cargo-hauler 0.7.1 → 0.7.3

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## 0.7.3
+
+### Patch Changes
+
+- 5d14c4f: Initialize the dashboard in Codex Desktop when MCP Apps use a
+  `codex-sandbox://` origin (#206).
+- 4ac68a9: Make `hauler daemon stop` and `cargo-hauler daemon stop` preserve typed shutdown outcomes and fail when the daemon refuses, times out, returns a protocol error, disconnects before acknowledgement, or remains alive (#200).
+- bc2ed53: Make daemon state and relocated control sockets owner-private on Linux and
+  macOS. The state directory, `tickets/`, and the socket's runtime directory
+  are created `0700` and sensitive files — complete ticket output, the ledger
+  and its WAL sidecars, the daemon log, the passthrough spool, `hook-state.json`,
+  `hook-events.jsonl`, the pid lock, and the jobserver FIFO — `0600`,
+  independent of the invoking shell's umask, instead of inheriting `0755`/`0644`.
+  An existing state directory the running user owns is tightened in place; a
+  parent named by `CARGO_HAULER_STATE_DIR` is never chmod'ed, and a state path
+  that is a symlink, the wrong kind of entry, or owned by another user is
+  refused by name rather than followed, chmod'ed, or deleted. A state directory
+  too deep for `sun_path` now puts its socket in a `cargo-hauler-<uid>`
+  directory under `XDG_RUNTIME_DIR`/`TMPDIR`/the system temporary directory
+  instead of directly in a possibly shared temporary root, and the socket
+  digest no longer lowercases Unix paths, so case-distinct state directories no
+  longer share one control endpoint. A daemon left listening at the previous
+  relocated path is retired by the next client under the existing one-version
+  rule and stopped by `hauler daemon stop`, so the moved endpoint needs no
+  manual cleanup on upgrade. Windows keeps its named pipe and gains no POSIX
+  modes or uids. (#203)
+
+## 0.7.2
+
+### Patch Changes
+
+- 0ca43dd: Compare prerelease versions by SemVer identifiers when deciding whether a client may replace a daemon. Numeric counters such as `rc.10` now sort after `rc.9`, preventing an older prerelease client from being mistaken for a newer install.
+- bb0901a: Install PATH shims without following existing symlinks or overwriting other hard links to Cargo executables. Refuse dangling destination links unless `--force` is supplied, publish complete executable files atomically, and prevent an existing destination symlink from being embedded as the shim's own real Cargo path.
+
 ## 0.7.1
 
 ### Patch Changes

package/README.md

@@ -85,7 +85,7 @@ The CLI is `hauler` on PATH from `npm i -g cargo-hauler`. Never run
 | `hauler result <ticket> [--full]` | A stored ticket in full: the settled 16 KiB output tail, or the whole live in-memory tail while it runs (not the status preview). The document names the full on-disk output log (`Full output: <path> (size)`) and `--json` carries it as `request.outputPath`; `--full` prints that whole log instead of the tail (the last ~768 KiB when it does not fit, with the path for the rest). |
 | `hauler kill <ticket>` | Stop a ticket: drop it from the queue or SIGTERM (then SIGKILL) its cargo process group, freeing the lane. Riders return to their lane or fail with it. |
 | `hauler request [--session ID] [--host HOST] [--cwd DIR] [--after TICKET …] -- <cargo …>` | Submit a background request and return its ticket, with where it landed in its lane (`queued behind cc-3281 (~13m)`, `waiting for cc-3281`, or `attached to cc-3281`). `--cwd` overrides the current CLI workspace; `--after` works as for `exec`. |
-| `hauler daemon <run\|start\|stop\|status\|restart>` | Manage the daemon lifecycle. `restart` is the manual replacement: it sends the graceful stop, waits up to 5 s for the old pid to exit, then starts a daemon from this install and prints both (`restarted: pid 741314 (0.6.0) → pid 742001 (0.6.1)`); a daemon that has not exited by then is reported, not killed, and nothing is started (exit `1`). Tickets in flight are not handed over: the old daemon settles them itself as it shuts down — `killed`, error `daemon shutdown` — and callers resubmit (only rows a daemon that died without shutting down never marked are stamped `orphaned by daemon restart` by the next daemon's first ledger pass). After upgrading the package, every client entry — reads (`status`, `daemon status`, `log`, `last`, `await`, `result`, the dashboard and MCP tools), writes, and hooks — checks the daemon version before requesting a versioned payload and replaces a daemon from the previous install automatically. When the old daemon has not exited within the grace, the command fails with `` cargo-hauler daemon pid N (X.Y.Z) is still running 5s after the shutdown request; not restarted — retry once it has exited, or stop it with `hauler daemon stop` `` instead of parsing its payload or starting a second daemon. |
+| `hauler daemon <run\|start\|stop\|status\|restart>` | Manage the daemon lifecycle. `stop` records its typed `shutdown` outcome in JSON and exits `0` only after a `shutting-down` acknowledgement followed by the original pid's exit, or when the daemon was already absent. Refusal, timeout, protocol error, disconnect before acknowledgement, and an acknowledged daemon still alive after 5 s exit `1`; `running` remains `true` when the original pid is alive and `null` when liveness could not be established. `restart` is the manual replacement: it sends the graceful stop, waits up to 5 s for the old pid to exit, then starts a daemon from this install and prints both (`restarted: pid 741314 (0.6.0) → pid 742001 (0.6.1)`); a daemon that has not exited by then is reported, not killed, and nothing is started (exit `1`). Tickets in flight are not handed over: the old daemon settles them itself as it shuts down — `killed`, error `daemon shutdown` — and callers resubmit (only rows a daemon that died without shutting down never marked are stamped `orphaned by daemon restart` by the next daemon's first ledger pass). After upgrading the package, every client entry — reads (`status`, `daemon status`, `log`, `last`, `await`, `result`, the dashboard and MCP tools), writes, and hooks — checks the daemon version before requesting a versioned payload and replaces a daemon from the previous install automatically. When the old daemon has not exited within the grace, the command fails with `` cargo-hauler daemon pid N (X.Y.Z) is still running 5s after the shutdown request; not restarted — retry once it has exited, or stop it with `hauler daemon stop` `` instead of parsing its payload or starting a second daemon. |
 | `hauler install-shim [--dir DIR] [--real-cargo PATH] [--force]` | Install the optional PATH shim. |
 | `hauler web [--port N] [--no-open]` | Open the dashboard from the checkout, npm package, or installed plugin. Agent Bundle's generated web command serves the built App against the plugin's own `hauler` server, opens it populated by `hauler_status`, and stays in the foreground until Ctrl-C. In an MCP host, call `hauler_status` instead. |
 
