@chorus-aidlc/chorus 0.11.1 → 0.12.1

package/cli/event-router.mjs

@@ -10,6 +10,27 @@
 
 const NOOP_LOGGER = { info() {}, warn() {}, error() {} };
 
+// Map a Notification.action to its DaemonSessionTurn trigger category — the daemon-side
+// MIRROR of the server's NOTIFICATION_ACTION_TO_TURN_TRIGGER (src/services/notification-turn.ts).
+// Used ONLY to match a re-read wake notification back to a DIRECTED autonomous pending turn
+// (the deliver_turn re-dispatch rebuilds the prompt from the notification, T2). Kept narrow
+// to the three triggers a `deliver_turn` ping can carry for an autonomous wake; every other
+// action collapses to the `task_assigned` trigger exactly as the server does, so a
+// task_assigned turn matches its task_reopened/task_verified/idea_claimed/proposal_* origins.
+const ACTION_TO_TURN_TRIGGER = {
+  mentioned: "mentioned",
+  elaboration_verified: "elaboration_verified",
+  elaboration_requested: "elaboration",
+  elaboration_answered: "elaboration",
+  human_instruction: "human_instruction",
+  task_assigned: "task_assigned",
+  task_reopened: "task_assigned",
+  task_verified: "task_assigned",
+  idea_claimed: "task_assigned",
+  proposal_approved: "task_assigned",
+  proposal_rejected: "task_assigned",
+};
+
 export class EventRouter {
   /**
    * @param {{
@@ -17,6 +38,15 @@ export class EventRouter {
    *   waker: { keyFor: (n: any) => Promise<{ key: string, rootIdeaUuid: string|null, directIdeaUuid: string|null }>, wake: (n: any, key: string, attribution?: any) => Promise<void>, markQueued?: (n: any, key: string, attribution?: any) => void },
    *   queue: { enqueue: (key: string, task: () => Promise<void>) => void },
    *   wakeActions: Set<string>,
+   *   getConnectionUuid?: () => (string|null),  This daemon's registered connection uuid
+   *                                             (null until the SSE handshake reports it).
+   *                                             Same self-identity source the control handler
+   *                                             uses — wired in cli/daemon.mjs. Used to suppress
+   *                                             a DIRECTED (pinned) wake whose stamped target is
+   *                                             NOT this connection (fix-pinned-wake-directed-
+   *                                             delivery). Absent ⇒ no targeting (no suppression
+   *                                             ever) — preserves the pre-change behavior for any
+   *                                             caller that does not wire it.
    *   logger?: { info(m:string):void, warn(m:string):void, error(m:string):void },
    * }} opts
    */
@@ -25,6 +55,12 @@ export class EventRouter {
     this.waker = opts.waker;
     this.queue = opts.queue;
     this.wakeActions = opts.wakeActions;
+    // This daemon's own connection uuid (lazy — read at routing time, not construction,
+    // since the SSE handshake assigns it after the router is built). Defaults to a getter
+    // returning null so an un-wired router behaves as before (a stamped target is then
+    // never "mine", but only `human_instruction`/directed paths stamp one — un-pinned wakes
+    // carry no target and are unaffected).
+    this.getConnectionUuid = opts.getConnectionUuid ?? (() => null);
     this.logger = opts.logger ?? NOOP_LOGGER;
     // Shared dedup set: the daemon passes the SAME Set to the reconnect backfill
     // so a notification handled live is never re-woken on reconnect, and a
@@ -37,7 +73,18 @@ export class EventRouter {
   /**
    * Handle one SSE event. Synchronous + non-throwing: it kicks off async
    * fetch/route work and returns immediately so the SSE consumer never blocks.
-   * @param {{ type?: string, notificationUuid?: string }} event
+   *
+   * DIRECTED-DELIVERY TRANSPORT FIELDS (fix-pinned-wake-directed-delivery): a live
+   * `new_notification` event for a PINNED autonomous wake carries two TRANSPORT-ONLY fields
+   * stamped by the server (NOT persisted, NOT on `chorus_get_notifications`):
+   *   - `targetConnectionUuid` — the resolved ONLINE target connection for a directed wake;
+   *     null for un-pinned / notify-only wakes.
+   *   - `suppressWake` — true ONLY for an offline-pin wake (a pin matched NO online
+   *     connection) so EVERY daemon suppresses (Q2 notify-only); false otherwise.
+   * They are threaded to `#fetchAndRoute` so the broadcast-suppression decision can be made
+   * there. A reconnect-backfill synthetic event omits both (so a backfilled wake behaves as
+   * un-pinned → online-first; the directed target is covered by its own `deliver_turn` ping).
+   * @param {{ type?: string, notificationUuid?: string, targetConnectionUuid?: string|null, suppressWake?: boolean }} event
    */
   dispatch(event) {
     if (event?.type !== "new_notification") {
@@ -51,13 +98,25 @@ export class EventRouter {
       return; // already handled (e.g. live delivery then reconnect backfill)
     }
     this.seen.add(event.notificationUuid);
-    this.#fetchAndRoute(event.notificationUuid).catch((err) => {
-      this.logger.error(`[Chorus] failed to route notification ${event.notificationUuid}: ${err}`);
-    });
+    // Snapshot the transport-only directed-delivery fields off the EVENT (NOT the fetched
+    // notification — the server stamps them on the SSE envelope only).
+    const targetConnectionUuid =
+      typeof event.targetConnectionUuid === "string" ? event.targetConnectionUuid : null;
+    const suppressWake = event.suppressWake === true;
+    this.#fetchAndRoute(event.notificationUuid, { targetConnectionUuid, suppressWake }).catch(
+      (err) => {
+        this.logger.error(`[Chorus] failed to route notification ${event.notificationUuid}: ${err}`);
+      }
+    );
   }
 
