@claudexor/cli 1.0.1 → 2.1.2

package/dist/claudexord.js

@@ -1,564 +1,367 @@
 #!/usr/bin/env node
-import { appendFileSync, chmodSync, mkdirSync, writeFileSync } from "node:fs";
-import { isAbsolute, join } from "node:path";
-import { DaemonClient, DaemonServer, InteractionRegistry, RunEventBus, ThreadStore, daemonDir, defaultSocketPath, ensureToken, logPath, socketAlive, } from "@claudexor/daemon";
+import { appendFileSync, mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { DaemonClient, commandProjection, interactionProjection, operatorDecisionProjection, runEventProjection, JournalManager, DaemonServer, InteractionRegistry, ProjectPartitions, projectProjection, RunEventBus, ResourceStore, quotaProjection, threadHeadPingProjection, threadProjection, daemonDir, defaultSocketPath, acquireDaemonWriterLease, ensureToken, ensureDaemonRuntimeRoot, logPath, socketAlive, } from "@claudexor/daemon";
 import { DaemonControlApiServer, normalizeRunStartRequest } from "@claudexor/control-api";
-import { armDaemonLifecycle, runStartupCrashGc } from "./daemon-lifecycle.js";
+import { armDaemonLifecycle, logLine, runStartupCrashGc } from "./daemon-lifecycle.js";
 import { Orchestrator } from "@claudexor/orchestrator";
-import { loadConfig, updateGlobalConfig } from "@claudexor/config";
-import { listTrustService, updateTrustService } from "./trust-services.js";
-import { SecretStore } from "@claudexor/secrets";
-import { ensureThreadWorktree, diffStaged, git, snapshotTree } from "@claudexor/workspace";
-import { deliver } from "@claudexor/delivery";
-import { containsSecretLikeToken, noProjectRepoRoot, readTextSafe, } from "@claudexor/util";
-import { ControlSettingsUpdateRequest, InterviewAnswer, } from "@claudexor/schema";
-import { invalidateDoctorCache, validateModel } from "@claudexor/core";
-import { resolveAttachments } from "./attachment-resolver.js";
-import { buildGateway, buildRegistry, harnessModels } from "./registry.js";
-import { buildAgentCapabilityCatalog } from "./capabilities.js";
-import { applyHarnessSettingsPatches, assertSettingsPatchValid } from "./settings-service.js";
+import { loadConfig } from "@claudexor/config";
+import { ensureThreadWorktree } from "@claudexor/workspace";
+import { noProjectRepoRoot, redactSecrets } from "@claudexor/util";
+import { scheduleStartupRetention } from "./retention-service.js";
+import { controlServices } from "./control-services.js";
+import { AuthReadinessService } from "@claudexor/gateway";
+import { buildGateway, buildRegistry } from "./registry.js";
 import { createSetupJobManager } from "./setup-jobs.js";
-import { buildGroundingPrompt, extractQuestionsFromPlan, freezeSpecFromGrounding, persistSpec, } from "./spec.js";
+import { SetupJobStore } from "./setup-job-store.js";
+import { SetupLifecycleBinding } from "./setup-lifecycle-binding.js";
+import { DaemonRuntimeShutdown } from "./daemon-runtime-shutdown.js";
+import { refreshCodexQuota } from "./codex-quota-source.js";
+import { refreshClaudeStatuslineQuota } from "./claude-statusline.js";
+import { refreshClaudeOauthUsageQuota } from "./claude-oauth-usage.js";
 const NO_PROJECT_ROOT = noProjectRepoRoot();
 async function main() {
-    // The daemon dir holds the auth token, jobs registry, and setup logs: it must
-    // never be group/world readable (mkdir mode only applies on creation).
-    mkdirSync(daemonDir(), { recursive: true, mode: 0o700 });
-    chmodSync(daemonDir(), 0o700);
-    const token = ensureToken();
+    ensureDaemonRuntimeRoot();
     const socketPath = defaultSocketPath();
-    // Live observation plane: every RunEvent is pushed onto the in-process bus
-    // (SSE latency drops to immediate; events.jsonl stays the canonical log) and
-    // harness questions park in the interaction registry until answered.
-    const bus = new RunEventBus();
-    const interactions = new InteractionRegistry();
-    // Thread/session SSOT: durable conversation registry; vendor CLI session
-    // ids are the re-hostable cache that lets later turns resume natively.
-    const threads = new ThreadStore(join(daemonDir(), "threads.json"));
-    const server = new DaemonServer({
-        socketPath,
-        token,
-        // Durable run registry so the run list survives a daemon/Mac restart.
-        persistPath: join(daemonDir(), "jobs.json"),
-        // A terminal run must stop advertising waiting_on_user immediately —
-        // cancelled/failed runs otherwise park their questions in the registry
-        // until the interaction timeout.
-        onRunTerminal: (runId) => interactions.dropForRun(runId),
-        // A turn whose job died BEFORE a run bound (trust gate, preflight throw)
-        // records the refusal on itself — the chat renders it inline instead of
-        // an eternally-empty bubble.
-        onTurnEnqueueFailed: (turnId, error, code) => threads.setTurnEnqueueError(turnId, error, code),
-        runner: async (params, ctx) => {
-            const p = normalizeDaemonRunStart(params);
-            const mode = p.mode;
-            const noProjectAsk = mode === "ask" && p.scope.kind === "none";
-            const repoRoot = p.scope.kind === "project" ? p.scope.root : NO_PROJECT_ROOT;
-            if (noProjectAsk)
-                mkdirSync(NO_PROJECT_ROOT, { recursive: true, mode: 0o700 });
-            const orchestrator = new Orchestrator({
-                registry: buildRegistry(),
-                portfolio: p.portfolio,
-                reviewerPanel: p.reviewerPanel,
-                reviewerModels: p.reviewerModels && typeof p.reviewerModels === "object" ? p.reviewerModels : undefined,
-                reviewerEfforts: p.reviewerEfforts && typeof p.reviewerEfforts === "object"
-                    ? p.reviewerEfforts
-                    : undefined,
-            });
-            // Fail loud on bogus socket-caller thread/turn ids (job settles failed).
