flowviant 0.96.0 → 0.99.0

package/bin/lib/landed.mjs

@@ -29,7 +29,7 @@ import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { createHash } from 'node:crypto';
 import { git, baseBranchName } from './git.mjs';
-import { stripDelims, taskIdsFromMessage } from './worktreeDiff.mjs';
+import { commitRecord, stripDelims, taskIdsFromMessage } from './worktreeDiff.mjs';
 import { warn } from './ui.mjs';
 import { FLEET_URL, FLEET_TOKEN, USER_AGENT } from './config.mjs';
 
@@ -95,41 +95,39 @@ export function createLandedObserver({ repoRoot, baseRef }) {
    *  merge commit describes a range rather than doing work, and its
    *  constituents are walked as themselves.
    *
-   *  THE SHA LIST COMES FROM REV-LIST, NEVER FROM THE FORMATTED LOG. Git
-   *  preserves the 0x1e/0x1f delimiter bytes inside a commit BODY (verified
-   *  empirically), so a crafted message can fabricate whole records — an
-   *  arbitrary sha plus Flowviant-Task ids that /fleet/base-landed would close
-   *  cards on. rev-list prints nothing an author controls, so its output is
-   *  the set of commits that exist: a parsed record whose sha is not in the
-   *  batch is a forgery and is dropped, a repeated sha is the same forgery
-   *  wearing a real commit's name, and the delimiter bytes are stripped from
-   *  every surviving field.
+   *  THE SHA LIST COMES FROM REV-LIST, NEVER FROM THE FORMATTED LOG, and each
+   *  commit is then read BY ITS OWN SHA (`commitRecord`, one `git show` per
+   *  commit) rather than as one delimited multi-record log. A batched log
+   *  used to print every commit's `%H%x1f%s%x1f%B%x1e` back to back and split
+   *  the blob on those same delimiter bytes — bytes git preserves verbatim
+   *  inside a commit BODY (verified empirically), so a crafted message could
+   *  embed its own fake `%x1e`/`%x1f%1f` run and fabricate an extra "record"
+   *  naming an arbitrary sha and Flowviant-Task ids that /fleet/base-landed
+   *  would close cards on. Reading one sha at a time removes the multi-record
+   *  parse entirely — there is no blob to split, so there is nothing for an
+   *  embedded delimiter to forge a SECOND record out of. `stripDelims` still
+   *  scrubs whatever lands in the subject/body of the commit it actually
+   *  belongs to, the same defence-in-depth `branchCommits` above keeps.
    *
-   *  BOUNDING THE BODY FETCH TO THE BATCH is what makes the header's batching
-   *  contract true at any range size: `%B` over the whole range grows without
-   *  bound, so the formatted log runs over exactly the shas being reported
-   *  this beat (`--no-walk=unsorted` shows precisely the commits named, in
-   *  argv order — measured). */
+   *  ONE UNREADABLE COMMIT IS SKIPPED, NOT AN ABORT OF THE WHOLE BATCH:
+   *  `commitRecord` runs through `gitRaw`, whose `maxBuffer` is git.mjs's
+   *  plain default (1MiB) rather than this module's widened `gitWide` — a
+   *  single commit whose message alone exceeds that returns null and is
+   *  dropped, while every other commit in the batch still reports. */
