@bondsmith/bondsmithd 0.1.0

package/dist/index.js

@@ -0,0 +1,2840 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { createServer } from "http";
+import { existsSync } from "fs";
+import { hostname as hostname2 } from "os";
+import { dirname as dirname4, join as join5 } from "path";
+import { fileURLToPath } from "url";
+
+// ../../packages/local-agent-protocol/src/session.ts
+var SESSION_STATUSES = ["running", "exited"];
+
+// ../../packages/local-agent-protocol/src/schemas.ts
+import { z as z2 } from "zod";
+
+// ../../packages/local-agent-protocol/src/connection-challenge.ts
+import { z } from "zod";
+var CONNECTION_CHALLENGE_PURPOSE = "bondsmith.connection-handshake";
+var connectionChallengeTranscriptSchema = z.object({
+  version: z.literal(1),
+  purpose: z.literal(CONNECTION_CHALLENGE_PURPOSE),
+  // Generated by the daemon per-socket, at connection time — never
+  // client-supplied, never reused across connections or reconnects.
+  connectionId: z.string().min(1),
+  // Fresh, cryptographically random, single-use — a second handshake
+  // attempt (even with a validly-signed transcript for the same
+  // connectionId) is rejected by the daemon outright.
+  challenge: z.string().min(1),
+  daemonFingerprint: z.string().min(1),
+  controllerId: z.string().min(1),
+  // An assertion the browser makes, not independent account
+  // authentication — the daemon has no account-token layer to verify this
+  // against (unchanged from ADR-012's existing caveat on CommandEnvelope's
+  // own accountId field).
+  accountId: z.number().int().positive()
+});
+var signedConnectionChallengeSchema = z.object({
+  transcript: connectionChallengeTranscriptSchema,
+  signature: z.string().min(1)
+});
+
+// ../../packages/local-agent-protocol/src/schemas.ts
+var MAX_INSERT_TEXT_BYTES = 32 * 1024;
+var localSessionSchema = z2.object({
+  id: z2.string(),
+  title: z2.string(),
+  command: z2.string(),
+  cwd: z2.string(),
+  tmuxSessionName: z2.string(),
+  status: z2.enum(SESSION_STATUSES),
+  startedAt: z2.string(),
+  branch: z2.string().nullable(),
+  repositoryFullName: z2.string().nullable(),
+  lastActivityAt: z2.string().nullable(),
+  changedFileCount: z2.number().int().nonnegative().nullable()
+});
+var workspaceFileEntrySchema = z2.object({
+  path: z2.string(),
+  previousPath: z2.string().optional(),
+  status: z2.enum(["added", "modified", "deleted", "renamed", "copied", "untracked"]),
+  staged: z2.boolean(),
+  additions: z2.number().int().nonnegative().nullable(),
+  deletions: z2.number().int().nonnegative().nullable(),
+  binary: z2.boolean()
+});
+var workspaceStatusSchema = z2.object({
+  isGitRepo: z2.boolean(),
+  branch: z2.string().nullable(),
+  files: z2.array(workspaceFileEntrySchema)
+});
+var workspaceFileDiffSchema = z2.object({
+  path: z2.string(),
+  staged: z2.boolean(),
+  patch: z2.string().nullable(),
+  binary: z2.boolean()
+});
+var browserMessageSchema = z2.discriminatedUnion("type", [
+  z2.object({ type: z2.literal("session.list") }),
+  z2.object({
+    type: z2.literal("session.create"),
+    title: z2.string().min(1).max(200),
+    cwd: z2.string().min(1),
+    command: z2.string().min(1).max(2e3),
+    requestId: z2.string().min(1).max(200).optional()
+  }),
+  z2.object({ type: z2.literal("session.attach"), sessionId: z2.string() }),
+  z2.object({
+    type: z2.literal("session.input"),
+    sessionId: z2.string(),
+    data: z2.string()
+  }),
+  z2.object({
+    type: z2.literal("session.insertText"),
+    sessionId: z2.string(),
+    text: z2.string().max(MAX_INSERT_TEXT_BYTES)
+  }),
+  z2.object({
+    type: z2.literal("session.resize"),
+    sessionId: z2.string(),
+    cols: z2.number().int().positive(),
+    rows: z2.number().int().positive()
+  }),
+  z2.object({ type: z2.literal("session.stop"), sessionId: z2.string() }),
+  z2.object({
+    type: z2.literal("workspace.getStatus"),
+    sessionId: z2.string(),
+    requestId: z2.string().min(1).max(200)
+  }),
+  z2.object({
+    type: z2.literal("workspace.getDiff"),
+    sessionId: z2.string(),
+    path: z2.string().min(1).max(4096),
+    staged: z2.boolean(),
+    requestId: z2.string().min(1).max(200)
+  }),
+  z2.object({ type: z2.literal("daemon.getInfo") }),
+  // Second-controller enrollment (ADR-011/ADR-012, BD-433) — deliberately
+  // unsigned: the requesting browser has no trusted key yet to sign with.
+  // Authority comes entirely from explicit daemon-local user approval, not
+  // from anything in this message.
+  z2.object({
+    type: z2.literal("controller.requestEnrollment"),
+    publicKeyPem: z2.string().min(1),
+    label: z2.string().min(1).max(200)
+  }),
+  // ADR-013/BD-477: the browser's signed response to connection.challenge —
+  // carries its own signed transcript, not a CommandEnvelope, so it's a
+  // distinct BrowserMessage variant rather than a SIGNABLE_ACTIONS entry.
+  z2.object({
+    type: z2.literal("connection.authenticate"),
+    signed: z2.object({
+      transcript: connectionChallengeTranscriptSchema,
+      signature: z2.string().min(1)
+    })
+  })
+]);
+var connectionAuthenticationFailureReasonSchema = z2.enum([
+  "bad_signature",
+  "untrusted_controller",
+  "wrong_daemon",
+  "wrong_connection",
+  "challenge_expired",
+  "already_authenticated",
+  "rate_limited"
+]);
+var connectionRejectionReasonSchema = z2.enum(["origin_not_allowed", "token_invalid"]);
+var daemonMessageSchema = z2.discriminatedUnion("type", [
+  z2.object({ type: z2.literal("session.list"), sessions: z2.array(localSessionSchema) }),
+  z2.object({
+    type: z2.literal("session.created"),
+    session: localSessionSchema,
+    requestId: z2.string().optional()
+  }),
+  z2.object({
+    type: z2.literal("terminal.output"),
+    sessionId: z2.string(),
+    data: z2.string()
+  }),
+  z2.object({ type: z2.literal("session.updated"), session: localSessionSchema }),
+  // Ack for a successful session.attach — the browser must wait for this
+  // before wiring up terminal input, or a keystroke sent before the daemon
+  // actually finishes attaching gets rejected as "not attached to
+  // session" (observed during a reconnect: attachSession() was
+  // fire-and-forget, so terminal.onData could fire before attach
+  // completed).
+  z2.object({ type: z2.literal("session.attached"), sessionId: z2.string() }),
+  z2.object({ type: z2.literal("error"), message: z2.string() }),
+  z2.object({
+    type: z2.literal("workspace.status"),
+    sessionId: z2.string(),
+    requestId: z2.string(),
+    status: workspaceStatusSchema
+  }),
+  z2.object({
+    type: z2.literal("workspace.diff"),
+    sessionId: z2.string(),
+    requestId: z2.string(),
+    diff: workspaceFileDiffSchema
+  }),
+  z2.object({
+    type: z2.literal("daemon.info"),
+    hostname: z2.string(),
+    daemonFingerprint: z2.string()
+  }),
+  z2.object({
+    type: z2.literal("controller.enrollmentPending"),
+    fingerprint: z2.string()
+  }),
+  z2.object({
+    type: z2.literal("controller.enrollmentRejected"),
+    reason: z2.enum(["not_interactive", "rate_limited"])
+  }),
+  z2.object({
+    type: z2.literal("connection.challenge"),
+    connectionId: z2.string().min(1),
+    challenge: z2.string().min(1),
+    daemonFingerprint: z2.string().min(1),
+    hostname: z2.string(),
+    expiresAt: z2.number().int().positive()
+  }),
+  z2.object({
+    type: z2.literal("connection.authenticated"),
+    connectionId: z2.string().min(1)
+  }),
+  z2.object({
+    type: z2.literal("connection.authenticationFailed"),
+    reason: connectionAuthenticationFailureReasonSchema
+  }),
+  z2.object({
+    type: z2.literal("connection.rejected"),
+    reason: connectionRejectionReasonSchema
+  })
+]);
+
+// ../../packages/local-agent-protocol/src/validation.ts
+var UUID_V4_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var TMUX_SESSION_NAME_RE = /^bondsmith-[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function isValidSessionId(id) {
+  return UUID_V4_RE.test(id);
+}
+function tmuxSessionNameFor(id) {
+  return `bondsmith-${id}`;
+}
+function isBondsmithTmuxSessionName(name) {
+  return TMUX_SESSION_NAME_RE.test(name);
+}
+
+// ../../packages/local-agent-protocol/src/fingerprint.ts
+async function formatDaemonFingerprint(publicKeyPem) {
+  const data = new TextEncoder().encode(publicKeyPem);
+  const digestBuffer = await globalThis.crypto.subtle.digest("SHA-256", data);
+  const digest = Array.from(new Uint8Array(digestBuffer)).map((byte) => byte.toString(16).padStart(2, "0")).join("").toUpperCase();
+  const truncated = digest.slice(0, 32);
+  return truncated.match(/.{1,4}/g).join("-");
+}
+
+// ../../packages/local-agent-protocol/src/controller-id.ts
+async function controllerIdFromPublicKeyPem(publicKeyPem) {
+  const data = new TextEncoder().encode(publicKeyPem);
+  const digestBuffer = await globalThis.crypto.subtle.digest("SHA-256", data);
+  const hex = Array.from(new Uint8Array(digestBuffer)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  return hex.slice(0, 32);
+}
+
+// ../../packages/local-agent-protocol/src/canonicalize.ts
+function canonicalize(value) {
+  return serialize(value);
+}
+function serialize(value) {
+  if (value === null || typeof value === "number" || typeof value === "boolean") {
+    return JSON.stringify(value);
+  }
+  if (typeof value === "string") {
+    return JSON.stringify(value);
+  }
+  if (value === void 0) {
+    throw new TypeError("canonicalize: undefined is not representable");
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(serialize).join(",")}]`;
+  }
+  if (typeof value === "object") {
+    const keys = Object.keys(value).sort();
+    const entries = keys.map((key) => {
+      const entryValue = value[key];
+      return `${JSON.stringify(key)}:${serialize(entryValue)}`;
+    });
+    return `{${entries.join(",")}}`;
+  }
+  throw new TypeError(`canonicalize: unsupported value type ${typeof value}`);
+}
+
+// ../../packages/local-agent-protocol/src/envelope.ts
+import { z as z3 } from "zod";
+var SIGNABLE_ACTIONS = [
+  "session.create",
+  "session.attach",
+  "session.input",
+  "session.insertText",
+  "session.resize",
+  "session.stop",
+  "session.list",
+  "workspace.getStatus",
+  "workspace.getDiff"
+];
+var envelopeSchema = z3.object({
+  version: z3.literal(1),
+  controllerId: z3.string().min(1),
+  accountId: z3.number().int().positive(),
+  daemonId: z3.string().min(1),
+  // The specific WebSocket connection this envelope was signed for (ADR-013,
+  // BD-477) — issued by the daemon during that connection's handshake
+  // (connection-challenge.ts), never reused across connections. `sequence`
+  // below is only ever compared against other envelopes carrying the SAME
+  // connectionId; an envelope for a stale or foreign connectionId is
+  // rejected before sequence is even considered (verify-command.ts).
+  connectionId: z3.string().min(1),
+  sessionId: z3.string().nullable(),
+  action: z3.enum(SIGNABLE_ACTIONS),
+  payload: z3.unknown(),
+  issuedAt: z3.number().int().positive(),
+  expiresAt: z3.number().int().positive(),
+  // Strictly increasing WITHIN one connectionId's sequence space, starting
+  // at 1 for every new authenticated connection — never a persisted,
+  // global-per-controller counter (that design broke on page reload; see
+  // ADR-013). Verified and advanced in-memory, per connection, never
+  // written to disk.
+  sequence: z3.number().int().positive()
+});
+var signedCommandSchema = z3.object({
+  envelope: envelopeSchema,
+  signature: z3.string().min(1)
+});
+
+// ../../packages/local-agent-protocol/src/pairing-challenge.ts
+import { z as z4 } from "zod";
+var PAIRING_CHALLENGE_PURPOSE = "bondsmith.initial-controller-pairing";
+var pairingChallengeTranscriptSchema = z4.object({
+  version: z4.literal(1),
+  purpose: z4.literal(PAIRING_CHALLENGE_PURPOSE),
+  pairingAttemptId: z4.string().min(1),
+  challenge: z4.string().min(1),
+  daemonFingerprint: z4.string().min(1),
+  controllerPublicKeyPem: z4.string().min(1),
+  accountId: z4.number().int().positive()
+});
+var signedPairingChallengeSchema = z4.object({
+  transcript: pairingChallengeTranscriptSchema,
+  signature: z4.string().min(1)
+});
+
+// ../../packages/local-agent-protocol/src/relay-register-transcript.ts
+import { z as z5 } from "zod";
+var RELAY_REGISTER_PURPOSE = "bondsmith.relay.register";
+var relayRegisterTranscriptSchema = z5.object({
+  version: z5.literal(1),
+  purpose: z5.literal(RELAY_REGISTER_PURPOSE),
+  // Relay-issued, single-use — a second registration attempt against the
+  // same challenge is meaningless since a daemon reconnecting always gets
+  // a fresh challenge from a fresh relay.challenge message; this field
+  // exists so a captured signed transcript can't be replayed later against
+  // a still-open relay listener.
+  challenge: z5.string().min(1),
+  daemonFingerprint: z5.string().min(1),
+  issuedAt: z5.number().int().positive(),
+  expiresAt: z5.number().int().positive(),
+  // Binds this transcript to one specific relay deployment (e.g.
