@cydm/happy-elves 0.1.0-beta.72 → 0.1.0-beta.73

package/apps/cli/dist/commands/daemon.js

@@ -329,6 +329,7 @@ export async function handleDaemon({ domain, action, flags }) {
             return {
                 ...readiness.local,
                 started: daemon.started,
+                ...(daemon.autostartNeedsAttention ? { needsAttention: daemon.autostartNeedsAttention } : {}),
                 machineId: readiness.machine?.id ?? config.machineId,
                 relayAuthenticated: readiness.relayAuthenticated,
                 ...(readiness.relayAuthenticated === "verified" ? { online: true } : {}),
@@ -518,6 +519,8 @@ function writeHumanDaemonStartOutput(data) {
     if (data.relayAuthenticated === "unverified") {
         console.log("Local daemon identity is ready; relay authentication was not verified because this host has no matching Device credential.");
     }
+    if (data.needsAttention)
+        console.log(`Automatic startup needs attention: ${data.needsAttention}`);
     console.log("This command manages only the paired background daemon; it does not open a browser page.");
     console.log("For setup or browser onboarding, run: happy-elves start");
 }

package/apps/cli/dist/commands/lib/account-snapshot.d.ts

@@ -6,7 +6,7 @@ type SnapshotMutationHooks = {
     afterTarget?(file: AccountSnapshotFile): Promise<void>;
 };
 export declare function recoverAccountSnapshotMutation(): Promise<void>;
-export declare function commitAccountSnapshotMutation(desired: AccountSnapshotContents, operation: "reset" | "restore", hooks?: SnapshotMutationHooks): Promise<{
+export declare function commitAccountSnapshotMutation(desired: AccountSnapshotContents, operation: "reset" | "restore" | "adopt-device", hooks?: SnapshotMutationHooks): Promise<{
     restored: string[];
     removed: string[];
 }>;