-  /** @param {string} notificationUuid */
-  async #fetchAndRoute(notificationUuid) {
+  /**
+   * @param {string} notificationUuid
+   * @param {{ targetConnectionUuid?: string|null, suppressWake?: boolean }} [transport]
+   *   Transport-only directed-delivery fields snapshotted off the SSE event (see `dispatch`).
+   *   Omitted/empty (e.g. reconnect backfill) ⇒ un-pinned behavior (no suppression).
+   */
+  async #fetchAndRoute(notificationUuid, transport = {}) {
     const result = await this.mcp.callTool("chorus_get_notifications", {
       status: "unread",
       limit: 50,
@@ -95,6 +154,59 @@ export class EventRouter {
       return;
     }
 
+    // DIRECTED-DELIVERY BROADCAST SUPPRESSION (fix-pinned-wake-directed-delivery, T2). The
+    // notification SSE stream is per-AGENT, so EVERY online (host, cwd) connection of the
+    // agent receives the same `new_notification`. A pinned autonomous wake (mention /
+    // task_assigned / elaboration_verified resolved to a specific online instance) must wake
+    // ONLY that instance — the others must ignore their broadcast copy. The decision uses the
+    // transport-only fields the server stamped on THIS event (read in `dispatch`):
+    //
+    //   1. suppressWake === true → OFFLINE-PIN (Q2): a real pin matched NO online connection.
+    //      Wake NO instance, agent-wide, even though this connection may be online and would
+    //      otherwise broadcast→online-first. This is the ONE place that realizes the design's
+    //      "no online target → every connection suppresses → notify-only" intent. Without this
+    //      explicit flag an offline-pin is indistinguishable from an un-pinned wake (both carry
+    //      targetConnectionUuid:null) and would be silently re-woken — the bug this guards.
+    //
+    //   2. targetConnectionUuid set AND !== my connection uuid → a DIRECTED wake for a
+    //      DIFFERENT instance. Suppress: the resolved target wakes from its own copy (and via
+    //      the precise deliver_turn ping); this connection must not also wake (the agent-wide
+    //      fan-out is the headline bug). Pre-handshake (my uuid still null) counts as "not mine"
+    //      → suppress, since this daemon cannot prove it is the target; delivery to the actual
+    //      target is covered by the deliver_turn ping + reconnect pending-turn backfill.
+    //
+    //   3. targetConnectionUuid set AND === my connection uuid → I am the resolved target →
+    //      wake (acting on this broadcast copy, which carries the full prompt context). The
+    //      target's own deliver_turn→pending-turn delivery is deduped against this via the
+    //      shared `seen` set (the pending re-dispatch keys turn:{uuid}; whichever runs first
+    //      marks the other seen) so the target wakes exactly ONCE.
+    //
+    //   4. no target AND not suppressed → UN-PINNED (or a fully-offline `none` agent): wake
+    //      exactly as before this change (broadcast → online-first). BYTE-IDENTICAL — the path
+    //      below is untouched for this case.
+    if (transport.suppressWake === true) {
+      this.logger.info(
+        `[Chorus] wake ${notificationUuid} (${n.action}) is an OFFLINE-PIN (pin matched no online instance) — notify-only, suppressing wake on every connection`
+      );
+      return;
+    }
+    const target =
+      typeof transport.targetConnectionUuid === "string" ? transport.targetConnectionUuid : null;
+    if (target) {
+      const me = this.getConnectionUuid();
+      if (target !== me) {
+        this.logger.info(
+          `[Chorus] wake ${notificationUuid} (${n.action}) is directed to connection ${target}` +
+            ` — not this daemon (${me ?? "<unregistered>"}); suppressing broadcast wake`
+        );
+        return;
+      }
+      // target === me: I am the resolved target — fall through and wake (deduped below).
+      this.logger.info(
