@alan-ai-hq/agent-manager 0.1.113 → 0.1.115

package/dist/daemon-local-control.js

@@ -0,0 +1,826 @@
+// AL-2472: local daemon control plane (probe, config, leases).
+import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { basename, dirname, join } from "node:path";
+import { isProviderProcessAlive, PENDING_RUN_START_TTL_MS } from "./daemon-runner-status.js";
+import { bindAgentConfigPathFromArgs, resolveAgentConfigPath, sanitizeAgentConfig, } from "./runtime-config.js";
+export function isNativeTaskLinkingEnabled(config) {
+    return config.nativeTaskLinkingEnabled === true;
+}
+export const LOCAL_SERVICE_OWNER_VERSION = 1;
+export const LOCAL_SERVICE_CHALLENGE_TTL_MS = 5_000;
+export function localServiceOwnerPayload(owner) {
+    return [
+        owner.version,
+        owner.serviceId,
+        owner.installationId,
+        owner.runtimeId,
+        owner.port,
+        owner.pid,
+        owner.startedAtMs,
+        owner.challenge,
+    ].join("\0");
+}
+export function signLocalServiceOwner(secret, owner) {
+    return createHmac("sha256", secret).update(localServiceOwnerPayload(owner)).digest("hex");
+}
+export function signLocalServiceAdoption(secret, serviceId, challenge) {
+    return createHmac("sha256", secret)
+        .update(["adopt", serviceId, challenge].join("\0"))
+        .digest("hex");
+}
+export function equalHexDigest(actual, expected) {
+    if (!/^[a-f0-9]{64}$/i.test(actual) || !/^[a-f0-9]{64}$/i.test(expected))
+        return false;
+    return timingSafeEqual(Buffer.from(actual, "hex"), Buffer.from(expected, "hex"));
+}
+export function parseLocalServiceOwner(value) {
+    if (!value || typeof value !== "object")
+        return null;
+    const owner = value;
+    if (owner.version !== LOCAL_SERVICE_OWNER_VERSION ||
+        typeof owner.serviceId !== "string" ||
+        typeof owner.installationId !== "string" ||
+        typeof owner.runtimeId !== "string" ||
+        typeof owner.port !== "number" ||
+        typeof owner.pid !== "number" ||
+        typeof owner.startedAtMs !== "number" ||
+        typeof owner.challenge !== "string" ||
+        typeof owner.signature !== "string") {
+        return null;
+    }
+    return owner;
+}
+export async function observeLocalDaemonEndpoint(port, token, timeoutMs = 750) {
+    const observedAtMs = Date.now();
+    try {
+        const headers = {};
+        if (token)
+            headers.authorization = `Bearer ${token}`;
+        const response = await fetch(`http://127.0.0.1:${port}/status`, {
+            headers,
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        if (response.status === 401) {
+            return { kind: "unauthorized", observedAtMs, httpStatus: 401 };
+        }
+        if (!response.ok) {
+            return {
+                kind: "unreachable",
+                reason: "http_error",
+                observedAtMs,
+                httpStatus: response.status,
+                detail: `HTTP ${response.status}`,
+            };
+        }
+        const body = (await response.json());
+        if (!body.runtimeId) {
+            return {
+                kind: "unreachable",
+                reason: "invalid_response",
+                observedAtMs,
+                detail: "status response missing runtimeId",
+            };
+        }
+        return { kind: "ready", status: body, observedAtMs };
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        const lowered = detail.toLowerCase();
+        if (lowered.includes("timeout") ||
+            lowered.includes("aborted") ||
+            lowered.includes("timed out")) {
+            return { kind: "unreachable", reason: "timeout", observedAtMs, detail };
+        }
+        if (lowered.includes("econnrefused") ||
+            lowered.includes("connection refused") ||
+            lowered.includes("fetch failed")) {
+            return { kind: "unreachable", reason: "connection_refused", observedAtMs, detail };
+        }
+        return { kind: "unreachable", reason: "network_error", observedAtMs, detail };
+    }
+}
+export async function probeLocalDaemonEndpoint(port, token, timeoutMs = 750) {
+    const observation = await observeLocalDaemonEndpoint(port, token, timeoutMs);
+    if (observation.kind === "ready") {
+        return { state: "running", status: observation.status };
+    }
+    if (observation.kind === "unauthorized") {
+        return { state: "listening_unauthorized" };
+    }
+    // Compatibility: legacy callers treated every failure as absent. Prefer
+    // observeLocalDaemonEndpoint for truthful degraded/unreachable semantics.
