@clearlysh/beehaven 0.8.29 → 0.8.31

package/dist/daemon.js

@@ -13,6 +13,8 @@ import { DaemonRepl } from './repl.js';
 import { browsePath } from './file-browser.js';
 import { CloudBeeProxy } from './bee/cloud-proxy.js';
 import { IpcServer, probeIpcSocket } from './ipc-server.js';
+import { ipcSocketPath } from './ipc-path.js';
+import { isBeehavenCommandLine, windowsNodeProcesses, selectWindowsDaemons } from './daemon-process.js';
 import { mintIpcAuthTokens, clearIpcAuthToken } from './ipc-auth.js';
 /**
  * What THIS daemon minted, so shutdown can avoid scrubbing a successor's token.
@@ -44,6 +46,7 @@ import { homedir, tmpdir } from 'os';
 import { join, dirname, relative } from 'path';
 import { fileURLToPath } from 'url';
 import { compareVersions, usableUpdateDigest } from './version-utils.js';
+import { npmUpdatePlan, installNpmVersion } from './npm-update.js';
 import { installKind } from './commands/self-update.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const CONFIG_DIR = join(homedir(), '.beehaven');
@@ -961,9 +964,85 @@ function updatesAreManagedExternally() {
  *
  * ⚠ NOTHING ELSE CALLS IT. The daemon's timer is still the only production caller.
  */
+/** Said once per daemon, not hourly — see the managed-updates note below. */
+let announcedNpmUpdateBlocked = false;
+/**
+ * Start the freshly installed version and leave (shared by the curl and npm update paths).
+ * A CLI-spawned headless daemon is detached, with no supervisor to interpret exit 75, so it starts
+ * the new entry in a helper that waits until this process releases the IPC socket.
+ */
+async function restartForUpdate() {
+    if (process.env.BEEHAVEN_CLI_OWNED_DAEMON === '1') {
+        const child = spawn(process.execPath, [join(__dirname, 'daemon-entry.js'), '--restart-after-update', String(process.pid)], {
+            detached: true,
+            stdio: 'ignore',
+            env: process.env,
+        });
+        child.on('error', (error) => console.error(`  [update] Restart helper failed: ${error.message}`));
+        if (!child.pid)
+            throw new Error('could not start update restart helper');
+        child.unref();
+    }
+    if (daemonRelay?.isConnected())
+        await new Promise((r) => setTimeout(r, 500));
+    process.exit(75);
+}
+/**
+ * ⚠⚠ npm INSTALLS (THE ONLY WINDOWS INSTALL) NEVER AUTO-UPDATED (CAN2-57). This routine re-ran the
+ * bash installer, so it skipped every npm install and a Windows user stayed on their first version.
+ * They now update with npm itself — to the version the release manifest names (stable only) — when
+ * this copy IS npm's global install and its folder is writable; otherwise one line says why and
+ * what to run. No rollback file: `install.sh` cannot reinstall an npm package; a bad release is
+ * undone with `npm install -g @clearlysh/beehaven@<previous>`.
+ */
+async function checkAndAutoUpdateNpm() {
+    // A headless daemon's stdout goes nowhere, so the update story also goes to daemon.log.
+    const say = (m, level = 'info') => {
+        (level === 'error' ? console.error : console.log)(`  [update] ${m}`);
+        try {
+            logger[level]('daemon', `[update] ${m}`);
+        }
+        catch { /* logging never blocks an update */ }
+    };
+    try {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), 5000);
+        const res = await fetch(LATEST_MANIFEST, { signal: controller.signal });
+        clearTimeout(timeout);
+        if (!res.ok)
+            return;
+        const latest = (await res.json())?.version;
+        if (typeof latest !== 'string')
+            return;
+        const current = getCurrentVersion();
+        if (compareVersions(latest, current) <= 0)
+            return;
+        const plan = npmUpdatePlan(join(__dirname, '..'));
+        if (!plan.ok) {
+            if (!announcedNpmUpdateBlocked) {
+                announcedNpmUpdateBlocked = true;
+                say(`${latest} is available, but this npm install cannot update itself: ${plan.reason}. Run: npm install -g @clearlysh/beehaven@latest`);
+            }
+            return;
+        }
+        say(`Updating ${current} → ${latest} with npm...`);
+        const r = await installNpmVersion(plan, latest);
+        if (!r.ok)
+            throw new Error(r.message);
+        if (getCurrentVersion() !== latest)
+            throw new Error(`npm did not install ${latest}`);
+        say(`Updated to v${latest} — restarting...`);
+        await restartForUpdate();
+    }
+    catch (error) {
+        say(`Update failed: ${error?.message ?? error}`, 'error');
+    }
+}
 export async function checkAndAutoUpdate() {
     const owner = updatesAreManagedExternally();
     const runningKind = installKind(join(__dirname, 'daemon-entry.js'));
+    if (!owner && runningKind === 'npm')
+        return checkAndAutoUpdateNpm();
     if (owner || runningKind !== 'user') {
         // Said once at startup, not hourly — a line every hour about a thing that is working as
         // designed is how a log stops being read.