+  // "relay.bondsmith.dev") — same reasoning as CommandEnvelope's own
+  // daemonId field binding a command to one specific daemon; prevents a
+  // transcript signed for one relay audience from being replayed against
+  // a different one.
+  relayAudience: z5.string().min(1)
+});
+var signedRelayRegisterSchema = z5.object({
+  // The daemon's full public key PEM, transmitted alongside the transcript
+  // so the relay can independently derive daemonFingerprint from it and
+  // verify the signature against it — see this file's own doc comment for
+  // why this must travel on the wire rather than being assumed.
+  daemonPublicKeyPem: z5.string().min(1),
+  transcript: relayRegisterTranscriptSchema,
+  signature: z5.string().min(1)
+});
+
+// ../../packages/local-agent-protocol/src/relay-ticket.ts
+import { z as z6 } from "zod";
+var RELAY_TICKET_PURPOSE = "bondsmith.relay.attach";
+var relayTicketSchema = z6.object({
+  version: z6.literal(1),
+  purpose: z6.literal(RELAY_TICKET_PURPOSE),
+  keyId: z6.string().min(1),
+  accountId: z6.number().int().positive(),
+  userId: z6.string().min(1),
+  daemonFingerprint: z6.string().min(1),
+  issuedAt: z6.number().int().positive(),
+  // Deliberately short — single-digit minutes, enough for one attach
+  // attempt, not a durable credential.
+  expiresAt: z6.number().int().positive(),
+  // Crypto-random, single-use — consumed atomically by the relay on
+  // successful attach (an in-memory, TTL-expiring record; see the relay
+  // architecture doc's own correction against an unbounded Set). A
+  // replayed ticket (same nonce, still within its own expiry window)
+  // fails closed.
+  nonce: z6.string().min(1)
+});
+var signedRelayTicketSchema = z6.object({
+  ticket: relayTicketSchema,
+  signature: z6.string().min(1)
+});
+
+// ../../packages/local-agent-protocol/src/relay-messages.ts
+import { z as z7 } from "zod";
+var relayFailureReasonSchema = z7.enum([
+  // relay.registrationFailed reasons (daemon side)
+  "bad_signature",
+  "wrong_fingerprint",
+  "wrong_purpose",
+  "challenge_expired",
+  "challenge_invalid",
+  "wrong_audience",
+  "untrusted_daemon",
+  // relay.attachFailed reasons (browser side)
+  "invalid_origin",
+  "unknown_key_id",
+  "ticket_invalid",
+  "ticket_expired",
+  "ticket_reused",
+  "daemon_offline",
+  "session_open_timeout",
+  // BD-485: the target daemon's CURRENT registration already holds
+  // MAX_SESSIONS_PER_REGISTRATION concurrent relay sessions — an
+  // independent, relay-side resource limit, not a re-statement of the
+  // daemon's own client-side cap (see session-registry.ts's doc comment).
+  "session_limit_exceeded"
+]);
+var relayFrameSchema = z7.object({
+  relaySessionId: z7.string().min(1),
+  // Opaque to the relay — the existing inner BrowserMessage/DaemonMessage
+  // JSON, unparsed and unvalidated by anything in this file. Typed as
+  // unknown here deliberately; callers narrow it via browserMessageSchema/
+  // daemonMessageSchema from messages.ts/schemas.ts after routing.
+  payload: z7.unknown()
+});
+var relayDaemonMessageSchema = z7.discriminatedUnion("type", [
+  z7.object({ type: z7.literal("relay.register"), signed: signedRelayRegisterSchema }),
+  // Sent in response to relay.sessionOpened, once ConnectionAuthState has
+  // actually been allocated — see relay-architecture doc §6's correction:
+  // the relay cannot assume this happened just because it sent the
+  // message, since bondsmithd is a remote process over a real WSS socket.
+  z7.object({ type: z7.literal("relay.sessionOpenAck"), relaySessionId: z7.string().min(1) }),
+  z7.object({ type: z7.literal("relay.frame"), frame: relayFrameSchema }),
+  // Daemon-initiated close — used when BD-434's existing
+  // revokeControllerConnections/revokeAllConnections destroys a
+  // ConnectionAuthState locally (controller revocation, daemon unpairing)
+  // and needs the relay to close the matching browser socket too. The
+  // daemon has already stopped honoring this relaySessionId's commands by
+  // the time this is sent (revocation's actual authorization guarantee
+  // never depends on the relay's cooperation) — this is cleanup, not the
+  // authorization boundary.
+  z7.object({ type: z7.literal("relay.closeSession"), relaySessionId: z7.string().min(1) })
+]);
+var relayToDaemonMessageSchema = z7.discriminatedUnion("type", [
+  z7.object({
+    type: z7.literal("relay.challenge"),
+    challenge: z7.string().min(1),
+    expiresAt: z7.number().int().positive(),
+    relayAudience: z7.string().min(1)
+  }),
+  z7.object({ type: z7.literal("relay.registered"), daemonFingerprint: z7.string().min(1) }),
+  z7.object({ type: z7.literal("relay.registrationFailed"), reason: relayFailureReasonSchema }),
+  z7.object({ type: z7.literal("relay.sessionOpened"), relaySessionId: z7.string().min(1) }),
+  z7.object({ type: z7.literal("relay.sessionClosed"), relaySessionId: z7.string().min(1) }),
+  z7.object({ type: z7.literal("relay.frame"), frame: relayFrameSchema })
+]);
+var relayBrowserMessageSchema = z7.discriminatedUnion("type", [
+  z7.object({ type: z7.literal("relay.attach"), signed: signedRelayTicketSchema }),
+  z7.object({ type: z7.literal("relay.frame"), frame: relayFrameSchema })
+]);
+var relayToBrowserMessageSchema = z7.discriminatedUnion("type", [
+  z7.object({ type: z7.literal("relay.attached"), relaySessionId: z7.string().min(1) }),
+  z7.object({ type: z7.literal("relay.attachFailed"), reason: relayFailureReasonSchema }),
+  z7.object({ type: z7.literal("relay.daemonOffline") }),
+  // Sent when the daemon registration a session was opened against gets
+  // superseded (the daemon reconnected) — the session is dead, the browser
+  // must perform a fresh relay.attach. "daemon_reconnected" covers V1's
+  // single-process supersession case (see relay-architecture.md §4); kept
+  // as its own reason (not folded into relay.daemonOffline) since the
+  // daemon IS reachable again, just under a new registration.
+  z7.object({
+    type: z7.literal("relay.sessionInvalidated"),
+    relaySessionId: z7.string().min(1),
+    reason: z7.literal("daemon_reconnected")
+  }),
+  z7.object({ type: z7.literal("relay.frame"), frame: relayFrameSchema })
+]);
+
+// src/index.ts
+import { config as loadEnv } from "dotenv";
+
+// src/config/environment.ts
+import { z as z8 } from "zod";
+var environmentSchema = z8.object({
+  PORT: z8.coerce.number().int().min(1).max(65535).default(4577),
+  ALLOWED_ORIGINS: z8.string().default(
+    "http://localhost:3000,http://127.0.0.1:3000,http://localhost:4000,http://127.0.0.1:4000"
+  ).transform(
+    (value) => value.split(",").map((origin) => origin.trim()).filter(Boolean)
+  ),
+  // Dev-tunnel spike only: when set, every WebSocket connection must present
+  // this token (via the Sec-WebSocket-Protocol header) or be rejected. Unset
+  // by default so plain localhost usage is unaffected. Never a substitute for
+  // real auth — see apps/bondsmithd/README.md's dev-tunnel section.
+  BONDSMITH_DEV_TUNNEL_TOKEN: z8.string().min(1).optional(),
+  // Base URL of the Bondsmith backend this daemon pairs itself against
+  // (BD-432) — defaults to production so a real install works with zero
+  // config; overridden to the local dev server (e.g. http://localhost:4000)
+  // when developing bondsmithd itself against a local web app.
+  BONDSMITH_API_URL: z8.string().url().default("https://app.bondsmith.dev"),
+  // Interface the WebSocket/HTTP server binds to. Defaults to loopback-only
+  // (never reachable from outside this machine) — real access control is
+  // ALLOWED_ORIGINS + the dev-tunnel token, not the bind address, but
+  // loopback-only is a reasonable default so the daemon isn't exposed on
+  // the network by accident. Only reason to widen this: a local dev setup
+  // that puts something (e.g. Docker's host-gateway route for an ngrok
+  // tunnel) between the daemon and the browser — not something a normal
+  // install needs to touch.
+  BONDSMITH_BIND_HOST: z8.string().min(1).default("127.0.0.1"),
+  // BD-450/BD-483/BD-484: connect outbound to the Bondsmith relay instead of
+  // (or alongside) listening inbound. ON by default — local dev is meant to
+  // mirror production's actual topology (browser -> relay -> daemon), not
+  // diverge from it, so plain `pnpm --filter @bondsmith/bondsmithd dev`
+  // connects outbound to a locally-running apps/relay (its own `pnpm dev`
+  // on the default port below) exactly like a real deployment would.
+  // BONDSMITH_RELAY_URL defaults to that same local apps/relay instance for
+  // the same reason. The existing inbound listener is completely
+  // unaffected either way — it keeps running regardless, so direct-
+  // connection debugging (bypassing the relay entirely) is still possible
+  // by setting BONDSMITH_RELAY_ENABLED=false explicitly.
+  BONDSMITH_RELAY_ENABLED: z8.string().default("true").transform((value) => value === "true" || value === "1"),
+  BONDSMITH_RELAY_URL: z8.string().url().default("ws://127.0.0.1:8787")
+});
+function getDaemonConfig(env = process.env) {
+  const parsed = environmentSchema.parse(env);
+  return {
+    port: parsed.PORT,
+    allowedOrigins: parsed.ALLOWED_ORIGINS,
+    devTunnelToken: parsed.BONDSMITH_DEV_TUNNEL_TOKEN,
+    apiUrl: parsed.BONDSMITH_API_URL,
+    bindHost: parsed.BONDSMITH_BIND_HOST,
+    relayEnabled: parsed.BONDSMITH_RELAY_ENABLED,
+    relayUrl: parsed.BONDSMITH_RELAY_URL
+  };
+}
+
+// src/pairing/open-browser.ts
+import { spawn } from "child_process";
+function openBrowser(url) {
+  try {
+    const { command, args } = commandFor(url);
+    const child = spawn(command, args, { stdio: "ignore", detached: true });
+    child.unref();
+    child.on("error", () => {
+    });
+  } catch {
+  }
+}
+function commandFor(url) {
+  switch (process.platform) {
+    case "darwin":
+      return { command: "open", args: [url] };
+    case "win32":
+      return { command: "cmd", args: ["/c", "start", "", url] };
+    default:
+      return { command: "xdg-open", args: [url] };
+  }
+}
+
+// src/pairing/pairing.ts
+import { verify } from "crypto";
+
+// src/pairing/trpc-client.ts
+var TRPCCallError = class extends Error {
+  constructor(message, procedure) {
+    super(message);
+    this.procedure = procedure;
+    this.name = "TRPCCallError";
+  }
+};
+function procedureUrl(baseUrl, procedure) {
+  return `${baseUrl.replace(/\/$/, "")}/api/trpc/${procedure}`;
+}
+async function parseTRPCResponse(response, procedure) {
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    throw new TRPCCallError(
+      `Unexpected response from ${procedure} (status ${response.status}, not valid JSON)`,
+      procedure
+    );
+  }
+  if (isErrorEnvelope(body)) {
+    throw new TRPCCallError(body.error.json.message, procedure);
+  }
+  if (!response.ok) {
+    throw new TRPCCallError(`HTTP ${response.status}`, procedure);
+  }
+  if (!isResultEnvelope(body)) {
+    throw new TRPCCallError(`Malformed response from ${procedure}`, procedure);
+  }
+  return body.result.data.json;
+}
+function isErrorEnvelope(body) {
+  if (typeof body !== "object" || body === null || !("error" in body)) return false;
+  const error2 = body.error;
+  if (typeof error2 !== "object" || error2 === null || !("json" in error2)) return false;
+  const json = error2.json;
+  return typeof json === "object" && json !== null && "message" in json && typeof json.message === "string";
+}
+function isResultEnvelope(body) {
+  return typeof body === "object" && body !== null && "result" in body && typeof body.result === "object";
+}
+async function callTRPCQuery(baseUrl, procedure, input) {
+  const encodedInput = encodeURIComponent(JSON.stringify({ json: input }));
+  const url = `${procedureUrl(baseUrl, procedure)}?input=${encodedInput}`;
+  const response = await fetch(url, { method: "GET" });
+  return parseTRPCResponse(response, procedure);
+}
+
+// src/pairing/pairing.ts
+var DEFAULT_POLL_INTERVAL_MS = 3e3;
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function ensurePaired(options) {
+  const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  const { paired } = await callTRPCQuery(
+    options.apiUrl,
+    "daemonPairing.checkOwnPairingStatus",
+    { daemonPublicKey: options.publicKeyPem }
+  );
+  if (paired) return;
+  const { code, challenge } = await callTRPCQuery(
+    options.apiUrl,
+    "daemonPairing.initiatePairing",
+    { daemonPublicKey: options.publicKeyPem, hostname: options.hostname }
+  );
+  const fingerprint = await formatDaemonFingerprint(options.publicKeyPem);
+  const pairingUrl = `${options.apiUrl.replace(/\/$/, "")}/pair?code=${code}`;
+  options.onPairingCode({ code, pairingUrl, fingerprint });
+  await pollUntilConfirmed({
+    apiUrl: options.apiUrl,
+    daemonPublicKey: options.publicKeyPem,
+    code,
+    expectedChallenge: challenge,
+    daemonFingerprint: fingerprint,
+    pollIntervalMs,
+    pendingAuthorizations: options.pendingAuthorizations,
+    presentPendingAuthorization: options.presentPendingAuthorization
+  });
+}
+async function pollUntilConfirmed(params) {
+  const { apiUrl, code, pollIntervalMs } = params;
+  for (; ; ) {
+    await sleep(pollIntervalMs);
+    let response;
+    try {
+      response = await callTRPCQuery(
+        apiUrl,
+        "daemonPairing.checkPairingStatus",
+        { code }
+      );
+    } catch (error2) {
+      if (!(error2 instanceof TRPCCallError)) throw error2;
+      continue;
+    }
+    if (response.status === "confirmed") {
+      await bindFirstController(params, response);
+      return;
+    }
+    if (response.status === "not_found") {
+      throw new Error(
+        "Pairing code expired before it was confirmed. Restart bondsmithd to get a new code."
