squadrant 0.18.0 → 0.18.1

package/dist/squadrantd.js

@@ -60,22 +60,90 @@ var init_snapshot = __esm({
 });
 
 // packages/cli/src/squadrantd.ts
-import { join as join19, dirname as dirname5 } from "path";
+import { join as join19, dirname as dirname4 } from "path";
 import { homedir as homedir14 } from "os";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { readFileSync as readFileSync14, statSync as statSync4 } from "fs";
+import { readFileSync as readFileSync13, statSync as statSync4, existsSync as existsSync12 } from "fs";
 
 // packages/shared/dist/config.js
-import fs from "fs";
-import path from "path";
+import path2 from "path";
 import os from "os";
 import chalk from "chalk";
-var CONFIG_DIR = path.join(os.homedir(), ".config", "squadrant");
-var DEFAULT_CONFIG_PATH = path.join(CONFIG_DIR, "config.json");
+
+// packages/shared/dist/lib/config-io.js
+import fs from "fs";
+import path from "path";
+var didLogMigration = false;
+var migrationRun = false;
+function tightenModeSync(p, expectedMode) {
+  try {
+    if (!fs.existsSync(p))
+      return;
+    const stat = fs.statSync(p);
+    const currentMode = stat.mode & 4095;
+    if ((currentMode & ~expectedMode) !== 0) {
+      fs.chmodSync(p, expectedMode);
+      if (!didLogMigration) {
+        console.warn(`\x1B[33m\u26A0\x1B[0m squadrant: tightened config file permissions (security fix #668)`);
+        didLogMigration = true;
+      }
+    }
+  } catch {
+  }
+}
+function writeConfigFileSync(filePath, content) {
+  ensureDirSync(path.dirname(filePath));
+  fs.writeFileSync(filePath, content, { mode: 384 });
+  tightenModeSync(filePath, 384);
+}
+function ensureDirSync(dirPath) {
+  if (dirPath !== CONFIG_DIR && !dirPath.startsWith(CONFIG_DIR + path.sep)) {
+    fs.mkdirSync(dirPath, { recursive: true });
+    return;
+  }
+  fs.mkdirSync(dirPath, { recursive: true, mode: 448 });
+  let current = dirPath;
+  while (current === CONFIG_DIR || current.startsWith(CONFIG_DIR + path.sep)) {
+    tightenModeSync(current, 448);
+    if (current === CONFIG_DIR)
+      break;
+    const parent = path.dirname(current);
+    if (parent === current)
+      break;
+    current = parent;
+  }
+}
+function readConfigFileSync(filePath) {
+  return fs.readFileSync(filePath, "utf-8");
+}
+function migrateConfigPermsSync() {
+  if (migrationRun)
+    return;
+  migrationRun = true;
+  tightenModeSync(CONFIG_DIR, 448);
+  tightenModeSync(path.join(CONFIG_DIR, "config.json"), 384);
+  const projectsDir = path.join(CONFIG_DIR, "projects");
+  tightenModeSync(projectsDir, 448);
+  try {
+    if (fs.existsSync(projectsDir)) {
+      const files = fs.readdirSync(projectsDir);
+      for (const file of files) {
+        if (file.endsWith(".json")) {
+          tightenModeSync(path.join(projectsDir, file), 384);
+        }
+      }
+    }
+  } catch {
+  }
+}
+
+// packages/shared/dist/config.js
+var DEFAULT_CONFIG_PATH = process.env.SQUADRANT_CONFIG || path2.join(os.homedir(), ".config", "squadrant", "config.json");
+var CONFIG_DIR = path2.dirname(DEFAULT_CONFIG_PATH);
 function getDefaultConfig() {
   return {
     commandName: "\u{1F3DB}\uFE0F command",
-    hubVault: path.join(os.homedir(), "squadrant-hub"),
+    hubVault: path2.join(os.homedir(), "squadrant-hub"),
     projects: {},
     agents: {
       claude: { cli: "claude", driver: "claude" }
@@ -119,13 +187,14 @@ function getDefaultConfig() {
     },
     metrics: {
       enabled: true,
-      path: path.join(CONFIG_DIR, "metrics.json")
+      path: path2.join(CONFIG_DIR, "metrics.json")
     }
   };
 }
 function loadConfig(configPath = DEFAULT_CONFIG_PATH) {
+  migrateConfigPermsSync();
   try {
-    const raw = fs.readFileSync(configPath, "utf-8");
+    const raw = readConfigFileSync(configPath);
     const config = JSON.parse(raw);
     if (config.defaults.models && !config.defaults.roles) {
       const m = config.defaults.models;
@@ -150,27 +219,24 @@ function loadConfig(configPath = DEFAULT_CONFIG_PATH) {
   }
 }
 function saveConfig(config, configPath = DEFAULT_CONFIG_PATH) {
-  const dir = path.dirname(configPath);
-  fs.mkdirSync(dir, { recursive: true });
-  fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+  writeConfigFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
 }
 function resolveHome(p) {
   return p.startsWith("~") ? p.replace("~", os.homedir()) : p;
 }
 
