Fixes issue 3mwixathb2o2a (https://tangled.org/permadeath.com/didbot-claude/issues). The hook connected to whatever listened at the socket path. On a shared host without XDG_RUNTIME_DIR, another user could pre-create /tmp/didbot-agent/, read every report, and answer with text the model reads.
Before connecting, the hook now lstats the socket's directory and requires a real directory, not a symlink, owned by this user, with no group or other bits. The socket itself must be a socket owned by this user. After connecting on Linux, it checks the listener's uid with SO_PEERCRED. A refusal sends nothing and is written to hook-errors.log. No socket at all stays silent. New tests cover an open directory mode, a symlinked directory and a symlinked socket.
🤖 Generated with Claude Code