+    return { state: "absent" };
+}
+export async function probeLocalDaemon(port, token, timeoutMs = 750) {
+    const probe = await probeLocalDaemonEndpoint(port, token, timeoutMs);
+    return probe.state === "running" ? probe.status : null;
+}
+export function requestLocalDaemonShutdown(port, token) {
+    return fetch(`http://127.0.0.1:${port}/shutdown?force=1`, {
+        method: "POST",
+        headers: {
+            authorization: `Bearer ${token}`,
+            "x-alan-shutdown-reason": "runtime_shutdown",
+        },
+        signal: AbortSignal.timeout(5_000),
+    });
+}
+export async function adoptLocalDaemonControl(input) {
+    const timeoutMs = input.timeoutMs ?? 750;
+    try {
+        const ownerResponse = await fetch(`http://127.0.0.1:${input.port}/owner`, {
+            headers: { accept: "application/json" },
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        if (!ownerResponse.ok)
+            return null;
+        const owner = parseLocalServiceOwner(await ownerResponse.json());
+        if (!owner ||
+            owner.serviceId !== input.serviceId ||
+            owner.port !== input.port ||
+            (input.installationId && owner.installationId !== input.installationId)) {
+            return null;
+        }
+        const { signature, ...unsignedOwner } = owner;
+        const expectedSignature = signLocalServiceOwner(input.serviceSecret, unsignedOwner);
+        if (!equalHexDigest(signature, expectedSignature))
+            return null;
+        const proof = signLocalServiceAdoption(input.serviceSecret, input.serviceId, owner.challenge);
+        const adoptionResponse = await fetch(`http://127.0.0.1:${input.port}/adopt`, {
+            method: "POST",
+            headers: {
+                accept: "application/json",
+                "x-alan-service-id": input.serviceId,
+                "x-alan-adoption-challenge": owner.challenge,
+                "x-alan-adoption-proof": proof,
+            },
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        if (!adoptionResponse.ok)
+            return null;
+        const adopted = (await adoptionResponse.json());
+        if (typeof adopted.localApiToken !== "string" || adopted.localApiToken.length < 32)
+            return null;
+        const status = await probeLocalDaemon(input.port, adopted.localApiToken, timeoutMs);
+        if (!status || status.runtimeId !== owner.runtimeId)
+            return null;
+        return { localApiToken: adopted.localApiToken, status };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Reclaims local control only when this config proves it owns the incumbent
+ * daemon. A process that merely occupies the port cannot trigger replacement
+ * or learn the bearer token.
+ */
+function argValueLocal(args, name) {
+    const idx = args.indexOf(name);
+    if (idx >= 0 && args[idx + 1])
+        return args[idx + 1];
+    const prefix = `${name}=`;
+    const matched = args.find((arg) => arg.startsWith(prefix));
+    return matched ? matched.slice(prefix.length) : undefined;
+}
+export function getLocalApiPort(args, stored) {
+    const raw = argValueLocal(args, "--local-api-port") ?? process.env.ALAN_AGENT_LOCAL_API_PORT;
+    if (raw)
+        return Number.parseInt(raw, 10);
+    const storedPort = stored.localApiPort;
+    if (storedPort && storedPort > 0)
+        return storedPort;
+    return 47831;
+}
+export async function adoptConfiguredLocalDaemon(args = []) {
+    bindConfigPath(args);
+    const stored = readConfig();
+    const port = getLocalApiPort(args, stored);
+    if (stored.localApiToken) {
+        const existing = await probeLocalDaemon(port, stored.localApiToken);
+        if (existing)
+            return existing;
+    }
+    if (!stored.localServiceId || !stored.localServiceSecret)
+        return null;
+    const adopted = await adoptLocalDaemonControl({
+        port,
+        serviceId: stored.localServiceId,
+        serviceSecret: stored.localServiceSecret,
+        installationId: stored.installationId,
+    });
+    if (!adopted)
+        return null;
+    // Do not overwrite credentials that may have changed while the handshake
+    // was in flight. The owner identity itself must still match.
