit history ↗
mentions2
- iss-2610032205304585abcd creates its home folder ~/.abcd with different permissions depending on which command creates it first: the credential store makes it private to the account (0o700), while ahoy's history store and owned copy make it readable by other accounts on the computer (0o755). On a Mac shared by several accounts, whichever runs first decides whether others can list abcd's home. Found by the dashboard design's security review.
- iss-2610120949163534Folders in abcd's home that an earlier abcd, a hand-run `mkdir`, or `git worktree add` created at the process umask are readable by every other account on the computer whenever the home itself is too: a home made 0755 keeps that mode, because every abcd writer leaves an existing folder's mode as it stands ([dcn-2610040000000007](../../decisions/dcn-2610040000000007-decided-without-a-question-by-abcd-50.md)). On a Mac where `~` is 0750 group staff and every local account is in staff, the other accounts can list and read `~/.abcd.noindex/{worktrees,runs,history,lifeboats,review-copies,scratch,sources,lab}` (each 0755), which hold private checkouts and session material. A lane worktree git adds into the store is 0755 whatever the store's mode.