@50arms/platform-mcp 0.0.0-stage → 0.1.436

package/dist/listener-reminder.js

@@ -0,0 +1,119 @@
+import { readSessionConnection } from "./session-connection.js";
+/** DX-3997 — how long one health read serves every response; per server process. */
+export const HEALTH_CACHE_WINDOW_MS = 30_000;
+function isReminder(value) {
+    const r = value;
+    return typeof r === "object" && r !== null && typeof r.key === "string" && typeof r.text === "string";
+}
+/** The reminders the health response carries, or a thrown Error naming why it cannot be read. */
+function readReminders(result) {
+    if (!result.ok)
+        throw new Error(`GET /api/plan-sessions/me/listener-health answered ${result.status}`);
+    const body = result.body;
+    if (typeof body !== "object" || body === null || Array.isArray(body)) {
+        throw new Error("GET /api/plan-sessions/me/listener-health did not answer a JSON object");
+    }
+    const reminders = body.reminders;
+    if (reminders === undefined)
+        return [];
+    if (!Array.isArray(reminders) || !reminders.every(isReminder)) {
+        throw new Error("GET /api/plan-sessions/me/listener-health carried a `reminders` field that is not an array of {key, text} strings");
+    }
+    return reminders.map(({ key, text }) => ({ key, text }));
+}
+export function createListenerReminder(deps) {
+    let cached = null;
+    let inFlight = null;
+    // Bumped by `invalidate()`: a read that started under an older value must not refill the cache.
+    let generation = 0;
+    let failureLogged = false;
+    let shapeLogged = false;
+    const logFailure = (reason) => {
+        if (failureLogged)
+            return;
+        failureLogged = true;
+        deps.logLine(`[platform-mcp] plan listener health check failed (${reason}); nothing relayed`);
+    };
+    async function read() {
+        try {
+            const reminders = readReminders(await deps.fetchHealth());
+            failureLogged = false;
+            return reminders;
+        }
+        catch (err) {
+            logFailure(err.message);
+            return [];
+        }
+    }
+    async function remindersNow() {
+        if (cached !== null && deps.now() - cached.at < HEALTH_CACHE_WINDOW_MS)
+            return cached.reminders;
+        // One read serves every caller that arrives while it is outstanding.
+        if (inFlight !== null)
+            return inFlight;
+        const startedUnder = generation;
+        const started = read()
+            .then((reminders) => {
+            if (generation === startedUnder)
+                cached = { reminders, at: deps.now() };
+            return reminders;
+        })
+            .finally(() => {
+            if (inFlight === started)
+                inFlight = null;
+        });
+        inFlight = started;
+        return started;
+    }
+    return {
+        async apply(result) {
+            const sessionId = deps.sessionId;
+            if (sessionId === undefined || sessionId === "")
+                return result;
+            const body = result.body;
+            // Never wrap or alter a body that is not a JSON object.
+            if (typeof body !== "object" || body === null || Array.isArray(body))
+                return result;
+            // Read per call (a file read): a connect made after this process started takes effect on
+            // the next call, and an unconnected session costs zero health reads.
+            let connected;
+            try {
+                connected = deps.isPlanConnected(sessionId);
+            }
+            catch (err) {
+                logFailure(err.message);
+                return result;
+            }
+            if (!connected)
+                return result;
+            const existing = body.reminders;
+            if (existing !== undefined && !Array.isArray(existing)) {
+                if (!shapeLogged) {
+                    shapeLogged = true;
+                    deps.logLine("[platform-mcp] listener reminder not relayed: the response's own `reminders` is not an array");
+                }
+                return result;
+            }
+            const relayed = await remindersNow();
+            const present = new Set((existing ?? []).map((r) => (isReminder(r) ? r.key : null)));
+            const fresh = relayed.filter((r) => {
+                if (present.has(r.key))
+                    return false;
+                present.add(r.key);
+                return true;
+            });
+            if (fresh.length === 0)
+                return result;
+            return { ...result, body: { ...body, reminders: [...(existing ?? []), ...fresh] } };
+        },
+        invalidate() {
+            generation += 1;
+            cached = null;
+            inFlight = null;
+        },
+    };
+}
+/** The production wiring: the real local record. */
+export function isPlanConnectedOnThisMachine(sessionId) {
+    return readSessionConnection(sessionId) !== null;
+}

package/dist/machine-daemon/autostart.js

@@ -0,0 +1,160 @@
+/**
+ * DX-5902 — the start-at-logon entry for the machine daemon, and what restarts it when it dies.
