@ctrl-spc/cs 0.7.12 → 0.7.13

package/dist/daemon.js

@@ -1,11 +1,5 @@
 import { ensureAutostart } from './autostart.js';
-import { claimDaemonLock, releaseDaemonLock } from './daemon-lock.js';
 import { liveClient, startPresence, stopPresence } from './presence.js';
-/* ═══ THE ONE IMPORT ANYTHING OUTSIDE `panel3/` MAKES INTO IT. ═══ Named in
-   `.implementations/19-agent-panel-v3/conventions.md` and enforced by
-   `test/panel3-isolation.contract.test.mjs`, whose MOUNTS map allows this file
-   exactly this specifier. A second one fails the suite. See `startPanel`. */
-import { startPanel } from './panel3/run.js';
 /**
  * The terminal presence daemon (`cs start`). Comes online and heartbeats until
  * the process is signalled. Under launchd/KeepAlive (autostart) a hard crash is
@@ -22,89 +16,12 @@ import { startPanel } from './panel3/run.js';
  * clients in one process is two refresh loops on one rotating refresh token,
  * both writing `session.json`.
  *
- * ═══ THE COMPANION DELIBERATELY DOES NOT DO THIS. ═══ Two panel loops on one
- * machine id and one harness contend on a single `panel3_machines` row and each
- * would sweep the other's live runs. `cs start` is the launch the ruling names,
- * and `ensureAutostart` below installs exactly it, so an existing login item
- * starts doing the right thing with nothing else typed.
+ * Companion and the terminal daemon both use the same presence lifecycle,
+ * which owns the card worker, session and per-machine lock.
  */
 export async function runDaemon() {
-    /* One daemon per config dir. See daemon-lock.ts for the flicker this stops.
-       Exits rather than replacing the holder: under launchd's KeepAlive a
-       replacement would be restarted and would then replace the replacer. */
-    const lock = claimDaemonLock();
-    if (lock.held) {
-        console.error(`cs start is already running on this computer (pid ${lock.pid}). Stop it first to start another.`);
-        process.exitCode = 1;
-        return;
-    }
-    ensureAutostart(); // default-on: install the login item unless the user opted out
     const { machineName, agents } = await startPresence();
-    /* ═══ THE PANEL READS PRESENCE'S CLIENT, IT IS NOT HANDED A COPY OF IT. ═══
-       `startPresence` used to return the client it had just built and this line
-       passed that value to `startPanel`, which held it for the process's life. The
-       heartbeat's catch block REBUILDS that client when `session.json` comes to
-       hold a different refresh token, and since the rebuild guard landed a
-       successful rebuild is the normal path rather than a throw. The value handed
-       over here was therefore a client the database refuses and nobody watches,
-       while the panel's two-second poll went on writing `panel3_machines` with it.
-       That table took 37,051 writes in the incident window, the largest single
-       share of it.
-       `liveClient` is presence's own accessor, so the panel asks the module that
-       owns the presence lifecycle rather than being told once. It cannot answer
-       null here: `startPresence` has returned, so presence is running. */
-    /* ═══ AND THE LAST CLIENT IT SAW IS KEPT, FOR THE ONE READ THAT HAPPENS AFTER
-       PRESENCE HAS ALREADY STOPPED. ═══ `startPanel` returns `stop: () =>
-       stopListening(current(), ...)`, and `current()` is evaluated in the arrow,
-       BEFORE `stopListening` is entered, so `stopListening`'s own best-effort
-       try/catch cannot cover it. On `SIGNED_OUT` both watchers are bound to this
-       same client and auth-js runs them in registration order: presence's fires
-       first and `stopPresence` sets its module singleton to null synchronously,
-       so by the time the daemon's watcher reaches `shutdown` -> `panel.stop()`
-       the getter below has nothing live to answer with. Throwing there is a throw
-       inside `shutdown` before its first await, which `void shutdown(1)` does not
-       contain: `panel3_machines.stopped_at` never gets written, the card goes on
-       saying an agent is working, `Promise.all` rejects, `process.exit` is never
-       reached, and the panel's `for(;;)` spins on a caught-and-logged failure
-       every two seconds forever. launchd's `KeepAlive` cannot help a process that
-       never exits. `shutdown()` must reach `process.exit` on every path.
-  
-       THE FALLBACK IS THE LAST CLIENT PRESENCE ITSELF HELD, not the one it built
-       at startup: a rebuild replaces `p.client`, and a goodbye written with the
-       pre-rebuild snapshot is the same refused write this branch exists to stop.
-       Recording it on every successful read is what keeps it current without a
-       second subscription to the presence lifecycle.
-  
-       THE THROW IS NOT WEAKENED FOR THE POLL, and that is the point of ordering
-       the two lines this way. A poll only reaches the fallback once presence has
-       stopped, which in this process means a shutdown is already in flight and
-       the exit is milliseconds away; every other poll, for the whole life of the
-       daemon, reads a live client or fails loudly exactly as before. What the
-       fallback buys is the goodbye write, which `stopListening` documents as
-       best-effort precisely because it is the last thing this process does.
-  
-       THE ONE THING THAT WINDOW COSTS, NAMED RATHER THAN LEFT TO BE REDISCOVERED:
-       a poll landing in it used to throw at the getter and be swallowed by the
-       per-poll catch, so it could not write at all. Now it takes the fallback and
-       reaches `sayListening`, whose upsert deliberately sends `stopped_at: null`
-       on every poll, since that is what lets a restarted daemon come back on a row
-       stamped as gone. If such a poll's write lands AFTER `stopListening`'s stamp,
-       it erases the goodbye and the row reads listening again. That is bounded and
-       self-healing: `LISTENING_WINDOW_MS` is 15s, so the freshness check calls the
-       machine gone 15 seconds later whatever the column says, and the process is
-       already exiting. Not worth a second seam to close, and worth knowing about
-       if a machine is ever seen lingering for a few seconds after `cs start` ends. */
-    let lastKnownClient = liveClient();
-    const panel = startPanel(() => {
-        const live = liveClient();
-        if (live) {
-            lastKnownClient = live;
-            return live;
-        }
-        if (!lastKnownClient)
-            throw new Error('the presence loop is not running, so there is no session to work through');
-        return lastKnownClient;
-    });
+    ensureAutostart(); // default-on: install the login item unless the user opted out
     console.log(`CTRL+SPC — this computer: ${machineName}`);
     console.log(`Agents detected: ${agents.length ? agents.join(', ') : 'none'}`);
     console.log('Online. Heartbeating presence and answering cards. Ctrl-C to stop.');
@@ -113,46 +30,13 @@ export async function runDaemon() {
         if (stopping)
             return;
         stopping = true;
-        /* ═══ ONE HANDLER, BOTH WRITES, AND THEN ONE EXIT. ═══ A machine that has
-           gone has to read gone in both places: `cliv2_agents` for the title bar's
-           machines chip, and `panel3_machines.stopped_at` for the card that would
-           otherwise go on saying an agent is working. Two handlers each calling
-           `process.exit` would let whichever finished first kill the other's write,
-           so the panel's own signal handling stands down when it is started from
-           here (see `run()`). Both are best-effort and neither throws, which is why
-           they can settle together. */
-        await Promise.all([panel.stop(), stopPresence()]);
-        releaseDaemonLock();
+        // Shared presence stops the card worker and both readiness records.
+        await stopPresence();
         process.exit(code);
     }
     process.on('SIGINT', () => void shutdown());
     process.on('SIGTERM', () => void shutdown());
-    /* ═══ AND THE PANEL GOES DOWN WITH THE SESSION TOO. ═══ presence.ts stops its
-       own three loops on `SIGNED_OUT`, which leaves this process holding a panel
-       that would go on upserting `panel3_machines` every few seconds with a token
-       the database refuses. It shares this client, so it hears the same event: one
-       shutdown, both halves, and the exit says the daemon needs a person rather
-       than pretending it is still online. Non-zero because this is a failure, not
-       a Ctrl-C. The login item's `KeepAlive` restarts either way, and that is the
-       point: a restart refuses at `getClient` after one refresh attempt and exits
-       again, so an unattended machine retries on launchd's throttle instead of
-       polling four times a second forever. */
-    /* ═══ BOUND TO WHATEVER CLIENT IS LIVE AT THIS INSTANT, WHICH IS WHY IT IS
-       READ AND NOT CAPTURED. ═══ This used to bind to the client `startPresence`
-       returned. A rebuild replaces that client, and presence re-binds its OWN
-       watcher to the replacement (`bindSignedOutWatcher`) while this one would
-       stay on the discarded client, where `SIGNED_OUT` can never fire again. That
-       leaves the daemon's half of the shutdown deaf for the rest of the process.