+    const latest = readConfig();
+    if (latest.localServiceId !== stored.localServiceId ||
+        latest.localServiceSecret !== stored.localServiceSecret) {
+        return null;
+    }
+    writeConfig({ ...latest, localApiPort: port, localApiToken: adopted.localApiToken });
+    return adopted.status;
+}
+export async function isLocalDaemonListening(port, token) {
+    const probe = await probeLocalDaemonEndpoint(port, token);
+    return probe.state !== "absent";
+}
+export function describeOccupiedLocalDaemon(port) {
+    return (`local daemon API port ${port} is already in use. ` +
+        "If Alan desktop is open, it manages the daemon automatically. " +
+        "Quit Alan desktop or stop the existing daemon before starting another.");
+}
+/**
+ * Last config path bound via bindAgentConfigPathFromArgs. Keeps late/async
+ * daemon code on the active profile's config even if the supervisor restores
+ * ALAN_AGENT_CONFIG_PATH after startup (the desktop supervisor does).
+ */
+let boundAgentConfigPath = null;
+export function bindConfigPath(args) {
+    boundAgentConfigPath = bindAgentConfigPathFromArgs(args);
+    return boundAgentConfigPath;
+}
+export function getConfigPath() {
+    return (boundAgentConfigPath ??
+        process.env.ALAN_AGENT_CONFIG_PATH ??
+        resolveAgentConfigPath({ profile: "production" }));
+}
+export function getEndpointDefaultsPath() {
+    return process.env.ALAN_AGENT_ENDPOINTS_PATH ?? join(dirname(getConfigPath()), "endpoints.json");
+}
+export function readConfig() {
+    const configPath = getConfigPath();
+    if (!existsSync(configPath))
+        return {};
+    const parsed = JSON.parse(readFileSync(configPath, "utf8"));
+    const sanitized = sanitizeAgentConfig(parsed);
+    if (Object.keys(parsed).some((key) => !Object.hasOwn(sanitized, key))) {
+        writeConfig(sanitized);
+    }
+    return sanitized;
+}
+export function readConfigForRegistration() {
+    try {
+        return readConfig();
+    }
+    catch {
+        // Registration is also the repair path for malformed/unreadable config.
+        return {};
+    }
+}
+export function readEndpointDefaults() {
+    const endpointsPath = getEndpointDefaultsPath();
+    if (!existsSync(endpointsPath))
+        return {};
+    try {
+        return JSON.parse(readFileSync(endpointsPath, "utf8"));
+    }
+    catch {
+        return {};
+    }
+}
+export function writeConfig(config) {
+    const configPath = getConfigPath();
+    mkdirSync(dirname(configPath), { recursive: true, mode: 0o700 });
+    const pendingPath = `${configPath}.pending-${process.pid}-${randomBytes(6).toString("hex")}`;
+    try {
+        writeFileSync(pendingPath, JSON.stringify(sanitizeAgentConfig(config), null, 2), { mode: 0o600 });
+        chmodSync(pendingPath, 0o600);
+        renameSync(pendingPath, configPath);
+    }
+    finally {
+        rmSync(pendingPath, { force: true });
+    }
+}
+export function maintenanceLeasePath(configPath) {
+    return `${configPath}.maintenance-lease.json`;
+}
+export function readLocalDaemonMaintenanceLease(configPath, nowMs = Date.now()) {
+    const path = maintenanceLeasePath(configPath);
+    if (!existsSync(path))
+        return null;
+    try {
+        const lease = JSON.parse(readFileSync(path, "utf8"));
+        if (lease.version !== 1 ||
+            typeof lease.id !== "string" ||
+            (lease.reason !== "credential_cleanup" &&
+                lease.reason !== "credential_swap" &&
+                lease.reason !== "daemon_startup" &&
+                lease.reason !== "watchdog") ||
+            !((lease.reason === "credential_cleanup" && lease.expiresAtMs === null) ||
+                (typeof lease.expiresAtMs === "number" && Number.isFinite(lease.expiresAtMs)))) {
+            throw new Error("invalid maintenance lease");
+        }
+        // Credential cleanup is a durable drain intent, not a watchdog timeout. Old
+        // versions wrote a finite expiry, so ignore it for this reason during
+        // rolling upgrades as well as writing null for all new cleanup leases.
