@cydm/happy-elves 0.1.0-beta.495 → 0.1.0-beta.497

package/apps/cli/dist/commands/lib/args.js

@@ -33,6 +33,11 @@ const valueFlags = new Set([
     "limit",
     "machine",
     "machine-id",
+    "operation-id",
+    "limit-bytes",
+    "max-wait-ms",
+    "manifest-digest",
+    "version",
     "native-identity",
     "memory",
     "memory-mode",

package/apps/cli/dist/commands/lib/usage.js

@@ -35,6 +35,14 @@ Check local controller config, relay reachability, and daemon state.
     machine: `Usage:
   happy-elves machine list [--verbose] [--json]
   happy-elves machine status <machineId> [--verbose] [--json]
+  happy-elves machine update check <machineId> [--json]
+  happy-elves machine update status <machineId> [--operation <operationId>] [--json]
+  happy-elves machine update apply <machineId> --version <version> [--reject] [--max-wait-ms <ms>] [--json]
+  happy-elves machine daemon <status|start|stop|restart|diagnose|logs> <machineId> [--limit-bytes <n>] [--json]
+  happy-elves machine host exec <machineId> <command> [args...] --operation-id <id> [--cwd <path>] [--timeout-ms <ms>] [--json]
+  happy-elves machine host exec <machineId> --shell <command> --operation-id <id> [--cwd <path>] [--timeout-ms <ms>] [--json]
+  happy-elves machine host status <machineId> --operation-id <id> [--json]
+  happy-elves machine host cancel <machineId> <jobId> [--json]
   happy-elves machine diagnose <machineId> [--json]
   happy-elves machine directory <machineId> [--path <path>] [--json]
   happy-elves machine exec <machineId> --shell <command> [--cwd <path>] [--timeout-ms <ms>] [--wait-timeout-ms <ms>] [--json]
@@ -42,7 +50,7 @@ Check local controller config, relay reachability, and daemon state.
   happy-elves machine file info <machineId> --root <cwd> --path <path> [--json]
   happy-elves machine file preview <machineId> --root <cwd> --path <path> [--mode auto|text|image|html-source|html-sandbox] [--output <file>] [--json]
 
-  diagnose/exec are LAN/dev-only. exec requires the daemon to advertise devTools.
+  diagnose/exec are LAN/dev-only. host is the durable updater-managed host command path.
   --timeout-ms limits the remote process. --wait-timeout-ms limits how long this CLI waits for the result.
   file preview is read-only and limited to files inside --root.
 `,
@@ -266,6 +274,9 @@ Happy Elves is a remote controller and orchestration layer for coding agents acr
 Core commands:
   machine list [--json]
   machine status <machineId> [--verbose] [--json]
+  machine update check <machineId> [--json]
+  machine update status <machineId> [--operation <operationId>] [--json]
+  machine update apply <machineId> --version <version> [--reject] [--json]
   machine directory <machineId> [--path <path>] [--json]
 
   session list [--machine <machineId>] [--cwd <path>] [--limit 20] [--json]

