@bahulam/code 0.1.2 → 0.1.4

package/src/daemon/session-core.mjs

@@ -0,0 +1,179 @@
+/**
+ *  §6.1 / §6.8 — SessionCore: the daemon-owned view of a session.
+ *
+ * The daemon (bahulamd, .3+) owns:
+ *   1. The agent loop (SSE consumer → tool executor → event dispatch).
+ *   2. The event log ( §6.4).
+ *   3. The message history + cumulative usage — everything an attach
+ *      client needs to reconstruct the transcript on reconnect.
+ *
+ * The attach client () owns everything rendering-related:
+ *   spinner, per-line dedup, block-boundary tracking, sub-agent tool
+ *   window, input-history for arrow keys, one-shot toasts, etc.
+ *
+ * repl-state.mjs already holds both categories mixed together (see the
+ * `session` and `runtime` exports). This module is the *classification*
+ * of which fields the daemon persists across attach/detach and which
+ * belong to the attached client — plus a small snapshot/restore API
+ * bahulamd will call to write/read the periodic snapshot-<seq>.json
+ * files that seed a re-attaching client.
+ *
+ * IMPORTANT — cache invariance ( §7 note we keep repeating):
+ * NOTHING in this module gets sent to the LLM. The snapshot is written
+ * to local disk only. The daemon's outbound HTTP body to /api/execute
+ * is constructed exactly the same way it is today — via existing code
+ * paths that read session.agentHistory / session.messages. The
+ * BAHULAM_CAPTURE_REQUEST hook (see stream-client.mjs) exists so a
+ * later slice can hard-assert that byte identity.
+ */
+
+import { session as sharedSession } from '../terminal/repl-state.mjs';
+
+// ── field classification ─────────────────────────────────────────────
+
+/**
+ * Daemon-owned session fields. These persist across detach/attach and
+ * appear in snapshot-<seq>.json. Order and shape match repl-state.mjs
+ * so callers don't have to translate.
+ *
+ * A field belongs here if:
+ *   • Its value is the source of truth for what happened in the session
+ *     (message history, cumulative usage, cost, files touched, …).
+ *   • A re-attaching client needs it to render an accurate transcript.
+ *   • It doesn't change based on which attach is watching.
+ */
+export const DAEMON_OWNED_FIELDS = Object.freeze([
+  'id',
+  'startTime',
+  'inputTokens',
+  'outputTokens',
+  'toolCalls',
+  'subAgentToolCalls',
+  'totalToolCalls',
+  'totalPrimaryToolCalls',
+  'totalSubAgentToolCalls',
+  'turns',
+  'history',
+  'agentHistory',
+  'user',
+  'model',
+  'modelLimits',
+  'blockedOps',
+  'delegations',
+  'phases',
+  'filesChanged',
+  'filesRead',
+  'lastTurnDuration',
+  'toolCounts',
+  'subAgentCounts',
+  'savedUsd',
+  'lastTask',
+  'lastReasoning',
+  'budgetUsd',
+  'budgetExceeded',
+  'costBreakdown',
+  'totalCost',
+  'costAccurate',
+  'modelOverrides',
+  'modelMode',
+  'routePreference',
+  'isByok',
+  'subscriptionTier',
+  'creditsTotal',
+  'creditsIncluded',
+  'creditsPurchased',
+  'creditsLimit',
+  'creditsCharged',
+  'rateLimit',
+]);
+
+/**
+ * Client-owned session fields. These belong to whichever attach is
+ * currently connected and MUST NOT be included in snapshots — replaying
+ * them on re-attach would produce wrong UX (e.g. a "low credits" toast
+ * shown twice, arrow-key history from a stranger's terminal).
+ *
+ * A field belongs here if:
+ *   • It exists to dedup a per-attach UI effect (`*_LowWarned` flags).
