{"record":{"id":"ccc44722133ea84f","repo":"alibaba/open-code-review","slug":"chmod-config-w","errorCode":null,"errorMessage":"chmod config: %w","messagePattern":"chmod config: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"cmd/opencodereview/provider_cmd.go","lineNumber":432,"sourceCode":"\n\tfmt.Printf(\"\\nModel set to: %s\\n\", selectedModel)\n\treturn nil\n}\n\nfunc saveConfig(path string, cfg *Config) error {\n\tdir := filepath.Dir(path)\n\tif err := os.MkdirAll(dir, 0o755); err != nil {\n\t\treturn fmt.Errorf(\"create config dir: %w\", err)\n\t}\n\tdata, err := json.MarshalIndent(cfg, \"\", \"    \")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"marshal config: %w\", err)\n\t}\n\tif err := os.WriteFile(path, data, 0o600); err != nil {\n\t\treturn fmt.Errorf(\"write config: %w\", err)\n\t}\n\tif err := os.Chmod(path, 0o600); err != nil {\n\t\treturn fmt.Errorf(\"chmod config: %w\", err)\n\t}\n\treturn nil\n}\n\nfunc maskKey(key string) string {\n\tif key == \"\" {\n\t\treturn \"(not set)\"\n\t}\n\tif len(key) <= 8 {\n\t\treturn \"***\"\n\t}\n\treturn key[:4] + \"***\" + key[len(key)-4:]\n}\n\n// validateBaseURL checks that a provider Base URL has an http or https scheme\n// and a non-empty host, giving the user immediate feedback rather than\n// a runtime failure when the LLM client tries to use it.\nfunc validateBaseURL(raw string) error {","sourceCodeStart":414,"sourceCodeEnd":450,"githubUrl":"https://github.com/alibaba/open-code-review/blob/5cf97d0d15cbd41b602513c4be3bfec3cee5bf7f/cmd/opencodereview/provider_cmd.go#L414-L450","documentation":"After writing the config file, saveConfig calls os.Chmod(path, 0o600) to guarantee owner-only permissions on systems where umask may have relaxed them; failure is wrapped as \"chmod config\". The file is already written successfully at this point, so this is a hardening step, not a data-integrity failure.","triggerScenarios":"os.Chmod fails after a successful write — typically on filesystems that do not support permission changes (some network mounts, FAT/exFAT, certain Windows configurations) or when ownership changed mid-operation.","commonSituations":"Config stored on an NFS/SMB share or a Windows drive where chmod is unsupported or returns an error; container volumes mounted with restrictive options.","solutions":["Verify the config file exists and is owned by the current user","Move the config to a local POSIX filesystem that supports chmod","If the filesystem cannot support permissions, verify the file already has 0600 via its mount options and treat this as environmental","Check the wrapped inner error for the exact errno"],"exampleFix":"// before: config on an exFAT mount\nOCR_CONFIG=/mnt/usb/ocr/config.json ocr config set provider openai\n// error: chmod config: ... operation not supported\n// after\nOCR_CONFIG=~/.config/ocr/config.json ocr config set provider openai","handlingStrategy":"try-catch","validationCode":"// verify chmod is supported on the target volume before saving\nif err := os.Chmod(path, 0o600); err != nil {\n    fmt.Fprintf(os.Stderr, \"warning: cannot enforce 0600 on %s: %v\\n\", path, err)\n}","typeGuard":null,"tryCatchPattern":"if err := saveConfig(path, cfg); err != nil {\n    if strings.Contains(err.Error(), \"chmod config\") {\n        fmt.Fprintln(os.Stderr, \"config saved but permissions could not be tightened; move config to a local POSIX filesystem\")\n        return nil\n    }\n    return err\n}","preventionTips":["Store config on a local POSIX filesystem rather than network/exFAT mounts","Verify the saved file is 0600 after writes when handling secrets (API keys)","Check mount options if chmod consistently fails"],"tags":["filesystem","permissions","chmod"],"backgroundTag":"chmod-unsupported-filesystem","analyzedSha":"5cf97d0d15cbd41b602513c4be3bfec3cee5bf7f","analyzedAt":"2026-09-02T02:08:09.116Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}