@@ -635,7 +635,7 @@ Per-host notes and hook timeouts are in [docs/install.md](docs/install.md).
 
 | Variable | Default | Meaning |
 | --- | --- | --- |
-| `CARGO_HAULER_STATE_DIR` | Per-user cache directory | Unix socket or Windows named pipe source, SQLite ledger, daemon log, pid lock, `hook-state.json`, `hook-events.jsonl`, and the per-ticket output logs under `tickets/`. |
+| `CARGO_HAULER_STATE_DIR` | Per-user cache directory | Unix socket or Windows named pipe source, SQLite ledger, daemon log, pid lock, `hook-state.json`, `hook-events.jsonl`, and the per-ticket output logs under `tickets/`. Owner-private on Linux and macOS: the directory is `0700` and its sensitive files `0600`, and an unsafe or unowned path is refused rather than reused. |
 | `CARGO_HAULER_CARGO_BIN` | `$CARGO_HOME/bin/cargo` | Cargo binary for daemon-started work; bare `cargo` is the last fallback. Never resolved through `PATH`. Read from the daemon's own environment (export it where the daemon starts, or before `hauler daemon start`); clients do not forward it. |
 | `CARGO_HAULER_MAX_CONCURRENT` | cores ÷ 8, clamped to 5–16 | Global admission permits for Cargo processes across all lanes; an integer >= 1. |
 | `CARGO_HAULER_OVERLAP_EXECUTION` | `1` | Hand a lane to its next request once a `test`/`nextest`/`bench`/`run` leader reports its build finished, overlapping the next compile with the leader's execution phase. `0` keeps a lane strictly one process at a time. |
@@ -672,11 +672,50 @@ as a warning (daemon log, or stderr for hand-run commands) and the default
 applies; only `0` or `off` disables an arm that documents that contract.
 The state directory defaults to `$XDG_CACHE_HOME/cargo-hauler`, otherwise
 `~/.cache/cargo-hauler` on Linux, `~/Library/Caches/cargo-hauler` on macOS, and
-`%LOCALAPPDATA%\cargo-hauler` on Windows. When `CARGO_HAULER_KACHE_INDEX` is
+`%LOCALAPPDATA%\cargo-hauler` on Windows. Its contents are owner-private, and
+the daemon is a single user's, not a shared service — see
+[State directory ownership](#state-directory-ownership). When
+`CARGO_HAULER_KACHE_INDEX` is
 unset, the daemon reads kache's configured local store from
 `$XDG_CONFIG_HOME/kache/config.toml` or `~/.config/kache/config.toml` and opens
 `<local_store>/index.db` read-only.
 
