Keep the remote daemon's Claude restore preload out of TMPDIR

CLI/cmux.swift

@@ -23616,18 +23616,29 @@ struct CMUXCLI {
     /// whole session, so it lives in ~/.cmuxterm with the other CLI shims rather
     /// than in $TMPDIR, which macOS purges under long-lived sessions (#12022).
     private func createClaudeNodeOptionsRestoreModule() throws -> URL {
-        let homePath = ProcessInfo.processInfo.environment["HOME"] ?? NSHomeDirectory()
+        // Match the wrapper: refuse a relative HOME and symlinked paths.
+        let environmentHome = ProcessInfo.processInfo.environment["HOME"] ?? ""
+        let homePath = environmentHome.hasPrefix("/") ? environmentHome : NSHomeDirectory()
+        guard homePath.hasPrefix("/") else {
+            throw CLIError(message: "Claude NODE_OPTIONS restore module needs an absolute HOME")
+        }
         let root = URL(fileURLWithPath: homePath, isDirectory: true)
             .appendingPathComponent(".cmuxterm", isDirectory: true)
             .appendingPathComponent("cmux-claude-node-options", isDirectory: true)
+        let restoreModuleURL = root.appendingPathComponent("restore-node-options.cjs", isDirectory: false)
         let fileManager = FileManager.default
+        for url in [root, restoreModuleURL] {
+            if let type = try? fileManager.attributesOfItem(atPath: url.path)[.type] as? FileAttributeType,
+               type == .typeSymbolicLink {
+                throw CLIError(message: "Refusing symlinked Claude NODE_OPTIONS restore path: \(url.path)")
+            }
+        }
         try fileManager.createDirectory(
             at: root,
             withIntermediateDirectories: true,
             attributes: [.posixPermissions: 0o700]
         )
         try fileManager.setAttributes([.posixPermissions: 0o700], ofItemAtPath: root.path)
-        let restoreModuleURL = root.appendingPathComponent("restore-node-options.cjs", isDirectory: false)
         try writeShimIfChanged(Self.claudeNodeOptionsRestoreModule, to: restoreModuleURL)
         return restoreModuleURL
     }

daemon/remote/cmd/cmuxd-remote/agent_launch.go

@@ -2,7 +2,6 @@ package main
 
 import (
 	"encoding/json"
-	"errors"
 	"fmt"
 	"os"
 	"os/exec"
@@ -19,12 +18,6 @@ if (hadOriginalNodeOptions) {
 }
 delete process.env.CMUX_ORIGINAL_NODE_OPTIONS;
 delete process.env.CMUX_ORIGINAL_NODE_OPTIONS_PRESENT;
-try {
-  const fs = require("node:fs");
-  const path = require("node:path");
-  fs.unlinkSync(__filename);
-  fs.rmdirSync(path.dirname(__filename));
-} catch {}
 `
 
 // runClaudeTeamsRelay implements `cmux claude-teams` on the remote side.
@@ -355,16 +348,32 @@ func closeTempFileAfterError(file *os.File, primary error) error {
 }
 
 func ensureClaudeNodeOptionsRestoreModule() (string, error) {
-	// A predictable shared /tmp directory would let another same-UID process
-	// tamper with the module before Node loads it. Retain this randomized,
-	// private directory through the returned path for the launch lifetime.
-	dir, err := os.MkdirTemp(os.TempDir(), "cmux-claude-node-options-")
+	// The preload must outlive the Claude session: every Node child loads it
+	// via NODE_OPTIONS, and the OS purges temp directories under long-lived
+	// sessions (https://github.com/manaflow-ai/cmux/issues/12022). Keep it in
+	// ~/.cmuxterm like the macOS wrapper, private and never through a symlink.
+	home, err := os.UserHomeDir()
 	if err != nil {
 		return "", err
 	}
+	if !filepath.IsAbs(home) {
+		return "", fmt.Errorf("home directory %q is not absolute", home)
+	}
+	dir := filepath.Join(home, ".cmuxterm", "cmux-claude-node-options")
 	restoreModulePath := filepath.Join(dir, "restore-node-options.cjs")
+	for _, path := range []string{dir, restoreModulePath} {
+		if info, err := os.Lstat(path); err == nil && info.Mode()&os.ModeSymlink != 0 {
+			return "", fmt.Errorf("refusing symlinked Node options restore path %q", path)
+		}
+	}
+	if err := os.MkdirAll(dir, 0700); err != nil {
+		return "", err
+	}
+	if err := os.Chmod(dir, 0700); err != nil {
+		return "", err
+	}
 	if err := writeShimIfChanged(restoreModulePath, claudeNodeOptionsRestoreModuleScript); err != nil {
-		return "", fmt.Errorf("create Node options restore module: %w", errors.Join(err, os.RemoveAll(dir)))
+		return "", fmt.Errorf("create Node options restore module: %w", err)
 	}
 	return restoreModulePath, nil
 }
@@ -383,6 +392,10 @@ func configureClaudeNodeOptions(restoreModulePath string) {
 
