From 741f0de14809de1286426d1285f69f156509424c Mon Sep 17 00:00:00 2001
From: Taksh <takshkothari09@gmail.com>
Date: Sun, 6 Sep 2026 22:19:47 +0530
Subject: [PATCH] Keep monitor-watch flock files out of world-writable /tmp

---
 bin/omarchy-hyprland-monitor-watch    |  6 ++++--
 test/shell.d/monitor-recovery-test.sh | 10 ++++++++++
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/bin/omarchy-hyprland-monitor-watch b/bin/omarchy-hyprland-monitor-watch
index 33e8f2c5999..871dc115b82 100755
--- a/bin/omarchy-hyprland-monitor-watch
+++ b/bin/omarchy-hyprland-monitor-watch
@@ -3,8 +3,10 @@
 # omarchy:summary=Watch Hyprland monitor events and recover monitor toggles when a monitor is removed
 
 SOCKET="$XDG_RUNTIME_DIR/hypr/$HYPRLAND_INSTANCE_SIGNATURE/.socket2.sock"
-LOCK="${XDG_RUNTIME_DIR:-/tmp}/omarchy-monitor-clamshell.lock"
-MODELESS_LOCK="${XDG_RUNTIME_DIR:-/tmp}/omarchy-monitor-modeless.lock"
+LOCK_DIR="${XDG_RUNTIME_DIR:-/tmp/omarchy-$UID}"
+mkdir -m 700 -p "$LOCK_DIR"
+LOCK="$LOCK_DIR/omarchy-monitor-clamshell.lock"
+MODELESS_LOCK="$LOCK_DIR/omarchy-monitor-modeless.lock"
 
 sync_clamshell() {
   (
diff --git a/test/shell.d/monitor-recovery-test.sh b/test/shell.d/monitor-recovery-test.sh
index 3401abc18da..ae6f386f937 100755
--- a/test/shell.d/monitor-recovery-test.sh
+++ b/test/shell.d/monitor-recovery-test.sh
@@ -23,6 +23,16 @@ grep -F 'flock -n 9' "$monitor_watch" >/dev/null
 grep -F 'omarchy-hyprland-monitor-clamshell' "$monitor_watch" >/dev/null
 pass "monitor watcher retries internal monitor recovery after removal"
 
+if grep -Fq '${XDG_RUNTIME_DIR:-/tmp}/omarchy-monitor-clamshell.lock' "$monitor_watch" ||
+  grep -Fq '${XDG_RUNTIME_DIR:-/tmp}/omarchy-monitor-modeless.lock' "$monitor_watch"; then
+  fail "monitor watcher flock files must not fall back to world-writable /tmp"
+fi
+grep -Fq '${XDG_RUNTIME_DIR:-/tmp/omarchy-$UID}' "$monitor_watch" ||
+  fail "monitor watcher flock falls back to a 0700 /tmp/omarchy-\$UID directory"
+grep -Fq 'mkdir -m 700 -p "$LOCK_DIR"' "$monitor_watch" ||
+  fail "monitor watcher creates the flock directory with mode 0700"
+pass "monitor watcher flock files are not in world-writable /tmp"
+
 grep -F 'monitoradded\>\>*|monitoraddedv2\>\>*)' "$monitor_watch" >/dev/null
 grep -F 'omarchy-hyprland-monitor-clamshell' "$monitor_watch" >/dev/null
 pass "monitor watcher disables the internal monitor after closed-lid external hotplug"