@bondsmith/bondsmithd 0.1.1 → 0.1.3

package/README.md

@@ -37,12 +37,26 @@ Environment variables (all optional):
 ```
 PORT=4577                                    # defaults to 4577
 ALLOWED_ORIGINS=https://app.bondsmith.dev
-BONDSMITH_RELAY_URL=wss://relay.bondsmith.dev # defaults to a local-only address; set this for a real install
+BONDSMITH_RELAY_URL=ws://127.0.0.1:8787       # defaults to production; set this when developing bondsmithd against a local apps/relay
 ```
 
 `BONDSMITH_DEV_TUNNEL_TOKEN` also exists but only applies to the legacy direct-connection path
 (`BONDSMITH_RELAY_ENABLED=false`) — should not be set by hand for a normal install.
 
+## Updating
+
+Stop the running daemon, then update it and start it again:
+
+```bash
+npm install -g @bondsmith/bondsmithd@latest
+bondsmithd
+```
+
+If you run it with `npx`, use `npx @bondsmith/bondsmithd@latest` so a cached older copy isn't reused.
+
+When the web app and an older daemon disagree, Bondsmith shows "couldn't read a message from your
+daemon". Reload the page first; if that doesn't fix it, update the daemon as above.
+
 ## What it does
 
 - Creates, lists, attaches to, and stops tmux sessions prefixed `bondsmith-*`.
@@ -54,10 +68,11 @@ BONDSMITH_RELAY_URL=wss://relay.bondsmith.dev # defaults to a local-only address
 
 ## Production connectivity (current status)
 
-`bondsmithd` connects outbound to the Bondsmith relay by default (`BONDSMITH_RELAY_ENABLED=true`),
-which is what a production account actually uses — no dev-tunnel token involved. Point
-`BONDSMITH_RELAY_URL` at `wss://relay.bondsmith.dev` for a real install (see "Environment
-variables" above); it defaults to a local-only address for monorepo development.
+`bondsmithd` connects outbound to the Bondsmith relay by default (`BONDSMITH_RELAY_ENABLED=true`,
+`BONDSMITH_RELAY_URL=wss://relay.bondsmith.dev`), which is what a production account actually
+uses — no dev-tunnel token involved, no config needed for a real install. Override
+`BONDSMITH_RELAY_URL` to a local apps/relay instance (see "Environment variables" above) only when
+developing bondsmithd itself.
 
 The dev-tunnel-token requirement only applies to the legacy direct-connection path
 (`BONDSMITH_RELAY_ENABLED=false`), which still 404s the token-handoff route in production by

package/dist/index.js

@@ -4,7 +4,7 @@
 import { createServer } from "http";
 import { existsSync } from "fs";
 import { hostname as hostname2 } from "os";
-import { dirname as dirname4, join as join5 } from "path";
+import { dirname as dirname4, join as join6 } from "path";
 import { fileURLToPath } from "url";
 
 // ../../packages/local-agent-protocol/src/session.ts
@@ -12,6 +12,19 @@ var SESSION_STATUSES = ["running", "exited"];
 
 // ../../packages/local-agent-protocol/src/messages.ts
 var REPLAYED_COMMAND_MESSAGE = "command already used (replay rejected)";
+var INVALID_MESSAGE_ERROR = "invalid message";
+
+// ../../packages/local-agent-protocol/src/protocol-version.ts
+var PROTOCOL_VERSION = 1;
+
+// ../../packages/local-agent-protocol/src/project-path.ts
+var PROJECT_PATH_INVALID_REASONS = [
+  "relative_path",
+  "not_found",
+  "not_a_directory",
+  "not_a_git_repo",
+  "permission_denied"
+];
 