package/apps/cli/dist/commands/machine.js

@@ -162,6 +162,57 @@ export async function handleMachine({ domain, action, positional, flags }) {
         return false;
     const config = await readConfig(flags);
     const client = new ControllerClient(config);
+    if (action === "update") {
+        const updateAction = positional[0];
+        const machineId = positional[1] ?? (typeof flags.machine === "string" ? flags.machine : undefined);
+        if (!machineId)
+            throw new CliError("Usage: happy-elves machine update <check|status|apply> <machineId> [--version <version>]", "USAGE");
+        if (updateAction === "check") {
+            const result = await client.machineUpdateCheck(machineId);
+            if (!wantsJson(flags)) {
+                console.log(`${machineId}: ${result.phase}${result.currentVersion ? ` (${result.currentVersion})` : ""}`);
+                return true;
+            }
+            ok("machine.update.check", { machineId, result }, { machineId });
+            return true;
+        }
+        if (updateAction === "status") {
+            const operationId = typeof flags.operation === "string" ? flags.operation : undefined;
+            const result = await client.machineUpdateStatus(machineId, operationId);
+            if (!wantsJson(flags)) {
+                console.log(`${machineId}: ${result.phase}${result.operationId ? ` ${result.operationId}` : ""}`);
+                if (result.error)
+                    console.log(`  ${result.errorCode ?? "error"}: ${result.error}`);
+                return true;
+            }
+            ok("machine.update.status", { machineId, result }, { machineId, ...(result.operationId ? { operationId: result.operationId } : {}) });
+            return true;
+        }
+        if (updateAction === "apply") {
+            const version = typeof flags.version === "string" ? flags.version : positional[2];
+            if (!version)
+                throw new CliError("Missing --version <version>", "INVALID_ARGUMENT");
+            const result = await client.machineUpdateApply({
+                machineId,
+                targetVersion: version,
+                operationId: typeof flags["operation-id"] === "string" ? flags["operation-id"] : undefined,
+                busyPolicy: flags.reject === true ? "reject" : "wait",
+                maxWaitMs: typeof flags["max-wait-ms"] === "string" ? Number(flags["max-wait-ms"]) : undefined,
+            });
+            const success = result.phase === "succeeded" || result.phase === "recovered";
+            if (!success)
+                process.exitCode = 1;
+            if (!wantsJson(flags)) {
+                console.log(`${machineId}: ${result.phase}${result.operationId ? ` ${result.operationId}` : ""}`);
+                if (result.error)
+                    console.log(`  ${result.errorCode ?? "error"}: ${result.error}`);
+                return true;
+            }
+            ok("machine.update.apply", { machineId, result }, { machineId, ...(result.operationId ? { operationId: result.operationId } : {}) }, success);
+            return true;
+        }
+        throw new CliError("Usage: happy-elves machine update <check|status|apply> <machineId>", "USAGE");
+    }
     if (action === "directory" || action === "dir" || action === "ls") {
         const machineId = requirePositional(positional[0], "machineId");
         const listing = await client.listDirectory({
@@ -269,6 +320,77 @@ export async function handleMachine({ domain, action, positional, flags }) {
         ok("machine.diagnose", { machineId, diagnostics }, { machineId });
         return true;
     }
+    if (action === "daemon") {
+        const daemonAction = positional[0];
+        const machineId = requirePositional(positional[1], "machineId");
+        if (!daemonAction || !["status", "start", "stop", "restart", "diagnose", "logs"].includes(daemonAction))
+            throw new CliError("Usage: happy-elves machine daemon <status|start|stop|restart|diagnose|logs> <machineId>", "USAGE");
+        const result = await client.daemonManage(machineId, daemonAction, typeof flags["limit-bytes"] === "string" ? Number(flags["limit-bytes"]) : undefined);
+        if (!wantsJson(flags)) {
+            console.log(`${machineId}: ${result.running ? "running" : "stopped"}${result.pid ? ` pid ${result.pid}` : ""}${result.version ? ` ${result.version}` : ""}`);
+            if (result.error)
+                console.log(`${result.errorCode ?? "error"}: ${result.error}`);
+            if (result.output)
+                console.log(result.output);
+            return true;
+        }
+        const success = !result.errorCode;
+        if (!success)
+            process.exitCode = 1;
+        ok(`machine.daemon.${daemonAction}`, { machineId, result }, { machineId }, success);
+        return true;
+    }
+    if (action === "host") {
+        const hostAction = positional[0];
+        const machineId = requirePositional(positional[1], "machineId");
+        if (hostAction === "exec") {
+            const operationId = typeof flags["operation-id"] === "string" ? flags["operation-id"] : "";
+            if (!operationId)
+                throw new CliError("Missing --operation-id <id>", "INVALID_ARGUMENT");
+            const shell = typeof flags.shell === "string" ? flags.shell : undefined;
+            const command = shell ?? requirePositional(positional[2], "command");
+            const args = shell ? [] : positional.slice(3);
+            const timeoutMs = typeof flags["timeout-ms"] === "string" ? Number(flags["timeout-ms"]) : undefined;
+            if (timeoutMs !== undefined && (!Number.isInteger(timeoutMs) || timeoutMs <= 0))
+                throw new CliError(`Invalid --timeout-ms: ${flags["timeout-ms"]}`, "INVALID_ARGUMENT");
+            const job = await client.hostExec({
+                machineId, operationId, command, args,
+                ...(typeof flags.cwd === "string" ? { cwd: flags.cwd } : {}),
+                ...(shell ? { shell } : {}),
+                ...(timeoutMs ? { timeoutMs } : {}),
+            });
+            if (!wantsJson(flags)) {
+                console.log(`${job.jobId} ${job.status} ${job.operationId}`);
+                if (job.stdout)
+                    console.log(job.stdout);
+                if (job.stderr)
+                    console.error(job.stderr);
+                return true;
+            }
+            ok("machine.host.exec", { machineId, job }, { machineId });
+            return true;
+        }
+        if (hostAction === "status" || hostAction === "cancel") {
+            const jobId = positional[2];
+            const operationId = typeof flags["operation-id"] === "string" ? flags["operation-id"] : undefined;
+            if (hostAction === "status" && !operationId)
+                throw new CliError("Missing --operation-id <id>", "INVALID_ARGUMENT");
+            if (hostAction === "cancel" && !jobId)
+                throw new CliError("Missing jobId", "INVALID_ARGUMENT");
+            const job = hostAction === "status" ? await client.hostOperationStatus(machineId, operationId) : await client.hostJobCancel(machineId, jobId);
+            if (!wantsJson(flags)) {
+                console.log(`${job.jobId} ${job.status}`);
+                if (job.stdout)
+                    console.log(job.stdout);
+                if (job.stderr)
+                    console.error(job.stderr);
+                return true;
+            }
+            ok(`machine.host.${hostAction}`, { machineId, job }, { machineId });
+            return true;
+        }
+        throw new CliError("Usage: happy-elves machine host <exec|status|cancel> <machineId> ...", "USAGE");
+    }
     if (action === "exec" || action === "dev-exec") {
         const machineId = requirePositional(positional[0], "machineId");
         const shell = typeof flags.shell === "string" ? flags.shell : undefined;