-       Reading it here binds to the current one; a client rebuilt LATER is
-       presence's watcher to carry, and that one calls `stopPresence`, which clears
-       the intervals this process depends on. This is not a second terminal stop,
-       it is the same one bound to a client that exists.
-  
-       THE NULL IS THROWN ON RATHER THAN SKIPPED, matching the getter above. `?.`
-       would read as though no client were an expected state, and it is not:
-       `startPresence` has returned, so presence is running. Worse, it would
-       silently drop half the shutdown in exactly the state it claims to guard
-       against, leaving a daemon that answers a dead session by doing nothing. */
+    // Presence owns sign-out cleanup; the terminal entry also exits.
     const live = liveClient();
     if (!live)
         throw new Error('the presence loop is not running, so there is no session to watch');

package/dist/folders.js

@@ -1,7 +1,7 @@
 import { execFile } from 'node:child_process';
-/** Native folder chooser per OS. Same commands the v1 companion uses. */
-function pickerCommand() {
-    if (process.platform === 'darwin') {
+/** Native folder chooser per OS. */
+export function pickerCommand(platform = process.platform) {
+    if (platform === 'darwin') {
         return {
             command: 'osascript',
             args: [
@@ -13,13 +13,101 @@ function pickerCommand() {
             ],
         };
     }
-    if (process.platform === 'win32') {
+    if (platform === 'win32') {
+        const source = String.raw `
+using System;
+using System.Runtime.InteropServices;
+
+[ComImport]
+[Guid("DC1C5A9C-E88A-4DDE-A5A1-60F82A20AEF7")]
+internal class FileOpenDialog { }
+
+[ComImport]
+[Guid("43826D1E-E718-42EE-BC55-A1E261C37BFE")]
+[InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
+internal interface IShellItem
+{
+    void BindToHandler(IntPtr pbc, ref Guid bhid, ref Guid riid, out IntPtr ppv);
+    void GetParent(out IShellItem parent);
+    void GetDisplayName(uint sigdnName, out IntPtr name);
+    void GetAttributes(uint mask, out uint attributes);
+    void Compare(IShellItem other, uint hint, out int order);
+}
+
+[ComImport]
+[Guid("D57C7288-D4AD-4768-BE02-9D969532D960")]
+[InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
+internal interface IFileOpenDialog
+{
+    [PreserveSig] int Show(IntPtr owner);
+    void SetFileTypes(uint count, IntPtr filters);
+    void SetFileTypeIndex(uint index);
+    void GetFileTypeIndex(out uint index);
+    void Advise(IntPtr events, out uint cookie);
+    void Unadvise(uint cookie);
+    void SetOptions(uint options);
+    void GetOptions(out uint options);
+    void SetDefaultFolder(IShellItem folder);
+    void SetFolder(IShellItem folder);
+    void GetFolder(out IShellItem folder);
+    void GetCurrentSelection(out IShellItem item);
+    void SetFileName([MarshalAs(UnmanagedType.LPWStr)] string name);
+    void GetFileName([MarshalAs(UnmanagedType.LPWStr)] out string name);
+    void SetTitle([MarshalAs(UnmanagedType.LPWStr)] string title);
+    void SetOkButtonLabel([MarshalAs(UnmanagedType.LPWStr)] string text);
+    void SetFileNameLabel([MarshalAs(UnmanagedType.LPWStr)] string label);
+    void GetResult(out IShellItem item);
+    void AddPlace(IShellItem item, uint alignment);
+    void SetDefaultExtension([MarshalAs(UnmanagedType.LPWStr)] string extension);
+    void Close(int result);
+    void SetClientGuid(ref Guid guid);
+    void ClearClientData();
+    void SetFilter(IntPtr filter);
+    void GetResults(out IntPtr items);
+    void GetSelectedItems(out IntPtr items);
+}
+
+public static class CtrlSpcFolderPicker
+{
+    private const uint PickFolders = 0x20;
