@bondsmith/bondsmithd 0.1.9 → 0.1.11

package/dist/index.js

@@ -16,7 +16,7 @@ var REPLAYED_COMMAND_MESSAGE = "command already used (replay rejected)";
 var INVALID_MESSAGE_ERROR = "invalid message";
 
 // ../../packages/local-agent-protocol/src/protocol-version.ts
-var PROTOCOL_VERSION = 8;
+var PROTOCOL_VERSION = 10;
 
 // ../../packages/local-agent-protocol/src/project-path.ts
 var PROJECT_PATH_INVALID_REASONS = [
@@ -28,32 +28,127 @@ var PROJECT_PATH_INVALID_REASONS = [
 ];
 
 // ../../packages/local-agent-protocol/src/schemas.ts
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 
 // ../../packages/local-agent-protocol/src/connection-challenge.ts
+import { z as z2 } from "zod";
+
+// ../../packages/local-agent-protocol/src/e2e-key.ts
 import { z } from "zod";
+
+// ../../packages/local-agent-protocol/src/canonicalize.ts
+function canonicalize(value) {
+  return serialize(value);
+}
+function serialize(value) {
+  if (value === null || typeof value === "number" || typeof value === "boolean") {
+    return JSON.stringify(value);
+  }
+  if (typeof value === "string") {
+    return JSON.stringify(value);
+  }
+  if (value === void 0) {
+    throw new TypeError("canonicalize: undefined is not representable");
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(serialize).join(",")}]`;
+  }
+  if (typeof value === "object") {
+    const keys = Object.keys(value).sort();
+    const entries = keys.map((key) => {
+      const entryValue = value[key];
+      return `${JSON.stringify(key)}:${serialize(entryValue)}`;
+    });
+    return `{${entries.join(",")}}`;
+  }
+  throw new TypeError(`canonicalize: unsupported value type ${typeof value}`);
+}
+
+// ../../packages/local-agent-protocol/src/e2e-key.ts
+var E2E_KEY_INFO = "bondsmith.e2e.v1";
+var X25519_PUBLIC_KEY_LENGTH = 43;
+var x25519PublicKeySchema = z.string().length(X25519_PUBLIC_KEY_LENGTH).regex(/^[A-Za-z0-9_-]+$/);
+var KEY_BYTES = 32;
+var encoder = new TextEncoder();
+function toBase64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+function fromBase64Url(value) {
+  const binary = atob(value.replaceAll("-", "+").replaceAll("_", "/"));
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+async function createEphemeralKeyExchange(role) {
+  const pair = await crypto.subtle.generateKey({ name: "X25519" }, false, [
+    "deriveBits"
+  ]);
+  const publicKey = toBase64Url(
+    new Uint8Array(await crypto.subtle.exportKey("raw", pair.publicKey))
+  );
+  return {
+    publicKey,
+    deriveKey: async (peerPublicKey, transcript) => {
+      const { clientEcdhPublicKey, daemonEcdhPublicKey } = transcript;
+      const [ownKey, expectedPeerKey] = role === "client" ? [clientEcdhPublicKey, daemonEcdhPublicKey] : [daemonEcdhPublicKey, clientEcdhPublicKey];
+      if (ownKey !== publicKey || expectedPeerKey !== peerPublicKey) {
+        throw new Error("The signed transcript does not carry this connection's key pair");
+      }
+      const peerKey = await crypto.subtle.importKey(
+        "raw",
+        fromBase64Url(peerPublicKey),
+        { name: "X25519" },
+        false,
+        []
+      );
+      const secret = await crypto.subtle.deriveBits(
+        { name: "X25519", public: peerKey },
+        pair.privateKey,
+        KEY_BYTES * 8
+      );
+      const hkdfKey = await crypto.subtle.importKey("raw", secret, "HKDF", false, ["deriveBits"]);
+      const salt = await crypto.subtle.digest("SHA-256", encoder.encode(canonicalize(transcript)));
+      return new Uint8Array(
+        await crypto.subtle.deriveBits(
+          { name: "HKDF", hash: "SHA-256", salt, info: encoder.encode(E2E_KEY_INFO) },
+          hkdfKey,
+          KEY_BYTES * 8
+        )
+      );
+    }
+  };
+}
+
+// ../../packages/local-agent-protocol/src/connection-challenge.ts
 var CONNECTION_CHALLENGE_PURPOSE = "bondsmith.connection-handshake";
-var connectionChallengeTranscriptSchema = z.object({
-  version: z.literal(1),
-  purpose: z.literal(CONNECTION_CHALLENGE_PURPOSE),
+var CLIENT_NONCE_MIN_LENGTH = 16;
+var connectionChallengeTranscriptSchema = z2.object({
+  version: z2.literal(1),
+  purpose: z2.literal(CONNECTION_CHALLENGE_PURPOSE),
   // Generated by the daemon per-socket, at connection time — never
   // client-supplied, never reused across connections or reconnects.
-  connectionId: z.string().min(1),
+  connectionId: z2.string().min(1),
   // Fresh, cryptographically random, single-use — a second handshake
   // attempt (even with a validly-signed transcript for the same
   // connectionId) is rejected by the daemon outright.
-  challenge: z.string().min(1),
-  daemonFingerprint: z.string().min(1),
-  controllerId: z.string().min(1),
+  challenge: z2.string().min(1),
+  daemonFingerprint: z2.string().min(1),
+  controllerId: z2.string().min(1),
   // An assertion the browser makes, not independent account
   // authentication — the daemon has no account-token layer to verify this
   // against (unchanged from ADR-012's existing caveat on CommandEnvelope's
   // own accountId field).
-  accountId: z.number().int().positive()
+  accountId: z2.number().int().positive(),
+  // Fresh per connection, chosen by the browser: the daemon signs it back (daemon-proof.ts) so the browser knows the daemon answered THIS handshake, not a replay. Absent from older browsers.
+  clientNonce: z2.string().min(CLIENT_NONCE_MIN_LENGTH).optional(),
+  // Fresh per connection: the browser's half of the key agreement (e2e-key.ts), signed here so the relay cannot swap it.
+  clientEcdhPublicKey: x25519PublicKeySchema.optional()
 });
-var signedConnectionChallengeSchema = z.object({
+var signedConnectionChallengeSchema = z2.object({
   transcript: connectionChallengeTranscriptSchema,
-  signature: z.string().min(1)
+  signature: z2.string().min(1)
 });
 