+### State directory ownership
+
+The daemon is local control for the user who owns its state directory, not a
+shared multi-user service. Everything under the state directory — complete
+command output in `tickets/`, the ledger, the daemon log, the passthrough
+spool, the hook records, the jobserver FIFO, the control socket — is that
+one account's, and there is no mechanism for a second user to submit work to
+another user's daemon.
+
+On Linux and macOS the daemon enforces that boundary rather than inheriting
+it from the umask:
+
+- Directories cargo-hauler creates are `0700`, and sensitive files `0600`,
+  whatever umask the invoking shell had. An existing state directory that
+  the running user already owns is tightened in place on the next start;
+  its contents are preserved.
+- Only the state directory and the entries cargo-hauler owns are changed. A
+  parent you configured through `CARGO_HAULER_STATE_DIR` — a shared volume,
+  a RAM disk — is never chmod'ed.
+- A state path that is a symbolic link, is the wrong kind of entry, or is
+  owned by another user is refused by name instead of being followed,
+  chmod'ed, or deleted. Fix or remove the path and start again; cargo-hauler
+  will not act on another account's file on your behalf.
+- When the state directory is too deep for the kernel's socket path limit,
+  the control socket moves to a `cargo-hauler-<uid>` directory (mode `0700`)
+  under `XDG_RUNTIME_DIR`, `TMPDIR`, or the system temporary directory —
+  never directly into a shared temporary root. Two accounts sharing one
+  temporary root get separate directories. A daemon from an earlier install
+  still listening at the previous relocated path is retired by the next
+  client under the usual one-version rule, and `hauler daemon stop` asks it
+  too before reporting nothing running, so upgrading needs no manual cleanup.
+
+Windows has neither POSIX modes nor uids, and its control endpoint is a
+named pipe rather than a filesystem entry, so none of the above applies
+there; state files keep the permissions the filesystem gives them.
+
 ## Runtime behavior and caveats
 
 - Hook and client transport failures fail open: a hook passes the original
@@ -946,8 +985,9 @@ Workbench's MCP page preview the same App with live rebuilds. The repository
 ships no preview harness of its own.
 
 agent-bundle does not yet have an npm release; this repository pins the
-[pkg.pr.new](https://pkg.pr.new) preview of Agent Bundle PR #733 commit
-[`5064133`](https://github.com/ScriptedAlchemy/agent-bundle/commit/506413326359bff154ce4476eb0f47b0dabf4efe)
+[pkg.pr.new](https://pkg.pr.new) preview of Agent Bundle main commit
+[`b807ca0`](https://github.com/ScriptedAlchemy/agent-bundle/commit/b807ca0eea5c0d5744350e1fa8829e3d59c3c0b8),
+merged by [Agent Bundle PR #772](https://github.com/ScriptedAlchemy/agent-bundle/pull/772),
 for both `agent-bundle` and `@agent-bundle/runtime`. `inspect` reports the
 `agent` component kind as unavailable on every host (agent-bundle G5
 deferral); this plugin defines no agents.

package/dist/.claude-plugin/marketplace.json

@@ -1 +1 @@
-{"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","name":"cargo-hauler-marketplace","owner":{"name":"cargo-hauler"},"plugins":[{"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","name":"cargo-hauler","source":"./","version":"0.7.1"}]}
+{"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","name":"cargo-hauler-marketplace","owner":{"name":"cargo-hauler"},"plugins":[{"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","keywords":["cargo","rust","agent","mcp","claude-code","codex","cursor","build-orchestration"],"license":"MIT","name":"cargo-hauler","repository":"https://github.com/ScriptedAlchemy/cargo-hauler","source":"./","version":"0.7.3"}]}

package/dist/.claude-plugin/plugin.json

@@ -1 +1 @@
-{"author":{"name":"cargo-hauler"},"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","name":"cargo-hauler","version":"0.7.1"}
+{"author":{"name":"cargo-hauler"},"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","name":"cargo-hauler","version":"0.7.3"}

package/dist/.codex-plugin/plugin.json

@@ -1 +1 @@
-{"author":{"name":"cargo-hauler"},"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","hooks":"./.codex-plugin/hooks.json","interface":{"capabilities":["mcp","hooks","skills"],"category":"Productivity","defaultPrompt":["Help me use cargo-hauler."],"developerName":"cargo-hauler","displayName":"cargo-hauler","longDescription":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","shortDescription":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks."},"mcpServers":"./.codex-plugin/mcp.json","name":"cargo-hauler","skills":"./skills/","version":"0.7.1"}
+{"author":{"name":"cargo-hauler"},"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","hooks":"./.codex-plugin/hooks.json","interface":{"capabilities":["mcp","hooks","skills"],"category":"Productivity","defaultPrompt":["Help me use cargo-hauler."],"developerName":"cargo-hauler","displayName":"cargo-hauler","longDescription":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","shortDescription":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks."},"keywords":["cargo","rust","agent","mcp","claude-code","codex","cursor","build-orchestration"],"license":"MIT","mcpServers":"./.codex-plugin/mcp.json","name":"cargo-hauler","repository":"https://github.com/ScriptedAlchemy/cargo-hauler","skills":"./skills/","version":"0.7.3"}