 // packages/shared/dist/project-config.js
-import fs2 from "fs";
 import os2 from "os";
-import path2 from "path";
+import path3 from "path";
 function defaultRoot() {
-  return path2.join(os2.homedir(), ".config", "squadrant");
+  return path3.join(os2.homedir(), ".config", "squadrant");
 }
 function projectConfigPath(name, root = defaultRoot()) {
-  return path2.join(root, "projects", `${name}.json`);
+  return path3.join(root, "projects", `${name}.json`);
 }
 function loadProjectOverride(name, root = defaultRoot()) {
   try {
-    return JSON.parse(fs2.readFileSync(projectConfigPath(name, root), "utf-8"));
+    return JSON.parse(readConfigFileSync(projectConfigPath(name, root)));
   } catch {
     return {};
   }
@@ -187,8 +253,7 @@ function deepMerge(base, patch) {
 function saveProjectOverride(name, patch, root = defaultRoot()) {
   const merged = deepMerge(loadProjectOverride(name, root), patch);
   const file = projectConfigPath(name, root);
-  fs2.mkdirSync(path2.dirname(file), { recursive: true });
-  fs2.writeFileSync(file, JSON.stringify(merged, null, 2) + "\n");
+  writeConfigFileSync(file, JSON.stringify(merged, null, 2) + "\n");
 }
 var DEFAULT_NOTIFY = { active: false, cap: true, crew: "alert_only" };
 function resolveNotify(globalNotify, override) {
@@ -208,9 +273,9 @@ var TERMINAL_STATES = /* @__PURE__ */ new Set([
 ]);
 
 // packages/shared/dist/lib/cmux-autoconfig.js
-import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3, mkdirSync as mkdirSync2, rmSync as rmSync2 } from "fs";
+import { existsSync as existsSync4, rmSync as rmSync2 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname2, join as join4 } from "path";
+import { join as join4 } from "path";
 
 // packages/shared/dist/lib/cmux-config.js
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";
@@ -233,22 +298,22 @@ var MINIMAL_TEMPLATE = [
   ``
 ].join("\n");
 function ensureSocketAutomation(opts = {}) {
-  const path19 = opts.path ?? defaultCmuxConfigPath();
-  if (!existsSync(path19)) {
-    mkdirSync(dirname(path19), { recursive: true });
-    writeFileSync(path19, MINIMAL_TEMPLATE);
-    return { path: path19, changed: true, alreadySet: false };
+  const path20 = opts.path ?? defaultCmuxConfigPath();
+  if (!existsSync(path20)) {
+    mkdirSync(dirname(path20), { recursive: true });
+    writeFileSync(path20, MINIMAL_TEMPLATE);
+    return { path: path20, changed: true, alreadySet: false };
   }
-  const text = readFileSync(path19, "utf-8");
+  const text = readFileSync(path20, "utf-8");
   const current = parse(text)?.automation?.socketControlMode;
   if (current === AUTOMATION_MODE) {
-    return { path: path19, changed: false, alreadySet: true };
+    return { path: path20, changed: false, alreadySet: true };
   }
   const edits = modify(text, [...SOCKET_CONTROL_MODE_PATH], AUTOMATION_MODE, {
     formattingOptions: { insertSpaces: true, tabSize: 2 }
   });
-  writeFileSync(path19, applyEdits(text, edits));
-  return { path: path19, changed: true, alreadySet: false };
+  writeFileSync(path20, applyEdits(text, edits));
+  return { path: path20, changed: true, alreadySet: false };
 }
 
 // packages/shared/dist/lib/cmux-probe.js
@@ -370,9 +435,9 @@ function sleep(ms) {
 function defaultStatePath() {
   return join4(homedir3(), ".config", "squadrant", "state", "cmux-autoconfig.json");
 }
-function readState(path19) {
+function readState(path20) {
   try {
-    return JSON.parse(readFileSync4(path19, "utf-8"));
+    return JSON.parse(readConfigFileSync(path20));
   } catch {
     return {};
   }
@@ -388,8 +453,7 @@ async function ensureCmuxAutoConfig(opts = {}) {
   if (needsRestart) {
     const already = readState(statePath3).promptedRestart === true;
     if (!already) {
-      mkdirSync2(dirname2(statePath3), { recursive: true });
-      writeFileSync3(statePath3, JSON.stringify({ promptedRestart: true }));
+      writeConfigFileSync(statePath3, JSON.stringify({ promptedRestart: true }));
       promptedThisRun = true;
     }
   } else if (verdict === "reachable") {
@@ -420,25 +484,25 @@ var compatManifest = {
 };
 
 // packages/shared/dist/lib/update-check.js
-import fs3 from "fs";
-import path3 from "path";
+import fs2 from "fs";
+import path4 from "path";
 import os3 from "os";
 import https from "https";
-var UPDATE_CHECK_STATE_PATH = path3.join(os3.homedir(), ".config", "squadrant", "update-check.json");
+var UPDATE_CHECK_STATE_PATH = path4.join(os3.homedir(), ".config", "squadrant", "update-check.json");
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 var FAILURE_RETRY_MS = 60 * 60 * 1e3;
 