@@ -1015,19 +1094,6 @@ export async function checkAndAutoUpdate() {
             throw new Error(`installer did not install ${latest}`);
         }
         console.log(`  [update] Updated to v${latest} — restarting...`);
-        if (process.env.BEEHAVEN_CLI_OWNED_DAEMON === '1') {
-            // A CLI-spawned headless daemon is detached, with no supervisor to interpret exit 75.
-            // Start the new entry in a helper that waits until this process releases the IPC socket.
-            const child = spawn(process.execPath, [join(__dirname, 'daemon-entry.js'), '--restart-after-update', String(process.pid)], {
-                detached: true,
-                stdio: 'ignore',
-                env: process.env,
-            });
-            child.on('error', (error) => console.error(`  [update] Restart helper failed: ${error.message}`));
-            if (!child.pid)
-                throw new Error('could not start update restart helper');
-            child.unref();
-        }
         // Drop the temp tarball BEFORE exiting. `process.exit` skips `finally`,
         // so cleaning up only there would leak the whole release into /tmp on every
         // SUCCESSFUL update — the one path that always runs.
@@ -1044,13 +1110,9 @@ export async function checkAndAutoUpdate() {
             catch { }
             installerPath = null;
         }
-        // Give relay a moment to flush
-        if (daemonRelay?.isConnected()) {
-            await new Promise((r) => setTimeout(r, 500));
-        }
-        // Exit with non-zero so launchd/systemd restarts with the new version
-        // (KeepAlive > SuccessfulExit > false means exit 0 stays down)
-        process.exit(75);
+        // Start the new version and exit non-zero, so launchd/systemd also restarts with it
+        // (KeepAlive > SuccessfulExit > false means exit 0 stays down).
+        await restartForUpdate();
     }
     catch (error) {
         console.error(`  [update] Update failed: ${error?.message ?? error}`);
@@ -1104,41 +1166,17 @@ function isBeehavenProcess(pid) {
                 timeout: 3000,
             }).trim();
         }
+        else if (process.platform === 'win32') {
+            // No `ps` and no /proc on Windows: read the command line from CIM (CAN2-56).
+            cmd = windowsNodeProcesses(pid)?.find(([p]) => p === pid)?.[1] ?? '';
+        }
         else {
             // Linux: /proc/PID/cmdline uses NULs; normalize to spaces
             cmd = readFileSync(`/proc/${pid}/cmdline`, 'utf8').replace(/\0/g, ' ').trim();
         }
-        if (!cmd)
-            return false;
-        // Condition 1: argv[0] must be a node/tsx/beehaven-wrapper binary.
-        // Anchoring with ^ so a shell running a heredoc that contains
-        // "node .../cli.js" deeper in its argv doesn't false-positive.
-        const argv0Ok = /^(\S*\/)?node(\s|$)/.test(cmd) ||
-            /^(\S*\/)?tsx(\s|$)/.test(cmd) ||
-            /^(\S*\/)?beehaven(\s|$)/.test(cmd);
-        if (!argv0Ok)
-            return false;
-        // Condition 2: a subsequent argument must reference a beehaven script.
-        //
-        // NOTE THE `\.?` — the directory may be `beehaven/` OR the DOTFILE
-        // `.beehaven/`. `public/install.sh` installs to `~/.beehaven/cli/`, which is
-        // the canonical location for every `curl … | sh` user, and these patterns
-        // used to require a path segment of exactly "beehaven". So the CLI could not
-        // recognise its OWN standard install: `stop` reported "No daemon running"
-        // while one was running, `restart` printed a fresh PID whose process then
-        // died with "Refusing to start — IPC socket already serving connections",
-        // and the real daemon was effectively unkillable from the CLI. Only
-        // monorepo (`beehaven_sdk/`) and Mac-app installs were ever detected.
