@cydm/happy-elves 0.1.0-beta.7 → 0.1.0-beta.71

package/apps/cli/dist/commands/daemon.js

@@ -1,6 +1,204 @@
+import { createHash, timingSafeEqual } from "node:crypto";
 import os from "node:os";
 import path from "node:path";
-import { CliError, compactText, ControllerClient, configDir, configPath, daemonPidPath, deriveOrchestration, idleSessionStatuses, localDaemonStatus, ok, parsePairingClaimResponse, randomId, readConfig, readDaemonConfig, readLocalAuditLog, readRelayJson, redactedDaemonConfig, requirePositional, requireRelayUrl, requireString, showMachine, spawnDaemonStart, stopLocalDaemon, throwRelayHttpError, wantsJson, writeDaemonConfig } from "./lib/index.js";
+import { daemonLifecycleRequestIdV1Schema, } from "../../../../packages/shared/dist/index.js";
+import { assertLocalDaemonRuntimeMatchesConfig, assertLocalDaemonVerified, canonicalRelayUrl, cliErrorFromFetch, CliError, compactText, ControllerClient, configDir, configPath, daemonPidPath, deriveOrchestration, diagnoseInstallation, emitDoctorResult, ensureDaemonRunning, idleSessionStatuses, localDaemonStatus, ok, parsePairingClaimResponse, randomId, readConfig, readDaemonConfig, readDaemonProjectionBaseline, readLocalAuditLog, readOptionalControllerConfig, readRelayJson, redactedDaemonConfig, requirePositional, requireRelayUrl, requireString, showMachine, startDaemonTimeoutMs, stopLocalDaemon, stopSpawnedDaemon, throwRelayHttpError, waitForDaemonReadiness, waitForDaemonSelfReadiness, wantsJson, withAccountConfigTransaction } from "./lib/index.js";
+function positiveLimit(flags, fallback) {
+    const value = flags.limit;
+    if (value === undefined)
+        return fallback;
+    if (typeof value !== "string")
+        throw new CliError("Missing --limit value", "MISSING_ARGUMENT");
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed <= 0 || parsed > 200)
+        throw new CliError(`Invalid --limit: ${value}`, "INVALID_ARGUMENT");
+    return parsed;
+}
+async function boundedMap(values, concurrency, map) {
+    const result = new Array(values.length);
+    let nextIndex = 0;
+    await Promise.all(Array.from({ length: Math.min(concurrency, values.length) }, async () => {
+        while (nextIndex < values.length) {
+            const index = nextIndex;
+            nextIndex += 1;
+            result[index] = await map(values[index]);
+        }
+    }));
+    return result;
+}
+function overviewUnsupported(error) {
+    return error.code === "OVERVIEW_UNSUPPORTED";
+}
+function assertControllerCanObserveDaemon(controllerConfig, daemonConfig) {
+    if (canonicalRelayUrl(controllerConfig.relayUrl, "Controller config") !==
+        canonicalRelayUrl(daemonConfig.relayUrl, "Daemon config") ||
+        !pairSecretsEqual(controllerConfig.accountSecret, daemonConfig.accountSecret)) {
+        throw new CliError("Controller and daemon configurations belong to different workspaces. Local daemon readiness cannot be verified and no process was changed.", "CONFIG_SPLIT_BRAIN");
+    }
+}
+async function waitForLocalDaemonReadiness(client, config, baseline, daemon, requireFreshProjection) {
+    try {
+        if (!client) {
+            const local = await localDaemonStatus();
+            assertLocalDaemonVerified(local);
+            if (!local.running) {
+                throw new CliError("Daemon exited before its local runtime identity became ready. Run happy-elves daemon doctor and happy-elves daemon logs.", "DAEMON_START_FAILED");
+            }
+            await assertLocalDaemonRuntimeMatchesConfig(config);
+            await waitForDaemonSelfReadiness(config, daemon.instanceGeneration, { timeoutMs: startDaemonTimeoutMs });
+            return { local, relayAuthenticated: "verified" };
+        }
+        const readiness = await waitForDaemonReadiness(client, config.machineId, {
+            baseline,
+            expectedInstanceGeneration: daemon.instanceGeneration,
+            requireFreshProjection,
+            timeoutMs: startDaemonTimeoutMs,
+        });
+        if (readiness.phase === "process-exited" || readiness.phase === "owner-changed") {
+            throw new CliError("Daemon exited before it authenticated with the relay. Run happy-elves daemon doctor and happy-elves daemon logs.", "DAEMON_START_FAILED");
+        }
+        if (readiness.phase !== "relay-authenticated" || !readiness.machine?.online) {
+            const relayDetail = readiness.lastRelayErrorCode ? ` Last relay error: ${readiness.lastRelayErrorCode}.` : "";
+            throw new CliError(`Daemon is running, but it did not authenticate with the relay before the startup deadline.${relayDetail} Run happy-elves daemon doctor and happy-elves daemon logs.`, "DAEMON_ONLINE_TIMEOUT");
+        }
+        return { ...readiness, relayAuthenticated: "verified" };
+    }
+    catch (error) {
+        if (daemon.startedHandle) {
+            try {
+                await stopSpawnedDaemon(daemon.startedHandle);
+            }
+            catch (cleanupError) {
+                throw new CliError(`Daemon readiness failed and its owned child could not be cleaned up: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`, "DAEMON_START_CLEANUP_FAILED");
+            }
+        }
+        throw error;
+    }
+}
+async function remoteDaemonLifecycle(flags, action) {
+    const machineId = requireString(flags, "machine");
+    if (flags["request-id"] === true)
+        throw new CliError("Missing --request-id value", "MISSING_ARGUMENT");
+    const explicitRequestId = typeof flags["request-id"] === "string" ? flags["request-id"] : undefined;
+    const requestId = explicitRequestId ?? randomId("life");
+    if (!daemonLifecycleRequestIdV1Schema.safeParse(requestId).success) {
+        throw new CliError("Invalid --request-id", "INVALID_ARGUMENT");
+    }
+    const config = await readConfig(flags);
+    const client = new ControllerClient(config);
+    if (explicitRequestId !== undefined) {
+        const retained = await client.queryDaemonLifecycleOperation(machineId, requestId);
+        if (retained) {
+            const semanticsMatch = retained.daemonId === machineId &&
+                retained.action === action &&
+                (action === "upgrade" ? retained.channel === "beta" : retained.channel === undefined);
+            if (!semanticsMatch) {
+                throw new CliError(`Lifecycle request id is already bound to another operation: ${requestId}`, "REQUEST_ID_CONFLICT");
+            }
+            ok(`daemon.${action}`, { operation: retained }, { requestId, machineId });
+            return;
+        }
+    }
+    const snapshot = await client.snapshot();
+    const matches = snapshot.machines.filter((machine) => machine.id === machineId);
+    const machine = matches[0];
+    if (!machine)
+        throw new CliError(`Daemon not found: ${machineId}`, "MACHINE_NOT_FOUND");
+    if (matches.length !== 1) {
+        throw new CliError(`Relay returned duplicate Daemon identities: ${machineId}`, "RELAY_RESPONSE_INVALID");
+    }
+    if (!machine.online)
+        throw new CliError(`Daemon is offline: ${machineId}`, "MACHINE_OFFLINE");
+    const capability = machine.capabilities.daemonLifecycleV1;
+    const expectedInstanceGeneration = machine.capabilities.daemonInstanceGeneration;
+    const supported = capability !== undefined &&
+        expectedInstanceGeneration !== undefined &&
+        capability[action] &&
+        (action !== "upgrade" || (capability.installKind === "npm-global" && capability.channel === "beta"));
+    if (!supported) {
+        throw new CliError(`Daemon does not support remote ${action}: ${machineId}`, "DAEMON_LIFECYCLE_UNSUPPORTED");
+    }
+    const request = action === "upgrade"
+        ? {
+            version: 1,
+            requestId,
+            daemonId: machineId,
+            expectedInstanceGeneration,
+            action,
+            channel: "beta",
+        }
+        : {
+            version: 1,
+            requestId,
+            daemonId: machineId,
+            expectedInstanceGeneration,
+            action,
+        };
+    const operation = await client.startDaemonLifecycleOperation(request);
+    ok(`daemon.${action}`, { operation }, { requestId, machineId });
+}
+async function daemonOverview(client, input) {
+    try {
+        const sessions = [];
+        let cursor = input.cursor;
+        let first;
+        let loadNextPage = true;
+        while (loadNextPage) {
+            const page = await client.overview({
+                machineId: input.machineId,
+                limit: input.includeSessions ? (input.all ? 200 : input.limit) : 0,
+                cursor,
+            });
+            first ??= page;
+            if (input.includeSessions)
+                sessions.push(...page.sessions);
+            cursor = page.page.nextCursor;
+            loadNextPage = input.all && page.page.hasMore && Boolean(cursor);
+        }
+        const overview = first;
+        if (!overview)
+            throw new CliError("Overview response is empty", "RELAY_RESPONSE_INVALID");
+        return {
+            machines: overview.machines,
+            sessions,
