[627150795]

Problem

Closes #908. Session worktree snapshots apply a tracked-file Git patch after creating a detached checkout. Under umask 077, Git can apply the executable mode as 0700, dropping group and other execute bits from tracked scripts.

Value

Session worktrees preserve executable tracked files under restrictive POSIX umasks, so scripts remain runnable by the intended users.

Approach

• Collect 100755 paths from the snapshot's temporary Git index.
• After checkout and patch application, restore missing execute bits on POSIX while preserving the file's other permission bits.
• Add regression coverage for explicit umask 022 and umask 077; restore the process umask in finally.
• Keep Windows behavior unchanged and do not modify the process umask in production.

Validation

Integration refresh — 2026-11-07

Current head: 034032bf1511c7b575258766ba0246405c94a6ca, based on main e01230cef711acbef704fc18cad20bf68aa701ac after #905 and #719. The original two-file patch is unchanged. Its complete source tree (d447bfa0e7443e63a88fc9f54a9c7dbd86617f91) exactly matches the validated integration candidate; only its parent/commit identity changed when #719 was squashed.

• Native macOS review: all 27 session-worktree tests passed. The strict-umask regression fails against the pre-fix implementation. Independent probes cover committed, modified and newly added executables, nonexecutables, and symlinks under umasks 022 and 077; existing read/write permissions remain intact.
• Frozen locked Pi 1.2.0, Node 26.12.0, Bun 1.3.14: full bun run check passed and left no tracked build changes.
• Full test runner's Node phase passed: 2,465 passed / 8 platform skips / 0 failed. The orchestration interruption left its UI phase without a final receipt; a separate bun run test ui then passed all 108 files / 1,632 tests. These results cover both suites, without claiming the interrupted combined invocation exited successfully.
• git diff --check passed. Current-head CI run 42259471021 passed all 19 jobs, including Pi minimum/latest, Linux/Windows runtime and UI, both Web E2E shards and provider handoff, installation smokes, and aggregate gates. Previous CI below is historical.
• No live interactive Pi/Web or live-provider smoke was repeated.

Prior contributor evidence

Historical validation against previous PR head 831318dd280d1d9d4a1611541855d17620046c35.

• POSIX regression integration: node --test --experimental-strip-types tests/web/session-worktree.test.ts — 27/27 passed on Linux/WSL with Node 22.19.0.
• PiWebRuntime fork integration: 1/1 passed using the real Pi runtime with the fixture provider.
• bun run check — passed with Node 22.19.0 and Bun 1.3.14.
• VITEST_MAX_WORKERS=1 bun run test — passed: Node 2,428 passed / 8 platform skips; Vitest 1,623 passed across 107 files. The worker cap accounts for WSL reporting 24 parallel CPUs despite lower effective throughput; no project test configuration was changed.
• GitHub Actions run 40803485954 — not green: 13 checks passed, 3 failure entries (one root Web E2E shard and two aggregate checks), and 2 downstream checks were cancelled. The root failure timed out in the unrelated tests/web/openpi-web.e2e.ts unknown-prompt-admission case after the “send as new message” button stayed disabled for 30 seconds. GitHub rerun requires repository admin rights; the local retry could not start because Chromium is absent from the WSL Playwright cache.
• git diff --check — passed.
• A disposable POSIX Git-patch reproduction confirmed 100644 → 100755 produces 0700 under umask 077 and 0755 under umask 022 before the fix.
• A live interactive Pi/Web smoke was not run. The POSIX regression and PiWebRuntime integration tests exercise the affected worktree-fork path; no user Pi installation or configuration was changed.

Impact

• User-visible behavior: tracked executable files retain all execute bits in POSIX session snapshots created under strict umasks.
• Model-visible context/tools: None.
• Runtime/lifecycle: POSIX snapshot file permissions only. The process umask and Windows behavior are unchanged.
• Persisted config/data: None.
• Compatibility/risk: Only tracked paths represented by Git mode 100755 receive execute-bit restoration.

[tt-a1i]

Reviewed 831318d. No blocking code findings. Executable paths are taken from the frozen temporary index; permission restoration preserves existing read/write bits and excludes symlinks.

Independent macOS validation passed all 27 session-worktree tests. The strict-umask regression fails against the pre-fix runtime, and separate probes cover committed, changed, newly added executable files, nonexecutables, and symlinks under umasks 022 and 077. This approval records code review only: the branch still needs its base refreshed and current CI gates satisfied before merge.