+ *
+ *   Windows: a per-user logon task (no elevation). It runs through `conhost.exe --headless`, so no console window opens
+ *            (PLAN-57 R-4: a console program started with no console of its own would open one). It starts at logon, and a
+ *            time trigger repeating every minute (with `IgnoreNew` keeping one instance) brings a killed or crashed daemon
+ *            back within a minute. Measured on Windows 11 (DX-5902): `RestartOnFailure` retries only a failed launch, never a
+ *            process that exited non-zero; `conhost --headless` exits 0 whatever its child returned; and a repetition on the
+ *            logon trigger runs only after a logon, never after an install mid-session.
+ *   Linux:   a systemd user unit with `Restart=on-failure`. DX-6537: an install restarts it, because `enable --now` leaves a running
+ *            unit on its old bundle.
+ *
+ * A daemon whose bearer the dashboard refused stops on purpose and disables its entry (`disableAutostart`), so neither the
+ * repeating trigger nor the next logon starts it into the same refusal; `install-daemon` enables it again.
+ *
+ * Every child process is started with `windowsHide: true`. The XML and unit text are pure functions so the tests pin them.
+ * The task XML is UTF-16: `schtasks /XML` reads no other encoding (a UTF-8 file is refused "unable to switch the encoding").
+ */
+import { execFileSync } from "node:child_process";
+import { mkdirSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+export const TASK_NAME = "danxbot-machine-daemon";
+export const UNIT_NAME = "danxbot-machine-daemon.service";
+function xmlEscape(value) {
+    return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+/** The Task Scheduler definition: this user's logon plus a once-a-minute time trigger, `conhost --headless` running node on the bundle. */
+export function buildWindowsTaskXml(args) {
+    return `<?xml version="1.0" encoding="UTF-16"?>
+<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
+  <RegistrationInfo><Description>danxbot machine daemon (DX-5902): one heartbeat a minute to the 50 Arms dashboard.</Description></RegistrationInfo>
+  <Triggers>
+    <LogonTrigger><Enabled>true</Enabled><UserId>${xmlEscape(args.userId)}</UserId></LogonTrigger>
+    <TimeTrigger>
+      <StartBoundary>2000-01-01T00:00:00</StartBoundary>
+      <Enabled>true</Enabled>
+      <Repetition><Interval>PT1M</Interval><StopAtDurationEnd>false</StopAtDurationEnd></Repetition>
+    </TimeTrigger>
+  </Triggers>
+  <Principals>
+    <Principal id="Author"><UserId>${xmlEscape(args.userId)}</UserId><LogonType>InteractiveToken</LogonType><RunLevel>LeastPrivilege</RunLevel></Principal>
+  </Principals>
+  <Settings>
+    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
+    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
+    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
+    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>
+    <Enabled>true</Enabled>
+    <Hidden>true</Hidden>
+  </Settings>
+  <Actions Context="Author">
+    <Exec>
+      <Command>${xmlEscape(args.conhostPath)}</Command>
+      <Arguments>--headless "${xmlEscape(args.nodePath)}" "${xmlEscape(args.bundlePath)}"</Arguments>
+    </Exec>
+  </Actions>
+</Task>
+`;
+}
+/** The systemd user unit: started at login, restarted after a failure (a deliberate stop, exit 0 on a refused bearer, is not restarted). */
+export function buildSystemdUnit(args) {
+    return `[Unit]
+Description=danxbot machine daemon (DX-5902): one heartbeat a minute to the 50 Arms dashboard
+After=network-online.target
+
+[Service]
+ExecStart=${args.nodePath} ${args.bundlePath}
+Restart=on-failure
+RestartSec=10
+
+[Install]
+WantedBy=default.target
+`;
+}
+/** Runs an OS command with no window and returns its stdout; a non-zero exit throws. */
+export function runHidden(file, args) {
+    return execFileSync(file, args, { encoding: "utf8", windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+}
+export function productionAutostartDeps(bundlePath) {
+    return {
+        platform: process.platform,
+        // DX-5902: the node binary's real path. Under a packaged (MSIX) app such as the Claude desktop app, `process.execPath` can
+        // be a redirected AppData path that exists only inside the package; Task Scheduler runs outside it, so `conhost` finds no
+        // node there and the task ends at once. The native realpath resolves the redirect.
