fix: stop logging pairing offer during daemon startup

2026-11-07 17:04:42 +00:00 · 2026-04-14 19:12:13 +07:00
61 changed files with 226 additions and 1366 deletions
@@ -1,33 +1,5 @@
 # Changelog

-## 0.1.56 - 2026-04-14
-
-### Fixed
- Projects with empty git repositories (no commits yet) no longer crash the app on startup.
- A single problematic project can no longer prevent the rest of your workspaces from loading.
-
-## 0.1.55 - 2026-04-14
-
-### Added
- Provider profiles — define custom providers in your Paseo config that appear alongside built-ins. Override a built-in's binary, env, or models, or create entirely new providers. See the [configuration guide](https://github.com/getpaseo/paseo/blob/main/docs/CUSTOM-PROVIDERS.md).
- ACP agent support — add any ACP-compatible agent to Paseo with `extends: "acp"` in your provider config. No code changes needed.
- Choose provider and model when creating scheduled agents.
- Max reasoning effort option for Opus 4.6 models.
- Cmd+, (Ctrl+, on Windows/Linux) opens settings.
-
-### Improved
- Git operations are dramatically faster — workspace status, PR checks, and branch data all use a shared cached snapshot service instead of shelling out to git on every request. Running 20+ workspaces simultaneously is now smooth.
- Windows support — the daemon and CLI run natively on Windows with proper shell quoting, executable resolution, and path handling.
- iPad and tablet layouts work correctly across all screen sizes.
- IME composition (Chinese, Japanese, Korean input) no longer submits prematurely when pressing Enter.
-
-### Fixed
- Creating a worktree no longer briefly flashes it as a standalone project before placing it under the correct repository.
- Worktree creation spinner stays visible throughout the process instead of disappearing on mouse-out.
- Workspace navigation updates correctly when switching between workspaces in the same project.
- Desktop workspace header alignment and model selector no longer overflow on narrow windows.
- Loading indicators are visible in light mode.
-
 ## 0.1.54 - 2026-04-12

 ### Added
@@ -24,7 +24,6 @@ This is an npm workspace monorepo:
 | [docs/TESTING.md](docs/TESTING.md) | TDD workflow, determinism, real dependencies over mocks, test organization |
 | [docs/DEVELOPMENT.md](docs/DEVELOPMENT.md) | Dev server, build sync gotchas, CLI reference, agent state, Playwright MCP |
 | [docs/RELEASE.md](docs/RELEASE.md) | Release playbook, draft releases, completion checklist |
-| [docs/CUSTOM-PROVIDERS.md](docs/CUSTOM-PROVIDERS.md) | Custom provider config: Z.AI, Alibaba/Qwen, ACP agents, profiles, custom binaries |
 | [docs/ANDROID.md](docs/ANDROID.md) | App variants, local/cloud builds, EAS workflows |
 | [docs/DESIGN.md](docs/DESIGN.md) | How to design features before implementation |
 | [SECURITY.md](SECURITY.md) | Relay threat model, E2E encryption, DNS rebinding, agent auth |
@@ -47,12 +46,6 @@ See [docs/DEVELOPMENT.md](docs/DEVELOPMENT.md) for full setup, build sync requir
 - **NEVER restart the main Paseo daemon on port 6767 without permission** — it manages all running agents. If you're an agent, restarting it kills your own process.
 - **NEVER assume a timeout means the service needs restarting** — timeouts can be transient.
 - **NEVER add auth checks to tests** — agent providers handle their own auth.
- **NEVER run the full test suite locally.** The test suites are heavy and will freeze the machine, especially if multiple agents run them in parallel. Rules:
-  - Run only the specific test file you changed: `npx vitest run <file> --bail=1`
-  - Never run `npm run test` for an entire workspace unless explicitly asked.
-  - If you must run a broad suite, pipe output to a file and read it afterward: `npx vitest run <file> --bail=1 > /tmp/test-output.txt 2>&1` then read the file.
-  - Never re-run a test suite that another agent already ran and reported green — trust the result.
-  - For full suite verification, push to CI and check GitHub Actions instead.
 - **Always run typecheck after every change.**
 - **Run `npm run format` before committing.** This repo uses Biome for formatting. Do not manually fix formatting — let the formatter handle it.
 - **NEVER make breaking changes to WebSocket or message schemas.** The primary compatibility path is old mobile app clients talking to newly updated daemons. Users update desktop and daemon first, then keep running the old app for a while. Every schema change MUST be backward-compatible for old clients against new daemons:
@@ -55,7 +55,7 @@ Host header validation and CORS origin checks are defense-in-depth controls for

 CORS is not a complete security boundary. It controls which browser origins can make requests, but does not prevent a malicious website from resolving its domain to your local machine (DNS rebinding).

-Paseo validates the `Host` header on incoming requests against configured hostnames. Requests with unrecognized hosts are rejected.
+Paseo uses a host allowlist to validate the `Host` header on incoming requests. Requests with unrecognized hosts are rejected.

