webmux 0.33.0 → 0.34.0

package/bin/webmux.js

@@ -2719,14 +2719,255 @@ ${result.stderr.trim()}` : ""
   console.log();
 });
 
+// backend/src/lib/log.ts
+function ts() {
+  return new Date().toISOString().slice(11, 23);
+}
+var DEBUG, log;
+var init_log = __esm(() => {
+  DEBUG = Bun.env.WEBMUX_DEBUG === "1";
+  log = {
+    info(msg) {
+      console.log(`[${ts()}] ${msg}`);
+    },
+    debug(msg) {
+      if (DEBUG)
+        console.log(`[${ts()}] ${msg}`);
+    },
+    warn(msg) {
+      console.warn(`[${ts()}] ${msg}`);
+    },
+    error(msg, err) {
+      err !== undefined ? console.error(`[${ts()}] ${msg}`, err) : console.error(`[${ts()}] ${msg}`);
+    }
+  };
+});
+
+// backend/src/domain/policies.ts
+function sanitizeBranchName(raw) {
+  return raw.toLowerCase().replace(/\s+/g, "-").replace(INVALID_BRANCH_CHARS_RE, "").replace(/@\{/g, "").replace(/\.{2,}/g, ".").replace(/\/{2,}/g, "/").replace(/-{2,}/g, "-").replace(/^[.\-/]+|[.\-/]+$/g, "").replace(/\.lock$/i, "");
+}
+function isValidBranchName(raw) {
+  return raw.length > 0 && sanitizeBranchName(raw) === raw;
+}
+function isValidWorktreeName(name) {
+  return name.length > 0 && VALID_WORKTREE_NAME_RE.test(name) && !name.includes("..");
+}
+function isValidEnvKey(key) {
+  return UNSAFE_ENV_KEY_RE.test(key);
+}
+function isValidInstancePrefix(value) {
+  return VALID_INSTANCE_PREFIX_RE.test(value) && !RESERVED_INSTANCE_PREFIXES.has(value);
+}
+function allocateServicePorts(existingMetas, services) {
+  const allocatable = services.filter((service) => service.portStart != null);
+  if (allocatable.length === 0)
+    return {};
+  const reference = allocatable[0];
+  const referenceStart = reference.portStart;
+  const referenceStep = reference.portStep ?? 1;
+  const occupiedSlots = new Set;
+  for (const meta of existingMetas) {
+    const port = meta.allocatedPorts[reference.portEnv];
+    if (!Number.isInteger(port) || port < referenceStart)
+      continue;
+    const diff = port - referenceStart;
+    if (diff % referenceStep !== 0)
+      continue;
+    occupiedSlots.add(diff / referenceStep);
+  }
+  let slot = 1;
+  while (occupiedSlots.has(slot))
+    slot += 1;
+  const result = {};
+  for (const service of allocatable) {
+    const start = service.portStart;
+    const step = service.portStep ?? 1;
+    result[service.portEnv] = start + slot * step;
+  }
+  return result;
+}
+var INVALID_BRANCH_CHARS_RE, UNSAFE_ENV_KEY_RE, VALID_WORKTREE_NAME_RE, VALID_INSTANCE_PREFIX_RE, RESERVED_INSTANCE_PREFIXES;
+var init_policies = __esm(() => {
+  INVALID_BRANCH_CHARS_RE = /[~^:?*\[\]\\]+/g;
+  UNSAFE_ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+  VALID_WORKTREE_NAME_RE = /^[a-z0-9][a-z0-9\-_./]*$/;
+  VALID_INSTANCE_PREFIX_RE = /^[a-z0-9][a-z0-9\-]*$/;
+  RESERVED_INSTANCE_PREFIXES = new Set(["api", "ws", "assets"]);
+});
+
+// backend/src/adapters/instance-registry.ts
+import { mkdirSync, readdirSync as readdirSync2, readFileSync as readFileSync3, renameSync, unlinkSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { join as join5 } from "path";
+function defaultRegistryDir() {
+  return join5(homedir(), ".webmux", "instances");
+}
+function isAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err?.code !== "ESRCH";
+  }
+}
+function isInstanceEntry(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const v2 = value;
+  return typeof v2.prefix === "string" && isValidInstancePrefix(v2.prefix) && typeof v2.port === "number" && typeof v2.projectDir === "string" && typeof v2.pid === "number" && typeof v2.startedAt === "number";
+}
+function createInstanceRegistry(dir = defaultRegistryDir()) {
+  function ensureDir() {
+    mkdirSync(dir, { recursive: true });
+  }
+  function entryPath(port) {
+    return join5(dir, `${port}.json`);
+  }
+  function readEntry(filename) {
+    try {
+      const raw = readFileSync3(join5(dir, filename), "utf8");
+      const parsed = JSON.parse(raw);
+      return isInstanceEntry(parsed) ? parsed : null;
+    } catch {
+      return null;
+    }
+  }
+  return {
+    register(entry) {
+      ensureDir();
+      const finalPath = entryPath(entry.port);
+      const tmpPath = `${finalPath}.${process.pid}.${Date.now()}.tmp`;
+      const text = `${JSON.stringify(entry, null, 2)}
+`;
+      writeFileSync(tmpPath, text);
+      renameSync(tmpPath, finalPath);
+    },
+    deregister(port, expectedPid) {
+      if (expectedPid !== undefined) {
+        const filename = `${port}.json`;
+        const entry = readEntry(filename);
+        if (entry && entry.pid !== expectedPid) {
+          return;
+        }
+      }
+      try {
+        unlinkSync(entryPath(port));
+      } catch (err) {
+        const code = err?.code;
+        if (code !== "ENOENT") {
+          log.debug(`[instance-registry] deregister(${port}) failed: ${String(err)}`);
+        }