package/apps/cli/dist/commands/lib/account-snapshot.js

@@ -71,7 +71,7 @@ function parseSnapshotIntent(raw) {
         if (value.version !== 1
             || typeof value.operationId !== "string"
             || !/^[a-f0-9]{48}$/u.test(value.operationId)
-            || (value.operation !== "reset" && value.operation !== "restore")
+            || (value.operation !== "reset" && value.operation !== "restore" && value.operation !== "adopt-device")
             || (value.phase !== "apply" && value.phase !== "rollback")
             || value.bundle !== `${accountSnapshotBundlePrefix}${value.operationId}`
             || !Array.isArray(value.desired)
@@ -224,8 +224,23 @@ async function applySnapshot(intent, side, hooks) {
         desired: await readSnapshotSide(bundlePath, "desired", intent.desired),
         previous: await readSnapshotSide(bundlePath, "previous", intent.previous),
     };
+    if (intent.operation === "adopt-device") {
+        const expectedDaemon = snapshots.desired.get("daemon.json");
+        const previousDaemon = snapshots.previous.get("daemon.json");
+        const currentDaemon = await readRegularFile(daemonConfigPath, "Daemon configuration fence");
+        if (expectedDaemon === undefined
+            || previousDaemon === undefined
+            || currentDaemon === undefined
+            || expectedDaemon !== previousDaemon
+            || currentDaemon !== expectedDaemon) {
+            throw new CliError("The Daemon configuration changed during Device access recovery. The pending recovery was left unchanged.", "ACCOUNT_CONFIG_RECOVERY_REQUIRED");
+        }
+    }
     const entries = snapshots[side];
-    for (const file of snapshotFiles) {
+    const targetFiles = intent.operation === "adopt-device"
+        ? ["config.json", "account.json"]
+        : snapshotFiles;
+    for (const file of targetFiles) {
         await hooks?.beforeTarget?.(file);
         const contents = entries.get(file);
         if (contents !== undefined) {
@@ -291,6 +306,15 @@ export async function recoverAccountSnapshotMutation() {
 export async function commitAccountSnapshotMutation(desired, operation, hooks) {
     await recoverAccountSnapshotMutation();
     const previous = await snapshotCurrentFiles();
+    if (operation === "adopt-device") {
+        if (desired["config.json"] === undefined
+            || desired["account.json"] === undefined
+            || desired["daemon.json"] === undefined
+            || previous["daemon.json"] === undefined
+            || desired["daemon.json"] !== previous["daemon.json"]) {
+            throw new CliError("Device access recovery requires an unchanged Daemon configuration fence.", "ACCOUNT_CONFIG_RECOVERY_REQUIRED");
+        }
+    }
     const operationId = randomBytes(24).toString("hex");
     const bundle = `${accountSnapshotBundlePrefix}${operationId}`;
     const bundlePath = path.join(configDir, bundle);
@@ -326,12 +350,19 @@ export async function commitAccountSnapshotMutation(desired, operation, hooks) {
         }
         if (error instanceof CliError)
             throw error;
-        throw new CliError(`Account ${operation} failed; the previous configuration was restored: ${error instanceof Error ? error.message : String(error)}`, operation === "restore" ? "ACCOUNT_RESTORE_FAILED" : "ACCOUNT_RESET_FAILED");
+        throw new CliError(`Account ${operation} failed; the previous configuration was restored: ${error instanceof Error ? error.message : String(error)}`, operation === "restore"
+            ? "ACCOUNT_RESTORE_FAILED"
+            : operation === "adopt-device"
+                ? "DEVICE_ACCESS_REPAIR_FAILED"
+                : "ACCOUNT_RESET_FAILED");
     }
     const desiredFiles = new Set(desiredEntries.map((entry) => entry.file));
     const previousFiles = new Set(previousEntries.map((entry) => entry.file));
+    const reportedFiles = operation === "adopt-device"
+        ? ["config.json", "account.json"]
+        : snapshotFiles;
     return {
-        restored: snapshotFiles.filter((file) => desiredFiles.has(file)).map(targetPath),
-        removed: snapshotFiles.filter((file) => previousFiles.has(file) && !desiredFiles.has(file)).map(targetPath),
+        restored: reportedFiles.filter((file) => desiredFiles.has(file)).map(targetPath),
+        removed: reportedFiles.filter((file) => previousFiles.has(file) && !desiredFiles.has(file)).map(targetPath),
     };
 }

package/apps/cli/dist/commands/lib/bootstrap-config.d.ts

@@ -1,12 +1,13 @@
 import type { CliConfig, DaemonConfig } from "./types.js";
 import { type AccountConfigTransaction } from "./config.js";
+import type { FreshStartIntentV1 } from "./fresh-start-intent.js";
 export type StartConfigPreflight = {
     kind: "fresh" | "controller-only" | "device-recovery" | "ready";
     relayUrl: string;
     explicitRelay: boolean;
     controller?: CliConfig;
     daemon?: DaemonConfig;
-    recoveryReason?: "device-missing" | "device-account-mismatch" | "device-relay-mismatch";
+    recoveryReason?: "device-missing" | "device-account-mismatch" | "device-relay-mismatch" | "account-binding-mismatch";
 };
 /**
  * Read and classify both local identities before `start` performs any network
@@ -30,13 +31,14 @@ export declare function ensureControllerConfig(params: {
     transaction: AccountConfigTransaction;
     deferWrite?: boolean;
     signal?: AbortSignal;
+    freshIdentity?: FreshStartIntentV1;
 }): Promise<{
     config: CliConfig;
     created: boolean;
     accountId?: string;
     reconfigured: false;
 }>;
-export declare function ensureDaemonPaired(config: CliConfig, machineName: string, existing: DaemonConfig | undefined, transaction: AccountConfigTransaction, deferWrite?: boolean, signal?: AbortSignal, expectedAccountId?: string): Promise<{
+export declare function ensureDaemonPaired(config: CliConfig, machineName: string, existing: DaemonConfig | undefined, transaction: AccountConfigTransaction, deferWrite?: boolean, signal?: AbortSignal, expectedAccountId?: string, freshIdentity?: FreshStartIntentV1): Promise<{
     config: DaemonConfig;
     created: boolean;
     reconfigured: false;

