@ctrl-spc/cs 0.7.14 → 0.7.15

package/dist/daemon.js

@@ -1,49 +1,17 @@
-import { ensureAutostart } from './autostart.js';
-import { liveClient, startPresence, stopPresence } from './presence.js';
-/**
- * The terminal presence daemon (`cs start`). Comes online and heartbeats until
- * the process is signalled. Under launchd/KeepAlive (autostart) a hard crash is
- * restarted by the OS. The companion server (`cs open`) shares the same presence
- * loop via presence.ts, so the two front-ends never diverge.
- *
- * ═══ AND SINCE recovery-1 SLICE 4 IT ALSO ANSWERS AGENT PANEL CARDS. ═══ Lane's
- * ruling (2026-08-21): *the user experience must never require them to launch or
- * authenticate multiple CLIs. They launch the CLI with `cs start`.* Before this
- * the panel was a second binary with a second sign-in, so a stranded card could
- * name the right machine and print a command that started the wrong daemon.
- *
- * THE PANEL GETS THE SESSION THIS ALREADY HOLDS, never one of its own. Two
- * clients in one process is two refresh loops on one rotating refresh token,
- * both writing `session.json`.
- *
- * Companion and the terminal daemon both use the same presence lifecycle,
- * which owns the card worker, session and per-machine lock.
- */
+import { inspectLocalRuntime, startLocalRuntime, stopLocalOwnerForSignal } from './daemon-lifecycle.js';
+import { CLI_VERSION } from './package-version.js';
+import { machineHostname } from './config.js';
+/** Foreground entry; local lifecycle owns service control and cloud reconnects. */
 export async function runDaemon() {
-    const { machineName, agents } = await startPresence();
-    ensureAutostart(); // default-on: install the login item unless the user opted out
-    console.log(`CTRL+SPC — this computer: ${machineName}`);
-    console.log(`Agents detected: ${agents.length ? agents.join(', ') : 'none'}`);
-    console.log('Online. Heartbeating presence and answering cards. Ctrl-C to stop.');
-    let stopping = false;
-    async function shutdown(code = 0) {
-        if (stopping)
-            return;
-        stopping = true;
-        // Shared presence stops the card worker and both readiness records.
-        await stopPresence();
-        process.exit(code);
+    if (!await startLocalRuntime()) {
+        const current = await inspectLocalRuntime();
+        console.log(`CTRL+SPC is already running on ${machineHostname()} (pid ${current?.record.process.pid ?? 'unknown'}).`);
+        console.log(`Running version: ${current?.status?.version ?? 'unavailable'}. Installed version: ${CLI_VERSION}.`);
+        console.log('Use cs status to check it, cs stop to stop it, or cs restart to load this installed version.');
+        return;
     }
-    process.on('SIGINT', () => void shutdown());
-    process.on('SIGTERM', () => void shutdown());
-    // Presence owns sign-out cleanup; the terminal entry also exits.
-    const live = liveClient();
-    if (!live)
-        throw new Error('the presence loop is not running, so there is no session to watch');
-    live.auth.onAuthStateChange((event) => {
-        if (event === 'SIGNED_OUT')
-            void shutdown(1);
-    });
-    // Keep the event loop alive.
