@hyperdrive.bot/fleet-server 0.3.99

package/dist/server/server/bootstrap.js

@@ -0,0 +1,1597 @@
+import express from "express";
+import { createServer as createHTTPServer } from "http";
+import { constants, existsSync, unlinkSync } from "fs";
+import { open } from "fs/promises";
+import { randomUUID } from "node:crypto";
+import { hostname as getHostname, userInfo } from "node:os";
+import path from "node:path";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { z } from "zod";
+import { createBranchChangeRouteHandler } from "./script-route-branch-handler.js";
+function resolveBoundListenTarget(listenTarget, httpServer) {
+    if (listenTarget.type !== "tcp") {
+        return listenTarget;
+    }
+    const address = httpServer.address();
+    if (!address || typeof address === "string") {
+        throw new Error("HTTP server did not expose a TCP address after listening");
+    }
+    return {
+        type: "tcp",
+        host: listenTarget.host,
+        port: address.port,
+    };
+}
+// Matches a Windows drive-letter path like C:\ or D:\
+const WINDOWS_DRIVE_RE = /^[A-Za-z]:\\/;
+export function parseListenString(listen) {
+    // 1. Windows named pipes: \\.\pipe\... or pipe://...
+    if (listen.startsWith("\\\\.\\pipe\\") || listen.startsWith("pipe://")) {
+        return {
+            type: "pipe",
+            path: listen.startsWith("pipe://") ? listen.slice("pipe://".length) : listen,
+        };
+    }
+    // 2. Explicit unix:// prefix
+    if (listen.startsWith("unix://")) {
+        return { type: "socket", path: listen.slice(7) };
+    }
+    // 3. Reject Windows absolute drive paths — they are not Unix sockets
+    if (WINDOWS_DRIVE_RE.test(listen)) {
+        throw new Error(`Invalid listen string (Windows path is not a valid listen target): ${listen}`);
+    }
+    // 4. POSIX absolute path (/ or ~) — Unix socket
+    if (listen.startsWith("/") || listen.startsWith("~")) {
+        return { type: "socket", path: listen };
+    }
+    // 5. Pure numeric — TCP port on 127.0.0.1
+    const trimmed = listen.trim();
+    if (/^\d+$/.test(trimmed)) {
+        const port = parseInt(trimmed, 10);
+        return { type: "tcp", host: "127.0.0.1", port };
+    }
+    // 6. host:port — TCP
+    if (listen.includes(":")) {
+        const lastColonIdx = listen.lastIndexOf(":");
+        const host = listen.slice(0, lastColonIdx);
+        const portStr = listen.slice(lastColonIdx + 1);
+        const parsedPort = parseInt(portStr, 10);
+        if (!Number.isFinite(parsedPort)) {
+            throw new Error(`Invalid port in listen string: ${listen}`);
+        }
+        const cleanHost = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+        return { type: "tcp", host: cleanHost || "127.0.0.1", port: parsedPort };
+    }
+    throw new Error(`Invalid listen string: ${listen}`);
+}
+function formatListenTarget(listenTarget) {
+    if (!listenTarget) {
+        return null;
+    }
+    if (listenTarget.type === "tcp") {
+        return `${listenTarget.host}:${listenTarget.port}`;
+    }
+    return listenTarget.path;
+}
+import { VoiceAssistantWebSocketServer } from "./websocket-server.js";
+import { createPushSubsystem } from "./push/index.js";
+import { registerPushRoutes } from "./push/routes.js";
+import { registerAllSessionsRoute } from "./workspace/all-sessions-route.js";
+import { registerSessionsSearchRoute } from "./workspace/sessions-search-route.js";
+import { registerWorkspaceSessionsRoute } from "./workspace/sessions-route.js";
+import { PushSubscriptionStore } from "./push/subscriptions.js";
+import { loadOrGenerateVapidKeys } from "./push/vapid-keys.js";
+import { createGitHubService } from "../services/github-service.js";
+import { createPaseoWorktree as createRegisteredPaseoWorktree, createLocalCheckoutWorkspace, } from "./paseo-worktree-service.js";
+import { createPaseoWorktreeWorkflow } from "./worktree-session.js";
+import { DownloadTokenStore } from "./file-download/token-store.js";
+import { registerMeetingsRoutes } from "./meetings/meetings-http.js";
+import { registerCaptureRoutes } from "./meetings/capture-http.js";
+import { getCaptureStreamWs } from "./meetings/capture-stream-ws.js";
+import { createSpeechService } from "./speech/speech-runtime.js";
+import { AgentManager } from "./agent/agent-manager.js";
+import { scheduleSessionDigestRefresh } from "./agent/session-digest-generator.js";
+import { CardMoveLog } from "./agent/card-move-log.js";
+import { BlockerLog } from "./agent/blocker-log.js";
+import { AUTHORSHIP_ENV_FLAG, createAuthorshipLedger } from "./agent/authorship-ledger.js";
+import { AUTHORSHIP_MARKUP_ENV_FLAG, AUTHORSHIP_SPEAKER_ENV, createAuthorshipMarkup, } from "./agent/authorship-markup.js";
+import { JudgeRelayGate } from "./agent/judge-relay-gate.js";
+import { JarvisJudge } from "./agent/jarvis-judge.js";
