cargo-hauler 0.7.2 → 0.7.4

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## 0.7.4
+
+### Patch Changes
+
+- 4267d0c: Keep read-only commands and MCP tools on a protocol-compatible running daemon, and defer automatic replacement for submissions until the older daemon is idle (#209).
+  
+  Initialize the dashboard on every MCP Apps host — Codex, Claude, ChatGPT, VS Code/Cursor, and Goose — without host-specific origin exceptions (#212).
+
+## 0.7.3
+
+### Patch Changes
+
+- 5d14c4f: Initialize the dashboard in Codex Desktop when MCP Apps use a
+  `codex-sandbox://` origin (#206).
+- 4ac68a9: Make `hauler daemon stop` and `cargo-hauler daemon stop` preserve typed shutdown outcomes and fail when the daemon refuses, times out, returns a protocol error, disconnects before acknowledgement, or remains alive (#200).
+- bc2ed53: Make daemon state and relocated control sockets owner-private on Linux and
+  macOS. The state directory, `tickets/`, and the socket's runtime directory
+  are created `0700` and sensitive files — complete ticket output, the ledger
+  and its WAL sidecars, the daemon log, the passthrough spool, `hook-state.json`,
+  `hook-events.jsonl`, the pid lock, and the jobserver FIFO — `0600`,
+  independent of the invoking shell's umask, instead of inheriting `0755`/`0644`.
+  An existing state directory the running user owns is tightened in place; a
+  parent named by `CARGO_HAULER_STATE_DIR` is never chmod'ed, and a state path
+  that is a symlink, the wrong kind of entry, or owned by another user is
+  refused by name rather than followed, chmod'ed, or deleted. A state directory
+  too deep for `sun_path` now puts its socket in a `cargo-hauler-<uid>`
+  directory under `XDG_RUNTIME_DIR`/`TMPDIR`/the system temporary directory
+  instead of directly in a possibly shared temporary root, and the socket
+  digest no longer lowercases Unix paths, so case-distinct state directories no
+  longer share one control endpoint. A daemon left listening at the previous
+  relocated path is retired by the next client under the existing one-version
+  rule and stopped by `hauler daemon stop`, so the moved endpoint needs no
+  manual cleanup on upgrade. Windows keeps its named pipe and gains no POSIX
+  modes or uids. (#203)
+
 ## 0.7.2
 
 ### Patch Changes

package/README.md

@@ -85,7 +85,7 @@ The CLI is `hauler` on PATH from `npm i -g cargo-hauler`. Never run
 | `hauler result <ticket> [--full]` | A stored ticket in full: the settled 16 KiB output tail, or the whole live in-memory tail while it runs (not the status preview). The document names the full on-disk output log (`Full output: <path> (size)`) and `--json` carries it as `request.outputPath`; `--full` prints that whole log instead of the tail (the last ~768 KiB when it does not fit, with the path for the rest). |
 | `hauler kill <ticket>` | Stop a ticket: drop it from the queue or SIGTERM (then SIGKILL) its cargo process group, freeing the lane. Riders return to their lane or fail with it. |
 | `hauler request [--session ID] [--host HOST] [--cwd DIR] [--after TICKET …] -- <cargo …>` | Submit a background request and return its ticket, with where it landed in its lane (`queued behind cc-3281 (~13m)`, `waiting for cc-3281`, or `attached to cc-3281`). `--cwd` overrides the current CLI workspace; `--after` works as for `exec`. |
-| `hauler daemon <run\|start\|stop\|status\|restart>` | Manage the daemon lifecycle. `restart` is the manual replacement: it sends the graceful stop, waits up to 5 s for the old pid to exit, then starts a daemon from this install and prints both (`restarted: pid 741314 (0.6.0) → pid 742001 (0.6.1)`); a daemon that has not exited by then is reported, not killed, and nothing is started (exit `1`). Tickets in flight are not handed over: the old daemon settles them itself as it shuts down — `killed`, error `daemon shutdown` — and callers resubmit (only rows a daemon that died without shutting down never marked are stamped `orphaned by daemon restart` by the next daemon's first ledger pass). After upgrading the package, every client entry — reads (`status`, `daemon status`, `log`, `last`, `await`, `result`, the dashboard and MCP tools), writes, and hooks — checks the daemon version before requesting a versioned payload and replaces a daemon from the previous install automatically. When the old daemon has not exited within the grace, the command fails with `` cargo-hauler daemon pid N (X.Y.Z) is still running 5s after the shutdown request; not restarted — retry once it has exited, or stop it with `hauler daemon stop` `` instead of parsing its payload or starting a second daemon. |
+| `hauler daemon <run\|start\|stop\|status\|restart>` | Manage the daemon lifecycle. `stop` records its typed `shutdown` outcome in JSON and exits `0` only after a `shutting-down` acknowledgement followed by the original pid's exit, or when the daemon was already absent. Refusal, timeout, protocol error, disconnect before acknowledgement, and an acknowledged daemon still alive after 5 s exit `1`; `running` remains `true` when the original pid is alive and `null` when liveness could not be established. `restart` is the explicit replacement path: it sends the graceful stop, waits up to 5 s for the old pid to exit, then starts a daemon from this install and prints both (`restarted: pid 741314 (0.6.0) → pid 742001 (0.6.1)`). Tickets in flight are not handed over: the old daemon settles them itself as it shuts down — `killed`, error `daemon shutdown` — and callers resubmit. Automatic upgrades are gentler: read-only commands and MCP/dashboard reads never retire a daemon; a protocol-compatible older daemon serves them directly. Submission commands replace an older daemon only after an idle status check; daemons from 0.7.4 onward hold admission closed while confirming that state, while 0.7.1–0.7.3 receive a client preflight. A busy or slow-to-retire daemon keeps serving the submission and emits one line such as `daemon 0.7.1 will be replaced by 0.7.3 when idle`. A truly incompatible daemon is reported with its pid and version instead of having its payload parsed. |
 | `hauler install-shim [--dir DIR] [--real-cargo PATH] [--force]` | Install the optional PATH shim. |
 | `hauler web [--port N] [--no-open]` | Open the dashboard from the checkout, npm package, or installed plugin. Agent Bundle's generated web command serves the built App against the plugin's own `hauler` server, opens it populated by `hauler_status`, and stays in the foreground until Ctrl-C. In an MCP host, call `hauler_status` instead. |
 
