Uh oh!
There was an error while loading. Please reload this page.
docs(web): document Windows token-file permission behavior - #428
Merged
Jason Robert (jrob5756) merged 2 commits intoAug 13, 2026
Conversation
Clarify that the 0600 mode for dashboard token files and MCP spill-dir chmod hardening are POSIX-only guarantees. On Windows, permission bits are not honored (files inherit the user-profile ACL / read-only attribute toggle instead), so this is documented rather than special- cased with a platform guard, preserving existing chmod-failure test coverage.
Fix factually-wrong and self-contradictory claims about Windows file-mode behavior introduced in the previous commit: - mcp/manager.py: the directory-hardening comment claimed Windows stat() "always" reports 0o777 (false — a read-only directory reports 0o555 per CPython's attributes_to_mode), called a chmod that toggles an attribute a "no-op", and asserted an unconditional NTFS ACL guarantee that does not hold for a user-configured spill_dir outside the temp root. Rewrote the comment to be accurate, merged the three previously separate blocks into one, made the cited test node id grep-able on a single line, and added a note that a chmod failure on Windows is a genuine anomaly, not expected noise. - mcp/manager.py: qualified _spill_full_output's docstring, which pairs the file mode with "may include secrets" without noting the POSIX-only caveat the function body now documents. - web/auth.py: qualified the module docstring's 0600 claim (previously unqualified 70 lines above the function docstring that was fixed) and hedged the ACL claim to name the actual dependency (rundir.runs_dir()); removed a duplicate, inconsistent inline comment restating the same fact as the function docstring. - docs/cli-reference.md: applied the same ACL hedge to the user-facing wording. - AGENTS.md: qualified the 0600 claim and trimmed an overlong parenthetical naming rottable test details for a fact the test file already documents. - CHANGELOG.md: qualified the unreleased #397 entry's 0600 claim. - tests/test_web/test_request_guard.py: restored the test_written_on_start_with_mode_0600 name dropped in the split, to preserve continuity with issue #425 and prior CI failure references. - tests/test_rundir_isolation.py: added a test pinning rundir.runs_dir() to Path.home()/.conductor/runs, the fact the documented Windows ACL posture rests on and which no existing test exercised directly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Jason Robert (jrob5756)
marked this pull request as ready for review
August 13, 2026 13:48
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Documents that the dashboard token file's
0600mode and the MCP spill-directory chmod hardening are POSIX-only guarantees. On Windows, permission bits aren't honored — files inherit the user-profile NTFS ACL / read-only attribute toggle instead — so this is called out in comments/docs rather than special-cased behind a platform guard, which would also skip existing chmod-failure test coverage.Closes#425