@alan-ai-hq/agent-manager 0.1.113 → 0.1.115

package/dist/daemon-start.js

@@ -0,0 +1,1313 @@
+// AL-2472: daemon start loop — WS connect, agent.execute, local HTTP API.
+import { randomBytes, randomUUID } from "node:crypto";
+import { appendFileSync, mkdirSync, renameSync, statSync } from "node:fs";
+import http from "node:http";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { io } from "socket.io-client";
+import { BindingSwitchGitError, executeBindingSwitchGitRpc, isBindingSwitchGitMethod, } from "./binding-switch-git.js";
+import { WorkspaceAccessTracker } from "./computer-readiness.js";
+import { handleAgentExecute } from "./daemon-execute.js";
+import { argValue, checkStoredEndpointConsistency, isLocalEndpoint, resolveEndpointProfile, resolveEndpoints, scheduleRuntimeModelScan, sleep, } from "./daemon-helpers.js";
+import { acquireLocalDaemonMaintenanceLease, acquireLocalDaemonOwnerLease, bindConfigPath, clearPendingSetupIntent, describeOccupiedLocalDaemon, getConfigPath, getLocalApiPort, probeLocalDaemonEndpoint, readConfig, readEndpointDefaults, readLocalDaemonMaintenanceLease, releaseLocalDaemonMaintenanceLease, releaseLocalDaemonOwnerLease, updateLocalDaemonOwnerEndpoint, writeConfig, } from "./daemon-local-control.js";
+import { createLocalDaemonHttpHandler } from "./daemon-local-http.js";
+import { deliverNativeHookWithOwnership } from "./daemon-native-hooks.js";
+import { discoverCapabilities, refreshProviderModels, refreshProviderVersions, VERSION_REFRESH_INTERVAL_MS, } from "./daemon-provider-scan.js";
+import { abortActiveAgent, collectRuntimeMetadataWithProviderLimits, DurablePendingRunStarts, flushPendingDeliveryLostEvents, reconcileActiveRuns, summarizeRunnerStatus, } from "./daemon-runner-status.js";
+import { EncryptedEventOutbox } from "./event-outbox.js";
+import { runRuntimeModelScan } from "./model-scan-runner.js";
+import { drainNativeHookInbox } from "./native-hook-drain.js";
+import { EncryptedNativeHookInbox, nativeHookInboxPath } from "./native-hook-inbox.js";
+import { createNativeStreamOutbox } from "./native-stream-platform.js";
+import { NativeTranscriptCursorStore } from "./native-transcript-cursor.js";
+import { NativeTranscriptStreamer } from "./native-transcript-stream.js";
+import { classifyTransportFailure } from "./network-diagnostics.js";
+import { ObservableMap } from "./observable-map.js";
+import { RuntimeRunJournal } from "./run-journal.js";
+import { buildModelsScanMetadata, getModelScanInFlight, setConnectedRuntimeSocket, } from "./runtime-capabilities-sync.js";
+import { exchangeRuntimeSetupGrant, } from "./runtime-registration.js";
+import { resolveSkillScanInput } from "./skills/local-skill-source.js";
+import { RuntimeSkillCoordinator } from "./skills/runtime-skill-coordinator.js";
+import { RuntimeSkillManager } from "./skills/runtime-skill-manager.js";
+import { HttpSkillControlClient } from "./skills/skill-control-client.js";
+import { SleepInhibitor } from "./sleep-inhibitor.js";
+import { SuspensionDetector } from "./suspension-detector.js";
+import { AGENT_VERSION } from "./version.js";
+import { executeWorkspaceRpc } from "./workspace-rpc.js";
+import { applyLeaseCheckResult, FRESH_LEASE_MONITOR_STATE, isLeaseCheckDue, WORKSPACE_LEASE_CHECK_INTERVAL_MS, } from "./workspace-run-lease.js";
+export const RUNTIME_TOKEN_RENEWAL_WINDOW_MS = 24 * 60 * 60 * 1000;
+export function runtimeTokenNeedsRenewal(expiresAt, nowMs = Date.now()) {
+    if (!expiresAt)
+        return true;
+    const expiresAtMs = Date.parse(expiresAt);
+    return !Number.isFinite(expiresAtMs) || expiresAtMs <= nowMs + RUNTIME_TOKEN_RENEWAL_WINDOW_MS;
+}
+export async function startDaemon(args) {
+    bindConfigPath(args);
+    const stored = readConfig();
+    const installationId = stored.installationId ?? randomUUID();
+    const configPath = getConfigPath();
+    const endpointProfile = stored.endpointProfile ?? resolveEndpointProfile(args);
+    const daemonSessionId = randomUUID();
+    let heartbeatSeq = 0;
+    const runtimeId = argValue(args, "--runtime-id") ?? process.env.ALAN_RUNTIME_ID ?? stored.runtimeId;
+    const runtimeTokenOverride = argValue(args, "--token") ?? process.env.ALAN_RUNTIME_TOKEN;
+    let runtimeToken = runtimeTokenOverride ?? stored.runtimeToken;
+    let runtimeRenewalToken = runtimeTokenOverride ? undefined : stored.runtimeRenewalToken;
+    let runtimeTokenExpiresAt = runtimeTokenOverride ? undefined : stored.runtimeTokenExpiresAt;
+    const wsUrlOverride = argValue(args, "--ws-url") ?? process.env.ALAN_WS_URL;
+    // CLI/env overrides are trusted; stored config is self-healed when profile disagrees.