+        if (lease.reason !== "credential_cleanup" && lease.expiresAtMs <= nowMs) {
+            releaseOwnedJsonFile(path, lease.id);
+            return null;
+        }
+        return lease;
+    }
+    catch {
+        // A partial/corrupt lease must fail closed for one short watchdog window,
+        // not fence dispatch forever.
+        const fallback = {
+            version: 1,
+            id: "invalid",
+            reason: "watchdog",
+            expiresAtMs: nowMs + 5_000,
+        };
+        try {
+            writeFileSync(path, JSON.stringify(fallback), { mode: 0o600 });
+            chmodSync(path, 0o600);
+        }
+        catch {
+            // The in-memory fallback still fences this decision safely.
+        }
+        return fallback;
+    }
+}
+export function acquireLocalDaemonMaintenanceLease(configPath, reason, ttlMs = 5_000) {
+    const existing = readLocalDaemonMaintenanceLease(configPath);
+    if (existing)
+        return { acquired: false, lease: existing };
+    const lease = {
+        version: 1,
+        id: randomUUID(),
+        reason,
+        expiresAtMs: reason === "credential_cleanup"
+            ? null
+            : Date.now() + Math.max(1_000, Math.min(ttlMs, 60_000)),
+    };
+    const path = maintenanceLeasePath(configPath);
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    try {
+        writeFileSync(path, JSON.stringify(lease), { mode: 0o600, flag: "wx" });
+        chmodSync(path, 0o600);
+        return { acquired: true, lease };
+    }
+    catch (error) {
+        const raced = readLocalDaemonMaintenanceLease(configPath);
+        if (raced)
+            return { acquired: false, lease: raced };
+        throw error;
+    }
+}
+export function releaseLocalDaemonMaintenanceLease(configPath, leaseId) {
+    releaseOwnedJsonFile(maintenanceLeasePath(configPath), leaseId);
+}
+export function daemonOwnerLeasePath(configPath) {
+    return `${configPath}.daemon-owner.json`;
+}
+export function readLocalDaemonOwnerLease(configPath) {
+    const path = daemonOwnerLeasePath(configPath);
+    if (!existsSync(path))
+        return null;
+    try {
+        const lease = JSON.parse(readFileSync(path, "utf8"));
+        if (lease.version !== 1 ||
+            typeof lease.id !== "string" ||
+            typeof lease.daemonSessionId !== "string" ||
+            !Number.isSafeInteger(lease.pid) ||
+            lease.pid <= 0 ||
+            typeof lease.startedAtMs !== "number" ||
+            !Number.isFinite(lease.startedAtMs) ||
+            typeof lease.runtimeId !== "string" ||
+            typeof lease.localServiceId !== "string" ||
+            !Number.isSafeInteger(lease.localApiPort) ||
+            lease.localApiPort < 0 ||
+            lease.localApiPort > 65_535 ||
+            typeof lease.localApiToken !== "string" ||
+            lease.localApiToken.length === 0) {
+            throw new Error("invalid daemon owner lease");
+        }
+        return lease;
+    }
+    catch (error) {
+        throw new Error(`Cannot safely read daemon owner lease: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+export async function acquireLocalDaemonOwnerLease(input) {
+    const existing = readLocalDaemonOwnerLease(input.configPath);
+    if (existing) {
+        const endpoint = existing.localApiPort > 0
+            ? await probeLocalDaemonEndpoint(existing.localApiPort, existing.localApiToken)
+            : { state: "absent" };
+        if (endpoint.state === "running") {
+            const matchesOwner = endpoint.status.runtimeId === existing.runtimeId &&
+                endpoint.status.localServiceId === existing.localServiceId &&
+                endpoint.status.daemonSessionId === existing.daemonSessionId;
+            if (!matchesOwner) {
+                throw new Error("Daemon owner lease does not match the authenticated local endpoint");
+            }
+            return { acquired: false, lease: existing };
+        }
+        if (endpoint.state === "listening_unauthorized") {
+            return { acquired: false, lease: existing };
+        }
+        // PID existence alone is not proof of daemon ownership: after a crash or
+        // reboot the OS can reuse the recorded PID for an unrelated process. The
+        // authenticated endpoint is authoritative. If it is absent, an apparently
+        // live owner only blocks takeover while accepted or pending work still
+        // needs protection. The startup maintenance lease already serializes this
+        // decision against another daemon that is concurrently starting.