   const walk = (from, to) => {
     const shas = gitWide(['rev-list', '--reverse', '--no-merges', `${from}..${to}`])
       .split('\n')
       .filter((s) => SHA_RE.test(s));
     const batch = shas.slice(0, MAX_COMMITS);
     const tipAfter = shas.length > MAX_COMMITS ? batch[batch.length - 1] : null;
-    if (batch.length === 0) return { commits: [], tipAfter };
-    const real = new Set(batch);
-    const raw = gitWide(['log', '--no-walk=unsorted', '--format=%H%x1f%s%x1f%B%x1e', ...batch]);
     const out = [];
-    for (const rec of raw.split('\x1e')) {
-      const line = rec.replace(/^\n+/, '');
-      if (!line.trim()) continue;
-      const [sha, subject, ...bodyParts] = line.split('\x1f');
-      if (!real.has(sha)) continue;
-      real.delete(sha);
+    for (const sha of batch) {
+      const rec = commitRecord(sha, repoRoot);
+      if (!rec) continue;
       out.push({
         sha,
-        subject: stripDelims(subject).slice(0, 200),
-        taskIds: taskIdsFromMessage(stripDelims(bodyParts.join('\n'))).slice(0, 8),
+        subject: stripDelims(rec.subject).slice(0, 200),
+        taskIds: taskIdsFromMessage(stripDelims(rec.body)).slice(0, 8),
       });
     }
     return { commits: out, tipAfter };
@@ -202,13 +200,23 @@ export function createLandedObserver({ repoRoot, baseRef }) {
         for (const r of j?.data?.deployRefused ?? []) {
           warn(`deploy-on-merge refused for target "${r?.targetId}": ${r?.reason}`);
         }
+      } else if (res.status === 408 || res.status === 429) {
+        // A TIMEOUT OR A RATE LIMIT IS "NOT NOW", NOT "NEVER". Both used to
+        // land in the drop below, so one 429 — a busy operator IP past the
+        // limiter — skipped the range for good: its trailers and receipt shas
+        // never closed their cards (in PR mode the observer is the ONLY road
+        // to Done) and deploy-on-merge for that tip was never queued. Keep the
+        // stored tip, exactly as a 5xx does; the next beat re-walks it.
       } else if (res.status >= 400 && res.status < 500) {
         // A persistent 4xx (deploy skew, a payload this server refuses) would
         // otherwise re-send the same poison range on every beat forever.
-        // Drop the range — the closes it carried re-run at the next REAL tip
-        // move only if their cards are still open, which is the idempotent
-        // half; the honest cost is stated out loud.
-        writeState({ ref, tip });
+        // Drop THIS BATCH — to `reportedTip`, the last commit it carried, never
+        // the full tip: a range past the cap has a remainder this batch never
+        // sent, and advancing to the tip discarded that too. The closes it
+        // carried re-run at the next REAL tip move only if their cards are
+        // still open, which is the idempotent half; the honest cost is stated
+        // out loud.
+        writeState({ ref, tip: reportedTip });
         warn(`base-landed report refused (${res.status}) — skipped ${commits.length} commit(s)`);
       }
     } catch {

package/bin/lib/listeners.mjs

@@ -509,3 +509,214 @@ export function isListening(port, timeoutMs = 1500) {
     sock.once('error', () => finish(false));
   });
 }
+
+// ── the address a share dials ────────────────────────────────────────────────
+
+/**
+ * WHICH ADDRESS REACHES THE ATTRIBUTED PROCESS on `port`, or why none does
+ * (audit 2026-09-24).
+ *
+ * Attribution above is keyed on the PORT, and the gate used to dial
+ * `127.0.0.1:<port>` whatever socket had been attributed. Linux and macOS let
+ * two processes hold one port on the two loopback families side by side, so a
+ * dev server in this worktree on `[::1]:5173` and an unrelated process on
+ * `127.0.0.1:5173` passed the attribution check while the tunnel published the
+ * UNRELATED one — the exact thing attribution exists to prevent. And the
+ * ordinary case broke the other way: Vite's default `localhost` bind resolves
+ * to `::1` on a Mac, so the share opened and every request answered 502.
+ *
+ * So the dial address is DERIVED FROM THE ATTRIBUTED SOCKET: a wildcard bind is
+ * reached on its own family's loopback, a specific bind on its own address —
+ * and a candidate is REFUSED when a process outside the worktree holds that
+ * same address (or the same wildcard, via SO_REUSEPORT) on that port, because
+ * the kernel may then hand the connection to either. IPv4 is preferred when
+ * both reach the attributed process, since that is what every dev server's
+ * own printed URL means.
+ *
+ * `{ host }` on success, `{ error }` with a sentence otherwise. A platform this
+ * file cannot measure answers the loopback it always dialled — the same
+ * behaviour as before, never a refusal invented from ignorance.
+ */
+export function originFor(worktree, port) {
+  if (!worktree || !Number.isInteger(port) || port <= 0 || port > 65535) {
+    return { error: `nothing is listening on port ${port} in this worktree.` };
+  }
+  let sockets;
+  try {
+    sockets =
+      platform() === 'linux'
+        ? socketsOnPortLinux(worktree, port)
+        : platform() === 'darwin'
+          ? socketsOnPortDarwin(worktree, port)
+          : null;
+  } catch {
+    sockets = null;
+  }
+  if (sockets == null) return { host: '127.0.0.1' };
+  return pickOrigin(sockets, port);
+}
+
+/**
+ * The rule alone, over `[{ family: 4|6, addr, ours }]` — split out so it is
+ * testable without two address families on the test box.
+ */
+export function pickOrigin(sockets, port) {
+  const ours = sockets.filter((s) => s.ours);
+  if (!ours.length) return { error: `nothing is listening on port ${port} in this worktree.` };
+  const foreign = sockets.filter((s) => !s.ours);
+  const dialOf = (s) =>
+    s.family === 6 ? (s.addr === '::' ? '::1' : s.addr) : s.addr === '0.0.0.0' ? '127.0.0.1' : s.addr;
+  const rank = (s) => {
+    const d = dialOf(s);
+    return d === '127.0.0.1' ? 0 : d === '::1' ? 1 : s.family === 4 ? 2 : 3;
+  };
+  let contested = false;
+  for (const s of [...ours].sort((a, b) => rank(a) - rank(b))) {
+    const dial = dialOf(s);
+    const shadowed = foreign.some((f) => f.family === s.family && (f.addr === dial || f.addr === s.addr));
+    if (shadowed) {
+      contested = true;
+      continue;
+    }
+    return { host: dial };
+  }
+  return contested
+    ? {
+        error: `another process on this machine, outside this worktree, also listens on port ${port} at the same address, so it was not shared.`,
+      }
+    : { error: `nothing is listening on port ${port} in this worktree.` };
+}
+
+/** /proc/net/tcp{,6} address hex → a printable address. Each 32-bit word is
+ *  stored little-endian. */
+function hexAddr(hex, family) {
+  const words = hex.match(/.{8}/g) || [];
+  const bytes = [];
+  for (const w of words) for (let i = 6; i >= 0; i -= 2) bytes.push(parseInt(w.slice(i, i + 2), 16));
+  if (family === 4) return bytes.join('.');
+  if (bytes.slice(0, 10).every((b) => b === 0) && bytes[10] === 0xff && bytes[11] === 0xff) {
+    return `::ffff:${bytes.slice(12).join('.')}`;
+  }