+    const endpointMismatch = wsUrlOverride
+        ? null
+        : checkStoredEndpointConsistency(stored, readEndpointDefaults());
+    let wsUrl = wsUrlOverride ?? stored.wsUrl;
+    if (endpointMismatch && stored.wsUrl && stored.wsUrl !== endpointMismatch.expectedWsUrl) {
+        console.warn("[alan-agent] Stored config does not match its endpoint profile — connecting with the profile endpoints instead. Re-run setup to repair the stored config.", { configPath: getConfigPath(), detail: endpointMismatch.detail });
+        wsUrl = endpointMismatch.expectedWsUrl;
+    }
+    let localApiPort = getLocalApiPort(args, stored);
+    const localApiToken = stored.localApiToken ?? randomBytes(24).toString("hex");
+    const localServiceId = stored.localServiceId ?? randomUUID();
+    const localServiceSecret = stored.localServiceSecret ?? randomBytes(32).toString("base64url");
+    const localServiceStartedAtMs = Date.now();
+    const eventSpoolKey = stored.eventSpoolKey ?? randomBytes(32).toString("base64url");
+    if (stored.daemonEpoch !== undefined &&
+        (!Number.isSafeInteger(stored.daemonEpoch) ||
+            stored.daemonEpoch < 0 ||
+            stored.daemonEpoch >= Number.MAX_SAFE_INTEGER)) {
+        throw new Error("daemon config contains an invalid durable epoch; repair the runtime config");
+    }
+    const daemonEpoch = (stored.daemonEpoch ?? 0) + 1;
+    if (!runtimeId || !runtimeToken || !wsUrl) {
+        throw new Error("daemon requires runtimeId, runtime token, and wsUrl. Run setup first or pass --runtime-id/--token/--ws-url.");
+    }
+    const explicitApiUrl = argValue(args, "--api-url") ?? process.env.ALAN_API_URL;
+    const apiUrl = explicitApiUrl ?? endpointMismatch?.expectedApiUrl ?? resolveEndpoints(args, stored).apiUrl;
+    const skillControl = new HttpSkillControlClient({
+        apiUrl,
+        runtimeId,
+        getRuntimeToken: () => runtimeToken,
+    });
+    const runtimeSkillManager = await RuntimeSkillManager.open({
+        homeDirectory: homedir(),
+        endpointProfile,
+        profileStorageIdentity: configPath,
+        controlClient: skillControl,
+    });
+    const runtimeSkillCoordinator = new RuntimeSkillCoordinator(runtimeSkillManager, skillControl, (input) => resolveSkillScanInput(homedir(), input));
+    const runSkillSync = async (reason) => {
+        const operation = reason === "startup"
+            ? runtimeSkillCoordinator.runStartup()
+            : reason === "interval"
+                ? runtimeSkillCoordinator.runIncremental()
+                : reason === "refresh"
+                    ? runtimeSkillCoordinator.runAudit()
+                    : runtimeSkillCoordinator.run();
+        try {
+            await operation;
+            return { status: "ready" };
+        }
+        catch (error) {
+            console.warn("[alan-agent] Skill synchronization failed", {
+                runtimeId,
+                reason,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return {
+                status: "failed",
+                message: error instanceof Error ? error.message : String(error),
+            };
+        }
+    };
+    let initialSkillReadiness = null;
+    const waitForSkillReadiness = async (readiness, timeoutMs) => {
+        if (!readiness) {
+            return { status: "failed", message: "initial Skill synchronization has not started" };
+        }
+        let timeout;
+        try {
+            return await Promise.race([
+                readiness,
+                new Promise((resolveTimeout) => {
+                    timeout = setTimeout(() => resolveTimeout({ status: "timeout" }), timeoutMs);
+                    timeout.unref?.();
+                }),
+            ]);
+        }
+        finally {
+            if (timeout)
+                clearTimeout(timeout);
+        }
+    };
+    const startupLeaseResult = acquireLocalDaemonMaintenanceLease(configPath, "daemon_startup", 60_000);
+    if (!startupLeaseResult.acquired) {
+        throw new Error(startupLeaseResult.lease.reason === "credential_cleanup"
+            ? "Cannot start the daemon while credential cleanup is in progress"
+            : "Another process is already starting or maintaining this daemon config");
+    }
+    let ownerLeaseResult;
+    try {
+        ownerLeaseResult = await acquireLocalDaemonOwnerLease({
+            configPath,
+            daemonSessionId,
+            runtimeId,
+            localServiceId,
+            localApiPort,
+            localApiToken,
+            storedLocalApiPort: stored.localApiPort,
+            storedLocalApiToken: stored.localApiToken,
+        });
+    }
+    catch (error) {
+        releaseLocalDaemonMaintenanceLease(configPath, startupLeaseResult.lease.id);
+        throw error;
+    }
+    if (!ownerLeaseResult.acquired) {
+        releaseLocalDaemonMaintenanceLease(configPath, startupLeaseResult.lease.id);
+        throw new Error(`Another process already owns this daemon config (pid ${ownerLeaseResult.lease.pid})`);
+    }
+    let ownerLease = ownerLeaseResult.lease;
+    let startupLeaseHeld = true;
+    let ownerLeaseHeld = true;
+    const releaseStartupLease = () => {
+        if (!startupLeaseHeld)
+            return;
+        startupLeaseHeld = false;
+        releaseLocalDaemonMaintenanceLease(configPath, startupLeaseResult.lease.id);
+    };
+    const releaseOwnerLease = () => {
+        if (!ownerLeaseHeld)
+            return;
+        ownerLeaseHeld = false;
+        releaseLocalDaemonOwnerLease(configPath, ownerLease.id);
+    };
+    // ObservableMap keeps derived "any run active?" state in sync across dispatch/abort/reconnect.
+    const activeAgents = new ObservableMap();
+    const pendingRunStarts = new DurablePendingRunStarts(`${configPath}.pending-runs.json`, daemonSessionId);
+    const maintenanceReason = () => readLocalDaemonMaintenanceLease(configPath)?.reason;
+    let disconnectedSinceMs = null;
+    let lastConnectError = null;
+    // Machine-readable code from the backend's socket.io middleware error
+    // (err.data.code), e.g. "invalid_runtime_token". Preferred over regex on the
+    // human-readable message; older servers that don't set it leave this null.
+    let lastConnectErrorCode = null;
+    // Sticky identity failures must not be overwritten by a later transport code
+    // or by renewal's own rejection code racing the connect_error that triggered it.
+    // Cleared only on successful connect / successful renewal.
+    const TERMINAL_RUNTIME_AUTH_CODES = new Set([
+        "invalid_runtime_token",
+        "runtime_renewal_rejected",
+        "runtime_deleted",
+        "runtime_disabled",
+    ]);
+    let terminalAuthFailureCode = null;
+    const rememberConnectErrorCode = (code) => {
+        if (code && TERMINAL_RUNTIME_AUTH_CODES.has(code)) {
+            terminalAuthFailureCode = code;
+        }
+        lastConnectErrorCode = terminalAuthFailureCode ?? code;
+    };
+    const clearConnectErrors = () => {
+        lastConnectError = null;
+        lastConnectErrorCode = null;
+        terminalAuthFailureCode = null;
+    };
+    const pendingDeliveryLost = [];
+    const currentCapabilities = () => discoverCapabilities();
+    const currentMetadata = async () => ({
+        ...(await collectRuntimeMetadataWithProviderLimits()),
+        installationId,
+    });
+    const recentLogs = [];
+    const daemonLogPath = join(dirname(configPath), "logs", "daemon.log");
+    const persistDaemonLog = (line) => {
+        try {
+            mkdirSync(dirname(daemonLogPath), { recursive: true });
+            try {
+                if (statSync(daemonLogPath).size > 5 * 1024 * 1024) {
+                    renameSync(daemonLogPath, `${daemonLogPath}.1`);
+                }
+            }
+            catch {
+                // Missing file is fine — append creates it.
+            }
+            appendFileSync(daemonLogPath, `${line}\n`, "utf8");
+        }
+        catch {
+            // Logging must never take down the daemon.
+        }
+    };
+    const pushLog = (message) => {
+        const line = `${new Date().toISOString()} ${message}`;
+        recentLogs.push(line);
+        if (recentLogs.length > 200)
+            recentLogs.splice(0, recentLogs.length - 200);
+        persistDaemonLog(line);
+    };
+    const sleepInhibitor = new SleepInhibitor({ log: pushLog });
+    sleepInhibitor.setActive(true);
+    if (sleepInhibitor.backendNames().length > 0) {
+        pushLog(`sleep-inhibitor backends=${sleepInhibitor.backendNames().join(",")}`);
+    }
+    const workspaceAccessTracker = new WorkspaceAccessTracker();
+    const recheckWorkspaceIssue = () => {
+        const previousPath = workspaceAccessTracker.recoveryPath();
+        const readiness = workspaceAccessTracker.recheck();
+        if (previousPath && readiness?.ready)
+            pushLog(`workspace-access-restored path=${previousPath}`);
+        return workspaceAccessTracker.recoveryPath() ?? undefined;
+    };
+    let nativeStreamOutbox;
+    let nativeStreamEnrollment = false;
+    let nativeDeliveryReady = false;
+    let eventOutbox;
+    let nativeHookInbox;
+    let nativeTranscriptStreamer;
+    let runJournal;
+    try {
+        nativeStreamOutbox = createNativeStreamOutbox(`${configPath}.native-streams`, eventSpoolKey, pushLog);
+        eventOutbox = new EncryptedEventOutbox(`${configPath}.event-outbox.enc`, eventSpoolKey, pushLog, 
+        // Keep replay below the legacy runtime-socket ceiling during rolling
+        // upgrades. Stable acknowledgements still make the stream eventually
+        // consistent; pacing only trades catch-up latency for connection health.