 // packages/shared/dist/lib/git-worktree.js
 import { execFileSync as execFileSync2 } from "child_process";
-import fs4 from "fs";
-import path4 from "path";
+import fs3 from "fs";
+import path5 from "path";
 
 // packages/shared/dist/lib/resolve-text-input.js
-import fs5 from "fs";
+import fs4 from "fs";
 
 // packages/shared/dist/lib/runtime-sync.js
-import fs6 from "fs";
-import path5 from "path";
+import fs5 from "fs";
+import path6 from "path";
 
 // packages/shared/dist/lib/tool-compat.js
 function parseSemVer(v) {
@@ -472,13 +536,13 @@ function checkToolCompat(name, rawVersion, entry) {
 }
 
 // packages/shared/dist/lib/canonical-source.js
-import fs7 from "fs";
-import path6 from "path";
+import fs6 from "fs";
+import path7 from "path";
 
 // packages/shared/dist/lib/daily-logs.js
 import { execSync } from "child_process";
-import fs8 from "fs";
-import path7 from "path";
+import fs7 from "fs";
+import path8 from "path";
 import matter from "gray-matter";
 
 // packages/core/dist/state-machine.js
@@ -1091,7 +1155,7 @@ function createDaemon(deps) {
 }
 
 // packages/core/dist/mailbox.js
-import { promises as fs9 } from "fs";
+import { promises as fs8 } from "fs";
 import { join as join5 } from "path";
 import { randomUUID } from "crypto";
 function inboxDir(stateRoot) {
@@ -1108,7 +1172,7 @@ async function listRotatedOldestFirst(stateRoot, project) {
   const dir = inboxDir(stateRoot);
   let entries;
   try {
-    entries = await fs9.readdir(dir);
+    entries = await fs8.readdir(dir);
   } catch {
     return [];
   }
@@ -1117,7 +1181,7 @@ async function listRotatedOldestFirst(stateRoot, project) {
 }
 async function readMaxSeqFromFile(file) {
   try {
-    const buf = await fs9.readFile(file, "utf-8");
+    const buf = await fs8.readFile(file, "utf-8");
     if (!buf.trim())
       return 0;
     const lines = buf.trim().split("\n");
@@ -1159,12 +1223,12 @@ function withProjectLock(project, fn) {
 function appendEntry(stateRoot, project, build) {
   return withProjectLock(project, async () => {
     const dir = inboxDir(stateRoot);
-    await fs9.mkdir(dir, { recursive: true });
+    await fs8.mkdir(dir, { recursive: true });
     const file = logPath(stateRoot, project);
     const lastSeq = await readMaxSeq(stateRoot, project);
     const seq = lastSeq + 1;
     const entry = build(seq);
-    await fs9.appendFile(file, JSON.stringify(entry) + "\n", { encoding: "utf-8" });
+    await fs8.appendFile(file, JSON.stringify(entry) + "\n", { encoding: "utf-8" });
     return seq;
   });
 }
@@ -1195,7 +1259,7 @@ function cursorPath(stateRoot, project, subscriber) {
 async function readCursor(opts) {
   let buf;
   try {
-    buf = await fs9.readFile(cursorPath(opts.stateRoot, opts.project, opts.subscriber), "utf-8");
+    buf = await fs8.readFile(cursorPath(opts.stateRoot, opts.project, opts.subscriber), "utf-8");
   } catch (e) {
     if (e.code === "ENOENT")
       return null;
@@ -1210,7 +1274,7 @@ async function readCursor(opts) {
   }
 }
 async function writeCursor(opts) {
-  await fs9.mkdir(inboxDir(opts.stateRoot), { recursive: true });
+  await fs8.mkdir(inboxDir(opts.stateRoot), { recursive: true });
   const dest = cursorPath(opts.stateRoot, opts.project, opts.subscriber);
   const tmp = `${dest}.${process.pid}.${randomUUID()}.tmp`;
   const data = {
@@ -1218,7 +1282,7 @@ async function writeCursor(opts) {
     subscriber: opts.subscriber,
     updatedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
-  const handle = await fs9.open(tmp, "w");
+  const handle = await fs8.open(tmp, "w");
   try {
     await handle.writeFile(JSON.stringify(data), { encoding: "utf-8" });
     await handle.sync();
@@ -1226,9 +1290,9 @@ async function writeCursor(opts) {
     await handle.close();
   }
   try {
-    await fs9.rename(tmp, dest);
+    await fs8.rename(tmp, dest);
   } catch (e) {
-    await fs9.unlink(tmp).catch(() => {
+    await fs8.unlink(tmp).catch(() => {
     });
     throw e;
   }
@@ -1239,7 +1303,7 @@ async function* readFromCursor(opts) {
   for (const file of files) {
     let buf;
     try {
-      buf = await fs9.readFile(file, "utf-8");
+      buf = await fs8.readFile(file, "utf-8");
     } catch (e) {
       if (e.code === "ENOENT")
         continue;
@@ -1265,7 +1329,7 @@ async function mailboxStats(stateRoot, project) {
   let sizeBytes = 0;
   for (const f of [file, ...rotated]) {
     try {
-      sizeBytes += (await fs9.stat(f)).size;
+      sizeBytes += (await fs8.stat(f)).size;
     } catch (e) {
       if (e.code !== "ENOENT")
         throw e;
@@ -1281,7 +1345,7 @@ async function mailboxStats(stateRoot, project) {
 }
 async function oldestEntryAgeMs(file) {
   try {
-    const buf = await fs9.readFile(file, "utf-8");
+    const buf = await fs8.readFile(file, "utf-8");
     const firstLine = buf.split("\n").find((l) => l.trim());
     if (!firstLine)
       return 0;
@@ -1296,7 +1360,7 @@ async function rotateIfNeeded(opts) {
     const file = logPath(opts.stateRoot, opts.project);
     let size = 0;
     try {
-      size = (await fs9.stat(file)).size;
+      size = (await fs8.stat(file)).size;
     } catch (e) {
       if (e.code === "ENOENT")
         return { rotated: false };
@@ -1312,29 +1376,29 @@ async function rotateIfNeeded(opts) {
       const dst = `${file}.${n + 1}`;
       if (n + 1 > opts.keepCount) {
         try {
-          await fs9.unlink(src);
+          await fs8.unlink(src);
         } catch (e) {
           if (e.code !== "ENOENT")
             throw e;
         }
       } else {
         try {
-          await fs9.rename(src, dst);
+          await fs8.rename(src, dst);
         } catch (e) {
           if (e.code !== "ENOENT")
             throw e;
         }
       }
     }
-    await fs9.rename(file, `${file}.1`);
-    await fs9.writeFile(file, "", { encoding: "utf-8" });
+    await fs8.rename(file, `${file}.1`);
+    await fs8.writeFile(file, "", { encoding: "utf-8" });
     return { rotated: true, from: file, to: `${file}.1` };
   });
 }
 
