pub fn load_config() -> Result<AppConfig, AppError>Expand description
Load application configuration from the XDG config file.
§Declared limit: the permission check below is Unix-only, on purpose
The write side has a Windows counterpart, restrict_to_current_user in
crate::config::permissions — named in prose because it is private, and a
public doc that links a private item is denied by [lints.rustdoc]; the
READ side deliberately does not, so on Windows a config.toml with a loose
ACL — holding the OpenRouter API key — is loaded without a word, while on
Unix the same file draws a warning. That asymmetry is stated here rather
than papered over, because a silent gap is the one an operator cannot plan
around.
It stands for three reasons. First, this check only WARNS: it never refuses
the file, so what Windows loses is a log line, not a guarantee. Second, the
guarantee itself is on the write path, where SetNamedSecurityInfoW
installs a PROTECTED single-ACE DACL — any file this CLI wrote is already
restricted, and the loose-ACL case can only arise from a file some other
tool produced. Third, deciding “too open” from a DACL means enumerating
ACEs and classifying trustees in unsafe Win32, and this project has no
Windows CI: permissions.rs already declares its Windows branch as
reviewed-but-never-executed code. Adding a second unverifiable unsafe
surface to gain a warning is a worse trade than admitting the limit.