+  const groups = [];
+  for (let i = 0; i < 16; i += 2) groups.push(((bytes[i] << 8) | bytes[i + 1]).toString(16));
+  // Compress the longest run of zero groups, the way the address is written.
+  let best = [-1, 0];
+  for (let i = 0; i < 8; ) {
+    if (groups[i] !== '0') {
+      i++;
+      continue;
+    }
+    let j = i;
+    while (j < 8 && groups[j] === '0') j++;
+    if (j - i > best[1]) best = [i, j - i];
+    i = j;
+  }
+  if (best[1] < 2) return groups.join(':');
+  const head = groups.slice(0, best[0]).join(':');
+  const tail = groups.slice(best[0] + best[1]).join(':');
+  return `${head}::${tail}`;
+}
+
+function socketsOnPortLinux(worktree, port) {
+  const byInode = new Map(); // inode -> { family, addr }
+  for (const [f, family] of [
+    ['/proc/net/tcp', 4],
+    ['/proc/net/tcp6', 6],
+  ]) {
+    let text;
+    try {
+      text = readFileSync(f, 'utf8');
+    } catch {
+      continue;
+    }
+    for (const line of text.split('\n').slice(1)) {
+      const c = line.trim().split(/\s+/);
+      if (c.length < 10 || c[3] !== '0A') continue;
+      const [a, p] = String(c[1]).split(':');
+      if (parseInt(p, 16) !== port) continue;
+      if (c[9] && c[9] !== '0') byInode.set(c[9], { family, addr: hexAddr(a, family) });
+    }
+  }
+  if (byInode.size === 0) return [];
+  let root;
+  try {
+    root = realpathSync(worktree);
+  } catch {
+    return [];
+  }
+  const prefix = root.endsWith(sep) ? root : root + sep;
+  const ours = new Set();
+  let pids;
+  try {
+    pids = readdirSync('/proc').filter((d) => /^\d+$/.test(d));
+  } catch {
+    return null;
+  }
+  if (pids.length > MAX_PIDS) pids = pids.slice(0, MAX_PIDS);
+  for (const pid of pids) {
+    let cwd;
+    try {
+      cwd = readlinkSync(`/proc/${pid}/cwd`);
+    } catch {
+      continue;
+    }
+    if (cwd !== root && !cwd.startsWith(prefix)) continue;
+    if (Number(pid) === process.pid || infraPids.has(Number(pid))) continue;
+    let fds;
+    try {
+      fds = readdirSync(`/proc/${pid}/fd`);
+    } catch {
+      continue;
+    }
+    for (const fd of fds) {
+      let link;
+      try {
+        link = readlinkSync(`/proc/${pid}/fd/${fd}`);
+      } catch {
+        continue;
+      }
+      const m = /^socket:\[(\d+)\]$/.exec(link);
+      if (m && byInode.has(m[1])) ours.add(m[1]);
+    }
+  }
+  // A socket whose holder we could not read (another user's process) is
+  // FOREIGN — the safe reading for a refusal check.
+  return [...byInode.entries()].map(([inode, s]) => ({ ...s, ours: ours.has(inode) }));
+}
+
+function socketsOnPortDarwin(worktree, port) {
+  const rows = []; // { pid, family, addr }
+  let pid = null;
+  let family = null;
+  for (const line of lsof(['-nP', `-iTCP:${port}`, '-sTCP:LISTEN', '-F', 'ptn']).split('\n')) {
+    if (line.startsWith('p')) pid = line.slice(1);
+    else if (line.startsWith('t')) family = line.slice(1) === 'IPv6' ? 6 : line.slice(1) === 'IPv4' ? 4 : null;
+    else if (line.startsWith('n') && pid && family) {
+      const m = /^n(.*):(\d+)$/.exec(line);
+      if (!m || Number(m[2]) !== port) continue;
+      let addr = m[1].replace(/^\[|\]$/g, '');
+      if (addr === '*') addr = family === 6 ? '::' : '0.0.0.0';
+      rows.push({ pid, family, addr });
+    }
+  }
+  if (!rows.length) return [];
+  let root;
+  try {
+    root = realpathSync(worktree);
+  } catch {
+    return [];
+  }
+  const prefix = root.endsWith(sep) ? root : root + sep;
+  const inside = new Set();
+  const self = String(process.pid);
+  let cur = null;
+  const pids = [...new Set(rows.map((r) => r.pid))];
+  for (const line of lsof(['-a', '-d', 'cwd', '-F', 'pn', '-p', pids.join(',')]).split('\n')) {
+    if (line.startsWith('p')) cur = line.slice(1);
+    else if (line.startsWith('n') && cur) {
+      const cwd = line.slice(1);
+      if ((cwd === root || cwd.startsWith(prefix)) && cur !== self && !infraPids.has(Number(cur))) inside.add(cur);
+    }
+  }
+  return rows.map((r) => ({ family: r.family, addr: r.addr, ours: inside.has(r.pid) }));
+}