+        nodePath: realpathSync.native(process.execPath),
+        bundlePath,
+        userId: process.env.USERDOMAIN && process.env.USERNAME ? `${process.env.USERDOMAIN}\\${process.env.USERNAME}` : process.env.USER ?? "",
+        conhostPath: join(process.env.SystemRoot ?? "C:\\Windows", "System32", "conhost.exe"),
+        home: homedir(),
+        run: runHidden,
+        writeFile: (file, content, encoding) => writeFileSync(file, encoding === "utf16le" ? `${content}` : content, { encoding }),
+        mkdir: (dir) => mkdirSync(dir, { recursive: true }),
+        remove: (file) => rmSync(file, { force: true }),
+    };
+}
+/** Registers the start-at-logon entry and starts it now. */
+export function installAutostart(deps) {
+    if (deps.platform === "win32") {
+        if (deps.userId === "")
+            throw new Error("cannot register the logon task: the current Windows user is unknown");
+        const xmlPath = join(deps.home, ".danxbot", `${TASK_NAME}.xml`);
+        deps.mkdir(join(deps.home, ".danxbot"));
+        deps.writeFile(xmlPath, buildWindowsTaskXml(deps), "utf16le");
+        deps.run("schtasks", ["/Create", "/TN", TASK_NAME, "/XML", xmlPath, "/F"]);
+        deps.run("schtasks", ["/Run", "/TN", TASK_NAME]);
+        return `scheduled task ${TASK_NAME} (at logon, restarted within a minute when it stops, via conhost --headless)`;
+    }
+    if (deps.platform === "linux") {
+        const unitDir = join(deps.home, ".config", "systemd", "user");
+        deps.mkdir(unitDir);
+        deps.writeFile(join(unitDir, UNIT_NAME), buildSystemdUnit(deps), "utf8");
+        deps.run("systemctl", ["--user", "daemon-reload"]);
+        deps.run("systemctl", ["--user", "enable", UNIT_NAME]);
+        deps.run("systemctl", ["--user", "restart", UNIT_NAME]);
+        return `systemd user unit ${UNIT_NAME} (enabled and started)`;
+    }
+    throw new Error(`no start-at-logon entry for platform ${deps.platform}: the machine daemon runs on Windows and Linux only`);
+}
+/**
+ * Disables the start-at-logon entry without stopping the daemon that calls it (it is about to exit on its own). Called by the
+ * daemon after the dashboard refused its bearer, so nothing restarts it into the same refusal.
