@chorus-aidlc/chorus 0.12.0 → 0.13.0

package/cli/daemon.mjs

@@ -18,8 +18,8 @@ import {
   resolvePermissionMode,
   yoloWarningLine,
 } from "./daemon-permission-mode.mjs";
-import { resolveAgentType } from "./daemon-agent.mjs";
-import { formatBanner } from "./daemon-banner.mjs";
+import { resolveAgentType, backendClientType } from "./daemon-agent.mjs";
+import { formatBanner, agentNotFoundWarningLine } from "./daemon-banner.mjs";
 import { ChorusClient, validateAndFetchIdentity } from "./chorus-client.mjs";
 import { SseListener } from "./sse-listener.mjs";
 import { createBackfill } from "./backfill.mjs";
@@ -27,7 +27,9 @@ import { EventRouter } from "./event-router.mjs";
 import { WakeQueue } from "./wake-queue.mjs";
 import { Waker } from "./waker.mjs";
 import { LineageResolver } from "./lineage.mjs";
-import { ClaudeSpawner, resolveClaudePath } from "./claude-spawner.mjs";
+import { resolveClaudePath } from "./claude-spawner.mjs";
+import { resolveCodexPath } from "./codex-spawner.mjs";
+import { selectSpawner } from "./spawner-select.mjs";
 import {
   createExecutionUploadHooks,
   createTranscriptUploadHooks,
@@ -95,9 +97,12 @@ function defaultLogger() {
 export function buildDaemon(creds, deps = {}) {
   const logger = deps.logger ?? defaultLogger();
   const permissionMode = deps.permissionMode ?? "chorus";
+  // The resolved agent backend selects which spawner the daemon injects
+  // (add-daemon-codex-backend). Defaults to claude-code, matching the prior
+  // hard-wired ClaudeSpawner. The spawn path below is backend-agnostic — it only
+  // ever calls the shared wake(...) contract.
+  const agentType = deps.agentType ?? "claude-code";
   // Per-wake verbose logging (daemon-startup-output), threaded into the Waker.
-  // agentType is currently display-only (banner/logs) — the spawn path is
-  // claude-code regardless (daemon-agent-selection reserves the slot only).
   const verbose = deps.verbose ?? false;
   // Escalation window for the interrupt killer (子3). Pre-resolved by runDaemon via
   // the layered resolver; falls back to the resolver's default here when not given,
@@ -112,7 +117,11 @@ export function buildDaemon(creds, deps = {}) {
   const lineage =
     deps.lineage ??
     new LineageResolver({ url: creds.url, apiKey: creds.apiKey, logger, fetchImpl: deps.fetchImpl });
-  const spawner = deps.spawner ?? new ClaudeSpawner({ logger, permissionMode });
+  // Inject the spawner for the resolved backend. claude-code → ClaudeSpawner
+  // (construction byte-identical to before); codex → CodexSpawner. `creds` are
+  // passed through so the Codex backend can export the daemon key into the woken
+  // process env (the Claude backend ignores creds — it gets its key via --mcp-config).
+  const spawner = deps.spawner ?? selectSpawner(agentType, { logger, permissionMode, creds });
   // The WakeQueue serializes per DIRECT idea (keyFor's key). It is shared across all
   // path-connections: serialization-per-idea still holds, and maxConcurrency caps the
   // whole process's in-flight wakes rather than per-cwd — the right global budget.
@@ -131,6 +140,40 @@ export function buildDaemon(creds, deps = {}) {
       ? deps.cwds
       : [deps.cwd];
 