 // ../../packages/local-agent-protocol/src/schemas.ts
@@ -64,77 +159,77 @@ var MAX_DAEMON_REPLY_BYTES = 200 * 1024;
 var MAX_RANGE_LINES = 500;
 var MAX_PLAN_CHARS = 32 * 1024;
 var MAX_TERMINAL_DIMENSION = 1e3;
-var terminalSizeSchema = z2.object({
-  cols: z2.number().int().min(1).max(MAX_TERMINAL_DIMENSION),
-  rows: z2.number().int().min(1).max(MAX_TERMINAL_DIMENSION)
+var terminalSizeSchema = z3.object({
+  cols: z3.number().int().min(1).max(MAX_TERMINAL_DIMENSION),
+  rows: z3.number().int().min(1).max(MAX_TERMINAL_DIMENSION)
 });
-var localSessionSchema = z2.object({
-  id: z2.string(),
-  title: z2.string(),
-  command: z2.string(),
-  cwd: z2.string(),
-  tmuxSessionName: z2.string(),
-  status: z2.enum(SESSION_STATUSES),
-  startedAt: z2.string(),
-  branch: z2.string().nullable(),
-  repositoryFullName: z2.string().nullable(),
-  lastActivityAt: z2.string().nullable(),
-  changedFileCount: z2.number().int().nonnegative().nullable(),
-  worktreeOf: z2.string().nullable(),
+var localSessionSchema = z3.object({
+  id: z3.string(),
+  title: z3.string(),
+  command: z3.string(),
+  cwd: z3.string(),
+  tmuxSessionName: z3.string(),
+  status: z3.enum(SESSION_STATUSES),
+  startedAt: z3.string(),
+  branch: z3.string().nullable(),
+  repositoryFullName: z3.string().nullable(),
+  lastActivityAt: z3.string().nullable(),
+  changedFileCount: z3.number().int().nonnegative().nullable(),
+  worktreeOf: z3.string().nullable(),
   // .catch(undefined): a state this version doesn't know must never drop the whole session message.
-  agentState: z2.enum(AGENT_STATES).nullable().optional().catch(void 0)
+  agentState: z3.enum(AGENT_STATES).nullable().optional().catch(void 0)
 });
-var workspaceFileEntrySchema = z2.object({
-  path: z2.string(),
-  previousPath: z2.string().optional(),
-  status: z2.enum(["added", "modified", "deleted", "renamed", "copied", "untracked"]),
-  staged: z2.boolean(),
-  additions: z2.number().int().nonnegative().nullable(),
-  deletions: z2.number().int().nonnegative().nullable(),
-  binary: z2.boolean()
+var workspaceFileEntrySchema = z3.object({
+  path: z3.string(),
+  previousPath: z3.string().optional(),
+  status: z3.enum(["added", "modified", "deleted", "renamed", "copied", "untracked"]),
+  staged: z3.boolean(),
+  additions: z3.number().int().nonnegative().nullable(),
+  deletions: z3.number().int().nonnegative().nullable(),
+  binary: z3.boolean()
 });
-var workspaceStatusSchema = z2.object({
-  isGitRepo: z2.boolean(),
-  branch: z2.string().nullable(),
+var workspaceStatusSchema = z3.object({
+  isGitRepo: z3.boolean(),
+  branch: z3.string().nullable(),
   // .catch(undefined): a malformed informational field must never drop the whole status message.
-  baseRef: z2.string().nullable().optional().catch(void 0),
-  files: z2.array(workspaceFileEntrySchema),
-  totalFiles: z2.number().int().nonnegative().optional().catch(void 0)
+  baseRef: z3.string().nullable().optional().catch(void 0),
+  files: z3.array(workspaceFileEntrySchema),
+  totalFiles: z3.number().int().nonnegative().optional().catch(void 0)
 });
-var workspaceFileDiffSchema = z2.object({
-  path: z2.string(),
-  staged: z2.boolean(),
-  patch: z2.string().nullable(),
-  binary: z2.boolean(),
-  tooLarge: z2.boolean().optional(),
-  version: z2.string().optional()
+var workspaceFileDiffSchema = z3.object({
+  path: z3.string(),
+  staged: z3.boolean(),
+  patch: z3.string().nullable(),
+  binary: z3.boolean(),
+  tooLarge: z3.boolean().optional(),
+  version: z3.string().optional()
 });
-var workspaceFileRangeSchema = z2.discriminatedUnion("ok", [
-  z2.object({
-    ok: z2.literal(true),
-    path: z2.string(),
-    startLine: z2.number().int().min(1),
-    lines: z2.array(z2.string()).max(MAX_RANGE_LINES),
-    totalLines: z2.number().int().nonnegative(),
-    version: z2.string()
+var workspaceFileRangeSchema = z3.discriminatedUnion("ok", [
+  z3.object({
+    ok: z3.literal(true),
+    path: z3.string(),
+    startLine: z3.number().int().min(1),
+    lines: z3.array(z3.string()).max(MAX_RANGE_LINES),
+    totalLines: z3.number().int().nonnegative(),
+    version: z3.string()
   }),
-  z2.object({
-    ok: z2.literal(false),
-    path: z2.string(),
-    reason: z2.enum(["changed", "missing", "binary", "too_large", "not_allowed"])
+  z3.object({
+    ok: z3.literal(false),
+    path: z3.string(),
+    reason: z3.enum(["changed", "missing", "binary", "too_large", "not_allowed"])
   })
 ]);
-var projectPathValidationSchema = z2.discriminatedUnion("valid", [
-  z2.object({ valid: z2.literal(true), path: z2.string() }),
-  z2.object({ valid: z2.literal(false), reason: z2.enum(PROJECT_PATH_INVALID_REASONS) })
+var projectPathValidationSchema = z3.discriminatedUnion("valid", [
+  z3.object({ valid: z3.literal(true), path: z3.string() }),
+  z3.object({ valid: z3.literal(false), reason: z3.enum(PROJECT_PATH_INVALID_REASONS) })
 ]);
-var browserMessageSchema = z2.discriminatedUnion("type", [
-  z2.object({ type: z2.literal("session.list") }),
-  z2.object({
-    type: z2.literal("session.create"),
-    title: z2.string().min(1).max(200),
-    cwd: z2.string().min(1),
-    command: z2.string().min(1).max(2e3),
+var browserMessageSchema = z3.discriminatedUnion("type", [
+  z3.object({ type: z3.literal("session.list") }),
+  z3.object({
+    type: z3.literal("session.create"),
+    title: z3.string().min(1).max(200),
+    cwd: z3.string().min(1),
+    command: z3.string().min(1).max(2e3),
     // Opt-in worktree creation — see messages.ts's own field comment.
     // Most branch-name legality is left to git itself in createWorktree()
     // (whose named error classes surface a rejection back to the
@@ -144,14 +239,14 @@ var browserMessageSchema = z2.discriminatedUnion("type", [
     // the error instead of a clean, classified one (confirmed live
     // during adversarial review) — rejected here instead, before it ever
     // reaches git.
-    worktreeBranch: z2.string().min(1).max(250).refine((value) => !value.startsWith("-"), {
+    worktreeBranch: z3.string().min(1).max(250).refine((value) => !value.startsWith("-"), {
       message: "branch name can't start with -"
     }).optional(),
-    requestId: z2.string().min(1).max(200).optional()
+    requestId: z3.string().min(1).max(200).optional()
   }),
-  z2.object({
-    type: z2.literal("session.attach"),
-    sessionId: z2.string(),
+  z3.object({
+    type: z3.literal("session.attach"),
+    sessionId: z3.string(),
     // Optional (not required) so an older daemon build, or a stale queued
     // envelope signed before this field existed, still parses — see
     // session.attached/error's own requestId fields for why this matters:
@@ -161,187 +256,192 @@ var browserMessageSchema = z2.discriminatedUnion("type", [
     // misattributes a daemon error for ANY other in-flight command
     // (observed: a session.resize racing ahead of its own session.attach)
     // to the wrong promise — a confirmed bug, not a hypothetical.
-    requestId: z2.string().min(1).max(200).optional(),
+    requestId: z3.string().min(1).max(200).optional(),
     // Tolerant like baseRef: an unreadable size must not make the daemon drop the attach itself.
     size: terminalSizeSchema.optional().catch(void 0)
   }),
-  z2.object({ type: z2.literal("session.detach"), sessionId: z2.string() }),
-  z2.object({
-    type: z2.literal("session.input"),
-    sessionId: z2.string(),
-    data: z2.string().max(MAX_INPUT_CHARS)
+  z3.object({ type: z3.literal("session.detach"), sessionId: z3.string() }),
+  z3.object({
+    type: z3.literal("session.input"),
+    sessionId: z3.string(),
+    data: z3.string().max(MAX_INPUT_CHARS)
   }),
-  z2.object({
-    type: z2.literal("session.insertText"),
-    sessionId: z2.string(),
-    text: z2.string().max(MAX_INSERT_TEXT_BYTES)
+  z3.object({
+    type: z3.literal("session.insertText"),
+    sessionId: z3.string(),
+    text: z3.string().max(MAX_INSERT_TEXT_BYTES)
   }),
-  z2.object({
-    type: z2.literal("session.resize"),
-    sessionId: z2.string(),
+  z3.object({
+    type: z3.literal("session.resize"),
+    sessionId: z3.string(),
     ...terminalSizeSchema.shape
   }),
-  z2.object({ type: z2.literal("session.stop"), sessionId: z2.string() }),
-  z2.object({
-    type: z2.literal("workspace.getStatus"),
-    sessionId: z2.string(),
-    requestId: z2.string().min(1).max(200)
+  z3.object({ type: z3.literal("session.stop"), sessionId: z3.string() }),
+  z3.object({
+    type: z3.literal("workspace.getStatus"),
+    sessionId: z3.string(),
+    requestId: z3.string().min(1).max(200)
   }),
-  z2.object({
-    type: z2.literal("workspace.readFileRange"),
-    sessionId: z2.string(),
-    path: z2.string().min(1).max(4096),
-    startLine: z2.number().int().min(1),
-    lineCount: z2.number().int().min(1).max(MAX_RANGE_LINES),
-    version: z2.string().min(1).max(100),
-    requestId: z2.string().min(1).max(200)
+  z3.object({
+    type: z3.literal("workspace.readFileRange"),
+    sessionId: z3.string(),
+    path: z3.string().min(1).max(4096),
+    startLine: z3.number().int().min(1),
+    lineCount: z3.number().int().min(1).max(MAX_RANGE_LINES),
+    version: z3.string().min(1).max(100),
+    requestId: z3.string().min(1).max(200)
   }),
-  z2.object({
-    type: z2.literal("workspace.getDiff"),
-    sessionId: z2.string(),
-    path: z2.string().min(1).max(4096),
-    staged: z2.boolean(),
-    requestId: z2.string().min(1).max(200)
+  z3.object({
+    type: z3.literal("workspace.getDiff"),
+    sessionId: z3.string(),
+    path: z3.string().min(1).max(4096),
+    staged: z3.boolean(),
+    requestId: z3.string().min(1).max(200)
   }),
-  z2.object({
-    type: z2.literal("workspace.getPlan"),
-    sessionId: z2.string(),
-    requestId: z2.string().min(1).max(200)
+  z3.object({
+    type: z3.literal("workspace.getPlan"),
+    sessionId: z3.string(),
+    requestId: z3.string().min(1).max(200)
   }),
-  z2.object({
-    type: z2.literal("project.validatePath"),
-    path: z2.string().min(1).max(4096),
-    requestId: z2.string().min(1).max(200)
+  z3.object({
+    type: z3.literal("project.validatePath"),
+    path: z3.string().min(1).max(4096),
+    requestId: z3.string().min(1).max(200)
   }),
-  z2.object({ type: z2.literal("daemon.getInfo") }),
+  z3.object({ type: z3.literal("daemon.getInfo") }),
   // Second-controller enrollment (ADR-011/ADR-012, BD-433) — deliberately
   // unsigned: the requesting browser has no trusted key yet to sign with.
   // Authority comes entirely from explicit daemon-local user approval, not
   // from anything in this message.
-  z2.object({
-    type: z2.literal("controller.requestEnrollment"),
-    publicKeyPem: z2.string().min(1),
-    label: z2.string().min(1).max(200)
+  z3.object({
+    type: z3.literal("controller.requestEnrollment"),
+    publicKeyPem: z3.string().min(1),
+    label: z3.string().min(1).max(200)
   }),
   // ADR-013/BD-477: the browser's signed response to connection.challenge —
   // carries its own signed transcript, not a CommandEnvelope, so it's a
   // distinct BrowserMessage variant rather than a SIGNABLE_ACTIONS entry.
-  z2.object({
-    type: z2.literal("connection.authenticate"),
-    signed: z2.object({
+  z3.object({
+    type: z3.literal("connection.authenticate"),
+    signed: z3.object({
       transcript: connectionChallengeTranscriptSchema,
-      signature: z2.string().min(1)
+      signature: z3.string().min(1)
     })
   })
 ]);
-var connectionAuthenticationFailureReasonSchema = z2.enum([
+var connectionAuthenticationFailureReasonSchema = z3.enum([
   "bad_signature",
   "untrusted_controller",
   "wrong_daemon",
   "wrong_connection",
   "challenge_expired",
   "already_authenticated",
-  "rate_limited"
+  "rate_limited",
+  "key_agreement_failed"
 ]);
-var connectionRejectionReasonSchema = z2.enum(["origin_not_allowed", "token_invalid"]);
-var daemonMessageSchema = z2.discriminatedUnion("type", [
-  z2.object({ type: z2.literal("session.list"), sessions: z2.array(localSessionSchema) }),
-  z2.object({
-    type: z2.literal("session.created"),
+var connectionRejectionReasonSchema = z3.enum(["origin_not_allowed", "token_invalid"]);
+var daemonMessageSchema = z3.discriminatedUnion("type", [
+  z3.object({ type: z3.literal("session.list"), sessions: z3.array(localSessionSchema) }),
+  z3.object({
+    type: z3.literal("session.created"),
     session: localSessionSchema,
-    requestId: z2.string().optional()
+    requestId: z3.string().optional()
   }),
-  z2.object({
-    type: z2.literal("terminal.output"),
-    sessionId: z2.string(),
-    data: z2.string()
+  z3.object({
+    type: z3.literal("terminal.output"),
+    sessionId: z3.string(),
+    data: z3.string()
   }),
-  z2.object({ type: z2.literal("session.updated"), session: localSessionSchema }),
+  z3.object({ type: z3.literal("session.updated"), session: localSessionSchema }),
   // Ack for a successful session.attach — the browser must wait for this
   // before wiring up terminal input, or a keystroke sent before the daemon
   // actually finishes attaching gets rejected as "not attached to
   // session" (observed during a reconnect: attachSession() was
   // fire-and-forget, so terminal.onData could fire before attach
   // completed).
-  z2.object({
-    type: z2.literal("session.attached"),
-    sessionId: z2.string(),
-    requestId: z2.string().optional()
+  z3.object({
+    type: z3.literal("session.attached"),
+    sessionId: z3.string(),
+    requestId: z3.string().optional()
   }),
-  z2.object({
-    type: z2.literal("error"),
-    message: z2.string(),
+  z3.object({
+    type: z3.literal("error"),
+    message: z3.string(),
     // Echoes the triggering message's requestId when it had one, so the
     // browser can match this error to the exact pending request instead
     // of guessing "oldest pending create, then oldest pending attach" —
     // undefined for error paths with no requestId to echo (most session.*
     // commands still don't carry one; see session.attach above for the
     // one this was added to fix).
-    requestId: z2.string().optional()
+    requestId: z3.string().optional()
   }),
-  z2.object({
-    type: z2.literal("workspace.status"),
-    sessionId: z2.string(),
-    requestId: z2.string(),
+  z3.object({
+    type: z3.literal("workspace.status"),
+    sessionId: z3.string(),
+    requestId: z3.string(),
     status: workspaceStatusSchema
   }),
-  z2.object({
-    type: z2.literal("workspace.fileRange"),
-    sessionId: z2.string(),
-    requestId: z2.string(),
+  z3.object({
+    type: z3.literal("workspace.fileRange"),
+    sessionId: z3.string(),
+    requestId: z3.string(),
     range: workspaceFileRangeSchema
   }),
-  z2.object({
-    type: z2.literal("workspace.diff"),
-    sessionId: z2.string(),
-    requestId: z2.string(),
+  z3.object({
+    type: z3.literal("workspace.diff"),
+    sessionId: z3.string(),
+    requestId: z3.string(),
     diff: workspaceFileDiffSchema
   }),
-  z2.object({
-    type: z2.literal("workspace.plan"),
-    sessionId: z2.string(),
-    requestId: z2.string(),
-    plan: z2.string().max(MAX_PLAN_CHARS).nullable()
+  z3.object({
+    type: z3.literal("workspace.plan"),
+    sessionId: z3.string(),
+    requestId: z3.string(),
+    plan: z3.string().max(MAX_PLAN_CHARS).nullable()
   }),
-  z2.object({
-    type: z2.literal("project.pathValidated"),
-    requestId: z2.string(),
+  z3.object({
+    type: z3.literal("project.pathValidated"),
+    requestId: z3.string(),
     result: projectPathValidationSchema
   }),
-  z2.object({
-    type: z2.literal("daemon.info"),
-    hostname: z2.string(),
-    daemonFingerprint: z2.string()
+  z3.object({
+    type: z3.literal("daemon.info"),
+    hostname: z3.string(),
+    daemonFingerprint: z3.string()
   }),
-  z2.object({
-    type: z2.literal("controller.enrollmentPending"),
-    fingerprint: z2.string()
+  z3.object({
+    type: z3.literal("controller.enrollmentPending"),
+    fingerprint: z3.string()
   }),
-  z2.object({
-    type: z2.literal("controller.enrollmentRejected"),
-    reason: z2.enum(["not_interactive", "rate_limited"])
+  z3.object({
+    type: z3.literal("controller.enrollmentRejected"),
+    reason: z3.enum(["not_interactive", "rate_limited"])
   }),
-  z2.object({
-    type: z2.literal("connection.challenge"),
-    connectionId: z2.string().min(1),
-    challenge: z2.string().min(1),
-    daemonFingerprint: z2.string().min(1),
-    hostname: z2.string(),
-    expiresAt: z2.number().int().positive(),
+  z3.object({
+    type: z3.literal("connection.challenge"),
+    connectionId: z3.string().min(1),
+    challenge: z3.string().min(1),
+    daemonFingerprint: z3.string().min(1),
+    hostname: z3.string(),
+    expiresAt: z3.number().int().positive(),
     // .catch(undefined): a malformed informational field must never fail the whole handshake message.
-    protocolVersion: z2.number().int().positive().optional().catch(void 0),
-    daemonVersion: z2.string().optional().catch(void 0)
+    protocolVersion: z3.number().int().positive().optional().catch(void 0),
+    daemonVersion: z3.string().optional().catch(void 0)
   }),
-  z2.object({
-    type: z2.literal("connection.authenticated"),
-    connectionId: z2.string().min(1)
+  z3.object({
+    type: z3.literal("connection.authenticated"),
+    connectionId: z3.string().min(1),
+    // Strict on purpose (no .catch): a corrupted signature must fail the message, not quietly read as "unsigned".
+    daemonSignature: z3.string().min(1).optional(),
+    // The daemon's half of the key agreement; covered by daemonSignature.
+    daemonEcdhPublicKey: x25519PublicKeySchema.optional()
   }),
-  z2.object({
-    type: z2.literal("connection.authenticationFailed"),
+  z3.object({
+    type: z3.literal("connection.authenticationFailed"),
     reason: connectionAuthenticationFailureReasonSchema
   }),
-  z2.object({
-    type: z2.literal("connection.rejected"),
+  z3.object({
+    type: z3.literal("connection.rejected"),
     reason: connectionRejectionReasonSchema
   })
 ]);
@@ -376,36 +476,8 @@ async function controllerIdFromPublicKeyPem(publicKeyPem) {
   return hex.slice(0, 32);
 }
 
