@hivefloor/cli 0.1.5 → 0.1.8

package/dist/{run-ZAZ45MKQ.js → run-JL2OZWK3.js}

@@ -1,57 +1,116 @@
 #!/usr/bin/env node
+import { createRequire as __hfCreateRequire } from 'node:module';
+const require = __hfCreateRequire(import.meta.url);
 import {
+  FLEET_ENV_KEY,
+  FLEET_ENV_SOCKET,
+  FLEET_SERVER_NAME,
+  FleetServer,
+  PERMIT_ENV_KEY,
+  PERMIT_ENV_SOCKET,
+  PERMIT_TOOL,
+  PermitServer,
+  fleetAllowedTools,
+  newFleetKey,
+  newPermitKey
+} from "./chunk-AGIYVFDQ.js";
+import {
+  claudeDecision,
+  claudeMessage,
+  findPane,
+  markSessionsEnded,
   nudgesOf,
+  readSessions,
+  realProc,
   releaseSpool,
+  sameProcess,
   stashNudges,
+  stopSession,
+  sweepInbox,
   takeSpool
-} from "./chunk-X6B6R32A.js";
+} from "./chunk-5OJUJCE3.js";
+import {
+  ensurePrivateDir
+} from "./chunk-SBOEAOHD.js";
 import {
   buildProfiles,
   cliVersionOs,
   makeEnvReader,
   scanProcesses
-} from "./chunk-MZGGJ6ZS.js";
+} from "./chunk-MYJCU5JL.js";
 import {
   VERSION
-} from "./chunk-C627OKTW.js";
+} from "./chunk-K2IRTZH5.js";
+import {
+  VERBS,
+  activeVerbs,
+  controlOn,
+  orchestratorFullOn,
+  orchestratorOn,
+  readControl
+} from "./chunk-KQMPCV57.js";
 import {
   claudeDirsFromRc,
+  claudeLabel,
   profileKeyOf,
   profileKeys,
   uniqueProfileKey
-} from "./chunk-J36OIJBM.js";
+} from "./chunk-L6EFW2SJ.js";
 import {
   readMachine,
   writeMachine,
   writeServiceState
-} from "./chunk-IJRHCDIG.js";
+} from "./chunk-LX5A25O6.js";
 import {
   apiRequest
-} from "./chunk-VX7SCIF2.js";
+} from "./chunk-NRJONTFT.js";
 import {
+  resolveClaudeBin,
+  runFile
+} from "./chunk-XAXKZ572.js";
+import {
+  atomicWrite,
+  cliEntry,
   configDir,
+  controlLogFile,
   home,
   isDir,
   isRecord,
   machineSpoolFile,
   serviceLogFile
-} from "./chunk-TPMFQUAW.js";
+} from "./chunk-XPGL7VYE.js";
 import {
   runCmd
-} from "./chunk-SOXRITAW.js";
+} from "./chunk-QGULSOQ2.js";
 import {
+  ENDED_SESSIONS_MAX,
+  ENDED_SESSION_ID_RE,
   HOOK_BATCH_MAX,
   MACHINE_HEARTBEAT_SECONDS,
   MACHINE_MIN_INTERVAL_SECONDS,
+  ORCH_LIMITS,
+  ORCH_PERMISSION_MODES,
+  PEEK_LINES_MAX,
+  PEEK_OUTPUT_MAX,
+  RESUME_ID,
+  cleanOrchText,
   estimateClaudeCostUsd,
+  isResumeTool,
+  machineCommandsResponse,
   machineHeartbeatResponseSchema,
+  orchCommandSchema,
+  orchCommandsResponseSchema,
+  orchEventIn,
   parseUsageKey,
+  redact,
+  resumeArgv,
+  stripControlChars,
   usageReadingSchema
-} from "./chunk-4DRHR7LR.js";
-import "./chunk-K3NQKI34.js";
+} from "./chunk-HWBUESB4.js";
+import "./chunk-2ERPDCOT.js";
 
 // src/service/run.ts
-import fs2 from "fs";
+import fs12 from "fs";
 
 // src/service/collectors.ts
 import fs from "fs";
@@ -509,9 +568,9 @@ function parseDf(text, only) {
   for (const line of text.split("\n").slice(1)) {
     const m = /^(\S+)\s+(\d+)\s+(\d+)\s+(\d+)\s+\S+\s+(\/.*)$/.exec(line.trim());
     if (!m) continue;
-    const [, fs3, total, used, , mount] = m;
-    if (seen.has(fs3) || only && !only(fs3, mount)) continue;
-    seen.add(fs3);
+    const [, fs13, total, used, , mount] = m;
+    if (seen.has(fs13) || only && !only(fs13, mount)) continue;
+    seen.add(fs13);
     out.push({ mount: mount.slice(0, 80), used_gb: round1(Number(used) / MB), total_gb: round1(Number(total) / MB) });
   }
   return out.slice(0, 8);
@@ -548,7 +607,7 @@ async function collectMachineStats(deps) {
     disks = df ? parseDf(df).map((d) => ({ ...d, mount: "/" })) : [];
   } else {
     const df = deps.exec("df", ["-kPl"]);
-    disks = df ? parseDf(df, (fs3, mount) => fs3.startsWith("/dev/") && !fs3.startsWith("/dev/loop") && !/^\/(boot|snap|var\/lib\/docker)/.test(mount)) : [];
+    disks = df ? parseDf(df, (fs13, mount) => fs13.startsWith("/dev/") && !fs13.startsWith("/dev/loop") && !/^\/(boot|snap|var\/lib\/docker)/.test(mount)) : [];
   }
   const stats = { cpu_pct, ram_used_mb, ram_total_mb, disks };
   if (gpu_pct !== void 0) stats.gpu_pct = gpu_pct;
@@ -910,20 +969,39 @@ var readClaude = async (deps) => {
   await readEnvTokens(deps, seenTokens, out);
   return out;
 };
+async function readClaudeLogin(deps, dir) {
+  const d = normalizeDir(dir);
+  let raw = deps.readFile(joinPath(d, ".credentials.json"));
+  if (raw === null && deps.platform === "darwin" && deps.exec) {
+    raw = deps.exec("security", ["find-generic-password", "-s", keychainService(d, deps.home), "-w"]);
+  }
+  const creds = parseClaudeCreds(raw, deps.now());
+  if (creds.kind !== "ok") return void 0;
+  try {
+    const parsed = await readTokenUsage(deps, creds.token, false);
+    return {
+      ...parsed.accountId ? { accountKey: accountKey("claude", parsed.accountId) } : {},
+      ...parsed.plan ?? creds.plan ? { plan: parsed.plan ?? creds.plan } : {},
+      windows: parsed.windows.map((w) => ({ window: w.window, percent: w.percent, ...w.resets_at ? { resets_at: w.resets_at } : {} }))
+    };
+  } catch {
+    return void 0;
+  }
+}
 var CLAUDE_HEADERS = (token) => ({
   Authorization: `Bearer ${token}`,
   "anthropic-beta": "oauth-2025-04-20",
   "anthropic-version": "2023-06-01",
   Accept: "application/json"
 });
-async function readTokenUsage(deps, token) {
+async function readTokenUsage(deps, token, probe = true) {
   const headers = CLAUDE_HEADERS(token);
   let parsed;
   try {
     parsed = parseClaudeUsage(await requestJson(deps, USAGE_URL, { headers }));
     if (parsed.windows.length === 0) throw new ReaderError("bad_response", issueMessage("bad_response"));
   } catch (e) {
-    if (!(e instanceof ReaderError) || e.code !== "rejected" && e.code !== "rate_limited") throw e;
+    if (!probe || !(e instanceof ReaderError) || e.code !== "rejected" && e.code !== "rate_limited") throw e;
     return probeRateLimits(deps, token);
   }
   try {
@@ -1734,9 +1812,9 @@ function exec(cmd, args) {
     return null;
   }
 }
-function readFile(path2) {
+function readFile(path11) {
   try {
-    return readFileSync(path2, "utf8");
+    return readFileSync(path11, "utf8");
   } catch {
     return null;
   }
@@ -1748,9 +1826,9 @@ function nodeDeps() {
       return { status: res.status, text: () => res.text(), headers: Object.fromEntries([...res.headers].map(([k, v]) => [k.toLowerCase(), v])) };
     },
     readFile,
-    readDir(path2) {
+    readDir(path11) {
       try {
-        return readdirSync(path2);
+        return readdirSync(path11);
       } catch {
         return [];
       }
@@ -1804,6 +1882,1800 @@ async function collectUsagePush(ctx) {
   return buildUsagePush({ ...nodeDeps(), claudeTokens: tokens }, nodeStatsDeps());
 }
 
+// src/service/control/ended.ts
+var ENDED_QUIET_MS = 15e3;
+async function pickEndedSessions(map, proc, now) {
+  const cands = Object.entries(map).filter(([id, e]) => !e.ended && e.pid !== void 0 && e.start !== void 0 && now - e.at > ENDED_QUIET_MS && ENDED_SESSION_ID_RE.test(id)).sort((a, b) => a[1].at - b[1].at);
+  const out = [];
+  for (const [id, e] of cands) {
+    if (out.length >= ENDED_SESSIONS_MAX) break;
+    if (!await sameProcess(proc, e.pid, e.start)) out.push({ id, pid: e.pid, start: e.start, at: e.at });
+  }
+  return out;
+}
+
+// src/service/control/executor.ts
+import fs6 from "fs";
+import path5 from "path";
+
+// src/service/control/log.ts
+import fs2 from "fs";
+import path2 from "path";
+var CONTROL_LOG_MAX_BYTES = 1024 * 1024;
+var clean = (s, max) => s.replace(/[^\p{L}\p{N}._:@/-]+/gu, "_").slice(0, max) || "-";
+function logControl(line, file = controlLogFile()) {
+  try {
+    ensurePrivateDir(path2.dirname(file));
+    let size = 0;
+    try {
+      size = fs2.statSync(file).size;
+    } catch {
+    }
+    if (size > CONTROL_LOG_MAX_BYTES) fs2.renameSync(file, `${file}.1`);
+    const text = `${new Date(line.at).toISOString()} cmd=${clean(line.id, 40)} kind=${clean(line.kind, 12)} session=${clean(line.session, 80)} by=${clean(line.by, 60)} result=${clean(line.result, 60)}
+`;
+    fs2.appendFileSync(file, text, { mode: 384 });
+    if (process.platform !== "win32") fs2.chmodSync(file, 384);
+  } catch {
+  }
+}
+
+// src/service/control/local.ts
+import fs3 from "fs";
+import path3 from "path";
+var ADAPTER_TIMEOUT_MS = 2e4;
+var adapterFor = (adapters, tool, verb) => adapters.find((a) => a.tools.includes(tool) && a.verbs.includes(verb));
+function execTrouble(exec2) {
+  if (!path3.isAbsolute(exec2)) return "exec is not an absolute path";
+  let real;
+  try {
+    real = fs3.realpathSync(exec2);
+  } catch {
+    return "exec does not exist";
+  }
+  let st;
+  try {
+    st = fs3.statSync(real);
+  } catch {
+    return "exec does not exist";
+  }
+  if (!st.isFile()) return "exec is not a regular file";
+  if (process.platform === "win32") return void 0;
+  if (typeof process.getuid === "function" && st.uid !== process.getuid()) return "exec is not owned by the user";
+  if ((st.mode & 18) !== 0) return "exec is writable by others";
+  return void 0;
+}
+var cleanEnv = () => ({ PATH: process.env.PATH ?? "/usr/bin:/bin", ...process.env.HOME ? { HOME: process.env.HOME } : {} });
+async function runAdapter(a, cmd, run = runFile) {
+  const trouble = execTrouble(a.exec);
+  if (trouble) return { status: "failed", code: "adapter_error", detail: trouble };
+  const r = await run(a.exec, [cmd.kind, cmd.session.external_id], { input: JSON.stringify(cmd.args), timeoutMs: ADAPTER_TIMEOUT_MS, env: cleanEnv() });
+  if (r.code === 0) return { status: "done", via: "adapter" };
