@cueloop/daemon 0.1.0-alpha.63 → 0.1.0-alpha.65

package/src/diff-watcher.ts

@@ -64,10 +64,7 @@ export class DiffWatcher {
     }
     // a watcher error (the root is deleted mid-review) must not take down the
     // daemon; the inherited EventEmitter `on` is absent from Bun's FSWatcher type
-    (handle as FSWatcher & { on(event: "error", listener: (error: Error) => void): void }).on(
-      "error",
-      () => {},
-    );
+    handle.on("error", () => {});
     this.repoWatches.set(repoRoot, { handle, sessionIds: new Set([sessionId]), debounce: null });
   }
 

package/src/herdr-pane.test.ts

@@ -16,7 +16,7 @@ const dir = mkdtempSync(join(tmpdir(), "cueloop-herdr-pane-"));
  * pane_id and tab_id (herdr 0.8.2 shape), and answers `pane get` alive or dead
  * per `paneAlive` so the liveness branch can be exercised.
  */
-function makeStub(name: string, paneAlive = false): { binPath: string; logPath: string } {
+function makeStub(name: string, paneAlive = false) {
   const logPath = join(dir, `${name}.log`);
   const binPath = join(dir, `${name}.sh`);
   const paneGet = paneAlive ? `printf '{"result":{"pane":{"pane_id":"w1:p2"}}}'` : "exit 1";
@@ -44,16 +44,13 @@ function readLines(logPath: string): string[] {
 }
 
 /** In-memory persistence double: records what openHerdrPaneForReview saves. */
-function fakePersistence(initial: HerdrTabHandle | null = null): {
-  persistence: HerdrTabPersistence;
-  saved: () => HerdrTabHandle | null;
-} {
+function fakePersistence(initial: HerdrTabHandle | null = null) {
   let stored = initial;
 
   return {
     persistence: {
       herdrGetTab: async () => stored,
-      herdrSetTab: async (_sessionId, handle) => {
+      herdrSetTab: async (_sessionId: string, handle: HerdrTabHandle) => {
         stored = handle;
       },
     },
@@ -199,7 +196,7 @@ describe("openHerdrPaneForReview", () => {
   });
 
   test("a recall failure (stale daemon) still opens a fresh tab", async () => {
-    // Arrange - a daemon predating the herdr-tab verbs rejects the recall
+    // Arrange - a daemon predating the herdr-tab primitives rejects the recall
     const stub = makeStub("gated-recall-fail");
     const env = { HERDR_ENV: "1", HERDR_PANE_ID: "w1:p1", HERDR_BIN_PATH: stub.binPath };
     const persistence: HerdrTabPersistence = {

package/src/herdr-pane.ts

@@ -7,9 +7,22 @@
  */
 
 import { detectHerdr, type HerdrEnv, type ReviewSession } from "@cueloop/schema";
+import * as v from "valibot";
 import type { HerdrTabHandle } from "./herdr-tab-store";
 
 const HERDR_SPAWN_TIMEOUT_MS = 2000;
+const CreatedTabSchema = v.object({
+  result: v.optional(
+    v.object({
+      root_pane: v.optional(
+        v.object({ pane_id: v.optional(v.string()), tab_id: v.optional(v.string()) }),
+      ),
+    }),
+  ),
+});
+const PaneResultSchema = v.object({
+  result: v.optional(v.object({ pane: v.optional(v.unknown()) })),
+});
 
 export interface OpenHerdrPaneOptions {
   sessionId: string;
@@ -40,11 +53,11 @@ export function openHerdrPane(options: OpenHerdrPaneOptions): HerdrTabHandle | n
     );
 