@@ -448,9 +448,13 @@ ever flagged.
 Tickets do not survive a daemon stop; runs are never handed over to the next
 daemon. How a ticket ends depends on how the daemon went. A graceful stop —
 `hauler daemon restart`, `hauler daemon stop`, or the automatic replacement of
-a daemon from another install by the next `hauler exec`, `hauler request`,
-hook call, or `hauler daemon start` — is the shutdown request, and the old
-daemon settles every queued, running, and attached ticket itself as it exits:
+an idle older daemon by the next `hauler exec`, `hauler request`, hook
+submission, or `hauler daemon start` — is the shutdown request. Automatic
+replacement checks for queued, running, executing, or attached work first;
+0.7.4 and later daemons hold admission closed through that decision, while
+0.7.1–0.7.3 receive the compatible client's status preflight. When a stop does
+proceed, the old daemon settles every queued, running, and attached ticket
+itself as it exits:
 its cargo processes are terminated (SIGTERM, then SIGKILL after
 `CARGO_HAULER_KILL_GRACE_MS`) and each row is marked `killed` with the error
 `daemon shutdown`, so `hauler result cc-N` shows the ticket `killed` with
@@ -635,7 +639,7 @@ Per-host notes and hook timeouts are in [docs/install.md](docs/install.md).
 
 | Variable | Default | Meaning |
 | --- | --- | --- |
-| `CARGO_HAULER_STATE_DIR` | Per-user cache directory | Unix socket or Windows named pipe source, SQLite ledger, daemon log, pid lock, `hook-state.json`, `hook-events.jsonl`, and the per-ticket output logs under `tickets/`. |
+| `CARGO_HAULER_STATE_DIR` | Per-user cache directory | Unix socket or Windows named pipe source, SQLite ledger, daemon log, pid lock, `hook-state.json`, `hook-events.jsonl`, and the per-ticket output logs under `tickets/`. Owner-private on Linux and macOS: the directory is `0700` and its sensitive files `0600`, and an unsafe or unowned path is refused rather than reused. |
 | `CARGO_HAULER_CARGO_BIN` | `$CARGO_HOME/bin/cargo` | Cargo binary for daemon-started work; bare `cargo` is the last fallback. Never resolved through `PATH`. Read from the daemon's own environment (export it where the daemon starts, or before `hauler daemon start`); clients do not forward it. |
 | `CARGO_HAULER_MAX_CONCURRENT` | cores ÷ 8, clamped to 5–16 | Global admission permits for Cargo processes across all lanes; an integer >= 1. |
 | `CARGO_HAULER_OVERLAP_EXECUTION` | `1` | Hand a lane to its next request once a `test`/`nextest`/`bench`/`run` leader reports its build finished, overlapping the next compile with the leader's execution phase. `0` keeps a lane strictly one process at a time. |
@@ -672,11 +676,50 @@ as a warning (daemon log, or stderr for hand-run commands) and the default
 applies; only `0` or `off` disables an arm that documents that contract.
 The state directory defaults to `$XDG_CACHE_HOME/cargo-hauler`, otherwise
 `~/.cache/cargo-hauler` on Linux, `~/Library/Caches/cargo-hauler` on macOS, and
-`%LOCALAPPDATA%\cargo-hauler` on Windows. When `CARGO_HAULER_KACHE_INDEX` is
+`%LOCALAPPDATA%\cargo-hauler` on Windows. Its contents are owner-private, and
+the daemon is a single user's, not a shared service — see
+[State directory ownership](#state-directory-ownership). When
+`CARGO_HAULER_KACHE_INDEX` is
 unset, the daemon reads kache's configured local store from
 `$XDG_CONFIG_HOME/kache/config.toml` or `~/.config/kache/config.toml` and opens
 `<local_store>/index.db` read-only.
 