 // ../../packages/local-agent-protocol/src/schemas.ts
 import { z as z2 } from "zod";
@@ -55,7 +68,8 @@ var localSessionSchema = z2.object({
   branch: z2.string().nullable(),
   repositoryFullName: z2.string().nullable(),
   lastActivityAt: z2.string().nullable(),
-  changedFileCount: z2.number().int().nonnegative().nullable()
+  changedFileCount: z2.number().int().nonnegative().nullable(),
+  worktreeOf: z2.string().nullable()
 });
 var workspaceFileEntrySchema = z2.object({
   path: z2.string(),
@@ -77,6 +91,10 @@ var workspaceFileDiffSchema = z2.object({
   patch: z2.string().nullable(),
   binary: z2.boolean()
 });
+var projectPathValidationSchema = z2.discriminatedUnion("valid", [
+  z2.object({ valid: z2.literal(true), path: z2.string() }),
+  z2.object({ valid: z2.literal(false), reason: z2.enum(PROJECT_PATH_INVALID_REASONS) })
+]);
 var browserMessageSchema = z2.discriminatedUnion("type", [
   z2.object({ type: z2.literal("session.list") }),
   z2.object({
@@ -84,9 +102,34 @@ var browserMessageSchema = z2.discriminatedUnion("type", [
     title: z2.string().min(1).max(200),
     cwd: z2.string().min(1),
     command: z2.string().min(1).max(2e3),
+    // Opt-in worktree creation — see messages.ts's own field comment.
+    // Most branch-name legality is left to git itself in createWorktree()
+    // (whose named error classes surface a rejection back to the
+    // browser), EXCEPT a leading "-": git's own argv parsing for
+    // `worktree add -b <branch>` treats a leading "-" as a flag, not a
+    // branch name, producing a raw multi-line `git branch` usage dump as
+    // the error instead of a clean, classified one (confirmed live
+    // during adversarial review) — rejected here instead, before it ever
+    // reaches git.
+    worktreeBranch: z2.string().min(1).max(250).refine((value) => !value.startsWith("-"), {
+      message: "branch name can't start with -"
+    }).optional(),
+    requestId: z2.string().min(1).max(200).optional()
+  }),
+  z2.object({
+    type: z2.literal("session.attach"),
+    sessionId: z2.string(),
+    // Optional (not required) so an older daemon build, or a stale queued
+    // envelope signed before this field existed, still parses — see
+    // session.attached/error's own requestId fields for why this matters:
+    // without a requestId round-tripped on both the ack and the error
+    // path, the browser can only guess which pending attachSession() call
+    // an incoming error/ack belongs to (oldest-pending heuristic), which
+    // misattributes a daemon error for ANY other in-flight command
+    // (observed: a session.resize racing ahead of its own session.attach)
+    // to the wrong promise — a confirmed bug, not a hypothetical.
     requestId: z2.string().min(1).max(200).optional()
   }),
-  z2.object({ type: z2.literal("session.attach"), sessionId: z2.string() }),
   z2.object({
     type: z2.literal("session.input"),
     sessionId: z2.string(),
@@ -116,6 +159,11 @@ var browserMessageSchema = z2.discriminatedUnion("type", [
     staged: z2.boolean(),
     requestId: z2.string().min(1).max(200)
   }),
+  z2.object({
+    type: z2.literal("project.validatePath"),
+    path: z2.string().min(1).max(4096),
+    requestId: z2.string().min(1).max(200)
+  }),
   z2.object({ type: z2.literal("daemon.getInfo") }),
   // Second-controller enrollment (ADR-011/ADR-012, BD-433) — deliberately
   // unsigned: the requesting browser has no trusted key yet to sign with.
@@ -166,8 +214,22 @@ var daemonMessageSchema = z2.discriminatedUnion("type", [
   // session" (observed during a reconnect: attachSession() was
   // fire-and-forget, so terminal.onData could fire before attach
   // completed).
-  z2.object({ type: z2.literal("session.attached"), sessionId: z2.string() }),
-  z2.object({ type: z2.literal("error"), message: z2.string() }),
+  z2.object({
+    type: z2.literal("session.attached"),
+    sessionId: z2.string(),
+    requestId: z2.string().optional()
+  }),
+  z2.object({
+    type: z2.literal("error"),
+    message: z2.string(),
+    // Echoes the triggering message's requestId when it had one, so the
+    // browser can match this error to the exact pending request instead
+    // of guessing "oldest pending create, then oldest pending attach" —
+    // undefined for error paths with no requestId to echo (most session.*
+    // commands still don't carry one; see session.attach above for the
+    // one this was added to fix).
+    requestId: z2.string().optional()
+  }),
   z2.object({
     type: z2.literal("workspace.status"),
     sessionId: z2.string(),
@@ -180,6 +242,11 @@ var daemonMessageSchema = z2.discriminatedUnion("type", [
     requestId: z2.string(),
     diff: workspaceFileDiffSchema
   }),
+  z2.object({
+    type: z2.literal("project.pathValidated"),
+    requestId: z2.string(),
+    result: projectPathValidationSchema
+  }),
   z2.object({
     type: z2.literal("daemon.info"),
     hostname: z2.string(),
@@ -199,7 +266,10 @@ var daemonMessageSchema = z2.discriminatedUnion("type", [
     challenge: z2.string().min(1),
     daemonFingerprint: z2.string().min(1),
     hostname: z2.string(),
-    expiresAt: z2.number().int().positive()
+    expiresAt: z2.number().int().positive(),
+    // .catch(undefined): a malformed informational field must never fail the whole handshake message.
+    protocolVersion: z2.number().int().positive().optional().catch(void 0),
+    daemonVersion: z2.string().optional().catch(void 0)
   }),
   z2.object({
     type: z2.literal("connection.authenticated"),
@@ -284,7 +354,8 @@ var SIGNABLE_ACTIONS = [
   "session.stop",
   "session.list",
   "workspace.getStatus",
-  "workspace.getDiff"
+  "workspace.getDiff",
+  "project.validatePath"
 ];
 var envelopeSchema = z3.object({
   version: z3.literal(1),
@@ -508,18 +579,19 @@ var environmentSchema = z8.object({
   // install needs to touch.
   BONDSMITH_BIND_HOST: z8.string().min(1).default("127.0.0.1"),
   // BD-450/BD-483/BD-484: connect outbound to the Bondsmith relay instead of
-  // (or alongside) listening inbound. ON by default — local dev is meant to
-  // mirror production's actual topology (browser -> relay -> daemon), not
-  // diverge from it, so plain `pnpm --filter @bondsmith/bondsmithd dev`
-  // connects outbound to a locally-running apps/relay (its own `pnpm dev`
-  // on the default port below) exactly like a real deployment would.
-  // BONDSMITH_RELAY_URL defaults to that same local apps/relay instance for
-  // the same reason. The existing inbound listener is completely
-  // unaffected either way — it keeps running regardless, so direct-
-  // connection debugging (bypassing the relay entirely) is still possible
-  // by setting BONDSMITH_RELAY_ENABLED=false explicitly.
+  // (or alongside) listening inbound. ON by default. The existing inbound
+  // listener is completely unaffected either way — it keeps running
+  // regardless, so direct-connection debugging (bypassing the relay
+  // entirely) is still possible by setting BONDSMITH_RELAY_ENABLED=false
+  // explicitly.
   BONDSMITH_RELAY_ENABLED: z8.string().default("true").transform((value) => value === "true" || value === "1"),
-  BONDSMITH_RELAY_URL: z8.string().url().default("ws://127.0.0.1:8787")
+  // Defaults to production, mirroring BONDSMITH_API_URL above, so a real
+  // install works with zero config — a bare `bondsmithd` used to silently
+  // connect outbound to loopback (nothing listening there) with no error,
+  // looking healthy while never reaching relay at all. Override to a local
+  // apps/relay instance (its own `pnpm dev` default port) when developing
+  // bondsmithd itself against a local relay.
+  BONDSMITH_RELAY_URL: z8.string().url().default("wss://relay.bondsmith.dev")
 });
 function getDaemonConfig(env = process.env) {
   const parsed = environmentSchema.parse(env);
@@ -612,7 +684,7 @@ async function callTRPCQuery(baseUrl, procedure, input) {
 // src/pairing/pairing.ts
 var DEFAULT_POLL_INTERVAL_MS = 3e3;
 function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 async function ensurePaired(options) {
   const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
@@ -749,20 +821,128 @@ async function bindFirstController(params, response) {
   }
 }
 
