@clearlysh/beehaven 0.8.27 → 0.8.30

package/dist/browser-login.js

@@ -93,10 +93,15 @@ async function warnIfLocalDevDown() {
  * Linux; start on Windows. Failure is SURFACED — silent failure was the bug — so the person can
  * paste the URL themselves.
  */
-function openInBrowser(url) {
+export function openInBrowser(url) {
     try {
-        const opener = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open';
-        const proc = spawn(opener, [url], { stdio: 'ignore', detached: true });
+        // ⚠ Windows: `start` is a cmd.exe BUILTIN, not a program, so spawning it always failed (ENOENT)
+        // and login fell back to "paste this URL". The URL protocol handler is a real executable, and
+        // passing the URL as an argv entry keeps cmd from splitting it at `&` (CAN2-56).
+        const [opener, args] = process.platform === 'darwin' ? ['open', [url]]
+            : process.platform === 'win32' ? ['rundll32.exe', ['url.dll,FileProtocolHandler', url]]
+                : ['xdg-open', [url]];
+        const proc = spawn(opener, args, { stdio: 'ignore', detached: true, windowsHide: true });
         proc.unref();
         proc.on('error', (err) => {
             console.log(`  ${color.yellow('!')} Couldn't auto-open browser: ${err.message}`);

package/dist/build-channel.js

@@ -53,9 +53,9 @@ export const PUBLIC_BUILD = true;
  * ⚠ REWRITTEN IN `dist/` AT BUILD TIME, like `PUBLIC_BUILD`. `unstamped` is what a source checkout
  * carries and what `tsx`/`vitest` see, and it is honest: nothing has stamped them.
  */
-export const BUILD_SHA = 'db2b3eaeb90b';
+export const BUILD_SHA = '2c7d78e7c945';
 /** ISO-8601 minute precision, UTC. Rewritten in `dist/` by `scripts/stamp-build-channel.mjs`. */
-export const BUILD_TIME = '2026-10-07T02:00Z';
+export const BUILD_TIME = '2026-10-13T06:00Z';
 /**
  * The build identity as one short string, for `--version`.
  *

package/dist/claude-bridge.js

@@ -15,12 +15,13 @@
  *   await bridge.callApp('recorder', 'record', { source: 'mic' });
  */
 import { createConnection } from 'net';
+import { request as httpRequest } from 'http';
 import { existsSync, readFileSync, readdirSync } from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
 import { EventEmitter } from 'events';
 import { activeAgentWrap } from './agent-attribution.js';
-const IPC_SOCKET_PATH = '/tmp/beehaven-ipc.sock';
+import { ipcSocketPath, watcherSocketPath, socketMayExist } from './ipc-path.js';
 const CONFIG_DIR = join(homedir(), '.beehaven');
 export class ClaudeBridge extends EventEmitter {
     socket = null;
@@ -39,11 +40,12 @@ export class ClaudeBridge extends EventEmitter {
     async connect() {
         if (this.connected)
             return true;
-        if (!existsSync(IPC_SOCKET_PATH))
+        const ipcPath = ipcSocketPath();
+        if (!socketMayExist(ipcPath))
             return false;
         return new Promise((resolve) => {
             const timeout = setTimeout(() => resolve(false), 5_000);
-            const socket = createConnection({ path: IPC_SOCKET_PATH });
+            const socket = createConnection({ path: ipcPath });
             this.socket = socket;
             socket.on('connect', () => {
                 this.connected = true;
@@ -198,11 +200,12 @@ export class ClaudeBridge extends EventEmitter {
     }
     // ── Internal ───────────────────────────────────────────────────────
     sendEvent(hookEvent, extra = {}) {
-        // Send via the watcher socket (HTTP POST to /tmp/beehaven.sock)
-        // This is the same protocol mwah uses.
-        if (!existsSync('/tmp/beehaven.sock'))
+        // Send via the watcher socket (HTTP POST to /event) — the same protocol mwah uses.
+        // ⚠ `http` is IMPORTED: this was `require('http')`, which is undefined in this ESM package,
+        // so every event threw a ReferenceError once the socket existed (CAN2-56).
+        const watcherPath = watcherSocketPath();
+        if (!socketMayExist(watcherPath))
             return;
-        const http = require('http');
         const body = JSON.stringify({
             hook_event_name: hookEvent,
             session_id: this.sessionId,
@@ -211,8 +214,8 @@ export class ClaudeBridge extends EventEmitter {
             source: 'claude-code',
             ...extra,
         });
-        const req = http.request({
-            socketPath: '/tmp/beehaven.sock',
+        const req = httpRequest({
+            socketPath: watcherPath,
             path: '/event',
             method: 'POST',
             headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) },

