@bondsmith/bondsmithd 0.1.2 → 0.1.4

package/dist/index.js

@@ -4,7 +4,7 @@
 import { createServer } from "http";
 import { existsSync } from "fs";
 import { hostname as hostname2 } from "os";
-import { dirname as dirname4, join as join5 } from "path";
+import { dirname as dirname4, join as join6 } from "path";
 import { fileURLToPath } from "url";
 
 // ../../packages/local-agent-protocol/src/session.ts
@@ -12,6 +12,19 @@ var SESSION_STATUSES = ["running", "exited"];
 
 // ../../packages/local-agent-protocol/src/messages.ts
 var REPLAYED_COMMAND_MESSAGE = "command already used (replay rejected)";
+var INVALID_MESSAGE_ERROR = "invalid message";
+
+// ../../packages/local-agent-protocol/src/protocol-version.ts
+var PROTOCOL_VERSION = 4;
+
+// ../../packages/local-agent-protocol/src/project-path.ts
+var PROJECT_PATH_INVALID_REASONS = [
+  "relative_path",
+  "not_found",
+  "not_a_directory",
+  "not_a_git_repo",
+  "permission_denied"
+];
 
 // ../../packages/local-agent-protocol/src/schemas.ts
 import { z as z2 } from "zod";
@@ -44,6 +57,13 @@ var signedConnectionChallengeSchema = z.object({
 
 // ../../packages/local-agent-protocol/src/schemas.ts
 var MAX_INSERT_TEXT_BYTES = 32 * 1024;
+var MAX_INPUT_CHARS = 16 * 1024;
+var MAX_WIRE_MESSAGE_BYTES = 256 * 1024;
+var MAX_TERMINAL_DIMENSION = 1e3;
+var terminalSizeSchema = z2.object({
+  cols: z2.number().int().min(1).max(MAX_TERMINAL_DIMENSION),
+  rows: z2.number().int().min(1).max(MAX_TERMINAL_DIMENSION)
+});
 var localSessionSchema = z2.object({
   id: z2.string(),
   title: z2.string(),
@@ -55,7 +75,8 @@ var localSessionSchema = z2.object({
   branch: z2.string().nullable(),
   repositoryFullName: z2.string().nullable(),
   lastActivityAt: z2.string().nullable(),
-  changedFileCount: z2.number().int().nonnegative().nullable()
+  changedFileCount: z2.number().int().nonnegative().nullable(),
+  worktreeOf: z2.string().nullable()
 });
 var workspaceFileEntrySchema = z2.object({
   path: z2.string(),
@@ -69,6 +90,8 @@ var workspaceFileEntrySchema = z2.object({
 var workspaceStatusSchema = z2.object({
   isGitRepo: z2.boolean(),
   branch: z2.string().nullable(),
+  // .catch(undefined): a malformed informational field must never drop the whole status message.
+  baseRef: z2.string().nullable().optional().catch(void 0),
   files: z2.array(workspaceFileEntrySchema)
 });
 var workspaceFileDiffSchema = z2.object({
@@ -77,6 +100,10 @@ var workspaceFileDiffSchema = z2.object({
   patch: z2.string().nullable(),
   binary: z2.boolean()
 });
+var projectPathValidationSchema = z2.discriminatedUnion("valid", [
+  z2.object({ valid: z2.literal(true), path: z2.string() }),
+  z2.object({ valid: z2.literal(false), reason: z2.enum(PROJECT_PATH_INVALID_REASONS) })
+]);
 var browserMessageSchema = z2.discriminatedUnion("type", [
   z2.object({ type: z2.literal("session.list") }),
   z2.object({
@@ -84,13 +111,41 @@ var browserMessageSchema = z2.discriminatedUnion("type", [
     title: z2.string().min(1).max(200),
     cwd: z2.string().min(1),
     command: z2.string().min(1).max(2e3),
+    // Opt-in worktree creation — see messages.ts's own field comment.
+    // Most branch-name legality is left to git itself in createWorktree()
+    // (whose named error classes surface a rejection back to the
+    // browser), EXCEPT a leading "-": git's own argv parsing for
+    // `worktree add -b <branch>` treats a leading "-" as a flag, not a
+    // branch name, producing a raw multi-line `git branch` usage dump as
+    // the error instead of a clean, classified one (confirmed live
+    // during adversarial review) — rejected here instead, before it ever
+    // reaches git.
+    worktreeBranch: z2.string().min(1).max(250).refine((value) => !value.startsWith("-"), {
+      message: "branch name can't start with -"
+    }).optional(),
     requestId: z2.string().min(1).max(200).optional()
   }),
-  z2.object({ type: z2.literal("session.attach"), sessionId: z2.string() }),
+  z2.object({
+    type: z2.literal("session.attach"),
+    sessionId: z2.string(),
+    // Optional (not required) so an older daemon build, or a stale queued
+    // envelope signed before this field existed, still parses — see
+    // session.attached/error's own requestId fields for why this matters:
+    // without a requestId round-tripped on both the ack and the error
+    // path, the browser can only guess which pending attachSession() call
+    // an incoming error/ack belongs to (oldest-pending heuristic), which
+    // misattributes a daemon error for ANY other in-flight command
+    // (observed: a session.resize racing ahead of its own session.attach)
+    // to the wrong promise — a confirmed bug, not a hypothetical.
+    requestId: z2.string().min(1).max(200).optional(),
+    // Tolerant like baseRef: an unreadable size must not make the daemon drop the attach itself.
+    size: terminalSizeSchema.optional().catch(void 0)
+  }),
+  z2.object({ type: z2.literal("session.detach"), sessionId: z2.string() }),
   z2.object({
     type: z2.literal("session.input"),
     sessionId: z2.string(),
-    data: z2.string()
+    data: z2.string().max(MAX_INPUT_CHARS)
   }),
   z2.object({
     type: z2.literal("session.insertText"),
@@ -100,8 +155,7 @@ var browserMessageSchema = z2.discriminatedUnion("type", [
   z2.object({
     type: z2.literal("session.resize"),
     sessionId: z2.string(),
-    cols: z2.number().int().positive(),
-    rows: z2.number().int().positive()
+    ...terminalSizeSchema.shape
   }),
   z2.object({ type: z2.literal("session.stop"), sessionId: z2.string() }),
   z2.object({
@@ -116,6 +170,11 @@ var browserMessageSchema = z2.discriminatedUnion("type", [
     staged: z2.boolean(),
     requestId: z2.string().min(1).max(200)
   }),
+  z2.object({
+    type: z2.literal("project.validatePath"),
+    path: z2.string().min(1).max(4096),
+    requestId: z2.string().min(1).max(200)
+  }),
   z2.object({ type: z2.literal("daemon.getInfo") }),
   // Second-controller enrollment (ADR-011/ADR-012, BD-433) — deliberately
   // unsigned: the requesting browser has no trusted key yet to sign with.
@@ -166,8 +225,22 @@ var daemonMessageSchema = z2.discriminatedUnion("type", [
   // session" (observed during a reconnect: attachSession() was
   // fire-and-forget, so terminal.onData could fire before attach
   // completed).
-  z2.object({ type: z2.literal("session.attached"), sessionId: z2.string() }),
-  z2.object({ type: z2.literal("error"), message: z2.string() }),
+  z2.object({
+    type: z2.literal("session.attached"),
+    sessionId: z2.string(),
+    requestId: z2.string().optional()
+  }),
+  z2.object({
+    type: z2.literal("error"),
+    message: z2.string(),
+    // Echoes the triggering message's requestId when it had one, so the
+    // browser can match this error to the exact pending request instead
+    // of guessing "oldest pending create, then oldest pending attach" —
+    // undefined for error paths with no requestId to echo (most session.*
+    // commands still don't carry one; see session.attach above for the
+    // one this was added to fix).
+    requestId: z2.string().optional()
+  }),
   z2.object({
     type: z2.literal("workspace.status"),
     sessionId: z2.string(),
@@ -180,6 +253,11 @@ var daemonMessageSchema = z2.discriminatedUnion("type", [
     requestId: z2.string(),
     diff: workspaceFileDiffSchema
   }),
+  z2.object({
+    type: z2.literal("project.pathValidated"),
+    requestId: z2.string(),
+    result: projectPathValidationSchema
+  }),
   z2.object({
     type: z2.literal("daemon.info"),
     hostname: z2.string(),
@@ -199,7 +277,10 @@ var daemonMessageSchema = z2.discriminatedUnion("type", [
     challenge: z2.string().min(1),
     daemonFingerprint: z2.string().min(1),
     hostname: z2.string(),
-    expiresAt: z2.number().int().positive()
+    expiresAt: z2.number().int().positive(),
+    // .catch(undefined): a malformed informational field must never fail the whole handshake message.
+    protocolVersion: z2.number().int().positive().optional().catch(void 0),
+    daemonVersion: z2.string().optional().catch(void 0)
   }),
   z2.object({
     type: z2.literal("connection.authenticated"),
@@ -278,13 +359,15 @@ import { z as z3 } from "zod";
 var SIGNABLE_ACTIONS = [
   "session.create",
   "session.attach",
+  "session.detach",
   "session.input",
   "session.insertText",
   "session.resize",
   "session.stop",
   "session.list",
   "workspace.getStatus",
-  "workspace.getDiff"
+  "workspace.getDiff",
+  "project.validatePath"
 ];
 var envelopeSchema = z3.object({
   version: z3.literal(1),
@@ -613,7 +696,7 @@ async function callTRPCQuery(baseUrl, procedure, input) {
 // src/pairing/pairing.ts
 var DEFAULT_POLL_INTERVAL_MS = 3e3;
 function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 async function ensurePaired(options) {
   const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
@@ -750,14 +833,137 @@ async function bindFirstController(params, response) {
   }
 }
 