+  const why = r.code === null ? r.spawnError ? "could not start" : "timed out" : r.stderr.trim();
+  return { status: "failed", code: "adapter_error", detail: (why || `exit ${r.code}`).slice(0, 200) };
+}
+
+// src/service/control/peek.ts
+import fs4 from "fs";
+var T = 4e3;
+var TRANSCRIPT_TAIL_BYTES = 256 * 1024;
+function peekLines(args) {
+  const n = args["lines"];
+  return typeof n === "number" && Number.isInteger(n) ? Math.min(PEEK_LINES_MAX, Math.max(1, n)) : 30;
+}
+var HOME_DIR = /(?<![\w./~-])(?:\/Users|\/home)\/[^/\s:'"`)]+(?=[/\s:'"`)]|$)/gm;
+var ANSI = /\u001b(?:\[[0-?]*[ -/]*[@-~]|\][^\u0007\u001b]*(?:\u0007|\u001b\\)|[@-Z\\-_])/g;
+function cleanPeek(raw, lines) {
+  const plain = raw.replace(ANSI, "").replace(/\r\n?/g, "\n").split("\n").map((l) => stripControlChars(l).replace(/\s+$/, "")).join("\n").replace(/\n+$/, "");
+  const text = redact(plain).text.replace(HOME_DIR, "~");
+  const kept = text.split("\n").slice(-lines);
+  while (kept.length > 1 && Buffer.byteLength(kept.join("\n")) > PEEK_OUTPUT_MAX) kept.shift();
+  let out = kept.join("\n");
+  if (Buffer.byteLength(out) > PEEK_OUTPUT_MAX) out = fitTail(out);
+  return out;
+}
+function fitTail(s) {
+  const cps = [...s];
+  let bytes = 0;
+  let i = cps.length;
+  while (i > 0 && bytes + Buffer.byteLength(cps[i - 1]) <= PEEK_OUTPUT_MAX) bytes += Buffer.byteLength(cps[--i]);
+  return cps.slice(i).join("");
+}
+function textOf(content) {
+  if (typeof content === "string") return content;
+  if (!Array.isArray(content)) return "";
+  return content.map((p) => p && typeof p === "object" && p.type === "text" && typeof p.text === "string" ? p.text : "").filter(Boolean).join("\n");
+}
+function renderTranscript(jsonl) {
+  const out = [];
+  for (const line of jsonl.split("\n")) {
+    if (!line.startsWith("{")) continue;
+    let j;
+    try {
+      j = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (!j || typeof j !== "object") continue;
+    const o = j;
+    if (o.type !== "user" && o.type !== "assistant") continue;
+    const t = textOf(o.message?.content).trim();
+    if (!t) continue;
+    out.push(o.type === "user" ? t.split("\n").map((l) => `> ${l}`).join("\n") : t);
+  }
+  return out.join("\n");
+}
+function readTranscriptTail(file, maxBytes = TRANSCRIPT_TAIL_BYTES) {
+  let fd;
+  try {
+    const st = fs4.lstatSync(file);
+    if (!st.isFile() || st.isSymbolicLink()) return void 0;
+    if (typeof process.getuid === "function" && st.uid !== process.getuid()) return void 0;
+    const len = Math.min(st.size, maxBytes);
+    const buf = Buffer.alloc(len);
+    fd = fs4.openSync(file, fs4.constants.O_RDONLY | (fs4.constants.O_NOFOLLOW ?? 0));
+    fs4.readSync(fd, buf, 0, len, st.size - len);
+    return buf.toString("utf8");
+  } catch {
+    return void 0;
+  } finally {
+    if (fd !== void 0) fs4.closeSync(fd);
+  }
+}
+async function peekSession(cmd, entry, env) {
+  const lines = peekLines(cmd.args);
+  const pane = entry.pid !== void 0 ? await findPane(env.run, env.proc, entry.pid) : void 0;
+  if (pane) {
+    const r = await env.run("tmux", ["capture-pane", "-p", "-J", "-S", `-${lines}`, "-t", pane], { timeoutMs: T });
+    if (r.code === 0) return { status: "done", via: "tmux", output: cleanPeek(r.stdout, lines) };
+  }
+  if (entry.transcript) {
+    const raw = (env.readTail ?? readTranscriptTail)(entry.transcript);
+    if (raw !== void 0) return { status: "done", output: cleanPeek(renderTranscript(raw), lines), detail: "transcript" };
+  }
+  return { status: "failed", code: "no_pane" };
+}
+
+// src/service/control/resume.ts
+import fs5 from "fs";
+import path4 from "path";
+var RESUME_SETTLE_MS = 1500;
+var failed = (code, detail) => ({ status: "failed", code, ...detail ? { detail } : {} });
+function findProgram(name, pathEnv = process.env.PATH) {
+  if (!/^[a-z][a-z0-9-]*$/.test(name)) return void 0;
+  for (const dir of (pathEnv ?? "").split(path4.delimiter)) {
+    if (!dir || !path4.isAbsolute(dir)) continue;
+    const file = path4.join(dir, name);
+    try {
+      const st = fs5.statSync(file);
+      if (!st.isFile()) continue;
+      fs5.accessSync(file, fs5.constants.X_OK);
+      return file;
+    } catch {
+    }
+  }
+  return void 0;
+}
+function resumeDir(cwd) {
+  if (typeof cwd !== "string" || cwd.length === 0 || cwd.length > 500 || cwd.includes("\0") || !path4.isAbsolute(cwd)) return void 0;
+  try {
+    const real = fs5.realpathSync(cwd);
+    return fs5.statSync(real).isDirectory() ? real : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function resumeEnv(src = process.env) {
+  const out = { TERM: "xterm-256color" };
+  for (const k of ["PATH", "HOME", "USER", "LOGNAME", "SHELL", "LANG", "LC_ALL", "LC_CTYPE", "XDG_RUNTIME_DIR", "TMUX_TMPDIR"]) {
+    const v = src[k];
+    if (v !== void 0) out[k] = v;
+  }
+  return out;
+}
+var resumeSessionName = (tool, id) => `hf-${tool}-${id.toLowerCase()}`;
+function tmuxMajor(out) {
+  const m = /(\d+)\.\d+/.exec(out);
+  return m ? Number(m[1]) : void 0;
+}
+async function resumeSession(cmd, entry, d) {
+  const id = cmd.session.external_id;
+  if (!RESUME_ID.test(id)) return failed("bad_session_id");
+  if (!entry) return failed("unknown_session", "this machine has no record of the session");
+  const tool = entry.tool;
+  if (!isResumeTool(tool)) return failed("unsupported", "no resume for this tool");
+  if (entry.pid !== void 0 && await sameProcess(d.proc, entry.pid, entry.start)) return failed("already_running");
+  const argv = resumeArgv(tool, id);
+  if (!argv) return failed("bad_session_id");
+  const dir = resumeDir(entry.cwd);
+  if (!dir) return failed("no_folder", "the session folder is unknown or gone");
+  const [prog, ...args] = argv;
+  const bin = findProgram(prog, d.pathEnv);
+  if (!bin) return failed("no_program", `${prog} is not on the service PATH`);
+  const name = resumeSessionName(tool, id);
+  const env = d.env ?? resumeEnv();
+  const v = await d.run("tmux", ["-V"], { env, timeoutMs: 5e3 });
+  if (v.spawnError) return failed("no_tmux", "tmux is not installed");
+  const major = tmuxMajor(v.stdout);
+  if (v.code !== 0 || major === void 0 || major < 3) return failed("old_tmux", "tmux 3.0 or newer is needed");
+  const r = await d.run("tmux", ["new-session", "-d", "-s", name, "-c", dir, "--", bin, ...args], { env, timeoutMs: 1e4 });
+  if (r.spawnError) return failed("no_tmux", "tmux is not installed");
+  if (r.code !== 0) {
+    if (/duplicate session/i.test(r.stderr)) return failed("already_running", `tmux session ${name} exists`);
+    return failed("tmux_error", r.stderr.trim().slice(0, 200) || `exit ${r.code ?? "killed"}`);
+  }
+  await d.sleep(RESUME_SETTLE_MS);
+  const alive = await d.run("tmux", ["has-session", "-t", `=${name}`], { env, timeoutMs: 5e3 });
+  if (alive.code !== 0) return failed("exited", `${prog} exited at once`);
+  return { status: "done", via: "tmux", detail: `tmux attach -t ${name}` };
+}
+
+// src/service/control/executor.ts
+var POLL_WAIT_SEC = 25;
+var POLL_TIMEOUT_MS = 35e3;
+var OFF_SLEEP_MS = 15e3;
+var SEEN_TTL_MS = 36e5;
+var SeenIds = class {
+  constructor(file) {
+    this.file = file;
+    if (!file) return;
+    try {
+      const j = JSON.parse(fs6.readFileSync(file, "utf8"));
+      if (isRecord(j)) {
+        for (const [k, v] of Object.entries(j)) if (typeof v === "number") this.ids.set(k, v);
+      }
+    } catch {
+    }
+  }
+  file;
+  ids = /* @__PURE__ */ new Map();
+  /** True when the id was seen in the last hour; otherwise remembers it. */
+  seenBefore(id, now) {
+    for (const [k, t] of this.ids) if (now - t > SEEN_TTL_MS) this.ids.delete(k);
+    if (this.ids.has(id)) return true;
+    this.ids.set(id, now);
+    if (this.file) {
+      try {
+        ensurePrivateDir(path5.dirname(this.file));
+        atomicWrite(this.file, `${JSON.stringify(Object.fromEntries(this.ids))}
+`, 384);
+      } catch {
+      }
+    }
+    return false;
+  }
+};
+async function resolveVersion(run, resolveBin) {
+  const r = await run(await resolveBin() ?? "claude", ["--version"], { timeoutMs: 3e3 });
+  return r.code === 0 ? r.stdout.trim() : void 0;
+}
+function adapterEnv(d) {
+  const run = d.run ?? runFile;
+  let cached;
+  return {
+    run,
+    proc: d.proc ?? realProc(run),
+    now: d.ctx.now,
+    sleep: d.ctx.sleep,
+    kill: d.kill ?? ((pid, sig) => void process.kill(pid, sig)),
+    claudeVersion: d.claudeVersion ?? (() => cached ??= resolveVersion(run, d.claudeBin ?? resolveClaudeBin))
+  };
+}
+var isVerb = (k) => VERBS.includes(k);
+var failed2 = (code, detail) => ({ status: "failed", code, ...detail ? { detail } : {} });
+async function handleCommand(cmd, receivedAt, d) {
+  const now = d.ctx.now();
+  const ctl = (d.readControl ?? readControl)();
+  if (ctl.state !== "ok" || !ctl.config.enabled) return failed2("control_off");
+  if (!isVerb(cmd.kind) || !ctl.config.verbs[cmd.kind]) return failed2("verb_off");
+  if (ctl.config.from === "owner" && !cmd.requested_by.is_machine_owner) return failed2("not_from_owner");
+  if (d.seen.seenBefore(cmd.id, now)) return null;
+  if (cmd.expires_in_ms - (now - receivedAt) <= 0) return failed2("expired");
+  const entry = readSessions(now)[cmd.session.external_id];
+  const env = adapterEnv(d);
+  if (cmd.kind === "resume") {
+    const local2 = entry ? adapterFor(ctl.config.adapters, entry.tool, "resume") : void 0;
+    if (local2 && entry && !(entry.pid !== void 0 && await sameProcess(env.proc, entry.pid, entry.start))) return await runAdapter(local2, cmd, env.run);
