fix: move unix socket from /tmp/ to ~/.wake/sockets/

README.md

@@ -145,7 +145,7 @@ cargo build --release --features metal  # Apple Silicon
 │                                                                     │
 │  ┌───────────┐       ┌─────────────┐      ┌──────────────────────┐  │
 │  │   Your    │  pty  │    Shell    │ hook │    Unix Socket       │  │
-│  │  Terminal │◄─────►│  (zsh/bash) │─────►│  /tmp/wake-*.sock    │  │
+│  │  Terminal │◄─────►│  (zsh/bash) │─────►│  ~/.wake/sockets/*   │  │
 │  └───────────┘       └─────────────┘      └──────────┬───────────┘  │
 │        │                   │                         │              │
 │        │                   │ stdout                  │ cmd events   │

crates/wake-cli/Cargo.toml

@@ -24,6 +24,7 @@ chrono.workspace = true
 signal-hook.workspace = true
 signal-hook-tokio.workspace = true
 anyhow.workspace = true
+dirs.workspace = true
 term_size.workspace = true
 libc.workspace = true
 

crates/wake-cli/src/commands/shell.rs

@@ -33,7 +33,15 @@ struct SessionState {
 
 pub async fn run() -> Result<()> {
     let session_id = uuid::Uuid::new_v4().to_string();
-    let socket_path = format!("/tmp/wake-{session_id}.sock");
+
+    // Use ~/.wake/sockets/ instead of /tmp/ to avoid world-writable directory risks
+    let socket_dir = dirs::home_dir()
+        .context("Could not determine home directory")?
+        .join(".wake")
+        .join("sockets");
+    std::fs::create_dir_all(&socket_dir).context("Failed to create socket directory")?;
+    let socket_path = socket_dir.join(format!("wake-{session_id}.sock"));
+    let socket_path = socket_path.to_string_lossy().to_string();
 
     // Clean up any stale socket
     let _ = std::fs::remove_file(&socket_path);