A read-only file stops nobody once the write is atomic

Gemini CLI recently made its file writes atomic: it writes the new content to a temp file next to the target and renames it over the original, so a crash can never leave half a file. Issue #29721 points out what that costs. A rename checks whether you can write to the directory, never whether you can write to the file. So a file you marked read-only with `chmod 444`, which the CLI used to refuse with a permission error, now gets replaced — the new file even keeps mode 444. The rename also gives the path a new inode, so if the file was a hard link, the name you edited gets the change and every other name keeps the old content.

The repro, run against the file system service on main, is the reporter’s own. The issue is still open and, at the time of writing, has no fix PR.

Do not rely on file permissions to keep an agent away from a file. If something must not change, put it outside the workspace, mount it read-only, or use the tool’s sandbox and deny rules.