+import { registerAgentRoutes } from "./agent/agent-routes.js";
+import { AgentStorage } from "./agent/agent-storage.js";
+import { attachAgentStoragePersistence } from "./persistence-hooks.js";
+import { writeRestartManifest } from "./restart-manifest.js";
+import { collectInFlightAgentIds, resumeAgentsAfterRestart } from "./resume-after-restart.js";
+import { WorkflowStorage } from "./workflow/workflow-storage.js";
+import { WORKFLOWS_FEATURE_ENABLED } from "./workflow/workflow-feature.js";
+import { registerWorkflowHttpRoutes } from "./workflow/workflow-http-routes.js";
+import { WorkflowManager } from "./workflow/workflow-manager.js";
+import { createAgentMcpServer } from "./agent/mcp-server.js";
+import { createPaseoToolCatalog, } from "./agent/tools/paseo-tools.js";
+import { ProviderSnapshotManager } from "./agent/provider-snapshot-manager.js";
+import { bootstrapWorkspaceRegistries } from "./workspace-registry-bootstrap.js";
+import { WorkspaceReconciliationService } from "./workspace-reconciliation-service.js";
+import { FileBackedProjectRegistry, FileBackedWorkspaceRegistry } from "./workspace-registry.js";
+import { FileBackedChatService } from "./chat/chat-service.js";
+import { CheckoutDiffManager } from "./checkout-diff-manager.js";
+import { LoopService } from "./loop-service.js";
+import { ScheduleService } from "./schedule/service.js";
+import { IngestionService } from "./ingestion/service.js";
+import { FilterStore, filtersDir } from "./ingestion/filters/store.js";
+import { SourceStore } from "./ingestion/sources/store.js";
+import { resolveSourceGateway } from "./ingestion/adapters.js";
+import { CapLimiter } from "./ingestion/cap-limiter.js";
+import { IngestionLedger } from "./ingestion/ledger.js";
+import { InMemoryCohortRecorder } from "./ingestion/cohort-recorder-memory.js";
+import { CohortStoreRecorder } from "./ingestion/cohort-recorder-store.js";
+import { CohortStore } from "./ingestion/cohort-store.js";
+import { resumeCohorts } from "./ingestion/cohort-resume.js";
+import { resolveMatchedItems } from "./ingestion/resolve-items.js";
+import { BACKFILL_WINDOW_OPTIONS_DAYS } from "./ingestion/backfill.js";
+import { createExtensionService } from "../extensions/extension-service.js";
+import { DaemonConfigStore } from "./daemon-config-store.js";
+import { BrowserToolsBroker } from "./browser-tools/broker.js";
+import { DaemonConfigBrowserToolsPolicy } from "./browser-tools/policy.js";
+import { WorkspaceGitServiceImpl } from "./workspace-git-service.js";
+import { resolveWorkspaceIdForPath } from "./resolve-workspace-id-for-path.js";
+import { ensureWorkspaceForCreate } from "./ensure-workspace-for-create.js";
+import { archivePersistedWorkspaceRecord, } from "./workspace-archive-service.js";
+import { setupAutoArchiveOnMerge } from "./auto-archive-on-merge/index.js";
+import { wrapSessionMessage } from "./messages.js";
+import { createConfiguredTerminalManager } from "../terminal/terminal-manager-factory.js";
+import { applyTerminalAgentHookSetting } from "../terminal/agent-hooks/terminal-agent-hook-setting.js";
+import { createConnectionOfferV2, encodeOfferToFragmentUrl } from "./connection-offer.js";
+import { loadOrCreateDaemonKeyPair } from "./daemon-keypair.js";
+import { startRelayTransport } from "./relay-transport.js";
+import { getOrCreateServerId } from "./server-id.js";
+import { resolveDaemonVersion } from "./daemon-version.js";
+import { createServiceProxySubsystem } from "./service-proxy.js";
+import { ScriptHealthMonitor } from "./script-health-monitor.js";
+import { createScriptStatusEmitter } from "./script-status-projection.js";
+import { WorkspaceScriptRuntimeStore } from "./workspace-script-runtime-store.js";
+import { createManagedProcessRegistry, createSystemManagedProcessTable, } from "./managed-processes/managed-processes.js";
+import { terminateWithTreeKill } from "../utils/tree-kill.js";
+import { isHostnameAllowed } from "./hostnames.js";
+import { createRequireBearerMiddleware, isAgentMcpRequestAuthorized, } from "./auth.js";
+import { createWebUiMiddleware } from "./web-ui.js";
+import { registerSessionRenameRoute } from "./session/session-rename-route.js";
+import { WorkspaceAutoName } from "./workspace-auto-name.js";
+import { createGitMutationService } from "./session/git-mutation/git-mutation-service.js";
+import { workspaceIdsOnCheckout } from "./workspace-directory.js";
+import { resolveFirstAgentPromptTitle } from "./agent/create-agent-title.js";
+const MAX_MCP_DEBUG_BATCH_ITEMS = 10;
+const REDACTED_LOG_VALUE = "[redacted]";
+const DOWNLOAD_OPEN_FLAGS = process.platform === "win32" ? constants.O_RDONLY : constants.O_RDONLY | constants.O_NOFOLLOW;
+function formatHostForHttpUrl(host) {
+    return host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+}
+function resolveAgentMcpClientHost(host) {
+    if (host === "0.0.0.0") {