 ## Agent authentication

@@ -23,7 +23,7 @@ const daemon = await createPaseoDaemon(
    listen: "127.0.0.1:0", // OS picks a free port
    paseoHome,
    corsAllowedOrigins: [],
-    hostnames: true,
+    allowedHosts: true,
    mcpEnabled: false,
    staticDir,
    mcpDebug: false,
@@ -1,522 +0,0 @@
-# Custom Provider Configuration
-
-Paseo supports configuring custom agent providers through `config.json` (located at `$PASEO_HOME/config.json`, typically `~/.paseo/config.json`). You can extend built-in providers with different API backends, add ACP-compatible agents, set custom binaries, disable providers, and create multiple profiles for the same underlying provider.
-
-All provider configuration lives under `agents.providers` in config.json:
-
-```json
-{
-  "version": 1,
-  "agents": {
-    "providers": {
-      "provider-id": { ... }
-    }
-  }
-}
-```
-
-Provider IDs must be lowercase alphanumeric with hyphens (`/^[a-z][a-z0-9-]*$/`).
-
---
-
-## Table of Contents
-
- [Extending a built-in provider](#extending-a-built-in-provider)
- [Z.AI (Zhipu) coding plan](#zai-zhipu-coding-plan)
- [Alibaba Cloud (Qwen) coding plan](#alibaba-cloud-qwen-coding-plan)
- [Multiple profiles for the same provider](#multiple-profiles-for-the-same-provider)
- [Custom binary for a provider](#custom-binary-for-a-provider)
- [Disabling a provider](#disabling-a-provider)
- [ACP providers](#acp-providers)
- [Provider override reference](#provider-override-reference)
-
---
-
-## Extending a built-in provider
-
-Use `extends` to create a new provider entry that inherits from a built-in provider (claude, codex, copilot, opencode, pi). The new provider gets its own entry in the provider list, with its own label, environment, and model definitions.
-
-```json
-{
-  "agents": {
-    "providers": {
-      "my-claude": {
-        "extends": "claude",
-        "label": "My Claude",
-        "description": "Claude with custom API endpoint",
-        "env": {
-          "ANTHROPIC_API_KEY": "sk-ant-...",
-          "ANTHROPIC_BASE_URL": "https://my-proxy.example.com/v1"
-        }
-      }
-    }
-  }
-}
-```
-
-Required fields for custom providers:
- `extends` — which built-in provider to inherit from (or `"acp"`)
- `label` — display name in the UI
-
---
-
-## Z.AI (Zhipu) coding plan
-
-[Z.AI](https://z.ai) is a Chinese AI company (Zhipu AI) that offers an Anthropic-compatible API endpoint. Their GLM Coding Plan provides flat-rate access to GLM models through Claude Code's Anthropic API protocol. These are **not** Anthropic Claude models — they are Zhipu's own GLM models exposed through an Anthropic-compatible API.
-
-### Setup
-
-1. Register at [z.ai](https://z.ai) and subscribe to a coding plan
-2. Create an API key from the Z.AI dashboard
-3. Add a provider entry in config.json:
-
-```json
-{
-  "agents": {
-    "providers": {
-      "zai": {
-        "extends": "claude",
-        "label": "ZAI",
-        "env": {
-          "ANTHROPIC_AUTH_TOKEN": "<your-zai-api-key>",
-          "ANTHROPIC_BASE_URL": "https://api.z.ai/api/anthropic",
-          "API_TIMEOUT_MS": "3000000"
-        },
-        "models": [
-          { "id": "glm-4.5-air", "label": "GLM 4.5 Air" },
-          { "id": "glm-5-turbo", "label": "GLM 5 Turbo", "isDefault": true },
-          { "id": "glm-5.1", "label": "GLM 5.1" }
-        ]
-      }
-    }
-  }
-}
-```
-
-### Available models
-
-| Model | Tier |
-|---|---|
-| `glm-5.1` | Advanced (flagship) |
-| `glm-5-turbo` | Advanced |
-| `glm-4.7` | Standard |
-| `glm-4.5-air` | Lightweight |
-
-### Notes
-
- `ANTHROPIC_AUTH_TOKEN` is used instead of `ANTHROPIC_API_KEY` — this is the z.ai API key
- The `API_TIMEOUT_MS` env var extends the request timeout (z.ai can be slower than direct Anthropic)
- If you get auth errors, run `/logout` inside Claude Code before switching to the z.ai provider
- Automated setup is also available: `npx @z_ai/coding-helper`
- Official docs: [docs.z.ai/devpack/tool/claude](https://docs.z.ai/devpack/tool/claude)
-
---
-
-## Alibaba Cloud (Qwen) coding plan
-
-[Alibaba Cloud Model Studio](https://www.alibabacloud.com/en/campaign/ai-scene-coding) offers a coding plan that routes Claude Code requests to Qwen models through an Anthropic-compatible API. Like z.ai, these are **not** Anthropic Claude models.
-
-### Setup
-
-1. Go to the [Coding Plan page](https://modelstudio.console.alibabacloud.com/ap-southeast-1/?tab=globalset#/efm/coding_plan) on Alibaba Cloud Model Studio (Singapore region)
-2. Subscribe to the Pro plan ($50/month)
-3. Obtain your plan-specific API key (format: `sk-sp-xxxxx`) — this is different from a standard Model Studio key
-4. Add a provider entry in config.json:
-
-```json
-{
-  "agents": {
-    "providers": {
-      "qwen": {
-        "extends": "claude",
-        "label": "Qwen (Alibaba)",
-        "env": {
-          "ANTHROPIC_AUTH_TOKEN": "sk-sp-<your-coding-plan-key>",
-          "ANTHROPIC_BASE_URL": "https://coding-intl.dashscope.aliyuncs.com/apps/anthropic"
-        },
-        "models": [
-          { "id": "qwen3.5-plus", "label": "Qwen 3.5 Plus", "isDefault": true },
-          { "id": "qwen3-coder-next", "label": "Qwen 3 Coder Next" },
-          { "id": "kimi-k2.5", "label": "Kimi K2.5" }
-        ]
-      }
-    }
-  }
-}
-```
-
-### API endpoints
-
-| Mode | Base URL |
-|---|---|
-| Coding plan (subscription) | `https://coding-intl.dashscope.aliyuncs.com/apps/anthropic` |
-| Pay-as-you-go (no subscription) | `https://dashscope-intl.aliyuncs.com/apps/anthropic` |
-
-For pay-as-you-go, use `ANTHROPIC_API_KEY` with a standard Model Studio key (`sk-xxxxx`) instead of `ANTHROPIC_AUTH_TOKEN`.
-
-### Available models
-
-**Recommended for coding plan:**
-
-| Model | Notes |
-|---|---|
-| `qwen3.5-plus` | Vision capable, recommended |
-| `qwen3-coder-next` | Optimized for coding |
-| `kimi-k2.5` | Vision capable |
-| `glm-5` | Zhipu GLM |
-| `MiniMax-M2.5` | MiniMax |
-
-**Additional models (pay-as-you-go):**
-`qwen3-max`, `qwen3.5-flash`, `qwen3-coder-plus`, `qwen3-coder-flash`, `qwen3-vl-plus`, `qwen3-vl-flash`
-
-### Notes
-
- API keys must be created in the **Singapore region**
- The coding plan is for personal use only in interactive coding tools
- Official docs: [alibabacloud.com/help/en/model-studio/claude-code-coding-plan](https://www.alibabacloud.com/help/en/model-studio/claude-code-coding-plan)
-
---
-
-## Multiple profiles for the same provider
-
-You can create multiple entries that extend the same built-in provider. Each gets its own entry in the provider list with independent credentials, models, and environment.
-
-Example: two different Anthropic accounts as separate profiles:
-
-```json
-{
-  "agents": {
-    "providers": {
-      "claude-work": {
-        "extends": "claude",
-        "label": "Claude (Work)",
-        "description": "Work Anthropic account",
-        "env": {
-          "ANTHROPIC_API_KEY": "sk-ant-work-..."
-        }
-      },
-      "claude-personal": {
-        "extends": "claude",
-        "label": "Claude (Personal)",
-        "description": "Personal Anthropic account",
-        "env": {
-          "ANTHROPIC_API_KEY": "sk-ant-personal-..."
-        }
-      }
-    }
-  }
-}
-```
-
-Each profile appears as a separate provider in the Paseo app. You can select which one to use when launching an agent.
-
-You can also combine profiles with model overrides to pin specific models per profile:
-
-```json
-{
-  "agents": {
-    "providers": {
-      "claude-fast": {
-        "extends": "claude",
-        "label": "Claude (Fast)",
-        "models": [
-          { "id": "claude-sonnet-4-6", "label": "Sonnet 4.6", "isDefault": true }
-        ]
-      },
-      "claude-smart": {
-        "extends": "claude",
-        "label": "Claude (Smart)",
-        "models": [
-          { "id": "claude-opus-4-6", "label": "Opus 4.6", "isDefault": true }
-        ]
-      }
-    }
-  }
-}
-```
-
---
-
-## Custom binary for a provider
-
-Override the command used to launch any provider with the `command` field. This is an array where the first element is the binary and the rest are arguments.
-
-### Override a built-in provider's binary
-
-```json
-{
-  "agents": {
-    "providers": {
-      "claude": {
-        "command": ["/opt/claude-nightly/claude"]
-      }
-    }
-  }
-}
-```
-
-### Use a custom wrapper script
-
-```json
-{
-  "agents": {
-    "providers": {
-      "claude": {
-        "command": ["/usr/local/bin/my-claude-wrapper", "--verbose"]
-      }
-    }
-  }
-}
-```
-
-### Custom binary on a derived provider
-
-```json
-{
-  "agents": {
-    "providers": {
-      "my-codex": {
-        "extends": "codex",
-        "label": "Codex (Custom Build)",
-        "command": ["/home/user/codex-dev/target/release/codex"]
-      }
-    }
-  }
-}
-```
-
-The `command` array completely replaces the default command for that provider. The binary must exist on the system — Paseo checks for its availability and will mark the provider as unavailable if not found.
-
---
-
-## Disabling a provider
-
-Set `enabled: false` to hide a provider from the provider list. The provider will not appear in the app or CLI.
-
-```json
-{
-  "agents": {
-    "providers": {
-      "copilot": { "enabled": false },
-      "codex": { "enabled": false }
-    }
-  }
-}
-```
-
-This works for both built-in and custom providers. To re-enable, set `enabled: true` or remove the `enabled` field entirely (providers are enabled by default).
-
---
-
-## ACP providers
-
-The [Agent Client Protocol (ACP)](https://agentclientprotocol.com) is an open standard for communication between editors and AI coding agents — think LSP but for AI agents. Any agent that supports ACP can be added to Paseo as a custom provider.
-
-ACP agents communicate over JSON-RPC 2.0 on stdio. Paseo spawns the agent process and talks to it through stdin/stdout.
-
-### Adding a generic ACP provider
-
-Set `extends: "acp"` and provide a `command`:
-
-```json
-{
-  "agents": {
-    "providers": {
-      "my-agent": {
-        "extends": "acp",
-        "label": "My Agent",
-        "command": ["my-agent-binary", "--acp"],
-        "env": {
-          "MY_API_KEY": "..."
-        }
-      }
-    }
-  }
-}
-```
-
-Required fields for ACP providers:
- `extends: "acp"`
- `label`
- `command` — the command to spawn the agent process (must support ACP over stdio)
-
-### Example: Google Gemini CLI
-
-[Gemini CLI](https://github.com/google-gemini/gemini-cli) supports ACP via the `--acp` flag.
-
-1. Install: `npm install -g @anthropic-ai/gemini-cli` or see [Gemini CLI docs](https://github.com/google-gemini/gemini-cli)
-2. Authenticate with Google (Gemini CLI handles its own auth)
-3. Add to config.json:
-
-```json
-{
-  "agents": {
-    "providers": {
-      "gemini": {
-        "extends": "acp",
-        "label": "Google Gemini",
-        "command": ["gemini", "--acp"]
-      }
-    }
-  }
-}
-```
-
-Ref: [Gemini CLI ACP mode docs](https://github.com/google-gemini/gemini-cli/blob/main/docs/cli/acp-mode.md)
-
-### Example: Hermes (Nous Research)
-
-[Hermes](https://github.com/NousResearch/hermes-agent) is an open-source coding agent by Nous Research with persistent memory and multi-provider LLM support. It supports ACP via the `acp` subcommand.
-
-1. Install: `curl -fsSL https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh | bash`
-2. Install ACP support: `pip install -e '.[acp]'`
-3. Configure Hermes credentials in `~/.hermes/`
-4. Add to config.json:
-
-```json
-{
-  "agents": {
-    "providers": {
-      "hermes": {
-        "extends": "acp",
-        "label": "Hermes",
-        "description": "Nous Research self-improving AI agent",
-        "command": ["hermes", "acp"]
-      }
-    }
-  }
-}
-```
-
-Ref: [Hermes ACP docs](https://hermes-agent.nousresearch.com/docs/user-guide/features/acp)
-
-### How ACP providers work in Paseo
-
-When you launch an agent with an ACP provider:
-
-1. Paseo spawns the process using the configured `command`
-2. Sends an `initialize` JSON-RPC request over stdin
-3. The agent responds with its capabilities, available modes, and models
-4. Paseo creates a session and sends prompts through the ACP protocol
-5. The agent streams responses, tool calls, and permission requests back over stdout
-
-Models and modes are discovered dynamically at runtime from the agent process. If you want to override the model list (e.g., to curate which models appear in the UI), use the `models` field:
-
-```json
-{
-  "agents": {
-    "providers": {
-      "my-agent": {
-        "extends": "acp",
-        "label": "My Agent",
-        "command": ["my-agent", "--acp"],
-        "models": [
-          { "id": "fast-model", "label": "Fast", "isDefault": true },
-          { "id": "smart-model", "label": "Smart" }
-        ]
-      }
-    }
-  }
-}
-```
-
-Profile models (defined in config.json) completely replace runtime-discovered models when present.
-
---
-
-## Provider override reference
-
-Every entry under `agents.providers` accepts these fields:
-
-| Field | Type | Required | Description |
-|---|---|---|---|
-| `extends` | `string` | Yes (custom only) | Built-in provider ID to inherit from, or `"acp"` |
-| `label` | `string` | Yes (custom only) | Display name in the UI |
-| `description` | `string` | No | Short description shown in the UI |
-| `command` | `string[]` | Yes (ACP only) | Command to spawn the agent process |
-| `env` | `Record<string, string>` | No | Environment variables to set for the agent process |
-| `models` | `ProviderProfileModel[]` | No | Static model list (overrides runtime discovery) |
-| `enabled` | `boolean` | No | Set to `false` to hide the provider (default: `true`) |
-| `order` | `number` | No | Sort order in the provider list |
-
-### Model definition
-
-Each entry in the `models` array:
-
-| Field | Type | Required | Description |
-|---|---|---|---|
-| `id` | `string` | Yes | Model identifier sent to the provider |
-| `label` | `string` | Yes | Display name in the UI |
-| `description` | `string` | No | Short description |
-| `isDefault` | `boolean` | No | Mark as the default model selection |
-| `thinkingOptions` | `ThinkingOption[]` | No | Available thinking/reasoning levels |
-
-### Thinking option
-
-| Field | Type | Required | Description |
-|---|---|---|---|
-| `id` | `string` | Yes | Thinking option identifier |
-| `label` | `string` | Yes | Display name |
-| `description` | `string` | No | Short description |
-| `isDefault` | `boolean` | No | Mark as the default thinking option |
-
-### Valid `extends` values
-
-Built-in providers: `claude`, `codex`, `copilot`, `opencode`, `pi`
-
-Special value: `acp` — creates a generic ACP provider (requires `command`)
-
-### Full example
-
-A config.json with multiple custom providers:
-
-```json
-{
-  "version": 1,
-  "agents": {
-    "providers": {
-      "copilot": { "enabled": false },
-
-      "zai": {
-        "extends": "claude",
-        "label": "ZAI",
-        "env": {
-          "ANTHROPIC_AUTH_TOKEN": "<zai-api-key>",
-          "ANTHROPIC_BASE_URL": "https://api.z.ai/api/anthropic",
-          "API_TIMEOUT_MS": "3000000"
-        },
-        "models": [
-          { "id": "glm-4.5-air", "label": "GLM 4.5 Air" },
-          { "id": "glm-5-turbo", "label": "GLM 5 Turbo", "isDefault": true },
-          { "id": "glm-5.1", "label": "GLM 5.1" }
-        ]
-      },
-
-      "qwen": {
-        "extends": "claude",
-        "label": "Qwen (Alibaba)",
-        "env": {
-          "ANTHROPIC_AUTH_TOKEN": "sk-sp-<coding-plan-key>",
-          "ANTHROPIC_BASE_URL": "https://coding-intl.dashscope.aliyuncs.com/apps/anthropic"
-        },
-        "models": [
-          { "id": "qwen3.5-plus", "label": "Qwen 3.5 Plus", "isDefault": true },
-          { "id": "qwen3-coder-next", "label": "Qwen 3 Coder Next" }
-        ]
-      },
-
-      "gemini": {
-        "extends": "acp",
-        "label": "Google Gemini",
-        "command": ["gemini", "--acp"]
-      },
-
-      "hermes": {
-        "extends": "acp",
-        "label": "Hermes",
-        "command": ["hermes", "acp"]
-      }
-    }
-  }
-}
-```
@@ -130,7 +130,7 @@ Single file, validated with `PersistedConfigSchema`.
  version: 1,
  daemon: {
    listen: "127.0.0.1:6767",
-    hostnames: true | string[],
+    allowedHosts: true | string[],
    mcp: { enabled: boolean },
    cors: { allowedOrigins: string[] },
    relay: { enabled: boolean, endpoint: string, publicEndpoint: string }
@@ -9,10 +9,6 @@ let
  cfg = config.services.paseo;
 in
 {
-  imports = [
-    (lib.mkRenamedOptionModule [ "services" "paseo" "allowedHosts" ] [ "services" "paseo" "hostnames" ])
-  ];
-
  options.services.paseo = {
    enable = lib.mkEnableOption "Paseo, a self-hosted daemon for AI coding agents";

@@ -62,12 +58,12 @@ in
      description = "Whether to open the firewall for the Paseo daemon port.";
    };

-    hostnames = lib.mkOption {
+    allowedHosts = lib.mkOption {
      type = lib.types.either (lib.types.enum [ true ]) (lib.types.listOf lib.types.str);
      default = [ ];
      example = [ ".example.com" "myhost.local" ];
      description = ''
-        Hostnames the Paseo daemon accepts in the Host header (DNS rebinding protection).
+        Hosts allowed to connect to the Paseo daemon (DNS rebinding protection).
        Localhost and IP addresses are always allowed by default.

        Use a leading dot to match a domain and all its subdomains
@@ -145,10 +141,10 @@ in
          "/run/wrappers/bin"
          "/nix/var/nix/profiles/default/bin"
        ]);
-      } // lib.optionalAttrs (cfg.hostnames == true) {
-        PASEO_HOSTNAMES = "true";
-      } // lib.optionalAttrs (lib.isList cfg.hostnames && cfg.hostnames != [ ]) {
-        PASEO_HOSTNAMES = lib.concatStringsSep "," cfg.hostnames;
+      } // lib.optionalAttrs (cfg.allowedHosts == true) {
+        PASEO_ALLOWED_HOSTS = "true";
+      } // lib.optionalAttrs (lib.isList cfg.allowedHosts && cfg.allowedHosts != [ ]) {
+        PASEO_ALLOWED_HOSTS = lib.concatStringsSep "," cfg.allowedHosts;
      } // cfg.environment;

      serviceConfig = {
@@ -42,7 +42,7 @@ buildNpmPackage rec {

  # To update: run `nix build` with lib.fakeHash, copy the `got:` hash.
  # CI auto-updates this when package-lock.json changes (see .github/workflows/).
-  npmDepsHash = "sha256-NBB8+DNyodnREhVEiNMLADd+4MMK4lssRuzlwvvPjk8=";
+  npmDepsHash = "sha256-AyhJwa2ISs3wxorZIWblYasH35K3YpesPl4+1f5QTJg=";

