didbot oauth connected to whatever listened at the socket path and sent it the approval token. It did no owner, mode or peer check, read with no timeout, and printed the listener's trouble and done sentences raw into the agent's transcript, newlines included. The CLI now applies the hook's checks before it sends anything. The directory must be a real directory owned by this user and closed to everyone else, the socket must be a socket this user owns, and SO_PEERCRED must report the listener running as this user. A socket that fails these checks no longer wins over a configured direct mode. The CLI waits five minutes at most for an answer. It prints the daemon's sentences through printable, so they stay on one line, and a reply that doesn't parse is refused without being repeated.
The new tests reproduce the audit. A fake listener in a 0777 directory is handed nothing, and the token least of all. A trusted listener whose trouble or done holds a second line is printed on one line. Unit tests cover a symlinked directory and a listener that never answers. The two binary tests fail on main. rustix (already in the lock graph) is now a direct dependency, because std's peer_cred is unstable. cargo deny fails on main for an unrelated tokio advisory (RUSTSEC-2026-0386), so that hook was skipped, but bans, licenses and sources pass. It needs no deploy window: it ships in the next didbot release and changes nothing on the server.
Closes https://tangled.org/permadeath.com/didbot/issues/240
🤖 Generated with Claude Code