+        const journal = inspectLocalDaemonRunJournal(input.configPath);
+        if (isProviderProcessAlive(existing.pid) && !journal.safeToRestart) {
+            return { acquired: false, lease: existing };
+        }
+        // The authenticated endpoint is absent and no live work prevents recovery.
+        // Replace the stale owner; the new owner confirms recovery only after bind.
+        releaseOwnedJsonFile(daemonOwnerLeasePath(input.configPath), existing.id);
+    }
+    if (!existing && input.storedLocalApiPort && input.storedLocalApiToken) {
+        const storedEndpoint = await probeLocalDaemonEndpoint(input.storedLocalApiPort, input.storedLocalApiToken);
+        if (storedEndpoint.state === "running") {
+            throw new Error("The stored local endpoint already owns this daemon config");
+        }
+        if (storedEndpoint.state === "listening_unauthorized") {
+            throw new Error("The stored local endpoint rejected this daemon config token");
+        }
+    }
+    const lease = {
+        version: 1,
+        id: randomUUID(),
+        daemonSessionId: input.daemonSessionId,
+        pid: process.pid,
+        startedAtMs: Date.now(),
+        runtimeId: input.runtimeId,
+        localServiceId: input.localServiceId,
+        localApiPort: input.localApiPort,
+        localApiToken: input.localApiToken,
+    };
+    const path = daemonOwnerLeasePath(input.configPath);
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    try {
+        writeFileSync(path, JSON.stringify(lease), { mode: 0o600, flag: "wx" });
+        chmodSync(path, 0o600);
+        return { acquired: true, lease };
+    }
+    catch (error) {
+        const raced = readLocalDaemonOwnerLease(input.configPath);
+        if (raced)
+            return { acquired: false, lease: raced };
+        throw error;
+    }
+}
+export function updateLocalDaemonOwnerEndpoint(configPath, lease, localApiPort) {
+    const current = readLocalDaemonOwnerLease(configPath);
+    if (current?.id !== lease.id)
+        throw new Error("Daemon ownership changed before local API bind");
+    const updated = { ...lease, localApiPort };
+    const path = daemonOwnerLeasePath(configPath);
+    const pendingPath = `${path}.pending-${lease.id}`;
+    try {
+        writeFileSync(pendingPath, JSON.stringify(updated), { mode: 0o600 });
+        chmodSync(pendingPath, 0o600);
+        renameSync(pendingPath, path);
+        return updated;
+    }
+    finally {
+        rmSync(pendingPath, { force: true });
+    }
+}
+export function releaseLocalDaemonOwnerLease(configPath, leaseId) {
+    releaseOwnedJsonFile(daemonOwnerLeasePath(configPath), leaseId);
+}
+/**
+ * Atomically take the current pathname before inspecting ownership. A newer
+ * replacement can therefore never be removed by an older owner's release.
+ */
+export function releaseOwnedJsonFile(path, ownerId, ownerField = "id") {
+    const releasePath = `${path}.release-${process.pid}-${randomBytes(6).toString("hex")}`;
+    try {
+        renameSync(path, releasePath);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return;
+        throw error;
+    }
+    try {
+        const content = readFileSync(releasePath, "utf8");
+        let capturedOwnerId = null;
+        try {
+            const captured = JSON.parse(content);
+            capturedOwnerId = typeof captured[ownerField] === "string" ? captured[ownerField] : null;
+        }
+        catch {
+            // Preserve an invalid replacement too; readers deliberately fail closed.
