@gajae-code/coding-agent 0.11.6 → 0.11.7

package/src/runtime-mcp/content-limits.ts

@@ -0,0 +1,71 @@
+export const MCP_MAX_CONTENT_BYTES = 16 * 1024 * 1024;
+export const MCP_MAX_ERROR_BYTES = 16 * 1024;
+export const MCP_MAX_SSE_REQUEST_MESSAGES = 1024;
+export const MCP_MAX_SSE_BATCH_MESSAGES = 1024;
+export const MCP_HTTP_TIMEOUT_MS = 30_000;
+
+function ignoreCancellation(cancel: () => Promise<unknown>): void {
+	try {
+		void cancel().catch(() => {});
+	} catch {}
+}
+
+export function cancelMCPStream(stream: ReadableStream<Uint8Array> | null): void {
+	if (stream) ignoreCancellation(() => stream.cancel());
+}
+
+type ByteReader = Pick<ReadableStreamDefaultReader<Uint8Array>, "read">;
+
+async function readChunk(reader: ByteReader, signal?: AbortSignal) {
+	if (!signal) return reader.read();
+	signal.throwIfAborted();
+	const aborted = Promise.withResolvers<never>();
+	const onAbort = () => aborted.reject(signal.reason);
+	signal.addEventListener("abort", onAbort, { once: true });
+	try {
+		return await Promise.race([reader.read(), aborted.promise]);
+	} finally {
+		signal.removeEventListener("abort", onAbort);
+	}
+}
+
+export async function readMCPResponseText(response: Response, limit: number, truncate = false, signal?: AbortSignal) {
+	const declared = response.headers.get("Content-Length");
+	if (!truncate && declared && /^\d+$/.test(declared) && Number(declared) > limit) {
+		cancelMCPStream(response.body);
+		throw new Error("MCP response exceeds size limit");
+	}
+	if (!response.body) return "";
+	const reader = response.body.getReader();
+	let buffer = new Uint8Array(Math.min(limit, 64 * 1024));
+	let total = 0;
+	try {
+		while (true) {
+			const { value, done } = await readChunk(reader, signal);
+			if (done) break;
+			if (value.length === 0) continue;
+			const remaining = limit - total;
+			if (value.length > remaining) {
+				if (truncate && remaining > 0) buffer.set(value.subarray(0, remaining), total);
+				ignoreCancellation(() => reader.cancel());
+				if (!truncate) throw new Error("MCP response exceeds size limit");
+				return `${new TextDecoder().decode(buffer)}\u2026`;
+			}
+			if (total + value.length > buffer.length) {
+				const grown = new Uint8Array(Math.min(limit, Math.max(total + value.length, buffer.length * 2)));
+				grown.set(buffer);
+				buffer = grown;
+			}
+			buffer.set(value, total);
+			total += value.length;
+		}
+		return new TextDecoder().decode(buffer.subarray(0, total));
+	} catch (error) {
+		ignoreCancellation(() => reader.cancel());
+		throw error;
+	} finally {
+		try {
+			reader.releaseLock();
+		} catch {}
+	}
+}

package/src/runtime-mcp/json-rpc.ts

@@ -4,6 +4,8 @@
  * Lightweight utilities for calling MCP servers directly via HTTP
  * without maintaining persistent connections.
  */
+// biome-ignore assist/source/organizeImports: Keep independent MCP security imports on separate merge anchors.
+import { cancelMCPStream, MCP_HTTP_TIMEOUT_MS, MCP_MAX_CONTENT_BYTES, readMCPResponseText } from "./content-limits";
 import { logger } from "@gajae-code/utils";
 
 /** Parse SSE response format (lines starting with "data: ") */
@@ -25,6 +27,15 @@ export function parseSSE(text: string): unknown {
 	}
 }
 
+async function translateMCPTimeout<T>(operation: Promise<T>, signal: AbortSignal): Promise<T> {
+	try {
+		return await operation;
+	} catch (error) {
+		if (signal.aborted && error === signal.reason) throw new Error("MCP request timed out");
+		throw error;
+	}
+}
+
 /** JSON-RPC 2.0 response structure */
 export interface JsonRpcResponse<T = unknown> {
 	jsonrpc: "2.0";
@@ -57,22 +68,25 @@ export async function callMCP<T = unknown>(
 		params: params ?? {},
 	};
 
