unsnooze 1.16.2 → 1.17.0

package/CHANGELOG.md

@@ -1,5 +1,160 @@
 # Changelog
 
+## 1.17.0 — 2026-08-23
+
+- **A state directory unsnooze cannot write to no longer pins a CPU core
+  forever.** The lock around `~/.unsnooze/state.json` treated every `mkdir`
+  failure as contention. `EEXIST` really is contention — someone else holds the
+  lock — but `EACCES` on an unwritable state directory, `EROFS` on a read-only
+  filesystem and `ENOSPC` on a full one are not, and that branch retried with
+  neither a sleep nor a deadline check. Since `mkdir -p` on a directory that
+  already exists succeeds as a no-op, there was nothing to break the cycle:
+  the loop spun at around 70% of a core, ignored `UNSNOOZE_LOCK_TIMEOUT_MS`
+  entirely, and never returned. It took every writer with it — the daemon, any
+  CLI command, and the StopFailure hook that runs *inside* your agent. unsnooze
+  now repairs a state directory it owns and otherwise fails on the deadline with
+  the errno that caused it.
+
+- **Everything under `~/.unsnooze` is now owner-only (0700 / 0600).** The
+  directory was 0755 and every file inside it 0644, so on a shared machine any
+  other local user could read them. That directory holds your ntfy bearer token
+  (`config.json`), the text of queued prompts and the paths they run in
+  (`state.json`), your fleet's ssh destinations and the commands that fetch
+  their passwords (`hosts.json`), a mirror of every remote host's sessions
+  (`fleet-cache.json`), a lease file per pane carrying its working directory
+  (`leases/`), and — for a headless revival — the entire stdout and stderr of
+  an unattended agent run (`headless/*.log`). Every writer now creates its file
+  owner-only and its directory 0700.
+
+  Upgrading an existing install needed more than that, because none of it is
+  something a writer can fix: `mkdir`'s mode is ignored for a directory that
+  already exists, appending to a log reuses the file's inode, and
+  `config.json` and `hosts.json` are written only by `config set` and
+  `hosts add`, so an install that never touches them again would have kept
+  their old mode — and the token in one of them — indefinitely. So a state
+  write repairs the modes directly, walking the `events/`, `leases/`,
+  `mux-sessions/` and `headless/` subdirectories as well as the top-level
+  files. It re-checks on an interval rather than once per process, because
+  `daemon.log` is created by launchd/systemd redirecting the daemon's stdout
+  and can appear after a first pass has already run — in a process that then
+  lives for days. It strips group and other access without touching the
+  owner's own bits, so an executable in there stays executable; it never
+  follows a symlink or a hardlink into a file it is about to change; and it
+  only ever touches unsnooze's own state directory. `unsnooze doctor` reports
+  from the same walk the repair acts on, so the two cannot disagree about what
+  counts as exposed. It is inert on Windows, which has no POSIX mode bits —
+  libuv synthesises them by mirroring the owner's, so every file there reads
+  as world-readable and no `chmod` can change it; access is governed by the
+  profile ACL instead. The same is true of a state directory on a filesystem
+  that does not implement permissions at all — a CIFS or vfat mount, WSL's
+  `drvfs`, a bind mount from a Windows host — and the platform name does not
+  identify those, so unsnooze finds out by attempting the change and looking:
+  a `chmod` that succeeds while the bits stay put means the filesystem has
+  nothing to set, and the directory is left alone rather than rewritten every
+  minute forever. `unsnooze doctor --fix` reports those three outcomes
+  separately, so "could not" is never printed as "did".
+
+  The statusline shim's own drop directory, `~/.claude/unsnooze`, gets the
+  same treatment: it holds your live rate-limit numbers and was created 0755.
+  It is repaired on the shim's next run rather than only for new installs.
+
+  `unsnooze doctor` now also reports anything under the state directory that
+  other users can read, and `doctor --fix` narrows it. That check exists
+  because the repair deliberately ignores a failed `chmod` — crashing every
+  state write on a filesystem that has no usable one would be the worse bug —
+  so something has to be able to tell you it did not take.
+
+  No credential was ever stored in plaintext: a password source is a
+  *reference* to your keychain, environment or secret tool, never the secret.
+  On a single-user machine nothing here was reachable by anyone new.
+
+- **A hostile `session_id` can no longer steer where unsnooze reads or
+  writes.** Three places took that value — which arrives in a payload from the
+  agent — and used it directly as a filename. The opt-in Claude Code statusline
+  shim built its drop filename by concatenating it, so a `/` or a `..` walked
+  the write out of `~/.claude/unsnooze` and over any `.json` file you can
+  write. `transcriptPath`, on the StopFailure hook path that everyone has
+  enabled, composed a transcript path the same way, turning a read of your own
+  transcript into a read of any `.jsonl` you name. And the Kimi adapter probed
+  for a session directory by the same concatenation, which leaked whether an
+  arbitrary path exists. Claude Code sends a uuid, so all three needed a
+  malicious or compromised agent to reach, and the two reads are only ever
+  mined for a timestamp or a boolean — never echoed back. None of them was in
+  a position to know that. All three now require a filename-shaped id and fall
+  back to `unknown` / no-transcript / not-found. If you have the statusline
+  shim installed, re-run `unsnooze usage --install-statusline` to pick up the
+  fix; the other two need nothing.
+
+- **A corrupt `state.json` no longer prints its own first bytes into the log.**
+  The quarantine message included V8's `JSON.parse` error, and V8 embeds a
+  snippet of the input it choked on — so a state file that had been replaced
+  with something else echoed that file's opening characters into
+  `unsnooze.log`. The quarantined file is still kept on disk, and the log still
+  names it and says why.
+
+- **Three narrower lock fixes.** A writer whose stale-lock steal was itself
+  stolen no longer deletes the thief's lock on the way out — it only removes a
+  lock still stamped with its own pid. The steal itself now re-checks that the
+  directory it is about to remove is still the one it judged stale, narrowing
+  a window where two contenders could both decide to steal and the slower one
+  would delete the winner's fresh lock. And a lock is now stolen on age alone
+  once it is very old: liveness was decided by signalling the recorded pid,
+  which cannot tell "unsnooze is still working" from "that number now belongs
+  to some unrelated long-lived process", so a leaked lock whose pid was later
+  recycled wedged every writer permanently, with no recovery but deleting the
+  directory by hand.
+
+  That last one is a trade rather than a free win — stealing from a holder that
+  really is still working puts two writers in the critical section, and one
+  overwrites the other. It is chosen because a permanent wedge is the worse
+  failure, and the exposure is kept small by making sure the lock is only ever
+  held for in-memory work plus a single write: `upsertSession` used to compute
+  its workspace fingerprint inside the lock, which shells out to git, and
+  `execFileSync`'s timeout is a soft bound — it signals the child and then
+  waits for it to actually exit, which a git wedged on a hung network mount
+  never does. That call now happens before the lock is taken, so nothing
+  unbounded runs inside it.
+
+  *Raised in [#17](https://github.com/saaranshM/unsnooze/issues/17). The report
+  also flagged the askpass `command` source as command injection and reading
+  `state.json` as a symlink-following bug; neither is a vulnerability. A
+  `command` source is your own configured command, in the shape git's
+  `credential.helper = !cmd` has always taken, and it can only be set by
+  someone who can already write to your home directory. As for the symlink:
+  reads do follow one — point `state.json` at a file holding valid JSON and
+  its contents are read as state — but planting that link needs write access
+  to a directory that is now 0700, which is not a boundary anyone crosses
+  without already owning the account. The write side is genuinely safe: the
+  quarantine renames the link rather than the file it points at, and a state
+  write replaces the link with a real file, so the target is never truncated
+  or overwritten.*
+
+## 1.16.3 — 2026-08-22
+
+- **A dashboard left open overnight no longer runs the machine out of memory.**
+  ([#16](https://github.com/saaranshM/unsnooze/issues/16)) `unsnooze status` in
+  a spare pane is exactly what it is for, and after nine or ten hours it was
+  dying on *"FATAL ERROR: Ineffective mark-compacts near heap limit — JavaScript
+  heap out of memory"*. The dashboard itself was innocent: React's development
+  build files a `performance.measure()` entry for every render, commit and
+  `setState` — the performance track it publishes for devtools — and Node
+  buffers user-timing entries forever with nothing to drain them. The status tab
+  repaints about three times a second (a one-second data tick plus the
+  450ms logo animation), each repaint left roughly 40 entries behind, and a
+  night of that walks into Node's 2GB heap ceiling. Measured at ~12kB retained
+  per render, surviving a forced garbage collection. The dashboard now drains
+  that buffer while it is mounted; heap use went from climbing without limit to
+  flat. Nothing else in unsnooze records user timing, and no other command
+  renders long enough to have been affected.
+
+- **Every release now creates its GitHub release automatically.** They were
+  written by hand afterwards, so 1.16.2 shipped to npm and to the website while
+  the repository's Releases tab still showed 1.16.1. The publish workflow now
+  creates the release from that version's CHANGELOG section, and waits for the
+  npm registry to actually serve the new version before rebuilding the website —
+  `npm publish` returns before the registry does, which is why 1.16.2's own
+  changelog entry was briefly invisible on unsnooze.dev.
+
 ## 1.16.2 — 2026-08-22
 
 - **A herdr revival now opens a tab in your project's workspace, not a new

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unsnooze",
-  "version": "1.16.2",
+  "version": "1.17.0",
   "description": "Automatically resume Claude Code, Codex CLI, Grok, Qwen Code, Kimi CLI, OpenCode, and Antigravity sessions when 5-hour or weekly usage limits reset—on macOS, Linux and Windows, with or without a terminal multiplexer.",
   "keywords": [
     "claude",

package/src/agents/kimi.js

@@ -54,7 +54,15 @@ function sessionsDirFor(cwd, kimiDir) {
   return join(kimiDir, 'sessions', createHash('md5').update(cwd).digest('hex'));
 }
 
+// sessionId comes from a hook payload and is used as a path component here.
+// The result only picks `-r <id>` over `--continue` and the id travels as
+// argv with no shell, so the exposure is an existence oracle rather than a
+// traversal — but it is the same shape as transcriptPath's, and the same
+// filename-shape gate closes it.
+const SAFE_SESSION_ID_RE = /^[A-Za-z0-9._-]{1,128}$/;
+
 function sessionExists(sessionId, kimiDir) {
+  if (!SAFE_SESSION_ID_RE.test(String(sessionId ?? ''))) return false;
   let hashes;
   try { hashes = readdirSync(join(kimiDir, 'sessions')); } catch { return false; }
   return hashes.some(h => existsSync(join(kimiDir, 'sessions', h, sessionId)));

package/src/askpass.js

@@ -3,7 +3,8 @@
 // anywhere. The SERVICE/ACCOUNT/VAR *names* may appear on argv; the secret
 // itself never does — it only ever comes back on stdout/stdin.
 import { execFileSync, spawnSync } from 'node:child_process';
-import { writeFileSync, chmodSync, mkdirSync, renameSync } from 'node:fs';
+import { writeFileSync, chmodSync, renameSync } from 'node:fs';
+import { ensureStateDir } from './config.js';
 import { join } from 'node:path';
 
 export class AuthError extends Error {
@@ -163,7 +164,7 @@ export async function cmdAskpass(args = []) {
 // by Task 5) because ssh controls the helper's argv — it passes only the
 // prompt text, never the host.
 export function ensureAskpassHelper({ platform = process.platform, stateDir, nodePath = process.execPath, scriptPath }) {
-  mkdirSync(stateDir, { recursive: true });
+  ensureStateDir(stateDir);
   if (platform === 'win32') {
     // Native ssh.exe needs a real exe; unix-like win ssh (Git/WSL) accepts a script.
     // The resolution ladder (design §5c) is finalized in Task 7's cross-platform pass;

package/src/config.js

@@ -1,5 +1,8 @@
 import { homedir } from 'node:os';
-import { join } from 'node:path';
+import { join, resolve } from 'node:path';
+import {
+  mkdirSync, chmodSync, writeFileSync, renameSync, lstatSync, statSync, readdirSync,
+} from 'node:fs';
 
 function envInt(name, def) {
   const v = parseInt(process.env[name] ?? '', 10);
@@ -15,6 +18,172 @@ export const RESUMER_LOCK = join(STATE_DIR, 'resumer.lock');
 // High-frequency burn accumulator + warn-dedup (daemon single-writer).
 export const USAGE_FILE = join(STATE_DIR, 'usage.json');
 
+// Everything under STATE_DIR is owner-only. The directory holds an ntfy
+// bearer token (config.json), queued prompt text and cwd paths (state.json),
+// ssh destinations and credential-source commands (hosts.json) — none of it
+// another local user's business, and the dir mode is what protects the files
+// that don't set their own. mkdir's `mode` only applies when it creates, so
+// a 0755 dir left by a pre-1.17.0 install is repaired explicitly.
+// No-op on Windows (node's chmod only carries the read-only bit there); the
+// user profile ACL already restricts it.
+export function ensureStateDir(dir = STATE_DIR) {
+  // Creating a directory owner-only is always right — we are about to put a
+  // 0600 file in it.
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  // Narrowing one that ALREADY exists is only ever done for our own state
+  // dir. ensureStateDir is also called with a caller-supplied path
+  // (writeUsageStore takes one), and re-permissioning someone else's
+  // directory — or the files inside it — is not this function's business.
+  if (isStateDir(dir)) {
+    try { chmodSync(dir, 0o700); } catch { /* shared/CI dir, not ours to fix */ }
+    repairModes(dir);
+  }
+  return dir;
+}
+
+// Repairing an install that predates 1.17.0. Three things the writers alone
+// cannot fix: mkdir's `mode` is ignored for a directory that already exists,
+// an append/open reuses an existing file's inode, and config.json/hosts.json
+// are written only by `config set` / `hosts add` — on an install that never
+// touches them again they would keep their old 0644 (and, for config.json,
+// the ntfy token in it) indefinitely. So the modes are repaired directly.
+//
+// Re-checked on an interval rather than once per process: daemon.log is
+// created by launchd/systemd redirecting the daemon's stdout, so it can
+// appear at 0644 AFTER a pass has run — in a process that then lives for
+// days. A walk is a readdir and a handful of lstats, so this is free at
+// daemon cadence.
+const MODE_REPAIR_INTERVAL_MS = envInt('UNSNOOZE_MODE_REPAIR_MS', 60_000);
+const repairedAt = new Map();
+
+// Compare resolved paths, not raw strings: callers reach ensureStateDir
+// through dirname(join(STATE_DIR, 'config.json')), which normalizes away a
+// trailing slash that STATE_DIR itself may carry from UNSNOOZE_STATE_DIR. A
+// raw comparison silently answers "not our directory" and skips the repair.
+const isStateDir = (dir) => resolve(dir) === resolve(STATE_DIR);
+
+// ONE walk, exported so `unsnooze doctor` reports from exactly what the
+// automatic repair acts on. They were separate before, and drifted: the
+// repair worked from a fixed list of filenames while doctor walked the whole
+// directory, so a quarantined state.json or a crashed writer's tmp file — the
+// two leftovers that hold verbatim copies of the sensitive files — were
+// reported forever and never fixed.
+//
+// Top level plus one level down is the entire layout: a handful of files and
+// four flat subdirectories.
+export function scanStateDir(dir = STATE_DIR, { platform = process.platform } = {}) {
+  const out = [];
+  // Windows has no POSIX mode bits. libuv synthesises them by mirroring the
+  // owner bits into group and other (win/fs.c `fs__stat_impl`), so a file is
+  // always 0666 (0444 read-only) and a directory 0777 — `mode & 0o077` is
+  // never zero and EVERY entry would look permanently exposed. Meanwhile
+  // uv_fs_chmod only toggles FILE_ATTRIBUTE_READONLY, so no repair could ever
+  // clear it: doctor would never report healthy, `--fix` would claim success
+  // while changing nothing, and the daemon would re-chmod the whole directory
+  // every interval forever. Access there is governed by the profile ACL.
+  if (platform === 'win32') return out;
+  // The root is stat'd, not lstat'd: a state dir that is itself a symlink is
+  // a legitimate setup (dotfiles, another volume) and must still be checked
+  // and repaired. Entries INSIDE are lstat'd and a link is skipped — chmod
+  // follows links, and following one there would reach outside the dir.
+  const inspect = (path, rel, isRoot = false) => {
+    try {
+      const st = isRoot ? statSync(path) : lstatSync(path);
+      if (!isRoot && st.isSymbolicLink()) return null;
+      const linked = !isRoot && !st.isDirectory() && st.nlink > 1;
+      // Strip group/other, but never the owner's execute bit: the state dir
+      // holds executables (askpass.sh, and whatever a test or a user drops
+      // beside it), and forcing a flat 0600 turns those into EACCES on spawn.
+      // Directories need their own traverse bit, hence 0700 rather than 0600.
+      const want = st.isDirectory() ? 0o700 : (0o600 | (st.mode & 0o100));
+      if ((st.mode & 0o077) !== 0) {
+        // `skipRepair` for a hardlink: lstat cannot distinguish one, so chmod
+        // would change an inode that also lives outside this directory.
+        // Reported anyway — an exposed file the repair will not touch is
+        // exactly what the doctor finding exists to surface.
+        out.push({ path, rel, mode: st.mode & 0o777, want, skipRepair: linked });
+      }
+      return st;
+    } catch { return null; }
+  };
+  if (!inspect(dir, '.', true)) return out;
+  let names = [];
+  try { names = readdirSync(dir); } catch { return out; }
+  for (const name of names) {
+    const path = join(dir, name);
+    const st = inspect(path, name);
+    if (!st?.isDirectory()) continue;
+    try {
+      for (const child of readdirSync(path)) inspect(join(path, child), `${name}/${child}`);
+    } catch { /* unreadable */ }
+  }
+  return out;
+}
+
+// Applies what scanStateDir found. `want` carries 0700 for directories and
+// 0600 for files — a directory chmod'd 0600 would lose its traverse bit and
+// nothing inside it could be opened.
+// Returns { fixed, refused, ineffective }. The three outcomes are genuinely
+// different and the caller needs to tell them apart:
+//   fixed       — the bits moved.
+//   refused     — chmod threw (EPERM, EROFS, an immutable flag). A real
+//                 exposure that cannot be repaired; keep reporting it.
+//   ineffective — chmod SUCCEEDED and nothing changed. The filesystem does
+//                 not implement POSIX modes at all (a CIFS/vfat/NTFS mount
+//                 with `noperm`, WSL's drvfs, a Docker bind mount from a
+//                 Windows host). Retrying forever would never converge, and
+//                 `process.platform` does not identify this case — only
+//                 attempting it does.
+export function narrowStateDir(entries) {
+  let fixed = 0, refused = 0, ineffective = 0;
+  for (const e of entries) {
+    if (e.skipRepair) continue;
+    try {
+      chmodSync(e.path, e.want);
+      if ((lstatSync(e.path).mode & 0o077) === 0) fixed += 1;
+      else ineffective += 1;
+    } catch { refused += 1; }
+  }
+  return { fixed, refused, ineffective };
+}
+
+// Directories whose filesystem provably ignores chmod. Learned by attempting
+// it, never guessed from the platform.
+const modesUnenforced = new Set();
+
+function repairModes(dir) {
+  // Key on the resolved path: callers reach this through
+  // dirname(join(STATE_DIR, 'x')), which normalizes a trailing slash away, so
+  // raw strings would give the same directory two throttle slots.
+  const key = resolve(dir);
+  if (modesUnenforced.has(key)) return;
+  const now = Date.now();
+  if (now - (repairedAt.get(key) ?? -Infinity) < MODE_REPAIR_INTERVAL_MS) return;
+  repairedAt.set(key, now);
+  const entries = scanStateDir(dir);
+  if (entries.length === 0) return;
+  const { fixed, refused, ineffective } = narrowStateDir(entries);
+  // Every attempt succeeded and not one bit moved: this filesystem has no
+  // POSIX modes to set. Stop walking it — the alternative is re-chmodding
+  // the whole directory every interval for the life of the daemon.
+  if (fixed === 0 && refused === 0 && ineffective > 0) modesUnenforced.add(key);
+}
+
+// tmp + rename + chmod. writeFileSync's `mode` lands only when it CREATES the
+// file, so a tmp left behind by a crashed predecessor that happened to share
+// this pid would otherwise carry its own 0644 onto the target through the
+// rename — and a target left 0644 by an older version would never be fixed.
+// The chmod after the rename closes both. Same pattern, and the same reason,
+// as ensureAskpassHelper in askpass.js.
+export function writePrivateFile(target, tmp, data) {
+  writeFileSync(tmp, data, { mode: 0o600 });
+  renameSync(tmp, target);
+  // A filesystem with no usable chmod (FAT, some network mounts) must not
+  // turn every state write into a crash — the 0700 directory still covers it.
+  try { chmodSync(target, 0o600); } catch { /* best-effort */ }
+  return target;
+}
+
 export const CLAUDE_DIR = process.env.UNSNOOZE_CLAUDE_DIR
   || process.env.CLAUDE_CONFIG_DIR || join(homedir(), '.claude');
 export const CLAUDE_SETTINGS = join(CLAUDE_DIR, 'settings.json');

package/src/dashboard/run.js

@@ -62,6 +62,41 @@ export function installMouseCleanup(stdout = process.stdout) {
   };
 }
 
+// React's development build records a `performance.measure()` entry for every
+// render, commit and setState — the React Performance Track it publishes for
+// devtools. Node buffers user-timing entries and nothing ever drains that
+// buffer, so on a long-lived dashboard it IS the leak: the status tab repaints
+// roughly three times a second (a 1s data tick plus the 450ms logo animation),
+// each repaint leaves ~40 entries behind, and an overnight `unsnooze status`
+// walked into Node's 2GB heap ceiling and aborted (#16). Measured at ~12 kB
+// retained per render, surviving a forced GC.
+//
+// The entries cannot be capped (Node caps resource timing, not user timing) and
+// switching React to its production build would mean setting NODE_ENV for the
+// whole CLI before anything imports React. Draining is the narrow fix: nothing
+// in unsnooze reads user timing, and the sweep lives exactly as long as the
+// render does.
+export const TIMING_SWEEP_MS = 5_000;
+
+export function sweepReactTiming(perf = globalThis.performance) {
+  try {
+    perf?.clearMeasures?.();
+    perf?.clearMarks?.();
+  } catch { /* a runtime with no user timing has nothing to leak */ }
+}
+
+// Returns the stop function. The timer is unref'd: draining a buffer is never
+// a reason to hold the process open.
+export function startTimingSweep({ intervalMs = TIMING_SWEEP_MS, perf } = {}) {
+  sweepReactTiming(perf);
+  const timer = setInterval(() => sweepReactTiming(perf), intervalMs);
+  timer.unref?.();
+  return () => {
+    clearInterval(timer);
+    sweepReactTiming(perf);
+  };
+}
+
 export function shouldUseDashboard({
   force = null,
   json = false,
@@ -87,13 +122,18 @@ export async function runDashboard({ tab = 'status' } = {}) {
   }
 
   installMouseCleanup(process.stdout);
-  const instance = render(h(App, { initialTab: tab, mouseEnabled: getConfig('mouse') !== false }), {
-    exitOnCtrlC: true,
-    // Full-screen: separate buffer like vim / htop / less — original scrollback restored on quit
-    alternateScreen: true,
-  });
+  const stopTimingSweep = startTimingSweep();
+  try {
+    const instance = render(h(App, { initialTab: tab, mouseEnabled: getConfig('mouse') !== false }), {
+      exitOnCtrlC: true,
+      // Full-screen: separate buffer like vim / htop / less — original scrollback restored on quit
+      alternateScreen: true,
+    });
 
-  await instance.waitUntilExit();
+    await instance.waitUntilExit();
+  } finally {
+    stopTimingSweep();
+  }
   // Belt and braces: normal quit also clears modes (provider already did).
   process.stdout.write(MOUSE_DISABLE_ALL);
   return 0;

package/src/doctor.js

@@ -10,7 +10,7 @@ import { readFileSync, readdirSync, renameSync, existsSync, unlinkSync, lstatSyn
 import { spawnSync } from 'node:child_process';
 import { homedir } from 'node:os';
 import { join, dirname } from 'node:path';
-import { CLAUDE_SETTINGS, RESUMER_LOCK } from './config.js';
+import { CLAUDE_SETTINGS, RESUMER_LOCK, STATE_DIR, scanStateDir, narrowStateDir } from './config.js';
 import { getMultiplexer } from './multiplexer.js';
 import { makeLogger } from './logger.js';
 import { shouldUseTui, formatDoctorTui } from './tui.js';
@@ -151,6 +151,26 @@ function daemonRunning() {
  * detail, fix? } — `fix` is a machine-actionable descriptor consumed by
  * applyFixes. healthy === no legacy and no health findings.
  */
+// Both delegate to config.js's walk: the reporter and the automatic repair
+// must never disagree about what counts as exposed, which is exactly what
+// happened when each had its own idea of where to look.
+export function findExposedStateFiles(dir = STATE_DIR, opts = {}) {
+  return scanStateDir(dir, opts).map(e => ({ ...e, mode: e.mode.toString(8) }));
+}
+
+// Deliberately NOT given runDoctor's `platform`. Every other check uses that
+// to simulate an install target — "what would doctor say on Windows?" — but
+// whether mode bits mean anything is a fact about the filesystem actually
+// under the process, not about the platform being simulated. Passing the
+// simulated one made a `platform: 'darwin'` test raise this finding while
+// running on a Windows runner, where the modes are synthetic and no repair
+// could ever clear it. scanStateDir keeps its own injectable platform for
+// direct unit tests.
+
+export function narrowStateModes(entries) {
+  return narrowStateDir(entries);
+}
+
 export async function runDoctor({
   runner = defaultRunner,
   platform = process.platform,
@@ -164,6 +184,7 @@ export async function runDoctor({
   rcContent = undefined,
   profileContent = undefined,
   autostartDir = null,
+  stateDir = STATE_DIR,
 } = {}) {
   const findings = [];
 
@@ -220,6 +241,22 @@ export async function runDoctor({
       detail: '  run: unsnooze install --yes  (then: exec $SHELL)',
     });
   }
+  // The state dir is repaired on every write, but chmod is swallowed there —
+  // a filesystem that cannot honour it (FAT, some network mounts) would
+  // otherwise leave everything world-readable with nothing ever saying so.
+  // This is the place that says so, and --fix retries the chmod.
+  const exposed = findExposedStateFiles(stateDir);
+  if (exposed.length) {
+    findings.push({
+      id: 'state-permissions', kind: 'health',
+      title: `${exposed.length} file(s) in ${stateDir} are readable by other users`,
+      detail: exposed.slice(0, 8).map(e => `  ${e.mode} ${e.rel}`).join('\n')
+        + (exposed.length > 8 ? `\n  …and ${exposed.length - 8} more` : '')
+        + '\n  run: unsnooze doctor --fix',
+      fix: { action: 'narrow-state-modes', entries: exposed },
+    });
+  }
+
   let muxOk = false;
   try { muxOk = !!mux.available(); } catch { muxOk = false; }
   if (!muxOk) {
@@ -321,6 +358,11 @@ export async function applyFixes(report, {
       } else {
         actions.push({ action: 'error', detail: 'could not determine a PATH that finds the multiplexer — run `unsnooze install --daemon` from your shell' });
       }
+    } else if (fix.action === 'narrow-state-modes') {
+      const r = narrowStateModes(fix.entries || []);
+      actions.push({ action: 'narrowed-modes', ...r });
+      log(`doctor: narrowed ${r.fixed} state-dir path(s) to owner-only `
+        + `(${r.refused} refused, ${r.ineffective} ignored by the filesystem)`);
     } else if (fix.action === 'archive-dir') {
       let target = `${fix.dir}.bak`;
       if (existsSync(target)) target = `${fix.dir}.bak.${now}`;
@@ -379,6 +421,16 @@ export async function cmdDoctor(rest = [], deps = {}) {
       if (a.action === 'killed') print(`  ✓ stopped csg process ${a.pid}`);
       else if (a.action === 'removed-unit') print(`  ✓ removed ${a.unit}`);
       else if (a.action === 'archived') print(`  ✓ archived ${a.from} → ${a.to}`);
+      else if (a.action === 'narrowed-modes') {
+        if (a.fixed) print(`  ✓ made ${a.fixed} state-dir path(s) owner-only`);
+        // Distinguish "cannot" from "did not": a filesystem with no POSIX
+        // modes reports success and changes nothing, and telling the user to
+        // try again would be advice that can never work.
+        if (a.ineffective) {
+          print(`  · ${a.ineffective} path(s) unchanged — this filesystem does not enforce POSIX permissions`);
+        }
+        if (a.refused) print(`  ✗ ${a.refused} path(s) could not be changed (permission denied)`);
+      }
       else if (a.action === 'error') print(`  ! ${a.detail}`);
     }
     const pkg = legacy.find(f => f.id === 'csg-package');
@@ -386,8 +438,14 @@ export async function cmdDoctor(rest = [], deps = {}) {
     return 0;
   }
 
+  // Offer --fix whenever anything reported is actually machine-fixable, not
+  // only for csg leftovers: a health finding that carries a `fix` (state
+  // permissions) was otherwise a dead end for the reader.
+  const fixable = report.findings.some(f => f.fix);
   print(legacy.length
     ? '\nRun `unsnooze doctor --fix` to stop csg processes, remove its autostart, and archive its state.'
-    : '\nSee the hints above to finish the install.');
+    : fixable
+      ? '\nRun `unsnooze doctor --fix` to apply the repairs above.'
+      : '\nSee the hints above to finish the install.');
   return 1;
 }

package/src/fleet.js

@@ -5,9 +5,9 @@
 // allowlisted host tokens, closed verb set, sentinel-framed JSON, and
 // control-char-stripped ingest.
 import { join } from 'node:path';
-import { readFileSync, writeFileSync, renameSync, mkdirSync, existsSync as fsExistsSync } from 'node:fs';
+import { readFileSync, existsSync as fsExistsSync } from 'node:fs';
 import { spawn, execFileSync, spawnSync } from 'node:child_process';
-import { STATE_DIR } from './config.js';
+import { STATE_DIR, ensureStateDir, writePrivateFile } from './config.js';
 import { colors, shouldUseTui, makeTable, logoBlock, badge } from './tui.js';
 import { ensureAskpassHelper, resolveSecret, readSecret } from './askpass.js';
 import { UNSNOOZE_BIN } from './spawn.js';
@@ -288,10 +288,12 @@ export function readHosts() {
 }
 
 export function writeHosts(hosts) {
-  mkdirSync(STATE_DIR, { recursive: true });
-  const tmp = HOSTS_FILE + `.tmp.${process.pid}`;
-  writeFileSync(tmp, JSON.stringify(hosts, null, 2) + '\n');
-  renameSync(tmp, HOSTS_FILE);
+  ensureStateDir();
+  // Owner-only: a `command` source's --cmd string is whatever the user
+  // pointed at their secret store, and a keychain source names the
+  // service/account to look up.
+  writePrivateFile(HOSTS_FILE, HOSTS_FILE + `.tmp.${process.pid}`,
+    JSON.stringify(hosts, null, 2) + '\n');
 }
 
 function parseFlags(argv) {
@@ -740,10 +742,11 @@ export function readFleetCache() {
 }
 
 export function writeFleetCache(results) {
-  mkdirSync(STATE_DIR, { recursive: true });
-  const tmp = FLEET_CACHE_FILE + `.tmp.${process.pid}`;
-  writeFileSync(tmp, JSON.stringify(results, null, 2) + '\n');
-  renameSync(tmp, FLEET_CACHE_FILE);
+  ensureStateDir();
+  // Owner-only: the cache mirrors every remote host's cwd paths and
+  // queued-prompt previews.
+  writePrivateFile(FLEET_CACHE_FILE, FLEET_CACHE_FILE + `.tmp.${process.pid}`,
+    JSON.stringify(results, null, 2) + '\n');
 }
 
 // I1: a `prompt`-source host at a real interactive TTY is the one case

package/src/hook.js

@@ -89,9 +89,10 @@ export async function runHook(rest = []) {
       // Seconds-scale problem — leave a marker for the pane's monitor, do NOT
       // record in state.json.
       if (pane) {
-        mkdirSync(EVENTS_DIR, { recursive: true });
+        mkdirSync(EVENTS_DIR, { recursive: true, mode: 0o700 });
         writeFileSync(join(EVENTS_DIR, `${addressHash({ mux: muxName, paneOwner, pane })}.json`),
-          JSON.stringify({ mux: muxName, paneOwner, pane, kind, at: Date.now(), payload: { error: payload.error ?? null } }));
+          JSON.stringify({ mux: muxName, paneOwner, pane, kind, at: Date.now(), payload: { error: payload.error ?? null } }),
+          { mode: 0o600 });
       }
       return 0;
     }

package/src/lease.js

@@ -43,10 +43,10 @@ function leasePath(address, leaseId) {
 }
 
 export function writeLease(lease) {
-  mkdirSync(LEASES_DIR, { recursive: true });
+  mkdirSync(LEASES_DIR, { recursive: true, mode: 0o700 });
   const path = leasePath(lease, lease.leaseId);
   const tmp = `${path}.tmp.${process.pid}.${randomUUID()}`;
-  writeFileSync(tmp, JSON.stringify(lease));
+  writeFileSync(tmp, JSON.stringify(lease), { mode: 0o600 });
   renameSync(tmp, path);
   return lease;
 }

package/src/logger.js

@@ -1,6 +1,6 @@
-import { appendFileSync, mkdirSync, statSync, renameSync, copyFileSync, truncateSync } from 'node:fs';
+import { appendFileSync, statSync, renameSync, copyFileSync, truncateSync } from 'node:fs';
 import { dirname } from 'node:path';
-import { LOG_FILE } from './config.js';
+import { LOG_FILE, ensureStateDir } from './config.js';
 
 // Logs must never grow unbounded (a single upgrade-window crash-loop once
 // produced a 10.3 MB daemon.log). One rotated generation is kept: file → .1.
@@ -46,11 +46,13 @@ export function log(component, message) {
   const line = `${new Date().toISOString()} [${component}] ${message}\n`;
   try {
     if (!dirReady) {
-      mkdirSync(dirname(LOG_FILE), { recursive: true });
+      ensureStateDir(dirname(LOG_FILE));
       dirReady = true;
     }
     rotateIfLarge(LOG_FILE);
-    appendFileSync(LOG_FILE, line);
+    // mode applies only when append CREATES the file — an existing log keeps
+    // whatever it has, and the 0700 dir is what covers it either way.
+    appendFileSync(LOG_FILE, line, { mode: 0o600 });
   } catch {
     // Logging must never crash the hook or monitor paths.
   }

package/src/multiplexers/headless.js

@@ -96,9 +96,11 @@ export function createHeadless({
     // A revive is just a detached child. Its output goes to a per-session log
     // because there is no scrollback to read it out of later.
     async newWindow(sessionName, cwd, launchSpec) {
-      mkdirSync(logDir, { recursive: true });
+      // 0700/0600: this log is the entire stdout+stderr of an unattended
+      // agent run — the most revealing thing under the state dir.
+      mkdirSync(logDir, { recursive: true, mode: 0o700 });
       const logPath = join(logDir, `${sessionName}.log`);
-      const fd = openSync(logPath, 'a');
+      const fd = openSync(logPath, 'a', 0o600);
       const child = spawner(launchSpec.file, launchSpec.args || [], {
         cwd,
         detached: true,

package/src/mux-sessions.js

@@ -29,10 +29,10 @@ export function recordOwnedSession({ mux, name }) {
   if (!mux || !name) return null;
   const record = { mux, name, createdAt: Date.now(), pid: process.pid };
   try {
-    mkdirSync(SESSIONS_DIR(), { recursive: true });
+    mkdirSync(SESSIONS_DIR(), { recursive: true, mode: 0o700 });
     const path = recordPath(mux, name);
     const tmp = `${path}.tmp.${process.pid}.${randomUUID()}`;
-    writeFileSync(tmp, JSON.stringify(record));
+    writeFileSync(tmp, JSON.stringify(record), { mode: 0o600 });
     renameSync(tmp, path);
     return record;
   } catch {

package/src/resumer.js

@@ -4,12 +4,12 @@
 // fires on the next tick), then re-opens/continues every due session.
 // Exits when no non-terminal records remain; the next limit event respawns it.
 
-import { writeFileSync, readFileSync, unlinkSync, mkdirSync } from 'node:fs';
+import { writeFileSync, readFileSync, unlinkSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { spawnSync } from 'node:child_process';
 import { getMultiplexer, backendCanType } from './multiplexer.js';
 import {
-  RESUMER_LOCK, STATE_DIR, POLL_INTERVAL_MS, STAGGER_MS, VERIFY_DELAY_MS,
+  RESUMER_LOCK, POLL_INTERVAL_MS, STAGGER_MS, VERIFY_DELAY_MS, ensureStateDir,
   BUSY_DEFER_MS, MAX_BUSY_DEFERS, MAX_RESUME_ATTEMPTS, READY_TIMEOUT_MS,
   CAPTURE_LINES, PANE_SCAN_LINES, RESUME_SESSION_NAME,
   RESET_MARGIN_MS, FALLBACK_RESET_MS, PROBE_INTERVAL_MS, PROBE_MAX_MS,
@@ -64,10 +64,10 @@ function defaultIsResumer(pid) {
 // read-check-write window. A held lock is honored only when its pid is alive
 // AND looks like a resumer; stale/garbage/recycled locks are replaced.
 export function acquireSingleton({ isResumer = defaultIsResumer } = {}) {
-  mkdirSync(STATE_DIR, { recursive: true });
+  ensureStateDir();
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
-      writeFileSync(RESUMER_LOCK, String(process.pid), { flag: 'wx' });
+      writeFileSync(RESUMER_LOCK, String(process.pid), { flag: 'wx', mode: 0o600 });
       return true;
     } catch { /* lock exists — inspect the holder below */ }
     let pid = NaN;

package/src/sessions.js

@@ -40,8 +40,26 @@ export function latestSessionId(cwd, aroundTs = null) {
   return best ? best.id : null;
 }
 
+// sessionId lands here straight off a hook payload / transcript record and is
+// used as a path component — the same untrusted-value-as-filename shape the
+// statusline shim had, on the channel everyone has enabled. dashCwd already
+// sanitizes the cwd half; a '/' or a '..' in the id half would walk this read
+// out of the projects tree.
+//
+// Deliberately a filename-shape check rather than UUID_RE: that regex is the
+// right gate for *discovering* transcripts (it reads Claude's own directory
+// listing) but the wrong one here, where the id arrives from an agent whose
+// naming we do not own. Requiring a uuid would silently turn off the context
+// guard for any session named otherwise; requiring a safe component closes
+// the traversal either way. '.' and '..' are harmless: the '.jsonl' suffix
+// makes them ordinary filenames. Returns null for anything else, which every
+// caller already reports as "no transcript".
+const SAFE_SESSION_ID_RE = /^[A-Za-z0-9._-]{1,128}$/;
+
 export function transcriptPath(cwd, sessionId, { claudeDir = CLAUDE_DIR } = {}) {
-  return join(claudeDir, 'projects', dashCwd(cwd), `${sessionId}.jsonl`);
+  const id = String(sessionId ?? '');
+  if (!SAFE_SESSION_ID_RE.test(id)) return null;
+  return join(claudeDir, 'projects', dashCwd(cwd), `${id}.jsonl`);
 }
 
 export function claudeRecordEnv(env = process.env) {

package/src/settings.js

@@ -6,9 +6,9 @@
 // the global resumeMessage even when the global came from an env var (see
 // resolveResumeMessage).
 
-import { readFileSync, writeFileSync, renameSync, mkdirSync } from 'node:fs';
+import { readFileSync } from 'node:fs';
 import { join, dirname } from 'node:path';
-import { MUX_NAMES, STATE_DIR } from './config.js';
+import { MUX_NAMES, STATE_DIR, ensureStateDir, writePrivateFile } from './config.js';
 
 export const CONFIG_FILE = () => join(process.env.UNSNOOZE_STATE_DIR || STATE_DIR, 'config.json');
 
@@ -267,10 +267,11 @@ export function setConfigValue(key, rawValue) {
 
 export function writeConfig(config) {
   const path = CONFIG_FILE();
-  mkdirSync(dirname(path), { recursive: true });
-  const tmp = join(dirname(path), `.config.tmp.${process.pid}`);
-  writeFileSync(tmp, JSON.stringify(config, null, 2) + '\n');
-  renameSync(tmp, path);
+  ensureStateDir(dirname(path));
+  // Owner-only: ntfyToken is a Bearer credential, and config.json was
+  // world-readable before 1.17.0.
+  writePrivateFile(path, join(dirname(path), `.config.tmp.${process.pid}`),
+    JSON.stringify(config, null, 2) + '\n');
 }
 
 export function configFileExists() {

package/src/state.js

@@ -10,7 +10,8 @@ import {
 } from 'node:fs';
 import { join } from 'node:path';
 import {
-  STATE_DIR, STATE_FILE, LOCK_DIR, STALE_LOCK_MS, PRUNE_AFTER_MS,
+  STATE_DIR, STATE_FILE, LOCK_DIR, STALE_LOCK_MS, PRUNE_AFTER_MS, ensureStateDir,
+  writePrivateFile,
   DEDUPE_WINDOW_MS, STALE_AFTER_MS, PROBE_INTERVAL_MS, PROBE_MAX_MS,
   RESET_MARGIN_MS,
 } from './config.js';
@@ -48,22 +49,78 @@ function lockHolderAlive() {
   }
 }
 
