fix(browse): never chmod shared, symlinked, or foreign-owned dirs to 0700

restrictDirectoryPermissions unconditionally chmodded its target. On hosts
where the process holds CAP_FOWNER (Docker as root, CI sandboxes) that
chmod SUCCEEDS on root-owned /tmp whenever a state file is configured
there (BROWSE_STATE_FILE=/tmp/x.json derives stateDir=/tmp), and a 0700
/tmp breaks access(2)-based checks machine-wide for every other process.

The POSIX branch now refuses shared sticky dirs, world-writable mounts
under root, foreign-owned dirs, and symlinked state dirs; refusals warn
once per process instead of failing silent; owned-but-unreadable dirs
keep their chmod self-repair; and the check-then-act race is closed with
fd-anchored O_NOFOLLOW + fstat/fchmod on a single inode.

Regression tests cover the sticky-dir, foreign-uid, mkdirSecure-reapply,
and symlinked-dir shapes.

browse/test/file-permissions.test.ts

@@ -72,6 +72,34 @@ describe('restrictDirectoryPermissions', () => {
     expect(fs.statSync(d).mode & 0o777).toBe(0o700);
   });
 
+  test('on POSIX, leaves a shared sticky world-writable dir untouched', () => {
+    if (process.platform === 'win32') return;
+    // Simulates /tmp: sticky + world-writable. Hardening a shared dir to
+    // 0o700 locks every other user on the machine out of it, so the helper
+    // must refuse — even when the caller owns the dir (root / CAP_FOWNER
+    // hosts are where the chmod would actually succeed).
+    const d = path.join(tmpDir, 'shared-tmp');
+    fs.mkdirSync(d);
+    // System chmod, not fs.chmodSync: Bun masks the sticky bit off chmod/
+    // mkdir modes, so 0o1777 through the fs API lands as 0o777.
+    Bun.spawnSync(['chmod', '1777', d]);
+    expect(fs.statSync(d).mode & 0o7777).toBe(0o1777); // fixture took
+    restrictDirectoryPermissions(d);
+    expect(fs.statSync(d).mode & 0o7777).toBe(0o1777);
+  });
+
+  test('on POSIX, leaves a directory owned by another user untouched', () => {
+    if (process.platform === 'win32') return;
+    const d = path.join(tmpDir, 'foreign');
+    fs.mkdirSync(d, { mode: 0o755 });
+    // Only constructible where chown to a foreign uid succeeds (root /
+    // CAP_CHOWN — containers, CI sandboxes). Elsewhere the chown throws
+    // and there's nothing to assert; bail.
+    try { fs.chownSync(d, process.getuid!() + 1, fs.statSync(d).gid); } catch { return; }
+    restrictDirectoryPermissions(d);
+    expect(fs.statSync(d).mode & 0o777).toBe(0o755);
+  });
+
   test('on Windows, does not throw on an existing directory', () => {
     if (process.platform !== 'win32') return;
     const d = path.join(tmpDir, 'subdir');
@@ -159,6 +187,23 @@ describe('mkdirSecure', () => {
     expect(() => mkdirSecure(d)).not.toThrow();
   });
 
+  test('does not chmod a pre-existing shared sticky dir (the /tmp state-dir case)', () => {
+    if (process.platform === 'win32') return;
+    // BROWSE_STATE_FILE=/tmp/foo.json derives stateDir=/tmp, and every
+    // daemon boot runs mkdirSecure(stateDir). The mkdir is a no-op on the
+    // existing dir; the permission re-apply must be one too — chmodding the
+    // real /tmp to 0o700 breaks fs.existsSync (access(2) → EACCES) for
+    // every process on the machine until something restores 1777.
+    const d = path.join(tmpDir, 'shared-tmp');
+    fs.mkdirSync(d);
+    // System chmod: Bun's fs API masks the sticky bit off modes (see the
+    // restrictDirectoryPermissions sticky-dir test).
+    Bun.spawnSync(['chmod', '1777', d]);
+    expect(fs.statSync(d).mode & 0o7777).toBe(0o1777); // fixture took
+    mkdirSecure(d);
+    expect(fs.statSync(d).mode & 0o7777).toBe(0o1777);
+  });
+
   test('on Windows, the created directory stays usable by the caller', () => {
     if (process.platform !== 'win32') return;
     // The state-dir path that broke: mkdirSecure() creates .gstack/, hardens
@@ -208,3 +253,21 @@ describe('repairBrokenDacl', () => {
     expect(() => repairBrokenDacl(path.join(tmpDir, 'nonexistent'))).not.toThrow();
   });
 });
+// Symlinked state dir (dotfiles-managed ~/.gstack via stow/chezmoi): the
+// fd-anchored path refuses to follow it (O_NOFOLLOW) — the refusal must warn,
+// never throw, and never chmod the symlink target.
+test('restrictDirectoryPermissions warns and skips a symlinked dir without throwing', () => {
+  const base = fs.mkdtempSync(path.join(os.tmpdir(), 'fp-symlink-'));
+  const target = path.join(base, 'real');
+  const link = path.join(base, 'link');
+  fs.mkdirSync(target, { mode: 0o755 });
+  fs.symlinkSync(target, link);
+  try {
+    expect(() => restrictDirectoryPermissions(link)).not.toThrow();
+    // Target permissions untouched — the link was never followed.
+    expect(fs.statSync(target).mode & 0o777).toBe(0o755);
+  } finally {
+    fs.rmSync(base, { recursive: true, force: true });
+  }
+});
+