+    return await resumeSession(cmd, entry, { run: env.run, proc: env.proc, sleep: (ms) => d.ctx.sleep(ms) });
+  }
+  if (!entry || !await sameProcess(env.proc, entry.pid, entry.start)) return failed2("unknown_session");
+  const local = adapterFor(ctl.config.adapters, entry.tool, cmd.kind);
+  if (local) return await runAdapter(local, cmd, env.run);
+  const claude = entry.tool === "claude";
+  let out;
+  switch (cmd.kind) {
+    case "message":
+      out = claude ? await claudeMessage(cmd, cmd.id, entry, env) : failed2("unsupported", "no adapter for this tool");
+      break;
+    case "approve":
+    case "deny":
+      out = claude ? claudeDecision(cmd, entry, now) : failed2("unsupported", "no adapter for this tool");
+      break;
+    case "stop":
+      out = await stopSession(cmd, entry, env);
+      break;
+    case "peek":
+      out = await peekSession(cmd, entry, env);
+      break;
+  }
+  return out;
+}
+var resultText = (r) => r === null ? "dropped_replay" : r.status === "done" ? `done${r.via ? `/${r.via}` : ""}${r.detail ? `/${r.detail}` : ""}` : `failed/${r.code ?? "unknown"}`;
+async function handleBatch(cmds, receivedAt, d, post) {
+  for (const cmd of cmds) {
+    let result;
+    try {
+      result = await handleCommand(cmd, receivedAt, d);
+    } catch (e) {
+      result = failed2("internal_error", e.message.slice(0, 200));
+    }
+    logControl({ at: d.ctx.now(), id: cmd.id, kind: cmd.kind, session: cmd.session.external_id, by: `${cmd.requested_by.user_id}:${cmd.requested_by.name}`, result: resultText(result) });
+    if (result) await post(cmd.id, result);
+  }
+}
+var seenFile = () => path5.join(configDir(), "control", "seen.json");
+async function pollOnce(d) {
+  const m = readMachine();
+  if (!m || m.revoked) return "revoked";
+  const ctl = (d.readControl ?? readControl)();
+  if (!controlOn(ctl)) return "off";
+  const post = async (id, body) => {
+    try {
+      await apiRequest(d.ctx, m.host, `/api/v1/machine/commands/${encodeURIComponent(id)}/result`, { method: "POST", token: m.token, body, timeoutMs: 1e4 });
+    } catch {
+    }
+  };
+  for (const g of sweepInbox(d.ctx.now())) {
+    logControl({ at: d.ctx.now(), id: g.entry.id, kind: "message", session: g.session, by: g.entry.from, result: "failed/not_taken" });
+    await post(g.entry.id, failed2("not_taken"));
+  }
+  let r;
+  try {
+    r = await apiRequest(d.ctx, m.host, `/api/v1/machine/commands?wait=${POLL_WAIT_SEC}`, { token: m.token, timeoutMs: POLL_TIMEOUT_MS });
+  } catch {
+    return "error";
+  }
+  if (r.status === 401) return "revoked";
+  if (r.status < 200 || r.status >= 300) return "error";
+  const parsed = machineCommandsResponse.safeParse(r.json);
+  if (!parsed.success) return "error";
+  const receivedAt = d.ctx.now();
+  if (parsed.data.commands.length === 0) return "idle";
+  await handleBatch(parsed.data.commands, receivedAt, d, post);
+  return "handled";
+}
+async function controlLoop(d, stopped, backoff) {
+  let failures = 0;
+  while (!stopped()) {
+    let r = "error";
+    try {
+      r = await pollOnce(d);
+    } catch {
+      r = "error";
+    }
+    if (r === "revoked") {
+      await d.ctx.sleep(OFF_SLEEP_MS);
+    } else if (r === "off") {
+      failures = 0;
+      await d.ctx.sleep(OFF_SLEEP_MS);
+    } else if (r === "error") {
+      failures += 1;
+      await d.ctx.sleep(backoff(failures));
+    } else {
+      failures = 0;
+    }
+    await new Promise((res) => setImmediate(res));
+  }
+}
+
+// src/service/orch/loop.ts
+import fs11 from "fs";
+import path10 from "path";
+
+// src/service/orch/map.ts
+import crypto from "crypto";
+var ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,127}$/;
+function safeId(raw, fallback) {
+  const s = typeof raw === "string" ? raw : "";
+  if (ID_RE.test(s)) return s;
+  const c = s.replace(/[^A-Za-z0-9._:@/-]/g, "_").replace(/^[^A-Za-z0-9]+/, "").slice(0, 128);
+  return ID_RE.test(c) ? c : fallback;
+}
+function capText(raw, max) {
+  const t = redact(raw).text;
+  if (t.length <= max) return t;
+  let cut = t.slice(0, max - 1);
+  if (/[\uD800-\uDBFF]$/.test(cut)) cut = cut.slice(0, -1);
+  return `${cut}\u2026`;
+}
+var isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var str = (v) => typeof v === "string" ? v : "";
+var int = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0 ? Math.round(v) : 0;
+function toolSummary(name, input, max = ORCH_LIMITS.toolSummary) {
+  const i = isObj(input) ? input : {};
+  let s;
+  switch (name) {
+    case "Bash":
+      s = str(i.command) || "(no command)";
+      if (str(i.description)) s = `${s}  # ${str(i.description)}`;
+      break;
+    case "Read":
+    case "Write":
+    case "Edit":
+    case "MultiEdit":
+    case "NotebookEdit":
+      s = str(i.file_path) || str(i.notebook_path) || "(no path)";
+      if (name === "Write") s = `${s} (${str(i.content).length} chars)`;
+      break;
+    case "Glob":
+    case "Grep":
+      s = `${str(i.pattern)}${str(i.path) ? ` in ${str(i.path)}` : ""}`;
+      break;
+    case "WebFetch":
+      s = str(i.url);
+      break;
+    case "WebSearch":
+      s = str(i.query);
+      break;
+    default: {
+      const parts = [];
+      for (const [k, v] of Object.entries(i)) {
+        if (typeof v === "string") parts.push(`${k}=${v.length > 200 ? `${v.slice(0, 200)}\u2026` : v}`);
+        else if (typeof v === "number" || typeof v === "boolean") parts.push(`${k}=${String(v)}`);
+        if (parts.length >= 8) break;
+      }
+      s = parts.join(" ");
+    }
+  }
+  return capText(stripControlChars(s.replace(/\s*\n\s*/g, " ")), max);
+}
+function resultText2(content) {
+  if (typeof content === "string") return content;
+  if (Array.isArray(content)) return content.map((c) => isObj(c) && c.type === "text" ? str(c.text) : isObj(c) && c.type === "image" ? "[image]" : "").filter(Boolean).join("\n");
+  return "";
+}
+var StreamMapper = class {
+  parts = /* @__PURE__ */ new Map();
+  /** The runtime's session id from `system/init` (for `--resume`). */
+  externalId;
+  msgId(raw) {
+    const base = safeId(raw, "msg").slice(0, 110);
+    const n = (this.parts.get(base) ?? 0) + 1;
+    this.parts.set(base, n);
+    if (this.parts.size > 500) this.parts.delete(this.parts.keys().next().value);
+    return `${base}.${n}`;
+  }
+  /** Map one parsed stream-json line. Unknown types give nothing (newer Claude versions add some). */
+  map(line) {
+    if (!isObj(line)) return [];
+    const out = [];
+    switch (line.type) {
+      case "system": {
+        if (line.subtype === "init" && typeof line.session_id === "string") {
+          const ext = safeId(line.session_id, "");
+          if (ext) {
+            this.externalId = ext;
+            out.push({ type: "status", body: { state: "working", external_id: ext } });
+          }
+        }
+        break;
+      }
+      case "assistant": {
+        const msg = isObj(line.message) ? line.message : {};
+        const content = Array.isArray(msg.content) ? msg.content : [];
+        for (const block of content) {
+          if (!isObj(block)) continue;
+          if (block.type === "text" && str(block.text).trim() !== "") {
+            out.push({ type: "message", body: { role: "assistant", text: capText(str(block.text), ORCH_LIMITS.messageText), msg_id: this.msgId(msg.id) } });
+          } else if (block.type === "thinking" && str(block.thinking).trim() !== "") {
+            out.push({ type: "thinking", body: { text: capText(str(block.thinking), ORCH_LIMITS.thinkingText) } });
+          } else if (block.type === "tool_use") {
+            const name = capText(stripControlChars(str(block.name)) || "tool", 100);
+            out.push({ type: "tool_use", body: { tool_use_id: safeId(block.id, "tool"), name, input_summary: toolSummary(str(block.name), block.input) } });
+          }
+        }
+        break;
+      }
+      case "user": {
+        const msg = isObj(line.message) ? line.message : {};
+        const content = Array.isArray(msg.content) ? msg.content : [];
+        for (const block of content) {
+          if (!isObj(block) || block.type !== "tool_result") continue;
+          out.push({ type: "tool_result", body: { tool_use_id: safeId(block.tool_use_id, "tool"), ok: block.is_error !== true, summary: capText(stripControlChars(resultText2(block.content)), ORCH_LIMITS.toolSummary) } });
+        }
+        break;
+      }
+      case "result": {
+        const u = isObj(line.usage) ? line.usage : {};
+        const usage = { input_tokens: int(u.input_tokens), output_tokens: int(u.output_tokens), duration_ms: int(line.duration_ms) };
+        if (typeof u.cache_read_input_tokens === "number") usage.cache_read = int(u.cache_read_input_tokens);
+        if (typeof line.total_cost_usd === "number" && line.total_cost_usd >= 0) usage.cost_usd = line.total_cost_usd;
+        out.push({ type: "usage", body: usage });
+        if (line.is_error === true) {
+          const code = capText(safeId(line.subtype, "error"), 60);
+          const text = str(line.result) || (Array.isArray(line.errors) ? line.errors.map(str).join("; ") : "") || "The turn ended with an error.";
+          out.push({ type: "error", body: { code, message: capText(stripControlChars(text), ORCH_LIMITS.errorMessage) } });
+        }
+        out.push({ type: "status", body: { state: "idle", ...this.externalId ? { external_id: this.externalId } : {} } });