+// lockHolderAlive() can only ask "is this pid alive", never "is it still
+// unsnooze". A leaked lock whose pid is later recycled onto some unrelated
+// long-lived process therefore looks live forever, and every writer — daemon,
+// CLI, in-agent hook — wedges permanently with no way out but deleting the
+// directory by hand. Past this ceiling, age wins regardless.
+//
+// This is a deliberate trade, not a free win: stealing from a holder that IS
+// still working puts two writers in the critical section, and the robbed one's
+// rename then clobbers the thief's write — a lost update. It is chosen because
+// a permanent unrecoverable wedge is the worse failure. The exposure is kept
+// small by holding this lock only for in-memory work plus one write:
+// upsertSession's git call is hoisted out for exactly this reason. Five
+// minutes is ~200x the worst measured critical section.
+//
+// Known limit: both sides of the age are wall-clock, so a forward clock step
+// (VM resume, laptop wake, a large NTP correction) can age a fresh lock past
+// the ceiling at once. There is no cross-process monotonic clock to use
+// instead, which is part of why the ceiling is generous rather than tight.
+const HARD_STALE_LOCK_MS = Math.max(STALE_LOCK_MS * 30, 300_000);
+
 function acquireLock() {
   const deadline = Date.now() + LOCK_TIMEOUT_MS;
+  let parentRepaired = false;
   for (;;) {
     try {
-      mkdirSync(LOCK_DIR);
+      mkdirSync(LOCK_DIR, { mode: 0o700 });
       // Record the holder so a slow-but-alive writer is never robbed — age
       // alone can't tell a hung process from a busy one.
-      try { writeFileSync(join(LOCK_DIR, 'pid'), String(process.pid)); } catch { /* best-effort */ }
+      try { writeFileSync(join(LOCK_DIR, 'pid'), String(process.pid), { mode: 0o600 }); } catch { /* best-effort */ }
       return;
     } catch (err) {
-      if (err.code !== 'EEXIST') { mkdirSync(STATE_DIR, { recursive: true }); continue; }
+      if (err.code !== 'EEXIST') {
+        // NOT contention. A missing STATE_DIR is worth exactly one immediate
+        // repair-and-retry; every other errno (EACCES on an unwritable
+        // ~/.unsnooze, EROFS, ENOSPC) must fall through to the same backoff
+        // and deadline as any other failure. This branch used to `continue`
+        // unconditionally, skipping both — and since mkdir -p on an existing
+        // STATE_DIR succeeds as a no-op, an unwritable state dir spun here
+        // forever at ~70% of a core, ignoring LOCK_TIMEOUT_MS, in every writer:
+        // the daemon, the CLI, and the StopFailure hook inside the agent.
+        if (!parentRepaired) {
+          parentRepaired = true;
+          try { ensureStateDir(); } catch { /* fall through to the backoff */ }
+          continue;
+        }
+        if (Date.now() > deadline) {
+          throw new Error(`unsnooze: cannot create state lock at ${LOCK_DIR}: ${err.code || err.message}`);
+        }
+        sleepSync(50);
+        // A *recurring* ENOENT means the directory keeps going away under us
+        // (an uninstall racing a write), not that the one-shot repair failed.
+        // Keep repairing it, but from the backoff — never in a tight loop.
+        if (err.code === 'ENOENT') { try { ensureStateDir(); } catch { /* next pass */ } }
+        continue;
+      }
       try {
-        const age = Date.now() - statSync(LOCK_DIR).mtimeMs;
-        if (age > STALE_LOCK_MS && lockHolderAlive() !== true) {
-          rmSync(LOCK_DIR, { recursive: true, force: true });   // steal from a dead/unknown holder
-          log(`stole stale lock (age ${Math.round(age)}ms)`);
+        const before = statSync(LOCK_DIR);
+        const age = Date.now() - before.mtimeMs;
+        if (age > STALE_LOCK_MS && (age > HARD_STALE_LOCK_MS || lockHolderAlive() !== true)) {
+          // Re-stat immediately before removing. The staleness verdict above
+          // costs a readFileSync + kill(), and in that gap another contender
+          // can have stolen this same lock and created a fresh one — removing
+          // that would drop a live holder's lock and break mutual exclusion.
+          // A matching inode means it is still the dir we judged stale. This
+          // narrows the window rather than closing it: a filesystem that
+          // recycles a just-freed directory inode can hand the same number
+          // back, and Windows may report 0 for both — in either case this
+          // degrades to the old unconditional behaviour, never to a worse one.
+          if (statSync(LOCK_DIR).ino === before.ino) {
+            rmSync(LOCK_DIR, { recursive: true, force: true });   // steal from a dead/unknown holder
+            log(`stole stale lock (age ${Math.round(age)}ms)`);
+          }
           continue;
         }
       } catch { /* lock vanished between check and stat — retry */ }
@@ -74,6 +131,14 @@ function acquireLock() {
 }
 
 function releaseLock() {
+  try {
+    // Only drop a lock we still hold. A stale-lock steal can rob a live
+    // holder (see acquireLock); if that happened, the dir now belongs to the
+    // thief, and removing it would hand a third writer a lock the thief still
+    // believes is theirs. An unreadable/absent pid file means the lock is
+    // ours-but-unstamped or already gone — both fall through to the remove.
+    if (readFileSync(join(LOCK_DIR, 'pid'), 'utf-8') !== String(process.pid)) return;
+  } catch { /* no pid file: our own best-effort stamp failed, or it's gone */ }
   try { rmSync(LOCK_DIR, { recursive: true, force: true }); } catch { /* already gone */ }
 }
 
@@ -86,7 +151,12 @@ export function readState() {
     try {
       const quarantine = `${STATE_FILE}.corrupt.${Date.now()}`;
       renameSync(STATE_FILE, quarantine);
-      log(`CORRUPT state.json quarantined to ${quarantine}: ${err.message}`);
+      // err.message, NOT logged: V8 embeds the first bytes of the input in
+      // its JSON.parse message ("Unexpected token 'S', \"SUPER SECR\"..."),
+      // so a state.json that is really a symlink to something else would
+      // print that file's opening bytes into unsnooze.log. The quarantined
+      // file is right there on disk for anyone who needs to see the content.
+      log(`CORRUPT state.json quarantined to ${quarantine} (${err.name || 'parse error'})`);
     } catch { /* someone else quarantined it first */ }
     return EMPTY();
   }
@@ -137,14 +207,14 @@ function normalizeRecord(rec) {
 // Locked read-modify-write. mutator receives the state object and mutates it
 // (or returns a replacement). Returns the final state.
 export function updateState(mutator) {
-  mkdirSync(STATE_DIR, { recursive: true });
+  ensureStateDir();
   acquireLock();
   try {
     const state = readState();
     const result = mutator(state) ?? state;
-    const tmp = join(STATE_DIR, `.state.tmp.${process.pid}`);
-    writeFileSync(tmp, JSON.stringify(result, null, 2));
-    renameSync(tmp, STATE_FILE);
+    // Owner-only: session records embed cwd paths and queued prompt text.
+    writePrivateFile(STATE_FILE, join(STATE_DIR, `.state.tmp.${process.pid}`),
+      JSON.stringify(result, null, 2));
     return result;
   } finally {
     releaseLock();
@@ -159,6 +229,24 @@ export function updateState(mutator) {
 // calibration snapshots so stop + ceiling sample never race (1.13).
 export function upsertSession(record, { after = null } = {}) {
   record = normalizeRecord({ ...record });
+  // Computed BEFORE the lock, never inside the mutator. workspaceFingerprint
+  // shells out to git, and execFileSync's `timeout` is a soft bound — it
+  // sends SIGTERM at the deadline and then waits for the child to actually
+  // exit, which a git wedged in uninterruptible I/O on a hung network mount
+  // never does. That made it the one unbounded operation under the state
+  // lock, and the only way a critical section could outlive
+  // HARD_STALE_LOCK_MS and be stolen from a writer that is still working.
+  // The cost of hoisting is one extra git call when the record turns out to
+  // be a duplicate; the benefit is that the lock is only ever held for
+  // in-memory work plus one write.
+  // 'resuming' is included deliberately: the `closing` branch inside the
+  // mutator can flip such a record to 'stopped', and the apply site below
+  // would then want a baseline this precompute never made. No caller passes
+  // 'resuming' today — this keeps the hoist from becoming a trap for one that
+  // later does.
+  const needsFingerprint = ['stopped', 'resuming'].includes(record.status)
+    && record.workspace === undefined;
+  const fingerprint = needsFingerprint ? workspaceFingerprint(record.cwd) : undefined;
   return updateState(state => {
     prune(state);
     const closing = state.paneClosures.find(c => c.pane && c.leaseId
@@ -228,9 +316,12 @@ export function upsertSession(record, { after = null } = {}) {
       log(`merged duplicate detection for pane ${record.pane} into ${existingKey}`);
     } else {
       // Baseline for the stale-workspace guard, captured once at stop time.
-      // (Merged duplicates above keep the ORIGINAL baseline — spread semantics.)
+      // (Merged duplicates above keep the ORIGINAL baseline — spread
+      // semantics — so this is applied on the non-duplicate branch ONLY.
+      // Assigning it before the branch would let the merge spread it over the
+      // existing record's baseline and silently reset it.)
       if (record.status === 'stopped' && record.workspace === undefined) {
-        record.workspace = workspaceFingerprint(record.cwd);
+        record.workspace = fingerprint;
       }
       const key = record.sessionId || `pane:${addressHash(record)}:${record.detectedAt}`;
       applied = { ...record, key };