+  // ===== All-conflict exit latch (add-daemon-connection-conflict-skip, Q3) =====
+  // Each declared connection resolves to exactly one terminal outcome: REGISTERED
+  // (saw connection_registered → onConnectionId) or CONFLICTED (saw
+  // connection_conflict → onConflict). When EVERY declared connection has resolved
+  // AND none registered (≥1 conflicted, 0 survived), the daemon has nothing to serve,
+  // so we settle `allConflict` — runDaemon races this against waitForever and returns
+  // a non-zero exit. The latch is evaluated only after all connections resolve (R5):
+  // a path still mid-handshake leaves `resolved < total`, so a partial conflict never
+  // triggers the exit. A connection that registers (even after some conflicted) flips
+  // `anyRegistered`, so the exit never fires while at least one path serves.
+  const totalConnections = cwdSet.length;
+  let resolvedConnections = 0;
+  let anyRegistered = false;
+  let settleAllConflict; // resolver, wired into the promise below
+  // A promise that settles ONLY in the all-paths-conflicted case. It never rejects and
+  // never settles otherwise (a serving daemon simply keeps waiting on waitForever).
+  const allConflict = new Promise((resolve) => {
+    settleAllConflict = resolve;
+  });
+  // Record one connection's terminal outcome and, once all have resolved, decide whether
+  // the whole daemon should exit. Idempotent per connection BY CONSTRUCTION: the guard
+  // lives here (flips the connection's own `outcome.resolved`) so a reconnect's repeated
+  // connection_registered — or any future caller — can never double-count, no matter the
+  // call site. The first terminal signal for a connection wins; later ones are no-ops.
+  function recordConnectionOutcome(outcome, registered) {
+    if (outcome.resolved) return;
+    outcome.resolved = true;
+    resolvedConnections += 1;
+    if (registered) anyRegistered = true;
+    if (resolvedConnections === totalConnections && !anyRegistered) {
+      settleAllConflict();
+    }
+  }
+
   /**
    * Build ONE independent path-connection bound to `cwd` (one SSE stream → one
    * DaemonConnection row, keyed by that cwd server-side). All per-connection state —
@@ -149,6 +192,13 @@ export function buildDaemon(creds, deps = {}) {
     /** @type {{ connectionUuid: string|null }} */
     const connectionState = { connectionUuid: null };
 
+    // Per-connection terminal-outcome bookkeeping (add-daemon-connection-conflict-skip).
+    // `resolved` guards recordConnectionOutcome against double-counting a reconnect's
+    // repeated connection_registered. `skipped` marks a cwd surrendered to a live
+    // different-process daemon — purely informational (the listener is torn down, so it
+    // simply never reconnects), kept on the returned object for inspection/tests.
+    const outcome = { resolved: false, skipped: false };
+
     // Interrupt reporter (子3): REST POST with the daemon's Bearer key. Injectable for
     // tests (shared across connections when injected — tests use a single connection).
     const reportInterrupt =
@@ -273,6 +323,9 @@ export function buildDaemon(creds, deps = {}) {
       makeSse({
         url: creds.url,
         apiKey: creds.apiKey,
+        // Self-report the SELECTED backend so the connection registry + presence UI
+        // label a codex daemon as `codex` (not the hardcoded `claude_code`).
+        clientType: backendClientType(agentType),
         // The working directory THIS connection serves (T3). `undefined` ⇒ the listener
         // reports its process cwd (single-path / HARD-1). It is just the served path.
         cwd,
@@ -283,13 +336,37 @@ export function buildDaemon(creds, deps = {}) {
             `[Chorus] registered as connection ${connectionUuid}` +
               (cwd ? ` (cwd=${cwd})` : "")
           );
+          // Terminal outcome: this path registered. recordConnectionOutcome is idempotent
+          // per connection, so a reconnect's repeated connection_registered counts once.
+          recordConnectionOutcome(outcome, true);
+        },
+        // Connection conflict (add-daemon-connection-conflict-skip, Q3/Q4): the server
+        // refused to register THIS cwd because a live different-process daemon already
+        // holds the same (agent, host, cwd). Warn prominently, tear the listener down
+        // (disconnect clears the reconnect timer + aborts), and mark the path skipped —
+        // it is never reconnected/re-probed for the process lifetime. Takeover happens
+        // only on the NEXT daemon start/restart. Independent closures mean skipping this
+        // path never disturbs another connection's dispatch/control.
+        onConflict: (event) => {
+          const conflictCwd = (event && event.cwd) ?? cwd ?? process.cwd();
+          const conflictHost = (event && event.host) || "this host";
+          logger.warn(
+            `[Chorus] ⚠ connection conflict: a live daemon already serves ` +
+              `(host=${conflictHost}, cwd=${conflictCwd}) — skipping this path. ` +
+              `Stop the other daemon (or wait for it to go offline) and restart to take it over.`
+          );
+          outcome.skipped = true;
+          // Tear down THIS path's listener: no reconnect, no re-probe (Q4).
+          sseListener.disconnect?.();
+          // Terminal outcome: this path conflicted (idempotent — counts once).
+          recordConnectionOutcome(outcome, false);
         },
         onControl,
         onReconnect: backfill,
         logger,
       });
 