+ *   • It's input state tied to a keyboard (`inputHistory`).
+ *   • It's a rendering flag whose value depends on the current visible
+ *     transcript, not the session's actual state (`inSubAgent`).
+ */
+export const CLIENT_OWNED_SESSION_FIELDS = Object.freeze([
+  'inputHistory',
+  'inSubAgent',
+  'creditsLowWarned',
+  'msgsLowWarned',
+  '_lastEmittedThinking',
+]);
+
+/**
+ * The `runtime` object in repl-state.mjs is ENTIRELY client-owned.
+ * It's stream buffers, spinner frames, explore-run counters, sub-agent
+ * live windows — all rendering. Listed here for completeness; the
+ * daemon never reads or writes runtime.*.
+ */
+export const CLIENT_OWNED_RUNTIME_FIELDS = Object.freeze([
+  'streamBuffer', 'streamedPartialText', 'streamTimer',
+  'renderedContentThisTurn', 'contentHeaderPrinted', 'afterContentFlush',
+  'pendingHead', 'lastRenderedBlock', 'renderedToolResults', 'renderedFileDiffPreviews',
+  'exploreRun', 'foldedSubAgentTools',
+  'spinInterval', 'spinText', 'spinFrame', 'spinPhase', 'spinStartedAt', 'spinToolCalls',
+  'subAgentWindow',
+]);
+
+// ── snapshot / restore ───────────────────────────────────────────────
+
+/**
+ * Extract the daemon-owned fields from a session-like object into a
+ * plain, JSON-serializable snapshot. Use `sharedSession` by default so
+ * bahulamd can call `snapshotSession()` with no arg and get the right
+ * thing; tests can pass an alternate source.
+ *
+ * Missing fields are omitted (not written as `undefined`) so the
+ * snapshot file stays clean. Nested objects/arrays are shallow-copied
+ * — callers that mutate history/agentHistory after snapshotting will
+ * see the mutation reflected. That's fine for the daemon (single
+ * writer, snapshot-then-continue pattern), but tests that reuse
+ * snapshots across mutations should structuredClone() the return.
+ */
+export function snapshotSession(source = sharedSession) {
+  const out = {};
+  for (const key of DAEMON_OWNED_FIELDS) {
+    if (source[key] !== undefined) out[key] = source[key];
+  }
+  return out;
+}
+
+/**
+ * Apply a snapshot back onto a session-like object. Only DAEMON_OWNED
+ * fields are copied — a maliciously crafted snapshot that includes
+ * runtime.* or CLIENT_OWNED_SESSION_FIELDS is silently ignored to
+ * prevent snapshot injection from replaying per-attach UI state.
+ *
+ * Fields the snapshot doesn't mention are left unchanged on `target`
+ * (not zeroed out). That way a partial snapshot from an older schema
+ * version still restores what it knows without wiping newer fields.
+ */
+export function restoreSession(snapshot, target = sharedSession) {
+  if (!snapshot || typeof snapshot !== 'object') return target;
+  for (const key of DAEMON_OWNED_FIELDS) {
+    if (Object.prototype.hasOwnProperty.call(snapshot, key)) {
+      target[key] = snapshot[key];
+    }
+  }
+  return target;
+}
+
+// ── introspection ────────────────────────────────────────────────────
+
+/**
+ * Classify a single field name. Useful in tests to guarantee every
+ * field in repl-state.mjs is accounted for (nothing accidentally lives
+ * in "neither" — new fields must be classified when added).
+ */
+export function classifyField(name) {
+  if (DAEMON_OWNED_FIELDS.includes(name)) return 'daemon';
+  if (CLIENT_OWNED_SESSION_FIELDS.includes(name)) return 'client';
+  return 'unclassified';
+}

package/src/daemon/session-list.mjs

@@ -0,0 +1,26 @@
+import { readdir, readFile } from 'node:fs/promises';
+ * Session list — reads local session metadata from ~/.bahulam/sessions/
+ * and presents them for attach/stop operations.  try {
+    const entries = await readdir(dir, { withFileTypes: true });
+    const sessions = [];
+    for (const entry of entries) {
+      if (!entry.isDirectory() || !entry.name.startsWith('sess_')) continue;
+      try {
+        const meta = JSON.parse(await readFile(join(dir, entry.name, 'meta.json'), 'utf-8'));
+        sessions.push({ id: entry.name, ...meta });
+      } catch { /* no meta.json, skip */ }
+    }
+    if (sessions.length === 0) {
+      process.stderr.write('No daemon sessions.\n');
+      return;
+    }
+    for (const s of sessions) {
+      const pid = s.pid ? ` (pid ${s.pid})` : '';
+      const cwd = s.cwd || '?';
+      const model = s.model || '?';
+      process.stderr.write(`  ${s.id}  ${cwd}  ${model}${pid}\n`);
+    }
+  } catch (err) {
+    process.stderr.write(`No daemon sessions: ${err.message}\n`);
+  }
+}

package/src/daemon/session-publisher.mjs

@@ -0,0 +1,78 @@
+/**
+ * .  — session_directory publisher (daemon side).
+ *
+ * POSTs to the gateway's /v1/session-directory endpoint on session
+ * lifecycle transitions so mobile clients + the web dashboard can see
+ * daemons that aren't currently connected to the relay.
+ *
+ * The gateway's /relay/sessions endpoint shows LIVE relay connections
+ * (in-memory hub state). This publisher covers the gap: daemons that
+ * started, ran, and now sit idle waiting for input still appear.
+ *
+ * Fire-and-forget: a publish failure MUST NOT interrupt the turn or
+ * crash the daemon. Errors log to stderr and the next transition retries.
+ *
+ * Called by:
+ *   - src/core/headless.mjs on session_info (status=running)
+ *   - src/core/headless.mjs on agent_complete (status=idle if held,
+ *                                              closed if exiting)
+ *   - src/terminal/repl.mjs on session_info (running) and REPL exit (closed)
+ *
+ * We hit the GATEWAY (BAHULAM_GATEWAY_URL) rather than Supabase directly
+ * because (a) the daemon has a Bahulam bearer token, not a Supabase
+ * JWT, and (b) the gateway already knows how to resolve that bearer to
+ * a user_id via /internal/whoami. Same trust chain as pair/device/remote.
+ */
+
+import * as os from 'node:os';
+
+const GATEWAY = (process.env.BAHULAM_GATEWAY_URL || 'https://gateway.bahulam.ai').replace(/\/+$/, '').replace(/\/v1$/, '');
+
+/** One publish. Returns nothing; errors log to stderr. */
+export async function publishSessionDirectory({
+  sessionId,
+  token,
+  cwd = null,
+  model = null,
+  hostHint = null,
+  status = 'running',
+  origin = 'local',
+} = {}) {
+  if (!sessionId || !token) return;
+  try {
+    const res = await fetch(`${GATEWAY}/v1/session-directory`, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({
+        session_id: sessionId,
+        origin,
+        host_hint: hostHint || _defaultHostHint(),
+        cwd_display: cwd,
+        model,
+        status,
+      }),
+    });
+    if (!res.ok) {
+      const body = await res.text().catch(() => '');
+      try { process.stderr.write(`[session-directory] publish ${status} failed (${res.status}): ${body.slice(0, 200)}\n`); } catch {}
+    }
+  } catch (err) {
+    try { process.stderr.write(`[session-directory] network error: ${err.message}\n`); } catch {}
+  }
+}
+
+/** Convenience: mark a session closed. Best-effort; call from exit paths. */
+export async function markSessionClosed({ sessionId, token }) {
+  return publishSessionDirectory({ sessionId, token, status: 'closed' });
+}
+
+function _defaultHostHint() {
+  try {
+    const user = process.env.USER || process.env.USERNAME || 'user';
+    const host = (os.hostname() || 'host').split('.')[0];
+    return `${user}@${host}`;
+  } catch { return 'unknown'; }
+}

