Oh My Zsh compaudit: missing auto-fix default for world-writable $fpath directories

Answer

Oh My Zsh does not automatically fix world‑writable $fpath directories; the warning is kept as an explicit security signal.

Confirmed facts

• compinit runs compaudit at startup and only reports insecure directories; it does not change permissions.
• The only built‑in ways to silence the check are to run compaudit | xargs chmod g-w,o-w manually or to set ZSH_DISABLE_COMPFIX=true, which disables the protection entirely.
• Oh My Zsh deliberately avoids an auto‑fix default to prevent hiding misconfigurations or abusive permission changes.

Likely explanation

The project treats the warning as a necessary cue that something in $fpath is writable by others. Auto‑fixing would remove that cue and could mask a legitimate problem (e.g., a package installing completions with insecure modes). Therefore the current manual step is intentional.

Steps to enable automatic fixing (if you accept the trade‑off)

1. Edit ~/.zshrc before the line that sources Oh My Zsh (source $ZSH/oh-my-zsh.sh).
2. Add a pre‑compinit hook that repairs permissions:

# Auto‑fix world‑writable $fpath entries on each start
compaudit | xargs chmod g-w,o-w 2>/dev/null

3. Save the file and start a new shell; the warning should disappear and the directories will no longer have group or other write bits.
4. Optionally, limit the hook to known safe paths by adding a grep -v filter or by whitelisting directories.

Missing diagnostic detail

Are the world‑writable entries coming from package‑manager‑installed completions (likely false positives) or from directories you added yourself? If they are false positives, the hook above is a reasonable middle ground; if they are your own additions, review the permissions manually before enabling automatic fixing.