+      }
+    },
+    listLive() {
+      let filenames;
+      try {
+        filenames = readdirSync2(dir).filter((name) => name.endsWith(".json"));
+      } catch {
+        return [];
+      }
+      const live = [];
+      for (const filename of filenames) {
+        const entry = readEntry(filename);
+        if (!entry)
+          continue;
+        if (!isAlive(entry.pid)) {
+          try {
+            unlinkSync(join5(dir, filename));
+          } catch {}
+          continue;
+        }
+        live.push(entry);
+      }
+      return live;
+    }
+  };
+}
+var init_instance_registry = __esm(() => {
+  init_log();
+  init_policies();
+});
+
+// bin/src/install-ports.ts
+import { existsSync as existsSync4, readdirSync as readdirSync3, readFileSync as readFileSync4 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join6 } from "path";
+function pickFreePort(start, taken) {
+  const set = new Set(taken);
+  let port = start;
+  while (set.has(port))
+    port += 1;
+  return port;
+}
+function readInstalledServicePorts(opts = {}) {
+  const systemdDir = opts.systemdDir ?? DEFAULT_SYSTEMD_DIR;
+  const launchdDir = opts.launchdDir ?? DEFAULT_LAUNCHD_DIR;
+  const ports = [];
+  function collect(dir, namePredicate) {
+    if (!existsSync4(dir))
+      return;
+    let names;
+    try {
+      names = readdirSync3(dir);
+    } catch {
+      return;
+    }
+    for (const name of names) {
+      if (!namePredicate(name))
+        continue;
+      const full = join6(dir, name);
+      if (opts.excludePath && full === opts.excludePath)
+        continue;
+      const port = readPortFromUnit(full);
+      if (port !== null)
+        ports.push(port);
+    }
+  }
+  collect(systemdDir, (n) => n.startsWith("webmux-") && n.endsWith(".service"));
+  collect(launchdDir, (n) => n.startsWith("com.webmux.") && n.endsWith(".plist"));
+  return ports;
+}
+function readPortFromUnit(filePath) {
+  let text;
+  try {
+    text = readFileSync4(filePath, "utf8");
+  } catch {
+    return null;
+  }
+  const regex = filePath.endsWith(".plist") ? LAUNCHD_PORT_RE : SYSTEMD_PORT_RE;
+  const match = regex.exec(text);
+  return match ? parseInt(match[1], 10) : null;
+}
+function discoverTakenPorts(opts = {}) {
+  const registry = createInstanceRegistry(opts.registryDir);
+  const live = registry.listLive().map((entry) => entry.port);
+  const installed = readInstalledServicePorts({
+    systemdDir: opts.systemdDir,
+    launchdDir: opts.launchdDir,
+    excludePath: opts.excludeUnitPath
+  });
+  return new Set([...live, ...installed]);
+}
+var DEFAULT_SYSTEMD_DIR, DEFAULT_LAUNCHD_DIR, SYSTEMD_PORT_RE, LAUNCHD_PORT_RE;
+var init_install_ports = __esm(() => {
+  init_instance_registry();
+  DEFAULT_SYSTEMD_DIR = join6(homedir2(), ".config", "systemd", "user");
+  DEFAULT_LAUNCHD_DIR = join6(homedir2(), "Library", "LaunchAgents");
+  SYSTEMD_PORT_RE = /--port\s+(\d+)/;
+  LAUNCHD_PORT_RE = /<string>--port<\/string>\s*<string>(\d+)<\/string>/;
+});
+
 // bin/src/service.ts
 var exports_service = {};
 __export(exports_service, {
+  parseInstalledServiceConfig: () => parseInstalledServiceConfig,
+  generateServiceFile: () => generateServiceFile,
   default: () => service
 });
-import { existsSync as existsSync4, mkdirSync, unlinkSync } from "fs";
-import { join as join5 } from "path";
-import { homedir } from "os";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync5, unlinkSync as unlinkSync2 } from "fs";
+import { basename as basename3, join as join7 } from "path";
+import { homedir as homedir3 } from "os";
 function getPlatform() {
   const plat = process.platform;
   if (plat === "linux" || plat === "darwin")
@@ -2755,10 +2996,10 @@ function printRunResult(result) {
     console.error(err);
 }
 function systemdUnitPath(serviceName) {
-  return join5(homedir(), ".config", "systemd", "user", `${serviceName}.service`);
+  return join7(homedir3(), ".config", "systemd", "user", `${serviceName}.service`);
 }
 function launchdPlistPath(serviceName) {
-  return join5(homedir(), "Library", "LaunchAgents", `com.webmux.${serviceName}.plist`);
+  return join7(homedir3(), "Library", "LaunchAgents", `com.webmux.${serviceName}.plist`);
 }
 function serviceFilePath(config) {
   if (config.platform === "linux")
@@ -2784,7 +3025,7 @@ WantedBy=default.target
 `;
 }
 function generateLaunchdPlist(config) {
-  const logPath = join5(homedir(), "Library", "Logs", `webmux-${config.serviceName}.log`);
+  const logPath = join7(homedir3(), "Library", "Logs", `webmux-${config.serviceName}.log`);
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -2829,6 +3070,36 @@ function generateServiceFile(config) {
     return generateSystemdUnit(config);
   return generateLaunchdPlist(config);
 }
+function readWorkingDirFromUnit(filePath, platform) {
+  let text;
+  try {
+    text = readFileSync5(filePath, "utf8");
+  } catch {
+    return null;
+  }
+  const regex = platform === "linux" ? SYSTEMD_WORKDIR_RE : LAUNCHD_WORKDIR_RE;
+  const match = regex.exec(text);
+  return match ? match[1].trim() : null;
+}
+function parseInstalledServiceConfig(filePath, platform, webmuxPath) {
+  const port = readPortFromUnit(filePath);
+  if (port === null)
+    return null;
+  const projectDir = readWorkingDirFromUnit(filePath, platform);
+  if (projectDir === null)
+    return null;
+  const fileBase = basename3(filePath);
+  const serviceName = platform === "linux" ? fileBase.replace(/\.service$/, "") : fileBase.replace(/^com\.webmux\./, "").replace(/\.plist$/, "");
+  const projectName = detectProjectName(projectDir);
+  return {
+    platform,
+    projectName,
+    serviceName,
+    webmuxPath,
+    projectDir,
+    port
+  };
+}
 function installCommands(config) {
   if (config.platform === "linux") {
     return [
@@ -2852,11 +3123,12 @@ function uninstallCommands(config) {
   ];
 }
 function isInstalled(config) {
-  return existsSync4(serviceFilePath(config));
+  return existsSync5(serviceFilePath(config));
 }
-async function install(config) {
+async function install(config, portExplicit) {
   const filePath = serviceFilePath(config);
-  if (isInstalled(config)) {
+  const alreadyInstalled = isInstalled(config);
+  if (alreadyInstalled) {
     const reinstall = await ue({ message: "Service is already installed. Reinstall?" });
     if (q(reinstall) || !reinstall) {
       R2.info("Aborted.");
@@ -2866,6 +3138,31 @@ async function install(config) {
       runCommand(cmd);
     }
   }
+  const requestedPort = config.port;
+  let chosenPort = requestedPort;
+  let portNote = null;
+  let portWarning = null;
+  if (!portExplicit) {
+    const existingPort = alreadyInstalled ? readPortFromUnit(filePath) : null;
+    if (existingPort !== null) {
+      chosenPort = existingPort;
+      if (existingPort !== requestedPort) {
+        portNote = `Reusing port ${existingPort} from the existing service unit (pass --port to override).`;
+      }
+    } else {
+      const taken = discoverTakenPorts({ excludeUnitPath: filePath });
+      chosenPort = pickFreePort(requestedPort, taken);
+      if (chosenPort !== requestedPort) {
+        portNote = `Port ${requestedPort} is already used by another webmux instance \u2014 picked ${chosenPort} instead (pass --port to override).`;
+      }
+    }
+  } else {
+    const taken = discoverTakenPorts({ excludeUnitPath: filePath });
+    if (taken.has(requestedPort)) {
+      portWarning = `Port ${requestedPort} is already claimed by another webmux instance. The service will fail to bind on start; omit --port to auto-pick a free port.`;
+    }
+  }
+  config = { ...config, port: chosenPort };
   const content = generateServiceFile(config);
   const commands = installCommands(config);
   Se([
@@ -2877,12 +3174,16 @@ async function install(config) {
     ...commands.map((c) => `  $ ${formatCommand(c)}`)
   ].join(`
 `), "Install service");
+  if (portNote)
+    R2.info(portNote);
+  if (portWarning)
+    R2.warn(portWarning);
   const ok = await ue({ message: "Proceed?" });
   if (q(ok) || !ok) {
     R2.info("Aborted.");
     return;
   }
-  mkdirSync(filePath.substring(0, filePath.lastIndexOf("/")), { recursive: true });
+  mkdirSync2(filePath.substring(0, filePath.lastIndexOf("/")), { recursive: true });
   await Bun.write(filePath, content);
   R2.success(`Wrote ${filePath}`);
   for (const cmd of commands) {
@@ -2932,7 +3233,7 @@ ${result.stderr.toString()}`);
       R2.success(`$ ${formatCommand(cmd)}`);
     }
   }
-  unlinkSync(filePath);
+  unlinkSync2(filePath);
   R2.success(`Removed ${filePath}`);
   R2.success("Service uninstalled.");
 }
@@ -2956,8 +3257,8 @@ function logs(config) {
   if (config.platform === "linux") {
     proc = Bun.spawn(["journalctl", "--user", "-u", config.serviceName, "-f", "--no-pager"], { stdout: "inherit", stderr: "inherit" });
   } else {
-    const logPath = join5(homedir(), "Library", "Logs", `webmux-${config.serviceName}.log`);
-    if (!existsSync4(logPath)) {
+    const logPath = join7(homedir3(), "Library", "Logs", `webmux-${config.serviceName}.log`);
+    if (!existsSync5(logPath)) {
       R2.error(`Log file not found: ${logPath}`);
       return;
     }
@@ -2978,6 +3279,12 @@ Usage:
   webmux service uninstall   Stop, disable, and remove the service
   webmux service status      Show service status
   webmux service logs        Tail service logs
+
+Options:
+  --port N                   Pin the service to a specific port. When omitted,
+                             a free port is picked automatically by scanning
+                             other webmux instances and installed services
+                             \u2014 second-project installs no longer collide on 5111.
 `);
 }
 async function service(args) {
@@ -3013,6 +3320,7 @@ async function service(args) {
     return;
   }
   let port = parseInt(process.env.PORT || "5111");
+  let portExplicit = false;
   for (let i = 1;i < args.length; i++) {
     if (args[i] === "--port" && args[i + 1]) {
       const parsed = parseInt(args[++i]);
@@ -3021,6 +3329,7 @@ async function service(args) {
         return;
       }
       port = parsed;
+      portExplicit = true;
     }
   }
   const projectName = detectProjectName(gitRoot2);
@@ -3035,7 +3344,7 @@ async function service(args) {
   };
   switch (action) {
     case "install":
-      await install(config);
+      await install(config, portExplicit);
       break;
     case "uninstall":
       await uninstall(config);
@@ -3048,9 +3357,141 @@ async function service(args) {
       break;
   }
 }
+var SYSTEMD_WORKDIR_RE, LAUNCHD_WORKDIR_RE;
 var init_service = __esm(() => {
   init_dist4();
   init_shared();
+  init_install_ports();
+  SYSTEMD_WORKDIR_RE = /^WorkingDirectory=(.+)$/m;
+  LAUNCHD_WORKDIR_RE = /<key>WorkingDirectory<\/key>\s*<string>([^<]+)<\/string>/;
+});
+
+// bin/src/service-restart.ts
+var exports_service_restart = {};
+__export(exports_service_restart, {
+  updateInstalledService: () => updateInstalledService,
+  restartInstalledService: () => restartInstalledService,
+  restartCommand: () => restartCommand,
+  listInstalledServices: () => listInstalledServices
+});
+import { existsSync as existsSync6, readdirSync as readdirSync4, readFileSync as readFileSync6 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join8 } from "path";
+function listInstalledServices(opts = {}) {
+  const out = [];
+  const systemdDir = opts.systemdDir ?? DEFAULT_SYSTEMD_DIR2;
+  const launchdDir = opts.launchdDir ?? DEFAULT_LAUNCHD_DIR2;
+  if (existsSync6(systemdDir)) {
+    try {
+      for (const name of readdirSync4(systemdDir)) {
+        if (!name.startsWith("webmux-") || !name.endsWith(".service"))
+          continue;
+        out.push({
+          name: name.slice(0, -".service".length),
+          filePath: join8(systemdDir, name),
+          platform: "linux"
+        });
+      }
+    } catch {}
+  }
+  if (existsSync6(launchdDir)) {
+    try {
+      for (const name of readdirSync4(launchdDir)) {
+        if (!name.startsWith("com.webmux.") || !name.endsWith(".plist"))
+          continue;
+        out.push({
+          name: name.slice(0, -".plist".length),
+          filePath: join8(launchdDir, name),
+          platform: "darwin"
+        });
+      }
+    } catch {}
+  }
+  return out;
+}
+function restartCommand(service2, uid) {
+  if (service2.platform === "linux") {
+    return { bin: "systemctl", args: ["--user", "restart", service2.name] };
+  }
+  return { bin: "launchctl", args: ["kickstart", "-k", `gui/${uid}/${service2.name}`] };
+}
+function restartInstalledService(service2, runner = defaultRunner) {
+  const uid = typeof process.getuid === "function" ? process.getuid() : 0;
+  const { bin, args } = restartCommand(service2, uid);
+  const result = runner.run(bin, args);
+  if (!result.success) {
+    return {
+      service: service2,
+      ok: false,
+      error: result.stderr.toString().trim() || `${bin} ${args.join(" ")} failed`
+    };
+  }
+  return { service: service2, ok: true };
+}
+function reloadAfterRegenerate(service2, runner) {
+  if (service2.platform === "linux") {
+    const result = runner.run("systemctl", ["--user", "daemon-reload"]);
+    return result.success ? { ok: true } : { ok: false, error: result.stderr.toString().trim() || "daemon-reload failed" };
+  }
+  runner.run("launchctl", ["unload", service2.filePath]);
+  const loadResult = runner.run("launchctl", ["load", "-w", service2.filePath]);
+  if (loadResult.success)
+    return { ok: true };
+  const stderr = loadResult.stderr.toString().trim() || "load failed";
+  return {
+    ok: false,
+    error: `${stderr}
+  service is now unloaded \u2014 recover with: launchctl load -w "${service2.filePath}"`
+  };
+}
+async function updateInstalledService(service2, webmuxPath, runner = defaultRunner) {
+  const canRegenerate = webmuxPath.length > 0;
+  const config = canRegenerate ? parseInstalledServiceConfig(service2.filePath, service2.platform, webmuxPath) : null;
+  let regenerated = false;
+  if (config !== null) {
+    let currentContent = "";
+    try {
+      currentContent = readFileSync6(service2.filePath, "utf8");
+    } catch {}
+    const expected = generateServiceFile(config);
+    if (currentContent !== expected) {
+      try {
+        await Bun.write(service2.filePath, expected);
+        regenerated = true;
+      } catch (err) {
+        return {
+          service: service2,
+          regenerated: false,
+          restarted: false,
+          error: `could not rewrite ${service2.filePath}: ${String(err)}`
+        };
+      }
+    }
+  }
+  if (regenerated) {
+    const reload = reloadAfterRegenerate(service2, runner);
+    if (!reload.ok) {
+      return { service: service2, regenerated, restarted: false, error: reload.error };
+    }
+    if (service2.platform === "darwin") {
+      return { service: service2, regenerated, restarted: true };
+    }
+  }
+  const outcome = restartInstalledService(service2, runner);
+  return {
+    service: service2,
+    regenerated,
+    restarted: outcome.ok,
+    error: outcome.error
+  };
+}
+var defaultRunner, DEFAULT_SYSTEMD_DIR2, DEFAULT_LAUNCHD_DIR2;
+var init_service_restart = __esm(() => {
+  init_shared();
+  init_service();
+  defaultRunner = { run };
+  DEFAULT_SYSTEMD_DIR2 = join8(homedir4(), ".config", "systemd", "user");
+  DEFAULT_LAUNCHD_DIR2 = join8(homedir4(), "Library", "LaunchAgents");
 });
 
 // node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
@@ -8221,30 +8662,6 @@ var init_src = __esm(() => {
   init_schemas();
 });
 
-// backend/src/lib/log.ts
-function ts() {
-  return new Date().toISOString().slice(11, 23);
-}
-var DEBUG, log;
-var init_log = __esm(() => {
-  DEBUG = Bun.env.WEBMUX_DEBUG === "1";
-  log = {
-    info(msg) {
-      console.log(`[${ts()}] ${msg}`);
-    },
-    debug(msg) {
-      if (DEBUG)
-        console.log(`[${ts()}] ${msg}`);
-    },
-    warn(msg) {
-      console.warn(`[${ts()}] ${msg}`);
-    },
-    error(msg, err) {
-      err !== undefined ? console.error(`[${ts()}] ${msg}`, err) : console.error(`[${ts()}] ${msg}`);
-    }
-  };
-});
-
 // backend/src/services/linear-service.ts
 function gqlErrorMessage(raw) {
   return raw.errors && raw.errors.length > 0 ? raw.errors.map((error) => error.message).join("; ") : null;
@@ -9562,7 +9979,7 @@ var WORKTREE_META_SCHEMA_VERSION = 1, WORKTREE_ARCHIVE_STATE_VERSION = 1;
 
 // backend/src/adapters/fs.ts
 import { mkdir } from "fs/promises";
-import { join as join6 } from "path";
+import { join as join9 } from "path";
 function stringifyAllocatedPorts(ports) {
   const entries = Object.entries(ports).map(([key, value]) => [key, String(value)]);
   return Object.fromEntries(entries);
@@ -9594,25 +10011,25 @@ function parseDotenv(content) {
 }
 async function loadDotenvLocal(worktreePath) {
   try {
-    const content = await Bun.file(join6(worktreePath, ".env.local")).text();
+    const content = await Bun.file(join9(worktreePath, ".env.local")).text();
     return parseDotenv(content);
   } catch {
     return {};
   }
 }
 function getWorktreeStoragePaths(gitDir) {
-  const webmuxDir = join6(gitDir, "webmux");
+  const webmuxDir = join9(gitDir, "webmux");
   return {
     gitDir,
     webmuxDir,
-    metaPath: join6(webmuxDir, "meta.json"),
-    runtimeEnvPath: join6(webmuxDir, "runtime.env"),
-    controlEnvPath: join6(webmuxDir, "control.env"),
-    prsPath: join6(webmuxDir, "prs.json")
+    metaPath: join9(webmuxDir, "meta.json"),
+    runtimeEnvPath: join9(webmuxDir, "runtime.env"),
+    controlEnvPath: join9(webmuxDir, "control.env"),
+    prsPath: join9(webmuxDir, "prs.json")
   };
 }
 function getProjectArchiveStatePath(gitDir) {
-  return join6(gitDir, "webmux", "archive.json");
+  return join9(gitDir, "webmux", "archive.json");
 }
 async function ensureWorktreeStorageDirs(gitDir) {
   const paths = getWorktreeStoragePaths(gitDir);
@@ -9781,7 +10198,7 @@ var init_fs = __esm(() => {
 
 // backend/src/adapters/tmux.ts
 import { createHash } from "crypto";
-import { basename as basename3, resolve as resolve3 } from "path";
+import { basename as basename4, resolve as resolve3 } from "path";
 function runTmux(args) {
   const result = Bun.spawnSync(["tmux", ...args], {
     stdout: "pipe",
@@ -9810,7 +10227,7 @@ function sanitizeTmuxNameSegment(value, maxLength = 24) {
 }
 function buildProjectSessionName(projectRoot) {
   const resolved = resolve3(projectRoot);
-  const base = sanitizeTmuxNameSegment(basename3(resolved), 18);
+  const base = sanitizeTmuxNameSegment(basename4(resolved), 18);
   const hash = createHash("sha1").update(resolved).digest("hex").slice(0, 8);
   return `wm-${base}-${hash}`;
 }
@@ -9885,55 +10302,6 @@ class BunTmuxGateway {
 }
 var init_tmux = () => {};
 
-// backend/src/domain/policies.ts
-function sanitizeBranchName(raw) {
