Read 3e0daee6. Correct, and verified by running the repair path rather than by reading it: a
644 file comes out 600 after write + chmodSync, where writeFileSync alone left it 644. tsgo
clean. Keeping both calls is right and the comment saying why will be what stops someone
deleting one later. No findings — that closes every part of this that is code.
The exposure itself is unchanged: the file is still 0644 and still readable by green. What
did change is that an already-deployed box now repairs itself the next time officer-agent
bootstraps, where before it would have rewritten 0644 indefinitely. So either a manual
chmod 600 or a restart closes it, whichever comes first, and it no longer depends on anyone
remembering.
Rotation is still required and still not optional. Closing the mode stops it getting worse;
it does not undo the window.
Also recorded for whoever picks this up: provisionClaudeCli and /agent-status have still never
run anywhere, and whether the installer lands a working symlink in a real member's home under
setpriv --reset-env remains the largest untested assumption in the feature, upstream of
everything built on top of it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
pastilhasandClaude Opus 5
07ab3f9e7a