package/apps/cli/dist/commands/lib/bootstrap-config.js

@@ -1,9 +1,9 @@
-import { ControllerClient } from "../../../../../packages/client/dist/index.js";
+import { claimMachinePairing, ControllerClient, ControllerClientError } from "../../../../../packages/client/dist/index.js";
 import { generateAccountSecret, randomId } from "../../../../../packages/shared/dist/index.js";
 import { CliError } from "../../errors.js";
 import { defaultHostedControllerUrl, defaultHostedRelayUrl } from "./paths.js";
 import { canonicalRelayUrl, redactedRelayUrl, requireRelayUrl, withAccountConfigTransaction, } from "./config.js";
-import { cliErrorFromFetch, parsePairingClaimResponse, parsePairingStartResponse, readRelayJson, throwRelayHttpError } from "./relay-http.js";
+import { cliErrorFromFetch, parsePairingStartResponse, readRelayJson, throwRelayHttpError } from "./relay-http.js";
 import { assertNoPendingEnrollmentAuthority } from "./pending-enrollment.js";
 /**
  * Read and classify both local identities before `start` performs any network
@@ -17,9 +17,6 @@ export async function readStartConfigPreflight(flags, transaction) {
         return await withAccountConfigTransaction(async (activeTransaction) => await readStartConfigPreflight(flags, activeTransaction));
     }
     const state = await transaction.readAccountState();
-    if (state.binding && state.daemon && !state.daemonMatchesBinding) {
-        throw new CliError("The local Daemon credential does not match account.json. No configuration or Daemon process was changed.", "CONFIG_SPLIT_BRAIN");
-    }
     if (state.binding && state.controller && !state.controllerMatchesBinding && !state.daemon) {
         throw new CliError("The local Device credential does not match account.json, and there is no matching Daemon to authorize recovery. No configuration was changed.", "CONFIG_SPLIT_BRAIN");
     }
@@ -27,7 +24,9 @@ export async function readStartConfigPreflight(flags, transaction) {
         controller: state.controller,
         daemon: state.daemon,
         explicitRelayUrl: typeof flags.relay === "string" ? requireRelayUrl(flags) : undefined,
-        forceDeviceRecovery: Boolean(state.binding && state.controller && !state.controllerMatchesBinding),
+        forceDeviceRecovery: Boolean(state.binding
+            && ((state.controller && !state.controllerMatchesBinding)
+                || (state.daemon && !state.daemonMatchesBinding))),
     });
     if (result.kind === "fresh" || result.kind === "controller-only") {
         await assertNoPendingEnrollmentAuthority();
@@ -62,9 +61,13 @@ export function classifyStartConfig(params) {
             explicitRelay: Boolean(explicitRelayUrl),
             controller,
             daemon,
-            recoveryReason: controllerRelayUrl === daemonRelayUrl
-                ? "device-account-mismatch"
-                : "device-relay-mismatch",
+            recoveryReason: params.forceDeviceRecovery === true
+                && controllerRelayUrl === daemonRelayUrl
+                && controller.accountSecret === daemon.accountSecret
+                ? "account-binding-mismatch"
+                : controllerRelayUrl === daemonRelayUrl
+                    ? "device-account-mismatch"
+                    : "device-relay-mismatch",
         };
     }
     return {
@@ -83,13 +86,21 @@ function splitBrainError(controller, daemon) {
         "No configuration or Daemon process was changed.", "CONFIG_SPLIT_BRAIN");
 }
 async function createControllerConfig(params, transaction, deferWrite = false) {
-    const accountSecret = generateAccountSecret();
+    const accountSecret = params.freshIdentity?.accountSecret ?? generateAccountSecret();
     let response;
     try {
         response = await fetch(`${params.relayUrl}/api/pairing/start`, {
             method: "POST",
             headers: { "content-type": "application/json" },
-            body: JSON.stringify({ deviceId: randomId("dev"), deviceName: params.deviceName, surface: "cli" }),
+            body: JSON.stringify({
+                deviceId: params.freshIdentity?.deviceId ?? randomId("dev"),
+                deviceName: params.deviceName,
+                surface: "cli",
+                ...(params.freshIdentity ? {
+                    requestId: params.freshIdentity.accountRequestId,
+                    recoveryKey: params.freshIdentity.accountRecoveryKey,
+                } : {}),
+            }),
             signal: params.signal,
         });
     }
@@ -117,35 +128,40 @@ export async function ensureControllerConfig(params) {
         }
         return { config: params.existing, created: false, reconfigured: false };
     }
-    const created = await createControllerConfig({ relayUrl: params.relayUrl, deviceName: params.deviceName, signal: params.signal }, params.transaction, params.deferWrite);
+    const created = await createControllerConfig({
+        relayUrl: params.relayUrl,
+        deviceName: params.deviceName,
+        signal: params.signal,
+        freshIdentity: params.freshIdentity,
+    }, params.transaction, params.deferWrite);
     return { config: created.config, created: true, accountId: created.accountId, reconfigured: false };
 }
-async function claimMachinePairing(params) {
-    let response;
+async function createDaemonConfig(config, machineName, transaction, deferWrite = false, signal, expectedAccountId, freshIdentity) {
+    const pairing = await new ControllerClient(config).createPairingCode({
+        signal,
+        ...(freshIdentity ? {
+            requestId: freshIdentity.pairingRequestId,
+            pairingCode: freshIdentity.pairingCode,
+        } : {}),
+    });
+    let claimed;
     try {
-        response = await fetch(`${params.relayUrl}/api/pairing/claim`, {
-            method: "POST",
-            headers: { "content-type": "application/json" },
-            body: JSON.stringify({ code: params.pairingCode, machineId: params.machineId }),
-            signal: params.signal,
+        claimed = await claimMachinePairing({ relayUrl: config.relayUrl }, {
+            code: pairing.pairingCode,
+            machineId: freshIdentity?.machineId ?? randomId("mach"),
+            machineName,
+            signal,
+            ...(freshIdentity ? {
+                requestId: freshIdentity.claimRequestId,
+                recoveryKey: freshIdentity.claimRecoveryKey,
+            } : {}),
         });
     }
     catch (error) {
-        throw cliErrorFromFetch(error, "RELAY_UNREACHABLE", `Could not reach ${redactedRelayUrl(params.relayUrl)}`);
-    }
-    if (!response.ok) {
-        await throwRelayHttpError(response, "Machine enrollment failed");
+        if (error instanceof ControllerClientError)
+            throw new CliError(error.message, error.code);
+        throw cliErrorFromFetch(error, "RELAY_UNREACHABLE", `Could not reach ${redactedRelayUrl(config.relayUrl)}`);
     }
-    return parsePairingClaimResponse(await readRelayJson(response, "Machine enrollment response is not valid JSON"));
-}
-async function createDaemonConfig(config, machineName, transaction, deferWrite = false, signal, expectedAccountId) {
-    const pairing = await new ControllerClient(config).createPairingCode({ signal });
-    const claimed = await claimMachinePairing({
-        relayUrl: config.relayUrl,
-        pairingCode: pairing.pairingCode,
-        machineId: randomId("mach"),
-        signal,
-    });
     if (pairing.accountId !== claimed.accountId ||
         (expectedAccountId !== undefined && pairing.accountId !== expectedAccountId)) {
         throw new CliError("The relay returned inconsistent account identities while pairing this machine. No configuration or daemon process was changed.", "PAIRING_ACCOUNT_MISMATCH");
@@ -163,7 +179,7 @@ async function createDaemonConfig(config, machineName, transaction, deferWrite =
     }
     return daemonConfig;
 }
-export async function ensureDaemonPaired(config, machineName, existing, transaction, deferWrite = false, signal, expectedAccountId) {
+export async function ensureDaemonPaired(config, machineName, existing, transaction, deferWrite = false, signal, expectedAccountId, freshIdentity) {
     if (existing) {
         if (canonicalRelayUrl(existing.relayUrl, "Daemon config") !== canonicalRelayUrl(config.relayUrl, "Controller config") ||
             existing.accountSecret !== config.accountSecret) {
@@ -172,7 +188,7 @@ export async function ensureDaemonPaired(config, machineName, existing, transact
         return { config: existing, created: false, reconfigured: false };
     }
     return {
-        config: await createDaemonConfig(config, machineName, transaction, deferWrite, signal, expectedAccountId),
+        config: await createDaemonConfig(config, machineName, transaction, deferWrite, signal, expectedAccountId, freshIdentity),
         created: true,
         reconfigured: false,
     };