     if (created.exitCode !== 0) return null;
-    const parsed = JSON.parse(created.stdout.toString()) as {
-      result?: { root_pane?: { pane_id?: string; tab_id?: string } };
-    };
-    const paneId = parsed.result?.root_pane?.pane_id;
-    const tabId = parsed.result?.root_pane?.tab_id;
+    const parsed = v.safeParse(CreatedTabSchema, JSON.parse(created.stdout.toString()));
+
+    if (!parsed.success) return null;
+    const paneId = parsed.output.result?.root_pane?.pane_id;
+    const tabId = parsed.output.result?.root_pane?.tab_id;
 
     if (!paneId || !tabId) return null;
     // A fresh tab hosts a plain shell, so the review is typed in like a human.
@@ -77,9 +90,9 @@ function herdrPaneAlive(binPath: string, paneId: string): boolean {
     });
 
     if (got.exitCode !== 0) return false;
-    const parsed = JSON.parse(got.stdout.toString()) as { result?: { pane?: unknown } };
+    const parsed = v.safeParse(PaneResultSchema, JSON.parse(got.stdout.toString()));
 
-    return parsed.result?.pane != null;
+    return parsed.success && parsed.output.result?.pane != null;
   } catch {
     return false;
   }

package/src/herdr-split.test.ts

@@ -9,7 +9,7 @@ import { launchHarnessInSplit } from "./herdr-split";
 const dir = mkdtempSync(join(tmpdir(), "cueloop-herdr-split-"));
 
 /** A stub herdr binary that logs argv and prints the pane-split result (pane_id of the new split). */
-function makeStub(name: string, splitOk = true): { binPath: string; logPath: string } {
+function makeStub(name: string, splitOk = true) {
   const logPath = join(dir, `${name}.log`);
   const binPath = join(dir, `${name}.sh`);
   const splitResult = splitOk

package/src/herdr-split.ts

@@ -7,8 +7,12 @@
  */
 
 import { detectHerdr, type HerdrEnv } from "@cueloop/schema";
+import * as v from "valibot";
 
 const HERDR_SPAWN_TIMEOUT_MS = 2000;
+const SplitPaneSchema = v.object({
+  result: v.optional(v.object({ pane: v.optional(v.object({ pane_id: v.optional(v.string()) })) })),
+});
 
 /** How much of the current pane the launched harness split takes (herdr --ratio). */
 const HARNESS_SPLIT_RATIO = "0.4";
@@ -55,10 +59,10 @@ export function launchHarnessInSplit(
     );
 
     if (split.exitCode !== 0) return false;
-    const parsed = JSON.parse(split.stdout.toString()) as {
-      result?: { pane?: { pane_id?: string } };
-    };
-    const paneId = parsed.result?.pane?.pane_id;
+    const parsed = v.safeParse(SplitPaneSchema, JSON.parse(split.stdout.toString()));
+
+    if (!parsed.success) return false;
+    const paneId = parsed.output.result?.pane?.pane_id;
 
     if (!paneId) return false;
     sendText(herdr.binPath, paneId, options.command);

package/src/herdr-tab-store.ts

@@ -6,6 +6,7 @@
  */
 
 import { readFileSync, renameSync, writeFileSync } from "node:fs";
+import * as v from "valibot";
 import { herdrTabsPath } from "./paths";
 
 /** The tab and its root pane: pane id checks liveness, tab id focuses it. */
@@ -14,15 +15,11 @@ export interface HerdrTabHandle {
   paneId: string;
 }
 
-/** Guard a persisted entry - both ids must be present strings, or it is dropped. */
-function isHerdrTabHandle(value: unknown): value is HerdrTabHandle {
-  return (
-    typeof value === "object" &&
-    value !== null &&
-    typeof (value as HerdrTabHandle).tabId === "string" &&
-    typeof (value as HerdrTabHandle).paneId === "string"
-  );
-}
+const HerdrTabHandleSchema = v.object({
+  tabId: v.string(),
+  paneId: v.string(),
+});
+const HerdrTabsSchema = v.record(v.string(), v.unknown());
 
 export class HerdrTabStore {
   private tabs = new Map<string, HerdrTabHandle>();
@@ -35,12 +32,12 @@ export class HerdrTabStore {
 
   private load(): void {
     try {
-      const parsed: unknown = JSON.parse(readFileSync(this.path, "utf8"));
+      const parsed = v.parse(HerdrTabsSchema, JSON.parse(readFileSync(this.path, "utf8")));
 