+// src/projects/validate-path.ts
+import { stat } from "fs/promises";
+import { isAbsolute, resolve } from "path";
+
+// src/sessions/expand-home.ts
+import { homedir } from "os";
+import { join } from "path";
+function expandHome(cwd) {
+  if (cwd === "~") return homedir();
+  if (cwd.startsWith("~/")) return join(homedir(), cwd.slice(2));
+  return cwd;
+}
+
+// src/sessions/git/client.ts
+import { execFile as execFileCb } from "child_process";
+import { promisify } from "util";
+var execFile = promisify(execFileCb);
+var GitNotARepoError = class extends Error {
+  constructor() {
+    super("not a git repository");
+    this.name = "GitNotARepoError";
+  }
+};
+function isNotARepoError(error2) {
+  if (typeof error2 !== "object" || error2 === null) return false;
+  const stderr = error2.stderr;
+  return typeof stderr === "string" && stderr.includes("not a git repository");
+}
+async function runGit(args, cwd) {
+  try {
+    const { stdout } = await execFile("git", args, { cwd });
+    return stdout;
+  } catch (error2) {
+    if (isNotARepoError(error2)) throw new GitNotARepoError();
+    throw error2;
+  }
+}
+async function runGitAllowingExitCodes(args, cwd, allowedExitCodes) {
+  try {
+    const { stdout } = await execFile("git", args, { cwd });
+    return stdout;
+  } catch (error2) {
+    if (isNotARepoError(error2)) throw new GitNotARepoError();
+    const code = error2.code;
+    const stdout = error2.stdout;
+    if (typeof code === "number" && allowedExitCodes.includes(code) && typeof stdout === "string") {
+      return stdout;
+    }
+    throw error2;
+  }
+}
+
+// src/projects/validate-path.ts
+var NOT_FOUND_CODES = /* @__PURE__ */ new Set(["ENOENT", "ENOTDIR"]);
+var PERMISSION_CODES = /* @__PURE__ */ new Set(["EACCES", "EPERM"]);
+function invalidReasonForFsError(error2) {
+  const code = error2?.code;
+  if (typeof code !== "string") return null;
+  if (NOT_FOUND_CODES.has(code)) return "not_found";
+  if (PERMISSION_CODES.has(code)) return "permission_denied";
+  return null;
+}
+async function validateProjectPath(input) {
+  const expanded = expandHome(input.trim());
+  if (!isAbsolute(expanded)) return { valid: false, reason: "relative_path" };
+  const path = resolve(expanded);
+  try {
+    const stats = await stat(path);
+    if (!stats.isDirectory()) return { valid: false, reason: "not_a_directory" };
+  } catch (error2) {
+    const reason = invalidReasonForFsError(error2);
+    if (reason) return { valid: false, reason };
+    throw error2;
+  }
+  try {
+    const insideWorkTree = (await runGit(["rev-parse", "--is-inside-work-tree"], path)).trim();
+    if (insideWorkTree !== "true") return { valid: false, reason: "not_a_git_repo" };
+  } catch (error2) {
+    if (error2 instanceof GitNotARepoError) return { valid: false, reason: "not_a_git_repo" };
+    throw error2;
+  }
+  return { valid: true, path };
+}
+
 // src/relay/relay-client.ts
 import { sign } from "crypto";
 import WebSocket from "ws";
 