+        `[Chorus] wake ${notificationUuid} (${n.action}) is directed to THIS connection (${me}) — waking`
+      );
+    }
+
     await this.#resolveAndEnqueue(n, notificationUuid);
   }
 
@@ -136,11 +248,21 @@ export class EventRouter {
    * pending turn already handled live (or by an earlier backfill) is not re-run.
    * Synchronous + non-throwing, mirroring `dispatch`/`dispatchResume`.
    *
-   * Only `human_instruction` pending turns are re-dispatched here: autonomous turns
-   * (task_assigned / mentioned / elaboration / resume) are re-driven by the
-   * notification backfill (their notifications are re-fetched), whereas a
-   * human_instruction's actionable payload lives ONLY on the turn — so the turn table
-   * is its sole reliable backfill source.
+   * DELIVERY SCOPE (fix-pinned-wake-directed-delivery, T2 — widened): a `deliver_turn` ping
+   * now also fires for a DIRECTED autonomous wake (`mentioned` / `task_assigned` /
+   * `elaboration_verified`), so this entrypoint re-dispatches those too — not only
+   * `human_instruction`. Unlike `human_instruction`, an autonomous turn has
+   * `promptText = null` (only human_instruction carries canonical free text), so its wake
+   * prompt CANNOT be rebuilt from the turn — it is rebuilt from the wake NOTIFICATION
+   * (re-read via `chorus_get_notifications`) for the turn's session. See the
+   * `#redispatchAutonomousTurn` helper.
+   *
+   * DEDUP (the two delivery routes for a DIRECTED target collapse to ONE wake): the
+   * target's BROADCAST copy (handled in `#fetchAndRoute`, keyed `notificationUuid` in the
+   * shared `seen` set when `target === me`) and THIS `deliver_turn`→pending delivery (keyed
+   * `turn:{uuid}`) both reach the target. They share the same `seen` set; the autonomous
+   * re-dispatch additionally marks the MATCHED notification's `notificationUuid` so whichever
+   * route runs first claims the other's key, and the second is dropped — exactly once.
    *
    * @param {{ turnUuid?: string, sessionId?: string, directIdeaUuid?: string|null,
    *           trigger?: string, promptText?: string|null }} pending
@@ -156,7 +278,36 @@ export class EventRouter {
       this.logger.warn(`[Chorus] pending-turn ${turnUuid} missing sessionId, skipping`);
       return;
     }
-    // Only human_instruction is re-derived from the turn table (see doc above).
+    // A DIRECTED autonomous turn (mentioned / task_assigned / elaboration_verified) is
+    // delivered by the deliver_turn ping too (T2). Its prompt must be rebuilt from the
+    // notification (promptText is null), so it takes a separate async path. resume /
+    // elaboration are not delivered by deliver_turn (resume is synthetic; elaboration
+    // request/answer rides the notification broadcast), so they are not re-dispatched here.
+    if (
+      pending.trigger === "mentioned" ||
+      pending.trigger === "task_assigned" ||
+      pending.trigger === "elaboration_verified"
+    ) {
+      // Shared dedup, marked BEFORE async work (mirrors the human_instruction path and
+      // `dispatch`) so concurrent deliveries collapse to one wake.
+      const seenKey = `turn:${turnUuid}`;
+      if (this.seen.has(seenKey)) return;
+      this.seen.add(seenKey);
+      const directIdeaUuid =
+        typeof pending.directIdeaUuid === "string" ? pending.directIdeaUuid : null;
+      this.#redispatchAutonomousTurn({
+        turnUuid,
+        sessionId,
+        directIdeaUuid,
+        trigger: pending.trigger,
+      }).catch((err) => {
+        this.logger.error(
+          `[Chorus] failed to re-dispatch autonomous pending turn ${turnUuid}: ${err}`
+        );
+      });
+      return;
+    }
+    // Only human_instruction is re-derived from the turn table directly (see doc above).
     if (pending.trigger !== "human_instruction") {
       return;
     }
@@ -211,6 +362,116 @@ export class EventRouter {
     this.queue.enqueue(key, () => this.waker.wake(n, key, attribution));
   }
 
+  /**
+   * Re-dispatch a DIRECTED autonomous pending turn (mentioned / task_assigned /
+   * elaboration_verified) delivered by the `deliver_turn` ping (T2 — fix-pinned-wake-
+   * directed-delivery). Unlike `human_instruction`, the turn carries `promptText = null`,
+   * so the wake prompt must be rebuilt from the wake NOTIFICATION — `buildPrompt` (run
+   * inside `waker.wake`) needs `entityType` / `entityUuid` / `entityTitle` / `actorName` /
+   * `message`, none of which live on the turn. We re-read the unread notifications (the
+   * same `chorus_get_notifications` the router already uses) and pick the wake notification
+   * for THIS turn's session + trigger.
+   *
+   * PROMPT-CONTEXT CONSTRAINT (Tech Design): in the normal live case the target is online,
+   * so it ALSO received the broadcast — which `#fetchAndRoute` already woke (and marked the
+   * notification `seen`). This path then finds that notification already `seen` and dedups
+   * away → exactly one wake. In the rare missed-broadcast case (the ping arrived but the
+   * broadcast copy did not), this path is the one that wakes, with the prompt rebuilt from
+   * the re-read notification. If no matching unread notification exists at all (e.g. it was
+   * already read), there is no autonomous context to rebuild — log and skip (the durable
+   * net is the reconnect notification backfill, which re-derives autonomous wakes).
+   *
+   * DEDUP across the two routes: this matched notification's `uuid` is the SAME key the
+   * broadcast path marks in the shared `seen` set, so whichever route runs first claims it
+   * and the other is dropped. The `turn:{uuid}` key was already marked by the caller.
+   *
+   * @param {{ turnUuid: string, sessionId: string, directIdeaUuid: string|null, trigger: string }} pending
+   */
+  async #redispatchAutonomousTurn(pending) {
+    const { turnUuid, sessionId, directIdeaUuid, trigger } = pending;
+    let result;
+    try {
+      result = await this.mcp.callTool("chorus_get_notifications", {
+        status: "unread",
+        limit: 50,
+        autoMarkRead: false,
+      });
+    } catch (err) {
+      this.logger.warn(
+        `[Chorus] autonomous pending turn ${turnUuid}: notification re-read failed: ${err}`
+      );
+      return;
+    }
+    const notifications = result?.notifications;
+    if (!Array.isArray(notifications)) {
+      this.logger.warn(
+        `[Chorus] autonomous pending turn ${turnUuid}: no notifications array to rebuild prompt from`
+      );
+      return;
+    }
+
+    // Candidate wake notifications: unread, wake-action, mapping to THIS turn's trigger.
+    // ACTION_TO_TURN_TRIGGER mirrors the server's action→trigger collapse, so e.g. a
+    // task_assigned turn matches task_reopened/task_verified/idea_claimed/proposal_* origins.
+    const candidates = notifications.filter(
+      (x) => x && typeof x.uuid === "string" && ACTION_TO_TURN_TRIGGER[x.action] === trigger
+    );
+
+    // Match the wake notification for THIS turn by its session ANCHOR. The anchor is the
+    // turn's direct idea (idea-anchored session) or, lacking one, its session id; a CROSS-CWD
+    // mention keys the per-instance session `${directIdeaUuid}::${connectionUuid}` with
+    // directIdeaUuid=null, so the idea prefix before "::" is also a valid anchor. We never run
+    // lineage on the daemon — these are the anchors the server itself keyed the session on.
+    const ideaPrefix =
+      directIdeaUuid == null && sessionId.includes("::") ? sessionId.split("::")[0] : null;
+    const anchors = new Set(
+      [directIdeaUuid, sessionId, ideaPrefix].filter((a) => typeof a === "string" && a)
+    );
+    let match = candidates.find((x) => anchors.has(x.entityUuid));
+
+    // MISSED-BROADCAST RECOVERY (the rare path this re-dispatch exists for): when the wake's
+    // notification entity is NOT the session anchor (a lineage-anchored task_assigned, a
+    // comment-on-task mention, or a cross-cwd mention whose entity is a child of the idea),
+    // the anchor equality above can't match without a lineage round-trip. If there is exactly
+    // ONE unread candidate for this trigger, it is unambiguously this turn's wake — recover it.
+    // With 2+ candidates we cannot disambiguate safely, so we defer to the reconnect
+    // notification backfill rather than risk waking the wrong one.
+    if (!match && candidates.length === 1) {
+      match = candidates[0];
+      this.logger.info(
+        `[Chorus] autonomous pending turn ${turnUuid} (${trigger}): no anchor match, recovering the ` +
+          `single unread ${trigger} notification ${match.uuid} (missed-broadcast recovery)`
+      );
+    }
+    if (!match || typeof match.uuid !== "string") {
+      this.logger.info(
+        `[Chorus] autonomous pending turn ${turnUuid} (${trigger}): no unambiguous unread wake ` +
+          `notification for session ${sessionId} (${candidates.length} candidate(s)) — skipping ` +
+          `(covered by reconnect notification backfill)`
+      );
+      return;
+    }
+
+    // Cross-route dedup: claim the broadcast's key. If the broadcast already woke it (target
+    // === me path), it is already seen → drop this delivery (exactly one wake). Otherwise we
+    // claim it so a later broadcast copy is dropped by `dispatch`'s seen check.
+    if (this.seen.has(match.uuid)) {
+      this.logger.info(
+        `[Chorus] autonomous pending turn ${turnUuid}: broadcast copy ${match.uuid} already handled — deduped`
+      );
+      return;
+    }
+    this.seen.add(match.uuid);
+
+    // Rebuild + enqueue through the SAME resolve→markQueued→enqueue path as a live broadcast
+    // wake, so the prompt (buildPrompt inside waker.wake), session anchor, and serialization
+    // are byte-identical to the broadcast route. `match` is a full NotificationDetail.
+    this.logger.info(
+      `[Chorus] autonomous pending turn ${turnUuid} (${trigger}): waking from re-read notification ${match.uuid}`
+    );
+    await this.#resolveAndEnqueue(match, match.uuid);
+  }
+
   /**
    * Resolve a wake's serialization key + idea attribution, mark it queued, and
    * enqueue it on the per-direct-idea queue. Shared by the notification path