+      );
+    }
+  }
+}
+async function bindFirstController(params, response) {
+  const {
+    apiUrl,
+    daemonPublicKey,
+    code,
+    expectedChallenge,
+    daemonFingerprint,
+    pendingAuthorizations,
+    presentPendingAuthorization
+  } = params;
+  const { transcript, signature } = response;
+  const parsed = signedPairingChallengeSchema.safeParse({ transcript, signature });
+  if (!parsed.success) {
+    throw new Error(
+      "Pairing confirmed, but the signed transcript is malformed. Refusing to trust this browser as a controller \u2014 restart bondsmithd to get a new code and try again."
+    );
+  }
+  let signatureValid;
+  try {
+    signatureValid = verify(
+      "sha256",
+      Buffer.from(canonicalize(transcript), "utf8"),
+      // WebCrypto's ECDSA signatures are raw r||s (IEEE P1363), not the
+      // DER encoding node:crypto defaults to for EC keys.
+      { key: transcript.controllerPublicKeyPem, dsaEncoding: "ieee-p1363" },
+      Buffer.from(signature, "base64")
+    );
+  } catch {
+    signatureValid = false;
+  }
+  if (!signatureValid) {
+    throw new Error(
+      "Pairing confirmed, but the controller signature over the pairing transcript did not verify. Refusing to trust this browser as a controller \u2014 restart bondsmithd to get a new code and try again."
+    );
+  }
+  if (transcript.purpose !== PAIRING_CHALLENGE_PURPOSE) {
+    throw new Error(
+      "Pairing confirmed, but the signed transcript has the wrong purpose. Refusing to trust this browser as a controller."
+    );
+  }
+  if (transcript.pairingAttemptId !== code) {
+    throw new Error(
+      "Pairing confirmed, but the signed transcript is for a different pairing attempt. Refusing to trust this browser as a controller."
+    );
+  }
+  if (transcript.challenge !== expectedChallenge) {
+    throw new Error(
+      "Pairing confirmed, but the signed transcript's challenge does not match. Refusing to trust this browser as a controller \u2014 restart bondsmithd to get a new code and try again."
+    );
+  }
+  if (transcript.daemonFingerprint !== daemonFingerprint) {
+    throw new Error(
+      "Pairing confirmed, but the signed transcript is addressed to a different daemon. Refusing to trust this browser as a controller."
+    );
+  }
+  const enrollmentResult = await pendingAuthorizations.requestEnrollment({
+    publicKeyPem: transcript.controllerPublicKeyPem,
+    label: "First controller (pairing)"
+  });
+  if (!enrollmentResult.ok) {
+    throw new Error(
+      enrollmentResult.reason === "not_interactive" ? "Pairing requires local approval, but bondsmithd is not running interactively. Restart bondsmithd in a terminal to complete pairing." : "Too many pairing attempts in a short window. Wait a moment and restart bondsmithd to try again."
+    );
+  }
+  presentPendingAuthorization(enrollmentResult.pending);
+  const outcome = await enrollmentResult.result;
+  if (outcome !== "approved") {
+    throw new Error(
+      outcome === "denied" ? "Pairing was not approved at the local terminal prompt. Restart bondsmithd to get a new code and try again." : "Pairing approval was not completed in time. Restart bondsmithd to get a new code and try again."
+    );
+  }
+  try {
+    await callTRPCQuery(apiUrl, "daemonPairing.reportControllerBound", {
+      daemonPublicKey,
+      controllerPublicKey: transcript.controllerPublicKeyPem,
+      label: "First controller (pairing)"
+    });
+  } catch (error2) {
+    console.error("Failed to report the new controller to Bondsmith (non-fatal)", error2);
+  }
+}
+
+// src/relay/relay-client.ts
+import { sign } from "crypto";
+import WebSocket from "ws";
+
+// src/sessions/tmux/client.ts
+import { execFile as execFileCb } from "child_process";
+import { promisify } from "util";
+var execFile = promisify(execFileCb);
+var TmuxNoServerRunningError = class extends Error {
+  constructor() {
+    super("no tmux server running");
+    this.name = "TmuxNoServerRunningError";
+  }
+};
+var SENSITIVE_ENV_KEYS = ["ANTHROPIC_API_KEY", "BONDSMITH_DEV_TUNNEL_TOKEN"];
+function filterSpawnEnv(env) {
+  const filtered = { ...env };
+  for (const key of SENSITIVE_ENV_KEYS) delete filtered[key];
+  return filtered;
+}
+async function runTmux(args, options) {
+  const { stdout } = await execFile("tmux", args, { ...options, encoding: "utf8" });
+  return stdout;
+}
+async function sendKeysLiteral(tmuxSessionName, text) {
+  await runTmux(["send-keys", "-t", tmuxSessionName, "-l", text]);
+}
+async function capturePane(tmuxSessionName) {
+  return runTmux(["capture-pane", "-t", tmuxSessionName, "-p", "-e"]);
+}
+async function getPaneActivity(tmuxSessionName) {
+  try {
+    const out = (await runTmux(["display-message", "-p", "-t", tmuxSessionName, "#{pane_activity}"])).trim();
+    const seconds = Number(out);
+    if (!out || Number.isNaN(seconds)) return null;
+    return new Date(seconds * 1e3).toISOString();
+  } catch {
+    return null;
+  }
+}
+async function listTmuxSessions(formatString) {
+  try {
+    return await runTmux(["list-sessions", "-F", formatString]);
+  } catch (error2) {
+    if (isNoServerError(error2)) throw new TmuxNoServerRunningError();
+    throw error2;
+  }
+}
+function isNoServerError(error2) {
+  if (typeof error2 !== "object" || error2 === null) return true;
+  return error2.code !== "ENOENT";
+}
+
+// src/security/verify-command.ts
+import { verify as verify2 } from "crypto";
+
+// src/security/trusted-controllers.ts
+import { mkdir, readFile, rename, rm, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { dirname, join } from "path";
+import { z as z9 } from "zod";
+var trustedControllerSchema = z9.object({
+  id: z9.string(),
+  publicKeyPem: z9.string(),
+  label: z9.string(),
+  addedAt: z9.string(),
+  lastUsedAt: z9.string().nullable(),
+  // Obsolete as of ADR-013/BD-477 — replay protection moved to an
+  // ephemeral, connection-scoped sequence (connection-auth.ts), never
+  // persisted. Accepted-but-ignored here (`.optional()`, not required, and
+  // never read into TrustedController above) purely for backward
+  // compatibility: a trusted-controllers.json written by a daemon from
+  // before this change still parses correctly — controller trust and
+  // revocation state is never lost — instead of throwing on an "unknown"
+  // shape. Never written by this file's own persist() calls going forward.
+  lastSeenSequence: z9.number().int().nonnegative().optional()
+});
+var trustedControllersFileSchema = z9.object({
+  version: z9.literal(1),
+  controllers: z9.array(trustedControllerSchema)
+});
+function defaultTrustedControllersPath() {
+  return join(homedir(), ".bondsmith", "trusted-controllers.json");
+}
+async function loadTrustedControllers(path = defaultTrustedControllersPath()) {
+  let raw;
+  try {
+    raw = await readFile(path, "utf8");
+  } catch {
+    return [];
+  }
+  const parsed = trustedControllersFileSchema.safeParse(JSON.parse(raw));
+  if (!parsed.success) {
+    throw new Error(
+      `trusted-controllers: file at ${path} exists but failed to parse \u2014 refusing to silently treat an already-trusted set as empty. Move or delete it manually to reset. (${parsed.error.message})`
+    );
+  }
+  return parsed.data.controllers.map(({ id, publicKeyPem, label, addedAt, lastUsedAt }) => ({
+    id,
+    publicKeyPem,
+    label,
+    addedAt,
+    lastUsedAt
+  }));
+}
+async function getTrustedController(controllerId, path = defaultTrustedControllersPath()) {
+  const controllers = await loadTrustedControllers(path);
+  return controllers.find((c) => c.id === controllerId) ?? null;
+}
+async function addTrustedController(params, path = defaultTrustedControllersPath()) {
+  return withTrustFileLock(path, async () => {
+    const controllers = await loadTrustedControllers(path);
+    const id = await controllerIdFromPublicKeyPem(params.publicKeyPem);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const existingIndex = controllers.findIndex((c) => c.id === id);
+    const entry = {
+      id,
+      publicKeyPem: params.publicKeyPem,
+      label: params.label,
+      addedAt: existingIndex >= 0 ? controllers[existingIndex].addedAt : now,
+      lastUsedAt: existingIndex >= 0 ? controllers[existingIndex].lastUsedAt : null
+    };
+    const next = existingIndex >= 0 ? controllers.map((c, i) => i === existingIndex ? entry : c) : [...controllers, entry];
+    await persist(path, next);
+    return entry;
+  });
+}
+async function revokeTrustedController(controllerId, path = defaultTrustedControllersPath()) {
+  return withTrustFileLock(path, async () => {
+    const controllers = await loadTrustedControllers(path);
+    const next = controllers.filter((c) => c.id !== controllerId);
+    await persist(path, next);
+  });
+}
+async function revokeAllTrustedControllers(path = defaultTrustedControllersPath()) {
+  return withTrustFileLock(path, () => persist(path, []));
+}
+async function recordControllerHandshake(controllerId, path = defaultTrustedControllersPath()) {
+  return withTrustFileLock(path, async () => {
+    const controllers = await loadTrustedControllers(path);
+    const next = controllers.map(
+      (c) => c.id === controllerId ? { ...c, lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() } : c
+    );
+    await persist(path, next);
+  });
+}
+var trustFileLocks = /* @__PURE__ */ new Map();
+function withTrustFileLock(path, fn) {
+  const previous = trustFileLocks.get(path) ?? Promise.resolve();
+  const next = previous.catch(() => {
+  }).then(fn);
+  trustFileLocks.set(
+    path,
+    next.catch(() => {
+    })
+  );
+  return next;
+}
+async function persist(path, controllers) {
+  await mkdir(dirname(path), { recursive: true });
+  const tmpPath = `${path}.tmp-${process.pid}-${Date.now()}`;
+  const contents = JSON.stringify({ version: 1, controllers }, null, 2);
+  try {
+    await writeFile(tmpPath, contents, { mode: 384 });
+    await rename(tmpPath, path);
+  } catch (error2) {
+    await rm(tmpPath, { force: true });
+    throw error2;
+  }
+}
+
+// src/security/verify-command.ts
+var ENVELOPE_MAX_AGE_MS = 6e4;
+var CLOCK_SKEW_TOLERANCE_MS = 5e3;
+async function verifyCommand(command, daemonFingerprint, connectionState, trustedControllersPath) {
+  const { envelope, signature } = command;
+  const identity = connectionState.getAuthenticatedIdentity();
+  if (!identity) {
+    return { ok: false, reason: "not_authenticated" };
+  }
+  if (envelope.connectionId !== connectionState.connectionId) {
+    return { ok: false, reason: "wrong_connection" };
+  }
+  if (envelope.controllerId !== identity.controllerId) {
+    return { ok: false, reason: "wrong_connection" };
+  }
+  const controller = await getTrustedController(envelope.controllerId, trustedControllersPath);
+  if (!controller) {
+    return { ok: false, reason: "untrusted_controller" };
+  }
+  const canonicalBytes = Buffer.from(canonicalize(envelope), "utf8");
+  let signatureValid;
+  try {
+    signatureValid = verify2(
+      "sha256",
+      canonicalBytes,
+      // WebCrypto's ECDSA signatures are raw r||s (IEEE P1363), not the
+      // DER encoding node:crypto defaults to for EC keys — without this
+      // option every browser-produced signature would fail to verify.