  # Prevent onnxruntime-node's install script from running during automatic
  # npm rebuild (it tries to download from api.nuget.org, which fails in the sandbox).
@@ -1,12 +1,12 @@
 {
  "name": "paseo",
-  "version": "0.1.57-rc.1",
+  "version": "0.1.55-rc.2",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "paseo",
-      "version": "0.1.57-rc.1",
+      "version": "0.1.55-rc.2",
      "hasInstallScript": true,
      "license": "AGPL-3.0-or-later",
      "workspaces": [
@@ -34906,16 +34906,16 @@
    },
    "packages/app": {
      "name": "@getpaseo/app",
-      "version": "0.1.57-rc.1",
+      "version": "0.1.55-rc.2",
      "dependencies": {
        "@dnd-kit/core": "^6.3.1",
        "@dnd-kit/sortable": "^10.0.0",
        "@dnd-kit/utilities": "^3.2.2",
        "@expo/vector-icons": "^15.0.2",
        "@floating-ui/react-native": "^0.10.7",
-        "@getpaseo/expo-two-way-audio": "0.1.57-rc.1",
-        "@getpaseo/highlight": "0.1.57-rc.1",
-        "@getpaseo/server": "0.1.57-rc.1",
+        "@getpaseo/expo-two-way-audio": "0.1.55-rc.2",
+        "@getpaseo/highlight": "0.1.55-rc.2",
+        "@getpaseo/server": "0.1.55-rc.2",
        "@gorhom/bottom-sheet": "^5.2.6",
        "@gorhom/portal": "^1.0.14",
        "@react-native-async-storage/async-storage": "2.2.0",
@@ -35056,11 +35056,11 @@
    },
    "packages/cli": {
      "name": "@getpaseo/cli",
-      "version": "0.1.57-rc.1",
+      "version": "0.1.55-rc.2",
      "dependencies": {
        "@clack/prompts": "^1.0.0",
-        "@getpaseo/relay": "0.1.57-rc.1",
-        "@getpaseo/server": "0.1.57-rc.1",
+        "@getpaseo/relay": "0.1.55-rc.2",
+        "@getpaseo/server": "0.1.55-rc.2",
        "chalk": "^5.3.0",
        "commander": "^12.0.0",
        "mime-types": "^2.1.35",
@@ -35101,11 +35101,11 @@
    },
    "packages/desktop": {
      "name": "@getpaseo/desktop",
-      "version": "0.1.57-rc.1",
+      "version": "0.1.55-rc.2",
      "license": "AGPL-3.0-or-later",
      "dependencies": {
-        "@getpaseo/cli": "0.1.57-rc.1",
-        "@getpaseo/server": "0.1.57-rc.1",
+        "@getpaseo/cli": "0.1.55-rc.2",
+        "@getpaseo/server": "0.1.55-rc.2",
        "electron-log": "^5.4.3",
        "electron-updater": "^6.6.2",
        "ws": "^8.14.2"
@@ -35139,7 +35139,7 @@
    },
    "packages/expo-two-way-audio": {
      "name": "@getpaseo/expo-two-way-audio",
-      "version": "0.1.57-rc.1",
+      "version": "0.1.55-rc.2",
      "license": "MIT",
      "devDependencies": {
        "@biomejs/biome": "1.9.4",
@@ -35340,7 +35340,7 @@
    },
    "packages/highlight": {
      "name": "@getpaseo/highlight",
-      "version": "0.1.57-rc.1",
+      "version": "0.1.55-rc.2",
      "dependencies": {
        "@lezer/common": "^1.5.0",
        "@lezer/cpp": "^1.1.5",
@@ -35366,7 +35366,7 @@
    },
    "packages/relay": {
      "name": "@getpaseo/relay",
-      "version": "0.1.57-rc.1",
+      "version": "0.1.55-rc.2",
      "dependencies": {
        "base64-js": "^1.5.1",
        "tweetnacl": "^1.0.3",
@@ -35382,14 +35382,14 @@
    },
    "packages/server": {
      "name": "@getpaseo/server",
-      "version": "0.1.57-rc.1",
+      "version": "0.1.55-rc.2",
      "dependencies": {
        "@agentclientprotocol/sdk": "^0.17.1",
        "@ai-sdk/openai": "2.0.52",
        "@anthropic-ai/claude-agent-sdk": "^0.2.11",
        "@deepgram/sdk": "^3.4.0",
-        "@getpaseo/highlight": "0.1.57-rc.1",
-        "@getpaseo/relay": "0.1.57-rc.1",
+        "@getpaseo/highlight": "0.1.55-rc.2",
+        "@getpaseo/relay": "0.1.55-rc.2",
        "@isaacs/ttlcache": "^2.1.4",
        "@modelcontextprotocol/sdk": "^1.20.1",
        "@opencode-ai/sdk": "1.2.6",
@@ -35817,7 +35817,7 @@
    },
    "packages/website": {
      "name": "@getpaseo/website",
-      "version": "0.1.57-rc.1",
+      "version": "0.1.55-rc.2",
      "dependencies": {
        "@cloudflare/vite-plugin": "^1.20.3",
        "@cloudflare/workers-types": "^4.20260114.0",
@@ -1,6 +1,6 @@
 {
  "name": "paseo",
-  "version": "0.1.57-rc.1",
+  "version": "0.1.55-rc.2",
  "private": true,
  "workspaces": [
    "packages/expo-two-way-audio",
@@ -1,7 +1,7 @@
 {
  "name": "@getpaseo/app",
  "main": "index.ts",
-  "version": "0.1.57-rc.1",
+  "version": "0.1.55-rc.2",
  "private": true,
  "scripts": {
    "start": "expo start",
@@ -31,9 +31,9 @@
    "@dnd-kit/utilities": "^3.2.2",
    "@expo/vector-icons": "^15.0.2",
    "@floating-ui/react-native": "^0.10.7",
-    "@getpaseo/expo-two-way-audio": "0.1.57-rc.1",
-    "@getpaseo/highlight": "0.1.57-rc.1",
-    "@getpaseo/server": "0.1.57-rc.1",
+    "@getpaseo/expo-two-way-audio": "0.1.55-rc.2",
+    "@getpaseo/highlight": "0.1.55-rc.2",
+    "@getpaseo/server": "0.1.55-rc.2",
    "@gorhom/bottom-sheet": "^5.2.6",
    "@gorhom/portal": "^1.0.14",
    "@react-native-async-storage/async-storage": "2.2.0",
@@ -63,7 +63,7 @@ type ImageListUpdater = ImageAttachment[] | ((prev: ImageAttachment[]) => ImageA
 interface AgentInputAreaProps {
  agentId: string;
  serverId: string;
-  isPaneFocused: boolean;
+  isInputActive: boolean;
  onSubmitMessage?: (payload: MessagePayload) => Promise<void>;
  /** Externally controlled loading state. When true, disables the submit button. */
  isSubmitLoading?: boolean;
@@ -98,7 +98,7 @@ const MOBILE_MESSAGE_PLACEHOLDER = "Message, @files, /commands";
 export function AgentInputArea({
  agentId,
  serverId,
-  isPaneFocused,
+  isInputActive,
  onSubmitMessage,
  isSubmitLoading = false,
  blurOnSubmit = false,
@@ -421,7 +421,7 @@ export function AgentInputArea({

  const handleKeyboardAction = useCallback(
    (action: KeyboardActionDefinition): boolean => {
-      if (!isPaneFocused) {
+      if (!isInputActive) {
        return false;
      }

@@ -461,7 +461,7 @@ export function AgentInputArea({
          return false;
      }
    },
-    [isPaneFocused],
+    [isInputActive],
  );

  useKeyboardActionHandler({
@@ -475,9 +475,9 @@ export function AgentInputArea({
      "message-input.voice-toggle",
      "message-input.voice-mute-toggle",
    ],
-    enabled: isPaneFocused,
+    enabled: isInputActive,
    priority: isMessageInputFocused ? 200 : 100,
-    isActive: () => isPaneFocused,
+    isActive: () => isInputActive,
    handle: handleKeyboardAction,
  });

@@ -736,7 +736,7 @@ export function AgentInputArea({
              autoFocus={autoFocus && isDesktopWebBreakpoint}
              autoFocusKey={`${serverId}:${agentId}`}
              disabled={isSubmitLoading}
-              isPaneFocused={isPaneFocused}
+              isInputActive={isInputActive}
              leftContent={leftContent}
              beforeVoiceContent={beforeVoiceContent}
              rightContent={rightContent}
@@ -43,17 +43,12 @@ export function BranchSwitcher({
    queryClient,
  });

-  const titleContent = (
-    <>
-      <GitBranch size={14} color={theme.colors.foregroundMuted} />
+  if (!currentBranchName) {
+    return (
      <Text testID="workspace-header-title" style={styles.headerTitle} numberOfLines={1}>
        {title}
      </Text>
-    </>
-  );
-
-  if (!currentBranchName) {
-    return <View style={styles.branchSwitcherTrigger}>{titleContent}</View>;
+    );
  }

  return (
@@ -68,7 +63,10 @@ export function BranchSwitcher({
        accessibilityRole="button"
        accessibilityLabel={`Current branch: ${currentBranchName}. Press to switch branch.`}
      >
-        {titleContent}
+        <GitBranch size={14} color={theme.colors.foregroundMuted} />
+        <Text testID="workspace-header-title" style={styles.headerTitle} numberOfLines={1}>
+          {title}
+        </Text>
        {!isCompact ? <ChevronDown size={12} color={theme.colors.foregroundMuted} /> : null}
      </Pressable>
      <Combobox
@@ -119,10 +117,7 @@ const styles = StyleSheet.create((theme) => ({
      xs: -theme.spacing[2],
      md: 0,
    },
-    paddingVertical: {
-      xs: 0,
-      md: theme.spacing[1],
-    },
+    paddingVertical: theme.spacing[1],
    paddingHorizontal: theme.spacing[2],
    borderRadius: theme.borderRadius.md,
    flexShrink: 1,
@@ -264,7 +264,6 @@ export function FilePane({
      return { file: payload.file ?? null, error: payload.error ?? null };
    },
    staleTime: 5_000,
-    refetchOnMount: true,
  });

  return (
@@ -42,8 +42,6 @@ import { Tooltip, TooltipContent, TooltipTrigger } from "@/components/ui/tooltip
 import { Shortcut } from "@/components/ui/shortcut";
 import { useWebElementScrollbar } from "@/components/use-web-scrollbar";
 import { useShortcutKeys } from "@/hooks/use-shortcut-keys";
-import { formatShortcut } from "@/utils/format-shortcut";
-import { getShortcutOs } from "@/utils/shortcut-platform";
 import type { MessageInputKeyboardActionKind } from "@/keyboard/actions";
 import {
  markScrollInvestigationEvent,
@@ -77,8 +75,8 @@ export interface MessageInputProps {
  autoFocus?: boolean;
  autoFocusKey?: string;
  disabled?: boolean;
-  /** True when this composer's pane is focused. Used to gate global hotkeys and stop dictation when hidden. */
-  isPaneFocused?: boolean;
+  /** True when this input is the active composer. Used to gate global hotkeys and stop dictation when hidden. */
+  isInputActive?: boolean;
  /** Content to render on the left side of the button row (e.g., AgentStatusBar) */
  leftContent?: React.ReactNode;
  /** Content to render on the right side before the voice button (e.g., context window meter) */
@@ -208,7 +206,7 @@ export const MessageInput = forwardRef<MessageInputRef, MessageInputProps>(funct
    autoFocus = false,
    autoFocusKey,
    disabled = false,
-    isPaneFocused = true,
+    isInputActive = true,
    leftContent,
    beforeVoiceContent,
    rightContent,
@@ -235,9 +233,7 @@ export const MessageInput = forwardRef<MessageInputRef, MessageInputProps>(funct
  const voiceMuteToggleKeys = useShortcutKeys("voice-mute-toggle");
  const dictationToggleKeys = useShortcutKeys("dictation-toggle");
  const queueKeys = useShortcutKeys("message-input-queue");
-  const focusInputKeys = useShortcutKeys("focus-message-input");
  const [inputHeight, setInputHeight] = useState(MIN_INPUT_HEIGHT);
-  const [isInputFocused, setIsInputFocused] = useState(false);
  const rootRef = useRef<View | null>(null);
  const inputWrapperRef = useRef<View | null>(null);
  const textInputRef = useRef<TextInput | (TextInput & { getNativeRef?: () => unknown }) | null>(
@@ -431,7 +427,7 @@ export const MessageInput = forwardRef<MessageInputRef, MessageInputProps>(funct
    onError: handleDictationError,
    canStart: canStartDictation,
    canConfirm: canConfirmDictation,
-    autoStopWhenHidden: { isVisible: isPaneFocused },
+    autoStopWhenHidden: { isVisible: isInputActive },
    enableDuration: true,
  });

@@ -1001,12 +997,10 @@ export const MessageInput = forwardRef<MessageInputRef, MessageInputProps>(funct
            accessibilityLabel="Message agent..."
            onFocus={() => {
              isInputFocusedRef.current = true;
-              setIsInputFocused(true);
              onFocusChange?.(true);
            }}
            onBlur={() => {
              isInputFocusedRef.current = false;
-              setIsInputFocused(false);
              onFocusChange?.(false);
            }}
            style={[
@@ -1031,11 +1025,6 @@ export const MessageInput = forwardRef<MessageInputRef, MessageInputProps>(funct
            autoFocus={isWeb && autoFocus}
          />
          {inputScrollbar}
-          {isWeb && isPaneFocused && !isInputFocused && !value && focusInputKeys ? (
-            <Text style={styles.focusHintText} pointerEvents="none">
-              {formatShortcut(focusInputKeys[0], getShortcutOs())} to focus
-            </Text>
-          ) : null}
        </View>