+    private const uint ForceFileSystem = 0x40;
+    private const uint PathMustExist = 0x800;
+    private const uint FileSystemPath = 0x80058000;
+    private const int Cancelled = unchecked((int)0x800704C7);
+
+    [DllImport("user32.dll")]
+    private static extern IntPtr GetForegroundWindow();
+
+    public static string Choose()
+    {
+        IFileOpenDialog dialog = (IFileOpenDialog)new FileOpenDialog();
+        IShellItem item = null;
+        IntPtr name = IntPtr.Zero;
+        try
+        {
+            uint options;
+            dialog.GetOptions(out options);
+            dialog.SetOptions(options | PickFolders | ForceFileSystem | PathMustExist);
+            dialog.SetTitle("Choose a project folder for CTRL+SPC");
+            int result = dialog.Show(GetForegroundWindow());
+            if (result == Cancelled) return null;
+            Marshal.ThrowExceptionForHR(result);
+            dialog.GetResult(out item);
+            item.GetDisplayName(FileSystemPath, out name);
+            return Marshal.PtrToStringUni(name);
+        }
+        finally
+        {
+            if (name != IntPtr.Zero) Marshal.FreeCoTaskMem(name);
+            if (item != null) Marshal.FinalReleaseComObject(item);
+            Marshal.FinalReleaseComObject(dialog);
+        }
+    }
+}`;
         const script = [
-            'Add-Type -AssemblyName System.Windows.Forms',
-            '$dialog = New-Object System.Windows.Forms.FolderBrowserDialog',
-            '$dialog.Description = "Choose a project folder for CTRL+SPC"',
-            'if ($dialog.ShowDialog() -eq "OK") { $dialog.SelectedPath }',
-        ].join('; ');
+            `Add-Type -TypeDefinition @'\n${source}\n'@`,
+            '[CtrlSpcFolderPicker]::Choose()',
+        ].join('\n');
         return { command: 'powershell.exe', args: ['-NoProfile', '-STA', '-Command', script] };
     }
     return {

package/dist/panel3/presence.js

@@ -86,6 +86,13 @@ export async function sayListening(client, machineId, name, harness) {
     if (error)
         throw new Error(`could not say this machine is listening: ${error.message}`);
 }
+/** Only a path-free category leaves the machine. The full error stays in its log. */
+export async function sayPollingProblem(client, machineId, harness, problem) {
+    const { error } = await client.from('panel3_machines').update({ problem })
+        .eq('machine_id', machineId).eq('harness', harness);
+    if (error)
+        throw new Error(`could not report worker health: ${error.message}`);
+}
 /**
  * Stop saying it, because this daemon is going away.
  *

package/dist/panel3/prompt.js

@@ -327,6 +327,8 @@ export const whatWasAttached = (attachments) => {
            second place for it to drift. */
         'A `workflow` is the process this work follows: stages, in an order it gives. The owner of this',
         'conversation is the one who reads it, with `get_workflow`.',
+        'An `artifact` is a document on a work item. Read it with `get_artifact`, and revise it with',
+        '`update_artifact`.',
     ];
     return [
         ...(codebases.length === 0 ? [] : [

package/dist/panel3/run.js

@@ -2,7 +2,7 @@
  * ═══ AGENT PANEL v3: the poll loop that answers a card. ═══
  *
  * THIS FILE BELONGS TO AGENT PANEL v3. Nothing outside `src/panel3/` may import
- * it, WITH ONE NAMED EXCEPTION: `cli-v2/src/daemon.ts` imports `startPanel` from
+ * it, WITH ONE NAMED EXCEPTION: `cli-v2/src/presence.ts` imports `startPanel` from
  * here and nothing else, which is how `cs start` runs the panel. It is written
  * down in `conventions.md` and checked by `panel3-isolation.contract.test.mjs`;
  * `startPanel`'s own comment at the foot of this file carries the reasoning.