 // packages/core/dist/protocol.js
 import { createServer, createConnection } from "net";
-import { existsSync as existsSync5, unlinkSync } from "fs";
+import { existsSync as existsSync5, unlinkSync, chmodSync } from "fs";
 var PROTOCOL_VERSION = 1;
 function encodeMsg(obj) {
   return JSON.stringify(obj) + "\n";
@@ -1448,6 +1512,12 @@ function startServer(sockPath, handlerOrCallbacks, onListenError = defaultListen
     });
   });
   server.on("error", onListenError);
+  server.on("listening", () => {
+    try {
+      chmodSync(sockPath, 384);
+    } catch {
+    }
+  });
   server.listen(sockPath);
   return server;
 }
@@ -1591,7 +1661,7 @@ function reconcileLiveness(prev, next) {
 }
 
 // packages/core/dist/store.js
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, readdirSync, renameSync, writeFileSync as writeFileSync4, existsSync as existsSync6, rmSync as rmSync3, statSync } from "fs";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync4, readdirSync, renameSync, writeFileSync as writeFileSync3, existsSync as existsSync6, rmSync as rmSync3, statSync } from "fs";
 import { join as join6, resolve, sep } from "path";
 function safeSegment(kind, s) {
   if (typeof s !== "string" || s.length === 0) {
@@ -1617,10 +1687,10 @@ function createStore(root) {
   const taskFile = (p, id) => assertUnderRoot(join6(projDir(p), `${safeSegment("id", id)}.json`));
   return {
     put(rec) {
-      mkdirSync3(projDir(rec.project), { recursive: true });
+      mkdirSync2(projDir(rec.project), { recursive: true });
       const dest = taskFile(rec.project, rec.id);
       const tmp = `${dest}.tmp`;
-      writeFileSync4(tmp, JSON.stringify(rec, null, 2));
+      writeFileSync3(tmp, JSON.stringify(rec, null, 2));
       renameSync(tmp, dest);
     },
     get(project, id) {
@@ -1628,7 +1698,7 @@ function createStore(root) {
       if (!existsSync6(f))
         return void 0;
       try {
-        return JSON.parse(readFileSync5(f, "utf-8"));
+        return JSON.parse(readFileSync4(f, "utf-8"));
       } catch {
         return void 0;
       }
@@ -1639,7 +1709,7 @@ function createStore(root) {
         return [];
       return readdirSync(d).filter((n) => n.endsWith(".json")).map((n) => {
         try {
-          return JSON.parse(readFileSync5(join6(d, n), "utf-8"));
+          return JSON.parse(readFileSync4(join6(d, n), "utf-8"));
         } catch {
           return void 0;
         }
@@ -1673,7 +1743,7 @@ function createStore(root) {
 import { homedir as homedir4 } from "os";
 import { join as join7, resolve as resolve2, sep as sep2 } from "path";
 import { randomBytes } from "crypto";
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync6, readdirSync as readdirSync2, renameSync as renameSync2, writeFileSync as writeFileSync5, existsSync as existsSync7, rmSync as rmSync4, statSync as statSync2 } from "fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, readdirSync as readdirSync2, renameSync as renameSync2, writeFileSync as writeFileSync4, existsSync as existsSync7, rmSync as rmSync4, statSync as statSync2 } from "fs";
 var WORK_ITEM_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
 