+// src/version.ts
+var DAEMON_VERSION = true ? "0.1.3" : "dev";
+
 // src/sessions/tmux/client.ts
-import { execFile as execFileCb } from "child_process";
-import { promisify } from "util";
-var execFile = promisify(execFileCb);
+import { execFile as execFileCb2 } from "child_process";
+import { promisify as promisify2 } from "util";
+var execFile2 = promisify2(execFileCb2);
 var TmuxNoServerRunningError = class extends Error {
   constructor() {
     super("no tmux server running");
     this.name = "TmuxNoServerRunningError";
   }
 };
+var TmuxNotFoundError = class extends Error {
+  constructor() {
+    super(
+      [
+        "bondsmithd requires tmux, and it was not found on PATH.",
+        "",
+        "Install it:",
+        "  macOS (Homebrew):     brew install tmux",
+        "  Debian/Ubuntu:        sudo apt-get install tmux",
+        "  Fedora/RHEL:          sudo dnf install tmux",
+        "  Arch:                 sudo pacman -S tmux",
+        "",
+        "If tmux is already installed, start bondsmithd from a normal interactive shell \u2014",
+        "not a LaunchAgent, Docker container, or other minimal-PATH context. Those often",
+        "don't inherit the PATH tmux was installed into (e.g. Homebrew's /opt/homebrew/bin",
+        "on Apple Silicon)."
+      ].join("\n")
+    );
+    this.name = "TmuxNotFoundError";
+  }
+};
 var SENSITIVE_ENV_KEYS = ["ANTHROPIC_API_KEY", "BONDSMITH_DEV_TUNNEL_TOKEN"];
 function filterSpawnEnv(env) {
   const filtered = { ...env };
@@ -770,8 +950,13 @@ function filterSpawnEnv(env) {
   return filtered;
 }
 async function runTmux(args, options) {
-  const { stdout } = await execFile("tmux", args, { ...options, encoding: "utf8" });
-  return stdout;
+  try {
+    const { stdout } = await execFile2("tmux", args, { ...options, encoding: "utf8" });
+    return stdout;
+  } catch (error2) {
+    if (error2?.code === "ENOENT") throw new TmuxNotFoundError();
+    throw error2;
+  }
 }
 async function sendKeysLiteral(tmuxSessionName, text) {
   await runTmux(["send-keys", "-t", tmuxSessionName, "-l", text]);
@@ -807,8 +992,8 @@ import { verify as verify2 } from "crypto";
 