        {/* Button row */}
@@ -1281,14 +1270,6 @@ const styles = StyleSheet.create(((theme: any) => ({
  textInputScrollWrapper: {
    position: "relative",
  },
-  focusHintText: {
-    position: "absolute",
-    top: 0,
-    right: 0,
-    fontSize: theme.fontSize.xs,
-    color: theme.colors.foregroundMuted,
-    opacity: 0.5,
-  },
  textInput: {
    width: "100%",
    color: theme.colors.foreground,
@@ -808,12 +808,7 @@ function ProjectHeaderRow({
          <NewWorktreeButton
            displayName={displayName}
            onPress={() => createWorktreeMutation.mutate()}
-            visible={
-              isHovered ||
-              platformIsNative ||
-              isMobileBreakpoint ||
-              createWorktreeMutation.isPending
-            }
+            visible={isHovered || platformIsNative || isMobileBreakpoint}
            loading={createWorktreeMutation.isPending}
            showShortcutHint={isProjectActive}
            testID={`sidebar-project-new-worktree-${project.projectKey}`}
@@ -890,7 +890,6 @@ const styles = StyleSheet.create((theme) => ({
  comboboxItemLabel: {
    fontSize: theme.fontSize.sm,
    color: theme.colors.foreground,
-    flexShrink: 0,
  },
  comboboxItemDescription: {
    fontSize: theme.fontSize.xs,
@@ -1,12 +1,7 @@
 import type { AgentStreamEventPayload } from "@server/shared/messages";
 import type { AgentLifecycleStatus } from "@server/shared/agent-lifecycle";
 import type { StreamItem } from "@/types/stream";
-import {
-  applyStreamEvent,
-  flushHeadToTail,
-  hydrateStreamState,
-  reduceStreamUpdate,
-} from "@/types/stream";
+import { applyStreamEvent, hydrateStreamState, reduceStreamUpdate } from "@/types/stream";
 import {
  classifySessionTimelineSeq,
  type SessionTimelineSeqDecision,
@@ -219,24 +214,12 @@ export function processTimelineResponse(
    }

    if (acceptedUnits.length > 0) {
-      // Flush head to tail before appending canonical entries so that
-      // chronological ordering is preserved.  This matters on mobile where
-      // the server drops live events for backgrounded/unfocused agents:
-      // when the client catches up, the head may still hold stale live
-      // items from before the gap that must be committed ahead of the
-      // canonical gap-fill entries.
-      const baseTail =
-        currentHead.length > 0 ? flushHeadToTail(currentTail, currentHead) : currentTail;
-      if (currentHead.length > 0) {
-        nextHead = [];
-      }
-
      nextTail = acceptedUnits.reduce<StreamItem[]>(
        (state, { event, timestamp }) =>
          reduceStreamUpdate(state, event, timestamp, {
            source: "canonical",
          }),
-        baseTail,
+        currentTail,
      );
    }

@@ -59,7 +59,7 @@ export function useAgentAttentionClear({
        return;
      }
      deferredFocusEntryClearRef.current = false;
-      client.clearAgentAttention(resolvedAgentId).catch(() => {});
+      client.clearAgentAttention(resolvedAgentId);
    },
    [agentId, attentionReason, client, isConnected, requiresAttention],
  );
@@ -791,32 +791,6 @@ const SHORTCUT_BINDINGS: readonly ShortcutBinding[] = [
  },

  // --- Message input ---
-  {
-    id: "message-input-focus-cmd-l-mac",
-    action: "message-input.action",
-    combo: "Cmd+L",
-    when: { mac: true, commandCenter: false },
-    payload: { type: "message-input", kind: "focus" },
-    help: {
-      id: "focus-message-input",
-      section: "agent-input",
-      label: "Focus message input",
-      keys: ["mod", "L"],
-    },
-  },
-  {
-    id: "message-input-focus-ctrl-l-non-mac",
-    action: "message-input.action",
-    combo: "Ctrl+L",
-    when: { mac: false, commandCenter: false, terminal: false },
-    payload: { type: "message-input", kind: "focus" },
-    help: {
-      id: "focus-message-input",
-      section: "agent-input",
-      label: "Focus message input",
-      keys: ["mod", "L"],
-    },
-  },
  {
    id: "message-input-voice-toggle-cmd-shift-d-mac",
    action: "message-input.action",
@@ -762,7 +762,7 @@ function AgentPanelBody({
            <AgentInputArea
              agentId={agentId}
              serverId={serverId}
-              isPaneFocused={isPaneFocused}
+              isInputActive={isPaneFocused}
              value={agentInputDraft.text}
              onChangeText={agentInputDraft.setText}
              images={agentInputDraft.images}
@@ -1232,7 +1232,7 @@ function DraftAgentScreenContent({
            <AgentInputArea
              agentId={draftAgentIdRef.current}
              serverId={selectedServerId ?? ""}
-              isPaneFocused={isFocused}
+              isInputActive={isFocused}
              onSubmitMessage={handleCreateFromInput}
              isSubmitLoading={isSubmitting}
              blurOnSubmit={true}
@@ -342,7 +342,7 @@ export function WorkspaceDraftAgentTab({
          <AgentInputArea
            agentId={tabId}
            serverId={serverId}
-            isPaneFocused={isPaneFocused}
+            isInputActive={isPaneFocused}
            onSubmitMessage={handleCreateFromInput}
            isSubmitLoading={isSubmitting}
            blurOnSubmit={true}
@@ -729,7 +729,7 @@ function finalizeHeadItems(head: StreamItem[]): StreamItem[] {
 /**
 * Flush head items to tail, avoiding duplicates.
 */
-export function flushHeadToTail(tail: StreamItem[], head: StreamItem[]): StreamItem[] {
+function flushHeadToTail(tail: StreamItem[], head: StreamItem[]): StreamItem[] {
  if (head.length === 0) {
    return tail;
  }
@@ -1,6 +1,6 @@
 {
  "name": "@getpaseo/cli",
-  "version": "0.1.57-rc.1",
+  "version": "0.1.55-rc.2",
  "description": "Paseo CLI - control your AI coding agents from the command line",
  "type": "module",
  "files": [
@@ -24,8 +24,8 @@
  },
  "dependencies": {
    "@clack/prompts": "^1.0.0",
-    "@getpaseo/relay": "0.1.57-rc.1",
-    "@getpaseo/server": "0.1.57-rc.1",
+    "@getpaseo/relay": "0.1.55-rc.2",
+    "@getpaseo/server": "0.1.55-rc.2",
    "chalk": "^5.3.0",
    "commander": "^12.0.0",
    "mime-types": "^2.1.35",
@@ -1,4 +1,4 @@
-import { Command, Option } from "commander";
+import { Command } from "commander";
 import { createRequire } from "node:module";
 import { createAgentCommand } from "./commands/agent/index.js";
 import { createDaemonCommand } from "./commands/daemon/index.js";
@@ -124,27 +124,10 @@ export function createCli(): Command {
    .option("--no-relay", "Disable relay on restarted daemon")
    .option("--no-mcp", "Disable Agent MCP on restarted daemon")
    .option(
-      "--hostnames <hosts>",
-      'Daemon hostnames (comma-separated, e.g. "myhost,.example.com" or "true" for any)',
+      "--allowed-hosts <hosts>",
+      'Comma-separated Host allowlist values (example: "localhost,.example.com" or "true")',
    )
-    .addOption(new Option("--allowed-hosts <hosts>").hideHelp())
-    .action(
-      withOutput((...args) => {
-        const [options, command] = args.slice(-2) as [(typeof args)[number], Command];
-        return runDaemonRestartCommand(
-          {
-            ...options,
-            hostnames:
-              typeof options.hostnames === "string"
-                ? options.hostnames
-                : typeof options.allowedHosts === "string"
-                  ? options.allowedHosts
-                  : undefined,
-          },
-          command,
-        );
-      }),
-    );
+    .action(withOutput(runDaemonRestartCommand));

  // Advanced agent commands (less common operations)
  program.addCommand(createAgentCommand());
@@ -1,4 +1,4 @@
-import { Command, Option } from "commander";
+import { Command } from "commander";
 import { startCommand } from "./start.js";
 import { runStatusCommand } from "./status.js";
 import { runStopCommand } from "./stop.js";
@@ -36,27 +36,10 @@ export function createDaemonCommand(): Command {
    .option("--no-mcp", "Disable Agent MCP on restarted daemon")
    .option("--no-inject-mcp", "Disable auto-injecting the Paseo MCP into created agents")
    .option(
-      "--hostnames <hosts>",
-      'Daemon hostnames (comma-separated, e.g. "myhost,.example.com" or "true" for any)',
+      "--allowed-hosts <hosts>",
+      'Comma-separated Host allowlist values (example: "localhost,.example.com" or "true")',
    )
-    .addOption(new Option("--allowed-hosts <hosts>").hideHelp())
-    .action(
-      withOutput((...args) => {
-        const [options, command] = args.slice(-2) as [(typeof args)[number], Command];
-        return runRestartCommand(
-          {
-            ...options,
-            hostnames:
-              typeof options.hostnames === "string"
-                ? options.hostnames
-                : typeof options.allowedHosts === "string"
-                  ? options.allowedHosts
-                  : undefined,
-          },
-          command,
-        );
-      }),
-    );
+    .action(withOutput(runRestartCommand));

  return daemon;
 }
@@ -13,7 +13,7 @@ export interface DaemonStartOptions {
  relay?: boolean;
  mcp?: boolean;
  injectMcp?: boolean;
-  hostnames?: string;
+  allowedHosts?: string;
 }

 export interface LocalDaemonPidInfo {
@@ -113,8 +113,8 @@ function buildChildEnv(options: DaemonStartOptions): NodeJS.ProcessEnv {
  } else if (options.port) {
    childEnv.PASEO_LISTEN = `127.0.0.1:${options.port}`;
  }
-  if (options.hostnames) {
-    childEnv.PASEO_HOSTNAMES = options.hostnames;
+  if (options.allowedHosts) {
+    childEnv.PASEO_ALLOWED_HOSTS = options.allowedHosts;
  }
  return childEnv;
 }
@@ -322,7 +322,6 @@ export function resolveLocalDaemonState(options: { home?: string } = {}): LocalD
    ...envWithHome(options.home),
    // Status should reflect local persisted config + pid file, not inherited daemon env overrides.
    PASEO_LISTEN: undefined,
-    PASEO_HOSTNAMES: undefined,
    PASEO_ALLOWED_HOSTS: undefined,
  };
  const home = resolvePaseoHome(env);
@@ -61,7 +61,7 @@ function toStartOptions(options: CommandOptions): DaemonStartOptions {
    relay: typeof options.relay === "boolean" ? options.relay : undefined,
    mcp: typeof options.mcp === "boolean" ? options.mcp : undefined,
    injectMcp: typeof options.injectMcp === "boolean" ? options.injectMcp : undefined,
-    hostnames: typeof options.hostnames === "string" ? options.hostnames : undefined,
+    allowedHosts: typeof options.allowedHosts === "string" ? options.allowedHosts : undefined,
  };

  if (startOptions.listen && startOptions.port) {
@@ -1,4 +1,4 @@
-import { Command, Option } from "commander";
+import { Command } from "commander";
 import chalk from "chalk";
 import {
  startLocalDaemonForeground,
@@ -9,10 +9,6 @@ import { getErrorMessage } from "../../utils/errors.js";

 export type { DaemonStartOptions as StartOptions } from "./local-daemon.js";

-type RawStartCommandOptions = StartOptions & {
-  allowedHosts?: string;
-};
-
 export function startCommand(): Command {
  return new Command("start")
    .description("Start the local Paseo daemon")
@@ -24,15 +20,11 @@ export function startCommand(): Command {
    .option("--no-mcp", "Disable the Agent MCP HTTP endpoint")
    .option("--no-inject-mcp", "Disable auto-injecting the Paseo MCP into created agents")
    .option(
-      "--hostnames <hosts>",
-      'Daemon hostnames (comma-separated, e.g. "myhost,.example.com" or "true" for any)',
+      "--allowed-hosts <hosts>",
+      'Comma-separated Host allowlist values (example: "localhost,.example.com" or "true")',
    )
-    .addOption(new Option("--allowed-hosts <hosts>").hideHelp())
-    .action(async (options: RawStartCommandOptions) => {
-      await runStart({
-        ...options,
-        hostnames: options.hostnames ?? options.allowedHosts,
-      });
+    .action(async (options: StartOptions) => {
+      await runStart(options);
    });
 }

@@ -1,5 +1,5 @@
 import { cancel, confirm, intro, isCancel, log, note, outro, spinner } from "@clack/prompts";
-import { Command, Option } from "commander";
+import { Command } from "commander";
 import { writeFileSync } from "node:fs";
 import path from "node:path";
 import {
@@ -24,10 +24,6 @@ interface OnboardOptions extends DaemonStartOptions {
  voice?: "ask" | "enable" | "disable";
 }

-type RawOnboardOptions = OnboardOptions & {
-  allowedHosts?: string;
-};
-
 type OnboardPersistedConfig = PersistedConfig & {
  features?: PersistedConfig["features"] & {
    dictation?: PersistedConfig["features"] extends { dictation?: infer T }
@@ -68,7 +64,7 @@ function parseTimeoutMs(raw: string | undefined): number {
  return Math.ceil(seconds * 1000);
 }

-function toCliOverrides(options: OnboardOptions): CliConfigOverrides {
+function toCliOverrides(options: DaemonStartOptions): CliConfigOverrides {
  const cliOverrides: CliConfigOverrides = {};

  if (options.listen) {
@@ -81,9 +77,9 @@ function toCliOverrides(options: OnboardOptions): CliConfigOverrides {
    cliOverrides.relayEnabled = false;
  }

