unsnooze 1.16.3 → 1.18.0

package/src/config.js

@@ -1,5 +1,8 @@
 import { homedir } from 'node:os';
-import { join } from 'node:path';
+import { join, resolve } from 'node:path';
+import {
+  mkdirSync, chmodSync, writeFileSync, renameSync, lstatSync, statSync, readdirSync,
+} from 'node:fs';
 
 function envInt(name, def) {
   const v = parseInt(process.env[name] ?? '', 10);
@@ -15,6 +18,172 @@ export const RESUMER_LOCK = join(STATE_DIR, 'resumer.lock');
 // High-frequency burn accumulator + warn-dedup (daemon single-writer).
 export const USAGE_FILE = join(STATE_DIR, 'usage.json');
 
+// Everything under STATE_DIR is owner-only. The directory holds an ntfy
+// bearer token (config.json), queued prompt text and cwd paths (state.json),
+// ssh destinations and credential-source commands (hosts.json) — none of it
+// another local user's business, and the dir mode is what protects the files
+// that don't set their own. mkdir's `mode` only applies when it creates, so
+// a 0755 dir left by a pre-1.17.0 install is repaired explicitly.
+// No-op on Windows (node's chmod only carries the read-only bit there); the
+// user profile ACL already restricts it.
+export function ensureStateDir(dir = STATE_DIR) {
+  // Creating a directory owner-only is always right — we are about to put a
+  // 0600 file in it.
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  // Narrowing one that ALREADY exists is only ever done for our own state
+  // dir. ensureStateDir is also called with a caller-supplied path
+  // (writeUsageStore takes one), and re-permissioning someone else's
+  // directory — or the files inside it — is not this function's business.
+  if (isStateDir(dir)) {
+    try { chmodSync(dir, 0o700); } catch { /* shared/CI dir, not ours to fix */ }
+    repairModes(dir);
+  }
+  return dir;
+}
+
+// Repairing an install that predates 1.17.0. Three things the writers alone
+// cannot fix: mkdir's `mode` is ignored for a directory that already exists,
+// an append/open reuses an existing file's inode, and config.json/hosts.json
+// are written only by `config set` / `hosts add` — on an install that never
+// touches them again they would keep their old 0644 (and, for config.json,
+// the ntfy token in it) indefinitely. So the modes are repaired directly.
+//
+// Re-checked on an interval rather than once per process: daemon.log is
+// created by launchd/systemd redirecting the daemon's stdout, so it can
+// appear at 0644 AFTER a pass has run — in a process that then lives for
+// days. A walk is a readdir and a handful of lstats, so this is free at
+// daemon cadence.
+const MODE_REPAIR_INTERVAL_MS = envInt('UNSNOOZE_MODE_REPAIR_MS', 60_000);
+const repairedAt = new Map();
+
+// Compare resolved paths, not raw strings: callers reach ensureStateDir
+// through dirname(join(STATE_DIR, 'config.json')), which normalizes away a
+// trailing slash that STATE_DIR itself may carry from UNSNOOZE_STATE_DIR. A
+// raw comparison silently answers "not our directory" and skips the repair.
+const isStateDir = (dir) => resolve(dir) === resolve(STATE_DIR);
+
+// ONE walk, exported so `unsnooze doctor` reports from exactly what the
+// automatic repair acts on. They were separate before, and drifted: the
+// repair worked from a fixed list of filenames while doctor walked the whole
+// directory, so a quarantined state.json or a crashed writer's tmp file — the
+// two leftovers that hold verbatim copies of the sensitive files — were
+// reported forever and never fixed.
+//
+// Top level plus one level down is the entire layout: a handful of files and
+// four flat subdirectories.
+export function scanStateDir(dir = STATE_DIR, { platform = process.platform } = {}) {
+  const out = [];
+  // Windows has no POSIX mode bits. libuv synthesises them by mirroring the
+  // owner bits into group and other (win/fs.c `fs__stat_impl`), so a file is
+  // always 0666 (0444 read-only) and a directory 0777 — `mode & 0o077` is
+  // never zero and EVERY entry would look permanently exposed. Meanwhile
+  // uv_fs_chmod only toggles FILE_ATTRIBUTE_READONLY, so no repair could ever
+  // clear it: doctor would never report healthy, `--fix` would claim success
+  // while changing nothing, and the daemon would re-chmod the whole directory
+  // every interval forever. Access there is governed by the profile ACL.
+  if (platform === 'win32') return out;
+  // The root is stat'd, not lstat'd: a state dir that is itself a symlink is
+  // a legitimate setup (dotfiles, another volume) and must still be checked
+  // and repaired. Entries INSIDE are lstat'd and a link is skipped — chmod
+  // follows links, and following one there would reach outside the dir.
+  const inspect = (path, rel, isRoot = false) => {
+    try {
+      const st = isRoot ? statSync(path) : lstatSync(path);
+      if (!isRoot && st.isSymbolicLink()) return null;
+      const linked = !isRoot && !st.isDirectory() && st.nlink > 1;
+      // Strip group/other, but never the owner's execute bit: the state dir
+      // holds executables (askpass.sh, and whatever a test or a user drops
+      // beside it), and forcing a flat 0600 turns those into EACCES on spawn.
+      // Directories need their own traverse bit, hence 0700 rather than 0600.
+      const want = st.isDirectory() ? 0o700 : (0o600 | (st.mode & 0o100));
+      if ((st.mode & 0o077) !== 0) {
+        // `skipRepair` for a hardlink: lstat cannot distinguish one, so chmod
+        // would change an inode that also lives outside this directory.
+        // Reported anyway — an exposed file the repair will not touch is
+        // exactly what the doctor finding exists to surface.
+        out.push({ path, rel, mode: st.mode & 0o777, want, skipRepair: linked });
+      }
+      return st;
+    } catch { return null; }
+  };
+  if (!inspect(dir, '.', true)) return out;
+  let names = [];
+  try { names = readdirSync(dir); } catch { return out; }
+  for (const name of names) {
+    const path = join(dir, name);
+    const st = inspect(path, name);
+    if (!st?.isDirectory()) continue;
+    try {
+      for (const child of readdirSync(path)) inspect(join(path, child), `${name}/${child}`);
+    } catch { /* unreadable */ }
+  }
+  return out;
+}
+
+// Applies what scanStateDir found. `want` carries 0700 for directories and
+// 0600 for files — a directory chmod'd 0600 would lose its traverse bit and
+// nothing inside it could be opened.
+// Returns { fixed, refused, ineffective }. The three outcomes are genuinely
+// different and the caller needs to tell them apart:
+//   fixed       — the bits moved.
+//   refused     — chmod threw (EPERM, EROFS, an immutable flag). A real
+//                 exposure that cannot be repaired; keep reporting it.
+//   ineffective — chmod SUCCEEDED and nothing changed. The filesystem does
+//                 not implement POSIX modes at all (a CIFS/vfat/NTFS mount
+//                 with `noperm`, WSL's drvfs, a Docker bind mount from a
+//                 Windows host). Retrying forever would never converge, and
+//                 `process.platform` does not identify this case — only
+//                 attempting it does.
+export function narrowStateDir(entries) {
+  let fixed = 0, refused = 0, ineffective = 0;
+  for (const e of entries) {
+    if (e.skipRepair) continue;
+    try {
+      chmodSync(e.path, e.want);
+      if ((lstatSync(e.path).mode & 0o077) === 0) fixed += 1;
+      else ineffective += 1;
+    } catch { refused += 1; }
+  }
+  return { fixed, refused, ineffective };
+}
+
+// Directories whose filesystem provably ignores chmod. Learned by attempting
+// it, never guessed from the platform.
+const modesUnenforced = new Set();
+
+function repairModes(dir) {
+  // Key on the resolved path: callers reach this through
+  // dirname(join(STATE_DIR, 'x')), which normalizes a trailing slash away, so
+  // raw strings would give the same directory two throttle slots.
+  const key = resolve(dir);
+  if (modesUnenforced.has(key)) return;
+  const now = Date.now();
+  if (now - (repairedAt.get(key) ?? -Infinity) < MODE_REPAIR_INTERVAL_MS) return;
+  repairedAt.set(key, now);
+  const entries = scanStateDir(dir);
+  if (entries.length === 0) return;
+  const { fixed, refused, ineffective } = narrowStateDir(entries);
+  // Every attempt succeeded and not one bit moved: this filesystem has no
+  // POSIX modes to set. Stop walking it — the alternative is re-chmodding
+  // the whole directory every interval for the life of the daemon.
+  if (fixed === 0 && refused === 0 && ineffective > 0) modesUnenforced.add(key);
+}
+
+// tmp + rename + chmod. writeFileSync's `mode` lands only when it CREATES the
+// file, so a tmp left behind by a crashed predecessor that happened to share
+// this pid would otherwise carry its own 0644 onto the target through the
+// rename — and a target left 0644 by an older version would never be fixed.
+// The chmod after the rename closes both. Same pattern, and the same reason,
+// as ensureAskpassHelper in askpass.js.
+export function writePrivateFile(target, tmp, data) {
+  writeFileSync(tmp, data, { mode: 0o600 });
+  renameSync(tmp, target);
+  // A filesystem with no usable chmod (FAT, some network mounts) must not
+  // turn every state write into a crash — the 0700 directory still covers it.
+  try { chmodSync(target, 0o600); } catch { /* best-effort */ }
+  return target;
+}
+
 export const CLAUDE_DIR = process.env.UNSNOOZE_CLAUDE_DIR
   || process.env.CLAUDE_CONFIG_DIR || join(homedir(), '.claude');
 export const CLAUDE_SETTINGS = join(CLAUDE_DIR, 'settings.json');

package/src/doctor.js

@@ -10,7 +10,7 @@ import { readFileSync, readdirSync, renameSync, existsSync, unlinkSync, lstatSyn
 import { spawnSync } from 'node:child_process';
 import { homedir } from 'node:os';
 import { join, dirname } from 'node:path';
-import { CLAUDE_SETTINGS, RESUMER_LOCK } from './config.js';
+import { CLAUDE_SETTINGS, RESUMER_LOCK, STATE_DIR, scanStateDir, narrowStateDir } from './config.js';
 import { getMultiplexer } from './multiplexer.js';
 import { makeLogger } from './logger.js';
 import { shouldUseTui, formatDoctorTui } from './tui.js';
@@ -151,6 +151,26 @@ function daemonRunning() {
  * detail, fix? } — `fix` is a machine-actionable descriptor consumed by
  * applyFixes. healthy === no legacy and no health findings.
  */
+// Both delegate to config.js's walk: the reporter and the automatic repair
+// must never disagree about what counts as exposed, which is exactly what
+// happened when each had its own idea of where to look.
+export function findExposedStateFiles(dir = STATE_DIR, opts = {}) {
+  return scanStateDir(dir, opts).map(e => ({ ...e, mode: e.mode.toString(8) }));
+}
+
+// Deliberately NOT given runDoctor's `platform`. Every other check uses that
+// to simulate an install target — "what would doctor say on Windows?" — but
+// whether mode bits mean anything is a fact about the filesystem actually
+// under the process, not about the platform being simulated. Passing the
+// simulated one made a `platform: 'darwin'` test raise this finding while
+// running on a Windows runner, where the modes are synthetic and no repair
+// could ever clear it. scanStateDir keeps its own injectable platform for
+// direct unit tests.
+
+export function narrowStateModes(entries) {
+  return narrowStateDir(entries);
+}
+
 export async function runDoctor({
   runner = defaultRunner,
   platform = process.platform,
@@ -164,6 +184,7 @@ export async function runDoctor({
   rcContent = undefined,
   profileContent = undefined,
   autostartDir = null,
+  stateDir = STATE_DIR,
 } = {}) {
   const findings = [];
 
@@ -220,6 +241,22 @@ export async function runDoctor({
       detail: '  run: unsnooze install --yes  (then: exec $SHELL)',
     });
   }
+  // The state dir is repaired on every write, but chmod is swallowed there —
+  // a filesystem that cannot honour it (FAT, some network mounts) would
+  // otherwise leave everything world-readable with nothing ever saying so.
+  // This is the place that says so, and --fix retries the chmod.
+  const exposed = findExposedStateFiles(stateDir);
+  if (exposed.length) {
+    findings.push({
+      id: 'state-permissions', kind: 'health',
+      title: `${exposed.length} file(s) in ${stateDir} are readable by other users`,
+      detail: exposed.slice(0, 8).map(e => `  ${e.mode} ${e.rel}`).join('\n')
+        + (exposed.length > 8 ? `\n  …and ${exposed.length - 8} more` : '')
+        + '\n  run: unsnooze doctor --fix',
+      fix: { action: 'narrow-state-modes', entries: exposed },
+    });
+  }
+
   let muxOk = false;
   try { muxOk = !!mux.available(); } catch { muxOk = false; }
   if (!muxOk) {
@@ -321,6 +358,11 @@ export async function applyFixes(report, {
       } else {
         actions.push({ action: 'error', detail: 'could not determine a PATH that finds the multiplexer — run `unsnooze install --daemon` from your shell' });
       }
+    } else if (fix.action === 'narrow-state-modes') {
+      const r = narrowStateModes(fix.entries || []);
+      actions.push({ action: 'narrowed-modes', ...r });
+      log(`doctor: narrowed ${r.fixed} state-dir path(s) to owner-only `
+        + `(${r.refused} refused, ${r.ineffective} ignored by the filesystem)`);
     } else if (fix.action === 'archive-dir') {
       let target = `${fix.dir}.bak`;
       if (existsSync(target)) target = `${fix.dir}.bak.${now}`;
@@ -379,6 +421,16 @@ export async function cmdDoctor(rest = [], deps = {}) {
       if (a.action === 'killed') print(`  ✓ stopped csg process ${a.pid}`);
       else if (a.action === 'removed-unit') print(`  ✓ removed ${a.unit}`);
       else if (a.action === 'archived') print(`  ✓ archived ${a.from} → ${a.to}`);
+      else if (a.action === 'narrowed-modes') {
+        if (a.fixed) print(`  ✓ made ${a.fixed} state-dir path(s) owner-only`);
+        // Distinguish "cannot" from "did not": a filesystem with no POSIX
+        // modes reports success and changes nothing, and telling the user to
+        // try again would be advice that can never work.
+        if (a.ineffective) {
+          print(`  · ${a.ineffective} path(s) unchanged — this filesystem does not enforce POSIX permissions`);
+        }
+        if (a.refused) print(`  ✗ ${a.refused} path(s) could not be changed (permission denied)`);
+      }
       else if (a.action === 'error') print(`  ! ${a.detail}`);
     }
     const pkg = legacy.find(f => f.id === 'csg-package');
@@ -386,8 +438,14 @@ export async function cmdDoctor(rest = [], deps = {}) {
     return 0;
   }
 
+  // Offer --fix whenever anything reported is actually machine-fixable, not
+  // only for csg leftovers: a health finding that carries a `fix` (state
+  // permissions) was otherwise a dead end for the reader.
+  const fixable = report.findings.some(f => f.fix);
   print(legacy.length
     ? '\nRun `unsnooze doctor --fix` to stop csg processes, remove its autostart, and archive its state.'
-    : '\nSee the hints above to finish the install.');
+    : fixable
+      ? '\nRun `unsnooze doctor --fix` to apply the repairs above.'
+      : '\nSee the hints above to finish the install.');
   return 1;
 }

package/src/fleet.js

@@ -5,9 +5,9 @@
 // allowlisted host tokens, closed verb set, sentinel-framed JSON, and
 // control-char-stripped ingest.
 import { join } from 'node:path';
-import { readFileSync, writeFileSync, renameSync, mkdirSync, existsSync as fsExistsSync } from 'node:fs';
+import { readFileSync, existsSync as fsExistsSync } from 'node:fs';
 import { spawn, execFileSync, spawnSync } from 'node:child_process';
-import { STATE_DIR } from './config.js';
+import { STATE_DIR, ensureStateDir, writePrivateFile } from './config.js';
 import { colors, shouldUseTui, makeTable, logoBlock, badge } from './tui.js';
 import { ensureAskpassHelper, resolveSecret, readSecret } from './askpass.js';
 import { UNSNOOZE_BIN } from './spawn.js';
@@ -288,10 +288,12 @@ export function readHosts() {
 }
 
 export function writeHosts(hosts) {
-  mkdirSync(STATE_DIR, { recursive: true });
-  const tmp = HOSTS_FILE + `.tmp.${process.pid}`;
-  writeFileSync(tmp, JSON.stringify(hosts, null, 2) + '\n');
-  renameSync(tmp, HOSTS_FILE);
+  ensureStateDir();
+  // Owner-only: a `command` source's --cmd string is whatever the user
+  // pointed at their secret store, and a keychain source names the
+  // service/account to look up.
+  writePrivateFile(HOSTS_FILE, HOSTS_FILE + `.tmp.${process.pid}`,
+    JSON.stringify(hosts, null, 2) + '\n');
 }
 
 function parseFlags(argv) {
@@ -740,10 +742,11 @@ export function readFleetCache() {
 }
 
 export function writeFleetCache(results) {
-  mkdirSync(STATE_DIR, { recursive: true });
-  const tmp = FLEET_CACHE_FILE + `.tmp.${process.pid}`;
-  writeFileSync(tmp, JSON.stringify(results, null, 2) + '\n');
-  renameSync(tmp, FLEET_CACHE_FILE);
+  ensureStateDir();
+  // Owner-only: the cache mirrors every remote host's cwd paths and
+  // queued-prompt previews.
+  writePrivateFile(FLEET_CACHE_FILE, FLEET_CACHE_FILE + `.tmp.${process.pid}`,
+    JSON.stringify(results, null, 2) + '\n');
 }
 
 // I1: a `prompt`-source host at a real interactive TTY is the one case

package/src/hook.js

@@ -89,9 +89,10 @@ export async function runHook(rest = []) {
       // Seconds-scale problem — leave a marker for the pane's monitor, do NOT
       // record in state.json.
       if (pane) {
-        mkdirSync(EVENTS_DIR, { recursive: true });
+        mkdirSync(EVENTS_DIR, { recursive: true, mode: 0o700 });
         writeFileSync(join(EVENTS_DIR, `${addressHash({ mux: muxName, paneOwner, pane })}.json`),
-          JSON.stringify({ mux: muxName, paneOwner, pane, kind, at: Date.now(), payload: { error: payload.error ?? null } }));
+          JSON.stringify({ mux: muxName, paneOwner, pane, kind, at: Date.now(), payload: { error: payload.error ?? null } }),
+          { mode: 0o600 });
       }
       return 0;
     }

package/src/install.js

@@ -16,6 +16,7 @@ import { CLAUDE_SETTINGS, STATE_DIR } from './config.js';
 import { getConfig, configFileExists } from './settings.js';
 import { xmlEscape } from './notify.js';
 import { installGrokHooks, uninstallGrokHooks } from './agents/grok.js';
+import { getAgent } from './agents/index.js';
 import { findCsgProcesses, findCsgAutostarts } from './doctor.js';
 import { UNSNOOZE_BIN, stopResumer } from './spawn.js';
 import { uninstallStatuslineShim } from './usage.js';
@@ -115,18 +116,29 @@ export function removeHookFromSettings(settingsJson) {
 
 // --- zshrc block management ---
 
+// Which shell commands an agent's wrappers shadow. Normally exactly the id,
+// because the id IS the command users type. Cursor breaks that: its id is
+// `cursor` but its command is `cursor-agent`, and the bare `cursor` belongs to
+// the IDE launcher (`cursor .`) which must never be shadowed. An adapter names
+// the commands to wrap via `wrapperNames`; the `_run` argument stays the id.
+export function wrapperNamesFor(id) {
+  const agent = getAgent(id);
+  // getAgent falls back to claude for unknown ids — never borrow its names.
+  return agent.id === id && agent.wrapperNames?.length ? agent.wrapperNames : [id];
+}
+
 export function wrapperBlock(agents = ['claude']) {
   // The missing-file guard is load-bearing: if unsnooze is ever uninstalled,
   // moved, or renamed without cleaning the rc file, the wrapper must degrade
   // to the plain CLI — never brick the user's `claude`/`codex` command.
-  const fns = agents.map(id => `unalias ${id} 2>/dev/null || true
-${id}() {
+  const fns = agents.flatMap(id => wrapperNamesFor(id).map(name => `unalias ${name} 2>/dev/null || true
+${name}() {
   if [ "\${UNSNOOZE_ACTIVE}" = "1" ] || [ ! -f "${UNSNOOZE_BIN}" ]; then
-    command ${id} "$@"
+    command ${name} "$@"
     return $?
   fi
   node "${UNSNOOZE_BIN}" _run ${id} "$@"
-}`).join('\n');
+}`)).join('\n');
   return `${FENCE_OPEN}
 # unsnooze wrappers: route every interactive launch of the CLIs below through
 # unsnooze so limit stops are recorded and auto-resumed.
@@ -142,16 +154,16 @@ ${FENCE_CLOSE}`;
 // PowerShell comments are `#`, so the same fence markers work and
 // stripFencedBlock() removes it unchanged.
 export function powershellWrapperBlock(agents = ['claude'], bin = UNSNOOZE_BIN) {
-  const fns = agents.map(id => `Remove-Item -Path Alias:${id} -Force -ErrorAction SilentlyContinue
-function ${id} {
+  const fns = agents.flatMap(id => wrapperNamesFor(id).map(name => `Remove-Item -Path Alias:${name} -Force -ErrorAction SilentlyContinue
+function ${name} {
   if ($env:UNSNOOZE_ACTIVE -eq '1' -or -not (Test-Path -LiteralPath '${bin}')) {
-    $real = Get-Command ${id} -CommandType Application -ErrorAction SilentlyContinue |
+    $real = Get-Command ${name} -CommandType Application -ErrorAction SilentlyContinue |
       Select-Object -First 1
-    if ($real) { & $real.Source @args } else { Write-Error '${id}: not found' }
+    if ($real) { & $real.Source @args } else { Write-Error '${name}: not found' }
     return
   }
   & node '${bin}' _run ${id} @args
-}`).join('\n');
+}`)).join('\n');
   return `${FENCE_OPEN}
 # unsnooze wrappers: route every interactive launch of the CLIs below through
 # unsnooze so limit stops are recorded and auto-resumed.
@@ -502,7 +514,7 @@ export function uninstallDaemonAutostart({ platform = process.platform, dir = nu
 // --- commands ---
 
 export function enabledAgents() {
-  return ['claude', 'codex', 'grok', 'qwen', 'kimi', 'opencode', 'agy'].filter(id => getConfig(`agents.${id}`));
+  return ['claude', 'codex', 'grok', 'qwen', 'kimi', 'opencode', 'agy', 'cursor'].filter(id => getConfig(`agents.${id}`));
 }
 
 // Qwen keeps Claude-shaped hooks in its own settings.json — reuse the same

package/src/lease.js

@@ -43,10 +43,10 @@ function leasePath(address, leaseId) {
 }
 
 export function writeLease(lease) {
-  mkdirSync(LEASES_DIR, { recursive: true });
+  mkdirSync(LEASES_DIR, { recursive: true, mode: 0o700 });
   const path = leasePath(lease, lease.leaseId);
   const tmp = `${path}.tmp.${process.pid}.${randomUUID()}`;
-  writeFileSync(tmp, JSON.stringify(lease));
+  writeFileSync(tmp, JSON.stringify(lease), { mode: 0o600 });
   renameSync(tmp, path);
   return lease;
 }

package/src/logger.js

@@ -1,6 +1,6 @@
-import { appendFileSync, mkdirSync, statSync, renameSync, copyFileSync, truncateSync } from 'node:fs';
+import { appendFileSync, statSync, renameSync, copyFileSync, truncateSync } from 'node:fs';
 import { dirname } from 'node:path';
-import { LOG_FILE } from './config.js';
+import { LOG_FILE, ensureStateDir } from './config.js';
 
 // Logs must never grow unbounded (a single upgrade-window crash-loop once
 // produced a 10.3 MB daemon.log). One rotated generation is kept: file → .1.
@@ -46,11 +46,13 @@ export function log(component, message) {
   const line = `${new Date().toISOString()} [${component}] ${message}\n`;
   try {
     if (!dirReady) {
-      mkdirSync(dirname(LOG_FILE), { recursive: true });
+      ensureStateDir(dirname(LOG_FILE));
       dirReady = true;
     }
     rotateIfLarge(LOG_FILE);
-    appendFileSync(LOG_FILE, line);
+    // mode applies only when append CREATES the file — an existing log keeps
+    // whatever it has, and the 0700 dir is what covers it either way.
+    appendFileSync(LOG_FILE, line, { mode: 0o600 });
   } catch {
     // Logging must never crash the hook or monitor paths.
   }

package/src/monitor.js

@@ -16,7 +16,7 @@ import {
   EVENT_MARKER_TTL_MS, OVERLOAD_BACKOFF_S, OVERLOAD_JITTER,
   PROBE_INTERVAL_MS, RESET_MARGIN_MS, LEASE_GRACE_MS,
 } from './config.js';
-import { detectLimit, isBusy, overloadMatch } from './patterns.js';
+import { detectLimit, isBusy, overloadMatch, modelRemedy } from './patterns.js';
 import { getAgent } from './agents/index.js';
 import { getConfig } from './settings.js';
 import { notify } from './notify.js';
@@ -208,7 +208,7 @@ export function createMonitor({
     log(`pane ${pane}: limit recorded (${resolved.limitType}, via ${detectedVia}), resets ${new Date(at).toISOString()} (${source})`);
     if (resolved.limitType === 'model') {
       notifier(`${agent.name} hit a model limit — needs you`,
-        `${cwd} — switch models (/model) or add credits (/usage-credits); unsnooze wakes it once the banner clears`,
+        `${cwd} — ${modelRemedy(agent)}; unsnooze wakes it once the banner clears`,
         { context: notifyCtx });
     } else {
       notifier(`${agent.name} hit a usage limit`, `${cwd} — auto-resume at ${new Date(at).toLocaleTimeString()}`, { context: notifyCtx });

package/src/multiplexers/headless.js

@@ -96,9 +96,11 @@ export function createHeadless({
     // A revive is just a detached child. Its output goes to a per-session log
     // because there is no scrollback to read it out of later.
     async newWindow(sessionName, cwd, launchSpec) {
-      mkdirSync(logDir, { recursive: true });
+      // 0700/0600: this log is the entire stdout+stderr of an unattended
+      // agent run — the most revealing thing under the state dir.
+      mkdirSync(logDir, { recursive: true, mode: 0o700 });
       const logPath = join(logDir, `${sessionName}.log`);
-      const fd = openSync(logPath, 'a');
+      const fd = openSync(logPath, 'a', 0o600);
       const child = spawner(launchSpec.file, launchSpec.args || [], {
         cwd,
         detached: true,

package/src/mux-sessions.js

@@ -29,10 +29,10 @@ export function recordOwnedSession({ mux, name }) {
   if (!mux || !name) return null;
   const record = { mux, name, createdAt: Date.now(), pid: process.pid };
   try {
-    mkdirSync(SESSIONS_DIR(), { recursive: true });
+    mkdirSync(SESSIONS_DIR(), { recursive: true, mode: 0o700 });
     const path = recordPath(mux, name);
     const tmp = `${path}.tmp.${process.pid}.${randomUUID()}`;
-    writeFileSync(tmp, JSON.stringify(record));
+    writeFileSync(tmp, JSON.stringify(record), { mode: 0o600 });
     renameSync(tmp, path);
     return record;
   } catch {

package/src/patterns.js

@@ -148,6 +148,13 @@ export function detectLimit(text, tailLines = 12, sets = claudePatterns) {
   return { hit: true, limitType, resetLine };
 }
 
+// What a user can actually do about a model limit. There is no reset time to
+// wait for, so the notification must name a real remedy — and the remedy is
+// per-CLI (claude has /usage-credits, cursor does not).
+export function modelRemedy(agent) {
+  return agent?.modelRemedy || 'switch models or add credits';
+}
+
 function tail(text, n = 12) {
   return contentLines(text, n);
 }

package/src/resumer.js

@@ -4,17 +4,17 @@
 // fires on the next tick), then re-opens/continues every due session.
 // Exits when no non-terminal records remain; the next limit event respawns it.
 