+        }
+        if (capturedOwnerId === ownerId)
+            return;
+        // Restore only if nobody acquired a still-newer lease in the short rename
+        // window. `wx` prevents this older release from overwriting that owner.
+        try {
+            writeFileSync(path, content, { mode: 0o600, flag: "wx" });
+            chmodSync(path, 0o600);
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+        }
+    }
+    finally {
+        rmSync(releasePath, { force: true });
+    }
+}
+export function inspectLocalDaemonRunJournal(configPath) {
+    const nowMs = Date.now();
+    const path = `${configPath}.run-journal.json`;
+    const pendingPath = `${configPath}.pending-runs.json`;
+    try {
+        let activeRunCount = 0;
+        for (const artifact of [path, pendingPath]) {
+            if (!existsSync(artifact))
+                continue;
+            const parsed = JSON.parse(readFileSync(artifact, "utf8"));
+            if (parsed.version !== 1 || !Array.isArray(parsed.entries))
+                throw new Error("invalid journal");
+            if (artifact === path) {
+                activeRunCount += parsed.entries.filter((entry) => {
+                    if (!entry || typeof entry !== "object")
+                        throw new Error("invalid run journal entry");
+                    const journalEntry = entry;
+                    if (typeof journalEntry.runId !== "string" ||
+                        journalEntry.runId.length === 0 ||
+                        typeof journalEntry.conversationId !== "string" ||
+                        journalEntry.conversationId.length === 0 ||
+                        typeof journalEntry.acceptedAtMs !== "number" ||
+                        !Number.isFinite(journalEntry.acceptedAtMs)) {
+                        throw new Error("invalid run journal identity");
+                    }
+                    const interruptedAtMs = journalEntry.interruptedAtMs;
+                    if (interruptedAtMs === undefined)
+                        return true;
+                    if (typeof interruptedAtMs !== "number" || !Number.isFinite(interruptedAtMs)) {
+                        throw new Error("invalid interrupted journal marker");
+                    }
+                    return false;
+                }).length;
+                continue;
+            }
+            const legacyStartedAtMs = statSync(pendingPath).mtimeMs;
+            activeRunCount += parsed.entries.filter((entry) => {
+                if (!entry || typeof entry !== "object")
+                    throw new Error("invalid pending run entry");
+                const startedAtMs = entry.startedAtMs;
+                if (startedAtMs === undefined) {
+                    return nowMs - legacyStartedAtMs <= PENDING_RUN_START_TTL_MS;
+                }
+                if (typeof startedAtMs !== "number" || !Number.isFinite(startedAtMs)) {
+                    throw new Error("invalid pending run timestamp");
+                }
+                return nowMs - startedAtMs <= PENDING_RUN_START_TTL_MS;
+            }).length;
+        }
+        return { safeToRestart: activeRunCount === 0, activeRunCount };
+    }
+    catch {
+        return { safeToRestart: false, activeRunCount: 1 };
+    }
+}
+export function pendingSetupIntentPath() {
+    return `${getConfigPath()}.setup-pending`;
+}
+export function setupTokenHash(setupToken) {
+    return createHash("sha256").update(setupToken).digest("hex");
+}
+export function getOrCreateSetupAttemptId(setupToken) {
+    const intentPath = pendingSetupIntentPath();
+    const tokenHash = setupTokenHash(setupToken);
+    if (existsSync(intentPath)) {
+        try {
+            const stored = JSON.parse(readFileSync(intentPath, "utf8"));
+            if (stored.setupTokenHash === tokenHash &&
+                typeof stored.registrationAttemptId === "string" &&
+                stored.registrationAttemptId.length > 0) {
+                return stored.registrationAttemptId;
+            }
+        }
+        catch {
+            // Replace malformed or stale setup intent below without touching active config.
