@yolo-labs/yolobridge 0.2.0 → 0.8.0

package/dist/cli.js

@@ -18,6 +18,7 @@
  */
 import { fileURLToPath } from 'node:url';
 import { realpathSync } from 'node:fs';
+import { hostname } from 'node:os';
 import { runLogin } from './login-cmd.js';
 import { runAttachFromDisk, pickWorkspaceFromDisk } from './attach-cmd.js';
 import { runDetach } from './detach-cmd.js';
@@ -93,6 +94,10 @@ function printHelp() {
         '    [--agent-id <id>]    Registry identity for local MCP access, if different from --agent',
         '                         (e.g. a raw executable path, or an agent whose binary name differs',
         '                         from its registry id like qwen-code/qwen). Defaults to --agent.',
+        '    [--fresh]            Always create a NEW attachment and tile. By default an attach that',
+        '                         finds a still-live attachment for this workspace on this machine',
+        '                         RESUMES it (same tile) instead of adding a duplicate; --fresh skips',
+        '                         that check entirely.',
         '  detach                 Detach the current workspace attachment.',
         '  status                 Print local login/attach state.',
         '  --help                 Print this help.',
@@ -138,8 +143,16 @@ export function parseAttachArgs(args) {
     let hostLabel;
     let agentBin;
     let agentId;
+    let fresh = false;
     for (let i = 0; i < args.length; i++) {
         const a = args[i];
+        // Boolean — handled before the value-taking flags so it never swallows
+        // the following argument (`attach --fresh w1` must still see `w1` as the
+        // positional workspace id).
+        if (a === '--fresh') {
+            fresh = true;
+            continue;
+        }
         if (a === '--label' || a === '--agent' || a === '--agent-id') {
             const value = args[i + 1];
             if (value === undefined || value.startsWith('--')) {
@@ -161,7 +174,41 @@ export function parseAttachArgs(args) {
             workspaceId = a;
         }
     }
-    return { workspaceId, hostLabel, agentBin, agentId };
+    return { workspaceId, hostLabel, agentBin, agentId, fresh };
+}
+/**
+ * Everything the attach handshake tells the workspace about this machine,
+ * resolved from already-known values — pure, so it's unit-testable without
+ * touching a real `os`/`process` (the caller passes the real ones in).
+ *
+ * Two things happen here:
+ *
+ *  - **`hostLabel` gains a default.** It was previously set ONLY by an
+ *    explicit `--label`, so the overwhelmingly common `yolo-bridge attach`
+ *    with no flags produced a tile named a bare "YoloBridge" with nothing
+ *    identifying WHICH machine had attached — actively confusing for an
+ *    operator running a daemon on more than one. The machine's own hostname
+ *    is the obvious default and is already what `--label` is usually set to
+ *    by hand. An explicit `--label` still wins.
+ *  - **`remoteHost` is assembled**: the launch directory, the OS platform
+ *    string, and which agent binary this attach drives.
+ *
+ * What is deliberately NOT collected, and should not be added without its
+ * own consent story: environment variables, anything listing the contents
+ * of `cwd`, the OS username or any other account identity, network
+ * addresses, or installed-software inventory. This is the operator's own
+ * machine being described back to the operator; it is not a survey of it.
+ */
+export function resolveAttachHostInfo(input) {
+    const label = input.label?.trim();
+    return {
+        hostLabel: label || input.hostname.trim() || undefined,
+        remoteHost: {
+            cwd: input.cwd,
+            platform: input.platform,
+            agent: input.agent,
+        },
+    };
 }
 async function cmdAttach(args) {
     // Printed unconditionally, first thing, regardless of how the rest of
@@ -175,7 +222,7 @@ async function cmdAttach(args) {
     const parsed = parseAttachArgs(args);
     if ('error' in parsed) {
         process.stderr.write(`yolo-bridge attach: ${parsed.error}\n`);
-        process.stderr.write('Usage: yolo-bridge attach [workspaceId] [--label <name>] [--agent <binary>] [--agent-id <registryId>]\n');
+        process.stderr.write('Usage: yolo-bridge attach [workspaceId] [--label <name>] [--agent <binary>] [--agent-id <registryId>] [--fresh]\n');
         return 64;
     }
     let workspaceId = parsed.workspaceId;
@@ -187,6 +234,7 @@ async function cmdAttach(args) {
     // match, which is every built-in agent this daemon has been used with so
     // far (claude, codex).
     const resolvedAgentId = parsed.agentId ?? agentBin ?? DEFAULT_AGENT_BIN;
+    const fresh = parsed.fresh === true;
     if (workspaceId) {
         const resolved = await resolveWorkspaceIdOrName(workspaceId, { commonApiBaseUrl: apiUrl() });
         if (!resolved.ok) {
@@ -215,7 +263,7 @@ async function cmdAttach(args) {
                     process.stderr.write(`yolo-bridge attach: ${pick.message}\n`);
                     break;
             }
-            process.stderr.write('Usage: yolo-bridge attach [workspaceId] [--label <name>] [--agent <binary>] [--agent-id <registryId>]\n');
+            process.stderr.write('Usage: yolo-bridge attach [workspaceId] [--label <name>] [--agent <binary>] [--agent-id <registryId>] [--fresh]\n');
             return 64;
         }
         workspaceId = pick.workspaceId;
@@ -231,6 +279,16 @@ async function cmdAttach(args) {
     process.on('SIGINT', onSignal);
     process.on('SIGTERM', onSignal);
     const spawnCwd = process.cwd();
+    // Everything the workspace tile shows about WHERE this session runs, all
+    // resolved here in one place (see resolveAttachHostInfo's doc comment for
+    // what is and isn't collected).
+    const attachHostInfo = resolveAttachHostInfo({
+        label: hostLabel,
+        hostname: hostname(),
+        cwd: spawnCwd,
+        platform: process.platform,
+        agent: resolvedAgentId,
+    });
     let mcpProxyHandle;
     let mcpConfigCleanup;
     let mcpTrustRemoval;
@@ -239,7 +297,9 @@ async function cmdAttach(args) {
         result = await runAttachFromDisk({
             workspaceId,
             commonApiBaseUrl: apiUrl(),
-            hostLabel,
+            hostLabel: attachHostInfo.hostLabel,
+            remoteHost: attachHostInfo.remoteHost,
+            fresh,
             shouldStop: () => stopRequested,
             // Fires once the real tileId exists (docs/YOLOBRIDGE_PLAN.md's "Local
             // MCP access" section) — starts the local MCP proxy and writes
@@ -248,7 +308,7 @@ async function cmdAttach(args) {
             // skipped, not fatal — MCP access is an enhancement on a tile that
             // already works without it (send_to_tile/read_tile_output are
             // unaffected either way).
-            onAttached: async ({ getAccessToken, clearScreen }) => {
+            onAttached: async ({ tileId, getAccessToken, clearScreen }) => {
                 // Isolated from `startLocalAgent` below on purpose (Codex review,
                 // 2026-08-24): `startMcpProxy` itself never throws, but
                 // `writeLocalMcpConfig`/`writeLocalMcpTrust` do plain synchronous
@@ -266,6 +326,11 @@ async function cmdAttach(args) {
                         getAccessToken,
                         workspaceId,
                         agentId: resolvedAgentId,
+                        // Self-identity for the spawned agent: the tile it is running in.
+                        // Without it, an agent asked to message "the other tile" has to
+                        // guess which studio_list_tiles row is itself — and a backwards
+                        // guess sends the prompt into its OWN input.
+                        callerTileId: tileId,
                         log: (line) => process.stdout.write(`${line}\n`),
                     });
                     // `.mcp.json` + `.claude/settings.json` are Claude Code-specific

package/dist/config-store.js

@@ -56,10 +56,21 @@ export function loadAuth(env = process.env, io = defaultIO) {
     try {
         const parsed = JSON.parse(raw);
         if (typeof parsed.accessToken === 'string' &&
-            typeof parsed.refreshToken === 'string' &&
+            // Absent is VALID (the scoped path deliberately drops it); present must
+            // still be a string. A malformed value is treated as absent rather than
+            // as a corrupt file: the access token half is what this record is for,
+            // and refusing to load it would log the operator out over a field the
+            // daemon may not even need.
+            (parsed.refreshToken === undefined || typeof parsed.refreshToken === 'string') &&
             typeof parsed.tokenType === 'string' &&
             typeof parsed.expiresAtMs === 'number') {
-            return parsed;
+            const { accessToken, refreshToken, tokenType, expiresAtMs } = parsed;
+            return {
+                accessToken,
+                tokenType,
+                expiresAtMs,
+                ...(refreshToken ? { refreshToken } : {}),
+            };
         }
         return undefined;
     }
@@ -67,8 +78,24 @@ export function loadAuth(env = process.env, io = defaultIO) {
         return undefined;
     }
 }
+/**
+ * Writes `auth.json`. A missing (or empty) `refreshToken` is written out as an
+ * ABSENT KEY, never as `""`.
+ *
+ * Normalised here rather than left to callers on purpose: an empty string is a
+ * value that every `typeof x === 'string'` check downstream accepts, so it
+ * would sail through the loader and be handed to auth-service's refresh
+ * endpoint as a credential, turning "we deliberately dropped this" into an
+ * unexplained 401. Absent is the honest encoding of absent.
+ */
 export function saveAuth(auth, env = process.env, io = defaultIO) {
-    io.writeFile(authPath(env), `${JSON.stringify(auth, null, 2)}\n`);
+    const record = {
+        accessToken: auth.accessToken,
+        ...(auth.refreshToken ? { refreshToken: auth.refreshToken } : {}),
+        tokenType: auth.tokenType,
+        expiresAtMs: auth.expiresAtMs,
+    };
+    io.writeFile(authPath(env), `${JSON.stringify(record, null, 2)}\n`);
 }
 export function clearAuth(env = process.env, io = defaultIO) {
     io.removeFile(authPath(env));
@@ -83,7 +110,15 @@ export function loadAttachment(env = process.env, io = defaultIO) {
             typeof parsed.tileId === 'string' &&
             typeof parsed.attachmentId === 'string' &&
             typeof parsed.attachedAt === 'string') {
-            return parsed;
+            const { workspaceId, tileId, attachmentId, attachedAt } = parsed;
+            // Both-or-neither. A half-pair is dropped rather than rejecting the whole
+            // record: the attachment IDENTITY is still perfectly good (detach and the
+            // status display need only that), and the daemon simply falls back to a
+            // fresh attach instead of resuming.
+            const scoped = typeof parsed.scopedToken === 'string' && typeof parsed.scopedTokenExpiresAtMs === 'number'
+                ? { scopedToken: parsed.scopedToken, scopedTokenExpiresAtMs: parsed.scopedTokenExpiresAtMs }
+                : {};
+            return { workspaceId, tileId, attachmentId, attachedAt, ...scoped };
         }
         return undefined;
     }
@@ -94,6 +129,25 @@ export function loadAttachment(env = process.env, io = defaultIO) {
 export function saveAttachment(attachment, env = process.env, io = defaultIO) {
     io.writeFile(attachmentPath(env), `${JSON.stringify(attachment, null, 2)}\n`);
 }
+/**
+ * Strips the workspace-scoped credential from `attachment.json`, leaving the
+ * attachment identity behind.
+ *
+ * Distinct from `clearAttachment` because the two answer different questions.
+ * `detach` clears the whole record on success — but on FAILURE it deliberately
+ * keeps it, so the retry path (`cli.ts`, or a manual `yolo-bridge detach`)
+ * knows what to retry against. The stored credential has no such second use:
+ * the server refuses it the moment the attachment stops being live, so leaving
+ * it on disk is residue that can only ever be leaked, never spent. No-ops when
+ * there is nothing stored, and never creates a file.
+ */
+export function clearStoredScopedToken(env = process.env, io = defaultIO) {
+    const attachment = loadAttachment(env, io);
+    if (!attachment || attachment.scopedToken === undefined)
+        return;
+    const { scopedToken: _dropped, scopedTokenExpiresAtMs: _droppedExpiry, ...rest } = attachment;
+    saveAttachment(rest, env, io);
+}
 export function clearAttachment(env = process.env, io = defaultIO) {
     io.removeFile(attachmentPath(env));
 }

package/dist/connection-state.js

@@ -0,0 +1,108 @@
+/**
+ * Out-of-band connection-state channel for the `yolo-bridge attach` daemon.
+ *
+ * **Why this module exists (bug, 2026-08-25).** `attach` spawns the user's
+ * local coding agent under a real PTY and pipes that PTY straight to this
+ * process's own `process.stdout` (`local-agent.ts`'s module header), so from
+ * the moment `startLocalAgent` runs the terminal belongs to a full-screen
+ * TUI that owns the alternate screen buffer and repaints on its own
+ * schedule. The daemon's own `log()` defaults to `process.stdout.write` —
+ * the SAME stream — so every connection-state line it emitted from inside
+ * the reconnect loop (`Stream error: …`, `Reconnecting in 1000ms
+ * (attempt 1)...`, `Stream connected.`) was injected into the middle of a
+ * frame the TUI believed it had drawn. The result is a garbled/overlapping
+ * display that persists until the agent happens to do a full repaint: a
+ * transient wifi blip the daemon recovers from entirely on its own still
+ * trashed the user's screen.
+ *
+ * Writing the same text to `process.stderr` instead is NOT a fix: in an
+ * interactive session both file descriptors point at the same tty, so the
+ * bytes land in exactly the same place.
+ *
+ * The fix is to stop putting human-readable status into a stream a TUI is
+ * actively rendering to, and route it to a channel that has nothing to do
+ * with the terminal. That channel is this file: a small JSON record under
+ * the daemon's existing config dir (`~/.config/yolobridge/`, alongside
+ * `auth.json`/`attachment.json`) holding the current connection state plus
+ * a bounded tail of recent transitions, written through the same injectable
+ * `ConfigStoreIO` every other piece of local state already uses.
+ *
+ * The information is deliberately NOT dropped — it is surfaced two ways:
+ *   - locally, by `yolo-bridge status` (status-cmd.ts), which reads this
+ *     record and renders the current state plus recent transitions;
+ *   - in the workspace, by the tile's own status: yolobridge tile status is
+ *     derived server-side from `lastHeartbeatAt` (docs/YOLOBRIDGE_PLAN.md's
+ *     "Status derivation" — ≤30s `running`, ≤90s `paused`, older
+ *     `stopped`), so a real drop already degrades the tile without the
+ *     daemon having to narrate it into the PTY.
+ *
+ * Scoped to one attachment (`attachmentId`): a record left over from a
+ * previous attach is ignored rather than shown as if it described the
+ * current one, which avoids needing a cleanup call at every teardown site.
+ */
+import * as path from 'node:path';
+import { defaultIO, configDir } from './config-store.js';
+/** How many prior transitions to keep. Enough to show "it blipped three
+ *  times in the last minute" without turning this into a log file. */
+export const MAX_RECENT_EVENTS = 20;
+function connectionPath(env) {
+    return path.join(configDir(env), 'connection.json');
+}
+export function loadConnectionState(env = process.env, io = defaultIO) {
+    const raw = io.readFile(connectionPath(env));
+    if (!raw)
+        return undefined;
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.attachmentId === 'string' &&
+            parsed.current !== undefined &&
+            typeof parsed.current.state === 'string' &&
+            typeof parsed.current.at === 'string') {
+            return {
+                attachmentId: parsed.attachmentId,
+                current: parsed.current,
+                recent: Array.isArray(parsed.recent) ? parsed.recent : [],
+            };
+        }
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Starts a fresh record for `attachmentId`. Called once, right after the
+ * attach succeeds, so `status` never renders a previous attach's history as
+ * if it belonged to the live one.
+ */
+export function resetConnectionState(attachmentId, event, env = process.env, io = defaultIO) {
+    writeState({ attachmentId, current: event, recent: [] }, env, io);
+}
+/**
+ * Appends `event` as the new current state, rolling the previous one into
+ * the bounded `recent` tail. A record belonging to a different attachment
+ * is replaced rather than appended to.
+ */
+export function recordConnectionEvent(attachmentId, event, env = process.env, io = defaultIO) {
+    const existing = loadConnectionState(env, io);
+    if (!existing || existing.attachmentId !== attachmentId) {
+        writeState({ attachmentId, current: event, recent: [] }, env, io);
+        return;
+    }
+    const recent = [...existing.recent, existing.current].slice(-MAX_RECENT_EVENTS);
+    writeState({ attachmentId, current: event, recent }, env, io);
+}
+function writeState(state, env, io) {
+    io.writeFile(connectionPath(env), `${JSON.stringify(state, null, 2)}\n`);
+}
+/** One-line human rendering, used by `yolo-bridge status`. */
+export function formatConnectionEvent(event) {
+    const parts = [event.state];
+    if (event.state === 'reconnecting' && typeof event.attempt === 'number') {
+        parts.push(`(attempt ${event.attempt}${typeof event.retryInMs === 'number' ? `, retrying in ${event.retryInMs}ms` : ''})`);
+    }
+    parts.push(`at ${event.at}`);
+    if (event.detail)
+        parts.push(`— ${event.detail}`);
+    return parts.join(' ');
+}

package/dist/detach-cmd.js

@@ -18,20 +18,58 @@
  * cli.ts).
  */
 import { detach as apiDetach } from './api-client.js';
-import { loadAuth, loadAttachment, clearAttachment } from './config-store.js';
+import { loadAuth, loadAttachment, clearAttachment, clearStoredScopedToken, } from './config-store.js';
 export async function runDetach(deps) {
-    const auth = loadAuth(deps.env, deps.io);
-    if (!auth)
+    // Still a real precondition, but no longer the credential: `auth.json` is
+    // what makes this a set-up machine at all, and its absence has a much better
+    // remedy to offer than a 403 would.
+    if (!loadAuth(deps.env, deps.io)) {
         return { ok: false, reason: 'not-logged-in', message: 'Not logged in — run `yolo-bridge login` first.' };
+    }
     const attachment = loadAttachment(deps.env, deps.io);
     if (!attachment)
         return { ok: false, reason: 'not-attached', message: 'No active attachment found.' };
+    // READ THE CREDENTIAL BEFORE ANY CLEARING BELOW. `DELETE .../attach/:id` is a
+    // daemon-only route behind Boundary B (card 09): an account token is refused
+    // there with 403 YOLOBRIDGE_SCOPED_TOKEN_REQUIRED, so this command must
+    // present the workspace-scoped credential `attach` persisted alongside the
+    // attachment identity — the same one the running daemon uses.
+    const scopedToken = attachment.scopedToken;
+    if (!scopedToken) {
+        // No credential the daemon surface will accept, and nothing on this machine
+        // can mint one for an attachment that already exists. Say so plainly rather
+        // than sending an account token to be refused: the operator's real remedy
+        // is to let the tile go stale on its own (the server stops it once the
+        // heartbeat lapses) or to re-attach.
+        return {
+            ok: false,
+            reason: 'error',
+            message: 'No workspace-scoped credential is stored for this attachment, so it cannot be '
+                + 'detached from this machine. The tile stops on its own once its heartbeat lapses; '
+                + 'run `yolo-bridge attach` to reconnect.',
+        };
+    }
     try {
-        await apiDetach({ commonApiBaseUrl: deps.commonApiBaseUrl, accessToken: auth.accessToken, fetchImpl: deps.fetchImpl }, attachment.workspaceId, attachment.attachmentId);
+        await apiDetach({ commonApiBaseUrl: deps.commonApiBaseUrl, accessToken: scopedToken, fetchImpl: deps.fetchImpl }, attachment.workspaceId, attachment.attachmentId);
     }
     catch (err) {
+        // The attachment RECORD **and** its credential are both kept on a genuine
+        // failure, because the retry needs both.
+        //
+        // Card 08 stripped the credential here, reasoning it was leakable residue
+        // the server would refuse anyway. Card 09 invalidated that: the scoped
+        // credential is now the ONLY thing Boundary B accepts on this route, so
+        // discarding it made every retry — automatic or manual — take the
+        // no-credential branch above. The attachment stays live server-side, this
+        // machine can no longer remove it, and the next `attach` creates a SECOND
+        // attachment and tile. (Codex review, gpt-5.6-sol, 2026-08-25: two P1s.)
+        //
+        // The credential is discarded only on a SUCCESSFUL or confirmed-gone
+        // detach — the same rule the record already follows, and for the same
+        // reason: the two are only useful together.
         return { ok: false, reason: 'error', message: err instanceof Error ? err.message : String(err) };
     }
+    clearStoredScopedToken(deps.env, deps.io);
     clearAttachment(deps.env, deps.io);
     return { ok: true };
 }

package/dist/mcp-proxy.js

@@ -167,7 +167,7 @@ async function fetchAllScopes(apiUrl, fetchImpl, tracker) {
 /** One cached, self-refreshing, workspace-wide token — scoped to whatever
  *  `agentId`'s registry entry actually allows out of the full scope
  *  universe (see this file's header comment). */
-function makeTokenCache(apiUrl, getAccessToken, workspaceId, agentId, fetchImpl, tracker) {
+function makeTokenCache(apiUrl, getAccessToken, workspaceId, agentId, callerTileId, fetchImpl, tracker) {
     let cached;
     async function mint() {
         const scopes = await fetchAllScopes(apiUrl, fetchImpl, tracker);
@@ -179,6 +179,7 @@ function makeTokenCache(apiUrl, getAccessToken, workspaceId, agentId, fetchImpl,
                     workspaceId,
                     agentId,
                     scopes,
+                    ...(callerTileId ? { callerTileId } : {}),
                     ttlSeconds: REQUESTED_TTL_SECONDS,
                 }),
                 signal,
@@ -243,7 +244,7 @@ export async function startMcpProxy(opts) {
     const log = opts.log ?? (() => { });
     const fetchImpl = opts.fetchImpl ?? fetch;
     const tracker = new RequestTracker();
-    const tokenCache = makeTokenCache(opts.apiUrl, opts.getAccessToken, opts.workspaceId, opts.agentId, fetchImpl, tracker);
+    const tokenCache = makeTokenCache(opts.apiUrl, opts.getAccessToken, opts.workspaceId, opts.agentId, opts.callerTileId, fetchImpl, tracker);
     // Bounded (STARTUP_MINT_TIMEOUT_MS): a stalled scope-discovery/mint fetch
     // must not block `onAttached` from ever reaching `startLocalAgent`
     // (Codex review, 2026-08-24). `abortAll()` only affects requests in

package/dist/status-cmd.js

@@ -11,8 +11,18 @@
  * a pidfile / lockfile next to attachment.json to close that gap; not
  * implemented here — flagged as a known limitation, not silently glossed
  * over.
+ *
+ * Partially narrowed since (2026-08-25): the daemon now records every
+ * connection transition to `connection.json` (connection-state.ts) instead
+ * of narrating it into the terminal the local agent's TUI is rendering
+ * into, and this command renders that record. That still isn't liveness —
+ * a crashed daemon leaves its last transition frozen on disk, so
+ * `Connection: connected` means "the last thing it managed to record",
+ * not "it is connected right now" — but a drop/reconnect blip is no
+ * longer invisible just because it can't be printed to the screen.
  */
 import { loadAuth, loadAttachment } from './config-store.js';
+import { loadConnectionState, formatConnectionEvent } from './connection-state.js';
 export function getStatus(deps = {}) {
     const now = deps.now ?? Date.now;
     const auth = loadAuth(deps.env, deps.io);
@@ -30,6 +40,14 @@ export function getStatus(deps = {}) {
         report.tileId = attachment.tileId;
         report.attachmentId = attachment.attachmentId;
         report.attachedAt = attachment.attachedAt;
+        const connection = loadConnectionState(deps.env, deps.io);
+        // Only report a record that belongs to the CURRENT attachment — a
+        // leftover from a previous attach describes a connection that no
+        // longer exists and would be actively misleading here.
+        if (connection && connection.attachmentId === attachment.attachmentId) {
+            report.connection = connection.current;
+            report.connectionHistory = connection.recent;
+        }
     }
     return report;
 }
@@ -47,6 +65,18 @@ export function formatStatus(report) {
     else {
         lines.push(`Attached: yes — workspace=${report.workspaceId} tile=${report.tileId} attachmentId=${report.attachmentId} since=${report.attachedAt}`);
         lines.push('(local file only — does not confirm the attach daemon process is still running/connected)');
+        if (report.connection) {
+            lines.push(`Connection: ${formatConnectionEvent(report.connection)}`);
+            const history = report.connectionHistory ?? [];
+            if (history.length > 0) {
+                // Newest first — a reconnect blip is easiest to read as "what just
+                // happened", not "what happened when this attach started".
+                lines.push('Recent connection events (newest first):');
+                for (const event of [...history].reverse()) {
+                    lines.push(`  ${formatConnectionEvent(event)}`);
+                }
+            }
+        }
     }
     return lines.join('\n');
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yolo-labs/yolobridge",
-  "version": "0.2.0",
+  "version": "0.8.0",
   "description": "YoloBridge — local coding-agent daemon that attaches a user's own Claude Code/Codex session to a YOLO Studio workspace as a first-class tile (docs/YOLOBRIDGE_PLAN.md, build-order Phase 5).",
   "license": "MIT",
   "type": "module",