package/apps/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cydm/happy-elves-cli",
-  "version": "0.1.0-beta.495",
+  "version": "0.1.0-beta.497",
   "private": true,
   "type": "module"
 }

package/apps/daemon/dist/direct/server.js

@@ -13,6 +13,7 @@ import { handleInboundPromptCommand } from "../relay/inbound-prompt.js";
 import { markDirectSocket, sendMachineMessageToRelay } from "../relay/send.js";
 import { setCurrentDirectTransportMetadata } from "./state.js";
 import { DirectGrantVerifier, DirectTicketStore, directAuthError, directTicketConfigFromEnv } from "./tickets.js";
+import { isUpdateAdmissionCommand, updateAdmissionBlocked, updateAdmissionError } from "../update-barrier.js";
 const DIRECT_PROTOCOL = "he-direct-v1";
 const DEFAULT_DIRECT_PORT = 8790;
 const MAX_FRAME_BYTES = 8 * 1024 * 1024;
@@ -282,6 +283,20 @@ class DirectState {
             this.ackStoredPacket(connection, message.packet);
             return;
         }
+        if (isUpdateAdmissionCommand(command.type)) {
+            const barrier = await updateAdmissionBlocked();
+            if (barrier) {
+                await this.sendMachinePacket({
+                    type: "machine:error",
+                    requestId: command.requestId,
+                    sessionId: sessionIdFromMachineCommand(command),
+                    code: updateAdmissionError(barrier).code,
+                    message: updateAdmissionError(barrier).message,
+                }, connection);
+                this.ackStoredPacket(connection, message.packet);
+                return;
+            }
+        }
         if (command.type === "machine:prompt") {
             await handleInboundPromptCommand({
                 ws: this.handlerSocket(connection),
@@ -742,6 +757,7 @@ class DirectState {
             acpxVersion: runtimeCapabilities.version,
             daemonVersion: daemonPackage.version,
             ...(runtimeCapabilities.turnPrimitives ? { turnPrimitives: runtimeCapabilities.turnPrimitives } : {}),
+            runtimeEvents: { forwardCursor: true },
             sessionPrimitives: runtimePrimitiveSupportForCapabilities(runtimeCapabilities.sessionPrimitives, "native"),
             ...(runtimeCapabilities.sidechat ? { sidechat: runtimeCapabilities.sidechat } : {}),
             directoryBrowser: true,