 // packages/core/dist/index.js
@@ -1681,9 +1751,9 @@ init_snapshot();
 
 // packages/core/dist/launchd.js
 import { execFileSync as execFileSync3 } from "child_process";
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync6, readFileSync as readFileSync7, existsSync as existsSync8, openSync, writeSync, closeSync, unlinkSync as unlinkSync2, constants } from "fs";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5, readFileSync as readFileSync6, existsSync as existsSync8, openSync, writeSync, closeSync, unlinkSync as unlinkSync2, constants } from "fs";
 import { homedir as homedir5 } from "os";
-import { dirname as dirname3, join as join8 } from "path";
+import { dirname as dirname2, join as join8 } from "path";
 import { fileURLToPath } from "url";
 
 // packages/core/dist/crew-pane-reader.js
@@ -1754,10 +1824,10 @@ function makeGate(opts) {
 import { homedir as homedir6 } from "os";
 import { join as join9 } from "path";
 import { spawn as realSpawn } from "child_process";
-import { writeFileSync as writeFileSync8, mkdirSync as mkdirSync6 } from "fs";
+import { writeFileSync as writeFileSync7, mkdirSync as mkdirSync5 } from "fs";
 
 // packages/core/dist/daemon/liveness-registry.js
-import { writeFileSync as writeFileSync7, readFileSync as readFileSync8, renameSync as renameSync3 } from "fs";
+import { writeFileSync as writeFileSync6, readFileSync as readFileSync7, renameSync as renameSync3 } from "fs";
 var LivenessRegistry = class {
   path;
   readFile;
@@ -1767,13 +1837,13 @@ var LivenessRegistry = class {
     this.path = opts.path;
     this.readFile = opts.readFile ?? ((p) => {
       try {
-        return readFileSync8(p, "utf-8");
+        return readFileSync7(p, "utf-8");
       } catch {
         return void 0;
       }
     });
     this.writeFile = opts.writeFile ?? ((p, c) => {
-      writeFileSync7(`${p}.tmp`, c);
+      writeFileSync6(`${p}.tmp`, c);
       renameSync3(`${p}.tmp`, p);
     });
   }
@@ -1840,10 +1910,10 @@ function buildContext(opts) {
   const isPidAlive = opts.isPidAlive ?? defaultIsPidAlive;
   const spawn2 = opts.spawn ?? realSpawn;
   const resultsDir = join9(stateRoot, "_results");
-  mkdirSync6(resultsDir, { recursive: true });
+  mkdirSync5(resultsDir, { recursive: true });
   const writeResult = (id, payload) => {
     const p = join9(resultsDir, `${id}.txt`);
-    writeFileSync8(p, payload);
+    writeFileSync7(p, payload);
     return p;
   };
   const log = (m) => process.stderr.write(`[squadrantd] ${(/* @__PURE__ */ new Date()).toISOString()} ${m}
@@ -1944,7 +2014,7 @@ function createAttach(ctx) {
 }
 
 // packages/core/dist/daemon/start.js
-import { join as join11, dirname as dirname4 } from "path";
+import { join as join11, dirname as dirname3 } from "path";
 import { readdir } from "fs/promises";
 
 // packages/core/dist/daemon/interactive-probe.js
@@ -2538,7 +2608,7 @@ function createServer2(ctx, handlers) {
 // packages/core/dist/daemon/snapshot-gather.js
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { join as join10 } from "path";
-import { statSync as statSync3, openSync as openSync2, readSync, closeSync as closeSync2, readdirSync as readdirSync3, readFileSync as readFileSync9 } from "fs";
+import { statSync as statSync3, openSync as openSync2, readSync, closeSync as closeSync2, readdirSync as readdirSync3, readFileSync as readFileSync8 } from "fs";
 var SELF_PATH = fileURLToPath2(import.meta.url);
 function distBuiltAt() {
   try {
@@ -2547,10 +2617,10 @@ function distBuiltAt() {
     return 0;
   }
 }
-function gatherLogStats(path19, now, windowMs) {
+function gatherLogStats(path20, now, windowMs) {
   let sizeBytes = 0;
   try {
-    sizeBytes = statSync3(path19).size;
+    sizeBytes = statSync3(path20).size;
   } catch {
     return { errorCount: 0, sizeBytes: 0, windowMs };
   }
@@ -2561,7 +2631,7 @@ function gatherLogStats(path19, now, windowMs) {
   const len = sizeBytes - start;
   let text = "";
   try {
-    const fd = openSync2(path19, "r");
+    const fd = openSync2(path20, "r");
     try {
       const buf = Buffer.alloc(len);
       readSync(fd, buf, 0, len, start);
@@ -2602,7 +2672,7 @@ function gatherStoreStats(store, stateRoot, project) {
       if (!n.endsWith(".json"))
         continue;
       try {
-        JSON.parse(readFileSync9(join10(dir, n), "utf-8"));
+        JSON.parse(readFileSync8(join10(dir, n), "utf-8"));
       } catch {
         corruptCount++;
       }
@@ -2707,7 +2777,7 @@ function startDaemon(ctx, opts, pkgVersion) {
     return out;
   }
   async function gatherSnapshotInputs(now) {
-    const logPath2 = join11(dirname4(stateRoot), "squadrantd.log");
+    const logPath2 = join11(dirname3(stateRoot), "squadrantd.log");
     const tier2Projects = opts.registeredProjects ?? Object.keys(loadConfig().projects);
     const projects = await Promise.all(tier2Projects.map(async (project) => {
       const cursor = await readCursor({ stateRoot, project, subscriber: CURSOR_SUBSCRIBER2 });
@@ -2896,8 +2966,8 @@ function startDaemon(ctx, opts, pkgVersion) {
 