+        break;
+      }
+      default:
+        break;
+    }
+    return out;
+  }
+};
+var fileKey = (id) => crypto.createHash("sha256").update(id).digest("hex").slice(0, 32);
+
+// src/service/orch/outbox.ts
+import fs7 from "fs";
+import path6 from "path";
+var BATCH_MAX_BYTES = 200 * 1024;
+var PENDING_MAX = 2e3;
+function relayable(ev) {
+  if (ev.type === "message" && ev.body.role !== "assistant") return false;
+  return orchEventIn.safeParse(ev).success;
+}
+var Outbox = class {
+  constructor(file, io) {
+    this.file = file;
+    this.io = io;
+    try {
+      const j = JSON.parse(fs7.readFileSync(file, "utf8"));
+      if (isRecord(j) && typeof j.last_src_seq === "number" && Number.isSafeInteger(j.last_src_seq) && j.last_src_seq >= 0) this.last = this.persisted = j.last_src_seq;
+    } catch {
+    }
+  }
+  file;
+  io;
+  last = 0;
+  persisted = 0;
+  pending = [];
+  flushing;
+  ready;
+  failures = 0;
+  /** The server no longer knows the session (404): nothing more is sent. */
+  gone = false;
+  revoked = false;
+  dropped = 0;
+  /** The counter, after asking the server once where it got to. */
+  start() {
+    this.ready ??= (async () => {
+      for (let i = 0; i < 5 && !this.gone; i += 1) {
+        const c = await this.io.cursor();
+        if (c !== void 0) {
+          if (c > this.last) this.last = c;
+          return;
+        }
+        await this.io.sleep(Math.min(3e4, 1e3 * 2 ** i));
+      }
+    })();
+    return this.ready;
+  }
+  /** Queue events; they go out on the next flush. Returns how many were taken. */
+  push(drafts) {
+    if (this.gone || drafts.length === 0) return 0;
+    let taken = 0;
+    for (const d of drafts) {
+      const ev = { ...d, src_seq: 0 };
+      if (!relayable({ ...ev, src_seq: 1 })) {
+        this.dropped += 1;
+        this.io.log?.(`dropped an event the server would refuse (${d.type})`);
+        continue;
+      }
+      this.pending.push(ev);
+      taken += 1;
+    }
+    if (this.pending.length > PENDING_MAX) {
+      const cut = this.pending.length - PENDING_MAX;
+      this.pending.splice(0, cut);
+      this.dropped += cut;
+    }
+    return taken;
+  }
+  saveCounter() {
+    if (this.last === this.persisted) return;
+    ensurePrivateDir(path6.dirname(this.file));
+    atomicWrite(this.file, `${JSON.stringify({ last_src_seq: this.last })}
+`, 384);
+    this.persisted = this.last;
+  }
+  /** Send what is queued, in order, until it is all stored or the server can't take it now. One flush runs at a time. */
+  flush() {
+    this.flushing ??= this.flushAll().finally(() => {
+      this.flushing = void 0;
+    });
+    return this.flushing;
+  }
+  get size() {
+    return this.pending.length;
+  }
+  async flushAll() {
+    await this.start();
+    while (this.pending.length > 0 && !this.gone && !this.revoked) {
+      const batch = [];
+      let bytes = 20;
+      for (const ev of this.pending) {
+        if (batch.length >= ORCH_LIMITS.batch) break;
+        if (ev.src_seq === 0) ev.src_seq = ++this.last;
+        const size = Buffer.byteLength(JSON.stringify(ev)) + 1;
+        if (batch.length > 0 && bytes + size > BATCH_MAX_BYTES) break;
+        batch.push(ev);
+        bytes += size;
+      }
+      try {
+        this.saveCounter();
+      } catch (e) {
+        this.io.log?.(`could not save the event counter: ${e.message}`);
+      }
+      const r = await this.io.post(batch);
+      if (r.kind === "ok") {
+        this.failures = 0;
+        if (r.acked > this.last) this.last = r.acked;
+        const top = Math.max(r.acked, batch[batch.length - 1].src_seq);
+        this.pending = this.pending.filter((e) => e.src_seq === 0 || e.src_seq > top);
+      } else if (r.kind === "bad") {
+        this.io.log?.(`the server refused a batch of ${batch.length} events (400); dropped`);
+        this.dropped += batch.length;
+        const top = batch[batch.length - 1].src_seq;
+        this.pending = this.pending.filter((e) => e.src_seq === 0 || e.src_seq > top);
+      } else if (r.kind === "gone") {
+        this.gone = true;
+        this.dropped += this.pending.length;
+        this.pending = [];
+      } else if (r.kind === "revoked") {
+        this.revoked = true;
+      } else {
+        this.failures += 1;
+        await this.io.sleep(Math.min(3e4, 500 * 2 ** Math.min(this.failures, 6)));
+        if (this.failures >= 3) return;
+      }
+    }
+  }
+};
+
+// src/service/orch/session.ts
+import crypto2 from "crypto";
+import fs8 from "fs";
+import path7 from "path";
+import readline from "readline";
+var MCP_SERVER_NAME = "hivefloor_orch";
+var ALLOWED_UP_FRONT = ["TodoWrite", ...fleetAllowedTools()];
+var READ_TOOLS = /* @__PURE__ */ new Set(["Read", "LS"]);
+var ENV_KEEP = ["PATH", "HOME", "USER", "LOGNAME", "SHELL", "LANG", "LANGUAGE", "TERM", "TMPDIR", "TZ", "XDG_RUNTIME_DIR", "HTTPS_PROXY", "HTTP_PROXY", "NO_PROXY", "https_proxy", "http_proxy", "no_proxy", "NODE_EXTRA_CA_CERTS", "SSL_CERT_FILE", "SSL_CERT_DIR"];
+var ENV_DROP_FULL = ["CLAUDECODE", "CLAUDE_CODE_ENTRYPOINT", "CLAUDE_CONFIG_DIR"];
+var CAFFEINATE = "/usr/bin/caffeinate";
+var MAX_RESTARTS = 3;
+var INTERRUPT_GRACE_MS = 3e3;
+var STOP_GRACE_MS = 5e3;
+var FULL_OFF_AT_START = "Full power is off on this machine, so the session was not started.";
+var isObj2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function insideDir(base, p) {
+  if (typeof p !== "string" || !path7.isAbsolute(p)) return false;
+  let real = path7.resolve(base, p);
+  try {
+    real = fs8.realpathSync(real);
+  } catch {
+  }
+  let root = path7.resolve(base);
+  try {
+    root = fs8.realpathSync(root);
+  } catch {
+  }
+  const rel = path7.relative(root, real);
+  return rel === "" || !rel.startsWith("..") && !path7.isAbsolute(rel);
+}
+var isFull = (c) => c.power === "full";
+function permissionModeOf(c) {
+  const m = c.permissionMode;
+  return isFull(c) && m !== void 0 && ORCH_PERMISSION_MODES.includes(m) ? m : "default";
+}
+var asksInBrowser = (c) => permissionModeOf(c) !== "bypassPermissions";
+function briefOf(c) {
+  if (typeof c.brief !== "string") return null;
+  let t = cleanOrchText(c.brief).trim();
+  const enc = new TextEncoder();
+  if (enc.encode(t).length > ORCH_LIMITS.briefBytes) {
+    const chars = Array.from(t);
+    let bytes = 0;
+    let n = 0;
+    for (; n < chars.length; n++) {
+      bytes += enc.encode(chars[n]).length;
+      if (bytes > ORCH_LIMITS.briefBytes) break;
+    }
+    t = chars.slice(0, n).join("").trim();
+  }
+  return t === "" ? null : t;
+}
+function fullArgs(c, mcpConfigFile, resumeId) {
+  const a = [
+    "-p",
+    "--input-format",
+    "stream-json",
+    "--output-format",
+    "stream-json",
+    "--verbose",
+    `--model=${c.model}`,
+    `--effort=${c.effort}`,
+    "--permission-mode",
+    permissionModeOf(c),
+    "--mcp-config",
+    mcpConfigFile,
+    "--allowedTools",
+    fleetAllowedTools().join(",")
+  ];
+  if (asksInBrowser(c)) a.push("--permission-prompt-tool", `mcp__${MCP_SERVER_NAME}__${PERMIT_TOOL}`);
+  if (c.chrome === true) a.push("--chrome");
+  if (resumeId) a.push(`--resume=${resumeId}`);
+  return a;
+}
+function claudeArgs(c, mcpConfigFile, resumeId) {
+  if (isFull(c)) return fullArgs(c, mcpConfigFile, resumeId);
+  const a = [
+    "-p",
+    "--input-format",
+    "stream-json",
+    "--output-format",
+    "stream-json",
+    "--verbose",
+    `--model=${c.model}`,
+    `--effort=${c.effort}`,
+    "--permission-mode",
+    "default",
+    "--permission-prompt-tool",
+    `mcp__${MCP_SERVER_NAME}__${PERMIT_TOOL}`,
+    "--mcp-config",
+    mcpConfigFile,
+    "--strict-mcp-config",
+    "--setting-sources=",
+    "--allowedTools",
+    ALLOWED_UP_FRONT.join(",")
+  ];
+  if (resumeId) a.push(`--resume=${resumeId}`);
+  return a;
+}
+var OrchSession = class {
+  constructor(cfg, d) {
+    this.cfg = cfg;
+    this.d = d;
+    this.mcpFile = path7.join(d.paths.run, `mcp-${fileKey(cfg.orchId)}.json`);
+  }
+  cfg;
+  d;
+  child;
+  mapper = new StreamMapper();
+  key = newPermitKey();
+  fleetKey = newFleetKey();
+  questions = /* @__PURE__ */ new Map();
+  stateNow = "stopped";
+  restarts = 0;
+  expectedExit;
+  interruptTimer;
+  stderrTail = "";
+  stoppedForGood = false;
+  awake;
+  mcpFile;
+  get state() {
+    return this.stateNow;
+  }
+  get externalId() {
+    return this.mapper.externalId ?? this.cfg.resumeId ?? void 0;
+  }
+  get running() {
+    return this.child !== void 0;
+  }
+  /** Stopped for good (by the user, a switch, or its own refusal to start): it will not spawn again. */
+  get ended() {
+    return this.stoppedForGood;
+  }
+  /** A check that throws (the file cannot be read) counts as "no". */
+  fullStillAllowed() {
+    try {
+      return this.d.fullAllowed() === true;
+    } catch {
+      return false;
+    }
+  }
+  emit(events) {
+    for (const e of events) if (e.type === "status") this.stateNow = e.body.state;
+    this.d.outbox.push(events);
+    void this.d.outbox.flush();
+  }
+  status(state, detail) {
+    const ext = this.externalId;
+    this.emit([{ type: "status", body: { state, ...detail ? { detail: detail.slice(0, 300) } : {}, ...ext ? { external_id: ext } : {} } }]);
+  }
+  writeMcpConfig() {
+    ensurePrivateDir(this.d.paths.run);
+    const conf = {
+      mcpServers: {
+        // The permission tool is there only for a session that asks: one with bypass gets the fleet tools alone.
