Summary

Publishing a bare static directory writes .spacefast/state.json and .spacefast/space.json into the directory's parent instead of the directory being published.

Sibling directories then inherit the same linked Space and anonymous credential. This can make a publish from one sibling update another project's Space.

Reproduction

Environment:

• spacefast/0.5.0 darwin-arm64 node-v22.23.1
• npm 10.9.8
• macOS 27.0 (26A428)

Start with no .spacefast directory in the test tree or its parents:

/tmp/sf-state-check/
└── project/
    └── index.html

From project/:

sf publish . --prebuilt --json
sf status --json

Actual behavior

sf status --json reports:

{
  "statePath": "/private/tmp/sf-state-check/.spacefast/state.json",
  "linkPath": "/private/tmp/sf-state-check/.spacefast/space.json"
}

The publishing directory is /private/tmp/sf-state-check/project.

Creating /private/tmp/sf-state-check/sibling, changing into it, and running sf status --json resolves the same linked anonymous Space from the parent .spacefast directory.

I reproduced the parent-directory write twice with fresh static directories after moving every pre-existing parent .spacefast directory out of the search path.

Expected behavior

The state and link files should be written under the directory being published:

/private/tmp/sf-state-check/project/.spacefast/state.json
/private/tmp/sf-state-check/project/.spacefast/space.json

This matches the docs: “The CLI caches it in .spacefast/state.json in the directory you published from.”

Relevant docs:

• https://spacefast.com/docs/anonymous-and-claim#publish-with-no-login
• https://spacefast.com/docs/cli/project

No claim keys, access URLs, or real Space IDs are included here.