package/bin/lib/localSessions.mjs

@@ -105,7 +105,7 @@ export function titleForSession(cwd, sessionId) {
     /* the place is gone — nothing to read */
   }
   for (const dir of dirs) {
-    const file = join(projects, dir.replace(/[/.]/g, '-'), `${sessionId}.jsonl`);
+    const file = join(projects, claudeProjectDir(dir), `${sessionId}.jsonl`);
     try {
       return transcriptTitle(file, statSync(file).mtimeMs);
     } catch {
@@ -115,6 +115,27 @@ export function titleForSession(cwd, sessionId) {
   return null;
 }
 
+/**
+ * THE DIRECTORY CLAUDE CODE FILES A CWD'S TRANSCRIPTS UNDER — its own rule,
+ * copied exactly (2.1.281): every character that is not an ASCII letter or
+ * digit becomes `-`, and a name past 200 characters is cut there and suffixed
+ * with a base-36 Java-style string hash of the ORIGINAL path.
+ *
+ * This file used `replace(/[/.]/g, '-')`, which agrees with Claude Code only
+ * while a path holds nothing but letters, digits, `/` and `.` — so a repo at
+ * `~/code/my_app` or `~/My Projects/x` never offered an ended terminal session
+ * for adoption and never got a tab auto-title, silently (audit 2026-09-24).
+ */
+const CLAUDE_DIR_MAX = 200;
+export function claudeProjectDir(path) {
+  const p = String(path);
+  const s = p.replace(/[^a-zA-Z0-9]/g, '-');
+  if (s.length <= CLAUDE_DIR_MAX) return s;
+  let h = 0;
+  for (let i = 0; i < p.length; i++) h = ((h << 5) - h + p.charCodeAt(i)) | 0;
+  return `${s.slice(0, CLAUDE_DIR_MAX)}-${Math.abs(h).toString(36)}`;
+}
+
 /** Path-prefix containment on already-realpath'd absolute paths. */
 const inside = (p, root) => p === root || p.startsWith(root.endsWith('/') ? root : `${root}/`);
 
@@ -373,7 +394,7 @@ export function scanLocalSessions({ repoRoot, excludeDirs = [], excludeIds }) {
           homedir(),
           '.claude',
           'projects',
-          cwd.replace(/[/.]/g, '-'),
+          claudeProjectDir(cwd),
           `${rec.sessionId}.jsonl`
         );
         liveTitle = transcriptTitle(liveFile, statSync(liveFile).mtimeMs);
@@ -400,7 +421,11 @@ export function scanLocalSessions({ repoRoot, excludeDirs = [], excludeIds }) {
     // But so does a sibling repo ('flowviant-two' shares 'flowviant' + '-'),
     // which is why every candidate is verified against the cwd its own records
     // embed rather than trusted on its directory name.
-    const munged = realRoot.replace(/[/.]/g, '-');
+    const munged = claudeProjectDir(realRoot);
+    // A root past Claude's 200-character cut carries a hash of ITSELF, which a
+    // subdirectory's name does not share — so the prefix a subdirectory can
+    // match is the cut, and the cwd verification below does the rest.
+    const mungedStem = munged.length > CLAUDE_DIR_MAX ? munged.slice(0, CLAUDE_DIR_MAX) : `${munged}-`;
     const projectsDir = join(homedir(), '.claude', 'projects');
     let projDirs = [];
     try {
@@ -411,7 +436,7 @@ export function scanLocalSessions({ repoRoot, excludeDirs = [], excludeIds }) {
     const cutoff = Date.now() - ENDED_WINDOW_MS;
     const candidates = [];
     for (const dirName of projDirs) {
-      if (dirName !== munged && !dirName.startsWith(`${munged}-`)) continue;
+      if (dirName !== munged && !dirName.startsWith(mungedStem)) continue;
       let entries = [];
       try {
         entries = readdirSync(join(projectsDir, dirName), { withFileTypes: true });

package/bin/lib/login.mjs

@@ -7,7 +7,7 @@
  */
 
 import { FLEET_URL, USER_AGENT, VERSION } from './config.mjs';
-import { saveLogin, detectRepoRoot, projectLabel, listStoredProjects, boundElsewhere, directoryTakenRefusal } from './credentials.mjs';
+import { saveLogin, detectRepoRoot, projectLabel, safeName, listStoredProjects, boundElsewhere, directoryTakenRefusal } from './credentials.mjs';
 import { c, info, ok, warn, fail } from './ui.mjs';
 import { sleep } from './claude.mjs';
 
@@ -70,7 +70,7 @@ export async function runLogin({ thenStart = false } = {}) {
         fleetToken: poll.machineToken ?? poll.fleetToken,
         projectId: poll.projectId,
         mcpUrl: poll.mcpUrl,
-        name: typeof poll.projectName === 'string' && poll.projectName ? poll.projectName : null,
+        name: safeName(poll.projectName),
         repoRoot,
       };
       // A DIRECTORY SERVES ONE PROJECT (2026-09-23). The owner, verbatim: "a

package/bin/lib/machines.mjs

@@ -72,7 +72,8 @@
  */
 
 import { USER_AGENT } from './config.mjs';
-import { projectLabel, repoCollisions } from './credentials.mjs';
+import { projectLabel, repoCollisions, safeName } from './credentials.mjs';
+import { credentialRejected } from './authReject.mjs';
 
 /** The boxes read, derived from the roster URL the way the diffstat post is —
  *  one place configures the API base and everything else is a suffix swap. */
@@ -178,7 +179,13 @@ function roleWord(role) {
  *  does not — and the words beside it are all the server's or the box's own. */
 export function renderBox(box, { me = null, latest = null } = {}, now = Date.now()) {
   const mark = box.fresh ? '●' : '○';
-  const name = box.boxName || 'an unnamed machine';
+  // SCRUBBED HERE TOO (2026-09-24, the audit) — a belt against the server's
+  // own display scrub, in defence of a stale stored row or a server this
+  // fix has not reached: the terminal is where an escape sequence in a
+  // box's name or its checkout path actually does harm, so this is the one
+  // place it must never be trusted to have already been cleaned. See
+  // printable.mjs.
+  const name = safeName(box.boxName) ?? 'an unnamed machine';
   // "LAST heard" is the staleness mark, and the row is never hidden for it —
   // the owner's answer to "what about a box that stopped" was exactly this.
   const heard = heardPhrase(box, now);
@@ -190,7 +197,7 @@ export function renderBox(box, { me = null, latest = null } = {}, now = Date.now
   const cells = [
     `${mark} ${name}`,
     roleWord(box.role),
-    box.checkoutPath || '(checkout not reported)',
+    safeName(box.checkoutPath) ?? '(checkout not reported)',
     box.daemonVersion ? `v${box.daemonVersion}` : 'version not reported',
     heard,
   ].filter(Boolean);
@@ -223,7 +230,7 @@ export function renderMachines(entries, results, { now = Date.now() } = {}) {
   // to notice a suffix to know whether it matters has already been asked to do
   // the work this listing is for.
   for (const e of entries) {
-    const label = e.name || `project ${e.projectId.slice(0, 8)}…`;
+    const label = projectLabel(e);
     const connected = connectedOn(e.savedAt);
     const id = `(id ${e.projectId.slice(0, 8)}…${connected ? `, connected ${connected}` : ''})`;
     lines.push(
@@ -340,7 +347,8 @@ export async function fetchBoxesFor(entry, { url, envpub, fetchImpl = fetch } =
       headers: { Authorization: `Bearer ${entry.fleetToken}`, 'User-Agent': USER_AGENT },
       signal: AbortSignal.timeout(15_000),
     });
-    if (res.status === 401 || res.status === 403) return { rejected: true };
+    if (await credentialRejected(res)) return { rejected: true };
+    if (res.status === 401 || res.status === 403) return { error: `HTTP ${res.status} from something in front of the app` };
     if (res.status === 404) return { unsupported: true };
     if (!res.ok) return { error: `HTTP ${res.status}` };
     const body = await res.json();
@@ -367,7 +375,7 @@ export function otherBoxesLine(boxes, me, now = Date.now()) {
   if (others.length === 0) return null;
   const parts = others.slice(0, 6).map((b) => {
     const role = roleWord(b.role);
-    return `${b.boxName || 'an unnamed machine'} (${role ? `${role} · ` : ''}${heardPhrase(b, now)})`;
+    return `${safeName(b.boxName) ?? 'an unnamed machine'} (${role ? `${role} · ` : ''}${heardPhrase(b, now)})`;
   });
   const more = others.length - parts.length;
   return `other machines on this project: ${parts.join(', ')}${more > 0 ? `, and ${more} more` : ''}`;
@@ -403,7 +411,8 @@ export async function leaveBoxFor(entry, { url, envpub, fetchImpl = fetch } = {}
       body: JSON.stringify({ envpub }),
       signal: AbortSignal.timeout(15_000),
     });
-    if (res.status === 401 || res.status === 403) return { rejected: true };
+    if (await credentialRejected(res)) return { rejected: true };
+    if (res.status === 401 || res.status === 403) return { error: `HTTP ${res.status} from something in front of the app` };
     if (res.status === 404) return { unsupported: true };
     if (!res.ok) return { error: `HTTP ${res.status}` };
     const body = await res.json();

package/bin/lib/preview.mjs

@@ -46,7 +46,7 @@ import {
 import { join } from 'node:path';
 import { homedir, platform, arch } from 'node:os';
 import { startAuthProxy } from './authproxy.mjs';
-import { forgetInfraPid, isListening, noteInfraPid } from './listeners.mjs';
+import { forgetInfraPid, isListening, noteInfraPid, originFor } from './listeners.mjs';
 
 // ── cloudflared: pinned, verified, or not fetched at all ───────────────────
 
@@ -138,7 +138,19 @@ async function ensureCloudflared(log) {
   }
 }
 
-const TUNNEL_RE = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/i;
+/**
+ * The hostname cloudflared ASSIGNED, and nothing else it happens to print.
+ *
+ * `[a-z0-9-]+\.trycloudflare\.com` also matched cloudflared's own FAILURE line
+ * — `failed to request quick Tunnel: Post "https://api.trycloudflare.com/tunnel":
+ * dial tcp: lookup api.trycloudflare.com: …` — so on any box that could not
+ * reach the quick-tunnel API (offline, DNS failure, a proxy blocking it) the
+ * share was reported LIVE at Cloudflare's own API host, and cloudflared's real
+ * sentence, which the tail exists to relay, was replaced by a wrong one (audit
+ * 2026-09-24). `api.` is the service's endpoint and never an assigned name, and
+ * the trailing guard stops a longer hostname matching on its prefix.
+ */
+export const TUNNEL_RE = /https:\/\/(?!api\.)[a-z0-9-]+\.trycloudflare\.com(?![a-z0-9.-])/i;
 
 // ── Orphan reaping ─────────────────────────────────────────────────────────
 // cloudflared is detached so we can kill its whole group — which also means it
@@ -228,6 +240,39 @@ function mutateRegistry(fn) {
   }
 }
 
+/**
+ * WHEN a process started, as the kernel reports it — or null when this box
+ * will not say. Paired with a pid it names ONE process: a pid alone is
+ * recycled, and the owner check below trusted signal 0 on a bare pid.
+ */
+export function processStartOf(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return null;
+  if (platform() === 'linux') {
+    try {
+      const stat = readFileSync(`/proc/${pid}/stat`, 'utf8');
+      // Field 22 (starttime), counted after the LAST ')' — the comm field in
+      // parentheses may itself hold spaces and parentheses.
+      const rest = stat.slice(stat.lastIndexOf(')') + 2).split(' ');
+      return rest[19] ? `l:${rest[19]}` : null;
+    } catch {
+      return null;
+    }
+  }
+  if (platform() === 'darwin') {
+    try {
+      const out = execFileSync('ps', ['-p', String(pid), '-o', 'lstart='], {
+        encoding: 'utf8',
+        timeout: 5_000,
+        stdio: ['ignore', 'pipe', 'ignore'],
+      }).trim();
+      return out ? `d:${out}` : null;
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+
 /** Signal-0 liveness (EPERM = alive and not ours), for the OWNER check below. */
 function processAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -246,7 +291,15 @@ function recordPreviewPid(pid, sig) {
   // starting daemon reaped its PEER's live tunnels: killed them, wiped their
   // entries, and the peer kept heartbeating a URL that 530s (its probe watches
   // the origin port, which was still alive).
-  mutateRegistry((list) => [...list, { pid, sig, owner: process.pid }]);
+  //
+  // `ownerStart` pins the owner to ONE process (audit 2026-09-24). A daemon that
+  // is SIGKILLed with a share open leaves cloudflared up; if its pid is reused
+  // by the next start — any process, another user's included, since EPERM
+  // counts as alive — a pid-only check read the entry as a live peer's and
+  // skipped it forever, leaving a public hostname aimed at a dead gate's
+  // ephemeral port for anything that binds it next.
+  const ownerStart = processStartOf(process.pid);
+  mutateRegistry((list) => [...list, { pid, sig, owner: process.pid, ...(ownerStart ? { ownerStart } : {}) }]);
 }
 