+// src/projects/validate-path.ts
+import { stat } from "fs/promises";
+import { isAbsolute, resolve } from "path";
+
+// src/sessions/expand-home.ts
+import { homedir } from "os";
+import { join } from "path";
+function expandHome(cwd) {
+  if (cwd === "~") return homedir();
+  if (cwd.startsWith("~/")) return join(homedir(), cwd.slice(2));
+  return cwd;
+}
+
+// src/sessions/git/client.ts
+import { execFile as execFileCb } from "child_process";
+import { promisify } from "util";
+var execFile = promisify(execFileCb);
+var MAX_GIT_OUTPUT_BYTES = 64 * 1024 * 1024;
+var SAFE_DIFF_FLAGS = ["--no-ext-diff", "--no-textconv"];
+var GitNotARepoError = class extends Error {
+  constructor() {
+    super("not a git repository");
+    this.name = "GitNotARepoError";
+  }
+};
+function isNotARepoError(error2) {
+  if (typeof error2 !== "object" || error2 === null) return false;
+  const stderr = error2.stderr;
+  return typeof stderr === "string" && stderr.includes("not a git repository");
+}
+async function runGit(args, cwd) {
+  try {
+    const { stdout } = await execFile("git", args, { cwd, maxBuffer: MAX_GIT_OUTPUT_BYTES });
+    return stdout;
+  } catch (error2) {
+    if (isNotARepoError(error2)) throw new GitNotARepoError();
+    throw error2;
+  }
+}
+async function runGitAllowingExitCodes(args, cwd, allowedExitCodes) {
+  try {
+    const { stdout } = await execFile("git", args, { cwd, maxBuffer: MAX_GIT_OUTPUT_BYTES });
+    return stdout;
+  } catch (error2) {
+    if (isNotARepoError(error2)) throw new GitNotARepoError();
+    const code = error2.code;
+    const stdout = error2.stdout;
+    if (typeof code === "number" && allowedExitCodes.includes(code) && typeof stdout === "string") {
+      return stdout;
+    }
+    throw error2;
+  }
+}
+function runGitDiff(args, cwd) {
+  return runGit(["diff", ...SAFE_DIFF_FLAGS, ...args], cwd);
+}
+function runGitDiffAllowingExitCodes(args, cwd, allowedExitCodes) {
+  return runGitAllowingExitCodes(["diff", ...SAFE_DIFF_FLAGS, ...args], cwd, allowedExitCodes);
+}
+
+// src/projects/validate-path.ts
+var NOT_FOUND_CODES = /* @__PURE__ */ new Set(["ENOENT", "ENOTDIR"]);
+var PERMISSION_CODES = /* @__PURE__ */ new Set(["EACCES", "EPERM"]);
+function invalidReasonForFsError(error2) {
+  const code = error2?.code;
+  if (typeof code !== "string") return null;
+  if (NOT_FOUND_CODES.has(code)) return "not_found";
+  if (PERMISSION_CODES.has(code)) return "permission_denied";
+  return null;
+}
+function shellQuote(value) {
+  return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function gitFailure(error2, path) {
+  const { code, stderr } = error2;
+  if (code === "ENOENT") {
+    return new Error(
+      "git isn't installed, or isn't on the PATH of the terminal running bondsmithd."
+    );
+  }
+  const text = typeof stderr === "string" ? stderr : "";
+  if (text.includes("dubious ownership")) {
+    return new Error(
+      `git doesn't trust this folder because another user owns it. If you trust it, run: git config --global --add safe.directory ${shellQuote(path)}`
+    );
+  }
+  const fatal = text.split("\n").find((line) => line.startsWith("fatal:"));
+  return new Error(
+    fatal ?? (error2 instanceof Error ? error2.message : "git failed to inspect that folder.")
+  );
+}
+async function validateProjectPath(input) {
+  const expanded = expandHome(input.trim());
+  if (!isAbsolute(expanded)) return { valid: false, reason: "relative_path" };
+  const path = resolve(expanded);
+  try {
+    const stats = await stat(path);
+    if (!stats.isDirectory()) return { valid: false, reason: "not_a_directory" };
+  } catch (error2) {
+    const reason = invalidReasonForFsError(error2);
+    if (reason) return { valid: false, reason };
+    throw error2;
+  }
+  try {
+    const insideWorkTree = (await runGit(["rev-parse", "--is-inside-work-tree"], path)).trim();
+    if (insideWorkTree !== "true") return { valid: false, reason: "not_a_git_repo" };
+  } catch (error2) {
+    if (error2 instanceof GitNotARepoError) return { valid: false, reason: "not_a_git_repo" };
+    throw gitFailure(error2, path);
+  }
+  return { valid: true, path };
+}
+
 // src/relay/relay-client.ts
 import { sign } from "crypto";
 import WebSocket from "ws";
 
+// src/version.ts
+var DAEMON_VERSION = true ? "0.1.4" : "dev";
+var VERSION_FLAGS = ["--version", "-v"];
+function versionLine() {
+  return `bondsmithd ${DAEMON_VERSION} (protocol ${PROTOCOL_VERSION})`;
+}
+function isVersionRequest(argv) {
+  return argv.some((arg) => VERSION_FLAGS.includes(arg));
+}
+
 // src/sessions/tmux/client.ts
-import { execFile as execFileCb } from "child_process";
-import { promisify } from "util";
-var execFile = promisify(execFileCb);
+import { execFile as execFileCb2 } from "child_process";
+import { promisify as promisify2 } from "util";
+var execFile2 = promisify2(execFileCb2);
 var TmuxNoServerRunningError = class extends Error {
   constructor() {
     super("no tmux server running");
@@ -793,7 +999,7 @@ function filterSpawnEnv(env) {
 }
 async function runTmux(args, options) {
   try {
-    const { stdout } = await execFile("tmux", args, { ...options, encoding: "utf8" });
+    const { stdout } = await execFile2("tmux", args, { ...options, encoding: "utf8" });
     return stdout;
   } catch (error2) {
     if (error2?.code === "ENOENT") throw new TmuxNotFoundError();
@@ -824,9 +1030,18 @@ async function listTmuxSessions(formatString) {
     throw error2;
   }
 }
+var NO_SERVER_MESSAGE_PATTERNS = [
+  /no server running/i,
+  /no current session/i,
+  /no sessions/i,
+  /failed to connect to server/i,
+  /error connecting to .*\((no such file or directory|connection refused)\)/i
+];
 function isNoServerError(error2) {
-  if (typeof error2 !== "object" || error2 === null) return true;
-  return error2.code !== "ENOENT";
+  if (typeof error2 !== "object" || error2 === null) return false;
+  const { message, stderr } = error2;
+  const text = [message, stderr].filter((part) => typeof part === "string").join("\n");
+  return NO_SERVER_MESSAGE_PATTERNS.some((pattern) => pattern.test(text));
 }
 