-            const { threadId, turnId } = threads.assertKnownIds(p.threadId, p.turnId);
-            // Resolve the execution tree: an ISOLATED thread runs in its persistent
-            // worktree (lazily created); in-place threads and ordinary runs use the
-            // project root. Config/artifacts stay anchored to repoRoot either way.
-            let executionRoot;
-            let inPlace = p.execution.isolation === "live";
-            if (threadId && repoRoot !== NO_PROJECT_ROOT) {
-                const thread = threads.getThread(threadId);
-                if (thread?.workspace.mode === "isolated") {
-                    const wt = await ensureThreadWorktree(repoRoot, threadId);
-                    executionRoot = wt.path;
-                    // Persist the base ONLY on creation: `apply` advances base_sha, and a
-                    // later turn must not clobber it back to the worktree HEAD (which never
-                    // moves, since turns don't commit) — that would re-apply old work.
-                    if (wt.created)
-                        threads.setThreadWorktree(threadId, wt.path, wt.baseSha);
-                    inPlace = true; // isolated turns run in-place WITHIN the worktree
-                }
+    const writerLease = acquireDaemonWriterLease(socketPath);
+    let shutdownRuntime = null;
+    // Release wave round-12 BLOCK: the single-writer lease may only be released
+    // after a CLEAN shutdown — a failed/partial shutdown keeps components that
+    // can still write, and releasing would let a successor acquire ownership
+    // beside them. On failure the lease dies with the process instead.
+    let releaseWriterLease = true;
+    let lifecycle = null;
+    let quotaPollTimer = null;
+    try {
+        const token = ensureToken();
+        if (await socketAlive(socketPath)) {
+            throw new Error(`a claudexor daemon is already listening on ${socketPath}; stop it first`);
+        }
+        await runStartupCrashGc({ daemonDir: daemonDir(), logPath: logPath() });
+        const bus = new RunEventBus();
+        const journalManager = new JournalManager(daemonDir());
+        const commandStoreSlot = journalManager.registerProjection(commandProjection());
+        const interactionStoreSlot = journalManager.registerProjection(interactionProjection());
+        const operatorDecisionStoreSlot = journalManager.registerProjection(operatorDecisionProjection());
+        const runEventStoreSlot = journalManager.registerProjection(runEventProjection());
+        const projectStoreSlot = journalManager.registerProjection(projectProjection());
+        const quotaStoreSlot = journalManager.registerProjection(quotaProjection([
+            refreshCodexQuota,
+            refreshClaudeStatuslineQuota,
+            () => refreshClaudeOauthUsageQuota(),
+        ]));
+        // Sidebar invalidation ping (W12): a GLOBAL-partition emitter every
+        // ThreadStore (global + per-project) writes through, so any thread
+        // mutation reaches the app's single global stream. The ping is auxiliary
+        // invalidation — it must never fail the mutation that triggered it
+        // (mirrors the runner's turn-binding policy).
+        const threadHeadPingSlot = journalManager.registerProjection(threadHeadPingProjection());
+        const threadHeadPing = (ping) => {
+            try {
+                threadHeadPingSlot.current().ping(ping);
             }
-            // Single-writer turn binding: control-api pre-creates the turn and passes
-            // its id, which we bind when the run starts. A thread run WITHOUT a
-            // pre-created turn (a direct POST /runs with threadId) gets its turn
-            // created and bound here, so "a run is always recorded on its thread".
-            const onRunStart = (info) => {
-                ctx.onRunStart?.(info);
-                if (!threadId)
-                    return;
-                try {
-                    if (turnId) {
-                        threads.bindTurnRun(turnId, info.runId);
-                    }
-                    else {
-                        const turn = threads.createTurn(threadId, String(p.prompt ?? ""), {
-                            parentRunId: typeof p.parentRunId === "string" ? p.parentRunId : null,
-                        });
-                        threads.bindTurnRun(turn.id, info.runId);
+            catch {
+                /* invalidation ping must never fail the thread mutation */
+            }
+        };
+        const threadStoreSlot = journalManager.registerProjection(threadProjection(threadHeadPing));
+        const setupStoreSlot = journalManager.registerProjection({
+            name: "setup",
+            create: (journal) => new SetupJobStore(daemonDir(), { journal }),
+            validate: (store) => store.validateProjection(),
+        });
+        journalManager.start();
+        const pollQuota = () => {
+            try {
+                void quotaStoreSlot.current().pollStale();
+            }
+            catch { }
+        };
+        quotaPollTimer = setInterval(pollQuota, 60_000).unref();
+        pollQuota();
+        const threads = new ProjectPartitions(daemonDir(), projectStoreSlot, commandStoreSlot, interactionStoreSlot, operatorDecisionStoreSlot, runEventStoreSlot, threadStoreSlot, threadHeadPing);
+        const interactions = new InteractionRegistry({
+            forRequest: (params) => threads.interactionsForRequest(params),
+            all: () => threads.interactionStores(),
+        });
+        const resources = new ResourceStore(join(daemonDir(), "resource-store"));
+        const server = new DaemonServer({
+            socketPath,
+            token,
+            commands: threads,
+            onRunTerminal: (runId, threadId) => {
+                interactions.dropForRun(runId);
+                // Run-terminal is the one W12 path with no thread-store mutation to
+                // ride — the terminal changes the thread's presented state, so ping.
+                if (threadId)
+                    threads.pingThreadHead(threadId);
+            },
+            onTurnEnqueueFailed: (turnId, error, code) => threads.setTurnEnqueueError(turnId, error, code),
+            onShutdownRequested: () => shutdownRuntime?.beginShutdown("socket-rpc stop") ??
+                Promise.reject(new Error("daemon shutdown coordinator is not initialized")),
+            runner: async (params, ctx) => {
+                const p = normalizeRunStartRequest(params);
+                const mode = p.mode;
+                const noProjectAsk = mode === "ask" && p.scope.kind === "none";
+                const repoRoot = p.scope.kind === "project" ? p.scope.root : NO_PROJECT_ROOT;
+                if (noProjectAsk)
+                    mkdirSync(NO_PROJECT_ROOT, { recursive: true, mode: 0o700 });
+                const orchestrator = new Orchestrator({
+                    registry: buildRegistry(),
+                    routingGoal: p.routingGoal,
+                    quotaSnapshots: () => quotaStoreSlot.current().read().snapshots,
+                    quotaEventSink: (harnessId, event) => quotaStoreSlot.current().ingest(harnessId, event),
+                    reviewerPanel: p.reviewerPanel,
+                    reviewerModels: p.reviewerModels && typeof p.reviewerModels === "object" ? p.reviewerModels : undefined,
+                    reviewerEfforts: p.reviewerEfforts && typeof p.reviewerEfforts === "object"
+                        ? p.reviewerEfforts
+                        : undefined,
+                });
+                const { threadId, turnId } = threads.assertKnownIds(p.threadId, p.turnId);
+                let executionRoot;
+                let inPlace = p.execution.isolation === "live";
+                if (threadId && repoRoot !== NO_PROJECT_ROOT) {
+                    const thread = threads.getThread(threadId);
+                    if (thread?.workspace.mode === "isolated") {
+                        const wt = await ensureThreadWorktree(repoRoot, threadId);
+                        executionRoot = wt.path;
+                        // Only creation owns the base; apply advances it independently.
+                        if (wt.created)
+                            threads.setThreadWorktree(threadId, wt.path, wt.baseSha);
+                        inPlace = true; // isolated turns run in-place WITHIN the worktree
                     }
                 }
-                catch {
-                    /* turn binding must never fail the run */
+                const onRunStart = (info) => {
+                    ctx.onRunStart?.(info);
+                    if (!threadId)
+                        return;
+                    try {
+                        if (turnId) {
+                            threads.bindTurnRun(turnId, info.runId);
+                        }
+                        else {
+                            const turn = threads.createTurn(threadId, String(p.prompt ?? ""), {
+                                parentRunId: typeof p.parentRunId === "string" ? p.parentRunId : null,
+                            });
+                            threads.bindTurnRun(turn.id, info.runId);
+                        }
+                    }
+                    catch {
+                        /* turn binding must never fail the run */
+                    }
+                };
+                // maxSeconds: a hard wall-clock deadline for the WHOLE run (run-scoped,
+                // never per-attempt). Combine the daemon's per-run cancel signal with a
+                // deadline that aborts with a typed STRING reason so the terminal is
+                // `cancelled` + wall_clock_exceeded rather than a bare user cancel.
+                const maxSeconds = typeof p.maxSeconds === "number" && p.maxSeconds > 0
+                    ? // Defense in depth against a setTimeout 32-bit-ms overflow (the
+                        // schema already caps at 7 days for the control-API path).
+                        Math.min(p.maxSeconds, 604_800)
+                    : null;
+                // INV-135 selection precedence: explicit per-turn profile beats the
+                // thread's sticky profile beats the engine default — and an explicit
+                // NULL forces the default ladder past the sticky profile (release
+                // wave round-11). The winner scopes BOTH the run spec and the
+                // resume-session lookup (resume never crosses profiles).
+                const requestedProfileId = p.credentialProfileId === null
+                    ? null
+                    : typeof p.credentialProfileId === "string" && p.credentialProfileId
+                        ? p.credentialProfileId
+                        : threadId
+                            ? (threads.getThread(threadId)?.credential_profile_id ?? null)
+                            : null;
+                let deadlineTimer;
+                let runSignal = ctx.signal;
+                if (maxSeconds !== null) {
+                    const deadline = new AbortController();
+                    deadlineTimer = setTimeout(() => deadline.abort("wall_clock_exceeded"), maxSeconds * 1000);
+                    deadlineTimer.unref?.();
+                    runSignal = ctx.signal ? AbortSignal.any([ctx.signal, deadline.signal]) : deadline.signal;
                 }
-            };
-            return orchestrator.run({
-                onEvent: (event) => bus.publish(event),
-                onInteraction: (ctx2) => interactions.register(ctx2),
-                interactionTimeoutMs: loadConfig(repoRoot).global.interaction_timeout_ms,
-                threadId,
-                executionRoot,
-                // Native session continuity: resume each routed harness's own prior
-                // conversation in this thread; record new native ids for future turns.
-                resumeSessions: threadId ? threads.resumeMap(threadId) : undefined,
-                onSessionObserved: threadId
-                    ? (harnessId, nativeSessionId, observedModel) => threads.recordSession(threadId, harnessId, nativeSessionId, observedModel)
-                    : undefined,
-                authPreference: p.authPreference,
-                // Orchestrate autonomy (suggest/auto_safe/auto_full): consumed by the
-                // executor in runOrchestrate. The daemon also lends the executor a live
-                // answer-delivery service for answer_question steps (the engine does not
-                // own the interaction registry).
-                autonomy: p.autonomy,
-                answerInteraction: async (subRunId, interactionId, answers) => interactions.answer(subRunId, interactionId, answers).status === "delivered",
-                repoRoot,
-                prompt: String(p.prompt ?? ""),
-                // Attachments ride on the turn (resolved to scoped paths); a direct
-                // POST /runs without a turn resolves them here. Never base64 in jobs.json.
-                attachments: turnId
-                    ? (threads.getTurn(turnId)?.attachments ?? [])
-                    : resolveAttachments(p.attachments),
-                // Agent-driven browser opt-in (Playwright MCP). The orchestrator gates it
-                // on the harness's browser_tool capability + web policy != off.
-                browser: p.browser === true,
-                mode: p.mode,
-                contextMode: noProjectAsk
-                    ? "off"
-                    : p.scope.kind === "project"
-                        ? p.scope.context
+                return orchestrator
+                    .run({
+                    onEvent: (event) => {
+                        if (event.type === "harness.event") {
+                            const payload = event.payload;
+                            const harnessId = typeof payload["harness_id"] === "string" ? payload["harness_id"] : "";
+                            if (harnessId)
+                                quotaStoreSlot.current().ingest(harnessId, payload);
+                        }
+                        threads.recordRunEvent(p, event);
+                        bus.publish(event);
+                    },
+                    onInteraction: (ctx2) => interactions.register(ctx2, p),
+                    interactionTimeoutMs: loadConfig(repoRoot).global.interaction_timeout_ms,
+                    threadId,
+                    executionRoot,
+                    resumeSessions: threadId ? threads.resumeMap(threadId, requestedProfileId) : undefined,
+                    onSessionObserved: threadId
+                        ? (harnessId, nativeSessionId, observedModel, profileId) => 
+                        // The EVENT's profile is the cache truth (INV-135): rotation
+                        // makes the effective profile differ from the requested one,
+                        // and a mislabeled session would resume under the wrong
+                        // account on the next turn.
+                        threads.recordSession(threadId, harnessId, nativeSessionId, observedModel, profileId ?? null)
                         : undefined,
-                harnesses: p.harnesses,
-                primaryHarness: p.primaryHarness,
-                portfolio: p.portfolio,
-                n: p.n,
-                attempts: p.attempts ?? null,
-                untilClean: p.untilClean === true,
-                swarm: p.swarm === true,
-                create: p.create === true,
-                synthesis: p.synthesis,
-                // Policy from the GUI composer / API client (applied, not just displayed).
-                maxUsd: p.maxUsd ?? null,
-                maxToolCalls: p.maxToolCalls ?? null,
-                access: p.access,
-                web: p.web ?? p.externalContextPolicy,
-                externalContextPolicy: p.externalContextPolicy ?? p.web,
-                model: p.model,
-                models: p.models,
-                effort: p.effort,
-                tests: Array.isArray(p.tests) ? p.tests : undefined,
-                protectedPathApprovals: Array.isArray(p.protectedPathApprovals)
-                    ? p.protectedPathApprovals
-                    : undefined,
-                specId: typeof p.specId === "string" ? p.specId : undefined,
-                specHash: typeof p.specHash === "string" ? p.specHash : undefined,
-                specPath: typeof p.specPath === "string" ? p.specPath : undefined,
-                inPlace,
-                signal: ctx.signal,
-                onRunStart,
-            });
-        },
-    });
-    // SINGLETON GUARD FIRST: a second claudexord must refuse BEFORE crash GC —
-    // otherwise it would reap the LIVE daemon's recorded children and sweep
-    // envelopes its running jobs still own. server.start() re-checks (race-safe
-    // enough: the window between the probe and listen is milliseconds, and GC
-    // only runs when the probe found no live daemon).
-    if (await socketAlive(socketPath)) {
-        throw new Error(`a claudexor daemon is already listening on ${socketPath}; stop it first`);
-    }
-    // Crash GC before any new work (reap surviving children, sweep orphaned
-    // envelopes/branches/tmp-homes), then arm live-children bookkeeping and
-    // graceful SIGTERM/SIGINT shutdown.
-    await runStartupCrashGc({ daemonDir: daemonDir(), logPath: logPath() });
-    await server.start();
-    appendFileSync(logPath(), `[${new Date().toISOString()}] claudexord listening on ${socketPath}\n`);
-    const lifecycle = armDaemonLifecycle({
-        daemonDir: daemonDir(),
-        logPath: logPath(),
-        stop: () => server.stop(),
-    });
-    const control = process.env.CLAUDEXOR_NO_CONTROL_API === "1"
-        ? null
-        : new DaemonControlApiServer({
-            token,
-            daemon: new DaemonClient(socketPath, token),
-            port: Number(process.env.CLAUDEXOR_CONTROL_PORT ?? 0),
-            bus,
-            services: controlServices(interactions, threads),
+                    authPreference: p.authPreference,
+                    credentialProfileId: requestedProfileId,
+                    autonomy: p.autonomy,
+                    answerInteraction: async (subRunId, interactionId, answers) => interactions.answer(subRunId, interactionId, answers).status === "delivered",
+                    repoRoot,
+                    prompt: String(p.prompt ?? ""),
+                    instructions: typeof p.instructions === "string" ? p.instructions : undefined,
+                    denyPaths: Array.isArray(p.denyPaths) ? p.denyPaths : undefined,
+                    maxTurns: typeof p.maxTurns === "number" && p.maxTurns > 0 ? p.maxTurns : undefined,
+                    outputSchema: p.outputSchema && typeof p.outputSchema === "object" && !Array.isArray(p.outputSchema)