+      { key: controller.publicKeyPem, dsaEncoding: "ieee-p1363" },
+      Buffer.from(signature, "base64")
+    );
+  } catch {
+    signatureValid = false;
+  }
+  if (!signatureValid) {
+    return { ok: false, reason: "bad_signature" };
+  }
+  if (envelope.daemonId !== daemonFingerprint) {
+    return { ok: false, reason: "wrong_daemon" };
+  }
+  const now = Date.now();
+  if (envelope.issuedAt > now + CLOCK_SKEW_TOLERANCE_MS) {
+    return { ok: false, reason: "expired" };
+  }
+  if (envelope.expiresAt <= now) {
+    return { ok: false, reason: "expired" };
+  }
+  if (envelope.expiresAt - envelope.issuedAt > ENVELOPE_MAX_AGE_MS) {
+    return { ok: false, reason: "expired" };
+  }
+  const sequenceResult = await connectionState.checkAndAdvanceSequence(envelope.sequence);
+  if (!sequenceResult.ok) {
+    return {
+      ok: false,
+      reason: sequenceResult.reason === "replayed" ? "replayed" : "not_authenticated"
+    };
+  }
+  return { ok: true };
+}
+
+// src/ws/router.ts
+var SIGNABLE_ACTION_SET = new Set(SIGNABLE_ACTIONS);
+function isSignableAction(type) {
+  return SIGNABLE_ACTION_SET.has(type);
+}
+function verifyRejectionMessage(reason) {
+  switch (reason) {
+    case "untrusted_controller":
+      return "controller not trusted by this daemon";
+    case "bad_signature":
+      return "invalid command signature";
+    case "expired":
+      return "command envelope expired";
+    case "replayed":
+      return "command already used (replay rejected)";
+    case "wrong_daemon":
+      return "command not addressed to this daemon";
+    case "wrong_connection":
+      return "command not addressed to this connection";
+    case "not_authenticated":
+      return "connection has not completed its handshake";
+  }
+}
+var REVOKED_REJECTION_MESSAGE = "connection has not completed its handshake";
+var BRACKETED_PASTE_START = "\x1B[200~";
+var BRACKETED_PASTE_END = "\x1B[201~";
+function createRouterConnection(connectionAuth, send, markControllerId, ptyAttachments) {
+  const outputListeners = /* @__PURE__ */ new Map();
+  const conn = {
+    subscriptions: /* @__PURE__ */ new Set(),
+    send,
+    registerOutputListener: (sessionId, listener) => {
+      outputListeners.set(sessionId, listener);
+    },
+    getOutputListener: (sessionId) => outputListeners.get(sessionId),
+    connectionAuth,
+    markControllerId
+  };
+  function releaseAllSubscriptions() {
+    for (const sessionId of conn.subscriptions) {
+      const listener = outputListeners.get(sessionId);
+      if (listener) ptyAttachments.release(sessionId, listener);
+    }
+  }
+  return { conn, releaseAllSubscriptions };
+}
+function error(message) {
+  return { type: "error", message };
+}
+function errorMessageOf(err, fallback) {
+  return err instanceof Error ? err.message : fallback;
+}
+function getSessionOrError(sessionManager, conn, sessionId) {
+  const session = sessionManager.get(sessionId);
+  if (!session) conn.send(error("unknown session"));
+  return session;
+}
+async function handleBrowserMessage(conn, raw, deps) {
+  const signedCommand = signedCommandSchema.safeParse(raw);
+  if (signedCommand.success) {
+    const { envelope } = signedCommand.data;
+    const innerMessage = browserMessageSchema.safeParse(envelope.payload);
+    if (!innerMessage.success || innerMessage.data.type !== envelope.action) {
+      conn.send(error("invalid message"));
+      return;
+    }
+    const verdict = await verifyCommand(
+      signedCommand.data,
+      deps.daemonFingerprint,
+      conn.connectionAuth,
+      deps.trustedControllersPath
+    );
+    if (!verdict.ok) {
+      conn.send(error(verifyRejectionMessage(verdict.reason)));
+      return;
+    }
+    if (conn.connectionAuth.isRevoked()) {
+      conn.send(error(REVOKED_REJECTION_MESSAGE));
+      return;
+    }
+    await dispatch(conn, innerMessage.data, deps);
+    return;
+  }
+  const parsed = browserMessageSchema.safeParse(raw);
+  if (!parsed.success) {
+    conn.send(error("invalid message"));
+    return;
+  }
+  if (parsed.data.type === "connection.authenticate") {
+    const result = await conn.connectionAuth.authenticate(
+      parsed.data.signed,
+      deps.trustedControllersPath
+    );
+    if (!result.ok) {
+      conn.send({ type: "connection.authenticationFailed", reason: result.reason });
+      return;
+    }
+    conn.markControllerId(result.controllerId);
+    conn.send({ type: "connection.authenticated", connectionId: conn.connectionAuth.connectionId });
+    return;
+  }
+  if (isSignableAction(parsed.data.type)) {
+    conn.send(error("signature required for this command"));
+    return;
+  }
+  await dispatch(conn, parsed.data, deps);
+}
+async function dispatch(conn, message, {
+  sessionManager,
+  ptyAttachments,
+  broadcast,
+  getWorkspaceStatus: getWorkspaceStatus2,
+  getWorkspaceDiff: getWorkspaceDiff2,
+  hostname: hostname3,
+  daemonFingerprint,
+  pendingAuthorizations,
+  presentPendingAuthorization
+}) {
+  switch (message.type) {
+    case "session.list": {
+      conn.send({ type: "session.list", sessions: sessionManager.list() });
+      return;
+    }
+    case "session.create": {
+      const { title, cwd, command, requestId } = message;
+      try {
+        const session = await sessionManager.create({ title, cwd, command });
+        broadcast({ type: "session.created", session, requestId });
+      } catch (err) {
+        conn.send(error(errorMessageOf(err, "failed to create session")));
+      }
+      return;
+    }
+    case "session.attach": {
+      if (!isValidSessionId(message.sessionId)) {
+        conn.send(error("invalid session id"));
+        return;
+      }
+      const session = getSessionOrError(sessionManager, conn, message.sessionId);
+      if (!session) return;
+      const previousListener = conn.getOutputListener(message.sessionId);
+      const onData = (data) => {
+        conn.send({ type: "terminal.output", sessionId: message.sessionId, data });
+      };
+      if (previousListener && await ptyAttachments.swapListener(
+        message.sessionId,
+        session.tmuxSessionName,
+        previousListener,
+        onData
+      )) {
+        conn.subscriptions.add(message.sessionId);
+        conn.registerOutputListener(message.sessionId, onData);
+        conn.send({ type: "session.attached", sessionId: message.sessionId });
+        return;
+      }
+      if (previousListener) {
+        ptyAttachments.release(message.sessionId, previousListener);
+      }
+      const attached = await ptyAttachments.ensureAttached(
+        message.sessionId,
+        session.tmuxSessionName,
+        onData
+      );
+      if (!attached) {
+        conn.send(error("failed to attach to session"));
+        return;
+      }
+      conn.subscriptions.add(message.sessionId);
+      conn.registerOutputListener(message.sessionId, onData);
+      conn.send({ type: "session.attached", sessionId: message.sessionId });
+      return;
+    }
+    case "session.input": {
+      if (!conn.subscriptions.has(message.sessionId)) {
+        conn.send(error("not attached to session"));
+        return;
+      }
+      ptyAttachments.write(message.sessionId, message.data);
+      return;
+    }
+    case "session.insertText": {
+      const session = getSessionOrError(sessionManager, conn, message.sessionId);
+      if (!session) return;
+      try {
+        await sendKeysLiteral(
+          session.tmuxSessionName,
+          `${BRACKETED_PASTE_START}${message.text}${BRACKETED_PASTE_END}`
+        );
+      } catch (err) {
+        conn.send(error(errorMessageOf(err, "failed to insert text")));
+      }
+      return;
+    }
+    case "session.resize": {
+      if (!conn.subscriptions.has(message.sessionId)) {
+        conn.send(error("not attached to session"));
+        return;
+      }
+      ptyAttachments.resize(message.sessionId, message.cols, message.rows);
+      return;
+    }
+    case "session.stop": {
+      try {
+        if (!await sessionManager.stop(message.sessionId)) {
+          conn.send(error("unknown session"));
+          return;
+        }
+      } catch (err) {
+        conn.send(error(errorMessageOf(err, "failed to stop session")));
+      }
+      return;
+    }
+    case "workspace.getStatus": {
+      const session = getSessionOrError(sessionManager, conn, message.sessionId);
+      if (!session) return;
+      try {
+        const status = await getWorkspaceStatus2(session.cwd);
+        conn.send({
+          type: "workspace.status",
+          sessionId: message.sessionId,
+          requestId: message.requestId,
+          status
+        });
+      } catch (err) {
+        conn.send(error(errorMessageOf(err, "failed to read workspace status")));
+      }
+      return;
+    }
+    case "workspace.getDiff": {
+      const session = getSessionOrError(sessionManager, conn, message.sessionId);
+      if (!session) return;
+      try {
+        const diff = await getWorkspaceDiff2(session.cwd, message.path, message.staged);
+        conn.send({
+          type: "workspace.diff",
+          sessionId: message.sessionId,
+          requestId: message.requestId,
+          diff
+        });
+      } catch (err) {
+        conn.send(error(errorMessageOf(err, "failed to read workspace diff")));
+      }
+      return;
+    }
+    case "daemon.getInfo": {
+      conn.send({ type: "daemon.info", hostname: hostname3(), daemonFingerprint });
+      return;
+    }
+    case "controller.requestEnrollment": {
+      const result = await pendingAuthorizations.requestEnrollment({
+        publicKeyPem: message.publicKeyPem,
+        label: message.label
+      });
+      if (!result.ok) {
+        conn.send({ type: "controller.enrollmentRejected", reason: result.reason });
+        return;
+      }
+      conn.send({ type: "controller.enrollmentPending", fingerprint: result.pending.fingerprint });
+      if (!result.coalesced) {
+        presentPendingAuthorization(result.pending);
+      }
+      return;
+    }
+  }
+}
+
+// src/security/connection-auth.ts
+import { randomBytes, verify as verify3 } from "crypto";
+var CHALLENGE_LENGTH_BYTES = 32;
+var CONNECTION_ID_LENGTH_BYTES = 24;
+var CHALLENGE_LIFETIME_MS = 3e4;
+var MAX_HANDSHAKE_ATTEMPTS_PER_WINDOW = 30;
+var HANDSHAKE_RATE_LIMIT_WINDOW_MS = 6e4;
+var handshakeAttemptTimestamps = [];
+function isHandshakeRateLimited() {
+  const windowStart = Date.now() - HANDSHAKE_RATE_LIMIT_WINDOW_MS;
+  handshakeAttemptTimestamps = handshakeAttemptTimestamps.filter((t) => t > windowStart);
+  return handshakeAttemptTimestamps.length >= MAX_HANDSHAKE_ATTEMPTS_PER_WINDOW;
+}
+function recordHandshakeAttempt() {
+  handshakeAttemptTimestamps.push(Date.now());
+}
+var ConnectionAuthState = class {
+  constructor(daemonFingerprint) {
+    this.daemonFingerprint = daemonFingerprint;
+    this.connectionId = randomBytes(CONNECTION_ID_LENGTH_BYTES).toString("base64url");
+    this.challenge = randomBytes(CHALLENGE_LENGTH_BYTES).toString("base64url");
+    this.challengeExpiresAt = Date.now() + CHALLENGE_LIFETIME_MS;
+  }
+  connectionId;
+  challenge;
+  challengeExpiresAt;
+  authenticated = null;
+  lastSequence = 0;
+  // BD-487: set synchronously by revocation (server.ts's
+  // revokeControllerConnections/revokeAllConnections, or relay-client.ts's
+  // identically-named functions), checked synchronously again in
+  // router.ts's handleBrowserMessage immediately before dispatch() runs —
+  // closes the gap where a command already past verifyCommand's async
+  // awaits (getTrustedController's disk read, checkAndAdvanceSequence)
+  // would otherwise still execute even though revocation was supposed to
+  // have already ended this connection's authority. Deliberately a plain
+  // synchronous flag, not itself awaited anywhere: the race this closes is
+  // specifically the gap between an async check's awaits, so the fix must
+  // be a check with zero await distance from dispatch(), not another
+  // async lookup that reopens the same kind of window.
+  revoked = false;
+  // Serializes sequence verify-and-advance within this one connection —
+  // without this, two commands signed close together could have their
+  // async verification interleave and both read the same "last sequence"
+  // before either advances it, letting a lower/equal sequence slip through
+  // as if it were the next one. A per-connection promise chain (same
+  // pattern as trusted-controllers.ts's withTrustFileLock, but in-memory
+  // and scoped to one socket instead of a file path) is sufficient — never
+  // contends across connections, and there is no file I/O to race.
+  sequenceChain = Promise.resolve();
+  // Serializes authenticate() the same way sequenceChain serializes
+  // checkAndAdvanceSequence — adversarial review (BD-477 follow-up) found
+  // that two connection.authenticate frames arriving back-to-back on one
+  // socket could both pass the `this.authenticated === null` check before
+  // either reached the assignment at the end of the async verification
+  // chain, since getTrustedController is a real await gap. Both attempts
+  // still require a validly-signed transcript (this was never an auth
+  // bypass), but the second could silently overwrite the first's identity
+  // and double-register the socket in server.ts's connectionsByController
+  // map. Without a chain here, the fix would need a synchronous
+  // compare-and-set instead, which would need to happen before the
+  // signature is even checked — this chain is simpler and matches the
+  // sequence check's own established pattern.
+  authenticateChain = Promise.resolve();
+  getChallenge() {
+    return {
+      connectionId: this.connectionId,
+      challenge: this.challenge,
+      expiresAt: this.challengeExpiresAt
+    };
+  }
+  isAuthenticated() {
+    return this.authenticated !== null;
+  }
+  /** BD-487: marks this connection's authority as ended — called by revocation, checked by router.ts immediately before dispatch(). Idempotent; a connection is never un-revoked. */
+  revoke() {
+    this.revoked = true;
+  }
+  isRevoked() {
+    return this.revoked;
+  }
+  /** The controller/account this connection authenticated as, or null before a successful handshake. Used by verify-command.ts to reject an envelope signed by a DIFFERENT controller than the one that authenticated this connection. */
+  getAuthenticatedIdentity() {
+    return this.authenticated;
+  }
+  /**
+   * Verifies a signed connection-handshake transcript and, on success,
+   * marks this connection authenticated — exactly once, including under
+   * concurrent calls. A second call (whether the first succeeded or
+   * failed, and regardless of whether the two calls overlap in time) is
+   * rejected with "already_authenticated": the challenge is bound to this
+   * ConnectionAuthState instance and is never reissued or extended, so a
+   * duplicate, delayed, or concurrent handshake attempt can never
+   * re-authenticate or reset this connection's sequence counter.
+   *
+   * Serialized via authenticateChain (same pattern as
+   * checkAndAdvanceSequence's sequenceChain) so two connection.authenticate
+   * frames arriving close together on one socket can't both observe
+   * `this.authenticated === null` before either finishes — without this,
+   * both could pass the guard, both complete real signature verification
+   * (this was never an auth bypass on its own), and the second's
+   * assignment would silently overwrite the first's, double-registering
+   * the socket under two controller identities.
+   *
+   * Checks run in a fixed order regardless of which field is
+   * attacker-controlled, matching verify-command.ts's own discipline:
+   * connection binding and freshness are checked before the signature is
+   * even verified (they're cheap, local, and don't leak anything about
+   * controller trust), then the signature, then controller trust —
+   * signature must pass before ANY other field of the transcript is
+   * trusted for a decision, since those fields are attacker-controlled
+   * until the signature over the whole transcript is checked.