+            counts: overview.sessionCounts,
+            page: {
+                returned: sessions.length,
+                total: overview.page.total,
+                hasMore: input.includeSessions && !input.all ? overview.page.hasMore : false,
+                ...(input.includeSessions && !input.all ? { limit: input.limit } : {}),
+                ...(!input.all && overview.page.nextCursor ? { nextCursor: overview.page.nextCursor } : {}),
+                source: "overview",
+            },
+        };
+    }
+    catch (error) {
+        if (!overviewUnsupported(error))
+            throw error;
+        if (input.cursor)
+            throw new CliError("This relay does not support daemon status cursors; retry without --cursor", "OVERVIEW_CURSOR_UNSUPPORTED");
+        const snapshot = await client.snapshot();
+        const machines = input.machineId ? snapshot.machines.filter((machine) => machine.id === input.machineId) : snapshot.machines;
+        const machineIds = new Set(machines.map((machine) => machine.id));
+        const allSessions = snapshot.sessions.filter((session) => machineIds.has(session.machineId));
+        const counts = {};
+        for (const session of allSessions)
+            counts[session.status] = (counts[session.status] ?? 0) + 1;
+        const sessions = input.includeSessions ? (input.all ? allSessions : allSessions.slice(0, input.limit)) : [];
+        return {
+            machines,
+            sessions,
+            counts,
+            page: {
+                returned: sessions.length,
+                total: allSessions.length,
+                hasMore: input.includeSessions && sessions.length < allSessions.length,
+                ...(input.includeSessions && !input.all ? { limit: input.limit } : {}),
+                source: "bootstrap-fallback",
+            },
+        };
+    }
+}
 export async function handleDaemon({ domain, action, flags }) {
     if (domain === "daemon" && action === "pair") {
         const relayUrl = requireRelayUrl(flags);
@@ -8,58 +206,57 @@ export async function handleDaemon({ domain, action, flags }) {
         const accountSecret = requireString(flags, "secret");
         const machineName = typeof flags.name === "string" && flags.name.trim() ? flags.name.trim() : os.hostname();
         const machineId = typeof flags["machine-id"] === "string" ? flags["machine-id"] : randomId("mach");
-        const response = await fetch(`${relayUrl}/api/pairing/claim`, {
-            method: "POST",
-            headers: { "content-type": "application/json" },
-            body: JSON.stringify({ code, machineId }),
+        let daemonConfig;
+        await withAccountConfigTransaction(async (transaction) => {
+            if (await transaction.daemonExists()) {
+                throw new CliError(`Daemon configuration already exists at ${transaction.daemonPath}. Pairing never replaces an existing machine identity; use an explicit account recovery or migration flow.`, "CONFIG_EXISTS");
+            }
+            const existingController = await transaction.readController();
+            if (existingController && (canonicalRelayUrl(existingController.relayUrl, "Controller config") !== canonicalRelayUrl(relayUrl) ||
+                !pairSecretsEqual(existingController.accountSecret, accountSecret))) {
+                throw new CliError("Daemon pairing does not match the existing controller relay/account. No relay request was sent and no configuration was changed.", "CONFIG_SPLIT_BRAIN");
+            }
+            let response;
+            try {
+                response = await fetch(`${relayUrl}/api/pairing/claim`, {
+                    method: "POST",
+                    headers: { "content-type": "application/json" },
+                    body: JSON.stringify({ code, machineId }),
+                    signal: AbortSignal.timeout(10_000),
+                });
+            }
+            catch (error) {
+                if (error.name === "TimeoutError" || error.name === "AbortError") {
+                    throw new CliError("Pairing claim timed out; daemon configuration was not changed.", "PAIRING_TIMEOUT");
+                }
+                throw cliErrorFromFetch(error, "RELAY_UNREACHABLE", `Could not reach relay while pairing ${relayUrl}`);
+            }
+            if (!response.ok) {
+                await throwRelayHttpError(response, "Pairing failed");
+            }
+            const claimed = parsePairingClaimResponse(await readRelayJson(response, "Pairing response is not valid JSON"));
+            daemonConfig = {
