What
Before creating the local socket directory that lets sessions talk to each other, Claude Code now inspects every component of that path and refuses to bind if it looks unsafe. When it refuses, cross-session messaging is simply off for that session rather than binding anyway, and you get a specific remediation hint.
Details
- Rejected: symlinks owned by another user, path components that are not directories, world- or group-writable directories without the sticky bit, symlink chains deeper than 16 levels, and dangling links.
- Each refusal is classified (
directory_rule,foreign_owner,leaf_shape,raced,symlink_loop, and others) and the session records the causesocket_dir_refusedand logs at error level. - The directory is created with mode 0700 and chmod'ed back to 0700 if found otherwise.
- The suggested fix is to point
XDG_RUNTIME_DIRorCLAUDE_CODE_TMPDIRat a private directory you own.
Evidence
Point XDG_RUNTIME_DIR or CLAUDE_CODE_TMPDIR at a private (0700) directory you own to use a different location.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.