flowviant 0.97.0 → 0.99.0

package/bin/lib/listeners.mjs

@@ -509,3 +509,214 @@ export function isListening(port, timeoutMs = 1500) {
     sock.once('error', () => finish(false));
   });
 }
+
+// ── the address a share dials ────────────────────────────────────────────────
+
+/**
+ * WHICH ADDRESS REACHES THE ATTRIBUTED PROCESS on `port`, or why none does
+ * (audit 2026-09-24).
+ *
+ * Attribution above is keyed on the PORT, and the gate used to dial
+ * `127.0.0.1:<port>` whatever socket had been attributed. Linux and macOS let
+ * two processes hold one port on the two loopback families side by side, so a
+ * dev server in this worktree on `[::1]:5173` and an unrelated process on
+ * `127.0.0.1:5173` passed the attribution check while the tunnel published the
+ * UNRELATED one — the exact thing attribution exists to prevent. And the
+ * ordinary case broke the other way: Vite's default `localhost` bind resolves
+ * to `::1` on a Mac, so the share opened and every request answered 502.
+ *
+ * So the dial address is DERIVED FROM THE ATTRIBUTED SOCKET: a wildcard bind is
+ * reached on its own family's loopback, a specific bind on its own address —
+ * and a candidate is REFUSED when a process outside the worktree holds that
+ * same address (or the same wildcard, via SO_REUSEPORT) on that port, because
+ * the kernel may then hand the connection to either. IPv4 is preferred when
+ * both reach the attributed process, since that is what every dev server's
+ * own printed URL means.
+ *
+ * `{ host }` on success, `{ error }` with a sentence otherwise. A platform this
+ * file cannot measure answers the loopback it always dialled — the same
+ * behaviour as before, never a refusal invented from ignorance.
+ */
+export function originFor(worktree, port) {
+  if (!worktree || !Number.isInteger(port) || port <= 0 || port > 65535) {
+    return { error: `nothing is listening on port ${port} in this worktree.` };
+  }
+  let sockets;
+  try {
+    sockets =
+      platform() === 'linux'
+        ? socketsOnPortLinux(worktree, port)
+        : platform() === 'darwin'
+          ? socketsOnPortDarwin(worktree, port)
+          : null;
+  } catch {
+    sockets = null;
+  }
+  if (sockets == null) return { host: '127.0.0.1' };
+  return pickOrigin(sockets, port);
+}
+
+/**
+ * The rule alone, over `[{ family: 4|6, addr, ours }]` — split out so it is
+ * testable without two address families on the test box.
+ */
+export function pickOrigin(sockets, port) {
+  const ours = sockets.filter((s) => s.ours);
+  if (!ours.length) return { error: `nothing is listening on port ${port} in this worktree.` };
+  const foreign = sockets.filter((s) => !s.ours);
+  const dialOf = (s) =>
+    s.family === 6 ? (s.addr === '::' ? '::1' : s.addr) : s.addr === '0.0.0.0' ? '127.0.0.1' : s.addr;
+  const rank = (s) => {
+    const d = dialOf(s);
+    return d === '127.0.0.1' ? 0 : d === '::1' ? 1 : s.family === 4 ? 2 : 3;
+  };
+  let contested = false;
+  for (const s of [...ours].sort((a, b) => rank(a) - rank(b))) {
+    const dial = dialOf(s);
+    const shadowed = foreign.some((f) => f.family === s.family && (f.addr === dial || f.addr === s.addr));
+    if (shadowed) {
+      contested = true;
+      continue;
+    }
+    return { host: dial };
+  }
+  return contested
+    ? {
+        error: `another process on this machine, outside this worktree, also listens on port ${port} at the same address, so it was not shared.`,
+      }
+    : { error: `nothing is listening on port ${port} in this worktree.` };
+}
+
+/** /proc/net/tcp{,6} address hex → a printable address. Each 32-bit word is
+ *  stored little-endian. */
+function hexAddr(hex, family) {
+  const words = hex.match(/.{8}/g) || [];
+  const bytes = [];
+  for (const w of words) for (let i = 6; i >= 0; i -= 2) bytes.push(parseInt(w.slice(i, i + 2), 16));
+  if (family === 4) return bytes.join('.');
+  if (bytes.slice(0, 10).every((b) => b === 0) && bytes[10] === 0xff && bytes[11] === 0xff) {
+    return `::ffff:${bytes.slice(12).join('.')}`;