package/dist/.cursor-plugin/plugin.json

@@ -1 +1 @@
-{"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","displayName":"cargo-hauler","hooks":"./.cursor-plugin/hooks.json","mcpServers":"./.cursor-plugin/mcp.json","name":"cargo-hauler","skills":"./skills/","version":"0.7.1"}
+{"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","displayName":"cargo-hauler","hooks":"./.cursor-plugin/hooks.json","keywords":["cargo","rust","agent","mcp","claude-code","codex","cursor","build-orchestration"],"license":"MIT","mcpServers":"./.cursor-plugin/mcp.json","name":"cargo-hauler","repository":"https://github.com/ScriptedAlchemy/cargo-hauler","skills":"./skills/","version":"0.7.3"}

package/dist/AGENTS.md

@@ -23,6 +23,8 @@
   component and a view-model.
 - Documents must stay honest: a daemon the probe could not reach renders as
   `stopped`/`unresponsive` with its typed reason, never as an empty success.
+- Daemon stop results carry their typed shutdown outcome. Only confirmed exit
+  or confirmed prior absence is success; acknowledgement alone is not stopped.
 - Names are `hauler` / `cargo-hauler` / `CARGO_HAULER_*`. No other prefix is
   read; never add an alias.
 

package/dist/INSTALL.md

@@ -2,7 +2,7 @@
 
 Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.
 
