# Understanding the Permissions of Files in the open-seo Repository Root

> Discover the file permissions in the open-seo repository root. Learn about standard Git modes and which file is executable, explained clearly for developers.

- Repository: [Every App/open-seo](https://github.com/every-app/open-seo)
- Tags: how-to-guide
- Published: 2026-09-11

---

**All root-level files in the every-app/open-seo repository use standard Git permission modes: regular files are `100644` (0644), directories are `040000` (0755), and only [`docker-entrypoint.sh`](https://github.com/every-app/open-seo/blob/main/docker-entrypoint.sh) is executable at `100755` (0755).**

The open-seo repository stores its file permissions within Git's object model, meaning every entry in the repository root carries a mode that maps directly to Unix permission bits. When developers clone the repository on Unix-like systems, these permissions are reconstructed automatically, determining who can read, write, or execute each file.

## How Git Stores File Permissions

Git tracks file permissions through the `mode` field in its tree objects. According to the GitHub API documentation for git trees, this field stores the file mode as a string representation of the octal value. The mapping is straightforward:

- Mode `100644` translates to Unix permission `rw-r--r--` (0644)
- Mode `100755` translates to Unix permission `rwxr-xr-x` (0755)  
- Mode `040000` indicates a directory with permission `rwxr-xr-x` (0755)

These values are recorded when files are added to the index and persist across clones.

## Complete File Permissions Breakdown for open-seo

The every-app/open-seo repository contains a mix of configuration files, source code, directories, and shell scripts at its root. Here is the complete permission mapping for all top-level entries.

### Regular Files (100644 / 0644)

The vast majority of files in the repository root are regular files stored with mode `100644`, yielding read-write access for the owner and read-only access for group and others:

- [`opencode.json`](https://github.com/every-app/open-seo/blob/main/opencode.json) — `rw-r--r--`
- `wrangler.jsonc` — `rw-r--r--`
- `wrangler.audit.jsonc` — `rw-r--r--`
- [`worker-configuration.d.ts`](https://github.com/every-app/open-seo/blob/main/worker-configuration.d.ts) — `rw-r--r--`
- [`vite-plugin-lean-worker-bundle.ts`](https://github.com/every-app/open-seo/blob/main/vite-plugin-lean-worker-bundle.ts) — `rw-r--r--`
- [`tsconfig.json`](https://github.com/every-app/open-seo/blob/main/tsconfig.json) — `rw-r--r--`
- [`vite.config.ts`](https://github.com/every-app/open-seo/blob/main/vite.config.ts) — `rw-r--r--`
- [`vitest.config.ts`](https://github.com/every-app/open-seo/blob/main/vitest.config.ts) — `rw-r--r--`
- [`skills-lock.json`](https://github.com/every-app/open-seo/blob/main/skills-lock.json) — `rw-r--r--`
- [`pnpm-workspace.yaml`](https://github.com/every-app/open-seo/blob/main/pnpm-workspace.yaml) — `rw-r--r--`
- [`pnpm-lock.yaml`](https://github.com/every-app/open-seo/blob/main/pnpm-lock.yaml) — `rw-r--r--`
- [`compose.yaml`](https://github.com/every-app/open-seo/blob/main/compose.yaml) — `rw-r--r--`
- [`cli-auth.ts`](https://github.com/every-app/open-seo/blob/main/cli-auth.ts) — `rw-r--r--`
- [`chatgpt-app-submission.json`](https://github.com/every-app/open-seo/blob/main/chatgpt-app-submission.json) — `rw-r--r--`
- [`alchemy.preview-access.run.ts`](https://github.com/every-app/open-seo/blob/main/alchemy.preview-access.run.ts) — `rw-r--r--`
- [`alchemy.access.ts`](https://github.com/every-app/open-seo/blob/main/alchemy.access.ts) — `rw-r--r--`
- [`README.md`](https://github.com/every-app/open-seo/blob/main/README.md) — `rw-r--r--`
- `LICENSE` — `rw-r--r--`
- `Dockerfile.selfhost` — `rw-r--r--`
- [`CLAUDE.md`](https://github.com/every-app/open-seo/blob/main/CLAUDE.md) — `rw-r--r--`
- [`AGENTS.md`](https://github.com/every-app/open-seo/blob/main/AGENTS.md) — `rw-r--r--`
- `.gitignore` — `rw-r--r--`
- `.env.preview.example` — `rw-r--r--`
- `.env.example` — `rw-r--r--`
- `.dockerignore` — `rw-r--r--`

### Executable Files (100755 / 0755)

Only one file in the repository root requires execution permissions. The [`docker-entrypoint.sh`](https://github.com/every-app/open-seo/blob/main/docker-entrypoint.sh) shell script is stored with mode `100755`, which translates to `rwxr-xr-x` on Unix systems. This permission allows the script to be executed directly by the Docker container entrypoint mechanism.