+   */
+  authenticate(signed, trustedControllersPath) {
+    const task = this.authenticateChain.then(
+      () => this.authenticateOnce(signed, trustedControllersPath)
+    );
+    this.authenticateChain = task.catch(() => {
+    });
+    return task;
+  }
+  async authenticateOnce(signed, trustedControllersPath) {
+    if (this.authenticated) {
+      return { ok: false, reason: "already_authenticated" };
+    }
+    if (isHandshakeRateLimited()) {
+      return { ok: false, reason: "rate_limited" };
+    }
+    recordHandshakeAttempt();
+    const { transcript, signature } = signed;
+    if (transcript.purpose !== CONNECTION_CHALLENGE_PURPOSE) {
+      return { ok: false, reason: "bad_signature" };
+    }
+    if (transcript.connectionId !== this.connectionId || transcript.challenge !== this.challenge) {
+      return { ok: false, reason: "wrong_connection" };
+    }
+    if (Date.now() >= this.challengeExpiresAt) {
+      return { ok: false, reason: "challenge_expired" };
+    }
+    if (transcript.daemonFingerprint !== this.daemonFingerprint) {
+      return { ok: false, reason: "wrong_daemon" };
+    }
+    const controller = await getTrustedController(transcript.controllerId, trustedControllersPath);
+    if (!controller) {
+      return { ok: false, reason: "untrusted_controller" };
+    }
+    let signatureValid;
+    try {
+      signatureValid = verify3(
+        "sha256",
+        Buffer.from(canonicalize(transcript), "utf8"),
+        // WebCrypto's ECDSA signatures are raw r||s (IEEE P1363), not the
+        // DER encoding node:crypto defaults to for EC keys — matches
+        // verify-command.ts's and pairing.ts's identical handling.
+        { key: controller.publicKeyPem, dsaEncoding: "ieee-p1363" },
+        Buffer.from(signature, "base64")
+      );
+    } catch {
+      signatureValid = false;
+    }
+    if (!signatureValid) {
+      return { ok: false, reason: "bad_signature" };
+    }
+    this.authenticated = { controllerId: transcript.controllerId, accountId: transcript.accountId };
+    recordControllerHandshake(transcript.controllerId, trustedControllersPath).catch(
+      (err) => {
+        console.error("Failed to record controller handshake (non-fatal)", err);
+      }
+    );
+    return { ok: true, controllerId: transcript.controllerId, accountId: transcript.accountId };
+  }
+  /**
+   * Verifies a command envelope's sequence number is strictly greater than
+   * the last one accepted on THIS connection, then advances the
+   * counter — serialized via sequenceChain so two verify calls racing
+   * close together can never both read the same lastSequence before
+   * either advances it. Must only be called for an envelope whose
+   * connectionId has already been confirmed to match this connection
+   * (router.ts checks that before calling this) and whose controllerId
+   * matches this connection's authenticated controller (same caller
+   * responsibility) — this method only ever checks the sequence number
+   * itself, not connection/controller binding, which is the caller's job.
+   */
+  async checkAndAdvanceSequence(sequence) {
+    if (!this.authenticated) {
+      return { ok: false, reason: "not_authenticated" };
+    }
+    const task = this.sequenceChain.then(() => {
+      if (sequence <= this.lastSequence) {
+        return { ok: false, reason: "replayed" };
+      }
+      this.lastSequence = sequence;
+      return { ok: true };
+    });
+    this.sequenceChain = task.catch(() => {
+    });
+    return task;
+  }
+};
+
+// src/relay/relay-session-registry.ts
+var MAX_CONCURRENT_RELAY_SESSIONS = 32;
+var RelaySessionRegistry = class {
+  byRelaySessionId = /* @__PURE__ */ new Map();
+  /** True if a NEW entry cannot be created right now — does not apply to a duplicate create() for an already-tracked relaySessionId, which stays idempotent regardless of the cap. */
+  isAtCapacity() {
+    return this.byRelaySessionId.size >= MAX_CONCURRENT_RELAY_SESSIONS;
+  }
+  create(relaySessionId, daemonFingerprint, buildConn) {
+    const connectionAuth = new ConnectionAuthState(daemonFingerprint);
+    const { conn, releaseAllSubscriptions } = buildConn(connectionAuth);
+    const entry = {
+      relaySessionId,
+      connectionAuth,
+      conn,
+      releaseAllSubscriptions
+    };
+    this.byRelaySessionId.set(relaySessionId, entry);
+    return entry;
+  }
+  get(relaySessionId) {
+    return this.byRelaySessionId.get(relaySessionId);
+  }
+  /** Releases pty subscriptions and removes the entry — called on relay.sessionClosed (relay-initiated) or when this daemon itself gives up on a session (relay.closeSession). */
+  delete(relaySessionId) {
+    const entry = this.byRelaySessionId.get(relaySessionId);
+    if (!entry) return;
+    entry.releaseAllSubscriptions();
+    this.byRelaySessionId.delete(relaySessionId);
+  }
+  /** Every currently-tracked relaySessionId — used to tear all of them down at once on a full relay-socket reconnect (a fresh outbound connection means a fresh relay.register, and the relay itself already invalidates every session bound to the old registration on its side). */
+  deleteAll() {
+    for (const relaySessionId of [...this.byRelaySessionId.keys()]) {
+      this.delete(relaySessionId);
+    }
+  }
+  /** Every currently-tracked entry — used to fan a SessionManager broadcast (session.updated etc.) out to every relay-connected browser session, mirroring server.ts's own wss.clients iteration for the inbound listener. */
+  values() {
+    return [...this.byRelaySessionId.values()];
+  }
+};
+
+// src/relay/relay-client.ts
+var RECONNECT_BASE_DELAY_MS = 1e3;
+var RECONNECT_MAX_DELAY_MS = 3e4;
+function signTranscript(transcript, privateKeyPem) {
+  return sign(null, Buffer.from(canonicalize(transcript), "utf8"), privateKeyPem).toString(
+    "base64"
+  );
+}
+function startRelayClient(deps) {
+  const sessions = new RelaySessionRegistry();
+  let stopped = false;
+  let socket;
+  let reconnectAttempt = 0;
+  let reconnectTimer;
+  function broadcast(message) {
+    for (const entry of sessions.values()) {
+      entry.conn.send(message);
+    }
+  }
+  const routerDeps = { ...deps, broadcast };
+  function revokeSession(relaySessionId) {
+    sessions.get(relaySessionId)?.connectionAuth.revoke();
+    if (socket) send(socket, { type: "relay.closeSession", relaySessionId });
+    sessions.delete(relaySessionId);
+  }
+  function revokeControllerConnections(controllerId) {
+    for (const entry of sessions.values()) {
+      if (entry.connectionAuth.getAuthenticatedIdentity()?.controllerId === controllerId) {
+        revokeSession(entry.relaySessionId);
+      }
+    }
+  }
+  function revokeAllConnections() {
+    for (const entry of sessions.values()) {
+      revokeSession(entry.relaySessionId);
+    }
+  }
+  function scheduleReconnect() {
+    if (stopped) return;
+    const base = deps.reconnectBaseDelayMs ?? RECONNECT_BASE_DELAY_MS;
+    const max = deps.reconnectMaxDelayMs ?? RECONNECT_MAX_DELAY_MS;
+    const delay = Math.min(base * 2 ** reconnectAttempt, max);
+    reconnectAttempt += 1;
+    reconnectTimer = setTimeout(() => connect(), delay);
+    deps.onCycleSettled?.();
+  }
+  function send(ws, message) {
+    if (ws.readyState === ws.OPEN) ws.send(JSON.stringify(message));
+  }
+  function buildRouterConnection(relaySessionId, ws, connectionAuth) {
+    return createRouterConnection(
+      connectionAuth,
+      (message) => {
+        const frame = { relaySessionId, payload: message };
+        send(ws, { type: "relay.frame", frame });
+      },
+      () => {
+      },
+      deps.ptyAttachments
+    );
+  }
+  function handleSessionOpened(ws, relaySessionId) {
+    if (sessions.get(relaySessionId)) {
+      send(ws, { type: "relay.sessionOpenAck", relaySessionId });
+      return;
+    }
+    if (sessions.isAtCapacity()) {
+      console.error(
+        `relay-client: refusing relay.sessionOpened for ${relaySessionId} \u2014 at MAX_CONCURRENT_RELAY_SESSIONS cap`
+      );
+      return;
+    }
+    sessions.create(
+      relaySessionId,
+      deps.daemonFingerprint,
+      (connectionAuth) => buildRouterConnection(relaySessionId, ws, connectionAuth)
+    );
+    const entry = sessions.get(relaySessionId);
+    send(ws, { type: "relay.sessionOpenAck", relaySessionId });
+    const challenge = entry.connectionAuth.getChallenge();
+    entry.conn.send({
+      type: "connection.challenge",
+      connectionId: challenge.connectionId,
+      challenge: challenge.challenge,
+      daemonFingerprint: deps.daemonFingerprint,
+      hostname: deps.hostname(),
+      expiresAt: challenge.expiresAt
+    });
+  }
+  function handleFrame(frame) {
+    const entry = sessions.get(frame.relaySessionId);
+    if (!entry) return;
+    handleBrowserMessage(entry.conn, frame.payload, routerDeps).catch((err) => {
+      console.error("relay-client: unhandled error in handleBrowserMessage", err);
+      entry.conn.send({
+        type: "error",
+        message: err instanceof Error ? err.message : "internal error"
+      });
+    });
+  }
+  function connect() {
+    if (stopped) return;
+    const ws = new WebSocket(`${deps.relayUrl}/relay/daemon`);
+    socket = ws;
+    ws.on("message", (raw) => {
+      let parsed;
+      try {
+        parsed = JSON.parse(raw.toString());
+      } catch {
+        return;
+      }
+      const result = relayToDaemonMessageSchema.safeParse(parsed);
+      if (!result.success) return;
+      const message = result.data;
+      switch (message.type) {
+        case "relay.challenge": {
+          const transcript = {
+            version: 1,
+            purpose: RELAY_REGISTER_PURPOSE,
+            challenge: message.challenge,
+            daemonFingerprint: deps.daemonFingerprint,
+            issuedAt: Date.now(),
+            expiresAt: message.expiresAt,
+            relayAudience: message.relayAudience
+          };
+          send(ws, {
+            type: "relay.register",
+            signed: {
+              daemonPublicKeyPem: deps.daemonPublicKeyPem,
+              transcript,
+              signature: signTranscript(transcript, deps.daemonPrivateKeyPem)
+            }
+          });
+          return;
+        }
+        case "relay.registered": {
+          reconnectAttempt = 0;
+          deps.onCycleSettled?.();
+          return;
+        }
+        case "relay.registrationFailed": {
+          console.error(`relay-client: registration failed (${message.reason})`);
+          ws.close();
+          return;
+        }
+        case "relay.sessionOpened": {
+          handleSessionOpened(ws, message.relaySessionId);
+          return;
+        }
+        case "relay.sessionClosed": {
+          sessions.delete(message.relaySessionId);
+          return;
+        }
+        case "relay.frame": {
+          handleFrame(message.frame);
+          return;
+        }
+      }
+    });
+    ws.on("error", () => {
+    });
+    ws.on("close", () => {
+      sessions.deleteAll();
+      if (socket === ws) socket = void 0;
+      scheduleReconnect();
+    });
+  }
+  connect();
+  return {
+    stop: () => {
+      stopped = true;
+      if (reconnectTimer) clearTimeout(reconnectTimer);
+      sessions.deleteAll();
+      socket?.close();
+    },
+    broadcast,
+    revokeControllerConnections,
+    revokeAllConnections
+  };
+}
+
+// src/security/daemon-identity.ts
+import { generateKeyPairSync, sign as sign2, verify as verify4 } from "crypto";
+import { mkdir as mkdir2, readFile as readFile2, rename as rename2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, join as join2 } from "path";
+function defaultCredentialsPath() {
+  return join2(homedir2(), ".bondsmith", "credentials");
+}
+async function loadOrCreateDaemonIdentity(credentialsPath = defaultCredentialsPath()) {
+  const existing = await tryReadIdentity(credentialsPath);
+  if (existing) return existing;
+  const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+  const identity = {
+    publicKeyPem: publicKey.export({ type: "spki", format: "pem" }).toString(),
+    privateKeyPem: privateKey.export({ type: "pkcs8", format: "pem" }).toString()
+  };
+  await persistIdentity(credentialsPath, identity);
+  return identity;
+}
+async function persistIdentity(credentialsPath, identity) {
+  await mkdir2(dirname2(credentialsPath), { recursive: true });
+  const tmpPath = `${credentialsPath}.tmp-${process.pid}-${Date.now()}`;
+  try {
+    await writeFile2(tmpPath, `${identity.privateKeyPem}${identity.publicKeyPem}`, { mode: 384 });
+    await rename2(tmpPath, credentialsPath);
+  } catch (error2) {
+    await rm2(tmpPath, { force: true });
+    throw error2;
+  }
+}
+async function tryReadIdentity(credentialsPath) {
+  let raw;
+  try {
+    raw = await readFile2(credentialsPath, "utf8");
+  } catch {
+    return null;
+  }
+  const privateKeyPem = extractPemBlock(raw, "PRIVATE KEY");
+  const publicKeyPem = extractPemBlock(raw, "PUBLIC KEY");
+  if (!privateKeyPem || !publicKeyPem) {
+    throw new Error(
+      `daemon-identity: credentials file at ${credentialsPath} exists but is missing a PEM block \u2014 refusing to silently regenerate a file that may already be paired. Move or delete it manually to re-pair.`
+    );
+  }
+  if (!isMatchingKeyPair(publicKeyPem, privateKeyPem)) {
+    throw new Error(
+      `daemon-identity: credentials file at ${credentialsPath} has a private key and public key that don't correspond to the same keypair \u2014 refusing to use a mismatched identity. Move or delete it manually to re-pair.`
+    );
+  }
+  return { publicKeyPem, privateKeyPem };
+}
+function isMatchingKeyPair(publicKeyPem, privateKeyPem) {
+  const probe = Buffer.from("daemon-identity-keypair-check");
+  try {
+    const signature = sign2(null, probe, privateKeyPem);
+    return verify4(null, probe, publicKeyPem, signature);
+  } catch {
+    return false;
+  }
+}
+function extractPemBlock(text, label) {
+  const pattern = new RegExp(`-----BEGIN ${label}-----[\\s\\S]*?-----END ${label}-----\\n?`);
+  return text.match(pattern)?.[0] ?? null;
+}
+
+// src/security/dev-tunnel-token-file.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import { mkdir as mkdir3, readFile as readFile3, rename as rename3, rm as rm3, writeFile as writeFile3 } from "fs/promises";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname3, join as join3 } from "path";
+function defaultDevTunnelTokenPath() {
+  return join3(homedir3(), ".bondsmith", "dev-tunnel-token");
+}
+async function loadOrCreateDevTunnelToken(tokenPath = defaultDevTunnelTokenPath()) {
+  const existing = await tryReadToken(tokenPath);
+  if (existing) return existing;
+  const token = randomBytes2(32).toString("base64url");
+  await persistToken(tokenPath, token);
+  return token;
+}
+async function tryReadToken(tokenPath) {
+  try {
+    const raw = await readFile3(tokenPath, "utf8");
+    const trimmed = raw.trim();
+    return trimmed.length > 0 ? trimmed : null;
+  } catch {
+    return null;
+  }
+}
+async function persistToken(tokenPath, token) {
+  await mkdir3(dirname3(tokenPath), { recursive: true });
+  const tmpPath = `${tokenPath}.tmp-${process.pid}-${Date.now()}`;
+  try {
+    await writeFile3(tmpPath, token, { mode: 384 });
+    await rename3(tmpPath, tokenPath);
+  } catch (error2) {
+    await rm3(tmpPath, { force: true });
+    throw error2;
+  }
+}
+
+// src/security/pending-authorizations.ts
+import { createHash, randomUUID } from "crypto";
+function controllerIdFromPublicKeySync(publicKeyPem) {
+  return createHash("sha256").update(publicKeyPem).digest("hex").slice(0, 32);
+}
+var REQUEST_EXPIRY_MS = 5 * 6e4;
+var MAX_REQUESTS_PER_WINDOW = 5;
+var RATE_LIMIT_WINDOW_MS = 6e4;
+var PendingAuthorizationStore = class {
+  // Invariant: at most one PendingEntry per controllerId at any time. A
+  // conflicting requestEnrollment call for a controllerId that already has
+  // a live (unsettled) entry coalesces onto it rather than replacing it —
+  // there is never a window where two different PendingAuthorization
+  // instances for the same controllerId both hold outstanding promises,
+  // which is exactly what would let a late response to a stale request
+  // resolve a newer, unrelated one.