package/apps/daemon/dist/local-control.d.ts

@@ -0,0 +1,4 @@
+export type LocalControlServer = {
+    close: () => Promise<void>;
+};
+export declare function startLocalControl(machineId: string): Promise<LocalControlServer>;

package/apps/daemon/dist/local-control.js

@@ -0,0 +1,111 @@
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import net from "node:net";
+import os from "node:os";
+import path from "node:path";
+import { configDir } from "./paths.js";
+import { readDaemonIdentity } from "./process.js";
+import { beginUpdateBarrier, clearUpdateBarrier, markUpdateBarrierPending } from "./update-barrier.js";
+import { pendingOptionsForSession } from "./state.js";
+import { sessionTurns } from "./state.js";
+import { sessions } from "./state.js";
+function localControlPath(machineId) {
+    return process.platform === "win32"
+        ? `\\\\.\\pipe\\happy-elves-daemon-${machineId}`
+        : unixControlPath(configDir);
+}
+function unixControlPath(root) {
+    const preferred = path.join(root, "daemon-control.sock");
+    if (preferred.length < 96)
+        return preferred;
+    const digest = crypto.createHash("sha256").update(path.resolve(root)).digest("hex").slice(0, 24);
+    return path.join(os.tmpdir(), `happy-elves-daemon-${digest}.sock`);
+}
+export async function startLocalControl(machineId) {
+    const socketPath = localControlPath(machineId);
+    if (process.platform !== "win32")
+        await fs.rm(socketPath, { force: true }).catch(() => undefined);
+    const server = net.createServer((socket) => {
+        let buffer = "";
+        socket.setEncoding("utf8");
+        socket.on("data", (chunk) => {
+            buffer += chunk;
+            let index = buffer.indexOf("\n");
+            while (index >= 0) {
+                const line = buffer.slice(0, index);
+                buffer = buffer.slice(index + 1);
+                index = buffer.indexOf("\n");
+                void handleControlRequest(line, socket);
+            }
+        });
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(socketPath, () => resolve());
+    });
+    if (process.platform !== "win32")
+        await fs.chmod(socketPath, 0o600).catch(() => undefined);
+    return {
+        close: async () => {
+            await new Promise((resolve) => server.close(() => resolve()));
+            if (process.platform !== "win32")
+                await fs.rm(socketPath, { force: true }).catch(() => undefined);
+        },
+    };
+}
+async function handleControlRequest(raw, socket) {
+    try {
+        const request = JSON.parse(raw);
+        if (request.type === "identity") {
+            const identity = await readDaemonIdentity();
+            if (!identity || identity.pid !== process.pid || identity.stateRoot !== path.resolve(configDir)) {
+                write(socket, { ok: false, code: "DAEMON_IDENTITY_UNAVAILABLE" });
+                return;
+            }
+            write(socket, { ok: true, pid: process.pid, stateRoot: identity.stateRoot, machineId: identity.machineId, nonce: identity.nonce, ...(identity.generation ? { generation: identity.generation } : {}), startedAt: identity.startedAt });
+            return;
+        }
+        if (request.type === "status") {
+            const activeTurns = sessionTurns.activeCount();
+            const pendingOptions = [...sessions.values()].reduce((count, session) => count + (sessionTurns.activeTurnId(session.sessionId) ? pendingOptionsForSession(session.sessionId, sessionTurns.activeTurnId(session.sessionId)).length : 0), 0);
+            write(socket, { ok: true, activeTurns, pendingOptions, busy: activeTurns > 0 || pendingOptions > 0 });
+            return;
+        }
+        if (request.type === "begin-update") {
+            const releasePending = markUpdateBarrierPending({ operationId: request.operationId, generation: request.generation, leaseMs: request.leaseMs ?? 120_000 });
+            try {
+                const activeTurns = sessionTurns.activeCount();
+                const pendingOptions = [...sessions.values()].reduce((count, session) => count + (sessionTurns.activeTurnId(session.sessionId) ? pendingOptionsForSession(session.sessionId, sessionTurns.activeTurnId(session.sessionId)).length : 0), 0);
+                if (activeTurns > 0 || pendingOptions > 0) {
+                    write(socket, { ok: false, code: "DAEMON_BUSY", activeTurns, pendingOptions });
+                    return;
+                }
+                const barrier = await beginUpdateBarrier({ operationId: request.operationId, generation: request.generation, leaseMs: request.leaseMs ?? 120_000 });
+                write(socket, { ok: true, barrier });
+            }
+            finally {
+                releasePending();
+            }
+            return;
+        }
+        if (request.type === "end-update") {
+            await clearUpdateBarrier(request.operationId);
+            write(socket, { ok: true });
+            return;
+        }
+        if (request.type === "shutdown") {
+            write(socket, { ok: true });
+            setTimeout(() => process.kill(process.pid, "SIGTERM"), 25).unref?.();
+            return;
+        }
+        write(socket, { ok: false, code: "INVALID_CONTROL_COMMAND" });
+    }
+    catch (error) {
+        write(socket, { ok: false, code: "INVALID_CONTROL_COMMAND", error: error instanceof Error ? error.message : String(error) });
+    }
+}
+function write(socket, value) {
+    if (!socket.destroyed)
+        socket.write(`${JSON.stringify(value)}\n`);
+}
+//# sourceMappingURL=local-control.js.map