package/dist/clearly.js

@@ -26,6 +26,7 @@
  * product promises. GitHub / Linear / Slack ingestion is a separate project; nothing here
  * pretends otherwise, and `status` says so out loud.
  */
+import './windows-hide.js'; // FIRST: no console windows flashing on Windows (CAN2-56)
 import { execFileSync, spawnSync } from 'node:child_process';
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
@@ -47,11 +48,12 @@ const c = {
     red: (s) => `\x1b[31m${s}\x1b[0m`,
 };
 /**
- * ⚠ THE AGENT TURN IS THE SLOW PART AND THE CLI RELAY CAPS AT 180s. `RESPOND_TIMEOUT_MS` on the
- * server is the same 180s, so a turn that outlives this was going to be killed anyway — matching
- * them means a timeout here always means the same thing it means there.
+ * ⚠ THE AGENT JOB IS THE SLOW PART. The server's `RESPOND_TIMEOUT_MS` is 900s (WDP3-62);
+ * this waits that plus the report's tail, so a turn that finishes on time is never abandoned
+ * by its caller and a timeout here still means the turn itself ran out. The relay-forward window
+ * follows the `_timeout` sent with the call.
  */
-const TURN_MS = 180_000;
+export const TURN_MS = 930_000;
 /**
  * ⚠ STDERR IS CAPTURED, NOT INHERITED. A failing probe is normal here — `HEAD~30` does not exist in
  * a repo with two commits — and with inherited stderr git printed

package/dist/cli.js

@@ -16,6 +16,7 @@
 if (!process.env.BEEHAVEN_IPC_SCOPE) {
     process.env.BEEHAVEN_IPC_SCOPE = 'developer';
 }
+import './windows-hide.js'; // FIRST: no console windows flashing on Windows (CAN2-56)
 import { parseArgs } from 'node:util';
 import { devModeAvailable, buildLabel, PUBLIC_BUILD } from './build-channel.js';
 import { readFileSync, existsSync, mkdirSync, writeFileSync, readdirSync, } from 'fs';
@@ -448,8 +449,9 @@ ${DEV_ONLY_HELP ? `
 
   Note: if you also run the Hive menu-bar app, the tray is the
   primary owner of the daemon. CLI start/stop only act when the tray
-  isn't running its own daemon. The same socket (/tmp/beehaven-ipc.sock)
-  is shared in both modes — never two daemons at once.
+  isn't running its own daemon. The same socket (/tmp/beehaven-ipc.sock;
+  a per-user named pipe on Windows) is shared in both modes — never two
+  daemons at once.
 
   ─────────────────────────────────────────────────────────────────────
   OPTIONS
@@ -3171,11 +3173,10 @@ async function run() {
             console.log(`  Sign up at ${color.cyan(signupUrl)}.`);
             console.log('  Then run "beehaven login" to wire the CLI to your account.');
             console.log('');
-            try {
-                const { spawn } = await import('child_process');
-                spawn('open', [signupUrl], { stdio: 'ignore', detached: true }).unref();
-            }
-            catch { }
+            // The shared opener: per-platform (Windows has no `open`), and a spawn failure prints the
+            // URL instead of crashing on an unhandled child 'error' event.
+            const { openInBrowser } = await import('./browser-login.js');
+            openInBrowser(signupUrl);
             break;
         }
         case 'treehouse': {
@@ -3917,7 +3918,7 @@ complete -F _beehaven_completions beehaven`);
             console.log(`  ${r.url}`);
             // "reached" not "navigated": the frame goes to every connected surface but only the
             // VISIBLE one acts on it, so a count of sockets is not a count of things that moved.
-            console.log(color.dim(`  ${r.delivered > 0 ? `on screen (reached ${r.delivered} connected surface(s))` : 'no tab connected'}`));
+            console.log(color.dim(`  ${r.delivered > 0 ? `navigation requested (${r.delivered} connected surface(s)); editor display is not yet verified` : 'no navigation recipient connected'}`));
             // Only reach for the local browser when asked, or when nothing was
             // delivered — opening a window under someone who already has the tab
             // focused is worse than doing nothing.

