{"record":{"id":"61ae6ac21ae2cd22","repo":"coleam00/Archon","slug":"detached-run-control-directory-must-have-mode-0700","errorCode":null,"errorMessage":"Detached run control directory must have mode 0700: ${directory}","messagePattern":"Detached run control directory must have mode 0700: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"packages/cli/src/utils/detached-run-control.ts","lineNumber":68,"sourceCode":"}\n\nfunction controlDirectory(): string {\n  const uid = process.getuid?.();\n  const directory =\n    process.platform === 'win32'\n      ? join(tmpdir(), 'archon-run-control')\n      : `/tmp/archon-${uid === undefined ? 'user' : String(uid)}`;\n  mkdirSync(directory, { recursive: true, mode: 0o700 });\n  if (process.platform !== 'win32') {\n    const stat = lstatSync(directory);\n    if (!stat.isDirectory() || stat.isSymbolicLink()) {\n      throw new Error(`Detached run control path is not a directory: ${directory}`);\n    }\n    if (uid !== undefined && stat.uid !== uid) {\n      throw new Error(`Detached run control directory is owned by another user: ${directory}`);\n    }\n    if ((stat.mode & 0o077) !== 0) {\n      throw new Error(`Detached run control directory must have mode 0700: ${directory}`);\n    }\n  }\n  return directory;\n}\n\n/** Prove the marked POSIX owner has the process group that active cancellation will signal. */\nexport function assertDetachedRunProcessOwner(): void {\n  if (process.platform !== 'win32' && !processGroupExists(process.pid)) {\n    throw new Error(\n      `Refusing detached run control because process ${String(process.pid)} does not own process group ${String(process.pid)}`\n    );\n  }\n}\n\n/** A bounded, user-scoped endpoint: Unix socket on POSIX, named pipe on Windows. */\nexport function detachedRunControlPath(runId: string): string {\n  const token = endpointToken(runId);\n  if (process.platform === 'win32') return `\\\\\\\\.\\\\pipe\\\\archon-workflow-${token}`;","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/coleam00/Archon/blob/0773b9745896ef0612e709c80845a0f7db315b19/packages/cli/src/utils/detached-run-control.ts#L50-L86","documentation":"controlDirectory() enforces that the detached-run control directory has mode exactly 0700 on POSIX ((stat.mode & 0o077) must be 0). A looser mode would let other local users read or interfere with run-control files, so the runtime refuses to proceed. mkdirSync uses mode 0700, so this error means the directory pre-existed with permissive bits or its mode was changed afterwards.","triggerScenarios":"lstatSync shows group/other permission bits set on the control directory (e.g. 0755) when resolving a detached-run control path or lock path on POSIX.","commonSituations":"Directory created earlier by an older version or different tool with a umask that yielded 0755; admin manually chmod'd the tmp dir; some provisioning step set a permissive umask before creation.","solutions":["Tighten the mode: chmod 700 /tmp/archon-<uid>.","If unsure of its provenance and no run is active, remove it (rm -rf) and let Archon recreate it with 0700.","Check your umask / provisioning scripts so the directory is not recreated group/world-readable."],"exampleFix":"// before\n$ ls -ld /tmp/archon-1000\ndrwxr-xr-x\n// after\n$ chmod 700 /tmp/archon-1000","handlingStrategy":"validation","validationCode":"import { lstatSync } from 'node:fs';\nfunction modeIsPrivate(dir: string): boolean {\n  try { return (lstatSync(dir).mode & 0o077) === 0; }\n  catch { return true; }\n}\nif (!modeIsPrivate('/tmp/archon-' + (process.getuid() ?? 'user'))) {\n  require('node:fs').chmodSync(dir, 0o700);\n}","typeGuard":null,"tryCatchPattern":"try {\n  const dir = controlDirectory();\n} catch (err) {\n  if (err instanceof Error && err.message.includes('must have mode 0700')) {\n    chmodSync(expectedControlDir, 0o700); // then retry\n  } else throw err;\n}","preventionTips":["Run with a umask like 077 when automation creates tmp dirs.","Never chmod the control directory to group/world-readable.","Periodically verify tmp-dir permissions in hardened environments."],"tags":["security","filesystem","posix","permissions"],"backgroundTag":"insecure-directory-permissions","analyzedSha":"0773b9745896ef0612e709c80845a0f7db315b19","analyzedAt":"2026-09-01T02:28:07.064Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}