-  return raw.toLowerCase().replace(/\s+/g, "-").replace(INVALID_BRANCH_CHARS_RE, "").replace(/@\{/g, "").replace(/\.{2,}/g, ".").replace(/\/{2,}/g, "/").replace(/-{2,}/g, "-").replace(/^[.\-/]+|[.\-/]+$/g, "").replace(/\.lock$/i, "");
-}
-function isValidBranchName(raw) {
-  return raw.length > 0 && sanitizeBranchName(raw) === raw;
-}
-function isValidWorktreeName(name) {
-  return name.length > 0 && VALID_WORKTREE_NAME_RE.test(name) && !name.includes("..");
-}
-function isValidEnvKey(key) {
-  return UNSAFE_ENV_KEY_RE.test(key);
-}
-function allocateServicePorts(existingMetas, services) {
-  const allocatable = services.filter((service2) => service2.portStart != null);
-  if (allocatable.length === 0)
-    return {};
-  const reference = allocatable[0];
-  const referenceStart = reference.portStart;
-  const referenceStep = reference.portStep ?? 1;
-  const occupiedSlots = new Set;
-  for (const meta of existingMetas) {
-    const port = meta.allocatedPorts[reference.portEnv];
-    if (!Number.isInteger(port) || port < referenceStart)
-      continue;
-    const diff = port - referenceStart;
-    if (diff % referenceStep !== 0)
-      continue;
-    occupiedSlots.add(diff / referenceStep);
-  }
-  let slot = 1;
-  while (occupiedSlots.has(slot))
-    slot += 1;
-  const result = {};
-  for (const service2 of allocatable) {
-    const start = service2.portStart;
-    const step = service2.portStep ?? 1;
-    result[service2.portEnv] = start + slot * step;
-  }
-  return result;
-}
-var INVALID_BRANCH_CHARS_RE, UNSAFE_ENV_KEY_RE, VALID_WORKTREE_NAME_RE, RESERVED_INSTANCE_PREFIXES;
-var init_policies = __esm(() => {
-  INVALID_BRANCH_CHARS_RE = /[~^:?*\[\]\\]+/g;
-  UNSAFE_ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-  VALID_WORKTREE_NAME_RE = /^[a-z0-9][a-z0-9\-_./]*$/;
-  RESERVED_INSTANCE_PREFIXES = new Set(["api", "ws", "assets"]);
-});
-
 // backend/src/services/archive-service.ts
 import { resolve as resolve4 } from "path";
 function createArchiveState(entries) {
@@ -16957,8 +17325,8 @@ var init_dist5 = __esm(() => {
 });
 
 // backend/src/adapters/config.ts
-import { readFileSync as readFileSync3 } from "fs";
-import { dirname as dirname2, join as join7, resolve as resolve5 } from "path";
+import { readFileSync as readFileSync7 } from "fs";
+import { dirname as dirname2, join as join10, resolve as resolve5 } from "path";
 function DEFAULT_ONESHOT_SYSTEM_PROMPT() {
   return [
     "You are running in webmux ONESHOT mode. There is NO interactive user \u2014 nobody is watching the chat or will respond to questions, approvals, or status checks. Any message asking the user to review, approve, confirm, take a look, or 'let you know' is wasted output: it will not be answered.",
@@ -17187,10 +17555,10 @@ function getDefaultProfileName(config) {
   return Object.keys(config.profiles)[0] ?? "default";
 }
 function readConfigFile(root) {
-  return readFileSync3(join7(root, ".webmux.yaml"), "utf8");
+  return readFileSync7(join10(root, ".webmux.yaml"), "utf8");
 }
 function readLocalConfigFile(root) {
-  return readFileSync3(join7(root, ".webmux.local.yaml"), "utf8");
+  return readFileSync7(join10(root, ".webmux.local.yaml"), "utf8");
 }
 function parseConfigDocument(text) {
   const parsed = $parse(text);
@@ -17695,7 +18063,7 @@ var init_docker = __esm(() => {
 });
 
 // backend/src/adapters/hooks.ts
-import { join as join8 } from "path";
+import { join as join11 } from "path";
 function buildErrorMessage(name, exitCode, stdout, stderr) {
   const output = stderr.trim() || stdout.trim();
   if (output) {
@@ -17720,7 +18088,7 @@ class BunLifecycleHookRunner {
     return this.direnvAvailable;
   }
   async buildCommand(cwd, command) {
-    if (this.checkDirenv() && await Bun.file(join8(cwd, ".envrc")).exists()) {
+    if (this.checkDirenv() && await Bun.file(join11(cwd, ".envrc")).exists()) {
       Bun.spawnSync(["direnv", "allow"], { cwd, stdout: "pipe", stderr: "pipe" });
       return ["direnv", "exec", cwd, "bash", "-c", command];
     }
@@ -18048,7 +18416,7 @@ var init_archive_state_service = __esm(() => {
 
 // backend/src/adapters/agent-runtime.ts
 import { chmod as chmod2, mkdir as mkdir3 } from "fs/promises";
-import { dirname as dirname4, join as join9, resolve as resolve6 } from "path";
+import { dirname as dirname4, join as join12, resolve as resolve6 } from "path";
 function shellQuote(value) {
   return `'${value.replaceAll("'", "'\\''")}'`;
 }
@@ -18467,7 +18835,7 @@ async function mergeCodexHooksFile(hooksPath, hookSettings, agentCtlPath) {
 }
 async function resolveGitCommonDir(gitDir) {
   try {
-    const commonDir = (await Bun.file(join9(gitDir, "commondir")).text()).trim();
