From cf0a385c282846908e88324f070626d8f96510cd Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Tue, 4 Aug 2026 16:25:01 +0500 Subject: [PATCH] fix(probe): run version probe under owner-only umask The version probe runs the OpenCode binary under an isolated HOME it may write to (e.g. ~/.cache). Under an ambient umask such as 0002, the binary creates those directories group-writable, and the subsequent cleanup- object mode journaling rejects them with: cleanup object directory must have mode 0700: .../probe-home/.cache Force an owner-only umask (0o077) via preexec_fn so anything the probe creates is already mode 0700/0600 and survives the cleanup-object mode journaling, regardless of the caller's ambient umask. The journal integrity check is unchanged. --- cli-tools/nddev_opencode.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/cli-tools/nddev_opencode.py b/cli-tools/nddev_opencode.py index a0e005e..3b2078a 100755 --- a/cli-tools/nddev_opencode.py +++ b/cli-tools/nddev_opencode.py @@ -4658,6 +4658,11 @@ def run_version_probe(binary: Path, stage: Path) -> str: text=True, check=False, timeout=VERSION_PROBE_TIMEOUT_SECONDS, + # The probe binary runs under an isolated HOME it may write to + # (e.g. ~/.cache). Force an owner-only umask so anything it creates + # is already mode 0700/0600 and survives the cleanup-object mode + # journaling that follows, regardless of the caller's ambient umask. + preexec_fn=lambda: os.umask(0o077), ) output = (completed.stdout + completed.stderr).strip() if completed.returncode != 0: