From 3a4a46fc181a71eddbebc4d96ee0c453580b78b7 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 30 Sep 2026 15:51:00 +0100
Subject: [PATCH 1/3] fix(launcher): stop project-wharf-launcher.sh writing
 pid/log to /tmp

A predictable /tmp path (/tmp/project-wharf.pid) lets another local
user on the same host pre-create that file and choose which process
`stop` subsequently kills (CWE-377 class). Move PID_FILE and LOG_FILE
to per-user XDG state, matching launch-scaffolder main's generator
template (standards/launcher-standard_praxis.deed :pid-file-pattern /
:log-file-pattern):

  PID: ${XDG_RUNTIME_DIR:-${XDG_STATE_HOME:-$HOME/.local/state}}/launch-scaffolder/project-wharf/server.pid
  LOG: ${XDG_STATE_HOME:-$HOME/.local/state}/launch-scaffolder/project-wharf/server.log

Parent directories are created 0700 before first use. All existing
$PID_FILE/$LOG_FILE expansions in the file were already double-quoted,
so no follow-on quoting fix was needed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK
---
 project-wharf-launcher.sh | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/project-wharf-launcher.sh b/project-wharf-launcher.sh
index 2869e87..5e34748 100755
--- a/project-wharf-launcher.sh
+++ b/project-wharf-launcher.sh
@@ -5,8 +5,17 @@
 set -euo pipefail
 
 REPO_DIR="/var/mnt/eclipse/repos/project-wharf"
-PID_FILE="/tmp/project-wharf.pid"
-LOG_FILE="/tmp/project-wharf.log"
+# Per-user XDG state, not /tmp: a world-writable /tmp path with a predictable
+# name lets another local user pre-create the pid file and choose which
+# process `stop` kills (CWE-377). Matches launch-scaffolder main's generator
+# (standards/launcher-standard_praxis.deed :pid-file-pattern/:log-file-pattern).
+PID_FILE="${XDG_RUNTIME_DIR:-${XDG_STATE_HOME:-$HOME/.local/state}}/launch-scaffolder/project-wharf/server.pid"
+LOG_FILE="${XDG_STATE_HOME:-$HOME/.local/state}/launch-scaffolder/project-wharf/server.log"
+for _d in "$(dirname "$PID_FILE")" "$(dirname "$LOG_FILE")"; do
+  mkdir -p "$_d"
+  chmod 0700 "$_d"
+done
+unset _d
 MODE="${1:---auto}"
 
 log() {

From f060297fc346dc4561b5737687186c7323f7ab30 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 30 Sep 2026 17:10:14 +0100
Subject: [PATCH 2/3] Update project-wharf-launcher.sh

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
 project-wharf-launcher.sh | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/project-wharf-launcher.sh b/project-wharf-launcher.sh
index 5e34748..bce1218 100755
--- a/project-wharf-launcher.sh
+++ b/project-wharf-launcher.sh
@@ -9,8 +9,21 @@ REPO_DIR="/var/mnt/eclipse/repos/project-wharf"
 # name lets another local user pre-create the pid file and choose which
 # process `stop` kills (CWE-377). Matches launch-scaffolder main's generator
 # (standards/launcher-standard_praxis.deed :pid-file-pattern/:log-file-pattern).
-PID_FILE="${XDG_RUNTIME_DIR:-${XDG_STATE_HOME:-$HOME/.local/state}}/launch-scaffolder/project-wharf/server.pid"
-LOG_FILE="${XDG_STATE_HOME:-$HOME/.local/state}/launch-scaffolder/project-wharf/server.log"
+case "${XDG_RUNTIME_DIR:-}" in
+  /*) _pid_root=$XDG_RUNTIME_DIR ;;
+  *)
+    case "${XDG_STATE_HOME:-}" in
+      /*) _pid_root=$XDG_STATE_HOME ;;
+      *) _pid_root=$HOME/.local/state ;;
+    esac
+    ;;
+esac
+case "${XDG_STATE_HOME:-}" in
+  /*) _state_root=$XDG_STATE_HOME ;;
+  *) _state_root=$HOME/.local/state ;;
+esac
+PID_FILE="${_pid_root}/launch-scaffolder/project-wharf/server.pid"
+LOG_FILE="${_state_root}/launch-scaffolder/project-wharf/server.log"
 for _d in "$(dirname "$PID_FILE")" "$(dirname "$LOG_FILE")"; do
   mkdir -p "$_d"
   chmod 0700 "$_d"

From b3df57ea78d203b497eed3c3c73ed915afb748ef Mon Sep 17 00:00:00 2001
From: "coderabbitai[bot]"
 <136622811+coderabbitai[bot]@users.noreply.github.com>
Date: Wed, 30 Sep 2026 16:14:12 +0000
Subject: [PATCH 3/3] docs(launcher): document log function output and argument

---
 project-wharf-launcher.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/project-wharf-launcher.sh b/project-wharf-launcher.sh
index bce1218..7bfd279 100755
--- a/project-wharf-launcher.sh
+++ b/project-wharf-launcher.sh
@@ -31,6 +31,9 @@ done
 unset _d
 MODE="${1:---auto}"
 
+# Write a launcher message to standard output with the [ProjectWharf] prefix.
+# Arguments:
+#   $1: Message to print.
 log() {
   echo "[ProjectWharf] $1"
 }