+                        ? p.outputSchema
+                        : undefined,
+                    attachments: turnId
+                        ? (threads.getTurn(turnId)?.attachments ?? [])
+                        : resources.resolve(p.attachments),
+                    browser: p.browser === true,
+                    mode: p.mode,
+                    contextMode: noProjectAsk
+                        ? "off"
+                        : p.scope.kind === "project"
+                            ? p.scope.context
+                            : undefined,
+                    harnesses: p.harnesses,
+                    primaryHarness: p.primaryHarness,
+                    routingGoal: p.routingGoal,
+                    n: p.n,
+                    attempts: p.attempts ?? null,
+                    untilClean: p.untilClean === true,
+                    swarm: p.swarm === true,
+                    create: p.create === true,
+                    synthesis: p.synthesis,
+                    paidBudget: p.paidBudget,
+                    maxToolCalls: p.maxToolCalls ?? null,
+                    access: p.access,
+                    web: p.web ?? p.externalContextPolicy,
+                    externalContextPolicy: p.externalContextPolicy ?? p.web,
+                    model: p.model,
+                    models: p.models,
+                    effort: p.effort,
+                    tests: Array.isArray(p.tests) ? p.tests : undefined,
+                    protectedPathApprovals: Array.isArray(p.protectedPathApprovals)
+                        ? p.protectedPathApprovals
+                        : undefined,
+                    specId: typeof p.specId === "string" ? p.specId : undefined,
+                    specHash: typeof p.specHash === "string" ? p.specHash : undefined,
+                    specPath: typeof p.specPath === "string" ? p.specPath : undefined,
+                    inPlace,
+                    signal: runSignal,
+                    onRunStart,
+                })
+                    .finally(() => {
+                    if (deadlineTimer)
+                        clearTimeout(deadlineTimer);
+                });
+            },
         });
-    if (control) {
-        const controlAddr = await control.start();
-        writeFileSync(join(daemonDir(), "control-api.json"), JSON.stringify({ ...controlAddr, tokenPath: join(daemonDir(), "token") }, null, 2) + "\n", { mode: 0o600 });
-        appendFileSync(logPath(), `[${new Date().toISOString()}] claudexor control-api listening on http://${controlAddr.host}:${controlAddr.port}\n`);
-    }
-    else {
-        appendFileSync(logPath(), `[${new Date().toISOString()}] claudexor control-api disabled by CLAUDEXOR_NO_CONTROL_API=1\n`);
-    }
-    await server.waitForShutdown();
-    await control?.stop();
-    lifecycle.finalize();
-    appendFileSync(logPath(), `[${new Date().toISOString()}] claudexord shut down\n`);
-    process.exit(0);
-}
-// Run-start normalization has exactly one owner (control-api); the socket
-// runner path delegates so scope/secret/absolute-root rules cannot drift.
-const normalizeDaemonRunStart = (raw) => normalizeRunStartRequest(raw);
-function projectRootFromScopedInput(p, purpose) {
-    if ("repoRoot" in p)
-        throw new Error("legacy repoRoot field is not accepted; use scope.kind=project with scope.root");
-    const scope = p["scope"];
-    if (!scope || typeof scope !== "object" || Array.isArray(scope))
-        throw new Error(`project scope is required for ${purpose}`);
-    const s = scope;
-    if (s["kind"] !== "project")
-        throw new Error(`project scope is required for ${purpose}`);
-    const root = typeof s["root"] === "string" ? s["root"].trim() : "";
-    if (!root)
-        throw new Error(`project scope root is required for ${purpose}`);
-    if (!isAbsolute(root))
-        throw new Error("project root must be an absolute path");
-    return root;
-}
-/** Deliver an isolated thread's accumulated worktree diff to its project. */
-async function applyThreadDiff(threads, id, opts) {
-    const thread = threads.getThread(id);
-    if (!thread)
-        throw Object.assign(new Error(`no such thread: ${id}`), { status: 404 });
-    const ws = thread.workspace;
-    if (ws.mode !== "isolated" || !ws.worktree_path || !thread.repo) {
-        throw Object.assign(new Error("thread has no isolated worktree to apply (in-place threads write the project directly)"), { status: 400 });
-    }
-    const projectRoot = thread.repo.root;
-    const base = ws.base_sha ?? "HEAD";
-    const patch = await diffStaged(ws.worktree_path, base);
-    if (!patch.trim())
-        return { applied: false, status: "empty", headMoved: false, detail: "no changes to apply" };
-    if (containsSecretLikeToken(patch))
-        return {
-            applied: false,
-            status: "rejected",
-            headMoved: false,
-            detail: "patch contains a secret-like token; refusing apply",
-        };
-    // Best-effort: did the PROJECT advance past where this thread branched? (a
-    // warning, not a blocker — git apply --3way still merges or fails loudly.)
-    let headMoved = false;
-    try {
-        const head = (await git(projectRoot, ["rev-parse", "HEAD"])).stdout.trim();
-        const mb = (await git(projectRoot, ["merge-base", "HEAD", base])).stdout.trim();
-        headMoved = mb !== "" && head !== "" && mb !== head;
-    }
-    catch {
-        /* best-effort */
-    }
-    const mode = (["apply", "branch", "commit", "pr"].includes(opts.mode) ? opts.mode : "apply");
-    const delivered = await deliver(projectRoot, patch, {
-        mode,
-        branch: opts.branch,
-        message: opts.message,
-    });
-    if (delivered.applied) {
-        // Re-base the thread on the new project state so the next apply diffs only new work.