package/dist/commands/daemon-cmd.js

@@ -42,6 +42,8 @@ export function spawnStandaloneDaemon(values) {
     const child = spawn(process.execPath, [entry], {
         detached: true,
         stdio: 'ignore',
+        // Windows: a detached child gets its OWN console window — closing it kills the daemon. Hide it.
+        windowsHide: true,
         // BEEHAVEN_HEADLESS=1 is REQUIRED, not optional: daemon-entry.ts runs a
         // parent-death watchdog (polls process.ppid, self-exits ~3s after the parent
         // is gone) to enforce the tray-coupled lifecycle. A detached CLI-spawned

package/dist/commands/workspace.js

@@ -26,7 +26,10 @@ import { resolveActiveAgent } from '../agent-state.js';
 import { isAgentRuntime } from '../agent-scope.js';
 import { getTarget } from '../cli-state.js';
 import { attachShellCwd, absorbShellCwd, shellTargetKey } from '../shell-session.js';
-export function getTimeout(values) {
+/** Workspace-agent jobs wait for the server's ceiling (900s) plus the report's tail. */
+export const AGENT_TURN_TIMEOUT_MS = 930_000;
+const AGENT_TURN_ACTIONS = new Set(['agent-prompt', 'agent-turn']);
+export function getTimeout(values, action) {
     // Precedence: explicit --timeout flag → BEEHAVEN_RPC_TIMEOUT_MS env → default.
     // The default is generous because real jobs (sticker-sheet gen, renders,
     // long agent turns) routinely run well past the old 30s and shouldn't need a
@@ -37,7 +40,8 @@ export function getTimeout(values) {
     const env = process.env.BEEHAVEN_RPC_TIMEOUT_MS;
     if (env && Number.isFinite(Number(env)) && Number(env) > 0)
         return parseInt(env, 10);
-    return 180_000;
+    // An agent job may run to the server's 900s ceiling (WDP3-62); waiting less abandons it.
+    return action && AGENT_TURN_ACTIONS.has(action) ? AGENT_TURN_TIMEOUT_MS : 180_000;
 }
 /**
  * True when `msg` says `action` isn't available on the target DO.
@@ -618,11 +622,24 @@ export async function cmdActions(values, positional) {
                 grouped.set(cat, []);
             grouped.get(cat).push(action);
         }
+        if (!values.verbose && !values.category && !values.search) {
+            for (const [category, entries] of grouped) {
+                console.log(`  ${category.padEnd(18)} ${String(entries.length).padStart(3)} actions · ${entries.slice(0, 3).map(a => a.name).join(', ')}${entries.length > 3 ? ', …' : ''}`);
+            }
+            console.log('');
+            console.log('  Find an action: beehaven actions --search <term>');
+            console.log('  List a category: beehaven actions --category <name>');
+            console.log('  Exact schema: beehaven explain <action>');
+            console.log('  Complete inventory: beehaven actions --verbose or --format full --json');
+            return;
+        }
         for (const [category, catActions] of grouped) {
             const catLabel = category.charAt(0).toUpperCase() + category.slice(1);
             console.log(`  \x1b[36m${catLabel}\x1b[0m (${catActions.length})`);
             for (const a of catActions) {
-                const desc = a.description ? `  \x1b[90m${a.description}\x1b[0m` : '';
+                const description = String(a.description || '');
+                const display = values.verbose || description.length <= 160 ? description : `${description.slice(0, 157)}…`;
+                const desc = display ? `  \x1b[90m${display}\x1b[0m` : '';
                 const aliasLabel = Array.isArray(a.aliases) && a.aliases.length > 0
                     ? `  \x1b[2m(also: ${a.aliases.join(', ')})\x1b[0m`
                     : '';
@@ -1088,7 +1105,7 @@ export async function cmdCall(action, rawInput, values) {
         console.error(`\x1b[2m→ ${target}  ${action}${who}\x1b[0m`);
     }
     try {
-        const raw = await rpcOnce(resolved.action, resolved.input, getTimeout(values));
+        const raw = await rpcOnce(resolved.action, resolved.input, getTimeout(values, action));
         // Unwrap proxy envelope: admin:*-rpc wraps results in { type: 'ack', result: ... }
         const result = raw?.type === 'ack' && raw?.result !== undefined
             ? raw.result
@@ -3090,7 +3107,7 @@ export async function cmdAgent(prompt, values) {
                 : {}),
         }, 
         // Omni runs tools; the CLI default is far too short for a real turn.
-        getTimeout(values) || 180_000);
+        getTimeout(values, 'agent-turn'));
         /**
          * Print the REPLY, not the envelope. The whole response is still available
          * with `--json` — but a verb whose entire purpose is "ask a question and read