-// ../../packages/local-agent-protocol/src/canonicalize.ts
-function canonicalize(value) {
-  return serialize(value);
-}
-function serialize(value) {
-  if (value === null || typeof value === "number" || typeof value === "boolean") {
-    return JSON.stringify(value);
-  }
-  if (typeof value === "string") {
-    return JSON.stringify(value);
-  }
-  if (value === void 0) {
-    throw new TypeError("canonicalize: undefined is not representable");
-  }
-  if (Array.isArray(value)) {
-    return `[${value.map(serialize).join(",")}]`;
-  }
-  if (typeof value === "object") {
-    const keys = Object.keys(value).sort();
-    const entries = keys.map((key) => {
-      const entryValue = value[key];
-      return `${JSON.stringify(key)}:${serialize(entryValue)}`;
-    });
-    return `{${entries.join(",")}}`;
-  }
-  throw new TypeError(`canonicalize: unsupported value type ${typeof value}`);
-}
-
 // ../../packages/local-agent-protocol/src/envelope.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 var SIGNABLE_ACTIONS = [
   "session.create",
   "session.attach",
@@ -421,113 +493,145 @@ var SIGNABLE_ACTIONS = [
   "workspace.getPlan",
   "project.validatePath"
 ];
-var envelopeSchema = z3.object({
-  version: z3.literal(1),
-  controllerId: z3.string().min(1),
-  accountId: z3.number().int().positive(),
-  daemonId: z3.string().min(1),
+var envelopeSchema = z4.object({
+  version: z4.literal(1),
+  controllerId: z4.string().min(1),
+  accountId: z4.number().int().positive(),
+  daemonId: z4.string().min(1),
   // The specific WebSocket connection this envelope was signed for (ADR-013,
   // BD-477) — issued by the daemon during that connection's handshake
   // (connection-challenge.ts), never reused across connections. `sequence`
   // below is only ever compared against other envelopes carrying the SAME
   // connectionId; an envelope for a stale or foreign connectionId is
   // rejected before sequence is even considered (verify-command.ts).
-  connectionId: z3.string().min(1),
-  sessionId: z3.string().nullable(),
-  action: z3.enum(SIGNABLE_ACTIONS),
-  payload: z3.unknown(),
-  issuedAt: z3.number().int().positive(),
-  expiresAt: z3.number().int().positive(),
+  connectionId: z4.string().min(1),
+  sessionId: z4.string().nullable(),
+  action: z4.enum(SIGNABLE_ACTIONS),
+  payload: z4.unknown(),
+  issuedAt: z4.number().int().positive(),
+  expiresAt: z4.number().int().positive(),
   // Strictly increasing WITHIN one connectionId's sequence space, starting
   // at 1 for every new authenticated connection — never a persisted,
   // global-per-controller counter (that design broke on page reload; see
   // ADR-013). Verified and advanced in-memory, per connection, never
   // written to disk.
-  sequence: z3.number().int().positive()
+  sequence: z4.number().int().positive()
 });
-var signedCommandSchema = z3.object({
+var signedCommandSchema = z4.object({
   envelope: envelopeSchema,
-  signature: z3.string().min(1)
+  signature: z4.string().min(1)
 });
 
 // ../../packages/local-agent-protocol/src/pairing-challenge.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 var PAIRING_CHALLENGE_PURPOSE = "bondsmith.initial-controller-pairing";
-var pairingChallengeTranscriptSchema = z4.object({
-  version: z4.literal(1),
-  purpose: z4.literal(PAIRING_CHALLENGE_PURPOSE),
-  pairingAttemptId: z4.string().min(1),
-  challenge: z4.string().min(1),
-  daemonFingerprint: z4.string().min(1),
-  controllerPublicKeyPem: z4.string().min(1),
-  accountId: z4.number().int().positive()
+var pairingChallengeTranscriptSchema = z5.object({
+  version: z5.literal(1),
+  purpose: z5.literal(PAIRING_CHALLENGE_PURPOSE),
+  pairingAttemptId: z5.string().min(1),
+  challenge: z5.string().min(1),
+  daemonFingerprint: z5.string().min(1),
+  controllerPublicKeyPem: z5.string().min(1),
+  accountId: z5.number().int().positive()
 });
-var signedPairingChallengeSchema = z4.object({
+var signedPairingChallengeSchema = z5.object({
   transcript: pairingChallengeTranscriptSchema,
-  signature: z4.string().min(1)
+  signature: z5.string().min(1)
+});
+
+// ../../packages/local-agent-protocol/src/daemon-proof.ts
+import { z as z6 } from "zod";
+var DAEMON_PROOF_PURPOSE = "bondsmith.daemon-proof";
+var daemonProofTranscriptSchema = z6.object({
+  version: z6.literal(1),
+  purpose: z6.literal(DAEMON_PROOF_PURPOSE),
+  connectionId: z6.string().min(1),
+  challenge: z6.string().min(1),
+  daemonFingerprint: z6.string().min(1),
+  controllerId: z6.string().min(1),
+  accountId: z6.number().int().positive(),
+  clientNonce: z6.string().min(CLIENT_NONCE_MIN_LENGTH),
+  // Both halves of the key agreement (e2e-key.ts), so the daemon's signature vouches for the key the browser derives from.
+  clientEcdhPublicKey: x25519PublicKeySchema.optional(),
+  daemonEcdhPublicKey: x25519PublicKeySchema.optional()
 });
+function buildDaemonProofTranscript(handshake, daemonEcdhPublicKey) {
+  if (handshake.clientNonce === void 0) return null;
+  return {
+    version: 1,
+    purpose: DAEMON_PROOF_PURPOSE,
+    connectionId: handshake.connectionId,
+    challenge: handshake.challenge,
+    daemonFingerprint: handshake.daemonFingerprint,
+    controllerId: handshake.controllerId,
+    accountId: handshake.accountId,
+    clientNonce: handshake.clientNonce,
+    ...handshake.clientEcdhPublicKey && { clientEcdhPublicKey: handshake.clientEcdhPublicKey },
+    ...daemonEcdhPublicKey && { daemonEcdhPublicKey }
+  };
+}
 
 // ../../packages/local-agent-protocol/src/relay-register-transcript.ts
-import { z as z5 } from "zod";
+import { z as z7 } from "zod";
 var RELAY_REGISTER_PURPOSE = "bondsmith.relay.register";
-var relayRegisterTranscriptSchema = z5.object({
-  version: z5.literal(1),
-  purpose: z5.literal(RELAY_REGISTER_PURPOSE),
+var relayRegisterTranscriptSchema = z7.object({
+  version: z7.literal(1),
+  purpose: z7.literal(RELAY_REGISTER_PURPOSE),
   // Relay-issued, single-use — a second registration attempt against the
   // same challenge is meaningless since a daemon reconnecting always gets
   // a fresh challenge from a fresh relay.challenge message; this field
   // exists so a captured signed transcript can't be replayed later against
   // a still-open relay listener.
-  challenge: z5.string().min(1),
-  daemonFingerprint: z5.string().min(1),
-  issuedAt: z5.number().int().positive(),
-  expiresAt: z5.number().int().positive(),
+  challenge: z7.string().min(1),
+  daemonFingerprint: z7.string().min(1),
+  issuedAt: z7.number().int().positive(),
+  expiresAt: z7.number().int().positive(),
   // Binds this transcript to one specific relay deployment (e.g.
   // "relay.bondsmith.dev") — same reasoning as CommandEnvelope's own
   // daemonId field binding a command to one specific daemon; prevents a
   // transcript signed for one relay audience from being replayed against
   // a different one.
-  relayAudience: z5.string().min(1)
+  relayAudience: z7.string().min(1)
 });
-var signedRelayRegisterSchema = z5.object({
+var signedRelayRegisterSchema = z7.object({
   // The daemon's full public key PEM, transmitted alongside the transcript
   // so the relay can independently derive daemonFingerprint from it and
   // verify the signature against it — see this file's own doc comment for
   // why this must travel on the wire rather than being assumed.
-  daemonPublicKeyPem: z5.string().min(1),
+  daemonPublicKeyPem: z7.string().min(1),
   transcript: relayRegisterTranscriptSchema,
-  signature: z5.string().min(1)
+  signature: z7.string().min(1)
 });
 
 // ../../packages/local-agent-protocol/src/relay-ticket.ts
-import { z as z6 } from "zod";
+import { z as z8 } from "zod";
 var RELAY_TICKET_PURPOSE = "bondsmith.relay.attach";
-var relayTicketSchema = z6.object({
-  version: z6.literal(1),
-  purpose: z6.literal(RELAY_TICKET_PURPOSE),
-  keyId: z6.string().min(1),
-  accountId: z6.number().int().positive(),
-  userId: z6.string().min(1),
-  daemonFingerprint: z6.string().min(1),
-  issuedAt: z6.number().int().positive(),
+var relayTicketSchema = z8.object({
+  version: z8.literal(1),
+  purpose: z8.literal(RELAY_TICKET_PURPOSE),
+  keyId: z8.string().min(1),
+  accountId: z8.number().int().positive(),
+  userId: z8.string().min(1),
+  daemonFingerprint: z8.string().min(1),
+  issuedAt: z8.number().int().positive(),
   // Deliberately short — single-digit minutes, enough for one attach
   // attempt, not a durable credential.
-  expiresAt: z6.number().int().positive(),
+  expiresAt: z8.number().int().positive(),
   // Crypto-random, single-use — consumed atomically by the relay on
   // successful attach (an in-memory, TTL-expiring record; see the relay
   // architecture doc's own correction against an unbounded Set). A
   // replayed ticket (same nonce, still within its own expiry window)
   // fails closed.
-  nonce: z6.string().min(1)
+  nonce: z8.string().min(1)
 });
-var signedRelayTicketSchema = z6.object({
+var signedRelayTicketSchema = z8.object({
   ticket: relayTicketSchema,
-  signature: z6.string().min(1)
+  signature: z8.string().min(1)
 });
 