-    await new Promise(() => { });
+    console.log(`CTRL+SPC is running on ${machineHostname()}. Loaded version: ${CLI_VERSION}.`);
+    console.log('Cloud connection is being checked. Run cs status for readiness. Use cs stop or cs restart to manage this service.');
+    process.on('SIGINT', () => void stopLocalOwnerForSignal().catch((error) => console.error(error.message)));
+    process.on('SIGTERM', () => void stopLocalOwnerForSignal().catch((error) => console.error(error.message)));
 }

package/dist/darwin-coalition.js

@@ -0,0 +1,340 @@
+import { spawn, execFile } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { promisify } from 'node:util';
+import { chmodSync, existsSync, mkdtempSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { createServer, createConnection } from 'node:net';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+const execute = promisify(execFile);
+const modulePath = fileURLToPath(import.meta.url);
+const executable = join(dirname(modulePath), 'native', 'darwin-coalition');
+export function validMacCoalition(value) {
+    const v = value;
+    return !!v && /^\d+$/.test(v.id) && /^[\da-f-]{36}$/i.test(v.boot) && /^com\.ctrl-spc\.execution\.[\da-f-]{36}$/i.test(v.label)
+        && (v.domain === undefined || v.domain === 'gui' || v.domain === 'user');
+}
+function timeout(deadline) {
+    if (Date.now() >= deadline)
+        throw new Error('Service operation exceeded its deadline.');
+    return Math.max(1, Math.min(5000, deadline - Date.now()));
+}
+async function native(args, deadline = Date.now() + 5000) {
+    for (;;) {
+        try {
+            const { stdout } = await execute(executable, args, { timeout: timeout(deadline), maxBuffer: 8 * 1024 * 1024 });
+            return stdout.trim() ? JSON.parse(stdout) : null;
+        }
+        catch (error) {
+            // A fork/exit between enumeration and the atomic count is a known,
+            // read-only race. Retry only this result within the caller's deadline.
+            if (error.code !== 75 || Date.now() + 25 >= deadline) {
+                // Preparation failures can become cloud-visible text. execFile's own
+                // message embeds local executable paths; the helper's fixed messages
+                // contain only the operation and OS error number.
+                const detail = error.stderr;
+                throw new Error(typeof detail === 'string' && detail.trim() ? detail.trim().slice(0, 500)
+                    : 'Mac execution ownership could not be verified. Reinstall CTRL+SPC or retry the command.', { cause: error });
+            }
+            await new Promise((resolve) => setTimeout(resolve, 25));
+        }
+    }
+}
+async function processCoalition(pid, deadline) {
+    const value = await native(['process', String(pid)], deadline);
+    if (value === null)
+        return null;
+    if (!value || typeof value.id !== 'string' || !/^\d+$/.test(value.id) || typeof value.boot !== 'string' || !/^[\da-f-]{36}$/i.test(value.boot)
+        || value.pid !== pid || value.owner !== process.getuid())
+        throw new Error('Mac execution identity is unavailable.');
+    return value;
+}
+export async function inspectMacCoalition(coalition, deadline = Date.now() + 5000) {
+    if (!validMacCoalition(coalition))
+        throw new Error('Mac execution identity is invalid.');
+    const result = await native(['inspect', coalition.id, coalition.boot], deadline);
+    if (!result || typeof result.exists !== 'boolean' || !Number.isSafeInteger(result.active) || result.active < 0 || !Array.isArray(result.members))
+        throw new Error('Mac execution membership is unavailable.');
+    const rows = result.members.map((row) => nativeIdentity(row, coalition));
+    if (result.active > rows.length || (result.active === 0 && rows.length))
+        throw new Error('Mac execution membership changed. Retry the command.');
+    return rows;
+}
+function nativeIdentity(row, coalition) {
+    if (!row || !Number.isInteger(row.pid) || row.pid <= 0 || !Number.isInteger(row.ppid) || !Number.isInteger(row.pgid)
+        || row.owner !== String(process.getuid()) || typeof row.birth !== 'string' || !Number.isFinite(Date.parse(row.birth))
+        || !Number.isInteger(row.version) || row.version <= 0)
+        throw new Error('Mac process identity is invalid.');
+    return { pid: row.pid, ppid: row.ppid, pgid: row.pgid, owner: row.owner, birth: row.birth,
+        commandHash: createHash('sha256').update(`${row.pid}:${row.version}`).digest('hex'), macProcessVersion: row.version, ...(coalition ? { macCoalition: coalition } : {}) };
+}
+export async function inspectMacProcess(pid, deadline) {
+    const result = await native(['process', String(pid)], deadline);
+    if (result === null)
+        return null;
+    return nativeIdentity({ ...result, owner: String(result.owner) });
+}
+export async function inspectMacProcesses(deadline) {
+    const result = await native(['all'], deadline);
+    if (!result || !Array.isArray(result.members))
+        throw new Error('Mac process enumeration is unavailable.');
+    return result.members.map((row) => nativeIdentity(row));
+}
+export async function signalMacMember(identity, deadline, signal = 'KILL') {
+    if (!identity.macCoalition || !identity.macProcessVersion)
+        throw new Error('Mac process ownership is unavailable.');
+    await native(['signal', identity.macCoalition.id, identity.macCoalition.boot, String(identity.pid), String(identity.macProcessVersion), signal], deadline);
+}
+export async function signalMacProcess(identity, deadline) {
+    if (identity.owner !== String(process.getuid()))
+        throw new Error('Mac process belongs to another user.');
+    const own = await processCoalition(process.pid, deadline);
+    if (!own)
+        throw new Error('Mac process signaling is unavailable.');
+    await native(['signal-process', own.boot, String(identity.pid), identity.birth], deadline);
+}
+export async function unloadMacExecution(coalition, deadline) {
+    if (!validMacCoalition(coalition))
+        throw new Error('Mac execution identity is invalid.');
+    // Only the first unpublished candidate omitted this field and used gui.