-Version: `0.7.1`
+Version: `0.7.3`
 
 Run these commands from this bundle directory. The bundle is self-contained: every command below is
 a host command or the bundled installer, and nothing requires the `agent-bundle` CLI. Where that CLI is
@@ -206,22 +206,21 @@ is configured but not runnable there.
   - Partial `skills`: 2026-09-06: the emitted package root is not a Cascade discovery root; each skill directory is copied into .windsurf/skills/, ~/.codeium/windsurf/skills/, or .agents/skills/ before Cascade sees it, and the copy is what loads.
 - **Cline** (@cline/cli 0.0.13 exercised 2026-09-06; docs.cline.bot retrieved 2026-09-06 (@cline/sdk 0.0.82)) loads the components it recognizes without reading the manifest. Reads: `skills`. Install: `cp -R skills/<skill> ~/.cline/skills/<skill>`. Not loaded: manifest, mcp, placeholders, hooks.
   - Partial `skills`: 2026-09-06: the skill tree must be copied into one of Cline's own roots; the emitted package is not a Cline install unit, and no CLI verb in @cline/cli 0.0.13 performs the copy.
-- **CodeWhale** (Hmbown/CodeWhale main 19d34a5fb6c07b34e0b7234beb74a1cf1969efb4, docs retrieved 2026-09-06 (native Agent Plugins v1.0.0 support since v0.9.4)) installs this bundle as one plugin. Reads: `mcp.json`, `plugin.json`, `skills`. Install: `/plugin install ./<plugin directory>`. Not loaded: placeholders, hooks.
-  - Partial `mcp`: 2026-09-06: CodeWhale narrows the standard's env rule — "Local stdio environment entries must use exact ${SOURCE_ENV} references" — so an emitted env value that is anything other than one whole variable reference is not accepted there.
-- **GitHub Copilot CLI** (@github/copilot 1.0.83, installed and exercised 2026-09-06) installs this bundle as one plugin. Reads: `mcp.json`, `plugin.json`, `skills`. Install: `copilot plugin install <plugin directory>`. Not loaded: hooks.
-  - Partial `placeholders`: 2026-09-06: the probe proved the configuration Copilot records, not a spawned server: `copilot mcp get` prints static configuration, and spawning the server requires a GitHub Copilot login that was not performed.
-- **Devin CLI** (Agent Plugins 1.0.0; docs retrieved 2026-09-06, plugins documented as closed beta) installs this bundle as one plugin, but this build also writes `.claude-plugin/plugin.json`, which it reads as the plugin instead.
+- **CodeWhale** (Hmbown/CodeWhale main 19d34a5fb6c07b34e0b7234beb74a1cf1969efb4, docs retrieved 2026-09-06 (native Agent Plugins v1.0.0 support since v0.9.4)) loads this bundle as one plugin. Reads: `mcp.json`, `plugin.json`, `skills`. Install: `/plugin install ./<plugin directory>`. Not loaded: placeholders, hooks.
+  - Partial `mcp`: 2026-09-06: CodeWhale narrows the standard at the plugin boundary. Its env rule — "Local stdio environment entries must use exact ${SOURCE_ENV} references" — rejects an emitted env value that is anything other than one whole variable reference. A remote server emitted into mcp.json is narrower still: the URL must be HTTPS (or explicit loopback HTTP) with no user information, query, or fragment, a literal header is rejected in favor of CodeWhale's own env_headers or bearer_token_env_var keys, redirects must stay on the reviewed origin, and the bundle must declare exactly the normalized endpoint host set in capabilities.network_hosts. That declaration rides in extensions["net.codewhale"], which this projection writes only when the author authors portable.extensions; a remote server emitted without it is a validation error, and "an active bundle must be … free of validation errors", so the whole bundle stays inactive there until the author declares the matching host set.
+- **GitHub Copilot CLI** (@github/copilot 1.0.83, installed and exercised 2026-09-06) loads this bundle as one plugin. Reads: `plugin.json`, `skills`. Install: `copilot plugin install <plugin directory>`. Not loaded: hooks. This build also writes `.mcp.json`, which it uses for mcp instead. A root that also carries `.plugin/plugin.json` uses it for manifest and still reads the rest.
+- **Devin CLI** (Agent Plugins 1.0.0; docs retrieved 2026-09-06, plugins documented as closed beta) loads this bundle as one plugin, but this build also writes `.claude-plugin/plugin.json`, which it reads as the plugin instead.
 - **Gemini CLI** (@google/gemini-cli 0.58.0, installed and exercised 2026-09-06) loads the components it recognizes without reading the manifest. Reads: `skills`. Install: `gemini skills install <plugin directory>/skills/<skill>`. Not loaded: manifest, mcp, placeholders, hooks.
-- **Grok Build** (xai-org/grok-build main 72a61251fcffb464bcc687aeb5a998e5a98ec0c9, docs retrieved 2026-09-06) loads the components it recognizes without reading the manifest. Reads: `skills`. Install (no local-directory install is verified for this artifact): `grok plugin install <marketplace plugin name> --trust`. Not loaded: manifest, mcp, placeholders, hooks.
-- **Hermes Agent** (hermes-agent.nousresearch.com developer guide retrieved 2026-09-06; no version is printed on the page) installs this bundle as one plugin. Reads: `mcp.json`, `plugin.json`, `skills`. Install (no local-directory install is verified for this artifact): `hermes plugins install <owner>/<repository> --no-enable`. Not loaded: hooks.
+- **Grok Build** (xai-org/grok-build main 72a61251fcffb464bcc687aeb5a998e5a98ec0c9, docs retrieved 2026-09-06) loads the components it recognizes without reading the manifest. Reads: `skills`. Install from a marketplace (no local-directory install is verified for this artifact): `grok plugin install <marketplace plugin name> --trust`. Not loaded: manifest, mcp, placeholders, hooks.
+- **Hermes Agent** (hermes-agent.nousresearch.com developer guide retrieved 2026-09-06; no version is printed on the page) loads this bundle as one plugin. Reads: `mcp.json`, `plugin.json`, `skills`. Install from a Git repository (no local-directory install is verified for this artifact): `hermes plugins install <owner>/<repository> --no-enable`. Not loaded: hooks.