+        }
+    }
+    const registrationAttemptId = randomUUID();
+    mkdirSync(dirname(intentPath), { recursive: true, mode: 0o700 });
+    const writePath = `${intentPath}.pending-${process.pid}-${randomBytes(6).toString("hex")}`;
+    try {
+        writeFileSync(writePath, JSON.stringify({ setupTokenHash: tokenHash, registrationAttemptId }, null, 2), { mode: 0o600 });
+        chmodSync(writePath, 0o600);
+        renameSync(writePath, intentPath);
+    }
+    finally {
+        rmSync(writePath, { force: true });
+    }
+    return registrationAttemptId;
+}
+export function clearPendingSetupIntent() {
+    rmSync(pendingSetupIntentPath(), { force: true });
+}
+export function pendingDeviceAuthorizationPath() {
+    return `${getConfigPath()}.device-auth-pending`;
+}
+export function deviceAuthorizationOperationPath() {
+    return `${getConfigPath()}.device-auth-operation.json`;
+}
+export function parseDeviceAuthorizationOperationContent(content) {
+    try {
+        const lease = JSON.parse(content);
+        if (lease.version !== 1 ||
+            typeof lease.id !== "string" ||
+            typeof lease.expiresAtMs !== "number" ||
+            !Number.isFinite(lease.expiresAtMs)) {
+            return null;
+        }
+        return lease;
+    }
+    catch {
+        return null;
+    }
+}
+export function restoreCapturedFileUnlessReplaced(path, content) {
+    try {
+        writeFileSync(path, content, { mode: 0o600, flag: "wx" });
+        chmodSync(path, 0o600);
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw error;
+    }
+}
+export function quarantineCorruptDeviceAuthorizationOperation(path) {
+    const quarantinePath = `${path}.corrupt-${process.pid}-${randomBytes(6).toString("hex")}`;
+    try {
+        renameSync(path, quarantinePath);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+    try {
+        const capturedContent = readFileSync(quarantinePath, "utf8");
+        // The pathname may have been replaced after the failed parse but before
+        // this atomic capture. Preserve it if what we actually captured is valid.
+        if (parseDeviceAuthorizationOperationContent(capturedContent)) {
+            restoreCapturedFileUnlessReplaced(path, capturedContent);
+        }
+    }
+    finally {
+        rmSync(quarantinePath, { force: true });
+    }
+    if (!existsSync(path))
+        return null;
+    return parseDeviceAuthorizationOperationContent(readFileSync(path, "utf8"));
+}
+export function readDeviceAuthorizationOperation() {
+    const path = deviceAuthorizationOperationPath();
+    if (!existsSync(path))
+        return null;
+    const parsed = parseDeviceAuthorizationOperationContent(readFileSync(path, "utf8"));
+    const lease = parsed ?? quarantineCorruptDeviceAuthorizationOperation(path);
+    if (!lease)
+        return null;
+    if (lease.expiresAtMs <= Date.now()) {
+        releaseOwnedJsonFile(path, lease.id);
+        return null;
+    }
+    return lease;
+}
+export function acquireDeviceAuthorizationOperation() {
+    const existing = readDeviceAuthorizationOperation();
+    if (existing)
+        return null;
+    const lease = {
+        version: 1,
+        id: randomUUID(),
+        expiresAtMs: Date.now() + 60_000,
+    };
+    const path = deviceAuthorizationOperationPath();
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    try {
+        writeFileSync(path, JSON.stringify(lease), { mode: 0o600, flag: "wx" });
+        chmodSync(path, 0o600);
+        return lease;
+    }
+    catch (error) {
+        if (error.code === "EEXIST")
+            return null;
+        throw error;
+    }
+}
+export function extendDeviceAuthorizationOperation(operationId, expiresAtMs) {
+    const current = readDeviceAuthorizationOperation();
+    if (current?.id !== operationId) {
+        throw new Error("browser authorization operation ownership was lost");
+    }
+    const path = deviceAuthorizationOperationPath();
+    const pendingPath = `${path}.pending-${process.pid}-${randomBytes(6).toString("hex")}`;
+    try {
+        writeFileSync(pendingPath, JSON.stringify({ ...current, expiresAtMs: Math.max(expiresAtMs, Date.now() + 60_000) }), { mode: 0o600 });
+        chmodSync(pendingPath, 0o600);
+        // The current operation is still unexpired, so a compliant peer cannot
+        // replace it between the owner check and this atomic renewal.