-        const scriptOk = 
-        // Dedicated daemon entry — what the Mac app tray spawns.
-        /[/\\]\.?beehaven(_sdk)?[/\\].*daemon-entry\.(js|ts)\b/.test(cmd) ||
-            /Clearly[^/\\]*\.app[/\\]Contents[/\\]Resources[/\\]beehaven[/\\]daemon-entry\.js\b/.test(cmd) ||
-            // Legacy `cli.js start` — for old bundles pre-dating daemon-entry.js.
-            /[/\\]\.?beehaven(_sdk)?[/\\].*cli\.(js|ts)\b/.test(cmd) ||
-            /Clearly[^/\\]*\.app[/\\]Contents[/\\]Resources[/\\]beehaven[/\\]cli\.js\b/.test(cmd) ||
-            // Bare `beehaven start` — wrapper already matched argv[0].
-            /^(\S*\/)?beehaven\s+start\b/.test(cmd);
-        return scriptOk;
+        // The two-condition rule (argv[0] is node/tsx/beehaven AND an argument is a beehaven script)
+        // lives in daemon-process.ts, where it also understands Windows command lines.
+        return isBeehavenCommandLine(cmd);
     }
     catch {
         return false; // Can't read → not our process or already dead
@@ -1151,6 +1189,23 @@ function isBeehavenProcess(pid) {
  */
 export function findLiveDaemons() {
     const found = new Set();
+    // Windows: no PID-file trust without a command line, and no pgrep — ONE CIM query of node
+    // processes answers both "is the PID file's process ours" and "are there orphans" (CAN2-56).
+    if (process.platform === 'win32') {
+        let pidFilePid = null;
+        try {
+            pidFilePid = existsSync(PID_FILE) ? parseInt(readFileSync(PID_FILE, 'utf8').trim(), 10) || null : null;
+        }
+        catch { }
+        const alive = (pid) => { try {
+            process.kill(pid, 0);
+            return true;
+        }
+        catch {
+            return false;
+        } };
+        return selectWindowsDaemons(windowsNodeProcesses(), { selfPid: process.pid, pidFilePid, isAlive: alive });
+    }
     // 1. Check PID file first — the canonical source.
     if (existsSync(PID_FILE)) {
         try {
@@ -1294,7 +1349,7 @@ export async function startDaemon(opts) {
     // live server answering here means some daemon is alive that findLiveDaemons
     // missed (e.g. different binary path, permissions edge case).
     if (await probeIpcSocket()) {
-        console.error(`\n  ✗ Another beehaven daemon is listening on /tmp/beehaven-ipc.sock.`);
+        console.error(`\n  ✗ Another beehaven daemon is listening on ${ipcSocketPath()}.`);
         console.error(`  ✗ Quit the Clearly Dev Mac app tray to stop the existing daemon, then restart.\n`);
         try {
             logger.error('daemon', 'Refusing to start — IPC socket already serving connections');

package/dist/ipc-auth.js

@@ -2,7 +2,9 @@
  * IPC auth — scope-aware shared secrets between daemon and local clients.
  *
  * Threat model: any process running as the same user can connect to
- * /tmp/beehaven-ipc.sock (it's chmod 0600, which only restricts other users).
+ * /tmp/beehaven-ipc.sock (it's chmod 0600, which only restricts other users). On
+ * Windows the daemon listens on a per-user named pipe, which has no file mode at all — so on
+ * that platform these tokens ARE the boundary for same-user callers (ipc-path.ts).
  * Without per-scope auth, any same-user process can invoke privileged
  * verbs — extract the Firebase ID token via `get-token`, run arbitrary
  * SQL, install marketplace packages with code execution.

package/dist/ipc-client.js

@@ -4,14 +4,15 @@
  * Used by CLI commands (actions, call, pipe, watch, ls, cat) to communicate
  * with the running daemon, which forwards requests to the cloud DO.
  *
- * Protocol: newline-delimited JSON over /tmp/beehaven-ipc.sock
+ * Protocol: newline-delimited JSON over /tmp/beehaven-ipc.sock (a named pipe on Windows — ipc-path.ts)
  */
-import { existsSync } from 'node:fs';
 import { createConnection } from 'net';
 import { EventEmitter } from 'events';
 import { resolveClientAuthToken } from './ipc-auth.js';
+import { ipcSocketPath, socketMayExist } from './ipc-path.js';
 import { activeAgentWrap } from './agent-attribution.js';
-const IPC_SOCKET_PATH = '/tmp/beehaven-ipc.sock';
+/** The default address (Unix socket, or this user's named pipe on Windows) — see `ipc-path.ts`. */
+const IPC_SOCKET_PATH = ipcSocketPath();
 /** Default timeout for RPC calls (ms) */
 const DEFAULT_TIMEOUT = 30_000;
 /**
@@ -49,7 +50,7 @@ export class IpcClient extends EventEmitter {
          * — the only way to guard the CALL SITE rather than the helper it calls, which is the exact
          * distinction that let 28 verbs ship un-attributed. Unset, nothing changes.
          */
-        this.socketPath = opts?.socketPath ?? process.env.BEEHAVEN_IPC_SOCKET ?? IPC_SOCKET_PATH;
+        this.socketPath = opts?.socketPath ?? ipcSocketPath(); // honours $BEEHAVEN_IPC_SOCKET
         this.defaultTimeout = opts?.timeout ?? DEFAULT_TIMEOUT;
         this.explicitAuthToken = opts?.authToken;
     }
@@ -113,7 +114,7 @@ export class IpcClient extends EventEmitter {
                                 ? resolveClientAuthToken()
                                 : this.explicitAuthToken;
                             let token = readToken();
-                            if (!token && this.explicitAuthToken === undefined && existsSync(this.socketPath)) {
+                            if (!token && this.explicitAuthToken === undefined && socketMayExist(this.socketPath)) {
                                 const deadline = Date.now() + TOKEN_MINT_WAIT_MS;
                                 while (!token && Date.now() < deadline) {
                                     /**
@@ -143,7 +144,7 @@ export class IpcClient extends EventEmitter {
                                  * ⚠ THE SOCKET IS THE DISCRIMINATOR: up means "still starting, wait"; absent
                                  * means "nothing is running, start one". Opposite actions.
                                  */
-                                (existsSync(this.socketPath)
+                                (socketMayExist(this.socketPath)
                                     ? 'The daemon is still starting — its socket is up but it has not minted an IPC token yet. ' +
                                         'Wait a second and retry. (Do NOT restart: `stop` scrubs the token, which re-enters this window.)'
                                     : 'No IPC auth token and no daemon socket — nothing is running. ' +

package/dist/ipc-path.js

@@ -0,0 +1,92 @@
+/**
+ * ipc-path — where the daemon's local sockets live, on every platform (CAN2-56).
+ *
+ * ⚠⚠ THE ONE PLACE A SOCKET ADDRESS IS DECIDED. `/tmp/beehaven-ipc.sock` was typed out in five CLI
+ * files (server, three clients, the claude bridge) and `/tmp/beehaven.sock` in two more, each
+ * gating its connect on `existsSync`, unlinking stale files and chmod-ing to 0600. On Windows none
+ * of that works: Node's `net` listens on a NAMED PIPE (`\\.\pipe\…`), there is no `/tmp`, a pipe is
+ * not a file you can stat, unlink or chmod — so the daemon could not bind and no client could
+ * reach it. Every caller now asks this module, and the Unix addresses are byte-for-byte unchanged
+ * (the Mac app, the mwah CLI and the Electron daemon client still dial `/tmp/beehaven-ipc.sock`).
+ *
+ * ⚠ A PIPE NAME IS MACHINE-GLOBAL, so it carries the user name: two people signed in to one
+ * Windows machine get two daemons, as two Unix users do. Same-user is still the boundary that
+ * matters, and the IPC auth token (`ipc-auth.ts`) is what gates verbs on both platforms — the
+ * Unix 0600 mode is defense in depth that a pipe does not have a file-mode equivalent for.
+ *
+ * ⚠ `$BEEHAVEN_IPC_SOCKET` / `$BEEHAVEN_WATCHER_SOCKET` override the address for BOTH ends (server
+ * and clients), so a test can stand a real daemon and a real client on a private path. Read at call
+ * time, not import time, for the same reason.
+ */
+import { existsSync, unlinkSync, chmodSync, statSync } from 'fs';
+import { tmpdir, userInfo } from 'os';
+import { join } from 'path';
+export const UNIX_IPC_SOCKET = '/tmp/beehaven-ipc.sock';
+export const UNIX_WATCHER_SOCKET = '/tmp/beehaven.sock';
+export const UNIX_EVENTS_FILE = '/tmp/beehaven-events.jsonl';
+/** `\\.\pipe\…` or `\\?\pipe\…` — the forms Node accepts for a Windows named pipe. */
+export function isNamedPipe(p) {
+    return /^\\\\[.?]\\pipe\\/i.test(p);
+}
+/** The signed-in user's name, made safe for a pipe name. */
+function pipeUser(env) {
+    let name = '';
+    try {
+        name = userInfo().username;
+    }
+    catch { /* no passwd entry / sandbox */ }
+    if (!name)
+        name = env.USERNAME || env.USER || 'user';
+    return name.toLowerCase().replace(/[^a-z0-9._-]+/g, '_').slice(0, 64) || 'user';
+}
+const pipe = (name, env) => `\\\\.\\pipe\\${name}-${pipeUser(env)}`;
+/** The daemon's IPC address: the Unix socket, or this user's named pipe on Windows. */
+export function ipcSocketPath(platform = process.platform, env = process.env) {
+    if (env.BEEHAVEN_IPC_SOCKET)
+        return env.BEEHAVEN_IPC_SOCKET;
+    return platform === 'win32' ? pipe('beehaven-ipc', env) : UNIX_IPC_SOCKET;
+}
+/** The Claude Code event watcher's HTTP-over-socket address. */
+export function watcherSocketPath(platform = process.platform, env = process.env) {
+    if (env.BEEHAVEN_WATCHER_SOCKET)
+        return env.BEEHAVEN_WATCHER_SOCKET;
+    return platform === 'win32' ? pipe('beehaven-watcher', env) : UNIX_WATCHER_SOCKET;
+}
+/** The watcher's JSONL fallback file. Windows has no `/tmp`; its temp dir is per-user already. */
+export function eventsFilePath(platform = process.platform) {
+    return platform === 'win32' ? join(tmpdir(), 'beehaven-events.jsonl') : UNIX_EVENTS_FILE;
+}
+/**
+ * Could a listener be at `p`? A socket FILE can be checked without touching it. A named pipe
+ * cannot: it exists only while a server holds it, and probing it with a filesystem call opens an
+ * instance of it. So a pipe answers `true` and the connect attempt decides (`ENOENT` = nothing).
+ */
+export function socketMayExist(p) {
+    return isNamedPipe(p) || existsSync(p);
+}
+/** Remove a stale socket file before binding. A named pipe leaves nothing behind to remove. */
+export function clearStaleSocket(p) {
+    if (isNamedPipe(p))
+        return;
+    try {
+        if (existsSync(p))
+            unlinkSync(p);
+    }
+    catch { /* already gone */ }
+}
+/**
+ * Restrict a freshly bound socket file to its owner (0600) and report the mode it really has.
+ * `applicable: false` for a named pipe, which has no file mode — its boundary is the per-user name
+ * plus the IPC token.
+ */
+export function restrictSocketToOwner(p) {
+    if (isNamedPipe(p))
+        return { applicable: false, mode: null };
+    try {
+        chmodSync(p, 0o600);
+        return { applicable: true, mode: statSync(p).mode & 0o777 };
+    }
+    catch (err) {
+        return { applicable: true, mode: null, error: String(err?.code ?? err?.message ?? err) };
+    }
+}

package/dist/ipc-server.js

@@ -2,7 +2,7 @@
  * IPC Server — bidirectional Unix socket for local clients (Electron, CLI tools).
  *
  * Provides request-response RPCs and broadcast subscriptions over a line-based
- * JSON protocol on /tmp/beehaven-ipc.sock.
+ * JSON protocol on /tmp/beehaven-ipc.sock (a per-user named pipe on Windows — see ipc-path.ts).
  *
  * Local clients send messages to the daemon, which forwards them to the DO
  * via the relay WebSocket. DO responses and broadcasts are forwarded back
@@ -24,10 +24,11 @@
  *   { "type": "status", "connected": true, "daemonPid": 1234 }
  */
 import { createConnection, createServer } from 'net';
-import { existsSync, unlinkSync, chmodSync, statSync } from 'fs';
 import { EventEmitter } from 'events';
 import { resolveAuthScope } from './ipc-auth.js';
-const IPC_SOCKET_PATH = '/tmp/beehaven-ipc.sock';
+import { ipcSocketPath, socketMayExist, clearStaleSocket, restrictSocketToOwner } from './ipc-path.js';
+/** The default address (Unix socket, or this user's named pipe on Windows) — see `ipc-path.ts`. */
+const IPC_SOCKET_PATH = ipcSocketPath();
 /**
  * Message types the daemon will process without authentication.
  *
@@ -114,9 +115,10 @@ export function actionChain(action, input, depth = 0) {
  */
 function probeIpcSocket(timeoutMs = 400) {
     return new Promise((resolve) => {
-        if (!existsSync(IPC_SOCKET_PATH))
+        const path = ipcSocketPath();
+        if (!socketMayExist(path))
             return resolve(false);
-        const client = createConnection(IPC_SOCKET_PATH);
+        const client = createConnection(path);
         const done = (alive) => {
             try {
                 client.destroy();
@@ -138,6 +140,8 @@ function probeIpcSocket(timeoutMs = 400) {
 export { probeIpcSocket };
 export class IpcServer extends EventEmitter {
     server = null;
+    /** The address this server bound (resolved at `start`, so an env override set before start applies). */
+    path = null;
     clients = new Map();
     clientCounter = 0;
     virtualClientCounter = 0;
@@ -157,12 +161,10 @@ export class IpcServer extends EventEmitter {
      * at this point; a live server would have been caught upstream.
      */
     start() {
-        // Clean up stale socket
-        try {
-            if (existsSync(IPC_SOCKET_PATH))
-                unlinkSync(IPC_SOCKET_PATH);
-        }
-        catch { }
+        // Clean up a stale socket file (a named pipe leaves none).
+        const path = ipcSocketPath();
+        this.path = path;
+        clearStaleSocket(path);
         this.server = createServer((socket) => {
             const clientId = `ipc_${++this.clientCounter}`;
             // Connections start unauthenticated and scope=null. The client must
@@ -235,7 +237,7 @@ export class IpcServer extends EventEmitter {
         // process-wide umask — umask changes are global and race with any
         // other mkdirSync / writeFileSync happening in parallel (e.g.
         // LocalHive pre-creating building data dirs during startup).
-        this.server.listen(IPC_SOCKET_PATH, () => {
+        this.server.listen(path, () => {
             /**
              * ⚠⚠ CHMOD, THEN **VERIFY**. This was `chmodSync(…, 0o600)` inside an empty `catch {}`, and
              * the mode it claims has been wrong on every start measured: the live socket comes up
@@ -266,19 +268,18 @@ export class IpcServer extends EventEmitter {
              * was learned once and not applied here. Import at the top; never reach for `require` in this
              * package.
              */
-            let mode = null;
-            try {
-                chmodSync(IPC_SOCKET_PATH, 0o600);
-                mode = statSync(IPC_SOCKET_PATH).mode & 0o777;
-            }
-            catch (err) {
-                console.warn(`[ipc] SECURITY: could not set 0600 on ${IPC_SOCKET_PATH} — ${err?.code ?? err?.message ?? err}`);
+            // A Windows named pipe has no file mode (`applicable: false`): its boundary is the per-user
+            // pipe name plus the IPC token — see `ipc-path.ts`.
+            const restricted = restrictSocketToOwner(path);
+            const mode = restricted.mode;
+            if (restricted.error) {
+                console.warn(`[ipc] SECURITY: could not set 0600 on ${path} — ${restricted.error}`);
             }
             if (mode !== null && mode !== 0o600) {
                 console.warn(`[ipc] SECURITY: socket mode is 0${mode.toString(8)}, expected 0600. Other-user connect is still `
                     + `blocked (no write bit), but the documented guarantee does not hold — do not weaken it further.`);
             }
-            console.log(`[ipc] Listening on ${IPC_SOCKET_PATH}${mode !== null ? ` (mode 0${mode.toString(8)})` : ''}`);
+            console.log(`[ipc] Listening on ${path}${mode !== null ? ` (mode 0${mode.toString(8)})` : ''}`);
         });
         this.server.on('error', (err) => {
             console.warn(`[ipc] Server error: ${err.message}`);
@@ -295,11 +296,7 @@ export class IpcServer extends EventEmitter {
             this.server.close();
             this.server = null;
         }
-        try {
-            if (existsSync(IPC_SOCKET_PATH))
-                unlinkSync(IPC_SOCKET_PATH);
-        }
-        catch { }
+        clearStaleSocket(this.path ?? ipcSocketPath());
     }
     /** Broadcast a message from the DO to all subscribed local clients */
     /**

package/dist/npm-update.js

@@ -0,0 +1,138 @@
+/**
+ * npm-update — updating a CLI that was installed with `npm install -g` (CAN2-57).