   - Partial `manifest`: 2026-09-06: the validation rule set is not published: the page never states that the manifest root is treated as closed or what happens to an unknown root key.
   - Partial `placeholders`: 2026-09-06: the expansion sites are unpublished — the page does not say whether ${PLUGIN_ROOT} and ${PLUGIN_DATA} are expanded in args, env values, and cwd as §9.1 requires, only that the variables are provided.
 - **JetBrains Junie** (junie.jetbrains.com/docs retrieved 2026-09-06, agent-skills page dated 01 September 2026; no CLI version is published on the page) loads the components it recognizes without reading the manifest. Reads: `skills`. Register: `junie --skill-location <plugin directory>/skills`. Not loaded: manifest, mcp, placeholders, hooks.
   - Partial `skills`: 2026-09-06: the emitted skills/ root is not a default location, so it loads only once registered with --skill-location or the skill-locations config field, and "if a project-level and a user-level skills have the same name, the user-level skill will be skipped".
-- **Kiro (Powers)** (kiro.dev/docs/powers pages updated September 2, 2026 and August 4, 2026, retrieved 2026-09-06) installs this bundle as one plugin. Reads: `mcp.json`, `plugin.json`, `skills`. Install: `Powers panel -> Add Custom Power -> Import power from a folder -> select <plugin directory> -> Install`. Not loaded: placeholders, hooks.
+- **Kiro (Powers)** (kiro.dev/docs/powers pages updated September 2, 2026 and August 4, 2026, retrieved 2026-09-06) loads this bundle as one plugin. Reads: `mcp.json`, `plugin.json`, `skills`. Install: `Powers panel -> Add Custom Power -> Import power from a folder -> select <plugin directory> -> Install`. Not loaded: placeholders, hooks.
   - Partial `manifest`: 2026-09-06: Kiro's "Required fields" table additionally requires version, description, author, and keywords, where the canonical schema requires only $schema and name — so a bundle that declares no portable author or keywords metadata does not meet Kiro's tightened manifest, and Kiro publishes no validation-error behavior to say what happens then.
   - Partial `mcp`: 2026-09-06: only stdio is documented for a power's mcp.json; no Kiro page states that a streamable-http server in that file is read, so an emitted remote server is unproven there.
-- **OpenClaw** (Agent Plugins 1.0.0; docs retrieved 2026-09-06) installs this bundle as one plugin, but this build also writes `.claude-plugin/plugin.json`, which it reads as the plugin instead.
+- **OpenClaw** (Agent Plugins 1.0.0; docs retrieved 2026-09-06) loads this bundle as one plugin, but this build also writes `.claude-plugin/plugin.json`, which it reads as the plugin instead.
 - **OpenCode** (opencode-ai 1.18.29 exercised 2026-09-06; opencode.ai/docs retrieved 2026-09-06) loads the components it recognizes without reading the manifest. Reads: `skills`. Install: `cp -R skills/<skill> .agents/skills/<skill>`. Not loaded: manifest, mcp, placeholders, hooks.
   - Partial `skills`: 2026-09-06: the skill tree must be copied into one of OpenCode's own roots; the emitted package as a whole is not an OpenCode install unit, and skill names must be unique across all roots ("Ensure skill names are unique across all locations").
 - **Pi** (@mariozechner/pi-coding-agent 0.73.1 installed from npm 2026-09-07; packaged docs/skills.md and docs/packages.md read from that release) loads the components it recognizes without reading the manifest. Reads: `skills`. Register: `pi --skill <plugin directory>/skills`. Not loaded: manifest, mcp, placeholders, hooks.
@@ -229,7 +228,7 @@ is configured but not runnable there.
 - **Qoder CLI** (docs retrieved 2026-09-06; no CLI version is published on any page) loads the components it recognizes without reading the manifest. Reads: `skills`. Install: `qoder plugins install <plugin directory> --scope user`. Not loaded: manifest, placeholders, hooks. This build also writes `.mcp.json`, which it uses for mcp instead.
 - **Swival** (docs retrieved 2026-09-06; no product version is published on the documentation pages) loads the components it recognizes without reading the manifest. Reads: `skills`. Register: `swival --skills-dir <plugin directory>/skills "<task>"`. Not loaded: manifest, mcp, placeholders, hooks.
   - Partial `skills`: 2026-09-06: the emitted skills/ root is not a default location, so it loads only once registered with --skills-dir or the swival.toml skills_dir field, and it loses by name to the default roots: "If the same skill name exists in multiple locations, the first one in the precedence order wins", with .swival/skills/ and .agents/skills/ ahead of --skills-dir paths. A registered tree outside the project resolves as external, which Swival adds "as read-only roots".
-- **VS Code (Copilot agent plugins)** (code.visualstudio.com/docs/agent-customization/agent-plugins, page footer 9/2/2026, retrieved 2026-09-06) installs this bundle as one plugin. Reads: `mcp.json`, `plugin.json`, `skills`. Install: `"chat.pluginLocations": { "<plugin directory>": true }`. Not loaded: placeholders, hooks.
+- **VS Code (Copilot agent plugins)** (code.visualstudio.com/docs/agent-customization/agent-plugins, page footer 9/2/2026, retrieved 2026-09-06) loads this bundle as one plugin. Reads: `mcp.json`, `plugin.json`, `skills`. Register: `"chat.pluginLocations": { "<plugin directory>": true }`. Not loaded: placeholders, hooks.
 - **Zed Agent** (zed.dev/docs retrieved 2026-09-06; no page publishes a version or last-updated date) loads the components it recognizes without reading the manifest. Reads: `skills`. Install: `cp -R skills/<skill> ~/.agents/skills/<skill>`. Not loaded: manifest, mcp, placeholders, hooks.
   - Partial `skills`: 2026-09-06: only the skill folders load, one copy at a time, and the catalog is capped — "50KB catalog budget… Skills that don't fit are dropped from the catalog with a warning in the UI" — so a large emitted skill set is not guaranteed to be wholly visible.
 