 // src/security/verify-command.ts
@@ -834,8 +1049,8 @@ import { verify as verify2 } from "crypto";
 
 // src/security/trusted-controllers.ts
 import { mkdir, readFile, rename, rm, writeFile } from "fs/promises";
-import { homedir } from "os";
-import { dirname, join } from "path";
+import { homedir as homedir2 } from "os";
+import { dirname, join as join2 } from "path";
 import { z as z9 } from "zod";
 var trustedControllerSchema = z9.object({
   id: z9.string(),
@@ -858,7 +1073,7 @@ var trustedControllersFileSchema = z9.object({
   controllers: z9.array(trustedControllerSchema)
 });
 function defaultTrustedControllersPath() {
-  return join(homedir(), ".bondsmith", "trusted-controllers.json");
+  return join2(homedir2(), ".bondsmith", "trusted-controllers.json");
 }
 async function loadTrustedControllers(path = defaultTrustedControllersPath()) {
   let raw;
@@ -1007,6 +1222,76 @@ async function verifyCommand(command, daemonFingerprint, connectionState, truste
   return { ok: true };
 }
 
+// src/ws/output-pacer.ts
+var OUTPUT_HIGH_WATER_BYTES = 1024 * 1024;
+var OUTPUT_LOW_WATER_BYTES = 256 * 1024;
+var DRAIN_POLL_MS = 50;
+var MAX_CAPTURE_FAILURES = 5;
+var REPAINT_PREFIX = "\x1B[0m\x1B[2J\x1B[H";
+function createOutputPacer(options) {
+  const highWater = options.highWaterBytes ?? OUTPUT_HIGH_WATER_BYTES;
+  const lowWater = options.lowWaterBytes ?? OUTPUT_LOW_WATER_BYTES;
+  const pollMs = options.pollMs ?? DRAIN_POLL_MS;
+  let behind = false;
+  let disposed = false;
+  let captureFailures = 0;
+  let timer;
+  function scheduleRepaint() {
+    timer = setTimeout(() => void repaintWhenDrained(), pollMs);
+  }
+  async function repaintWhenDrained() {
+    timer = void 0;
+    if (disposed) return;
+    if (options.bufferedBytes() > lowWater) {
+      scheduleRepaint();
+      return;
+    }
+    let snapshot;
+    try {
+      snapshot = await options.snapshot();
+    } catch (error2) {
+      if (disposed) return;
+      captureFailures += 1;
+      if (captureFailures < MAX_CAPTURE_FAILURES) {
+        scheduleRepaint();
+        return;
+      }
+      console.warn("bondsmithd: giving up repainting a terminal after repeated capture failures", error2);
+      behind = false;
+      captureFailures = 0;
+      return;
+    }
+    if (disposed) return;
+    captureFailures = 0;
+    if (options.bufferedBytes() > lowWater) {
+      scheduleRepaint();
+      return;
+    }
+    try {
+      options.send(REPAINT_PREFIX + snapshot);
+    } catch (error2) {
+      console.error("bondsmithd: terminal repaint failed", error2);
+    }
+    behind = false;
+  }
+  return {
+    write(data) {
+      if (disposed || behind) return;
+      if (options.bufferedBytes() > highWater) {
+        behind = true;
+        scheduleRepaint();
+        return;
+      }
+      options.send(data);
+    },
+    dispose() {
+      disposed = true;
+      if (timer !== void 0) clearTimeout(timer);
+      timer = void 0;
+    }
+  };
+}
+
 // src/ws/router.ts
 var SIGNABLE_ACTION_SET = new Set(SIGNABLE_ACTIONS);
 function isSignableAction(type) {
@@ -1033,18 +1318,40 @@ function verifyRejectionMessage(reason) {
 var REVOKED_REJECTION_MESSAGE = "connection has not completed its handshake";
 var BRACKETED_PASTE_START = "\x1B[200~";
 var BRACKETED_PASTE_END = "\x1B[201~";
-function createRouterConnection(connectionAuth, send, markControllerId, ptyAttachments) {
+function releaseSession(conn, ptyAttachments, sessionId) {
+  const listener = conn.getOutputListener(sessionId);
+  if (listener) ptyAttachments.release(sessionId, listener);
+  conn.unregisterOutputListener(sessionId);
+  conn.subscriptions.delete(sessionId);
+}
+function createRouterConnection(connectionAuth, send, markControllerId, ptyAttachments, bufferedBytes) {
   const outputListeners = /* @__PURE__ */ new Map();
   const attachLocks = /* @__PURE__ */ new Map();
+  let closed = false;
+  let admissionChain = Promise.resolve();
   const conn = {
     subscriptions: /* @__PURE__ */ new Set(),
     send,
-    registerOutputListener: (sessionId, listener) => {
-      outputListeners.set(sessionId, listener);
+    bufferedBytes,
+    isClosed: () => closed,
+    registerOutputListener: (sessionId, listener, dispose) => {
+      outputListeners.get(sessionId)?.dispose?.();
+      outputListeners.set(sessionId, { listener, dispose });
+    },
+    getOutputListener: (sessionId) => outputListeners.get(sessionId)?.listener,
+    unregisterOutputListener: (sessionId) => {
+      outputListeners.get(sessionId)?.dispose?.();
+      outputListeners.delete(sessionId);
     },
-    getOutputListener: (sessionId) => outputListeners.get(sessionId),
     connectionAuth,
     markControllerId,
+    admitInOrder: (fn) => {
+      const next = admissionChain.catch(() => {
+      }).then(fn);
+      admissionChain = next.catch(() => {
+      });
+      return next;
+    },
     withAttachLock: (sessionId, fn) => {
       const previous = attachLocks.get(sessionId) ?? Promise.resolve();
       const next = previous.catch(() => {
@@ -1058,15 +1365,15 @@ function createRouterConnection(connectionAuth, send, markControllerId, ptyAttac
     }
   };
   function releaseAllSubscriptions() {
-    for (const sessionId of conn.subscriptions) {
-      const listener = outputListeners.get(sessionId);
-      if (listener) ptyAttachments.release(sessionId, listener);
+    closed = true;
+    for (const sessionId of [...conn.subscriptions]) {
+      releaseSession(conn, ptyAttachments, sessionId);
     }
   }
   return { conn, releaseAllSubscriptions };
 }
-function error(message) {
-  return { type: "error", message };
+function error(message, requestId) {
+  return { type: "error", message, requestId };
 }
 function errorMessageOf(err, fallback) {
   return err instanceof Error ? err.message : fallback;
@@ -1082,35 +1389,39 @@ async function handleBrowserMessage(conn, raw, deps) {
     const { envelope } = signedCommand.data;
     const innerMessage = browserMessageSchema.safeParse(envelope.payload);
     if (!innerMessage.success || innerMessage.data.type !== envelope.action) {
-      conn.send(error("invalid message"));
-      return;
-    }
-    const verdict = await verifyCommand(
-      signedCommand.data,
-      deps.daemonFingerprint,
-      conn.connectionAuth,
-      deps.trustedControllersPath
-    );
-    if (!verdict.ok) {
-      conn.send(error(verifyRejectionMessage(verdict.reason)));
-      return;
-    }
-    if (conn.connectionAuth.isRevoked()) {
-      conn.send(error(REVOKED_REJECTION_MESSAGE));
+      conn.send(error(INVALID_MESSAGE_ERROR));
       return;
     }
+    const admitted = await conn.admitInOrder(async () => {
+      const verdict = await verifyCommand(
+        signedCommand.data,
+        deps.daemonFingerprint,
+        conn.connectionAuth,
+        deps.trustedControllersPath
+      );
+      if (!verdict.ok) {
+        conn.send(error(verifyRejectionMessage(verdict.reason)));
+        return false;
+      }
+      if (conn.connectionAuth.isRevoked()) {
+        conn.send(error(REVOKED_REJECTION_MESSAGE));
+        return false;
+      }
+      return true;
+    });
+    if (!admitted) return;
     await dispatch(conn, innerMessage.data, deps);
     return;
   }
   const parsed = browserMessageSchema.safeParse(raw);
   if (!parsed.success) {
-    conn.send(error("invalid message"));
+    conn.send(error(INVALID_MESSAGE_ERROR));
     return;
   }
   if (parsed.data.type === "connection.authenticate") {
-    const result = await conn.connectionAuth.authenticate(