+                relayUrl,
+                accountId: claimed.accountId,
+                machineId: claimed.machineId,
+                machineName,
+                machineToken: claimed.machineToken,
+                accountSecret,
+            };
+            await transaction.writeDaemon(daemonConfig, "create");
         });
-        if (!response.ok) {
-            await throwRelayHttpError(response, "Pairing failed");
-        }
-        const claimed = parsePairingClaimResponse(await readRelayJson(response, "Pairing response is not valid JSON"));
-        const daemonConfig = {
-            relayUrl,
-            accountId: claimed.accountId,
-            machineId: claimed.machineId,
-            machineName,
-            machineToken: claimed.machineToken,
-            accountSecret,
-        };
-        const daemonConfigPath = await writeDaemonConfig(daemonConfig);
+        if (!daemonConfig)
+            throw new CliError("Pairing did not produce daemon configuration", "PAIRING_FAILED");
         ok("daemon.pair", {
-            path: daemonConfigPath,
+            path: path.join(configDir, "daemon.json"),
             config: redactedDaemonConfig(daemonConfig),
         });
         return true;
     }
     if (domain === "daemon" && action === "doctor") {
-        const checks = [];
-        let config;
-        try {
-            config = await readConfig(flags);
-            checks.push({ name: "config", ok: true, message: configPath });
-        }
-        catch (error) {
-            checks.push({ name: "config", ok: false, message: error instanceof Error ? error.message : String(error) });
-        }
-        if (config) {
-            try {
-                const response = await fetch(`${config.relayUrl}/health`);
-                checks.push({ name: "relay", ok: response.ok, message: response.ok ? "reachable" : await response.text() });
-            }
-            catch (error) {
-                checks.push({ name: "relay", ok: false, message: error instanceof Error ? error.message : String(error) });
-            }
-        }
-        const data = { ok: checks.every((check) => check.ok), checks };
-        if (!wantsJson(flags)) {
-            console.log(`Daemon doctor: ${data.ok ? "ok" : "issues found"}`);
-            for (const check of checks) {
-                console.log(`${check.ok ? "ok" : "fail"} ${check.name}: ${check.message}`);
-            }
-            return true;
-        }
-        ok("daemon.doctor", data);
+        const requestedRelay = typeof flags.relay === "string" ? requireRelayUrl(flags) : undefined;
+        const data = await diagnoseInstallation("daemon", requestedRelay);
+        emitDoctorResult("daemon.doctor", "Daemon doctor", data, flags);
         return true;
     }
     if (domain === "daemon" && action === "config") {
@@ -69,8 +266,8 @@ export async function handleDaemon({ domain, action, flags }) {
             console.log(`Config: ${path.join(configDir, "daemon.json")}`);
             console.log(`Relay: ${redacted.relayUrl}`);
             console.log(`Account: ${redacted.accountId}`);
-            console.log(`Machine: ${redacted.machineName} (${redacted.machineId})`);
-            console.log(`Machine token: ${redacted.hasMachineToken ? "configured" : "missing"}`);
+            console.log(`Daemon: ${redacted.machineName} (${redacted.machineId})`);
+            console.log(`Daemon credential: ${redacted.hasMachineToken ? "configured" : "missing"}`);
             console.log(`Account secret: ${redacted.hasAccountSecret ? "configured" : "missing"}`);
             return true;
         }
@@ -112,33 +309,78 @@ export async function handleDaemon({ domain, action, flags }) {
         return true;
     }
     if (domain === "daemon" && action === "start") {
-        const status = await localDaemonStatus();
-        if (status.running) {
-            ok("daemon.start", { ...status, started: false });
-            return true;
-        }
-        await readDaemonConfig();
-        const startArgs = typeof flags.relay === "string" ? ["--relay", flags.relay] : [];
-        const pid = spawnDaemonStart(startArgs);
-        ok("daemon.start", { pid, pidPath: daemonPidPath, started: true });
+        assertLocalDaemonVerified(await localDaemonStatus());
+        const config = await readDaemonConfig();
+        assertDaemonRelayOverrideMatches(flags, config);
+        const controllerConfig = await readOptionalControllerConfig();
+        if (controllerConfig)
+            assertControllerCanObserveDaemon(controllerConfig, config);
