fix(workspace): keep state.db's umask permissions when building via mkstemp (#954)

mkstemp forces 0600 and os.replace preserves it, so the transactional-init
change silently tightened state.db from the umask-derived mode sqlite used to
create it (0644 on a stock 0022 umask). That is an unrequested behavior change
that could break a shared-group deployment. Reproduce a normal file creation
instead — permissions are not this change's business.

Author: frankbria

codeframe/core/workspace.py

@@ -988,6 +988,14 @@ def create_or_load_workspace(repo_path: Path, tech_stack: Optional[str] = None)
     os.close(fd)
     tmp_db = Path(tmp_name)
     try:
+        # mkstemp forces 0600 and os.replace preserves it, which would silently
+        # tighten state.db from the umask-derived mode sqlite used to create it.
+        # Reproduce a normal file creation instead — permissions are not this
+        # change's business.
+        umask = os.umask(0)
+        os.umask(umask)
+        os.chmod(tmp_db, 0o666 & ~umask)
+
         # mkstemp already created an empty file; sqlite is happy to build into it.
         _init_database(tmp_db)
 

tests/core/test_atomic_writes_954.py

@@ -363,6 +363,25 @@ def test_workspace_init_fsyncs_the_state_dir_after_the_rename(tmp_path, monkeypa
     assert str(repo / ".codeframe") in synced
 
 
+def test_state_db_keeps_normal_create_permissions(tmp_path):
+    """Building via mkstemp must not silently tighten state.db to 0600.
+
+    mkstemp forces 0600 and os.replace preserves it; sqlite used to create the
+    file with the process umask. Permissions are not this change's business.
+    """
+    from codeframe.core import workspace as ws
+
+    repo = tmp_path / "repo"
+    repo.mkdir()
+    ws.create_or_load_workspace(repo)
+
+    umask = os.umask(0)
+    os.umask(umask)
+    expected = 0o666 & ~umask
+    actual = (repo / ".codeframe" / ws.STATE_DB_NAME).stat().st_mode & 0o777
+    assert actual == expected, f"expected {oct(expected)}, got {oct(actual)}"
+
+
 def test_an_existing_workspace_is_still_loaded_not_rebuilt(tmp_path):
     from codeframe.core import workspace as ws