package/apps/daemon/dist/orchestration/watcher.d.ts

@@ -22,6 +22,7 @@ export declare function catchUpSubscriptionEvents(input: {
     config: DaemonConfig;
     subscription: OrchestrationSubscriptionRecord;
 }): Promise<SubscriptionCatchUpResult>;
+export declare function remoteEventCursorForSubscription(crewMachineId: string, subscription: Pick<OrchestrationSubscriptionRecord, "remoteEventCursor" | "remoteEventSeq">): string | undefined;
 export declare function attentionFromReconcile(result: TurnReconcileResult): {
     eventType: TaskAttentionEventType;
     reason: string;

package/apps/daemon/dist/orchestration/watcher.js

@@ -4,10 +4,13 @@ import { RemoteCommandError, requestRemoteMachineResult } from "../relay/remote-
 import { runtimeRead } from "../session/runtime-truth.js";
 import { activeSubscriptionsForTurn, appendAttention, markSubscriptionLiveness, markSubscriptionRemoteScan, recordTurnRuntimeBinding, } from "./store.js";
 import { scheduleRemoteOrchestrationWork } from "./remote-work-budget.js";
+import { relayMachineRegistry } from "../state.js";
 const remoteCatchupsInFlight = new Map();
 const legacyRemoteCursorFallbackUntil = new Map();
+const remoteForwardCursorConfirmed = new Set();
 const legacyRemoteCursorFallbackMs = 5 * 60 * 1000;
 const initialRemoteEventCursor = "event_000000000000";
+const forwardEventCursorSinceBeta = 495;
 export async function observeSessionEvent(input) {
     const attention = attentionFromEvent(input.payload);
     if (!attention) {
@@ -116,11 +119,10 @@ export async function catchUpSubscriptionEvents(input) {
 }
 async function catchUpSubscriptionEventsInternal(input) {
     const crewMachineId = input.subscription.crewMachineId ?? input.config.machineId;
-    const remoteCursorEnabled = crewMachineId !== input.config.machineId && canUseRemoteEventCursor(crewMachineId);
-    const remoteCursor = remoteCursorEnabled
-        ? input.subscription.remoteEventCursor
-            ?? (input.subscription.remoteEventSeq ? `event_${String(input.subscription.remoteEventSeq).padStart(12, "0")}` : initialRemoteEventCursor)
+    const remoteCursor = crewMachineId !== input.config.machineId
+        ? remoteEventCursorForSubscription(crewMachineId, input.subscription)
         : undefined;
+    const remoteCursorEnabled = remoteCursor !== undefined;
     try {
         const result = crewMachineId === input.config.machineId
             ? await runtimeRead(input.config, {
@@ -171,7 +173,14 @@ async function catchUpSubscriptionEventsInternal(input) {
         // the forward cursor in its response. Treat that as the legacy path for
         // this machine; in particular, never advance a durable cursor from a
         // page whose peer cannot prove append-only progress.
-        if (crewMachineId !== input.config.machineId && remoteCursorEnabled && !result.cursorSupported && !result.nextAfter) {
+        if (crewMachineId !== input.config.machineId && result.cursorSupported === true) {
+            remoteForwardCursorConfirmed.add(crewMachineId);
+        }
+        else if (crewMachineId !== input.config.machineId && remoteCursorEnabled && !result.nextAfter) {
+            // A peer that accepted the forward request but cannot prove the cursor
+            // contract is no longer trusted. Remove the positive handshake so the
+            // next safe, legacy-compatible request can renegotiate it.
+            remoteForwardCursorConfirmed.delete(crewMachineId);
             legacyRemoteCursorFallbackUntil.set(crewMachineId, Date.now() + legacyRemoteCursorFallbackMs);
         }
         const observed = await observeSubscriptionRuntimeEvents({
@@ -201,6 +210,7 @@ async function catchUpSubscriptionEventsInternal(input) {
     }