+ */
+export function disableAutostart(deps) {
+    if (deps.platform === "win32") {
+        deps.run("schtasks", ["/Change", "/TN", TASK_NAME, "/DISABLE"]);
+        return;
+    }
+    if (deps.platform === "linux") {
+        deps.run("systemctl", ["--user", "disable", UNIT_NAME]);
+        return;
+    }
+    throw new Error(`no start-at-logon entry for platform ${deps.platform}`);
+}
+/** Stops and removes the start-at-logon entry. Missing entries are not an error: uninstall is re-runnable. */
+export function removeAutostart(deps) {
+    if (deps.platform === "win32") {
+        try {
+            deps.run("schtasks", ["/End", "/TN", TASK_NAME]);
+        }
+        catch {
+            // the task may not be running; deleting it below is what matters
+        }
+        deps.run("schtasks", ["/Delete", "/TN", TASK_NAME, "/F"]);
+        deps.remove(join(deps.home, ".danxbot", `${TASK_NAME}.xml`));
+        return `removed scheduled task ${TASK_NAME}`;
+    }
+    if (deps.platform === "linux") {
+        try {
+            deps.run("systemctl", ["--user", "disable", "--now", UNIT_NAME]);
+        }
+        catch {
+            // not enabled
+        }
+        deps.remove(join(deps.home, ".config", "systemd", "user", UNIT_NAME));
+        deps.run("systemctl", ["--user", "daemon-reload"]);
+        return `removed systemd user unit ${UNIT_NAME}`;
+    }
+    throw new Error(`no start-at-logon entry for platform ${deps.platform}`);
+}

package/dist/machine-daemon/beat.js

@@ -0,0 +1,77 @@
+export const BEAT_INTERVAL_MS = 60_000;
+/** A 401 on either path: a replaced bearer (DX-6537) is an update in progress, anything else is a real refusal. */
+function stopOnRefusal(deps) {
+    const onDisk = deps.readBearer();
+    if (onDisk !== null && onDisk !== deps.config.bearer) {
+        deps.log("install-daemon replaced this machine's reporting bearer: this process is the old bundle, so it exits and the start entry runs the new one.");
+        return { reason: "replaced" };
+    }
+    deps.log("the dashboard refused this machine's reporting bearer (HTTP 401): re-run install-daemon. The daemon has stopped beating.");
+    return { reason: "refused" };
+}
+/** One POST with the machine's own bearer. `status` is null when the request itself failed; `text` is the answer's body. */
+export async function postAsMachine(config, fetchFn, route, payload) {
+    try {
+        const res = await fetchFn(`${config.dashboard_url.replace(/\/+$/, "")}${route}`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Authorization: `Bearer ${config.bearer}` },
+            body: JSON.stringify({ machine_id: config.machine_id, ...payload }),
+        });
+        return { status: res.status, error: res.status === 200 ? null : `HTTP ${res.status}`, text: await res.text() };
+    }
+    catch (err) {
+        return { status: null, error: err instanceof Error ? err.message : String(err), text: "" };
+    }
+}
+/** Sends one beat. Returns the HTTP status, or null when the request itself failed. */
+export async function sendBeat(deps, vitals) {
+    const { status, error } = await postAsMachine(deps.config, deps.fetchFn, "/api/machines/heartbeat", { vitals });
+    return { status, error };
+}
+/** Runs beats until the dashboard refuses the bearer, the daemon is uninstalled, or `maxTicks` is spent. */
+export async function runBeatLoop(deps) {
+    let ticks = 0;
+    for (;;) {
+        if (deps.maxTicks !== undefined && ticks >= deps.maxTicks)
+            return { reason: "ticks-exhausted" };
+        if (!deps.installed()) {
+            deps.log("the daemon's config is gone (uninstall-daemon removed it): stopping.");
+            return { reason: "uninstalled" };
+        }
+        ticks += 1;
+        const beatAt = deps.now();
+        let vitals = null;
+        let outcome;
+        try {
+            vitals = deps.collect();
+            outcome = await sendBeat(deps, vitals);
+        }
+        catch (err) {
+            // A vitals probe that cannot read the machine is loud: it is recorded and the next tick retries it.