+        return "127.0.0.1";
+    }
+    if (host === "::" || host === "[::]") {
+        return "::1";
+    }
+    return host;
+}
+function createAgentMcpBaseUrl(listenTarget) {
+    if (!listenTarget || listenTarget.type !== "tcp") {
+        return null;
+    }
+    const host = resolveAgentMcpClientHost(listenTarget.host);
+    return new URL("/mcp/agents", `http://${formatHostForHttpUrl(host)}:${listenTarget.port}`).toString();
+}
+function createTerminalActivityUrl(listenTarget) {
+    if (!listenTarget || listenTarget.type !== "tcp") {
+        return null;
+    }
+    const host = resolveAgentMcpClientHost(listenTarget.host);
+    return new URL("/api/terminal-activity", `http://${formatHostForHttpUrl(host)}:${listenTarget.port}`).toString();
+}
+const TerminalActivityReportSchema = z.object({
+    terminalId: z.string().min(1),
+    token: z.string().min(1),
+    state: z.enum(["running", "idle", "needs-input"]),
+});
+const TERMINAL_ACTIVITY_STATE_MAP = {
+    running: "working",
+    idle: "idle",
+    "needs-input": "attention",
+};
+const LOOPBACK_REMOTE_ADDRESSES = new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
+function isLoopbackRemoteAddress(remoteAddress) {
+    return remoteAddress !== undefined && LOOPBACK_REMOTE_ADDRESSES.has(remoteAddress);
+}
+export function createTerminalActivityRouteHandler(terminalManager) {
+    return async (req, res) => {
+        if (!isLoopbackRemoteAddress(req.socket.remoteAddress)) {
+            res.status(403).json({ error: "Forbidden" });
+            return;
+        }
+        const parsed = TerminalActivityReportSchema.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({ error: "Invalid terminal activity report" });
+            return;
+        }
+        const validation = terminalManager.validateTerminalActivityToken(parsed.data.terminalId, parsed.data.token);
+        if (validation !== "valid") {
+            res.status(403).json({ error: "Forbidden" });
+            return;
+        }
+        try {
+            const updated = await terminalManager.setTerminalActivity(parsed.data.terminalId, TERMINAL_ACTIVITY_STATE_MAP[parsed.data.state]);
+            if (!updated) {
+                res.status(403).json({ error: "Forbidden" });
+                return;
+            }
+            res.status(204).end();
+        }
+        catch {
+            res.status(500).json({ error: "Failed to update terminal activity" });
+        }
+    };
+}
+function summarizeAgentMcpDebugMessage(body) {
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+        return {
+            type: body === null ? "null" : typeof body,
+        };
+    }
+    const record = body;
+    const method = typeof record.method === "string" ? record.method : undefined;
+    return {
+        type: "object",
+        ...(typeof record.jsonrpc === "string" ? { jsonrpc: record.jsonrpc } : {}),
+        ...(method ? { method } : {}),
+        hasId: Object.prototype.hasOwnProperty.call(record, "id"),
+        hasParams: Object.prototype.hasOwnProperty.call(record, "params"),
+    };
+}
+function summarizeAgentMcpDebugBody(body) {
+    if (!Array.isArray(body)) {
+        return summarizeAgentMcpDebugMessage(body);
+    }
+    const messages = body.slice(0, MAX_MCP_DEBUG_BATCH_ITEMS).map(summarizeAgentMcpDebugMessage);
+    return {
+        type: "batch",
+        count: body.length,
+        messages,
+        ...(body.length > messages.length ? { omitted: body.length - messages.length } : {}),
+    };
+}
+function createBootstrapManagedProcessRegistry(config, logger) {
+    if (config.managedProcesses) {
+        return config.managedProcesses;
+    }
+    return createManagedProcessRegistry({
+        paseoHome: config.paseoHome,
+        processTable: createSystemManagedProcessTable(),
+        terminateProcess: terminateWithTreeKill,
+        logger,
+    });
+}
+async function reconcileManagedProcessLedger(managedProcesses, logger) {
+    const reapResult = await managedProcesses.reapStale();
+    if (reapResult.checked > 0 || reapResult.errors.length > 0) {
+        logger.info(reapResult, "Managed helper process ledger reconciled");
+    }
+}
+function mountWebUi(app, config, logger) {
+    app.use(createWebUiMiddleware({
+        enabled: config.webUi?.enabled ?? false,
+        distDir: config.webUi?.distDir ?? null,
+        label: getHostname(),
+        logger,
+    }));
+}
+function resolveExpressTrustProxySetting(config) {
+    return config.trustedProxies ?? ["loopback"];
+}
+/**
+ * Builds the config object broadcast to every connected client.
+ *
+ * Exported for the ingestion config-no-leak test: MutableDaemonConfigSchema is
+ * `.passthrough()`, so nothing downstream strips an unknown key. This function
+ * enumerating its output field by field, never spreading its input, is the only
+ * thing keeping a daemon-side secret off the wire.
