From c6da56b1d830f70e7f665c7cb62845fc383e7e93 Mon Sep 17 00:00:00 2001
From: Levi Neely <141506390+lneely@users.noreply.github.com>
Date: Tue, 19 May 2026 15:56:26 +0200
Subject: [PATCH] perms: session tools (s/{sid}/t/) are owner-only (0700)

Prevents agents from accessing other sessions' tools.
---
 server.go | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/server.go b/server.go
index 1da87a6..8222995 100644
--- a/server.go
+++ b/server.go
@@ -1637,7 +1637,7 @@ func (s *Server) makeStat(path string) plan9.Dir {
 		if strings.HasPrefix(path, "/s/") {
 			parts := strings.SplitN(strings.TrimPrefix(path, "/s/"), "/", 3)
 			if (len(parts) == 2 && parts[1] == "t") || (len(parts) == 3 && parts[1] == "t") {
-				mode = plan9.DMDIR | 0777
+				mode = plan9.DMDIR | 0700
 			} else {
 				mode = plan9.DMDIR | 0555
 			}
@@ -1677,9 +1677,9 @@ func (s *Server) makeStat(path string) plan9.Dir {
 			} else if strings.HasPrefix(path, "/s/") {
 				parts := strings.SplitN(strings.TrimPrefix(path, "/s/"), "/", 3)
 				if len(parts) == 3 && parts[1] == "t" && parts[2] == "idx" {
-					mode = 0444
+					mode = 0400
 				} else if len(parts) == 3 && parts[1] == "t" {
-					mode = 0777
+					mode = 0700
 				} else {
 					mode = 0444
 				}