{"version":"2.1.248","anchor":"clearer-refusals-when-the-socket-directory-is-unsafe-plus-co","canonical_anchor":"clearer-refusals-when-the-socket-directory-is-unsafe-plus-co","heading":"Clearer refusals when the socket directory is unsafe, plus container uid detection","tier":"notice","area":"Cross-Session Messaging","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.248\/e\/clearer-refusals-when-the-socket-directory-is-unsafe-plus-co","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.248","markdown":"### Clearer refusals when the socket directory is unsafe, plus container uid detection\n\nUnsafe socket directories now name the owner, group and mode, and containers are detected.\n\n**What**\n\nThe check that vets the directory Claude Code uses for its local Unix sockets was reworked. Refusals now name the offending directory with its owner, group and mode and tell you how to fix it, and a container or sandbox where your uid is unmapped is now detected and refused explicitly instead of failing obscurely.\n\n**Details**\n\n- New `uid_collapse` refusal fires when running in a user namespace with no uid mapping, detected because your own uid reads back as the kernel overflow uid. The message suggests starting with a uid map, e.g. `unshare -Ur`.\n- Symlinked path components are resolved so real ownership is checked.\n- A world-writable directory without the sticky bit suggests `chmod o-w`.\n- Alternatives offered in every refusal: set `XDG_RUNTIME_DIR` or `CLAUDE_CODE_TMPDIR`, or pass `--messaging-socket-path`.\n\n**Evidence**\n\n`start it with a uid map (e.g. unshare -Ur), or pass --messaging-socket-path`\n\n- Area: Cross-Session Messaging\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 2\/5"}