+ */
+export function createInitialMutableDaemonConfig(config) {
+    const providers = Object.fromEntries(Object.entries(config.providerOverrides ?? {}).map(([providerId, override]) => {
+        const providerConfig = {};
+        if (override.enabled !== undefined) {
+            providerConfig.enabled = override.enabled;
+        }
+        if (override.additionalModels) {
+            providerConfig.additionalModels = override.additionalModels;
+        }
+        return [providerId, providerConfig];
+    }));
+    const initialConfig = {
+        mcp: { injectIntoAgents: config.mcpInjectIntoAgents ?? true },
+        browserTools: { enabled: config.browserToolsEnabled ?? false },
+        providers,
+        metadataGeneration: {
+            providers: config.metadataGeneration?.providers ?? [],
+        },
+        autoArchiveAfterMerge: config.autoArchiveAfterMerge ?? false,
+        ingestionReconcileEnabled: config.ingestionReconcileEnabled ?? true,
+        ingestionReconcileStaleMs: config.ingestionReconcileStaleMs ?? 60000,
+        enableTerminalAgentHooks: config.enableTerminalAgentHooks ?? false,
+        appendSystemPrompt: config.appendSystemPrompt ?? "",
+    };
+    if (config.terminalProfiles !== undefined) {
+        initialConfig.terminalProfiles = config.terminalProfiles;
+    }
+    // Left undefined when the daemon has never stored a board. The client reads
+    // that as "nothing to adopt yet" and seeds the daemon from its own local board
+    // on first connect, so upgrading never wipes the columns you already had.
+    if (config.kanbanBoard !== undefined) {
+        initialConfig.kanbanBoard = config.kanbanBoard;
+    }
+    return initialConfig;
+}
+/**
+ * The aggregator gateway resolver: the injected one, or the real registry.
+ *
+ * A module function rather than an inline `??` because the daemon factory sits
+ * exactly on the repo's complexity ceiling, and one more branch tips it over.
+ */
+/**
+ * The daemon's ONE cohort store and the recorder `applySelection` writes through.
+ *
+ * A module function rather than two inline ternaries in `createPaseoDaemon`, for
+ * the same reason `buildCohortResumerOption` below is one: that function sits on
+ * the repo's complexity ceiling, and a guard reads better beside its reason.
+ *
+ * With a ledger: sqlite-backed, over the LEDGER'S OWN HANDLE, so a cohort
+ * survives a restart. Without one: the in-memory recorder, which is honest about
+ * not surviving a restart and is still strictly better than an apply that can
+ * dispatch sessions with nowhere to record having done so.
+ */
+function buildCohortRecording(ledger) {
+    if (!ledger) {
+        return { store: undefined, recorder: new InMemoryCohortRecorder() };
+    }
+    const store = new CohortStore({ db: ledger.database, now: () => Date.now() });
+    return { store, recorder: new CohortStoreRecorder(store) };
+}
+/**
+ * The `cohortResumer` option for `ScheduleService`, or nothing at all.
+ *
+ * A module function rather than an inline ternary in `createPaseoDaemon`: the
+ * three-way guard pushed that function past the repo's complexity ceiling, and
+ * the guard reads better next to the reason for it anyway - the same call
+ * `createChatIngestionSession` makes one file over.
+ *
+ * Returns `{}` when there is no ledger, no limiter or no store, because a resume
+ * that could not claim, could not count against the day's cap, or had nothing to
+ * read would dispatch sessions with no ceiling and no memory of having done so.
+ */
+function buildCohortResumerOption(deps) {
+    const { store, limiter, ledger } = deps;
+    if (!store || !limiter || !ledger) {
+        return {};
+    }
+    return {
+        cohortResumer: () => resumeCohorts({
+            store,
+            filterResolver: (filterId) => deps.filterStore.get(filterId),
+            resolveItems: (filter, itemKeys) => resolveMatchedItems({
+                filter,
+                sourceStore: deps.sourceStore,
+                gatewayResolver: deps.gatewayResolver,
+                itemKeys,
+                windowDays: Math.max(...BACKFILL_WINDOW_OPTIONS_DAYS),
+                now: () => Date.now(),
+            }),
+            ledger,
+            schedule: deps.schedule(),
+            cohorts: deps.cohorts,
+            limiter,
+            runIdFactory: () => randomUUID(),
+            logger: deps.logger,
+        }),
+    };
+}
+function resolveIngestionGatewayResolver(config, ingestionConfig) {
+    return (config.ingestionGatewayResolver ??
+        ((kind) => resolveSourceGateway(kind, { config: ingestionConfig })));
+}
+/**
+ * Every ingestion collaborator the daemon needs, built in one place.
+ *
+ * Extracted from `createPaseoDaemon` purely to keep its branch count under the
+ * oxlint complexity cap: the `??` config defaults and the ledger-conditional
+ * limiter are three decision points that belong to ingestion, not to daemon
+ * startup. Construction order and behaviour are unchanged.
+ */
+function buildIngestionCollaborators(config, ingestionLedger) {
+    // Undefined when the ledger is: a limiter with nowhere durable to count would
+    // be an in-memory counter that resets on every restart, which is the exact
+    // failure the on-disk budget exists to prevent.
+    //
+    // ONE instance, TWO counters (Epic 5, Story 5.2). `admit`/`spent` spend the
+    // APPLY budget, a row in `ingestion_dispatch_budget`, on disk, surviving
+    // restarts, bounding outward artifacts. `admitDryRun`/`spentDryRun` spend the
+    // DRY-RUN budget, a Map on this object, in memory, reset by a restart, bounding
+    // only token spend. They are deliberately separate numbers on deliberately
+    // different substrates: a rehearsal must never consume the day's real
+    // allowance, and a restart must never hand back the day's real allowance.