+            outcome = { status: null, error: `vitals: ${err instanceof Error ? err.message : String(err)}` };
+        }
+        const next = new Date(beatAt.getTime() + BEAT_INTERVAL_MS);
+        deps.writeStatus({
+            pid: deps.pid,
+            last_beat_at: beatAt.toISOString(),
+            last_beat_ok: outcome.status === 200,
+            last_error: outcome.error,
+            next_beat_at: next.toISOString(),
+        });
+        if (outcome.status === 200) {
+            deps.log(`beat ok at ${beatAt.toISOString()}`);
+        }
+        else if (outcome.status === 401) {
+            return stopOnRefusal(deps);
+        }
+        else {
+            deps.log(`beat failed at ${beatAt.toISOString()}: ${outcome.error}; retrying on the next tick`);
+        }
+        if (deps.reporter.refused())
+            return stopOnRefusal(deps);
+        deps.reporter.tick(beatAt);
+        if (deps.maxTicks !== undefined && ticks >= deps.maxTicks)
+            return { reason: "ticks-exhausted" };
+        await deps.sleep(Math.max(0, next.getTime() - deps.now().getTime()));
+    }
+}

package/dist/machine-daemon/cli.js

@@ -0,0 +1,42 @@
+/**
+ * DX-5902 — the `install-daemon`, `status` and `uninstall-daemon` subcommands of `@50arms/platform-mcp`. The bin
+ * (`dist/index.js`) dispatches them here; the daemon itself is the separate bundle `dist/machine-daemon.js`.
+ */
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { DEFAULT_DASHBOARD_URL, daemonStatusText, installDaemon, productionInstallDeps, uninstallDaemon } from "./install.js";
+import { productionAutostartDeps } from "./autostart.js";
+import { daemonBundleDir, danxbotHome } from "./state.js";
+export const MACHINE_DAEMON_SUBCOMMANDS = ["install-daemon", "status", "uninstall-daemon"];
+function flag(args, name) {
+    const i = args.indexOf(name);
+    return i >= 0 ? args[i + 1] : undefined;
+}
+export async function runMachineDaemonCommand(subcommand, args) {
+    const home = danxbotHome();
+    if (subcommand === "status") {
+        console.log(daemonStatusText(home));
+        return 0;
+    }
+    if (subcommand === "install-daemon") {
+        const kindFlag = flag(args, "--kind") ?? "dev";
+        if (kindFlag !== "dev" && kindFlag !== "worker_host")
+            throw new Error("--kind must be dev or worker_host");
+        // The bundles this package ships beside its dist (dist/machine-daemon/cli.js -> dist/machine-daemon.js, dist/machine-toolkit.js).
+        const dist = join(dirname(fileURLToPath(import.meta.url)), "..");
+        await installDaemon(productionInstallDeps({
+            dashboardUrl: flag(args, "--dashboard-url") ?? process.env.DANXBOT_DASHBOARD_URL ?? DEFAULT_DASHBOARD_URL,
+            kind: kindFlag,
+            profile: flag(args, "--profile") ?? null,
+            bundleSource: join(dist, "machine-daemon.js"),
+            toolkitBundleSource: join(dist, "machine-toolkit.js"),
+        }));
+        return 0;
+    }
+    if (subcommand === "uninstall-daemon") {
+        const autostart = productionAutostartDeps(join(daemonBundleDir(home), "machine-daemon.js"));
+        await uninstallDaemon({ home, fetchFn: fetch, autostart, print: (line) => console.log(line) });
+        return 0;
+    }
+    throw new Error(`unknown machine daemon subcommand ${subcommand}`);
+}

package/dist/machine-daemon/install.js

@@ -0,0 +1,168 @@
+/**
+ * DX-5902 — `install-daemon`, `status` and `uninstall-daemon` for the machine daemon.
+ *
+ * install: asks the dashboard for a `machine` access request (the DX-5809 flow), prints the approval link and confirm code, and
+ * polls until a person approves. The approved key is used ONCE: to register this machine, which returns the machine's own
+ * reporting bearer. The key is never written to disk or printed. The bearer goes to `machine-daemon.json` (0600). The daemon
+ * and toolkit bundles are copied under `~/.danxbot/machine-daemon/` and the start-at-logon entry is registered.