-  if (options.hostnames) {
-    const raw = options.hostnames.trim();
-    cliOverrides.hostnames =
+  if (options.allowedHosts) {
+    const raw = options.allowedHosts.trim();
+    cliOverrides.allowedHosts =
      raw.toLowerCase() === "true"
        ? true
        : raw
@@ -301,17 +297,13 @@ export function onboardCommand(): Command {
    .option("--no-relay", "Disable relay connection")
    .option("--no-mcp", "Disable the Agent MCP HTTP endpoint")
    .option(
-      "--hostnames <hosts>",
-      'Daemon hostnames (comma-separated, e.g. "myhost,.example.com" or "true" for any)',
+      "--allowed-hosts <hosts>",
+      'Comma-separated Host allowlist values (example: "localhost,.example.com" or "true")',
    )
-    .addOption(new Option("--allowed-hosts <hosts>").hideHelp())
    .option("--timeout <seconds>", "Max time to wait for daemon readiness (default: 600)")
    .option("--voice <mode>", "Voice setup mode: ask, enable, disable", "ask")
-    .action(async (options: RawOnboardOptions) => {
-      await runOnboard({
-        ...options,
-        hostnames: options.hostnames ?? options.allowedHosts,
-      });
+    .action(async (options: OnboardOptions) => {
+      await runOnboard(options);
    });
 }

@@ -1,6 +1,6 @@
 {
  "name": "@getpaseo/desktop",
-  "version": "0.1.57-rc.1",
+  "version": "0.1.55-rc.2",
  "private": true,
  "description": "Paseo desktop app (Electron wrapper)",
  "main": "dist/main.js",
@@ -13,8 +13,8 @@
    "typecheck": "tsc --noEmit -p tsconfig.json"
  },
  "dependencies": {
-    "@getpaseo/cli": "0.1.57-rc.1",
-    "@getpaseo/server": "0.1.57-rc.1",
+    "@getpaseo/cli": "0.1.55-rc.2",
+    "@getpaseo/server": "0.1.55-rc.2",
    "electron-log": "^5.4.3",
    "electron-updater": "^6.6.2",
    "ws": "^8.14.2"
@@ -1,6 +1,6 @@
 {
  "name": "@getpaseo/expo-two-way-audio",
-  "version": "0.1.57-rc.1",
+  "version": "0.1.55-rc.2",
  "description": "Native module for two way audio streaming",
  "main": "build/index.js",
  "types": "build/index.d.ts",
@@ -1,6 +1,6 @@
 {
  "name": "@getpaseo/highlight",
-  "version": "0.1.57-rc.1",
+  "version": "0.1.55-rc.2",
  "type": "module",
  "publishConfig": {
    "access": "public"
@@ -1,6 +1,6 @@
 {
  "name": "@getpaseo/relay",
-  "version": "0.1.57-rc.1",
+  "version": "0.1.55-rc.2",
  "description": "Paseo relay for bridging daemon and client connections",
  "type": "module",
  "publishConfig": {
@@ -1,6 +1,6 @@
 {
  "name": "@getpaseo/server",
-  "version": "0.1.57-rc.1",
+  "version": "0.1.55-rc.2",
  "description": "Paseo backend server",
  "type": "module",
  "publishConfig": {
@@ -64,8 +64,8 @@
    "@ai-sdk/openai": "2.0.52",
    "@anthropic-ai/claude-agent-sdk": "^0.2.11",
    "@deepgram/sdk": "^3.4.0",
-    "@getpaseo/highlight": "0.1.57-rc.1",
-    "@getpaseo/relay": "0.1.57-rc.1",
+    "@getpaseo/highlight": "0.1.55-rc.2",
+    "@getpaseo/relay": "0.1.55-rc.2",
    "@isaacs/ttlcache": "^2.1.4",
    "@modelcontextprotocol/sdk": "^1.20.1",
    "@opencode-ai/sdk": "1.2.6",
@@ -1187,28 +1187,8 @@ export class DaemonClient {
    }
  }

-  async clearAgentAttention(agentId: string | string[]): Promise<void> {
-    const requestId = this.createRequestId();
-    const message = SessionInboundMessageSchema.parse({
-      type: "clear_agent_attention",
-      agentId,
-      requestId,
-    });
-    await this.sendRequest({
-      requestId,
-      message,
-      timeout: 15000,
-      options: { skipQueue: true },
-      select: (msg) => {
-        if (msg.type !== "clear_agent_attention_response") {
-          return null;
-        }
-        if (msg.payload.requestId !== requestId) {
-          return null;
-        }
-        return msg.payload;
-      },
-    });
+  clearAgentAttention(agentId: string | string[]): void {
+    this.sendSessionMessage({ type: "clear_agent_attention", agentId });
  }

  sendHeartbeat(params: {
@@ -1712,27 +1692,7 @@ export class DaemonClient {
  }

  async cancelAgent(agentId: string): Promise<void> {
-    const requestId = this.createRequestId();
-    const message = SessionInboundMessageSchema.parse({
-      type: "cancel_agent_request",
-      agentId,
-      requestId,
-    });
-    await this.sendRequest({
-      requestId,
-      message,
-      timeout: 15000,
-      options: { skipQueue: true },
-      select: (msg) => {
-        if (msg.type !== "cancel_agent_response") {
-          return null;
-        }
-        if (msg.payload.requestId !== requestId) {
-          return null;
-        }
-        return msg.payload;
-      },
-    });
+    this.sendSessionMessage({ type: "cancel_agent_request", agentId });
  }

  async setAgentMode(agentId: string, modeId: string): Promise<void> {
@@ -119,7 +119,7 @@ describe("agent MCP end-to-end (offline)", () => {
      listen: `127.0.0.1:${port}`,
      paseoHome,
      corsAllowedOrigins: [],
-      hostnames: true,
+      allowedHosts: true,
      mcpEnabled: true,
      staticDir,
      mcpDebug: false,
@@ -192,7 +192,7 @@ describe("agent MCP end-to-end (offline)", () => {
      listen: `127.0.0.1:${port}`,
      paseoHome,
      corsAllowedOrigins: [],
-      hostnames: true,
+      allowedHosts: true,
      mcpEnabled: true,
      staticDir,
      mcpDebug: false,
@@ -216,7 +216,7 @@ describe("agent MCP end-to-end (offline)", () => {
      listen: `127.0.0.1:${disabledPort}`,
      paseoHome: disabledPaseoHome,
      corsAllowedOrigins: [],
-      hostnames: true,
+      allowedHosts: true,
      mcpEnabled: true,
      mcpInjectIntoAgents: false,
      staticDir: disabledStaticDir,
@@ -307,7 +307,7 @@ describe("agent MCP end-to-end (offline)", () => {
      listen: `127.0.0.1:${port}`,
      paseoHome,
      corsAllowedOrigins: [],
-      hostnames: true,
+      allowedHosts: true,
      mcpEnabled: true,
      staticDir,
      mcpDebug: false,
@@ -42,7 +42,7 @@ async function startAgentMcpServer(logger: pino.Logger): Promise<AgentMcpServerH
    logger,
  });

-  let mcpAllowedHosts: string[] | undefined;
+  let allowedHosts: string[] | undefined;
  const agentMcpTransports = new Map<string, StreamableHTTPServerTransport>();

  const createAgentMcpTransport = async (callerAgentId?: string) => {
@@ -62,7 +62,7 @@ async function startAgentMcpServer(logger: pino.Logger): Promise<AgentMcpServerH
        agentMcpTransports.delete(sessionId);
      },
      enableDnsRebindingProtection: true,
-      ...(mcpAllowedHosts ? { allowedHosts: mcpAllowedHosts } : {}),
+      ...(allowedHosts ? { allowedHosts } : {}),
    });

    transport.onclose = () => {
@@ -129,7 +129,7 @@ async function startAgentMcpServer(logger: pino.Logger): Promise<AgentMcpServerH
    });
  });

-  mcpAllowedHosts = [`127.0.0.1:${port}`, `localhost:${port}`];
+  allowedHosts = [`127.0.0.1:${port}`, `localhost:${port}`];
  const url = `http://127.0.0.1:${port}/mcp/agents`;

  return {
@@ -1,86 +0,0 @@
-import { afterEach, describe, expect, test, vi } from "vitest";
-
-vi.mock("@opencode-ai/sdk/v2/client", () => ({
-  createOpencodeClient: vi.fn(),
-}));
-
-import { createOpencodeClient } from "@opencode-ai/sdk/v2/client";
-
-import { createTestLogger } from "../../../test-utils/test-logger.js";
-import { OpenCodeAgentClient, OpenCodeServerManager } from "./opencode-agent.js";
-
-function createDeferred<T>(): {
-  promise: Promise<T>;
-  resolve: (value: T) => void;
-  reject: (error: unknown) => void;
-} {
-  let resolve!: (value: T) => void;
-  let reject!: (error: unknown) => void;
-  const promise = new Promise<T>((res, rej) => {
-    resolve = res;
-    reject = rej;
-  });
-  return { promise, resolve, reject };
-}
-
-describe("OpenCodeAgentSession slash command timeout handling", () => {
-  afterEach(() => {
-    vi.restoreAllMocks();
-  });
-
-  test("waits for SSE completion when slash commands hit a header timeout", async () => {
-    const idleEventGate = createDeferred<void>();
-
-    vi.mocked(createOpencodeClient).mockReturnValue({
-      session: {
-        create: vi.fn().mockResolvedValue({ data: { id: "session-1" } }),
-        command: vi.fn().mockRejectedValue(new Error("fetch failed: Headers Timeout Error")),
-      },
-      provider: {
-        list: vi.fn().mockResolvedValue({
-          data: {
-            connected: ["openai"],
-            all: [{ id: "openai", name: "OpenAI", models: {} }],
-          },
-        }),
-      },
-      event: {
-        subscribe: vi.fn().mockResolvedValue({
-          stream: (async function* () {
-            await idleEventGate.promise;
-            yield {
-              type: "session.idle",
-              properties: { sessionID: "session-1" },
-            };
-          })(),
-        }),
-      },
-      command: {
-        list: vi.fn().mockResolvedValue({
-          data: [{ name: "help", description: "Show help", hints: [] }],
-        }),
-      },
-      app: {
-        agents: vi.fn().mockResolvedValue({ data: [] }),
-      },
-    } as never);
-
-    vi.spyOn(OpenCodeServerManager, "getInstance").mockReturnValue({
-      ensureRunning: vi.fn().mockResolvedValue({ port: 1234, url: "http://127.0.0.1:1234" }),
-    } as never);
-
-    const client = new OpenCodeAgentClient(createTestLogger());
-    const session = await client.createSession({ provider: "opencode", cwd: "/tmp" });
-
-    const runPromise = session.run("/help");
-    await Promise.resolve();
-    idleEventGate.resolve();
-
-    await expect(runPromise).resolves.toMatchObject({
-      sessionId: "session-1",
-      finalText: "",
-      timeline: [],
-      usage: undefined,
-    });
-  });
-});
@@ -315,65 +315,6 @@ const hasOpenCode = isBinaryInstalled("opencode");
 });

 describe("OpenCode adapter context-window normalization", () => {
-  test("close reconciliation aborts then archives upstream session", async () => {
-    const abort = vi.fn().mockResolvedValue({ data: true, error: undefined });
-    const update = vi.fn().mockResolvedValue({
-      data: { id: "session-1", time: { archived: Date.now() } },
-      error: undefined,
-    });
-
-    await __openCodeInternals.reconcileOpenCodeSessionClose({
-      client: {
-        session: {
-          abort,
-          update,
-        },
-      } as never,
-      sessionId: "session-1",
-      directory: "/tmp/project",
-      logger: createTestLogger(),
-    });
-
-    expect(abort).toHaveBeenCalledWith({
-      sessionID: "session-1",
-      directory: "/tmp/project",
-    });
-    expect(update).toHaveBeenCalledTimes(1);
-    expect(update).toHaveBeenCalledWith({
-      sessionID: "session-1",
-      directory: "/tmp/project",
-      time: {
-        archived: expect.any(Number),
-      },
-    });
-  });
-
-  test("close reconciliation still archives when abort returns an error", async () => {
-    const abort = vi.fn().mockResolvedValue({
-      data: undefined,
-      error: { data: {}, errors: [], success: false },
-    });
-    const update = vi.fn().mockResolvedValue({
-      data: { id: "session-1", time: { archived: Date.now() } },
-      error: undefined,
-    });
-
-    await __openCodeInternals.reconcileOpenCodeSessionClose({
-      client: {
-        session: {
-          abort,
-          update,
-        },
-      } as never,
-      sessionId: "session-1",
-      directory: "/tmp/project",
-      logger: createTestLogger(),
-    });
-
-    expect(abort).toHaveBeenCalledTimes(1);
-    expect(update).toHaveBeenCalledTimes(1);
-  });
-
  test("builds OpenCode file parts for image prompt blocks", () => {
    expect(
      __openCodeInternals.buildOpenCodePromptParts([
@@ -107,12 +107,6 @@ const OPENCODE_FATAL_RETRY_MESSAGE_TOKENS = [
  "does not exist",
  "unsupported model",
 ] as const;
-const OPENCODE_HEADERS_TIMEOUT_TOKENS = [
-  "headers timeout",
-  "headers timeout error",
-  "headers_timeout",
-  "und_err_headers_timeout",
-] as const;

 const OpencodeToolStateSchema = z
  .object({
@@ -237,73 +231,6 @@ function normalizeTurnFailureError(error: unknown): string {
  return normalized.length > 0 ? normalized : "Unknown error";
 }