+  }
+  const groups = [];
+  for (let i = 0; i < 16; i += 2) groups.push(((bytes[i] << 8) | bytes[i + 1]).toString(16));
+  // Compress the longest run of zero groups, the way the address is written.
+  let best = [-1, 0];
+  for (let i = 0; i < 8; ) {
+    if (groups[i] !== '0') {
+      i++;
+      continue;
+    }
+    let j = i;
+    while (j < 8 && groups[j] === '0') j++;
+    if (j - i > best[1]) best = [i, j - i];
+    i = j;
+  }
+  if (best[1] < 2) return groups.join(':');
+  const head = groups.slice(0, best[0]).join(':');
+  const tail = groups.slice(best[0] + best[1]).join(':');
+  return `${head}::${tail}`;
+}
+
+function socketsOnPortLinux(worktree, port) {
+  const byInode = new Map(); // inode -> { family, addr }
+  for (const [f, family] of [
+    ['/proc/net/tcp', 4],
+    ['/proc/net/tcp6', 6],
+  ]) {
+    let text;
+    try {
+      text = readFileSync(f, 'utf8');
+    } catch {
+      continue;
+    }
+    for (const line of text.split('\n').slice(1)) {
+      const c = line.trim().split(/\s+/);
+      if (c.length < 10 || c[3] !== '0A') continue;
+      const [a, p] = String(c[1]).split(':');
+      if (parseInt(p, 16) !== port) continue;
+      if (c[9] && c[9] !== '0') byInode.set(c[9], { family, addr: hexAddr(a, family) });
+    }
+  }
+  if (byInode.size === 0) return [];
+  let root;
+  try {
+    root = realpathSync(worktree);
+  } catch {
+    return [];
+  }
+  const prefix = root.endsWith(sep) ? root : root + sep;
+  const ours = new Set();
+  let pids;
+  try {
+    pids = readdirSync('/proc').filter((d) => /^\d+$/.test(d));
+  } catch {
+    return null;
+  }
+  if (pids.length > MAX_PIDS) pids = pids.slice(0, MAX_PIDS);
+  for (const pid of pids) {
+    let cwd;
+    try {
+      cwd = readlinkSync(`/proc/${pid}/cwd`);
+    } catch {
+      continue;
+    }
+    if (cwd !== root && !cwd.startsWith(prefix)) continue;
+    if (Number(pid) === process.pid || infraPids.has(Number(pid))) continue;
+    let fds;
+    try {
+      fds = readdirSync(`/proc/${pid}/fd`);
+    } catch {
+      continue;
+    }
+    for (const fd of fds) {
+      let link;
+      try {
+        link = readlinkSync(`/proc/${pid}/fd/${fd}`);
+      } catch {
+        continue;
+      }
+      const m = /^socket:\[(\d+)\]$/.exec(link);
+      if (m && byInode.has(m[1])) ours.add(m[1]);
+    }
+  }
+  // A socket whose holder we could not read (another user's process) is
+  // FOREIGN — the safe reading for a refusal check.
+  return [...byInode.entries()].map(([inode, s]) => ({ ...s, ours: ours.has(inode) }));
+}
+
+function socketsOnPortDarwin(worktree, port) {
+  const rows = []; // { pid, family, addr }
+  let pid = null;
+  let family = null;
+  for (const line of lsof(['-nP', `-iTCP:${port}`, '-sTCP:LISTEN', '-F', 'ptn']).split('\n')) {
+    if (line.startsWith('p')) pid = line.slice(1);
+    else if (line.startsWith('t')) family = line.slice(1) === 'IPv6' ? 6 : line.slice(1) === 'IPv4' ? 4 : null;
+    else if (line.startsWith('n') && pid && family) {
+      const m = /^n(.*):(\d+)$/.exec(line);
+      if (!m || Number(m[2]) !== port) continue;
+      let addr = m[1].replace(/^\[|\]$/g, '');
+      if (addr === '*') addr = family === 6 ? '::' : '0.0.0.0';
+      rows.push({ pid, family, addr });
+    }
+  }
+  if (!rows.length) return [];
+  let root;
+  try {
+    root = realpathSync(worktree);
+  } catch {
+    return [];
+  }
+  const prefix = root.endsWith(sep) ? root : root + sep;
+  const inside = new Set();
+  const self = String(process.pid);
+  let cur = null;
+  const pids = [...new Set(rows.map((r) => r.pid))];
+  for (const line of lsof(['-a', '-d', 'cwd', '-F', 'pn', '-p', pids.join(',')]).split('\n')) {
+    if (line.startsWith('p')) cur = line.slice(1);
+    else if (line.startsWith('n') && cur) {
+      const cwd = line.slice(1);
+      if ((cwd === root || cwd.startsWith(prefix)) && cur !== self && !infraPids.has(Number(cur))) inside.add(cur);
+    }
+  }
+  return rows.map((r) => ({ family: r.family, addr: r.addr, ours: inside.has(r.pid) }));
+}

package/bin/lib/localSessions.mjs

@@ -105,7 +105,7 @@ export function titleForSession(cwd, sessionId) {
     /* the place is gone — nothing to read */
   }
   for (const dir of dirs) {
-    const file = join(projects, dir.replace(/[/.]/g, '-'), `${sessionId}.jsonl`);
+    const file = join(projects, claudeProjectDir(dir), `${sessionId}.jsonl`);
     try {
       return transcriptTitle(file, statSync(file).mtimeMs);
     } catch {
@@ -115,6 +115,27 @@ export function titleForSession(cwd, sessionId) {
   return null;
 }
 
+/**
+ * THE DIRECTORY CLAUDE CODE FILES A CWD'S TRANSCRIPTS UNDER — its own rule,
+ * copied exactly (2.1.281): every character that is not an ASCII letter or
+ * digit becomes `-`, and a name past 200 characters is cut there and suffixed
+ * with a base-36 Java-style string hash of the ORIGINAL path.
+ *
+ * This file used `replace(/[/.]/g, '-')`, which agrees with Claude Code only
+ * while a path holds nothing but letters, digits, `/` and `.` — so a repo at
+ * `~/code/my_app` or `~/My Projects/x` never offered an ended terminal session
+ * for adoption and never got a tab auto-title, silently (audit 2026-09-24).
+ */
+const CLAUDE_DIR_MAX = 200;
+export function claudeProjectDir(path) {
+  const p = String(path);
+  const s = p.replace(/[^a-zA-Z0-9]/g, '-');
+  if (s.length <= CLAUDE_DIR_MAX) return s;
+  let h = 0;
+  for (let i = 0; i < p.length; i++) h = ((h << 5) - h + p.charCodeAt(i)) | 0;
+  return `${s.slice(0, CLAUDE_DIR_MAX)}-${Math.abs(h).toString(36)}`;
+}
+
 /** Path-prefix containment on already-realpath'd absolute paths. */
 const inside = (p, root) => p === root || p.startsWith(root.endsWith('/') ? root : `${root}/`);
 
@@ -373,7 +394,7 @@ export function scanLocalSessions({ repoRoot, excludeDirs = [], excludeIds }) {
           homedir(),
           '.claude',
           'projects',
-          cwd.replace(/[/.]/g, '-'),
+          claudeProjectDir(cwd),
           `${rec.sessionId}.jsonl`
         );
         liveTitle = transcriptTitle(liveFile, statSync(liveFile).mtimeMs);
@@ -400,7 +421,11 @@ export function scanLocalSessions({ repoRoot, excludeDirs = [], excludeIds }) {
     // But so does a sibling repo ('flowviant-two' shares 'flowviant' + '-'),
     // which is why every candidate is verified against the cwd its own records
     // embed rather than trusted on its directory name.
-    const munged = realRoot.replace(/[/.]/g, '-');
+    const munged = claudeProjectDir(realRoot);
+    // A root past Claude's 200-character cut carries a hash of ITSELF, which a
+    // subdirectory's name does not share — so the prefix a subdirectory can
+    // match is the cut, and the cwd verification below does the rest.
+    const mungedStem = munged.length > CLAUDE_DIR_MAX ? munged.slice(0, CLAUDE_DIR_MAX) : `${munged}-`;
     const projectsDir = join(homedir(), '.claude', 'projects');
     let projDirs = [];
     try {
@@ -411,7 +436,7 @@ export function scanLocalSessions({ repoRoot, excludeDirs = [], excludeIds }) {
     const cutoff = Date.now() - ENDED_WINDOW_MS;
     const candidates = [];
     for (const dirName of projDirs) {
-      if (dirName !== munged && !dirName.startsWith(`${munged}-`)) continue;
+      if (dirName !== munged && !dirName.startsWith(mungedStem)) continue;
       let entries = [];
       try {
         entries = readdirSync(join(projectsDir, dirName), { withFileTypes: true });

package/bin/lib/login.mjs

@@ -7,7 +7,7 @@
  */
 
 import { FLEET_URL, USER_AGENT, VERSION } from './config.mjs';
-import { saveLogin, detectRepoRoot, projectLabel, listStoredProjects, boundElsewhere, directoryTakenRefusal } from './credentials.mjs';
+import { saveLogin, detectRepoRoot, projectLabel, safeName, listStoredProjects, boundElsewhere, directoryTakenRefusal } from './credentials.mjs';
 import { c, info, ok, warn, fail } from './ui.mjs';
 import { sleep } from './claude.mjs';
 
@@ -70,7 +70,7 @@ export async function runLogin({ thenStart = false } = {}) {
         fleetToken: poll.machineToken ?? poll.fleetToken,
         projectId: poll.projectId,
         mcpUrl: poll.mcpUrl,
-        name: typeof poll.projectName === 'string' && poll.projectName ? poll.projectName : null,
+        name: safeName(poll.projectName),
         repoRoot,
       };
       // A DIRECTORY SERVES ONE PROJECT (2026-09-23). The owner, verbatim: "a

package/bin/lib/machines.mjs

@@ -72,7 +72,8 @@
  */
 
 import { USER_AGENT } from './config.mjs';
-import { projectLabel, repoCollisions } from './credentials.mjs';
+import { projectLabel, repoCollisions, safeName } from './credentials.mjs';
+import { credentialRejected } from './authReject.mjs';
 
 /** The boxes read, derived from the roster URL the way the diffstat post is —
  *  one place configures the API base and everything else is a suffix swap. */
@@ -178,7 +179,13 @@ function roleWord(role) {
  *  does not — and the words beside it are all the server's or the box's own. */
 export function renderBox(box, { me = null, latest = null } = {}, now = Date.now()) {
   const mark = box.fresh ? '●' : '○';
-  const name = box.boxName || 'an unnamed machine';
+  // SCRUBBED HERE TOO (2026-09-24, the audit) — a belt against the server's
+  // own display scrub, in defence of a stale stored row or a server this
+  // fix has not reached: the terminal is where an escape sequence in a
+  // box's name or its checkout path actually does harm, so this is the one
+  // place it must never be trusted to have already been cleaned. See
+  // printable.mjs.
+  const name = safeName(box.boxName) ?? 'an unnamed machine';
   // "LAST heard" is the staleness mark, and the row is never hidden for it —
   // the owner's answer to "what about a box that stopped" was exactly this.
   const heard = heardPhrase(box, now);
@@ -190,7 +197,7 @@ export function renderBox(box, { me = null, latest = null } = {}, now = Date.now
   const cells = [
     `${mark} ${name}`,
     roleWord(box.role),
-    box.checkoutPath || '(checkout not reported)',
+    safeName(box.checkoutPath) ?? '(checkout not reported)',
     box.daemonVersion ? `v${box.daemonVersion}` : 'version not reported',
     heard,
   ].filter(Boolean);
@@ -223,7 +230,7 @@ export function renderMachines(entries, results, { now = Date.now() } = {}) {
   // to notice a suffix to know whether it matters has already been asked to do
   // the work this listing is for.
   for (const e of entries) {
-    const label = e.name || `project ${e.projectId.slice(0, 8)}…`;
+    const label = projectLabel(e);
     const connected = connectedOn(e.savedAt);
     const id = `(id ${e.projectId.slice(0, 8)}…${connected ? `, connected ${connected}` : ''})`;
     lines.push(
@@ -340,7 +347,8 @@ export async function fetchBoxesFor(entry, { url, envpub, fetchImpl = fetch } =
       headers: { Authorization: `Bearer ${entry.fleetToken}`, 'User-Agent': USER_AGENT },
       signal: AbortSignal.timeout(15_000),
     });
-    if (res.status === 401 || res.status === 403) return { rejected: true };
+    if (await credentialRejected(res)) return { rejected: true };
+    if (res.status === 401 || res.status === 403) return { error: `HTTP ${res.status} from something in front of the app` };
     if (res.status === 404) return { unsupported: true };
     if (!res.ok) return { error: `HTTP ${res.status}` };
     const body = await res.json();
@@ -367,7 +375,7 @@ export function otherBoxesLine(boxes, me, now = Date.now()) {
   if (others.length === 0) return null;
   const parts = others.slice(0, 6).map((b) => {
     const role = roleWord(b.role);
-    return `${b.boxName || 'an unnamed machine'} (${role ? `${role} · ` : ''}${heardPhrase(b, now)})`;
+    return `${safeName(b.boxName) ?? 'an unnamed machine'} (${role ? `${role} · ` : ''}${heardPhrase(b, now)})`;
   });
   const more = others.length - parts.length;
   return `other machines on this project: ${parts.join(', ')}${more > 0 ? `, and ${more} more` : ''}`;
@@ -403,7 +411,8 @@ export async function leaveBoxFor(entry, { url, envpub, fetchImpl = fetch } = {}
       body: JSON.stringify({ envpub }),
       signal: AbortSignal.timeout(15_000),
     });
-    if (res.status === 401 || res.status === 403) return { rejected: true };
+    if (await credentialRejected(res)) return { rejected: true };
+    if (res.status === 401 || res.status === 403) return { error: `HTTP ${res.status} from something in front of the app` };
     if (res.status === 404) return { unsupported: true };
     if (!res.ok) return { error: `HTTP ${res.status}` };
     const body = await res.json();

package/bin/lib/preview.mjs

@@ -46,7 +46,7 @@ import {
 import { join } from 'node:path';
 import { homedir, platform, arch } from 'node:os';
 import { startAuthProxy } from './authproxy.mjs';
-import { forgetInfraPid, isListening, noteInfraPid } from './listeners.mjs';
+import { forgetInfraPid, isListening, noteInfraPid, originFor } from './listeners.mjs';
 
 // ── cloudflared: pinned, verified, or not fetched at all ───────────────────
 
@@ -138,7 +138,19 @@ async function ensureCloudflared(log) {
   }
 }
 
-const TUNNEL_RE = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/i;
+/**
+ * The hostname cloudflared ASSIGNED, and nothing else it happens to print.
+ *
+ * `[a-z0-9-]+\.trycloudflare\.com` also matched cloudflared's own FAILURE line
+ * — `failed to request quick Tunnel: Post "https://api.trycloudflare.com/tunnel":
+ * dial tcp: lookup api.trycloudflare.com: …` — so on any box that could not
+ * reach the quick-tunnel API (offline, DNS failure, a proxy blocking it) the
+ * share was reported LIVE at Cloudflare's own API host, and cloudflared's real
+ * sentence, which the tail exists to relay, was replaced by a wrong one (audit
+ * 2026-09-24). `api.` is the service's endpoint and never an assigned name, and
+ * the trailing guard stops a longer hostname matching on its prefix.
+ */
+export const TUNNEL_RE = /https:\/\/(?!api\.)[a-z0-9-]+\.trycloudflare\.com(?![a-z0-9.-])/i;
 
 // ── Orphan reaping ─────────────────────────────────────────────────────────
 // cloudflared is detached so we can kill its whole group — which also means it
@@ -228,6 +240,39 @@ function mutateRegistry(fn) {
   }
 }
 
+/**
+ * WHEN a process started, as the kernel reports it — or null when this box
+ * will not say. Paired with a pid it names ONE process: a pid alone is
+ * recycled, and the owner check below trusted signal 0 on a bare pid.
+ */
+export function processStartOf(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return null;
+  if (platform() === 'linux') {
+    try {
+      const stat = readFileSync(`/proc/${pid}/stat`, 'utf8');
+      // Field 22 (starttime), counted after the LAST ')' — the comm field in
+      // parentheses may itself hold spaces and parentheses.
+      const rest = stat.slice(stat.lastIndexOf(')') + 2).split(' ');
+      return rest[19] ? `l:${rest[19]}` : null;
+    } catch {
+      return null;
+    }
+  }
+  if (platform() === 'darwin') {
+    try {
+      const out = execFileSync('ps', ['-p', String(pid), '-o', 'lstart='], {
+        encoding: 'utf8',
+        timeout: 5_000,
+        stdio: ['ignore', 'pipe', 'ignore'],
+      }).trim();
+      return out ? `d:${out}` : null;
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+
 /** Signal-0 liveness (EPERM = alive and not ours), for the OWNER check below. */
 function processAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -246,7 +291,15 @@ function recordPreviewPid(pid, sig) {
   // starting daemon reaped its PEER's live tunnels: killed them, wiped their
   // entries, and the peer kept heartbeating a URL that 530s (its probe watches
   // the origin port, which was still alive).
-  mutateRegistry((list) => [...list, { pid, sig, owner: process.pid }]);
+  //
+  // `ownerStart` pins the owner to ONE process (audit 2026-09-24). A daemon that
+  // is SIGKILLed with a share open leaves cloudflared up; if its pid is reused
+  // by the next start — any process, another user's included, since EPERM
+  // counts as alive — a pid-only check read the entry as a live peer's and
+  // skipped it forever, leaving a public hostname aimed at a dead gate's
+  // ephemeral port for anything that binds it next.
+  const ownerStart = processStartOf(process.pid);
+  mutateRegistry((list) => [...list, { pid, sig, owner: process.pid, ...(ownerStart ? { ownerStart } : {}) }]);
 }
 
 function forgetPreviewPid(pid) {
@@ -311,13 +364,24 @@ function stillOurs(pid, sig) {
  *  own teardown handles it) — killing those and wiping their entries was a
  *  peer daemon's startup silently breaking every live share on the box. Only
  *  the entries this pass handled are removed; a peer's records survive. */
+/** Is the daemon that recorded an entry still the process at that pid? With
+ *  a recorded start time, only when the pid's start time still matches (a
+ *  recycled pid is an orphaned entry); where this box cannot report a start
+ *  time now, or the entry predates the field, signal 0 is all there is. */
+function ownerStillRunning(owner, ownerStart) {
+  if (!processAlive(owner)) return false;
+  if (typeof ownerStart !== 'string') return true;
+  const now = processStartOf(owner);
+  return now == null ? true : now === ownerStart;
+}
+
 export function reapOrphanPreviews(log) {
   const list = readRegistry();
   if (list.length === 0) return;
   let killed = 0;
   const handled = new Set();
-  for (const { pid, sig, owner } of list) {
-    if (Number.isInteger(owner) && owner !== process.pid && processAlive(owner)) continue;
+  for (const { pid, sig, owner, ownerStart } of list) {
+    if (Number.isInteger(owner) && owner !== process.pid && ownerStillRunning(owner, ownerStart)) continue;
     const ours = stillOurs(pid, sig);
     /**
      * THE RECORD OUTLIVES A REAP THAT COULD NOT LOOK. `handled.add` ran BEFORE
@@ -396,6 +460,11 @@ export async function openTunnel({
   onAbuse,
   onTunnelGone,
   stillServing,
+  // The worktree the port was attributed to. When given, the gate dials the
+  // address the ATTRIBUTED socket holds (`originFor`) rather than assuming
+  // 127.0.0.1, and every liveness check re-derives it — so a neighbour on the
+  // other loopback family is never what the tunnel publishes.
+  worktree,
   probeMs = 20_000,
   // The members-gate triple, all three or none. Absent = an older server, or a
   // password-mode share: the gate runs exactly as it always has.
@@ -406,8 +475,15 @@ export async function openTunnel({
   // ONE predicate for every liveness question this function asks. Attribution
   // when the caller gave it, a bare TCP connect only when it did not; an
   // attribution check that errors is not a "yes".
+  // `origin` is decided once, at the gate's start; after that a change of
+  // address is a different process and reads as "not serving".
+  let origin = null;
   const serving = async () => {
     try {
+      if (worktree) {
+        const o = originFor(worktree, port);
+        if (o.error || (origin && o.host !== origin)) return false;
+      }
       return stillServing ? await stillServing() : await isListening(port);
     } catch {
       return false;
@@ -455,8 +531,14 @@ export async function openTunnel({
 
   // The gate comes up FIRST and the tunnel points at it, never at the origin —
   // so there is no window in which the public hostname is un-gated.
+  if (worktree) {
+    const o = originFor(worktree, port);
+    if (o.error) return { error: o.error };
+    origin = o.host;
+  }
   gate = await startAuthProxy({
     targetPort: port,
+    ...(origin ? { targetHost: origin } : {}),
     log,
     // Never logged, never written to previews.json, never in the reap
     // signature, never in argv or a child env — /proc/<pid>/cmdline is
@@ -529,7 +611,14 @@ export async function openTunnel({
     const onOut = (d) => {
       const s = d.toString();
       tail = (tail + s).slice(-TAIL_BYTES);
-      const m = TUNNEL_RE.exec(s);
+      // ONE URL, ONE PROBE. A second match after we settled (cloudflared
+      // repeats the banner, or a later line names another host) used to start
+      // a second probe interval and a second close listener on a tunnel whose
+      // answer had already been given.
+      if (settled) return;
+      // Matched over the TAIL, not the chunk: a pipe read can split the
+      // hostname across two chunks, and a half never matches.
+      const m = TUNNEL_RE.exec(tail);
       if (!m) return;
 
       // Watch the ORIGIN — with the caller's ATTRIBUTION check when it gave

package/bin/lib/printable.mjs

@@ -0,0 +1,42 @@
+/**
+ * PRINTABLE(): the CLI's own belt against a server-supplied string it is
+ * about to write to a TTY (2026-09-24, the audit's A3 CROSS 8a).
+ *
+ * `safeName` (credentials.mjs) already stripped C0/DEL/C1 for the same reason
+ * the server's own `parseBoxName`/`parseCheckoutPath` did — an escape
+ * sequence in a project or box name can clear the screen or, via OSC 52,
+ * rewrite the terminal's clipboard — but it stopped at C1 and never scrubbed
+ * the BIDI/format controls (U+200E/U+200F, U+202A–U+202E, U+2066–U+2069) that
+ * reorder a line to hide or forge part of it: a box named
+ * `evil‮txt.crt⁦` reads backwards on a bidi-aware terminal, so
+ * "evil" can visually swap places with an extension that was never there.
+ *
+ * THIS IS A LEAF MODULE ON PURPOSE. `machines.mjs` and `fleet.mjs` both need
+ * it, `machines.mjs` deliberately imports nothing from `fleet.mjs`'s world
+ * (its own header explains why: it runs before the auth gate, like `stop` and
+ * `projects`, and must not pull in the daemon's whole CLI/worktree
+ * machinery), and `credentials.mjs` is where `safeName` already lived. A leaf
+ * with zero imports is the one shape both can depend on without adding an
+ * edge neither wants.
+ *
+ * THE CHARACTER CLASS IS THE SERVER'S OWN (`stripDisplayControl`,
+ * machineBoxes.ts, 2026-09-24) — copied rather than re-derived, because the
+ * point of a BELT is that the two ends agree about what counts as printable
+ * without either one trusting the other to have applied it. The server scrub
+ * is the primary fix (it is what a stale stored row, upserted before this
+ * belt existed, is read back through); this is defence in depth, because the
+ * terminal is where the harm happens and the CLI should not trust that every
+ * string on the wire already passed through it — including a project's own
+ * `name`, which reaches every terminal that connects a machine (`login`, the
+ * banner, the picker, `projects`, `machines`) and had no scrub at all before
+ * `safeName`.
+ */
+// eslint-disable-next-line no-control-regex
+const DISPLAY_CONTROL = /[\u0000-\u001f\u007f-\u009f‎‏‪-‮⁦-⁩]/g;
+
+/** Strip the class above. Non-strings pass through unchanged — this is a
+ *  scrub, not a coercion, and a caller that hands it `undefined` should get
+ *  `undefined` back rather than the string `"undefined"`. */
+export function printable(raw) {
+  return typeof raw === 'string' ? raw.replace(DISPLAY_CONTROL, '') : raw;
+}

package/bin/lib/procRegistry.mjs

@@ -17,6 +17,8 @@
  *    does not become a file nobody can read.
  */
 
+import { execFileSync } from 'node:child_process';
+import { platform, uptime } from 'node:os';
 import {
   closeSync,
   mkdirSync,
@@ -95,6 +97,69 @@ export function writeRegistry(dir, path, list) {
   }
 }
 
+/**
+ * WHICH BOOT THIS IS — so a pid or process-group id read back off disk is only
+ * ever believed in the boot that wrote it.
+ *
+ * A registry outlives a reboot and pids do not: after one, the number a file
+ * remembers belongs to whatever the kernel handed it to next — another user's
+ * service, the operator's shell — and signal-0 says "alive" about a stranger.
+ * Linux names the boot outright (`boot_id`); elsewhere the boot INSTANT stands
+ * in, derived from the uptime and compared with slack, because two reads a
+ * second apart disagree by the rounding.
+ */
+const BOOT_SLACK_S = 120;
+export function bootMark() {
+  try {
+    const id = readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim();
+    if (id) return id;
+  } catch {
+    /* not Linux, or /proc is not mounted */
+  }
+  return `bt:${Math.round(Date.now() / 1000 - uptime())}`;
+}
+/** Was `mark` written during this boot? An absent mark is NOT this boot —
+ *  an entry that cannot say when it was written cannot be trusted across one. */
+export function sameBoot(mark, now = bootMark()) {
+  if (typeof mark !== 'string' || !mark) return false;
+  if (mark.startsWith('bt:') && now.startsWith('bt:'))
+    return Math.abs(Number(mark.slice(3)) - Number(now.slice(3))) <= BOOT_SLACK_S;
+  return mark === now;
+}
+
+/**
+ * WHEN A PROCESS STARTED, as an opaque token — so a lock that remembers a pid
+ * can tell the process it meant from one that inherited the number.
+ *
+ * Linux: field 22 of `/proc/<pid>/stat` (start time in clock ticks since boot),
+ * read after the LAST `)` because the comm field may itself contain one.
+ * macOS: `ps -o lstart=`. Null when it cannot be read, which callers treat as
+ * "cannot tell" — never as a mismatch.
+ */
+export function processStartTime(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return null;
+  try {
+    const stat = readFileSync(`/proc/${pid}/stat`, 'utf8');
+    const rest = stat.slice(stat.lastIndexOf(')') + 2).split(' ');
+    // `rest[0]` is field 3 (state), so field 22 is rest[19].
+    const st = rest[19];
+    return st && /^\d+$/.test(st) ? `${bootMark()}:${st}` : null;
+  } catch {
+    /* not Linux, or the pid is gone */
+  }
+  if (platform() !== 'darwin') return null;
+  try {
+    const out = execFileSync('ps', ['-o', 'lstart=', '-p', String(pid)], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 5_000,
+    }).trim();
+    return out || null;
+  } catch {
+    return null;
+  }
+}
+
 /** Signal-0 liveness. EPERM means alive and not ours, which is still alive. */
 export function processAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;