+    const commonDir = (await Bun.file(join12(gitDir, "commondir")).text()).trim();
     if (!commonDir)
       return gitDir;
     return commonDir.startsWith("/") ? commonDir : resolve6(gitDir, commonDir);
@@ -18477,7 +18845,7 @@ async function resolveGitCommonDir(gitDir) {
 }
 async function ensureGeneratedCodexHooksIgnored(gitDir) {
   const commonDir = await resolveGitCommonDir(gitDir);
-  const excludePath = join9(commonDir, "info", "exclude");
+  const excludePath = join12(commonDir, "info", "exclude");
   let existing = "";
   try {
     existing = await Bun.file(excludePath).text();
@@ -18497,9 +18865,9 @@ async function ensureGeneratedCodexHooksIgnored(gitDir) {
 async function ensureAgentRuntimeArtifacts(input) {
   const storagePaths = getWorktreeStoragePaths(input.gitDir);
   const artifacts = {
-    agentCtlPath: join9(storagePaths.webmuxDir, "webmux-agentctl"),
-    claudeSettingsPath: join9(input.worktreePath, ".claude", "settings.local.json"),
-    codexHooksPath: join9(input.worktreePath, ".codex", "hooks.json")
+    agentCtlPath: join12(storagePaths.webmuxDir, "webmux-agentctl"),
+    claudeSettingsPath: join12(input.worktreePath, ".claude", "settings.local.json"),
+    codexHooksPath: join12(input.worktreePath, ".codex", "hooks.json")
   };
   await mkdir3(dirname4(artifacts.claudeSettingsPath), { recursive: true });
   await mkdir3(dirname4(artifacts.codexHooksPath), { recursive: true });
@@ -18533,7 +18901,7 @@ function buildDockerRuntimeBootstrap(runtimeEnvPath) {
 function buildBuiltInAgentInvocation(input) {
   const promptSuffix = input.prompt ? ` -- ${quoteShell(input.prompt)}` : "";
   if (input.agent === "codex") {
-    const hooksFlag = " --enable codex_hooks";
+    const hooksFlag = " --enable hooks";
     const yoloFlag2 = input.yolo ? " --yolo" : "";
     if (input.launchMode === "resume") {
       return `codex${hooksFlag}${yoloFlag2} resume --last${promptSuffix}`;
@@ -19998,7 +20366,7 @@ async function mapWithConcurrency(items, limit, fn) {
 }
 
 // backend/src/services/reconciliation-service.ts
-import { basename as basename4, resolve as resolve9 } from "path";
+import { basename as basename5, resolve as resolve9 } from "path";
 function makeUnmanagedWorktreeId(path) {
   return `unmanaged:${resolve9(path)}`;
 }
@@ -20033,7 +20401,7 @@ function findWindow(windows, sessionName, branch) {
   return windows.find((window) => window.sessionName === sessionName && window.windowName === windowName) ?? null;
 }
 function resolveBranch(entry, metaBranch) {
-  const fallback = basename4(entry.path);
+  const fallback = basename5(entry.path);
   return entry.branch ?? metaBranch ?? (fallback.length > 0 ? fallback : "unknown");
 }
 
@@ -20270,7 +20638,7 @@ __export(exports_worktree_commands, {
   parseAddCommandArgs: () => parseAddCommandArgs,
   getWorktreeCommandUsage: () => getWorktreeCommandUsage
 });
-import { basename as basename5, resolve as resolve10 } from "path";
+import { basename as basename6, resolve as resolve10 } from "path";
 function getWorktreeCommandUsage(command) {
   switch (command) {
     case "add":
@@ -20706,7 +21074,7 @@ async function listWorktrees(runtime, stdout, options) {
   const projectGitDir = runtime.git.resolveWorktreeGitDir(projectDir);
   const archivedPaths = buildArchivedWorktreePathSet(await readWorktreeArchiveState(projectGitDir));
   const rows = await Promise.all(entries.map(async (entry) => {
-    const branch = entry.branch ?? basename5(entry.path);
+    const branch = entry.branch ?? basename6(entry.path);
     const isOpen = openWindows.has(buildWorktreeWindowName(branch));
     const gitDir = runtime.git.resolveWorktreeGitDir(entry.path);
     const meta = await readWorktreeMeta(gitDir);
@@ -20950,13 +21318,13 @@ var init_worktree_commands = __esm(() => {
 });
 
 // bin/src/webmux.ts
-import { resolve as resolve11, dirname as dirname6, join as join10 } from "path";
-import { existsSync as existsSync5 } from "fs";
+import { resolve as resolve11, dirname as dirname6, join as join13 } from "path";
+import { existsSync as existsSync7 } from "fs";
 import { fileURLToPath } from "url";
 // package.json
 var package_default = {
   name: "webmux",
-  version: "0.33.0",
+  version: "0.34.0",
   description: "Web dashboard for workmux \u2014 browser UI with embedded terminals, PR monitoring, and CI integration",
   type: "module",
   repository: {
@@ -21060,6 +21428,7 @@ function isServeRootOption(value) {
 }
 function parseRootArgs(args) {
   let port = parseInt(process.env.PORT || "5111", 10);
+  let portExplicit = process.env.PORT !== undefined;
   let debug = false;
