Files
orca/src/main/ssh
JinjingandNeil 0a5a7b1446 fix(orcad): run the remote daemon at the login umask so worktrees it creates are not owner-only (#31135)
* fix(orcad): run the remote daemon at the login umask so worktrees it creates are not owner-only (#31125)

* fix(orcad): keep refreshed Gemini OAuth tokens owner-only now that orcad runs at the login umask

The Gemini usage fetcher rewrote ~/.gemini/oauth_creds.json through a temp file and rename with
no mode, so the replacement took the process umask. Under the old inherited umask 077 that
happened to be 0600 on SSH hosts; at the login umask it would be 0644. Write it through
writeCredentialFileAtomic (0600 staging file, owner-only ACL on Windows).

The hostile-host matrix now checks that the deployed orcad runs at the SSH login's umask and that
its readiness file stays 0600.

* fix(orcad): keep rewritten agent configs at their mode and create the launch PID file owner-only

writeHooksJson now keeps an existing config's mode unless a caller opts out. Rewriting
~/.claude/settings.json (which can hold API keys) and the other agent configs through a temp file
used to take the process umask; inside orcad that was 077, and at the login umask it would widen an
owner-only file to 0644.

The launch runs `umask 077` in the foreground shell rather than inside the backgrounded nohup
list, so the PID file the foreground writes is created 0600 instead of relying on a racing chmod.

The Gemini credential test now pins umask 022 rather than inheriting the runner's.

* fix(agent-hooks): do not create a read-only temp file for a read-only Windows config

A preserved Windows mode can be read-only, which would leave an undeletable temp file behind when
the rename fails. POSIX keeps the preserved mode.

---------

Co-authored-by: Neil <neil@stably.ai>
2026-10-20 13:39:32 -07:00
..