-        threads.setThreadWorktree(id, ws.worktree_path, await snapshotTree(ws.worktree_path));
-    }
-    const status = !delivered.applied
-        ? "conflict"
-        : mode === "branch"
-            ? "branched"
-            : mode === "commit"
-                ? "committed"
-                : mode === "pr"
-                    ? "pr_opened"
-                    : "applied";
-    return { applied: delivered.applied, status, headMoved, detail: delivered.detail ?? null };
-}
-function controlServices(interactions, threads) {
-    const secretStore = new SecretStore();
-    const setupJobs = createSetupJobManager();
-    mkdirSync(NO_PROJECT_ROOT, { recursive: true, mode: 0o700 });
-    return {
-        createThread: async (input) => threads.createThread((input ?? {})),
-        listThreads: async () => ({ threads: threads.listThreads() }),
-        threadDetail: async (id) => {
-            const thread = threads.getThread(id);
-            if (!thread)
-                throw Object.assign(new Error(`no such thread: ${id}`), { status: 404 });
-            return {
-                thread: thread,
-                sessions: threads.sessionsForThread(id),
-                turns: threads.turnsFor(id),
-            };
-        },
-        createThreadTurn: async (id, prompt, opts) => threads.createTurn(id, prompt, {
-            kind: opts.kind,
-            parentRunId: opts.parentRunId,
-            planRunId: opts.planRunId,
-            attachments: resolveAttachments(opts.attachments),
-        }),
-        updateThread: async (id, patch) => threads.updateThread(id, {
-            title: patch.title,
-            state: patch.state,
-            primaryHarness: patch.primaryHarness,
-            eligibleHarnesses: patch.eligibleHarnesses,
-        }),
-        applyThread: async (id, opts) => applyThreadDiff(threads, id, opts),
-        setTurnEnqueueError: (turnId, message, code, retryable) => threads.setTurnEnqueueError(turnId, message, code, retryable ?? true),
-        // User-level trust surface (narrow by design): list per-repo trust files
-        // and grant/revoke ONE flag — the same file/writer `claudexor trust` owns.
-        listTrust: listTrustService,
-        updateTrust: updateTrustService,
-        pendingInteractions: (runId) => interactions.pendingForRun(runId),
-        answerInteraction: (runId, interactionId, answers) => interactions.answer(runId, interactionId, answers),
-        harnesses: async () => {
-            const statuses = await buildGateway({ includeFakes: false }).statusAll({
-                cwd: NO_PROJECT_ROOT,
-            });
-            // The doctor's configured-model truth check rides the status DTO
-            // so the UI renders the same honesty the CLI prints (never a green
-            // harness with a doomed configured model).
-            const cfg = loadConfig(NO_PROJECT_ROOT);
-            return {
-                harnesses: await Promise.all(statuses.map(async (s) => {
-                    const configured = cfg.global.harnesses[s.id]?.default_model ?? null;
-                    if (!configured)
-                        return { ...s, configuredModel: null, configuredModelCheck: null };
-                    const truth = await harnessModels(s.id, NO_PROJECT_ROOT, true);
-                    const check = validateModel(configured, truth.models.map((m) => m.id), truth.source === "api" ? "api" : "manifest");
-                    return { ...s, configuredModel: configured, configuredModelCheck: check };
-                })),
-            };
-        },
-        harnessModels: async (input) => harnessModels(input.harnessId, NO_PROJECT_ROOT),
-        // Derived catalog for external agents; same composer the CLI verb and the
-        // MCP tool use, so all three surfaces answer identically.
-        agentCapabilities: async () => buildAgentCapabilityCatalog(),
-        createSetupJob: async (input) => setupJobs.create(input),
-        listSetupJobs: async () => ({ jobs: setupJobs.list() }),
-        setupJobStatus: async (input) => setupJobs.status(input),
-        cancelSetupJob: async (input) => setupJobs.cancel(input),
-        confirmSetupJob: async (input) => setupJobs.confirm(input),
-        settings: async () => {
-            const cfg = loadConfig(NO_PROJECT_ROOT);
-            return {
-                sources: cfg.sources,
-                defaultPortfolio: cfg.global.default_portfolio,
-                interactionTimeoutMs: cfg.global.interaction_timeout_ms,
-                routing: {
-                    defaultPolicy: cfg.global.routing.default_policy,
-                    primaryHarness: cfg.global.routing.primary_harness,
-                    eligibleHarnesses: cfg.global.routing.eligible_harnesses,
-                    envInheritance: cfg.global.routing.env_inheritance,
-                    authPreference: cfg.global.routing.auth_preference,
-                },
-                budget: {
-                    maxUsdPerRun: cfg.global.budget.max_usd_per_run,
-                },
-                runtime: {
-                    reviewerTimeoutMs: cfg.global.runtime.reviewer_timeout_ms,
-                    harnessInactivityTimeoutMs: cfg.global.runtime.harness_inactivity_timeout_ms,
-                    transientRetry: {
-                        maxRetries: cfg.global.runtime.transient_retry.max_retries,
-                        initialDelayMs: cfg.global.runtime.transient_retry.initial_delay_ms,
-                        maxDelayMs: cfg.global.runtime.transient_retry.max_delay_ms,
-                    },
-                },
-                harnesses: Object.fromEntries(Object.entries(cfg.global.harnesses).map(([id, h]) => [
-                    id,
-                    {
-                        enabled: h.enabled,
-                        defaultModel: h.default_model,
-                        effort: h.effort,
-                        maxTurns: h.max_turns,
-                        maxRounds: h.max_rounds,
-                        maxUsd: h.max_usd,
-                        toolsAllow: h.tools_allow,
-                        toolsDeny: h.tools_deny,
-                        fallbackModel: h.fallback_model,
-                        web: h.web,
-                        authPreference: h.auth_preference,
-                    },
-                ])),
-            };
-        },
-        updateSettings: async (patch) => {
-            // FAIL LOUDLY on malformed patches: a typo'd field name or bad enum must
-            // surface as a 4xx, never be silently dropped.