### Directories (040000 / 0755)

All top-level directories in open-seo are stored with Git mode `040000`, which corresponds to standard directory permissions `0755` (`rwxr-xr-x`):

- `web/`
- `specs/`
- `scripts/`
- `runbooks/`
- `release-notes/`
- `public/`
- `badseo/`
- `.greptile/`
- `.cursor-plugin/`

These permissions allow the owner full control while granting read and execute (traverse) rights to all other users.

## Programmatically Checking Repository Permissions

You can verify these permissions programmatically using the GitHub REST API. The following Node.js script fetches the git tree for the every-app/open-seo repository and displays the permission modes for all root-level entries:

```javascript
import fetch from 'node-fetch';

async function listRootPermissions(owner, repo, ref = 'main') {
  const url = `https://api.github.com/repos/${owner}/${repo}/git/trees/${ref}?recursive=1`;
  const resp = await fetch(url);
  const data = await resp.json();

  const rootEntries = data.tree.filter(e => !e.path.includes('/') && e.type === 'blob');
  console.log('| File | Git mode | Unix permission |');
  console.log('|------|----------|-----------------|');
  for (const e of rootEntries) {
    const perm = e.mode === '100755' ? '0755' : '0644';
    console.log(`| ${e.path} | ${e.mode} | ${perm} |`);
  }
}

listRootPermissions('every-app', 'open-seo');

```

When executed, this script outputs a permission table matching the manual analysis above. The `e.mode` property directly reflects the Git object model values documented in the GitHub API reference.

## Summary

- **Default permission**: Most files in the open-seo repository root use mode `100644` (Unix `0644`), providing owner read-write and group/others read-only access.
- **Single executable**: Only [`docker-entrypoint.sh`](https://github.com/every-app/open-seo/blob/main/docker-entrypoint.sh) carries mode `100755` (`0755`), making it the sole executable file at the repository root.
- **Directory handling**: All directories including `web/`, `scripts/`, and `public/` use mode `040000` (`0755`), standard for traversable directories.
- **Git persistence**: These permissions are embedded in Git's tree objects and persist across clones and checkouts on Unix filesystems.

## Frequently Asked Questions

### How do Git file modes translate to Unix permissions?

Git stores file modes in the tree object as octal strings. Mode `100644` maps to `rw-r--r--` (0644), `100755` maps to `rwxr-xr-x` (0755), and directories use `040000` which also results in `0755` permissions. When you clone the every-app/open-seo repository, Git applies these modes to your local filesystem.

### Why is docker-entrypoint.sh the only executable file in the repository root?

The [`docker-entrypoint.sh`](https://github.com/every-app/open-seo/blob/main/docker-entrypoint.sh) script requires execution permissions because it serves as the entrypoint for Docker containers. In the every-app/open-seo repository, this is the only shell script located at the root level that needs to run directly, so it is stored with mode `100755` while all other configuration and source files remain at `100644`.

### Can file permissions change between different versions of the repository?

Yes, file permissions are versioned just like content. If a commit changes a file from `100644` to `100755`, that change is recorded in the git history. The open-seo repository currently maintains consistent permissions across its root files, but checking out specific commits could reveal historical permission differences.

### How can I check permissions without cloning the repository?

Use the GitHub REST API endpoint for git trees: `GET /repos/{owner}/{repo}/git/trees/{ref}`. The response includes a `mode` field for each entry. For the every-app/open-seo repository, this returns values like `100644` for regular files and `100755` for [`docker-entrypoint.sh`](https://github.com/every-app/open-seo/blob/main/docker-entrypoint.sh), allowing you to audit permissions remotely without downloading the entire repository.