-      if (typeof parsed !== "object" || parsed === null) return;
       for (const [sessionId, value] of Object.entries(parsed)) {
-        if (isHerdrTabHandle(value))
-          this.tabs.set(sessionId, { tabId: value.tabId, paneId: value.paneId });
+        const handle = v.safeParse(HerdrTabHandleSchema, value);
+
+        if (handle.success) this.tabs.set(sessionId, handle.output);
       }
     } catch {
       // absent, unreadable, or malformed: start empty - a stale tab just reopens on resubmit

package/src/paths.ts

@@ -30,6 +30,11 @@ export function lockPath(home = cueloopHome()): string {
   return join(home, "cueloop.lock");
 }
 
+/** The secret a connection presents to be the owner; written by the daemon, mode 0600. */
+export function ownerTokenPath(home = cueloopHome()): string {
+  return join(home, "owner.token");
+}
+
 /** Adapter scratch: herdr tab handles keyed by session id, kept out of the core session record. */
 export function herdrTabsPath(home = cueloopHome()): string {
   return join(home, "herdr-tabs.json");

package/src/protocol.ts

@@ -4,6 +4,8 @@
  * Events (push, after events.subscribe): { event, sessionId }
  */
 
+import * as v from "valibot";
+
 export interface Request {
   id: number;
   method: string;
@@ -19,10 +21,36 @@ export interface Response {
 export interface EventFrame {
   event: string;
   sessionId: string;
+  /** The history entry the change appended, when it appended one. */
+  entryId?: string;
 }
 
 export type Frame = Response | EventFrame;
 
+const RequestSchema = v.object({
+  id: v.number(),
+  method: v.string(),
+  params: v.optional(v.unknown()),
+});
+const ResponseSchema = v.object({
+  id: v.number(),
+  result: v.optional(v.unknown()),
+  error: v.optional(v.object({ code: v.string(), message: v.string() })),
+});
+const EventFrameSchema = v.object({
+  event: v.string(),
+  sessionId: v.string(),
+  entryId: v.optional(v.string()),
+});
+
+export function parseRequestFrame(line: string): Request {
+  return v.parse(RequestSchema, JSON.parse(line));
+}
+
+export function parseInboundFrame(line: string): Frame {
+  return v.parse(v.union([ResponseSchema, EventFrameSchema]), JSON.parse(line));
+}
+
 /** Incremental NDJSON splitter; tolerates partial writes. */
 export class LineBuffer {
   private buffered = "";

package/src/retention.test.ts

@@ -48,7 +48,7 @@ describe("resolveCleanupPeriodDays", () => {
     const missing = join(tempDir("cueloop-retention-"), "config.toml");
 
     // Act
-    const days = resolveCleanupPeriodDays({ CUELOOP_CONFIG: missing } as NodeJS.ProcessEnv);
+    const days = resolveCleanupPeriodDays({ CUELOOP_CONFIG: missing });
 
     // Assert
     expect(days).toBe(DEFAULT_CLEANUP_PERIOD_DAYS);
@@ -61,7 +61,7 @@ describe("resolveCleanupPeriodDays", () => {
     writeFileSync(path, "[cleanup]\nperiod_days = 7\n");
 
     // Act
-    const days = resolveCleanupPeriodDays({ CUELOOP_CONFIG: path } as NodeJS.ProcessEnv);
+    const days = resolveCleanupPeriodDays({ CUELOOP_CONFIG: path });
 
     // Assert
     expect(days).toBe(7);
@@ -74,7 +74,7 @@ describe("resolveCleanupPeriodDays", () => {
     writeFileSync(path, '[cleanup]\nperiod_days = "soon"\n');
 
     // Act
-    const days = resolveCleanupPeriodDays({ CUELOOP_CONFIG: path } as NodeJS.ProcessEnv);
+    const days = resolveCleanupPeriodDays({ CUELOOP_CONFIG: path });
 
     // Assert
     expect(days).toBe(DEFAULT_CLEANUP_PERIOD_DAYS);

package/src/retention.ts

@@ -20,7 +20,7 @@ const RefineStateSchema = v.object({
 
 export type RefineState = v.InferOutput<typeof RefineStateSchema>;
 
-export function parseRefineState(raw: unknown): Map<string, string> {
+export function parseRefineState(raw: Parameters<typeof v.safeParse>[1]): Map<string, string> {
   const parsed = v.safeParse(RefineStateSchema, raw);
 
   if (!parsed.success) return new Map();

package/src/review.ts

@@ -18,7 +18,7 @@ import {
 import { verdictResponse } from "./api";
 import type { DaemonClient } from "./client";
 
-// Adapters and CLI verbs reach the verdict mapping through this module too,
+// Adapters and CLI primitives reach the verdict mapping through this module too,
 // so a session obtained outside a ReviewHandle maps the same way.
 export { verdictResponse };
 

package/src/server.test.ts

@@ -1,7 +1,8 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { mkdtempSync, rmSync } from "node:fs";
+import { existsSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import * as v from "valibot";
 import { DaemonServer } from "./server";
 import { DaemonClient, DaemonClientError } from "./client";
 import type { Artifact, WorkspaceKey } from "@cueloop/schema";
@@ -54,12 +55,8 @@ describe("socket round-trip", () => {
   });
 
   test("errors carry codes across the wire", async () => {
-    expect(client.sessionGet("nope")).rejects.toBeInstanceOf(DaemonClientError);
-    try {
-      await client.sessionGet("nope");
-    } catch (error) {
-      expect((error as DaemonClientError).code).toBe("not_found");
-    }
+    await expect(client.sessionGet("nope")).rejects.toBeInstanceOf(DaemonClientError);
+    await expect(client.sessionGet("nope")).rejects.toHaveProperty("code", "not_found");
   });
 
   test("events push to subscribed connections only", async () => {
@@ -83,40 +80,103 @@ describe("socket round-trip", () => {
     observer.close();
   });
 
+  test("an event names the history entry its change appended", async () => {
+    // Arrange
+    const observer = await DaemonClient.connect({ home });
+    const frames: Array<{ event: string; entryId?: string }> = [];
+
+    observer.onEvent((event) => frames.push(event));
+    await observer.subscribe();
+    const session = await client.sessionCreate(WS, PLAN);
+
+    // Act
+    const annotated = await client.sessionAnnotate(session.id, {
+      id: "a_evt",
+      kind: "comment",
+      anchor: { quote: "Plan", prefix: "", suffix: "" },
+      body: "hello",
+    });
+
+    await Bun.sleep(50);
+
+    // Assert: the update frame carries the comment entry's id
+    const updated = frames.find((frame) => frame.event === "session.updated");
+
+    expect(updated?.entryId).toBe(annotated.history!.entries.at(-1)!.id);
+    observer.close();
+  });
+
+  test("a non-owner removes only the comments of the author it acts as, and names itself", async () => {
+    // Arrange: the owner's and Ana's comments; an agent connection acting as Ana
+    const session = await client.sessionCreate(WS, PLAN);
+
+    await client.sessionAnnotate(session.id, {
+      id: "own",
+      kind: "comment",
+      anchor: { quote: "Plan", prefix: "", suffix: "" },
+      body: "mine",
+    });
+    await client.sessionAnnotate(session.id, {
+      id: "anas",
+      kind: "comment",
+      anchor: { quote: "Plan", prefix: "", suffix: "" },
+      body: "hers",
+      author: "SHA256:ana",
+    });
+    const anonymous = await DaemonClient.connect({ home, role: "agent" });
+    const agent = await DaemonClient.connect({ home, role: "agent", author: "SHA256:ana" });
+
+    // Act + Assert: an unbound connection removes nothing; a bound one never another author's
+    await expect(anonymous.sessionRemoveAnnotation(session.id, "own")).rejects.toHaveProperty(
+      "code",
+      "forbidden",
+    );
+    await expect(agent.sessionRemoveAnnotation(session.id, "own")).rejects.toHaveProperty(
+      "code",
+      "forbidden",
+    );
+    await expect(
+      agent.sessionSetParticipantName(session.id, "SHA256:bob", "Not Bob"),
+    ).rejects.toHaveProperty("code", "forbidden");
+
+    // Act: her own comment goes, and she names herself
+    const removed = await agent.sessionRemoveAnnotation(session.id, "anas");
+    const named = await agent.sessionSetParticipantName(session.id, "SHA256:ana", "Ana");
+
+    // Assert
+    expect(removed.annotations.map((annotation) => annotation.id)).toEqual(["own"]);
+    expect(removed.history!.entries.at(-1)).toMatchObject({
+      type: "comment-removed",
+      annotationId: "anas",
+    });
+    expect(named.participants).toContainEqual({ id: "SHA256:ana", provider: "ssh", name: "Ana" });
+    anonymous.close();
+    agent.close();
+  });
+
   test("malformed requests get structured errors and never wedge the daemon", async () => {
     // missing required params
-    try {
-      await client.request("session.create", { artifact: { type: "plan", content: "x" } });
-      throw new Error("should have thrown");
-    } catch (error) {
-      expect((error as DaemonClientError).code).toBe("invalid_params");
-    }
+    await expect(
+      client.request("session.create", { artifact: { type: "plan", content: "x" } }, v.object({})),
+    ).rejects.toHaveProperty("code", "invalid_params");
     // wrong types
-    try {
-      await client.request("session.wait", { id: 42 });
-      throw new Error("should have thrown");
-    } catch (error) {
-      expect((error as DaemonClientError).code).toBe("invalid_params");
-    }
+    await expect(client.request("session.wait", { id: 42 }, v.object({}))).rejects.toHaveProperty(
+      "code",
+      "invalid_params",
+    );
     // unknown method
-    try {
-      await client.request("session.nuke", {});
-      throw new Error("should have thrown");
-    } catch (error) {
-      expect((error as DaemonClientError).code).toBe("unknown_method");
-    }
-    const prototypeMethods = await Promise.allSettled([
-      client.request("__proto__", {}),
-      client.request("toString", {}),
-      client.request("constructor", {}),
-    ]);
-
-    for (const result of prototypeMethods) {
-      expect(result.status).toBe("rejected");
-      expect(((result as PromiseRejectedResult).reason as DaemonClientError).code).toBe(
-        "unknown_method",
-      );
-    }
+    await expect(client.request("session.nuke", {}, v.object({}))).rejects.toHaveProperty(
+      "code",
+      "unknown_method",
+    );
+    await Promise.all(
+      ["__proto__", "toString", "constructor"].map((method) =>
+        expect(client.request(method, {}, v.object({}))).rejects.toHaveProperty(
+          "code",
+          "unknown_method",
+        ),
+      ),
+    );
     // the daemon is still fully alive afterwards
     const session = await client.sessionCreate(WS, PLAN);
 
@@ -137,7 +197,7 @@ describe("socket round-trip", () => {
     expect(got.artifact.meta.agent).toBe("claude-code");
   });
 