 // ../../packages/local-agent-protocol/src/relay-messages.ts
-import { z as z7 } from "zod";
-var relayFailureReasonSchema = z7.enum([
+import { z as z9 } from "zod";
+var relayFailureReasonSchema = z9.enum([
   // relay.registrationFailed reasons (daemon side)
   "bad_signature",
   "wrong_fingerprint",
@@ -550,22 +654,22 @@ var relayFailureReasonSchema = z7.enum([
   // daemon's own client-side cap (see session-registry.ts's doc comment).
   "session_limit_exceeded"
 ]);
-var relayFrameSchema = z7.object({
-  relaySessionId: z7.string().min(1),
+var relayFrameSchema = z9.object({
+  relaySessionId: z9.string().min(1),
   // Opaque to the relay — the existing inner BrowserMessage/DaemonMessage
   // JSON, unparsed and unvalidated by anything in this file. Typed as
   // unknown here deliberately; callers narrow it via browserMessageSchema/
   // daemonMessageSchema from messages.ts/schemas.ts after routing.
-  payload: z7.unknown()
+  payload: z9.unknown()
 });
-var relayDaemonMessageSchema = z7.discriminatedUnion("type", [
-  z7.object({ type: z7.literal("relay.register"), signed: signedRelayRegisterSchema }),
+var relayDaemonMessageSchema = z9.discriminatedUnion("type", [
+  z9.object({ type: z9.literal("relay.register"), signed: signedRelayRegisterSchema }),
   // Sent in response to relay.sessionOpened, once ConnectionAuthState has
   // actually been allocated — see relay-architecture doc §6's correction:
   // the relay cannot assume this happened just because it sent the
   // message, since bondsmithd is a remote process over a real WSS socket.
-  z7.object({ type: z7.literal("relay.sessionOpenAck"), relaySessionId: z7.string().min(1) }),
-  z7.object({ type: z7.literal("relay.frame"), frame: relayFrameSchema }),
+  z9.object({ type: z9.literal("relay.sessionOpenAck"), relaySessionId: z9.string().min(1) }),
+  z9.object({ type: z9.literal("relay.frame"), frame: relayFrameSchema }),
   // Daemon-initiated close — used when BD-434's existing
   // revokeControllerConnections/revokeAllConnections destroys a
   // ConnectionAuthState locally (controller revocation, daemon unpairing)
@@ -574,51 +678,51 @@ var relayDaemonMessageSchema = z7.discriminatedUnion("type", [
   // the time this is sent (revocation's actual authorization guarantee
   // never depends on the relay's cooperation) — this is cleanup, not the
   // authorization boundary.
-  z7.object({ type: z7.literal("relay.closeSession"), relaySessionId: z7.string().min(1) })
+  z9.object({ type: z9.literal("relay.closeSession"), relaySessionId: z9.string().min(1) })
 ]);
-var relayToDaemonMessageSchema = z7.discriminatedUnion("type", [
-  z7.object({
-    type: z7.literal("relay.challenge"),
-    challenge: z7.string().min(1),
-    expiresAt: z7.number().int().positive(),
-    relayAudience: z7.string().min(1)
+var relayToDaemonMessageSchema = z9.discriminatedUnion("type", [
+  z9.object({
+    type: z9.literal("relay.challenge"),
+    challenge: z9.string().min(1),
+    expiresAt: z9.number().int().positive(),
+    relayAudience: z9.string().min(1)
   }),
-  z7.object({ type: z7.literal("relay.registered"), daemonFingerprint: z7.string().min(1) }),
-  z7.object({ type: z7.literal("relay.registrationFailed"), reason: relayFailureReasonSchema }),
-  z7.object({ type: z7.literal("relay.sessionOpened"), relaySessionId: z7.string().min(1) }),
-  z7.object({ type: z7.literal("relay.sessionClosed"), relaySessionId: z7.string().min(1) }),
-  z7.object({ type: z7.literal("relay.frame"), frame: relayFrameSchema })
+  z9.object({ type: z9.literal("relay.registered"), daemonFingerprint: z9.string().min(1) }),
+  z9.object({ type: z9.literal("relay.registrationFailed"), reason: relayFailureReasonSchema }),
+  z9.object({ type: z9.literal("relay.sessionOpened"), relaySessionId: z9.string().min(1) }),
+  z9.object({ type: z9.literal("relay.sessionClosed"), relaySessionId: z9.string().min(1) }),
+  z9.object({ type: z9.literal("relay.frame"), frame: relayFrameSchema })
 ]);
-var relayBrowserMessageSchema = z7.discriminatedUnion("type", [
-  z7.object({ type: z7.literal("relay.attach"), signed: signedRelayTicketSchema }),
-  z7.object({ type: z7.literal("relay.frame"), frame: relayFrameSchema })
+var relayBrowserMessageSchema = z9.discriminatedUnion("type", [
+  z9.object({ type: z9.literal("relay.attach"), signed: signedRelayTicketSchema }),
+  z9.object({ type: z9.literal("relay.frame"), frame: relayFrameSchema })
 ]);
-var relayToBrowserMessageSchema = z7.discriminatedUnion("type", [
-  z7.object({ type: z7.literal("relay.attached"), relaySessionId: z7.string().min(1) }),
-  z7.object({ type: z7.literal("relay.attachFailed"), reason: relayFailureReasonSchema }),
-  z7.object({ type: z7.literal("relay.daemonOffline") }),
+var relayToBrowserMessageSchema = z9.discriminatedUnion("type", [
+  z9.object({ type: z9.literal("relay.attached"), relaySessionId: z9.string().min(1) }),
+  z9.object({ type: z9.literal("relay.attachFailed"), reason: relayFailureReasonSchema }),
+  z9.object({ type: z9.literal("relay.daemonOffline") }),
   // Sent when the daemon registration a session was opened against gets
   // superseded (the daemon reconnected) — the session is dead, the browser
   // must perform a fresh relay.attach. "daemon_reconnected" covers V1's
   // single-process supersession case (see relay-architecture.md §4); kept
   // as its own reason (not folded into relay.daemonOffline) since the
   // daemon IS reachable again, just under a new registration.
-  z7.object({
-    type: z7.literal("relay.sessionInvalidated"),
-    relaySessionId: z7.string().min(1),
-    reason: z7.literal("daemon_reconnected")
+  z9.object({
+    type: z9.literal("relay.sessionInvalidated"),
+    relaySessionId: z9.string().min(1),
+    reason: z9.literal("daemon_reconnected")
   }),
-  z7.object({ type: z7.literal("relay.frame"), frame: relayFrameSchema })
+  z9.object({ type: z9.literal("relay.frame"), frame: relayFrameSchema })
 ]);
 
 // src/index.ts
 import { config as loadEnv } from "dotenv";
 
 // src/config/environment.ts
-import { z as z8 } from "zod";
-var environmentSchema = z8.object({
-  PORT: z8.coerce.number().int().min(1).max(65535).default(4577),
-  ALLOWED_ORIGINS: z8.string().default(
+import { z as z10 } from "zod";
+var baseEnvironmentSchema = z10.object({
+  PORT: z10.coerce.number().int().min(1).max(65535).default(4577),
+  ALLOWED_ORIGINS: z10.string().default(
     "http://localhost:3000,http://127.0.0.1:3000,http://localhost:4000,http://127.0.0.1:4000"
   ).transform(
     (value) => value.split(",").map((origin) => origin.trim()).filter(Boolean)
@@ -627,12 +731,14 @@ var environmentSchema = z8.object({
   // this token (via the Sec-WebSocket-Protocol header) or be rejected. Unset
   // by default so plain localhost usage is unaffected. Never a substitute for
   // real auth — see apps/bondsmithd/README.md's dev-tunnel section.
-  BONDSMITH_DEV_TUNNEL_TOKEN: z8.string().min(1).optional(),
+  BONDSMITH_DEV_TUNNEL_TOKEN: z10.string().min(1).optional(),
   // Base URL of the Bondsmith backend this daemon pairs itself against
   // (BD-432) — defaults to production so a real install works with zero
   // config; overridden to the local dev server (e.g. http://localhost:4000)
   // when developing bondsmithd itself against a local web app.
-  BONDSMITH_API_URL: z8.string().url().default("https://app.bondsmith.dev"),
+  BONDSMITH_API_URL: z10.string().url().default("https://app.bondsmith.dev").refine((value) => isSecureOrLoopbackUrl(value, "https:", "http:"), {
+    message: "BONDSMITH_API_URL must use https:// (plain http:// is only allowed for a loopback server such as http://localhost:4000)"
+  }),
   // Interface the WebSocket/HTTP server binds to. Defaults to loopback-only
   // (never reachable from outside this machine) — real access control is
   // ALLOWED_ORIGINS + the dev-tunnel token, not the bind address, but
@@ -641,22 +747,47 @@ var environmentSchema = z8.object({
   // that puts something (e.g. Docker's host-gateway route for an ngrok
   // tunnel) between the daemon and the browser — not something a normal
   // install needs to touch.
-  BONDSMITH_BIND_HOST: z8.string().min(1).default("127.0.0.1"),
+  BONDSMITH_BIND_HOST: z10.string().min(1).default("127.0.0.1"),
   // BD-450/BD-483/BD-484: connect outbound to the Bondsmith relay instead of
   // (or alongside) listening inbound. ON by default. The existing inbound
   // listener is completely unaffected either way — it keeps running
   // regardless, so direct-connection debugging (bypassing the relay
   // entirely) is still possible by setting BONDSMITH_RELAY_ENABLED=false
   // explicitly.
-  BONDSMITH_RELAY_ENABLED: z8.string().default("true").transform((value) => value === "true" || value === "1"),
+  BONDSMITH_RELAY_ENABLED: z10.string().default("true").transform((value) => value === "true" || value === "1"),
   // Defaults to production, mirroring BONDSMITH_API_URL above, so a real
   // install works with zero config — a bare `bondsmithd` used to silently
   // connect outbound to loopback (nothing listening there) with no error,
   // looking healthy while never reaching relay at all. Override to a local
   // apps/relay instance (its own `pnpm dev` default port) when developing
   // bondsmithd itself against a local relay.
-  BONDSMITH_RELAY_URL: z8.string().url().default("wss://relay.bondsmith.dev")
+  BONDSMITH_RELAY_URL: z10.string().url().default("wss://relay.bondsmith.dev"),
+  // The audience a non-loopback relay must present. Defaults to the relay URL's host; set it only when the relay's RELAY_AUDIENCE differs from its hostname.
+  BONDSMITH_RELAY_AUDIENCE: z10.string().min(1).optional()
+});
+var environmentSchema = baseEnvironmentSchema.superRefine((env, ctx) => {
+  if (env.BONDSMITH_RELAY_ENABLED && !isSecureOrLoopbackUrl(env.BONDSMITH_RELAY_URL, "wss:", "ws:")) {
+    ctx.addIssue({
+      code: z10.ZodIssueCode.custom,
+      path: ["BONDSMITH_RELAY_URL"],
+      message: "BONDSMITH_RELAY_URL must use wss:// (plain ws:// is only allowed for a loopback relay such as ws://127.0.0.1:8787)"
+    });
+  }
 });
+var LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+function isLoopbackUrl(url) {
+  return LOOPBACK_HOSTNAMES.has(url.hostname);
+}
+function isSecureOrLoopbackUrl(value, secureProtocol, plainProtocol) {
+  if (!URL.canParse(value)) return true;
+  const url = new URL(value);
+  return url.protocol === secureProtocol || url.protocol === plainProtocol && isLoopbackUrl(url);
+}
+function resolveExpectedRelayAudience(relayUrl, override) {
+  if (override) return override;
+  const url = new URL(relayUrl);
+  return isLoopbackUrl(url) ? null : url.hostname;
+}
 function getDaemonConfig(env = process.env) {
   const parsed = environmentSchema.parse(env);
   return {
@@ -666,7 +797,11 @@ function getDaemonConfig(env = process.env) {
     apiUrl: parsed.BONDSMITH_API_URL,
     bindHost: parsed.BONDSMITH_BIND_HOST,
     relayEnabled: parsed.BONDSMITH_RELAY_ENABLED,
-    relayUrl: parsed.BONDSMITH_RELAY_URL
+    relayUrl: parsed.BONDSMITH_RELAY_URL,
+    expectedRelayAudience: resolveExpectedRelayAudience(
+      parsed.BONDSMITH_RELAY_URL,
+      parsed.BONDSMITH_RELAY_AUDIENCE
+    )
   };
 }
 
@@ -904,6 +1039,7 @@ import { promisify } from "util";
 var execFile = promisify(execFileCb);
 var MAX_GIT_OUTPUT_BYTES = 64 * 1024 * 1024;
 var SAFE_DIFF_FLAGS = ["--no-ext-diff", "--no-textconv"];
+var SAFE_GIT_CONFIG = ["-c", "core.fsmonitor=false"];
 function splitNulList(output) {
   return output.split("\0").filter((entry) => entry.length > 0);
 }
@@ -920,7 +1056,10 @@ function isNotARepoError(error2) {
 }
 async function runGit(args, cwd) {
   try {
-    const { stdout } = await execFile("git", args, { cwd, maxBuffer: MAX_GIT_OUTPUT_BYTES });
+    const { stdout } = await execFile("git", [...SAFE_GIT_CONFIG, ...args], {
+      cwd,
+      maxBuffer: MAX_GIT_OUTPUT_BYTES
+    });
     return stdout;
   } catch (error2) {
     if (isNotARepoError(error2)) throw new GitNotARepoError();
@@ -929,7 +1068,10 @@ async function runGit(args, cwd) {
 }
 async function runGitAllowingExitCodes(args, cwd, allowedExitCodes) {
   try {
-    const { stdout } = await execFile("git", args, { cwd, maxBuffer: MAX_GIT_OUTPUT_BYTES });
+    const { stdout } = await execFile("git", [...SAFE_GIT_CONFIG, ...args], {
+      cwd,
+      maxBuffer: MAX_GIT_OUTPUT_BYTES
+    });
     return stdout;
   } catch (error2) {
     if (isNotARepoError(error2)) throw new GitNotARepoError();
@@ -1005,124 +1147,20 @@ async function validateProjectPath(input) {
 import { sign } from "crypto";
 import WebSocket from "ws";
 