package/cli/login.mjs

@@ -3,7 +3,7 @@
 // ~/.chorus/daemon.json (0600). On validation failure, nothing is written.
 // Plain ESM; the only dependency is the in-repo MCP SDK (via chorus-client).
 
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { createInterface } from "node:readline";
 
@@ -49,56 +49,99 @@ export function prompt(query, opts = {}) {
 }
 
 /**
- * Persist credentials + identity to the login file with owner-only perms.
+ * Field-level merge update of the login file (`~/.chorus/daemon.json`) — the
+ * single read → merge → write(0600) helper every config writer routes through.
+ *
+ * Reads any existing file, shallow-merges `partial` over it (partial keys win,
+ * every other pre-existing field is preserved), and writes the result back with
+ * owner-only permissions. A shallow merge is correct because every field is a
+ * scalar or a flat array (`cwds`) — there are no nested objects to deep-merge.
  *
- * Writing the file with a fresh credential object intentionally OMITS any
- * `yoloAckAt` that a previous file carried — a credential change (re-login)
- * clears the yolo acknowledgement, so the next yolo TTY start re-confirms once
- * (daemon-permission-mode spec). To preserve an existing ack across an
- * unrelated rewrite, the caller must read it first and pass it in `data`.
+ * The write is atomic: the JSON is written to a sibling `<path>.tmp` at 0600 and
+ * then `rename()`d over the target, so a crash mid-write never truncates the
+ * live file. A missing / unreadable / malformed existing file is treated as an
+ * empty object (defensive parse), so a re-login still produces a valid file
+ * rather than aborting on a corrupt one.
  *
- * @param {{ url: string, apiKey: string, agentUuid: string, agentName: string, yoloAckAt?: string }} data
- * @param {{ path?: string, write?: (p: string, c: string, o: object) => void, mkdir?: (p: string, o: object) => void }} [deps]
+ * Because writes now merge, NO field is ever silently dropped — in particular a
+ * `chorus login` preserves any pre-existing `cwds` / `yoloAckAt` /
+ * `sigintTimeoutMs` (daemon-config-field-merge change; supersedes the prior
+ * "credential change clears the yolo acknowledgement" behavior).
+ *
+ * @param {Record<string, unknown>} partial  The fields to set/overwrite.
+ * @param {{
+ *   path?: string,
+ *   read?: (p: string) => string,
+ *   write?: (p: string, c: string, o: object) => void,
+ *   mkdir?: (p: string, o: object) => void,
+ *   rename?: (from: string, to: string) => void,
+ * }} [deps]
+ * @returns {string} the file path written
  */
-export function writeLoginFile(data, deps = {}) {
+export function updateDaemonConfig(partial, deps = {}) {
   const path = deps.path ?? loginFilePath();
+  const read = deps.read ?? ((p) => readFileSync(p, "utf8"));
   const write = deps.write ?? writeFileSync;
   const mkdir = deps.mkdir ?? mkdirSync;
+  const rename = deps.rename ?? renameSync;
+
+  // Defensive read: missing / unreadable / malformed → start from empty so a
+  // re-login over a corrupt file still writes a valid one (no silent abort).
+  let current = {};
+  try {
+    const parsed = JSON.parse(read(path));
+    // Only a plain object is a valid config; arrays / scalars → start fresh.
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) current = parsed;
+  } catch {
+    // treat as empty
+  }
+
+  const merged = { ...current, ...partial };
   mkdir(dirname(path), { recursive: true });
-  write(path, JSON.stringify(data, null, 2) + "\n", { mode: 0o600 });
+  // Atomic write: temp file (0600) in the same dir, then rename over target.
+  const tmp = `${path}.tmp`;
+  write(tmp, JSON.stringify(merged, null, 2) + "\n", { mode: 0o600 });
+  rename(tmp, path);
   return path;
 }
 