 // src/security/trusted-controllers.ts
 import { mkdir, readFile, rename, rm, writeFile } from "fs/promises";
-import { homedir } from "os";
-import { dirname, join } from "path";
+import { homedir as homedir2 } from "os";
+import { dirname, join as join2 } from "path";
 import { z as z9 } from "zod";
 var trustedControllerSchema = z9.object({
   id: z9.string(),
@@ -831,7 +1016,7 @@ var trustedControllersFileSchema = z9.object({
   controllers: z9.array(trustedControllerSchema)
 });
 function defaultTrustedControllersPath() {
-  return join(homedir(), ".bondsmith", "trusted-controllers.json");
+  return join2(homedir2(), ".bondsmith", "trusted-controllers.json");
 }
 async function loadTrustedControllers(path = defaultTrustedControllersPath()) {
   let raw;
@@ -1009,6 +1194,7 @@ var BRACKETED_PASTE_END = "\x1B[201~";
 function createRouterConnection(connectionAuth, send, markControllerId, ptyAttachments) {
   const outputListeners = /* @__PURE__ */ new Map();
   const attachLocks = /* @__PURE__ */ new Map();
+  let admissionChain = Promise.resolve();
   const conn = {
     subscriptions: /* @__PURE__ */ new Set(),
     send,
@@ -1018,6 +1204,13 @@ function createRouterConnection(connectionAuth, send, markControllerId, ptyAttac
     getOutputListener: (sessionId) => outputListeners.get(sessionId),
     connectionAuth,
     markControllerId,
+    admitInOrder: (fn) => {
+      const next = admissionChain.catch(() => {
+      }).then(fn);
+      admissionChain = next.catch(() => {
+      });
+      return next;
+    },
     withAttachLock: (sessionId, fn) => {
       const previous = attachLocks.get(sessionId) ?? Promise.resolve();
       const next = previous.catch(() => {
@@ -1038,8 +1231,8 @@ function createRouterConnection(connectionAuth, send, markControllerId, ptyAttac
   }
   return { conn, releaseAllSubscriptions };
 }
-function error(message) {
-  return { type: "error", message };
+function error(message, requestId) {
+  return { type: "error", message, requestId };
 }
 function errorMessageOf(err, fallback) {
   return err instanceof Error ? err.message : fallback;
@@ -1055,35 +1248,39 @@ async function handleBrowserMessage(conn, raw, deps) {
     const { envelope } = signedCommand.data;
     const innerMessage = browserMessageSchema.safeParse(envelope.payload);
     if (!innerMessage.success || innerMessage.data.type !== envelope.action) {
-      conn.send(error("invalid message"));
-      return;
-    }
-    const verdict = await verifyCommand(
-      signedCommand.data,
-      deps.daemonFingerprint,
-      conn.connectionAuth,
-      deps.trustedControllersPath
-    );
-    if (!verdict.ok) {
-      conn.send(error(verifyRejectionMessage(verdict.reason)));
-      return;
-    }
-    if (conn.connectionAuth.isRevoked()) {
-      conn.send(error(REVOKED_REJECTION_MESSAGE));
+      conn.send(error(INVALID_MESSAGE_ERROR));
       return;
     }
+    const admitted = await conn.admitInOrder(async () => {
+      const verdict = await verifyCommand(
+        signedCommand.data,
+        deps.daemonFingerprint,
+        conn.connectionAuth,
+        deps.trustedControllersPath
+      );
+      if (!verdict.ok) {
+        conn.send(error(verifyRejectionMessage(verdict.reason)));
+        return false;
+      }
+      if (conn.connectionAuth.isRevoked()) {
+        conn.send(error(REVOKED_REJECTION_MESSAGE));
+        return false;
+      }
+      return true;
+    });
+    if (!admitted) return;
     await dispatch(conn, innerMessage.data, deps);
     return;
   }
   const parsed = browserMessageSchema.safeParse(raw);
   if (!parsed.success) {
-    conn.send(error("invalid message"));
+    conn.send(error(INVALID_MESSAGE_ERROR));
     return;
   }
   if (parsed.data.type === "connection.authenticate") {
-    const result = await conn.connectionAuth.authenticate(
-      parsed.data.signed,
-      deps.trustedControllersPath
+    const { signed } = parsed.data;
+    const result = await conn.admitInOrder(
+      () => conn.connectionAuth.authenticate(signed, deps.trustedControllersPath)
     );
     if (!result.ok) {
       conn.send({ type: "connection.authenticationFailed", reason: result.reason });
@@ -1105,6 +1302,7 @@ async function dispatch(conn, message, {
   broadcast,
   getWorkspaceStatus: getWorkspaceStatus2,
   getWorkspaceDiff: getWorkspaceDiff2,
+  validateProjectPath: validateProjectPath2,
   hostname: hostname3,
   daemonFingerprint,
   pendingAuthorizations,
@@ -1116,22 +1314,26 @@ async function dispatch(conn, message, {
       return;
     }
     case "session.create": {
-      const { title, cwd, command, requestId } = message;
+      const { title, cwd, command, worktreeBranch, requestId } = message;
       try {
-        const session = await sessionManager.create({ title, cwd, command });
+        const session = await sessionManager.create({ title, cwd, command, worktreeBranch });
         broadcast({ type: "session.created", session, requestId });
       } catch (err) {
-        conn.send(error(errorMessageOf(err, "failed to create session")));
+        conn.send(error(errorMessageOf(err, "failed to create session"), requestId));
       }
       return;
     }
     case "session.attach": {
+      const { requestId } = message;
       if (!isValidSessionId(message.sessionId)) {
-        conn.send(error("invalid session id"));
+        conn.send(error("invalid session id", requestId));
+        return;
+      }
+      const session = sessionManager.get(message.sessionId);
+      if (!session) {
+        conn.send(error("unknown session", requestId));
         return;
       }
-      const session = getSessionOrError(sessionManager, conn, message.sessionId);
-      if (!session) return;
       await conn.withAttachLock(message.sessionId, async () => {
         const previousListener = conn.getOutputListener(message.sessionId);
         const onData = (data) => {
@@ -1145,7 +1347,7 @@ async function dispatch(conn, message, {
         )) {
           conn.subscriptions.add(message.sessionId);
           conn.registerOutputListener(message.sessionId, onData);
-          conn.send({ type: "session.attached", sessionId: message.sessionId });
+          conn.send({ type: "session.attached", sessionId: message.sessionId, requestId });
           return;
         }
         if (previousListener) {
@@ -1157,12 +1359,12 @@ async function dispatch(conn, message, {
           onData
         );
         if (!attached) {
-          conn.send(error("failed to attach to session"));
+          conn.send(error("failed to attach to session", requestId));
           return;
         }
         conn.subscriptions.add(message.sessionId);
         conn.registerOutputListener(message.sessionId, onData);
-        conn.send({ type: "session.attached", sessionId: message.sessionId });
+        conn.send({ type: "session.attached", sessionId: message.sessionId, requestId });
       });
       return;
     }
@@ -1238,6 +1440,15 @@ async function dispatch(conn, message, {
       }
       return;
     }
+    case "project.validatePath": {
+      try {
+        const result = await validateProjectPath2(message.path);
+        conn.send({ type: "project.pathValidated", requestId: message.requestId, result });
+      } catch (err) {
+        conn.send(error(errorMessageOf(err, "failed to validate project path"), message.requestId));
+      }
+      return;
+    }
     case "daemon.getInfo": {
       conn.send({ type: "daemon.info", hostname: hostname3(), daemonFingerprint });
       return;
@@ -1588,7 +1799,9 @@ function startRelayClient(deps) {
       challenge: challenge.challenge,
       daemonFingerprint: deps.daemonFingerprint,
       hostname: deps.hostname(),
-      expiresAt: challenge.expiresAt
+      expiresAt: challenge.expiresAt,
+      protocolVersion: PROTOCOL_VERSION,
+      daemonVersion: DAEMON_VERSION
     });
   }
   function handleFrame(frame) {
@@ -1686,10 +1899,10 @@ function startRelayClient(deps) {
 // src/security/daemon-identity.ts
 import { generateKeyPairSync, sign as sign2, verify as verify4 } from "crypto";
 import { mkdir as mkdir2, readFile as readFile2, rename as rename2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join2 } from "path";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname2, join as join3 } from "path";
 function defaultCredentialsPath() {
-  return join2(homedir2(), ".bondsmith", "credentials");
+  return join3(homedir3(), ".bondsmith", "credentials");
 }
 async function loadOrCreateDaemonIdentity(credentialsPath = defaultCredentialsPath()) {
   const existing = await tryReadIdentity(credentialsPath);
@@ -1751,10 +1964,10 @@ function extractPemBlock(text, label) {
 // src/security/dev-tunnel-token-file.ts
 import { randomBytes as randomBytes2 } from "crypto";
 import { mkdir as mkdir3, readFile as readFile3, rename as rename3, rm as rm3, writeFile as writeFile3 } from "fs/promises";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname3, join as join3 } from "path";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname3, join as join4 } from "path";
 function defaultDevTunnelTokenPath() {
-  return join3(homedir3(), ".bondsmith", "dev-tunnel-token");
+  return join4(homedir4(), ".bondsmith", "dev-tunnel-token");
 }
 async function loadOrCreateDevTunnelToken(tokenPath = defaultDevTunnelTokenPath()) {
   const existing = await tryReadToken(tokenPath);
@@ -1862,8 +2075,8 @@ var PendingAuthorizationStore = class {
       requestToken: randomUUID()
     };
     let settleFn;
-    const resultPromise = new Promise((resolve) => {
-      settleFn = resolve;
+    const resultPromise = new Promise((resolve2) => {
+      settleFn = resolve2;
     });
     const entry = {
       authorization,
@@ -2087,45 +2300,6 @@ function presentPendingAuthorizationOnTerminal(store) {
   };
 }
 