-	const response = await fetch(url, {
-		method: "POST",
-		headers: {
-			"Content-Type": "application/json",
-			Accept: "application/json, text/event-stream",
-		},
-		body: JSON.stringify(body),
-	});
+	const signal = AbortSignal.timeout(MCP_HTTP_TIMEOUT_MS);
+	const response = await translateMCPTimeout(
+		fetch(url, {
+			method: "POST",
+			headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream" },
+			body: JSON.stringify(body),
+			signal,
+		}),
+		signal,
+	);
 
 	if (!response.ok) {
+		cancelMCPStream(response.body);
 		const errorMsg = `MCP request failed: ${response.status} ${response.statusText}`;
 		logger.error(errorMsg, { url, method, params });
 		throw new Error(errorMsg);
 	}
 
-	const text = await response.text();
+	const text = await translateMCPTimeout(readMCPResponseText(response, MCP_MAX_CONTENT_BYTES, false, signal), signal);
 	const result = parseSSE(text) as JsonRpcResponse<T> | null;
 
 	if (!result) {

package/src/runtime-mcp/transports/http.ts

@@ -16,6 +16,14 @@ import type {
 	MCPTransport,
 } from "../../runtime-mcp/types";
 import { MCPExpectedFailure, toJsonRpcError } from "../../runtime-mcp/types";
+import {
+	cancelMCPStream,
+	MCP_MAX_CONTENT_BYTES,
+	MCP_MAX_ERROR_BYTES,
+	MCP_MAX_SSE_BATCH_MESSAGES,
+	MCP_MAX_SSE_REQUEST_MESSAGES,
+	readMCPResponseText,
+} from "../content-limits";
 
 /**
  * HTTP transport for MCP servers.
@@ -73,6 +81,9 @@ export class HttpTransport implements MCPTransport {
 		if (this.#sseConnection) return;
 
 		const sseConnection = new AbortController();
+		const headerController = new AbortController();
+		const headerTimeout = this.config.timeout ?? 30000;
+		const headerTimeoutId = setTimeout(() => headerController.abort(), headerTimeout);
 		this.#sseConnection = sseConnection;
 		const headers: Record<string, string> = {
 			Accept: "text/event-stream",
@@ -88,18 +99,22 @@ export class HttpTransport implements MCPTransport {
 			response = await fetch(this.config.url, {
 				method: "GET",
 				headers,
-				signal: sseConnection.signal,
+				signal: AbortSignal.any([sseConnection.signal, headerController.signal]),
 			});
 		} catch (error) {
 			this.#sseConnection = this.#sseConnection === sseConnection ? null : this.#sseConnection;
-			if (error instanceof Error && error.name !== "AbortError") {
+			if (headerController.signal.aborted && !sseConnection.signal.aborted) {
+				this.onError?.(new Error(`SSE connection timeout after ${headerTimeout}ms`));
+			} else if (error instanceof Error && error.name !== "AbortError") {
 				this.onError?.(error);
 			}
 			return;
+		} finally {
+			clearTimeout(headerTimeoutId);
 		}
 
 		if (response.status === 405 || !response.ok || !response.body) {
-			await response.body?.cancel().catch(() => {});
+			cancelMCPStream(response.body);
 			this.#sseConnection = this.#sseConnection === sseConnection ? null : this.#sseConnection;
 			return;
 		}
@@ -117,8 +132,13 @@ export class HttpTransport implements MCPTransport {
 	}
 	async #readSSEStream(body: ReadableStream<Uint8Array>, signal: AbortSignal): Promise<void> {
 		try {
-			for await (const message of readSseJson<JsonRpcMessage>(body, signal)) {
+			for await (const message of readSseJson<JsonRpcMessage>(body, signal, undefined, {
+				maxEventBytes: MCP_MAX_CONTENT_BYTES,
+			})) {
 				if (!this.#connected) break;
+				if (Array.isArray(message) && message.length > MCP_MAX_SSE_BATCH_MESSAGES) {
+					throw new Error("MCP SSE batch exceeds message limit");
+				}
 				this.#dispatchSSEMessage(message);
 			}
 		} catch (error) {
@@ -221,7 +241,7 @@ export class HttpTransport implements MCPTransport {
 			}
 