 /**
- * Record (or refresh) the yolo acknowledgement in the existing login file,
- * preserving the credentials already on disk. Reads the current file, merges
- * `yoloAckAt`, and rewrites with 0600. Used by the daemon after an interactive
- * TTY yolo confirmation — it does NOT touch url/apiKey/identity.
+ * Persist credentials + identity to the login file with owner-only perms.
+ *
+ * Thin wrapper over {@link updateDaemonConfig}: it field-merges the given
+ * credential/identity fields over any existing file, so every OTHER pre-existing
+ * field (`cwds`, `yoloAckAt`, `sigintTimeoutMs`, …) is preserved across a
+ * `chorus login` or a daemon-start credential completion. It no longer omits
+ * `yoloAckAt` — a credential write never discards the recorded yolo ack.
+ *
+ * The `deps` seams (`path`, `write`, `mkdir`) are kept for callers/tests that
+ * inject IO; `write` is the low-level `(path, content, opts)` writer.
+ *
+ * @param {{ url: string, apiKey: string, agentUuid: string, agentName: string }} data
+ * @param {{ path?: string, write?: (p: string, c: string, o: object) => void, mkdir?: (p: string, o: object) => void, read?: (p: string) => string, rename?: (from: string, to: string) => void }} [deps]
+ */
+export function writeLoginFile(data, deps = {}) {
+  return updateDaemonConfig(data, deps);
+}
+
+/**
+ * Record (or refresh) the yolo acknowledgement in the login file, preserving
+ * everything already on disk. Delegates to {@link updateDaemonConfig}, which
+ * reads the current file, merges `yoloAckAt`, and rewrites with 0600. Used by
+ * the daemon after an interactive TTY yolo confirmation — it does NOT touch
+ * url/apiKey/identity.
  *
- * No-silent-errors: a read/parse failure is surfaced to the caller (throws), so
- * the daemon can log it rather than silently losing the ack.
+ * A TTY user whose credentials come from env / flags has no login file yet, but
+ * the ack must still persist (else they'd re-confirm yolo on every start). A
+ * file carrying only `yoloAckAt` is harmless — resolveCredentials simply falls
+ * through it.
  *
  * @param {string} yoloAckAt  ISO-8601 timestamp of the confirmation.
- * @param {{ path?: string, read?: (p: string) => string, write?: typeof writeLoginFile }} [deps]
+ * @param {{ path?: string, read?: (p: string) => string, write?: (p: string, c: string, o: object) => void, mkdir?: (p: string, o: object) => void, rename?: (from: string, to: string) => void }} [deps]
  * @returns {string} the file path written
  */
 export function recordYoloAck(yoloAckAt, deps = {}) {
-  const path = deps.path ?? loginFilePath();
-  const read = deps.read ?? ((p) => readFileSync(p, "utf8"));
-  const write = deps.write ?? writeLoginFile;
-  // Start from the existing file when present, else an empty object: a TTY user
-  // whose credentials come from env / flags has no login file yet, but the ack
-  // must still persist (else they'd re-confirm yolo on every start). A file
-  // carrying only `yoloAckAt` is harmless — resolveCredentials simply falls
-  // through it, and a later `chorus login` overwrites (clearing the ack).
-  let current = {};
-  try {
-    const parsed = JSON.parse(read(path));
-    if (parsed && typeof parsed === "object") current = parsed;
-  } catch {
-    // missing / unreadable / malformed → treat as empty (start fresh)
-  }
-  return write({ ...current, yoloAckAt }, { path });
+  return updateDaemonConfig({ yoloAckAt }, deps);
 }
 