package/src/daemon/socket-server.mjs

@@ -0,0 +1,329 @@
+/**
+ * Unix socket server — accepts local CLI client connections and
+ * dispatches relay events to attached clients.
+ *
+ * Commands accepted from local clients:
+ *   • `approve` / `deny` — dispatched to the approval handler
+ *   • `interrupt`, `send_message`, `switch_model` — forwarded to relay
+ *   • `take_input_lock` / `release_input_lock` — lock management *   • Multi-attach input lock ().
+ *   • Relay bridge ().
+ *
+ * Design invariants:
+ *   • ONE writer per event log; the server never writes to the log
+ *     directly. The tap does. The server only READS the log to replay.
+ *   • Broadcast failures on ONE client MUST NOT affect other clients or
+ *     the daemon's own event flow. Every socket write is try/catch'd.
+ *   • The server is a passive fan-out: it does not mutate session
+ *     state, it does not drive the SSE loop, it does not have opinions
+ *     about which events matter.
+ */
+
+import * as net from 'node:net';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { readEvents, readLatestSnapshot } from '../core/event-log.mjs';
+import { daemonSocketPath, daemonSocketsDir } from '../core/paths.mjs';
+import {
+  onAttachJoined, onAttachLeft, takeInputLock, releaseInputLock, isHolder,
+} from './input-lock.mjs';
+
+const NL = '\n';
+
+/**
+ * Create + start a socket server for one session.
+ *
+ * @param {object} opts
+ * @param {string} opts.sessionId
+ * @param {object} [opts.onCommand] — { approve, deny, interrupt, sendMessage, ... }
+ *                                     each handler is `async (payload, attachId) => void`.
+ *                                     Missing keys → the server responds with a
+ *                                     `command_error { code: "not_implemented" }` event.
+ * @returns {Promise<{
+ *   sockPath: string,
+ *   broadcastEvent(event: object): void,
+ *   attachedCount(): number,
+ *   close(): Promise<void>,
+ * }>}
+ */
+export async function startSocketServer({ sessionId, onCommand = {} } = {}) {
+  if (!sessionId) throw new Error('startSocketServer: sessionId is required');
+
+  const sockPath = daemonSocketPath(sessionId);
+  fs.mkdirSync(daemonSocketsDir(), { recursive: true, mode: 0o700 });
+  // If a stale socket exists (previous daemon crashed), remove it before bind.
+  // The OS retains the inode across process death so `listen` will EADDRINUSE
+  // even though nothing owns it.
+  try { fs.unlinkSync(sockPath); } catch { /* file didn't exist, fine */ }
+
+  /** @type {Set<AttachedClient>} */
+  const clients = new Set();
+
+  const server = net.createServer(sock => {
+    // 0600 on the socket path itself. On most kernels this is enforced at
+    // bind() time (see below), but re-chmod defensively in case umask lied.
+    try { fs.chmodSync(sockPath, 0o600); } catch { /* best effort */ }
+
+    const client = _createAttachedClient(sock, sessionId, onCommand);
+    clients.add(client);
+    sock.on('close', () => { clients.delete(client); });
+  });
+
+  server.on('error', err => {
+    // Never crash on a listen error — log and let the caller notice via
+    // attachedCount() staying at 0. The daemon session itself continues.
+    try { process.stderr.write(`[socket-server] listen error: ${err.message}\n`); } catch {}
+  });
+
+  // Bind with umask temporarily narrowed so the socket file is created 0600
+  // even if the user's shell umask would grant group/other read.
+  const priorUmask = process.umask(0o077);
+  try {
+    await new Promise((resolve, reject) => {
+      server.once('error', reject);
+      server.listen(sockPath, () => {
+        server.off('error', reject);
+        resolve();
+      });
+    });
+  } finally {
+    process.umask(priorUmask);
+  }
+  // chmod again post-listen — belt and braces on platforms where the umask
+  // trick doesn't cover socket files (rare but seen on some Linux configs).
+  try { fs.chmodSync(sockPath, 0o600); } catch { /* ignore */ }
+
+  return {
+    sockPath,
+    broadcastEvent(event) {
+      // Fire-and-forget to every client. One slow reader must not throttle
+      // the daemon; we let the OS socket buffer absorb bursts and drop on
+      // the individual client if that client fills.
+      const line = _serializeFrame(event);