+    const capLimiter = ingestionLedger ? new CapLimiter({ store: ingestionLedger }) : undefined;
+    // The ingestion collaborators are built HERE, above `ScheduleService`, rather
+    // than beside `IngestionService` further down, because `start()` runs the
+    // cohort resume and therefore needs the store to already exist. Every one of
+    // them is a pure constructor over config or a directory - no connection, no
+    // network - so moving them up costs nothing and removes a late-binding hazard.
+    const ingestionConfig = config.ingestion ?? {
+        pipedream: { environment: "development", allowedOrigins: [] },
+        composio: {},
+    };
+    // EXACTLY ONE cohort store per daemon, for the same reason there is exactly
+    // one ledger: two would be two answers to "what did that apply dispatch", and
+    // the client that asked second would get the emptier one.
+    //
+    // Story 5.4: sqlite-backed, over the LEDGER'S OWN HANDLE (`ingestionLedger.database`),
+    // so a cohort survives a restart and a half-dispatched batch is finished rather
+    // than orphaned. No second `new DatabaseSync(...)` anywhere in this file.
+    //
+    // The in-memory recorder remains the fallback for a daemon whose sqlite could
+    // not be opened. It is honest about what it cannot do - a cohort in that map is
+    // gone after a restart - and it is strictly better than an apply that can
+    // dispatch sessions with nowhere to record having done so.
+    const { store: ingestionCohortStore, recorder: ingestionCohorts } = buildCohortRecording(ingestionLedger);
+    const ingestionFilterStore = new FilterStore(filtersDir(config.paseoHome));
+    const ingestionSourceStore = new SourceStore(path.join(config.paseoHome, "sources"));
+    const ingestionGatewayResolver = resolveIngestionGatewayResolver(config, ingestionConfig);
+    return {
+        capLimiter,
+        ingestionCohortStore,
+        ingestionCohorts,
+        ingestionFilterStore,
+        ingestionSourceStore,
+        ingestionGatewayResolver,
+    };
+}
+export async function createPaseoDaemon(config, rootLogger) {
+    const logger = rootLogger.child({ module: "bootstrap" });
+    const bootstrapStart = performance.now();
+    const elapsed = () => `${(performance.now() - bootstrapStart).toFixed(0)}ms`;
+    const daemonVersion = resolveDaemonVersion(import.meta.url);
+    const daemonConfigStore = new DaemonConfigStore(config.paseoHome, createInitialMutableDaemonConfig(config), logger);
+    const browserToolsPolicy = new DaemonConfigBrowserToolsPolicy(daemonConfigStore);
+    const browserToolsBroker = new BrowserToolsBroker({});
+    const serverId = getOrCreateServerId(config.paseoHome, { logger });
+    const daemonKeyPair = await loadOrCreateDaemonKeyPair(config.paseoHome, logger);
+    const managedProcesses = createBootstrapManagedProcessRegistry(config, logger);
+    // Reconcile the helper-process ledger in the background so it never blocks the
+    // daemon from coming up; terminating a live leftover can take a few seconds.
+    // Best-effort, so a failure is logged here rather than crashing startup.
+    void reconcileManagedProcessLedger(managedProcesses, logger).catch((error) => {
+        logger.warn({ err: error }, "Failed to reconcile managed helper process ledger");
+    });
+    let relayTransport = null;
+    const staticDir = config.staticDir;
+    const downloadTokenTtlMs = config.downloadTokenTtlMs ?? 60000;
+    const downloadTokenStore = new DownloadTokenStore({
+        ttlMs: downloadTokenTtlMs,
+    });
+    // Capability token authenticating the daemon's own agents to the loopback
+    // Agent MCP endpoint (/mcp/agents). Random per daemon run, injected only into
+    // local agent configs and the daemon's own MCP client — never sent to remote
+    // clients — so it cannot be replayed off-box. This lets the injected MCP
+    // authenticate even when the daemon password is set via the app (hash only,
+    // no plaintext available). Mirrors the /api/files/download capability-token
+    // pattern.
+    const agentMcpAuthToken = randomUUID();
+    const listenTarget = parseListenString(config.listen);
+    const app = express();
+    app.set("trust proxy", resolveExpressTrustProxySetting(config));
+    let boundListenTarget = null;
+    let workspaceRegistry = null;
+    const terminalManager = createConfiguredTerminalManager({
+        getTerminalActivityUrl: () => createTerminalActivityUrl(boundListenTarget),
+    });
+    applyTerminalAgentHookSetting({ store: daemonConfigStore, logger });
+    const serviceProxyPublicBaseUrl = config.serviceProxy?.publicBaseUrl
+        ? config.serviceProxy.publicBaseUrl
+        : null;
+    const serviceProxy = createServiceProxySubsystem({
+        logger,
+        publicBaseUrl: serviceProxyPublicBaseUrl,
+    });
+    const scriptRuntimeStore = new WorkspaceScriptRuntimeStore();
+    const configuredHostnames = config.hostnames ?? config.allowedHosts;
+    let wsServer = null;
+    let pushSubsystem = null;
+    let serviceProxyListenTarget = null;
+    const scriptHealthMonitor = new ScriptHealthMonitor({
+        serviceProxy,
+        onChange: createScriptStatusEmitter({
+            sessions: () => wsServer?.listActiveSessions().map((session) => ({
+                emit: (message) => session.emitServerMessage(message),
+            })) ?? [],
+            serviceProxy,
+            runtimeStore: scriptRuntimeStore,
+            daemonPort: () => (boundListenTarget?.type === "tcp" ? boundListenTarget.port : null),
+            resolveWorkspaceDirectory: async (workspaceId) => (await workspaceRegistry?.get(workspaceId))?.cwd ?? null,
+            logger,
+            serviceProxyPublicBaseUrl,
+        }),
+    });
+    const handleBranchChange = createBranchChangeRouteHandler({
+        serviceProxy,
+        onRoutesChanged: (workspaceId) => {
+            scriptHealthMonitor.invalidateWorkspace(workspaceId);
+        },
+        logger,
+    });
+    // Service proxy classifies service hosts before daemon auth/route fallthrough.
