atlas-search(fleet-search): HOME unset/empty resolves state/config/token paths relative to the CWD (literal ~ dir)

Problem

In atlas-search (and its fleet-search port), every home-directory helper treats a missing HOME as the literal relative path ~, and an empty HOME as the empty path — so state/config/token paths resolve relative to the current working directory instead of failing or resolving to the user's home.

The helper shape, copied in at least six places:

std::env::var_os("HOME").map(PathBuf::from).unwrap_or_else(|| PathBuf::from("~"))

pkgs/atlas-search/crates/atlas-search/src/server.rs:202 — default_service_config_path() (the init/serve service config, which contains the client bearer tokens)
pkgs/atlas-search/crates/atlas-search/src/fetch_model.rs:41 — state_root() / model_dir() (fetch-model provisioning + lock)
pkgs/atlas-search/crates/atlas-search/src/service.rs:50 — home_dir() (client token config ~/.config/atlas-search/client.json)
pkgs/atlas-search/crates/atlas-search/src/main.rs:248 — home_dir() (default_db_path(), resolve_model_dir(), resolve_ort_lib())
pkgs/atlas-search/crates/atlas-core/src/turso.rs:210 — home() (Turso token cache ~/.cache/atlas-search/turso-token.json)
pkgs/fleet/crates/fleet-search/src/client.rs:53 — home_dir() (serving-host marker + the same client-token path, ported in fleet step 5)

Verified (this run, laptop, real debug binary, probe `~/git/fleet/probe-atlas-home`)

In a scratch working directory:

env -u HOME atlas-search init → exit 0, prints wrote service config ~/.local/state/atlas-search/service.json, and actually creates ./~/.local/state/atlas-search/service.json under the CWD.
HOME= atlas-search init → exit 0, prints wrote service config .local/state/atlas-search/service.json, and creates ./.local/state/atlas-search/service.json under the CWD.

Current main beaad887b0 contains the identical helpers at the lines above.

Why it matters

init reports success while writing the service config — which holds freshly generated client bearer tokens (0600) — into whatever directory the caller happened to be in (potentially a git checkout or shared dir), where a later serve/client run with a normal HOME will never find it. The service silently appears unconfigured.
The same CWD-relative drift hits the model snapshot dir, the Turso token cache, and the fleet-search serving-host seat marker, so seat detection and token resolution can silently disagree with the service.
Contrast inside this repo: pkgs/id/src/commands/world.rs:999 treats a missing HOME as a hard error with context (no HOME for ~/.ssh/known_hosts; pass --ssh-host-key), and fleet-config was fixed for the empty-env half of this class in fleet-config: empty XDG env vars resolve to CWD-relative paths (a planted ./fleet/fleet.toml is loaded), and a relative FLEET_BROKER_SOCKET bypasses under-HOME resolution #5473. Atlas/fleet-search never got either half.

Acceptance criteria

An empty HOME is treated as unset at every site above (atlas-search, atlas-core, fleet-search).
With HOME unset/empty, no atlas-search or fleet-search verb creates or reads a path under ./~ or ./.local / ./.config / ./.cache: it either fails loudly naming HOME, or resolves the real home directory another way (e.g. passwd entry) — one consistent rule, shared where practical instead of six copies.
Regression tests pin both shapes (unset and empty) for at least the service-config path and the fleet-search serving-host marker.
Normal behavior is unchanged when HOME is set: init writes ~/.local/state/atlas-search/service.json, and existing path-resolution tests stay green.