 			if (!response.ok) {
-				const text = await response.text();
+				const text = await readMCPResponseText(response, MCP_MAX_ERROR_BYTES, true, operationSignal);
 				const wwwAuthenticate = response.headers.get("WWW-Authenticate");
 				const mcpAuthServer = response.headers.get("Mcp-Auth-Server");
 				const authHints = [
@@ -245,7 +265,9 @@ export class HttpTransport implements MCPTransport {
 			if (!response.body) {
 				throw new MCPExpectedFailure();
 			}
-			const parsedResult = await response.json();
+			const parsedResult = JSON.parse(
+				await readMCPResponseText(response, MCP_MAX_CONTENT_BYTES, false, operationSignal),
+			) as unknown;
 
 			if (
 				typeof parsedResult !== "object" ||
@@ -293,6 +315,7 @@ export class HttpTransport implements MCPTransport {
 
 		const { promise, resolve, reject } = Promise.withResolvers<T>();
 		let captured = false;
+		let messageCount = 0;
 
 		// Drain this per-request SSE response from a single iterator. Once the
 		// matching response arrives, resolve/reject and abort the reader so the
@@ -304,8 +327,20 @@ export class HttpTransport implements MCPTransport {
 		this.#streamControllers.add(drainController);
 		const drain = async (): Promise<void> => {
 			try {
-				for await (const raw of readSseJson<JsonRpcMessage | JsonRpcMessage[]>(response.body!, operationSignal)) {
+				for await (const raw of readSseJson<JsonRpcMessage | JsonRpcMessage[]>(
+					response.body!,
+					operationSignal,
+					undefined,
+					{
+						maxEventBytes: MCP_MAX_CONTENT_BYTES,
+						maxTotalBytes: MCP_MAX_CONTENT_BYTES,
+					},
+				)) {
 					const messages = Array.isArray(raw) ? raw : [raw];
+					if (messages.length > MCP_MAX_SSE_BATCH_MESSAGES) throw new Error("MCP SSE batch exceeds message limit");
+					messageCount += messages.length;
+					if (messageCount > MCP_MAX_SSE_REQUEST_MESSAGES)
+						throw new Error("MCP SSE response exceeds message limit");
 					for (const message of messages) {
 						if (
 							!captured &&
@@ -352,7 +387,7 @@ export class HttpTransport implements MCPTransport {
 			} finally {
 				clearTimeout(timeoutId);
 				this.#streamControllers.delete(drainController);
-				await response.body?.cancel().catch(() => {});
+				cancelMCPStream(response.body);
 			}
 		};
 
@@ -396,7 +431,7 @@ export class HttpTransport implements MCPTransport {
 			});
 			// Retry once on auth failure if onAuthError is wired
 			if (this.onAuthError && (resp.status === 401 || resp.status === 403)) {
-				await resp.body?.cancel();
+				cancelMCPStream(resp.body);
 				const newHeaders = await this.onAuthError();
 				if (newHeaders) {
 					this.config.headers ??= {};
@@ -408,11 +443,11 @@ export class HttpTransport implements MCPTransport {
 						body: JSON.stringify(body),
 						signal: AbortSignal.timeout(this.config.timeout ?? 30000),
 					});
-					await retry.body?.cancel();
+					cancelMCPStream(retry.body);
 					return;
 				}
 			}
-			await resp.body?.cancel();
+			cancelMCPStream(resp.body);
 		} catch {
 			// Best-effort response delivery — server may have disconnected
 		}
@@ -452,11 +487,9 @@ export class HttpTransport implements MCPTransport {
 				signal: abortController.signal,
 			});
 
-			clearTimeout(timeoutId);
-
 			// 202 Accepted is success for notifications
 			if (!response.ok && response.status !== 202) {
-				const text = await response.text();
+				const text = await readMCPResponseText(response, MCP_MAX_ERROR_BYTES, true, abortController.signal);
 				throw new Error(`HTTP ${response.status}: ${text}`);
 			}
 
@@ -472,14 +505,15 @@ export class HttpTransport implements MCPTransport {
 				const reader = this.#readSSEStream(response.body, AbortSignal.any(signals));
 				this.#trackReader(reader, streamController);
 			} else {
-				await response.body?.cancel();
+				cancelMCPStream(response.body);
 			}
 		} catch (error) {
-			clearTimeout(timeoutId);
 			if (error instanceof Error && error.name === "AbortError") {
 				throw new MCPExpectedFailure(new Error(`Notify timeout after ${timeout}ms`));
 			}
 			throw error instanceof MCPExpectedFailure ? error : new MCPExpectedFailure(error);
+		} finally {
+			clearTimeout(timeoutId);
 		}
 	}
 

package/src/sdk/bus/chat-daemon-control.ts

@@ -27,11 +27,12 @@ export type ChatDaemonAction = "stop" | "reload";
  * Generation 6 carries the retained managed filesystem authority boundary.
  * Generation 7 restores macOS daemon signaling (kill(2) with a start-time
  * incarnation recheck) so a live/hung owner can be replaced without an external
- * `kill -9`.
+ * `kill -9`. Generation 8 adopts Windows expected-identity ACL verification and
+ * repair for shared native authority.
  */
 export const CHAT_DAEMON_GENERATIONS: Readonly<Record<ChatDaemonKind, number>> = {
-	discord: 7,
-	slack: 7,
+	discord: 8,
+	slack: 8,
 };
 
 export function chatDaemonGeneration(kind: ChatDaemonKind): number {

package/src/sdk/bus/index.ts

@@ -30,7 +30,7 @@ import { promisify } from "node:util";
 import { ThinkingLevel } from "@gajae-code/agent-core";
 import type { ImageContent, TextContent, Tool } from "@gajae-code/ai";
 import { NotificationServer, nativeBuildInfo } from "@gajae-code/natives";
-import { logger, postmortem, prompt, VERSION } from "@gajae-code/utils";
+import { logger, postmortem, VERSION } from "@gajae-code/utils";
 import { Settings } from "../../config/settings";
 import type { ExtensionAPI, ExtensionCommandContext, ExtensionContext } from "../../extensibility/extensions";
 import { toAgentWireEventPayload } from "../../modes/shared/agent-wire/event-envelope";
@@ -40,7 +40,6 @@ import {
 	type WorkflowGateTerminalController,
 	type WorkflowGateTerminalProof,
 } from "../../modes/shared/agent-wire/workflow-gate-broker";
-import btwUserPrompt from "../../prompts/system/btw-user.md" with { type: "text" };
 import type { AgentSessionEvent } from "../../session/agent-session";
 import { parseThinkingLevel } from "../../thinking";
 import type {
@@ -2778,7 +2777,7 @@ export function createNotificationsExtension(
 		sdkHostModeSupported?: boolean;
 
 		onSdkRequest?: (kind: "control" | "query", connectionId: string, frame: Record<string, unknown>) => void;
-		runEphemeralTurn?: (promptText: string, signal: AbortSignal) => Promise<{ replyText: string }>;
+		runBtwTurn?: (question: string, signal: AbortSignal) => Promise<{ replyText: string }>;
 		/** Observes settlement of optional session-branch startup after reconciliation completes. */
 		onBranchStartupSettled?: (receipt: { sessionId: string; status: SessionStartResult["status"] }) => void;
 		readNotificationFile?: (path: string) => Promise<Buffer>;
@@ -3587,10 +3586,10 @@ export function createNotificationsExtension(
 		};
 
 		const ephemeralTurns = new EphemeralTurnHost(sendSdkFrame, async (question, signal) => {
-			if (!options.runEphemeralTurn) throw new Error("Ephemeral turns are unavailable.");
+			if (!options.runBtwTurn) throw new Error("Ephemeral turns are unavailable.");
 			const generation = initializedRuntime.policyGeneration;
 			if (initializedRuntime.policySuspended) throw new Error("Notification policy is provisional.");
-			const result = await options.runEphemeralTurn(prompt.render(btwUserPrompt, { question }), signal);
+			const result = await options.runBtwTurn(question, signal);
 			if (
 				initializedRuntime.policySuspended ||
 				initializedRuntime.policyGeneration !== generation ||