+ *
+ * status: reads the local files (no network): the machine id, the last beat, the next beat and the last health report.
+ * uninstall: removes the start-at-logon entry, retires the machine row (the daemon's own bearer), and deletes the local config.
+ * A daemon still running (on Windows, ending the task leaves node alive) sees its config gone and stops at its next tick.
+ */
+import { randomUUID } from "node:crypto";
+import { copyFileSync, existsSync, mkdirSync, rmSync } from "node:fs";
+import { hostname } from "node:os";
+import { join } from "node:path";
+import { claimAccessRequest } from "../access-request.js";
+import { installAutostart, productionAutostartDeps, removeAutostart } from "./autostart.js";
+import { DAEMON_VERSION } from "./version.js";
+import { toolkitBundlePath, daemonBundleDir, daemonConfigPath, daemonStatusPath, danxbotHome, machineIdentityPath, readJsonIfPresent, writeOwnerOnlyJson, } from "./state.js";
+export const DEFAULT_DASHBOARD_URL = "https://app.50arms.ai";
+function base(url) {
+    return url.replace(/\/+$/, "");
+}
+async function postJson(fetchFn, url, body, bearer) {
+    const res = await fetchFn(url, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...(bearer ? { Authorization: `Bearer ${bearer}` } : {}) },
+        body: JSON.stringify(body),
+    });
+    const text = await res.text();
+    return { status: res.status, json: text === "" ? null : JSON.parse(text) };
+}
+/** Approval: request, show the link, poll the claim until approved. Returns the machine key, held only in memory. */
+async function approveMachineKey(deps) {
+    const created = await postJson(deps.fetchFn, `${base(deps.dashboardUrl)}/api/access-requests`, {
+        kind: "machine",
+        labelId: deps.label,
+        title: `Machine ${deps.label}: its daemon reports its vitals, Docker resource names and process command lines to the dashboard`,
+        machine: deps.label,
+    });
+    if (created.status !== 201)
+        throw new Error(`the dashboard refused the machine request (HTTP ${created.status})`);
+    const request = created.json;
+    deps.print(`Open this link, check the code is ${request.confirmCode}, and approve:`);
+    deps.print(request.approvalUrl);
+    deps.print("Waiting for approval...");
+    for (;;) {
+        const claim = await claimAccessRequest(deps.fetchFn, deps.dashboardUrl, request.secret);
+        switch (claim.kind) {
+            case "approved":
+                return claim.apiKey;
+            case "pending":
+                await deps.sleep(request.pollMs > 0 ? request.pollMs : 2000);
+                break;
+            case "rate_limited":
+                await deps.sleep(claim.retryAfterSeconds * 1000);
+                break;
+            case "denied":
+            case "expired":
+            case "claimed":
+            case "not_found":
+                throw new Error(`the machine request ended (${claim.kind}), not approved: run install-daemon again`);
+            case "refused":
+                throw new Error(`the dashboard refused the claim (HTTP ${claim.status})`);
+        }
+    }
+}
+/** Registers the machine with the approved key and returns the machine's own reporting bearer. */
+async function registerWithKey(deps, machineId, machineKey) {
+    const res = await postJson(deps.fetchFn, `${base(deps.dashboardUrl)}/api/machines/register`, { machine_id: machineId, label: deps.label, kind: deps.kind, profile: deps.profile, daemon_version: DAEMON_VERSION }, machineKey);
+    if (res.status !== 200)
+        throw new Error(`machine registration refused (HTTP ${res.status})`);
+    const bearer = res.json.bearer;
+    if (typeof bearer !== "string" || bearer === "")
+        throw new Error("machine registration answered without a reporting bearer");
+    return bearer;
+}
+export async function installDaemon(deps) {
+    // DX-6537: checked before registering, which replaces the bearer of a daemon already running here: a half-installed package changes nothing.