-      parsed.data.signed,
-      deps.trustedControllersPath
+    const { signed } = parsed.data;
+    const result = await conn.admitInOrder(
+      () => conn.connectionAuth.authenticate(signed, deps.trustedControllersPath)
     );
     if (!result.ok) {
       conn.send({ type: "connection.authenticationFailed", reason: result.reason });
@@ -1132,6 +1443,7 @@ async function dispatch(conn, message, {
   broadcast,
   getWorkspaceStatus: getWorkspaceStatus2,
   getWorkspaceDiff: getWorkspaceDiff2,
+  validateProjectPath: validateProjectPath2,
   hostname: hostname3,
   daemonFingerprint,
   pendingAuthorizations,
@@ -1143,26 +1455,39 @@ async function dispatch(conn, message, {
       return;
     }
     case "session.create": {
-      const { title, cwd, command, requestId } = message;
+      const { title, cwd, command, worktreeBranch, requestId } = message;
       try {
-        const session = await sessionManager.create({ title, cwd, command });
+        const session = await sessionManager.create({ title, cwd, command, worktreeBranch });
         broadcast({ type: "session.created", session, requestId });
       } catch (err) {
-        conn.send(error(errorMessageOf(err, "failed to create session")));
+        conn.send(error(errorMessageOf(err, "failed to create session"), requestId));
       }
       return;
     }
     case "session.attach": {
+      const { requestId } = message;
       if (!isValidSessionId(message.sessionId)) {
-        conn.send(error("invalid session id"));
+        conn.send(error("invalid session id", requestId));
+        return;
+      }
+      const session = sessionManager.get(message.sessionId);
+      if (!session) {
+        conn.send(error("unknown session", requestId));
         return;
       }
-      const session = getSessionOrError(sessionManager, conn, message.sessionId);
-      if (!session) return;
       await conn.withAttachLock(message.sessionId, async () => {
         const previousListener = conn.getOutputListener(message.sessionId);
-        const onData = (data) => {
-          conn.send({ type: "terminal.output", sessionId: message.sessionId, data });
+        const output = createOutputPacer({
+          send: (data) => conn.send({ type: "terminal.output", sessionId: message.sessionId, data }),
+          bufferedBytes: conn.bufferedBytes,
+          snapshot: () => ptyAttachments.paneSnapshot(session.tmuxSessionName)
+        });
+        const onData = output.write;
+        const abandonedBecauseClosed = () => {
+          if (!conn.isClosed()) return false;
+          ptyAttachments.release(message.sessionId, onData);
+          output.dispose();
+          return true;
         };
         if (previousListener && await ptyAttachments.swapListener(
           message.sessionId,
@@ -1170,26 +1495,38 @@ async function dispatch(conn, message, {
           previousListener,
           onData
         )) {
+          if (abandonedBecauseClosed()) return;
           conn.subscriptions.add(message.sessionId);
-          conn.registerOutputListener(message.sessionId, onData);
-          conn.send({ type: "session.attached", sessionId: message.sessionId });
+          conn.registerOutputListener(message.sessionId, onData, output.dispose);
+          conn.send({ type: "session.attached", sessionId: message.sessionId, requestId });
           return;
         }
         if (previousListener) {
           ptyAttachments.release(message.sessionId, previousListener);
+          conn.unregisterOutputListener(message.sessionId);
         }
         const attached = await ptyAttachments.ensureAttached(
           message.sessionId,
           session.tmuxSessionName,
-          onData
+          onData,
+          message.size
         );
         if (!attached) {
-          conn.send(error("failed to attach to session"));
+          output.dispose();
+          conn.send(error("failed to attach to session", requestId));
           return;
         }
+        if (abandonedBecauseClosed()) return;
         conn.subscriptions.add(message.sessionId);
-        conn.registerOutputListener(message.sessionId, onData);
-        conn.send({ type: "session.attached", sessionId: message.sessionId });
+        conn.registerOutputListener(message.sessionId, onData, output.dispose);
+        conn.send({ type: "session.attached", sessionId: message.sessionId, requestId });
+      });
+      return;
+    }
+    case "session.detach": {
+      if (!isValidSessionId(message.sessionId)) return;
+      await conn.withAttachLock(message.sessionId, async () => {
+        releaseSession(conn, ptyAttachments, message.sessionId);
       });
       return;
     }
@@ -1265,6 +1602,15 @@ async function dispatch(conn, message, {
       }
       return;
     }
+    case "project.validatePath": {
+      try {
+        const result = await validateProjectPath2(message.path);
+        conn.send({ type: "project.pathValidated", requestId: message.requestId, result });
+      } catch (err) {
+        conn.send(error(errorMessageOf(err, "failed to validate project path"), message.requestId));
+      }
+      return;
+    }
     case "daemon.getInfo": {
       conn.send({ type: "daemon.info", hostname: hostname3(), daemonFingerprint });
       return;
@@ -1587,7 +1933,9 @@ function startRelayClient(deps) {
       },
       () => {
       },
-      deps.ptyAttachments
+      deps.ptyAttachments,
+      // One socket carries every browser session, so a backed-up relay link slows all of them together.
+      () => ws.bufferedAmount
     );
   }
   function handleSessionOpened(ws, relaySessionId) {
@@ -1615,7 +1963,9 @@ function startRelayClient(deps) {
       challenge: challenge.challenge,
       daemonFingerprint: deps.daemonFingerprint,
       hostname: deps.hostname(),
-      expiresAt: challenge.expiresAt
+      expiresAt: challenge.expiresAt,
+      protocolVersion: PROTOCOL_VERSION,
+      daemonVersion: DAEMON_VERSION
     });
   }
   function handleFrame(frame) {
@@ -1713,10 +2063,10 @@ function startRelayClient(deps) {
 // src/security/daemon-identity.ts
 import { generateKeyPairSync, sign as sign2, verify as verify4 } from "crypto";
 import { mkdir as mkdir2, readFile as readFile2, rename as rename2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join2 } from "path";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname2, join as join3 } from "path";
 function defaultCredentialsPath() {
-  return join2(homedir2(), ".bondsmith", "credentials");
+  return join3(homedir3(), ".bondsmith", "credentials");
 }
 async function loadOrCreateDaemonIdentity(credentialsPath = defaultCredentialsPath()) {
   const existing = await tryReadIdentity(credentialsPath);
@@ -1778,10 +2128,10 @@ function extractPemBlock(text, label) {
 // src/security/dev-tunnel-token-file.ts
 import { randomBytes as randomBytes2 } from "crypto";
 import { mkdir as mkdir3, readFile as readFile3, rename as rename3, rm as rm3, writeFile as writeFile3 } from "fs/promises";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname3, join as join3 } from "path";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname3, join as join4 } from "path";
 function defaultDevTunnelTokenPath() {
-  return join3(homedir3(), ".bondsmith", "dev-tunnel-token");
+  return join4(homedir4(), ".bondsmith", "dev-tunnel-token");
 }
 async function loadOrCreateDevTunnelToken(tokenPath = defaultDevTunnelTokenPath()) {
   const existing = await tryReadToken(tokenPath);
@@ -1813,12 +2163,27 @@ async function persistToken(tokenPath, token) {
 