package/src/sdk/bus/lifecycle-commands.ts

@@ -238,11 +238,12 @@ function isSafeBranch(value: string): boolean {
 /**
  * Map a lifecycle response/error to a user-facing Telegram message (G010).
  *
- * Only derives text from sessionId, mode, reason, a safe message, and candidate
- * {sessionId,path} — never a token or prompt. Each error reason gets tailored,
- * actionable copy; an "in progress" pending response is surfaced distinctly.
+ * Only derives text from sessionId, mode, reason, a safe message, the originating
+ * lifecycle verb, and candidate {sessionId,path} — never a token or prompt. Each
+ * error reason gets tailored, actionable copy; an "in progress" pending response
+ * is surfaced distinctly.
  */
-export function formatLifecycleOutcome(r: SessionLifecycleResponse): string {
+export function formatLifecycleOutcome(r: SessionLifecycleResponse, verb?: LifecycleCommandVerb): string {
 	switch (r.type) {
 		case "session_create_response":
 			return `\u{1f680} Launching session ${r.sessionId} in tmux. It will appear once ready \u2014 check /session_recent.`;
@@ -282,9 +283,17 @@ export function formatLifecycleOutcome(r: SessionLifecycleResponse): string {
 		case "unsupported_platform":
 			return "Remote session lifecycle is unavailable on this psmux host because GJC cannot prove immutable session identity. No lifecycle action was performed. Use a local GJC terminal with a supported tmux provider.";
 		case "terminal_uncertain":
-			return /in progress/i.test(r.message)
-				? "\u23f3 That request is already in progress \u2014 hold on."
-				: "\u26a0\ufe0f Outcome uncertain. Check /session_recent before retrying so you don't double-spawn.";
+			if (/in progress/i.test(r.message)) return "\u23f3 That request is already in progress \u2014 hold on.";
+			switch (verb) {
+				case "session_create":
+					return "\u26a0\ufe0f Create outcome uncertain. The session may already be starting \u2014 check /session_recent before retrying to avoid starting it twice.";
+				case "session_close":
+					return "\u26a0\ufe0f Close outcome uncertain. The session may already be closed \u2014 check /session_recent before retrying.";
+				case "session_resume":
+					return "\u26a0\ufe0f Resume outcome uncertain. The session may already be reattached or restarting \u2014 check /session_recent before retrying.";
+				default:
+					return "\u26a0\ufe0f Outcome uncertain. Check /session_recent before retrying.";
+			}
 		default:
 			return `\u26a0\ufe0f ${r.reason}: ${r.message}`;
 	}

package/src/sdk/bus/notification-service.ts

@@ -251,19 +251,29 @@ export function formatNotificationStatusReport(report: NotificationStatusReport)
 
 // --- endpoint / daemon file readers -------------------------------------
 
-interface EndpointView {
+export interface NotificationEndpointView {
 	sessionId: string;
 	pid: number | undefined;
 	stale: boolean;
 }
 
-type EndpointFileRead =
-	| { kind: "endpoint"; view: EndpointView; identity: NotificationEndpointFileIdentity }
+export type NotificationEndpointLiveness = "live" | "dead" | "unknown";
+
+/**
+ * Classification used by recovery and startup takeover. A file is an endpoint
+ * only when it has endpoint authority fields; lifecycle/audit records are never
+ * candidates for endpoint cleanup.
+ */
+export type NotificationEndpointClassification =
+	| {
+			kind: "endpoint";
+			view: NotificationEndpointView;
+			liveness: NotificationEndpointLiveness;
+			identity: NotificationEndpointFileIdentity;
+	  }
 	| { kind: "non-endpoint" }
 	| { kind: "unreadable" };
 
-type EndpointLiveness = "live" | "dead" | "unknown";
-
 /**
  * Classify an endpoint using owner-proof semantics. An endpoint is only `dead`
  * with positive proof: an explicit `stale` tombstone, or a recorded pid that is
@@ -271,7 +281,10 @@ type EndpointLiveness = "live" | "dead" | "unknown";
  * must never be treated as dead — removing it could delete a live session's
  * discovery file that simply omitted a pid.
  */
-function endpointLiveness(view: EndpointView, pidAlive: (pid: number) => boolean): EndpointLiveness {
+export function notificationEndpointLiveness(
+	view: NotificationEndpointView,
+	pidAlive: (pid: number) => boolean,
+): NotificationEndpointLiveness {
 	if (view.stale) return "dead";
 	if (view.pid === undefined) return "unknown";
 	return pidAlive(view.pid) ? "live" : "dead";
@@ -314,11 +327,19 @@ function isCanonicalLifecycleArtifactName(name: string): boolean {
 	);
 }
 
-function unreadableEndpointResult(file: string): EndpointFileRead {
+function unreadableEndpointResult(file: string): NotificationEndpointClassification {
 	return isCanonicalLifecycleArtifactName(path.basename(file)) ? { kind: "non-endpoint" } : { kind: "unreadable" };
 }
 
