@clearlysh/beehaven 0.8.37 → 0.8.38

package/dist/agent-mint-response.js

@@ -0,0 +1,10 @@
+/** Only an explicit appearance choice may rebind a portable identity on another device. */
+export function accountMintRequest(agentId, requestedAvatarId) {
+    return { agentId, ...(requestedAvatarId ? { avatarId: requestedAvatarId } : {}) };
+}
+export function accountMintResponse(response) {
+    const value = response?.result ?? response;
+    if (!value?.token)
+        throw Object.assign(new Error(`${String(value?.error || 'The server returned no agent token')}${value?.code ? ` (${value.code})` : ''}`), { code: value?.code || 'mint-refused' });
+    return value;
+}

package/dist/build-channel.js

@@ -53,9 +53,9 @@ export const PUBLIC_BUILD = true;
  * ⚠ REWRITTEN IN `dist/` AT BUILD TIME, like `PUBLIC_BUILD`. `unstamped` is what a source checkout
  * carries and what `tsx`/`vitest` see, and it is honest: nothing has stamped them.
  */
-export const BUILD_SHA = '7674ddaca41b';
+export const BUILD_SHA = '6f5ce18b17c5';
 /** ISO-8601 minute precision, UTC. Rewritten in `dist/` by `scripts/stamp-build-channel.mjs`. */
-export const BUILD_TIME = '2026-10-29T21:35Z';
+export const BUILD_TIME = '2026-10-30T07:25Z';
 /**
  * The build identity as one short string, for `--version`.
  *

package/dist/cli.js

@@ -3064,13 +3064,13 @@ async function run() {
             }
             console.log('');
             console.log(`  ${color.green('✓')} Signed in as ${color.bold(captured.email ?? captured.userId)}`);
-            console.log(`    Tokens stored in keychain + ~/.beehaven/config.json`);
+            console.log(`    Sign-in saved on this device`);
             // Auto-restart the daemon. New tokens won't take effect until
             // the daemon restarts (it reads creds at startup, keeps them
             // in memory, has no hot-reload IPC verb). Doing the restart
             // here matches gh / firebase-tools UX — login-then-go.
             const { findLiveDaemons, stopDaemonProcess } = await import('./daemon.js');
-            const { spawnStandaloneDaemon } = await import('./commands/daemon-cmd.js');
+            const { spawnStandaloneDaemon, waitForLoginConnection } = await import('./commands/daemon-cmd.js');
             /**
              * ⚠⚠ THE RESTART IS PLUMBING AND WAS NARRATED AS THOUGH IT WERE THE POINT. What a person saw
              * after signing in was:
@@ -3115,6 +3115,7 @@ async function run() {
              * started with developer scope.
              */
             const pid = spawnStandaloneDaemon(values);
+            const connection = await waitForLoginConnection();
             /**
              * ⚠ ONE OUTCOME LINE, IN THE SAME SHAPE AS THE ONE ABOVE IT. `✓ (PID 73532)` was a tick, a
              * bracket and a number — grammatically nothing, and unreadable as a result. This says what
@@ -3125,7 +3126,16 @@ async function run() {
              * `beehaven status` labels the same thing `Relay:`. Naming the outcome rather than the
              * process is what stops a sign-in ending on the word "stopped".
              */
-            console.log(`  ${color.green('✓')} Connected — your new sign-in is live`);
+            if (connection.ready) {
+                console.log(`  ${color.green('✓')} Connected — your new sign-in is live`);
+            }
+            else {
+                console.error(`  ${color.yellow('!')} Signed in, but the workspace connection is not ready.`);
+                console.error(connection.reason === 'environment-mismatch'
+                    ? '    The running service is on a different environment. Run `beehaven status` before retrying.'
+                    : '    Run `beehaven status` to check the connection, then retry your workspace command.');
+                process.exitCode = 2;
+            }
             console.log(`    Background service ${wasRunning ? 'restarted' : 'started'} (PID ${pid})`);
             /**
              * ⚠⚠ TEACH THE AGENTS AS PART OF SIGNING IN (PPO-190). "Install the CLI, log in, and your