+### State directory ownership
+
+The daemon is local control for the user who owns its state directory, not a
+shared multi-user service. Everything under the state directory — complete
+command output in `tickets/`, the ledger, the daemon log, the passthrough
+spool, the hook records, the jobserver FIFO, the control socket — is that
+one account's, and there is no mechanism for a second user to submit work to
+another user's daemon.
+
+On Linux and macOS the daemon enforces that boundary rather than inheriting
+it from the umask:
+
+- Directories cargo-hauler creates are `0700`, and sensitive files `0600`,
+  whatever umask the invoking shell had. An existing state directory that
+  the running user already owns is tightened in place on the next start;
+  its contents are preserved.
+- Only the state directory and the entries cargo-hauler owns are changed. A
+  parent you configured through `CARGO_HAULER_STATE_DIR` — a shared volume,
+  a RAM disk — is never chmod'ed.
+- A state path that is a symbolic link, is the wrong kind of entry, or is
+  owned by another user is refused by name instead of being followed,
+  chmod'ed, or deleted. Fix or remove the path and start again; cargo-hauler
+  will not act on another account's file on your behalf.
+- When the state directory is too deep for the kernel's socket path limit,
+  the control socket moves to a `cargo-hauler-<uid>` directory (mode `0700`)
+  under `XDG_RUNTIME_DIR`, `TMPDIR`, or the system temporary directory —
+  never directly into a shared temporary root. Two accounts sharing one
+  temporary root get separate directories. A daemon from an earlier install
+  still listening at the previous relocated path is considered only by a
+  daemon-starting submission, never by a read; `hauler daemon stop` asks it
+  too before reporting nothing running.
+
+Windows has neither POSIX modes nor uids, and its control endpoint is a
+named pipe rather than a filesystem entry, so none of the above applies
+there; state files keep the permissions the filesystem gives them.
+
 ## Runtime behavior and caveats
 
 - Hook and client transport failures fail open: a hook passes the original
@@ -689,14 +732,11 @@ unset, the daemon reads kache's configured local store from
   `hauler_await` fail loudly when the daemon is unreachable instead of
   reporting a ticket as not found; `hauler_status`, `hauler_log`, and
   `hauler_last` read the ledger with the daemon marked `stopped` or
-  `unresponsive`. Before any live daemon reply is parsed, these reads apply
-  the one-version rule and replace a daemon left running by a previous
-  install. Replacement is directional: only a newer install replaces a
-  daemon. A client older than the daemon it finds — a session still on a
-  previous plugin — never shuts it down (the daemon refuses a shutdown from
-  an older or unversioned client), reports the daemon as newer, and runs
-  cargo directly. If replacement fails, the reads report that failure
-  instead of reading the stale payload.
+  `unresponsive`. Reads never request daemon shutdown. They use an older
+  daemon when its wire-protocol identity is compatible; a truly incompatible
+  daemon is reported with its pid and version. A client older than the daemon
+  it finds — a session still on a previous plugin — keeps the directional
+  `DaemonNewer` behavior and never shuts it down.
 - The state directory is not migrated between installs. Every rendered
   document names the one in use (`state dir …` in the header; `stateRoot` in
   `--json`), so a `CARGO_HAULER_STATE_DIR` change is visible on the next
@@ -946,9 +986,11 @@ Workbench's MCP page preview the same App with live rebuilds. The repository
 ships no preview harness of its own.
 
 agent-bundle does not yet have an npm release; this repository pins the
-[pkg.pr.new](https://pkg.pr.new) preview of Agent Bundle PR #733 commit
-[`5064133`](https://github.com/ScriptedAlchemy/agent-bundle/commit/506413326359bff154ce4476eb0f47b0dabf4efe)
-for both `agent-bundle` and `@agent-bundle/runtime`. `inspect` reports the
+[pkg.pr.new](https://pkg.pr.new) preview of Agent Bundle main commit
+[`e040c32`](https://github.com/ScriptedAlchemy/agent-bundle/commit/e040c32591d586eba72da6fa5c1bc1c881993000),
+built from [Agent Bundle PR #779](https://github.com/ScriptedAlchemy/agent-bundle/pull/779),
+for `agent-bundle`, `@agent-bundle/runtime`, and their paired
+`rsc-markdown-stream` preview. `inspect` reports the
 `agent` component kind as unavailable on every host (agent-bundle G5
 deferral); this plugin defines no agents.
 

package/dist/.claude-plugin/marketplace.json

@@ -1 +1 @@
-{"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","name":"cargo-hauler-marketplace","owner":{"name":"cargo-hauler"},"plugins":[{"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","name":"cargo-hauler","source":"./","version":"0.7.2"}]}
+{"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","name":"cargo-hauler-marketplace","owner":{"name":"cargo-hauler"},"plugins":[{"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","keywords":["cargo","rust","agent","mcp","claude-code","codex","cursor","build-orchestration"],"license":"MIT","name":"cargo-hauler","repository":"https://github.com/ScriptedAlchemy/cargo-hauler","source":"./","version":"0.7.4"}]}

package/dist/.claude-plugin/plugin.json

@@ -1 +1 @@
-{"author":{"name":"cargo-hauler"},"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","name":"cargo-hauler","version":"0.7.2"}
+{"author":{"name":"cargo-hauler"},"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","name":"cargo-hauler","version":"0.7.4"}