-async function readEndpointView(fs: NotificationServiceFs, file: string): Promise<EndpointFileRead> {
+/**
+ * Read and classify one endpoint candidate. The returned identity belongs to
+ * exactly the bytes inspected and is required for any later deletion.
+ */
+export async function classifyNotificationEndpoint(
+	fs: Pick<NotificationServiceFs, "readEndpointFile">,
+	file: string,
+	pidAlive: (pid: number) => boolean,
+): Promise<NotificationEndpointClassification> {
 	let endpoint: NotificationEndpointFile;
 	let raw: string;
 	try {
@@ -334,16 +355,19 @@ async function readEndpointView(fs: NotificationServiceFs, file: string): Promis
 		return unreadableEndpointResult(file);
 	}
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return { kind: "non-endpoint" };
+	if (path.basename(file) === "broker.json") return { kind: "non-endpoint" };
 	const rec = parsed as Record<string, unknown>;
 	if (isLifecycleArtifact(rec) || typeof rec.url !== "string" || typeof rec.token !== "string")
 		return { kind: "non-endpoint" };
+	const view: NotificationEndpointView = {
+		sessionId: typeof rec.sessionId === "string" ? rec.sessionId : path.basename(file, ".json"),
+		pid: safePositiveInteger(rec.pid),
+		stale: rec.stale === true,
+	};
 	return {
 		kind: "endpoint",
-		view: {
-			sessionId: typeof rec.sessionId === "string" ? rec.sessionId : path.basename(file, ".json"),
-			pid: safePositiveInteger(rec.pid),
-			stale: rec.stale === true,
-		},
+		view,
+		liveness: notificationEndpointLiveness(view, pidAlive),
 		identity: endpoint.identity,
 	};
 }
@@ -604,14 +628,13 @@ export async function checkNotificationHealth(opts: HealthOptions): Promise<Noti
 	let unknownEndpoints = 0;
 	let unreadable = 0;
 	for (const name of files) {
-		const record = await readEndpointView(fs, path.join(dir, name));
+		const record = await classifyNotificationEndpoint(fs, path.join(dir, name), pidAlive);
 		if (record.kind === "non-endpoint") continue;
 		if (record.kind === "unreadable") {
 			unreadable += 1;
 			continue;
 		}
-		const view = record.view;
-		switch (endpointLiveness(view, pidAlive)) {
+		switch (record.liveness) {
 			case "live":
 				live += 1;
 				break;
@@ -1040,7 +1063,7 @@ export async function recoverNotifications(opts: RecoveryOptions): Promise<Notif
 	let unreadable = 0;
 	for (const name of files) {
 		const file = path.join(dir, name);
-		const record = await readEndpointView(fs, file);
+		const record = await classifyNotificationEndpoint(fs, file, pidAlive);
 		if (record.kind === "non-endpoint") continue;
 		if (record.kind === "unreadable") {
 			// Leave unparseable files untouched: they may be mid-write by a live server.
@@ -1048,7 +1071,7 @@ export async function recoverNotifications(opts: RecoveryOptions): Promise<Notif
 			continue;
 		}
 		const view = record.view;
-		if (endpointLiveness(view, pidAlive) !== "dead") {
+		if (record.liveness !== "dead") {
 			// Keep live AND unknown (PID-less) endpoints: only positive proof of
 			// death (a stale tombstone or a dead pid) authorizes removal.
 			kept += 1;

package/src/sdk/bus/telegram-daemon-contract.ts

@@ -21,7 +21,12 @@ export const NOTIFICATION_PROTOCOL_VERSION = 3;
  * confirmed-dead owner's lock in generation 10, legacy stopped-tombstone
  * reclamation in generation 11, force-escalated SIGKILL of an unresponsive
  * older-generation owner during automatic generation-upgrade reload in
- * generation 12, and restored macOS daemon signaling (kill(2) with a start-time
- * incarnation recheck, replacing the darwin no-op) in generation 13.
+ * generation 12, restored macOS daemon signaling (kill(2) with a start-time
+ * incarnation recheck, replacing the darwin no-op) in generation 13, retained
+ * legacy stopped-lock reclamation in generation 14, Windows expected-identity
+ * ACL verification and repair in generation 15, identity-fenced stale endpoint
+ * startup recovery in generation 16, Telegram topic recovery authority fencing
+ * in generation 17, and fail-closed blank-token validation plus lifecycle-startup
+ * stop fencing in generation 18.
  */
-export const DAEMON_GENERATION = 13;
+export const DAEMON_GENERATION = 18;

package/src/sdk/bus/telegram-daemon-control.ts

@@ -178,8 +178,8 @@ function defaultPidAlive(pid: number): boolean {
 	try {
 		process.kill(pid, 0);
 		return true;
-	} catch {
-		return false;
+	} catch (error) {
+		return (error as NodeJS.ErrnoException).code !== "ESRCH";
 	}
 }