 func mergeNodeOptions(existing string, restoreModulePath string) string {
 	requireFlag := "--require=" + restoreModulePath
+	// NODE_OPTIONS splits on whitespace; quote the path when HOME has spaces.
+	if strings.ContainsAny(restoreModulePath, " \t\n") {
+		requireFlag = `--require="` + restoreModulePath + `"`
+	}
 	const memoryFlag = "--max-old-space-size=4096"
 	cleaned := cleanedNodeOptions(existing)
 	if cleaned == "" {

daemon/remote/cmd/cmuxd-remote/agent_launch_temp_test.go

@@ -3,32 +3,71 @@ package main
 import (
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 )
 
-func TestEnsureClaudeNodeOptionsRestoreModuleUsesPrivateRandomDirectory(t *testing.T) {
-	first, err := ensureClaudeNodeOptionsRestoreModule()
+func TestEnsureClaudeNodeOptionsRestoreModuleLivesInPrivateHomeDirectory(t *testing.T) {
+	home := filepath.Join(t.TempDir(), "home with space")
+	t.Setenv("HOME", home)
+	t.Setenv("TMPDIR", t.TempDir())
+
+	path, err := ensureClaudeNodeOptionsRestoreModule()
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := filepath.Join(home, ".cmuxterm", "cmux-claude-node-options", "restore-node-options.cjs")
+	if path != want {
+		t.Fatalf("restore module path = %q, want %q", path, want)
+	}
+	info, err := os.Stat(filepath.Dir(path))
 	if err != nil {
 		t.Fatal(err)
 	}
-	second, err := ensureClaudeNodeOptionsRestoreModule()
+	if mode := info.Mode().Perm(); mode != 0700 {
+		t.Fatalf("directory mode = %o, want 700", mode)
+	}
+	content, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(content) != claudeNodeOptionsRestoreModuleScript {
+		t.Fatalf("restore module content mismatch")
+	}
+	// Concurrent launches share this file, so loading it must not delete it.
+	if strings.Contains(claudeNodeOptionsRestoreModuleScript, "unlinkSync") ||
+		strings.Contains(claudeNodeOptionsRestoreModuleScript, "rmdirSync") {
+		t.Fatalf("restore module deletes itself; a concurrent launch would lose it")
+	}
+
+	// Reuse is stable across launches, so a purged TMPDIR cannot strand it.
+	again, err := ensureClaudeNodeOptionsRestoreModule()
 	if err != nil {
 		t.Fatal(err)
 	}
-	for _, path := range []string{first, second} {
-		t.Cleanup(func() { _ = os.RemoveAll(filepath.Dir(path)) })
-		if filepath.Dir(first) == filepath.Dir(second) {
-			t.Fatalf("restore module directories are not randomized: %q", filepath.Dir(first))
-		}
-		info, err := os.Stat(filepath.Dir(path))
-		if err != nil {
-			t.Fatal(err)
-		}
-		if mode := info.Mode().Perm(); mode != 0700 {
-			t.Fatalf("directory mode = %o, want 700", mode)
-		}
-		if _, err := os.Stat(path); err != nil {
-			t.Fatal(err)
-		}
+	if again != path {
+		t.Fatalf("second restore module path = %q, want %q", again, path)
+	}
+
+	if got, want := mergeNodeOptions("", path), `--require="`+path+`" --max-old-space-size=4096`; got != want {
+		t.Fatalf("mergeNodeOptions with spaced path = %q, want %q", got, want)
+	}
+}
+
+func TestEnsureClaudeNodeOptionsRestoreModuleRefusesSymlinkedDirectory(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	target := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(home, ".cmuxterm"), 0700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(target, filepath.Join(home, ".cmuxterm", "cmux-claude-node-options")); err != nil {
+		t.Fatal(err)
+	}
+	if path, err := ensureClaudeNodeOptionsRestoreModule(); err == nil {
+		t.Fatalf("expected symlinked directory to be refused, got %q", path)
+	}
+	if _, err := os.Stat(filepath.Join(target, "restore-node-options.cjs")); !os.IsNotExist(err) {
+		t.Fatalf("restore module was written through the symlink: %v", err)
 	}
 }