-  test("share-sync verbs round-trip: setShareId persists, mergeShared unions notes and identities by id", async () => {
+  test("share-sync primitives round-trip: setShareId persists, mergeShared unions notes and identities by id", async () => {
     // Given a shared session with one local note
     const session = await client.sessionCreate(WS, PLAN);
     const anchor = { quote: "Body text", prefix: "", suffix: "." };
@@ -181,15 +241,11 @@ describe("socket round-trip", () => {
     // Given a session
     const session = await client.sessionCreate(WS, PLAN);
 
-    try {
-      // When a malformed annotation is merged
-      // @ts-expect-error intentionally malformed annotation (empty id, missing fields)
-      await client.sessionMergeShared(session.id, { annotations: [{ id: "" }] });
-      throw new Error("should have thrown");
-    } catch (error) {
-      // Then it is rejected at the wire boundary
-      expect((error as DaemonClientError).code).toBe("invalid_params");
-    }
+    // When a malformed annotation is merged, it is rejected at the wire boundary
+    // @ts-expect-error intentionally malformed annotation (empty id, missing fields)
+    const merge = client.sessionMergeShared(session.id, { annotations: [{ id: "" }] });
+
+    await expect(merge).rejects.toHaveProperty("code", "invalid_params");
   });
 
   test("session.delete removes a session over the wire", async () => {
@@ -200,13 +256,8 @@ describe("socket round-trip", () => {
     await client.sessionDelete(session.id);
 
     // Then it is gone, and deleting an unknown id is a not_found error
-    expect(client.sessionGet(session.id)).rejects.toBeInstanceOf(DaemonClientError);
-    try {
-      await client.sessionDelete("ses_missing");
-      throw new Error("should have thrown");
-    } catch (error) {
-      expect((error as DaemonClientError).code).toBe("not_found");
-    }
+    await expect(client.sessionGet(session.id)).rejects.toBeInstanceOf(DaemonClientError);
+    await expect(client.sessionDelete("ses_missing")).rejects.toHaveProperty("code", "not_found");
   });
 
   test("two clients see the same state (thin-renderer model)", async () => {
@@ -223,6 +274,159 @@ describe("socket round-trip", () => {
   });
 });
 