package/apps/cli/dist/commands/lib/bootstrap-daemon.d.ts

@@ -10,6 +10,7 @@ export declare function ensureDaemonRunning(expectedConfig: DaemonConfig, cwd?:
     startedPid?: number;
     startedHandle?: SpawnedDaemonHandle;
     committedConfigMayBeInUse?: boolean;
+    autostartNeedsAttention?: string;
 }>;
 export type DaemonReadinessResult = {
     phase: "relay-authenticated" | "process-exited" | "owner-changed" | "relay-pending";

package/apps/cli/dist/commands/lib/bootstrap-daemon.js

@@ -3,7 +3,7 @@ import { daemonRuntimeConfigFingerprint } from "../../../../../packages/shared/d
 import { CliError } from "../../errors.js";
 import { startDaemonTimeoutMs } from "./paths.js";
 import { readDaemonConfig } from "./config.js";
-import { assertLocalDaemonRuntimeMatchesConfig, assertLocalDaemonVerified, inspectLocalDaemonRuntime, localDaemonStatus, readLocalDaemonPidIdentity, spawnDaemonStartTracked, stopSpawnedDaemon, } from "./local-daemon.js";
+import { assertLocalDaemonRuntimeMatchesConfig, assertLocalDaemonVerified, inspectLocalDaemonRuntime, ensureRunningDaemonAutostart, localDaemonStatus, readLocalDaemonPidIdentity, spawnDaemonStartTracked, stopSpawnedDaemon, } from "./local-daemon.js";
 const committedConfigMayBeInUseErrors = new WeakSet();
 export function startFailureMayUseCommittedConfig(error) {
     return Boolean(error && typeof error === "object" && committedConfigMayBeInUseErrors.has(error));
@@ -34,16 +34,26 @@ export async function ensureDaemonRunning(expectedConfig, cwd = process.cwd()) {
         const owner = await readLocalDaemonPidIdentity();
         if (!owner.record)
             throw new CliError("Verified daemon owner identity is missing.", "DAEMON_PID_INVALID");
+        const autostart = await ensureRunningDaemonAutostart();
+        const confirmedOwner = await readLocalDaemonPidIdentity();
+        if (!confirmedOwner.record ||
+            confirmedOwner.record.pid !== owner.record.pid ||
+            confirmedOwner.record.instanceNonce !== owner.record.instanceNonce) {
+            throw committedConfigInUseError("The verified daemon owner changed while automatic startup was being inspected. No replacement process was started.");
+        }
         return {
             local: current,
             instanceGeneration: owner.record.instanceNonce,
             started: false,
             committedConfigMayBeInUse: true,
+            ...(autostart.state === "needs-attention"
+                ? { autostartNeedsAttention: autostart.message }
+                : {}),
         };
     }
-    const handle = spawnDaemonStartTracked([], cwd);
-    const startedPid = handle.pid;
-    if (!startedPid)
+    const handle = await spawnDaemonStartTracked([], cwd, daemonRuntimeConfigFingerprint(expectedConfig));
+    let startedPid = handle.pid || undefined;
+    if (handle.kind === "child" && !startedPid)
         throw new CliError("Daemon failed to start.", "DAEMON_START_FAILED");
     try {
         const spawnResult = await handle.spawnResult;
@@ -66,17 +76,28 @@ export async function ensureDaemonRunning(expectedConfig, cwd = process.cwd()) {
             }
             if (local.running) {
                 const owner = await readLocalDaemonPidIdentity();
-                const ownOwner = owner.record?.pid === handle.pid &&
-                    owner.record.instanceNonce === handle.instanceNonce;
+                const ownOwner = owner.record?.instanceNonce === handle.instanceNonce &&
+                    (handle.kind === "service" || owner.record.pid === handle.pid);
+                if (ownOwner && owner.record && handle.kind === "service") {
+                    handle.pid = owner.record.pid;
+                    handle.observedOwner = {
+                        pid: owner.record.pid,
+                        instanceNonce: owner.record.instanceNonce,
+                        startedAt: owner.record.startedAt,
+                    };
+                    startedPid = owner.record.pid;
+                }
                 const runtime = await inspectLocalDaemonRuntime(expectedConfig);
                 if (!ownOwner) {
                     competingOwnerObserved = true;
                     if (runtime.state === "match") {
-                        try {
-                            await stopSpawnedDaemon(handle);
-                        }
-                        catch (cleanupError) {
-                            throw markCommittedConfigMayBeInUse(new CliError(`A matching daemon became owner, but this start attempt could not settle its own child: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`, "DAEMON_START_CLEANUP_FAILED"));
+                        if (handle.kind === "child") {
+                            try {
+                                await stopSpawnedDaemon(handle);
+                            }
+                            catch (cleanupError) {
+                                throw markCommittedConfigMayBeInUse(new CliError(`A matching daemon became owner, but this start attempt could not settle its own child: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`, "DAEMON_START_CLEANUP_FAILED"));
+                            }
                         }
                         const confirmedLocal = await localDaemonStatus();
                         try {
@@ -137,7 +158,7 @@ export async function ensureDaemonRunning(expectedConfig, cwd = process.cwd()) {
                 // A missing or stale marker is a bounded startup window. The daemon
                 // publishes its owner-bound marker atomically immediately after PID v2.
             }
-            if (!competingOwnerPending &&
+            if (handle.kind === "child" && !competingOwnerPending &&
                 (handle.child.exitCode !== null || handle.child.signalCode !== null)) {
                 throw new CliError("Daemon exited during startup.", "DAEMON_START_FAILED");
             }

