fix(cli): preserve permissions when replacing settings - #13293

[codex] Settings permission preservation — scoped E2E report

Independent test-engineer verification binds to writer blob ec85ed424d80d89b69a118a797ee2d8d38440239, which exactly matches commit b30d1cdc73dbd8aab0bf406cbc8c94b89bdf8c97. Test execution preceded the commit; no source changes occurred between verification/review and committing.

Environment: macOS arm64, UID501, Node 24.19.0; owned temporary User/Workspace/settings/runtime fixtures and fake credentials only. Umask restored to022 and fixtures cleaned. Compiled source identity was checked with parser-derived leaf tokens; three initial harness prechecks stopped before CLI execution and were corrected before the recorded28-case verification.

This verifies offline startup migration and actual compiled save helpers. It does not claim native Linux/Windows, ACL/owner identity, cross-user reads, full TUI/authenticated-provider sessions or new concurrency/failure-injection E2E runs. Parent-owned unit tests separately cover atomic-reader policy, overlapping writers, recovery and chmod failure; final exact-commit build/typecheck/bundle/test gate is recorded in the PR description. Four native Windows tests are local skips, not passed native acceptance.

[codex] Round 1 compatibility verification — 37b137ee7c0c7a5cdce9b131b3344ec5fe9543d0

Independent observer verification recorded 44 effective observations and 117 passing checks: 22 actual built User/Workspace startups (seven injected error conditions and four normal mode/umask controls per scope), 14 compiled writer/editor error controls and eight real-file special-bit controls. ENOSYS/ENOTSUP publish complete version-normalized settings; EPERM/EACCES/EIO/EROFS and code-less errors retain the exact old bytes/inode/mode and do not copy/rename. Startup still exits 0 on a refused normalization write; exit status is not used as proof of saving. Compiled helpers preserve the original error object. Real 04000/02000/01000 and combined 07640 fixtures drop special bits under both masks.

The tested working writer blob d1d7df0fbf14387e646111c28a1f639c995affeb matches this commit. Execution preceded committing; the entry bundle hash was f3f569d394960db907dbea3b8cb77ad9b69917754001a0606063f701f58e71f7. An initial Workspace injector missed /var versus /private/var; it is recorded only as an ordinary save and excluded from injection success. Corrected realpath-bound cases supply the actual injection evidence; completed User cases were not repeated. The final build/typecheck/bundle and 339 focused tests passed once on the clean committed SHA (four native Windows skips).

These are real built-CLI/compiled-API executions with narrowly injected chmod errors and native macOS positive mode controls. No native FAT/exFAT failure, Linux/Windows, ACL/owner or authenticated-provider guarantee is inferred. The attempted ExFAT image command failed at creation because its harness arguments were invalid; no image was mounted. Owned fixtures were cleaned and fs/umask restored.

中文：本轮44个有效观察、117项检查通过：22个真实User/Workspace启动、14个编译API错误对照、8个真实特殊位对照。不支持错误码可发布；权限/I/O/只读/无code错误保留原字节、inode、mode且不copy/rename；启动拒绝写入仍exit0，不把退出码当保存成功。特殊位真实存在于原文件且在两种umask下丢弃。复验writer blob与提交一致，观察先于提交。首次Workspace注入未命中仅记普通保存；修正realpath后取得有效证据，已完成User不重复。干净提交上的最终 build/typecheck/bundle 与339项定向测试已各通过一次（4项Windows跳过）。注入不代表原生FAT/exFAT或其他平台验收；镜像创建命令参数无效，未挂载。夹具及fs/umask已清理恢复。

[codex] Round 2 test-only verification - bc2d5837aa6fd37ef3b40da63b535558cfb3f117

The independent observer first pinned parent 37b137e and recorded original writer/M2 suites both green at 33/33, plus 16 real-file observations showing four actual widening cells when only creation mode is removed (ENOSYS/ENOTSUP, umask 022, original 0600/0640 -> 0644). No production file was mutated.

With the added four POSIX code-by-mask tests, the unchanged writer passes 37/37. The same isolated loader mutant passes 35 and fails only the two new 022 tests on actual staging mode 0644 versus expected 0600; its first fixture fails before the subsequent 0640 iteration, whose widening evidence comes from the separate original matrix. Original 33 and new 077 controls remain green. Real staged/target/final modes, actual chmod arguments, complete new content and cleanup are asserted. Umask is restored in finally.

Test blob 461b5eed886a4e22fec2c2604bdd7e1ae7446dad and unchanged writer blob d1d7df0fbf14387e646111c28a1f639c995affeb match the committed source. Runs preceded committing; each normal/mutant suite ran once. A raw-name property mistake in result aggregation was corrected from the existing outputs, with no rerun. Two clean self-audits and independent review passed. This is owned macOS fixture injection and regression-oracle evidence, not native FAT/exFAT/Windows or new CLI acceptance. The separate Linux container report at parent 37b137e supplies its own 221 passing assertions.

Final gate: build, typecheck and all 37 affected writer tests passed once on the clean committed SHA bc2d5837aa6fd37ef3b40da63b535558cfb3f117; reviewed/tested blobs and tree remained unchanged.

Round 3 — symlink permission boundary (47fc0cf)

Before editing, independent native macOS reproduction compared exact base576689d and reviewed bc2d writer bytes:18 real-writer observations plus2 installed-global CLI startup controls. The reviewed writer published0666 for /dev/null links and0777 for links to owned0777 referents, instead of the base's default0644/0600 under022/077. Owned referents remained unchanged. Two optional source-startup loader calls failed before product import; the old namespace rename probe produced no stage receipts, so that reproduction only claims final-mode evidence.

The fix inherits mode only for a regular entry checked without following its final link. Following directory refusal remains, and other links keep default umask publication. Independent source-bound candidate verification ran6 actual built CLI startups (User links→owned0644 / Workspace links→owned0777 under both masks, plus ordinary0600/0640 controls) and5 compiled writer native-filesystem controls (/dev/null links and new files under both masks, plus directory-link refusal). All pass with complete fake data/version4, correct staged/final modes, unchanged referents and no settings-write artifacts. The4 successful compiled controls capture native pre-rename staging; no device was modified.

