feat(storage): enforce_private_permissions opt-out for trusted-group shared databases (#252)

Author: ualtinok

CONFIGURATION.md

@@ -26,6 +26,20 @@ So memories you write in OpenCode appear in Pi sessions for the same project (an
 
 For semantic search to work cross-harness, both plugins resolve embedding config per project identity on every retrieval path. OpenCode and Pi can run in the same process against different projects without sharing one process-global embedding provider. For one project, keep the effective `embedding` block consistent across the OpenCode and Pi config stack; Magic Context tags stored vectors with the resolved model identity and clears stale vectors for that project when the provider/model changes.
 
+### Trusted-group shared storage
+
+By default, Magic Context enforces owner-only `0700` storage directories and `0600` storage files. For a deliberate Unix deployment where trusted users share one store and an operator manages permissions externally, set this **in user config only**:
+
+```jsonc
+{
+  "storage": {
+    "enforce_private_permissions": false
+  }
+}
+```
+
+For example, the operator may maintain the storage directory as `2770` and `context.db`, `context.db-wal`, and `context.db-shm` as `0660` for a trusted Unix group. With this setting disabled, Magic Context never re-tightens directory, database, WAL/SHM, model-cache, or RPC-file permissions; missing paths are still created using the operator's umask. Every group member that can read this store can read **all** stored session content and memories, so use this only for a deliberately trusted group. On Windows, POSIX modes are not meaningful, so the setting has no effect.
+
 ### JSON Schema
 
 Add `$schema` to your config file for autocomplete and validation in VS Code and other editors:
@@ -121,6 +135,7 @@ Higher-tier models with longer cache windows benefit from a longer TTL. Setting
 | `keep_subagents` | `boolean` | `false` | Debug: keep the child sessions Magic Context spawns for its own subagents (historian, dreamer, sidekick, memory-migration) instead of deleting them on success, so their full transcript stays in the host session store for inspection. Kept sessions accumulate until cleared manually — leave `false` for normal use. |
 | `todowrite` | `object` | See below | **Pi only.** Controls Magic Context's built-in `todowrite` tool and persistent task overlay. OpenCode has its own built-in `todowrite`, so this setting has no effect there. |
 | `sqlite` | `object` | See below | Per-connection SQLite tuning for Magic Context's own `context.db`. |
+| `storage.enforce_private_permissions` | `boolean` | `true` | User-config-only. Keep owner-only `0700` directories and `0600` files. Set `false` only for an externally managed trusted-group deployment; Magic Context will never re-tighten storage permissions. |
 
 ### `fail_closed_blocking`
 

assets/magic-context.schema.json

@@ -1259,6 +1259,20 @@
         }
       }
     },
+    "storage": {
+      "default": {
+        "enforce_private_permissions": true
+      },
+      "description": "Storage permission policy. The default keeps session content and memories owner-private. Disabling enforcement is for trusted shared-group storage managed externally; every group member able to read the storage can read all stored session content and memories.",
+      "type": "object",
+      "properties": {
+        "enforce_private_permissions": {
+          "default": true,
+          "description": "When true (default), Magic Context creates and re-tightens its storage directories to owner-only 0700 and storage files to owner-only 0600. Set false only for a deliberate trusted-group deployment whose operator manages directory, database, WAL/SHM, cache, and RPC file permissions externally; Magic Context then never chmods or supplies restrictive creation modes. USER-LEVEL ONLY — ignored in project config for security. On Windows, POSIX chmod modes are already meaningless, so this setting is a no-op.",
+          "type": "boolean"
+        }
+      }
+    },
     "embedding": {
       "description": "Embedding provider configuration",
       "type": "object",