package/dist/README.md

@@ -85,7 +85,7 @@ The CLI is `hauler` on PATH from `npm i -g cargo-hauler`. Never run
 | `hauler result <ticket> [--full]` | A stored ticket in full: the settled 16 KiB output tail, or the whole live in-memory tail while it runs (not the status preview). The document names the full on-disk output log (`Full output: <path> (size)`) and `--json` carries it as `request.outputPath`; `--full` prints that whole log instead of the tail (the last ~768 KiB when it does not fit, with the path for the rest). |
 | `hauler kill <ticket>` | Stop a ticket: drop it from the queue or SIGTERM (then SIGKILL) its cargo process group, freeing the lane. Riders return to their lane or fail with it. |
 | `hauler request [--session ID] [--host HOST] [--cwd DIR] [--after TICKET …] -- <cargo …>` | Submit a background request and return its ticket, with where it landed in its lane (`queued behind cc-3281 (~13m)`, `waiting for cc-3281`, or `attached to cc-3281`). `--cwd` overrides the current CLI workspace; `--after` works as for `exec`. |
-| `hauler daemon <run\|start\|stop\|status\|restart>` | Manage the daemon lifecycle. `restart` is the manual replacement: it sends the graceful stop, waits up to 5 s for the old pid to exit, then starts a daemon from this install and prints both (`restarted: pid 741314 (0.6.0) → pid 742001 (0.6.1)`); a daemon that has not exited by then is reported, not killed, and nothing is started (exit `1`). Tickets in flight are not handed over: the old daemon settles them itself as it shuts down — `killed`, error `daemon shutdown` — and callers resubmit (only rows a daemon that died without shutting down never marked are stamped `orphaned by daemon restart` by the next daemon's first ledger pass). After upgrading the package, every client entry — reads (`status`, `daemon status`, `log`, `last`, `await`, `result`, the dashboard and MCP tools), writes, and hooks — checks the daemon version before requesting a versioned payload and replaces a daemon from the previous install automatically. When the old daemon has not exited within the grace, the command fails with `` cargo-hauler daemon pid N (X.Y.Z) is still running 5s after the shutdown request; not restarted — retry once it has exited, or stop it with `hauler daemon stop` `` instead of parsing its payload or starting a second daemon. |
+| `hauler daemon <run\|start\|stop\|status\|restart>` | Manage the daemon lifecycle. `stop` records its typed `shutdown` outcome in JSON and exits `0` only after a `shutting-down` acknowledgement followed by the original pid's exit, or when the daemon was already absent. Refusal, timeout, protocol error, disconnect before acknowledgement, and an acknowledged daemon still alive after 5 s exit `1`; `running` remains `true` when the original pid is alive and `null` when liveness could not be established. `restart` is the manual replacement: it sends the graceful stop, waits up to 5 s for the old pid to exit, then starts a daemon from this install and prints both (`restarted: pid 741314 (0.6.0) → pid 742001 (0.6.1)`); a daemon that has not exited by then is reported, not killed, and nothing is started (exit `1`). Tickets in flight are not handed over: the old daemon settles them itself as it shuts down — `killed`, error `daemon shutdown` — and callers resubmit (only rows a daemon that died without shutting down never marked are stamped `orphaned by daemon restart` by the next daemon's first ledger pass). After upgrading the package, every client entry — reads (`status`, `daemon status`, `log`, `last`, `await`, `result`, the dashboard and MCP tools), writes, and hooks — checks the daemon version before requesting a versioned payload and replaces a daemon from the previous install automatically. When the old daemon has not exited within the grace, the command fails with `` cargo-hauler daemon pid N (X.Y.Z) is still running 5s after the shutdown request; not restarted — retry once it has exited, or stop it with `hauler daemon stop` `` instead of parsing its payload or starting a second daemon. |
 | `hauler install-shim [--dir DIR] [--real-cargo PATH] [--force]` | Install the optional PATH shim. |
 | `hauler web [--port N] [--no-open]` | Open the dashboard from the checkout, npm package, or installed plugin. Agent Bundle's generated web command serves the built App against the plugin's own `hauler` server, opens it populated by `hauler_status`, and stays in the foreground until Ctrl-C. In an MCP host, call `hauler_status` instead. |
 
@@ -635,7 +635,7 @@ Per-host notes and hook timeouts are in [docs/install.md](docs/install.md).
 