+    for (const source of [deps.bundleSource, deps.toolkitBundleSource]) {
+        if (!existsSync(source))
+            throw new Error(`this package has no ${source}: it cannot install the daemon`);
+    }
+    const existing = readJsonIfPresent(machineIdentityPath(deps.home));
+    const machineId = existing?.machine_id ?? deps.newId();
+    const machineKey = await approveMachineKey(deps);
+    const bearer = await registerWithKey(deps, machineId, machineKey);
+    writeOwnerOnlyJson(machineIdentityPath(deps.home), { machine_id: machineId });
+    const config = {
+        dashboard_url: base(deps.dashboardUrl),
+        machine_id: machineId,
+        bearer,
+        label: deps.label,
+        kind: deps.kind,
+        profile: deps.profile,
+        daemon_version: DAEMON_VERSION,
+    };
+    writeOwnerOnlyJson(daemonConfigPath(deps.home), config);
+    mkdirSync(daemonBundleDir(deps.home), { recursive: true });
+    const bundlePath = join(daemonBundleDir(deps.home), "machine-daemon.js");
+    copyFileSync(deps.bundleSource, bundlePath);
+    copyFileSync(deps.toolkitBundleSource, toolkitBundlePath(deps.home));
+    const entry = installAutostart({ ...deps.autostart, bundlePath });
+    deps.print(`Registered machine ${machineId} as "${deps.label}". The daemon runs from ${bundlePath}.`);
+    deps.print(`Start at logon: ${entry}.`);
+}
+export function daemonStatusText(home) {
+    const identity = readJsonIfPresent(machineIdentityPath(home));
+    const status = readJsonIfPresent(daemonStatusPath(home));
+    if (identity === null)
+        return "Not installed: run npx @50arms/platform-mcp install-daemon.";
+    const lines = [`Machine id: ${identity.machine_id}`];
+    lines.push(`Last beat: ${status?.last_beat_at ?? "none yet"}${status ? (status.last_beat_ok ? " (ok)" : ` (failed: ${status.last_error ?? "unknown"})`) : ""}`);
+    lines.push(`Next beat: ${status?.next_beat_at ?? "none yet"}`);
+    lines.push(`Last report: ${status?.last_report_at ?? "none yet"}${status?.last_report_outcome ? ` (${status.last_report_outcome}${status.last_report_error ? `: ${status.last_report_error}` : ""})` : ""}`);
+    return lines.join("\n");
+}
+export async function uninstallDaemon(deps) {
+    const config = readJsonIfPresent(daemonConfigPath(deps.home));
+    deps.print(removeAutostart(deps.autostart));
+    // The retire is attempted, then the local files go either way: the daemon is removed from this machine even when the dashboard
+    // refuses or cannot be reached. A refusal is reported afterwards, naming the row that stays on the dashboard.
+    let refusal = null;
+    if (config !== null) {
+        try {
+            const res = await deps.fetchFn(`${config.dashboard_url}/api/machines/retire`, {
+                method: "POST",
+                headers: { "Content-Type": "application/json", Authorization: `Bearer ${config.bearer}` },
+                body: JSON.stringify({ machine_id: config.machine_id }),
+            });
+            if (res.status === 200)
+                deps.print(`Retired machine ${config.machine_id} on the dashboard.`);
+            else
+                refusal = `HTTP ${res.status}`;
+        }
+        catch (err) {
+            refusal = err instanceof Error ? err.message : String(err);
+        }
+    }
+    for (const file of [daemonConfigPath(deps.home), daemonStatusPath(deps.home)]) {
+        if (existsSync(file)) {
+            rmSync(file, { force: true });
+        }
+    }
+    if (config !== null && refusal !== null) {
+        throw new Error(`retiring machine ${config.machine_id} on the dashboard failed (${refusal}). The local daemon is removed; the row stays listed on the dashboard until a person retires it there.`);
+    }
+}
+/** The production wiring the CLI uses (the real network, clock and OS). */
+export function productionInstallDeps(opts) {
+    const home = danxbotHome();
+    const autostartDeps = productionAutostartDeps(join(daemonBundleDir(home), "machine-daemon.js"));
+    return {
+        dashboardUrl: opts.dashboardUrl,
+        label: hostname(),
+        kind: opts.kind,
+        profile: opts.profile,
+        fetchFn: fetch,
+        sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+        home,
+        bundleSource: opts.bundleSource,
+        toolkitBundleSource: opts.toolkitBundleSource,
+        autostart: autostartDeps,
+        print: (line) => console.log(line),
+        newId: () => randomUUID(),
+    };
+}

package/dist/machine-daemon/state.js

@@ -0,0 +1,64 @@
+/**
+ * DX-5902 — the machine daemon's files under `~/.danxbot/`. Nothing here is inside a repo.