@@ -136,7 +136,7 @@ import { readableWriteError } from '../firewall.js';
 import { answerPrompt, escalationPrompt, levelOnePrompt, ownerActivationPrompt, readBackPrompt, landingOutcomeContext, presentedArtifactAnswerContext, resumePrompt, retryPrompt, standingRules, whatWasAttached, workingRules, OWNER_COMPLETION_RULES, } from './prompt.js';
 import { ASK_CONTENT_COLUMNS, attachmentLine, gitRulesFor, loadAttachments, loadOutputNames, outputOf, recordBaseProtection, standingRulesFor, withAskContent, } from './show.js';
 import { forgetSecrets, redactSecrets } from './secrets.js';
-import { sayListening, stopListening } from './presence.js';
+import { sayListening, sayPollingProblem, stopListening } from './presence.js';
 import { selectedHarness } from './coordinator.js';
 import { baseBranchState, checkoutForCodebase, commitCardWork, detectBaseProtection, folderIsBranch, hasCheckoutForCodebase, mergeIntoBase, releaseBaseBranch, settleCardWorktree, worktreeForCard, worktreesOnThisMachine, } from './checkout.js';
 import { harness, startAgent } from './spawn.js';
@@ -2980,7 +2980,7 @@ export async function sweepFinishedWorktrees(client) {
 export function clientReader(injected) {
     return typeof injected === 'function' ? injected : () => injected;
 }
-export async function run(args, injected, signal) {
+export async function run(args, injected, signal, lifecycle) {
     let once = false;
     for (const arg of args) {
         if (arg === '--once')
@@ -3078,6 +3078,9 @@ export async function run(args, injected, signal) {
     }
     try {
         while (!signal?.aborted) {
+            // Restart only at a poll boundary, before any claims, with no live work.
+            if (lifecycle && !lifecycle.beforePoll(inFlight.size))
+                break;
             /* ═══ ONE POLL FAILING IS NOT THE DAEMON FAILING. ═══ Every read and write
                here throws on a network or database error, by design (constraint 7), and
                until Slice 4 that threw straight out of `panel3/cli.js run` and exited the process.
@@ -3188,6 +3191,8 @@ export async function run(args, injected, signal) {
                     // rather than becoming an unhandled rejection.
                     hold(runId, answerCard(current(), tools, machineId, cardId, turns));
                 }
+                await sayPollingProblem(current(), machineId, machineHarness, null);
+                lifecycle?.ready();
                 if (once) {
                     /* ═══ UNTIL NOTHING IS LEFT, NOT ONCE OVER WHAT WAS THERE. ═══ A level 1
                        run dispatches WHILE it is being waited on, so the child appears in
@@ -3203,6 +3208,14 @@ export async function run(args, injected, signal) {
                 if (once)
                     throw error;
                 said(`this poll did not finish: ${error instanceof Error ? error.message : String(error)}`);
+                if (listeningHarness !== null) {
+                    try {
+                        await sayPollingProblem(current(), machineId, listeningHarness, 'poll_failed');
+                    }
+                    catch (reportError) {
+                        said(`worker health could not be reported: ${reportError instanceof Error ? reportError.message : String(reportError)}`);
+                    }
+                }
             }
             if (!signal?.aborted)
                 await sleep(POLL_INTERVAL_MS);
@@ -3219,52 +3232,67 @@ export async function run(args, injected, signal) {
     }
 }
 // ---------------------------------------------------------------------------
-/**
- * ═══ THE ONE THING `cs start` REACHES INTO `panel3/` FOR. ═══
- *
- * recovery-1 Slice 4, and Lane's ruling behind it (2026-08-21): *the user
- * experience must never require them to launch or authenticate multiple CLIs.
- * They launch the CLI with `cs start`.* Slices 1 to 3 print `cs start` on a
- * stranded card and, until this function existed, that command started a daemon
- * which polled no cards at all — the sentence named the right machine and the
- * wrong command, and no rewording could fix it.
- *
- * ═══ IT IS A NAMED EXCEPTION TO THE ISOLATION RULE, NOT A HOLE IN IT. ═══
- * `conventions.md` forbids anything outside `panel3/` importing anything inside
- * it, and `panel3-isolation.contract.test.mjs` enforces it. `cli-v2/src/daemon.ts`
- * is listed there with exactly ONE allowed specifier, `./panel3/run.js`, which is
- * why this is a single entry point handing back a single closure rather than
- * three exports the daemon would have to assemble. A second specifier fails the
- * suite, which is the point: the rule is enumerated, never weakened.
- *
- * ═══ THE CLIENT IS THE CALLER'S, AND THAT IS THE WHOLE OF "ONE SIGN-IN". ═══
- * `startPresence()` owns the client it built from the session `cs login` stored.
- * This must never take one of its own: two clients in one process is two refresh
- * loops on one rotating refresh token, both writing `session.json` through
- * `getClient`'s `onAuthStateChange`, which is the hazard `client.ts` describes
- * moved indoors.