packages/docs/src/content/docs/reference/configuration.md

@@ -23,7 +23,7 @@ Add the schema line for editor validation and autocomplete:
 ```
 
 :::note
-Project-level configs cannot use `{env:VAR}` / `{file:path}` expansion. A cloned repository also cannot set `sqlite.*`, hidden-agent prompts/permissions, `historian.model`, or `historian.fallback_models`. Project `execute_threshold_percentage` / `execute_threshold_tokens` may only RAISE thresholds relative to the user's effective settings (a repo may delay compaction, not make it happen earlier). Dreamer model/schedule/task tuning and `memory.enabled` remain allowed project overrides.
+Project-level configs cannot use `{env:VAR}` / `{file:path}` expansion. A cloned repository also cannot set `sqlite.*`, `storage.enforce_private_permissions`, hidden-agent prompts/permissions, `historian.model`, or `historian.fallback_models`. Project `execute_threshold_percentage` / `execute_threshold_tokens` may only RAISE thresholds relative to the user's effective settings (a repo may delay compaction, not make it happen earlier). Dreamer model/schedule/task tuning and `memory.enabled` remain allowed project overrides.
 :::
 
 ## Top-level switches
@@ -250,6 +250,8 @@ Behavior tuning most installs never need to touch.
 | `sqlite` | object | — | SQLite connection tuning for Magic Context's own context.db. These are per-connection PRAGMAs applied at open; they do not change the schema or what is stored. |
 | `sqlite.cache_size_mb` | number (2–2048) | `64` | Page-cache size in MiB per connection (PRAGMA cache_size). Larger keeps more hot pages resident, cutting re-reads on repeated full-table scans. (min 2, max 2048, default 64) |
 | `sqlite.mmap_size_mb` | number (0–8192) | `0` | Memory-mapped I/O size in MiB (PRAGMA mmap_size). 0 disables mmap (SQLite default). Raising it can cut read overhead on large DBs at the cost of address space. (min 0, max 8192, default 0) |
+| `storage` | object | — | Storage permission policy. The default keeps session content and memories owner-private. Disabling enforcement is for trusted shared-group storage managed externally; every group member able to read the storage can read all stored session content and memories. |
+| `storage.enforce_private_permissions` | boolean | `true` | When true (default), Magic Context creates and re-tightens its storage directories to owner-only 0700 and storage files to owner-only 0600. Set false only for a deliberate trusted-group deployment whose operator manages directory, database, WAL/SHM, cache, and RPC file permissions externally; Magic Context then never chmods or supplies restrictive creation modes. USER-LEVEL ONLY — ignored in project config for security. On Windows, POSIX chmod modes are already meaningless, so this setting is a no-op. |
 
 ## Other
 

packages/pi-plugin/src/config/index.test.ts

@@ -168,6 +168,29 @@ describe("loadPiConfig", () => {
 		expect(result.loadedFromPaths).toEqual([userPath]);
 	});
 
+	it("honors user storage permissions while ignoring a project-tier override", () => {
+		const cwd = makeTempRoot("mc-pi-cwd-");
+		const home = makeTempRoot("mc-pi-home-");
+		withHome(home);
+		writeUserConfig(
+			home,
+			JSON.stringify({ storage: { enforce_private_permissions: false } }),
+		);
+		writeProjectConfig(
+			cwd,
+			JSON.stringify({
+				storage: { enforce_private_permissions: true, futureSibling: 1 },
+			}),
+		);
+
+		const result = loadPiConfig({ cwd });
+
+		expect(result.config.storage.enforce_private_permissions).toBe(false);
+		expect(result.warnings.join("\n")).toContain(
+			"storage.enforce_private_permissions",
+		);
+	});
+
 	it("merges user then project with project overrides winning", () => {
 		const cwd = makeTempRoot("mc-pi-cwd-");
 		const home = makeTempRoot("mc-pi-home-");

packages/pi-plugin/src/index.ts

@@ -93,6 +93,7 @@ import { setKeepSubagents } from "@magic-context/core/shared/keep-subagents";
 import { log } from "@magic-context/core/shared/logger";
 import { isSaneLimit } from "@magic-context/core/shared/models-dev-cache";
 import { resolveFallbackChain } from "@magic-context/core/shared/resolve-fallbacks";
+import { setStoragePrivatePermissionEnforcement } from "@magic-context/core/shared/storage-permissions";
 
 import { handlePiCloneSessionStart } from "./clone-inheritance";
 import {
@@ -721,6 +722,20 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 	markPiMagicContextActive();