+        { deliveryIntervalMs: 50, maxConcurrentDeliveries: 2 });
+        nativeHookInbox = new EncryptedNativeHookInbox(nativeHookInboxPath(configPath), eventSpoolKey, {
+            recoverClaims: true,
+            concurrency: 2,
+            onQuarantine: ({ fileName, error }) => pushLog(`native-hook-quarantined file=${fileName} error=${error.message}`),
+        });
+        nativeTranscriptStreamer = new NativeTranscriptStreamer(new NativeTranscriptCursorStore(`${configPath}.native-transcript-cursors.json`));
+        runJournal = new RuntimeRunJournal(`${configPath}.run-journal.json`);
+    }
+    catch (error) {
+        releaseOwnerLease();
+        releaseStartupLease();
+        throw error;
+    }
+    const workspaceRelocations = new Map();
+    const shutdownAbort = new AbortController();
+    let nativeHookDrainInFlight = null;
+    const drainNativeHooks = async () => {
+        try {
+            const result = await drainNativeHookInbox({
+                inbox: nativeHookInbox,
+                transcriptStreamer: nativeTranscriptStreamer,
+                sink: {
+                    deliver: (envelope, sourceHook) => deliverNativeHookWithOwnership({
+                        socket,
+                        envelope,
+                        sourceHook,
+                        outbox: nativeStreamOutbox,
+                        enrollment: nativeStreamEnrollment,
+                        signal: shutdownAbort.signal,
+                        pushLog,
+                    }),
+                    deliverCanonical: async (binding, source) => {
+                        if (shutdownAbort.signal.aborted)
+                            return false;
+                        eventOutbox.enqueueSource(binding.conversationId, binding.runId, source.eventId, source.event);
+                        eventOutbox.flush(socket);
+                        try {
+                            await eventOutbox.waitForAcknowledgement(source.eventId, shutdownAbort.signal);
+                        }
+                        catch (error) {
+                            if (shutdownAbort.signal.aborted)
+                                return false;
+                            throw error;
+                        }
+                        return true;
+                    },
+                },
+                onTranscriptError: ({ envelope, error }) => pushLog(`native-transcript-unavailable event=${envelope.eventId} provider=${envelope.provider} error=${error.message}`),
+            });
+            if (result.attempted > 0) {
+                pushLog(`native-hook-drain attempted=${result.attempted} acknowledged=${result.acknowledged} deferred=${result.deferred}`);
+            }
+        }
+        catch (error) {
+            pushLog(`native-hook-drain-failed ${error.message}`);
+        }
+    };
+    const flushNativeHookInbox = () => {
+        if (nativeHookDrainInFlight)
+            return nativeHookDrainInFlight;
+        if (shutdownAbort.signal.aborted || !socket.connected || !nativeDeliveryReady)
+            return Promise.resolve();
+        nativeHookDrainInFlight = drainNativeHooks().finally(() => {
+            nativeHookDrainInFlight = null;
+        });
+        return nativeHookDrainInFlight;
+    };
+    for (const relocation of stored.workspaceRelocations ?? []) {
+        if (relocation?.conversationId &&
+            relocation.runId &&
+            relocation.previousPath &&
+            relocation.canonicalPath) {
+            workspaceRelocations.set(resolve(relocation.previousPath), relocation);
+        }
+    }
+    if (stored.localApiPort !== localApiPort ||
+        stored.localApiToken !== localApiToken ||
+        stored.localServiceId !== localServiceId ||
+        stored.localServiceSecret !== localServiceSecret ||
+        stored.eventSpoolKey !== eventSpoolKey ||
+        stored.daemonEpoch !== daemonEpoch ||
+        stored.installationId !== installationId) {
+        // Persist only local API details plus first-run identity. Identity/wsUrl
+        // overrides from CLI args or env are per-invocation and must never clobber
+        // an existing stored config for the active profile.
+        try {
+            writeConfig({
+                ...stored,
+                runtimeId: stored.runtimeId ?? runtimeId,
+                runtimeToken: stored.runtimeToken ?? runtimeToken,
+                wsUrl: stored.wsUrl ?? wsUrl,
+                localApiPort,
+                localApiToken,
+                localServiceId,
+                localServiceSecret,
+                eventSpoolKey,
+                daemonEpoch,
+                installationId,
+            });
+        }
+        catch (error) {
+            releaseOwnerLease();
+            releaseStartupLease();
+            throw error;
+        }
+    }
+    let socket;
+    try {
+        socket = io(wsUrl, {
+            query: { type: "runtime", runtimeId, hostKind: "daemon", agentVersion: AGENT_VERSION },
+            auth: { token: runtimeToken },
+            transports: ["websocket"],
+            reconnection: true,
+            reconnectionAttempts: Infinity,
+            reconnectionDelay: 1000,
+            reconnectionDelayMax: 5000,
+            timeout: 20_000,
+            upgrade: false,
+            extraHeaders: { "ngrok-skip-browser-warning": "1" },
+        });
+        setConnectedRuntimeSocket(socket);
+    }
+    catch (error) {
+        releaseOwnerLease();
+        releaseStartupLease();
+        throw error;
+    }
+    socket.on("runtime.ready", (ready) => {
+        nativeDeliveryReady = true;
+        nativeStreamEnrollment =
+            Boolean(nativeStreamOutbox) &&
+                ready?.nativeStreamVersion === 2 &&
+                ready.nativeStreamEnrollment === true;
+        if (ready?.nativeStreamVersion === 2)
+            nativeStreamOutbox?.connect(socket);
+        void flushNativeHookInbox();
+    });
+    let runtimeCredentialOperationTail = Promise.resolve();
+    const runCredentialOperation = (operation) => {
+        const result = runtimeCredentialOperationTail.catch(() => { }).then(operation);
+        runtimeCredentialOperationTail = result.then(() => { }, () => { });
+        return result;
+    };
+    let runtimeRenewalInFlight = null;
+    const renewRuntimeLease = () => {
+        if (runtimeRenewalInFlight)
+            return runtimeRenewalInFlight;
+        const attempt = runCredentialOperation(async () => {
+            const renewalToken = runtimeRenewalToken;
+            if (!renewalToken) {
+                return false;
+            }
+            let response = null;
+            let transportError = null;
+            for (let retry = 1; retry <= 3; retry += 1) {
+                try {
+                    response = await fetch(`${apiUrl}/public/runtimes/${runtimeId}/tokens/renew`, {
+                        method: "POST",
+                        headers: {
+                            authorization: `Bearer ${renewalToken}`,
+                            "content-type": "application/json",
+                        },
+                        body: "{}",
+                        signal: AbortSignal.timeout(10_000),
+                    });
+                    transportError = null;
+                }
+                catch (error) {
+                    response = null;
+                    transportError = error;
+                }
+                const retriable = !response || response.status === 408 || response.status === 429 || response.status >= 500;
+                if (!retriable || retry === 3)
+                    break;
+                await sleep(retry * 250);
+            }
+            if (!response) {
+                rememberConnectErrorCode("backend_unreachable");
+                lastConnectError = `Runtime renewal could not reach Alan: ${transportError instanceof Error ? transportError.message : String(transportError)}`;
+                pushLog(`runtime-renewal-transport-failed ${lastConnectError}`);
+                return false;
+            }
+            if (!response.ok) {
+                const code = response.status === 401