-    return { cwd, connectionState, waker, router, backfill, sseListener, hooks };
+    return { cwd, connectionState, waker, router, backfill, sseListener, hooks, outcome };
   }
 
   // Build one connection per declared cwd. The order is the declaration order; the
@@ -309,6 +386,10 @@ export function buildDaemon(creds, deps = {}) {
     router: primary.router,
     sseListener: primary.sseListener,
     connections,
+    // Settles ONLY when every declared connection resolved and none registered
+    // (all paths already served by a live daemon — Q3). runDaemon races this against
+    // waitForever to exit non-zero. Never settles for a serving daemon.
+    allConflict,
     async start() {
       // Connect every path-connection. Each fires its own onConnect hook + SSE connect;
       // the daemon process cwd is untouched (NFR-3).
@@ -356,7 +437,11 @@ export async function runDaemon(flags = {}, deps = {}) {
   const askPrompt = deps.prompt ?? prompt;
   const writeCreds = deps.writeLoginFile ?? writeLoginFile;
   const version = deps.version ?? readVersion();
+  // Backend executable resolvers — injectable for tests. The SELECTED backend's
+  // resolver runs below (claude-code → findClaude, codex → findCodex), so the
+  // banner shows the right binary instead of always probing for `claude`.
   const findClaude = deps.resolveClaudePath ?? resolveClaudePath;
+  const findCodex = deps.resolveCodexPath ?? resolveCodexPath;
   const verbose = flags.verbose === true || env.CHORUS_VERBOSE === "1";
 
   // Resolve the agent backend (default claude-code). An unknown --agent /
@@ -410,10 +495,12 @@ export async function runDaemon(flags = {}, deps = {}) {
   if (typeof pf === "number") return pf;
   const { creds, identity, permissionMode } = pf;
 
-  // Detect the claude executable (non-fatal): the daemon still subscribes when
-  // it's missing; a wake surfaces the error visibly when one arrives. The
-  // resolved path (or absence) is shown in the banner below.
-  const claudePath = findClaude();
+  // Detect the SELECTED backend's executable (non-fatal): the daemon still
+  // subscribes when it's missing; a wake surfaces the error visibly when one
+  // arrives. The resolved path (or absence) is shown in the banner below. codex
+  // → resolveCodexPath, otherwise resolveClaudePath — so a `--agent codex` run
+  // probes (and the banner reports) `codex`, not `claude`.
+  const cliPath = agentType === "codex" ? findCodex() : findClaude();
 
   // The daemon.json the layered config readers (credentials, sigint timeout, cwds)
   // consult. Surfacing its absolute path + presence in the banner makes it obvious
@@ -432,7 +519,7 @@ export async function runDaemon(flags = {}, deps = {}) {
         permissionMode,
         credentialSource: creds.source,
         agentType,
-        claudePath,
+        cliPath,
         connection: "connecting…",
         configPath,
         configExists,
@@ -445,6 +532,14 @@ export async function runDaemon(flags = {}, deps = {}) {
   if (permissionMode === "yolo") {
     errLog(`[Chorus] ${yoloWarningLine()}`);
   }
+  // A missing backend binary is non-fatal (the daemon still subscribes), but the
+  // banner row alone is easy to miss in a systemd journal — emit one loud ⚠ line
+  // on stderr so the operator sees it at startup, not only when a wake fails. The
+  // warning names the SELECTED backend (claude / CHORUS_CLAUDE_PATH or codex /
+  // CHORUS_CODEX_PATH).
+  if (cliPath === null) {
+    errLog(`[Chorus] ${agentNotFoundWarningLine(agentType)}`);
+  }
 
   // Surface the served paths so an operator sees a multi-path daemon at a glance.
   // A single `[undefined]` (the default) prints the process cwd it falls back to.
@@ -476,8 +571,32 @@ export async function runDaemon(flags = {}, deps = {}) {
   await daemon.start();
   log("[Chorus] daemon running. Waiting for task dispatches (Ctrl+C to stop).");
 