-// src/version.ts
-var DAEMON_VERSION = true ? "0.1.9" : "dev";
-var VERSION_FLAGS = ["--version", "-v"];
-function versionLine() {
-  return `bondsmithd ${DAEMON_VERSION} (protocol ${PROTOCOL_VERSION})`;
-}
-function isVersionRequest(argv) {
-  return argv.some((arg) => VERSION_FLAGS.includes(arg));
-}
-
-// src/sessions/tmux/client.ts
-import { execFile as execFileCb2 } from "child_process";
-import { promisify as promisify2 } from "util";
-var execFile2 = promisify2(execFileCb2);
-var TmuxNoServerRunningError = class extends Error {
-  constructor() {
-    super("no tmux server running");
-    this.name = "TmuxNoServerRunningError";
-  }
-};
-var TmuxNotFoundError = class extends Error {
-  constructor() {
-    super(
-      [
-        "bondsmithd requires tmux, and it was not found on PATH.",
-        "",
-        "Install it:",
-        "  macOS (Homebrew):     brew install tmux",
-        "  Debian/Ubuntu:        sudo apt-get install tmux",
-        "  Fedora/RHEL:          sudo dnf install tmux",
-        "  Arch:                 sudo pacman -S tmux",
-        "",
-        "If tmux is already installed, start bondsmithd from a normal interactive shell \u2014",
-        "not a LaunchAgent, Docker container, or other minimal-PATH context. Those often",
-        "don't inherit the PATH tmux was installed into (e.g. Homebrew's /opt/homebrew/bin",
-        "on Apple Silicon)."
-      ].join("\n")
-    );
-    this.name = "TmuxNotFoundError";
-  }
-};
-var SENSITIVE_ENV_KEYS = ["ANTHROPIC_API_KEY", "BONDSMITH_DEV_TUNNEL_TOKEN"];
-function filterSpawnEnv(env) {
-  const filtered = { ...env };
-  for (const key of SENSITIVE_ENV_KEYS) delete filtered[key];
-  return filtered;
-}
-async function runTmux(args, options) {
-  try {
-    const { stdout } = await execFile2("tmux", args, { ...options, encoding: "utf8" });
-    return stdout;
-  } catch (error2) {
-    if (error2?.code === "ENOENT") throw new TmuxNotFoundError();
-    throw error2;
-  }
-}
-async function sendKeysLiteral(tmuxSessionName, text) {
-  await runTmux(["send-keys", "-t", tmuxSessionName, "-l", text]);
-}
-async function capturePane(tmuxSessionName) {
-  return runTmux(["capture-pane", "-t", tmuxSessionName, "-p", "-e"]);
-}
-async function getSessionActivity(tmuxSessionName) {
-  try {
-    const out = (await runTmux(["display-message", "-p", "-t", tmuxSessionName, "#{window_activity}"])).trim();
-    const seconds = Number(out);
-    if (!out || Number.isNaN(seconds)) return null;
-    return new Date(seconds * 1e3).toISOString();
-  } catch {
-    return null;
-  }
-}
-var PLAN_OPTION = "@bondsmith-plan";
-async function getSessionPlan(tmuxSessionName) {
-  try {
-    const plan = (await runTmux(["show-options", "-qv", "-t", tmuxSessionName, PLAN_OPTION])).trim();
-    return plan ? plan.slice(0, MAX_PLAN_CHARS) : null;
-  } catch (error2) {
-    if (error2 instanceof TmuxNotFoundError) throw error2;
-    return null;
-  }
-}
-async function listTmuxSessions(formatString) {
-  try {
-    return await runTmux(["list-sessions", "-F", formatString]);
-  } catch (error2) {
-    if (isNoServerError(error2)) throw new TmuxNoServerRunningError();
-    throw error2;
-  }
-}
-var NO_SERVER_MESSAGE_PATTERNS = [
-  /no server running/i,
-  /no current session/i,
-  /no sessions/i,
-  /failed to connect to server/i,
-  /error connecting to .*\((no such file or directory|connection refused)\)/i
-];
-function isNoServerError(error2) {
-  if (typeof error2 !== "object" || error2 === null) return false;
-  const { message, stderr } = error2;
-  const text = [message, stderr].filter((part) => typeof part === "string").join("\n");
-  return NO_SERVER_MESSAGE_PATTERNS.some((pattern) => pattern.test(text));
-}
-
-// src/security/verify-command.ts
-import { verify as verify2 } from "crypto";
+// src/security/connection-auth.ts
+import { randomBytes, verify as verify2 } from "crypto";
 
