pub(crate) fn capture_window_dir() -> Result<PathBuf, String>Expand description
Where CaptureWindow writes its PNGs: <AgentMux root>/tmp/capture-window,
not the shared OS temp dir — reagent P2 on this tool’s own PR (#2709
round 1): std::env::temp_dir() is world-readable on a multi-user host,
and CaptureWindow can capture arbitrary OS windows (not just AgentMux’s own
pane), so a captured image could leak to other local users.
The root comes from agentmux_common::data_paths::agentmux_root(), the one
resolver srv uses too (#3372). This used to be a private copy that read only
AGENTMUX_DATA_HOME and fell back to / with no home dir; it now honours
AGENTMUX_HOME_OVERRIDE first and errors instead.