Frozen candidate tests select only7 new link cases. Normal7/0; following-stat mutant3/4; omitted-regular-gate mutant1/6. The37 other tests are unselected, not native-platform skip acceptance. Most failures assert actual staged-mode broadening;0644/022 has matching default bits and instead detects the forbidden chmod attempt. Only the advertised writer gate changes in mutant arms, with test bytes frozen. Original aggregator false positives (ordinary User extension directories and Vitest unselected status) are retained and corrected from raw evidence without CLI/test reruns.

Observed writer blob278820c262dd2c03caf14b1b5aed102eece18a2f and test blob69177fca8eb86b41cc2f2038fe14f6c6cf1c5dc7, plus both designs and unchanged settings mock, match this committed fix. Source/compiled tokens, reachable bundled functions and bundle byte manifest bind the pre-commit execution; committing changed no source. Final clean-commit build/typecheck/bundle and six affected/caller test files ran once: 350 passed, 0 failed, 4 native Windows skips. ESLint, two self-audits and independent source/evidence review pass. This is native macOS arm64 evidence, not native Linux/Windows/FAT/exFAT, ACL/owner preservation, hostile races, power-loss or authenticated TUI acceptance. Earlier221 sandbox assertions belong to parent37b.

中文：第三轮修复符号链接权限边界，提交 47fc0cf。独立复现18个真实writer观察+2次全局CLI启动，确认旧bc2d会把引用目标0666/0777继承到替换文件。只对不跟随链接的普通条目继承权限，链接仍按默认umask发布，目录链接仍拒绝。复验6次实际构建后CLI启动+5个编译writer原生控制全过，完整假值/版本、暂存/最终权限、引用目标不变和清理均验证。新增7项测试正常全绿；跟随stat变异3过4失败，移除普通文件门禁1过6失败，37项仅未选择。聚合误判保留原始记录并据已有raw纠正，未重跑。所审/所测blob与本提交一致，干净提交最终检查各跑一次（350 passed, 0 failed, 4 native Windows skips）；ESLint、两次自审和独立源码/证据审查通过。证据限macOS arm64，Windows/Linux/FAT/exFAT、ACL/owner、敌对竞争、断电和认证TUI仍未验收；221项沙箱报告归父提交37b。

R4 — missing-target regression and symmetric preservation

Commit 4c8a8e1, tree 67d30b7b0befb707157265894482f9e72149d658; source writer 7f93f0154ab895e253d632d4c49d459512a13d2f, test 48c780586cdb92ab35a059e018e894a3c2c8dce5.

Independent reproduce-first work on native macOS arm64 used 20 bounded observations: two installed global CLI baselines, byte-faithful git-source arms at pre-PR 576689d / pre-R3 bc2d583 / reviewed 47fc0cf, and initially-missing controls. Actual deletion immediately after native staging-directory creation made reviewed 47fc0cf throw native lstat ENOENT and remove staging without publication; earlier arms succeeded. Existing regular modes 0666/0777/0664 are symmetrically retained by the reviewed writer, whereas pre-PR incidental umask narrowing remains a baseline difference. This supports the paired documentation decision, not a clamp.

Independent post-fix verification ran six actual built CLI startup migrations in isolated owned fixtures with fake values and no provider authentication. Four preload-instrumented cases performed a real deletion at that same staging boundary (User/Workspace × umask 022/077); native lstat returned absent, and complete values plus $version 4 published at default 0644/0600. No staged chmod, target backup-copy or leftover settings artifacts occurred. Two ordinary regular-file controls retained User 0666 / Workspace 0777 under 022. These are startup migration via --list-extensions, not dynamic calls to a saveSettings command. Original normal-control labels were preserved locally and corrected only from existing raw observations; executions were not repeated.

Two compiled-writer helper controls injected EACCES/EIO at the new lstat probe: the exact error objects propagated, while original bytes, inode and mode remained unchanged and owned staging was cleaned. These injections establish failure policy, not native access-denial/I/O-failure acceptance.

Loader traces hold test bytes fixed and mutate only the intended production expression in memory. Old 0600/0640/0644 values are unaffected by the write-bit clamp; both failures occur at the added 0666 row. Unselected tests are distinct from platform skips. Parent-run candidate writer coverage was separately 45/45. Source tokens match the compiled writer and bundled functions; the writer chunk is reachable from the actual CLI entry. All 656 recorded bundle files stayed stable. CLI entry SHA256 6009d7c65e5b0ae57b2fbb34d4bf8f12fa99517c7a17f689748f0c673d649502. All five observed/reviewed source blobs exactly match this commit. Those independent observations occurred before commit and are bound by source identity, not represented as repeated post-commit execution.

After two consecutive clean self-audits and independent source/evidence review, the clean pushed commit ran build, typecheck, bundle and six affected/caller test files exactly once: 351 passed, 0 failed, 4 native Windows platform skips. Normal writer tests include the prior unsupported chmod, symlink, directory-link, overlap, recovery and complete-byte assertions. Detailed ignored local artifacts: .qwen/e2e-tests/pr-13293-r4-reproduction.md/json, pr-13293-r4-verification.md/json, and .qwen/pr-reviews/pr-13293-r4-final-gate.json, pr-13293-r4-commit-binding.json, pr-13293-r4-independent-review.md/json.

Limits: native macOS only; deterministic scheduling proves the specific added-probe window, not field race frequency or earlier exists/stat race freedom. Error injection and loader mutation remain distinct from real native platform acceptance. No native Linux/Windows/FAT/exFAT, owner/ACL/xattr, hostile replacement/stale-inode, durability, authenticated provider session or full TUI claim. Prior Linux 221-assertion evidence is bound to 37b137e, not approval or this SHA. The documented symmetric ordinary-bit policy remains intact; unrelated shared errno refactoring and diagnostic/native-platform follow-ups remain outside this repair.