+        const client = controllerConfig ? new ControllerClient(controllerConfig) : undefined;
+        const baseline = client
+            ? await readDaemonProjectionBaseline(client, config.machineId, { timeoutMs: startDaemonTimeoutMs })
+            : undefined;
+        const daemon = await ensureDaemonRunning(config);
+        const readiness = await waitForLocalDaemonReadiness(client, config, baseline, daemon, daemon.started);
+        const data = {
+            ...readiness.local,
+            started: daemon.started,
+            machineId: readiness.machine?.id ?? config.machineId,
+            relayAuthenticated: readiness.relayAuthenticated,
+            ...(readiness.relayAuthenticated === "verified" ? { online: true } : {}),
+        };
+        if (wantsJson(flags))
+            ok("daemon.start", data);
+        else
+            writeHumanDaemonStartOutput(data);
         return true;
     }
     if (domain === "daemon" && action === "stop") {
         ok("daemon.stop", await stopLocalDaemon());
         return true;
     }
+    if (domain === "daemon" && action === "restart" && flags.machine === true) {
+        throw new CliError("Missing --machine value", "MISSING_ARGUMENT");
+    }
+    if (domain === "daemon" && action === "restart" && typeof flags.machine === "string") {
+        await remoteDaemonLifecycle(flags, "restart");
+        return true;
+    }
+    if (domain === "daemon" && action === "upgrade") {
+        await remoteDaemonLifecycle(flags, "upgrade");
+        return true;
+    }
     if (domain === "daemon" && action === "restart") {
-        await readDaemonConfig();
+        assertLocalDaemonVerified(await localDaemonStatus());
+        const config = await readDaemonConfig();
+        assertDaemonRelayOverrideMatches(flags, config);
+        const controllerConfig = await readOptionalControllerConfig();
+        if (controllerConfig)
+            assertControllerCanObserveDaemon(controllerConfig, config);
+        const client = controllerConfig ? new ControllerClient(controllerConfig) : undefined;
+        const baseline = client
+            ? await readDaemonProjectionBaseline(client, config.machineId, { timeoutMs: startDaemonTimeoutMs })
+            : undefined;
         const stop = await stopLocalDaemon();
-        const startArgs = typeof flags.relay === "string" ? ["--relay", flags.relay] : [];
-        const pid = spawnDaemonStart(startArgs);
-        ok("daemon.restart", { stop, startedPid: pid, pidPath: daemonPidPath });
+        if (stop.running || stop.alive) {
+            throw new CliError("Daemon did not stop before the restart deadline; no replacement process was started.", "DAEMON_STOP_FAILED");
+        }
+        const daemon = await ensureDaemonRunning(config);
+        const readiness = await waitForLocalDaemonReadiness(client, config, baseline, daemon, true);
+        ok("daemon.restart", {
+            stop,
+            startedPid: daemon.startedPid ?? readiness.local.pid,
+            pidPath: daemonPidPath,
+            local: readiness.local,
+            machineId: readiness.machine?.id ?? config.machineId,
+            relayAuthenticated: readiness.relayAuthenticated,
+            ...(readiness.relayAuthenticated === "verified" ? { online: true } : {}),
+        });
         return true;
     }
     if (domain === "daemon" && action === "status" && flags.local === true) {
         const local = await localDaemonStatus();
         if (!wantsJson(flags)) {
-            console.log(local.running ? `Daemon: running${local.pid ? ` pid ${local.pid}` : ""}` : "Daemon: stopped");
+            console.log(local.running ? `Daemon: running${local.pid ? ` pid ${local.pid}` : ""}` : local.state === "unverified" ? `Daemon: unverified live pid${local.pid ? ` ${local.pid}` : ""}` : "Daemon: stopped");
             console.log(`Pid file: ${local.pidPath}`);
             return true;
         }
@@ -150,17 +392,30 @@ export async function handleDaemon({ domain, action, flags }) {
         const client = new ControllerClient(config);
         const local = await localDaemonStatus();
         const response = await fetch(`${config.relayUrl}/health`);
-        const snapshot = await client.snapshot();
         const machineFilter = flags.machine === true ? requirePositional(undefined, "machineId") : typeof flags.machine === "string" ? flags.machine : undefined;
-        const machines = machineFilter
-            ? snapshot.machines.filter((machine) => machine.id === machineFilter)
-            : snapshot.machines;