+    // Never try both namespaces: the recorded one is the only owned job.
+    try {
+        await execute('/bin/launchctl', ['bootout', `${coalition.domain ?? 'gui'}/${process.getuid()}/${coalition.label}`], { timeout: timeout(deadline) });
+    }
+    catch (error) {
+        if (![3, 113].includes(error.code ?? -1))
+            throw new Error('The owned Mac execution job could not be unloaded.', { cause: error });
+    }
+}
+export function spawnMacExecution(bin, args, options, reservationId, file) {
+    if (!existsSync(executable))
+        throw new Error('The Mac execution helper is missing. Reinstall CTRL+SPC before starting work.');
+    if (!/^[\da-f-]{36}$/i.test(reservationId))
+        throw new Error('Invalid execution reservation.');
+    // A private short path avoids sockaddr_un's path limit for long config dirs.
+    const directory = mkdtempSync(`/tmp/ctrl-spc-execution-${process.getuid()}-`);
+    chmodSync(directory, 0o700);
+    const access = statSync(directory);
+    if (access.uid !== process.getuid() || (access.mode & 0o777) !== 0o700)
+        throw new Error('Mac execution transport could not be made private.');
+    const ready = join(directory, 'ready.json');
+    const launch = { bin, args, cwd: options.cwd?.toString() ?? process.cwd(), env: options.env ?? process.env,
+        shell: options.shell ?? false, label: `com.ctrl-spc.execution.${reservationId}`, domain: 'user', directory, ready };
+    try {
+        writeFileSync(file, JSON.stringify(launch), { flag: 'wx', mode: 0o600 });
+        return { child: spawn(process.execPath, [modulePath, '--bridge', file], { ...options, shell: false, detached: true }), ready };
+    }
+    catch (error) {
+        rmSync(directory, { recursive: true, force: true });
+        rmSync(file, { force: true });
+        throw error;
+    }
+}
+export function readMacExecution(ready) {
+    let text;
+    try {
+        text = readFileSync(ready, 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+    const result = JSON.parse(text);
+    if (!validMacCoalition(result))
+        throw new Error('Mac execution identity is invalid.');
+    return result;
+}
+export function removeMacExecutionFiles(ready) { rmSync(dirname(ready), { recursive: true, force: true }); }
+function send(socket, frame, source) {
+    if (!socket.write(JSON.stringify(frame) + '\n') && source) {
+        source.pause();
+        socket.once('drain', () => source.resume());
+    }
+}
+function frames(socket, receive) {
+    let pending = '';
+    socket.setEncoding('utf8');
+    socket.on('data', (chunk) => {
+        pending += chunk;
+        if (pending.length > 2 * 1024 * 1024) {
+            socket.destroy(new Error('Mac execution transport exceeded its frame limit.'));
+            return;
+        }
+        let end;
+        while ((end = pending.indexOf('\n')) >= 0) {
+            const line = pending.slice(0, end);
+            pending = pending.slice(end + 1);
+            try {
+                receive(JSON.parse(line));
+            }
+            catch {
+                socket.destroy(new Error('Mac execution transport is invalid.'));
+                return;
+            }
+        }
+    });
+}
+function xml(text) { return text.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;'); }
+async function bridge(file) {
+    const launch = JSON.parse(readFileSync(file, 'utf8'));
+    const own = await processCoalition(process.pid);
+    if (!own)
+        throw new Error('Mac execution capability is unavailable; no agent was started.');
+    const socketPath = join(launch.directory, 'io.sock'), plist = join(launch.directory, 'job.plist');
+    let socket = null, connected = false, ended = false, exitReceived = false;
+    let jobIdentity = null;
+    process.stdin.pause();
+    const server = createServer((peer) => {
+        if (connected) {
+            peer.destroy();
+            return;
+        }
+        connected = true;
+        socket = peer;
+        peer.on('error', () => { process.exitCode = 1; });
+        peer.on('close', () => {