package/src/update-check.js

@@ -7,13 +7,14 @@
 // All of it is gated on the `updateCheck` setting / UNSNOOZE_UPDATE_CHECK.
 // The check is a plain GET to registry.npmjs.org — nothing identifying.
 
-import { readFileSync, writeFileSync, renameSync, mkdirSync, existsSync } from 'node:fs';
+import { readFileSync, existsSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { getConfig } from './settings.js';
 import { notify } from './notify.js';
 import { UNSNOOZE_BIN, pidAlive } from './spawn.js';
+import { ensureStateDir, writePrivateFile } from './config.js';
 
 const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
 export const PKG_VERSION = JSON.parse(readFileSync(join(ROOT, 'package.json'), 'utf-8')).version;
@@ -31,10 +32,11 @@ export function readCache() {
 export function writeCache(patch) {
   const merged = { ...readCache(), ...patch };
   const path = CACHE_FILE();
-  mkdirSync(dirname(path), { recursive: true });
-  const tmp = join(dirname(path), `.update-check.tmp.${process.pid}`);
-  writeFileSync(tmp, JSON.stringify(merged, null, 2) + '\n');
-  renameSync(tmp, path);
+  // _update-check runs as a detached child, so on a fresh install this can be
+  // the process that creates ~/.unsnooze — it must create it owner-only.
+  ensureStateDir(dirname(path));
+  writePrivateFile(path, join(dirname(path), `.update-check.tmp.${process.pid}`),
+    JSON.stringify(merged, null, 2) + '\n');
   return merged;
 }
 

package/src/usage.js

@@ -11,7 +11,7 @@ import {
   CLAUDE_DIR, CODEX_DIR, USAGE_FILE, USAGE_ETA_WARN_MIN,
   USAGE_BURN_LOOKBACK_MS, USAGE_BURN_MIN_COVERAGE_MS, USAGE_IDLE_GAP_MS,
   USAGE_WINDOW_IDLE_MS, USAGE_CALIBRATION_RING, USAGE_CALIBRATION_MEDIAN_N,
-  USAGE_STATUSLINE_DIR,
+  USAGE_STATUSLINE_DIR, ensureStateDir, writePrivateFile,
 } from './config.js';
 import { readState, updateState } from './state.js';
 import { getConfig } from './settings.js';
@@ -535,10 +535,9 @@ export function readUsageStore(path = USAGE_FILE) {
 }
 
 export function writeUsageStore(store, path = USAGE_FILE) {
-  mkdirSync(dirname(path), { recursive: true });
-  const tmp = join(dirname(path), `.usage.tmp.${process.pid}`);
-  writeFileSync(tmp, JSON.stringify(store));
-  renameSync(tmp, path);
+  ensureStateDir(dirname(path));
+  writePrivateFile(path, join(dirname(path), `.usage.tmp.${process.pid}`),
+    JSON.stringify(store));
   return store;
 }
 
@@ -1239,15 +1238,30 @@ let data = {};
 try { data = JSON.parse(raw || '{}'); } catch { /* ignore */ }
 
 const dir = path.join(os.homedir(), '.claude', 'unsnooze');
-try { fs.mkdirSync(dir, { recursive: true }); } catch { /* ignore */ }
-const sid = data.session_id || data.sessionId || 'unknown';
+// 0700/0600 like the state dir: these drops carry your live rate-limit
+// numbers, and the shim is the only thing that creates them. mkdir's mode is
+// ignored for a directory that already exists, so an install that predates
+// this is repaired explicitly — the same reasoning ensureStateDir applies one
+// directory over. Skipped on Windows, where the POSIX bits are synthetic.
+try { fs.mkdirSync(dir, { recursive: true, mode: 0o700 }); } catch { /* ignore */ }
+if (process.platform !== 'win32') {
+  try { fs.chmodSync(dir, 0o700); } catch { /* not ours */ }
+}
+// The id becomes a filename. Claude Code sends a uuid, but nothing here is
+// in a position to trust that: a '/' or a '..' would walk the drop file out
+// of ~/.claude/unsnooze and overwrite any .json the user can write.
+const rawSid = String(data.session_id || data.sessionId || 'unknown');
+const sid = /^[A-Za-z0-9._-]{1,128}$/.test(rawSid) ? rawSid : 'unknown';
 const drop = path.join(dir, 'usage-' + sid + '.json');
 try {
   fs.writeFileSync(drop, JSON.stringify({
     rate_limits: data.rate_limits || null,
     at: Date.now(),
     sessionId: sid,
-  }));
+  }), { mode: 0o600 });
+  // mode only lands when writeFileSync CREATES the file; an existing drop
+  // from before this change keeps its own until chmod'd.
+  if (process.platform !== 'win32') fs.chmodSync(drop, 0o600);
 } catch { /* ignore */ }
 
 const orig = process.env.UNSNOOZE_STATUSLINE_ORIG || '';

package/src/watcher.js

@@ -293,9 +293,9 @@ export function createWatcher({
     }
     if (!dirty) return;
     try {
-      mkdirSync(dirname(offsetsPath), { recursive: true });
+      mkdirSync(dirname(offsetsPath), { recursive: true, mode: 0o700 });
       const tmp = join(dirname(offsetsPath), `.offsets.tmp.${process.pid}`);
-      writeFileSync(tmp, JSON.stringify(offsets));
+      writeFileSync(tmp, JSON.stringify(offsets), { mode: 0o600 });
       renameSync(tmp, offsetsPath);
       dirty = false;
     } catch (err) {