+      for (const client of clients) {
+        try { client.write(line); }
+        catch (err) { try { process.stderr.write(`[socket-server] write to ${client.id} failed: ${err.message}\n`); } catch {} }
+      }
+    },
+    attachedCount: () => clients.size,
+    async close() {
+      // Close all client sockets first so they drain, then stop listening.
+      for (const client of Array.from(clients)) {
+        try { client.end(); } catch { /* ignore */ }
+      }
+      await new Promise(res => server.close(() => res()));
+      try { fs.unlinkSync(sockPath); } catch { /* ignore */ }
+    },
+  };
+}
+
+// ── attached client (per-connection state) ───────────────────────────
+
+let _nextAttachId = 1;
+
+/**
+ * @typedef {{ id: string, write: (line: string) => void, end: () => void }} AttachedClient
+ */
+
+function _createAttachedClient(sock, sessionId, onCommand) {
+  const attachId = `att_${Date.now().toString(36)}_${(_nextAttachId++).toString(36)}`;
+  let helloSeen = false;
+  let buf = '';
+
+  sock.setEncoding('utf-8');
+  sock.on('data', chunk => {
+    buf += chunk;
+    let nl;
+    while ((nl = buf.indexOf(NL)) !== -1) {
+      const line = buf.slice(0, nl);
+      buf = buf.slice(nl + 1);
+      if (line.trim().length === 0) continue;
+      _handleFrame(line).catch(err => {
+        try { process.stderr.write(`[socket-server] frame handler crashed: ${err.message}\n`); } catch {}
+      });
+    }
+  });
+  sock.on('error', err => {
+    try { process.stderr.write(`[socket-server] ${attachId} socket error: ${err.message}\n`); } catch {}
+  });
+
+  async function _handleFrame(line) {
+    let msg;
+    try { msg = JSON.parse(line); }
+    catch { _sendError('invalid_json', 'frame is not valid JSON'); return; }
+    if (!msg || typeof msg.type !== 'string') {
+      _sendError('invalid_frame', 'missing type'); return;
+    }
+
+    if (!helloSeen && msg.type !== 'hello') {
+      _sendError('hello_required', 'first frame must be hello'); return;
+    }
+
+    switch (msg.type) {
+      case 'hello': {
+        helloSeen = true;
+        const lastSeq = Number(msg.last_seq) || 0;
+        //  — input lock: first attach implicitly becomes holder;
+        // later attaches join as watchers. The state is stored in
+        // input-lock.mjs; the changed event is emitted from THAT module
+        // (via wireEmit()) so it also fans out through the tap and hits
+        // the event log for later attaches to replay.
+        const lockInfo = onAttachJoined(attachId);
+        _send({
+          type: 'hello_ok', v: 1,
+          data: {
+            attach_id: attachId,
+            session_id: sessionId,
+            input_lock: { holder: lockInfo.holder, kind: lockInfo.kind },
+          },
+        });
+        await _replaySince(lastSeq);
+        _send({
+          seq: 0, ts: new Date().toISOString(), type: 'attach_joined',
+          session_id: sessionId, v: 1,
+          data: {
+            attach_id: attachId, kind: 'local',
+            human_hint: msg.human_hint || null,
+            input_role: lockInfo.kind,   // 'holder' | 'watch'
+          },
+        });
+        return;
+      }
+      //  — input lock commands. Both handled internally by the
+      // shared input-lock.mjs state; the resulting input_lock_changed
+      // event is emitted from that module (via wireEmit) so all attaches
+      // see the transition, including the daemon's local renderer.
+      case 'take_input_lock': {
+        const out = takeInputLock(attachId);
+        _send({
+          seq: 0, ts: new Date().toISOString(), type: 'input_lock_ack',
+          session_id: sessionId, v: 1,
+          data: { in_reply_to: msg.reply_to || null, ...out },
+        });
+        return;
+      }
+      case 'release_input_lock': {
+        const out = releaseInputLock(attachId);
+        _send({
+          seq: 0, ts: new Date().toISOString(), type: 'input_lock_ack',
+          session_id: sessionId, v: 1,
+          data: { in_reply_to: msg.reply_to || null, ...out },
+        });
+        return;
+      }
+
+      case 'bye': {
+        onAttachLeft(attachId);
+        // Serialize attach_left, then end() only after the write drains.
+        // Immediate sock.end() after sock.write() races the flush on some
+        // kernels — the FIN can go out before the frame's last byte lands