package/dist/.codex-plugin/plugin.json

@@ -1 +1 @@
-{"author":{"name":"cargo-hauler"},"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","hooks":"./.codex-plugin/hooks.json","interface":{"capabilities":["mcp","hooks","skills"],"category":"Productivity","defaultPrompt":["Help me use cargo-hauler."],"developerName":"cargo-hauler","displayName":"cargo-hauler","longDescription":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","shortDescription":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks."},"mcpServers":"./.codex-plugin/mcp.json","name":"cargo-hauler","skills":"./skills/","version":"0.7.2"}
+{"author":{"name":"cargo-hauler"},"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","hooks":"./.codex-plugin/hooks.json","interface":{"capabilities":["mcp","hooks","skills"],"category":"Productivity","defaultPrompt":["Help me use cargo-hauler."],"developerName":"cargo-hauler","displayName":"cargo-hauler","longDescription":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","shortDescription":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks."},"keywords":["cargo","rust","agent","mcp","claude-code","codex","cursor","build-orchestration"],"license":"MIT","mcpServers":"./.codex-plugin/mcp.json","name":"cargo-hauler","repository":"https://github.com/ScriptedAlchemy/cargo-hauler","skills":"./skills/","version":"0.7.4"}

package/dist/.cursor-plugin/plugin.json

@@ -1 +1 @@
-{"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","displayName":"cargo-hauler","hooks":"./.cursor-plugin/hooks.json","mcpServers":"./.cursor-plugin/mcp.json","name":"cargo-hauler","skills":"./skills/","version":"0.7.2"}
+{"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","displayName":"cargo-hauler","hooks":"./.cursor-plugin/hooks.json","keywords":["cargo","rust","agent","mcp","claude-code","codex","cursor","build-orchestration"],"license":"MIT","mcpServers":"./.cursor-plugin/mcp.json","name":"cargo-hauler","repository":"https://github.com/ScriptedAlchemy/cargo-hauler","skills":"./skills/","version":"0.7.4"}

package/dist/AGENTS.md

@@ -23,6 +23,8 @@
   component and a view-model.
 - Documents must stay honest: a daemon the probe could not reach renders as
   `stopped`/`unresponsive` with its typed reason, never as an empty success.
+- Daemon stop results carry their typed shutdown outcome. Only confirmed exit
+  or confirmed prior absence is success; acknowledgement alone is not stopped.
 - Names are `hauler` / `cargo-hauler` / `CARGO_HAULER_*`. No other prefix is
   read; never add an alias.
 

package/dist/INSTALL.md

@@ -2,7 +2,7 @@
 
 Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.
 