- *
- * ═══ AND IT IS READ RATHER THAN HANDED OVER, BECAUSE PRESENCE REPLACES IT. ═══
- * A `SupabaseClient` is still accepted, for the harness and for any caller
- * holding exactly one. `cs start` passes a function instead, because presence's
- * heartbeat rebuilds its client when the account on disk changes, and the panel
- * holding the pre-rebuild one is the largest single share of the poll storm this
- * widening closes. `stop` reads it through the same getter for the same reason:
- * it is the last write this process makes, minutes or days after the getter was
- * handed over, and a goodbye written with a refused token leaves the card saying
- * an agent is working.
- *
- * ═══ IT DOES NOT BLOCK, AND IT DOES NOT TAKE THE DAEMON DOWN. ═══ The loop
- * never returns, so awaiting it here would hang `cs start` before it printed a
- * line. A throw that escapes the per-poll guard inside it is the panel stopping,
- * which is said on the one stream a person reads and leaves v2 presence
- * heartbeating rather than killing the process around it.
- */
+/** Shared presence owns this supervisor and supplies its current authenticated
+ * client. A stopped worker is restarted automatically. Explicit restarts happen
+ * at an idle poll boundary and confirm only after a new worker completes a poll.
+ * Sign-out stops the supervisor, so it cannot restart behind the user's back. */
 export function startPanel(injected) {
     const controller = new AbortController();
-    const running = run([], injected, controller.signal).catch((error) => {
-        said(`the agent panel stopped polling: ${error instanceof Error ? error.message : String(error)}`);
-    });
-    // The loop owns its current presence row, including shutdown after a switch.
-    return { stop: async () => { controller.abort(); await running; } };
+    let requested = false;
+    let restarting = null;
+    let resolveRestart = null;
+    let rejectRestart = null;
+    const running = (async () => {
+        while (!controller.signal.aborted) {
+            try {
+                await run([], injected, controller.signal, {
+                    beforePoll: (active) => {
+                        if (!requested)
+                            return true;
+                        requested = false;
+                        if (active > 0) {
+                            rejectRestart?.(new Error('Work is still running on this machine. Stop the affected cards before restarting the worker.'));
+                            return true;
+                        }
+                        return false;
+                    },
+                    ready: () => { if (!requested)
+                        resolveRestart?.(); },
+                });
+            }
+            catch (error) {
+                said(`the agent panel stopped polling: ${error instanceof Error ? error.message : String(error)}`);
+                // Startup failures must not leave an online machine with a dead worker.
+                if (!controller.signal.aborted)
+                    await sleep(POLL_INTERVAL_MS);
+            }
+        }
+    })();
+    return {
+        restart: () => {
+            if (controller.signal.aborted)
+                return Promise.reject(new Error('This machine is signing out. Open Companion and sign in again.'));
+            if (restarting)
+                return restarting;
+            requested = true;
+            let timeout;
+            restarting = new Promise((resolve, reject) => {
+                resolveRestart = resolve;
+                rejectRestart = reject;
+                timeout = setTimeout(() => reject(new Error('The worker did not reconnect. Open Companion on this machine, then try again.')), 20_000);
+            }).finally(() => {
+                clearTimeout(timeout);
+                requested = false;
+                restarting = null;
+                resolveRestart = null;
+                rejectRestart = null;
+            });
+            return restarting;
+        },
+        stop: async () => {
+            controller.abort();
+            rejectRestart?.(new Error('The machine disconnected before the worker restarted.'));
+            await running;
+        },
+    };
 }

package/dist/presence.js

@@ -9,6 +9,8 @@ import { buildPresenceHeartbeatPayload } from './presence-heartbeat.js';
 import { createListenerState, orchestratorTick, reapDeadWorkers, recoverStrandedWorkers, takeRunMessages, liveAgents, } from './orchestrator.js';
 /* 18c Slice 8 — the on-disk half of the crash recovery beside it. */
 import { sweepStrandedCodexHomes } from './codex-home.js';
+import { claimDaemonLock, releaseDaemonLock } from './daemon-lock.js';
+import { startPanel } from './panel3/run.js';
 let presence = null;
 /** In-flight guard: startPresence yields to the event loop (network setSession)
  *  before `presence` is assigned, so a plain `if (presence)` check lets two