-            const p = ControlSettingsUpdateRequest.parse(patch ?? {});
-            await assertSettingsPatchValid(p);
-            const nullableName = (value, current) => {
-                if (value === undefined)
-                    return current;
-                if (value === null)
-                    return null;
-                return value;
-            };
-            const updated = updateGlobalConfig((cfg) => ({
-                ...cfg,
-                default_portfolio: p.defaultPortfolio ?? cfg.default_portfolio,
-                interaction_timeout_ms: p.interactionTimeoutMs ?? cfg.interaction_timeout_ms,
-                routing: {
-                    ...cfg.routing,
-                    primary_harness: nullableName(p.primaryHarness, cfg.routing.primary_harness),
-                    default_policy: p.routingPolicy ?? cfg.routing.default_policy,
-                    env_inheritance: p.envInheritance ?? cfg.routing.env_inheritance,
-                    eligible_harnesses: p.eligibleHarnesses ?? cfg.routing.eligible_harnesses,
-                    auth_preference: p.authPreference ?? cfg.routing.auth_preference,
-                },
-                budget: {
-                    ...cfg.budget,
-                    max_usd_per_run: p.clearMaxUsdPerRun === true ? null : (p.maxUsdPerRun ?? cfg.budget.max_usd_per_run),
+        const authReadiness = new AuthReadinessService(buildGateway({ includeFakes: false }), {
+            cwd: NO_PROJECT_ROOT,
+        });
+        const setupBinding = new SetupLifecycleBinding(setupStoreSlot, (store) => createSetupJobManager({
+            rootDir: daemonDir(),
+            store,
+            onCredentialStateMayHaveChanged: (harness) => authReadiness.invalidate(harness),
+        }));
+        let control = null;
+        shutdownRuntime = new DaemonRuntimeShutdown({
+            daemon: server,
+            setup: setupBinding,
+            control: () => control,
+            journal: {
+                close: () => {
+                    if (quotaPollTimer)
+                        clearInterval(quotaPollTimer);
+                    threads.close();
+                    journalManager.close();
                 },
-                harnesses: applyHarnessSettingsPatches(cfg.harnesses, p.harnesses),
-            }));
-            // Routing/auth settings change harness readiness semantics: drop the
-            // doctor TTL cache so the next /harnesses reflects the new truth.
-            invalidateDoctorCache();
-            return updated;
-        },
-        listSecrets: async () => ({
-            backend: secretStore.resolvedBackend(),
-            secrets: secretStore.list(),
-        }),
-        setSecret: async (input) => {
-            const p = (input ?? {});
-            const name = typeof p["name"] === "string" ? p["name"] : "";
-            const value = typeof p["value"] === "string" ? p["value"] : "";
-            if (!name || !value)
-                throw new Error("name and value are required");
-            const backend = secretStore.set(name, value);
-            // A new key changes auth readiness immediately: drop the doctor TTL cache.
-            invalidateDoctorCache();
-            // Keychain->file degradation is disclosed, not silent (UI shows it).
-            return {
-                name,
-                backend,
-                stored: true,
-                ...(secretStore.lastFallbackReason ? { warning: secretStore.lastFallbackReason } : {}),
-            };
-        },
-        deleteSecret: async (name) => {
-            secretStore.delete(name);
-            // A removed key changes auth readiness immediately: drop the doctor cache.
-            invalidateDoctorCache();
-            return { name, deleted: true };
-        },
-        specQuestions: async (input) => {
-            const p = (input ?? {});
-            const prompt = typeof p["prompt"] === "string" ? p["prompt"] : "";
-            if (!prompt.trim())
-                throw new Error("prompt is required");
-            const repoRoot = projectRootFromScopedInput(p, "spec questions");
-            // Drive an interactive, CHOICE-BASED interview: the read-only grounding plan
-            // must end with a structured "## Open Questions" section that
-            // extractQuestionsFromPlan parses into single/multi/text questions with options.
-            // The instruction + its parser are a co-located contract pair in spec.ts.
-            // Prior tiers' answers: carried so each round goes DEEPER (adaptive interview).
-            const priorDecisions = Array.isArray(p["priorDecisions"])
-                ? p["priorDecisions"].filter((d) => !!d &&
-                    typeof d === "object" &&
-                    typeof d.question === "string" &&
-                    typeof d.answer === "string")
-                : [];
-            const plan = await new Orchestrator({ registry: buildRegistry() }).run({
-                repoRoot,
-                prompt: buildGroundingPrompt(prompt, priorDecisions),
-                mode: "plan",
-                harnesses: Array.isArray(p["harnesses"])
-                    ? p["harnesses"].filter((x) => typeof x === "string")
-                    : undefined,
-                access: "readonly",
+            },
+            log: (message) => logLine(logPath(), message),
+        });
+        // The daemon owns its services whether or not the HTTP surface is up —
+        // the startup retention pass below consumes them directly.
+        const selfClient = new DaemonClient(socketPath, token);
+        const services = controlServices(interactions, () => projectStoreSlot.current(), threads, setupBinding, journalManager, authReadiness, resources, () => quotaStoreSlot.current(), () => selfClient.list());
+        control =
+            process.env.CLAUDEXOR_NO_CONTROL_API === "1"
+                ? null
+                : new DaemonControlApiServer({
+                    token,
+                    daemon: new DaemonClient(socketPath, token),
+                    port: Number(process.env.CLAUDEXOR_CONTROL_PORT ?? 0),
+                    bus,
+                    services,
+                });
+        lifecycle = armDaemonLifecycle({
+            daemonDir: daemonDir(),
+            logPath: logPath(),
+            beginShutdown: (reason) => shutdownRuntime.beginShutdown(reason),
+        });
+        await setupBinding.start();
+        if (!shutdownRuntime.requested())
+            await server.start();
+        if (!shutdownRuntime.requested()) {
+            appendFileSync(logPath(), `[${new Date().toISOString()}] claudexord listening on ${socketPath}\n`);
+        }
+        if (control && !shutdownRuntime.requested()) {
+            const controlAddr = await control.start();
+            if (!shutdownRuntime.requested()) {
+                writeFileSync(join(daemonDir(), "control-api.json"), `${JSON.stringify({ ...controlAddr, tokenPath: join(daemonDir(), "token") }, null, 2)}\n`, { mode: 0o600 });
+                appendFileSync(logPath(), `[${new Date().toISOString()}] claudexor control-api listening on http://${controlAddr.host}:${controlAddr.port}\n`);
+            }
+        }
+        else if (!control && !shutdownRuntime.requested()) {
+            appendFileSync(logPath(), `[${new Date().toISOString()}] claudexor control-api disabled by CLAUDEXOR_NO_CONTROL_API=1\n`);
+        }
+        if (!shutdownRuntime.requested()) {
+            scheduleStartupRetention(services.runRetention, {
+                logPath: logPath(),
+                shuttingDown: () => shutdownRuntime.requested(),
             });
-            const planText = readTextSafe(join(plan.runDir, "final", "plan.md")) ?? plan.summary;
-            return {
-                planRunId: plan.runId,
-                planDir: plan.runDir,
-                questions: extractQuestionsFromPlan(planText),
-            };
-        },
-        specFreeze: async (input) => {
-            const p = (input ?? {});
-            const prompt = typeof p["prompt"] === "string" ? p["prompt"] : "";
-            const planDir = typeof p["planDir"] === "string" ? p["planDir"] : "";
-            const plan = typeof p["plan"] === "string"
-                ? p["plan"]
-                : (readTextSafe(join(planDir, "final", "plan.md")) ?? "");
-            if (!prompt.trim() || !plan.trim())
-                throw new Error("prompt and plan/planDir are required");
-            const repoRoot = projectRootFromScopedInput(p, "spec freeze");
-            // Forward the full SpecAnswersFile shape — not just answers — so a client that
-            // edited the draft's summary / criteria / non-goals / gates doesn't have them
-            // silently dropped from the frozen SpecPack. Fail LOUDLY on a malformed field
-            // (e.g. tests:[123]) rather than silently filtering it.