package/dist/daemon-client.js

@@ -15,17 +15,16 @@
  *   }
  */
 import net from 'net';
-import { existsSync } from 'fs';
 import { resolveClientAuthToken } from './ipc-auth.js';
 import { activeAgentWrap } from './agent-attribution.js';
-const SOCKET_PATH = '/tmp/beehaven-ipc.sock';
+import { ipcSocketPath, socketMayExist } from './ipc-path.js';
 const TIMEOUT_MS = 60_000;
 const AUTH_TIMEOUT_MS = 3_000;
 /** One attempt. Resolves, never rejects. */
 function probeOnce(deadlineMs) {
     return new Promise((resolve) => {
         let connected = false;
-        const sock = net.createConnection(SOCKET_PATH);
+        const sock = net.createConnection(ipcSocketPath());
         const timer = setTimeout(() => {
             sock.destroy();
             // ⚠ CONNECTED-BUT-SILENT IS NOT "DOWN". The kernel accepted us, so a listener exists.
@@ -65,7 +64,7 @@ const PROBE_BACKOFF_MS = 150;
  * that "down" is the original defect.
  */
 export async function probeDaemon() {
-    if (!existsSync(SOCKET_PATH))
+    if (!socketMayExist(ipcSocketPath()))
         return { state: 'down', attempts: 0 };
     let sawListener = false;
     let last = { state: 'down', attempts: 0 };
@@ -74,6 +73,11 @@ export async function probeDaemon() {
         last = { ...r, attempts: i };
         if (r.state === 'up')
             return last;
+        // Nothing at the address (no socket file, or no such Windows pipe): permanent, like the
+        // missing-file check above — a named pipe cannot be checked before connecting, so this is
+        // where "nothing is running" is learned on Windows. Retrying would only add ~300 ms.
+        if (r.code === 'ENOENT' && !sawListener)
+            return last;
         if (r.state === 'silent')
             sawListener = true;
         if (i < PROBE_ATTEMPTS)
@@ -165,7 +169,7 @@ function handshake(socket) {
                          * ⚠ `start --headless` NOW WAITS for the socket (see `daemon-cmd.ts`), so a script
                          * that uses it should no longer reach this at all.
                          */
-                        (existsSync(SOCKET_PATH)
+                        (socketMayExist(ipcSocketPath())
                             ? 'The daemon is still starting — its socket is up but it has not minted an IPC token yet. ' +
                                 'Wait a second and retry. (Do NOT restart: `stop` scrubs the token, which re-enters this window.)'
                             : 'No IPC auth token and no daemon socket — nothing is running. ' +
@@ -192,7 +196,7 @@ function handshake(socket) {
 }
 /** Open a socket, complete auth handshake, run a single request, close. */
 async function withSocket(fn) {
-    const socket = net.createConnection(SOCKET_PATH);
+    const socket = net.createConnection(ipcSocketPath());
     await new Promise((resolve, reject) => {
         socket.once('connect', () => resolve());
         socket.once('error', reject);

package/dist/daemon-entry.js

@@ -23,6 +23,7 @@
  *     startup errors (those usually need user intervention — expired token,
  *     missing config, etc).
  */
+import './windows-hide.js'; // FIRST: no console windows flashing on Windows (CAN2-56)
 import { startDaemon } from './daemon.js';
 // ── Parent-watcher (tray-coupled enforcement) ──
 // The daemon is documented as tray-coupled: it must not outlive the