package/dist/commands/agent.js

@@ -25,6 +25,7 @@ import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import { rpcOnce } from '../ipc-client.js';
+import { accountMintRequest, accountMintResponse } from '../agent-mint-response.js';
 import { saveAgent, loadAgent, listAgents, deleteAgent, findAgentByAvatar, isValidAgentName, resolveActiveAgent, activeAgentName, saveAgentSession, clearAgentSession, clearAgentSessionId, decodeAgentTokenClaims, } from '../agent-state.js';
 const VALID_KINDS = ['claude-code', 'daemon-agent', 'clearly-ai'];
 export const FREE_SKINS = [
@@ -643,7 +644,7 @@ async function agentLogin(args, values) {
     }
     const avatarId = requestedAvatarId || existingRecord?.avatarId || chosenSkin || name;
     // Local-first avatar-collision guard (durable guard is the cloud pool).
-    const collision = findAgentByAvatar(avatarId, name);
+    const collision = requestedAvatarId ? findAgentByAvatar(requestedAvatarId, name) : null;
     if (collision) {
         console.error(`  Avatar "${avatarId}" is already claimed by agent "${collision}".`);
         console.error(`  Pick another: beehaven agent login ${name} --avatar <other-id>`);
@@ -670,7 +671,7 @@ async function agentLogin(args, values) {
      * credential.
      */
     try {
-        const cloud = await rpcOnce('agent-account-mint', { agentId: name, avatarId }, 15_000);
+        const cloud = accountMintResponse(await rpcOnce('agent-account-mint', accountMintRequest(name, requestedAvatarId), 15_000));
         const tok = cloud?.token ?? cloud?.result?.token;
         if (tok) {
             minted = {
@@ -698,7 +699,8 @@ async function agentLogin(args, values) {
     }
     catch (err) {
         console.error(`  Could not mint identity: ${err?.message ?? err}`);
-        console.error('  Is the daemon connected? Check with: beehaven status');
+        if (!err?.code || /^(ECONN|ENOENT|ETIMEDOUT)/.test(String(err.code)))
+            console.error('  Is the daemon connected? Check with: beehaven status');
         process.exit(1);
     }
     /**

package/dist/commands/daemon-cmd.js

@@ -16,6 +16,22 @@ import { fileURLToPath } from 'node:url';
 import { existsSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { findLiveDaemons, resolveRelayUrlForDaemon } from '../daemon.js';
+import { waitForConnection } from '../connection-ready.js';
+/** Each attempt authenticates over IPC; a PID or greeting alone cannot prove a usable sign-in. */
+export async function waitForLoginConnection() {
+    const { IpcClient } = await import('../ipc-client.js');
+    return waitForConnection(async () => {
+        const client = new IpcClient({ timeout: 1000 });
+        try {
+            await client.connect();
+            const state = await client.call('daemon:session-status', {}, 1000);
+            return { connected: state?.relay?.connected === true, endpoint: state?.relay?.endpoint };
+        }
+        finally {
+            client.disconnect();
+        }
+    }, resolveRelayUrlForDaemon());
+}
 /** dist/daemon-entry.js — sibling of dist/cli.js (this file is dist/commands/). */
 function daemonEntryPath() {
     return join(dirname(fileURLToPath(import.meta.url)), '..', 'daemon-entry.js');
@@ -82,7 +98,7 @@ export async function startHeadlessDaemon(values) {
             const { daemonRpc } = await import('../daemon-client.js');
             let activeRelay = null;
             try {
-                const status = await daemonRpc('daemon:status', {});
+                const status = await daemonRpc('daemon:session-status', {});
                 activeRelay = status?.relay?.endpoint ?? null;
             }
             catch { /* status is advisory; the socket probe already succeeded */ }

package/dist/connection-ready.js

@@ -0,0 +1,25 @@
+export async function waitForConnection(probe, expectedEndpoint, options = {}) {
+    const now = options.now ?? Date.now;
+    const sleep = options.sleep ?? ((ms) => new Promise(resolve => setTimeout(resolve, ms)));
+    const deadline = now() + (options.timeoutMs ?? 30_000);
+    const normalize = (value) => value.replace(/\/+$/, '');
+    let reason = 'starting';
+    do {
+        try {
+            const state = await probe();
+            if (state.endpoint && normalize(state.endpoint) !== normalize(expectedEndpoint))
+                return { ready: false, reason: 'environment-mismatch' };
+            if (state.connected && state.endpoint && normalize(state.endpoint) === normalize(expectedEndpoint))
+                return { ready: true, reason: 'connected' };
+            reason = 'relay-unavailable';
+        }
+        catch {
+            reason = 'starting';
+        }
+        const remaining = deadline - now();
+        if (remaining <= 0)
+            break;
+        await sleep(Math.min(options.pollMs ?? 250, remaining));
+    } while (now() < deadline);
+    return { ready: false, reason };
+}