 // src/security/trusted-controllers.ts
 import { mkdir, readFile, rename, rm, writeFile } from "fs/promises";
 import { homedir as homedir2 } from "os";
 import { dirname, join as join2 } from "path";
-import { z as z9 } from "zod";
-var trustedControllerSchema = z9.object({
-  id: z9.string(),
-  publicKeyPem: z9.string(),
-  label: z9.string(),
-  addedAt: z9.string(),
-  lastUsedAt: z9.string().nullable(),
+import { z as z11 } from "zod";
+var trustedControllerSchema = z11.object({
+  id: z11.string(),
+  publicKeyPem: z11.string(),
+  label: z11.string(),
+  addedAt: z11.string(),
+  lastUsedAt: z11.string().nullable(),
   // Obsolete as of ADR-013/BD-477 — replay protection moved to an
   // ephemeral, connection-scoped sequence (connection-auth.ts), never
   // persisted. Accepted-but-ignored here (`.optional()`, not required, and
@@ -1131,11 +1169,11 @@ var trustedControllerSchema = z9.object({
   // before this change still parses correctly — controller trust and
   // revocation state is never lost — instead of throwing on an "unknown"
   // shape. Never written by this file's own persist() calls going forward.
-  lastSeenSequence: z9.number().int().nonnegative().optional()
+  lastSeenSequence: z11.number().int().nonnegative().optional()
 });
-var trustedControllersFileSchema = z9.object({
-  version: z9.literal(1),
-  controllers: z9.array(trustedControllerSchema)
+var trustedControllersFileSchema = z11.object({
+  version: z11.literal(1),
+  controllers: z11.array(trustedControllerSchema)
 });
 function defaultTrustedControllersPath() {
   return join2(homedir2(), ".bondsmith", "trusted-controllers.json");
@@ -1202,32 +1240,363 @@ async function recordControllerHandshake(controllerId, path = defaultTrustedCont
     await persist(path, next);
   });
 }
-var trustFileLocks = /* @__PURE__ */ new Map();
-function withTrustFileLock(path, fn) {
-  const previous = trustFileLocks.get(path) ?? Promise.resolve();
-  const next = previous.catch(() => {
-  }).then(fn);
-  trustFileLocks.set(
-    path,
-    next.catch(() => {
-    })
-  );
-  return next;
+var trustFileLocks = /* @__PURE__ */ new Map();
+function withTrustFileLock(path, fn) {
+  const previous = trustFileLocks.get(path) ?? Promise.resolve();
+  const next = previous.catch(() => {
+  }).then(fn);
+  trustFileLocks.set(
+    path,
+    next.catch(() => {
+    })
+  );
+  return next;
+}
+async function persist(path, controllers) {
+  await mkdir(dirname(path), { recursive: true });
+  const tmpPath = `${path}.tmp-${process.pid}-${Date.now()}`;
+  const contents = JSON.stringify({ version: 1, controllers }, null, 2);
+  try {
+    await writeFile(tmpPath, contents, { mode: 384 });
+    await rename(tmpPath, path);
+  } catch (error2) {
+    await rm(tmpPath, { force: true });
+    throw error2;
+  }
+}
+
+// src/security/connection-auth.ts
+var CHALLENGE_LENGTH_BYTES = 32;
+var CONNECTION_ID_LENGTH_BYTES = 24;
+var CHALLENGE_LIFETIME_MS = 3e4;
+var UNAUTHENTICATED_CONNECTION_TIMEOUT_MS = CHALLENGE_LIFETIME_MS;
+var MAX_FAILED_HANDSHAKES_PER_CONNECTION = 3;
+var MAX_FAILED_HANDSHAKES_PER_WINDOW = 300;
+var HANDSHAKE_RATE_LIMIT_WINDOW_MS = 6e4;
+var failedHandshakeTimestamps = [];
+function isHandshakeRateLimited() {
+  const windowStart = Date.now() - HANDSHAKE_RATE_LIMIT_WINDOW_MS;
+  failedHandshakeTimestamps = failedHandshakeTimestamps.filter((t) => t > windowStart);
+  return failedHandshakeTimestamps.length >= MAX_FAILED_HANDSHAKES_PER_WINDOW;
+}
+function recordFailedHandshake() {
+  failedHandshakeTimestamps.push(Date.now());
+}
+var ConnectionAuthState = class {
+  constructor(daemonFingerprint) {
+    this.daemonFingerprint = daemonFingerprint;
+    this.connectionId = randomBytes(CONNECTION_ID_LENGTH_BYTES).toString("base64url");
+    this.challenge = randomBytes(CHALLENGE_LENGTH_BYTES).toString("base64url");
+    this.challengeExpiresAt = Date.now() + CHALLENGE_LIFETIME_MS;
+  }
+  connectionId;
+  challenge;
+  challengeExpiresAt;
+  authenticated = null;
+  lastSequence = 0;
+  connectionKey = null;
+  failedHandshakes = 0;
+  // BD-487: set synchronously by revocation (server.ts's
+  // revokeControllerConnections/revokeAllConnections, or relay-client.ts's
+  // identically-named functions), checked synchronously again in
+  // router.ts's handleBrowserMessage immediately before dispatch() runs —
+  // closes the gap where a command already past verifyCommand's async
+  // awaits (getTrustedController's disk read, checkAndAdvanceSequence)
+  // would otherwise still execute even though revocation was supposed to
+  // have already ended this connection's authority. Deliberately a plain
+  // synchronous flag, not itself awaited anywhere: the race this closes is
+  // specifically the gap between an async check's awaits, so the fix must
+  // be a check with zero await distance from dispatch(), not another
+  // async lookup that reopens the same kind of window.
+  revoked = false;
+  // Serializes sequence verify-and-advance within this one connection —
+  // without this, two commands signed close together could have their
+  // async verification interleave and both read the same "last sequence"
+  // before either advances it, letting a lower/equal sequence slip through
+  // as if it were the next one. A per-connection promise chain (same
+  // pattern as trusted-controllers.ts's withTrustFileLock, but in-memory
+  // and scoped to one socket instead of a file path) is sufficient — never
+  // contends across connections, and there is no file I/O to race.
+  sequenceChain = Promise.resolve();
+  // Serializes authenticate() the same way sequenceChain serializes
+  // checkAndAdvanceSequence — adversarial review (BD-477 follow-up) found
+  // that two connection.authenticate frames arriving back-to-back on one
+  // socket could both pass the `this.authenticated === null` check before
+  // either reached the assignment at the end of the async verification
+  // chain, since getTrustedController is a real await gap. Both attempts
+  // still require a validly-signed transcript (this was never an auth
+  // bypass), but the second could silently overwrite the first's identity
+  // and double-register the socket in server.ts's connectionsByController
+  // map. Without a chain here, the fix would need a synchronous
+  // compare-and-set instead, which would need to happen before the
+  // signature is even checked — this chain is simpler and matches the
+  // sequence check's own established pattern.
+  authenticateChain = Promise.resolve();
+  getChallenge() {
+    return {
+      connectionId: this.connectionId,
+      challenge: this.challenge,
+      expiresAt: this.challengeExpiresAt
+    };
+  }
+  isAuthenticated() {
+    return this.authenticated !== null;
+  }
+  /** The key derived from this connection's handshake, held in memory only; null when the browser offered no key. */
+  setConnectionKey(key) {
+    this.connectionKey = key;
+  }
+  getConnectionKey() {
+    return this.connectionKey;
+  }
+  /** Ends this connection's authority and marks it for closing, since the transports close a connection once its handshake attempts are exhausted. */
+  abandonAfterKeyAgreementFailure() {
+    this.revoked = true;
+    this.failedHandshakes = MAX_FAILED_HANDSHAKES_PER_CONNECTION;
+  }
+  /** BD-487: marks this connection's authority as ended — called by revocation, checked by router.ts immediately before dispatch(). Idempotent; a connection is never un-revoked. */
+  revoke() {
+    this.revoked = true;
+  }
+  isRevoked() {
+    return this.revoked;
+  }
+  /** Unsolicited daemon broadcasts (session.created/updated) go only to connections that completed the handshake and still hold authority. */
+  canReceiveBroadcasts() {
+    return this.authenticated !== null && !this.revoked;
+  }
+  /** The controller/account this connection authenticated as, or null before a successful handshake. Used by verify-command.ts to reject an envelope signed by a DIFFERENT controller than the one that authenticated this connection. */
+  getAuthenticatedIdentity() {
+    return this.authenticated;
+  }
+  /**
+   * Verifies a signed connection-handshake transcript and, on success,
+   * marks this connection authenticated — exactly once, including under
+   * concurrent calls. A call after a SUCCESSFUL handshake (even one that
+   * overlaps in time) is rejected with "already_authenticated"; a failed
+   * attempt does not consume the slot, up to this connection's failure cap.
+   * The challenge is bound to this ConnectionAuthState instance and is never
+   * reissued or extended, so a duplicate, delayed, or concurrent attempt can
+   * never re-authenticate or reset this connection's sequence counter.
+   *
+   * Serialized via authenticateChain (same pattern as
+   * checkAndAdvanceSequence's sequenceChain) so two connection.authenticate
+   * frames arriving close together on one socket can't both observe
+   * `this.authenticated === null` before either finishes — without this,
+   * both could pass the guard, both complete real signature verification
+   * (this was never an auth bypass on its own), and the second's
+   * assignment would silently overwrite the first's, double-registering
+   * the socket under two controller identities.
+   *
+   * Checks run in a fixed order regardless of which field is
+   * attacker-controlled, matching verify-command.ts's own discipline:
+   * connection binding and freshness are checked before the signature is
+   * even verified (they're cheap, local, and don't leak anything about
+   * controller trust), then the signature, then controller trust —
+   * signature must pass before ANY other field of the transcript is
+   * trusted for a decision, since those fields are attacker-controlled
+   * until the signature over the whole transcript is checked.
+   */
+  authenticate(signed, trustedControllersPath) {
+    const task = this.authenticateChain.then(
+      () => this.authenticateOnce(signed, trustedControllersPath)
+    );
+    this.authenticateChain = task.catch(() => {
+    });
+    return task;
+  }
+  async authenticateOnce(signed, trustedControllersPath) {
+    if (this.authenticated) {
+      return { ok: false, reason: "already_authenticated" };
+    }
+    if (isHandshakeRateLimited()) {
+      this.failedHandshakes += 1;
+      return { ok: false, reason: "rate_limited" };
+    }
+    const result = await this.verifyHandshake(signed, trustedControllersPath);
+    if (!result.ok) {
+      this.failedHandshakes += 1;
+      recordFailedHandshake();
+    }
+    return result;
+  }
+  /** True once this connection has used up its failed handshakes; its transport must close it. */
+  hasExhaustedHandshakeAttempts() {
+    return this.failedHandshakes >= MAX_FAILED_HANDSHAKES_PER_CONNECTION;
+  }
+  async verifyHandshake(signed, trustedControllersPath) {
+    const { transcript, signature } = signed;
+    if (transcript.purpose !== CONNECTION_CHALLENGE_PURPOSE) {
+      return { ok: false, reason: "bad_signature" };
+    }
+    if (transcript.connectionId !== this.connectionId || transcript.challenge !== this.challenge) {
+      return { ok: false, reason: "wrong_connection" };
+    }
+    if (Date.now() >= this.challengeExpiresAt) {
+      return { ok: false, reason: "challenge_expired" };
+    }
+    if (transcript.daemonFingerprint !== this.daemonFingerprint) {
+      return { ok: false, reason: "wrong_daemon" };
+    }
+    const controller = await getTrustedController(transcript.controllerId, trustedControllersPath);
+    if (!controller) {
+      return { ok: false, reason: "untrusted_controller" };
+    }
+    let signatureValid;
+    try {
+      signatureValid = verify2(
+        "sha256",
+        Buffer.from(canonicalize(transcript), "utf8"),
+        // WebCrypto's ECDSA signatures are raw r||s (IEEE P1363), not the
+        // DER encoding node:crypto defaults to for EC keys — matches
+        // verify-command.ts's and pairing.ts's identical handling.
+        { key: controller.publicKeyPem, dsaEncoding: "ieee-p1363" },
+        Buffer.from(signature, "base64")
+      );
+    } catch {
+      signatureValid = false;
+    }
+    if (!signatureValid) {
+      return { ok: false, reason: "bad_signature" };
+    }
+    this.authenticated = { controllerId: transcript.controllerId, accountId: transcript.accountId };
+    recordControllerHandshake(transcript.controllerId, trustedControllersPath).catch(
+      (err) => {
+        console.error("Failed to record controller handshake (non-fatal)", err);
+      }
+    );
+    return { ok: true, controllerId: transcript.controllerId, accountId: transcript.accountId };
+  }
+  /**
+   * Verifies a command envelope's sequence number is strictly greater than
+   * the last one accepted on THIS connection, then advances the
+   * counter — serialized via sequenceChain so two verify calls racing
+   * close together can never both read the same lastSequence before
+   * either advances it. Must only be called for an envelope whose
+   * connectionId has already been confirmed to match this connection
+   * (router.ts checks that before calling this) and whose controllerId
+   * matches this connection's authenticated controller (same caller
+   * responsibility) — this method only ever checks the sequence number
+   * itself, not connection/controller binding, which is the caller's job.
+   */
+  async checkAndAdvanceSequence(sequence) {
+    if (!this.authenticated) {
+      return { ok: false, reason: "not_authenticated" };
+    }
+    const task = this.sequenceChain.then(() => {
+      if (sequence <= this.lastSequence) {
+        return { ok: false, reason: "replayed" };
+      }
+      this.lastSequence = sequence;
+      return { ok: true };
+    });
+    this.sequenceChain = task.catch(() => {
+    });
+    return task;
+  }
+};
+
+// src/version.ts
+var DAEMON_VERSION = true ? "0.1.11" : "dev";
+var VERSION_FLAGS = ["--version", "-v"];
+function versionLine() {
+  return `bondsmithd ${DAEMON_VERSION} (protocol ${PROTOCOL_VERSION})`;
+}
+function isVersionRequest(argv) {
+  return argv.some((arg) => VERSION_FLAGS.includes(arg));
+}
+
+// src/sessions/tmux/client.ts
+import { execFile as execFileCb2 } from "child_process";
+import { promisify as promisify2 } from "util";
+var execFile2 = promisify2(execFileCb2);
+var TmuxNoServerRunningError = class extends Error {
+  constructor() {
+    super("no tmux server running");
+    this.name = "TmuxNoServerRunningError";
+  }
+};
+var TmuxNotFoundError = class extends Error {
+  constructor() {
+    super(
+      [
+        "bondsmithd requires tmux, and it was not found on PATH.",
+        "",
+        "Install it:",
+        "  macOS (Homebrew):     brew install tmux",
+        "  Debian/Ubuntu:        sudo apt-get install tmux",
+        "  Fedora/RHEL:          sudo dnf install tmux",
+        "  Arch:                 sudo pacman -S tmux",
+        "",
+        "If tmux is already installed, start bondsmithd from a normal interactive shell \u2014",
+        "not a LaunchAgent, Docker container, or other minimal-PATH context. Those often",
+        "don't inherit the PATH tmux was installed into (e.g. Homebrew's /opt/homebrew/bin",
+        "on Apple Silicon)."
+      ].join("\n")
+    );
+    this.name = "TmuxNotFoundError";
+  }
+};
+var SENSITIVE_ENV_KEYS = ["ANTHROPIC_API_KEY", "BONDSMITH_DEV_TUNNEL_TOKEN"];
+function filterSpawnEnv(env) {
+  const filtered = { ...env };
+  for (const key of SENSITIVE_ENV_KEYS) delete filtered[key];
+  return filtered;
+}
+async function runTmux(args, options) {
+  try {
+    const { stdout } = await execFile2("tmux", args, { ...options, encoding: "utf8" });
+    return stdout;
+  } catch (error2) {
+    if (error2?.code === "ENOENT") throw new TmuxNotFoundError();
+    throw error2;
+  }
+}
+async function sendKeysLiteral(tmuxSessionName, text) {
+  await runTmux(["send-keys", "-t", tmuxSessionName, "-l", text]);
+}
+async function capturePane(tmuxSessionName) {
+  return runTmux(["capture-pane", "-t", tmuxSessionName, "-p", "-e"]);
+}
+async function getSessionActivity(tmuxSessionName) {
+  try {
+    const out = (await runTmux(["display-message", "-p", "-t", tmuxSessionName, "#{window_activity}"])).trim();
+    const seconds = Number(out);
+    if (!out || Number.isNaN(seconds)) return null;
+    return new Date(seconds * 1e3).toISOString();
+  } catch {
+    return null;
+  }
+}
+var PLAN_OPTION = "@bondsmith-plan";
+async function getSessionPlan(tmuxSessionName) {
+  const plan = (await runTmux(["show-options", "-qv", "-t", tmuxSessionName, PLAN_OPTION])).trim();
+  return plan ? plan.slice(0, MAX_PLAN_CHARS) : null;
 }
-async function persist(path, controllers) {
-  await mkdir(dirname(path), { recursive: true });
-  const tmpPath = `${path}.tmp-${process.pid}-${Date.now()}`;
-  const contents = JSON.stringify({ version: 1, controllers }, null, 2);
+async function listTmuxSessions(formatString) {
   try {
-    await writeFile(tmpPath, contents, { mode: 384 });
-    await rename(tmpPath, path);
+    return await runTmux(["list-sessions", "-F", formatString]);
   } catch (error2) {
-    await rm(tmpPath, { force: true });
+    if (isNoServerError(error2)) throw new TmuxNoServerRunningError();
     throw error2;
   }
 }
+var NO_SERVER_MESSAGE_PATTERNS = [
+  /no server running/i,
+  /no current session/i,
+  /no sessions/i,
+  /failed to connect to server/i,
+  /error connecting to .*\((no such file or directory|connection refused)\)/i
+];
+function isNoServerError(error2) {
+  if (typeof error2 !== "object" || error2 === null) return false;
+  const { message, stderr } = error2;
+  const text = [message, stderr].filter((part) => typeof part === "string").join("\n");
+  return NO_SERVER_MESSAGE_PATTERNS.some((pattern) => pattern.test(text));
+}
 
 // src/security/verify-command.ts
+import { verify as verify3 } from "crypto";
 var ENVELOPE_MAX_AGE_MS = 6e4;
 var CLOCK_SKEW_TOLERANCE_MS = 5e3;
 async function verifyCommand(command, daemonFingerprint, connectionState, trustedControllersPath) {
@@ -1249,7 +1618,7 @@ async function verifyCommand(command, daemonFingerprint, connectionState, truste
   const canonicalBytes = Buffer.from(canonicalize(envelope), "utf8");
   let signatureValid;
   try {
-    signatureValid = verify2(
+    signatureValid = verify3(
       "sha256",
       canonicalBytes,
       // WebCrypto's ECDSA signatures are raw r||s (IEEE P1363), not the
@@ -1357,6 +1726,14 @@ function createOutputPacer(options) {
   };
 }
 