package/dist/daemon-process.js

@@ -0,0 +1,125 @@
+/**
+ * daemon-process — "is this process a beehaven daemon?", on every platform (CAN2-56).
+ *
+ * Split out of `daemon.ts` so the rule is testable without importing the daemon, and so Windows has
+ * an answer at all: `findLiveDaemons` read a command line with `ps` (macOS) or `/proc/<pid>/cmdline`
+ * (Linux) and found orphans with `pgrep`. Windows has none of those, so every lookup threw, was
+ * swallowed as "not ours", and `stop` / `restart` / the single-instance guard never saw a running
+ * daemon. Windows reads command lines from one CIM query instead.
+ */
+import { execFileSync } from 'child_process';
+/**
+ * Whether a full command line is a beehaven daemon or CLI process.
+ *
+ * Strict two-condition test (unchanged on macOS/Linux):
+ *   1. argv[0] is a node/tsx/beehaven binary — not a shell, an editor, a grep, etc.;
+ *   2. a later argument is a beehaven cli/daemon-entry script (under a beehaven* directory OR a
+ *      Clearly*.app bundle).
+ *
+ * ⚠ WINDOWS COMMAND LINES ARE NORMALISED FIRST: argv[0] arrives quoted with backslashes, spaces and
+ * an extension (`"C:\Program Files\nodejs\node.exe" C:\…\daemon-entry.js`). It is reduced to the
+ * Unix shape (`C:/Program_Files/nodejs/node …`) so the same two conditions apply, unquoted.
+ */
+export function isBeehavenCommandLine(raw, platform = process.platform) {
+    let cmd = (raw ?? '').trim();
+    if (!cmd)
+        return false;
+    if (platform === 'win32') {
+        const m = /^"([^"]*)"\s*(.*)$/s.exec(cmd) ?? /^(\S+)\s*(.*)$/s.exec(cmd);
+        if (!m)
+            return false;
+        const argv0 = m[1].replace(/\\/g, '/').replace(/\.(exe|cmd)$/i, '').replace(/\s+/g, '_').toLowerCase();
+        cmd = `${argv0} ${m[2].replace(/"/g, '')}`.trim();
+    }
+    // Condition 1: argv[0] must be a node/tsx/beehaven-wrapper binary. Anchored with ^ so a shell
+    // running a heredoc that contains "node .../cli.js" deeper in its argv doesn't false-positive.
+    const argv0Ok = /^(\S*\/)?node(\s|$)/.test(cmd) ||
+        /^(\S*\/)?tsx(\s|$)/.test(cmd) ||
+        /^(\S*\/)?beehaven(\s|$)/.test(cmd);
+    if (!argv0Ok)
+        return false;
+    // ⚠⚠ ON WINDOWS ONLY THE DAEMON ENTRY COUNTS. The `cli.js` patterns below exist for LEGACY daemons
+    // (`node cli.js start`, before daemon-entry.js) — and on macOS `pgrep` never surfaced ordinary CLI
+    // runs anyway (it reads its pattern as a BASIC regex, where `(js|ts)` matches nothing). Windows
+    // lists every node process, so with them a `start --headless` parent waiting for its child was
+    // "another daemon" (the child refused to start — the second Windows CI run), and `stop` would
+    // have killed an agent's in-flight `beehaven call`. There are no legacy Windows daemons to find.
+    if (platform === 'win32')
+        return /[/\\]\.?beehaven([-_]sdk)?[/\\].*daemon-entry\.(js|ts)\b/.test(cmd);
+    // Condition 2: a subsequent argument must reference a beehaven script.
+    //
+    // NOTE THE `\.?` — the directory may be `beehaven/` OR the DOTFILE `.beehaven/`. And `[-_]sdk`:
+    // the monorepo checkout is `beehaven_sdk/`, but a clone of the GitHub repo is `beehaven-sdk/` —
+    // the first Windows CI run could not find its own daemon for exactly that reason (CAN2-56).