+  pending = /* @__PURE__ */ new Map();
+  requestTimestamps = /* @__PURE__ */ new Map();
+  isInteractive;
+  trustedControllersPath;
+  constructor(options = {}) {
+    this.isInteractive = options.isInteractive ?? (() => process.stdin.isTTY === true);
+    this.trustedControllersPath = options.trustedControllersPath;
+  }
+  /**
+   * Registers a new enrollment request, or coalesces onto the existing
+   * pending entry if an identical request (same public key) is already
+   * pending — coalescing avoids re-prompting the terminal for a requester
+   * that retries before the user has responded, and shares the exact same
+   * `result` promise so both callers observe the same eventual outcome.
+   *
+   * Fails closed with "not_interactive" if bondsmithd has no TTY attached:
+   * this must never silently fall back to any cloud-side approval path.
+   *
+   * The pending-entry slot (and its result promise/settle function) is
+   * claimed synchronously, before the only `await` in this method
+   * (formatDaemonFingerprint's WebCrypto digest) and before the terminal
+   * prompt is ever displayed — two concurrent requests for the same
+   * public key can otherwise both observe "no existing entry" before
+   * either has written one (server.ts's message handler doesn't await
+   * handleBrowserMessage, so two in-flight calls for the same connection
+   * or two different connections genuinely interleave), each computing
+   * coalesced: false and each triggering a terminal prompt — exactly the
+   * double-prompt the coalescing check exists to prevent. Registering the
+   * promise before the prompt is displayed also closes a narrower race: a
+   * caller awaiting `result` immediately after a synchronous-looking
+   * `requestEnrollment` return could otherwise miss an extremely fast
+   * resolution.
+   */
+  async requestEnrollment(params) {
+    if (!this.isInteractive()) {
+      return { ok: false, reason: "not_interactive" };
+    }
+    const controllerId = controllerIdFromPublicKeySync(params.publicKeyPem);
+    const existing = this.pending.get(controllerId);
+    if (existing && !existing.settled && existing.authorization.expiresAt > Date.now()) {
+      return {
+        ok: true,
+        pending: existing.authorization,
+        coalesced: true,
+        result: existing.resultPromise
+      };
+    }
+    if (this.isRateLimited(controllerId)) {
+      return { ok: false, reason: "rate_limited" };
+    }
+    this.recordRequestTimestamp(controllerId);
+    const now = Date.now();
+    const authorization = {
+      controllerId,
+      publicKeyPem: params.publicKeyPem,
+      label: params.label,
+      fingerprint: "",
+      requestedAt: now,
+      expiresAt: now + REQUEST_EXPIRY_MS,
+      requestToken: randomUUID()
+    };
+    let settleFn;
+    const resultPromise = new Promise((resolve) => {
+      settleFn = resolve;
+    });
+    const entry = {
+      authorization,
+      resultPromise,
+      settle: (outcome) => {
+        if (entry.settled) return;
+        entry.settled = true;
+        clearTimeout(entry.expiryTimer);
+        settleFn(outcome);
+      },
+      settled: false,
+      // Fails closed on its own if nobody ever answers — resolve() is
+      // never called (e.g. bondsmithd exits before the user responds
+      // would already tear this down via shutdown handling; this timer
+      // covers the plain "nobody typed anything" case).
+      expiryTimer: setTimeout(() => {
+        this.pending.delete(controllerId);
+        entry.settle("expired");
+      }, REQUEST_EXPIRY_MS)
+    };
+    this.pending.set(controllerId, entry);
+    authorization.fingerprint = await formatDaemonFingerprint(params.publicKeyPem);
+    return { ok: true, pending: authorization, coalesced: false, result: resultPromise };
+  }
+  /**
+   * Resolves a pending authorization. On approve, mutates the trusted set
+   * (persisting the exact publicKeyPem/label captured at request time —
+   * the same values whose fingerprint was shown to the user, so there is
+   * no gap between what was displayed and what gets trusted); on deny or
+   * expiry, just drops the pending entry. Callers must not surface a
+   * distinguishable signal to the ORIGINAL REQUESTER (e.g. over WS, for
+   * second-controller enrollment) between denied/expired/still-pending —
+   * the requester's next enrollment attempt or command simply continues
+   * to see no trust. This is separate from the `result` promise returned
+   * by requestEnrollment, which DOES carry the explicit outcome — that
+   * promise is for the daemon-local caller driving the approval flow
+   * (e.g. initial pairing blocking on it), never relayed back over the
+   * network to the browser that requested enrollment.
+   *
+   * `requestToken` must match the token on the PendingAuthorization this
+   * caller was originally handed (from requestEnrollment's `pending`
+   * field) — a stale/late answer for a request that has since expired or
+   * been replaced by a new one for the same controllerId will find the
+   * token no longer matches the current entry and safely no-op, rather
+   * than approving whatever request happens to be live under that
+   * controllerId now. This is the fix for a real race: two requests for
+   * the same public key, one expired and later answered, must never be
+   * able to approve the other.
+   */
+  async resolve(controllerId, requestToken, approved) {
+    const entry = this.pending.get(controllerId);
+    if (!entry || entry.settled || entry.authorization.requestToken !== requestToken) return;
+    this.pending.delete(controllerId);
+    if (entry.authorization.expiresAt <= Date.now()) {
+      entry.settle("expired");
+      return;
+    }
+    if (approved) {
+      await addTrustedController(
+        { publicKeyPem: entry.authorization.publicKeyPem, label: entry.authorization.label },
+        this.trustedControllersPath
+      );
+      entry.settle("approved");
+    } else {
+      entry.settle("denied");
+    }
+  }
+  /**
+   * Settles every still-pending authorization as "cancelled" — called on
+   * daemon shutdown or when the terminal/stdin closes mid-prompt, so any
+   * caller blocking on a `result` promise (initial pairing, in
+   * particular) fails closed rather than hanging forever.
+   */
+  cancelAll() {
+    for (const [controllerId, entry] of this.pending) {
+      this.pending.delete(controllerId);
+      entry.settle("cancelled");
+    }
+  }
+  isRateLimited(controllerId) {
+    const timestamps = this.requestTimestamps.get(controllerId) ?? [];
+    const windowStart = Date.now() - RATE_LIMIT_WINDOW_MS;
+    const recent = timestamps.filter((t) => t > windowStart);
+    return recent.length >= MAX_REQUESTS_PER_WINDOW;
+  }
+  recordRequestTimestamp(controllerId) {
+    const windowStart = Date.now() - RATE_LIMIT_WINDOW_MS;
+    const timestamps = (this.requestTimestamps.get(controllerId) ?? []).filter(
+      (t) => t > windowStart
+    );
+    timestamps.push(Date.now());
+    this.requestTimestamps.set(controllerId, timestamps);
+  }
+};
+
+// src/security/revocation-sync.ts
+var POLL_INTERVAL_MS = 3e4;
+var POLL_JITTER_MS = 6e3;
+var POLL_REQUEST_TIMEOUT_MS = 1e4;
+var BACKOFF_BASE_MS = 2e3;
+var BACKOFF_MAX_MS = 2e4;
+var MAX_CONSECUTIVE_FAILURE_BACKOFFS = 4;
+function jitteredInterval(deps) {
+  const interval = deps.pollIntervalMs ?? POLL_INTERVAL_MS;
+  const jitter = deps.pollJitterMs ?? POLL_JITTER_MS;
+  return interval + Math.floor(Math.random() * jitter);
+}
+async function withTimeout(promise, ms) {
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new TRPCCallError("revocation poll timed out", "timeout")), ms);
+  });
+  try {
+    return await Promise.race([promise, timeout]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function pollOnce(deps) {
+  const trusted = await loadTrustedControllers(deps.trustedControllersPath);
+  if (trusted.length === 0) return true;
+  let response;
+  try {
+    response = await withTimeout(
+      callTRPCQuery(
+        deps.apiUrl,
+        "daemonPairing.checkRevocationStatus",
+        {
+          daemonPublicKey: deps.daemonPublicKey,
+          controllerPublicKeys: trusted.map((c) => c.publicKeyPem)
+        }
+      ),
+      deps.pollRequestTimeoutMs ?? POLL_REQUEST_TIMEOUT_MS
+    );
+  } catch {
+    return false;
+  }
+  if (response.pairingRevoked) {
+    await revokeAllTrustedControllers(deps.trustedControllersPath);
+    deps.revokeAllConnections();
+    return true;
+  }
+  for (const publicKeyPem of response.revokedControllerPublicKeys) {
+    const controllerId = await controllerIdFromPublicKeyPem(publicKeyPem);
+    await revokeTrustedController(controllerId, deps.trustedControllersPath);
+    deps.revokeControllerConnections(controllerId);
+  }
+  return true;
+}
+function startRevocationSync(deps) {
+  let stopped = false;
+  let timer;
+  const status = {
+    lastSuccessfulSyncAt: null,
+    degraded: false,
+    consecutiveFailures: 0
+  };
+  function reportStatus() {
+    deps.onStatusChange?.({ ...status });
+  }
+  async function tick() {
+    if (stopped) return;
+    let succeeded;
+    try {
+      succeeded = await pollOnce(deps);
+    } catch (err) {
+      console.error("revocation-sync: unexpected error during poll", err);
+      succeeded = false;
+    }
+    if (stopped) return;
+    if (succeeded) {
+      status.lastSuccessfulSyncAt = /* @__PURE__ */ new Date();
+      status.degraded = false;
+      status.consecutiveFailures = 0;
+      reportStatus();
+      timer = setTimeout(() => void tickAndReport(), jitteredInterval(deps));
+      return;
+    }
+    status.consecutiveFailures += 1;
+    status.degraded = status.consecutiveFailures >= 2;
+    reportStatus();
+    const backoffBase = deps.backoffBaseMs ?? BACKOFF_BASE_MS;
+    const backoffMax = deps.backoffMaxMs ?? BACKOFF_MAX_MS;
+    const backoffIndex = Math.min(status.consecutiveFailures, MAX_CONSECUTIVE_FAILURE_BACKOFFS);
+    const backoffMs = Math.min(backoffBase * 2 ** (backoffIndex - 1), backoffMax);
+    timer = setTimeout(() => void tickAndReport(), backoffMs);
+  }
+  async function tickAndReport() {
+    await tick();
+    deps.onTickSettled?.();
+  }
+  void tickAndReport();
+  return {
+    stop: () => {
+      stopped = true;
+      if (timer) clearTimeout(timer);
+    }
+  };
+}
+
+// src/security/terminal-approval.ts
+import { createInterface } from "readline";
+function presentPendingAuthorizationOnTerminal(store) {
+  return (pending) => {
+    console.log("");
+    console.log("  Bondsmith controller authorization request");
+    console.log(`  Browser:     ${pending.label}`);
+    console.log(`  Fingerprint: ${pending.fingerprint}`);
+    console.log("");
+    console.log("  Allow this browser to control local sessions? [y/N]");
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    rl.question("  > ", (answer) => {
+      rl.close();
+      const approved = answer.trim().toLowerCase() === "y";
+      store.resolve(pending.controllerId, pending.requestToken, approved).catch((error2) => {
+        console.error("Failed to record controller authorization decision", error2);
+      });
+      console.log(approved ? "  Approved." : "  Denied.");
+      console.log("");
+    });
+  };
+}
+
+// src/sessions/git/client.ts
+import { execFile as execFileCb2 } from "child_process";
+import { promisify as promisify2 } from "util";
+var execFile2 = promisify2(execFileCb2);
+var GitNotARepoError = class extends Error {
+  constructor() {
+    super("not a git repository");
+    this.name = "GitNotARepoError";
+  }
+};
+function isNotARepoError(error2) {
+  if (typeof error2 !== "object" || error2 === null) return false;
+  const stderr = error2.stderr;
+  return typeof stderr === "string" && stderr.includes("not a git repository");
+}
+async function runGit(args, cwd) {
+  try {
+    const { stdout } = await execFile2("git", args, { cwd });
+    return stdout;
+  } catch (error2) {
+    if (isNotARepoError(error2)) throw new GitNotARepoError();
+    throw error2;
+  }
+}
+async function runGitAllowingExitCodes(args, cwd, allowedExitCodes) {
+  try {
+    const { stdout } = await execFile2("git", args, { cwd });
+    return stdout;
+  } catch (error2) {
+    if (isNotARepoError(error2)) throw new GitNotARepoError();
+    const code = error2.code;
+    const stdout = error2.stdout;
+    if (typeof code === "number" && allowedExitCodes.includes(code) && typeof stdout === "string") {
+      return stdout;
+    }
+    throw error2;
+  }
+}
+
+// src/sessions/git/diff.ts
+async function getWorkspaceDiff(cwd, path, staged) {
+  const numstatArgs = staged ? ["diff", "--cached", "--numstat", "--", path] : ["diff", "--numstat", "--", path];
+  const numstat = await runGit(numstatArgs, cwd);
+  const binary = /^(-\t-\t)/.test(numstat.trim());
+  if (binary) {
+    return { path, staged, patch: null, binary: true };
+  }
+  const diffArgs = staged ? ["diff", "--cached", "--", path] : ["diff", "--", path];
+  let patch = await runGit(diffArgs, cwd);
+  if (patch.trim() === "" && !staged) {