+describe("ownership is proven, never declared", () => {
+  /** A wire frame as the daemon answers it: a result or a coded error. */
+  interface WireReply {
+    result?: unknown;
+    error?: { code: string };
+  }
+
+  /** The request body a bare socket sends: the primitive's params as the wire carries them. */
+  type WireParams = Parameters<typeof JSON.stringify>[0];
+
+  interface RawConnection {
+    call: (method: string, params: WireParams) => Promise<WireReply>;
+    close: () => void;
+  }
+
+  /** A bare socket that speaks the wire protocol without the client's handshake. */
+  async function rawConnection(): Promise<RawConnection> {
+    const pending = new Map<number, (frame: WireReply) => void>();
+    let buffered = "";
+    let nextId = 1;
+    const socket = await Bun.connect({
+      unix: join(home, "cueloop.sock"),
+      socket: {
+        data: (_socket, data) => {
+          buffered += data.toString();
+          const lines = buffered.split("\n");
+
+          buffered = lines.pop() ?? "";
+          for (const line of lines) {
+            const frame = JSON.parse(line);
+
+            if ("id" in frame) pending.get(frame.id)?.(frame);
+          }
+        },
+      },
+    });
+
+    return {
+      call: (method, params) =>
+        new Promise((resolve) => {
+          const id = nextId++;
+
+          pending.set(id, resolve);
+          socket.write(JSON.stringify({ id, method, params }) + "\n");
+        }),
+      close: () => socket.end(),
+    };
+  }
+
+  test("a connection that never proves ownership is a collaborator: it reads and comments, nothing more", async () => {
+    // Arrange
+    const session = await client.sessionCreate(WS, PLAN);
+    const raw = await rawConnection();
+
+    // Act + Assert
+    expect((await raw.call("session.get", { id: session.id })).error).toBeUndefined();
+    expect(
+      (
+        await raw.call("session.annotate", {
+          id: session.id,
+          annotation: {
+            id: "a_raw",
+            kind: "comment",
+            anchor: { quote: "Plan", prefix: "", suffix: "" },
+            body: "from a bare socket",
+          },
+        })
+      ).error,
+    ).toBeUndefined();
+    expect(
+      (await raw.call("session.resolve", { id: session.id, verdictKind: "approve", summary: "" }))
+        .error?.code,
+    ).toBe("forbidden");
+    expect((await raw.call("session.delete", { id: session.id })).error?.code).toBe("forbidden");
+    raw.close();
+  });
+
+  test("claiming ownership without the token is refused; the token grants it", async () => {
+    // Arrange
+    const raw = await rawConnection();
+
+    // Act + Assert: a bare claim, then a wrong token, both refused
+    expect((await raw.call("daemon.hello", { role: "owner" })).error?.code).toBe("forbidden");
+    expect((await raw.call("daemon.hello", { role: "owner", token: "nope" })).error?.code).toBe(
+      "forbidden",
+    );
+    expect((await raw.call("daemon.shutdown", {})).error?.code).toBe("forbidden");
+
+    // Act: the token the daemon wrote into its home
+    const token = readFileSync(join(home, "owner.token"), "utf8").trim();
+
+    expect((await raw.call("daemon.hello", { role: "owner", token })).error).toBeUndefined();
+
+    // Assert: owner primitives open up
+    const created = await raw.call("session.create", { workspace: WS, artifact: PLAN });
+
+    expect(created.error).toBeUndefined();
+    raw.close();
+  });
+
+  test("a refused handshake reaches the caller and leaves the live daemon's socket alone", async () => {
+    // Arrange: a token file that is not what the daemon minted
+    const tokenPath = join(home, "owner.token");
+    const minted = readFileSync(tokenPath, "utf8");
+
+    writeFileSync(tokenPath, "0".repeat(64));
+
+    // Act + Assert: the client hears the refusal; autostart does not replace the daemon
+    await expect(DaemonClient.connect({ home, autostart: true })).rejects.toHaveProperty(
+      "code",
+      "forbidden",
+    );
+    expect(existsSync(join(home, "cueloop.sock"))).toBe(true);
+    expect((await client.sessionList()).length).toBe(0);
+
+    // Arrange: a token file that is not a token at all
+    writeFileSync(tokenPath, "not-a-token");
+
+    // Act + Assert
+    await expect(DaemonClient.connect({ home })).rejects.toHaveProperty(
+      "code",
+      "invalid_owner_token",
+    );
+    writeFileSync(tokenPath, minted);
+  });
+
+  test("the token exists before the socket does", () => {
+    // Arrange: a second daemon in another home
+    const other = mkdtempSync(join(tmpdir(), "cueloop-token-"));
+    const daemon = new DaemonServer({ home: other, idleExitMs: 0 });
+
+    try {
+      // Act
+      daemon.start();
+
+      // Assert: the token is on disk the moment the socket is
+      expect(existsSync(join(other, "owner.token"))).toBe(true);
+      expect(existsSync(join(other, "cueloop.sock"))).toBe(true);
+    } finally {
+      daemon.stop();
+      rmSync(other, { recursive: true, force: true });
+    }
+  });
+
+  test("the daemon client proves ownership on connect and the token is private to the home", async () => {
+    // Assert: the client in beforeEach connected as the owner through the token
+    const session = await client.sessionCreate(WS, PLAN);
+
+    expect((await client.sessionResolve(session.id, "approve", "")).status).toBe("resolved");
+    expect(statSync(join(home, "owner.token")).mode & 0o777).toBe(0o600);
+  });
+});
+
 describe("large payloads survive socket backpressure", () => {
   test("a session bigger than the kernel socket buffer round-trips", async () => {
     // Regression: responses larger than one socket write used to truncate