+    // Registered service hosts proxy directly; known service namespaces without a
+    // route return 404 and never reach daemon APIs.
+    app.use(serviceProxy.middleware());
+    // Host allowlist / DNS rebinding protection (vite-like semantics).
+    // For non-TCP (unix sockets), skip host validation.
+    if (listenTarget.type === "tcp") {
+        app.use((req, res, next) => {
+            const hostHeader = typeof req.headers.host === "string" ? req.headers.host : undefined;
+            if (!isHostnameAllowed(hostHeader, configuredHostnames)) {
+                res.status(403).json({ error: "Invalid Host header" });
+                return;
+            }
+            next();
+        });
+    }
+    // CORS - allow same-origin + configured origins
+    const allowedOrigins = new Set([
+        ...config.corsAllowedOrigins,
+        // Packaged desktop renderers use the custom paseo:// protocol scheme.
+        "paseo://app",
+        // For TCP, add localhost variants
+        ...(listenTarget.type === "tcp"
+            ? [
+                `http://${listenTarget.host}:${listenTarget.port}`,
+                `http://localhost:${listenTarget.port}`,
+                `http://127.0.0.1:${listenTarget.port}`,
+            ]
+            : []),
+    ]);
+    app.use((req, res, next) => {
+        const origin = req.headers.origin;
+        if (origin && (allowedOrigins.has("*") || allowedOrigins.has(origin))) {
+            res.setHeader("Access-Control-Allow-Origin", origin);
+            res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
+            res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
+            res.setHeader("Access-Control-Allow-Credentials", "true");
+        }
+        if (req.method === "OPTIONS") {
+            res.status(204).end();
+            return;
+        }
+        next();
+    });
+    // Local, harmless, and token-gated; deliberately skips daemon auth.
+    app.post("/api/terminal-activity", express.json(), createTerminalActivityRouteHandler(terminalManager));
+    // Serve the bundled browser web UI when enabled. Mounted after service-proxy
+    // classification and host/CORS handling, but before daemon bearer auth, so
+    // static app files load without the daemon password while API/WebSocket calls
+    // remain protected.
+    mountWebUi(app, config, logger);
+    app.use(createRequireBearerMiddleware(config.auth, (context) => {
+        logger.warn(context, "Rejected HTTP request with invalid daemon password");
+    }));
+    app.use(express.json());
+    // Serve static files from public directory
+    app.use("/public", express.static(staticDir));
+    // Health check endpoint
+    app.get("/api/health", (_req, res) => {
+        res.json({ status: "ok", timestamp: new Date().toISOString() });
+    });
+    // MEETINGS BACKEND (B) — serve real meeting data from the engine's meetings.db
+    registerMeetingsRoutes(app);
+    // CAPTURE — start/stop/status for a live meeting capture session (spawns meetcap)
+    registerCaptureRoutes(app);
+    app.get("/api/status", (_req, res) => {
+        res.json({
+            status: "server_info",
+            serverId,
+            hostname: getHostname(),
+            version: daemonVersion,
+            listen: formatListenTarget(boundListenTarget ?? listenTarget),
+        });
+    });
+    const handleFileDownload = async (req, res) => {
+        const token = typeof req.query.token === "string" && req.query.token.trim().length > 0
+            ? req.query.token.trim()
+            : null;
+        if (!token) {
+            res.status(400).json({ error: "Missing download token" });
+            return;
+        }
+        const entry = downloadTokenStore.consumeToken(token);
+        if (!entry) {
+            res.status(403).json({ error: "Invalid or expired token" });
+            return;
+        }
+        let fileHandle = null;
+        try {
+            fileHandle = await open(entry.absolutePath, DOWNLOAD_OPEN_FLAGS);
+            const fileStats = await fileHandle.stat();
+            if (!fileStats.isFile()) {
+                res.status(404).json({ error: "File not found" });
+                return;
+            }
+            const safeFileName = entry.fileName.replace(/["\r\n]/g, "_");
+            res.setHeader("Content-Type", entry.mimeType);
+            res.setHeader("Content-Disposition", `attachment; filename="${safeFileName}"`);
+            res.setHeader("Content-Length", fileStats.size.toString());
+            const stream = fileHandle.createReadStream();
+            fileHandle = null;
+            stream.on("error", (err) => {
+                logger.error({ err }, "Failed to stream download");
+                if (!res.headersSent) {
+                    res.status(500).json({ error: "Failed to read file" });
+                }
+                else {
+                    res.end();
+                }
+            });
+            stream.pipe(res);
+        }
+        catch (err) {
+            logger.error({ err }, "Failed to download file");
+            if (!res.headersSent) {
+                res.status(404).json({ error: "File not found" });
+            }
+        }
+        finally {
+            await fileHandle?.close().catch(() => undefined);
+        }
+    };
+    app.get("/api/files/download", (req, res) => {
+        void handleFileDownload(req, res);
+    });
+    // Story PASEO-CHAT-ACTIONS-V1-story-3.2: tab rename persistence.
