From c8b8aeb871bcd664583b325546e4bb2927cd4aa7 Mon Sep 17 00:00:00 2001
From: Lunar-feedmob <lunar@feedmob.com>
Date: Fri, 15 May 2026 13:06:55 +0800
Subject: [PATCH] fix(security): surface Windows ACL repair hint when
 .secret_key is unreadable (#1748)

---
 src/openhuman/security/secrets.rs | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/src/openhuman/security/secrets.rs b/src/openhuman/security/secrets.rs
index 043c0f42e..b710224e5 100644
--- a/src/openhuman/security/secrets.rs
+++ b/src/openhuman/security/secrets.rs
@@ -188,8 +188,22 @@ impl SecretStore {
         }
 
         if self.key_path.exists() {
-            let hex_key = read_key_file_with_retry(&self.key_path)
-                .context("Failed to read secret key file")?;
+            let hex_key = read_key_file_with_retry(&self.key_path).with_context(|| {
+                let mut msg = format!(
+                    "Failed to read secret key file at {}",
+                    self.key_path.display()
+                );
+                #[cfg(windows)]
+                {
+                    msg.push_str(
+                        "\n\nThis is often caused by incorrect file permissions on Windows. \
+                         Try repairing ACLs on the .openhuman directory:\n\
+                         icacls \"%USERPROFILE%\\.openhuman\" /reset /t /c\n\
+                         icacls \"%USERPROFILE%\\.openhuman\\.secret_key\" /reset /c",
+                    );
+                }
+                msg
+            })?;
             let key = hex_decode(hex_key.trim()).context("Secret key file is corrupt")?;
             anyhow::ensure!(
                 key.len() == KEY_LEN,