[shunk031]

Trigger

A user reported mode flipping on another Mac when public and private chezmoi apply runs manage the same directories.

Change

• Add a focused Bats regression test that starts ~/.codex at mode 0755, copies the public private_dot_codex source entry, creates a minimal private-source fixture, and applies public → private → public to an isolated destination, asserting mode 0700 after every pass.
• The minimal source avoids resolving unrelated external templates during this directory-only check. The initial full-source test setup exposed a GitHub release lookup whose TLS certificate is unavailable in Linux CI; the revised test passes in every CI environment.
• The current public source already applies the private_ attribute to every active shared target below, including the merged directory mode alignment change. This pull request adds the requested regression coverage; it does not need additional source renames.

Private directory inventory and public overlap

The private permissions change sets the following 26 directories to mode 0700. The public ownership column accounts for public ignore rules. The private_ attribute removes group and other permissions, as described in the chezmoi source state attributes documentation.

Private target	Public manages this target?	Public handling
~/.aws	No	Private only
~/.codex	Yes	Mode 0700 via private_ on the current public base
~/.codex/hooks	No	Private only
~/.config	Yes	Mode 0700 via private_ on the current public base
~/.config/agents	No	Ignored by public source
~/.config/alias	Yes	Mode 0700 via private_ on the current public base
~/.config/chezmoi-private	No	Private only
~/.config/fnox	No	Private only
~/.config/mise	Yes	Mode 0700 via private_ on the current public base
~/.config/mise/conf.d	No	Private only
~/.config/work	No	Private only
~/.local	Yes	Mode 0700 via private_ on the current public base
~/.local/bin	Yes	Mode 0700 via private_ on the current public base
~/.local/bin/work	No	Private only
~/.local/bin/work/*.d (2 directories)	No	Private only
~/.mise	No	Ignored by public source
~/.ssh	Yes	Mode 0700 via private_ on the current public base
~/.ssh/work.d	No	Private only
~/.ssh/work.d/* (7 directories)	No	Private only

The wildcard rows represent all private-only directories in those groups; no public-managed overlap is omitted.

Apply-order verification

Using an isolated temporary HOME, separate source, cache, and persistent-state paths, and --include=dirs --exclude=externals,scripts --recursive=false --refresh-externals=never, I applied each active public target, then each private target, then each active public target again. The first public pass confirmed all 7 active shared targets were mode 0700; the private pass confirmed all 26 private directories were mode 0700; the final public pass confirmed all 26 remained mode 0700.

Work outside this diff

No real-machine apply, runtime permission change, or merge was performed. All apply checks targeted a temporary HOME.

Verified

• make setup
• make format
• python3 -m unittest discover -s tests/python (18 tests)
• Manual isolated public apply changed a pre-existing ~/.codex directory from 0755 to 0700 on macOS and Ubuntu.
• Isolated public → private → public apply-order check passed for all listed targets.
• The new Bats test and all required GitHub Actions and Codecov checks passed on macOS, Ubuntu, and Rocky Linux.

Not verified

• Bats was not run locally; CI ran the new regression test.
• No real-machine apply was performed.

Unrelated changes

None.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.53%. Comparing base (e5b011f) to head (927bdaa).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #807      +/-   ##
==========================================
+ Coverage   82.35%   83.53%   +1.18%     
==========================================
  Files          26       26              
  Lines        1213     1215       +2     
==========================================
+ Hits          999     1015      +16     
+ Misses        214      200      -14     

Flag	Coverage Δ
macos	41.66% <ø> (ø)
rockylinux	82.83% <ø> (-0.07%)	⬇️
ubuntu	80.32% <ø> (+1.64%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.