中文：R4 已复现并修复新权限探测点的缺失文件回归，双语记录已有宽权限的对称保留，并补充真实删除及普通 0666 断言。原生 macOS 4 次受控删除启动迁移、2 次普通文件启动迁移和 2 项编译 helper 错误注入均通过；三组冻结测试的正常/移除缺失保护/收窄写权限结果分别为 3/0、0/1、0/2，未选中项不是平台跳过。5 个提交源码 blob 与提交前独立观察完全一致，实际推送提交最终检查仅运行一次，351 通过、0 失败、4 项原生 Windows 跳过。普通 CLI 控制明确验证启动迁移，未动态调用直接保存命令；标签更正仅来自原始证据，无重复执行。保留自然竞态频率、原生 Linux/Windows/FAT/ACL 等未验证边界。

R6 — guarded EPERM fallback (e477bac)

Independent reproduction at 4c8a8e1 used global qwen 0.24.6 first, then exact reviewed source: controlled staged chmod EPERM made direct project saves exit 1 without changing the target, while startup exited 0 without persisting version metadata. Exact base writer controls saved without invoking chmod. All errno failures were injected on owned local macOS fixtures, not a native CIFS mount.

The actual built candidate CLI then passed 23 scenarios: direct saves and startup under equal/narrower EPERM modes; ENOSYS/ENOTSUP equivalents; all three recognized errors refusing broader staging before backup/rename; refusal against the original captured ceiling even after an injected target-mode change; EACCES/EIO propagation; and native exact ordinary modes, special-bit removal, default new-file/symlink behavior and unchanged referents. Two built-helper controls also preserve the exact injected EACCES/EIO objects. Source, entry/chunk/helper identities were stable during observation and fixtures removed. The final gate regenerated the Git version stamp; two in-memory bundle diagnostics reproduce the observed and final entry hashes solely by changing that stamp. The final entry reaches the byte-identical writer chunk and compiled helper; no post-commit CLI execution is claimed. These observations preceded commit; four observed source blobs exactly match this commit, without claiming execution of the new SHA.

The writer file passed 50/50. Frozen normal selection passed 12/12; the old writer failed 5 rows and removal of the ceiling guard failed 3 broader-mode rows, with 38 deselected tests each (not platform skips). The exact clean-commit final gate ran once: build/typecheck/bundle and six affected/caller files passed (356 passed, 0 failed, 4 native Windows skips). Two clean self-audits and independent source/evidence review bind the same blobs.

Local environment: macOS arm64/uid501/local temporary filesystem; CLI Node 22.14.0, build/final checks Node 24.19.0. Full local evidence: .qwen/e2e-tests/pr-13293-r6-cifs-chmod.md, reproduction/verification JSON, and .qwen/pr-reviews/pr-13293-r6-commit-binding.json, final-gate/final-tests/mutation-summary/self-audit/independent-review artifacts.

Maintainer native Linux CIFS, second-user and FAT/macOS observations bind the previous head and their candidate as external evidence. No local native Linux CIFS, Windows, macOS SMB, NFS, ACL/xattr or natural-race acceptance is claimed. Owner/group and symlink-managed settings follow-ups remain deferred; forced-owner vfat already failed in base.

中文：R6 在自有 macOS 夹具中通过受控 errno 注入复现 EPERM 回归；实际构建候选 CLI 的 23 项场景与 2 项 helper 检查通过。只在暂存普通权限不超出原捕获上限时容忍 ENOSYS/ENOTSUP/EPERM，更宽权限及其他错误仍拒绝发布。观察发生于提交前，4 个 blob 与提交相同，不称为新 SHA 或原生 CIFS 再跑。最终干净提交检查各执行一次（356 通过、0 失败、4 项原生 Windows 跳过）。维护者的原生平台报告为独立外部证据；身份、链接隐私、并发与额外平台验收保持延期。

Main synchronization — actual HEAD 9fa9393

Normal merge of R6 e477bac with pinned main 8648508; tree 08be8015ca4f7797ed4ae93993b6d3c578433d1e. This incorporates the lint freshness baseline that the prior run lacked. All five main-relative PR files retain the exact R6 blobs/modes, with zero incoming-path overlap; all 501 inherited paths match pinned main. Latest main at the bounded freshness recheck was 85ea235, and all eight gate files' latest changes are ancestors of this merge. That local containment proof is separate from fresh remote CI execution.

The actual clean merge commit ran its final gate once: build, typecheck, bundle and six affected/caller test files pass — 356 passed, 0 failed, 4 native Windows skips (360 total). Two clean full-diff self-audits and an independent scoped source/ownership review found no merge issue. The commit hook's re-staging step reported an ignored upstream tracked .qwen path; no tree change resulted, and this hook is not counted as a successful final gate. The independently reviewed preview and actual tree are identical.

Independent test-engineer verification executed four representative cases against the final built CLI 0.25.0 after this actual commit: controlled EPERM project save and startup version persistence succeed at 0640; controlled broader 0644 staging under EPERM refuses before backup/rename, preserving original bytes/inode/0640; native direct saving under umask 077 restores exact 0640. Successful cases retain complete fake values and publish with one rename; all settings directories contain only settings.json. Fixture directories were removed. The four scenarios are pass/fail assertions, including the expected refusal exit 1; they are not four successful publications.

Generated commit metadata 9fa9393, exact source blobs and binary hashes remained stable. Actual caller stacks bind execution to the final writer-containing chunk. CLI entry SHA256 dc8f4213d728196e00e20b0fad129fbf4baf8fa8a8689d84ca42236adafae94f; chunk-KMA5RTTK.js SHA256 c2419b9fe2e266b3daed1be6ac3c748a2ca8298b8ce7cd013dff83903248a8de; compiled helper SHA256 0a03ffdee8cd2fa366e2f0bfa0b337555b8b34b35c1e1678347e0a591499b0a6. This new observation is bound to 9fa9393; earlier R6 observations are retained as their original precommit source-bound evidence and are not retroactively labelled as runs of this merge.

Environment: owned macOS arm64/uid501 local temporary fixtures with fake values; actual CLI Node 22.14.0; final build/checks Node 24.19.0. EPERM and altered staging are controlled local injections, not native CIFS/SMB acceptance. No new native Linux/Windows/FAT/ACL, owner/group, concurrent or hostile replacement, full TUI or provider-authentication claim is made. The earlier 23-case R6 verification and old final gates were not mechanically rerun.

Local artifacts: .qwen/e2e-tests/pr-13293-main-sync-verification.md/json and .qwen/pr-reviews/pr-13293-main-sync-final-gate.json, final-tests.json, commit-binding.json, self-audit.md/json, independent-review.md/json, lint-freshness-proof.json.