-            const strArr = (v, field) => {
-                if (v === undefined)
-                    return undefined;
-                if (!Array.isArray(v) || !v.every((x) => typeof x === "string")) {
-                    throw new Error(`spec freeze: "${field}" must be an array of strings`);
+        }
+        await shutdownRuntime.wait();
+        lifecycle.finalize();
+        appendFileSync(logPath(), `[${new Date().toISOString()}] claudexord shut down\n`);
+    }
+    catch (error) {
+        try {
+            appendFileSync(logPath(), `[${new Date().toISOString()}] daemon lifecycle FAILED: ${redactSecrets(error instanceof Error ? `${error.name}: ${error.message}` : String(error))}\n`);
+        }
+        catch {
+            /* preserve the lifecycle failure */
+        }
+        if (shutdownRuntime) {
+            try {
+                await shutdownRuntime.beginShutdown("startup failure");
+                lifecycle?.finalize();
+            }
+            catch (shutdownError) {
+                try {
+                    appendFileSync(logPath(), `[${new Date().toISOString()}] shutdown FAILED: ${redactSecrets(shutdownError instanceof Error ? shutdownError.message : String(shutdownError))}\n`);
                 }
-                return v;
-            };
-            const strOpt = (v, field) => {
-                if (v === undefined)
-                    return undefined;
-                if (typeof v !== "string")
-                    throw new Error(`spec freeze: "${field}" must be a string`);
-                return v;
-            };
-            // Schema-parse the answers at the wire boundary (Bible §3): a malformed item
-            // (missing/typed question_id, bad option_ids) fails loudly with a typed error,
-            // rather than slipping through an `as never[]` cast. Absent => no answers.
-            const answers = p["answers"] === undefined ? [] : InterviewAnswer.array().parse(p["answers"]);
-            // Multi-tier interview: prior-tier decisions are folded into decided_tradeoffs
-            // so the frozen SpecPack carries EVERY tier, not just the last one the client
-            // sent as `answers` (the v0.13 freeze-drops-prior-tiers bug, #8/#9).
-            const priorDecisions = Array.isArray(p["priorDecisions"])
-                ? p["priorDecisions"].filter((d) => !!d &&
-                    typeof d.question === "string" &&
-                    typeof d.answer === "string")
-                : [];
-            const priorLines = priorDecisions.map((d) => `Interview (prior tier) — ${d.question} → ${d.answer}`);
-            const explicitTradeoffs = strArr(p["decided_tradeoffs"], "decided_tradeoffs") ?? [];
-            const mergedTradeoffs = [...priorLines, ...explicitTradeoffs];
-            const spec = await freezeSpecFromGrounding(prompt, plan, {
-                answers,
-                summary: strOpt(p["summary"], "summary"),
-                success_criteria: strArr(p["success_criteria"], "success_criteria"),
-                non_goals: strArr(p["non_goals"], "non_goals"),
-                forbidden_approaches: strArr(p["forbidden_approaches"], "forbidden_approaches"),
-                // undefined-when-empty keeps single-tier behavior byte-identical.
-                decided_tradeoffs: mergedTradeoffs.length ? mergedTradeoffs : undefined,
-                tests: strArr(p["tests"], "tests"),
-            });
-            const persisted = persistSpec(repoRoot, spec, plan);
-            // specPath = the frozen SpecPack file an Implement run reads (a bare specId
-            // does not load content). Single producer; the layout matches persistSpec.
-            return {
-                specId: spec.id,
-                specDir: persisted.specDir,
-                specPath: join(persisted.specDir, "spec.json"),
-                specHash: persisted.specHash,
-                changes: persisted.changes,
-            };
-        },
-    };
+                catch {
+                    /* preserve the shutdown failure */
+                }
+                releaseWriterLease = false;
+                throw new AggregateError([error, shutdownError], "claudexord failed and could not complete shutdown");
+            }
+        }
+        throw error;
+    }
+    finally {
+        if (quotaPollTimer)
+            clearInterval(quotaPollTimer);
+        if (releaseWriterLease)
+            writerLease.release();
+    }
 }
 main().catch((err) => {
     process.stderr.write(`claudexord: ${err instanceof Error ? err.message : String(err)}\n`);
-    process.exit(1);
+    process.exitCode = 1;
 });
 //# sourceMappingURL=claudexord.js.map