+    patch = await runGitAllowingExitCodes(["diff", "--no-index", "--", "/dev/null", path], cwd, [
+      1
+    ]).catch(() => "");
+  }
+  return { path, staged, patch: patch || null, binary: false };
+}
+
+// src/sessions/git/status.ts
+async function getCurrentBranch(cwd) {
+  try {
+    const out = (await runGit(["rev-parse", "--abbrev-ref", "HEAD"], cwd)).trim();
+    return out === "" || out === "HEAD" ? null : out;
+  } catch (err) {
+    if (err instanceof GitNotARepoError) return null;
+    throw err;
+  }
+}
+async function getRepositoryFullName(cwd) {
+  let url;
+  try {
+    url = (await runGit(["remote", "get-url", "origin"], cwd)).trim();
+  } catch {
+    return null;
+  }
+  if (!url) return null;
+  const match = /[:/]([^/:]+\/[^/]+?)(\.git)?$/.exec(url);
+  return match?.[1] ?? null;
+}
+async function isGitRepo(cwd) {
+  try {
+    await runGit(["rev-parse", "--is-inside-work-tree"], cwd);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function parseNumstat(output) {
+  const map = /* @__PURE__ */ new Map();
+  const fields = output.split("\0").filter((f) => f.length > 0);
+  let i = 0;
+  while (i < fields.length) {
+    const line = fields[i];
+    const match = /^(-|\d+)\t(-|\d+)\t(.*)$/.exec(line);
+    if (!match) {
+      i++;
+      continue;
+    }
+    const [, addStr, delStr, path] = match;
+    const binary = addStr === "-" || delStr === "-";
+    let finalPath = path ?? "";
+    if (finalPath === "") {
+      i++;
+      i++;
+      finalPath = fields[i] ?? "";
+    }
+    map.set(finalPath, {
+      additions: binary ? null : Number(addStr),
+      deletions: binary ? null : Number(delStr),
+      binary
+    });
+    i++;
+  }
+  return map;
+}
+var STATUS_CODE_MAP = {
+  A: "added",
+  M: "modified",
+  D: "deleted",
+  R: "renamed",
+  C: "copied",
+  U: "modified"
+  // unmerged — treated as modified, no conflict-resolution UI in scope
+};
+async function getWorkspaceStatus(cwd) {
+  const branch = await getCurrentBranch(cwd);
+  if (branch === null && !await isGitRepo(cwd)) {
+    return { isGitRepo: false, branch: null, files: [] };
+  }
+  const [porcelain, unstagedRaw, stagedRaw] = await Promise.all([
+    runGit(["status", "--porcelain=v1", "-z"], cwd),
+    runGit(["diff", "--numstat", "-z"], cwd),
+    runGit(["diff", "--cached", "--numstat", "-z"], cwd)
+  ]);
+  const unstagedNumstat = parseNumstat(unstagedRaw);
+  const stagedNumstat = parseNumstat(stagedRaw);
+  const files = parsePorcelain(porcelain, unstagedNumstat, stagedNumstat);
+  return { isGitRepo: true, branch, files };
+}
+function parsePorcelain(porcelain, unstagedNumstat, stagedNumstat) {
+  const entries = [];
+  const fields = porcelain.split("\0").filter((f) => f.length > 0);
+  let i = 0;
+  while (i < fields.length) {
+    const raw = fields[i];
+    const x = raw[0] ?? " ";
+    const y = raw[1] ?? " ";
+    const path = raw.slice(3);
+    i++;
+    if (x === "R" || x === "C" || y === "R" || y === "C") {
+      const previousPath = fields[i];
+      i++;
+      if (previousPath === void 0) continue;
+      pushEntriesForPath(entries, path, x, y, previousPath, unstagedNumstat, stagedNumstat);
+      continue;
+    }
+    pushEntriesForPath(entries, path, x, y, void 0, unstagedNumstat, stagedNumstat);
+  }
+  return entries;
+}
+function pushEntriesForPath(entries, path, x, y, previousPath, unstagedNumstat, stagedNumstat) {
+  if (x === "?" && y === "?") {
+    const numstat = unstagedNumstat.get(path);
+    entries.push({
+      path,
+      status: "untracked",
+      staged: false,
+      additions: numstat?.additions ?? null,
+      deletions: numstat?.deletions ?? null,
+      binary: numstat?.binary ?? false
+    });
+    return;
+  }
+  if (x !== " " && x !== "?") {
+    const numstat = stagedNumstat.get(path);
+    entries.push({
+      path,
+      previousPath,
+      status: STATUS_CODE_MAP[x] ?? "modified",
+      staged: true,
+      additions: numstat?.additions ?? null,
+      deletions: numstat?.deletions ?? null,
+      binary: numstat?.binary ?? false
+    });
+  }
+  if (y !== " " && y !== "?") {
+    const numstat = unstagedNumstat.get(path);
+    entries.push({
+      path,
+      previousPath,
+      status: STATUS_CODE_MAP[y] ?? "modified",
+      staged: false,
+      additions: numstat?.additions ?? null,
+      deletions: numstat?.deletions ?? null,
+      binary: numstat?.binary ?? false
+    });
+  }
+}
+async function enrichSessionWithGitMetadata(session) {
+  const [branch, repositoryFullName, status, lastActivityAt] = await Promise.all([
+    getCurrentBranch(session.cwd),
+    getRepositoryFullName(session.cwd),
+    getWorkspaceStatus(session.cwd),
+    getPaneActivity(session.tmuxSessionName)
+  ]);
+  const changedFileCount = status.isGitRepo ? new Set(status.files.map((f) => f.path)).size : null;
+  return {
+    ...session,
+    branch,
+    repositoryFullName,
+    changedFileCount,
+    lastActivityAt
+  };
+}
+
+// src/ws/server.ts
+import { hostname } from "os";
+import { WebSocketServer } from "ws";
+
+// src/security/dev-tunnel-token.ts
+import { timingSafeEqual } from "crypto";
+function isValidDevTunnelToken(secWebSocketProtocol, expectedToken) {
+  if (!expectedToken) return false;
+  if (!secWebSocketProtocol) return false;
+  const presented = secWebSocketProtocol.split(",")[0]?.trim();
+  if (!presented) return false;
+  const expected = Buffer.from(expectedToken);
+  const actual = Buffer.from(presented);
+  if (expected.length !== actual.length) return false;
+  return timingSafeEqual(expected, actual);
+}
+
+// src/security/origin-check.ts
+function isAllowedOrigin(origin, allowlist) {
+  if (!origin) return false;
+  return allowlist.includes(origin);
+}
+
+// src/sessions/pty-attachment.ts
+import * as pty from "node-pty";
+var PtyAttachmentManager = class {
+  handles = /* @__PURE__ */ new Map();
+  /**
+   * Attempts to attach (spawning a pty if one isn't already running for this
+   * session). Returns false, without throwing, if the pty could not be
+   * spawned — a spawn failure here must never take down the whole daemon
+   * process, since every other session's pty would die with it.
+   */
+  async ensureAttached(sessionId, tmuxSessionName, onData) {
+    let handle = this.handles.get(sessionId);
+    if (!handle) {
+      let ptyProcess;
+      try {
+        ptyProcess = pty.spawn("tmux", ["attach-session", "-t", tmuxSessionName], {
+          name: "xterm-256color",
+          cols: 80,
+          rows: 24,
+          cwd: process.env.HOME,
+          env: filterSpawnEnv(process.env)
+        });
+      } catch {
+        return false;
+      }
+      handle = { process: ptyProcess, refCount: 0, dataListeners: /* @__PURE__ */ new Set() };
+      this.handles.set(sessionId, handle);
+      ptyProcess.onData((data) => {
+        for (const listener of handle?.dataListeners ?? []) listener(data);
+      });
+      ptyProcess.onExit(() => {
+        this.handles.delete(sessionId);
+      });
+      handle.refCount += 1;
+      handle.dataListeners.add(onData);
+      return true;
+    }
+    await this.sendPaneSnapshot(tmuxSessionName, onData);
+    handle.refCount += 1;
+    handle.dataListeners.add(onData);
+    return true;
+  }
+  // Swaps a re-attaching connection's listener in place — avoids killing/respawning the live pty (see router.ts). Returns false if no handle exists.
+  async swapListener(sessionId, tmuxSessionName, previousOnData, nextOnData) {
+    const handle = this.handles.get(sessionId);
+    if (!handle) return false;
+    await this.sendPaneSnapshot(tmuxSessionName, nextOnData);
+    handle.dataListeners.delete(previousOnData);
+    handle.dataListeners.add(nextOnData);
+    return true;
+  }
+  // Best-effort: a capture failure just leaves this listener blank until the next real write.
+  async sendPaneSnapshot(tmuxSessionName, onData) {
+    try {
+      onData(await capturePane(tmuxSessionName));
+    } catch {
+    }
+  }
+  release(sessionId, onData) {
+    const handle = this.handles.get(sessionId);
+    if (!handle) return;
+    handle.dataListeners.delete(onData);
+    handle.refCount -= 1;
+    if (handle.refCount <= 0) {
+      handle.process.kill();
+      this.handles.delete(sessionId);
+    }
+  }
+  write(sessionId, data) {
+    this.handles.get(sessionId)?.process.write(data);
+  }
+  resize(sessionId, cols, rows) {
+    this.handles.get(sessionId)?.process.resize(cols, rows);
+  }
+  isAttached(sessionId) {
+    return this.handles.has(sessionId);
+  }
+  killAll() {
+    for (const handle of this.handles.values()) handle.process.kill();
+    this.handles.clear();
+  }
+};
+
+// src/sessions/session-manager.ts
+import { v4 as uuidv4 } from "uuid";
+
+// src/sessions/tmux/create.ts
+import { access } from "fs/promises";
+import { homedir as homedir4 } from "os";
+import { join as join4 } from "path";
+var InvalidCwdError = class extends Error {
+  constructor(cwd) {
+    super(`working directory does not exist: ${cwd}`);
+    this.name = "InvalidCwdError";
+  }
+};
+function expandHome(cwd) {
+  if (cwd === "~") return homedir4();
+  if (cwd.startsWith("~/")) return join4(homedir4(), cwd.slice(2));
+  return cwd;
+}
+async function createTmuxSession(input) {
+  const cwd = expandHome(input.cwd);
+  try {
+    await access(cwd);
+  } catch {
+    throw new InvalidCwdError(input.cwd);
+  }
+  const tmuxSessionName = tmuxSessionNameFor(input.id);
+  const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+  await runTmux(["new-session", "-d", "-s", tmuxSessionName, "-c", cwd, input.command], {
+    env: filterSpawnEnv(process.env)
+  });
+  await runTmux(["set-option", "-t", tmuxSessionName, "@bondsmith-id", input.id]);
+  await runTmux(["set-option", "-t", tmuxSessionName, "@bondsmith-title", input.title]);
+  await runTmux(["set-option", "-t", tmuxSessionName, "@bondsmith-command", input.command]);
+  await runTmux(["set-option", "-t", tmuxSessionName, "@bondsmith-cwd", cwd]);
+  await runTmux(["set-option", "-t", tmuxSessionName, "@bondsmith-started-at", startedAt]);
+  const session = {
+    id: input.id,
+    title: input.title,
+    command: input.command,
+    cwd,
+    tmuxSessionName,
+    status: "running",
+    startedAt,
+    branch: null,
+    repositoryFullName: null,
+    lastActivityAt: null,
+    changedFileCount: null
+  };
+  return enrichSessionWithGitMetadata(session);
+}
+async function stopTmuxSession(tmuxSessionName) {
+  await runTmux(["kill-session", "-t", tmuxSessionName]);
+}
+
+// src/sessions/tmux/parse.ts
+var FIELD_COUNT = 6;
+function parseTmuxSessions(output) {
+  const sessions = [];
+  for (const line of output.split("\n")) {
+    if (!line.trim()) continue;
+    const fields = line.split("	");
+    if (fields.length < FIELD_COUNT) continue;
+    const [sessionName, id, title, command, cwd, startedAt] = fields;
+    if (!isBondsmithTmuxSessionName(sessionName)) continue;
+    if (!id || !title || !command || !cwd || !startedAt) continue;
+    sessions.push({
+      id,
+      title,
+      command,
+      cwd,
+      tmuxSessionName: sessionName,
+      status: "running",
+      startedAt,
+      branch: null,
+      repositoryFullName: null,
+      lastActivityAt: null,
+      changedFileCount: null
+    });
+  }
+  return sessions;
+}
+
+// src/sessions/tmux/discover.ts
+var LIST_FORMAT = [
+  "#{session_name}",
+  "#{@bondsmith-id}",
+  "#{@bondsmith-title}",
+  "#{@bondsmith-command}",
+  "#{@bondsmith-cwd}",
+  "#{@bondsmith-started-at}"
+].join("	");
+async function discoverSessions() {
+  try {
+    const output = await listTmuxSessions(LIST_FORMAT);
+    const sessions = parseTmuxSessions(output);
+    return Promise.all(sessions.map((session) => enrichSessionWithGitMetadata(session)));
+  } catch (error2) {
+    if (error2 instanceof TmuxNoServerRunningError) return [];
+    throw error2;
+  }
+}
+
+// src/sessions/session-manager.ts
+var SessionManager = class {
+  sessions = /* @__PURE__ */ new Map();
+  listeners = /* @__PURE__ */ new Set();
+  async initialize() {
+    const discovered = await discoverSessions();
+    this.sessions.clear();
+    for (const session of discovered) {
+      this.sessions.set(session.id, session);
+    }
+  }
+  list() {
+    return Array.from(this.sessions.values());
+  }
+  get(sessionId) {
+    return this.sessions.get(sessionId);
+  }
+  onSessionUpdated(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  emitUpdated(session) {
+    for (const listener of this.listeners) listener(session);
+  }
+  async create(input) {
+    const id = uuidv4();
+    const session = await createTmuxSession({ id, ...input });
+    this.sessions.set(id, session);
+    return session;
+  }
+  async stop(sessionId) {
+    const session = this.sessions.get(sessionId);
+    if (!session) return void 0;
+    try {
+      await stopTmuxSession(session.tmuxSessionName);
+    } catch {
+    }
+    return this.removeAsExited(session);
+  }
+  /**
+   * Drops sessions whose underlying tmux session died *without* an explicit
+   * stop (command inside exited on its own, `tmux kill-server`, a reboot).
