fix: validate private state before access

[mldangelo-oai]

Summary

Make unsafe output-parent errors actionable and validate configured state paths before state-backed operations access data.

The existing ancestry restriction is intentional: a private child can still be renamed or replaced through a writable, non-sticky parent. This change keeps that protection in place.

Changes

• Include the offending parent's octal permission mode and safe recovery guidance in the existing error.
• Require an existing state root to be private to the current user, while retaining the sticky-bit exception for trusted parent directories.
• Check lexical symlink paths and their targets before selecting state, including the direct workbench entry point. Preserve trusted aliases and non-mutating validation of missing paths.
• Apply state validation to history, authentication, and publication entry points. Keep the validated canonical state location for each operation.
• Create missing state directories one component at a time with private permissions, including under restrictive umasks, and check the workbench's canonical directory before opening SQLite. Preserve ownership-specific recovery guidance.
• Add synthetic regression tests for state privacy, path aliases, early rejection, and local CLI error handling. Simplify the CLI test to inject its typed error directly.
• Document the separate output, persistent-state, and temporary-directory settings.

This complements the overlap checks in #418. The structured-error work in #463 addresses a separate concern.

Testing

• Focused shared-state, publication, direct-workbench, history-preflight, and compact-MCP regressions passed.
• bun test --randomize --seed 12345: 1,323 passed, 11 skipped, 0 failed.
• pnpm run test: 1,323 passed, 11 skipped, 0 failed.
• pnpm run types, pnpm run format, Ruff lint on the changed Python script, and git diff --check: passed.

An unchanged login-cleanup test timed out in an earlier full run. It passed in isolated checks on the earlier revisions and in both final full runs. No authentication cleanup code was changed.

Risk and rollout

Existing state roots with group or other permissions, including older 0755 directories, now fail state-backed operations. Use a dedicated private state directory, or correct its permissions only when it is yours and safe to change. New workbench state is created privately. The existing global output-ancestry rules are unchanged, and POSIX ownership and mode checks remain platform-gated. The new validation does not change existing state or parent permissions, silently relocate explicit paths, or migrate history or credentials. No dependency or release change is included.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

@codex review

Please review commit 8f4c05113d6b4dc7e7a3b4df642c899d3fe3da0f.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: 8f4c05113d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 8f4c05113d

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8f4c05113d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

@codex review

Please review the current head: 5254d5f.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: 5254d5fcf0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 5254d5fcf0

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.