+        ...asksInBrowser(this.cfg) ? {
+          [MCP_SERVER_NAME]: {
+            type: "stdio",
+            command: this.d.cli.node,
+            args: [this.d.cli.entry, "mcp", "--permission-prompt"],
+            env: { [PERMIT_ENV_SOCKET]: this.d.permit.socketPath, [PERMIT_ENV_KEY]: this.key }
+          }
+        } : {},
+        [FLEET_SERVER_NAME]: {
+          type: "stdio",
+          command: this.d.cli.node,
+          args: [this.d.cli.entry, "mcp", "--orchestrator"],
+          env: { [FLEET_ENV_SOCKET]: this.d.fleet.socketPath, [FLEET_ENV_KEY]: this.fleetKey }
+        }
+      }
+    };
+    atomicWrite(this.mcpFile, `${JSON.stringify(conf)}
+`, 384);
+  }
+  fullEnv() {
+    const env = { ...this.d.env };
+    for (const k of ENV_DROP_FULL) delete env[k];
+    if (this.cfg.configDir) env.CLAUDE_CONFIG_DIR = this.cfg.configDir;
+    if (asksInBrowser(this.cfg)) env.MCP_TOOL_TIMEOUT = String((ORCH_LIMITS.questionTimeoutSec + 60) * 1e3);
+    return env;
+  }
+  childEnv() {
+    if (isFull(this.cfg)) return this.fullEnv();
+    const env = {};
+    for (const k of ENV_KEEP) if (this.d.env[k] !== void 0) env[k] = this.d.env[k];
+    for (const k of Object.keys(this.d.env)) if (k.startsWith("LC_")) env[k] = this.d.env[k];
+    if (this.cfg.configDir) env.CLAUDE_CONFIG_DIR = this.cfg.configDir;
+    env.MCP_TOOL_TIMEOUT = String((ORCH_LIMITS.questionTimeoutSec + 60) * 1e3);
+    return env;
+  }
+  /** Start (or start again with `--resume`). */
+  start() {
+    if (this.child || this.stoppedForGood) return;
+    if (isFull(this.cfg) && !this.fullStillAllowed()) {
+      this.stoppedForGood = true;
+      this.emit([{ type: "error", body: { code: "full_not_allowed", message: FULL_OFF_AT_START } }]);
+      this.finish();
+      this.status("stopped", FULL_OFF_AT_START);
+      return;
+    }
+    if (!isFull(this.cfg)) ensurePrivateDir(this.d.paths.work);
+    this.writeMcpConfig();
+    if (asksInBrowser(this.cfg)) this.d.permit.add(this.key, (req) => this.onPermit(req));
+    this.d.fleet.add(this.fleetKey, this.d.fleetCall);
+    this.status("starting");
+    const resume = this.externalId ?? null;
+    let child;
+    try {
+      child = this.d.spawn(this.d.claudeBin ?? "claude", claudeArgs(this.cfg, this.mcpFile, resume), { cwd: this.d.paths.work, env: this.childEnv() });
+    } catch (e) {
+      this.d.log(`orchestrator: could not start claude: ${e.message}`);
+      this.onExit(null, null);
+      return;
+    }
+    this.child = child;
+    this.stderrTail = "";
+    this.keepAwake(child);
+    const brief = resume === null ? briefOf(this.cfg) : null;
+    if (brief !== null) {
+      child.stdin.write(`${JSON.stringify({ type: "user", message: { role: "user", content: [{ type: "text", text: brief }] } })}
+`);
+      this.status("working");
+    }
+    const rl = readline.createInterface({ input: child.stdout, crlfDelay: Infinity });
+    rl.on("line", (line) => this.onLine(line));
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (s) => {
+      this.stderrTail = (this.stderrTail + s).slice(-2e3);
+    });
+    child.onExit((code, signal) => {
+      rl.close();
+      this.letSleep();
+      if (this.child === child) {
+        this.child = void 0;
+        this.onExit(code, signal);
+      }
+    });
+  }
+  /** macOS only: `caffeinate -i -w <pid>` holds the idle-sleep assertion for exactly as long as our child lives. */
+  keepAwake(child) {
+    this.letSleep();
+    if (this.cfg.keepAwake !== true || (this.d.platform ?? process.platform) !== "darwin") return;
+    if (typeof child.pid !== "number" || !Number.isInteger(child.pid) || child.pid <= 0) return;
+    try {
+      ensurePrivateDir(this.d.paths.run);
+      const c = this.d.spawn(CAFFEINATE, ["-i", "-w", String(child.pid)], { cwd: this.d.paths.run, env: {} });
+      this.awake = c;
+      c.stdout.resume();
+      c.stderr.resume();
+      c.onExit(() => {
+        if (this.awake === c) this.awake = void 0;
+      });
+    } catch (e) {
+      this.d.log(`orchestrator: keep-awake could not start: ${e.message}`);
+    }
+  }
+  letSleep() {
+    const c = this.awake;
+    this.awake = void 0;
+    c?.kill("SIGTERM");
+  }
+  onLine(line) {
+    if (line.trim() === "") return;
+    let j;
+    try {
+      j = JSON.parse(line);
+    } catch {
+      return;
+    }
+    if (isObj2(j) && j.type === "result") this.restarts = 0;
+    if (isObj2(j) && j.type === "result" && this.interruptTimer) {
+      this.interruptTimer.cancel();
+      this.interruptTimer = void 0;
+    }
+    this.emit(this.mapper.map(j));
+  }
+  onExit(code, signal) {
+    this.interruptTimer?.cancel();
+    this.interruptTimer = void 0;
+    this.denyAll("The session ended.");
+    const why = this.expectedExit;
+    this.expectedExit = void 0;
+    if (why === "stop" || this.stoppedForGood) {
+      this.finish();
+      this.status("stopped");
+      return;
+    }
+    if (why === "respawn") {
+      this.start();
+      return;
+    }
+    const tail = this.stderrTail.trim();
+    this.d.log(`orchestrator: claude exited (code ${code ?? "-"}, signal ${signal ?? "-"})${tail ? `: ${capText(stripControlChars(tail.split("\n").slice(-3).join(" ")), 500)}` : ""}`);
+    const kind = /usage limit|rate limit|429/i.test(tail) ? "usage_limit" : /login|log in|auth|credential|401/i.test(tail) ? "auth" : "exited";
+    const say = { usage_limit: "Claude hit a usage limit", auth: "Claude is not signed in on this machine (or the login expired)", exited: "Claude exited" }[kind];
+    this.emit([{ type: "error", body: { code: kind, message: `${say} (code ${code ?? "-"}, signal ${signal ?? "-"}).` } }]);
+    if (this.restarts >= MAX_RESTARTS) {
+      this.finish();
+      this.status("crashed", `stopped after ${MAX_RESTARTS} restarts`);
+      return;
+    }
+    this.restarts += 1;
+    const wait = 2e3 * 2 ** (this.restarts - 1);
+    this.status("starting", `restart ${this.restarts} of ${MAX_RESTARTS}`);
+    this.d.setTimer(() => this.start(), wait);
+  }
+  finish() {
+    this.d.permit.remove(this.key);
+    this.d.fleet.remove(this.fleetKey);
+    fs8.rmSync(this.mcpFile, { force: true });
+  }
+  /** A user message from HiveFloor, written as one stream-json line. Never a shell command. */
+  send(text) {
+    if (!this.child) return false;
+    const clean2 = cleanOrchText(text).slice(0, ORCH_LIMITS.sendText);
+    if (clean2.trim() === "") return false;
+    this.child.stdin.write(`${JSON.stringify({ type: "user", message: { role: "user", content: [{ type: "text", text: clean2 }] } })}
+`);
+    if (this.stateNow !== "working") this.status("working");
+    return true;
+  }
+  /** End the turn: ask Claude first; if it is still working after a few seconds, SIGINT our own child and resume it. */
+  interrupt() {
+    const child = this.child;
+    if (!child || this.interruptTimer) return;
+    child.stdin.write(`${JSON.stringify({ type: "control_request", request_id: crypto2.randomBytes(8).toString("hex"), request: { subtype: "interrupt" } })}
+`);
+    this.denyAll("Interrupted by the user.");
+    this.interruptTimer = this.d.setTimer(() => {
+      this.interruptTimer = void 0;
+      if (this.child !== child || this.stateNow === "idle") return;
+      this.expectedExit = "respawn";
+      child.kill("SIGINT");
+    }, INTERRUPT_GRACE_MS);
+  }
+  /** Stop for good (the user stopped it, or the orchestrator was switched off). */
+  stop() {
+    this.stoppedForGood = true;
+    const child = this.child;
+    if (!child) {
+      this.finish();
+      this.status("stopped");
+      return;
+    }
+    this.expectedExit = "stop";
+    this.denyAll("The session was stopped.");
+    child.stdin.end();
+    this.d.setTimer(() => {
+      if (this.child === child) child.kill("SIGTERM");
+    }, STOP_GRACE_MS);
+  }
+  /** The user's answer from the browser. An unknown or already answered id does nothing. */
+  answer(questionId, choice) {
+    const q = this.questions.get(questionId);
+    if (!q) return false;
+    this.questions.delete(questionId);
+    q.timer.cancel();
+    q.resolve(choice);
+    return true;
+  }
+  denyAll(_why) {
+    for (const [id, q] of this.questions) {
+      this.questions.delete(id);
+      q.timer.cancel();
+      q.resolve(null);
+    }
+  }
+  /** Called by the permit server for this session's key. */
+  async onPermit(req) {
+    const name = req.tool_name;
+    const input = req.input;
+    if (ALLOWED_UP_FRONT.includes(name)) return { behavior: "allow", updatedInput: input };
+    if (READ_TOOLS.has(name) && insideDir(this.d.paths.work, name === "Read" ? input.file_path : input.path)) return { behavior: "allow", updatedInput: input };
+    if (!this.child) return { behavior: "deny", message: "The session is not running." };
+    const questionId = `q_${crypto2.randomBytes(12).toString("base64url")}`;
+    let summary;
+    let options;
+    let kind;
+    if (name === "AskUserQuestion") {
+      kind = "ask";
+      const qs = Array.isArray(input.questions) ? input.questions : [];
+      const first = isObj2(qs[0]) ? qs[0] : {};
+      summary = capText(stripControlChars(typeof first.question === "string" ? first.question : "A question from the orchestrator"), ORCH_LIMITS.questionSummary);
+      const opts = Array.isArray(first.options) ? first.options : [];
+      options = opts.map((o) => isObj2(o) && typeof o.label === "string" ? o.label : typeof o === "string" ? o : "").map((l) => capText(stripControlChars(l), ORCH_LIMITS.optionText)).filter((l) => l.trim() !== "").slice(0, ORCH_LIMITS.optionCount);
+    } else {
+      kind = "permission";
+      summary = capText(`${name}: ${toolSummary(name, input, ORCH_LIMITS.questionSummary)}`, ORCH_LIMITS.questionSummary);
+      options = ["allow", "deny"];
+    }
+    const choice = await new Promise((resolve) => {
+      const timer = this.d.setTimer(() => {
+        if (this.questions.delete(questionId)) resolve(null);
+      }, ORCH_LIMITS.questionTimeoutSec * 1e3);
+      this.questions.set(questionId, { kind, resolve, timer });
+      this.emit([
+        { type: "question", body: { question_id: questionId, kind, tool: capText(stripControlChars(name), 100), summary, ...options.length > 0 ? { options } : {} } }
+      ]);
+      this.status("waiting_input");
+    });
+    if (this.child && this.questions.size === 0) this.status("working");
+    if (kind === "ask") {
+      if (choice === null) return { behavior: "deny", message: "The user did not answer." };
+      return { behavior: "deny", message: `The user answered through HiveFloor: ${choice.slice(0, ORCH_LIMITS.optionText)}` };
+    }
+    if (choice === "allow") return { behavior: "allow", updatedInput: input };
+    return { behavior: "deny", message: choice === null ? "No answer from the user in time; denied." : "The user denied this." };
+  }
+};
+
+// src/service/orch/runtimes.ts
+import fs9 from "fs";
+import path8 from "path";
+var OK_TTL_MS = 5 * 6e4;
+var LIMITED_TTL_MS = 2 * 6e4;
+var FAIL_TTL_MS = 6e4;
+var STALE_MS = 30 * 6e4;
+var PROBE_TIMEOUT_MS = 6e3;
+function cachedLoginInfo(read, now = Date.now, timeoutMs = PROBE_TIMEOUT_MS) {
+  const cache = /* @__PURE__ */ new Map();
+  return async (dir) => {
+    const c = cache.get(dir);
+    const t = now();
+    if (c?.good && t - c.at < (limitedOf(c.good.state) ? LIMITED_TTL_MS : OK_TTL_MS) && c.failedAt === void 0) return c.good.state;
+    if (c?.failedAt !== void 0 && t - c.failedAt < FAIL_TTL_MS) return c.good && t - c.good.at < STALE_MS ? c.good.state : void 0;
+    let state;
+    let timer;
+    try {
+      state = await Promise.race([read(dir), new Promise((r) => {
+        timer = setTimeout(() => r(void 0), timeoutMs);