+        renameSync(pendingPath, path);
+    }
+    finally {
+        rmSync(pendingPath, { force: true });
+    }
+}
+export function assertDeviceAuthorizationOperationOwner(operationId) {
+    if (readDeviceAuthorizationOperation()?.id !== operationId) {
+        throw new Error("browser authorization operation ownership was lost");
+    }
+}
+export function clearPendingDeviceAuthorization(operationId) {
+    const path = pendingDeviceAuthorizationPath();
+    if (!operationId) {
+        rmSync(path, { force: true });
+        return;
+    }
+    if (!existsSync(path))
+        return;
+    try {
+        const pending = JSON.parse(readFileSync(path, "utf8"));
+        if (pending.operationId !== operationId)
+            return;
+    }
+    catch {
+        return;
+    }
+    releaseOwnedJsonFile(path, operationId, "operationId");
+}
+export function readPendingDeviceAuthorization(apiUrl) {
+    const path = pendingDeviceAuthorizationPath();
+    if (!existsSync(path))
+        return null;
+    try {
+        const pending = JSON.parse(readFileSync(path, "utf8"));
+        const expiresAtMs = Date.parse(pending.expiresAt ?? "");
+        if (pending.apiUrl !== apiUrl ||
+            typeof pending.deviceCode !== "string" ||
+            typeof pending.userCode !== "string" ||
+            typeof pending.verificationUri !== "string" ||
+            typeof pending.installationId !== "string" ||
+            (pending.operationId !== undefined && typeof pending.operationId !== "string") ||
+            !Number.isFinite(pending.intervalSeconds) ||
+            !Number.isFinite(expiresAtMs) ||
+            expiresAtMs <= Date.now()) {
+            return null;
+        }
+        return pending;
+    }
+    catch {
+        return null;
+    }
+}
+export function writePendingDeviceAuthorization(pending) {
+    const path = pendingDeviceAuthorizationPath();
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const writePath = `${path}.pending-${process.pid}-${randomBytes(6).toString("hex")}`;
+    try {
+        writeFileSync(writePath, JSON.stringify(pending, null, 2), { mode: 0o600 });
+        chmodSync(writePath, 0o600);
+        renameSync(writePath, path);
+    }
+    finally {
+        rmSync(writePath, { force: true });
+    }
+}
+export function removeAlanOwnedLocalArtifacts() {
+    const configPath = getConfigPath();
+    const directory = dirname(configPath);
+    const configName = basename(configPath).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const alanAtomicSidecarPattern = new RegExp(`^${configName}(?:|\\.setup-pending|\\.device-auth-pending|\\.device-auth-operation\\.json|\\.maintenance-lease\\.json|\\.event-outbox\\.enc)\\.(?:pending|release|corrupt)-\\d+-[a-f0-9]{12}$`);
+    // This is the complete Alan-owned local credential/state inventory. Keep
+    // third-party provider and MCP config outside this list: logout must never
+    // delete user-owned tool configuration.
+    const artifacts = new Set([
+        `${configPath}.pending`,
+        `${configPath}.last-known-good`,
+        pendingSetupIntentPath(),
+        pendingDeviceAuthorizationPath(),
+        deviceAuthorizationOperationPath(),
+        `${configPath}.event-outbox.enc`,
+        `${configPath}.run-journal.json`,
+        `${configPath}.run-journal.json.pending`,
+        `${configPath}.pending-runs.json`,
+        `${configPath}.pending-runs.json.pending`,
+        maintenanceLeasePath(configPath),
+    ]);
+    if (existsSync(directory)) {
+        for (const entry of readdirSync(directory)) {
+            if (alanAtomicSidecarPattern.test(entry))
+                artifacts.add(join(directory, entry));
+        }
+    }
+    for (const artifact of artifacts)
+        rmSync(artifact, { force: true });
+    // Remove the durable credential file last so a partial cleanup never leaves
+    // hidden credential sidecars behind while claiming logout succeeded.
+    rmSync(configPath, { force: true });
+}
+//# sourceMappingURL=daemon-local-control.js.map