 	beginBootQuietPeriod();
 
+	// Resolve the user-tier storage policy before opening the shared database.
+	// Project config cannot alter it, so every project in this process shares the
+	// operator's chosen owner-private or externally managed permission policy.
+	const bootProjectDir = process.cwd();
+	ensureConfigLocationsMigrated(bootProjectDir);
+	const bootConfig = loadPiConfig({ cwd: bootProjectDir });
+	setStoragePrivatePermissionEnforcement(
+		bootConfig.config.storage.enforce_private_permissions,
+	);
+	setSqlitePragmaConfig({
+		cacheSizeMb: bootConfig.config.sqlite.cache_size_mb,
+		mmapSizeMb: bootConfig.config.sqlite.mmap_size_mb,
+	});
+
 	const storageDir = getMagicContextStorageDir();
 	const dbPath = join(storageDir, "context.db");
 
@@ -894,10 +909,13 @@ async function startPiMagicContextRuntime(
 		dedupe: true,
 	});
 
-	// Pi opens the shared DB before config is available (above), so apply the
-	// configured SQLite tuning to the already-open connection now. cache_size /
-	// mmap_size take effect live; future opens in this process pick them up via
+	// Reapply boot-resolved storage and SQLite settings in case config changed
+	// between the initial open and runtime registration. cache_size / mmap_size
+	// take effect live; future opens in this process pick them up via
 	// setSqlitePragmaConfig.
+	setStoragePrivatePermissionEnforcement(
+		config.storage.enforce_private_permissions,
+	);
 	setSqlitePragmaConfig({
 		cacheSizeMb: config.sqlite.cache_size_mb,
 		mmapSizeMb: config.sqlite.mmap_size_mb,

packages/pi-plugin/src/subagent-entry.ts

@@ -56,6 +56,7 @@ import type { ContextDatabase } from "@magic-context/core/features/magic-context
 import { openDatabase } from "@magic-context/core/features/magic-context/storage-db";
 import { setHarness } from "@magic-context/core/shared/harness";
 import { log } from "@magic-context/core/shared/logger";
+import { setStoragePrivatePermissionEnforcement } from "@magic-context/core/shared/storage-permissions";
 import { loadPiConfig } from "./config";
 import { ensureProjectRegisteredFromPiDirectory } from "./embedding-bootstrap";
 import { registerMagicContextTools } from "./tools";
@@ -81,20 +82,20 @@ export default function magicContextSubagentExtension(pi: ExtensionAPI): void {
 
 	pi.on("session_start", async () => {
 		try {
+			// Load shared config before opening storage so a trusted-group deployment
+			// never has its externally managed permissions re-tightened by a child.
+			const directory = process.cwd();
+			const { config: cfg } = loadPiConfig({ cwd: directory });
+			setStoragePrivatePermissionEnforcement(
+				cfg.storage.enforce_private_permissions,
+			);
 			const db = openDatabase();
 			if (!db) {
 				throw new Error(
 					"storage open failed; refusing to start without Magic Context tools",
 				);
 			}
 			openedDb = db;
-
-			// Load shared config so embedding settings + memory enabled
-			// flag match the parent's runtime. Subagent doesn't honor
-			// historian/dreamer/sidekick blocks at all (those are
-			// parent-only concerns).
-			const directory = process.cwd();
-			const { config: cfg } = loadPiConfig({ cwd: directory });
 			await ensureProjectRegisteredFromPiDirectory(directory, db);
 			const dreamerActionsEnabled =
 				pi.getFlag(SUBAGENT_DREAMER_ACTIONS_FLAG) === true;

packages/plugin/scripts/build-config-docs.ts

@@ -142,6 +142,7 @@ const SECTION_ORDER: Array<{ keys: string[]; title: string; intro: string }> = [
             "caveman_text_compression",
             "system_prompt_injection",
             "sqlite",
+            "storage",
         ],
         title: "Advanced",
         intro: "Behavior tuning most installs never need to touch.",
@@ -245,7 +246,7 @@ Add the schema line for editor validation and autocomplete:
 \`\`\`
 
 :::note
-Project-level configs cannot use \`{env:VAR}\` / \`{file:path}\` expansion. A cloned repository also cannot set \`sqlite.*\`, hidden-agent prompts/permissions, \`historian.model\`, or \`historian.fallback_models\`. Project \`execute_threshold_percentage\` / \`execute_threshold_tokens\` may only RAISE thresholds relative to the user's effective settings (a repo may delay compaction, not make it happen earlier). Dreamer model/schedule/task tuning and \`memory.enabled\` remain allowed project overrides.
