q2cli may select an unwritable shared cache directory in centrally-installed Conda environments

[zhuofeih]

Summary

When q2cli is installed in a centrally managed Conda environment (e.g., an EasyBuild installation on an HPC cluster), get_app_dir() may incorrectly select the environment cache directory even when the current user cannot write to it.

The current implementation checks only whether the cache directory exists:

if conda_prefix != '' and (
    os.access(conda_prefix, os.W_OK | os.X_OK)
    or os.path.exists(environment_cache)
):
    return environment_cache

As a result, if

$CONDA_PREFIX/var/q2cli

exists but is not writable by regular users, q2cli still chooses that directory and later encounters permission errors while writing cache files.

Proposed fix

Replace

os.path.exists(environment_cache)

with

os.access(environment_cache, os.W_OK | os.X_OK)

Patch:

diff --git a/q2cli/util.py b/q2cli/util.py
@@
-                               or os.path.exists(environment_cache)):
+                               or os.access(environment_cache, os.W_OK | os.X_OK)):

Validation

Environment:

• QIIME2 2025.10-amplicon
• Centrally installed via EasyBuild
• Linux multi-user HPC cluster

Administrator account

/apps/eb/QIIME2/2025.10-amplicon/var/q2cli

is selected because it is writable.

Regular user

/home/<user>/.config/q2cli

is selected because the shared cache directory is not writable.

This preserves the existing behavior for writable Conda environments while avoiding permission issues in centrally managed installations.