Skip to content

fix: warn on writable provider-state ancestors#43

Merged
aksOps merged 1 commit into
mainfrom
agent/warn-writable-provider-state
Jul 13, 2026
Merged

fix: warn on writable provider-state ancestors#43
aksOps merged 1 commit into
mainfrom
agent/warn-writable-provider-state

Conversation

@aksOps

@aksOps aksOps commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

What changed

  • downgrade group/other-writable provider-state ancestors from a blocking error to a structured warning
  • emit the warning once per ancestor to avoid refresh-driven log churn
  • retain fail-closed ownership, symlink, file-type, and UAM-owned mode checks
  • update OpenCode and OMP integration coverage for managed 0775 environments

Why

Some managed Linux and macOS systems provision home or XDG state ancestors as 0775 and do not allow users to change those permissions. UAM previously prevented provider dispatch entirely in those environments.

Validation

  • go test -race -count=1 -covermode=atomic -coverpkg=./... ./...
  • coverage: 88.4%
  • go vet ./...
  • staticcheck ./...
  • golangci-lint run ./...
  • gosec ./...
  • govulncheck ./...
  • Linux amd64 and Darwin amd64/arm64 builds

@aksOps aksOps merged commit 148022c into main Jul 13, 2026
16 checks passed
@aksOps aksOps deleted the agent/warn-writable-provider-state branch July 13, 2026 03:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant