copilot-swe-agent[bot] 1b8d8e670d fix: enforce 0o600 permissions on sensitive files by unlinking before write ... Unlink any existing file before writing in writeFileWithMode so the mode option is always applied on fresh file creation (Node.js ignores mode for existing files). This prevents inheriting wrong permissions on Docker bind-mount filesystems such as Synology NAS where ACLs can cause SSH key files to be created with 755 instead of 600. The fs.unlink error is only swallowed for ENOENT (file doesn't exist); other errors (e.g. EPERM) propagate as before. The chmod call is kept as an additional safety net against umask effects. A test for the new-file creation case is added alongside the existing existing-file rewrite test. Agent-Logs-Url: https://github.com/mowdep/zerobyte/sessions/2a4ab129-9668-402e-8687-d792f9b9e704 Co-authored-by: mowdep <10937987+mowdep@users.noreply.github.com>		2026-05-10 22:08:51 +00:00
..
contracts	refactor: move backup path resolution into agent contract (#872)	2026-05-10 21:46:03 +02:00
core	fix: enforce 0o600 permissions on sensitive files by unlinking before write	2026-05-10 22:08:51 +00:00