+            if (!exitReceived)
+                process.exitCode = 1;
+            process.stdin.destroy();
+            if (!exitReceived)
+                server.close();
+        });
+        frames(peer, (frame) => {
+            if (frame.kind === 'hello' && typeof frame.pid === 'number') {
+                void (async () => {
+                    const identity = await processCoalition(frame.pid);
+                    if (!identity || identity.id === own.id)
+                        throw new Error('The Mac execution job is not isolated.');
+                    const coalition = { id: identity.id, boot: identity.boot, label: launch.label, domain: launch.domain };
+                    const members = await inspectMacCoalition(coalition);
+                    if (members.length !== 1 || members[0].pid !== frame.pid)
+                        throw new Error('The Mac execution job is not exclusively owned.');
+                    jobIdentity = members[0];
+                    const temp = launch.ready + '.tmp';
+                    writeFileSync(temp, JSON.stringify(coalition), { flag: 'wx', mode: 0o600 });
+                    renameSync(temp, launch.ready);
+                    process.stdin.on('data', (chunk) => send(peer, { kind: 'stdin', data: chunk.toString('base64') }, process.stdin));
+                    process.stdin.on('end', () => { ended = true; send(peer, { kind: 'end' }); });
+                    process.stdin.resume();
+                })().catch(() => { console.error('The Mac execution job could not be safely registered.'); process.exitCode = 1; peer.destroy(); });
+            }
+            else if ((frame.kind === 'stdout' || frame.kind === 'stderr') && typeof frame.data === 'string') {
+                const output = frame.kind === 'stdout' ? process.stdout : process.stderr;
+                if (!output.write(Buffer.from(frame.data, 'base64'))) {
+                    peer.pause();
+                    output.once('drain', () => peer.resume());
+                }
+            }
+            else if (frame.kind === 'exit' && typeof frame.code === 'number') {
+                exitReceived = true;
+                process.exitCode = frame.code;
+                peer.end();
+                process.stdin.destroy();
+                void (async () => {
+                    const deadline = Date.now() + 5000;
+                    while (jobIdentity && Date.now() < deadline) {
+                        const current = await inspectMacProcess(jobIdentity.pid, deadline);
+                        if (!current || current.birth !== jobIdentity.birth)
+                            return;
+                        await new Promise((resolve) => setTimeout(resolve, 10));
+                    }
+                    if (jobIdentity)
+                        throw new Error('Mac execution helper did not close.');
+                })().catch(() => { process.exitCode = 1; }).finally(() => server.close());
+            }
+            else
+                throw new Error('Invalid execution transport frame.');
+        });
+    });
+    await new Promise((resolve, reject) => { server.once('error', reject); server.listen(socketPath, resolve); });
+    const content = '<?xml version="1.0"?><plist version="1.0"><dict><key>Label</key><string>' + launch.label + '</string>'
+        + '<key>ProgramArguments</key><array>' + [process.execPath, modulePath, '--job', file, launch.domain].map((value) => '<string>' + xml(value) + '</string>').join('') + '</array>'
+        + '<key>LimitLoadToSessionType</key><string>Background</string><key>RunAtLoad</key><true/><key>KeepAlive</key><false/><key>AbandonProcessGroup</key><true/></dict></plist>';
+    writeFileSync(plist, content, { flag: 'wx', mode: 0o600 });
+    try {
+        await execute('/bin/launchctl', ['bootstrap', `${launch.domain}/${process.getuid()}`, plist], { timeout: 5000 });
+    }
+    catch (error) {
+        socket?.destroy();
+        server.close();
+        throw error;
+    }
+    // Only bootstrap/registration is bounded. Running agents have no timer.
+    const timer = setTimeout(() => { if (!existsSync(launch.ready)) {
+        console.error('The Mac execution job did not become ready.');
+        process.exitCode = 1;
+        socket?.destroy();
+        server.close();
+    } }, 5000);
+    timer.unref();
+    process.on('exit', () => { if (!ended)
+        process.stdin.destroy(); });
+}
+function job(file) {
+    const closeUnpromptedJob = (label, domain = process.argv[4] === 'user' ? 'user' : 'gui') => {
+        if (!label || !/^com\.ctrl-spc\.execution\.[\da-f-]{36}$/i.test(label))
+            return;
+        // The creator can disappear before this queued job even reads its launch
+        // file. No grant can then arrive; remove this exact one-shot job as well.
+        void execute('/bin/launchctl', ['bootout', `${domain}/${process.getuid()}/${label}`], { timeout: 5000 }).catch(() => { process.exitCode = 1; });
+    };
+    let launch;
+    try {
+        launch = JSON.parse(readFileSync(file, 'utf8'));
+    }
+    catch {
+        closeUnpromptedJob(process.env.XPC_SERVICE_NAME);
+        process.exitCode = 1;
+        return;
+    }
+    const socket = createConnection(join(launch.directory, 'io.sock'));
+    let provider = null, admitted = false;
+    socket.on('connect', () => send(socket, { kind: 'hello', pid: process.pid }));
+    socket.on('error', () => { if (!admitted)
+        process.exitCode = 1; });
+    socket.on('close', () => { if (!admitted)
+        closeUnpromptedJob(launch.label, launch.domain ?? 'gui'); });
+    frames(socket, (frame) => {
+        if (frame.kind === 'stdin' && typeof frame.data === 'string') {
+            let bytes = Buffer.from(frame.data, 'base64');
+            if (!admitted) {
+                if (!bytes.length || bytes[0] !== 1)
+                    throw new Error('Invalid execution grant.');
+                admitted = true;
+                bytes = bytes.subarray(1);
+                provider = spawn(launch.bin, launch.args, { cwd: launch.cwd, env: launch.env, shell: launch.shell, stdio: ['pipe', 'pipe', 'pipe'] });
+                provider.stdin?.on('error', () => { });
+                provider.stdout?.on('data', (chunk) => { if (!socket.destroyed)
+                    send(socket, { kind: 'stdout', data: chunk.toString('base64') }, provider.stdout); });
+                provider.stderr?.on('data', (chunk) => { if (!socket.destroyed)
+                    send(socket, { kind: 'stderr', data: chunk.toString('base64') }, provider.stderr); });
+                provider.on('error', () => { if (!socket.destroyed)
+                    send(socket, { kind: 'stderr', data: Buffer.from('The harness could not start.').toString('base64') }); });
+                provider.on('close', (code, signal) => { if (!socket.destroyed) {
+                    send(socket, { kind: 'exit', code: code ?? 1, signal });
+                    socket.end();
+                } });
+            }
+            if (bytes.length && !provider?.stdin?.write(bytes)) {
+                socket.pause();
+                provider?.stdin?.once('drain', () => socket.resume());
+            }
+        }
+        else if (frame.kind === 'end') {
+            if (provider)
+                provider.stdin?.end();
+            else {
+                send(socket, { kind: 'exit', code: 0 });
+                socket.end();
+            }
+        }
+        else
+            throw new Error('Invalid execution transport frame.');
+    });
+}
+if (process.argv[1] === modulePath) {
+    if (process.argv[2] === '--bridge')
+        void bridge(process.argv[3]).catch(() => { console.error('Mac safe execution is unavailable; no agent was started.'); process.exitCode = 1; });
+    else if (process.argv[2] === '--job')
+        job(process.argv[3]);
+}

package/dist/index.js

@@ -4,9 +4,11 @@ import { runDaemon } from './daemon.js';
 import { openCompanion } from './companion.js';
 import { autostartOn, autostartOff } from './autostart.js';
 import { detectAgents } from './agents.js';
-import { getMachineIdentity, clearSession, readSession } from './config.js';
-import { getClient } from './supabase.js';
-import { foreignToolsServerAlive, claudeRegisteredOnDisk, codexRegisteredOnDisk } from './mcp.js';
+import { getMachineIdentity, clearSession, readSession, machineHostname } from './config.js';
+import { CLI_VERSION } from './package-version.js';
+import { inspectLocalRuntime, runLifecycleCommand } from './daemon-lifecycle.js';
+import { readMigration, readRuntime } from './daemon-lock.js';
+import { claudeRegisteredOnDisk, codexRegisteredOnDisk } from './mcp.js';
 import { panelCommand } from './panel3/cli.js';
 const HELP = `cs — CTRL+SPC
 
@@ -14,7 +16,11 @@ const HELP = `cs — CTRL+SPC
   cs open           Open the Companion app in your browser
   cs login          Sign in from the terminal and link this computer
   cs start          Come online and answer cards, no window (used by auto-start)
-  cs status         Show the whole setup state and the one next step to take
+  cs stop           Stop this service; refuses while work is active
+  cs restart        Load this installed version and keep it running in background
+  cs stop --force   Interrupt owned work, save recovery, then stop
+  cs restart --force Interrupt owned work, then load this installed version
+  cs status         Show local service, cloud readiness and running version
   cs autostart on   Come online automatically at login
   cs autostart off  Stop coming online at login
   cs logout         Sign this computer out
@@ -28,80 +34,62 @@ const HELP = `cs — CTRL+SPC
 
   cs help           Show this help
 `;
-/**
- * The whole setup state, and the ONE next step to take, for an agent — the
- * reader of this command in every story is Claude Code or Codex, not a person
- * at a prompt, so every step below addresses the agent and names the user only
- * for sign-in, which is the one step only the user can take.
- *
- * A non-zero exit means "not fully set up", NEVER "a command failed". A machine
- * mid-setup exits 1 while everything is working correctly.
- */
+/** Inspection never creates a competing cloud refresh owner. */
 async function status() {
-    const id = getMachineIdentity();
+    const machine = getMachineIdentity();
     const installed = detectAgents();
-    /* Signed-out is a FILE question, not a network one. getClient() throws
-       NotLoggedIn whenever setSession fails FOR ANY REASON, including a network
-       failure (supabase.ts), so trusting it would tell a signed-in user on bad
-       wifi to go and sign in again — the confident-wrong instruction this feature
-       exists to kill. readSession() returning null is the only true "signed out". */
-    const stored = readSession();
-    let signedIn = false;
-    let email = null;
-    let sessionProblem = null;
-    if (stored) {
-        try {
-            const client = await getClient();
-            const { data } = await client.auth.getUser();
-            email = data.user?.email ?? null;
-            signedIn = true;
+    console.log('Computer: ' + machine.name);
+    console.log('Installed CLI version: ' + CLI_VERSION);
+    console.log('Harnesses installed: ' + (installed.join(', ') || 'none'));
+    console.log('Harness sign-in: not checked by this command; each work request checks its selected harness.');
+    const inspection = await inspectLocalRuntime();
+    if (inspection?.status) {
+        const current = inspection.status;
+        console.log('Local service: ' + current.local + ' (pid ' + current.pid + ')');
+        console.log('Running version: ' + current.version + ' — verified');
+        console.log('Cloud connection: ' + current.cloud);
+        const work = [...current.work.active, ...current.work.pending, ...current.work.unknown];
+        console.log('Owned work: ' + work.length + (current.work.unknown.length ? ' (includes unverified execution)' : ''));
+        for (const item of work)
+            console.log('  ' + (item.cardId ?? item.workId ?? 'Card identity unavailable') + ' — ' + (item.harness ?? 'harness unknown'));
+        if (current.work.receipts || current.work.legacyHeldTodoIds.length)