 /**

package/cli/server-signal-handlers.mjs

@@ -0,0 +1,41 @@
+// cli/server-signal-handlers.mjs
+// The Chorus CLI entry (`chorus.mjs`) is dual-purpose: with no subcommand it
+// launches the embedded Next.js server (with a PGlite child); with `daemon` /
+// `login` it dispatches a client subcommand that connects OUT to a remote
+// server. The server-launch path installs three process-signal handlers — a
+// SIGINT/SIGTERM graceful-shutdown handler and an `exit` handler that
+// force-kills the PGlite child — but those are MEANINGLESS (and actively
+// harmful) on a client-subcommand process: a `chorus daemon` never starts
+// PGlite, and the server's SIGINT/SIGTERM handler would otherwise pre-empt the
+// daemon's OWN graceful shutdown (it runs first, in registration order, and
+// calls `process.exit(0)` synchronously). See the idea / design docs.
+//
+// This module is intentionally PURE — it runs no side effects at import — so a
+// unit test can import the function in isolation and drive it with a fake
+// `process`-like object, without executing `chorus.mjs`'s import-time side
+// effects (subcommand dispatch, server-config parsing) and without delivering a
+// real fatal signal to the test runner.
+
+/**
+ * Install the server-only process-signal handlers, but ONLY for the server
+ * launch path (no client subcommand). When invoked as a client subcommand
+ * (`chorus daemon` / `chorus login`), this registers NOTHING and returns false,
+ * so the process terminates exclusively through the subcommand's own handler
+ * (e.g. the daemon's graceful `daemon.stop()`).
+ *
+ * @param {object} params
+ * @param {boolean} params.isSubcommand  true when a client subcommand is running.
+ * @param {{ on(event: string, listener: (...args: any[]) => void): unknown }} params.processRef
+ *   the process to attach listeners to (real `process`, or a fake in tests).
+ * @param {(...args: any[]) => void} params.shutdown    SIGINT/SIGTERM handler.
+ * @param {(...args: any[]) => void} params.cleanupExit `exit` handler (PGlite SIGKILL).
+ * @returns {boolean} true if the server handlers were installed, false if skipped.
+ */
+export function installServerSignalHandlers({ isSubcommand, processRef, shutdown, cleanupExit }) {
+  // Client subcommand → install none of the server's signal handlers.
+  if (isSubcommand) return false;
+  processRef.on("SIGINT", shutdown);
+  processRef.on("SIGTERM", shutdown);
+  processRef.on("exit", cleanupExit);
+  return true;
+}

package/cli/spawner-select.mjs

@@ -0,0 +1,30 @@
+// cli/spawner-select.mjs
+// Backend selection seam: maps the resolved agent type (daemon-agent.mjs) to a
+// concrete Spawner instance. This is the ONLY place the daemon branches on the
+// backend — the wake pipeline above it (queue, waker, directed delivery, headless
+// guard, reporters) stays backend-agnostic and drives whichever spawner is
+// injected purely through the shared wake(...) contract.
+//
+// The function is TOTAL: resolveAgentType has already rejected unknown values
+// before this runs, so an unrecognized type here is not a user error path — we
+// fall back to the safe default (claude-code) rather than throw.
+
+import { ClaudeSpawner } from "./claude-spawner.mjs";
+import { CodexSpawner } from "./codex-spawner.mjs";
+
+/**
+ * Construct the spawner backend for `agentType`.
+ * @param {string} agentType  "claude-code" | "codex" (already validated upstream).
+ * @param {{ logger?: any, permissionMode?: "chorus"|"yolo", creds?: { url: string, apiKey: string } }} [opts]
+ * @returns {import("./codex-spawner.mjs").Spawner}
+ */
+export function selectSpawner(agentType, opts = {}) {
+  const { logger, permissionMode, creds } = opts;
+  if (agentType === "codex") {
+    return new CodexSpawner({ logger, permissionMode, creds });
+  }
+  // Default / "claude-code": construction byte-identical to the prior daemon
+  // (ClaudeSpawner takes only { logger, permissionMode } — creds are not used by
+  // the Claude backend, which gets its key via the --mcp-config file).
+  return new ClaudeSpawner({ logger, permissionMode });
+}