-  // Keep the process alive for the long-lived SSE subscription.
-  await (deps.waitForever ?? (() => new Promise(() => {})))();
+  // Keep the process alive for the long-lived SSE subscription, but exit non-zero if
+  // EVERY declared path turns out to be already served by a live daemon
+  // (add-daemon-connection-conflict-skip, Q3). `daemon.allConflict` settles only in
+  // that all-paths-conflicted case; otherwise we wait forever on the subscription. A
+  // sentinel distinguishes the two so a waitForever that never settles can't be mistaken
+  // for the conflict exit.
+  const ALL_CONFLICT = Symbol("all-conflict");
+  const waitForever = deps.waitForever ?? (() => new Promise(() => {}));
+  // `daemon.allConflict` is present on the real buildDaemon output; guard for injected
+  // test fakes that don't provide it (those never settle the conflict branch). A
+  // never-settling fallback keeps the race purely waitForever-driven in that case.
+  const allConflictSignal =
+    daemon.allConflict ?? new Promise(() => {});
+  const outcome = await Promise.race([
+    waitForever().then(() => 0),
+    allConflictSignal.then(() => ALL_CONFLICT),
+  ]);
+  if (outcome === ALL_CONFLICT) {
+    const n = servedPaths.length;
+    errLog(
+      `[Chorus] all ${n} declared ${n === 1 ? "path is" : "paths are"} already served by a live daemon — nothing to do. ` +
+        `Stop the other daemon(s) or remove the conflicting path(s), then restart.`
+    );
+    await daemon.stop();
+    return 1;
+  }
   return 0;
 }
 

package/cli/embedded-db.mjs

@@ -0,0 +1,234 @@
+// cli/embedded-db.mjs
+// Embedded PGlite launch logic, extracted out of chorus.mjs (GitHub #379).
+//
+// Why this module exists — the bug:
+//   chorus.mjs used to fork the PGlite child with { stdio: "ignore" }, attach only
+//   .on("error") (which fires ONLY on spawn failure), then trust waitForTcp — which
+//   answers "is *someone* listening on this port?", NOT "is it *our* PGlite?". When a
+//   real Postgres already occupied the port (default 5433), the forked PGlite child
+//   died of EADDRINUSE — but it catches that and exits with code 0 (a clean shutdown),
+//   so .on("error") never fired and its output was swallowed by stdio:"ignore". The
+//   launcher then connected to the FOREIGN Postgres, printed a false "PGlite ready",
+//   and `prisma migrate deploy` failed authentication with a bare Prisma P1000.
+//
+// The fix is defense-in-depth, both layers pure + dependency-injected so they unit-test
+// with fakes (server-signal-handlers.mjs precedent — no real process spawning, no
+// import-time side effects):
+//   1. Pre-flight port-occupancy probe — before forking, check whether the port is
+//      already held. If so, FAIL FAST with an actionable message (no fork, no false
+//      "ready", no silent mis-connect).
+//   2. Exit-latch — after forking, race the child's "exit"/"error" against port-ready.
+//      If the child exits before readiness is confirmed, for ANY exit code (including
+//      the reproduced EADDRINUSE -> exit 0), the launch is FATAL. "someone is listening"
+//      is no longer sufficient evidence that our embedded PGlite is up.
+//
+// No automatic port bumping (out of scope for #379 — elaboration chose fail-fast).
+
+/**
+ * Format the fail-fast message shown when the embedded PGlite port is occupied.
+ * @param {number} port
+ * @returns {string}
+ */
+export function formatPortConflictMessage(port) {
+  return (
+    `ERROR: Embedded PostgreSQL (PGlite) could not start — port ${port} is already in use.\n` +
+    `Another process (often a real PostgreSQL) is occupying it. Free the port, or run\n` +
+    `Chorus on a different embedded port:  chorus --pglite-port <port>`
+  );
+}
+
+/** True when a child process has already terminated (exit code recorded). */
+function childHasExited(child) {
+  return child.exitCode !== null && child.exitCode !== undefined;
+}
+
+/**
+ * Classify migrate output as a Prisma authentication failure (P1000).
+ *
+ * Matches the stable error CODE token first, then the human phrase as a fallback,
+ * so it survives message drift across Prisma versions. Deliberately narrow: it must
+ * NOT fire on other migration errors (P3009 failed migration, P1001 can't-reach, etc.)
+ * — those keep chorus.mjs's existing generic "Database migration failed" path.
+ * Verified against the installed Prisma 7.3.0 surface text (GitHub #379).
+ *
+ * @param {string|undefined|null} output  combined stdout+stderr of `prisma migrate deploy`
+ * @returns {boolean}
+ */
+export function isPrismaAuthFailure(output) {
+  if (!output) return false;
+  const text = String(output);
+  // P1000 is Prisma's dedicated auth-failure code — the most stable signal.
+  if (/\bP1000\b/.test(text)) return true;
+  // Fallback phrase (covers adapter-surfaced errors that omit the bare code token).
+  if (/Authentication failed against (the )?database server/i.test(text)) return true;
+  return false;
+}
+
+/**
+ * Mask credentials in a Postgres connection URL, preserving host:port (+db) for
+ * diagnostics. Falls back to a naive user:pass@ strip if URL parsing fails, and to a
+ * placeholder for empty input.
+ *
+ * @param {string|undefined|null} url
+ * @returns {string}
+ */
+export function maskDbUrl(url) {
+  if (!url) return "(unknown database)";
+  const raw = String(url);
+  try {
+    const u = new URL(raw);
+    const auth = u.username ? `${u.username}:***@` : "";
+    const db = u.pathname && u.pathname !== "/" ? u.pathname : "";
+    return `${u.protocol}//${auth}${u.host}${db}`;
+  } catch {
+    // Best-effort: strip a user:pass@ segment if present.
+    return raw.replace(/\/\/[^@/]*@/, "//***@");
+  }
+}
+
+/** Extract just host:port from a connection URL for terse messages. */
+function hostPortOf(url) {
+  if (!url) return "the database";
+  try {
+    return new URL(String(url)).host || "the database";
+  } catch {
+    const m = String(url).match(/@([^/?]+)/);
+    return m ? m[1] : "the database";
+  }
+}
+
+/**
+ * Build the Chorus-friendly diagnostic shown (as the FINAL output) when
+ * `prisma migrate deploy` fails authentication. The remedy depends on WHY we're
+ * pointed at that database:
+ *   - embedded path (no external DATABASE_URL): the port is likely occupied by another
+ *     PostgreSQL — suggest `chorus --pglite-port <port>`.
+ *   - external path (DATABASE_URL set): name the external host:port and suggest
+ *     `unset DATABASE_URL` if it was unintended.
+ * Credentials are always masked.
+ *
+ * @param {object} params