+    // Loopback-bound, single-user trust model — same as the other /api/* routes.
+    // Provider-specific hook wiring lives in session-rename-route.ts so provider
+    // names stay out of this generic bootstrap file.
+    registerSessionRenameRoute(app, logger);
+    // Push subscription endpoint (Story PASEO-CHAT-ACTIONS-V1-story-1.002).
+    // Loopback-bound, single-user trust model — no auth. Persists to
+    // $PASEO_HOME/push-subscriptions.json with mode 0600.
+    const pushSubscriptionStore = new PushSubscriptionStore(logger, path.join(config.paseoHome, "push-subscriptions.json"));
+    // Story 1.4 — VAPID key pair for Web Push delivery.
+    const vapidKeys = loadOrGenerateVapidKeys(path.join(config.paseoHome, "vapid-keys.json"), logger);
+    registerPushRoutes(app, pushSubscriptionStore, logger, {
+        vapidPublicKey: vapidKeys.publicKey,
+    });
+    const httpServer = createHTTPServer(app);
+    // Script proxy WebSocket upgrade handler — must be registered before the
+    // VoiceAssistantWebSocketServer attaches its own "upgrade" listener so that
+    // script-bound upgrades are forwarded first. The handler is a no-op for
+    // requests that don't match a registered script route.
+    httpServer.on("upgrade", serviceProxy.upgradeHandler({ passthroughUnknown: true }));
+    // Capture-stream WebSocket (meetings live capture). Registered BEFORE the VoiceAssistant `/ws`
+    // server attaches so it gets first claim on `/api/meetings/capture/stream`; it no-ops on every
+    // other URL, so `/ws`, script-proxy, and relay upgrades pass through untouched.
+    httpServer.on("upgrade", getCaptureStreamWs().upgrade);
+    if (config.serviceProxy?.standaloneListen) {
+        serviceProxyListenTarget = parseListenString(config.serviceProxy.standaloneListen);
+    }
+    const agentStorage = new AgentStorage(config.agentStoragePath, logger);
+    const projectRegistry = new FileBackedProjectRegistry(path.join(config.paseoHome, "projects", "projects.json"), logger);
+    workspaceRegistry = new FileBackedWorkspaceRegistry(path.join(config.paseoHome, "projects", "workspaces.json"), logger);
+    // Story PASEO-CHAT-ACTIONS-V1-story-3.003 — GET /workspace/:id/sessions.
+    registerWorkspaceSessionsRoute(app, workspaceRegistry, logger);
+    // MARRA CUSTOMIZATION — GET /sessions (global; walks the agent transcript
+    // dirs). Powers the cross-workspace "find any session" mode in the command
+    // palette. Provider-specific paths are resolved inside the route module.
+    registerAllSessionsRoute(app, logger);
+    // MARRA CUSTOMIZATION — GET /sessions/search?q=… spawns the recall CLI to
+    // do FTS across every supported agent's transcripts and returns ranked
+    // snippets. Powers the FTS mode of the command palette.
+    registerSessionsSearchRoute(app, logger);
+    const chatService = new FileBackedChatService({
+        paseoHome: config.paseoHome,
+        logger,
+    });
+    const github = createGitHubService();
+    const workspaceGitService = new WorkspaceGitServiceImpl({
+        logger,
+        paseoHome: config.paseoHome,
+        worktreesRoot: config.worktreesRoot,
+        deps: {
+            github,
+        },
+    });
+    const providerSnapshotLogger = logger.child({ module: "provider-snapshot-manager" });
+    const providerSnapshotManager = new ProviderSnapshotManager({
+        logger: providerSnapshotLogger,
+        runtimeSettings: config.agentProviderSettings,
+        providerOverrides: config.providerOverrides,
+        workspaceGitService,
+        managedProcesses,
+        isDev: config.isDev === true,
+        extraClients: config.agentClients,
+    });
+    // Jarvis substrate (JARVIS-V1-SPEC §3.2). Append-only kanban move history.
+    // Prospective only: nothing before this ships is recoverable, which is why the
+    // spec sequences it ahead of every other piece.
+    const cardMoveLog = new CardMoveLog({ dir: config.paseoHome, logger });
+    // Blocker history. Same prospective-only property as the move log, and it
+    // answers a different question: not "how often was this deferred" but "who or
+    // what has kept blocking it". mergeDigest overwrites digest.blockers on every
+    // derivation, so without this the signal is destroyed on each idle.
+    const blockerLog = new BlockerLog({ dir: config.paseoHome, logger });
+    // Human-authorship ledger (multiplayer architecture §4). OFF BY DEFAULT:
+    // opt in with PASEO_AUTHORSHIP_ENABLED=true. Same prospective-only property
+    // as the two logs above and a sharper deadline, because paseo is the only
+    // component that ever sees the human and the turn together - a provider
+    // transcript records that a message came from `human`, never which one.