+      })]);
+    } catch {
+      state = void 0;
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+    if (state) {
+      cache.set(dir, { at: t, good: { at: t, state } });
+      return state;
+    }
+    cache.set(dir, { at: t, ...c?.good ? { good: c.good } : {}, failedAt: t });
+    return c?.good && t - c.good.at < STALE_MS ? c.good.state : void 0;
+  };
+}
+var sharedInfo;
+var realLoginInfo = (dir) => (sharedInfo ??= cachedLoginInfo((d) => readClaudeLogin(nodeDeps(), d)))(dir);
+var limitedOf = (s) => {
+  const full = s.windows.filter((w) => w.percent >= 100);
+  if (full.length === 0) return void 0;
+  const times = full.map((w) => w.resets_at).filter((x) => !!x).sort();
+  const last = times[times.length - 1];
+  return last ? { resetsAt: last } : {};
+};
+function shortResets(iso, timeZone) {
+  const d = new Date(iso);
+  if (Number.isNaN(d.getTime())) return void 0;
+  const parts = new Intl.DateTimeFormat("en-US", { timeZone, month: "short", day: "numeric", hour: "numeric", minute: "2-digit", hour12: true }).formatToParts(d);
+  const g = (t) => parts.find((p) => p.type === t)?.value ?? "";
+  const min = g("minute");
+  return `${g("month")} ${g("day")} ${g("hour")}${min && min !== "00" ? `:${min}` : ""}${g("dayPeriod").toLowerCase()}`.slice(0, 40);
+}
+function usageOf(s, timeZone) {
+  if (!s || s.windows.length === 0) return void 0;
+  const lim = limitedOf(s);
+  if (!lim) return { usage: "ok" };
+  const resets = lim.resetsAt ? shortResets(lim.resetsAt, timeZone) : void 0;
+  return { usage: "limited", ...resets ? { resets } : {} };
+}
+var signedIn = (dir) => {
+  try {
+    return fs9.statSync(dir).isDirectory() && (fs9.existsSync(path8.join(dir, ".credentials.json")) || process.platform === "darwin");
+  } catch {
+    return false;
+  }
+};
+function claudeLogins(installedDirs, homeDir = home(), states = /* @__PURE__ */ new Map(), timeZone) {
+  const std = path8.join(homeDir, ".claude");
+  const dirs = [std, ...installedDirs.filter((d) => path8.resolve(d) !== path8.resolve(std))].filter((d, i, a) => a.indexOf(d) === i);
+  const keys = profileKeys("claude", dirs, homeDir);
+  const out = [];
+  for (const d of dirs) {
+    if (!signedIn(d)) continue;
+    const id = keys.get(d);
+    const st = states.get(d);
+    const tag = st?.accountKey ? ` \xB7 #${st.accountKey.slice(0, 4)}` : "";
+    out.push({ id, label: `${claudeLabel(d, id, st?.plan)}${tag}`.slice(0, 120), dir: d, ...usageOf(st, timeZone) });
+    if (out.length >= 20) break;
+  }
+  return out;
+}
+async function claudeVersion(run, bin = "claude") {
+  const r = await run(bin, ["--version"], { timeoutMs: 5e3 });
+  if (r.code !== 0) return void 0;
+  const v = r.stdout.trim().split(/\s+/)[0] ?? "";
+  return /^[0-9][0-9A-Za-z.+-]{0,39}$/.test(v) ? v : void 0;
+}
+async function orchRuntimes(run, installedDirs, resolveBin = resolveClaudeBin, loginInfo, homeDir = home()) {
+  const version = await claudeVersion(run, await resolveBin() ?? "claude");
+  if (!version) return { runtimes: [], logins: [] };
+  const states = /* @__PURE__ */ new Map();
+  if (loginInfo) {
+    const dirs = claudeLogins(installedDirs, homeDir).map((l) => l.dir);
+    await Promise.all(dirs.map(async (d) => states.set(d, await loginInfo(d).catch(() => void 0))));
+  }
+  const logins = claudeLogins(installedDirs, homeDir, states);
+  return {
+    runtimes: [{ runtime: "claude", version, logins: logins.map(({ id, label, usage, resets }) => ({ id, label, ...usage ? { usage } : {}, ...resets ? { resets } : {} })) }],
+    logins
+  };
+}
+
+// src/service/orch/spawn.ts
+import { spawn } from "child_process";
+var realSpawn = (file, args, opts) => {
+  const child = spawn(file, args, { cwd: opts.cwd, env: opts.env, shell: false, windowsHide: true, stdio: ["pipe", "pipe", "pipe"] });
+  let exited = false;
+  let result = [null, null];
+  const cbs = [];
+  const done = (code, signal) => {
+    if (exited) return;
+    exited = true;
+    result = [code, signal];
+    for (const cb of cbs) cb(code, signal);
+  };
+  child.on("error", () => done(null, null));
+  child.on("exit", (code, signal) => done(code, signal));
+  child.stdin.on("error", () => void 0);
+  return {
+    pid: child.pid,
+    stdin: child.stdin,
+    stdout: child.stdout,
+    stderr: child.stderr,
+    // Only the child this handle started, and only while it runs: a pid is never signalled after its exit.
+    kill: (signal) => {
+      if (!exited) child.kill(signal);
+    },
+    onExit: (cb) => {
+      if (exited) cb(...result);
+      else cbs.push(cb);
+    }
+  };
+};
+
+// src/service/orch/transcript.ts
+import fs10 from "fs";
+import path9 from "path";
+var TRANSCRIPT_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+var CWD_SCAN_BYTES = 4 * 1024 * 1024;
+var PROJECT_NAME_EXACT_MAX = 200;
+var encodeProjectDir = (cwd) => cwd.replace(/[^A-Za-z0-9]/g, "-");
+function nameMatches(folder, cwd) {
+  const enc = encodeProjectDir(cwd);
+  if (enc === folder) return true;
+  return enc.length > PROJECT_NAME_EXACT_MAX && folder.startsWith(enc.slice(0, PROJECT_NAME_EXACT_MAX));
+}
+function readTranscriptCwd(file, folder) {
+  let fd;
+  try {
+    fd = fs10.openSync(file, fs10.constants.O_RDONLY | fs10.constants.O_NOFOLLOW);
+  } catch {
+    return void 0;
+  }
+  try {
+    const size = fs10.fstatSync(fd).size;
+    const buf = Buffer.alloc(Math.min(size, CWD_SCAN_BYTES));
+    let got = 0;
+    while (got < buf.length) {
+      const n = fs10.readSync(fd, buf, got, buf.length - got, got);
+      if (n <= 0) break;
+      got += n;
+    }
+    const lines = buf.subarray(0, got).toString("utf8").split("\n");
+    if (size > got) lines.pop();
+    for (const line of lines) {
+      if (!line.includes('"cwd"')) continue;
+      let j;
+      try {
+        j = JSON.parse(line);
+      } catch {
+        continue;
+      }
+      if (typeof j !== "object" || j === null) continue;
+      const cwd = j.cwd;
+      if (typeof cwd === "string" && path9.isAbsolute(cwd) && !cwd.includes("\0") && nameMatches(folder, cwd)) return cwd;
+    }
+    return void 0;
+  } catch {
+    return void 0;
+  } finally {
+    fs10.closeSync(fd);
+  }
+}
+var isRealDir = (p) => {
+  try {
+    return fs10.lstatSync(p).isDirectory();
+  } catch {
+    return false;
+  }
+};
+var isRealFile = (p) => {
+  try {
+    return fs10.lstatSync(p).isFile();
+  } catch {
+    return false;
+  }
+};
+function findTranscript(id, configDirs) {
+  if (!TRANSCRIPT_ID_RE.test(id)) return void 0;
+  let best;
+  const seen = /* @__PURE__ */ new Set();
+  for (const dir of configDirs) {
+    const projects = path9.join(dir, "projects");
+    if (seen.has(path9.resolve(projects))) continue;
+    seen.add(path9.resolve(projects));
+    let names;
+    try {
+      names = fs10.readdirSync(projects, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const n of names) {
+      if (!n.isDirectory()) continue;
+      const file = path9.join(projects, n.name, `${id}.jsonl`);
+      let st;
+      try {
+        st = fs10.lstatSync(file);
+      } catch {
+        continue;
+      }
+      if (!st.isFile()) continue;
+      if (best && best.mtime >= st.mtimeMs) continue;
+      best = { f: { id, configDir: dir, projectDir: path9.join(projects, n.name), file, cwd: void 0 }, mtime: st.mtimeMs };
+    }
+  }
+  if (!best) return void 0;
+  best.f.cwd = readTranscriptCwd(best.f.file, path9.basename(best.f.projectDir));
+  return best.f;
+}
+function usableDir(dir) {
+  if (dir === void 0 || !path9.isAbsolute(dir)) return false;
+  try {
+    return fs10.statSync(dir).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function ensureDir(dir) {
+  fs10.mkdirSync(dir, { recursive: true, mode: 448 });
+  return fs10.realpathSync(dir);
+}
+var stableDirFor = (homeDir, id) => path9.join(homeDir, "hivefloor", "orchestrators", id.slice(0, 8));
+var mainDirFor = (homeDir) => path9.join(homeDir, "hivefloor", "orchestrators", "main");
+var noLinks = (src) => {
+  try {
+    return !fs10.lstatSync(src).isSymbolicLink();
+  } catch {
+    return false;
+  }
+};
+function placeTranscript(found, configDir2, cwd) {
+  const sameCwd = found.cwd !== void 0 && path9.resolve(found.cwd) === path9.resolve(cwd);
+  const folder = sameCwd ? path9.basename(found.projectDir) : encodeProjectDir(cwd);
+  const destProject = path9.join(configDir2, "projects", folder);
+  const dest = path9.join(destProject, `${found.id}.jsonl`);
+  try {
+    if (path9.resolve(dest) === path9.resolve(found.file)) return { ok: true, how: "in_place", file: dest };
+    if (fs10.existsSync(dest)) return isRealFile(dest) ? { ok: true, how: "kept_copy", file: dest } : { ok: false, reason: "the place for the copy is taken by something that is not a file" };
+    fs10.mkdirSync(destProject, { recursive: true, mode: 448 });
+    fs10.copyFileSync(found.file, dest, fs10.constants.COPYFILE_EXCL);
+    fs10.chmodSync(dest, 384);
+    for (const extra of ["memory", found.id]) {
+      const from = path9.join(found.projectDir, extra);
+      const to = path9.join(destProject, extra);
+      if (!isRealDir(from) || fs10.existsSync(to)) continue;
+      try {
+        fs10.cpSync(from, to, { recursive: true, force: false, errorOnExist: false, filter: noLinks });
+      } catch {
+      }
+    }
+    return { ok: true, how: "copied", file: dest };
+  } catch (e) {
+    return { ok: false, reason: e.message };
+  }
+}
+
+// src/service/orch/loop.ts
+var ORCH_POLL_WAIT_SEC = 25;
+var ORCH_POLL_TIMEOUT_MS = 35e3;
+var ORCH_OFF_SLEEP_MS = 15e3;
+var ORCH_SWITCH_CHECK_MS = 2e3;
+var INFO_EVERY_MS = 5 * 6e4;
+var OUTBOX_MAX = 4;
+var ORCH_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,127}$/;
+var orchDir = () => path10.join(configDir(), "orchestrator");
+var startKey = (a) => JSON.stringify([a.runtime, a.model, a.effort, a.login_id ?? null, a.mode, a.external_id ?? null, a.power ?? "safe", a.permission_mode ?? "default", a.chrome === true, a.keep_awake === true, a.cwd ?? "auto"]);
+var FULL_OFF_MESSAGE = 'Full power is not turned on on this machine. Run "hivefloor orch enable --full" on it, then start again.';
+var realTimer = (fn, ms) => {
+  const t = setTimeout(fn, ms);
+  t.unref?.();
+  return { cancel: () => clearTimeout(t) };
+};
+var Orchestrator = class {
+  constructor(d) {
+    this.d = d;
+    this.dir = d.dir ?? orchDir();
+    this.seen = new SeenIds(path10.join(this.dir, "state", "seen.json"));
+  }
+  d;
+  sessions = /* @__PURE__ */ new Map();
+  outboxes = /* @__PURE__ */ new Map();
+  permit;
+  fleet;
+  seen;
+  logins = [];
+  lastInfo = "";
+  lastInfoAt = -Infinity;
+  /** Every orch/info send runs through this one chain: a full-power report from the watcher and a round's info can't overlap, so the later one (built from the later state) always lands last. */
+  infoChain = Promise.resolve();
+  enabled = false;
+  fullAllowed = false;
+  startKeys = /* @__PURE__ */ new Map();
+  reconciled = false;
+  dir;
+  log(line) {
+    this.d.log?.(line);
+  }
+  machine() {
+    return (this.d.readMachine ?? readMachine)();
+  }
+  outbox(orchId, m) {
+    let o = this.outboxes.get(orchId);
+    if (o) return o;
+    this.evictOutboxes();
+    const idPath = encodeURIComponent(orchId);
+    o = new Outbox(this.stateFile(orchId), {
+      post: async (events) => {
+        try {
+          const r = await apiRequest(this.d.ctx, m.host, `/api/v1/machine/orch/${idPath}/events`, { method: "POST", token: m.token, body: { events }, timeoutMs: 15e3 });
+          if (r.status === 200 && isRecord(r.json) && typeof r.json.acked_src_seq === "number") return { kind: "ok", acked: r.json.acked_src_seq };