+    // `public/install.sh` installs to `~/.beehaven/cli/`, the canonical location for every
+    // `curl … | sh` user; requiring exactly "beehaven" once made the CLI blind to its own standard
+    // install (`stop` said "No daemon running" while one was).
+    return (
+    // Dedicated daemon entry — what the Mac app tray and `start --headless` spawn.
+    /[/\\]\.?beehaven([-_]sdk)?[/\\].*daemon-entry\.(js|ts)\b/.test(cmd) ||
+        /Clearly[^/\\]*\.app[/\\]Contents[/\\]Resources[/\\]beehaven[/\\]daemon-entry\.js\b/.test(cmd) ||
+        // Legacy `cli.js start` — for old bundles pre-dating daemon-entry.js.
+        /[/\\]\.?beehaven([-_]sdk)?[/\\].*cli\.(js|ts)\b/.test(cmd) ||
+        /Clearly[^/\\]*\.app[/\\]Contents[/\\]Resources[/\\]beehaven[/\\]cli\.js\b/.test(cmd) ||
+        // Bare `beehaven start` — wrapper already matched argv[0].
+        /^(\S*\/)?beehaven\s+start\b/.test(cmd));
+}
+/** Parse `ConvertTo-Json` output of `{ProcessId, CommandLine}` rows (one object, or an array). */
+export function parseWindowsProcessJson(out) {
+    const text = (out ?? '').trim();
+    if (!text)
+        return [];
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return [];
+    }
+    const rows = Array.isArray(parsed) ? parsed : [parsed];
+    const result = [];
+    for (const r of rows) {
+        const pid = Number(r?.ProcessId);
+        if (Number.isFinite(pid) && pid > 0)
+            result.push([pid, typeof r?.CommandLine === 'string' ? r.CommandLine : '']);
+    }
+    return result;
+}
+/**
+ * Node processes on Windows with their command lines — one `Get-CimInstance` call (~0.5–1 s, so it
+ * runs only on start/stop/status paths, never per RPC). `pid` narrows it to one process.
+ * Returns `null` when the query itself failed (no PowerShell, blocked by policy, timed out) — which
+ * is NOT the same as "no node processes", and `selectWindowsDaemons` treats it differently.
+ */
+export function windowsNodeProcesses(pid) {
+    const filter = pid ? `ProcessId=${Math.trunc(pid)}` : "Name='node.exe'";
+    const script = `Get-CimInstance Win32_Process -Filter "${filter}" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress`;
+    try {
+        const out = execFileSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: 8000,
+            windowsHide: true,
+        });
+        return parseWindowsProcessJson(out);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Which of these Windows processes are beehaven daemons (never this process).
+ *
+ * ⚠ WHEN THE PROCESS QUERY FAILED (`rows === null`), THE PID FILE IS THE ONLY WITNESS LEFT. Seeing
+ * nothing would make `stop` say "No daemon running" over a live one and let `start` spawn a second
+ * daemon beside it — the failure the first Windows CI run showed. A live process at the recorded
+ * PID is trusted then, and only then: with a working query, the command line decides, so a PID
+ * recycled by an unrelated program is never taken for the daemon.
+ */
+export function selectWindowsDaemons(rows, opts) {
+    if (rows === null) {
+        const p = opts.pidFilePid;
+        return p && p > 0 && p !== opts.selfPid && opts.isAlive(p) ? [p] : [];
+    }
+    return rows.filter(([pid, cmd]) => pid !== opts.selfPid && isBeehavenCommandLine(cmd, 'win32')).map(([pid]) => pid);
+}