 // src/security/pending-authorizations.ts
 import { createHash, randomUUID } from "crypto";
+
+// src/security/controller-label.ts
+var MAX_LABEL_CHARACTERS = 60;
+var MAX_STACKED_MARKS = 3;
+var FALLBACK_LABEL = "Unnamed browser";
+var EXCESS_MARKS = new RegExp(`(\\p{M}{${MAX_STACKED_MARKS}})\\p{M}+`, "gu");
+function sanitizeControllerLabel(raw) {
+  const printable = raw.replace(/\p{C}/gu, " ").replace(EXCESS_MARKS, "$1").replace(/\s+/g, " ").trim();
+  const clipped = Array.from(printable).slice(0, MAX_LABEL_CHARACTERS).join("").trim();
+  return clipped === "" ? FALLBACK_LABEL : clipped;
+}
+
+// src/security/pending-authorizations.ts
 function controllerIdFromPublicKeySync(publicKeyPem) {
   return createHash("sha256").update(publicKeyPem).digest("hex").slice(0, 32);
 }
 var REQUEST_EXPIRY_MS = 5 * 6e4;
 var MAX_REQUESTS_PER_WINDOW = 5;
 var RATE_LIMIT_WINDOW_MS = 6e4;
+var MAX_PENDING_REQUESTS = 5;
+var MAX_NEW_REQUESTS_PER_WINDOW = 10;
 var PendingAuthorizationStore = class {
   // Invariant: at most one PendingEntry per controllerId at any time. A
   // conflicting requestEnrollment call for a controllerId that already has
@@ -1829,6 +2194,7 @@ var PendingAuthorizationStore = class {
   // resolve a newer, unrelated one.
   pending = /* @__PURE__ */ new Map();
   requestTimestamps = /* @__PURE__ */ new Map();
+  allRequestTimestamps = [];
   isInteractive;
   trustedControllersPath;
   constructor(options = {}) {
@@ -1874,7 +2240,7 @@ var PendingAuthorizationStore = class {
         result: existing.resultPromise
       };
     }
-    if (this.isRateLimited(controllerId)) {
+    if (this.isRateLimited(controllerId) || this.isOverGlobalLimits()) {
       return { ok: false, reason: "rate_limited" };
     }
     this.recordRequestTimestamp(controllerId);
@@ -1882,15 +2248,15 @@ var PendingAuthorizationStore = class {
     const authorization = {
       controllerId,
       publicKeyPem: params.publicKeyPem,
-      label: params.label,
+      label: sanitizeControllerLabel(params.label),
       fingerprint: "",
       requestedAt: now,
       expiresAt: now + REQUEST_EXPIRY_MS,
       requestToken: randomUUID()
     };
     let settleFn;
-    const resultPromise = new Promise((resolve) => {
-      settleFn = resolve;
+    const resultPromise = new Promise((resolve2) => {
+      settleFn = resolve2;
     });
     const entry = {
       authorization,
@@ -1970,19 +2336,33 @@ var PendingAuthorizationStore = class {
       entry.settle("cancelled");
     }
   }
+  /** True while this exact request is still waiting for an answer, so a queued prompt can skip one that expired or was cancelled. */
+  isPending(controllerId, requestToken) {
+    const entry = this.pending.get(controllerId);
+    return entry !== void 0 && !entry.settled && entry.authorization.requestToken === requestToken && entry.authorization.expiresAt > Date.now();
+  }
   isRateLimited(controllerId) {
     const timestamps = this.requestTimestamps.get(controllerId) ?? [];
     const windowStart = Date.now() - RATE_LIMIT_WINDOW_MS;
     const recent = timestamps.filter((t) => t > windowStart);
     return recent.length >= MAX_REQUESTS_PER_WINDOW;
   }
-  recordRequestTimestamp(controllerId) {
+  isOverGlobalLimits() {
     const windowStart = Date.now() - RATE_LIMIT_WINDOW_MS;
-    const timestamps = (this.requestTimestamps.get(controllerId) ?? []).filter(
-      (t) => t > windowStart
-    );
-    timestamps.push(Date.now());
-    this.requestTimestamps.set(controllerId, timestamps);
+    const recent = this.allRequestTimestamps.filter((t) => t > windowStart);
+    return recent.length >= MAX_NEW_REQUESTS_PER_WINDOW || this.pending.size >= MAX_PENDING_REQUESTS;
+  }
+  recordRequestTimestamp(controllerId) {
+    const now = Date.now();
+    const windowStart = now - RATE_LIMIT_WINDOW_MS;
+    this.allRequestTimestamps = this.allRequestTimestamps.filter((t) => t > windowStart);
+    this.allRequestTimestamps.push(now);
+    for (const [key, timestamps] of this.requestTimestamps) {
+      if (!timestamps.some((t) => t > windowStart)) this.requestTimestamps.delete(key);
+    }
+    const recent = (this.requestTimestamps.get(controllerId) ?? []).filter((t) => t > windowStart);
+    recent.push(now);
+    this.requestTimestamps.set(controllerId, recent);
   }
 };
 
@@ -2094,81 +2474,101 @@ function startRevocationSync(deps) {
 // src/security/terminal-approval.ts
 import { createInterface } from "readline";
 function presentPendingAuthorizationOnTerminal(store) {
-  return (pending) => {
+  const waiting = [];
+  let prompting = false;
+  let inputEnded = false;
+  const record = (pending, approved) => {
+    store.resolve(pending.controllerId, pending.requestToken, approved).catch((error2) => {
+      console.error("Failed to record controller authorization decision", error2);
+    });
+  };
+  const askNext = () => {
+    if (prompting) return;
+    const pending = waiting.shift();
+    if (!pending) return;
+    if (!store.isPending(pending.controllerId, pending.requestToken)) {
+      askNext();
+      return;
+    }
+    if (inputEnded) {
+      record(pending, false);
+      askNext();
+      return;
+    }
+    prompting = true;
     console.log("");
     console.log("  Bondsmith controller authorization request");
-    console.log(`  Browser:     ${pending.label}`);
+    console.log(`  Browser:     "${pending.label}"`);
     console.log(`  Fingerprint: ${pending.fingerprint}`);
+    if (waiting.length > 0) console.log(`  (${waiting.length} more waiting after this one)`);
     console.log("");
     console.log("  Allow this browser to control local sessions? [y/N]");
     const rl = createInterface({ input: process.stdin, output: process.stdout });
-    rl.question("  > ", (answer) => {
+    let answered = false;
+    let expired = false;
+    const expiryTimer = setTimeout(
+      () => {
+        expired = true;
+        rl.close();
+      },
+      Math.max(0, pending.expiresAt - Date.now())
+    );
+    const finish = (approved) => {
+      if (answered) return;
+      answered = true;
+      clearTimeout(expiryTimer);
       rl.close();
-      const approved = answer.trim().toLowerCase() === "y";
-      store.resolve(pending.controllerId, pending.requestToken, approved).catch((error2) => {
-        console.error("Failed to record controller authorization decision", error2);
-      });
-      console.log(approved ? "  Approved." : "  Denied.");
+      record(pending, approved);
+      if (expired) console.log("  Request expired.");
+      else console.log(approved ? "  Approved." : "  Denied.");
       console.log("");
+      prompting = false;
+      askNext();
+    };
+    rl.question("  > ", (answer) => finish(answer.trim().toLowerCase() === "y"));
+    rl.on("SIGINT", () => finish(false));
+    rl.on("close", () => {
+      if (!answered && !expired) inputEnded = true;
+      finish(false);
     });
   };
+  return (pending) => {
+    waiting.push(pending);
+    askNext();
+  };
 }
 
