From e553e40577077b8a7bf50f111ab941295aaf4ffc Mon Sep 17 00:00:00 2001 From: atlas Date: Thu, 4 Jun 2026 14:48:08 +0200 Subject: [PATCH] fix: soft-fail chmod in ensure_claude_dir when dir is agent-owned MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit hive-agent-user-migrate chowns the bind-mounted claude dir to the agent user on every container boot. After that, hive-core (a different user) cannot chmod it — set_permissions fails with EPERM, which was propagated as an error and caused the rebuild to fail entirely. Fix: make the chmod best-effort. Newly created dirs (owned by hive-core) get the 0755 mode set immediately; after the agent-migration chown the mode is preserved so claude_has_session works correctly. Subsequent calls that hit the EPERM path just log at DEBUG and continue. --- hive-c0re/src/lifecycle.rs | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/hive-c0re/src/lifecycle.rs b/hive-c0re/src/lifecycle.rs index dd635bf8..72821fca 100644 --- a/hive-c0re/src/lifecycle.rs +++ b/hive-c0re/src/lifecycle.rs @@ -781,11 +781,23 @@ pub fn ensure_claude_dir(claude_dir: &Path) -> Result<()> { // list the directory so `claude_has_session` can detect a valid session. // The credential files inside (`.credentials.json` etc.) are 0600 so the // secrets themselves stay private regardless of the directory mode. + // + // Best-effort: on the first container boot, `hive-agent-user-migrate` + // chowns this dir to the agent user. After that, hive-core (a different + // user) cannot chmod it — that's fine because the mode set during + // initial creation (0755) is preserved through the chown. #[cfg(unix)] { use std::os::unix::fs::PermissionsExt; - std::fs::set_permissions(claude_dir, std::fs::Permissions::from_mode(0o755)) - .with_context(|| format!("chmod 755 {}", claude_dir.display()))?; + if let Err(e) = + std::fs::set_permissions(claude_dir, std::fs::Permissions::from_mode(0o755)) + { + tracing::debug!( + path = %claude_dir.display(), + error = %e, + "ensure_claude_dir: chmod 755 skipped (dir likely owned by agent user after migration)" + ); + } } Ok(()) }