-// src/sessions/git/client.ts
-import { execFile as execFileCb2 } from "child_process";
-import { promisify as promisify2 } from "util";
-var execFile2 = promisify2(execFileCb2);
-var GitNotARepoError = class extends Error {
-  constructor() {
-    super("not a git repository");
-    this.name = "GitNotARepoError";
-  }
-};
-function isNotARepoError(error2) {
-  if (typeof error2 !== "object" || error2 === null) return false;
-  const stderr = error2.stderr;
-  return typeof stderr === "string" && stderr.includes("not a git repository");
-}
-async function runGit(args, cwd) {
-  try {
-    const { stdout } = await execFile2("git", args, { cwd });
-    return stdout;
-  } catch (error2) {
-    if (isNotARepoError(error2)) throw new GitNotARepoError();
-    throw error2;
-  }
-}
-async function runGitAllowingExitCodes(args, cwd, allowedExitCodes) {
-  try {
-    const { stdout } = await execFile2("git", args, { cwd });
-    return stdout;
-  } catch (error2) {
-    if (isNotARepoError(error2)) throw new GitNotARepoError();
-    const code = error2.code;
-    const stdout = error2.stdout;
-    if (typeof code === "number" && allowedExitCodes.includes(code) && typeof stdout === "string") {
-      return stdout;
-    }
-    throw error2;
-  }
-}
-
 // src/sessions/git/diff.ts
 async function getWorkspaceDiff(cwd, path, staged) {
   const numstatArgs = staged ? ["diff", "--cached", "--numstat", "--", path] : ["diff", "--numstat", "--", path];
@@ -2346,7 +2520,12 @@ var PtyAttachmentManager = class {
           cwd: process.env.HOME,
           env: filterSpawnEnv(process.env)
         });
-      } catch {
+      } catch (error2) {
+        if (error2?.code === "ENOENT") {
+          console.error(`
+${new TmuxNotFoundError().message}
+`);
+        }
         return false;
       }
       handle = { process: ptyProcess, refCount: 0, dataListeners: /* @__PURE__ */ new Set() };
@@ -2410,23 +2589,84 @@ var PtyAttachmentManager = class {
 // src/sessions/session-manager.ts
 import { v4 as uuidv4 } from "uuid";
 