中文：已正常合并 main，实际 HEAD 9fa9393/tree08be8015 保留 R6 的全部 5 个 PR 文件，上游 501 个路径精确匹配 main，无重叠。实际提交最终检查各跑一次，356 通过、0 失败、4 项原生 Windows 跳过。4 项实际最终 bundle 验证通过：EPERM 直接保存、启动版本持久化、更宽暂存权限拒绝且原字节/inode/0640 不变，以及原生 umask077 下保留0640；拒绝场景的 exit1 是预期结果，不把4项都称成功发布。源码、生成版本戳、入口/chunk/helper 身份稳定，夹具已清理；注入错误与维护者原生 CIFS 证据分开，旧 R6 观察不改称本 SHA 执行。两轮自审与独立合并审查完成，既有延期边界保持。

[codex] Fixed the conditional ENOSYS/ENOTSUP regression in 37b137ee7, addressing Stage 2 and the review. Only these two chmod error codes are tolerated. EPERM/EACCES/EIO/EROFS and unclassified errors still preserve the original and abort before backup/publication.

Added real staged/final checks for dropping setuid/setgid/sticky, and error-code regression coverage. The two unsupported-code tests fail on b30d1cd and pass after the fix. Independent built-CLI/compiled-helper verification has 44 effective observations and 117 checks pass; the final clean-commit build/typecheck/bundle and 339 focused tests passed once, with four native Windows skips. Both self-audits and independent five-file review passed, and all reviewed/tested source blobs match the pushed commit. Injection establishes the error-code contract, not native FAT/exFAT behavior.

Retaining the creation mode is useful when chmod is unsupported, avoiding a fallback to default creation permissions. Automatic tightening of legacy permissive files and writer consolidation remain separate maintainer policy/scope decisions. This PR retains the existing-permissions contract and adds no ACL/owner or sandbox authorization changes.

中文：条件性不支持错误回归已修复并推送；仅放行 ENOSYS/ENOTSUP，其他权限、I/O、只读和无分类错误继续保全原件。补充特殊位丢弃与错误边界测试；独立44个有效观察、117检查和干净提交上的最终门禁均通过。注入不代表原生FAT/exFAT验收；保留创建mode，历史宽权限自动收紧与writer合并另由维护者决定。

@qwen-code /triage

[codex] Review round 1 is pushed as 37b137ee7. Please reassess the current HEAD; the earlier CHANGES_REQUESTED reviewed b30d1cd.

Validation: 23 baseline injection observations; two unsupported-code tests red on b30d1cd, then green. Independent verification: 44 effective observations/117 checks pass, including 22 actual User/Workspace startups, 14 compiled writer/editor controls and eight actual special-bit fixtures. Startup exit 0 is not evidence of a successful save: refusal is verified from unchanged bytes/inode/mode and absent copy/rename. Final build, typecheck, bundle and 339 focused tests passed once on the clean pushed commit; four native Windows tests skipped. Two clean self-audits and independent full five-file review passed, with exact source-blob binding. The E2E report has the current round appended.

Post-reply query at the pushed HEAD: 0 inline threads total, 0 unresolved; resolved 0/0 because feedback was top-level. The older CHANGES_REQUESTED is awaiting fresh assessment. No CI retry was used. Fixes #13287. Refs #12417; #13288/#13290 remain separate.

中文：第一轮已推送，申请基于当前HEAD复审。修复不支持chmod的窄例外并补特殊位真实断言；保留创建mode和已有权限策略，自动收紧与writer合并延期。44个有效观察/117检查、自审和独立审查通过，干净提交上一次最终build/typecheck/bundle及339项测试通过（4项Windows跳过）。原生FAT/exFAT、新HEAD平台CI和Windows ACL仍未由本地注入证明；没有使用CI重跑预算。

CI diagnostic after the push: Assign PR owner run 37127785761 fails at checkout, before owner-assignment code. The trusted base 576689d workflow requests file paths in sparse-checkout while default cone mode treats them as directories: .github/issue-owners.json is not a directory (exit 128). None of this workflow/config is changed by this PR. This is a deterministic trusted-base CI configuration failure, not a transient chmod/test failure; no rerun or unrelated workflow change was made. The bounded post-push snapshot has 9 passed, 14 pending and this one failed check; the previous-SHA requested-changes review is awaiting the requested fresh triage.

Hourly check at 2026-10-03 16:24 UTC: the requested re-triage job failed to produce a review because the model API connection timed out (ETIMEDOUT / ENETUNREACH). The direct job log identifies a network/API infrastructure failure; it does not report a new code finding. The workflow verify job completed successfully, but its report publication is still queued, so that success is not being treated as a published acceptance report. The separate automatic PR review is currently running. Current HEAD remains 37b137e with 0 unresolved inline threads. The owner-assignment checkout failure remains the same known unrelated configuration issue. No source changes, duplicate review replies, final-gate reruns or workflow retries were made; the watcher has not recommended a retry and the per-SHA retry budget remains 0/3. Hourly follow-up continues.

[codex] Fixed F1 in the published verification report. Added a POSIX regression oracle for ENOSYS/ENOTSUP under umask 022/077 with explicit 0600/0640 targets, checking the staged and published permissions. The production writer already kept the creation mode; this test-only round pins that fallback. Fixed in bc2d5837a.

F2 is valid as a startup observability concern: migration persistence catches the write failure and the debug logger returns without an active session. Deferring that product behavior to a separate follow-up because this PR preserves permission bits and deliberately propagates genuine chmod failures; explicit settings saves already rethrow. F3 remains an unverified native Windows read-only interaction, with no observed new defect to fix here. F4 is an incomplete-mock condition, not a production Stats value; the existing mock fidelity change is retained. No owner/ACL/xattr or sandbox authorization changes are proposed.

Independent oracle: normal 37/37 passed; removing only creation mode leaves the original 33 green but makes exactly the two added 022 cases red (real staged 0644 versus expected 0600). The 077 cases remain correct controls. Both self-audits and independent review passed; reviewed/tested blobs match the commit. The earlier report-only aggregation error was corrected from saved raw evidence without repeating tests.

Final gate: build, typecheck and all 37 affected writer tests passed once on the clean committed SHA bc2d5837aa6fd37ef3b40da63b535558cfb3f117; reviewed/tested blobs and tree remained unchanged.