@@ -246,21 +248,57 @@ async function cleanupSupersededRows(p) {
     }
 }
 async function pollCommands(p) {
+    if (p.pollingCommands)
+        return;
+    p.pollingCommands = true;
     try {
         const { data, error } = await p.client
             .from('cliv2_commands')
             .update({ status: 'ack', acked_at: new Date().toISOString() })
             .eq('machine_id', p.identity.id)
             .eq('status', 'pending')
+            .eq('command', 'ping')
             .select('id, command');
         if (error)
             throw error;
         for (const cmd of data ?? [])
             console.log(`Acked ${cmd.command} (${cmd.id})`);
+        const { data: restarts, error: restartError } = await p.client
+            .from('cliv2_commands')
+            .update({ status: 'processing' })
+            .eq('machine_id', p.identity.id)
+            .eq('status', 'pending')
+            .eq('command', 'restart_worker')
+            .select('id, created_at');
+        if (restartError)
+            throw restartError;
+        for (const command of restarts ?? []) {
+            let result = 'Worker restarted';
+            let status = 'ack';
+            try {
+                if (Date.now() - Date.parse(command.created_at) > 30_000) {
+                    throw new Error('This restart request expired. Try again while the machine is online.');
+                }
+                if (!p.panel)
+                    throw new Error('The worker has not started. Open Companion on this machine and reconnect.');
+                await p.panel.restart();
+            }
+            catch (error) {
+                status = 'failed';
+                result = error instanceof Error ? error.message : String(error);
+            }
+            const { error: saved } = await p.client.from('cliv2_commands')
+                .update({ status, result, acked_at: new Date().toISOString() }).eq('id', command.id);
+            if (saved)
+                throw saved;
+        }
     }
     catch (err) {
         console.warn(`command poll failed, will retry: ${err.message}`);
     }
+    finally {
+        p.pollingCommands = false;
+    }
 }
 /**
  * One turn of the orchestrator listener (feature 16, Slice 3). All the logic is
@@ -298,12 +336,17 @@ async function pollOrchestrator(p) {
  *  the companion guard for that; the terminal daemon lets it surface. No-op if
  *  already running. */
 export async function startPresence() {
+    if (stopping)
+        await stopping;
     if (presence) {
         return { machineName: presence.identity.name, agents: presence.agents };
     }
     if (starting)
         return starting;
     starting = (async () => {
+        const lock = claimDaemonLock();
+        if (lock.held)
+            throw new Error(`CTRL+SPC is already running on this computer (pid ${lock.pid}).`);
         const identity = getMachineIdentity();
         const agents = detectAgents();
         const client = await getClient();
@@ -337,6 +380,7 @@ export async function startPresence() {
             throw new Error('Signed-in user could not be resolved. Sign in again.');
         const p = {
             client,
+            panel: null,
             userId,
             identity,
             agents,
@@ -482,11 +526,19 @@ export async function startPresence() {
         catch (err) {
             console.warn(`Agent tools server did not start: ${err.message}`);
         }
+        // Both cs open and cs start answer cards through this one lifecycle.
+        // Read the owner's client on every use, including after refresh or logout.
+        p.panel = startPanel(() => p.client);
         return { machineName: identity.name, agents };
     })();
     try {
         return await starting;
     }
+    catch (error) {
+        await stopPresence();
+        releaseDaemonLock();
+        throw error;
+    }
     finally {
         starting = null;
     }
@@ -535,6 +587,7 @@ export async function stopPresence({ unregister = false } = {}) {
            call `stopPresence()` and kill the presence belonging to a DIFFERENT
            session, one that is signed in and healthy. */
         p.authSubscription.unsubscribe();
+        await p.panel?.stop();
         // On logout (unregister), scrub the ctrl-spc entry from each detected agent's
         // config so a logged-out machine leaves no dead server that would read "failed
         // to connect" on the next agent run. Fire-and-forget best-effort — never blocks
@@ -561,5 +614,6 @@ export async function stopPresence({ unregister = false } = {}) {
     }
     finally {
         stopping = null;
+        releaseDaemonLock();
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ctrl-spc/cs",
-  "version": "0.7.12",
+  "version": "0.7.13",
   "description": "CTRL+SPC — minimal, reliable per-machine agent presence. Sign-in, auto-start, agent detection, heartbeat presence, and ping acknowledgement.",
   "engines": {
     "node": ">=22"