@cotal-ai/cli 0.10.1 → 0.11.1

package/dist/commands/doctor.d.ts

@@ -0,0 +1,14 @@
+import { type ParsedArgs } from "@cotal-ai/core";
+export declare const doctorFlags: readonly [{
+    readonly name: "fix";
+    readonly type: "boolean";
+    readonly description: "execute the safe repairs (re-sign the manager-remintable daemon creds; needs the local signer)";
+}];
+/** `cotal doctor auth` — the ONE stale-credential repair surface (D5 slice 6). Read-only diagnosis
+ *  of every managed credential file in this folder against the credential-lifetime matrix, rendered
+ *  as healthy / near-expiry (yellow) / expired / unreadable (red) with the LAST-RENEWAL timestamp
+ *  for manager-reminted creds — ending in either `healthy` or the exact next command (exit 1).
+ *  `--fix` executes the one safe local repair (re-sign the class-2 daemon files for their existing
+ *  nkeys); $SYS and agent creds are never auto-fixed — their repairs are printed, not guessed. */
+export declare function doctor(args: ParsedArgs): Promise<void>;
+//# sourceMappingURL=doctor.d.ts.map

package/dist/commands/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAEA,OAAO,EAML,KAAK,UAAU,EAChB,MAAM,gBAAgB,CAAC;AAaxB,eAAO,MAAM,WAAW;;;;EAEd,CAAC;AAaX;;;;;kGAKkG;AAClG,wBAAsB,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAmD5D"}