     catch (error) {
         if (crewMachineId !== input.config.machineId && remoteCursorEnabled && isRemoteEventCursorCompatibilityFailure(error)) {
+            remoteForwardCursorConfirmed.delete(crewMachineId);
             legacyRemoteCursorFallbackUntil.set(crewMachineId, Date.now() + legacyRemoteCursorFallbackMs);
         }
         await appendOrchestrationAudit(input.config, "orchestration.subscription.catchup_failed", `Subscription catch-up failed for ${input.subscription.taskId}`, {
@@ -216,13 +226,63 @@ async function catchUpSubscriptionEventsInternal(input) {
 function canUseRemoteEventCursor(crewMachineId) {
     const until = legacyRemoteCursorFallbackUntil.get(crewMachineId);
     if (until === undefined)
-        return true;
+        return remotePeerAdvertisesForwardCursor(crewMachineId);
     if (until <= Date.now()) {
         legacyRemoteCursorFallbackUntil.delete(crewMachineId);
-        return true;
+        return remotePeerAdvertisesForwardCursor(crewMachineId);
     }
     return false;
 }
+export function remoteEventCursorForSubscription(crewMachineId, subscription) {
+    const fallbackUntil = legacyRemoteCursorFallbackUntil.get(crewMachineId);
+    if (fallbackUntil !== undefined && fallbackUntil > Date.now())
+        return undefined;
+    if (fallbackUntil !== undefined)
+        legacyRemoteCursorFallbackUntil.delete(crewMachineId);
+    const advertised = remotePeerForwardCursorSupport(crewMachineId);
+    // An explicit old version wins over a stale persisted cursor (for example,
+    // after a peer downgrade). Unknown manifests are different: a persisted
+    // cursor is still positive evidence until the peer identity is refreshed.
+    if (advertised === false)
+        return undefined;
+    // A persisted cursor is positive evidence from a previous successful
+    // forward-page response. It remains usable even when the peer's manifest is
+    // temporarily unavailable during reconnect.
+    if (subscription.remoteEventCursor)
+        return subscription.remoteEventCursor;
+    if (advertised !== true || !canUseRemoteEventCursor(crewMachineId))
+        return undefined;
+    return subscription.remoteEventSeq
+        ? `event_${String(subscription.remoteEventSeq).padStart(12, "0")}`
+        : initialRemoteEventCursor;
+}
+function remotePeerAdvertisesForwardCursor(crewMachineId) {
+    return remotePeerForwardCursorSupport(crewMachineId) === true;
+}
+function remotePeerForwardCursorSupport(crewMachineId) {
+    const machine = relayMachineRegistry.get(crewMachineId);
+    const daemonVersion = machine?.capabilities.daemonVersion?.trim();
+    const advertisedFeature = machine?.capabilities.runtimeEvents?.forwardCursor;
+    if (advertisedFeature === false)
+        return false;
+    if (!daemonVersion) {
+        if (advertisedFeature === true || remoteForwardCursorConfirmed.has(crewMachineId))
+            return true;
+        return undefined;
+    }
+    // Published beta495 introduced the append-only eventsPage `after` field.
+    // Workspace daemons also publish an explicit feature bit. The historical
+    // package version 0.1.0 alone is not evidence: older development daemons
+    // used that same version while rejecting `after`.
+    const match = /^0\.1\.0-beta\.(\d+)$/.exec(daemonVersion);
+    if (match && Number(match[1]) < forwardEventCursorSinceBeta)
+        return false;
+    if (advertisedFeature === true || remoteForwardCursorConfirmed.has(crewMachineId))
+        return true;
+    if (match)
+        return Number(match[1]) >= forwardEventCursorSinceBeta;
+    return undefined;
+}
 function isRemoteEventCursorCompatibilityFailure(error) {
     if (!(error instanceof RemoteCommandError))
         return false;