+   * tmux is the source of truth and the registry is only a cache over it,
+   * so any cached session that no longer exists in tmux is marked exited
+   * and removed.
+   *
+   * Live sessions get their git metadata re-enriched on the same tick so
+   * branch/repo/changedFileCount track reality instead of the snapshot taken
+   * at create/discover — otherwise the associated-work lookup (open PR whose
+   * head = session.branch) stays pinned to a branch the developer already
+   * left. `session.updated` is only emitted when something actually changed,
+   * so an idle session doesn't broadcast every tick.
+   */
+  async reconcile() {
+    let liveSessionNames = /* @__PURE__ */ new Set();
+    try {
+      const output = await listTmuxSessions("#{session_name}");
+      liveSessionNames = new Set(output.split("\n").filter((name) => name.length > 0));
+    } catch (error2) {
+      if (!(error2 instanceof TmuxNoServerRunningError)) return;
+    }
+    await Promise.all(
+      Array.from(this.sessions.values()).map(async (session) => {
+        if (!liveSessionNames.has(session.tmuxSessionName)) {
+          this.removeAsExited(session);
+          return;
+        }
+        try {
+          const updated = await enrichSessionWithGitMetadata(session);
+          if (!gitSnapshotEquals(session, updated)) {
+            this.sessions.set(session.id, updated);
+            this.emitUpdated(updated);
+          }
+        } catch (error2) {
+          console.error("Session git re-enrichment failed", {
+            tmuxSessionName: session.tmuxSessionName,
+            error: error2
+          });
+        }
+      })
+    );
+  }
+  removeAsExited(session) {
+    const updated = { ...session, status: "exited" };
+    this.sessions.delete(session.id);
+    this.emitUpdated(updated);
+    return updated;
+  }
+};
+function gitSnapshotEquals(a, b) {
+  return a.branch === b.branch && a.repositoryFullName === b.repositoryFullName && a.changedFileCount === b.changedFileCount && a.lastActivityAt === b.lastActivityAt;
+}
+
+// src/ws/server.ts
+function createDaemonWebSocketServer(httpServer, config, daemonFingerprint, pendingAuthorizations, presentPendingAuthorization, trustedControllersPath) {
+  const sessionManager = new SessionManager();
+  const ptyAttachments = new PtyAttachmentManager();
+  const connectionsByController = /* @__PURE__ */ new Map();
+  const cleanupBySocket = /* @__PURE__ */ new Map();
+  const connectionAuthBySocket = /* @__PURE__ */ new Map();
+  function registerControllerConnection(controllerId, socket) {
+    let sockets = connectionsByController.get(controllerId);
+    if (!sockets) {
+      sockets = /* @__PURE__ */ new Set();
+      connectionsByController.set(controllerId, sockets);
+    }
+    sockets.add(socket);
+  }
+  function unregisterControllerConnection(socket) {
+    for (const sockets of connectionsByController.values()) {
+      sockets.delete(socket);
+    }
+  }
+  function revokeControllerConnections(controllerId) {
+    const sockets = connectionsByController.get(controllerId);
+    if (!sockets) return;
+    for (const socket of sockets) {
+      connectionAuthBySocket.get(socket)?.revoke();
+      connectionAuthBySocket.delete(socket);
+      cleanupBySocket.get(socket)?.();
+      cleanupBySocket.delete(socket);
+      socket.terminate();
+    }
+    connectionsByController.delete(controllerId);
+  }
+  function revokeAllConnections() {
+    for (const controllerId of [...connectionsByController.keys()]) {
+      revokeControllerConnections(controllerId);
+    }
+  }
+  const rejectionReasonByRequest = /* @__PURE__ */ new WeakMap();
+  const wss = new WebSocketServer({
+    server: httpServer,
+    // Client always sends the dev-tunnel token as the sole entry (see
+    // isValidDevTunnelToken); echoing it back is required for a spec-
+    // compliant handshake once a Sec-WebSocket-Protocol is offered.
+    handleProtocols: (protocols) => protocols.values().next().value ?? false,
+    verifyClient: (info, done) => {
+      if (!isAllowedOrigin(info.origin, config.allowedOrigins)) {
+        rejectionReasonByRequest.set(info.req, "origin_not_allowed");
+      } else if (!isValidDevTunnelToken(info.req.headers["sec-websocket-protocol"], config.devTunnelToken)) {
+        rejectionReasonByRequest.set(info.req, "token_invalid");
+      }
+      done(true);
+    }
+  });
+  function broadcast(message) {
+    const payload = JSON.stringify(message);
+    for (const client of wss.clients) {
+      if (client.readyState === client.OPEN) client.send(payload);
+    }
+  }
+  sessionManager.onSessionUpdated((session) => {
+    broadcast({ type: "session.updated", session });
+  });
+  wss.on("connection", (socket, request) => {
+    const rejectionReason = rejectionReasonByRequest.get(request);
+    if (rejectionReason) {
+      rejectionReasonByRequest.delete(request);
+      socket.send(JSON.stringify({ type: "connection.rejected", reason: rejectionReason }));
+      socket.close();
+      return;
+    }
+    const connectionAuth = new ConnectionAuthState(daemonFingerprint);
+    const { conn, releaseAllSubscriptions } = createRouterConnection(
+      connectionAuth,
+      (message) => {
+        if (socket.readyState === socket.OPEN) socket.send(JSON.stringify(message));
+      },
+      (controllerId) => registerControllerConnection(controllerId, socket),
+      ptyAttachments
+    );
+    cleanupBySocket.set(socket, releaseAllSubscriptions);
+    connectionAuthBySocket.set(socket, connectionAuth);
+    const challenge = connectionAuth.getChallenge();
+    conn.send({
+      type: "connection.challenge",
+      connectionId: challenge.connectionId,
+      challenge: challenge.challenge,
+      daemonFingerprint,
+      hostname: hostname(),
+      expiresAt: challenge.expiresAt
+    });
+    socket.on("message", (raw) => {
+      let parsed;
+      try {
+        parsed = JSON.parse(raw.toString());
+      } catch {
+        conn.send({ type: "error", message: "invalid JSON" });
+        return;
+      }
+      handleBrowserMessage(conn, parsed, {
+        sessionManager,
+        ptyAttachments,
+        broadcast,
+        getWorkspaceStatus,
+        getWorkspaceDiff,
+        hostname: () => hostname(),
+        daemonFingerprint,
+        pendingAuthorizations,
+        presentPendingAuthorization,
+        trustedControllersPath
+      }).catch((err) => {
+        console.error("Unhandled error in handleBrowserMessage", err);
+        conn.send({
+          type: "error",
+          message: err instanceof Error ? err.message : "internal error"
+        });
+      });
+    });
+    socket.on("close", () => {
+      releaseAllSubscriptions();
+      cleanupBySocket.delete(socket);
+      connectionAuthBySocket.delete(socket);
+      unregisterControllerConnection(socket);
+    });
+  });
+  return {
+    sessionManager,
+    ptyAttachments,
+    wss,
+    // Exposed for revocation-sync.ts (BD-434) — the poll loop calls these
+    // once it observes a controller/pairing was revoked in the cloud, so
+    // an already-open connection is torn down immediately rather than
+    // only failing its next signed command.
+    revokeControllerConnections,
+    revokeAllConnections
+  };
+}
+
+// src/index.ts
+function loadRepoRootEnv() {
+  const repoRoot = join5(dirname4(fileURLToPath(import.meta.url)), "..", "..", "..");
+  if (!existsSync(join5(repoRoot, "pnpm-workspace.yaml"))) return;
+  const envLocal = join5(repoRoot, ".env.local");
+  const envDefault = join5(repoRoot, ".env");
+  loadEnv({ path: existsSync(envLocal) ? envLocal : envDefault });
+}
+loadRepoRootEnv();
+async function start() {
+  let config = getDaemonConfig();
+  if (!config.devTunnelToken) {
+    const generatedToken = await loadOrCreateDevTunnelToken();
+    config = { ...config, devTunnelToken: generatedToken };
+  }
+  const identity = await loadOrCreateDaemonIdentity();
+  const daemonFingerprint = await formatDaemonFingerprint(identity.publicKeyPem);
+  const pendingAuthorizations = new PendingAuthorizationStore();
+  const presentPendingAuthorization = presentPendingAuthorizationOnTerminal(pendingAuthorizations);
+  await ensurePaired({
+    apiUrl: config.apiUrl,
+    publicKeyPem: identity.publicKeyPem,
+    hostname: hostname2(),
+    pendingAuthorizations,
+    presentPendingAuthorization,
+    onPairingCode: ({ code, pairingUrl, fingerprint }) => {
+      console.log("");
+      console.log("  bondsmithd needs to be paired with your Bondsmith account.");
+      console.log("");
+      console.log(`  Pairing code: ${code}`);
+      console.log(`  Confirm at:   ${pairingUrl}`);
+      console.log(`  Fingerprint:  ${fingerprint}`);
+      console.log("");
+      console.log("  Verify the fingerprint shown above matches what the confirmation");
+      console.log("  page displays before confirming \u2014 a mismatch means the code being");
+      console.log("  confirmed did not come from this machine.");
+      console.log("");
+      openBrowser(pairingUrl);
+    }
+  });
+  const httpServer = createServer();
+  const { sessionManager, ptyAttachments, revokeControllerConnections, revokeAllConnections } = createDaemonWebSocketServer(
+    httpServer,
+    config,
+    daemonFingerprint,
+    pendingAuthorizations,
+    presentPendingAuthorization
+  );
+  await sessionManager.initialize();
+  const relayClient = config.relayEnabled ? startRelayClient({
+    relayUrl: config.relayUrl,
+    daemonFingerprint,
+    daemonPublicKeyPem: identity.publicKeyPem,
+    daemonPrivateKeyPem: identity.privateKeyPem,
+    sessionManager,
+    ptyAttachments,
+    getWorkspaceStatus,
+    getWorkspaceDiff,
+    hostname: hostname2,
+    pendingAuthorizations,
+    presentPendingAuthorization
+  }) : void 0;
+  if (relayClient) {
+    sessionManager.onSessionUpdated((session) => {
+      relayClient.broadcast({ type: "session.updated", session });
+    });
+  }
+  const revocationSync = startRevocationSync({
+    apiUrl: config.apiUrl,
+    daemonPublicKey: identity.publicKeyPem,
+    revokeControllerConnections: (controllerId) => {
+      revokeControllerConnections(controllerId);
+      relayClient?.revokeControllerConnections(controllerId);
+    },
+    revokeAllConnections: () => {
+      revokeAllConnections();
+      relayClient?.revokeAllConnections();
+    }
+  });
+  const RECONCILE_INTERVAL_MS = 5e3;
+  const reconcileTimer = setInterval(() => {
+    sessionManager.reconcile().catch((error2) => {
+      console.error("Session reconcile failed", error2);
+    });
+  }, RECONCILE_INTERVAL_MS);
+  httpServer.listen(config.port, config.bindHost, () => {
+    console.log(`bondsmithd listening on ${config.bindHost}:${config.port}`);
+  });
+  function shutdown() {
+    console.log("bondsmithd shutting down");
+    clearInterval(reconcileTimer);
+    revocationSync.stop();
+    relayClient?.stop();
+    ptyAttachments.killAll();
+    pendingAuthorizations.cancelAll();
+    httpServer.close(() => process.exit(0));
+  }
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
+  function crash(source, error2) {
+    console.error(`bondsmithd: fatal ${source}, shutting down`, error2);
+    clearInterval(reconcileTimer);
+    revocationSync.stop();
+    relayClient?.stop();
+    ptyAttachments.killAll();
+    pendingAuthorizations.cancelAll();
+    httpServer.close(() => process.exit(1));
+  }
+  process.on("uncaughtException", (error2) => crash("uncaughtException", error2));
+  process.on("unhandledRejection", (error2) => crash("unhandledRejection", error2));
+}
+start().catch((error2) => {
+  console.error("Failed to start bondsmithd", error2);
+  process.exit(1);
+});
+//# sourceMappingURL=index.js.map