+ *
+ * ⚠⚠ npm IS THE ONLY WINDOWS INSTALL, AND IT NEVER UPDATED. The daemon's hourly updater re-runs the
+ * bash `install.sh`, so it served only `~/.beehaven/cli` installs; `beehaven update` refused npm
+ * installs and printed the npm command instead. A Windows user stayed on whatever version they
+ * first installed until they noticed the notice. Both paths now call this module.
+ *
+ * ⚠ IT UPDATES THE COPY THAT IS RUNNING, OR NOTHING. The npm that sits beside the running Node is
+ * asked for its global root; if this package is not the one installed there (an npx run, a second
+ * Node, a copied folder), installing would create a SECOND copy that shadows or is shadowed by
+ * this one — the failure `self-update.ts` documents for curl installs. So it refuses and says why.
+ *
+ * ⚠ A GLOBAL PREFIX THE USER CANNOT WRITE IS NOT "TRY sudo". Windows (`%AppData%\npm`) and
+ * Homebrew/nvm prefixes are user-writable; a system `/usr/local` usually is not, and an unattended
+ * daemon must never escalate. Not writable → the one-line manual command, nothing else.
+ *
+ * ⚠ THE EXACT VERSION, NOT `@latest`. The caller passes the version from the release manifest
+ * (`latest.json`, stable only), so the channel is decided by our publish script, never by a dist
+ * tag someone moved by hand.
+ */
+import { execFile, execFileSync } from 'child_process';
+import { accessSync, constants, existsSync, readFileSync, realpathSync } from 'fs';
+import { homedir } from 'os';
+import { dirname, join, resolve } from 'path';
+export const PACKAGE = '@clearlysh/beehaven';
+const VERSION_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+/** The npm that belongs to the Node running this process, else whatever `npm` is on PATH. */
+export function npmCommand(platform = process.platform, execPath = process.execPath) {
+    const local = join(dirname(execPath), platform === 'win32' ? 'npm.cmd' : 'npm');
+    return existsSync(local) ? local : platform === 'win32' ? 'npm.cmd' : 'npm';
+}
+/** Windows `.cmd` shims cannot be spawned without a shell (Node refuses with EINVAL since 18.20/20.12). */
+const needsShell = (cmd) => /\.cmd$/i.test(cmd);
+const quoteForShell = (s) => (/[\s"&|<>^]/.test(s) ? `"${s.replace(/"/g, '""')}"` : s);
+/** Run npm synchronously; returns stdout. Never inside the package directory (Windows rename locks). */
+function npmSync(npm, args, timeoutMs) {
+    const shell = needsShell(npm);
+    return execFileSync(shell ? quoteForShell(npm) : npm, args, {
+        encoding: 'utf8',
+        cwd: homedir(),
+        timeout: timeoutMs,
+        stdio: ['ignore', 'pipe', 'pipe'],
+        shell,
+        windowsHide: true,
+    });
+}
+/**
+ * Can this install update itself with npm? `pkgRoot` is the running package's root (the folder
+ * holding its package.json).
