Host files take the ambient umask: team state, Bot memory, chat index and OCR cache are world-readable, and a rewrite widens a 0600 #2697

Written-by: Chief

The host's own files are created with whatever umask the process inherited — no mode is passed anywhere on these paths, and the repository never sets a umask. On a stock login/desktop umask of 022 that is 0644 for the files and 0755 for the directories, so every other local account can read the saved team, Bot memories, the decision log and a cache of the user's images. Worse, an atomic rewrite widens a file the owner deliberately narrowed: a 0600 MEMORY.md comes back 0644 after the next remember.

This is not a uniform hole — the repository already hardens several writers (state.journal and the trace segments are 0700/0600, workflow-store.js:249 passes a mode, the secrets and social credential writers are 0600). The host's own state, memory and cache writers are the ones that were missed.

Reproduction (main e3e488d3c5fccd553760130e940707a568ffa12c)

/data/dsh/bot/workspace/audit43/audit43.test.mjs and audit43-verify.test.mjs, against the real modules in a scratch home, umask 022 set in-process:

• B (the widening case): the owner chmod 0600s MEMORY.md; after the next remember it is 0644 again — the write creates a new file with the ambient mode and the owner's decision is gone, silently.
• D (counter-check): the same writes under umask 077, or under a 0700 ancestor, are 0600/0700 and unreadable to others. That is why this box does not reproduce it: its umask is 077 and /data/dsh is 0700. The deployment is not this box.

Blocked, for the record: a symlink planted at the state.json.<pid>.tmp temp name refuses the save (Not saved: … is not a plain file of its own, target untouched) — the temp-name check holds, so this is a permission defect, not a redirect.

Why it matters

The files that are exposed are exactly the private ones: a group's messages, every Bot's memory notes, every conversation part (indexed), project decisions and the OCR text of the user's images. On a shared machine — a workstation with more than one account, a container with a shared volume — another account reads all of it with cat. And the widening case means a user cannot fix it by hand: the next write undoes the chmod.

Expected

Every host-owned file that carries a user's content is created with an explicit 0600 and its directory with 0700, independent of umask; a rewrite keeps the mode the existing file already has (atomic replace through a temp file must chmod the temp to the old mode before the rename, never widen it); the SQLite index is tightened right after it is created. Public/computed content may keep the ambient mode, but that should be a decision in the code, not a default. One small helper in core/src/host/ used by these writers beats a mode repeated at each call site.

Change scope

core/src/host/memory.js, core/src/host/store.js (home mkdir, state.json), the chat-index writer, core/src/host/resume.js (inflight.json — same shape, listed as unproven: it could not be shown to carry another person's message), the project-state decisions.jsonl writer, the OCR cache writer, plus tests that assert the mode under umask 022. docs/subsystems/core-host.md states the invariant if it belongs there.