+        const includeSessions = flags.verbose === true || flags.all === true;
+        const all = flags.all === true;
+        const cursor = typeof flags.cursor === "string" && flags.cursor.trim() ? flags.cursor.trim() : undefined;
+        if (all && flags.limit !== undefined)
+            throw new CliError("--all and --limit are mutually exclusive", "INVALID_ARGUMENT");
+        if (all && cursor)
+            throw new CliError("--all and --cursor are mutually exclusive", "INVALID_ARGUMENT");
+        if (cursor && !includeSessions)
+            throw new CliError("--cursor requires --verbose", "INVALID_ARGUMENT");
+        if (!all && flags.limit !== undefined && flags.verbose !== true) {
+            throw new CliError("--limit requires --verbose", "INVALID_ARGUMENT");
+        }
+        const limit = positiveLimit(flags, 20);
+        const overview = await daemonOverview(client, { machineId: machineFilter, includeSessions, all, limit, cursor });
+        const machines = overview.machines;
         if (machineFilter && machines.length === 0)
-            throw new CliError("Machine not found", "MACHINE_NOT_FOUND");
-        const machineIds = new Set(machines.map((machine) => machine.id));
-        const sessions = snapshot.sessions.filter((session) => machineIds.has(session.machineId));
-        const projectedMachines = await Promise.all(machines.map((machine) => showMachine(client, machine)));
-        const projectedSessions = await Promise.all(sessions.map(async (session) => ({
+            throw new CliError("Daemon not found", "MACHINE_NOT_FOUND");
+        const projectedMachines = includeSessions
+            ? await Promise.all((await client.snapshot()).machines
+                .filter((machine) => machines.some((summary) => summary.id === machine.id))
+                .map((machine) => showMachine(client, machine)))
+            : [];
+        const projectedSessions = includeSessions ? await boundedMap(overview.sessions, 4, async (session) => ({
             sessionId: session.id,
             machineId: session.machineId,
             agent: session.agent,
@@ -168,46 +423,66 @@ export async function handleDaemon({ domain, action, flags }) {
             orchestration: deriveOrchestration(session, await client.history(session.id, 20)),
             updatedAt: session.updatedAt,
             capabilities: session.capabilities,
-        })));
+        })) : [];
+        const sessionCount = overview.page.total;
+        const runningSessionCount = overview.counts.running ?? 0;
+        const idleSessionCount = idleSessionStatuses.reduce((sum, status) => sum + (overview.counts[status] ?? 0), 0);
         const data = {
             configPath,
             local,
             relayUrl: config.relayUrl,
             relayReachable: response.ok,
             relay: response.ok ? await response.json() : await response.text(),
-            machines: projectedMachines.map((machine) => ({
+            machines: includeSessions ? projectedMachines.map((machine) => ({
                 machineId: machine.id,
                 name: machine.metadata.name ?? machine.name,
                 online: machine.online,
                 lastSeen: machine.lastSeen,
-                defaultCwd: machine.defaultCwd,
                 daemonVersion: machine.capabilities.daemonVersion,
+                defaultCwd: machine.defaultCwd,
                 acpxVersion: machine.capabilities.acpxVersion,
                 sessionPrimitives: machine.capabilities.sessionPrimitives,
                 agents: machine.capabilities.agents,
                 metadata: machine.metadata,
+            })) : machines.map((machine) => ({
+                machineId: machine.id,
+                name: machine.name,
+                online: machine.online,
+                lastSeen: machine.lastSeen,
             })),
-            sessions: projectedSessions,
+            ...(includeSessions ? { sessions: projectedSessions, page: overview.page } : {}),
             summary: {
                 machineCount: machines.length,
                 onlineMachineCount: machines.filter((machine) => machine.online).length,
-                sessionCount: projectedSessions.length,
-                runningSessionCount: projectedSessions.filter((session) => session.status === "running").length,
-                idleSessionCount: projectedSessions.filter((session) => idleSessionStatuses.includes(session.status)).length,
-                blockedSessionCount: projectedSessions.filter((session) => session.orchestration.blocked).length,