+ */
+export function npmUpdatePlan(pkgRoot, platform = process.platform) {
+    const npm = npmCommand(platform);
+    let globalRoot;
+    try {
+        globalRoot = npmSync(npm, ['root', '-g'], 30_000).trim();
+    }
+    catch (e) {
+        return { ok: false, npm, reason: `npm is not available (${String(e?.code ?? e?.message ?? e).slice(0, 80)})` };
+    }
+    const real = (p) => { try {
+        return realpathSync(p);
+    }
+    catch {
+        return resolve(p);
+    } };
+    const installed = join(globalRoot, ...PACKAGE.split('/'));
+    if (real(installed).toLowerCase() !== real(pkgRoot).toLowerCase()) {
+        return { ok: false, npm, globalRoot, reason: `this copy (${pkgRoot}) is not npm's global install (${installed})` };
+    }
+    try {
+        accessSync(globalRoot, constants.W_OK);
+        accessSync(installed, constants.W_OK);
+    }
+    catch {
+        return { ok: false, npm, globalRoot, reason: `npm's global folder is not writable by you (${globalRoot})` };
+    }
+    return { ok: true, npm, globalRoot };
+}
+/** The version npm's global install of this package reports, read from disk. */
+export function installedNpmVersion(globalRoot) {
+    try {
+        return JSON.parse(readFileSync(join(globalRoot, ...PACKAGE.split('/'), 'package.json'), 'utf8')).version ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The newest published version, from npm (for `beehaven update`; the daemon uses the release manifest). */
+export function latestNpmVersion(npm) {
+    try {
+        const v = npmSync(npm, ['view', PACKAGE, 'version', '--registry=https://registry.npmjs.org'], 30_000).trim();
+        return VERSION_RE.test(v) ? v : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The arguments that install exactly `version` globally — exported so the shape is pinned. */
+export function npmInstallArgs(version) {
+    if (!VERSION_RE.test(version))
+        throw new Error(`not a release version: ${version}`);
+    return ['install', '-g', `${PACKAGE}@${version}`, '--no-audit', '--no-fund', '--registry=https://registry.npmjs.org'];
+}
+/** Install `version` (blocking — the CLI's `update`). Verifies what landed on disk. */
+export function installNpmVersionSync(plan, version) {
+    if (!plan.ok || !plan.globalRoot)
+        return { ok: false, message: plan.reason ?? 'npm update not possible here' };
+    try {
+        npmSync(plan.npm, npmInstallArgs(version), 5 * 60_000);
+    }
+    catch (e) {
+        const detail = String(e?.stderr || e?.message || e).trim().split('\n').slice(-3).join(' ').slice(0, 240);
+        return { ok: false, message: `npm install failed: ${detail}` };
+    }
+    const got = installedNpmVersion(plan.globalRoot);
+    return got === version
+        ? { ok: true, message: `Updated to ${version}.` }
+        : { ok: false, message: `npm reported success but ${got ?? 'nothing'} is installed, not ${version}.` };
+}
+/** Install `version` without blocking the event loop (the daemon's hourly updater). */
+export function installNpmVersion(plan, version) {
+    return new Promise((resolveP) => {
+        if (!plan.ok || !plan.globalRoot)
+            return resolveP({ ok: false, message: plan.reason ?? 'npm update not possible here' });
+        const shell = needsShell(plan.npm);
+        execFile(shell ? quoteForShell(plan.npm) : plan.npm, npmInstallArgs(version), {
+            cwd: homedir(), timeout: 5 * 60_000, shell, windowsHide: true,
+        }, (err, _out, stderr) => {
+            if (err)
+                return resolveP({ ok: false, message: `npm install failed: ${String(stderr || err.message).trim().split('\n').slice(-3).join(' ').slice(0, 240)}` });
+            const got = installedNpmVersion(plan.globalRoot);
+            resolveP(got === version
+                ? { ok: true, message: `Updated to ${version}.` }
+                : { ok: false, message: `npm reported success but ${got ?? 'nothing'} is installed, not ${version}.` });
+        });
+    });
+}

package/dist/setup-service.js

@@ -391,8 +391,12 @@ export async function cleanupAll() {
     }
     // 3. Socket + event log
     const { existsSync, unlinkSync, readdirSync, rmSync, readFileSync, writeFileSync } = await import('node:fs');
-    const { join } = await import('node:path');
-    for (const p of ['/tmp/beehaven.sock', '/tmp/beehaven-ipc.sock', '/tmp/beehaven-events.jsonl']) {
+    const { join, dirname } = await import('node:path');
+    const { watcherSocketPath, ipcSocketPath, eventsFilePath, isNamedPipe } = await import('./ipc-path.js');
+    const eventsFile = eventsFilePath();
+    for (const p of [watcherSocketPath(), ipcSocketPath(), eventsFile]) {
+        if (isNamedPipe(p))
+            continue; // a Windows pipe disappears with the daemon that held it
         try {
             if (existsSync(p)) {
                 unlinkSync(p);
@@ -402,10 +406,11 @@ export async function cleanupAll() {
         catch { }
     }
     try {
-        for (const f of readdirSync('/tmp')) {
+        const eventsDir = dirname(eventsFile);
+        for (const f of readdirSync(eventsDir)) {
             if (f.startsWith('beehaven-events.jsonl.') && f.endsWith('.old')) {
                 try {
-                    unlinkSync(join('/tmp', f));
+                    unlinkSync(join(eventsDir, f));
                 }
                 catch { }
             }