+ * @param {string}  params.effectiveUrl    the DATABASE_URL actually used for migration
+ * @param {boolean} params.startedEmbedded  true if we launched embedded PGlite ourselves
+ * @param {number}  params.pglitePort       the embedded port (for the --pglite-port hint)
+ * @returns {string}
+ */
+export function formatMigrationAuthDiagnostic({ effectiveUrl, startedEmbedded, pglitePort }) {
+  const masked = maskDbUrl(effectiveUrl);
+  const hostPort = hostPortOf(effectiveUrl);
+  const lines = [
+    "",
+    "ERROR: Database migration failed — the database server rejected the credentials.",
+    `Connected to ${masked}, but authentication failed (Prisma P1000).`,
+    "",
+  ];
+  if (startedEmbedded) {
+    lines.push(
+      `This usually means port ${pglitePort} is occupied by another PostgreSQL, so Chorus`,
+      `connected to it instead of its own embedded database. Free the port, or run on a`,
+      `different one:  chorus --pglite-port <port>`
+    );
+  } else {
+    lines.push(
+      `Chorus used the DATABASE_URL from your environment (${hostPort}) instead of its`,
+      `embedded database. If that was not intended, clear it and re-run:  unset DATABASE_URL`
+    );
+  }
+  return lines.join("\n");
+}
+
+/**
+ * Launch the embedded PGlite child and confirm it is genuinely OUR process that is
+ * ready — not a foreign listener on the same port.
+ *
+ * Pure w.r.t. its injected dependencies: `fork`, `waitForTcp`, `preflightCheck`,
+ * `logger`. No process global is touched here; the caller (chorus.mjs) wires the real
+ * implementations and decides how to exit on failure.
+ *
+ * @param {object} params
+ * @param {string}   params.host            host to probe for readiness (e.g. "localhost")
+ * @param {number}   params.port            embedded PGlite port
+ * @param {() => { on: Function, kill?: Function, exitCode: number|null, killed?: boolean }} params.fork
+ *   forks the PGlite server child and returns a ChildProcess-like object
+ * @param {(host: string, port: number) => Promise<void>} params.waitForTcp
+ *   resolves when the port accepts a TCP connection, rejects on timeout
+ * @param {(host: string, port: number) => Promise<boolean>} params.preflightCheck
+ *   resolves true if the port is ALREADY occupied before we fork (foreign listener)
+ * @param {{ log: Function, error: Function }} params.logger
+ * @returns {Promise<
+ *   | { ok: true, child: object }
+ *   | { ok: false, reason: "port-occupied", port: number }
+ *   | { ok: false, reason: "child-exited", exitInfo: { code: number|null, signal: string|null } }
+ *   | { ok: false, reason: "child-error", error: Error }
+ *   | { ok: false, reason: "not-ready", error: Error }
+ * >}
+ */
+export async function launchEmbeddedPglite({ host, port, fork, waitForTcp, preflightCheck, logger }) {
+  // Layer 1 — pre-flight: never fork onto an already-occupied port.
+  const occupied = await preflightCheck(host, port);
+  if (occupied) {
+    logger.error(formatPortConflictMessage(port));
+    return { ok: false, reason: "port-occupied", port };
+  }
+
+  const child = fork();
+
+  // The child may have died synchronously during/just after fork (its exit code is
+  // then already recorded even if our "exit" listener attaches a tick too late).
+  if (childHasExited(child)) {
+    return {
+      ok: false,
+      reason: "child-exited",
+      exitInfo: { code: child.exitCode, signal: null },
+    };
+  }
+
+  // Layer 2 — latch the child's terminal events, then race them against readiness.
+  // A dead child ALWAYS beats a "someone is listening" probe: that is the #379 guard.
+  let exitInfo = null; // { code, signal } once the child exits
+  let spawnError = null;
+  let readyError = null;
+
+  const childDied = new Promise((resolve) => {
+    child.on("exit", (code, signal) => {
+      exitInfo = { code, signal };
+      resolve("exit");
+    });
+    child.on("error", (err) => {
+      spawnError = err;
+      resolve("error");
+    });
+  });
+
+  const readied = waitForTcp(host, port).then(
+    () => "ready",
+    (err) => {
+      readyError = err;
+      return "not-ready";
+    }
+  );
+
+  const outcome = await Promise.race([childDied, readied]);
+
+  // Re-check the latches regardless of who won the race — the child dying is fatal
+  // even if the port-ready probe also resolved (e.g. against a foreign listener).
+  if (exitInfo || childHasExited(child)) {
+    return {
+      ok: false,
+      reason: "child-exited",
+      exitInfo: exitInfo || { code: child.exitCode ?? null, signal: null },
+    };
+  }
+  if (spawnError) {
+    return { ok: false, reason: "child-error", error: spawnError };
+  }
+  if (outcome === "not-ready") {
+    // Readiness timed out but the child is (as far as we know) still alive — don't leak it.
+    if (child.kill && !child.killed) child.kill("SIGTERM");
+    return { ok: false, reason: "not-ready", error: readyError };
+  }
+
+  // outcome === "ready" AND the child has not exited → genuinely our PGlite.
+  logger.log(`PGlite ready on port ${port}.`);
+  return { ok: true, child };
+}