+// src/sessions/git/worktree.ts
+import { execFile as execFileCb3 } from "child_process";
+import { promisify as promisify3 } from "util";
+var execFile3 = promisify3(execFileCb3);
+var WorktreeBranchNameTakenError = class extends Error {
+  constructor(branch) {
+    super(`a branch named "${branch}" already exists`);
+    this.name = "WorktreeBranchNameTakenError";
+  }
+};
+var WorktreePathExistsError = class extends Error {
+  constructor(path) {
+    super(`worktree path already exists: ${path}`);
+    this.name = "WorktreePathExistsError";
+  }
+};
+var WorktreeHasUncommittedChangesError = class extends Error {
+  constructor(path) {
+    super(
+      `worktree at ${path} has uncommitted or untracked changes \u2014 not removing it. Commit or discard the changes, then remove it yourself (git worktree remove ${path}).`
+    );
+    this.name = "WorktreeHasUncommittedChangesError";
+  }
+};
+function stderrOf(error2) {
+  if (typeof error2 !== "object" || error2 === null) return "";
+  const stderr = error2.stderr;
+  return typeof stderr === "string" ? stderr : "";
+}
+async function createWorktree(sourceCwd, worktreePath, branch) {
+  try {
+    await execFile3("git", ["worktree", "add", "-b", branch, worktreePath], { cwd: sourceCwd });
+  } catch (error2) {
+    const stderr = stderrOf(error2);
+    if (stderr.includes("a branch named")) {
+      throw new WorktreeBranchNameTakenError(branch);
+    }
+    if (stderr.includes("already exists")) {
+      throw new WorktreePathExistsError(worktreePath);
+    }
+    throw error2;
+  }
+}
+async function removeWorktree(sourceCwd, worktreePath) {
+  try {
+    await execFile3("git", ["worktree", "remove", worktreePath], { cwd: sourceCwd });
+  } catch (error2) {
+    const stderr = stderrOf(error2);
+    if (stderr.includes("contains modified or untracked files")) {
+      throw new WorktreeHasUncommittedChangesError(worktreePath);
+    }
+    throw error2;
+  }
+}
+
 // src/sessions/tmux/create.ts
 import { access } from "fs/promises";
-import { homedir as homedir4 } from "os";
-import { join as join4 } from "path";
+import { homedir as homedir5 } from "os";
+import { join as join5 } from "path";
 var InvalidCwdError = class extends Error {
   constructor(cwd) {
     super(`working directory does not exist: ${cwd}`);
     this.name = "InvalidCwdError";
   }
 };
-function expandHome(cwd) {
-  if (cwd === "~") return homedir4();
-  if (cwd.startsWith("~/")) return join4(homedir4(), cwd.slice(2));
-  return cwd;
+function worktreePathFor(sessionId) {
+  return join5(homedir5(), ".bondsmith", "worktrees", sessionId);
 }
 async function createTmuxSession(input) {
-  const cwd = expandHome(input.cwd);
+  const sourceCwd = expandHome(input.cwd);
+  let cwd = sourceCwd;
+  let worktreeOf = null;
+  if (input.worktreeBranch) {
+    const worktreePath = worktreePathFor(input.id);
+    await createWorktree(sourceCwd, worktreePath, input.worktreeBranch);
+    cwd = worktreePath;
+    worktreeOf = sourceCwd;
+  }
   try {
     await access(cwd);
   } catch {
@@ -2442,6 +2682,9 @@ async function createTmuxSession(input) {
   await runTmux(["set-option", "-t", tmuxSessionName, "@bondsmith-command", input.command]);
   await runTmux(["set-option", "-t", tmuxSessionName, "@bondsmith-cwd", cwd]);
   await runTmux(["set-option", "-t", tmuxSessionName, "@bondsmith-started-at", startedAt]);
+  if (worktreeOf) {
+    await runTmux(["set-option", "-t", tmuxSessionName, "@bondsmith-worktree-of", worktreeOf]);
+  }
   const session = {
     id: input.id,
     title: input.title,
@@ -2453,7 +2696,8 @@ async function createTmuxSession(input) {
     branch: null,
     repositoryFullName: null,
     lastActivityAt: null,
-    changedFileCount: null
+    changedFileCount: null,
+    worktreeOf
   };
   return enrichSessionWithGitMetadata(session);
 }
@@ -2462,14 +2706,14 @@ async function stopTmuxSession(tmuxSessionName) {
 }
 