-Version: `0.7.2`
+Version: `0.7.4`
 
 Run these commands from this bundle directory. The bundle is self-contained: every command below is
 a host command or the bundled installer, and nothing requires the `agent-bundle` CLI. Where that CLI is
@@ -206,22 +206,21 @@ is configured but not runnable there.
   - Partial `skills`: 2026-09-06: the emitted package root is not a Cascade discovery root; each skill directory is copied into .windsurf/skills/, ~/.codeium/windsurf/skills/, or .agents/skills/ before Cascade sees it, and the copy is what loads.
 - **Cline** (@cline/cli 0.0.13 exercised 2026-09-06; docs.cline.bot retrieved 2026-09-06 (@cline/sdk 0.0.82)) loads the components it recognizes without reading the manifest. Reads: `skills`. Install: `cp -R skills/<skill> ~/.cline/skills/<skill>`. Not loaded: manifest, mcp, placeholders, hooks.
   - Partial `skills`: 2026-09-06: the skill tree must be copied into one of Cline's own roots; the emitted package is not a Cline install unit, and no CLI verb in @cline/cli 0.0.13 performs the copy.
-- **CodeWhale** (Hmbown/CodeWhale main 19d34a5fb6c07b34e0b7234beb74a1cf1969efb4, docs retrieved 2026-09-06 (native Agent Plugins v1.0.0 support since v0.9.4)) installs this bundle as one plugin. Reads: `mcp.json`, `plugin.json`, `skills`. Install: `/plugin install ./<plugin directory>`. Not loaded: placeholders, hooks.
-  - Partial `mcp`: 2026-09-06: CodeWhale narrows the standard's env rule — "Local stdio environment entries must use exact ${SOURCE_ENV} references" — so an emitted env value that is anything other than one whole variable reference is not accepted there.
-- **GitHub Copilot CLI** (@github/copilot 1.0.83, installed and exercised 2026-09-06) installs this bundle as one plugin. Reads: `mcp.json`, `plugin.json`, `skills`. Install: `copilot plugin install <plugin directory>`. Not loaded: hooks.
-  - Partial `placeholders`: 2026-09-06: the probe proved the configuration Copilot records, not a spawned server: `copilot mcp get` prints static configuration, and spawning the server requires a GitHub Copilot login that was not performed.
-- **Devin CLI** (Agent Plugins 1.0.0; docs retrieved 2026-09-06, plugins documented as closed beta) installs this bundle as one plugin, but this build also writes `.claude-plugin/plugin.json`, which it reads as the plugin instead.
+- **CodeWhale** (Hmbown/CodeWhale main 19d34a5fb6c07b34e0b7234beb74a1cf1969efb4, docs retrieved 2026-09-06 (native Agent Plugins v1.0.0 support since v0.9.4)) loads this bundle as one plugin. Reads: `mcp.json`, `plugin.json`, `skills`. Install: `/plugin install ./<plugin directory>`. Not loaded: placeholders, hooks.
+  - Partial `mcp`: 2026-09-06: CodeWhale narrows the standard at the plugin boundary. Its env rule — "Local stdio environment entries must use exact ${SOURCE_ENV} references" — rejects an emitted env value that is anything other than one whole variable reference. A remote server emitted into mcp.json is narrower still: the URL must be HTTPS (or explicit loopback HTTP) with no user information, query, or fragment, a literal header is rejected in favor of CodeWhale's own env_headers or bearer_token_env_var keys, redirects must stay on the reviewed origin, and the bundle must declare exactly the normalized endpoint host set in capabilities.network_hosts. That declaration rides in extensions["net.codewhale"], which this projection writes only when the author authors portable.extensions; a remote server emitted without it is a validation error, and "an active bundle must be … free of validation errors", so the whole bundle stays inactive there until the author declares the matching host set.
+- **GitHub Copilot CLI** (@github/copilot 1.0.83, installed and exercised 2026-09-06) loads this bundle as one plugin. Reads: `plugin.json`, `skills`. Install: `copilot plugin install <plugin directory>`. Not loaded: hooks. This build also writes `.mcp.json`, which it uses for mcp instead. A root that also carries `.plugin/plugin.json` uses it for manifest and still reads the rest.
+- **Devin CLI** (Agent Plugins 1.0.0; docs retrieved 2026-09-06, plugins documented as closed beta) loads this bundle as one plugin, but this build also writes `.claude-plugin/plugin.json`, which it reads as the plugin instead.
 - **Gemini CLI** (@google/gemini-cli 0.58.0, installed and exercised 2026-09-06) loads the components it recognizes without reading the manifest. Reads: `skills`. Install: `gemini skills install <plugin directory>/skills/<skill>`. Not loaded: manifest, mcp, placeholders, hooks.
-- **Grok Build** (xai-org/grok-build main 72a61251fcffb464bcc687aeb5a998e5a98ec0c9, docs retrieved 2026-09-06) loads the components it recognizes without reading the manifest. Reads: `skills`. Install (no local-directory install is verified for this artifact): `grok plugin install <marketplace plugin name> --trust`. Not loaded: manifest, mcp, placeholders, hooks.
-- **Hermes Agent** (hermes-agent.nousresearch.com developer guide retrieved 2026-09-06; no version is printed on the page) installs this bundle as one plugin. Reads: `mcp.json`, `plugin.json`, `skills`. Install (no local-directory install is verified for this artifact): `hermes plugins install <owner>/<repository> --no-enable`. Not loaded: hooks.
+- **Grok Build** (xai-org/grok-build main 72a61251fcffb464bcc687aeb5a998e5a98ec0c9, docs retrieved 2026-09-06) loads the components it recognizes without reading the manifest. Reads: `skills`. Install from a marketplace (no local-directory install is verified for this artifact): `grok plugin install <marketplace plugin name> --trust`. Not loaded: manifest, mcp, placeholders, hooks.
+- **Hermes Agent** (hermes-agent.nousresearch.com developer guide retrieved 2026-09-06; no version is printed on the page) loads this bundle as one plugin. Reads: `mcp.json`, `plugin.json`, `skills`. Install from a Git repository (no local-directory install is verified for this artifact): `hermes plugins install <owner>/<repository> --no-enable`. Not loaded: hooks.