 // packages/core/dist/session-freshness.js
 import crypto from "crypto";
-import fs10 from "fs";
-import path8 from "path";
+import fs9 from "fs";
+import path9 from "path";
 
 // packages/core/dist/crew-protocol.js
 function buildCompletionProtocol(taskId, project) {
@@ -3159,17 +3229,16 @@ function formatInbound(text) {
 }
 
 // packages/core/dist/telegram/state.js
-import fs11 from "fs";
-import path9 from "path";
+import path10 from "path";
 function statePath(stateRoot) {
-  return path9.join(stateRoot, "telegram-state.json");
+  return path10.join(stateRoot, "telegram-state.json");
 }
 function topicKey(project, scope = "project") {
   return `${project}::${scope}`;
 }
 function loadState(stateRoot) {
   try {
-    const raw = fs11.readFileSync(statePath(stateRoot), "utf-8");
+    const raw = readConfigFileSync(statePath(stateRoot));
     const data = JSON.parse(raw);
     const result = {
       offset: typeof data.offset === "number" ? data.offset : 0,
@@ -3184,8 +3253,7 @@ function loadState(stateRoot) {
   }
 }
 function saveState(stateRoot, s) {
-  fs11.mkdirSync(stateRoot, { recursive: true });
-  fs11.writeFileSync(statePath(stateRoot), JSON.stringify(s, null, 2) + "\n");
+  writeConfigFileSync(statePath(stateRoot), JSON.stringify(s, null, 2) + "\n");
 }
 function setTopic(stateRoot, project, topicId, scope = "project") {
   const s = loadState(stateRoot);
@@ -3276,7 +3344,7 @@ function createTelegramClient(opts) {
 
 // packages/core/dist/telegram/bridge.js
 import os4 from "os";
-import path10 from "path";
+import path11 from "path";
 
 // packages/core/dist/telegram/panels.js
 var mark = (on, label) => on ? `\u2022 ${label}` : label;
@@ -3382,7 +3450,7 @@ function notifyToggle(text) {
 }
 function createTelegramBridge(opts) {
   const { cfg, stateRoot, client, appendCaptainMessage: appendCaptainMessage2, log, ensureCaptainAlive, runCommand, sendReply } = opts;
-  const configRoot = opts.configRoot ?? path10.join(os4.homedir(), ".config", "squadrant");
+  const configRoot = opts.configRoot ?? path11.join(os4.homedir(), ".config", "squadrant");
   const pollMs = cfg.pollMs ?? 1e3;
   let running = false;
   let lastSuccessfulPollAt = null;
@@ -3513,14 +3581,14 @@ function createTelegramBridge(opts) {
   }
   function currentEffort() {
     try {
-      return loadConfig(path10.join(configRoot, "config.json")).defaults.effort ?? "balance";
+      return loadConfig(path11.join(configRoot, "config.json")).defaults.effort ?? "balance";
     } catch {
       return "balance";
     }
   }
   function projectNames() {
     try {
-      return Object.keys(loadConfig(path10.join(configRoot, "config.json")).projects);
+      return Object.keys(loadConfig(path11.join(configRoot, "config.json")).projects);
     } catch {
       return [];
     }
@@ -3732,7 +3800,7 @@ function createTelegramBridge(opts) {
 }
 
 // packages/core/dist/telegram/setup.js
-import fs12 from "fs";
+import fs10 from "fs";
 
 // packages/core/dist/restart-daemon.js
 import { execFileSync as execFileSync4 } from "child_process";
@@ -3748,14 +3816,14 @@ import { join as join13 } from "path";
 var DEFAULT_SOCK_PATH2 = join13(homedir8(), ".config", "squadrant", "squadrant.sock");
 
 // packages/core/dist/side-session.js
-import fs13 from "fs";
+import fs11 from "fs";
 