package/dist/commands/doctor.js

@@ -0,0 +1,171 @@
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { basename, join } from "node:path";
+import { credentialLifetime, inspectCredHealth, } from "@cotal-ai/core";
+import { authDir, findCotalRoot, loadSpaceAuth, readRenewalRecord, remintDaemonCreds, userAuthStateDir, writeRenewalRecord, } from "@cotal-ai/workspace";
+import { displayCmd } from "../lib/self-exec.js";
+import { c } from "../ui.js";
+export const doctorFlags = [
+    { name: "fix", type: "boolean", description: "execute the safe repairs (re-sign the manager-remintable daemon creds; needs the local signer)" },
+];
+/** `cotal doctor auth` — the ONE stale-credential repair surface (D5 slice 6). Read-only diagnosis
+ *  of every managed credential file in this folder against the credential-lifetime matrix, rendered
+ *  as healthy / near-expiry (yellow) / expired / unreadable (red) with the LAST-RENEWAL timestamp
+ *  for manager-reminted creds — ending in either `healthy` or the exact next command (exit 1).
+ *  `--fix` executes the one safe local repair (re-sign the class-2 daemon files for their existing
+ *  nkeys); $SYS and agent creds are never auto-fixed — their repairs are printed, not guessed. */
+export async function doctor(args) {
+    const sub = args.positionals[0];
+    if (sub !== "auth") {
+        console.error(`usage: ${displayCmd()} doctor auth [--fix]  - credential-health diagnosis + repair for this folder's mesh`);
+        process.exitCode = 1;
+        return;
+    }
+    const values = args.values;
+    const root = findCotalRoot(process.cwd());
+    const auth = loadSpaceAuth(authDir(root));
+    console.log(c.bold("cotal doctor auth"));
+    console.log(`  root ${root}`);
+    if (!auth) {
+        // An open mesh has no minted credentials at all — nothing to diagnose is a healthy answer,
+        // not a silent one.
+        console.log(c.green("\nauth: healthy - open mesh (no credential material in this folder)"));
+        return;
+    }
+    const userMode = existsSync(userAuthStateDir(root, auth.space));
+    console.log(`  space ${auth.space}${userMode ? " · user-auth" : ""} · signer ${c.green("present")} (${join(authDir(root), "auth.json")})`);
+    let reports = inventory(root);
+    let problems = reports.filter((r) => r.problem);
+    // --fix: the one safe local repair — re-sign the remintable daemon files (same nkeys), exactly
+    // what the manager's renewal pass does, and record the pass so the audit trail stays honest
+    // (adoption is the DAEMON's explicit reload, which only the running manager requests — a doctor
+    // fix without a live manager is adopted by the daemon's 75% re-read backstop). Then re-diagnose:
+    // the doctor reports what IS, never what it hopes the fix did.
+    if (values.fix && problems.some((r) => isRemintable(r.kind))) {
+        console.log(c.dim("\n--fix: re-signing the remintable daemon creds…"));
+        const results = await remintDaemonCreds(root);
+        writeRenewalRecord(root, { ts: new Date().toISOString(), owner: "doctor --fix", results });
+        for (const r of results.filter((x) => !x.ok && !x.skipped))
+            console.error(c.red(`  ✗ ${r.file}: ${r.error}`));
+        reports = inventory(root);
+        problems = reports.filter((r) => r.problem);
+    }
+    render("Daemon creds (manager-reminted - class 2)", reports.filter((r) => isRemintable(r.kind)));
+    renderRenewalRecord(root);
+    render("$SYS creds (rotation-renewed - never remintable from disk)", reports.filter((r) => r.kind === "membership-observer" || r.kind === "connection-evictor"));
+    render("Agent creds (static, pre-flip)", reports.filter((r) => r.kind === "agent"));
+    if (!problems.length) {
+        console.log(c.green("\nauth: healthy"));
+        return;
+    }
+    console.log(c.red(`\nauth: ${problems.length} problem${problems.length === 1 ? "" : "s"}`));
+    for (const p of problems)
+        console.log(`  ${c.red("✗")} ${p.label}: ${p.problem}\n    next: ${p.repair}`);
+    process.exitCode = 1;
+}
+function isRemintable(kind) {
+    return kind === "delivery" || kind === "membership-rw";
+}
+/** Inspect every managed credential file for this folder. Missing files are noted (with how they
+ *  get provisioned) but only EXISTING-but-bad material is a problem — process presence is `cotal
+ *  status`'s job; this surface owns credential health. */
+function inventory(root) {
+    const cotal = (f) => join(root, ".cotal", f);
+    const fixed = [
+        { label: "delivery.creds", kind: "delivery", path: cotal("delivery.creds") },
+        { label: "membership-rw.creds", kind: "membership-rw", path: cotal("membership-rw.creds") },