   - Partial `manifest`: 2026-09-06: the validation rule set is not published: the page never states that the manifest root is treated as closed or what happens to an unknown root key.
   - Partial `placeholders`: 2026-09-06: the expansion sites are unpublished — the page does not say whether ${PLUGIN_ROOT} and ${PLUGIN_DATA} are expanded in args, env values, and cwd as §9.1 requires, only that the variables are provided.
 - **JetBrains Junie** (junie.jetbrains.com/docs retrieved 2026-09-06, agent-skills page dated 01 September 2026; no CLI version is published on the page) loads the components it recognizes without reading the manifest. Reads: `skills`. Register: `junie --skill-location <plugin directory>/skills`. Not loaded: manifest, mcp, placeholders, hooks.
   - Partial `skills`: 2026-09-06: the emitted skills/ root is not a default location, so it loads only once registered with --skill-location or the skill-locations config field, and "if a project-level and a user-level skills have the same name, the user-level skill will be skipped".
-- **Kiro (Powers)** (kiro.dev/docs/powers pages updated September 2, 2026 and August 4, 2026, retrieved 2026-09-06) installs this bundle as one plugin. Reads: `mcp.json`, `plugin.json`, `skills`. Install: `Powers panel -> Add Custom Power -> Import power from a folder -> select <plugin directory> -> Install`. Not loaded: placeholders, hooks.
+- **Kiro (Powers)** (kiro.dev/docs/powers pages updated September 2, 2026 and August 4, 2026, retrieved 2026-09-06) loads this bundle as one plugin. Reads: `mcp.json`, `plugin.json`, `skills`. Install: `Powers panel -> Add Custom Power -> Import power from a folder -> select <plugin directory> -> Install`. Not loaded: placeholders, hooks.
   - Partial `manifest`: 2026-09-06: Kiro's "Required fields" table additionally requires version, description, author, and keywords, where the canonical schema requires only $schema and name — so a bundle that declares no portable author or keywords metadata does not meet Kiro's tightened manifest, and Kiro publishes no validation-error behavior to say what happens then.
   - Partial `mcp`: 2026-09-06: only stdio is documented for a power's mcp.json; no Kiro page states that a streamable-http server in that file is read, so an emitted remote server is unproven there.
-- **OpenClaw** (Agent Plugins 1.0.0; docs retrieved 2026-09-06) installs this bundle as one plugin, but this build also writes `.claude-plugin/plugin.json`, which it reads as the plugin instead.
+- **OpenClaw** (Agent Plugins 1.0.0; docs retrieved 2026-09-06) loads this bundle as one plugin, but this build also writes `.claude-plugin/plugin.json`, which it reads as the plugin instead.
 - **OpenCode** (opencode-ai 1.18.29 exercised 2026-09-06; opencode.ai/docs retrieved 2026-09-06) loads the components it recognizes without reading the manifest. Reads: `skills`. Install: `cp -R skills/<skill> .agents/skills/<skill>`. Not loaded: manifest, mcp, placeholders, hooks.
   - Partial `skills`: 2026-09-06: the skill tree must be copied into one of OpenCode's own roots; the emitted package as a whole is not an OpenCode install unit, and skill names must be unique across all roots ("Ensure skill names are unique across all locations").
 - **Pi** (@mariozechner/pi-coding-agent 0.73.1 installed from npm 2026-09-07; packaged docs/skills.md and docs/packages.md read from that release) loads the components it recognizes without reading the manifest. Reads: `skills`. Register: `pi --skill <plugin directory>/skills`. Not loaded: manifest, mcp, placeholders, hooks.
@@ -229,7 +228,7 @@ is configured but not runnable there.
 - **Qoder CLI** (docs retrieved 2026-09-06; no CLI version is published on any page) loads the components it recognizes without reading the manifest. Reads: `skills`. Install: `qoder plugins install <plugin directory> --scope user`. Not loaded: manifest, placeholders, hooks. This build also writes `.mcp.json`, which it uses for mcp instead.
 - **Swival** (docs retrieved 2026-09-06; no product version is published on the documentation pages) loads the components it recognizes without reading the manifest. Reads: `skills`. Register: `swival --skills-dir <plugin directory>/skills "<task>"`. Not loaded: manifest, mcp, placeholders, hooks.
   - Partial `skills`: 2026-09-06: the emitted skills/ root is not a default location, so it loads only once registered with --skills-dir or the swival.toml skills_dir field, and it loses by name to the default roots: "If the same skill name exists in multiple locations, the first one in the precedence order wins", with .swival/skills/ and .agents/skills/ ahead of --skills-dir paths. A registered tree outside the project resolves as external, which Swival adds "as read-only roots".
-- **VS Code (Copilot agent plugins)** (code.visualstudio.com/docs/agent-customization/agent-plugins, page footer 9/2/2026, retrieved 2026-09-06) installs this bundle as one plugin. Reads: `mcp.json`, `plugin.json`, `skills`. Install: `"chat.pluginLocations": { "<plugin directory>": true }`. Not loaded: placeholders, hooks.
+- **VS Code (Copilot agent plugins)** (code.visualstudio.com/docs/agent-customization/agent-plugins, page footer 9/2/2026, retrieved 2026-09-06) loads this bundle as one plugin. Reads: `mcp.json`, `plugin.json`, `skills`. Register: `"chat.pluginLocations": { "<plugin directory>": true }`. Not loaded: placeholders, hooks.
 - **Zed Agent** (zed.dev/docs retrieved 2026-09-06; no page publishes a version or last-updated date) loads the components it recognizes without reading the manifest. Reads: `skills`. Install: `cp -R skills/<skill> ~/.agents/skills/<skill>`. Not loaded: manifest, mcp, placeholders, hooks.
   - Partial `skills`: 2026-09-06: only the skill folders load, one copy at a time, and the catalog is capped — "50KB catalog budget… Skills that don't fit are dropped from the catalog with a warning in the UI" — so a large emitted skill set is not guaranteed to be wholly visible.
 

