Drop project-marker requirement on launch

cwdGuard required cwd to contain one of .git, package.json,
composer.json, Cargo.toml, or pyproject.toml. The check was
paternalistic, not load-bearing: nothing else in the codebase consumes
PROJECT_MARKERS, and the real safety guards (refusing ~, /, /root, and
inside ~/.mdredd/) were already separate.

The sandbox builder mirrors via cheap symlinks and applies gitignore
filtering at every level, so launching from a non-project directory is
slow at worst (a flat dump with no .gitignore would walk every file)
but never unsafe. Remove the marker check, the anyExists helper, and
the PROJECT_MARKERS constant.

Author: slaFFik

CLAUDE.md

@@ -36,7 +36,7 @@ npm run test:slug         # tsx test/slug.spec.ts
 
 - `CLAUDE_BIN` — path to the `claude` binary. Defaults to `claude` (resolved via PATH). Point this at `test/fake-claude.mjs` to drive the runner deterministically without spending tokens.
 - `MDREDD_LOG_LEVEL` — `debug` | `info` (default) | `warn` | `error`. Server-only; logs go to stdout (info/debug) or stderr (warn/error).
-- `bin/mdredd.js` takes no flags. The cwd must contain a project marker (`.git`, `package.json`, etc. — see `PROJECT_MARKERS`); the browser opens automatically on first launch and is suppressed on tsx-watch hot restarts via `~/.mdredd/.dev-open-marker`.
+- `bin/mdredd.js` takes no flags. mdredd runs from any cwd except `~`, `/`, `/root`, or inside `~/.mdredd/`. The browser opens automatically on first launch and is suppressed on tsx-watch hot restarts via `~/.mdredd/.dev-open-marker`.
 
 Tests are plain tsx scripts, not a framework. Each file declares scenarios via a local `scenario(name, fn)` helper and exits non-zero on failure. To run a single scenario, edit the file's queue or comment out the others — there's no `--grep`. Most server tests use `test/fake-claude.mjs` (a stand-in for the real `claude` CLI) selected via `FAKE_CLAUDE_SCENARIO` env vars.
 

src/server/preflight.ts

@@ -4,12 +4,7 @@ import { createHash } from 'node:crypto';
 import { homedir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { pathExists, atomicWriteFile, ensureDir, readJsonIfExists } from './fsUtil.js';
-import {
-  PROJECT_INFO_FILE,
-  PROJECT_MARKERS,
-  PROJECTS_DIR_NAME,
-  STORAGE_DIR_NAME,
-} from '@shared/constants.js';
+import { PROJECT_INFO_FILE, PROJECTS_DIR_NAME, STORAGE_DIR_NAME } from '@shared/constants.js';
 import { readdir, readFile, rm, stat, unlink, writeFile } from 'node:fs/promises';
 import lockfile from 'proper-lockfile';
 import { log } from './log.js';
@@ -158,22 +153,6 @@ async function cwdGuard(cwd: string, storageRoot: string): Promise<void> {
       'cd into the project root and try again.',
     );
   }
-
-  const hasMarker = await anyExists(PROJECT_MARKERS.map((m) => join(cwd, m)));
-  if (!hasMarker) {
-    throw new PreflightError(
-      'cwd-no-marker',
-      `No project marker (${PROJECT_MARKERS.join(', ')}) found at ${cwd}.`,
-      'Run mdredd from a project root.',
-    );
-  }
-}
-
-async function anyExists(paths: string[]): Promise<boolean> {
-  for (const p of paths) {
-    if (await pathExists(p)) return true;
-  }
-  return false;
 }
 
 async function ensureAutoGitignore(storageRoot: string): Promise<void> {

src/shared/constants.ts

@@ -17,14 +17,6 @@ export const HEARTBEAT_INTERVAL_MS = 15_000;
 export const READ_ONLY_TOOLS = ['Read', 'Glob', 'Grep', 'WebSearch', 'WebFetch'];
 export const WRITE_TOOLS = [...READ_ONLY_TOOLS, 'Write', 'Edit'];
 
-export const PROJECT_MARKERS = [
-  '.git',
-  'package.json',
-  'composer.json',
-  'Cargo.toml',
-  'pyproject.toml',
-];
-
 // Pin to a concrete model ID, not the `haiku` CLI alias: aliases can be
 // repointed to a future generation or removed, which would silently shift
 // score baselines or break the judge entirely (issue #13). Bump manually