+        { label: "membership-observer.creds", kind: "membership-observer", path: cotal("membership-observer.creds") },
+        { label: "connection-evictor.creds", kind: "connection-evictor", path: cotal("connection-evictor.creds") },
+    ];
+    const reports = fixed.map((f) => report(f.label, f.kind, f.path));
+    const agentDir = join(authDir(root), "creds");
+    if (existsSync(agentDir)) {
+        for (const f of readdirSync(agentDir).filter((f) => f.endsWith(".creds") && !f.endsWith(".sentinel.creds")).sort()) {
+            reports.push(report(basename(f), "agent", join(agentDir, f)));
+        }
+    }
+    return reports;
+}
+function report(label, kind, path) {
+    if (!existsSync(path))
+        return { label, kind, path };
+    const health = inspectCredHealth(readFileSync(path, "utf8"));
+    const r = { label, kind, path, health };
+    const policy = credentialLifetime(kind);
+    const standing = policy.class === "standing-renewable" || policy.class === "rotation-renewed";
+    const repair = isRemintable(kind)
+        ? `${displayCmd()} doctor auth --fix   (or start the mesh's manager - it is the renewal owner and re-signs + reloads these every half-TTL)`
+        : kind === "agent"
+            ? `respawn the agent (\`${displayCmd()} spawn\`) - its old cred is dead by design`
+            : `system-account rotation: \`${displayCmd()} down\` then a fresh \`${displayCmd()} up\` regenerates the $SYS material`;
+    switch (health.state) {
+        case "unreadable":
+            r.problem = `unreadable credential file (${health.error})`;
+            r.repair = repair;
+            break;
+        case "expired":
+            r.problem = "EXPIRED - the broker denies this credential";
+            r.repair = repair;
+            break;
+        case "near-expiry":
+            if (standing) {
+                r.problem = `past its renewal point (renewal owner: ${policy.renewalOwner}) - expires ${at(health.exp)}`;
+                r.repair = repair;
+            }
+            break;
+        case "unbounded":
+            if (standing) {
+                r.problem = "unbounded standing credential (minted before the renewal slice) - a copied cred never dies";
+                r.repair = repair;
+            }
+            break;
+    }
+    return r;
+}
+function render(title, reports) {
+    console.log(`\n  ${c.bold(title)}`);
+    if (!reports.length) {
+        console.log(c.dim("    none"));
+        return;
+    }
+    for (const r of reports) {
+        if (!r.health) {
+            console.log(`    ${c.dim("−")} ${r.label} ${c.dim(`not provisioned here (written by \`${displayCmd()} up\`)`)}`);
+            continue;
+        }
+        const h = r.health;
+        const lastRenewal = h.iat ? c.dim(` · last renewal ${at(h.iat)}`) : "";
+        const expiry = h.exp ? c.dim(` · expires ${at(h.exp)}`) : "";
+        const badge = h.state === "healthy" ? c.green("● healthy")
+            : h.state === "near-expiry" ? c.yellow("◐ near-expiry")
+                : h.state === "unbounded" ? (r.problem ? c.red("∞ unbounded") : c.dim("∞ static (dies at the flip)"))
+                    : c.red(`✗ ${h.state}`);
+        console.log(`    ${badge}  ${r.label}${lastRenewal}${expiry}`);
+    }
+}
+/** Render the renewal owner's audit record (written by the manager's pass / doctor --fix): when the
+ *  last pass ran, who ran it, and whether the daemon EXPLICITLY adopted — the "file re-signed" vs
+ *  "daemon adopted" distinction the D5 panel required. Absence is informational (a mesh started
+ *  before the renewal owner existed, or an open mesh). */
+function renderRenewalRecord(root) {
+    const rec = readRenewalRecord(root);
+    if (!rec) {
+        console.log(c.dim("    no renewal record yet (written by the manager's renewal pass)"));
+        return;
+    }
+    const resigned = rec.results.filter((r) => r.ok).map((r) => r.file);
+    const failed = rec.results.filter((r) => !r.ok && !r.skipped);
+    const adoption = rec.adoption === undefined
+        ? resigned.length
+            ? c.yellow("daemon adoption not requested by this pass - daemons adopt via the 75% re-read backstop or the manager's next renewal pass")
+            : c.dim("adoption: n/a (nothing re-signed)")
+        : rec.adoption.ok
+            ? c.green("daemon adopted ✓")
+            : c.yellow(`daemon adoption pending - ${rec.adoption.error ?? "unknown"}`);
+    console.log(`    ${c.dim(`last renewal pass ${rec.ts} by ${rec.owner}`)} - re-signed [${resigned.join(", ") || "none"}] · ${adoption}`);
+    for (const f of failed)
+        console.log(`    ${c.red("✗")} last pass failed on ${f.file}: ${f.error}`);
+}
+function at(sec) {
+    return sec ? new Date(sec * 1000).toISOString() : "?";
+}
+//# sourceMappingURL=doctor.js.map

