Error writing to log.jon on Win-PS

[claudiushaag]

Environment

• OS: Windows 11 Pro (10.0.26200, 25H2)
• Shell: PowerShell
• tirith version (tirith --version):
• Install method (cargo/brew/deb/manual): conda-forge

Doctor output

tirith 0.2.11
  binary:       D:\XXX\rattler_local\pixi_home\envs\tirith\Library\bin\tirith.exe
  shell:        powershell
  interactive:  true
  hook dir:     C:\Users\XXX\AppData\Roaming\tirith\shell
  materialized: true
  profile:      C:\Users\XXX\Documents\WindowsPowerShell/Microsoft.PowerShell_profile.ps1
  hook status:  configured
  bash mode:    normal
  policies:     (none found)
  data dir:     C:\Users\XXX\AppData\Roaming\tirith
  log path:     C:\Users\XXX\AppData\Roaming\tirith\log.jsonl
  last trigger: C:\Users\XXX\AppData\Roaming\tirith\last_trigger.json
  cloaking:     not available (Unix-only)
  webhooks:     not available (Unix-only)
  license key:  not found

What happened

Using tirith with PowerShell integration on Windows, commands fail due to an inability to lock the log file under %APPDATA%\tirith\log.jsonl. The issue occurs consistently, including after deleting the tirith directory and recreating it. Running PowerShell as Administrator does not resolve the issue. Manual file creation in the same directory succeeds, indicating write permissions are present. The error occurs during normal command execution.

What you expected

tirith should execute normally without failing to lock its log file on a standard Windows setup.

Command (if applicable)

powershell -ExecutionPolicy Bypass -c "irm -useb https://pixi.sh/install.ps1 | iex"

tirith output

powershell -ExecutionPolicy Bypass -c "irm -useb https://pixi.sh/install.ps1 | iex"command> "powershell -ExecutionPolicy Bypass -c \"irm -useb https://pixi.sh/install.ps1 | iex\""
tirith.exe : tirith: audit: cannot lock C:\Users\XXX\AppData\Roaming\tirith\log.jsonl: Zugriff verweigert (os error 5)
In C:\Users\XXX\AppData\Roaming\tirith\shell\lib\powershell-hook.ps1:136 Zeichen:21
+ ... rovalPath = & tirith check --approval-check --non-interactive --inter ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (tirith: audit: ...rt (os error 5):String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError

tirith: BLOCKED
  [HIGH] pipe_to_interpreter ÔÇö Pipe to interpreter: powershell | iex
    Command pipes output from 'powershell' directly to interpreter 'iex'. Downloaded content will be executed without inspection.

Category

• False positive (benign command flagged)
• False negative (malicious command not flagged)
• Latency issue
• Shell integration issue
• Policy issue
• Other

[sheeki03]

Fixed on main and included in v0.2.12.

The non-fatal audit/logging noise is now silent by default, so shell-hook flows should no longer trip over background stderr output. If you need those diagnostics while debugging, you can still opt in with TIRITH_AUDIT_DEBUG=1.

I also fixed a related bash-hook regression I found while smoke-testing the CLI/hook path manually.

Please update to the latest version and try it again.

Thanks for reporting this.