package/apps/daemon/dist/paths.d.ts

@@ -13,6 +13,7 @@ export declare const orchestrationStorePath: string;
 export declare const artifactStorePath: string;
 export declare const memoryRootDir: string;
 export declare const pidPath: string;
+export declare const identityPath: string;
 export declare const daemonScriptPath: string;
 export declare const daemonScriptRelativePath: string;
 export declare const daemonScriptRepoSuffix: string;

package/apps/daemon/dist/paths.js

@@ -18,6 +18,7 @@ export const orchestrationStorePath = path.join(configDir, "orchestration.json")
 export const artifactStorePath = path.join(configDir, "artifacts.json");
 export const memoryRootDir = path.join(configDir, "memory");
 export const pidPath = path.join(configDir, "daemon.pid");
+export const identityPath = path.join(configDir, "daemon.identity.json");
 export const daemonScriptPath = fileURLToPath(new URL(import.meta.url.endsWith(".ts") ? "./cli.ts" : "./cli.js", import.meta.url));
 export const daemonScriptRelativePath = path.relative(process.cwd(), daemonScriptPath);
 export const daemonScriptRepoSuffix = path.join("apps", "daemon", "dist", "cli.js");

package/apps/daemon/dist/process.d.ts

@@ -1,10 +1,20 @@
+export type DaemonIdentity = {
+    pid: number;
+    stateRoot: string;
+    machineId: string;
+    nonce: string;
+    generation?: string;
+    startedAt: string;
+};
 export declare function isManagedDaemonCommand(command: string | undefined): boolean;
-export declare function writePid(): Promise<void>;
+export declare function readDaemonIdentity(): Promise<DaemonIdentity | undefined>;
+export declare function writePid(machineId: string): Promise<void>;
 export declare function removePidIfCurrent(): Promise<void>;
 export declare function localStatus(): Promise<{
     pidPath: string;
     pid?: number;
     running: boolean;
+    identityVerified?: boolean;
 }>;
 export declare function stopDaemon(timeoutMs?: number): Promise<{
     pidPath: string;

