Development record
2026-10-12 — An existing abcd home is narrowed to the account's alone, reversing the 2026-10-04 decision that it keeps the mode it has (iss-2610120949163534), on the security standard ruling of 2026-10-11 (abcd fixes the risks it adds): a home made 0755 by an earlier abcd or by hand leaves every folder abcd keeps in it (worktrees, runs, history, lab, sources) readable by the other accounts in the home directory's group. At the CLI front door, before any verb runs, a ~/.abcd.noindex this account owns that is a real directory has its group and other bits removed (fsutil.NarrowToOwner, on the opened descriptor, never following a symlink); a symlinked home, one another account owns and an absent one are left alone, and nothing below the home is walked or re-moded, because closing the home closes everything in it. A lane worktree git adds into the store is narrowed the same way after the add. Writers keep their contract that a folder they find keeps its mode; only the home itself is narrowed. Not chosen: re-moding every folder below the home, which would change folders a person may have opened deliberately and gains nothing once the home is closed.
2026-10-12 — An existing abcd home is narrowed to the account's alone, reversing the 2026-10-04 decision that it keeps the mode it has (iss-2610120949163534), on the security standard ruling of 2026-10-11 (abcd fixes the risks it adds): a home made 0755 by an earlier abcd or by hand leaves every folder abcd keeps in it (worktrees, runs, history, lab, sources) readable by the other accounts in the home directory's group. At the CLI front door, before any verb runs, a ~/.abcd.noindex this account owns that is a real directory has its group and other bits removed (fsutil.NarrowToOwner, on the opened descriptor, never following a symlink); a symlinked home, one another account owns and an absent one are left alone, and nothing below the home is walked or re-moded, because closing the home closes everything in it. A lane worktree git adds into the store is narrowed the same way after the add. Writers keep their contract that a folder they find keeps its mode; only the home itself is narrowed. Not chosen: re-moding every folder below the home, which would change folders a person may have opened deliberately and gains nothing once the home is closed.
Frontmatter
| id | dcn-2610120000000002 |
|---|---|
| type | decision |
| date | 2026-10-12 |
.abcd/work/decisions/dcn-2610120000000002-an-existing-abcd-home-is-narrowed-to-the.md
open on GitHub ↗ · commit history ↗
mentions1
- iss-2610120949163534Folders in abcd's home that an earlier abcd, a hand-run `mkdir`, or `git worktree add` created at the process umask are readable by every other account on the computer whenever the home itself is too: a home made 0755 keeps that mode, because every abcd writer leaves an existing folder's mode as it stands ([dcn-2610040000000007](../../decisions/dcn-2610040000000007-decided-without-a-question-by-abcd-50.md)). On a Mac where `~` is 0750 group staff and every local account is in staff, the other accounts can list and read `~/.abcd.noindex/{worktrees,runs,history,lifeboats,review-copies,scratch,sources,lab}` (each 0755), which hold private checkouts and session material. A lane worktree git adds into the store is 0755 whatever the store's mode.