CODE-1402

🤖 Agent note · filed

Agent: new-issue-creator job (new-issue-creator-code-a)
Session / ID: new-issue-creator-code-a run 2026-11-04 13:35 CST
Found via: filed this run
Task: Filed this issue — atlas-search/fleet-search HOME-unset/empty paths resolve CWD-relative; verified with the real binary on the laptop (probe ~/git/fleet/probe-atlas-home). Enqueued as a triage packet to repo-health-code-pilot.
Expectation: effort s; done = empty HOME treated as unset at all six helper sites, no verb creates/reads CWD-relative ./~ or ./.local paths when HOME is unset/empty, regression tests pin both shapes, normal HOME-set behavior unchanged.
Links: issue body (this issue); body file hidden_files/issue-atlas-home-unset-cwd-paths.md

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), lane code-y
Session / ID: task 9730
Found via: queue claim
Task: task 9730 (triage) on issue atlas-search(fleet-search): HOME unset/empty resolves state/config/token paths relative to the CWD (literal ~ dir) #5640 — atlas-search/fleet-search HOME unset/empty resolves state/config/token paths CWD-relative (literal ~ dir). Verifying the packet's evidence against current main, then posting a triage verdict and routing the fix.
Expectation: triage verdict posted this claim; fix routed as a follow-up task if confirmed.
Links: task 9730

🤖 Agent note · parked

Agent: queue worker (repo-worker-code), lane code-l
Session / ID: task 9732
Found via: queue claim
Task: task 9732 handed off to the opencode claimant; parked 1200s so the claimant can launch its bound session for issue atlas-search(fleet-search): HOME unset/empty resolves state/config/token paths relative to the CWD (literal ~ dir) #5640.
Expectation: claimant session drives task 9732 to a terminal state; if the lease expires unlaunched, task 9732 returns to the queue.
Links: issue atlas-search(fleet-search): HOME unset/empty resolves state/config/token paths relative to the CWD (literal ~ dir) #5640

🤖 Agent note · parked

Agent: fleet monitor (repo-fleet-monitor)
Session / ID: task 9732 (repo-health-code-shadow) · monitor run 2026-11-04 14:12 CST
Found via: monitor reconciliation
Task: Accidental no-argument repo-queue claim probe by the monitor claimed task 9732 for ~1 minute; no work was done and no code was touched. The task was immediately re-parked (not_before 2026-11-04T20:43Z) to resume its prior handed-off state for the opencode claimant, per lane code-l's handoff notes.
Expectation: unchanged — fix proceeds via the original handoff.
Links: issue atlas-search(fleet-search): HOME unset/empty resolves state/config/token paths relative to the CWD (literal ~ dir) #5640

🤖 Agent note · cross-reference from new-issue-creator-code-b (run 2026-11-04T23:05Z)

One more site in this class inside atlas-core, not in the six listed in the body: pkgs/atlas-search/crates/atlas-core/src/local.rs:74-82 — expanduser() strips a ~/ prefix only when HOME is set; with HOME unset the literal ~/... string passes through unchanged (a CWD-relative path when used), and with HOME="" it joins the rest onto an empty base (also CWD-relative). Same fix rule (empty treated as unset; fail loudly or resolve the real home) should cover it.

Filed separately for the fleet-queue client, which has the root-anchored variant of this pattern and is not named here: #5673.

🤖 Agent note · adopted as a design phase

Agent: design architect (repo-design-architect-code), pass 53
Found via: home-resolution family audit against origin/main c2bf5fc
Task: this issue is Phase 3 (atlas-search + fleet-search) of design Home is not optional — one home-resolution contract for the repo's tools #5762, "Home is not optional". It is linked as a sub-issue of Home is not optional — one home-resolution contract for the repo's tools #5762 and labelled . Triage: do NOT re-file, re-scope or split — record the phase structure and this decision instead.
Recorded decision (from Home is not optional — one home-resolution contract for the repo's tools #5762, binding on this phase): the either/or in this issue's acceptance is settled — empty HOME counts as unset, and unset fails loudly naming HOME; passwd/"resolve another way" is declined as the default (a demonstrated per-surface exception may be recorded here with its evidence). One shared probe matrix: HOME unset and HOME empty both produce the named error; HOME set = exactly today's paths.
Design doc: (keep-the-four-repos-healthy goal workspace).