 // packages/core/dist/crew-spawn.js
-import fs14 from "fs";
+import fs12 from "fs";
 import os5 from "os";
-import path11 from "path";
-var TEMPLATES_DIR = path11.join(os5.homedir(), ".config", "squadrant", "templates");
-var STATE_ROOT = path11.join(os5.homedir(), ".config", "squadrant", "state");
+import path12 from "path";
+var TEMPLATES_DIR = path12.join(os5.homedir(), ".config", "squadrant", "templates");
+var STATE_ROOT = path12.join(os5.homedir(), ".config", "squadrant", "state");
 
 // packages/core/dist/lifecycle-source.js
 function reduceLifecycle(prev, next) {
@@ -3787,27 +3855,27 @@ import { execSync as execSync4 } from "child_process";
 import { execSync as execSync5 } from "child_process";
 
 // packages/agents/dist/drivers/launch-cmd.js
-import fs15 from "fs";
-import path12 from "path";
+import fs13 from "fs";
+import path13 from "path";
 
 // packages/agents/dist/projection/cursor.js
 import { mkdir, readFile, writeFile } from "fs/promises";
-import path13 from "path";
+import path14 from "path";
 import os6 from "os";
 
 // packages/agents/dist/projection/codex.js
 import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
-import path14 from "path";
+import path15 from "path";
 import os7 from "os";
 
 // packages/agents/dist/projection/gemini.js
 import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "fs/promises";
-import path15 from "path";
+import path16 from "path";
 import os8 from "os";
 
 // packages/agents/dist/projection/opencode.js
 import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4 } from "fs/promises";
-import path16 from "path";
+import path17 from "path";
 import os9 from "os";
 
 // packages/agents/dist/codex/app-server-client.js
@@ -4575,7 +4643,7 @@ var OpencodeSseBridge = class {
 
 // packages/agents/dist/interactive/claude.js
 import { execSync as execSync6 } from "child_process";
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 import { homedir as homedir10 } from "os";
 import { join as join15 } from "path";
 var nextAskUserQuestionRequestId = Date.now();
@@ -5334,9 +5402,9 @@ var NotifierRegistry = class {
 };
 
 // packages/workspaces/dist/workspaces/obsidian.js
-import fs16 from "fs/promises";
+import fs14 from "fs/promises";
 import { existsSync as existsSync10 } from "fs";
-import path17 from "path";
+import path18 from "path";
 
 // packages/workspaces/dist/cmux-daemon/events-bridge.js
 import { spawn as nodeSpawn2 } from "child_process";
@@ -5473,7 +5541,7 @@ var CmuxEventsBridge = class {
 };
 
 // packages/workspaces/dist/cmux-daemon/daemon-cmux.js
-import { readdirSync as readdirSync4, readFileSync as readFileSync11 } from "fs";
+import { readdirSync as readdirSync4, readFileSync as readFileSync10 } from "fs";
 import { join as join16 } from "path";
 import { homedir as homedir11 } from "os";
 
@@ -5602,14 +5670,14 @@ var DaemonCmux = class {
     } catch (e) {
       throw new Error(`liveness: could not read cmux state dir ${dir}: ${e.message}`);
     }
-    return readLivenessSnapshot(files, (f) => readFileSync11(join16(dir, f), "utf-8"), projects);
+    return readLivenessSnapshot(files, (f) => readFileSync10(join16(dir, f), "utf-8"), projects);
   }
 };
 
 // packages/workspaces/dist/cmux-daemon/cmux-store-source.js
 import { join as join17 } from "path";
 import { homedir as homedir12 } from "os";
-import { watch, readdirSync as readdirSync5, readFileSync as readFileSync12, existsSync as existsSync11 } from "fs";
+import { watch, readdirSync as readdirSync5, readFileSync as readFileSync11, existsSync as existsSync11 } from "fs";
 var CmuxStoreSource = class {
   name = "cmux-store";
   stateDir;
@@ -5763,9 +5831,9 @@ function defaultListFiles(dir) {
     return [];
   }
 }
-function defaultReadFile(path19) {
+function defaultReadFile(path20) {
   try {
-    return readFileSync12(path19, "utf-8");
+    return readFileSync11(path20, "utf-8");
   } catch {
     return void 0;
   }
@@ -5782,7 +5850,7 @@ function defaultWatchDir(dir, cb) {
 // packages/workspaces/dist/native-hooks/native-hook-source.js
 import { join as join18 } from "path";
 import { homedir as homedir13 } from "os";
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync13, writeFileSync as writeFileSync9 } from "fs";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync8 } from "fs";
 var CLAUDE_HOOK_EVENTS = [
   ["SessionStart", "session-start"],
   ["UserPromptSubmit", "prompt-submit"],
@@ -5962,16 +6030,16 @@ function extractDetail(sub, payload) {
   }
   return void 0;
 }
-function defaultReadFile2(path19) {
+function defaultReadFile2(path20) {
   try {
-    return readFileSync13(path19, "utf-8");
+    return readFileSync12(path20, "utf-8");
   } catch {
     return void 0;
   }
 }
-function defaultWriteFile(path19, content) {
-  mkdirSync7(path19.replace(/\/[^/]+$/, ""), { recursive: true });
-  writeFileSync9(path19, content, "utf-8");
+function defaultWriteFile(path20, content) {
+  mkdirSync6(path20.replace(/\/[^/]+$/, ""), { recursive: true });
+  writeFileSync8(path20, content, "utf-8");
 }
 