package/dist/daemon-process.js

@@ -8,8 +8,15 @@
  * daemon. Windows reads command lines from one CIM query instead.
  */
 import { execFileSync } from 'child_process';
+import { fileURLToPath } from 'node:url';
+export const CURRENT_DAEMON_ENTRY = fileURLToPath(new URL('./daemon-entry.js', import.meta.url));
+/** pgrep receives a regex argument, so every metacharacter in a user-chosen path is literal. */
+export function daemonEntryPattern(entry = CURRENT_DAEMON_ENTRY) {
+    const special = '\\.^$*+?()[]{}|';
+    return Array.from(entry, character => special.includes(character) ? '\\' + character : character).join('');
+}
 /**
- * Whether a full command line is a beehaven daemon or CLI process.
+ * Whether a full command line is a beehaven daemon or a legacy CLI-start daemon.
  *
  * Strict two-condition test (unchanged on macOS/Linux):
  *   1. argv[0] is a node/tsx/beehaven binary — not a shell, an editor, a grep, etc.;
@@ -20,14 +27,17 @@ import { execFileSync } from 'child_process';
  * an extension (`"C:\Program Files\nodejs\node.exe" C:\…\daemon-entry.js`). It is reduced to the
  * Unix shape (`C:/Program_Files/nodejs/node …`) so the same two conditions apply, unquoted.
  */
-export function isBeehavenCommandLine(raw, platform = process.platform) {
+export function isBeehavenCommandLine(raw, platform = process.platform, expectedEntry = CURRENT_DAEMON_ENTRY, executable = process.execPath) {
     let cmd = (raw ?? '').trim();
     if (!cmd)
         return false;
+    const ownExecutable = platform !== 'win32' && (cmd.startsWith(executable + ' ') || cmd.startsWith(`"${executable}" `));
+    let tail = ownExecutable ? cmd.slice(cmd.startsWith('"') ? executable.length + 3 : executable.length + 1).trim() : cmd.replace(/^\S+\s*/, '');
     if (platform === 'win32') {
         const m = /^"([^"]*)"\s*(.*)$/s.exec(cmd) ?? /^(\S+)\s*(.*)$/s.exec(cmd);
         if (!m)
             return false;
+        tail = m[2].trim();
         const argv0 = m[1].replace(/\\/g, '/').replace(/\.(exe|cmd)$/i, '').replace(/\s+/g, '_').toLowerCase();
         cmd = `${argv0} ${m[2].replace(/"/g, '')}`.trim();
     }
@@ -35,15 +45,20 @@ export function isBeehavenCommandLine(raw, platform = process.platform) {
     // running a heredoc that contains "node .../cli.js" deeper in its argv doesn't false-positive.
     const argv0Ok = /^(\S*\/)?node(\s|$)/.test(cmd) ||
         /^(\S*\/)?tsx(\s|$)/.test(cmd) ||
-        /^(\S*\/)?beehaven(\s|$)/.test(cmd);
+        /^(\S*\/)?beehaven(\s|$)/.test(cmd) || ownExecutable;
     if (!argv0Ok)
         return false;
-    // ⚠⚠ ON WINDOWS ONLY THE DAEMON ENTRY COUNTS. The `cli.js` patterns below exist for LEGACY daemons
-    // (`node cli.js start`, before daemon-entry.js) — and on macOS `pgrep` never surfaced ordinary CLI
-    // runs anyway (it reads its pattern as a BASIC regex, where `(js|ts)` matches nothing). Windows
-    // lists every node process, so with them a `start --headless` parent waiting for its child was
-    // "another daemon" (the child refused to start — the second Windows CI run), and `stop` would
-    // have killed an agent's in-flight `beehaven call`. There are no legacy Windows daemons to find.
+    const firstArgument = tail.startsWith('"') ? tail.slice(1).split('"')[0] : tail.split(/\s/)[0];
+    if (/^-(?:e|p|ep|pe)$|^--(?:eval|print)(?:=|$)/.test(firstArgument))
+        return false;
+    // A custom installer prefix need not contain the word "beehaven". Trust only this package's
+    // exact entry as the direct script argument; a quoted mention inside `node -e` is not a daemon.
+    const normalize = (s) => platform === 'win32' ? s.replace(/\\/g, '/').toLowerCase() : s;
+    const rest = normalize(tail), entry = normalize(expectedEntry);
+    if ([entry, `"${entry}"`].some(value => rest === value || rest.startsWith(value + ' ')))
+        return true;
+    // Windows has no legacy CLI-start daemons. Unix retains that old start shape, but ordinary
+    // CLI calls and eval/print processes are never daemon candidates on any platform.
     if (platform === 'win32')
         return /[/\\]\.?beehaven([-_]sdk)?[/\\].*daemon-entry\.(js|ts)\b/.test(cmd);
     // Condition 2: a subsequent argument must reference a beehaven script.
@@ -59,8 +74,8 @@ export function isBeehavenCommandLine(raw, platform = process.platform) {
     /[/\\]\.?beehaven([-_]sdk)?[/\\].*daemon-entry\.(js|ts)\b/.test(cmd) ||
         /Clearly[^/\\]*\.app[/\\]Contents[/\\]Resources[/\\]beehaven[/\\]daemon-entry\.js\b/.test(cmd) ||
         // Legacy `cli.js start` — for old bundles pre-dating daemon-entry.js.
-        /[/\\]\.?beehaven([-_]sdk)?[/\\].*cli\.(js|ts)\b/.test(cmd) ||
-        /Clearly[^/\\]*\.app[/\\]Contents[/\\]Resources[/\\]beehaven[/\\]cli\.js\b/.test(cmd) ||
+        /[/\\]\.?beehaven([-_]sdk)?[/\\].*cli\.(js|ts)["']?\s+start(?:\s|$)/.test(cmd) ||
+        /Clearly[^/\\]*\.app[/\\]Contents[/\\]Resources[/\\]beehaven[/\\]cli\.js["']?\s+start(?:\s|$)/.test(cmd) ||
         // Bare `beehaven start` — wrapper already matched argv[0].
         /^(\S*\/)?beehaven\s+start\b/.test(cmd));
 }

package/dist/daemon.js

@@ -14,7 +14,7 @@ import { browsePath } from './file-browser.js';
 import { CloudBeeProxy } from './bee/cloud-proxy.js';
 import { IpcServer, probeIpcSocket } from './ipc-server.js';
 import { ipcSocketPath } from './ipc-path.js';
-import { isBeehavenCommandLine, windowsNodeProcesses, selectWindowsDaemons } from './daemon-process.js';
+import { isBeehavenCommandLine, windowsNodeProcesses, selectWindowsDaemons, daemonEntryPattern } from './daemon-process.js';
 import { mintIpcAuthTokens, clearIpcAuthToken } from './ipc-auth.js';
 /**
  * What THIS daemon minted, so shutdown can avoid scrubbing a successor's token.
@@ -41,7 +41,7 @@ import { AgentSessions } from './agent-sessions.js';
 import { RELAY_PRESETS, relayUrlFromConfig, resolveRelaySelection } from './relay-presets.js';
 import { readFileSync, existsSync, mkdirSync, mkdtempSync, writeFileSync, readdirSync, chmodSync, unlinkSync, rmSync, } from 'fs';
 import { createHash } from 'crypto';
-import { execFile, execSync, spawn } from 'child_process';
+import { execFile, execFileSync, execSync, spawn } from 'child_process';
 import { homedir, tmpdir } from 'os';
 import { join, dirname, relative } from 'path';
 import { fileURLToPath } from 'url';
@@ -1228,13 +1228,14 @@ export function findLiveDaemons() {
     //    re-validated by isBeehavenProcess so a broad pgrep hit still has
     //    to pass the strict regex check before being considered ours.
     const patterns = [
+        daemonEntryPattern(),
         'beehaven.*daemon-entry\\.(js|ts)',
         'beehaven.*cli\\.(js|ts)',
         'Clearly.*Resources/beehaven',
     ];
     for (const pattern of patterns) {
         try {
-            const out = execSync(`pgrep -f "${pattern}"`, {
+            const out = execFileSync('pgrep', ['-f', pattern], {
                 encoding: 'utf8',
                 stdio: ['pipe', 'pipe', 'pipe'],
             }).trim();

package/dist/relay.js

@@ -518,7 +518,16 @@ export class Relay {
                     expiredNoRefresh = true;
             }
         }
-        catch { }
+        catch {
+            // A damaged cached ID token has no decodable exp, but a valid refresh session can still
+            // recover it. Do not strand that account in an unauthenticated reconnect loop. Opaque
+            // self-hosted tokens without a refresh session retain their existing dial behavior.
+            if (this.config.refreshToken) {
+                const refreshed = await this.refreshIdToken();
+                if (refreshed && this.config)
+                    token = this.config.token;
+            }
+        }
         // If the token is already expired AND refresh failed, dialing would just
         // get rejected — spinning the reconnect loop forever with a dead
         // credential (the classic "daemon stuck reconnecting" state). Back off

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clearlysh/beehaven",
-  "version": "0.8.37",
+  "version": "0.8.38",
   "description": "Beehaven CLI — command your Clearly workspace, agents, and canvas from the terminal",
   "private": false,
   "type": "module",

package/dist/daemon-codex.js

@@ -1,349 +0,0 @@
-/**
- * Daemon-side Codex — OpenAI Codex SDK integration, sibling of daemon-omni.
- *
- * The "treehouse" architecture: one daemon process hosts multiple AI
- * agent SDKs in parallel, each as its own module with the same shape:
- *   • daemon-omni.ts     → @anthropic-ai/claude-agent-sdk (Claude)
- *   • daemon-codex.ts    → @openai/codex-sdk             (GPT/Codex)
- *   • daemon-gemini-cli  → @google/gemini-cli-core       (planned)
- *
- * Each emits the SAME event shapes (agent:text-delta, agent:tool-call,
- * agent:tool-result, agent:done) so the FAB renderer doesn't need a
- * per-provider code path.
- *
- * IPC verbs the daemon exposes:
- *   codex:prompt   { prompt, sessionId, model?, workingDir? }
- *   codex:end      { sessionId }
- *   codex:sessions {}
- *
- * Codex SDK shape (v0.130):
- *   const codex = new Codex({ apiKey? });
- *   const thread = codex.startThread({ model?, workingDirectory? });
- *   const stream = thread.runStreamed(prompt);
- *   for await (const event of stream.events) { ... }
- *
- * Auth:
- *   Reads OPENAI_API_KEY from process.env. If absent, the SDK refuses
- *   to start. Future: per-user BYOK via daemon settings.
- */
-const sessions = new Map();
-const subscribers = new Set();
-// Lazy SDK instance — keeps the Codex client warm across sessions in
-// the same daemon process. Constructed on first session start.
-let _codex = null;
-// ── Safety knobs (parity with daemon-omni — audit task #64) ──────────
-/** Default max prompts queued per session before promptCodex rejects. */
-const DEFAULT_MAX_QUEUED_PROMPTS = 20;
-/** Idle-session reaper: a Codex session held in memory after the user
- *  stops using it leaks a Thread object (which the SDK may keep TCP
- *  connections / file descriptors warm for). Reaper sweeps every minute
- *  and ends sessions idle longer than the timeout. The Codex SDK's
- *  thread store survives — next promptCodex resumes via resumeThreadId. */
-const IDLE_TIMEOUT_MS = (() => {
-    const env = process.env.BEEHAVEN_CODEX_IDLE_TIMEOUT_MS;
-    if (env != null) {
-        const n = Number(env);
-        if (Number.isFinite(n) && n >= 0)
-            return n;
-    }
-    return 30 * 60_000; // 30 min default — matches Omni
-})();
-const CLEANUP_INTERVAL_MS = 60_000;
-let cleanupTimer = null;
-function reapIdleSessions() {
-    if (IDLE_TIMEOUT_MS === 0)
-        return 0;
-    const now = Date.now();
-    let reaped = 0;
-    for (const [id, sess] of sessions) {
-        if (sess.turnInFlight)
-            continue; // never reap mid-turn
-        if (sess.queuedPrompts.length > 0)
-            continue; // pending work
-        if (now - sess.lastActivityAt > IDLE_TIMEOUT_MS) {
-            endSession(id);
-            reaped++;
-        }
-    }
-    return reaped;
-}
-function ensureCleanupTimer() {
-    if (cleanupTimer)
-        return;
-    if (IDLE_TIMEOUT_MS === 0)
-        return;
-    cleanupTimer = setInterval(() => {
-        const reaped = reapIdleSessions();
-        if (reaped > 0) {
-            // eslint-disable-next-line no-console
-            console.log(`[codex] reaped ${reaped} idle session(s); ${sessions.size} remain`);
-        }
-    }, CLEANUP_INTERVAL_MS);
-    if (typeof cleanupTimer?.unref === 'function')
-        cleanupTimer.unref();
-}
-// ── Subscriber API ───────────────────────────────────────────────────
-export function subscribe(fn) {
-    subscribers.add(fn);
-    return () => subscribers.delete(fn);
-}
-function emit(event) {
-    for (const fn of subscribers) {
-        try {
-            fn(event);
-        }
-        catch { /* subscriber errors don't sink the loop */ }
-    }
-}
-async function getOrCreateCodex() {
-    if (_codex)
-        return _codex;
-    const mod = await import('@openai/codex-sdk');
-    _codex = new mod.Codex();
-    return _codex;
-}
-async function getOrCreateSession(opts) {
-    const existing = sessions.get(opts.sessionId);
-    if (existing)
-        return existing;
-    const now = Date.now();
-    const session = {
-        sessionId: opts.sessionId,
-        userId: opts.userId,
-        thread: null,
-        threadId: opts.resumeThreadId ?? null,
-        ended: false,
-        turnIndex: 0,
-        startedAt: now,
-        currentText: '',
-        turnInFlight: false,
-        queuedPrompts: [],
-        lastActivityAt: now,
-        maxQueuedPrompts: opts.maxQueuedPrompts ?? DEFAULT_MAX_QUEUED_PROMPTS,
-    };
-    sessions.set(opts.sessionId, session);
-    ensureCleanupTimer();
-    const codex = await getOrCreateCodex();
-    // Resolve working directory (#103): if compositionId is set, use the
-    // composition's scratch dir — same as Claude's FAB session. Codex
-    // and Claude operating in the same directory is the basis of the
-    // handoff pattern (Claude writes plan.md, Codex reads + implements).
-    // Explicit workingDir overrides; otherwise compositionId wins;
-    // otherwise SDK default.
-    let workingDirectory;
-    if (opts.workingDir) {
-        workingDirectory = opts.workingDir;
-    }
-    else if (opts.compositionId) {
-        const { homedir } = await import('os');
-        const { join } = await import('path');
-        const { existsSync, mkdirSync } = await import('fs');
-        workingDirectory = join(homedir(), '.clearly', 'compositions', opts.compositionId);
-        try {
-            if (!existsSync(workingDirectory))
-                mkdirSync(workingDirectory, { recursive: true });
-        }
-        catch { /* fall through — Codex will fail with a clearer error */ }
-    }
-    // `skipGitRepoCheck`: Codex defaults to requiring a Git repo for the
-    // working directory (refuses to start otherwise). Composition dirs
-    // aren't git repos by default, so we disable the check.
-    session.thread = opts.resumeThreadId
-        ? codex.resumeThread(opts.resumeThreadId)
-        : codex.startThread({
-            ...(opts.model ? { model: opts.model } : {}),
-            ...(workingDirectory ? { workingDirectory } : {}),
-            skipGitRepoCheck: true,
-        });
-    return session;
-}
-/**
- * Run a single Codex turn — the SDK's runStreamed returns an iterable
- * of typed events; we re-shape each into our CodexEvent union and emit.
- *
- * Codex's event taxonomy (per SDK 0.130):
- *   • item.completed → text chunks (kind: 'agent_message')
- *   • item.completed → tool calls/results (kind: 'command_execution')
- *   • turn.completed → end of turn marker
- *   • thread.started → session id update
- *   • error → fail the turn
- *
- * We translate these to the same {agent:text-delta, agent:tool-call,
- * agent:tool-result, agent:done} the FAB already speaks for Claude.
- */
-async function runTurn(session, prompt) {
-    if (session.ended)
-        return;
-    if (!session.thread) {
-        throw new Error('Codex session not initialized');
-    }
-    session.turnInFlight = true;
-    session.currentText = '';
-    const turnStart = Date.now();
-    try {
-        const stream = await session.thread.runStreamed(prompt);
-        for await (const event of stream.events) {
-            if (session.ended)
-                break;
-            handleCodexEvent(session, event);
-        }
-        session.turnIndex += 1;
-        emit({
-            type: 'agent:turn-complete',
-            sessionId: session.sessionId,
-            turnIndex: session.turnIndex,
-        });
-        emit({
-            type: 'agent:done',
-            sessionId: session.sessionId,
-            result: {
-                text: session.currentText,
-                turns: session.turnIndex,
-                durationMs: Date.now() - turnStart,
-            },
-        });
-    }
-    catch (err) {
-        emit({
-            type: 'agent:error',
-            sessionId: session.sessionId,
-            error: err?.message ?? String(err),
-        });
-    }
-    finally {
-        session.turnInFlight = false;
-        session.lastActivityAt = Date.now();
-        // Drain queued prompts FIFO (parity with daemon-omni — audit #64).
-        const next = session.queuedPrompts.shift();
-        if (next && !session.ended) {
-            void runTurn(session, next).catch((e) => {
-                emit({
-                    type: 'agent:error',
-                    sessionId: session.sessionId,
-                    error: e?.message ?? String(e),
-                });
-            });
-        }
-    }
-}
-function handleCodexEvent(session, event) {
-    // Item events — Codex bundles assistant messages, tool calls, and
-    // tool results all as "items." We dispatch on kind.
-    if (event?.type === 'item.completed' || event?.type === 'item.updated') {
-        const item = event.item;
-        if (!item)
-            return;
-        if (item.item_type === 'agent_message' && typeof item.text === 'string') {
-            // Codex sends the full assistant message text in one item rather
-            // than delta-chunks. We emit it as a single agent:text-delta with
-            // the whole payload — the FAB's streaming bubble handler treats
-            // "current = '' + this chunk" as full text, which is the right
-            // behavior since the bubble had no prior content.
-            const delta = item.text.slice(session.currentText.length);
-            if (delta) {
-                session.currentText = item.text;
-                emit({
-                    type: 'agent:text-delta',
-                    sessionId: session.sessionId,
-                    text: delta,
-                });
-            }
-            return;
-        }
-        if (item.item_type === 'command_execution') {
-            // Two-phase: when Codex starts a command, we emit tool-call.
-            // When it finishes (status === 'completed' | 'failed'), we emit
-            // tool-result. Both carry the same call id so the FAB can match.
-            const callId = item.id ?? `codex-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
-            const status = item.status;
-            if (status === 'in_progress' || event.type === 'item.updated') {
-                emit({
-                    type: 'agent:tool-call',
-                    sessionId: session.sessionId,
-                    callId,
-                    tool: 'Bash', // Codex's command_execution is shell-based
-                    input: { command: item.command ?? '', description: '' },
-                });
-            }
-            else if (status === 'completed' || status === 'failed') {
-                const out = item.aggregated_output ?? '';
-                emit({
-                    type: 'agent:tool-result',
-                    sessionId: session.sessionId,
-                    callId,
-                    tool: 'Bash',
-                    ok: status === 'completed',
-                    preview: typeof out === 'string' ? out.slice(0, 200) : '',
-                });
-            }
-            return;
-        }
-        return;
-    }
-    if (event?.type === 'thread.started' && event.thread_id) {
-        session.threadId = event.thread_id;
-        return;
-    }
-    if (event?.type === 'error') {
-        emit({
-            type: 'agent:error',
-            sessionId: session.sessionId,
-            error: event.message ?? 'Codex error',
-        });
-        return;
-    }
-}
-/** Push a user message into a Codex session. Resolves when the SDK
- *  starts processing (events stream via subscribers). One concurrent
- *  turn per session; subsequent prompts queue FIFO (parity with
- *  daemon-omni). Throws QUEUE_FULL if the queue is at capacity. */
-export async function promptCodex(input) {
-    const session = await getOrCreateSession({
-        sessionId: input.sessionId,
-        userId: input.userId,
-        model: input.model,
-        workingDir: input.workingDir,
-        compositionId: input.compositionId,
-        resumeThreadId: input.resumeThreadId,
-        maxQueuedPrompts: input.maxQueuedPrompts,
-    });
-    if (session.ended) {
-        throw new Error(`Codex session ${input.sessionId} has ended; start a new one.`);
-    }
-    if (session.turnInFlight) {
-        // Queue cap (audit task #64 — parity with daemon-omni).
-        if (session.queuedPrompts.length >= session.maxQueuedPrompts) {
-            throw new Error(`QUEUE_FULL: Codex session ${input.sessionId} has ${session.queuedPrompts.length} prompts queued (max ${session.maxQueuedPrompts}). ` +
-                `Wait for the current turn to finish or end this session.`);
-        }
-        session.queuedPrompts.push(input.prompt);
-    }
-    else {
-        // Fire-and-forget the turn — the subscriber stream surfaces progress.
-        void runTurn(session, input.prompt).catch((err) => {
-            emit({
-                type: 'agent:error',
-                sessionId: session.sessionId,
-                error: err?.message ?? String(err),
-            });
-        });
-    }
-    return { sessionId: input.sessionId, threadId: session.threadId };
-}
-export function endSession(sessionId) {
-    const session = sessions.get(sessionId);
-    if (!session)
-        return;
-    session.ended = true;
-    sessions.delete(sessionId);
-}
-export function listSessions() {
-    const now = Date.now();
-    return Array.from(sessions.values()).map((s) => ({
-        sessionId: s.sessionId,
-        userId: s.userId,
-        turns: s.turnIndex,
-        ageMs: now - s.startedAt,
-        threadId: s.threadId,
-    }));
-}

package/dist/daemon-write-sandbox.js

@@ -1,191 +0,0 @@
-/**
- * Sandbox-then-commit Write policy (#62) — gate destructive Write tool
- * calls behind a temp-directory sandbox so a buggy agent can't
- * irrecoverably trash the user's filesystem.
- *
- * The pattern:
- *   1. Agent calls `Write` with file_path X + new content.
- *   2. canUseTool wrapper intercepts:
- *      - mkdtemp under `~/.beehaven/sandbox/<sessionId>/`
- *      - mirror the file (or its containing dir) into the sandbox
- *      - write to the sandboxed copy
- *      - return ok to the agent (it sees the write as "successful")
- *   3. On agent:done OR explicit `commit-sandbox` IPC verb, atomically
- *      promote the sandbox into the real path.
- *   4. On `discard-sandbox` (timeout / agent error), rm -rf the
- *      sandbox dir.
- *
- * Wins:
- *   - One buggy agent turn doesn't permanently corrupt the user's
- *     project. Diffs are reviewable before commit.
- *   - Pair with `git-vfs.ts` (#103 Claude→Codex handoff) — the sandbox
- *     dir is a git working tree, so the agent's edits show as
- *     untracked changes the user can `git diff` against.
- *
- * Wiring (Mac app rebuild required after this lands):
- *   - daemon-omni-hooks.ts: add a PreToolUse hook for `Write` that
- *     calls `wrapInSandbox()` before the agent SDK dispatches.
- *   - daemon-omni.ts: on agent:done, fire `commitSandbox(sessionId)`.
- *   - Add `commit-sandbox` + `discard-sandbox` IPC verbs in
- *     packages/cli/src/ipc-server.ts so the FAB can drive a "Review
- *     changes → Apply" approval card (#59).
- */
-import { mkdir, copyFile, rename, rm, stat, readFile, writeFile } from 'node:fs/promises';
-import { dirname, join, normalize as normalizePath, isAbsolute, } from 'node:path';
-import { homedir } from 'node:os';
-import { existsSync } from 'node:fs';
-const SANDBOX_ROOT = join(homedir(), '.beehaven', 'sandbox');
-/**
- * Defense-in-depth path check (note from 2.19.0 audit). Callers today
- * pre-normalize realPath via the path-transform layer, so escape-via-`..`
- * isn't reachable in the current wiring. But this module is library
- * code — future callers may invoke it directly. Reject anything that
- * isn't an absolute, normalized path with no `..` segments.
- */
-function assertSafeRealPath(realPath) {
-    if (typeof realPath !== 'string' || realPath.length === 0) {
-        throw new Error('wrapInSandbox: realPath must be a non-empty string');
-    }
-    if (!isAbsolute(realPath)) {
-        throw new Error(`wrapInSandbox: realPath must be absolute (got '${realPath}')`);
-    }
-    const normalized = normalizePath(realPath);
-    if (normalized !== realPath) {
-        throw new Error(`wrapInSandbox: realPath must be normalized — '${realPath}' normalizes to '${normalized}'`);
-    }
-    if (normalized.split('/').includes('..')) {
-        throw new Error(`wrapInSandbox: realPath must not contain '..' segments (got '${realPath}')`);
-    }
-}
-const _activeSandboxes = new Map();
-/**
- * Wrap a Write call in a sandbox. Returns the sandboxed path the
- * agent should actually write to. The caller is responsible for
- * subbing that path into the agent's tool-input before dispatch.
- */
-export async function wrapInSandbox(args) {
-    assertSafeRealPath(args.realPath);
-    // Per-session sandbox dir. Same session reuses the dir so multi-file
-    // writes share a coherent staging area.
-    const sessionDir = await ensureSessionDir(args.sessionId);
-    // Mirror the realPath structure inside the sandbox. For a real path
-    // `/Users/me/proj/src/foo.ts` we land at
-    // `~/.beehaven/sandbox/<sid>/Users/me/proj/src/foo.ts`. Absolute-path
-    // preservation lets the commit step paths-back-1-to-1.
-    const sandboxPath = join(sessionDir, args.realPath.replace(/^\//, ''));
-    await mkdir(dirname(sandboxPath), { recursive: true });
-    // Snapshot existing content (for restore-on-discard). Skip for
-    // files > 5 MB — we don't want to balloon disk on a large file
-    // sandbox. Those skip restore, and discard becomes "delete only."
-    let originalContent;
-    let preExisting = false;
-    if (existsSync(args.realPath)) {
-        preExisting = true;
-        try {
-            const s = await stat(args.realPath);
-            if (s.size < 5 * 1024 * 1024) {
-                originalContent = await readFile(args.realPath, 'utf8');
-            }
-            // Pre-populate the sandbox with the current file so partial
-            // edits (e.g. agent appending) start from real state.
-            await copyFile(args.realPath, sandboxPath);
-        }
-        catch {
-            // Source unreadable — let the agent write its content fresh
-            // into the sandbox.
-        }
-    }
-    // If the agent supplied content, write it to the sandbox up-front
-    // so the inspector RPC can show it without waiting for the agent
-    // to finish.
-    if (args.content !== undefined) {
-        await writeFile(sandboxPath, args.content, 'utf8');
-    }
-    const sandboxedWrite = {
-        sessionId: args.sessionId,
-        realPath: args.realPath,
-        sandboxPath,
-        preExisting,
-        originalContent,
-        ts: Date.now(),
-    };
-    const list = _activeSandboxes.get(args.sessionId) ?? [];
-    list.push(sandboxedWrite);
-    _activeSandboxes.set(args.sessionId, list);
-    return { sandboxPath, sandboxedWrite };
-}
-/**
- * Atomically promote a session's sandboxed writes into their real
- * paths. Uses fs.rename which is atomic on the same filesystem.
- *
- * Returns the list of {realPath, ok, error?} per file so the UI can
- * surface which writes landed cleanly.
- */
-export async function commitSandbox(sessionId) {
-    const writes = _activeSandboxes.get(sessionId) ?? [];
-    const results = [];
-    for (const w of writes) {
-        try {
-            await mkdir(dirname(w.realPath), { recursive: true });
-            // rename is atomic on same FS; if cross-FS, fall back to copy.
-            try {
-                await rename(w.sandboxPath, w.realPath);
-            }
-            catch {
-                await copyFile(w.sandboxPath, w.realPath);
-                await rm(w.sandboxPath, { force: true });
-            }
-            results.push({ realPath: w.realPath, ok: true });
-        }
-        catch (err) {
-            results.push({ realPath: w.realPath, ok: false, error: err?.message ?? 'commit-failed' });
-        }
-    }
-    _activeSandboxes.delete(sessionId);
-    // Best-effort: nuke the session dir so the next session starts clean.
-    try {
-        await rm(await sessionDirPath(sessionId), { recursive: true, force: true });
-    }
-    catch { }
-    return results;
-}
-/**
- * Discard a session's sandboxed writes. Restores any pre-existing
- * content from `originalContent` snapshots; deletes new files.
- */
-export async function discardSandbox(sessionId) {
-    const writes = _activeSandboxes.get(sessionId) ?? [];
-    let restored = 0;
-    for (const w of writes) {
-        if (w.preExisting && w.originalContent !== undefined) {
-            try {
-                await writeFile(w.realPath, w.originalContent, 'utf8');
-                restored++;
-            }
-            catch { }
-        }
-    }
-    _activeSandboxes.delete(sessionId);
-    try {
-        await rm(await sessionDirPath(sessionId), { recursive: true, force: true });
-    }
-    catch { }
-    return { discarded: writes.length, restored };
-}
-/**
- * List a session's pending writes. Powers the FAB approval card's
- * "Review N changes" affordance.
- */
-export function listPendingWrites(sessionId) {
-    return _activeSandboxes.get(sessionId) ?? [];
-}
-async function ensureSessionDir(sessionId) {
-    const dir = await sessionDirPath(sessionId);
-    await mkdir(dir, { recursive: true });
-    return dir;
-}
-async function sessionDirPath(sessionId) {
-    // Sanitize sessionId — agent-supplied. Anything outside [a-z0-9-_] becomes _.
-    const safe = sessionId.replace(/[^a-z0-9\-_]/gi, '_').slice(0, 64);
-    return join(SANDBOX_ROOT, safe);
-}