package/apps/cli/dist/commands/lib/bootstrap-device-recovery.d.ts

@@ -1,13 +1,33 @@
 import { ControllerClient } from "../../../../../packages/client/dist/index.js";
 import { type DeviceRecoveryIntentV1 } from "../../../../../packages/shared/dist/index.js";
+import { stopSpawnedDaemon } from "./local-daemon.js";
 import { type StartConfigPreflight } from "./bootstrap-config.js";
+import { ensureDaemonRunning } from "./bootstrap-daemon.js";
 export declare function startDeviceRecoveryBootstrap(params: {
     flags: Record<string, string | boolean>;
     preflight: StartConfigPreflight;
     cwd: string;
     deviceName: string;
+    controllerCredentialKnownInvalid?: boolean;
 }): Promise<void>;
 export declare function deviceRecoveryIntentNeedsReplacement(intent: Pick<DeviceRecoveryIntentV1, "status">): boolean;
+export declare function isTerminalRecoveryIntentCreationFailure(error: unknown): boolean;
+export declare function projectRecoveredDaemonReadinessFailure(started: Awaited<ReturnType<typeof ensureDaemonRunning>>, machineName: string, readinessError: unknown, options?: {
+    stopStarted?: typeof stopSpawnedDaemon;
+}): Promise<{
+    online: false;
+    pid?: number;
+    started: boolean;
+    name: string;
+    needsAttention: string;
+}>;
+/**
+ * Daemon credential rotation and Device recovery both change Account
+ * authority. Call this while holding the Account config transaction so a
+ * target Re-enroll cannot invalidate the machine generation needed to settle
+ * an exact pending Device recovery.
+ */
+export declare function assertNoPendingDeviceRecoveryForDaemonEnrollment(): Promise<void>;
 /**
  * A previous recovery may have reached Relay after its CLI process lost the
  * response. Never discard the fragment secret solely because ordinary start