[codex] Review round 2: the permission-ceiling test gap from the published sandbox report is addressed in bc2d5837aa6fd37ef3b40da63b535558cfb3f117.

Independent evidence: original suite 33/33 green with both real writer and mode-removal mutant; 16 real-file observations independently expose four mutant 022 widening cells. Added tests: unchanged writer 37/37 green, same isolated mutant 35/37 with exactly the two new 022 tests red on real staged 0644 versus expected 0600. The two 077 controls and original 33 remain green. The failing mutant tests stop at their first 0600 fixture; the separate original matrix supplies the 0640 widening witnesses. A report postprocessor field error was corrected from the saved raw outputs without repeating either suite.

Two clean self-audits and independent five-file review bind to the committed test blob 461b5eed886a4e22fec2c2604bdd7e1ae7446dad; writer blob d1d7df0fbf14387e646111c28a1f639c995affeb is unchanged. The earlier Linux container report's 221 assertions concern parent 37b137e, not a new run of this test-only commit, and are advisory evidence rather than approval. Injected chmod errors do not claim native FAT/exFAT or Windows read-only/ACL acceptance. Fixes #13287. Refs #12417; #13288/#13290 remain separate.

中文：第二轮只补不支持 chmod 时的权限上限回归测试。正常 37 项全过，移除创建 mode 的变异恰好使新增两个 022 场景失败，原 33 项及 077 控制仍通过；真实 0640 放宽证据由独立原始矩阵提供。生产代码与双语设计不变，启动诊断延期、Windows 只读场景仍未验证、mock 缺 mode 不是生产输入。两轮自审和独立审查通过，源码绑定精确提交；Linux 221 项断言明确归于父提交，不当作新提交批准。

Final gate: build, typecheck and all 37 affected writer tests passed once on the clean committed SHA bc2d5837aa6fd37ef3b40da63b535558cfb3f117; reviewed/tested blobs and tree remained unchanged.

Post-reply query on the pushed HEAD: 0 inline threads total, 0 unresolved; resolved 0/0 because this report was top-level. No flaky retry used. New-commit CI is being checked once before the next hourly follow-up.

[codex] Review batch 3: fixed the symlink permission regression in 47fc0cf.

Validation: focused44/44 and ESLint passed; independent native macOS observations and exact-source oracle evidence are summarized below. Both designs now state the ordinary-file/symlink boundary. Existing R2 F2 diagnostics deferral, F3 Windows readonly uncertainty and F4 mock-only disposition are unchanged.

Independent native macOS verification passed six built CLI startups and five compiled writer/filesystem controls, with unchanged referents and correct actual staged/final modes. The seven new link tests pass normally; following-stat mutation gives 3 passes/4 failures and omitting the regular-file gate gives 1 pass/6 failures (37 other tests unselected). Raw aggregation corrections required no CLI/test reruns.

The clean committed build/typecheck/bundle and affected/caller test gate ran once: 350 passed, 0 failed, 4 native Windows skips. Source blobs reviewed and observed before committing match this commit. This change does not add directory permissions, link following writes, owner/ACL/xattr preservation, adversarial race protection, or sandbox authorization. The original broader-mode difference is confirmed;0755 traversal alone does not establish permission to plant directory entries.

Threads: resolved 1/1 addressed inline thread; 0 unresolved threads remain.

[codex] R4 feedback addressed and pushed in 4c8a8e1.

Independent native macOS verification: four actual built CLI startup migrations with deterministic real deletion (User/Workspace × umask 022/077) publish complete values and version metadata at 0644/0600, without chmod, backup-copy or leftover staging. Two regular-file startup migration controls retain 0666/0777. Two compiled-helper EACCES/EIO injections still propagate the exact errors and preserve original bytes/inode/mode. Those two normal controls exercise startup migration, not a direct saveSettings command; the initial labels are preserved locally and were corrected from existing raw data without reruns.

The three selected normal tests pass; removing the missing-entry option fails the new deletion case, and clamping write bits fails the two mode loops at 0666. Unselected cases are not platform skips. Prior unsupported-chmod and symlink fixes remain intact. After two consecutive clean audits and independent source/evidence review, the clean commit passed build, typecheck, bundle and six affected/caller files exactly once: 351 passed, 0 failed, 4 native Windows skips. All five observed/reviewed source blobs match this commit; independent CLI observations preceded commit and were not rerun on the new SHA.

Scope remains ordinary POSIX mode preservation, including already permissive regular files; no owner/ACL/xattr, stale-inode/hostile race, sandbox authorization or unrelated settings fixture changes. No native Windows/Linux/FAT/ACL acceptance is claimed. The earlier 221-assertion Linux sandbox report belongs to 37b137e and is not approval or a run of this SHA. Existing diagnostic and native read-only follow-ups remain separate. New CI/review must still finish; no automatic merge.

Thread handling: resolved 2/2 addressed threads; 0 unresolved threads remain, confirmed by a complete GraphQL snapshot.

中文：已批量修复新增探测点的缺失文件回归，补齐宽权限对称保留的双语决策和断言。原生 macOS 受控删除与启动迁移验证通过；最终提交检查 351 项通过、0 失败、4 项 Windows 原生测试跳过。独立观察发生在提交前，源码 blob 与本提交完全一致，未冒充新 SHA 重跑。保留 Fixes #13287 与 Refs #12417，#13288/#13290 独立跟进；继续每小时核对新 CI 与评审。

[codex] R5 review disposition at 4c8a8e12b1cb038d4ff854a9cf1a419798c2c064. This batch records three Suggestions from review 5406624403. After approximately five feedback rounds, repository policy limits further changes to Critical fixes. Independent source review and bounded observations found no new Critical within the explicitly accepted scope, so these items are deferred separately below.

Evidence is eight native owned-fixture observations over exact Git source: six deterministic staging-window A/B observations and two gid/mode observations. No second UID performed a read or startup; EACCES/exit-52 consequences are source-based, conditional inferences, not executed acceptance. Parent gid and egid were both 20, so this fixture does not distinguish their inheritance mechanisms. No natural race frequency, attacker exploit, Linux/Windows/FAT/ACL behavior or whole-platform suite is claimed.