package/dist/commands/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAKlB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,OAAO,EACP,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,UAAU,CAAC;AAE7B,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,gGAAgG,EAAE;CACvI,CAAC;AAaX;;;;;kGAKkG;AAClG,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAgB;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,CAAC,UAAU,UAAU,EAAE,qFAAqF,CAAC,CAAC;QAC3H,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAwC,CAAC;IAC7D,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAE1C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,2FAA2F;QAC3F,oBAAoB;QACpB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAC,CAAC;QAC5F,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;IAE3I,IAAI,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAEhD,+FAA+F;IAC/F,4FAA4F;IAC5F,gGAAgG;IAChG,iGAAiG;IACjG,+DAA+D;IAC/D,IAAI,MAAM,CAAC,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC9C,kBAAkB,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3F,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC9G,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC1B,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,CAAC,2CAA2C,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,CAAC,4DAA4D,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,IAAI,CAAC,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC;IACjK,MAAM,CAAC,gCAAgC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC;IAEpF,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,QAAQ,CAAC,MAAM,WAAW,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC5F,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACzG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,YAAY,CAAC,IAAoB;IACxC,OAAO,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,eAAe,CAAC;AACzD,CAAC;AAED;;0DAE0D;AAC1D,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACrD,MAAM,KAAK,GAAiE;QAC1E,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,gBAAgB,CAAC,EAAE;QAC5E,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,CAAC,qBAAqB,CAAC,EAAE;QAC3F,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,KAAK,CAAC,2BAA2B,CAAC,EAAE;QAC7G,EAAE,KAAK,EAAE,0BAA0B,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,KAAK,CAAC,0BAA0B,CAAC,EAAE;KAC3G,CAAC;IACF,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACnH,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,MAAM,CAAC,KAAa,EAAE,IAAoB,EAAE,IAAY;IAC/D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,iBAAiB,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,GAAe,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,KAAK,oBAAoB,IAAI,MAAM,CAAC,KAAK,KAAK,kBAAkB,CAAC;IAC9F,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC;QAC/B,CAAC,CAAC,GAAG,UAAU,EAAE,0HAA0H;QAC3I,CAAC,CAAC,IAAI,KAAK,OAAO;YAChB,CAAC,CAAC,wBAAwB,UAAU,EAAE,4CAA4C;YAClF,CAAC,CAAC,8BAA8B,UAAU,EAAE,0BAA0B,UAAU,EAAE,qCAAqC,CAAC;IAC5H,QAAQ,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,KAAK,YAAY;YACf,CAAC,CAAC,OAAO,GAAG,+BAA+B,MAAM,CAAC,KAAK,GAAG,CAAC;YAC3D,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC;YAClB,MAAM;QACR,KAAK,SAAS;YACZ,CAAC,CAAC,OAAO,GAAG,6CAA6C,CAAC;YAC1D,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC;YAClB,MAAM;QACR,KAAK,aAAa;YAChB,IAAI,QAAQ,EAAE,CAAC;gBACb,CAAC,CAAC,OAAO,GAAG,0CAA0C,MAAM,CAAC,YAAY,eAAe,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzG,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC;YACpB,CAAC;YACD,MAAM;QACR,KAAK,WAAW;YACd,IAAI,QAAQ,EAAE,CAAC;gBACb,CAAC,CAAC,OAAO,GAAG,4FAA4F,CAAC;gBACzG,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC;YACpB,CAAC;YACD,MAAM;IACV,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,MAAM,CAAC,KAAa,EAAE,OAAqB;IAClD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/B,OAAO;IACT,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,sCAAsC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;YACjH,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACnB,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,KAAK,GACT,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;YAC5C,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC;gBACvD,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;oBACrG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,KAAK,GAAG,WAAW,GAAG,MAAM,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED;;;0DAG0D;AAC1D,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC,CAAC;QACxF,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,SAAS;QACzC,CAAC,CAAC,QAAQ,CAAC,MAAM;YACf,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,4HAA4H,CAAC;YACxI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,mCAAmC,CAAC;QAC9C,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;YACf,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAC7B,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,6BAA6B,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,qBAAqB,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC,iBAAiB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,OAAO,QAAQ,EAAE,CAAC,CAAC;IACxI,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AACrG,CAAC;AAED,SAAS,EAAE,CAAC,GAAY;IACtB,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AACxD,CAAC"}

package/dist/commands/down-manifest.js

@@ -55,17 +55,17 @@ export async function downManifest(file, flags) {
         specPath = join(runParent ?? join(root, ".cotal", "run"), `${ledger.runId}.json`);
     }
     catch (e) {
-        console.error(c.red(`✗ refusing teardown — unsafe owned resource: ${e.message}`));
+        console.error(c.red(`✗ refusing teardown - unsafe owned resource: ${e.message}`));
         process.exit(1);
     }
     if (flags.dryRun) {
         console.log(c.bold("\nWould remove (dry run):"));
         for (const a of credPaths)
-            console.log(`  ${c.red("-")} agent ${a.name} ${c.dim(`(id ${a.id.slice(0, 8)}, creds ${a.path}) — stopped only if name+id match live`)}`);
+            console.log(`  ${c.red("-")} agent ${a.name} ${c.dim(`(id ${a.id.slice(0, 8)}, creds ${a.path}) - stopped only if name+id match live`)}`);
         for (const ch of ledger.created.channels)
             console.log(`  ${c.red("-")} channel ${c.cyan("#" + ch)} ${c.dim("(auth mesh: only if no members remain · open mesh: metadata cleanup, no membership audit)")}`);
         console.log(`  ${c.red("-")} run dir ${runDir ?? "(none)"} + ledger ${ledgerPath} ${c.dim("(only if every owned resource is removed/proven gone; else the ledger is kept)")}`);
-        console.log(c.dim("\nDry run — nothing was changed. The live membership check + actual disposition happen at apply."));
+        console.log(c.dim("\nDry run - nothing was changed. The live membership check + actual disposition happen at apply."));
         return;
     }
     // 4) Best-effort live teardown: stop owned agents (name AND id match) + remove childless owned
@@ -97,7 +97,7 @@ export async function downManifest(file, flags) {
                     if (!l) {
                         const sameName = live.find((r) => r.name === a.name);
                         if (sameName)
-                            console.log(c.yellow(`  ~ ${a.name}: a different agent (id ${sameName.id.slice(0, 8)}) holds this name — NOT ours, left running`));
+                            console.log(c.yellow(`  ~ ${a.name}: a different agent (id ${sameName.id.slice(0, 8)}) holds this name - NOT ours, left running`));
                         else
                             console.log(c.dim(`  • ${a.name}: not running`));
                         continue;
@@ -108,7 +108,7 @@ export async function downManifest(file, flags) {
                         console.log(c.green(`  ✓ stopped ${l.name}`));
                     }
                     else {
-                        console.log(c.yellow(`  ! ${l.name}: stop failed — ${stop.error ?? "unknown"}`));
+                        console.log(c.yellow(`  ! ${l.name}: stop failed - ${stop.error ?? "unknown"}`));
                     }
                 }
                 // Channel removal: skip on ANY uncertainty (best-effort, racy — said so in output). The
@@ -152,11 +152,11 @@ export async function downManifest(file, flags) {
             }
         }
         catch (e) {
-            console.log(c.yellow(`  ! ${ledger.server}: control plane unavailable (${e.message}) — nothing torn down remotely; the ledger is RETAINED for a later \`down -f --run ${ledger.runId}\``));
+            console.log(c.yellow(`  ! ${ledger.server}: control plane unavailable (${e.message}) - nothing torn down remotely; the ledger is RETAINED for a later \`down -f --run ${ledger.runId}\``));
         }
     }
     else {
-        console.log(c.yellow(`  ! ${ledger.server} unreachable — can't stop processes or remove channels; the ledger is RETAINED for a later \`down -f --run ${ledger.runId}\``));
+        console.log(c.yellow(`  ! ${ledger.server} unreachable - can't stop processes or remove channels; the ledger is RETAINED for a later \`down -f --run ${ledger.runId}\``));
     }
     // 5) Remote resolution: which owned REMOTE resources are NOT proven handled. An agent is unresolved
     //    if the broker was unreachable, or it's still live under our recorded id and its stop failed (an
@@ -186,11 +186,11 @@ export async function downManifest(file, flags) {
         if (sub === undefined)
             continue; // no cred file — proven absent
         if (sub === null) {
-            console.error(c.yellow(`  ! ${cp.name} creds: unreadable/unverifiable — left in place (resolve by hand if it's a stale cred)`));
+            console.error(c.yellow(`  ! ${cp.name} creds: unreadable/unverifiable - left in place (resolve by hand if it's a stale cred)`));
             continue;
         }
         if (sub !== cp.id) {
-            console.error(c.yellow(`  ~ ${cp.name} creds belong to a different agent (id ${sub.slice(0, 8)} ≠ ${cp.id.slice(0, 8)}) — ours is gone, left in place`));
+            console.error(c.yellow(`  ~ ${cp.name} creds belong to a different agent (id ${sub.slice(0, 8)} ≠ ${cp.id.slice(0, 8)}) - ours is gone, left in place`));
             continue;
         }
         try {
@@ -198,7 +198,7 @@ export async function downManifest(file, flags) {
                 console.log(c.dim(`  • removed creds for ${cp.name}`));
         }
         catch (e) {
-            console.error(c.yellow(`  ! ${cp.name} creds: ${e.message} — retained for retry`));
+            console.error(c.yellow(`  ! ${cp.name} creds: ${e.message} - retained for retry`));
             unresolvedCredIds.add(cp.id); // OUR id-verified cred, unlink failed (recoverable) → keep the record
         }
     }
@@ -209,9 +209,9 @@ export async function downManifest(file, flags) {
     const retainIds = new Set([...unresolvedIds, ...unresolvedCredIds]);
     const complete = retainIds.size === 0 && unresolvedChannels.length === 0;
     for (const s of skipped)
-        console.log(c.yellow(`  ~ left ${c.cyan("#" + s.channel)}: ${s.why}`) + c.dim(" (best-effort membership check — racy)"));
+        console.log(c.yellow(`  ~ left ${c.cyan("#" + s.channel)}: ${s.why}`) + c.dim(" (best-effort membership check - racy)"));
     if (openNoFeed.length)
-        console.log(c.dim(`  note: removed ${openNoFeed.length} channel(s) on an OPEN mesh with no membership feed — no ACL isolation to protect, no membership proof: ${openNoFeed.map((n) => "#" + n).join(", ")}`));
+        console.log(c.dim(`  note: removed ${openNoFeed.length} channel(s) on an OPEN mesh with no membership feed - no ACL isolation to protect, no membership proof: ${openNoFeed.map((n) => "#" + n).join(", ")}`));
     if (complete) {
         // Everything owned is removed/proven gone — safe to delete the run dir + launch spec + ledger.
         try {
@@ -228,7 +228,7 @@ export async function downManifest(file, flags) {
         catch (e) {
             console.error(c.yellow(`  ! ledger: ${e.message}`));
         }
-        console.log(c.green(`✓ torn down run ${ledger.runId}`) + (removed.length ? c.dim(` — removed ${removed.length} channel(s): ${removed.map((n) => "#" + n).join(", ")}`) : ""));
+        console.log(c.green(`✓ torn down run ${ledger.runId}`) + (removed.length ? c.dim(` - removed ${removed.length} channel(s): ${removed.map((n) => "#" + n).join(", ")}`) : ""));
     }
     else {
         // Partial: rewrite the ledger DOWN to the unresolved resources so a later `down -f --run` finishes.
@@ -236,9 +236,9 @@ export async function downManifest(file, flags) {
         const remaining = { ...ledger, created: { channels: unresolvedChannels, agents: remainAgents } };
         writeLedger(root, remaining, { update: true });
         console.log(c.yellow(`! partial teardown of run ${ledger.runId}`) +
-            c.dim(` — ${remainAgents.length} agent(s) + ${unresolvedChannels.length} channel(s) still owned; ledger kept`));
+            c.dim(` - ${remainAgents.length} agent(s) + ${unresolvedChannels.length} channel(s) still owned; ledger kept`));
         if (unresolvedCredIds.size)
-            console.log(c.dim(`  local credential cleanup incomplete for ${unresolvedCredIds.size} agent(s) — ledger kept for retry`));
+            console.log(c.dim(`  local credential cleanup incomplete for ${unresolvedCredIds.size} agent(s) - ledger kept for retry`));
         console.log(c.dim(`  finish later (broker up / members gone): cotal down -f ${ledger.manifestPath} --run ${ledger.runId}`));
         process.exitCode = 1; // not a full success
     }

package/dist/commands/down.d.ts

@@ -4,4 +4,20 @@ import { type ParsedArgs } from "@cotal-ai/core";
  *  an ownership-scoped teardown of a `spawn -f` deploy instead — removing ONLY what that run created
  *  (its agents + the channels it added), from the ledger, never the whole shared mesh. */
 export declare function down(args: ParsedArgs): Promise<void>;
+/** Every pidfile a background mesh records under `.cotal/`, in stop order (manager → delivery →
+ *  auth service → web → nats: the manager's graceful shutdown releases its lease OVER nats, so nats
+ *  must outlive it). Shared with `cotal clean`, which refuses local-state deletion while any of
+ *  these is still alive. */
+export declare function pidfileTargets(space: string): Array<[file: string, label: string]>;
+export declare const isAlive: (pid: number) => boolean;
+export type PidfileState = {
+    pid?: number;
+    live: boolean;
+    note?: string;
+};
+/** Read one pidfile and probe liveness with ONE hardened semantics, shared by `down`, `clean`,
+ *  and `status` so they can never drift: only a positive integer pid counts (an empty/corrupt
+ *  pidfile parses to 0, and POSIX `kill(0, 0)` probes our own process group), and EPERM reads as
+ *  ALIVE (the process exists, we merely can't signal it). */
+export declare function pidfileState(path: string): PidfileState;
 //# sourceMappingURL=down.d.ts.map

package/dist/commands/down.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"down.d.ts","sourceRoot":"","sources":["../../src/commands/down.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAOjD;;;0FAG0F;AAC1F,wBAAsB,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAmC1D"}
+{"version":3,"file":"down.d.ts","sourceRoot":"","sources":["../../src/commands/down.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAOjD;;;0FAG0F;AAC1F,wBAAsB,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAyC1D;AAED;;;4BAG4B;AAC5B,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAQlF;AAGD,eAAO,MAAM,OAAO,GAAI,KAAK,MAAM,KAAG,OAOrC,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1E;;;6DAG6D;AAC7D,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAKvD"}

package/dist/commands/down.js

@@ -1,8 +1,8 @@
-import { existsSync, readFileSync, rmSync } from "node:fs";
+import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import {} from "@cotal-ai/core";
-import { clearCurrent, getCurrent, removeMesh } from "@cotal-ai/workspace";
+import { removeMeshesByRoot } from "@cotal-ai/workspace";
 import { c } from "../ui.js";
-import { cotalPath } from "../lib/paths.js";
+import { cotalPath, cotalRoot } from "../lib/paths.js";
 import { resolveSpace } from "../lib/status.js";
 import { downManifest } from "./down-manifest.js";
 /** Stop the background processes started by `cotal up --detach`: the manager, the
@@ -15,21 +15,28 @@ export async function down(args) {
         await downManifest(values.file ?? "<run>", { run: values.run, dryRun: Boolean(values["dry-run"]) });
         return;
     }
-    const targets = [
-        ["manager.pid", "manager"],
-        ["delivery.pid", "delivery daemon"],
-        ["web.pid", "web dashboard"],
-        ["nats.pid", "nats-server"],
-    ];
+    // The auth service's pid file is SPACE-scoped (auth-service.<space>.pid) — resolve the space
+    // first, so `down` can only ever stop THIS folder's space's daemon, never another space's.
+    const space = resolveSpace(process.cwd());
+    const targets = pidfileTargets(space);
     let any = false;
-    // Sequential, in declared order (manager → delivery → web → nats): the manager's graceful shutdown
-    // releases its lease OVER nats, so nats must outlive it. Each stop awaits the real exit.
+    let allStopped = true;
+    // Sequential, in declared (stop) order — see pidfileTargets. Each stop awaits the real exit.
     for (const [file, label] of targets) {
         const pidPath = cotalPath(file);
         if (!existsSync(pidPath))
             continue;
         any = true;
-        await stop(pidPath, label);
+        if (!(await stop(pidPath, label)))
+            allStopped = false;
+    }
+    // A process we could not stop (EPERM, or a SIGKILL survivor) is still RUNNING: presenting the
+    // mesh as cleanly down — sweeping artifacts and the registry entry — would let a later `clean`
+    // delete the store underneath it. Keep everything and fail loud instead.
+    if (!allStopped) {
+        console.error(c.red("✗ not cleanly stopped - keeping the pidfiles, artifacts, and registry entry"));
+        process.exitCode = 1;
+        return;
     }
     // Non-pid control-plane artifacts: the delivery daemon's scoped creds + the manager's delivery-aware
     // marker. Drop them with the processes so a stale creds file / marker never lingers.
@@ -38,43 +45,82 @@ export async function down(args) {
     // Transient `cotal up -f` launch artifacts (launch specs + materialized runtime personas). `up -f`
     // owns the whole mesh, so tearing it down clears all run dirs — they're never authoritative source.
     rmSync(cotalPath("run"), { recursive: true, force: true });
-    // Drop this folder's mesh from the registry (and the `current` pointer if it was the default).
-    const space = resolveSpace(process.cwd());
-    removeMesh(space);
-    if (getCurrent() === space)
-        clearCurrent();
+    // Drop this folder's meshes from the registry (and the `current` pointer per removed entry),
+    // keyed by ROOT - a named OPEN mesh has no auth material, so a space-name key would resolve to
+    // the default space and delete an unrelated mesh's entry (see removeMeshesByRoot).
+    removeMeshesByRoot(cotalRoot());
     if (!any) {
         console.error(c.red("Nothing running here (no .cotal/*.pid). Was it started with `cotal up` / `cotal setup`?"));
         process.exit(1);
     }
 }
+/** Every pidfile a background mesh records under `.cotal/`, in stop order (manager → delivery →
+ *  auth service → web → nats: the manager's graceful shutdown releases its lease OVER nats, so nats
+ *  must outlive it). Shared with `cotal clean`, which refuses local-state deletion while any of
+ *  these is still alive. */
+export function pidfileTargets(space) {
+    return [
+        ["manager.pid", "manager"],
+        ["delivery.pid", "delivery daemon"],
+        [`auth-service.${encodeURIComponent(space)}.pid`, "user-auth service"],
+        ["web.pid", "web dashboard"],
+        ["nats.pid", "nats-server"],
+    ];
+}
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-const isAlive = (pid) => {
+export const isAlive = (pid) => {
     try {
         process.kill(pid, 0);
         return true;
     }
-    catch {
-        return false;
+    catch (e) {
+        // EPERM = the process EXISTS but we may not signal it (e.g. launched from a differently
+        // elevated context). For safety that counts as alive; only ESRCH-style "no such process"
+        // reads as dead.
+        return e.code === "EPERM";
     }
 };
+/** Read one pidfile and probe liveness with ONE hardened semantics, shared by `down`, `clean`,
+ *  and `status` so they can never drift: only a positive integer pid counts (an empty/corrupt
+ *  pidfile parses to 0, and POSIX `kill(0, 0)` probes our own process group), and EPERM reads as
+ *  ALIVE (the process exists, we merely can't signal it). */
+export function pidfileState(path) {
+    if (!existsSync(path))
+        return { live: false, note: "no pidfile" };
+    const pid = Number(readFileSync(path, "utf8").trim());
+    if (!Number.isInteger(pid) || pid <= 0)
+        return { live: false, note: "bad pidfile" };
+    return isAlive(pid) ? { pid, live: true } : { pid, live: false, note: "stale pidfile" };
+}
 /** Stop one recorded process and AWAIT its actual exit — SIGTERM starts a graceful shutdown (a
  *  manager reaps its agents and releases its JetStream lease over NATS, which isn't instant), so
  *  returning before the process is really gone would let callers (and `up`-style smokes) race a
- *  still-dying manager. Poll the pid, escalate to SIGKILL if it overstays, then confirm it's gone. */
+ *  still-dying manager. Poll the pid, escalate to SIGKILL if it overstays, then confirm it's gone.
+ *  Returns whether the process is confirmed absent. The pidfile is removed only once that is
+ *  established: erasing the record of a process we could NOT stop (EPERM — alive but
+ *  unsignalable) would let a later `cotal clean` delete the store underneath a live broker. */
 async function stop(pidPath, label) {
-    const pid = Number(readFileSync(pidPath, "utf8").trim());
-    // Drop the pidfile up front so a concurrent `down` can't double-signal a reused pid.
-    rmSync(pidPath, { force: true });
-    if (!Number.isFinite(pid))
-        return;
+    const s = pidfileState(pidPath);
+    if (!s.live) {
+        // Dead or unusable record (stale pid, empty/corrupt file) — nothing to stop, drop it.
+        rmSync(pidPath, { force: true });
+        if (s.pid)
+            console.log(c.dim(`${label} (pid ${s.pid}) was not running.`));
+        return true;
+    }
+    const pid = s.pid;
     try {
         process.kill(pid, "SIGTERM");
     }
-    catch {
-        console.log(c.dim(`${label} (pid ${pid}) was not running.`));
-        return;
+    catch (e) {
+        // The probe said alive, the signal was refused: EPERM (differently elevated context) or
+        // similar. The process is still running — keep its pidfile and fail loud.
+        console.error(c.red(`✗ cannot stop ${label} (pid ${pid}): ${e.code ?? e.message}`));
+        return false;
     }
+    // Signal accepted — this `down` owns the stop. Drop the pidfile now so a concurrent `down`
+    // can't double-signal a reused pid.
+    rmSync(pidPath, { force: true });
     const graceDeadline = Date.now() + 15_000;
     while (isAlive(pid) && Date.now() < graceDeadline)
         await sleep(100);
@@ -87,8 +133,13 @@ async function stop(pidPath, label) {
         while (isAlive(pid) && Date.now() < hardDeadline)
             await sleep(100);
     }
-    console.log(isAlive(pid)
-        ? c.red(`✗ ${label} (pid ${pid}) did not exit`)
-        : c.green(`✓ stopped ${label} (pid ${pid})`));
+    if (isAlive(pid)) {
+        // A SIGKILL survivor is still running — restore the record it must keep.
+        writeFileSync(pidPath, String(pid));
+        console.log(c.red(`✗ ${label} (pid ${pid}) did not exit`));
+        return false;
+    }
+    console.log(c.green(`✓ stopped ${label} (pid ${pid})`));
+    return true;
 }
 //# sourceMappingURL=down.js.map

package/dist/commands/down.js.map

@@ -1 +1 @@
-{"version":3,"file":"down.js","sourceRoot":"","sources":["../../src/commands/down.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAmB,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,CAAC,EAAE,MAAM,UAAU,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD;;;0FAG0F;AAC1F,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAgB;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAA8D,CAAC;IACnF,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,YAAY,CAAC,MAAM,CAAC,IAAI,IAAI,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;QACpG,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAA4B;QACvC,CAAC,aAAa,EAAE,SAAS,CAAC;QAC1B,CAAC,cAAc,EAAE,iBAAiB,CAAC;QACnC,CAAC,SAAS,EAAE,eAAe,CAAC;QAC5B,CAAC,UAAU,EAAE,aAAa,CAAC;KAC5B,CAAC;IACF,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,mGAAmG;IACnG,yFAAyF;IACzF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QACnC,GAAG,GAAG,IAAI,CAAC;QACX,MAAM,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,qGAAqG;IACrG,qFAAqF;IACrF,KAAK,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,wBAAwB,CAAC;QAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpG,mGAAmG;IACnG,oGAAoG;IACpG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,+FAA+F;IAC/F,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1C,UAAU,CAAC,KAAK,CAAC,CAAC;IAClB,IAAI,UAAU,EAAE,KAAK,KAAK;QAAE,YAAY,EAAE,CAAC;IAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,yFAAyF,CAAC,CAAC,CAAC;QAChH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACpE,MAAM,OAAO,GAAG,CAAC,GAAW,EAAW,EAAE;IACvC,IAAI,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACpE,CAAC,CAAC;AAEF;;;sGAGsG;AACtG,KAAK,UAAU,IAAI,CAAC,OAAe,EAAE,KAAa;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACzD,qFAAqF;IACrF,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO;IAClC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,GAAG,oBAAoB,CAAC,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa;QAAE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACjB,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,CAAC;QACnE,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACxC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY;YAAE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,CAAC,GAAG,CACT,OAAO,CAAC,GAAG,CAAC;QACV,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,GAAG,gBAAgB,CAAC;QAC/C,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,GAAG,GAAG,CAAC,CAC/C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"down.js","sourceRoot":"","sources":["../../src/commands/down.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAmB,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,CAAC,EAAE,MAAM,UAAU,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD;;;0FAG0F;AAC1F,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAgB;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAA8D,CAAC;IACnF,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,YAAY,CAAC,MAAM,CAAC,IAAI,IAAI,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;QACpG,OAAO;IACT,CAAC;IACD,6FAA6F;IAC7F,2FAA2F;IAC3F,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,IAAI,UAAU,GAAG,IAAI,CAAC;IACtB,6FAA6F;IAC7F,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QACnC,GAAG,GAAG,IAAI,CAAC;QACX,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAAE,UAAU,GAAG,KAAK,CAAC;IACxD,CAAC;IACD,8FAA8F;IAC9F,+FAA+F;IAC/F,yEAAyE;IACzE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC,CAAC;QACpG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,qGAAqG;IACrG,qFAAqF;IACrF,KAAK,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,wBAAwB,CAAC;QAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpG,mGAAmG;IACnG,oGAAoG;IACpG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,6FAA6F;IAC7F,+FAA+F;IAC/F,mFAAmF;IACnF,kBAAkB,CAAC,SAAS,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,yFAAyF,CAAC,CAAC,CAAC;QAChH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;4BAG4B;AAC5B,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO;QACL,CAAC,aAAa,EAAE,SAAS,CAAC;QAC1B,CAAC,cAAc,EAAE,iBAAiB,CAAC;QACnC,CAAC,gBAAgB,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC;QACtE,CAAC,SAAS,EAAE,eAAe,CAAC;QAC5B,CAAC,UAAU,EAAE,aAAa,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACpE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,GAAW,EAAW,EAAE;IAC9C,IAAI,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACpD,wFAAwF;QACxF,yFAAyF;QACzF,iBAAiB;QACjB,OAAQ,CAA2B,CAAC,IAAI,KAAK,OAAO,CAAC;IACvD,CAAC;AACH,CAAC,CAAC;AAIF;;;6DAG6D;AAC7D,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACpF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;AAC1F,CAAC;AAED;;;;;;+FAM+F;AAC/F,KAAK,UAAU,IAAI,CAAC,OAAe,EAAE,KAAa;IAChD,MAAM,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACZ,sFAAsF;QACtF,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,GAAG,oBAAoB,CAAC,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAI,CAAC;IACnB,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,wFAAwF;QACxF,0EAA0E;QAC1E,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,KAAK,SAAS,GAAG,MAAO,CAA2B,CAAC,IAAI,IAAK,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC1H,OAAO,KAAK,CAAC;IACf,CAAC;IACD,2FAA2F;IAC3F,oCAAoC;IACpC,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa;QAAE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACjB,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,CAAC;QACnE,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACxC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY;YAAE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACjB,yEAAyE;QACzE,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/commands/ext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ext.d.ts","sourceRoot":"","sources":["../../src/commands/ext.ts"],"names":[],"mappings":"AAIA,OAAO,EAA0B,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAczE;;;;;;;;;;;;;;GAcG;AAEH,wBAAsB,GAAG,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAOzD"}
+{"version":3,"file":"ext.d.ts","sourceRoot":"","sources":["../../src/commands/ext.ts"],"names":[],"mappings":"AAIA,OAAO,EAA0B,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAyBzE;;;;;;;;;;;;;;GAcG;AAEH,wBAAsB,GAAG,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAOzD"}