-function isOpenCodeNotFoundError(error: unknown): boolean {
-  return (
-    typeof error === "object" &&
-    error !== null &&
-    "name" in error &&
-    (error as { name?: unknown }).name === "NotFoundError"
-  );
-}
-
-async function reconcileOpenCodeSessionClose(params: {
-  client: Pick<OpencodeClient, "session">;
-  sessionId: string;
-  directory: string;
-  logger: Logger;
-}): Promise<void> {
-  const { client, sessionId, directory, logger } = params;
-
-  try {
-    const response = await client.session.abort({
-      sessionID: sessionId,
-      directory,
-    });
-    if (response.error && !isOpenCodeNotFoundError(response.error)) {
-      logger.warn(
-        {
-          sessionId,
-          error: normalizeTurnFailureError(response.error),
-        },
-        "Failed to abort OpenCode session during close",
-      );
-    }
-  } catch (error) {
-    logger.warn(
-      {
-        sessionId,
-        error: normalizeTurnFailureError(error),
-      },
-      "Failed to abort OpenCode session during close",
-    );
-  }
-
-  try {
-    const response = await client.session.update({
-      sessionID: sessionId,
-      directory,
-      time: { archived: Date.now() },
-    });
-    if (response.error && !isOpenCodeNotFoundError(response.error)) {
-      logger.warn(
-        {
-          sessionId,
-          error: normalizeTurnFailureError(response.error),
-        },
-        "Failed to archive OpenCode session during close",
-      );
-    }
-  } catch (error) {
-    logger.warn(
-      {
-        sessionId,
-        error: normalizeTurnFailureError(error),
-      },
-      "Failed to archive OpenCode session during close",
-    );
-  }
-}
-
 function isFatalOpenCodeRetryMessage(message: string | null | undefined): boolean {
  const normalized = typeof message === "string" ? message.trim().toLowerCase() : "";
  if (!normalized) {
@@ -312,49 +239,6 @@ function isFatalOpenCodeRetryMessage(message: string | null | undefined): boolea
  return OPENCODE_FATAL_RETRY_MESSAGE_TOKENS.some((token) => normalized.includes(token));
 }

-function isOpenCodeHeadersTimeoutFailure(error: unknown): boolean {
-  const diagnostics = new Set<string>();
-  const queue: unknown[] = [error];
-
-  while (queue.length > 0) {
-    const current = queue.shift();
-    if (!current) {
-      continue;
-    }
-
-    const normalized = stringifyUnknownError(current).trim().toLowerCase();
-    if (normalized) {
-      diagnostics.add(normalized);
-    }
-
-    if (typeof current === "object") {
-      const record = current as {
-        message?: unknown;
-        code?: unknown;
-        name?: unknown;
-        cause?: unknown;
-      };
-
-      for (const value of [record.message, record.code, record.name]) {
-        if (typeof value === "string") {
-          const diagnostic = value.trim().toLowerCase();
-          if (diagnostic) {
-            diagnostics.add(diagnostic);
-          }
-        }
-      }
-
-      if (record.cause) {
-        queue.push(record.cause);
-      }
-    }
-  }
-
-  return [...diagnostics].some((diagnostic) =>
-    OPENCODE_HEADERS_TIMEOUT_TOKENS.some((token) => diagnostic.includes(token)),
-  );
-}
-
 function isAlreadyPresentMcpError(error: unknown): boolean {
  const normalized = stringifyUnknownError(error).toLowerCase();
  return MCP_ALREADY_PRESENT_ERROR_TOKENS.some((token) => normalized.includes(token));
@@ -686,7 +570,6 @@ export const __openCodeInternals = {
  hasNormalizedOpenCodeUsage,
  mergeOpenCodeStepFinishUsage,
  parseOpenCodeModelLookupKey,
-  reconcileOpenCodeSessionClose,
  resolveOpenCodeModelLookupKeyFromAssistantMessage,
  resolveOpenCodeSelectedModelContextWindow,
 };
@@ -1647,17 +1530,6 @@ class OpenCodeAgentSession implements AgentSession {
        })
        .then((response) => {
          if (response.error) {
-            if (isOpenCodeHeadersTimeoutFailure(response.error)) {
-              this.logger.warn(
-                {
-                  err: response.error,
-                  commandName: slashCommand.commandName,
-                  turnId,
-                },
-                "OpenCode slash command hit a header timeout; waiting for SSE terminal event",
-              );
-              return;
-            }
            const errorMsg = normalizeTurnFailureError(response.error);
            this.finishForegroundTurn(
              { type: "turn_failed", provider: "opencode", error: errorMsg },
@@ -1671,17 +1543,6 @@ class OpenCodeAgentSession implements AgentSession {
          }
        })
        .catch((err) => {
-          if (isOpenCodeHeadersTimeoutFailure(err)) {
-            this.logger.warn(
-              {
-                err,
-                commandName: slashCommand.commandName,
-                turnId,
-              },
-              "OpenCode slash command hit a header timeout; waiting for SSE terminal event",
-            );
-            return;
-          }
          this.finishForegroundTurn(
            { type: "turn_failed", provider: "opencode", error: normalizeTurnFailureError(err) },
            turnId,
@@ -2071,12 +1932,6 @@ class OpenCodeAgentSession implements AgentSession {

  async close(): Promise<void> {
    this.abortController?.abort();
-    await reconcileOpenCodeSessionClose({
-      client: this.client,
-      sessionId: this.sessionId,
-      directory: this.config.cwd,
-      logger: this.logger,
-    });
    this.subscribers.clear();
    this.activeForegroundTurnId = null;
  }
@@ -0,0 +1,45 @@
+import { describe, it, expect } from "vitest";
+import { isHostAllowed, mergeAllowedHosts, parseAllowedHostsEnv } from "./allowed-hosts.js";
+
+describe("allowed hosts (vite-style)", () => {
+  it("allows localhost by default", () => {
+    expect(isHostAllowed("localhost:6767", undefined)).toBe(true);
+  });
+
+  it("allows subdomains of .localhost by default", () => {
+    expect(isHostAllowed("foo.localhost:6767", undefined)).toBe(true);
+  });
+
+  it("allows IP addresses by default", () => {
+    expect(isHostAllowed("127.0.0.1:6767", undefined)).toBe(true);
+    expect(isHostAllowed("[::1]:6767", undefined)).toBe(true);
+  });
+
+  it("rejects non-default hosts when no allowlist is provided", () => {
+    expect(isHostAllowed("evil.com:6767", undefined)).toBe(false);
+  });
+
+  it("allows any host when set to true", () => {
+    expect(isHostAllowed("evil.com:6767", true)).toBe(true);
+  });
+
+  it("supports leading-dot patterns", () => {
+    const allowed = [".example.com"];
+    expect(isHostAllowed("example.com:6767", allowed)).toBe(true);
+    expect(isHostAllowed("foo.example.com:6767", allowed)).toBe(true);
+    expect(isHostAllowed("foo.bar.example.com:6767", allowed)).toBe(true);
+    expect(isHostAllowed("notexample.com:6767", allowed)).toBe(false);
+  });
+
+  it("merges arrays (append + de-dupe) and short-circuits on true", () => {
+    expect(mergeAllowedHosts([["a"], ["a", "b"]])).toEqual(["a", "b"]);
+    expect(mergeAllowedHosts([["a"], true, ["b"]])).toBe(true);
+  });
+
+  it("parses env var values", () => {
+    expect(parseAllowedHostsEnv(undefined)).toBeUndefined();
+    expect(parseAllowedHostsEnv("")).toBeUndefined();
+    expect(parseAllowedHostsEnv("true")).toBe(true);
+    expect(parseAllowedHostsEnv("localhost,.example.com")).toEqual(["localhost", ".example.com"]);
+  });
+});
@@ -1,6 +1,6 @@
 import net from "node:net";

-export type HostnamesConfig = true | string[] | undefined;
+export type AllowedHostsConfig = true | string[] | undefined;

 function normalizeHostname(hostname: string): string {
  return hostname.trim().toLowerCase();
@@ -25,7 +25,7 @@ function parseHostnameFromHostHeader(hostHeader: string): string | null {
  return normalizeHostname(trimmed.slice(0, colonIndex));
 }

-function matchesHostnamePattern(hostname: string, pattern: string): boolean {
+function matchesAllowedHostPattern(hostname: string, pattern: string): boolean {
  const normalizedPattern = normalizeHostname(pattern);
  if (!normalizedPattern) return false;

@@ -47,33 +47,33 @@ function isDefaultAllowedHostname(hostname: string): boolean {
 }

 /**
- * Vite-style hostname allowlist check, adapted to raw Host headers.
+ * Vite-style allowed hosts check, adapted to raw Host headers.
 *
 * Semantics:
- * - `hostnames === true` => allow any host.
- * - `hostnames === []` or `undefined` => allow localhost, *.localhost, and all IPs.
- * - `hostnames === ['.example.com', 'myhost']` => allow those *in addition* to defaults.
+ * - `allowedHosts === true` => allow any host.
+ * - `allowedHosts === []` or `undefined` => allow localhost, *.localhost, and all IPs.
+ * - `allowedHosts === ['.example.com', 'myhost']` => allow those *in addition* to defaults.
 */
-export function isHostnameAllowed(
+export function isHostAllowed(
  hostHeader: string | undefined,
-  hostnames: HostnamesConfig,
+  allowedHosts: AllowedHostsConfig,
 ): boolean {
  const hostname = hostHeader ? parseHostnameFromHostHeader(hostHeader) : null;
  if (!hostname) return false;

-  if (hostnames === true) return true;
+  if (allowedHosts === true) return true;

  // Defaults are always allowed.
  if (isDefaultAllowedHostname(hostname)) return true;

-  const patterns = hostnames ?? [];
+  const patterns = allowedHosts ?? [];
  for (const pattern of patterns) {
-    if (matchesHostnamePattern(hostname, pattern)) return true;
+    if (matchesAllowedHostPattern(hostname, pattern)) return true;
  }
  return false;
 }

-export function mergeHostnames(values: Array<HostnamesConfig>): HostnamesConfig {
+export function mergeAllowedHosts(values: Array<AllowedHostsConfig>): AllowedHostsConfig {
  let merged: string[] = [];
  for (const value of values) {
    if (value === true) return true;
@@ -85,7 +85,7 @@ export function mergeHostnames(values: Array<HostnamesConfig>): HostnamesConfig
  return deduped;
 }

-export function parseHostnamesEnv(raw: string | undefined): HostnamesConfig {
+export function parseAllowedHostsEnv(raw: string | undefined): AllowedHostsConfig {
  if (!raw) return undefined;
  const trimmed = raw.trim();
  if (!trimmed) return undefined;
@@ -50,7 +50,7 @@ describe("paseo daemon bootstrap", () => {
      listen: "127.0.0.1:0",
      paseoHome,
      corsAllowedOrigins: [],
-      hostnames: true,
+      allowedHosts: true,
      mcpEnabled: false,
      staticDir,
      mcpDebug: false,
@@ -163,7 +163,7 @@ describe("paseo daemon bootstrap", () => {
      listen: socketPath,
      paseoHome,
      corsAllowedOrigins: [],
-      hostnames: true,
+      allowedHosts: true,
      mcpEnabled: false,
      staticDir,
      mcpDebug: false,
@@ -119,7 +119,7 @@ import type {
  AgentProviderRuntimeSettingsMap,
  ProviderOverride,
 } from "./agent/provider-launch-config.js";
-import { isHostnameAllowed, type HostnamesConfig } from "./hostnames.js";
+import { isHostAllowed, type AllowedHostsConfig } from "./allowed-hosts.js";

 type AgentMcpTransportMap = Map<string, StreamableHTTPServerTransport>;

@@ -162,7 +162,7 @@ export type PaseoDaemonConfig = {
  listen: string;
  paseoHome: string;
  corsAllowedOrigins: string[];
-  hostnames?: HostnamesConfig;
+  allowedHosts?: AllowedHostsConfig;
  mcpEnabled?: boolean;
  mcpInjectIntoAgents?: boolean;
  staticDir: string;
@@ -231,7 +231,7 @@ export async function createPaseoDaemon(
    if (listenTarget.type === "tcp") {
      app.use((req, res, next) => {
        const hostHeader = typeof req.headers.host === "string" ? req.headers.host : undefined;
-        if (!isHostnameAllowed(hostHeader, config.hostnames)) {
+        if (!isHostAllowed(hostHeader, config.allowedHosts)) {
          res.status(403).json({ error: "Invalid Host header" });
          return;
        }
@@ -604,7 +604,7 @@ export async function createPaseoDaemon(
              config.paseoHome,
              daemonConfigStore,
              mcpBaseUrl,
-              { allowedOrigins, hostnames: config.hostnames },
+              { allowedOrigins, allowedHosts: config.allowedHosts },
              speechService,
              terminalManager,
              {
@@ -11,7 +11,11 @@ import type {
 import { ProviderOverrideSchema } from "./agent/provider-launch-config.js";
 import { AgentProviderSchema } from "./agent/provider-manifest.js";
 import { resolveSpeechConfig } from "./speech/speech-config-resolver.js";
-import { mergeHostnames, parseHostnamesEnv, type HostnamesConfig } from "./hostnames.js";
+import {
+  mergeAllowedHosts,
+  parseAllowedHostsEnv,
+  type AllowedHostsConfig,
+} from "./allowed-hosts.js";

 const DEFAULT_PORT = 6767;
 const DEFAULT_RELAY_ENDPOINT = "relay.paseo.sh:443";
@@ -38,7 +42,7 @@ export type CliConfigOverrides = Partial<{
  relayEnabled: boolean;
  mcpEnabled: boolean;
  mcpInjectIntoAgents: boolean;
-  hostnames: HostnamesConfig;
+  allowedHosts: AllowedHostsConfig;
 }>;

 const OptionalVoiceLlmProviderSchema = z
@@ -129,10 +133,10 @@ export function loadConfig(

  const persistedCorsOrigins = persisted.daemon?.cors?.allowedOrigins ?? [];