-                activeSessionCount: projectedSessions.filter((session) => session.orchestration.state === "active").length,
-                completedSessionCount: projectedSessions.filter((session) => session.orchestration.completed).length,
-                needsUserSessionCount: projectedSessions.filter((session) => session.orchestration.needsUser).length,
+                sessionCount,
+                runningSessionCount,
+                idleSessionCount,
+                statusCounts: overview.counts,
+                ...(includeSessions ? {
+                    blockedSessionCount: projectedSessions.filter((session) => session.orchestration.blocked).length,
+                    activeSessionCount: projectedSessions.filter((session) => session.orchestration.state === "active").length,
+                    completedSessionCount: projectedSessions.filter((session) => session.orchestration.completed).length,
+                    needsUserSessionCount: projectedSessions.filter((session) => session.orchestration.needsUser).length,
+                } : {}),
             },
         };
         if (!wantsJson(flags)) {
-            console.log(`Relay: ${data.relayUrl} ${data.relayReachable ? "ok" : "unreachable"}`);
+            console.log(`Account: ${data.relayReachable ? "connected" : "unavailable"}`);
             console.log(data.local.running ? `Local daemon: running${data.local.pid ? ` pid ${data.local.pid}` : ""}` : "Local daemon: stopped");
-            console.log(`Machines: ${data.summary.onlineMachineCount}/${data.summary.machineCount} online`);
-            console.log(`Sessions: ${data.summary.sessionCount} total, ${data.summary.runningSessionCount} running, ${data.summary.needsUserSessionCount} needs user`);
+            console.log(`Daemons: ${data.summary.onlineMachineCount}/${data.summary.machineCount} online`);
+            console.log(`Sessions: ${data.summary.sessionCount} total, ${data.summary.runningSessionCount} running`);
             for (const machine of data.machines) {
                 console.log(`- ${machine.name} (${machine.machineId}) ${machine.online ? "online" : "offline"}`);
-                console.log(`  cwd: ${machine.defaultCwd ?? "-"}`);
+                if ("defaultCwd" in machine)
+                    console.log(`  cwd: ${machine.defaultCwd ?? "-"}`);
+            }
+            if (includeSessions) {
+                for (const session of projectedSessions) {
+                    console.log(`- ${session.sessionId}  ${session.status}  ${session.orchestration.state}  ${session.agent}  daemon:${session.machineId}`);
+                }
+                console.log(`Page: ${overview.page.returned} of ${overview.page.total} sessions${overview.page.hasMore ? "; more available" : "; complete"}`);
+                if (overview.page.nextCursor)
+                    console.log(`Next cursor: ${overview.page.nextCursor}`);
             }
             return true;
         }
@@ -216,4 +491,28 @@ export async function handleDaemon({ domain, action, flags }) {
     }
     return false;
 }
-//# sourceMappingURL=daemon.js.map
+function pairSecretsEqual(left, right) {
+    const leftDigest = createHash("sha256").update(left).digest();
+    const rightDigest = createHash("sha256").update(right).digest();
+    return timingSafeEqual(leftDigest, rightDigest);
+}
+function writeHumanDaemonStartOutput(data) {
+    if (data.started) {
+        console.log(`Daemon start requested${data.pid ? ` (pid ${data.pid})` : ""}.`);
+    }
+    else {
+        console.log(`Daemon is already running${data.pid ? ` (pid ${data.pid})` : ""}.`);
+    }
+    if (data.relayAuthenticated === "unverified") {
+        console.log("Local daemon identity is ready; relay authentication was not verified because this host has no matching Device credential.");
+    }
+    console.log("This command manages only the paired background daemon; it does not open a browser page.");
+    console.log("For setup or browser onboarding, run: happy-elves start");
+}
+function assertDaemonRelayOverrideMatches(flags, config) {
+    if (typeof flags.relay !== "string")
+        return;
+    if (canonicalRelayUrl(flags.relay) === canonicalRelayUrl(config.relayUrl))
+        return;
+    throw new CliError("daemon start/restart cannot change the enrolled Account. Use a one-time Re-enroll invite from the Account UI.", "CONFIG_SPLIT_BRAIN");
+}

package/apps/cli/dist/commands/gateway.d.ts

@@ -0,0 +1,2 @@
+import type { CommandInput } from "./command.js";
+export declare function handleGateway({ domain, action, positional, flags }: CommandInput): Promise<boolean>;