Fix permission bits in mock-policy-server file commands

[joshspicer]

This pull request addresses the permission bit settings for file-based configurations in the mock-policy-server to ensure compliance with SDK/runtime requirements.

Changes made include:

• Updated macOS and Linux commands to explicitly set root ownership and mode 0644, ensuring files are root-owned and not group/world-writable, even when overwriting existing files.
• No changes were made to Windows commands, as the runtime does not enforce equivalent ACL checks.
• Revised the README.md to reflect these updates.
• Applied consistent fixes to both UI-generated commands in app.ts and the control API in server.ts.

Validation has been completed successfully, confirming that the changes meet the necessary requirements.

[Copilot]

Copilot review overview

🟡 Changes recommended

The commands follow existing symlinks, potentially overwriting another file while producing a deployment the runtime rejects.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 2

New issues introduced by this change (2)

Severity	Finding
	scripts/​mock-policy-server/​public/​app.ts — Opening $1 with > follows an existing symlink. In that case this command changes and overwrites…
	scripts/​mock-policy-server/​server.ts — The control-API command follows an existing symlink at the destination. It then…

What changed in this PR

Updates mock policy deployment commands to enforce Unix ownership and permissions.

Changes:

• Sets root ownership and mode 0644 on macOS/Linux.
• Updates UI and API-generated commands.
• Documents permission requirements.

File	Description
scripts/​mock-policy-server/​server.ts	Updates API-generated commands.
scripts/​mock-policy-server/​public/​app.ts	Updates UI-generated commands.
scripts/​mock-policy-server/​README.md	Documents permissions.

Suppressed comments (2)

scripts/mock-policy-server/public/app.ts:297

• Opening $1 with > follows an existing symlink. In that case this command changes and overwrites the symlink target, but the managed-settings path remains a symlink rather than the regular file required by the UI (public/index.html:204), so the runtime will ignore the deployment. Remove/recreate the destination (or atomically rename a fresh temporary file) before writing it.

		return `sudo mkdir -p /etc/github-copilot && sudo sh -c 'cat > "$1" && chown root "$1" && chmod 0644 "$1"' sh ${linuxManagedSettingsPath} <<'JSON'\n${body}\nJSON`;

scripts/mock-policy-server/server.ts:854

• The control-API command follows an existing symlink at the destination. It then overwrites/chowns/chmods the linked target while leaving managed-settings.json non-regular, contrary to the documented runtime requirement (public/index.html:204). Ensure the destination is replaced with a newly created regular file before applying ownership and mode.

				installCommand: `sudo mkdir -p /etc/github-copilot && sudo sh -c 'cat > "$1" && chown root "$1" && chmod 0644 "$1"' sh ${linuxPath} <<'JSON'\n${body}\nJSON`,

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

The commands can still leave the destination non-regular when it is a symlink to a directory.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 2

New issues introduced by this change (2)

Severity	Finding
	scripts/​mock-policy-server/​public/​app.ts — mv treats a destination symlink to a directory as a directory, so this reports success after…
	scripts/​mock-policy-server/​server.ts — The control-API command still follows a destination symlink when it points to a directory: mv…

Issues resolved since last review (2)

Severity	Finding
	scripts/​mock-policy-server/​server.ts — The control-API command follows an existing symlink at the destination. It then… View resolved comment
	scripts/​mock-policy-server/​public/​app.ts — Opening $1 with > follows an existing symlink. In that case this command changes and overwrites… View resolved comment

Suppressed comments (2)

scripts/mock-policy-server/public/app.ts:297

• mv treats a destination symlink to a directory as a directory, so this reports success after moving the temporary file inside the linked directory while leaving managed-settings.json as a symlink. GNU mv -T makes the destination be treated as the target file and preserves the intended atomic replacement.

		return `sudo mkdir -p /etc/github-copilot && sudo sh -c 'tmp=$(mktemp "\${1}.tmp.XXXXXX") && trap "rm -f -- \\"$tmp\\"" EXIT && cat > "$tmp" && chown root "$tmp" && chmod 0644 "$tmp" && mv -f -- "$tmp" "$1"' sh ${linuxManagedSettingsPath} <<'JSON'\n${body}\nJSON`;

scripts/mock-policy-server/server.ts:854

• The control-API command still follows a destination symlink when it points to a directory: mv moves the temporary file into that directory and exits successfully, leaving the managed-settings path non-regular. Use GNU mv -T so the destination is always treated as the target file.

				installCommand: `sudo mkdir -p /etc/github-copilot && sudo sh -c 'tmp=$(mktemp "\${1}.tmp.XXXXXX") && trap "rm -f -- \\"$tmp\\"" EXIT && cat > "$tmp" && chown root "$tmp" && chmod 0644 "$tmp" && mv -f -- "$tmp" "$1"' sh ${linuxPath} <<'JSON'\n${body}\nJSON`,