-  const hostnames = mergeHostnames([
-    persisted.daemon?.hostnames,
-    parseHostnamesEnv(env.PASEO_HOSTNAMES ?? env.PASEO_ALLOWED_HOSTS),
-    options?.cli?.hostnames,
+  const allowedHosts = mergeAllowedHosts([
+    persisted.daemon?.allowedHosts,
+    parseAllowedHostsEnv(env.PASEO_ALLOWED_HOSTS),
+    options?.cli?.allowedHosts,
  ]);

  const mcpEnabled = options?.cli?.mcpEnabled ?? persisted.daemon?.mcp?.enabled ?? true;
@@ -177,7 +181,7 @@ export function loadConfig(
    corsAllowedOrigins: Array.from(
      new Set([...persistedCorsOrigins, ...envCorsOrigins].filter((s) => s.length > 0)),
    ),
-    hostnames,
+    allowedHosts,
    mcpEnabled,
    mcpInjectIntoAgents,
    mcpDebug: env.MCP_DEBUG === "1",
@@ -1,56 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { PersistedConfigSchema } from "./persisted-config.js";
-import { isHostnameAllowed, mergeHostnames, parseHostnamesEnv } from "./hostnames.js";
-
-describe("hostnames (vite-style)", () => {
-  it("allows localhost by default", () => {
-    expect(isHostnameAllowed("localhost:6767", undefined)).toBe(true);
-  });
-
-  it("allows subdomains of .localhost by default", () => {
-    expect(isHostnameAllowed("foo.localhost:6767", undefined)).toBe(true);
-  });
-
-  it("allows IP addresses by default", () => {
-    expect(isHostnameAllowed("127.0.0.1:6767", undefined)).toBe(true);
-    expect(isHostnameAllowed("[::1]:6767", undefined)).toBe(true);
-  });
-
-  it("rejects non-default hosts when no allowlist is provided", () => {
-    expect(isHostnameAllowed("evil.com:6767", undefined)).toBe(false);
-  });
-
-  it("allows any host when set to true", () => {
-    expect(isHostnameAllowed("evil.com:6767", true)).toBe(true);
-  });
-
-  it("supports leading-dot patterns", () => {
-    const hostnames = [".example.com"];
-    expect(isHostnameAllowed("example.com:6767", hostnames)).toBe(true);
-    expect(isHostnameAllowed("foo.example.com:6767", hostnames)).toBe(true);
-    expect(isHostnameAllowed("foo.bar.example.com:6767", hostnames)).toBe(true);
-    expect(isHostnameAllowed("notexample.com:6767", hostnames)).toBe(false);
-  });
-
-  it("merges arrays (append + de-dupe) and short-circuits on true", () => {
-    expect(mergeHostnames([["a"], ["a", "b"]])).toEqual(["a", "b"]);
-    expect(mergeHostnames([["a"], true, ["b"]])).toBe(true);
-  });
-
-  it("parses env var values", () => {
-    expect(parseHostnamesEnv(undefined)).toBeUndefined();
-    expect(parseHostnamesEnv("")).toBeUndefined();
-    expect(parseHostnamesEnv("true")).toBe(true);
-    expect(parseHostnamesEnv("localhost,.example.com")).toEqual(["localhost", ".example.com"]);
-  });
-
-  it("normalizes persisted allowedHosts into hostnames for backward compatibility", () => {
-    const parsed = PersistedConfigSchema.parse({
-      daemon: {
-        allowedHosts: [".example.com"],
-      },
-    });
-
-    expect(parsed.daemon?.hostnames).toEqual([".example.com"]);
-  });
-});
@@ -228,7 +228,6 @@ export const PersistedConfigSchema = z
    daemon: z
      .object({
        listen: z.string().optional(),
-        hostnames: z.union([z.literal(true), z.array(z.string())]).optional(),
        allowedHosts: z.union([z.literal(true), z.array(z.string())]).optional(),
        mcp: z
          .object({
@@ -253,10 +252,6 @@ export const PersistedConfigSchema = z
          .optional(),
      })
      .strict()
-      .transform(({ allowedHosts, ...daemon }) => {
-        const hostnames = daemon.hostnames ?? allowedHosts;
-        return hostnames === undefined ? daemon : { ...daemon, hostnames };
-      })
      .optional(),

    app: z
@@ -1752,7 +1752,7 @@ export class Session {
            break;

          case "cancel_agent_request":
-            await this.handleCancelAgentRequest(msg.agentId, msg.requestId);
+            await this.handleCancelAgentRequest(msg.agentId);
            break;

          case "restart_server_request":
@@ -1933,7 +1933,7 @@ export class Session {
            break;

          case "clear_agent_attention":
-            await this.handleClearAgentAttention(msg.agentId, msg.requestId);
+            await this.handleClearAgentAttention(msg.agentId);
            break;

          case "client_heartbeat":
@@ -3189,23 +3189,11 @@ export class Session {
    }
  }

-  private async handleCancelAgentRequest(agentId: string, requestId?: string): Promise<void> {
+  private async handleCancelAgentRequest(agentId: string): Promise<void> {
    this.sessionLogger.info({ agentId }, `Cancel request received for agent ${agentId}`);

    try {
      await this.interruptAgentIfRunning(agentId);
-      if (requestId) {
-        const agent = this.agentManager.getAgent(agentId);
-        const payload = agent ? await this.buildAgentPayload(agent) : null;
-        this.emit({
-          type: "cancel_agent_response",
-          payload: {
-            requestId,
-            agentId,
-            agent: payload,
-          },
-        });
-      }
    } catch (error) {
      this.handleAgentRunError(agentId, error, "Failed to cancel running agent on request");
    }
@@ -3869,32 +3857,11 @@ export class Session {
  /**
   * Handle clearing agent attention flag
   */
-  private async handleClearAgentAttention(
-    agentId: string | string[],
-    requestId?: string,
-  ): Promise<void> {
+  private async handleClearAgentAttention(agentId: string | string[]): Promise<void> {
    const agentIds = Array.isArray(agentId) ? agentId : [agentId];

    try {
      await Promise.all(agentIds.map((id) => this.agentManager.clearAgentAttention(id)));
-      if (requestId) {
-        const agents = (
-          await Promise.all(
-            agentIds.map(async (id) => {
-              const agent = this.agentManager.getAgent(id);
-              return agent ? this.buildAgentPayload(agent) : null;
-            }),
-          )
-        ).filter((payload): payload is NonNullable<typeof payload> => payload !== null);
-        this.emit({
-          type: "clear_agent_attention_response",
-          payload: {
-            requestId,
-            agentId,
-            agents,
-          },
-        });
-      }
    } catch (error: any) {
      this.sessionLogger.error({ err: error, agentIds }, "Failed to clear agent attention");
      // Don't throw - this is not critical
@@ -5476,17 +5443,7 @@ export class Session {
    projectRecord?: PersistedProjectRecord | null,
  ): Promise<WorkspaceDescriptorPayload> {
    const base = await this.describeWorkspaceRecord(workspace, projectRecord);
-
-    let snapshot: WorkspaceGitRuntimeSnapshot;
-    try {
-      snapshot = await this.workspaceGitService.getSnapshot(workspace.cwd);
-    } catch (error) {
-      this.sessionLogger.warn(
-        { err: error, cwd: workspace.cwd },
-        "Failed to load git snapshot for workspace",
-      );
-      return base;
-    }
+    const snapshot = await this.workspaceGitService.getSnapshot(workspace.cwd);

    const checkout = checkoutLiteFromGitSnapshot(workspace.cwd, snapshot.git);
    const displayName = deriveWorkspaceDisplayName({ cwd: workspace.cwd, checkout });
@@ -5923,6 +5880,8 @@ export class Session {
        buildPersistedWorkspaceRecord: (input) => this.buildPersistedWorkspaceRecord(input),
        buildProjectPlacement: (cwd) => this.buildProjectPlacement(cwd),
        projectRegistry: this.projectRegistry,
+        syncWorkspaceGitWatchTarget: (cwd, syncOptions) =>
+          this.syncWorkspaceGitWatchTarget(cwd, syncOptions),
        workspaceRegistry: this.workspaceRegistry,
        archiveProjectRecordIfEmpty: (projectId, archivedAt) =>
          this.archiveProjectRecordIfEmpty(projectId, archivedAt),
@@ -6310,8 +6269,6 @@ export class Session {
        emit: (message) => this.emit(message),
        registerPendingWorktreeWorkspace: (options) =>
          this.registerPendingWorktreeWorkspace(options),
-        syncWorkspaceGitWatchTarget: (cwd, syncOptions) =>
-          this.syncWorkspaceGitWatchTarget(cwd, syncOptions),
        sessionLogger: this.sessionLogger,
        runWorktreeSetupInBackground: (options) => this.runWorktreeSetupInBackground(options),
      },
@@ -85,7 +85,7 @@ export async function createTestPaseoDaemon(
      listen: `${listenHost}:0`,
      paseoHome,
      corsAllowedOrigins: options.corsAllowedOrigins ?? [],
-      hostnames: true,
+      allowedHosts: true,
      mcpEnabled: true,
      staticDir,
      mcpDebug: false,
@@ -23,8 +23,8 @@ import {
  wrapSessionMessage,
 } from "./messages.js";
 import { asUint8Array, decodeTerminalStreamFrame } from "../shared/terminal-stream-protocol.js";
-import type { HostnamesConfig } from "./hostnames.js";
-import { isHostnameAllowed } from "./hostnames.js";
+import type { AllowedHostsConfig } from "./allowed-hosts.js";
+import { isHostAllowed } from "./allowed-hosts.js";
 import { Session, type SessionLifecycleIntent, type SessionRuntimeMetrics } from "./session.js";
 import type { AgentProvider } from "./agent/agent-sdk-types.js";
 import type {
@@ -61,7 +61,7 @@ type PendingConnection = {

 type WebSocketServerConfig = {
  allowedOrigins: Set<string>;
-  hostnames?: HostnamesConfig;
+  allowedHosts?: AllowedHostsConfig;
 };

 type WebSocketRuntimeMetrics = SessionRuntimeMetrics & CheckoutDiffMetrics;
@@ -433,7 +433,7 @@ export class VoiceAssistantWebSocketServer {
      this.broadcastAgentAttention(params);
    });

-    const { allowedOrigins, hostnames } = wsConfig;
+    const { allowedOrigins, allowedHosts } = wsConfig;
    this.wss = new WebSocketServer({
      server,
      path: "/ws",
@@ -441,7 +441,7 @@ export class VoiceAssistantWebSocketServer {
        const requestMetadata = extractSocketRequestMetadata(req);
        const origin = requestMetadata.origin;
        const requestHost = requestMetadata.host ?? null;
-        if (requestHost && !isHostnameAllowed(requestHost, hostnames)) {
+        if (requestHost && !isHostAllowed(requestHost, allowedHosts)) {
          this.incrementRuntimeCounter("hostRejected");
          this.logger.warn(
            { ...requestMetadata, host: requestHost },
@@ -592,13 +592,6 @@ describe("WorkspaceGitServiceImpl", () => {
  });

  test("sets a 5-second fallback polling interval when recursive watch is unavailable", async () => {
-    if (process.platform === "linux") {
-      // On Linux, recursive watch is never attempted — the service uses per-directory
-      // watchers from the start. This scenario only applies to macOS/Windows where
-      // recursive watch is tried first and may fail.
-      return;
-    }
-
    const recursiveUnsupported = new Error("recursive unsupported");
    const watch = vi
      .fn()
@@ -636,12 +629,7 @@ describe("WorkspaceGitServiceImpl", () => {
    const target = (service as any).workingTreeWatchTargets.get("/tmp/plain");

    expect(subscription.repoRoot).toBeNull();
-    const expectedRecursive = process.platform !== "linux";
-    expect(watch).toHaveBeenCalledWith(
-      "/tmp/plain",
-      { recursive: expectedRecursive },
-      expect.any(Function),
-    );
+    expect(watch).toHaveBeenCalledWith("/tmp/plain", { recursive: true }, expect.any(Function));
    expect(target?.repoWatchPath).toBe("/tmp/plain");
    expect(target?.fallbackRefreshInterval).not.toBeNull();