 | Variable | Default | Meaning |
 | --- | --- | --- |
-| `CARGO_HAULER_STATE_DIR` | Per-user cache directory | Unix socket or Windows named pipe source, SQLite ledger, daemon log, pid lock, `hook-state.json`, `hook-events.jsonl`, and the per-ticket output logs under `tickets/`. |
+| `CARGO_HAULER_STATE_DIR` | Per-user cache directory | Unix socket or Windows named pipe source, SQLite ledger, daemon log, pid lock, `hook-state.json`, `hook-events.jsonl`, and the per-ticket output logs under `tickets/`. Owner-private on Linux and macOS: the directory is `0700` and its sensitive files `0600`, and an unsafe or unowned path is refused rather than reused. |
 | `CARGO_HAULER_CARGO_BIN` | `$CARGO_HOME/bin/cargo` | Cargo binary for daemon-started work; bare `cargo` is the last fallback. Never resolved through `PATH`. Read from the daemon's own environment (export it where the daemon starts, or before `hauler daemon start`); clients do not forward it. |
 | `CARGO_HAULER_MAX_CONCURRENT` | cores ÷ 8, clamped to 5–16 | Global admission permits for Cargo processes across all lanes; an integer >= 1. |
 | `CARGO_HAULER_OVERLAP_EXECUTION` | `1` | Hand a lane to its next request once a `test`/`nextest`/`bench`/`run` leader reports its build finished, overlapping the next compile with the leader's execution phase. `0` keeps a lane strictly one process at a time. |
@@ -672,11 +672,50 @@ as a warning (daemon log, or stderr for hand-run commands) and the default
 applies; only `0` or `off` disables an arm that documents that contract.
 The state directory defaults to `$XDG_CACHE_HOME/cargo-hauler`, otherwise
 `~/.cache/cargo-hauler` on Linux, `~/Library/Caches/cargo-hauler` on macOS, and
-`%LOCALAPPDATA%\cargo-hauler` on Windows. When `CARGO_HAULER_KACHE_INDEX` is
+`%LOCALAPPDATA%\cargo-hauler` on Windows. Its contents are owner-private, and
+the daemon is a single user's, not a shared service — see
+[State directory ownership](#state-directory-ownership). When
+`CARGO_HAULER_KACHE_INDEX` is
 unset, the daemon reads kache's configured local store from
 `$XDG_CONFIG_HOME/kache/config.toml` or `~/.config/kache/config.toml` and opens
 `<local_store>/index.db` read-only.
 
+### State directory ownership
+
+The daemon is local control for the user who owns its state directory, not a
+shared multi-user service. Everything under the state directory — complete
+command output in `tickets/`, the ledger, the daemon log, the passthrough
+spool, the hook records, the jobserver FIFO, the control socket — is that
+one account's, and there is no mechanism for a second user to submit work to
+another user's daemon.
+
+On Linux and macOS the daemon enforces that boundary rather than inheriting
+it from the umask:
+
+- Directories cargo-hauler creates are `0700`, and sensitive files `0600`,
+  whatever umask the invoking shell had. An existing state directory that
+  the running user already owns is tightened in place on the next start;
+  its contents are preserved.
+- Only the state directory and the entries cargo-hauler owns are changed. A
+  parent you configured through `CARGO_HAULER_STATE_DIR` — a shared volume,
+  a RAM disk — is never chmod'ed.
+- A state path that is a symbolic link, is the wrong kind of entry, or is
+  owned by another user is refused by name instead of being followed,
+  chmod'ed, or deleted. Fix or remove the path and start again; cargo-hauler
+  will not act on another account's file on your behalf.
+- When the state directory is too deep for the kernel's socket path limit,
+  the control socket moves to a `cargo-hauler-<uid>` directory (mode `0700`)
+  under `XDG_RUNTIME_DIR`, `TMPDIR`, or the system temporary directory —
+  never directly into a shared temporary root. Two accounts sharing one
+  temporary root get separate directories. A daemon from an earlier install
+  still listening at the previous relocated path is retired by the next
+  client under the usual one-version rule, and `hauler daemon stop` asks it
+  too before reporting nothing running, so upgrading needs no manual cleanup.
+
+Windows has neither POSIX modes nor uids, and its control endpoint is a
+named pipe rather than a filesystem entry, so none of the above applies
+there; state files keep the permissions the filesystem gives them.
+
 ## Runtime behavior and caveats
 
 - Hook and client transport failures fail open: a hook passes the original
@@ -946,8 +985,9 @@ Workbench's MCP page preview the same App with live rebuilds. The repository
 ships no preview harness of its own.
 
 agent-bundle does not yet have an npm release; this repository pins the
-[pkg.pr.new](https://pkg.pr.new) preview of Agent Bundle PR #733 commit
-[`5064133`](https://github.com/ScriptedAlchemy/agent-bundle/commit/506413326359bff154ce4476eb0f47b0dabf4efe)
+[pkg.pr.new](https://pkg.pr.new) preview of Agent Bundle main commit
+[`b807ca0`](https://github.com/ScriptedAlchemy/agent-bundle/commit/b807ca0eea5c0d5744350e1fa8829e3d59c3c0b8),
+merged by [Agent Bundle PR #772](https://github.com/ScriptedAlchemy/agent-bundle/pull/772),
 for both `agent-bundle` and `@agent-bundle/runtime`. `inspect` reports the
 `agent` component kind as unavailable on every host (agent-bundle G5
 deferral); this plugin defines no agents.