+          if (r.status === 400 || r.status === 413) return { kind: "bad" };
+          if (r.status === 404) return { kind: "gone" };
+          if (r.status === 401) return { kind: "revoked" };
+          return { kind: "retry" };
+        } catch {
+          return { kind: "retry" };
+        }
+      },
+      cursor: async () => {
+        try {
+          const r = await apiRequest(this.d.ctx, m.host, `/api/v1/machine/orch/${idPath}/cursor`, { token: m.token, timeoutMs: 1e4 });
+          if (r.status === 200 && isRecord(r.json) && typeof r.json.acked_src_seq === "number") return r.json.acked_src_seq;
+        } catch {
+        }
+        return void 0;
+      },
+      sleep: (ms) => this.d.ctx.sleep(ms),
+      log: (l) => this.log(`orchestrator ${orchId}: ${l}`)
+    });
+    this.outboxes.set(orchId, o);
+    return o;
+  }
+  stateFile(orchId) {
+    return path10.join(this.dir, "state", `${fileKey(orchId)}.json`);
+  }
+  /** Keep at most OUTBOX_MAX outboxes: drop idle ones that no running session uses, oldest first. */
+  evictOutboxes() {
+    for (const [id, o] of this.outboxes) {
+      if (this.outboxes.size < OUTBOX_MAX) return;
+      if (o.size > 0 || this.sessions.has(id)) continue;
+      this.outboxes.delete(id);
+      fs11.rmSync(this.stateFile(id), { force: true });
+    }
+  }
+  async ensurePermit() {
+    if (this.permit) return this.permit;
+    const p = new PermitServer(path10.join(this.dir, "run", "permit.sock"));
+    await p.listen();
+    this.permit = p;
+    return p;
+  }
+  async ensureFleet() {
+    if (this.fleet) return this.fleet;
+    const f = new FleetServer(path10.join(this.dir, "run", "fleet.sock"));
+    await f.listen();
+    this.fleet = f;
+    return f;
+  }
+  /** One fleet read for an orchestrator: relayed to the server with this machine's credentials (the child holds none). */
+  fleetCall(orchId, m0) {
+    const idPath = encodeURIComponent(orchId);
+    return async (tool, args) => {
+      const m = this.machine() ?? m0;
+      try {
+        const r = await apiRequest(this.d.ctx, m.host, `/api/v1/machine/orch/${idPath}/fleet`, { method: "POST", token: m.token, body: { tool, args }, timeoutMs: 2e4 });
+        if (r.status === 200 && isRecord(r.json) && typeof r.json.text === "string") return { ok: true, text: r.json.text };
+        if (r.status === 404) return { ok: false, error: "Not found (or not yours)." };
+        if (r.status === 401) return { ok: false, error: "This machine is not signed in to HiveFloor." };
+        if (r.status === 429) return { ok: false, error: "Too many fleet reads; wait a moment." };
+        return { ok: false, error: "The HiveFloor server could not answer that." };
+      } catch {
+        return { ok: false, error: "The HiveFloor server is not reachable." };
+      }
+    };
+  }
+  /** Events for a session that is not running here (an error, then `stopped`), so the server's state follows. */
+  report(orchId, m, events) {
+    const o = this.outbox(orchId, m);
+    o.push(events);
+    void o.flush();
+  }
+  notRunning(orchId, m, code, message) {
+    this.report(orchId, m, [
+      { type: "error", body: { code, message } },
+      { type: "status", body: { state: "stopped", detail: message.slice(0, 300) } }
+    ]);
+  }
+  control() {
+    return (this.d.readControl ?? readControl)();
+  }
+  /** Every Claude config dir a transcript may be under: the standard one, then the signed-in logins. */
+  configDirs() {
+    return [path10.join(this.d.home ?? home(), ".claude"), ...this.logins.map((l) => l.dir)];
+  }
+  /**
+   * Where a full-power session runs and what it resumes. A fresh one: `~/hivefloor/orchestrators/main`. One with an id: the folder
+   * its transcript names, or the stable folder when asked (`cwd: 'stable'`) or when that folder is gone; the transcript is copied
+   * there first (transcript.ts). Returns a refusal as `{ code, message }`.
+   */
+  fullPlan(args, login, resume) {
+    const homeDir = this.d.home ?? home();
+    const std = path10.join(homeDir, ".claude");
+    const configOf = (dir) => dir === void 0 || path10.resolve(dir) === path10.resolve(std) ? void 0 : dir;
+    const attached = args.mode === "attached";
+    try {
+      if (resume === null) return { work: ensureDir(mainDirFor(homeDir)), configDir: configOf(login?.dir), resumeId: null };
+      const found = TRANSCRIPT_ID_RE.test(resume) ? findTranscript(resume, this.configDirs()) : void 0;
+      if (!found) {
+        if (attached) return { code: "session_not_found", message: "No Claude Code session with that id was found on this machine." };
+        return { work: ensureDir(mainDirFor(homeDir)), configDir: configOf(login?.dir), resumeId: null, note: "The earlier conversation was not found on this machine; this is a new one." };
+      }
+      const dir = args.login_id === null || !login ? found.configDir : login.dir;
+      const stable = args.cwd === "stable" || !usableDir(found.cwd);
+      const work = stable ? ensureDir(stableDirFor(homeDir, found.id)) : found.cwd;
+      const placed = placeTranscript(found, dir, work);
+      if (!placed.ok) return { code: "resume_failed", message: `The session could not be made ready to resume: ${placed.reason}`.slice(0, 900) };
+      const note = !stable ? void 0 : placed.how !== "copied" ? `Resumed from the copy already in ${work}.` : args.cwd === "stable" ? `Copied to ${work} and resumed there.` : `Its folder is gone, so it was copied to ${work} and resumed there.`;
+      return { work, configDir: configOf(dir), resumeId: found.id, ...note ? { note } : {} };
+    } catch (e) {
+      return { code: "resume_failed", message: `The session's folder could not be made ready: ${e.message}`.slice(0, 900) };
+    }
+  }
+  async start(orchId, m, args) {
+    const cur = this.sessions.get(orchId);
+    const key = startKey(args);
+    if (cur?.running && this.startKeys.get(orchId) === key && !args.brief) return;
+    for (const [id, s2] of this.sessions) {
+      s2.stop();
+      this.sessions.delete(id);
+    }
+    this.startKeys.clear();
+    const full = args.power === "full";
+    if (args.runtime !== "claude") return this.notRunning(orchId, m, "unsupported", `This version of the HiveFloor service runs only Claude sessions.`);
+    if (args.mode !== "spawned" && !full) return this.notRunning(orchId, m, "unsupported", "Resuming a session by its id needs full power on this machine.");
+    if (full && !orchestratorFullOn(this.control())) return this.notRunning(orchId, m, "full_not_allowed", FULL_OFF_MESSAGE);
+    if (this.logins.length === 0) await this.refreshInfo(m, true);
+    const login = args.login_id === null || args.login_id === "default" ? this.logins.find((l) => l.id === "default") : this.logins.find((l) => l.id === args.login_id);
+    if (!login && args.login_id !== null) return this.notRunning(orchId, m, "login_unknown", "That login is not signed in on this machine.");
+    const asked = args.resume_id ?? args.external_id ?? null;
+    let resumeId = asked ? safeId(asked, "") || null : null;
+    if (args.mode === "attached" && resumeId === null) return this.notRunning(orchId, m, "session_not_found", "No session id was given to resume.");
+    let work = path10.join(this.dir, "work");
+    let configDir2 = login && login.id !== "default" ? login.dir : void 0;
+    let note;
+    if (full) {
+      const plan = this.fullPlan(args, login, resumeId);
+      if ("code" in plan) return this.notRunning(orchId, m, plan.code, plan.message);
+      ({ work, configDir: configDir2, resumeId } = plan);
+      note = plan.note;
+    }
+    const cfg = {
+      orchId,
+      model: args.model,
+      effort: args.effort,
+      configDir: configDir2,
+      resumeId,
+      power: full ? "full" : "safe",
+      permissionMode: full ? args.permission_mode ?? "default" : "default",
+      chrome: full && args.chrome === true,
+      keepAwake: args.keep_awake === true,
+      brief: args.mode === "spawned" ? args.brief ?? null : null
+    };
+    let permit;
+    try {
+      permit = await this.ensurePermit();
+    } catch (e) {
+      return this.notRunning(orchId, m, "permit_failed", `The permission channel could not start: ${e.message}`.slice(0, 900));
+    }
+    let fleet;
+    try {
+      fleet = await this.ensureFleet();
+    } catch (e) {
+      return this.notRunning(orchId, m, "fleet_failed", `The fleet tools channel could not start: ${e.message}`.slice(0, 900));
+    }
+    const claudeBin = await (this.d.claudeBin ?? resolveClaudeBin)();
+    const deps = {
+      spawn: this.d.spawn ?? realSpawn,
+      ...claudeBin ? { claudeBin } : {},
+      outbox: this.outbox(orchId, m),
+      permit,
+      fleet,
+      fleetCall: this.fleetCall(orchId, m),
+      fullAllowed: () => orchestratorFullOn(this.control()),
+      paths: { work, run: path10.join(this.dir, "run") },
+      cli: this.d.cli ?? { node: process.execPath, entry: cliEntry() },
+      env: this.d.ctx.env,
+      now: this.d.ctx.now,
+      setTimer: this.d.setTimer ?? realTimer,
+      log: (l) => this.log(l),
+      ...this.d.platform ? { platform: this.d.platform } : {}
+    };
+    const s = new OrchSession(cfg, deps);
+    this.sessions.set(orchId, s);
+    this.startKeys.set(orchId, key);
+    if (note) this.report(orchId, m, [{ type: "status", body: { state: "starting", detail: note.slice(0, 300) } }]);
+    s.start();
+    if (s.ended) {
+      this.sessions.delete(orchId);
+      this.startKeys.delete(orchId);
+      return this.log(`orchestrator ${orchId}: not started, full power is off on this machine`);
+    }
+    this.log(`orchestrator ${orchId}: started (${args.model}, ${args.effort}, ${cfg.power}${full ? `, ${cfg.permissionMode}` : ""}${resumeId ? ", resumed" : ""})`);
+  }
+  async handle(cmd, m) {
+    if (!ORCH_ID_RE.test(cmd.orch_id)) return this.log(`orchestrator: ignored a ${cmd.kind} for a malformed session id`);
+    if (this.seen.seenBefore(`orch:${cmd.id}`, this.d.ctx.now())) return;
+    const s = this.sessions.get(cmd.orch_id);
+    switch (cmd.kind) {
+      case "orch_start":
+        await this.start(cmd.orch_id, m, cmd.args);
+        break;
+      case "orch_send":
+        if (!s?.running || !s.send(cmd.args.text)) this.notRunning(cmd.orch_id, m, "not_running", "The session is not running on this machine; start it again from Settings.");
+        break;
+      case "orch_answer":
+        s?.answer(cmd.args.question_id, cmd.args.choice);
+        break;
+      case "orch_interrupt":
+        s?.interrupt();
+        break;
+      case "orch_stop":
+        if (s) {
+          s.stop();
+          this.sessions.delete(cmd.orch_id);
+          this.startKeys.delete(cmd.orch_id);
+        } else this.report(cmd.orch_id, m, [{ type: "status", body: { state: "stopped" } }]);
+        break;
+    }
+  }
+  stopAll() {
+    for (const [id, s] of this.sessions) {
+      s.stop();
+      this.sessions.delete(id);
+    }
+    this.startKeys.clear();
+  }
+  /** Full power was switched off on this machine: a session that runs with it ends now. */
+  stopFull(m) {
+    for (const [id, s] of this.sessions) {
+      if (s.cfg.power !== "full") continue;
+      if (m && !s.ended) this.report(id, m, [{ type: "error", body: { code: "full_not_allowed", message: "Full power was turned off on this machine, so the session was stopped." } }]);
+      s.stop();
+      this.sessions.delete(id);
+      this.startKeys.delete(id);
+    }
+  }
+  /**
+   * The local switches, read between rounds (every ORCH_SWITCH_CHECK_MS while the loop runs): a round can sit in a long-poll or
+   * a backoff for a long time, and turning the orchestrator or full power off must not wait for it, or for the network.