-// src/sessions/git/client.ts
-import { execFile as execFileCb2 } from "child_process";
-import { promisify as promisify2 } from "util";
-var execFile2 = promisify2(execFileCb2);
-var GitNotARepoError = class extends Error {
-  constructor() {
-    super("not a git repository");
-    this.name = "GitNotARepoError";
-  }
-};
-function isNotARepoError(error2) {
-  if (typeof error2 !== "object" || error2 === null) return false;
-  const stderr = error2.stderr;
-  return typeof stderr === "string" && stderr.includes("not a git repository");
-}
-async function runGit(args, cwd) {
+// src/sessions/git/base.ts
+var EMPTY_TREE_SHA = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+var DEFAULT_BRANCH_CANDIDATES = ["origin/main", "origin/master", "main", "master"];
+async function tryGit(args, cwd) {
   try {
-    const { stdout } = await execFile2("git", args, { cwd });
-    return stdout;
-  } catch (error2) {
-    if (isNotARepoError(error2)) throw new GitNotARepoError();
-    throw error2;
+    return (await runGit(args, cwd)).trim() || null;
+  } catch {
+    return null;
   }
 }
-async function runGitAllowingExitCodes(args, cwd, allowedExitCodes) {
-  try {
-    const { stdout } = await execFile2("git", args, { cwd });
-    return stdout;
-  } catch (error2) {
-    if (isNotARepoError(error2)) throw new GitNotARepoError();
-    const code = error2.code;
-    const stdout = error2.stdout;
-    if (typeof code === "number" && allowedExitCodes.includes(code) && typeof stdout === "string") {
-      return stdout;
+async function findDefaultBranchRef(cwd) {
+  const remoteHead = await tryGit(
+    ["symbolic-ref", "--quiet", "--short", "refs/remotes/origin/HEAD"],
+    cwd
+  );
+  if (remoteHead) return remoteHead;
+  for (const candidate of DEFAULT_BRANCH_CANDIDATES) {
+    if (await tryGit(["rev-parse", "--verify", "--quiet", `${candidate}^{commit}`], cwd)) {
+      return candidate;
     }
-    throw error2;
   }
+  return null;
 }
-
-// src/sessions/git/diff.ts
-async function getWorkspaceDiff(cwd, path, staged) {
-  const numstatArgs = staged ? ["diff", "--cached", "--numstat", "--", path] : ["diff", "--numstat", "--", path];
-  const numstat = await runGit(numstatArgs, cwd);
-  const binary = /^(-\t-\t)/.test(numstat.trim());
-  if (binary) {
-    return { path, staged, patch: null, binary: true };
+async function resolveComparisonBase(cwd) {
+  if (!await tryGit(["rev-parse", "--verify", "--quiet", "HEAD^{commit}"], cwd)) {
+    return { sha: EMPTY_TREE_SHA, ref: null };
   }
-  const diffArgs = staged ? ["diff", "--cached", "--", path] : ["diff", "--", path];
-  let patch = await runGit(diffArgs, cwd);
-  if (patch.trim() === "" && !staged) {
-    patch = await runGitAllowingExitCodes(["diff", "--no-index", "--", "/dev/null", path], cwd, [
-      1
-    ]).catch(() => "");
-  }
-  return { path, staged, patch: patch || null, binary: false };
+  const defaultRef = await findDefaultBranchRef(cwd);
+  if (!defaultRef) return { sha: "HEAD", ref: null };
+  const mergeBase = await tryGit(["merge-base", "HEAD", defaultRef], cwd);
+  return mergeBase ? { sha: mergeBase, ref: defaultRef } : { sha: "HEAD", ref: null };
 }
 
 // src/sessions/git/status.ts
@@ -2178,7 +2578,11 @@ async function getCurrentBranch(cwd) {
     return out === "" || out === "HEAD" ? null : out;
   } catch (err) {
     if (err instanceof GitNotARepoError) return null;
-    throw err;
+    try {
+      return (await runGit(["symbolic-ref", "--quiet", "--short", "HEAD"], cwd)).trim() || null;
+    } catch {
+      throw err;
+    }
   }
 }
 async function getRepositoryFullName(cwd) {
@@ -2228,88 +2632,73 @@ function parseNumstat(output) {
   }
   return map;
 }
-var STATUS_CODE_MAP = {
+var STATUS_BY_LETTER = {
   A: "added",
   M: "modified",
   D: "deleted",
   R: "renamed",
   C: "copied",
+  T: "modified",
+  // type change, such as a file becoming a symlink
   U: "modified"
-  // unmerged — treated as modified, no conflict-resolution UI in scope
+  // unmerged: no conflict-resolution UI yet, so it reads as modified
 };
-async function getWorkspaceStatus(cwd) {
-  const branch = await getCurrentBranch(cwd);
-  if (branch === null && !await isGitRepo(cwd)) {
-    return { isGitRepo: false, branch: null, files: [] };
-  }
-  const [porcelain, unstagedRaw, stagedRaw] = await Promise.all([
-    runGit(["status", "--porcelain=v1", "-z"], cwd),
-    runGit(["diff", "--numstat", "-z"], cwd),
-    runGit(["diff", "--cached", "--numstat", "-z"], cwd)
-  ]);
-  const unstagedNumstat = parseNumstat(unstagedRaw);
-  const stagedNumstat = parseNumstat(stagedRaw);
-  const files = parsePorcelain(porcelain, unstagedNumstat, stagedNumstat);
-  return { isGitRepo: true, branch, files };
-}
-function parsePorcelain(porcelain, unstagedNumstat, stagedNumstat) {
-  const entries = [];
-  const fields = porcelain.split("\0").filter((f) => f.length > 0);
+function isStatusLetter(letter) {
+  return letter in STATUS_BY_LETTER;
+}
+function parseNameStatus(output) {
+  const fields = output.split("\0").filter((f) => f.length > 0);
+  const changed = [];
   let i = 0;
   while (i < fields.length) {
-    const raw = fields[i];
-    const x = raw[0] ?? " ";
-    const y = raw[1] ?? " ";
-    const path = raw.slice(3);
-    i++;
-    if (x === "R" || x === "C" || y === "R" || y === "C") {
-      const previousPath = fields[i];
-      i++;
-      if (previousPath === void 0) continue;
-      pushEntriesForPath(entries, path, x, y, previousPath, unstagedNumstat, stagedNumstat);
-      continue;
+    const letter = fields[i++][0] ?? "";
+    const status = isStatusLetter(letter) ? STATUS_BY_LETTER[letter] : "modified";
+    if (status === "renamed" || status === "copied") {
+      const previousPath = fields[i++];
+      const path = fields[i++];
+      if (previousPath === void 0 || path === void 0) break;
+      changed.push({ path, previousPath, status });
+    } else {
+      const path = fields[i++];
+      if (path === void 0) break;
+      changed.push({ path, status });
     }
-    pushEntriesForPath(entries, path, x, y, void 0, unstagedNumstat, stagedNumstat);
   }
-  return entries;
+  return changed;
 }
-function pushEntriesForPath(entries, path, x, y, previousPath, unstagedNumstat, stagedNumstat) {
-  if (x === "?" && y === "?") {
-    const numstat = unstagedNumstat.get(path);
-    entries.push({
-      path,
-      status: "untracked",
-      staged: false,
-      additions: numstat?.additions ?? null,
-      deletions: numstat?.deletions ?? null,
-      binary: numstat?.binary ?? false
-    });
-    return;
-  }
-  if (x !== " " && x !== "?") {
-    const numstat = stagedNumstat.get(path);
-    entries.push({
-      path,
-      previousPath,
-      status: STATUS_CODE_MAP[x] ?? "modified",
-      staged: true,
-      additions: numstat?.additions ?? null,
-      deletions: numstat?.deletions ?? null,
-      binary: numstat?.binary ?? false
-    });
+async function getWorkspaceStatus(cwd) {
+  const branch = await getCurrentBranch(cwd);
+  if (branch === null && !await isGitRepo(cwd)) {
+    return { isGitRepo: false, branch: null, files: [] };
   }
-  if (y !== " " && y !== "?") {
-    const numstat = unstagedNumstat.get(path);
-    entries.push({
-      path,
-      previousPath,
-      status: STATUS_CODE_MAP[y] ?? "modified",
+  const base = await resolveComparisonBase(cwd);
+  const [nameStatusRaw, numstatRaw, untrackedRaw] = await Promise.all([
+    runGitDiff(["--name-status", "-z", "-M", base.sha], cwd),
+    runGitDiff(["--numstat", "-z", "-M", base.sha], cwd),
+    runGit(["ls-files", "--others", "--exclude-standard", "-z"], cwd)
+  ]);
+  const numstat = parseNumstat(numstatRaw);
+  const tracked = parseNameStatus(nameStatusRaw).map((changed) => {
+    const counts = numstat.get(changed.path);
+    return {
+      path: changed.path,
+      previousPath: changed.previousPath,
+      status: changed.status,
       staged: false,
-      additions: numstat?.additions ?? null,
-      deletions: numstat?.deletions ?? null,
-      binary: numstat?.binary ?? false
-    });
-  }
+      additions: counts?.additions ?? null,
+      deletions: counts?.deletions ?? null,
+      binary: counts?.binary ?? false
+    };
+  });
+  const untracked = untrackedRaw.split("\0").filter((path) => path.length > 0).map((path) => ({
+    path,
+    status: "untracked",
+    staged: false,
+    additions: null,
+    deletions: null,
+    binary: false
+  }));
+  return { isGitRepo: true, branch, baseRef: base.ref, files: [...tracked, ...untracked] };
 }
 async function enrichSessionWithGitMetadata(session) {
   const [branch, repositoryFullName, status, lastActivityAt] = await Promise.all([
@@ -2328,6 +2717,33 @@ async function enrichSessionWithGitMetadata(session) {
   };
 }
 