+            console.log('Saved interruptions are waiting for reconciliation or explicit continuation.');
+        if (current.cloud === 'sign-in-required')
+            console.log('Run cs login on ' + machine.name + '. Local stop and restart remain available.');
+        else if (current.cloud !== 'online')
+            console.log('Cloud readiness is not confirmed. Check the connection; cs status will show when it is ready.');
+        if (current.version !== CLI_VERSION)
+            console.log('Run cs restart to activate the installed CLI version.');
+        else
+            console.log('Stop: cs stop. Restart this installed version: cs restart.');
+        console.log('Explicit interruption: cs stop --force or cs restart --force. Interrupted cards need a new message to continue.');
+        if (current.cloud === 'online') {
+            for (const agent of installed)
+                console.log('  ' + agent + ': ' + ((agent === 'claude' ? claudeRegisteredOnDisk() : codexRegisteredOnDisk()) ? 'registered' : 'not registered'));
         }
-        catch (err) {
-            /* The REASON only. getClient()'s NotLoggedIn message ends with its own
-               "Run `cs login` again.", which would print twice in the step below. */
-            const raw = err instanceof Error ? err.message : String(err);
-            sessionProblem = raw.replace(/\s*Run `cs login` again\.?\s*$/, '').replace(/\.$/, '');
-        }
-    }
-    const serving = await foreignToolsServerAlive();
-    /* Gated on `serving` because a plain shutdown DELIBERATELY leaves the agent
-       config entries in place (presence.ts), so an ungated read prints
-       "registered" against a daemon that is not there. */
-    const registered = {
-        claude: serving && claudeRegisteredOnDisk(),
-        codex: serving && codexRegisteredOnDisk(),
-    };
-    console.log(`Computer:  ${id.name}`);
-    console.log(`Signed in: ${signedIn ? (email ?? 'unknown') : stored ? 'saved sign-in unusable' : 'Not signed in'}`);
-    console.log(`Daemon:    ${serving ? 'running' : 'not running'}`);
-    console.log(`Agents:    ${installed.length ? installed.join(', ') : 'none installed'}`);
-    for (const agent of installed) {
-        console.log(`  ${agent.padEnd(8)} ${registered[agent] ? 'registered' : 'not registered'}`);
-    }
-    console.log('');
-    const unregistered = installed.filter((a) => !registered[a]);
-    if (!stored) {
-        console.log('Nobody is signed in. Ask the user to run `cs login` themselves: it opens a');
-        console.log('browser and waits up to five minutes, so do not run it yourself. They sign in');
-        console.log('with the same email and password they use on ctrl-spc.com. Then run `cs status`');
-        console.log('again.');
-    }
-    else if (!signedIn) {
-        console.log(`The saved sign-in could not be used: ${sessionProblem ?? 'unknown'}. Ask the user to run`);
-        console.log('`cs login` again.');
-    }
-    else if (!serving) {
-        console.log('Nothing is serving the tools. `cs start` never exits on its own, so start it in');
-        console.log('the background and leave it running, then run `cs status` again.');
+        if (current.cloud !== 'online' || current.work.unknown.length)
+            process.exitCode = 1;
+        return;
     }
-    else if (unregistered.length) {
-        console.log(`The tools are being served but are not registered into ${unregistered.join(' or ')}. Restart the`);
-        console.log('background daemon, then run `cs status` again.');
+    if (inspection) {
+        console.log('Local service: alive; control is unavailable (pid ' + inspection.record.process.pid + ')');
+        console.log('Running version: unavailable. Last recorded version: ' + inspection.record.version);
+        console.log('Cloud connection and owned work: unknown');
+        console.log('Run cs restart --force to recover verified owned execution. This interrupts work; saved cards need a new message to continue.');
     }
     else {
-        console.log('Tools are registered. If this agent cannot see them, restart it. An agent picks');