 function forgetPreviewPid(pid) {
@@ -311,13 +364,24 @@ function stillOurs(pid, sig) {
  *  own teardown handles it) — killing those and wiping their entries was a
  *  peer daemon's startup silently breaking every live share on the box. Only
  *  the entries this pass handled are removed; a peer's records survive. */
+/** Is the daemon that recorded an entry still the process at that pid? With
+ *  a recorded start time, only when the pid's start time still matches (a
+ *  recycled pid is an orphaned entry); where this box cannot report a start
+ *  time now, or the entry predates the field, signal 0 is all there is. */
+function ownerStillRunning(owner, ownerStart) {
+  if (!processAlive(owner)) return false;
+  if (typeof ownerStart !== 'string') return true;
+  const now = processStartOf(owner);
+  return now == null ? true : now === ownerStart;
+}
+
 export function reapOrphanPreviews(log) {
   const list = readRegistry();
   if (list.length === 0) return;
   let killed = 0;
   const handled = new Set();
-  for (const { pid, sig, owner } of list) {
-    if (Number.isInteger(owner) && owner !== process.pid && processAlive(owner)) continue;
+  for (const { pid, sig, owner, ownerStart } of list) {
+    if (Number.isInteger(owner) && owner !== process.pid && ownerStillRunning(owner, ownerStart)) continue;
     const ours = stillOurs(pid, sig);
     /**
      * THE RECORD OUTLIVES A REAP THAT COULD NOT LOOK. `handled.add` ran BEFORE
@@ -396,6 +460,11 @@ export async function openTunnel({
   onAbuse,
   onTunnelGone,
   stillServing,
+  // The worktree the port was attributed to. When given, the gate dials the
+  // address the ATTRIBUTED socket holds (`originFor`) rather than assuming
+  // 127.0.0.1, and every liveness check re-derives it — so a neighbour on the
+  // other loopback family is never what the tunnel publishes.
+  worktree,
   probeMs = 20_000,
   // The members-gate triple, all three or none. Absent = an older server, or a
   // password-mode share: the gate runs exactly as it always has.
@@ -406,8 +475,15 @@ export async function openTunnel({
   // ONE predicate for every liveness question this function asks. Attribution
   // when the caller gave it, a bare TCP connect only when it did not; an
   // attribution check that errors is not a "yes".
+  // `origin` is decided once, at the gate's start; after that a change of
+  // address is a different process and reads as "not serving".
+  let origin = null;
   const serving = async () => {
     try {
+      if (worktree) {
+        const o = originFor(worktree, port);
+        if (o.error || (origin && o.host !== origin)) return false;
+      }
       return stillServing ? await stillServing() : await isListening(port);
     } catch {
       return false;
@@ -455,8 +531,14 @@ export async function openTunnel({
 
   // The gate comes up FIRST and the tunnel points at it, never at the origin —
   // so there is no window in which the public hostname is un-gated.
+  if (worktree) {
+    const o = originFor(worktree, port);
+    if (o.error) return { error: o.error };
+    origin = o.host;
+  }
   gate = await startAuthProxy({
     targetPort: port,
+    ...(origin ? { targetHost: origin } : {}),
     log,
     // Never logged, never written to previews.json, never in the reap
     // signature, never in argv or a child env — /proc/<pid>/cmdline is
@@ -529,7 +611,14 @@ export async function openTunnel({
     const onOut = (d) => {
       const s = d.toString();
       tail = (tail + s).slice(-TAIL_BYTES);
-      const m = TUNNEL_RE.exec(s);
+      // ONE URL, ONE PROBE. A second match after we settled (cloudflared
+      // repeats the banner, or a later line names another host) used to start
+      // a second probe interval and a second close listener on a tunnel whose
+      // answer had already been given.
+      if (settled) return;
+      // Matched over the TAIL, not the chunk: a pipe read can split the
+      // hostname across two chunks, and a half never matches.
+      const m = TUNNEL_RE.exec(tail);
       if (!m) return;
 
       // Watch the ORIGIN — with the caller's ATTRIBUTION check when it gave