package/apps/daemon/dist/process.js

@@ -1,7 +1,8 @@
 import fs from "node:fs/promises";
 import path from "node:path";
+import crypto from "node:crypto";
 import { execFileSync, spawn } from "node:child_process";
-import { daemonScriptPath, daemonScriptRelativePath, daemonScriptRepoSuffix, pidPath } from "./paths.js";
+import { configDir, daemonScriptPath, daemonScriptRelativePath, daemonScriptRepoSuffix, identityPath, pidPath } from "./paths.js";
 import { sleep } from "./utils.js";
 function isPidAlive(pid) {
     if (!Number.isInteger(pid) || pid <= 0)
@@ -47,31 +48,74 @@ export function isManagedDaemonCommand(command) {
             command.includes(path.join("apps", "daemon", "src", "cli.ts"))) &&
         /\bstart\b/.test(command));
 }
-async function readPid() {
+async function readPidRecord() {
     try {
         const raw = await fs.readFile(pidPath, "utf8");
         const pid = Number(raw.trim());
-        return Number.isInteger(pid) && pid > 0 ? pid : undefined;
+        return Number.isInteger(pid) && pid > 0 ? { pid } : undefined;
     }
     catch (error) {
         if (error.code === "ENOENT")
             return undefined;
-        throw error;
+        return undefined;
+    }
+}
+export async function readDaemonIdentity() {
+    try {
+        const value = JSON.parse(await fs.readFile(identityPath, "utf8"));
+        if (typeof value.pid !== "number" || !Number.isInteger(value.pid) || value.pid <= 0 ||
+            typeof value.stateRoot !== "string" || !path.isAbsolute(value.stateRoot) ||
+            typeof value.machineId !== "string" || !value.machineId ||
+            typeof value.nonce !== "string" || !value.nonce ||
+            typeof value.startedAt !== "string" || !value.startedAt)
+            return undefined;
+        return {
+            pid: value.pid,
+            stateRoot: path.resolve(value.stateRoot),
+            machineId: value.machineId,
+            nonce: value.nonce,
+            ...(typeof value.generation === "string" && value.generation ? { generation: value.generation } : {}),
+            startedAt: value.startedAt,
+        };
+    }
+    catch {
+        return undefined;
     }
 }
-export async function writePid() {
+export async function writePid(machineId) {
     await fs.mkdir(path.dirname(pidPath), { recursive: true });
+    const identity = {
+        pid: process.pid,
+        stateRoot: path.resolve(configDir),
+        machineId,
+        nonce: crypto.randomUUID(),
+        ...(process.env.HAPPY_ELVES_UPDATER_GENERATION ? { generation: process.env.HAPPY_ELVES_UPDATER_GENERATION } : {}),
+        startedAt: new Date().toISOString(),
+    };
     await fs.writeFile(pidPath, `${process.pid}\n`, { mode: 0o600 });
+    await fs.chmod(pidPath, 0o600);
+    const temporary = `${identityPath}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+    await fs.writeFile(temporary, `${JSON.stringify(identity)}\n`, { mode: 0o600 });
+    await fs.rename(temporary, identityPath);
+    await fs.chmod(identityPath, 0o600);
 }
 export async function removePidIfCurrent() {
-    const pid = await readPid();
-    if (pid === process.pid) {
+    const record = await readPidRecord();
+    const identity = await readDaemonIdentity();
+    if (record?.pid === process.pid && identity?.pid === process.pid && identity.stateRoot === path.resolve(configDir)) {
         await fs.rm(pidPath, { force: true });
+        await fs.rm(identityPath, { force: true });
     }
 }
 export async function localStatus() {
-    const pid = await readPid();
-    return { pidPath, pid, running: pid !== undefined && isPidAlive(pid) && isManagedDaemonPid(pid) };
+    const record = await readPidRecord();
+    const pid = record?.pid;
+    const alive = pid !== undefined && isPidAlive(pid) && isManagedDaemonPid(pid);
+    if (!alive)
+        return { pidPath, ...(pid ? { pid } : {}), running: false };
+    const identity = await readDaemonIdentity();
+    const verified = identity?.pid === pid && identity.stateRoot === path.resolve(configDir);
+    return { pidPath, pid, running: true, identityVerified: verified };
 }
 export async function stopDaemon(timeoutMs = 5000) {
     const status = await localStatus();
@@ -79,6 +123,8 @@ export async function stopDaemon(timeoutMs = 5000) {
         await fs.rm(pidPath, { force: true });
         return { ...status, stopped: false, running: false };
     }
+    if (status.identityVerified !== true)
+        throw Object.assign(new Error("The daemon PID is alive but its state-root identity cannot be verified; refusing to stop it"), { code: "DAEMON_IDENTITY_UNVERIFIED" });
     process.kill(status.pid, "SIGTERM");
     const deadline = Date.now() + timeoutMs;
     while (Date.now() < deadline) {