-        console.log('up MCP servers only when it starts.');
-        return;
+        const migration = readMigration();
+        console.log('Local service: stopped or not yet managed by this release');
+        console.log('Running version: unavailable');
+        console.log('Cloud connection: unknown; local service is not responding');
+        if (migration && !migration.completed)
+            console.log('One-time upgrade is pending. Run cs restart to check whether this computer still needs a restart.');
+        else if (readRuntime())
+            console.log('A previous service exited. Run cs restart to recover this instance.');
+        else
+            console.log('Run cs start. If an older service needs a one-time computer restart, the command will explain it.');
+        if (!readSession())
+            console.log('No saved sign-in. Run cs login on ' + machine.name + '. Local service controls work without sign-in.');
     }
     process.exitCode = 1;
 }
@@ -112,7 +100,15 @@ async function main() {
         case undefined: return openCompanion();
         case 'open': return openCompanion();
         case 'login': return login();
-        case 'start': return runDaemon();
+        case 'start':
+            if (arg && !(arg.startsWith('--lifecycle-handover=') && process.env.CTRL_SPC_LIFECYCLE_HANDOVER === arg.slice('--lifecycle-handover='.length)))
+                throw new Error('Usage: cs start');
+            return runDaemon();
+        case 'stop':
+        case 'restart':
+            if (process.argv.length > 4 || (arg !== undefined && arg !== '--force'))
+                throw new Error('Usage: cs ' + cmd + ' [--force]');
+            return runLifecycleCommand(cmd, arg === '--force');
         case 'status': return status();
         case 'logout':
             console.log(clearSession() ? 'Signed out.' : 'Was not signed in.');
@@ -145,6 +141,6 @@ async function main() {
     }
 }
 main().catch((err) => {
-    console.error(err instanceof Error ? err.message : String(err));
+    console.error('CTRL+SPC on ' + machineHostname() + ': ' + (err instanceof Error ? err.message : String(err)));
     process.exit(1);
 });

package/dist/login.js

@@ -82,8 +82,8 @@ async function handleCallback(req, res, state, finish) {
     }
     writeSession({ access_token, refresh_token });
     try {
-        const client = await getClient();
-        const { data, error } = await client.auth.getUser();
+        const client = await getClient({ refreshing: false });
+        const { data, error } = await client.auth.getUser(access_token);
         if (error || !data.user?.email)
             throw new Error(error?.message ?? 'No user for this session.');
         res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -169,7 +169,9 @@ function renderPage(state) {
   tin.onclick=()=>{tin.classList.add('active');tup.classList.remove('active');fin.classList.add('active');fup.classList.remove('active')}
   tup.onclick=()=>{tup.classList.add('active');tin.classList.remove('active');fup.classList.add('active');fin.classList.remove('active')}
   const { createClient } = await import('https://esm.sh/@supabase/supabase-js@2')
-  const sb = createClient(${JSON.stringify(SUPABASE_URL)}, ${JSON.stringify(SUPABASE_KEY)})
+  const sb = createClient(${JSON.stringify(SUPABASE_URL)}, ${JSON.stringify(SUPABASE_KEY)}, {
+    auth: { autoRefreshToken: false, persistSession: false, detectSessionInUrl: false }
+  })
   async function done(session){
     const r = await fetch('/callback',{method:'POST',headers:{'Content-Type':'application/json'},
       body:JSON.stringify({access_token:session.access_token,refresh_token:session.refresh_token,state:STATE})})

package/dist/native/darwin-coalition.build.json

@@ -0,0 +1 @@
+{"sourceHash":"e817b52cb4cf445046d83c9d4a6a7f8e79624f498564a3e40cb66d575ed4d63a","compiler":"Apple clang version 21.0.0 (clang-2100.1.1.101)\nTarget: arm64-apple-darwin25.3.0\nThread model: posix\nInstalledDir: /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin\n","binaryHash":"25d9d65d0ee5718ddb8f54a08fa5000b9c73508f6eb532f085e812b249adf9bb"}