 // packages/workspaces/dist/crew-pane.js
@@ -6042,17 +6110,16 @@ async function resendCrewFirstTurn(runtime, captainName, project, name, message)
 }
 
 // packages/cli/src/lib/daemon-restart-broadcast.ts
-import fs17 from "fs";
-import path18 from "path";
+import path19 from "path";
 function statePath2(stateRoot) {
-  return path18.join(stateRoot, "daemon-restart-state.json");
+  return path19.join(stateRoot, "daemon-restart-state.json");
 }
 function computeRestartSignature(version, buildMtimeMs) {
   return `${version}::${buildMtimeMs}`;
 }
 function readPersistedRestartSignature(stateRoot) {
   try {
-    const raw = fs17.readFileSync(statePath2(stateRoot), "utf-8");
+    const raw = readConfigFileSync(statePath2(stateRoot));
     const data = JSON.parse(raw);
     return typeof data.signature === "string" ? data.signature : null;
   } catch {
@@ -6060,8 +6127,7 @@ function readPersistedRestartSignature(stateRoot) {
   }
 }
 function writePersistedRestartSignature(stateRoot, signature) {
-  fs17.mkdirSync(stateRoot, { recursive: true });
-  fs17.writeFileSync(statePath2(stateRoot), JSON.stringify({ signature }, null, 2) + "\n");
+  writeConfigFileSync(statePath2(stateRoot), JSON.stringify({ signature }, null, 2) + "\n");
 }
 function restartNotice(version, isDevRebuild) {
   const suffix = isDevRebuild ? " (dev build)" : "";
@@ -6095,12 +6161,12 @@ async function maybeBroadcastDaemonRestart(opts) {
 
 // packages/cli/src/squadrantd.ts
 var SELF_PATH2 = fileURLToPath3(import.meta.url);
-var CLI_BIN = join19(dirname5(SELF_PATH2), "index.js");
+var CLI_BIN = join19(dirname4(SELF_PATH2), "index.js");
 var DAEMON_SOCK = join19(homedir14(), ".config", "squadrant", "squadrant.sock");
 function readPkgVersion() {
   try {
-    const pkgPath = join19(dirname5(SELF_PATH2), "..", "package.json");
-    return JSON.parse(readFileSync14(pkgPath, "utf-8")).version ?? "unknown";
+    const pkgPath = join19(dirname4(SELF_PATH2), "..", "package.json");
+    return JSON.parse(readFileSync13(pkgPath, "utf-8")).version ?? "unknown";
   } catch {
     return "unknown";
   }
@@ -6122,7 +6188,7 @@ function buildTelegramBridge(cfg, stateRoot, log) {
   return createTelegramBridge({
     cfg,
     stateRoot,
-    configRoot: dirname5(stateRoot),
+    configRoot: dirname4(stateRoot),
     client,
     appendCaptainMessage,
     log,
@@ -6390,6 +6456,9 @@ function logCrashMarker(kind, err) {
   process.stderr.write(`[squadrantd] ${(/* @__PURE__ */ new Date()).toISOString()} ${kind} pid=${process.pid} error=${message}
 `);
 }
+function isMonorepoCheckout(scriptPath, dirExists = existsSync12) {
+  return dirExists(join19(dirname4(scriptPath), "..", "packages"));
+}
 if (process.argv[1] && process.argv[1].endsWith("squadrantd.js")) {
   process.on("uncaughtException", (err) => {
     logCrashMarker("uncaughtException", err);
@@ -6405,6 +6474,13 @@ if (process.argv[1] && process.argv[1].endsWith("squadrantd.js")) {
       process.stdout.write("squadrantd: launchd-managed daemon entry (no CLI args). Use `squadrant` for commands.\n");
       process.exit(0);
     }
+    if (isMonorepoCheckout(process.argv[1])) {
+      process.stderr.write(
+        `[squadrantd] refusing to start: '${process.argv[1]}' is a monorepo/worktree checkout, not an installed copy \u2014 it must never become the shared production daemon (#670). This entry takes no CLI flags/sockPath override; for local testing, import startSquadrantd({ sockPath, ... }) programmatically instead of running this entry directly, or run the test suite (\`pnpm test\`).
+`
+      );
+      process.exit(1);
+    }
     const sock = join19(homedir14(), ".config", "squadrant", "squadrant.sock");
     if (await isDaemonSocketLive(sock)) {
       process.stderr.write(`[squadrantd] refusing to start: a live daemon already owns ${sock}
@@ -6422,6 +6498,7 @@ if (process.argv[1] && process.argv[1].endsWith("squadrantd.js")) {
 export {
   defaultIsPidAlive,
   discoverCaptainSurface,
+  isMonorepoCheckout,
   startSquadrantd
 };
 //# sourceMappingURL=squadrantd.js.map