   let app = false;
   let prefix = process.env.WEBMUX_PREFIX?.trim() || null;
@@ -21083,6 +21452,7 @@ function parseRootArgs(args) {
         if (Number.isNaN(port)) {
           throw new Error("Error: --port requires a numeric value");
         }
+        portExplicit = true;
         index += 1;
         break;
       }
@@ -21120,6 +21490,7 @@ Run webmux --help for usage.`);
   }
   return {
     port,
+    portExplicit,
     debug,
     app,
     prefix,
@@ -21131,7 +21502,7 @@ function isWorktreeCommand(command) {
   return command === "add" || command === "list" || command === "open" || command === "close" || command === "archive" || command === "unarchive" || command === "label" || command === "remove" || command === "merge" || command === "send" || command === "prune";
 }
 async function loadEnvFile(path) {
-  if (!existsSync5(path))
+  if (!existsSync7(path))
     return;
   const lines = (await Bun.file(path).text()).split(`
 `);
@@ -21164,7 +21535,7 @@ function findBrowserBinary() {
     "brave-browser"
   ];
   for (const candidate of candidates) {
-    const found = candidate.startsWith("/") ? existsSync5(candidate) : Bun.spawnSync(["which", candidate], { stdout: "pipe", stderr: "pipe" }).success;
+    const found = candidate.startsWith("/") ? existsSync7(candidate) : Bun.spawnSync(["which", candidate], { stdout: "pipe", stderr: "pipe" }).success;
     if (found)
       return candidate;
   }
@@ -21243,6 +21614,28 @@ async function main(args = process.argv.slice(2)) {
       stderr: "inherit"
     });
     const code = await proc.exited;
+    if (code === 0) {
+      const { listInstalledServices: listInstalledServices2, updateInstalledService: updateInstalledService2 } = await Promise.resolve().then(() => (init_service_restart(), exports_service_restart));
+      const services = listInstalledServices2();
+      if (services.length > 0) {
+        const whichResult = Bun.spawnSync(["which", "webmux"], { stdout: "pipe", stderr: "pipe" });
+        const webmuxPath = whichResult.success ? whichResult.stdout.toString().trim() : "";
+        console.log(`
+Refreshing ${services.length} installed webmux service(s) to pick up the new version...`);
+        for (const svc of services) {
+          const outcome = await updateInstalledService2(svc, webmuxPath);
+          const parts = [];
+          if (outcome.regenerated)
+            parts.push("regenerated unit");
+          if (outcome.restarted)
+            parts.push("restarted");
+          if (!outcome.regenerated && !outcome.restarted && !outcome.error)
+            parts.push("no change");
+          const status2 = outcome.error ? `failed \u2014 ${outcome.error}` : parts.join(", ");
+          console.log(`  ${svc.name}: ${status2}`);
+        }
+      }
+    }
     process.exit(code);
   }
   await loadEnvFile(resolve11(process.cwd(), ".env.local"));
@@ -21271,7 +21664,7 @@ async function main(args = process.argv.slice(2)) {
     usage2();
     process.exit(0);
   }
-  if (!existsSync5(resolve11(process.cwd(), ".webmux.yaml"))) {
+  if (!existsSync7(resolve11(process.cwd(), ".webmux.yaml"))) {
     console.error("No .webmux.yaml found in this directory.\nRun `webmux init` to set up your project.");
     process.exit(1);
   }
@@ -21279,6 +21672,7 @@ async function main(args = process.argv.slice(2)) {
     ...process.env,
     PORT: String(parsed.port),
     WEBMUX_PROJECT_DIR: process.cwd(),
+    ...parsed.portExplicit ? { WEBMUX_PORT_STRICT: "1" } : {},
     ...parsed.prefix ? { WEBMUX_PREFIX: parsed.prefix } : {},
     ...parsed.debug ? { WEBMUX_DEBUG: "1" } : {}
   };
@@ -21306,13 +21700,13 @@ async function main(args = process.argv.slice(2)) {
   }
   process.on("SIGINT", cleanup);
   process.on("SIGTERM", cleanup);
-  const backendEntry = join10(PKG_ROOT, "backend", "dist", "server.js");
-  const staticDir = join10(PKG_ROOT, "frontend", "dist");
-  if (!existsSync5(staticDir)) {
+  const backendEntry = join13(PKG_ROOT, "backend", "dist", "server.js");
+  const staticDir = join13(PKG_ROOT, "frontend", "dist");
+  if (!existsSync7(staticDir)) {
     console.error(`Error: frontend/dist/ not found. Run 'bun run build' first.`);
     process.exit(1);
   }
-  console.log(`Starting webmux on port ${parsed.port} (falls back to a free port if taken)...`);
+  console.log(parsed.portExplicit ? `Starting webmux on port ${parsed.port}...` : `Starting webmux on port ${parsed.port} (falls back to a free port if taken)...`);
   const be2 = Bun.spawn(["bun", backendEntry], {
     env: { ...baseEnv, WEBMUX_STATIC_DIR: staticDir },
     stdout: "pipe",