+                    ? "runtime_renewal_rejected"
+                    : response.status === 403
+                        ? "runtime_disabled"
+                        : response.status === 410
+                            ? "runtime_deleted"
+                            : response.status >= 500
+                                ? "backend_unreachable"
+                                : "runtime_renewal_failed";
+                rememberConnectErrorCode(code);
+                lastConnectError = `Runtime renewal failed: ${response.status} ${await response.text()}`;
+                pushLog(`runtime-renewal-rejected ${lastConnectError}`);
+                return false;
+            }
+            const body = (await response.json());
+            if (typeof body.runtimeToken !== "string" ||
+                !body.runtimeToken.startsWith("alan_runtime_") ||
+                typeof body.runtimeTokenExpiresAt !== "string" ||
+                !Number.isFinite(Date.parse(body.runtimeTokenExpiresAt))) {
+                rememberConnectErrorCode("runtime_renewal_failed");
+                lastConnectError = "Runtime renewal returned an invalid access token";
+                pushLog("runtime-renewal-invalid-response");
+                return false;
+            }
+            const current = readConfig();
+            if (current.runtimeId !== runtimeId || current.runtimeRenewalToken !== renewalToken) {
+                rememberConnectErrorCode("runtime_renewal_superseded");
+                lastConnectError = "Runtime credentials changed while renewal was in progress";
+                pushLog("runtime-renewal-superseded");
+                return false;
+            }
+            const replacementExpiresAt = body.runtimeTokenExpiresAt;
+            try {
+                writeConfig({
+                    ...current,
+                    runtimeToken: body.runtimeToken,
+                    runtimeTokenExpiresAt: replacementExpiresAt,
+                });
+            }
+            catch (error) {
+                rememberConnectErrorCode("config_write_failed");
+                lastConnectError = `Runtime renewal could not save its replacement: ${error.message}`;
+                pushLog(`runtime-renewal-config-write-failed ${error.message}`);
+                return false;
+            }
+            runtimeToken = body.runtimeToken;
+            runtimeTokenExpiresAt = replacementExpiresAt;
+            socket.auth = { token: body.runtimeToken };
+            clearConnectErrors();
+            pushLog("runtime-renewal-succeeded");
+            socket.connect();
+            return true;
+        });
+        runtimeRenewalInFlight = attempt;
+        void attempt
+            .finally(() => {
+            if (runtimeRenewalInFlight === attempt)
+                runtimeRenewalInFlight = null;
+        })
+            .catch(() => { });
+        return attempt;
+    };
+    const ensureRuntimeTokenForLaunch = () => {
+        if (!runtimeRenewalToken || !runtimeTokenNeedsRenewal(runtimeTokenExpiresAt))
+            return true;
+        return renewRuntimeLease().then((renewed) => {
+            if (renewed)
+                return true;
+            // A transient renewal failure must not interrupt a credential that is
+            // still valid. Unknown expiry belongs to an older config; its authenticated
+            // WebSocket is the live validity signal until a later renewal succeeds.
+            if (!runtimeTokenExpiresAt)
+                return socket.connected;
+            return Date.parse(runtimeTokenExpiresAt) > Date.now();
+        });
+    };
+    let queueIdentityRestart = () => { };
+    let runtimeSetupInFlight = null;
+    const adoptRuntimeSetupGrant = (input) => {
+        if (runtimeSetupInFlight)
+            return runtimeSetupInFlight;
+        const attempt = runCredentialOperation(async () => {
+            const activeRunCount = activeAgents.size + pendingRunStarts.size;
+            if (activeRunCount > 0) {
+                throw new Error(`credential setup is deferred while ${activeRunCount} active run${activeRunCount === 1 ? " finishes" : "s finish"}`);
+            }
+            const current = readConfig();
+            if (current.runtimeId !== runtimeId ||
+                current.installationId !== installationId ||
+                input.installationId !== installationId) {
+                throw new Error("credential setup does not belong to this daemon installation");
+            }
+            if (input.apiUrl !== stored.apiUrl || input.wsUrl !== wsUrl) {
+                throw new Error("credential setup cannot change a running daemon's endpoints");
+            }
+            const bundle = await exchangeRuntimeSetupGrant(input);
+            if (bundle.runtimeId !== runtimeId) {
+                writeConfig({
+                    ...current,
+                    runtimeId: bundle.runtimeId,
+                    runtimeToken: bundle.runtimeToken,
+                    runtimeRenewalToken: bundle.runtimeRenewalToken,
+                    runtimeTokenExpiresAt: bundle.runtimeTokenExpiresAt,
+                    displayName: bundle.displayName,
+                });
+                clearPendingSetupIntent();
+                pushLog(`runtime-identity-switch-queued from=${runtimeId} to=${bundle.runtimeId} generation=${bundle.credentialGeneration}`);
+                const restartTimer = setTimeout(queueIdentityRestart, 100);
+                restartTimer.unref?.();
+                return {
+                    runtimeId: bundle.runtimeId,
+                    credentialGeneration: bundle.credentialGeneration,
+                };
+            }
+            writeConfig({
+                ...current,
+                runtimeToken: bundle.runtimeToken,
+                runtimeRenewalToken: bundle.runtimeRenewalToken,
+                runtimeTokenExpiresAt: bundle.runtimeTokenExpiresAt,
+                displayName: bundle.displayName,
+            });
+            clearPendingSetupIntent();
+            runtimeToken = bundle.runtimeToken;
+            runtimeRenewalToken = bundle.runtimeRenewalToken;
+            runtimeTokenExpiresAt = bundle.runtimeTokenExpiresAt;
+            socket.auth = { token: bundle.runtimeToken };
+            clearConnectErrors();
+            const ready = new Promise((resolveReady, rejectReady) => {
+                const timeout = setTimeout(() => {
+                    socket.off("runtime.ready", onReady);
+                    rejectReady(new Error("backend did not acknowledge the replacement credential generation"));
+                }, 15_000);
+                const onReady = (payload) => {
+                    if (payload?.credentialGeneration !== bundle.credentialGeneration)
+                        return;
+                    clearTimeout(timeout);
+                    socket.off("runtime.ready", onReady);
+                    resolveReady();
+                };
+                socket.on("runtime.ready", onReady);
+            });
+            pushLog(`runtime-credential-setup-redial generation=${bundle.credentialGeneration}`);
+            if (socket.connected)
+                socket.disconnect();
+            socket.connect();
+            await ready;
+            pushLog(`runtime-credential-setup-ready generation=${bundle.credentialGeneration}`);
+            return {
+                runtimeId: bundle.runtimeId,
+                credentialGeneration: bundle.credentialGeneration,
+            };
+        });
+        runtimeSetupInFlight = attempt;
+        void attempt
+            .finally(() => {
+            if (runtimeSetupInFlight === attempt)
+                runtimeSetupInFlight = null;
+        })
+            .catch(() => { });
+        return attempt;
+    };
+    const relocationInFlight = new Set();
+    const persistWorkspaceRelocations = () => {
+        const current = readConfig();
+        writeConfig({
+            ...current,
+            workspaceRelocations: workspaceRelocations.size > 0 ? [...workspaceRelocations.values()] : undefined,
+        });
+    };
+    const flushWorkspaceRelocations = () => {
+        if (!socket.connected)
+            return;