@@ -21,7 +21,7 @@ import type { WorkspaceGitService } from "./workspace-git-service.js";
 import { normalizeWorkspaceId as normalizePersistedWorkspaceId } from "./workspace-registry-model.js";
 import { createAgentWorktree } from "./worktree-bootstrap.js";
 import type { TerminalManager } from "../terminal/terminal-manager.js";
-import { getCurrentBranch, resolveRepositoryDefaultBranch } from "../utils/checkout-git.js";
+import { resolveRepositoryDefaultBranch } from "../utils/checkout-git.js";
 import { expandTilde } from "../utils/path.js";
 import {
  computeWorktreePath,
@@ -35,7 +35,8 @@ import {
  validateBranchSlug,
  type WorktreeConfig,
 } from "../utils/worktree.js";
-import { toCheckoutError } from "./checkout-git-utils.js";
+import { runGitCommand } from "../utils/run-git-command.js";
+import { READ_ONLY_GIT_ENV, toCheckoutError } from "./checkout-git-utils.js";
 const SAFE_GIT_REF_PATTERN = /^[A-Za-z0-9._\/-]+$/;

 export type NormalizedGitOptions = {
@@ -86,6 +87,7 @@ type RegisterPendingWorktreeWorkspaceDependencies = {
  }) => PersistedWorkspaceRecord;
  buildProjectPlacement: (cwd: string) => Promise<ProjectPlacementPayload>;
  projectRegistry: Pick<ProjectRegistry, "get" | "upsert">;
+  syncWorkspaceGitWatchTarget: (cwd: string, options: { isGit: boolean }) => Promise<void>;
  workspaceRegistry: Pick<WorkspaceRegistry, "get" | "upsert">;
  archiveProjectRecordIfEmpty: (projectId: string, archivedAt: string) => Promise<void>;
 };
@@ -109,7 +111,6 @@ type HandleCreatePaseoWorktreeRequestDependencies = {
    worktreePath: string;
    branchName: string;
  }) => Promise<PersistedWorkspaceRecord>;
-  syncWorkspaceGitWatchTarget: (cwd: string, options: { isGit: boolean }) => Promise<void>;
  sessionLogger: Logger;
  runWorktreeSetupInBackground: (options: {
    requestCwd: string;
@@ -152,7 +153,11 @@ export async function buildAgentSessionConfig(
    if (normalized.createNewBranch) {
      targetBranch = normalized.newBranchName!;
    } else {
-      targetBranch = (await getCurrentBranch(cwd)) ?? "";
+      const { stdout } = await runGitCommand(["rev-parse", "--abbrev-ref", "HEAD"], {
+        cwd,
+        env: READ_ONLY_GIT_ENV,
+      });
+      targetBranch = stdout.trim();
    }

    if (!targetBranch) {
@@ -530,6 +535,9 @@ export async function registerPendingWorktreeWorkspace(

  await dependencies.projectRegistry.upsert(nextProjectRecord);
  await dependencies.workspaceRegistry.upsert(nextWorkspaceRecord);
+  await dependencies.syncWorkspaceGitWatchTarget(workspaceId, {
+    isGit: placement.checkout.isGit,
+  });

  if (
    existingWorkspace &&
@@ -585,8 +593,6 @@ export async function handleCreatePaseoWorktreeRequest(
      paseoHome: dependencies.paseoHome,
    });

-    await dependencies.syncWorkspaceGitWatchTarget(worktreePath, { isGit: true });
-
    const descriptor = await dependencies.describeWorkspaceRecord(workspace);
    dependencies.emit({
      type: "create_paseo_worktree_response",
@@ -876,7 +876,6 @@ export const RefreshAgentRequestMessageSchema = z.object({
 export const CancelAgentRequestMessageSchema = z.object({
  type: z.literal("cancel_agent_request"),
  agentId: z.string(),
-  requestId: z.string().optional(),
 });

 export const RestartServerRequestMessageSchema = z.object({
@@ -1308,7 +1307,6 @@ export const FileDownloadTokenRequestSchema = z.object({
 export const ClearAgentAttentionMessageSchema = z.object({
  type: z.literal("clear_agent_attention"),
  agentId: z.union([z.string(), z.array(z.string())]),
-  requestId: z.string().optional(),
 });

 export const ClientHeartbeatMessageSchema = z.object({
@@ -2104,24 +2102,6 @@ export const FetchAgentTimelineResponseMessageSchema = z.object({
  }),
 });

-export const CancelAgentResponseMessageSchema = z.object({
-  type: z.literal("cancel_agent_response"),
-  payload: z.object({
-    requestId: z.string(),
-    agentId: z.string(),
-    agent: AgentSnapshotPayloadSchema.nullable(),
-  }),
-});
-
-export const ClearAgentAttentionResponseMessageSchema = z.object({
-  type: z.literal("clear_agent_attention_response"),
-  payload: z.object({
-    requestId: z.string(),
-    agentId: z.string().or(z.array(z.string())),
-    agents: z.array(AgentSnapshotPayloadSchema),
-  }),
-});
-
 export const SendAgentMessageResponseMessageSchema = z.object({
  type: z.literal("send_agent_message_response"),
  payload: z.object({
@@ -2791,8 +2771,6 @@ export const SessionOutboundMessageSchema = z.discriminatedUnion("type", [
  ArchiveWorkspaceResponseMessageSchema,
  FetchAgentResponseMessageSchema,
  FetchAgentTimelineResponseMessageSchema,
-  CancelAgentResponseMessageSchema,
-  ClearAgentAttentionResponseMessageSchema,
  SendAgentMessageResponseMessageSchema,
  SetVoiceModeResponseMessageSchema,
  GetDaemonConfigResponseMessageSchema,
@@ -2905,7 +2883,6 @@ export type FetchAgentResponseMessage = z.infer<typeof FetchAgentResponseMessage
 export type FetchAgentTimelineResponseMessage = z.infer<
  typeof FetchAgentTimelineResponseMessageSchema
 >;
-export type CancelAgentResponseMessage = z.infer<typeof CancelAgentResponseMessageSchema>;
 export type SendAgentMessageResponseMessage = z.infer<typeof SendAgentMessageResponseMessageSchema>;
 export type SetVoiceModeResponseMessage = z.infer<typeof SetVoiceModeResponseMessageSchema>;
 export type SetAgentModeResponseMessage = z.infer<typeof SetAgentModeResponseMessageSchema>;
@@ -3071,9 +3048,6 @@ export type FileDownloadTokenResponse = z.infer<typeof FileDownloadTokenResponse
 export type RestartServerRequestMessage = z.infer<typeof RestartServerRequestMessageSchema>;
 export type ShutdownServerRequestMessage = z.infer<typeof ShutdownServerRequestMessageSchema>;
 export type ClearAgentAttentionMessage = z.infer<typeof ClearAgentAttentionMessageSchema>;
-export type ClearAgentAttentionResponseMessage = z.infer<
-  typeof ClearAgentAttentionResponseMessageSchema
->;
 export type ClientHeartbeatMessage = z.infer<typeof ClientHeartbeatMessageSchema>;
 export type ListCommandsRequest = z.infer<typeof ListCommandsRequestSchema>;
 export type ListCommandsResponse = z.infer<typeof ListCommandsResponseSchema>;
@@ -18,7 +18,6 @@ import {
  __setGhPathForTests,
  __setPullRequestStatusCacheTtlForTests,
  commitAll,
-  getCurrentBranch,
  getCheckoutDiff,
  getCheckoutShortstat,
  getPullRequestStatus,
@@ -85,15 +84,6 @@ describe("checkout git utilities", () => {
    );
  });

-  it("returns null for getCurrentBranch in a repo with no commits", async () => {
-    const emptyRepo = join(tempDir, "empty-repo");
-    execSync(`mkdir -p ${emptyRepo}`);
-    execSync("git init -b main", { cwd: emptyRepo });
-
-    const branch = await getCurrentBranch(emptyRepo);
-    expect(branch).toBeNull();
-  });
-
  it("handles status/diff/commit in a normal repo", async () => {
    writeFileSync(join(repoDir, "file.txt"), "updated\n");

@@ -525,16 +525,12 @@ async function requireGitRepo(cwd: string): Promise<void> {
 }

 export async function getCurrentBranch(cwd: string): Promise<string | null> {
-  try {
-    const { stdout } = await runGitCommand(["rev-parse", "--abbrev-ref", "HEAD"], {
-      cwd,
-      env: READ_ONLY_GIT_ENV,
-    });
-    const branch = stdout.trim();
-    return branch.length > 0 ? branch : null;
-  } catch {
-    return null;
-  }
+  const { stdout } = await runGitCommand(["rev-parse", "--abbrev-ref", "HEAD"], {
+    cwd,
+    env: READ_ONLY_GIT_ENV,
+  });
+  const branch = stdout.trim();
+  return branch.length > 0 ? branch : null;
 }

 async function getWorktreeRoot(cwd: string): Promise<string | null> {
@@ -1,6 +1,6 @@
 {
  "name": "@getpaseo/website",
-  "version": "0.1.57-rc.1",
+  "version": "0.1.55-rc.2",
  "private": true,
  "type": "module",
  "scripts": {
@@ -14,22 +14,7 @@
            "listen": {
              "type": "string"
            },
-            "hostnames": {
-              "anyOf": [
-                {
-                  "type": "boolean",
-                  "const": true
-                },
-                {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  }
-                }
-              ]
-            },
            "allowedHosts": {
-              "description": "Deprecated: use hostnames instead",
              "anyOf": [
                {
                  "type": "boolean",
@@ -51,7 +51,8 @@ function Configuration() {
          <li>CLI flags</li>
        </ol>
        <p className="text-white/60 leading-relaxed">
-          Lists append across sources (for example, <code className="font-mono">hostnames</code> and
+          Lists append across sources (for example, <code className="font-mono">allowedHosts</code>{" "}
+          and
          <code className="font-mono">cors.allowedOrigins</code>).
        </p>
      </section>
@@ -59,7 +60,7 @@ function Configuration() {
      <section className="space-y-4">
        <h2 className="text-xl font-medium">Example</h2>
        <p className="text-white/60 leading-relaxed">
-          Minimal example that configures listening address, hostnames, provider keys, and MCP:
+          Minimal example that configures listening address, host allowlist, provider keys, and MCP:
        </p>
        <pre className="bg-card border border-border rounded-lg p-4 font-mono text-sm overflow-x-auto text-white/80">
          {`{
@@ -70,16 +71,11 @@ function Configuration() {
  },
  "daemon": {
    "listen": "127.0.0.1:6767",
-    "hostnames": ["localhost", ".localhost"],
+    "allowedHosts": ["localhost", ".localhost"],
    "mcp": { "enabled": true }
  }
 }`}
        </pre>
-        <p className="text-white/60 leading-relaxed">
-          <code className="font-mono">daemon.hostnames</code> is the primary field. The old{" "}
-          <code className="font-mono">daemon.allowedHosts</code> name still works as a deprecated
-          alias for backward compatibility.
-        </p>
      </section>

      <section className="space-y-4">
@@ -233,12 +229,8 @@ docker run --rm -i \\
            <code className="font-mono">daemon.listen</code>
          </li>
          <li>
-            <code className="font-mono">PASEO_HOSTNAMES</code> — override/extend{" "}
-            <code className="font-mono">daemon.hostnames</code>
-          </li>
-          <li>
-            <code className="font-mono">PASEO_ALLOWED_HOSTS</code> — deprecated alias for{" "}
-            <code className="font-mono">PASEO_HOSTNAMES</code>
+            <code className="font-mono">PASEO_ALLOWED_HOSTS</code> — override/extend{" "}
+            <code className="font-mono">daemon.allowedHosts</code>
          </li>
          <li>
            <code className="font-mono">PASEO_LOG_CONSOLE_LEVEL</code> — override{" "}
@@ -185,7 +185,7 @@ function Security() {
            <code className="font-mono">100.x.y.z:6767</code>)
          </li>
          <li>
-            Add your Tailscale hostname to <code className="font-mono">hostnames</code> and{" "}
+            Add your Tailscale hostname to <code className="font-mono">allowedHosts</code> and{" "}
            <code className="font-mono">cors.allowedOrigins</code>
          </li>
          <li>
@@ -199,7 +199,7 @@ function Security() {
          daemon reachable on all network interfaces, including public Wi-Fi and local networks.
          This can expose your daemon to unauthorized access. If you must bind to all interfaces,
          ensure you have proper firewall rules and review your{" "}
-          <code className="font-mono">hostnames</code> configuration.
+          <code className="font-mono">allowedHosts</code> configuration.
        </div>
      </section>

@@ -216,7 +216,7 @@ function Security() {
          on incoming requests. Requests with unrecognized hosts are rejected.
        </p>
        <p className="text-white/60 leading-relaxed">
-          Configure via <code className="font-mono">daemon.hostnames</code> in{" "}
+          Configure via <code className="font-mono">daemon.allowedHosts</code> in{" "}
          <code className="font-mono">config.json</code>:
        </p>
        <ul className="text-white/60 space-y-2 list-disc list-inside">