+// src/sessions/git/diff.ts
+async function withRenameSource(cwd, baseSha, path) {
+  const nameStatus = await runGitDiff(["--name-status", "-z", "-M", baseSha], cwd);
+  const previousPath = parseNameStatus(nameStatus).find((c) => c.path === path)?.previousPath;
+  return previousPath === void 0 ? [path] : [previousPath, path];
+}
+async function isUntracked(cwd, path) {
+  const out = await runGit(["ls-files", "--others", "--exclude-standard", "--", path], cwd);
+  return out.trim() !== "";
+}
+async function getWorkspaceDiff(cwd, path, staged) {
+  const base = await resolveComparisonBase(cwd);
+  const pathspec = await withRenameSource(cwd, base.sha, path);
+  const numstat = await runGitDiff(["--numstat", "-M", base.sha, "--", ...pathspec], cwd);
+  const binary = /^(-\t-\t)/.test(numstat.trim());
+  if (binary) {
+    return { path, staged, patch: null, binary: true };
+  }
+  let patch = await runGitDiff(["-M", base.sha, "--", ...pathspec], cwd);
+  if (patch.trim() === "" && await isUntracked(cwd, path)) {
+    patch = await runGitDiffAllowingExitCodes(["--no-index", "--", "/dev/null", path], cwd, [
+      1
+    ]).catch(() => "");
+  }
+  return { path, staged, patch: patch || null, binary: false };
+}
+
 // src/ws/server.ts
 import { hostname } from "os";
 import { WebSocketServer } from "ws";
@@ -2353,23 +2769,40 @@ function isAllowedOrigin(origin, allowlist) {
 
 // src/sessions/pty-attachment.ts
 import * as pty from "node-pty";
+var DEFAULT_PTY_SIZE = { cols: 80, rows: 24 };
+var MAX_SNAPSHOT_JSON_BYTES = 128 * 1024;
+function keepBottomRows(rows) {
+  let budget = MAX_SNAPSHOT_JSON_BYTES;
+  let first = rows.length;
+  while (first > 0) {
+    budget -= JSON.stringify(rows[first - 1]).length;
+    if (budget < 0) break;
+    first -= 1;
+  }
+  return rows.slice(first);
+}
+function snapshotToTerminalOutput(snapshot) {
+  const rows = snapshot.replace(/\r?\n$/, "").split(/\r?\n/);
+  return keepBottomRows(rows).join("\r\n");
+}
 var PtyAttachmentManager = class {
   handles = /* @__PURE__ */ new Map();
   /**
    * Attempts to attach (spawning a pty if one isn't already running for this
    * session). Returns false, without throwing, if the pty could not be
    * spawned — a spawn failure here must never take down the whole daemon
-   * process, since every other session's pty would die with it.
+   * process, since every other session's pty would die with it. `size` only
+   * applies to a pty spawned here; an existing one keeps its current size.
    */
-  async ensureAttached(sessionId, tmuxSessionName, onData) {
+  async ensureAttached(sessionId, tmuxSessionName, onData, size = DEFAULT_PTY_SIZE) {
     let handle = this.handles.get(sessionId);
     if (!handle) {
       let ptyProcess;
       try {
         ptyProcess = pty.spawn("tmux", ["attach-session", "-t", tmuxSessionName], {
           name: "xterm-256color",
-          cols: 80,
-          rows: 24,
+          cols: size.cols,
+          rows: size.rows,
           cwd: process.env.HOME,
           env: filterSpawnEnv(process.env)
         });
@@ -2381,16 +2814,16 @@ ${new TmuxNotFoundError().message}
         }
         return false;
       }
-      handle = { process: ptyProcess, refCount: 0, dataListeners: /* @__PURE__ */ new Set() };
-      this.handles.set(sessionId, handle);
+      const created = { process: ptyProcess, refCount: 0, dataListeners: /* @__PURE__ */ new Set() };
+      this.handles.set(sessionId, created);
       ptyProcess.onData((data) => {
-        for (const listener of handle?.dataListeners ?? []) listener(data);
+        for (const listener of created.dataListeners) listener(data);
       });
       ptyProcess.onExit(() => {
-        this.handles.delete(sessionId);
+        if (this.handles.get(sessionId) === created) this.handles.delete(sessionId);
       });
-      handle.refCount += 1;
-      handle.dataListeners.add(onData);
+      created.refCount += 1;
+      created.dataListeners.add(onData);
       return true;
     }
     await this.sendPaneSnapshot(tmuxSessionName, onData);
@@ -2407,17 +2840,20 @@ ${new TmuxNotFoundError().message}
     handle.dataListeners.add(nextOnData);
     return true;
   }
+  /** The pane's current screen as terminal output; rejects if tmux cannot capture it. */
+  async paneSnapshot(tmuxSessionName) {
+    return snapshotToTerminalOutput(await capturePane(tmuxSessionName));
+  }
   // Best-effort: a capture failure just leaves this listener blank until the next real write.
   async sendPaneSnapshot(tmuxSessionName, onData) {
     try {
-      onData(await capturePane(tmuxSessionName));
+      onData(await this.paneSnapshot(tmuxSessionName));
     } catch {
     }
   }
   release(sessionId, onData) {
     const handle = this.handles.get(sessionId);
-    if (!handle) return;
-    handle.dataListeners.delete(onData);
+    if (!handle?.dataListeners.delete(onData)) return;
     handle.refCount -= 1;
     if (handle.refCount <= 0) {
       handle.process.kill();
@@ -2442,23 +2878,84 @@ ${new TmuxNotFoundError().message}
 // src/sessions/session-manager.ts
 import { v4 as uuidv4 } from "uuid";
 
+// src/sessions/git/worktree.ts
+import { execFile as execFileCb3 } from "child_process";
+import { promisify as promisify3 } from "util";
+var execFile3 = promisify3(execFileCb3);
+var WorktreeBranchNameTakenError = class extends Error {
+  constructor(branch) {
+    super(`a branch named "${branch}" already exists`);
+    this.name = "WorktreeBranchNameTakenError";
+  }
+};
+var WorktreePathExistsError = class extends Error {
+  constructor(path) {
+    super(`worktree path already exists: ${path}`);
+    this.name = "WorktreePathExistsError";
+  }
+};
+var WorktreeHasUncommittedChangesError = class extends Error {
+  constructor(path) {
+    super(
+      `worktree at ${path} has uncommitted or untracked changes \u2014 not removing it. Commit or discard the changes, then remove it yourself (git worktree remove ${path}).`
+    );
+    this.name = "WorktreeHasUncommittedChangesError";
+  }
+};
+function stderrOf(error2) {
+  if (typeof error2 !== "object" || error2 === null) return "";
+  const stderr = error2.stderr;
+  return typeof stderr === "string" ? stderr : "";
+}
+async function createWorktree(sourceCwd, worktreePath, branch) {
+  try {
+    await execFile3("git", ["worktree", "add", "-b", branch, worktreePath], { cwd: sourceCwd });
+  } catch (error2) {
+    const stderr = stderrOf(error2);
+    if (stderr.includes("a branch named")) {
+      throw new WorktreeBranchNameTakenError(branch);
+    }
+    if (stderr.includes("already exists")) {
+      throw new WorktreePathExistsError(worktreePath);
+    }
+    throw error2;
+  }
+}
+async function removeWorktree(sourceCwd, worktreePath) {
+  try {
+    await execFile3("git", ["worktree", "remove", worktreePath], { cwd: sourceCwd });
+  } catch (error2) {
+    const stderr = stderrOf(error2);
+    if (stderr.includes("contains modified or untracked files")) {
+      throw new WorktreeHasUncommittedChangesError(worktreePath);
+    }
+    throw error2;
+  }
+}
+
 // src/sessions/tmux/create.ts
 import { access } from "fs/promises";
-import { homedir as homedir4 } from "os";
-import { join as join4 } from "path";
+import { homedir as homedir5 } from "os";
+import { join as join5 } from "path";
 var InvalidCwdError = class extends Error {
   constructor(cwd) {
     super(`working directory does not exist: ${cwd}`);
     this.name = "InvalidCwdError";
   }
 };
-function expandHome(cwd) {
-  if (cwd === "~") return homedir4();
-  if (cwd.startsWith("~/")) return join4(homedir4(), cwd.slice(2));
-  return cwd;
+function worktreePathFor(sessionId) {
+  return join5(homedir5(), ".bondsmith", "worktrees", sessionId);
 }
 async function createTmuxSession(input) {
-  const cwd = expandHome(input.cwd);
+  const sourceCwd = expandHome(input.cwd);
+  let cwd = sourceCwd;
+  let worktreeOf = null;
+  if (input.worktreeBranch) {
+    const worktreePath = worktreePathFor(input.id);
+    await createWorktree(sourceCwd, worktreePath, input.worktreeBranch);
+    cwd = worktreePath;
+    worktreeOf = sourceCwd;
+  }
   try {
     await access(cwd);
   } catch {
@@ -2474,6 +2971,9 @@ async function createTmuxSession(input) {
   await runTmux(["set-option", "-t", tmuxSessionName, "@bondsmith-command", input.command]);
   await runTmux(["set-option", "-t", tmuxSessionName, "@bondsmith-cwd", cwd]);
   await runTmux(["set-option", "-t", tmuxSessionName, "@bondsmith-started-at", startedAt]);
+  if (worktreeOf) {
+    await runTmux(["set-option", "-t", tmuxSessionName, "@bondsmith-worktree-of", worktreeOf]);
+  }
   const session = {
     id: input.id,
     title: input.title,
@@ -2485,7 +2985,8 @@ async function createTmuxSession(input) {
     branch: null,
     repositoryFullName: null,
     lastActivityAt: null,
-    changedFileCount: null
+    changedFileCount: null,
+    worktreeOf
   };
   return enrichSessionWithGitMetadata(session);
 }
@@ -2494,14 +2995,14 @@ async function stopTmuxSession(tmuxSessionName) {
 }
 