+ *
+ *   machine.json            — `{ machine_id }`: the stable id the daemon made at install (never the hostname).
+ *   machine-daemon.json     — the dashboard URL, the machine id and its reporting bearer, owner-only (0600). The bearer is
+ *                             the daemon's only credential; it is never printed or logged.
+ *   machine-daemon-status.json — written after every beat and report: when it last beat, whether that beat landed, when the next is
+ *                             due, and the last health report's time, outcome and error.
+ *   machine-daemon/         — the copies of the daemon and toolkit bundles the autostart entry runs (so a package update never changes a running file).
+ */
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+export const MACHINE_DAEMON_DIR_NAME = ".danxbot";
+/** One status file, two writers: each write merges into the same value, so a beat and a report never clobber each other's fields. */
+export function createStatusWriter(write) {
+    let current = {
+        pid: process.pid,
+        last_beat_at: null,
+        last_beat_ok: null,
+        last_error: null,
+        next_beat_at: null,
+        last_report_at: null,
+        last_report_outcome: null,
+        last_report_error: null,
+    };
+    const merge = (fields) => {
+        current = { ...current, ...fields };
+        write(current);
+    };
+    return { beat: merge, report: merge };
+}
+export function danxbotHome() {
+    return join(homedir(), MACHINE_DAEMON_DIR_NAME);
+}
+export function machineIdentityPath(home = danxbotHome()) {
+    return join(home, "machine.json");
+}
+export function daemonConfigPath(home = danxbotHome()) {
+    return join(home, "machine-daemon.json");
+}
+export function daemonStatusPath(home = danxbotHome()) {
+    return join(home, "machine-daemon-status.json");
+}
+export function daemonBundleDir(home = danxbotHome()) {
+    return join(home, "machine-daemon");
+}
+export function toolkitBundlePath(home = danxbotHome()) {
+    return join(daemonBundleDir(home), "machine-toolkit.js");
+}
+/** Writes the file whole (temp then rename) and owner-only, so a crash never leaves a half-written credential. */
+export function writeOwnerOnlyJson(file, value) {
+    mkdirSync(dirname(file), { recursive: true });
+    const tmp = `${file}.${process.pid}.tmp`;
+    writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    if (process.platform !== "win32")
+        chmodSync(tmp, 0o600);
+    renameSync(tmp, file);
+}
+export function readJsonIfPresent(file) {
+    if (!existsSync(file))
+        return null;
+    return JSON.parse(readFileSync(file, "utf8"));
+}

package/dist/machine-daemon/version.js

@@ -0,0 +1,13 @@
+/**
+ * DX-5902 - the daemon's version, read from this package's own `package.json`: the one source `install-daemon` reports to the
+ * dashboard. The file sits two folders up from both `src/machine-daemon/` and the built `dist/machine-daemon/`, and the daemon
+ * bundle (`dist/machine-daemon.js`) never includes this module, so the path is always the installed package's own manifest.
+ */
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+const manifest = JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "..", "package.json"), "utf8"));
+if (typeof manifest.version !== "string" || manifest.version === "") {
+    throw new Error("packages/danx-dashboard-mcp/package.json has no version: the machine daemon cannot report one");
+}
+export const DAEMON_VERSION = manifest.version;