+        for (const [key, relocation] of workspaceRelocations) {
+            if (relocationInFlight.has(key))
+                continue;
+            relocationInFlight.add(key);
+            socket.emit("runtime.workspace.relocated", relocation, (result) => {
+                relocationInFlight.delete(key);
+                if (!result?.ok || !result.persisted)
+                    return;
+                const current = workspaceRelocations.get(key);
+                if (current?.canonicalPath !== relocation.canonicalPath)
+                    return;
+                workspaceRelocations.delete(key);
+                try {
+                    persistWorkspaceRelocations();
+                    pushLog(`workspace-relocation-persisted path=${relocation.canonicalPath}`);
+                }
+                catch (error) {
+                    workspaceRelocations.set(key, relocation);
+                    pushLog(`workspace-relocation-ack-save-failed ${error.message}`);
+                }
+            });
+        }
+    };
+    const emitRunnerPresence = () => {
+        if (!socket.connected)
+            return;
+        reconcileActiveRuns({ activeAgents, pushLog });
+        heartbeatSeq += 1;
+        const runnerSummary = summarizeRunnerStatus({
+            connected: socket.connected,
+            activeAgents,
+            disconnectedSinceMs,
+            daemonSessionId,
+            daemonEpoch,
+            heartbeatSeq,
+            interruptedRunIds: runJournal.recoveredRunIds(),
+            endpointProfile,
+            configPath,
+            runtimeId,
+            runtimeAuthValid: Boolean(runtimeToken),
+            endpointMismatchDetail: endpointMismatch?.detail ?? null,
+            workspacePath: recheckWorkspaceIssue(),
+            maintenanceReason: maintenanceReason(),
+            reservedStartCount: pendingRunStarts.size,
+        });
+        void currentMetadata().then((metadata) => {
+            socket.emit("runtime.heartbeat", {
+                capabilities: currentCapabilities(),
+                metadata: {
+                    ...metadata,
+                    runnerStatus: runnerSummary.runnerStatus,
+                },
+            });
+        });
+    };
+    const heartbeat = setInterval(() => {
+        if (!socket.connected)
+            return;
+        emitRunnerPresence();
+        flushWorkspaceRelocations();
+        void flushNativeHookInbox();
+    }, 15_000);
+    // Report suspension after reconnect so the backend can grant grace instead of failing the run.
+    let pendingWakeGapMs = null;
+    const flushWakeGap = () => {
+        if (pendingWakeGapMs === null || !socket.connected)
+            return;
+        const gapMs = pendingWakeGapMs;
+        pendingWakeGapMs = null;
+        socket.emit("runtime.wake", { gapMs });
+        pushLog(`runtime-wake reported gapMs=${gapMs}`);
+    };
+    const suspensionDetector = new SuspensionDetector({
+        onSuspensionDetected: (gapMs) => {
+            // Keep the longest gap if several elapse before we reconnect.
+            pendingWakeGapMs = Math.max(pendingWakeGapMs ?? 0, gapMs);
+            pushLog(`host-suspension detected gapMs=${gapMs}`);
+            flushWakeGap();
+        },
+    });
+    suspensionDetector.start();
+    void refreshProviderVersions();
+    const versionRefresh = setInterval(() => {
+        void refreshProviderVersions();
+    }, VERSION_REFRESH_INTERVAL_MS);
+    // Transient lease-probe tolerance for git slowness; see notes/agent-daemon-app-nap.md.
+    const parsedMaxTransient = Number(process.env.ALAN_WORKSPACE_LEASE_MAX_TRANSIENT_FAILURES);
+    const WORKSPACE_LEASE_MAX_TRANSIENT_FAILURES = Number.isFinite(parsedMaxTransient) && parsedMaxTransient >= 1
+        ? Math.floor(parsedMaxTransient)
+        : 3;
+    const WORKSPACE_LEASE_FAILURE_BACKOFF_BASE_MS = 1_000;
+    const WORKSPACE_LEASE_FAILURE_BACKOFF_MAX_MS = 15_000;
+    const stopRunForWorkspaceLease = (runId, entry, failure) => {
+        entry.stage = "failed";
+        if (!entry.presenter.failWorkspaceLease(failure))
+            return;
+        entry.agent.kill();
+        entry.cleanupState = "stopping";
+        void entry.agent.cleanup().then((cleaned) => {
+            if (cleaned && activeAgents.get(runId) === entry)
+                activeAgents.delete(runId);
+            else if (!cleaned)
+                entry.cleanupState = "failed";
+        });
+        pushLog(`workspace-lease-lost run=${runId} code=${failure.code}`);
+    };
+    const leaseCheckPolicy = {
+        maxTransientFailures: WORKSPACE_LEASE_MAX_TRANSIENT_FAILURES,
+        backoffBaseMs: WORKSPACE_LEASE_FAILURE_BACKOFF_BASE_MS,
+        backoffMaxMs: WORKSPACE_LEASE_FAILURE_BACKOFF_MAX_MS,
+    };
+    const verifyActiveWorkspaceLease = async (runId, entry, nowMs, force = false) => {
+        if (entry.cleanupState || entry.presenter.isTerminalFenced())
+            return false;
+        const lease = entry.workspaceLease;
+        if (!lease)
+            return true;
+        const state = entry.leaseCheck ?? { ...FRESH_LEASE_MONITOR_STATE };
+        const inFlight = entry.leaseCheckInFlight;
+        if (inFlight && (!force || inFlight.fresh))
+            return inFlight.promise;
+        if (!force && !isLeaseCheckDue(state, nowMs))
+            return true;
+        let verification;
+        verification = Promise.resolve(lease.verifyDetailed(force ? { fresh: true } : undefined))
+            .then((detailed) => {
+            if (activeAgents.get(runId) !== entry ||
+                entry.cleanupState ||
+                entry.presenter.isTerminalFenced()) {
+                return false;
+            }
+            const decision = applyLeaseCheckResult({
+                state,
+                detailed,
+                nowMs: Date.now(),
+                policy: leaseCheckPolicy,
+            });
+            entry.leaseCheck =
+                decision.action === "ok"
+                    ? { ...decision.state, nextCheckAtMs: Date.now() + WORKSPACE_LEASE_CHECK_INTERVAL_MS }
+                    : decision.state;
+            if (decision.action === "fail" && decision.failure) {
+                stopRunForWorkspaceLease(runId, entry, decision.failure);
+                return false;
+            }
+            else if (decision.action === "transient" && decision.failure) {
+                pushLog(`workspace-lease-transient run=${runId} streak=${decision.state.transientStreak}/${WORKSPACE_LEASE_MAX_TRANSIENT_FAILURES} code=${decision.failure.code} backoff_ms=${decision.backoffMs ?? 0}`);
+            }
+            return true;
+        })
+            .catch((error) => {
+            pushLog(`workspace-lease-check-failed run=${runId} ${String(error)}`);
+            return false;
+        })
+            .finally(() => {
+            if (entry.leaseCheckInFlight?.promise === verification) {
+                entry.leaseCheckInFlight = undefined;
+            }
+        });
+        entry.leaseCheckInFlight = { promise: verification, fresh: force };
+        return verification;
+    };
+    const workspaceLeaseMonitor = setInterval(() => {
+        const nowMs = Date.now();
+        for (const [runId, entry] of activeAgents) {
+            void verifyActiveWorkspaceLease(runId, entry, nowMs);
+        }
+    }, WORKSPACE_LEASE_CHECK_INTERVAL_MS);
+    workspaceLeaseMonitor.unref?.();
+    socket.on("connect", () => {
+        disconnectedSinceMs = null;
+        clearConnectErrors();
+        setConnectedRuntimeSocket(socket);
+        pushLog(`connected runtime=${runtimeId}`);
+        console.info("[alan-agent] Daemon connected", { runtimeId, wsUrl, version: AGENT_VERSION });
+        flushWorkspaceRelocations();
+        flushPendingDeliveryLostEvents({
+            socket,
+            activeAgents,
+            pending: pendingDeliveryLost,
+            eventOutbox,
+            pushLog,
+        });
+        reconcileActiveRuns({ activeAgents, pushLog });
+        // The server responds with the exact repositories and onboarding-enabled
+        // provider kinds. Do not perform a broad local scan before that authority arrives.