package/cli/login.mjs

@@ -3,7 +3,7 @@
 // ~/.chorus/daemon.json (0600). On validation failure, nothing is written.
 // Plain ESM; the only dependency is the in-repo MCP SDK (via chorus-client).
 
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { createInterface } from "node:readline";
 
@@ -49,56 +49,99 @@ export function prompt(query, opts = {}) {
 }
 
 /**
- * Persist credentials + identity to the login file with owner-only perms.
+ * Field-level merge update of the login file (`~/.chorus/daemon.json`) — the
+ * single read → merge → write(0600) helper every config writer routes through.
+ *
+ * Reads any existing file, shallow-merges `partial` over it (partial keys win,
+ * every other pre-existing field is preserved), and writes the result back with
+ * owner-only permissions. A shallow merge is correct because every field is a
+ * scalar or a flat array (`cwds`) — there are no nested objects to deep-merge.
  *
- * Writing the file with a fresh credential object intentionally OMITS any
- * `yoloAckAt` that a previous file carried — a credential change (re-login)
- * clears the yolo acknowledgement, so the next yolo TTY start re-confirms once
- * (daemon-permission-mode spec). To preserve an existing ack across an
- * unrelated rewrite, the caller must read it first and pass it in `data`.
+ * The write is atomic: the JSON is written to a sibling `<path>.tmp` at 0600 and
+ * then `rename()`d over the target, so a crash mid-write never truncates the
+ * live file. A missing / unreadable / malformed existing file is treated as an
+ * empty object (defensive parse), so a re-login still produces a valid file
+ * rather than aborting on a corrupt one.
  *
- * @param {{ url: string, apiKey: string, agentUuid: string, agentName: string, yoloAckAt?: string }} data
- * @param {{ path?: string, write?: (p: string, c: string, o: object) => void, mkdir?: (p: string, o: object) => void }} [deps]
+ * Because writes now merge, NO field is ever silently dropped — in particular a
+ * `chorus login` preserves any pre-existing `cwds` / `yoloAckAt` /
+ * `sigintTimeoutMs` (daemon-config-field-merge change; supersedes the prior
+ * "credential change clears the yolo acknowledgement" behavior).
+ *
+ * @param {Record<string, unknown>} partial  The fields to set/overwrite.
+ * @param {{
+ *   path?: string,
+ *   read?: (p: string) => string,
+ *   write?: (p: string, c: string, o: object) => void,
+ *   mkdir?: (p: string, o: object) => void,
+ *   rename?: (from: string, to: string) => void,
+ * }} [deps]
+ * @returns {string} the file path written
  */
-export function writeLoginFile(data, deps = {}) {
+export function updateDaemonConfig(partial, deps = {}) {
   const path = deps.path ?? loginFilePath();
+  const read = deps.read ?? ((p) => readFileSync(p, "utf8"));
   const write = deps.write ?? writeFileSync;
   const mkdir = deps.mkdir ?? mkdirSync;
+  const rename = deps.rename ?? renameSync;
+
+  // Defensive read: missing / unreadable / malformed → start from empty so a
+  // re-login over a corrupt file still writes a valid one (no silent abort).
+  let current = {};
+  try {
+    const parsed = JSON.parse(read(path));
+    // Only a plain object is a valid config; arrays / scalars → start fresh.
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) current = parsed;
+  } catch {
+    // treat as empty
+  }
+
+  const merged = { ...current, ...partial };
   mkdir(dirname(path), { recursive: true });
-  write(path, JSON.stringify(data, null, 2) + "\n", { mode: 0o600 });
+  // Atomic write: temp file (0600) in the same dir, then rename over target.
+  const tmp = `${path}.tmp`;
+  write(tmp, JSON.stringify(merged, null, 2) + "\n", { mode: 0o600 });
+  rename(tmp, path);
   return path;
 }
 