+Project-level configs cannot use \`{env:VAR}\` / \`{file:path}\` expansion. A cloned repository also cannot set \`sqlite.*\`, \`storage.enforce_private_permissions\`, hidden-agent prompts/permissions, \`historian.model\`, or \`historian.fallback_models\`. Project \`execute_threshold_percentage\` / \`execute_threshold_tokens\` may only RAISE thresholds relative to the user's effective settings (a repo may delay compaction, not make it happen earlier). Dreamer model/schedule/task tuning and \`memory.enabled\` remain allowed project overrides.
 :::
 
 ${sections.join("\n\n")}

packages/plugin/src/config/index.test.ts

@@ -355,6 +355,16 @@ describe("loadPluginConfig — secret redaction", () => {
         expect(result.embedding.endpoint).toBe("https://embeddings.example/v1");
     });
 
+    it("honors user storage permissions while ignoring a project-tier override", () => {
+        const result = loadWithUserAndProjectConfig(
+            JSON.stringify({ storage: { enforce_private_permissions: false } }),
+            JSON.stringify({ storage: { enforce_private_permissions: true, futureSibling: 1 } }),
+        );
+
+        expect(result.storage.enforce_private_permissions).toBe(false);
+        expect(result.configWarnings?.join("\n")).toContain("storage.enforce_private_permissions");
+    });
+
     it("ignores embedding destination fields from untrusted project config", () => {
         const userConfig = JSON.stringify({
             embedding: {

packages/plugin/src/config/project-security.test.ts

@@ -59,6 +59,28 @@ describe("stripUnsafeProjectConfigFields", () => {
         expect(warnings.some((w) => w.includes("sqlite"))).toBe(true);
     });
 
+    it("strips storage.enforce_private_permissions from project config (only-key case)", () => {
+        const raw: Record<string, unknown> = {
+            storage: { enforce_private_permissions: false },
+        };
+
+        const warnings = stripUnsafeProjectConfigFields(raw);
+
+        expect(raw.storage).toEqual({});
+        expect(warnings.some((w) => w.includes("storage.enforce_private_permissions"))).toBe(true);
+    });
+
+    it("strips storage.enforce_private_permissions but keeps a sibling key", () => {
+        const raw: Record<string, unknown> = {
+            storage: { enforce_private_permissions: false, futureSibling: 1 },
+        };
+
+        const warnings = stripUnsafeProjectConfigFields(raw);
+
+        expect(raw.storage).toEqual({ futureSibling: 1 });
+        expect(warnings.some((w) => w.includes("storage.enforce_private_permissions"))).toBe(true);
+    });
+
     it("strips Pi subagent extension allowlists from project config", () => {
         const raw: Record<string, unknown> = {
             pi: { subagent_extensions: ["./repo-controlled-extension.ts"] },

packages/plugin/src/config/project-security.ts

@@ -198,6 +198,10 @@ function makeProjectThresholdWarning(field: string, reason: string): string {
  *    process). A cloned repo could set a huge value to exhaust host memory /
  *    address space — a resource-exhaustion vector with no legitimate per-repo
  *    use. Honor user-level config only.
+ *  - `storage.enforce_private_permissions` — changing a shared store from
+ *    owner-private to group-readable changes every session and memory's local
+ *    confidentiality. Only the machine operator's user config may opt into an
+ *    externally managed trusted-group deployment.
  *  - `embedding.endpoint` / `embedding.provider` — a repo must not choose
  *    where private memory/search/commit text is embedded. User-level config is
  *    the trust boundary for embedding destinations.
@@ -256,6 +260,17 @@ export function stripUnsafeProjectConfigFields(projectRaw: Record<string, unknow
         );
     }
 
+    // storage.enforce_private_permissions is USER-tier only because disabling it
+    // changes the confidentiality of the process-global shared store. Field-scoped
+    // stripping preserves future project-tier storage settings in the same block.
+    const storage = projectRaw.storage;
+    if (isPlainObject(storage) && "enforce_private_permissions" in storage) {
+        delete storage.enforce_private_permissions;
+        warnings.push(
+            "Ignoring storage.enforce_private_permissions from project config (security: only user-level config may opt into externally managed shared storage permissions).",
+        );
+    }
+
     const pi = projectRaw.pi;
     if (isPlainObject(pi) && "subagent_extensions" in pi) {
         delete pi.subagent_extensions;