+        initialSkillReadiness = runSkillSync("startup");
+        void currentMetadata().then((metadata) => {
+            const runnerSummary = summarizeRunnerStatus({
+                connected: true,
+                activeAgents,
+                disconnectedSinceMs,
+                daemonSessionId,
+                daemonEpoch,
+                heartbeatSeq,
+                interruptedRunIds: runJournal.recoveredRunIds(),
+                endpointProfile,
+                configPath,
+                runtimeId,
+                runtimeAuthValid: Boolean(runtimeToken),
+                endpointMismatchDetail: endpointMismatch?.detail ?? null,
+                workspacePath: recheckWorkspaceIssue(),
+                maintenanceReason: maintenanceReason(),
+                reservedStartCount: pendingRunStarts.size,
+            });
+            socket.emit("runtime.hello", {
+                capabilities: currentCapabilities(),
+                metadata: {
+                    ...metadata,
+                    runnerStatus: runnerSummary.runnerStatus,
+                },
+            });
+            // Emitted after hello so the backend has already marked this runtime
+            // online and can attribute the wake to a known connection.
+            flushWakeGap();
+            scheduleRuntimeModelScan(() => Promise.resolve(metadata));
+        });
+    });
+    let lastConnectErrorLogAt = 0;
+    socket.on("connect_error", (error) => {
+        if (!socket.connected && disconnectedSinceMs === null)
+            disconnectedSinceMs = Date.now();
+        lastConnectError = error.message;
+        const errorCode = error?.data?.code;
+        // Middleware rejections carry a server code. A connect_error without one is
+        // a transport/service reachability failure, not evidence that the local
+        // daemon or Computer is broken.
+        rememberConnectErrorCode(typeof errorCode === "string" ? errorCode : classifyTransportFailure(error));
+        pushLog(`connect_error ${error.message}${lastConnectErrorCode ? ` code=${lastConnectErrorCode}` : ""}`);
+        if ((lastConnectErrorCode === "invalid_runtime_token" ||
+            terminalAuthFailureCode === "invalid_runtime_token") &&
+            runtimeRenewalToken) {
+            void renewRuntimeLease().catch((renewalError) => {
+                rememberConnectErrorCode("runtime_renewal_failed");
+                lastConnectError = `Runtime renewal failed unexpectedly: ${renewalError.message}`;
+                pushLog(`runtime-renewal-unexpected-failure ${renewalError.message}`);
+            });
+            return;
+        }
+        const now = Date.now();
+        if (now - lastConnectErrorLogAt < 5000)
+            return;
+        lastConnectErrorLogAt = now;
+        const wsHint = isLocalEndpoint(wsUrl)
+            ? ` Nothing is listening at ${wsUrl}. For local dev run setup with --profile local and start the stack (WS on ws://localhost:8401).`
+            : ` Verify wsUrl in ${getConfigPath()} and that you can reach ${wsUrl}.`;
+        console.warn("[alan-agent] Daemon connection error:", `${error.message}.${wsHint}`);
+    });
+    socket.on("connection_directive", (value) => {
+        if (!value || typeof value !== "object")
+            return;
+        const directive = value;
+        if (directive.retryable !== false || typeof directive.code !== "string")
+            return;
+        rememberConnectErrorCode(directive.code);
+        if (typeof directive.reason === "string")
+            lastConnectError = directive.reason;
+        pushLog(`connection_directive ${directive.code}${lastConnectError ? ` reason=${lastConnectError}` : ""}`);
+    });
+    socket.on("disconnect", (reason) => {
+        setConnectedRuntimeSocket(null);
+        relocationInFlight.clear();
+        eventOutbox.disconnect();
+        nativeStreamOutbox?.disconnect();
+        nativeStreamEnrollment = false;
+        nativeDeliveryReady = false;
+        if (disconnectedSinceMs === null)
+            disconnectedSinceMs = Date.now();
+        pushLog(`disconnected ${reason}`);
+        console.info("[alan-agent] Daemon disconnected:", reason);
+        for (const [runId, entry] of activeAgents.entries()) {
+            if (entry.stage === "completed" ||
+                entry.stage === "failed" ||
+                entry.stage === "aborted" ||
+                entry.stage === "delivery_lost") {
+                continue;
+            }
+            entry.stage = "delivery_lost";
+            pendingDeliveryLost.push({ conversationId: entry.conversationId, runId });
+        }
+    });
+    socket.on("desktop:rpc", async (message) => {
+        if (!message?.id || !message.method)
+            return;
+        try {
+            const params = message.params ?? {};
+            const result = isBindingSwitchGitMethod(message.method)
+                ? await executeBindingSwitchGitRpc(message.method, params)
+                : executeWorkspaceRpc(message.method, params);
+            socket.emit("desktop:rpc", { jsonrpc: "2.0", id: message.id, result });
+        }
+        catch (error) {
+            const stableCode = error instanceof BindingSwitchGitError ? error.code : "runtime_operation_failed";
+            const stableDetails = error instanceof BindingSwitchGitError ? error.details : undefined;
+            socket.emit("desktop:rpc", {
+                jsonrpc: "2.0",
+                id: message.id,
+                error: {
+                    code: -32000,
+                    message: error.message,
+                    data: { ...stableDetails, code: stableCode },
+                },
+            });
+        }
+    });
+    socket.on("agent.execute", async (payload) => {
+        if (shutdownAbort.signal.aborted)
+            return;
+        if (payload.skillInvocation || payload.skillInvocations?.length) {
+            let readiness = await waitForSkillReadiness(initialSkillReadiness, 15_000);
+            if (readiness.status === "failed") {
+                initialSkillReadiness = runSkillSync("sync");
+                readiness = await waitForSkillReadiness(initialSkillReadiness, 15_000);
+            }
+            if (readiness.status !== "ready") {
+                socket.emit("agent.rejected", {
+                    runId: payload.runId,
+                    message: readiness.status === "timeout"
+                        ? "Skills are still synchronizing on this runtime. Try again in a moment."