+        // in the client's read buffer, so the client sees close-without-
+        // attach_left. Use the write completion callback to sequence.
+        const frame = _serializeFrame({
+          seq: 0, ts: new Date().toISOString(), type: 'attach_left',
+          session_id: sessionId, v: 1, data: { attach_id: attachId, reason: 'bye' },
+        });
+        try {
+          sock.write(frame, () => { try { sock.end(); } catch {} });
+        } catch {
+          try { sock.end(); } catch {}
+        }
+        return;
+      }
+      case 'approve':
+      case 'deny': {
+        const handler = onCommand[msg.type];
+        if (typeof handler !== 'function') {
+          _sendError('not_implemented', `command ${msg.type} has no handler`, msg.reply_to);
+          return;
+        }
+        try { await handler(msg.data || {}, attachId); }
+        catch (err) { _sendError('handler_failed', err.message, msg.reply_to); }
+        return;
+      }
+      case 'interrupt':
+      case 'send_message':
+      case 'switch_model': {
+        //  — typing-class commands require the input lock. Watch-
+        // mode attaches get a `not_input_holder` error and can request
+        // the lock via take_input_lock (steal-with-grace).
+        if (!isHolder(attachId)) {
+          _sendError('not_input_holder', `command ${msg.type} requires the input lock; send take_input_lock first`, msg.reply_to);
+          return;
+        }
+        const handler = onCommand[msg.type];
+        if (typeof handler !== 'function') {
+          _sendError('not_implemented', `command ${msg.type} is not wired yet (deferred slice)`, msg.reply_to);
+          return;
+        }
+        try { await handler(msg.data || {}, attachId); }
+        catch (err) { _sendError('handler_failed', err.message, msg.reply_to); }
+        return;
+      }
+      case 'wake': {
+        const handler = onCommand[msg.type];
+        if (typeof handler !== 'function') {
+          _sendError('not_implemented', `command ${msg.type} is not wired yet (deferred slice)`, msg.reply_to);
+          return;
+        }
+        try { await handler(msg.data || {}, attachId); }
+        catch (err) { _sendError('handler_failed', err.message, msg.reply_to); }
+        return;
+      }
+      default:
+        _sendError('unknown_type', `unknown command: ${msg.type}`, msg.reply_to);
+    }
+  }
+
+  async function _replaySince(lastSeq) {
+    // Seed from snapshot (if any) so long-running sessions don't stream 100k
+    // events at attach time. Then stream events with seq > snapshot.seq (or
+    // > lastSeq, whichever's higher).
+    let sinceSeq = lastSeq;
+    const snap = await readLatestSnapshot({ sessionId }).catch(() => null);
+    if (snap && typeof snap.seq === 'number' && snap.seq > sinceSeq) {
+      _send({
+        seq: 0, ts: new Date().toISOString(), type: 'snapshot',
+        session_id: sessionId, v: 1, data: { seq: snap.seq, state: snap.state },
+      });
+      sinceSeq = snap.seq;
+    }
+    let firstSeq = null, lastSeqSeen = sinceSeq;
+    const batch = [];
+    for await (const evt of readEvents({ sessionId, sinceSeq })) {
+      if (firstSeq == null) firstSeq = evt.seq;
+      batch.push(evt);
+      lastSeqSeen = evt.seq;
+    }
+    if (batch.length > 0) {
+      _send({ seq: 0, ts: new Date().toISOString(), type: 'replay_batch_start',
+              session_id: sessionId, v: 1, data: { from_seq: firstSeq, to_seq: lastSeqSeen } });
+      for (const evt of batch) _send(evt);
+      _send({ seq: 0, ts: new Date().toISOString(), type: 'replay_batch_end',
+              session_id: sessionId, v: 1, data: { from_seq: firstSeq, to_seq: lastSeqSeen } });
+    }
+  }
+
+  function _send(obj) {
+    try { sock.write(_serializeFrame(obj)); }
+    catch { /* silent — client will close and we'll clean up */ }
+  }
+
+  function _sendError(code, message, in_reply_to) {
+    _send({
+      seq: 0, ts: new Date().toISOString(), type: 'command_error',
+      session_id: sessionId, v: 1,
+      data: { code, message, ...(in_reply_to ? { in_reply_to } : {}) },
+    });
+  }
+
+  return {
+    id: attachId,
+    write: line => sock.write(line),
+    end: () => sock.end(),
+  };
+}
+
+function _serializeFrame(obj) {
+  return JSON.stringify(obj) + NL;
+}