-import { writeFileSync, readFileSync, unlinkSync, mkdirSync } from 'node:fs';
+import { writeFileSync, readFileSync, unlinkSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { spawnSync } from 'node:child_process';
 import { getMultiplexer, backendCanType } from './multiplexer.js';
 import {
-  RESUMER_LOCK, STATE_DIR, POLL_INTERVAL_MS, STAGGER_MS, VERIFY_DELAY_MS,
+  RESUMER_LOCK, POLL_INTERVAL_MS, STAGGER_MS, VERIFY_DELAY_MS, ensureStateDir,
   BUSY_DEFER_MS, MAX_BUSY_DEFERS, MAX_RESUME_ATTEMPTS, READY_TIMEOUT_MS,
   CAPTURE_LINES, PANE_SCAN_LINES, RESUME_SESSION_NAME,
   RESET_MARGIN_MS, FALLBACK_RESET_MS, PROBE_INTERVAL_MS, PROBE_MAX_MS,
 } from './config.js';
-import { detectLimit, isBusy } from './patterns.js';
+import { detectLimit, isBusy, modelRemedy } from './patterns.js';
 import { getAgent } from './agents/index.js';
 import { parseResetTime, resetAtMs, nextProbeDelayMs } from './time-parser.js';
 import {
@@ -64,10 +64,10 @@ function defaultIsResumer(pid) {
 // read-check-write window. A held lock is honored only when its pid is alive
 // AND looks like a resumer; stale/garbage/recycled locks are replaced.
 export function acquireSingleton({ isResumer = defaultIsResumer } = {}) {
-  mkdirSync(STATE_DIR, { recursive: true });
+  ensureStateDir();
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
-      writeFileSync(RESUMER_LOCK, String(process.pid), { flag: 'wx' });
+      writeFileSync(RESUMER_LOCK, String(process.pid), { flag: 'wx', mode: 0o600 });
       return true;
     } catch { /* lock exists — inspect the holder below */ }
     let pid = NaN;
@@ -372,7 +372,7 @@ function rescheduleProbe(rec, now = Date.now()) {
       }, { expect: ['stopped'] });
       log(`${key}: model limit still active at probe ceiling — needs a human`);
       notify('unsnooze: model limit needs you ⚠️',
-        `${rec.cwd}: still limited after probing — /model to switch or /usage-credits`,
+        `${rec.cwd}: still limited after probing — ${modelRemedy(getAgent(rec.agent))}`,
         { context: ctxOf(rec), priority: 4 });
       return 'held';
     }

package/src/sessions.js

@@ -40,8 +40,26 @@ export function latestSessionId(cwd, aroundTs = null) {
   return best ? best.id : null;
 }
 
+// sessionId lands here straight off a hook payload / transcript record and is
+// used as a path component — the same untrusted-value-as-filename shape the
+// statusline shim had, on the channel everyone has enabled. dashCwd already
+// sanitizes the cwd half; a '/' or a '..' in the id half would walk this read
+// out of the projects tree.
+//
+// Deliberately a filename-shape check rather than UUID_RE: that regex is the
+// right gate for *discovering* transcripts (it reads Claude's own directory
+// listing) but the wrong one here, where the id arrives from an agent whose
+// naming we do not own. Requiring a uuid would silently turn off the context
+// guard for any session named otherwise; requiring a safe component closes
+// the traversal either way. '.' and '..' are harmless: the '.jsonl' suffix
+// makes them ordinary filenames. Returns null for anything else, which every
+// caller already reports as "no transcript".
+const SAFE_SESSION_ID_RE = /^[A-Za-z0-9._-]{1,128}$/;
+
 export function transcriptPath(cwd, sessionId, { claudeDir = CLAUDE_DIR } = {}) {
-  return join(claudeDir, 'projects', dashCwd(cwd), `${sessionId}.jsonl`);
+  const id = String(sessionId ?? '');
+  if (!SAFE_SESSION_ID_RE.test(id)) return null;
+  return join(claudeDir, 'projects', dashCwd(cwd), `${id}.jsonl`);
 }
 
 export function claudeRecordEnv(env = process.env) {