 /**
- * Record (or refresh) the yolo acknowledgement in the existing login file,
- * preserving the credentials already on disk. Reads the current file, merges
- * `yoloAckAt`, and rewrites with 0600. Used by the daemon after an interactive
- * TTY yolo confirmation — it does NOT touch url/apiKey/identity.
+ * Persist credentials + identity to the login file with owner-only perms.
+ *
+ * Thin wrapper over {@link updateDaemonConfig}: it field-merges the given
+ * credential/identity fields over any existing file, so every OTHER pre-existing
+ * field (`cwds`, `yoloAckAt`, `sigintTimeoutMs`, …) is preserved across a
+ * `chorus login` or a daemon-start credential completion. It no longer omits
+ * `yoloAckAt` — a credential write never discards the recorded yolo ack.
+ *
+ * The `deps` seams (`path`, `write`, `mkdir`) are kept for callers/tests that
+ * inject IO; `write` is the low-level `(path, content, opts)` writer.
+ *
+ * @param {{ url: string, apiKey: string, agentUuid: string, agentName: string }} data
+ * @param {{ path?: string, write?: (p: string, c: string, o: object) => void, mkdir?: (p: string, o: object) => void, read?: (p: string) => string, rename?: (from: string, to: string) => void }} [deps]
+ */
+export function writeLoginFile(data, deps = {}) {
+  return updateDaemonConfig(data, deps);
+}
+
+/**
+ * Record (or refresh) the yolo acknowledgement in the login file, preserving
+ * everything already on disk. Delegates to {@link updateDaemonConfig}, which
+ * reads the current file, merges `yoloAckAt`, and rewrites with 0600. Used by
+ * the daemon after an interactive TTY yolo confirmation — it does NOT touch
+ * url/apiKey/identity.
  *
- * No-silent-errors: a read/parse failure is surfaced to the caller (throws), so
- * the daemon can log it rather than silently losing the ack.
+ * A TTY user whose credentials come from env / flags has no login file yet, but
+ * the ack must still persist (else they'd re-confirm yolo on every start). A
+ * file carrying only `yoloAckAt` is harmless — resolveCredentials simply falls
+ * through it.
  *
  * @param {string} yoloAckAt  ISO-8601 timestamp of the confirmation.
- * @param {{ path?: string, read?: (p: string) => string, write?: typeof writeLoginFile }} [deps]
+ * @param {{ path?: string, read?: (p: string) => string, write?: (p: string, c: string, o: object) => void, mkdir?: (p: string, o: object) => void, rename?: (from: string, to: string) => void }} [deps]
  * @returns {string} the file path written
  */
 export function recordYoloAck(yoloAckAt, deps = {}) {
-  const path = deps.path ?? loginFilePath();
-  const read = deps.read ?? ((p) => readFileSync(p, "utf8"));
-  const write = deps.write ?? writeLoginFile;
-  // Start from the existing file when present, else an empty object: a TTY user
-  // whose credentials come from env / flags has no login file yet, but the ack
-  // must still persist (else they'd re-confirm yolo on every start). A file
-  // carrying only `yoloAckAt` is harmless — resolveCredentials simply falls
-  // through it, and a later `chorus login` overwrites (clearing the ack).
-  let current = {};
-  try {
-    const parsed = JSON.parse(read(path));
-    if (parsed && typeof parsed === "object") current = parsed;
-  } catch {
-    // missing / unreadable / malformed → treat as empty (start fresh)
-  }
-  return write({ ...current, yoloAckAt }, { path });
+  return updateDaemonConfig({ yoloAckAt }, deps);
 }
 
 /**

package/cli/spawner-select.mjs

@@ -0,0 +1,30 @@
+// cli/spawner-select.mjs
+// Backend selection seam: maps the resolved agent type (daemon-agent.mjs) to a
+// concrete Spawner instance. This is the ONLY place the daemon branches on the
+// backend — the wake pipeline above it (queue, waker, directed delivery, headless
+// guard, reporters) stays backend-agnostic and drives whichever spawner is
+// injected purely through the shared wake(...) contract.
+//
+// The function is TOTAL: resolveAgentType has already rejected unknown values
+// before this runs, so an unrecognized type here is not a user error path — we
+// fall back to the safe default (claude-code) rather than throw.
+
+import { ClaudeSpawner } from "./claude-spawner.mjs";
+import { CodexSpawner } from "./codex-spawner.mjs";
+
+/**
+ * Construct the spawner backend for `agentType`.
+ * @param {string} agentType  "claude-code" | "codex" (already validated upstream).
+ * @param {{ logger?: any, permissionMode?: "chorus"|"yolo", creds?: { url: string, apiKey: string } }} [opts]
+ * @returns {import("./codex-spawner.mjs").Spawner}
+ */
+export function selectSpawner(agentType, opts = {}) {
+  const { logger, permissionMode, creds } = opts;
+  if (agentType === "codex") {
+    return new CodexSpawner({ logger, permissionMode, creds });
+  }
+  // Default / "claude-code": construction byte-identical to the prior daemon
+  // (ClaudeSpawner takes only { logger, permissionMode } — creds are not used by
+  // the Claude backend, which gets its key via the --mcp-config file).
+  return new ClaudeSpawner({ logger, permissionMode });
+}