package/src/daemon/stop-daemon.mjs

@@ -0,0 +1,18 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { daemonSessionDir } from '../core/paths.mjs';
+
+export async function stopDaemonSession(sessionId) {
+  if (!sessionId) {
+    process.stderr.write('Usage: bahulam stop <session-id>\n');
+    return;
+  }
+  const pidFile = join(daemonSessionDir(sessionId), 'daemon.pid');
+  try {
+    const pid = parseInt((await readFile(pidFile, 'utf-8')).trim(), 10);
+    process.kill(pid, 'SIGTERM');
+    process.stderr.write(`Sent SIGTERM to daemon ${sessionId} (pid ${pid})\n`);
+  } catch (err) {
+    process.stderr.write(`Failed to stop daemon ${sessionId}: ${err.message}\n`);
+  }
+}

package/src/permissions/checker.mjs

@@ -17,7 +17,7 @@ export function createPermissionChecker(config = {}) {
         mode,
         async check(toolName, input) {
             // Always run injection check on Bash commands
-            if (toolName === 'Bash' && input?.command) {
+            if (toolName === 'shell' && input?.command) {
                 const injection = checkInjection(input.command);
                 if (!injection.safe) {
                     return false; // block dangerous commands
@@ -25,8 +25,8 @@ export function createPermissionChecker(config = {}) {
             }
 
             // Always validate file paths for file operations
-            if (['Edit', 'Write', 'Read', 'MultiEdit'].includes(toolName) && input?.file_path) {
-                const pathResult = validatePath(input.file_path, { write: toolName !== 'Read' });
+            if (['edit_file', 'write_file', 'read_file', 'MultiEdit'].includes(toolName) && input?.file_path) {
+                const pathResult = validatePath(input.file_path, { write: toolName !== 'read_file' });
                 if (!pathResult.safe) {
                     return false; // block unsafe paths
                 }
@@ -35,14 +35,14 @@ export function createPermissionChecker(config = {}) {
             switch (mode) {
                 case 'bypassPermissions': return true;
                 case 'acceptEdits':
-                    // Allow file ops, block Bash/Agent unless rl available
-                    if (toolName === 'Bash' || toolName === 'Agent') {
+                    // Allow file ops, block shell/Agent unless rl available
+                    if (toolName === 'shell' || toolName === 'Agent') {
                         return !requiresPermission(toolName) || !!config.bypassBash;
                     }
                     return true;
                 case 'auto': return true; // AI decides
                 case 'dontAsk': return false; // deny everything not pre-approved
-                case 'plan': return toolName === 'Read' || toolName === 'Glob' || toolName === 'Grep';
+                case 'plan': return toolName === 'read_file' || toolName === 'list_files' || toolName === 'search_code' || toolName === 'grep';
                 case 'default':
                 default:
                     // In default mode, safe tools pass through