 // src/sessions/tmux/parse.ts
-var FIELD_COUNT = 6;
+var FIELD_COUNT = 7;
 function parseTmuxSessions(output) {
   const sessions = [];
   for (const line of output.split("\n")) {
     if (!line.trim()) continue;
     const fields = line.split("	");
     if (fields.length < FIELD_COUNT) continue;
-    const [sessionName, id, title, command, cwd, startedAt] = fields;
+    const [sessionName, id, title, command, cwd, startedAt, worktreeOf] = fields;
     if (!isBondsmithTmuxSessionName(sessionName)) continue;
     if (!id || !title || !command || !cwd || !startedAt) continue;
     sessions.push({
@@ -2483,7 +2727,11 @@ function parseTmuxSessions(output) {
       branch: null,
       repositoryFullName: null,
       lastActivityAt: null,
-      changedFileCount: null
+      changedFileCount: null,
+      // tmux reports an unset user-option as an empty string via
+      // #{...}, never literally absent — a non-worktree session (the
+      // common case) has no @bondsmith-worktree-of option set at all.
+      worktreeOf: worktreeOf ? worktreeOf : null
     });
   }
   return sessions;
@@ -2496,7 +2744,8 @@ var LIST_FORMAT = [
   "#{@bondsmith-title}",
   "#{@bondsmith-command}",
   "#{@bondsmith-cwd}",
-  "#{@bondsmith-started-at}"
+  "#{@bondsmith-started-at}",
+  "#{@bondsmith-worktree-of}"
 ].join("	");
 async function discoverSessions() {
   try {
@@ -2505,6 +2754,12 @@ async function discoverSessions() {
     return Promise.all(sessions.map((session) => enrichSessionWithGitMetadata(session)));
   } catch (error2) {
     if (error2 instanceof TmuxNoServerRunningError) return [];
+    if (error2 instanceof TmuxNotFoundError) {
+      console.error(`
+${error2.message}
+`);
+      process.exit(1);
+    }
     throw error2;
   }
 }
@@ -2546,6 +2801,17 @@ var SessionManager = class {
       await stopTmuxSession(session.tmuxSessionName);
     } catch {
     }
+    if (session.worktreeOf) {
+      try {
+        await removeWorktree(session.worktreeOf, session.cwd);
+      } catch (error2) {
+        console.error("Failed to remove session worktree", {
+          sessionId: session.id,
+          worktreePath: session.cwd,
+          error: error2
+        });
+      }
+    }
     return this.removeAsExited(session);
   }
   /**
@@ -2568,6 +2834,9 @@ var SessionManager = class {
       const output = await listTmuxSessions("#{session_name}");
       liveSessionNames = new Set(output.split("\n").filter((name) => name.length > 0));
     } catch (error2) {
+      if (error2 instanceof TmuxNotFoundError) console.error(`
+${error2.message}
+`);
       if (!(error2 instanceof TmuxNoServerRunningError)) return;
     }
     await Promise.all(
@@ -2690,7 +2959,9 @@ function createDaemonWebSocketServer(httpServer, config, daemonFingerprint, pend
       challenge: challenge.challenge,
       daemonFingerprint,
       hostname: hostname(),
-      expiresAt: challenge.expiresAt
+      expiresAt: challenge.expiresAt,
+      protocolVersion: PROTOCOL_VERSION,
+      daemonVersion: DAEMON_VERSION
     });
     socket.on("message", (raw) => {
       let parsed;
@@ -2706,6 +2977,7 @@ function createDaemonWebSocketServer(httpServer, config, daemonFingerprint, pend
         broadcast,
         getWorkspaceStatus,
         getWorkspaceDiff,
+        validateProjectPath,
         hostname: () => hostname(),
         daemonFingerprint,
         pendingAuthorizations,
@@ -2741,10 +3013,10 @@ function createDaemonWebSocketServer(httpServer, config, daemonFingerprint, pend
 
 // src/index.ts
 function loadRepoRootEnv() {
-  const repoRoot = join5(dirname4(fileURLToPath(import.meta.url)), "..", "..", "..");
-  if (!existsSync(join5(repoRoot, "pnpm-workspace.yaml"))) return;
-  const envLocal = join5(repoRoot, ".env.local");
-  const envDefault = join5(repoRoot, ".env");
+  const repoRoot = join6(dirname4(fileURLToPath(import.meta.url)), "..", "..", "..");
+  if (!existsSync(join6(repoRoot, "pnpm-workspace.yaml"))) return;
+  const envLocal = join6(repoRoot, ".env.local");
+  const envDefault = join6(repoRoot, ".env");
   loadEnv({ path: existsSync(envLocal) ? envLocal : envDefault });
 }
 loadRepoRootEnv();
@@ -2797,6 +3069,7 @@ async function start() {
     ptyAttachments,
     getWorkspaceStatus,
     getWorkspaceDiff,
+    validateProjectPath,
     hostname: hostname2,
     pendingAuthorizations,
     presentPendingAuthorization

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@bondsmith/bondsmithd",
-	"version": "0.1.1",
+	"version": "0.1.3",
 	"private": false,
 	"description": "Local daemon for Bondsmith agent sessions — runs on the user's own machine, pairs with a Bondsmith account, and exposes tmux-backed terminal sessions to the Bondsmith web app over a signed WebSocket protocol.",
 	"homepage": "https://bondsmith.dev",