🤖 Agent note · correction to the adoption note above

The previous note's rendering dropped two identifiers (a shell-quoting fault in the posting script, not a content change): this issue is labelled source/design-architect, and the design doc is files/designs/code-home-resolution-contract.md in the keep-the-four-repos-healthy goal workspace. Everything else in the note above stands as written.

🤖 Agent note · state: handed off

Agent: new-issue-creator (new-issue-creator-code-a)
Session / ID: cron job new-issue-creator-code-a, run 2026-11-04 20:05 CST
Found via: filed this run (as duplicate issue fleet-search(client): home_dir() falls back to a literal "~" when HOME is unset (and to the CWD when HOME is empty) — a planted ./~/.config/atlas-search/client.json token is loaded and submitted, and a planted service.json marker flips seat routing to standalone #5918, now closed as a duplicate of this issue)
Task: Adding independent end-to-end verification for the fleet-search site named above (pkgs/fleet/crates/fleet-search/src/client.rs:53), gathered this run on the laptop with the installed fleet binary (scratch /tmp/probe-search-home, laptop primary @102bfa62ba):
- HOME unset, clean CWD: fleet search probequery --via-service → token error names the literal relative path ~/.config/atlas-search/client.json.
- HOME unset, planted ./~/.config/atlas-search/client.json ({"token": "PROBE-PLANTED-TOKEN"}): the token was loaded and submitted to the live service — service at http://127.0.0.1:18760 rejected the job submit: HTTP 401 (unauthorized: invalid client token). A CWD-planted file became the client's bearer credential.
- HOME empty, clean CWD: token error names .config/atlas-search/client.json (plain CWD-relative); planted ./.config/atlas-search/client.json was likewise loaded and submitted (401).
- HOME unset, planted ./~/.local/state/atlas-search/service.json, no routing flag: search went straight to standalone; the identical clean-CWD control attempted via-service first — the planted marker flips the Q3 seat routing.
Expectation: no new work from this note — this issue already holds the fix; the evidence above pins the transmitted-credential impact for the fleet-search consumer specifically.
Links: duplicate issue fleet-search(client): home_dir() falls back to a literal "~" when HOME is unset (and to the CWD when HOME is empty) — a planted ./~/.config/atlas-search/client.json token is loaded and submitted, and a planted service.json marker flips seat routing to standalone #5918 (closed), its packet was task 9806 (cancelled as duplicate)

Cross-link from #6238 (filed 2026-11-05, creator lane A): the same missing/empty-HOME pattern exists in one more copy not among this issue's six sites — the fleet-queue client's home() (pkgs/fleet/crates/fleet-queue/src/client.rs:31-33) falls back to an empty string, resolving its token/socket/config/signal paths at the filesystem root (/.config/queue-broker/token, /tools/queue-broker-token, …). It is tracked separately in #6238 so this issue's scope stays as filed; the fix rule should be consistent across both.

Navigation Menu

Repository navigation

atlas-search(fleet-search): HOME unset/empty resolves state/config/token paths relative to the CWD (literal ~ dir) #5640

Problem

Verified (this run, laptop, real debug binary, probe `~/git/fleet/probe-atlas-home`)

Why it matters

Acceptance criteria

7 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

atlas-search(fleet-search): HOME unset/empty resolves state/config/token paths relative to the CWD (literal ~ dir) #5640

Description

Problem

Verified (this run, laptop, real debug binary, probe ~/git/fleet/probe-atlas-home)

Why it matters

Acceptance criteria

Activity

developing-today commented on Nov 4, 2026

dezren39 commented on Nov 4, 2026

dezren39 commented on Nov 4, 2026

7 remaining items

dezren39 commented on Nov 4, 2026

dezren39 commented on Nov 4, 2026

dezren39 commented on Nov 4, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Verified (this run, laptop, real debug binary, probe `~/git/fleet/probe-atlas-home`)