+// src/ws/sanitize-insert-text.ts
+var DISALLOWED_CHARACTERS = /[\x00-\x08\x0b-\x1f\x7f-\x9f‪-‮⁦-⁩]/g;
+function sanitizeInsertText(text) {
+  const withLineFeeds = text.replace(/\r\n?/g, "\n");
+  const sanitized = withLineFeeds.replace(DISALLOWED_CHARACTERS, "");
+  return { text: sanitized, strippedCount: withLineFeeds.length - sanitized.length };
+}
+
 // src/ws/router.ts
 var SIGNABLE_ACTION_SET = new Set(SIGNABLE_ACTIONS);
 function isSignableAction(type) {
@@ -1526,7 +1903,30 @@ async function handleBrowserMessage(conn, raw, deps) {
       return;
     }
     conn.markControllerId(result.controllerId);
-    conn.send({ type: "connection.authenticated", connectionId: conn.connectionAuth.connectionId });
+    let daemonEcdhPublicKey;
+    if (signed.transcript.clientEcdhPublicKey) {
+      try {
+        const exchange = await createEphemeralKeyExchange("daemon");
+        daemonEcdhPublicKey = exchange.publicKey;
+        const keyedTranscript = buildDaemonProofTranscript(signed.transcript, daemonEcdhPublicKey);
+        if (!keyedTranscript) throw new Error("A key agreement needs a clientNonce");
+        conn.connectionAuth.setConnectionKey(
+          await exchange.deriveKey(signed.transcript.clientEcdhPublicKey, keyedTranscript)
+        );
+      } catch (err) {
+        console.error("Key agreement failed; ending the connection", err);
+        conn.connectionAuth.abandonAfterKeyAgreementFailure();
+        conn.send({ type: "connection.authenticationFailed", reason: "key_agreement_failed" });
+        return;
+      }
+    }
+    const proofTranscript = buildDaemonProofTranscript(signed.transcript, daemonEcdhPublicKey);
+    conn.send({
+      type: "connection.authenticated",
+      connectionId: conn.connectionAuth.connectionId,
+      ...proofTranscript && { daemonSignature: deps.signDaemonProof(proofTranscript) },
+      ...daemonEcdhPublicKey && { daemonEcdhPublicKey }
+    });
     return;
   }
   if (isSignableAction(parsed.data.type)) {
@@ -1640,10 +2040,14 @@ async function dispatch(conn, message, {
     case "session.insertText": {
       const session = getSessionOrError(sessionManager, conn, message.sessionId);
       if (!session) return;
+      const { text, strippedCount } = sanitizeInsertText(message.text);
+      if (strippedCount > 0) {
+        console.warn(`bondsmithd: stripped ${strippedCount} control characters from inserted text`);
+      }
       try {
         await sendKeysLiteral(
           session.tmuxSessionName,
-          `${BRACKETED_PASTE_START}${message.text}${BRACKETED_PASTE_END}`
+          `${BRACKETED_PASTE_START}${text}${BRACKETED_PASTE_END}`
         );
       } catch (err) {
         conn.send(error(errorMessageOf(err, "failed to insert text")));
@@ -1782,206 +2186,6 @@ async function dispatch(conn, message, {
   }
 }
 
-// src/security/connection-auth.ts
-import { randomBytes, verify as verify3 } from "crypto";
-var CHALLENGE_LENGTH_BYTES = 32;
-var CONNECTION_ID_LENGTH_BYTES = 24;
-var CHALLENGE_LIFETIME_MS = 3e4;
-var MAX_HANDSHAKE_ATTEMPTS_PER_WINDOW = 30;
-var HANDSHAKE_RATE_LIMIT_WINDOW_MS = 6e4;
-var handshakeAttemptTimestamps = [];
-function isHandshakeRateLimited() {
-  const windowStart = Date.now() - HANDSHAKE_RATE_LIMIT_WINDOW_MS;
-  handshakeAttemptTimestamps = handshakeAttemptTimestamps.filter((t) => t > windowStart);
-  return handshakeAttemptTimestamps.length >= MAX_HANDSHAKE_ATTEMPTS_PER_WINDOW;
-}
-function recordHandshakeAttempt() {
-  handshakeAttemptTimestamps.push(Date.now());
-}
-var ConnectionAuthState = class {
-  constructor(daemonFingerprint) {
-    this.daemonFingerprint = daemonFingerprint;
-    this.connectionId = randomBytes(CONNECTION_ID_LENGTH_BYTES).toString("base64url");
-    this.challenge = randomBytes(CHALLENGE_LENGTH_BYTES).toString("base64url");
-    this.challengeExpiresAt = Date.now() + CHALLENGE_LIFETIME_MS;
-  }
-  connectionId;
-  challenge;
-  challengeExpiresAt;
-  authenticated = null;
-  lastSequence = 0;
-  // BD-487: set synchronously by revocation (server.ts's
-  // revokeControllerConnections/revokeAllConnections, or relay-client.ts's
-  // identically-named functions), checked synchronously again in
-  // router.ts's handleBrowserMessage immediately before dispatch() runs —
-  // closes the gap where a command already past verifyCommand's async
-  // awaits (getTrustedController's disk read, checkAndAdvanceSequence)
-  // would otherwise still execute even though revocation was supposed to
-  // have already ended this connection's authority. Deliberately a plain
-  // synchronous flag, not itself awaited anywhere: the race this closes is
-  // specifically the gap between an async check's awaits, so the fix must
-  // be a check with zero await distance from dispatch(), not another
-  // async lookup that reopens the same kind of window.
-  revoked = false;
-  // Serializes sequence verify-and-advance within this one connection —
-  // without this, two commands signed close together could have their
-  // async verification interleave and both read the same "last sequence"
-  // before either advances it, letting a lower/equal sequence slip through
-  // as if it were the next one. A per-connection promise chain (same
-  // pattern as trusted-controllers.ts's withTrustFileLock, but in-memory
-  // and scoped to one socket instead of a file path) is sufficient — never
-  // contends across connections, and there is no file I/O to race.
-  sequenceChain = Promise.resolve();
-  // Serializes authenticate() the same way sequenceChain serializes
-  // checkAndAdvanceSequence — adversarial review (BD-477 follow-up) found
-  // that two connection.authenticate frames arriving back-to-back on one
-  // socket could both pass the `this.authenticated === null` check before
-  // either reached the assignment at the end of the async verification
-  // chain, since getTrustedController is a real await gap. Both attempts
-  // still require a validly-signed transcript (this was never an auth
-  // bypass), but the second could silently overwrite the first's identity
-  // and double-register the socket in server.ts's connectionsByController
-  // map. Without a chain here, the fix would need a synchronous
-  // compare-and-set instead, which would need to happen before the
-  // signature is even checked — this chain is simpler and matches the
-  // sequence check's own established pattern.
-  authenticateChain = Promise.resolve();
-  getChallenge() {
-    return {
-      connectionId: this.connectionId,
-      challenge: this.challenge,
-      expiresAt: this.challengeExpiresAt
-    };
-  }
-  isAuthenticated() {
-    return this.authenticated !== null;
-  }
-  /** BD-487: marks this connection's authority as ended — called by revocation, checked by router.ts immediately before dispatch(). Idempotent; a connection is never un-revoked. */
-  revoke() {
-    this.revoked = true;
-  }
-  isRevoked() {
-    return this.revoked;
-  }
-  /** The controller/account this connection authenticated as, or null before a successful handshake. Used by verify-command.ts to reject an envelope signed by a DIFFERENT controller than the one that authenticated this connection. */
-  getAuthenticatedIdentity() {
-    return this.authenticated;
-  }
-  /**
-   * Verifies a signed connection-handshake transcript and, on success,
-   * marks this connection authenticated — exactly once, including under
-   * concurrent calls. A second call (whether the first succeeded or
-   * failed, and regardless of whether the two calls overlap in time) is
-   * rejected with "already_authenticated": the challenge is bound to this
-   * ConnectionAuthState instance and is never reissued or extended, so a
-   * duplicate, delayed, or concurrent handshake attempt can never
-   * re-authenticate or reset this connection's sequence counter.
-   *
-   * Serialized via authenticateChain (same pattern as
-   * checkAndAdvanceSequence's sequenceChain) so two connection.authenticate
-   * frames arriving close together on one socket can't both observe
-   * `this.authenticated === null` before either finishes — without this,
-   * both could pass the guard, both complete real signature verification
-   * (this was never an auth bypass on its own), and the second's
-   * assignment would silently overwrite the first's, double-registering
-   * the socket under two controller identities.
-   *
-   * Checks run in a fixed order regardless of which field is
-   * attacker-controlled, matching verify-command.ts's own discipline:
-   * connection binding and freshness are checked before the signature is
-   * even verified (they're cheap, local, and don't leak anything about
-   * controller trust), then the signature, then controller trust —
-   * signature must pass before ANY other field of the transcript is
-   * trusted for a decision, since those fields are attacker-controlled
-   * until the signature over the whole transcript is checked.
-   */
-  authenticate(signed, trustedControllersPath) {
-    const task = this.authenticateChain.then(
-      () => this.authenticateOnce(signed, trustedControllersPath)
-    );
-    this.authenticateChain = task.catch(() => {
-    });
-    return task;
-  }
-  async authenticateOnce(signed, trustedControllersPath) {
-    if (this.authenticated) {
-      return { ok: false, reason: "already_authenticated" };
-    }
-    if (isHandshakeRateLimited()) {
-      return { ok: false, reason: "rate_limited" };
-    }
-    recordHandshakeAttempt();
-    const { transcript, signature } = signed;
-    if (transcript.purpose !== CONNECTION_CHALLENGE_PURPOSE) {
-      return { ok: false, reason: "bad_signature" };
-    }
-    if (transcript.connectionId !== this.connectionId || transcript.challenge !== this.challenge) {
-      return { ok: false, reason: "wrong_connection" };
-    }
-    if (Date.now() >= this.challengeExpiresAt) {
-      return { ok: false, reason: "challenge_expired" };
-    }
-    if (transcript.daemonFingerprint !== this.daemonFingerprint) {
-      return { ok: false, reason: "wrong_daemon" };
-    }
-    const controller = await getTrustedController(transcript.controllerId, trustedControllersPath);
-    if (!controller) {
-      return { ok: false, reason: "untrusted_controller" };
-    }
-    let signatureValid;
-    try {
-      signatureValid = verify3(
-        "sha256",
-        Buffer.from(canonicalize(transcript), "utf8"),
-        // WebCrypto's ECDSA signatures are raw r||s (IEEE P1363), not the
-        // DER encoding node:crypto defaults to for EC keys — matches
-        // verify-command.ts's and pairing.ts's identical handling.
-        { key: controller.publicKeyPem, dsaEncoding: "ieee-p1363" },
-        Buffer.from(signature, "base64")
-      );
-    } catch {
-      signatureValid = false;
-    }
-    if (!signatureValid) {
-      return { ok: false, reason: "bad_signature" };
-    }
-    this.authenticated = { controllerId: transcript.controllerId, accountId: transcript.accountId };
-    recordControllerHandshake(transcript.controllerId, trustedControllersPath).catch(
-      (err) => {
-        console.error("Failed to record controller handshake (non-fatal)", err);
-      }
-    );
-    return { ok: true, controllerId: transcript.controllerId, accountId: transcript.accountId };
-  }
-  /**
-   * Verifies a command envelope's sequence number is strictly greater than
-   * the last one accepted on THIS connection, then advances the
-   * counter — serialized via sequenceChain so two verify calls racing
-   * close together can never both read the same lastSequence before
-   * either advances it. Must only be called for an envelope whose
-   * connectionId has already been confirmed to match this connection
-   * (router.ts checks that before calling this) and whose controllerId
-   * matches this connection's authenticated controller (same caller
-   * responsibility) — this method only ever checks the sequence number
-   * itself, not connection/controller binding, which is the caller's job.
-   */
-  async checkAndAdvanceSequence(sequence) {
-    if (!this.authenticated) {
-      return { ok: false, reason: "not_authenticated" };
-    }
-    const task = this.sequenceChain.then(() => {
-      if (sequence <= this.lastSequence) {
-        return { ok: false, reason: "replayed" };
-      }
-      this.lastSequence = sequence;
-      return { ok: true };
-    });
-    this.sequenceChain = task.catch(() => {
-    });
-    return task;
-  }
-};
-
 // src/relay/relay-session-registry.ts
 var MAX_CONCURRENT_RELAY_SESSIONS = 32;
 var RelaySessionRegistry = class {
@@ -2034,20 +2238,31 @@ function signTranscript(transcript, privateKeyPem) {
 }
 function startRelayClient(deps) {
   const sessions = new RelaySessionRegistry();
+  const unauthenticatedTimers = /* @__PURE__ */ new Map();
+  function forgetSession(relaySessionId) {
+    clearTimeout(unauthenticatedTimers.get(relaySessionId));
+    unauthenticatedTimers.delete(relaySessionId);
+    sessions.delete(relaySessionId);
+  }
+  function forgetAllSessions() {
+    for (const timer of unauthenticatedTimers.values()) clearTimeout(timer);
+    unauthenticatedTimers.clear();
+    sessions.deleteAll();
+  }
   let stopped = false;
   let socket;
   let reconnectAttempt = 0;
   let reconnectTimer;
   function broadcast(message) {
     for (const entry of sessions.values()) {
-      entry.conn.send(message);
+      if (entry.connectionAuth.canReceiveBroadcasts()) entry.conn.send(message);
     }
   }
   const routerDeps = { ...deps, broadcast };
   function revokeSession(relaySessionId) {
     sessions.get(relaySessionId)?.connectionAuth.revoke();
     if (socket) send(socket, { type: "relay.closeSession", relaySessionId });
-    sessions.delete(relaySessionId);
+    forgetSession(relaySessionId);
   }
   function revokeControllerConnections(controllerId) {
     for (const entry of sessions.values()) {
@@ -2104,6 +2319,13 @@ function startRelayClient(deps) {
       (connectionAuth) => buildRouterConnection(relaySessionId, ws, connectionAuth)
     );
     const entry = sessions.get(relaySessionId);
+    const unauthenticatedTimer = setTimeout(() => {
+      if (sessions.get(relaySessionId) === entry && !entry.connectionAuth.isAuthenticated()) {
+        revokeSession(relaySessionId);
+      }
+    }, deps.unauthenticatedTimeoutMs ?? UNAUTHENTICATED_CONNECTION_TIMEOUT_MS);
+    unauthenticatedTimer.unref();
+    unauthenticatedTimers.set(relaySessionId, unauthenticatedTimer);
     send(ws, { type: "relay.sessionOpenAck", relaySessionId });
     const challenge = entry.connectionAuth.getChallenge();
     entry.conn.send({
@@ -2120,7 +2342,11 @@ function startRelayClient(deps) {
   function handleFrame(frame) {
     const entry = sessions.get(frame.relaySessionId);
     if (!entry) return;
-    handleBrowserMessage(entry.conn, frame.payload, routerDeps).catch((err) => {
+    handleBrowserMessage(entry.conn, frame.payload, routerDeps).then(() => {
+      if (entry.connectionAuth.hasExhaustedHandshakeAttempts()) {
+        revokeSession(frame.relaySessionId);
+      }
+    }).catch((err) => {
       console.error("relay-client: unhandled error in handleBrowserMessage", err);
       entry.conn.send({
         type: "error",
@@ -2144,6 +2370,13 @@ function startRelayClient(deps) {
       const message = result.data;
       switch (message.type) {
         case "relay.challenge": {
+          if (deps.expectedRelayAudience !== null && message.relayAudience !== deps.expectedRelayAudience) {
+            console.error(
+              `relay-client: refusing to register \u2014 relay presented audience "${message.relayAudience}", expected "${deps.expectedRelayAudience}"`
+            );
+            ws.close();
+            return;
+          }
           const transcript = {
             version: 1,
             purpose: RELAY_REGISTER_PURPOSE,
@@ -2178,7 +2411,7 @@ function startRelayClient(deps) {
           return;
         }
         case "relay.sessionClosed": {
-          sessions.delete(message.relaySessionId);
+          forgetSession(message.relaySessionId);
           return;
         }
         case "relay.frame": {
@@ -2190,7 +2423,7 @@ function startRelayClient(deps) {
     ws.on("error", () => {
     });
     ws.on("close", () => {
-      sessions.deleteAll();
+      forgetAllSessions();
       if (socket === ws) socket = void 0;
       scheduleReconnect();
     });
@@ -2200,7 +2433,7 @@ function startRelayClient(deps) {
     stop: () => {
       stopped = true;
       if (reconnectTimer) clearTimeout(reconnectTimer);
-      sessions.deleteAll();
+      forgetAllSessions();
       socket?.close();
     },
     broadcast,
@@ -2274,6 +2507,12 @@ function extractPemBlock(text, label) {
   return text.match(pattern)?.[0] ?? null;
 }
 