+   * It only stops sessions; the next round tells the server.
+   */
+  enforceSwitch() {
+    if (this.sessions.size === 0) return;
+    const ctl = this.control();
+    if (!orchestratorOn(ctl)) this.stopAll();
+    else if (!orchestratorFullOn(ctl)) this.stopFull(this.machine());
+  }
+  /**
+   * Has this machine's own switch (orchestrator or full power) changed since the last round reported it? The loop wakes from its
+   * off-sleep on this, so `hivefloor orch enable` shows in the machine list within seconds, with no service restart.
+   */
+  switchPending() {
+    const ctl = this.control();
+    return orchestratorOn(ctl) !== this.enabled || orchestratorFullOn(ctl) !== this.fullAllowed;
+  }
+  /**
+   * Full power was switched while the orchestrator stays on (`hivefloor orch enable --full`, or `--no-full`): tell the server now, from
+   * the file as it is now, instead of at the end of the long-poll round that is in flight. Turning the orchestrator itself on or off
+   * is the round's job (it also reconciles); this only handles the full-power flag.
+   */
+  async reportFullChange() {
+    const m = this.machine();
+    if (!m || m.revoked || !this.enabled) return;
+    const ctl = this.control();
+    if (!orchestratorOn(ctl)) return;
+    const fullOn = orchestratorFullOn(ctl);
+    if (fullOn === this.fullAllowed) return;
+    this.fullAllowed = fullOn;
+    if (!fullOn) this.stopFull(m);
+    await this.refreshInfo(m, true);
+  }
+  refreshInfo(m, force = false) {
+    const run = this.infoChain.then(() => this.sendInfo(m, force));
+    this.infoChain = run.catch(() => void 0);
+    return run;
+  }
+  async sendInfo(m, force) {
+    const now = this.d.ctx.now();
+    let runtimes = [];
+    if (this.enabled) {
+      const r = await orchRuntimes(this.d.run ?? runFile, m.installed.claude_dirs, this.d.claudeBin ?? resolveClaudeBin, this.d.loginInfo ?? realLoginInfo);
+      runtimes = r.runtimes;
+      this.logins = r.logins;
+    }
+    const body = { enabled: this.enabled, runtimes, ...this.enabled && this.fullAllowed ? { full_allowed: true } : {} };
+    const key = JSON.stringify(body);
+    if (!force && key === this.lastInfo && now - this.lastInfoAt < INFO_EVERY_MS) return;
+    try {
+      const r = await apiRequest(this.d.ctx, m.host, "/api/v1/machine/orch/info", { method: "POST", token: m.token, body, timeoutMs: 1e4 });
+      if (r.status === 204 || r.status === 200) {
+        this.lastInfo = key;
+        this.lastInfoAt = now;
+      }
+    } catch {
+    }
+  }
+  /** After a service restart (or switching on): run what the server says should be running. */
+  async reconcile(m) {
+    const r = await apiRequest(this.d.ctx, m.host, "/api/v1/machine/orch/session", { token: m.token, timeoutMs: 1e4 });
+    if (r.status !== 200 || !isRecord(r.json)) throw new Error(`session: ${r.status}`);
+    const s = r.json.session;
+    if (!isRecord(s) || typeof s.id !== "string") {
+      this.stopAll();
+    } else if (!ORCH_ID_RE.test(s.id)) {
+      this.stopAll();
+    } else if (!this.sessions.get(s.id)?.running) {
+      const args = { runtime: s.runtime, model: s.model, effort: s.effort, login_id: s.login_id ?? null, resume_id: s.resume_id ?? null, mode: s.mode, external_id: s.external_id ?? null };
+      for (const k of ["power", "permission_mode", "chrome", "keep_awake", "cwd", "brief"]) if (s[k] !== void 0 && s[k] !== null) args[k] = s[k];
+      const c = orchCommandSchema.safeParse({ id: "reconcile", orch_id: s.id, kind: "orch_start", args });
+      if (!c.success || c.data.kind !== "orch_start") this.notRunning(s.id, m, "bad_session", "The session settings from the server were not valid; nothing was started.");
+      else await this.start(s.id, m, c.data.args);
+    }
+    this.reconciled = true;
+  }
+  /** One round: switch, info, reconcile, one long-poll. 'off' and 'revoked' tell the caller to sleep. */
+  async step() {
+    const m = this.machine();
+    if (!m || m.revoked) return "revoked";
+    const ctl = this.control();
+    const on = orchestratorOn(ctl);
+    const fullOn = orchestratorFullOn(ctl);
+    if (on !== this.enabled || fullOn !== this.fullAllowed) {
+      if (on !== this.enabled) this.reconciled = false;
+      this.enabled = on;
+      this.fullAllowed = fullOn;
+      if (!on) this.stopAll();
+      else if (!fullOn) this.stopFull(m);
+      await this.refreshInfo(m, true);
+    } else {
+      await this.refreshInfo(m);
+    }
+    if (!on) return "off";
+    for (const o of this.outboxes.values()) if (o.size > 0) void o.flush();
+    if (!this.reconciled) await this.reconcile(m);
+    const r = await apiRequest(this.d.ctx, m.host, `/api/v1/machine/orch/commands?wait=${ORCH_POLL_WAIT_SEC}`, { token: m.token, timeoutMs: ORCH_POLL_TIMEOUT_MS });
+    if (r.status === 401) return "revoked";
+    if (r.status !== 200) return "error";
+    const parsed = orchCommandsResponseSchema.safeParse(r.json);
+    if (!parsed.success) return "error";
+    const after = this.control();
+    if (!orchestratorOn(after)) return "ok";
+    if (!orchestratorFullOn(after)) this.stopFull(m);
+    for (const cmd of parsed.data.commands) {
+      try {
+        await this.handle(cmd, m);
+      } catch (e) {
+        this.log(`orchestrator: ${cmd.kind} failed: ${e.message}`);
+      }
+    }
+    return "ok";
+  }
+  async close() {
+    this.stopAll();
+    await this.permit?.close();
+    this.permit = void 0;
+    await this.fleet?.close();
+    this.fleet = void 0;
+  }
+};
+async function orchLoop(d, stopped, backoff) {
+  if (process.platform === "win32") return;
+  const o = new Orchestrator(d);
+  let failures = 0;
+  let wake;
+  const watch = setInterval(() => {
+    try {
+      o.enforceSwitch();
+    } catch {
+    }
+    try {
+      if (!o.switchPending()) return;
+      if (wake) wake();
+      else void o.reportFullChange().catch(() => void 0);
+    } catch {
+    }
+  }, d.switchCheckMs ?? ORCH_SWITCH_CHECK_MS);
+  watch.unref();
+  try {
+    while (!stopped()) {
+      let r;
+      try {
+        r = await o.step();
+      } catch {
+        r = "error";
+      }
+      if (r === "ok") failures = 0;
+      else if (r === "error") {
+        failures += 1;
+        await d.ctx.sleep(backoff(failures));
+      } else {
+        await Promise.race([d.ctx.sleep(ORCH_OFF_SLEEP_MS), new Promise((resolve) => {
+          if (r === "off") wake = resolve;
+        })]);
+        wake = void 0;
+      }
+    }
+  } finally {
+    clearInterval(watch);
+    await o.close();
+  }
+}
+
 // src/service/run.ts
 var FLUSH_EVERY_MS = 2e3;
 var FLUSH_BUDGET_MS = 5e3;
@@ -1822,22 +3694,22 @@ function log(st, now, state) {
   if (st.logged === state) return;
   st.logged = state;
   try {
-    fs2.mkdirSync(configDir(), { recursive: true, mode: 448 });
+    fs12.mkdirSync(configDir(), { recursive: true, mode: 448 });
     const f = serviceLogFile();
     let size = 0;
     try {
-      size = fs2.statSync(f).size;
+      size = fs12.statSync(f).size;
     } catch {
     }
-    if (size > LOG_MAX_BYTES) fs2.writeFileSync(f, "", { mode: 384 });
-    fs2.appendFileSync(f, `${new Date(now).toISOString()} ${state}
+    if (size > LOG_MAX_BYTES) fs12.writeFileSync(f, "", { mode: 384 });
+    fs12.appendFileSync(f, `${new Date(now).toISOString()} ${state}
 `, { mode: 384 });
   } catch {
   }
 }
-async function call(deps, m, path2, body) {
+async function call(deps, m, path11, body) {
   try {
-    const r = await apiRequest(deps.ctx, m.host, `/api/v1/machine${path2}`, { method: "POST", token: m.token, body, timeoutMs: 1e4 });
+    const r = await apiRequest(deps.ctx, m.host, `/api/v1/machine${path11}`, { method: "POST", token: m.token, body, timeoutMs: 1e4 });
     if (r.status >= 200 && r.status < 300) return { outcome: "ok", json: r.json };
     if (r.status === 401) return { outcome: "revoked" };
     if (r.status === 429 || r.status >= 500) return { outcome: "retry" };
@@ -1881,9 +3753,21 @@ async function serviceStep(deps, st) {
   if (now < st.quietUntil) return true;
   if (now >= st.heartbeat) {
     const stats = await collectStats(deps.collectors);
-    const r = await call(deps, m, "/heartbeat", { os: cliVersionOs(), cli_version: VERSION, ...stats ? { stats } : {} });
+    let ended = [];
+    try {
+      ended = await pickEndedSessions(readSessions(now), deps.proc ?? realProc(), now);
+    } catch {
+    }
+    const r = await call(deps, m, "/heartbeat", {
+      os: cliVersionOs(),
+      cli_version: VERSION,
+      ...stats ? { stats } : {},
+      control: activeVerbs(readControl()),
+      ...ended.length > 0 ? { ended_sessions: ended.map((e) => e.id) } : {}
+    });
     if (r.outcome === "revoked") return revoke();
     if (r.outcome === "ok") {
+      markSessionsEnded(ended, now);
       const parsed = machineHeartbeatResponseSchema.safeParse(r.json);
       const secs = parsed.success ? parsed.data.interval : MACHINE_HEARTBEAT_SECONDS;
       st.interval = Math.max(MACHINE_MIN_INTERVAL_SECONDS, secs) * 1e3;
@@ -1973,6 +3857,13 @@ async function runService(deps) {
   };
   process.on("SIGTERM", stop);
   process.on("SIGINT", stop);
+  if (deps.control !== false) {
+    void controlLoop({ ctx: deps.ctx, seen: new SeenIds(seenFile()), ...deps.control }, () => st.stop, (n) => backoffMs(n, deps.random ?? Math.random)).catch(() => void 0);
+  }
+  if (deps.orch !== false) {
+    void orchLoop({ ctx: deps.ctx, log: (l) => deps.ctx.err(`${l}
+`), ...deps.orch }, () => st.stop, (n) => backoffMs(n, deps.random ?? Math.random)).catch(() => void 0);
+  }
   try {
     while (!st.stop) {
       const more = await serviceStep(deps, st);
@@ -1981,6 +3872,7 @@ async function runService(deps) {
     }
     return 0;
   } finally {
+    st.stop = true;
     process.off("SIGTERM", stop);
     process.off("SIGINT", stop);
   }