+                        : `Skills could not be synchronized on this runtime: ${readiness.message}`,
+                    code: "skill_sync_unavailable",
+                });
+                return;
+            }
+        }
+        await handleAgentExecute({
+            activeAgents,
+            shutdownSignal: shutdownAbort.signal,
+            pendingRunStarts,
+            pushLog,
+            socket,
+            runJournal,
+            publishCapacityChange: emitRunnerPresence,
+            runtimeId,
+            runtimeSkillManager,
+            getRuntimeToken: () => runtimeToken,
+            ensureRuntimeTokenForLaunch,
+            eventOutbox,
+            daemonSessionId,
+            daemonEpoch,
+            getHeartbeatSeq: () => heartbeatSeq,
+            endpointProfile,
+            apiUrl,
+            configPath,
+            endpointMismatch,
+            workspaceAccessTracker,
+            getDisconnectedSinceMs: () => disconnectedSinceMs,
+            workspaceRelocations,
+            persistWorkspaceRelocations,
+            flushWorkspaceRelocations,
+            recheckWorkspaceIssue,
+            maintenanceReason,
+            verifyActiveWorkspaceLease,
+        }, payload);
+    });
+    socket.on("agent.abort", (payload) => {
+        if (!payload?.runId)
+            return;
+        const entry = activeAgents.get(payload.runId);
+        if (!entry)
+            return;
+        // Only server-side timeouts are accepted as a non-user reason; everything
+        // else (including legacy payloads without a reason) is a user stop.
+        const reason = payload.reason === "watchdog_timeout" ? "watchdog_timeout" : "user";
+        abortActiveAgent(entry, { userInitiated: true, reason });
+        pushLog(`aborted run=${payload.runId} reason=${reason}`);
+        console.info("[alan-agent] Agent run aborted", {
+            runId: payload.runId,
+            reason,
+            agentVersion: AGENT_VERSION,
+        });
+    });
+    socket.on("agent.tool_response", async (payload) => {
+        if (!payload?.toolId || typeof payload.response !== "string")
+            return;
+        // Route tool answers by run/conversation; stdin writes do not verify tool ownership.
+        const entries = payload.runId
+            ? [[payload.runId, activeAgents.get(payload.runId)]]
+            : payload.conversationId
+                ? [...activeAgents.entries()].filter(([, entry]) => entry.conversationId === payload.conversationId)
+                : [...activeAgents.entries()];
+        let delivered = false;
+        for (const [runId, entry] of entries) {
+            if (!entry || !(await verifyActiveWorkspaceLease(runId, entry, Date.now(), true))) {
+                continue;
+            }
+            if (entry.agent.sendToolResponse(payload.toolId, payload.response) === true) {
+                delivered = true;
+                break;
+            }
+        }
+        if (!delivered) {
+            pushLog(`tool_response missed tool=${payload.toolId}`);
+            // Surface the lost delivery to the conversation instead of hanging
+            // silently until a timeout: the agent process is gone or its stdin is
+            // closed, so the user's answer can only arrive as a new message.
+            // Resolve the conversation even when the runId is stale (e.g. the run was
+            // retried or already reaped) so the error still lands in the right chat.
+            const fallbackRun = [...activeAgents.entries()][0];
+            const resolvedRunId = payload.runId ?? entries[0]?.[0] ?? fallbackRun?.[0];
+            const conversationId = payload.conversationId ??
+                (payload.runId ? activeAgents.get(payload.runId)?.conversationId : undefined) ??
+                fallbackRun?.[1].conversationId;
+            if (conversationId && resolvedRunId) {
+                eventOutbox.enqueue(conversationId, resolvedRunId, {
+                    type: "error",
+                    message: "Your answer could not be delivered to the running agent — its input channel is closed. Send your answer as a new message to continue.",
+                });
+                eventOutbox.flush(socket);
+            }
+        }
+    });
+    socket.on("runtime.skills.invalidate", () => {
+        void runSkillSync("refresh");
+    });
+    socket.on("runtime.models.scan", (payload) => {
+        if (!payload?.requestId)
+            return;
+        const requestId = payload.requestId;
+        void (async () => {
+            try {
+                await runRuntimeModelScan({
+                    refreshModels: refreshProviderModels,
+                    getCapabilities: () => discoverCapabilities(),
+                    getBaseMetadata: async () => (await currentMetadata()),
+                    publishCredentials: (() => {
+                        const stored = readConfig();
+                        if (!stored.runtimeId || !stored.runtimeToken || !stored.apiUrl)
+                            return undefined;
+                        return {
+                            apiUrl: stored.apiUrl,
+                            runtimeId: stored.runtimeId,
+                            runtimeToken: stored.runtimeToken,
+                        };
+                    })(),
+                }, { force: payload.force === true || payload.refresh === true });
+                const metadata = await currentMetadata();
+                socket.emit("runtime.models.result", {
+                    requestId,
+                    capabilities: discoverCapabilities(),
+                    metadata: {
+                        ...metadata,
+                        ...buildModelsScanMetadata("complete"),
+                    },
+                });
+            }
+            catch (error) {
+                socket.emit("runtime.models.result", {
+                    requestId,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        })();
+    });
+    const adoptionChallenges = new Map();
+    let queueFullShutdown = () => { };
+    const localServer = http.createServer(createLocalDaemonHttpHandler({
+        adoptionChallenges,
+        localServiceId,
+        localServiceSecret,
+        installationId,
+        runtimeId,
+        getLocalApiPort: () => localApiPort,
+        localServiceStartedAtMs,
+        localApiToken,
+        activeAgents,
+        pendingRunStarts,
+        pushLog,
+        socket,
+        getDisconnectedSinceMs: () => disconnectedSinceMs,
+        daemonSessionId,
+        daemonEpoch,
+        getHeartbeatSeq: () => heartbeatSeq,
+        runJournal,
+        endpointProfile,
+        configPath,
+        getRuntimeToken: () => runtimeToken,
+        endpointMismatchDetail: endpointMismatch?.detail ?? null,
+        recheckWorkspaceIssue,
+        maintenanceReason,
+        getLastConnectError: () => lastConnectError,
+        getLastConnectErrorCode: () => lastConnectErrorCode,
+        setLastConnectError: (v) => {
+            lastConnectError = v;
+        },
+        setLastConnectErrorCode: (v) => {
+            if (v === null) {
+                // Explicit reconnect clears transport noise, but sticky identity
+                // rejections stay until a successful connect/renew clears them.