package/dist/README.md

@@ -85,7 +85,7 @@ The CLI is `hauler` on PATH from `npm i -g cargo-hauler`. Never run
 | `hauler result <ticket> [--full]` | A stored ticket in full: the settled 16 KiB output tail, or the whole live in-memory tail while it runs (not the status preview). The document names the full on-disk output log (`Full output: <path> (size)`) and `--json` carries it as `request.outputPath`; `--full` prints that whole log instead of the tail (the last ~768 KiB when it does not fit, with the path for the rest). |
 | `hauler kill <ticket>` | Stop a ticket: drop it from the queue or SIGTERM (then SIGKILL) its cargo process group, freeing the lane. Riders return to their lane or fail with it. |
 | `hauler request [--session ID] [--host HOST] [--cwd DIR] [--after TICKET …] -- <cargo …>` | Submit a background request and return its ticket, with where it landed in its lane (`queued behind cc-3281 (~13m)`, `waiting for cc-3281`, or `attached to cc-3281`). `--cwd` overrides the current CLI workspace; `--after` works as for `exec`. |
-| `hauler daemon <run\|start\|stop\|status\|restart>` | Manage the daemon lifecycle. `restart` is the manual replacement: it sends the graceful stop, waits up to 5 s for the old pid to exit, then starts a daemon from this install and prints both (`restarted: pid 741314 (0.6.0) → pid 742001 (0.6.1)`); a daemon that has not exited by then is reported, not killed, and nothing is started (exit `1`). Tickets in flight are not handed over: the old daemon settles them itself as it shuts down — `killed`, error `daemon shutdown` — and callers resubmit (only rows a daemon that died without shutting down never marked are stamped `orphaned by daemon restart` by the next daemon's first ledger pass). After upgrading the package, every client entry — reads (`status`, `daemon status`, `log`, `last`, `await`, `result`, the dashboard and MCP tools), writes, and hooks — checks the daemon version before requesting a versioned payload and replaces a daemon from the previous install automatically. When the old daemon has not exited within the grace, the command fails with `` cargo-hauler daemon pid N (X.Y.Z) is still running 5s after the shutdown request; not restarted — retry once it has exited, or stop it with `hauler daemon stop` `` instead of parsing its payload or starting a second daemon. |
+| `hauler daemon <run\|start\|stop\|status\|restart>` | Manage the daemon lifecycle. `stop` records its typed `shutdown` outcome in JSON and exits `0` only after a `shutting-down` acknowledgement followed by the original pid's exit, or when the daemon was already absent. Refusal, timeout, protocol error, disconnect before acknowledgement, and an acknowledged daemon still alive after 5 s exit `1`; `running` remains `true` when the original pid is alive and `null` when liveness could not be established. `restart` is the explicit replacement path: it sends the graceful stop, waits up to 5 s for the old pid to exit, then starts a daemon from this install and prints both (`restarted: pid 741314 (0.6.0) → pid 742001 (0.6.1)`). Tickets in flight are not handed over: the old daemon settles them itself as it shuts down — `killed`, error `daemon shutdown` — and callers resubmit. Automatic upgrades are gentler: read-only commands and MCP/dashboard reads never retire a daemon; a protocol-compatible older daemon serves them directly. Submission commands replace an older daemon only after an idle status check; daemons from 0.7.4 onward hold admission closed while confirming that state, while 0.7.1–0.7.3 receive a client preflight. A busy or slow-to-retire daemon keeps serving the submission and emits one line such as `daemon 0.7.1 will be replaced by 0.7.3 when idle`. A truly incompatible daemon is reported with its pid and version instead of having its payload parsed. |
 | `hauler install-shim [--dir DIR] [--real-cargo PATH] [--force]` | Install the optional PATH shim. |
 | `hauler web [--port N] [--no-open]` | Open the dashboard from the checkout, npm package, or installed plugin. Agent Bundle's generated web command serves the built App against the plugin's own `hauler` server, opens it populated by `hauler_status`, and stays in the foreground until Ctrl-C. In an MCP host, call `hauler_status` instead. |
 
@@ -448,9 +448,13 @@ ever flagged.
 Tickets do not survive a daemon stop; runs are never handed over to the next
 daemon. How a ticket ends depends on how the daemon went. A graceful stop —
 `hauler daemon restart`, `hauler daemon stop`, or the automatic replacement of
-a daemon from another install by the next `hauler exec`, `hauler request`,
-hook call, or `hauler daemon start` — is the shutdown request, and the old
-daemon settles every queued, running, and attached ticket itself as it exits:
+an idle older daemon by the next `hauler exec`, `hauler request`, hook
+submission, or `hauler daemon start` — is the shutdown request. Automatic
+replacement checks for queued, running, executing, or attached work first;
+0.7.4 and later daemons hold admission closed through that decision, while
+0.7.1–0.7.3 receive the compatible client's status preflight. When a stop does
+proceed, the old daemon settles every queued, running, and attached ticket
+itself as it exits:
 its cargo processes are terminated (SIGTERM, then SIGKILL after
 `CARGO_HAULER_KILL_GRACE_MS`) and each row is marked `killed` with the error
 `daemon shutdown`, so `hauler result cc-N` shows the ticket `killed` with
@@ -635,7 +639,7 @@ Per-host notes and hook timeouts are in [docs/install.md](docs/install.md).
 
 | Variable | Default | Meaning |
 | --- | --- | --- |
-| `CARGO_HAULER_STATE_DIR` | Per-user cache directory | Unix socket or Windows named pipe source, SQLite ledger, daemon log, pid lock, `hook-state.json`, `hook-events.jsonl`, and the per-ticket output logs under `tickets/`. |
+| `CARGO_HAULER_STATE_DIR` | Per-user cache directory | Unix socket or Windows named pipe source, SQLite ledger, daemon log, pid lock, `hook-state.json`, `hook-events.jsonl`, and the per-ticket output logs under `tickets/`. Owner-private on Linux and macOS: the directory is `0700` and its sensitive files `0600`, and an unsafe or unowned path is refused rather than reused. |
 | `CARGO_HAULER_CARGO_BIN` | `$CARGO_HOME/bin/cargo` | Cargo binary for daemon-started work; bare `cargo` is the last fallback. Never resolved through `PATH`. Read from the daemon's own environment (export it where the daemon starts, or before `hauler daemon start`); clients do not forward it. |
 | `CARGO_HAULER_MAX_CONCURRENT` | cores ÷ 8, clamped to 5–16 | Global admission permits for Cargo processes across all lanes; an integer >= 1. |
 | `CARGO_HAULER_OVERLAP_EXECUTION` | `1` | Hand a lane to its next request once a `test`/`nextest`/`bench`/`run` leader reports its build finished, overlapping the next compile with the leader's execution phase. `0` keeps a lane strictly one process at a time. |
@@ -672,11 +676,50 @@ as a warning (daemon log, or stderr for hand-run commands) and the default
 applies; only `0` or `off` disables an arm that documents that contract.
 The state directory defaults to `$XDG_CACHE_HOME/cargo-hauler`, otherwise
 `~/.cache/cargo-hauler` on Linux, `~/Library/Caches/cargo-hauler` on macOS, and
-`%LOCALAPPDATA%\cargo-hauler` on Windows. When `CARGO_HAULER_KACHE_INDEX` is
+`%LOCALAPPDATA%\cargo-hauler` on Windows. Its contents are owner-private, and
+the daemon is a single user's, not a shared service — see
+[State directory ownership](#state-directory-ownership). When
+`CARGO_HAULER_KACHE_INDEX` is
 unset, the daemon reads kache's configured local store from
 `$XDG_CONFIG_HOME/kache/config.toml` or `~/.config/kache/config.toml` and opens
 `<local_store>/index.db` read-only.
 
