Windows: EPERM when reading <stateDir>/.env, secrets silently not loaded

[sosidudku1]

Summary

On Windows, atomic-agent fails to read %USERPROFILE%\.atomic-agent\.env with EPERM. The loader warns on stderr and continues without secrets, so stored API keys and custom base URLs are never applied. The user has to re-enter them on every launch.

Reported by a user in Discord (Windows 11, PowerShell).

Error output

PS C:\WINDOWS\system32> atomic-agent
atomic-agent: cannot read C:\Users\ben\.atomic-agent\.env: EPERM: operation not permitted, open 'C:\Users\ben\.atomic-agent\.env'
[atomic-agent] local-llm unreachable at http://127.0.0.1:8080 - starting setup...

 llama-server not reachable
 last error: fetch failed

   [1] Local models (llama.cpp) - download and run locally
 > [2] Cloud models - configure API key and pick a model

Environment

• OS: Windows 11
• Shell: PowerShell
• Install: irm https://atomicagent.io/install.ps1 | iex

Reproduction / what we know

1. Run atomic-agent, configure a cloud provider with a custom base URL and API key
2. Restart the agent
3. Setup asks for the API key and base URL again, EPERM warning shows on startup

The .env file does exist (confirmed via Explorer screenshot, 1 KB, created by the agent itself in C:\Users\ben\.atomic-agent\, alongside config.json, memory.sqlite, sessions.sqlite, tasks.sqlite, analytics.json).

Reproduces in both a non-elevated and an elevated PowerShell, so this is not a simple elevation-context mismatch. Antivirus interference and broken file ACLs are still open suspects, the user's AV has not been identified yet.

Where it happens

src/config/load-dotenv.ts - loadDotenvFromStateDir(). Any non-ENOENT error writes a stderr warning and returns an empty result, so startup continues with no secrets loaded.

Suggested fixes

1. Surface the failure properly. A stderr line is easy to miss and does not explain the consequence. When .env exists but cannot be read, show it in the TUI and say plainly that stored secrets were not loaded and why.
2. Retry / diagnose on Windows. On EPERM, retry the read once and, if it fails again, print actionable guidance (icacls "%USERPROFILE%\.atomic-agent\.env" /reset, check antivirus exclusions).
3. Consider whether the file is being written with an ACL the reading process cannot use.

Workaround

Set the same KEY=VALUE pairs as Windows environment variables. Shell-exported variables take priority over .env, so this bypasses the failing read entirely.