+                lastConnectErrorCode = terminalAuthFailureCode;
+                return;
+            }
+            rememberConnectErrorCode(v);
+        },
+        workspaceAccessTracker,
+        recentLogs,
+        emitRunnerPresence,
+        queueFullShutdown: () => queueFullShutdown(),
+        wsUrl,
+        inspectLocalSkill: (input) => runtimeSkillManager.inspectLocalPackage(input),
+        readLocalSkillFile: (input) => runtimeSkillManager.readLocalPackageFile(input),
+        adoptRuntimeSetupGrant,
+    }));
+    const occupiedProbe = await probeLocalDaemonEndpoint(localApiPort, localApiToken);
+    if (occupiedProbe.state === "running") {
+        clearInterval(heartbeat);
+        clearInterval(versionRefresh);
+        clearInterval(workspaceLeaseMonitor);
+        suspensionDetector.stop();
+        socket.disconnect();
+        releaseOwnerLease();
+        releaseStartupLease();
+        throw new Error(`${describeOccupiedLocalDaemon(localApiPort)} (runtime ${occupiedProbe.status.runtimeId})`);
+    }
+    if (occupiedProbe.state === "listening_unauthorized") {
+        clearInterval(heartbeat);
+        clearInterval(versionRefresh);
+        clearInterval(workspaceLeaseMonitor);
+        suspensionDetector.stop();
+        socket.disconnect();
+        releaseOwnerLease();
+        releaseStartupLease();
+        throw new Error(`${describeOccupiedLocalDaemon(localApiPort)} The token in ${getConfigPath()} no longer matches the running daemon; quit Alan desktop or run setup again.`);
+    }
+    const localApiListening = new Promise((resolve, reject) => {
+        const onError = (error) => {
+            clearInterval(heartbeat);
+            clearInterval(versionRefresh);
+            clearInterval(workspaceLeaseMonitor);
+            suspensionDetector.stop();
+            socket.disconnect();
+            if (error.code === "EADDRINUSE") {
+                void probeLocalDaemonEndpoint(localApiPort).then((probe) => {
+                    if (probe.state !== "absent") {
+                        reject(new Error(describeOccupiedLocalDaemon(localApiPort)));
+                        return;
+                    }
+                    reject(new Error(`local daemon API port ${localApiPort} is already in use by another process. ` +
+                        "Otherwise free the port or pass `--local-api-port` with a different value."));
+                });
+                return;
+            }
+            reject(error);
+        };
+        localServer.once("error", onError);
+        localServer.listen(localApiPort, "127.0.0.1", () => {
+            localServer.off("error", onError);
+            const address = localServer.address();
+            if (address && typeof address === "object")
+                localApiPort = address.port;
+            pushLog(`local_api listening port=${localApiPort}`);
+            console.info("[alan-agent] Local daemon API listening", { port: localApiPort });
+            resolve();
+        });
+    });
+    try {
+        await localApiListening;
+    }
+    catch (error) {
+        releaseOwnerLease();
+        releaseStartupLease();
+        throw error;
+    }
+    try {
+        ownerLease = updateLocalDaemonOwnerEndpoint(configPath, ownerLease, localApiPort);
+        // The config-scoped owner is held and its authenticated endpoint is now
+        // bound. Only now may prior journal entries be persisted as interrupted.
+        runJournal.confirmRecoveryOwnership();
+        pendingRunStarts.discardRecovered();
+    }
+    catch (error) {
+        clearInterval(heartbeat);
+        clearInterval(versionRefresh);
+        clearInterval(workspaceLeaseMonitor);
+        suspensionDetector.stop();
+        socket.disconnect();
+        await new Promise((resolve) => localServer.close(() => resolve()));
+        releaseOwnerLease();
+        releaseStartupLease();
+        throw error;
+    }
+    releaseStartupLease();
+    // Incremental scans reuse cached file hashes and only inspect the source roots
+    // selected during onboarding; the daily audit deliberately ignores that cache.
+    const skillSyncInterval = setInterval(() => void runSkillSync("interval"), 60_000);
+    skillSyncInterval.unref?.();
+    const skillAuditInterval = setInterval(() => void runSkillSync("refresh"), 24 * 60 * 60_000);
+    skillAuditInterval.unref?.();
+    const nativeHookDrainInterval = setInterval(() => void flushNativeHookInbox(), 1_000);
+    nativeHookDrainInterval.unref?.();
+    let stopInFlight = null;
+    const stopOwned = async () => {
+        let shutdownComplete = false;
+        try {
+            clearInterval(heartbeat);
+            clearInterval(versionRefresh);
+            clearInterval(workspaceLeaseMonitor);
+            clearInterval(skillSyncInterval);
+            clearInterval(skillAuditInterval);
+            clearInterval(nativeHookDrainInterval);
+            suspensionDetector.stop();
+            shutdownAbort.abort(new Error("Daemon stopping"));
+            socket.disconnect();
+            // scheduleRuntimeModelScan() on socket "connect" is fire-and-forget: it
+            // spawns each installed provider CLI (codex, claude, antigravity, ...)
+            // to probe versions/models and was never joined by shutdown, so a probe
+            // could still be writing to its own CLI-owned config/log directory
+            // after stop() had already resolved. Reproduced on macOS: 10 back-to-
+            // back daemon-child cycles raced a still-running `agy` (antigravity
+            // CLI) version probe against that cycle's temp HOME directory cleanup.
+            // Bounded wait: a slow or hung provider CLI must not block shutdown.
+            const pendingModelScan = getModelScanInFlight();
+            if (pendingModelScan)
+                await Promise.race([pendingModelScan, sleep(3_000)]);
+            const stoppingEntries = [...activeAgents.values()];
+            for (const entry of stoppingEntries) {
+                abortActiveAgent(entry, { reason: "runtime_shutdown" });
+            }
+            const cleanupResults = await Promise.all(stoppingEntries.map((entry) => entry.agent.cleanup()));
+            const providersExited = cleanupResults.every(Boolean);
+            if (!providersExited)
+                throw new Error("Provider cleanup failed; daemon ownership retained");
+            activeAgents.clear();
+            await nativeHookDrainInFlight;
+            await nativeStreamOutbox?.close();
+            // A momentary I/O error must not fail shutdown and strand the owner
+            // lease: the failed batch is requeued, so retry the flush a bounded
+            // number of times and only refuse to release ownership when the journal
+            // still cannot persist. Include the recorded cause: without it the next
+            // failure of this kind is undebuggable (the outbox logs to the daemon
+            // log file, not the test output).
+            for (let attempt = 0;; attempt++) {
+                await eventOutbox.flushDurable();
+                const stopMetrics = eventOutbox.metrics();
+                if (!stopMetrics.persistFailure)
+                    break;
+                if (attempt >= 2)
+                    throw new Error(`Event journal flush failed (${stopMetrics.persistFailure}); daemon ownership retained`);
+                await sleep(100);
+            }
+            await new Promise((resolve) => {
+                localServer.close(() => resolve());
+            });
+            shutdownComplete = true;
+        }
+        finally {
+            // Release the sleep assertion even if teardown above threw; a leaked
+            // helper would keep the machine awake indefinitely.
+            sleepInhibitor.dispose();
+            // Never advertise the endpoint as replaceable while a provider process
+            // from this daemon is still alive. The owner lease then expires or is
+            // released when the containing process exits, preventing overlap.
+            if (shutdownComplete)
+                releaseOwnerLease();
+        }
+    };
+    const stop = () => {
+        if (!stopInFlight) {
+            stopInFlight = stopOwned().catch((error) => {
+                stopInFlight = null;
+                throw error;
+            });
+        }
+        return stopInFlight;
+    };
+    const controller = {
+        runtimeId,
+        wsUrl,
+        localApiPort,
+        localApiToken,
+        stop,
+    };
+    queueFullShutdown = () => {
+        void stop()
+            .then(() => controller.whenExternallyStopped?.())
+            .catch((error) => pushLog(`daemon-shutdown-failed ${String(error)}`));
+    };
+    queueIdentityRestart = () => {
+        void stop()
+            .then(() => controller.whenExternallyStopped?.("runtime_identity_changed"))
+            .catch((error) => pushLog(`daemon-identity-restart-failed ${String(error)}`));
+    };
+    return controller;
+}
+//# sourceMappingURL=daemon-start.js.map