package/dist/daemon.js

@@ -13,6 +13,8 @@ import { DaemonRepl } from './repl.js';
 import { browsePath } from './file-browser.js';
 import { CloudBeeProxy } from './bee/cloud-proxy.js';
 import { IpcServer, probeIpcSocket } from './ipc-server.js';
+import { ipcSocketPath } from './ipc-path.js';
+import { isBeehavenCommandLine, windowsNodeProcesses, selectWindowsDaemons } from './daemon-process.js';
 import { mintIpcAuthTokens, clearIpcAuthToken } from './ipc-auth.js';
 /**
  * What THIS daemon minted, so shutdown can avoid scrubbing a successor's token.
@@ -1104,41 +1106,17 @@ function isBeehavenProcess(pid) {
                 timeout: 3000,
             }).trim();
         }
+        else if (process.platform === 'win32') {
+            // No `ps` and no /proc on Windows: read the command line from CIM (CAN2-56).
+            cmd = windowsNodeProcesses(pid)?.find(([p]) => p === pid)?.[1] ?? '';
+        }
         else {
             // Linux: /proc/PID/cmdline uses NULs; normalize to spaces
             cmd = readFileSync(`/proc/${pid}/cmdline`, 'utf8').replace(/\0/g, ' ').trim();
         }
-        if (!cmd)
-            return false;
-        // Condition 1: argv[0] must be a node/tsx/beehaven-wrapper binary.
-        // Anchoring with ^ so a shell running a heredoc that contains
-        // "node .../cli.js" deeper in its argv doesn't false-positive.
-        const argv0Ok = /^(\S*\/)?node(\s|$)/.test(cmd) ||
-            /^(\S*\/)?tsx(\s|$)/.test(cmd) ||
-            /^(\S*\/)?beehaven(\s|$)/.test(cmd);
-        if (!argv0Ok)
-            return false;
-        // Condition 2: a subsequent argument must reference a beehaven script.
-        //
-        // NOTE THE `\.?` — the directory may be `beehaven/` OR the DOTFILE
-        // `.beehaven/`. `public/install.sh` installs to `~/.beehaven/cli/`, which is
-        // the canonical location for every `curl … | sh` user, and these patterns
-        // used to require a path segment of exactly "beehaven". So the CLI could not
-        // recognise its OWN standard install: `stop` reported "No daemon running"
-        // while one was running, `restart` printed a fresh PID whose process then
-        // died with "Refusing to start — IPC socket already serving connections",
-        // and the real daemon was effectively unkillable from the CLI. Only
-        // monorepo (`beehaven_sdk/`) and Mac-app installs were ever detected.
-        const scriptOk = 
-        // Dedicated daemon entry — what the Mac app tray spawns.
-        /[/\\]\.?beehaven(_sdk)?[/\\].*daemon-entry\.(js|ts)\b/.test(cmd) ||
-            /Clearly[^/\\]*\.app[/\\]Contents[/\\]Resources[/\\]beehaven[/\\]daemon-entry\.js\b/.test(cmd) ||
-            // Legacy `cli.js start` — for old bundles pre-dating daemon-entry.js.
-            /[/\\]\.?beehaven(_sdk)?[/\\].*cli\.(js|ts)\b/.test(cmd) ||
-            /Clearly[^/\\]*\.app[/\\]Contents[/\\]Resources[/\\]beehaven[/\\]cli\.js\b/.test(cmd) ||
-            // Bare `beehaven start` — wrapper already matched argv[0].
-            /^(\S*\/)?beehaven\s+start\b/.test(cmd);
-        return scriptOk;
+        // The two-condition rule (argv[0] is node/tsx/beehaven AND an argument is a beehaven script)
+        // lives in daemon-process.ts, where it also understands Windows command lines.
+        return isBeehavenCommandLine(cmd);
     }
     catch {
         return false; // Can't read → not our process or already dead
@@ -1151,6 +1129,23 @@ function isBeehavenProcess(pid) {
  */
 export function findLiveDaemons() {
     const found = new Set();
+    // Windows: no PID-file trust without a command line, and no pgrep — ONE CIM query of node
+    // processes answers both "is the PID file's process ours" and "are there orphans" (CAN2-56).
+    if (process.platform === 'win32') {
+        let pidFilePid = null;
+        try {
+            pidFilePid = existsSync(PID_FILE) ? parseInt(readFileSync(PID_FILE, 'utf8').trim(), 10) || null : null;
+        }
+        catch { }
+        const alive = (pid) => { try {
+            process.kill(pid, 0);
+            return true;
+        }
+        catch {
+            return false;
+        } };
+        return selectWindowsDaemons(windowsNodeProcesses(), { selfPid: process.pid, pidFilePid, isAlive: alive });
+    }
     // 1. Check PID file first — the canonical source.
     if (existsSync(PID_FILE)) {
         try {
@@ -1294,7 +1289,7 @@ export async function startDaemon(opts) {
     // live server answering here means some daemon is alive that findLiveDaemons
     // missed (e.g. different binary path, permissions edge case).
     if (await probeIpcSocket()) {
-        console.error(`\n  ✗ Another beehaven daemon is listening on /tmp/beehaven-ipc.sock.`);
+        console.error(`\n  ✗ Another beehaven daemon is listening on ${ipcSocketPath()}.`);
         console.error(`  ✗ Quit the Clearly Dev Mac app tray to stop the existing daemon, then restart.\n`);
         try {
             logger.error('daemon', 'Refusing to start — IPC socket already serving connections');