+// src/security/daemon-proof.ts
+import { sign as sign3 } from "crypto";
+function createDaemonProofSigner(privateKeyPem) {
+  return (transcript) => sign3(null, Buffer.from(canonicalize(transcript), "utf8"), privateKeyPem).toString("base64");
+}
+
 // src/security/dev-tunnel-token-file.ts
 import { randomBytes as randomBytes2 } from "crypto";
 import { mkdir as mkdir3, readFile as readFile3, rename as rename3, rm as rm3, writeFile as writeFile3 } from "fs/promises";
@@ -2516,12 +2755,17 @@ var PendingAuthorizationStore = class {
 };
 
 // src/security/revocation-sync.ts
+import { z as z12 } from "zod";
 var POLL_INTERVAL_MS = 3e4;
 var POLL_JITTER_MS = 6e3;
 var POLL_REQUEST_TIMEOUT_MS = 1e4;
 var BACKOFF_BASE_MS = 2e3;
 var BACKOFF_MAX_MS = 2e4;
 var MAX_CONSECUTIVE_FAILURE_BACKOFFS = 4;
+var checkRevocationStatusResponseSchema = z12.object({
+  pairingRevoked: z12.boolean(),
+  revokedControllerPublicKeys: z12.array(z12.string())
+});
 function jitteredInterval(deps) {
   const interval = deps.pollIntervalMs ?? POLL_INTERVAL_MS;
   const jitter = deps.pollJitterMs ?? POLL_JITTER_MS;
@@ -2543,17 +2787,22 @@ async function pollOnce(deps) {
   if (trusted.length === 0) return true;
   let response;
   try {
-    response = await withTimeout(
-      callTRPCQuery(
-        deps.apiUrl,
-        "daemonPairing.checkRevocationStatus",
-        {
-          daemonPublicKey: deps.daemonPublicKey,
-          controllerPublicKeys: trusted.map((c) => c.publicKeyPem)
-        }
-      ),
+    const raw = await withTimeout(
+      callTRPCQuery(deps.apiUrl, "daemonPairing.checkRevocationStatus", {
+        daemonPublicKey: deps.daemonPublicKey,
+        controllerPublicKeys: trusted.map((c) => c.publicKeyPem)
+      }),
       deps.pollRequestTimeoutMs ?? POLL_REQUEST_TIMEOUT_MS
     );
+    const parsed = checkRevocationStatusResponseSchema.safeParse(raw);
+    if (!parsed.success) {
+      console.error(
+        "revocation-sync: ignoring malformed checkRevocationStatus response",
+        parsed.error.message
+      );
+      return false;
+    }
+    response = parsed.data;
   } catch {
     return false;
   }
@@ -3317,7 +3566,9 @@ function stderrOf(error2) {
 }
 async function createWorktree(sourceCwd, worktreePath, branch) {
   try {
-    await execFile3("git", ["worktree", "add", "-b", branch, worktreePath], { cwd: sourceCwd });
+    await execFile3("git", [...SAFE_GIT_CONFIG, "worktree", "add", "-b", branch, worktreePath], {
+      cwd: sourceCwd
+    });
   } catch (error2) {
     const stderr = stderrOf(error2);
     if (stderr.includes("a branch named")) {
@@ -3331,7 +3582,9 @@ async function createWorktree(sourceCwd, worktreePath, branch) {
 }
 async function removeWorktree(sourceCwd, worktreePath) {
   try {
-    await execFile3("git", ["worktree", "remove", worktreePath], { cwd: sourceCwd });
+    await execFile3("git", [...SAFE_GIT_CONFIG, "worktree", "remove", worktreePath], {
+      cwd: sourceCwd
+    });
   } catch (error2) {
     const stderr = stderrOf(error2);
     if (stderr.includes("contains modified or untracked files")) {
@@ -3345,6 +3598,7 @@ async function removeWorktree(sourceCwd, worktreePath) {
 var LIVE_SESSION_REPORTS_FORMAT = "#{session_name}	#{@bondsmith-agent-state}	#{window_bell_flag}";
 var AGENT_STATE_OUTPUT_GRACE_MS = 2e3;
 var FUTURE_REPORT_ALLOWANCE_MS = 2e3;
+var WORKING_SILENCE_MS = 12e4;
 var SETTLED_STATES = /* @__PURE__ */ new Set(["waiting", "done"]);
 function isAgentState(value) {
   return AGENT_STATES.includes(value);
@@ -3366,6 +3620,10 @@ function resolveAgentState(raw, lastActivityAt, nowMs = Date.now()) {
   if (SETTLED_STATES.has(state) && lastActivityAt) {
     if (Date.parse(lastActivityAt) > reportedAtMs + AGENT_STATE_OUTPUT_GRACE_MS) return null;
   }
+  if (state === "working" && lastActivityAt) {
+    const quietSinceMs = Math.max(Date.parse(lastActivityAt), reportedAtMs);
+    if (nowMs - quietSinceMs > WORKING_SILENCE_MS) return null;
+  }
   return state;
 }
 function resolveSessionAttention(report, lastActivityAt, nowMs) {
@@ -3407,6 +3665,7 @@ async function createTmuxSession(input) {
   await runTmux(["new-session", "-d", "-s", tmuxSessionName, "-c", cwd, input.command], {
     env: filterSpawnEnv(process.env)
   });
+  await runTmux(["set-option", "-t", tmuxSessionName, "status", "off"]);
   await runTmux(["set-option", "-t", tmuxSessionName, "@bondsmith-id", input.id]);
   await runTmux(["set-option", "-t", tmuxSessionName, "@bondsmith-title", input.title]);
   await runTmux(["set-option", "-t", tmuxSessionName, "@bondsmith-command", input.command]);
@@ -3657,7 +3916,7 @@ function snapshotEquals(a, b) {
 }
 
 // src/ws/server.ts
-function createDaemonWebSocketServer(httpServer, config, daemonFingerprint, pendingAuthorizations, presentPendingAuthorization, trustedControllersPath) {
+function createDaemonWebSocketServer(httpServer, config, daemonFingerprint, pendingAuthorizations, presentPendingAuthorization, signDaemonProof, trustedControllersPath, unauthenticatedTimeoutMs = UNAUTHENTICATED_CONNECTION_TIMEOUT_MS) {
   const sessionManager = new SessionManager();
   const ptyAttachments = new PtyAttachmentManager();
   const connectionsByController = /* @__PURE__ */ new Map();
@@ -3714,7 +3973,9 @@ function createDaemonWebSocketServer(httpServer, config, daemonFingerprint, pend
   function broadcast(message) {
     const payload = JSON.stringify(message);
     for (const client of wss.clients) {
-      if (client.readyState === client.OPEN) client.send(payload);
+      if (client.readyState === client.OPEN && connectionAuthBySocket.get(client)?.canReceiveBroadcasts()) {
+        client.send(payload);
+      }
     }
   }
   sessionManager.onSessionUpdated((session) => {
@@ -3754,6 +4015,10 @@ function createDaemonWebSocketServer(httpServer, config, daemonFingerprint, pend
       protocolVersion: PROTOCOL_VERSION,
       daemonVersion: DAEMON_VERSION
     });
+    const unauthenticatedTimer = setTimeout(() => {
+      if (!connectionAuth.isAuthenticated()) socket.close();
+    }, unauthenticatedTimeoutMs);
+    unauthenticatedTimer.unref();
     socket.on("message", (raw) => {
       let parsed;
       try {
@@ -3774,7 +4039,10 @@ function createDaemonWebSocketServer(httpServer, config, daemonFingerprint, pend
         daemonFingerprint,
         pendingAuthorizations,
         presentPendingAuthorization,
+        signDaemonProof,
         trustedControllersPath
+      }).then(() => {
+        if (connectionAuth.hasExhaustedHandshakeAttempts()) socket.close();
       }).catch((err) => {
         console.error("Unhandled error in handleBrowserMessage", err);
         conn.send({
@@ -3784,6 +4052,7 @@ function createDaemonWebSocketServer(httpServer, config, daemonFingerprint, pend
       });
     });
     socket.on("close", () => {
+      clearTimeout(unauthenticatedTimer);
       releaseAllSubscriptions();
       cleanupBySocket.delete(socket);
       connectionAuthBySocket.delete(socket);
@@ -3825,6 +4094,7 @@ async function start() {
   }
   const identity = await loadOrCreateDaemonIdentity();
   const daemonFingerprint = await formatDaemonFingerprint(identity.publicKeyPem);
+  const signDaemonProof = createDaemonProofSigner(identity.privateKeyPem);
   const pendingAuthorizations = new PendingAuthorizationStore();
   const presentPendingAuthorization = presentPendingAuthorizationOnTerminal(pendingAuthorizations);
   await ensurePaired({
@@ -3854,11 +4124,13 @@ async function start() {
     config,
     daemonFingerprint,
     pendingAuthorizations,
-    presentPendingAuthorization
+    presentPendingAuthorization,
+    signDaemonProof
   );
   await sessionManager.initialize();
   const relayClient = config.relayEnabled ? startRelayClient({
     relayUrl: config.relayUrl,
+    expectedRelayAudience: config.expectedRelayAudience,
     daemonFingerprint,
     daemonPublicKeyPem: identity.publicKeyPem,
     daemonPrivateKeyPem: identity.privateKeyPem,
@@ -3870,7 +4142,8 @@ async function start() {
     validateProjectPath,
     hostname: hostname2,
     pendingAuthorizations,
-    presentPendingAuthorization
+    presentPendingAuthorization,
+    signDaemonProof
   }) : void 0;
   if (relayClient) {
     sessionManager.onSessionUpdated((session) => {