Source, tests and tracked designs are unchanged. The existing once-only final gate for this exact commit remains 351 passed, 0 failed and 4 native-Windows skips; it was not rerun. Earlier unsupported-chmod, stable-symlink and missing-at-probe fixes remain present. The previously recorded errno-helper and optional probe-comment Suggestions remain deferred. The review runner's platform/integration gaps and unattributed settings-fixture failures are not promoted to new PR defects or acceptance evidence.

Thread handling: all three newly replied Suggestion threads are resolved with explicit deferral records (3/3); remaining unresolved threads: 0. Resolution records disposition, not a code fix or review approval.

中文：本批次为第五轮反馈处置，源码、测试与已跟踪设计均未修改，未重复最终检查。三条建议分别延期：旧设计的双语修订与互链；并发替换/改权限时的元数据快照契约；组身份及多用户访问策略。后两项属于已明确排除的并发修改与 owner/group 范围，独立源码审查未确认新的范围内 Critical。

独立原生 macOS 观察共 8 项，仅使用自有假数据夹具；确认了替换窗口中的 mode 差异和 gid/mode 组合变化。未由第二用户执行读取或启动，也未测自然竞态频率、攻击利用或其他原生平台，因此不把条件推导写成实测 EACCES/exit-52 验收。原有私有权限修复、默认新文件策略和显式边界保持。CI 无失败，旧 CHANGES_REQUESTED 仍等待维护者新的审查结论；不会自动合并。

Maintainer verification: real-environment A/B at 4c8a8e12b1

Verdict: the core fix works as described on macOS and on native Linux, including against a real second local user. I found one new regression outside the covered matrix: on Linux CIFS/SMB shares mounted root-owned (no uid=), head refuses settings saves that base completes (F1). A small tested candidate fix is below. I recommend fixing F1 before merge. R3-3 and the symlink residual are reasonable follow-ups.

Both arms are real npm run bundle builds of the same checkout and differ only in packages/cli/src/utils/write-with-backup.ts, which I confirmed in the bundled chunk. base uses the merge-base 576689d073 writer. head is 4c8a8e12b1. Each case runs the shipped CLI through two entry points:

• qwen --list-extensions: startup normalization, which adds $version.
• qwen mcp add -s user|project: the direct saveSettings path. The PR's own evidence covered only the startup path.

Fixtures contain only a fake env.MY_TOKEN.

Results

F1: Root-owned CIFS/SMB mounts reject every settings write (new regression)

Setup. A Linux project sits on an SMB share mounted the common fstab way, without uid= (file_mode=0777,dir_mode=0777). Files appear owned by root. The user can create and rename them. However, chmod on a file the user just created returns EPERM, even when the mode is unchanged.

What happens:

• qwen mcp add -s project …: base exits 0. Head exits 1 with EPERM: operation not permitted, chmod '…/settings.json.write-XXXX/settings.json.tmp', and the settings stay unchanged.
• Startup normalization: head exits 0 but never writes $version. The error only goes to the debug log, so the write is retried on every launch.
• Control: with uid=alice on the same share, both arms pass.

I reproduced this three times: two matrix runs and the screenshot run.

Why base works. fs.copyFileSync (libuv uv_fs_copyfile) also fchmods its destination. On Linux, libuv deliberately ignores that EPERM when the destination is on SMB/SMB2/CIFS (libuv v1.52.1 src/unix/fs.c L1340-L1353); f_type here is 0xFE534D42 (smb2). The new chmodSync tolerates only ENOSYS/ENOTSUP, so the save now fails one step before the backup copy, which would have succeeded.

Candidate fix (tested). On ENOSYS/ENOTSUP/EPERM, publish only when the staged file grants nothing beyond the captured mode. The staged file is created with mode, so it gets mode & ~umask; on POSIX filesystems the check therefore always holds. A filesystem that ignores the creation mode and reports broader bits still refuses. This also makes the unsupported-chmod path verify the "never broader than the existing file" property instead of assuming it.

Candidate results:

• On root-owned CIFS, mcp add exits 0 and startup writes $version, matching base.
• All 32 macOS cases and all 15 Linux head cases give identical results to head, so the privacy fix is kept.
• The PR suite passes 46/46 with the test update below.
• Mutation checks: dropping the subset guard fails only the new "refuses EPERM when broader" test. Head source with the new tests fails only the EPERM publish row.
• eslint, prettier and tsc --noEmit (cli) are clean.

diff --git a/packages/cli/src/utils/write-with-backup.ts b/packages/cli/src/utils/write-with-backup.ts
@@ -92,11 +92,15 @@ export function writeWithBackupSync(
       try {
         fs.chmodSync(tempPath, mode);
       } catch (error) {
-        // Filesystems without POSIX permissions may not support chmod.
+        // Filesystems without POSIX permissions may not support chmod, and
+        // root-owned CIFS/SMB mounts reject it with EPERM (libuv's copyfile
+        // tolerates that too). Publish only when the staged entry grants
+        // nothing beyond the existing permissions.
+        const code =
+          error instanceof Error && 'code' in error ? error.code : undefined;
         if (
-          !(error instanceof Error) ||
-          !('code' in error) ||
-          (error.code !== 'ENOSYS' && error.code !== 'ENOTSUP')
+          (code !== 'ENOSYS' && code !== 'ENOTSUP' && code !== 'EPERM') ||
+          (fs.statSync(tempPath).mode & 0o777 & ~mode) !== 0
         ) {
           throw error;
         }
diff --git a/packages/cli/src/utils/write-with-backup.test.ts b/packages/cli/src/utils/write-with-backup.test.ts
@@ -87,8 +87,8 @@ describe('writeWithBackup', () => {
-  it.each(['ENOSYS', 'ENOTSUP'])(
-    'publishes when chmod is unsupported (%s)',
+  it.each(['ENOSYS', 'ENOTSUP', 'EPERM'])(
+    'publishes when chmod is unsupported or refused (%s)',
@@ -265,7 +265,29 @@ describe('writeWithBackup', () => {
-    it.each([undefined, 'EPERM', 'EACCES', 'EIO', 'EROFS'])(
+    it('refuses EPERM when the staged file is broader than the target', () => {
+      nativeFs.writeFileSync(targetPath, 'old');
+      nativeFs.chmodSync(targetPath, 0o600);
+      // Simulates a filesystem that ignores the requested creation mode.
+      vi.mocked(fs.writeFileSync).mockImplementation((file, data, options) => {
+        nativeFs.writeFileSync(file, data, options);
+        nativeFs.chmodSync(file as string, 0o644);
+      });
+      const failure = Object.assign(new Error('chmod failed'), {
+        code: 'EPERM',
+      });
+      vi.mocked(fs.chmodSync).mockImplementation(() => {
+        throw failure;
+      });
+
+      expect(() => writeWithBackupSync(targetPath, 'new')).toThrow(failure);
+      expect(fs.readFileSync(targetPath, 'utf8')).toBe('old');
+      expect(fs.statSync(targetPath).mode & 0o777).toBe(0o600);
+      expect(fs.readdirSync(tempDir)).toEqual(['settings.json']);
+      expect(fs.renameSync).not.toHaveBeenCalled();
+    });
+
+    it.each([undefined, 'EACCES', 'EIO', 'EROFS'])(
       'preserves the target when staging chmod fails (%s)',