+### State directory ownership
+
+The daemon is local control for the user who owns its state directory, not a
+shared multi-user service. Everything under the state directory — complete
+command output in `tickets/`, the ledger, the daemon log, the passthrough
+spool, the hook records, the jobserver FIFO, the control socket — is that
+one account's, and there is no mechanism for a second user to submit work to
+another user's daemon.
+
+On Linux and macOS the daemon enforces that boundary rather than inheriting
+it from the umask:
+
+- Directories cargo-hauler creates are `0700`, and sensitive files `0600`,
+  whatever umask the invoking shell had. An existing state directory that
+  the running user already owns is tightened in place on the next start;
+  its contents are preserved.
+- Only the state directory and the entries cargo-hauler owns are changed. A
+  parent you configured through `CARGO_HAULER_STATE_DIR` — a shared volume,
+  a RAM disk — is never chmod'ed.
+- A state path that is a symbolic link, is the wrong kind of entry, or is
+  owned by another user is refused by name instead of being followed,
+  chmod'ed, or deleted. Fix or remove the path and start again; cargo-hauler
+  will not act on another account's file on your behalf.
+- When the state directory is too deep for the kernel's socket path limit,
+  the control socket moves to a `cargo-hauler-<uid>` directory (mode `0700`)
+  under `XDG_RUNTIME_DIR`, `TMPDIR`, or the system temporary directory —
+  never directly into a shared temporary root. Two accounts sharing one
+  temporary root get separate directories. A daemon from an earlier install
+  still listening at the previous relocated path is considered only by a
+  daemon-starting submission, never by a read; `hauler daemon stop` asks it
+  too before reporting nothing running.
+
+Windows has neither POSIX modes nor uids, and its control endpoint is a
+named pipe rather than a filesystem entry, so none of the above applies
+there; state files keep the permissions the filesystem gives them.
+
 ## Runtime behavior and caveats
 
 - Hook and client transport failures fail open: a hook passes the original
@@ -689,14 +732,11 @@ unset, the daemon reads kache's configured local store from
   `hauler_await` fail loudly when the daemon is unreachable instead of
   reporting a ticket as not found; `hauler_status`, `hauler_log`, and
   `hauler_last` read the ledger with the daemon marked `stopped` or
-  `unresponsive`. Before any live daemon reply is parsed, these reads apply
-  the one-version rule and replace a daemon left running by a previous
-  install. Replacement is directional: only a newer install replaces a
-  daemon. A client older than the daemon it finds — a session still on a
-  previous plugin — never shuts it down (the daemon refuses a shutdown from
-  an older or unversioned client), reports the daemon as newer, and runs
-  cargo directly. If replacement fails, the reads report that failure
-  instead of reading the stale payload.
+  `unresponsive`. Reads never request daemon shutdown. They use an older
+  daemon when its wire-protocol identity is compatible; a truly incompatible
+  daemon is reported with its pid and version. A client older than the daemon
+  it finds — a session still on a previous plugin — keeps the directional
+  `DaemonNewer` behavior and never shuts it down.
 - The state directory is not migrated between installs. Every rendered
   document names the one in use (`state dir …` in the header; `stateRoot` in
   `--json`), so a `CARGO_HAULER_STATE_DIR` change is visible on the next
@@ -946,9 +986,11 @@ Workbench's MCP page preview the same App with live rebuilds. The repository
 ships no preview harness of its own.
 
 agent-bundle does not yet have an npm release; this repository pins the
-[pkg.pr.new](https://pkg.pr.new) preview of Agent Bundle PR #733 commit
-[`5064133`](https://github.com/ScriptedAlchemy/agent-bundle/commit/506413326359bff154ce4476eb0f47b0dabf4efe)
-for both `agent-bundle` and `@agent-bundle/runtime`. `inspect` reports the
+[pkg.pr.new](https://pkg.pr.new) preview of Agent Bundle main commit
+[`e040c32`](https://github.com/ScriptedAlchemy/agent-bundle/commit/e040c32591d586eba72da6fa5c1bc1c881993000),
+built from [Agent Bundle PR #779](https://github.com/ScriptedAlchemy/agent-bundle/pull/779),
+for `agent-bundle`, `@agent-bundle/runtime`, and their paired
+`rsc-markdown-stream` preview. `inspect` reports the
 `agent` component kind as unavailable on every host (agent-bundle G5
 deferral); this plugin defines no agents.