package/dist/ipc-auth.js

@@ -2,7 +2,9 @@
  * IPC auth — scope-aware shared secrets between daemon and local clients.
  *
  * Threat model: any process running as the same user can connect to
- * /tmp/beehaven-ipc.sock (it's chmod 0600, which only restricts other users).
+ * /tmp/beehaven-ipc.sock (it's chmod 0600, which only restricts other users). On
+ * Windows the daemon listens on a per-user named pipe, which has no file mode at all — so on
+ * that platform these tokens ARE the boundary for same-user callers (ipc-path.ts).
  * Without per-scope auth, any same-user process can invoke privileged
  * verbs — extract the Firebase ID token via `get-token`, run arbitrary
  * SQL, install marketplace packages with code execution.

package/dist/ipc-client.js

@@ -4,14 +4,15 @@
  * Used by CLI commands (actions, call, pipe, watch, ls, cat) to communicate
  * with the running daemon, which forwards requests to the cloud DO.
  *
- * Protocol: newline-delimited JSON over /tmp/beehaven-ipc.sock
+ * Protocol: newline-delimited JSON over /tmp/beehaven-ipc.sock (a named pipe on Windows — ipc-path.ts)
  */
-import { existsSync } from 'node:fs';
 import { createConnection } from 'net';
 import { EventEmitter } from 'events';
 import { resolveClientAuthToken } from './ipc-auth.js';
+import { ipcSocketPath, socketMayExist } from './ipc-path.js';
 import { activeAgentWrap } from './agent-attribution.js';
-const IPC_SOCKET_PATH = '/tmp/beehaven-ipc.sock';
+/** The default address (Unix socket, or this user's named pipe on Windows) — see `ipc-path.ts`. */
+const IPC_SOCKET_PATH = ipcSocketPath();
 /** Default timeout for RPC calls (ms) */
 const DEFAULT_TIMEOUT = 30_000;
 /**
@@ -49,7 +50,7 @@ export class IpcClient extends EventEmitter {
          * — the only way to guard the CALL SITE rather than the helper it calls, which is the exact
          * distinction that let 28 verbs ship un-attributed. Unset, nothing changes.
          */
-        this.socketPath = opts?.socketPath ?? process.env.BEEHAVEN_IPC_SOCKET ?? IPC_SOCKET_PATH;
+        this.socketPath = opts?.socketPath ?? ipcSocketPath(); // honours $BEEHAVEN_IPC_SOCKET
         this.defaultTimeout = opts?.timeout ?? DEFAULT_TIMEOUT;
         this.explicitAuthToken = opts?.authToken;
     }
@@ -113,7 +114,7 @@ export class IpcClient extends EventEmitter {
                                 ? resolveClientAuthToken()
                                 : this.explicitAuthToken;
                             let token = readToken();
-                            if (!token && this.explicitAuthToken === undefined && existsSync(this.socketPath)) {
+                            if (!token && this.explicitAuthToken === undefined && socketMayExist(this.socketPath)) {
                                 const deadline = Date.now() + TOKEN_MINT_WAIT_MS;
                                 while (!token && Date.now() < deadline) {
                                     /**
@@ -143,7 +144,7 @@ export class IpcClient extends EventEmitter {
                                  * ⚠ THE SOCKET IS THE DISCRIMINATOR: up means "still starting, wait"; absent
                                  * means "nothing is running, start one". Opposite actions.
                                  */
-                                (existsSync(this.socketPath)
+                                (socketMayExist(this.socketPath)
                                     ? 'The daemon is still starting — its socket is up but it has not minted an IPC token yet. ' +
                                         'Wait a second and retry. (Do NOT restart: `stop` scrubs the token, which re-enters this window.)'
                                     : 'No IPC auth token and no daemon socket — nothing is running. ' +