Other observations

• R3-3 now confirmed with a real second user (not previously executed). The file is 0640 alice:devs in a plain directory, umask 022.

  • base republishes it as 0644 alice:alice. carol keeps access only because everyone can now read the file.
  • head republishes it as 0640 alice:alice, and carol (in devs) gets Permission denied.
  • In a setgid directory, head keeps alice:devs and carol can read. Under umask 077, base also locks carol out.

  This seems an acceptable trade: the only access lost came from world-readability. It deserves one sentence in the design doc but is not blocking.

• Symlinked (dotfile-managed) settings still become world-readable after a save, in both arms. A link to a 0600 referent is replaced by a regular 0644 file that contains the secret, on both macOS and Linux; on Linux, bob reads it. This is the documented default for links and not a regression. It does mean fix(cli): preserve private settings permissions during rewrites #13287's privacy goal does not cover dotfile-managed settings. A possible follow-up: inherit the referent's mode capped at the default (referent & 0o666 & ~umask). That keeps 0600 private without reopening R1-1's widening.

• Forced-owner vfat already fails in base. On vfat uid=0,umask=000, base fails at the backup copy (Failed to backup existing file: EPERM … copyfile, because libuv ignores the error only on CIFS/SMB) and head fails at chmod. Startup normalization silently fails in both arms. quiet and uid=alice mounts pass in both. This is not a regression from this PR.

• macOS FAT32/exFAT (fskit msdos/exfat, noowners): chmod succeeds without effect and new files report 0700. Behavior does not change.

Not covered

• Native Windows. PR CI does not run the Windows leg. From reading the source, the code there only toggles the read-only attribute, and a read-only target fails rename in both arms; I did not execute this.
• The macOS SMB client (smbfs), NFS root_squash/all_squash, and ACL/xattr preservation.

Merge note

reviewDecision is CHANGES_REQUESTED because of the bot's rounds on b30d1cdc / bc2d5837. Only an APPROVE from the bot itself, a dismissal of those reviews, or a human approval clears it.

[codex] @wenshao Fixed F1 in e477bac. The chmod fallback now accepts ENOSYS/ENOTSUP/EPERM only when the staged file’s reported ordinary bits are a subset of the originally captured mode; broader stages and unrelated errors still refuse before backup/publication.

Independent reproduction confirmed the EPERM save/startup regression at 4c8a8e1 using owned macOS fixtures and controlled errno injection. The actual candidate bundle passed 23 CLI scenarios (including direct project saves and startup normalization) plus 2 built-helper error-identity controls. Your native Linux CIFS observations remain separately attributed external evidence; these local observations preceded commit, with the same four source blobs, and are not described as a new-SHA native CIFS run. The exact clean-commit build/typecheck/bundle/six-file gate passed once: 356 passed, 0 failed, 4 native Windows skips. Frozen tests also detect the old EPERM path and removal of the mode ceiling. Two clean self-audits and independent source/evidence review found no further in-scope Critical.

The confirmed group-reader identity and symlink-managed settings residuals remain follow-ups as recorded in R5; no chown or broader-readable fallback is added. Historical design clarification and concurrent metadata policy also remain deferred. Forced-owner vfat already failing in base, silent chmod on FAT/exFAT, and native Windows/macOS SMB/NFS/ACL acceptance are not claimed fixed or locally verified here.

Reply to #13293 (comment).

[codex] R6: address the maintainer’s in-scope EPERM save regression in e477bac.

Validation: actual built CLI 23 scenarios + 2 helper checks, 50 writer tests; frozen normal 12 pass, old-head 5 expected failures, omitted guard 3 expected failures (38 deselected each). Exact final commit gate: build/typecheck/bundle and six affected/caller files, 356 passed, 0 failed, 4 native Windows skips. Two clean self-audits and independent source/evidence review complete. CLI evidence was observed before commit; all four source blobs match. Native Linux CIFS is maintainer evidence, not a local run of this commit. R6 came through a top-level comment, so there are no new inline threads to resolve; previous 6/6 threads remain resolved, 0 unresolved.

CI will be checked once after the push. A clean local gate and our response do not replace maintainer approval; the old CHANGES_REQUESTED disposition still requires a new approval or dismissal. Existing deferred items are recorded in the R5 summary.

Post-push bounded snapshot: OPEN/MERGEABLE/BLOCKED, old CHANGES_REQUESTED awaiting new maintainer approval; all 6 threads resolved, 0 unresolved. The full rollup has 8 success, 8 skipped, 18 pending, 1 failure. The Lint job failed at “Check lint gate freshness”, before dependency install/ESLint/Prettier: main's lint gate commit 6b878e1a04ec is not incorporated in this branch. The API containment compare confirms divergence. This is deterministic and no flaky retry was recommended or spent (0/3). Per the one-round schedule, the next hourly run will safely synchronize main and validate the resulting commit. This is separate from the passed R6 local gate above.

中文：推送后完整快照为 8 成功、8 跳过、18 等待、1 失败，PR 开放且可合并，仍等待新批准，6/6 线程已解决、剩余 0。Lint 在实际 lint 前被基线规则过期门禁拒绝；下一小时安全同步 main 后重新验证实际提交。未消耗重跑预算，仍为 0/3。

[codex] Main synchronization pushed in 9fa9393 (parents: R6 e477bac and main 8648508). The lint freshness failure occurred before dependency installation or actual lint execution; this normal merge incorporates the updated gate without changing settings-permission logic or bypassing lint rules.