 // src/sessions/tmux/parse.ts
-var FIELD_COUNT = 6;
+var FIELD_COUNT = 7;
 function parseTmuxSessions(output) {
   const sessions = [];
   for (const line of output.split("\n")) {
     if (!line.trim()) continue;
     const fields = line.split("	");
     if (fields.length < FIELD_COUNT) continue;
-    const [sessionName, id, title, command, cwd, startedAt] = fields;
+    const [sessionName, id, title, command, cwd, startedAt, worktreeOf] = fields;
     if (!isBondsmithTmuxSessionName(sessionName)) continue;
     if (!id || !title || !command || !cwd || !startedAt) continue;
     sessions.push({
@@ -2515,7 +3016,11 @@ function parseTmuxSessions(output) {
       branch: null,
       repositoryFullName: null,
       lastActivityAt: null,
-      changedFileCount: null
+      changedFileCount: null,
+      // tmux reports an unset user-option as an empty string via
+      // #{...}, never literally absent — a non-worktree session (the
+      // common case) has no @bondsmith-worktree-of option set at all.
+      worktreeOf: worktreeOf ? worktreeOf : null
     });
   }
   return sessions;
@@ -2528,7 +3033,8 @@ var LIST_FORMAT = [
   "#{@bondsmith-title}",
   "#{@bondsmith-command}",
   "#{@bondsmith-cwd}",
-  "#{@bondsmith-started-at}"
+  "#{@bondsmith-started-at}",
+  "#{@bondsmith-worktree-of}"
 ].join("	");
 async function discoverSessions() {
   try {
@@ -2584,6 +3090,17 @@ var SessionManager = class {
       await stopTmuxSession(session.tmuxSessionName);
     } catch {
     }
+    if (session.worktreeOf) {
+      try {
+        await removeWorktree(session.worktreeOf, session.cwd);
+      } catch (error2) {
+        console.error("Failed to remove session worktree", {
+          sessionId: session.id,
+          worktreePath: session.cwd,
+          error: error2
+        });
+      }
+    }
     return this.removeAsExited(session);
   }
   /**
@@ -2609,7 +3126,12 @@ var SessionManager = class {
       if (error2 instanceof TmuxNotFoundError) console.error(`
 ${error2.message}
 `);
-      if (!(error2 instanceof TmuxNoServerRunningError)) return;
+      if (!(error2 instanceof TmuxNoServerRunningError)) {
+        if (!(error2 instanceof TmuxNotFoundError)) {
+          console.error("tmux list-sessions failed; skipping reconcile", error2);
+        }
+        return;
+      }
     }
     await Promise.all(
       Array.from(this.sessions.values()).map(async (session) => {
@@ -2683,6 +3205,8 @@ function createDaemonWebSocketServer(httpServer, config, daemonFingerprint, pend
   const rejectionReasonByRequest = /* @__PURE__ */ new WeakMap();
   const wss = new WebSocketServer({
     server: httpServer,
+    // ws defaults to 100 MiB per frame, parsed before any signature is checked.
+    maxPayload: MAX_WIRE_MESSAGE_BYTES,
     // Client always sends the dev-tunnel token as the sole entry (see
     // isValidDevTunnelToken); echoing it back is required for a spec-
     // compliant handshake once a Sec-WebSocket-Protocol is offered.
@@ -2706,6 +3230,9 @@ function createDaemonWebSocketServer(httpServer, config, daemonFingerprint, pend
     broadcast({ type: "session.updated", session });
   });
   wss.on("connection", (socket, request) => {
+    socket.on("error", (error2) => {
+      console.warn("bondsmithd: browser socket error", error2.message);
+    });
     const rejectionReason = rejectionReasonByRequest.get(request);
     if (rejectionReason) {
       rejectionReasonByRequest.delete(request);
@@ -2720,7 +3247,8 @@ function createDaemonWebSocketServer(httpServer, config, daemonFingerprint, pend
         if (socket.readyState === socket.OPEN) socket.send(JSON.stringify(message));
       },
       (controllerId) => registerControllerConnection(controllerId, socket),
-      ptyAttachments
+      ptyAttachments,
+      () => socket.bufferedAmount
     );
     cleanupBySocket.set(socket, releaseAllSubscriptions);
     connectionAuthBySocket.set(socket, connectionAuth);
@@ -2731,7 +3259,9 @@ function createDaemonWebSocketServer(httpServer, config, daemonFingerprint, pend
       challenge: challenge.challenge,
       daemonFingerprint,
       hostname: hostname(),
-      expiresAt: challenge.expiresAt
+      expiresAt: challenge.expiresAt,
+      protocolVersion: PROTOCOL_VERSION,
+      daemonVersion: DAEMON_VERSION
     });
     socket.on("message", (raw) => {
       let parsed;
@@ -2747,6 +3277,7 @@ function createDaemonWebSocketServer(httpServer, config, daemonFingerprint, pend
         broadcast,
         getWorkspaceStatus,
         getWorkspaceDiff,
+        validateProjectPath,
         hostname: () => hostname(),
         daemonFingerprint,
         pendingAuthorizations,
@@ -2781,15 +3312,20 @@ function createDaemonWebSocketServer(httpServer, config, daemonFingerprint, pend
 }
 
 // src/index.ts
+if (isVersionRequest(process.argv.slice(2))) {
+  console.log(versionLine());
+  process.exit(0);
+}
 function loadRepoRootEnv() {
-  const repoRoot = join5(dirname4(fileURLToPath(import.meta.url)), "..", "..", "..");
-  if (!existsSync(join5(repoRoot, "pnpm-workspace.yaml"))) return;
-  const envLocal = join5(repoRoot, ".env.local");
-  const envDefault = join5(repoRoot, ".env");
+  const repoRoot = join6(dirname4(fileURLToPath(import.meta.url)), "..", "..", "..");
+  if (!existsSync(join6(repoRoot, "pnpm-workspace.yaml"))) return;
+  const envLocal = join6(repoRoot, ".env.local");
+  const envDefault = join6(repoRoot, ".env");
   loadEnv({ path: existsSync(envLocal) ? envLocal : envDefault });
 }
 loadRepoRootEnv();
 async function start() {
+  console.log(versionLine());
   let config = getDaemonConfig();
   if (!config.devTunnelToken) {
     const generatedToken = await loadOrCreateDevTunnelToken();
@@ -2838,6 +3374,7 @@ async function start() {
     ptyAttachments,
     getWorkspaceStatus,
     getWorkspaceDiff,
+    validateProjectPath,
     hostname: hostname2,
     pendingAuthorizations,
     presentPendingAuthorization