The four CLI cases ran on owned macOS fixtures using Node 22.14.0; errno/mode changes were controlled simulations, not native CIFS acceptance. Final build/tests used Node 24.19.0. Prior R6 observations retain their original precommit/source binding and are not reclassified as runs of this merge. Detailed evidence is appended to the existing E2E report.

Threads: no new inline discussions; the existing 6/6 remain resolved, 0 unresolved. CI completion and our comments do not replace maintainer approval; the old CHANGES_REQUESTED review still needs a new approval or dismissal.

中文：已正常合并 main 并推送 9fa9393，修复实际 lint 前的基线过期门禁，不手改 lint 规则。5 个 PR 文件与 R6 完全一致，上游 501 个路径均匹配 main、无重叠；实际合并提交最终检查各跑一次，356 通过、0 失败、4 项原生 Windows 跳过。4 项实际构建后 CLI 代表性验证通过，错误注入与原生 CIFS 证据分开记录。旧 F1 回复不重复，现有 6/6 讨论已解决、剩余 0；原延期项保持延期，等待新 HEAD 的 CI 和维护者批准。

[codex] R7 disposition for review 5419097471. No new in-scope Critical was verified; both new Suggestions are deferred under the repository's convergence rule. HEAD remains 9fa93938de90e19fb69e68c815882547dc067c1d (tree 08be8015ca4f7797ed4ae93993b6d3c578433d1e). There is no source/test edit, commit, push, gate repetition, or CI rerun in this batch.

The two new observations used the existing exact-bound compiled helper on macOS arm64/Node 22.14.0/uid501: controlled chmod EPERM followed by real staged unlink/native stat ENOENT, and controlled chmod EPERM followed by controlled staged-stat EIO with the stage retained. In both, the exact stat error escapes, original bytes/inode/0640 remain unchanged, no backup/rename occurs, and staging is removed. This is diagnostic-boundary evidence, not native CIFS acceptance, a CLI run, or a code fix.

The existing 356 passed / 4 native Windows skips result belongs to the six affected/caller test files run once on clean 9fa93938; the prior four actual final-CLI observations retain their original binding. They neither claim whole-repository coverage nor close the missing caller-unit assertions. The reviewer's differently scoped suite counts, skipped test legs and inconclusive probe are separate evidence, not our final gate or approval.

This round's complete GH rollup snapshot has 30 SUCCESS, 27 SKIPPED, 0 waiting and 0 failed; the earlier watcher separately reported 29 passed/0 waiting/0 failed. The PR is OPEN/MERGEABLE/BLOCKED with the prior CHANGES_REQUESTED awaiting a new maintainer approval or dismissal. No flaky retry was used (current SHA 0/3, history preserved). Resolving these discussions records their explicit deferral, not a claim that the gaps were fixed. Hourly bounded monitoring continues; the PR will not be auto-merged.

中文：R7 两条新建议已逐条核实并回复延期：暂存权限探测的原异常诊断，以及 settings/JSONC 层的权限回归断言。未确认新的范围内 Critical；仅补充两项自有 macOS helper 诊断边界观察，原文件内容/inode/0640 保持、未备份或发布、暂存清理；这是受控注入及真实 unlink 后的原生 ENOENT，非原生 CIFS、CLI 验收或代码修复。已有六文件 356 通过/4 Windows 跳过及四项真实最终 CLI 观察保持原绑定，与复审者不同范围的测试结果分开。本轮不改代码、不重跑 gate/CI，线程解决仅记录延期；完整快照 CI 无失败，仍待维护者新的批准/撤销旧 CHANGES_REQUESTED，继续每小时有界检查，不自动合并。

Maintainer re-verification (R2) at 9fa93938de

Verdict: F1 is fixed. I verified it natively on the same root-owned CIFS mount. A chmodSync trace shows the new fallback branch working as designed, including a native refusal of a broader staged mode on vfat. Every R1 matrix reproduces case-for-case, and I found no new issue. From a verification standpoint this is ready to merge. The deferred suggestions (R3-3, symlinked settings, R4-1, R4-2) remain follow-ups.

What changed since R1:

• e477bac4b9:
  • When chmod fails with ENOSYS/ENOTSUP/EPERM, the writer now publishes only if the staged file's ordinary permission bits are within the captured mode (R1 candidate semantics).
  • New tests cover the EPERM rows and broader-stage refusal for all three codes.
  • Both design notes are updated.
• 9fa93938de: merges main. git show --remerge-diff is empty, and the five PR files are byte-identical to e477bac4b9.

The arms are built the same way as in R1. Both are real npm run bundle builds of 9fa93938de (CLI 0.25.0). base swaps in the merge-base 864850816e writer, which is identical to R1's base writer. head is unmodified. I confirmed that the head chunk contains the EPERM code and the & ~mode guard, and that base has no chmodSync.

Results

The R1 figures (macOS matrix, Linux second user) still describe this head exactly, because every case repeated with identical results.

Notes

• The fix also applies the subset check to ENOSYS/ENOTSUP, which earlier assumed the creation mode was honored. That makes the "never broader than the existing file" property checked rather than assumed, and the new refusal rows pin it.
• R4-1 (a failing staged-mode stat masks the chmod error): agree it is non-blocking. The path still fails closed, and in every CIFS/vfat run here the probe succeeded. Reporting the original error is a diagnostics follow-up.
• R4-2 (no permission assertions at the settings layer): agree it is a follow-up. The end-to-end runs above exercise both settings-layer callers (startup normalization and saveSettings via mcp add) on real filesystems, but they don't replace unit coverage there.
• R3-3 (group identity) and the symlinked-settings residual are unchanged from R1 and remain deferred as recorded.

Not covered

Same as R1: native Windows, the macOS SMB client (smbfs), NFS squash modes, and ACL/xattr preservation.

Merge note

The remaining blocker is procedural. reviewDecision is still CHANGES_REQUESTED from the bot's rounds on b30d1cdc / bc2d5837. It needs a human approval, or a dismissal of those reviews.

@qwen-code /triage