+    //
+    // Disabled yields undefined, and AgentManager's call site is `?.`, so the
+    // feature costs nothing and touches no disk until it is switched on.
+    const authorshipLedger = createAuthorshipLedger({
+        dir: config.paseoHome,
+        logger,
+        flag: process.env[AUTHORSHIP_ENV_FLAG],
+    });
+    // Prompt attribution (multiplayer architecture 4.6). OFF BY DEFAULT: opt in
+    // with PASEO_AUTHORSHIP_MARKUP=true. Unlike the ledger this REWRITES the
+    // prompt and lands permanently in the provider transcript, so the flag is
+    // strict and separate: enabling history must not silently enable injection.
+    //
+    // The speaker name is a placeholder until per-user identity exists. A daemon
+    // has one principal today, so this names the daemon's user, not a person in a
+    // shared session. Truthful, low-information, and the only thing that changes
+    // when identity lands.
+    const authorshipMarkup = createAuthorshipMarkup({
+        flag: process.env[AUTHORSHIP_MARKUP_ENV_FLAG],
+        speaker: process.env[AUTHORSHIP_SPEAKER_ENV] ?? userInfo().username,
+    });
+    // Jarvis judge config (§5, §9.1). Env-driven in v1 to avoid protocol churn
+    // while the feature is still being shaped.
+    // Gate for the judge's one mutating capability. Enabled only when the judge
+    // itself is, so an unconfigured deployment cannot expose relay_to_agent.
+    const judgeRelayGate = new JudgeRelayGate({
+        enabled: Boolean(process.env.PASEO_JARVIS_AGENT_ID?.trim()),
+    });
+    const jarvisJudgeConfig = {
+        agentId: process.env.PASEO_JARVIS_AGENT_ID?.trim() || null,
+        shadow: process.env.PASEO_JARVIS_SHADOW === "1",
+    };
+    const initialAgentManagerState = providerSnapshotManager.getAgentManagerProviderState();
+    const agentManager = new AgentManager({
+        clients: initialAgentManagerState.clients,
+        providerDefinitions: initialAgentManagerState.providerDefinitions,
+        registry: agentStorage,
+        cardMoveLog,
+        blockerLog,
+        authorshipLedger,
+        authorshipMarkup,
+        appendSystemPrompt: config.appendSystemPrompt,
+        onWorkspaceStateMayHaveChanged: ({ cwd }) => {
+            workspaceGitService.onWorkspaceStateMayHaveChanged(cwd);
+        },
+        mcpAuthToken: agentMcpAuthToken,
+        logger,
+    });
+    // Session digest (docs/session-digest.md §4.3 + §5): on the running→idle
+    // "finished" transition, refresh the digest — derive keyFiles deterministically
+    // and regenerate summary/accomplishments via the borrowed-provider rail (the
+    // same one auto-title uses; the daemon holds no API key of its own). Debounced +
+    // coalesced inside the scheduler; internal agents never broadcast attention.
+    // Jarvis judge (JARVIS-V1-SPEC §5.1). Constructed before the attention
+    // listener because the listener has to ORDER the two: see below.
+    const jarvisJudge = new JarvisJudge({
+        agentManager,
+        agentStorage,
+        cardMoveLog,
+        blockerLog,
+        relayGate: judgeRelayGate,
+        config: jarvisJudgeConfig,
+        logger,
+    });
+    if (jarvisJudge.enabled) {
+        logger.info({ judgeAgentId: jarvisJudgeConfig.agentId, shadow: jarvisJudgeConfig.shadow }, "Jarvis judge enabled");
+        // Resolve the judge NOW rather than waiting for the first event. An archived
+        // judge emits nothing, so a purely event-driven probe would keep advertising
+        // the feature as healthy in exactly the case where it is dead. Best-effort:
+        // a storage hiccup here must not block daemon startup.
+        void jarvisJudge.refreshAvailability().catch((error) => {
+            logger.warn({ err: error }, "Jarvis availability probe failed");
+        });
+    }
+    agentManager.addAgentAttentionListener((params) => {
+        // Never let a judge failure take down attention handling for everyone else.
+        const wakeJudge = () => {
+            void jarvisJudge.handleAttention({ agentId: params.agentId, reason: params.reason });
+        };
+        // `error` and `permission` have no derivation step, so nothing to wait for.
+        if (params.reason !== "finished") {
+            if (jarvisJudge.enabled) {
+                wakeJudge();
+            }
+            return;
+        }
+        const agent = agentManager.getAgent(params.agentId);
+        if (!agent || agent.internal) {
+            return;
+        }
+        // ORDERING IS LOAD-BEARING, and getting it wrong is invisible.
+        //
+        // The digest refresh and the judge both hang off this one `finished` event.
+        // Fired in parallel, the judge wins the race every time and reads a digest
+        // that has not been written yet, so its briefing carries no summary, no
+        // blockers and no deadline. It then correctly concludes there is nothing
+        // worth saying and answers "quiet" forever. No error is raised anywhere: the
+        // feature looks healthy and delivers nothing. Verified live in the docker lab
+        // before this chaining existed.
+        //
+        // So the judge is woken from onSettled, which fires on success, skip AND
+        // failure. A judge that only ran on the happy path would go quiet exactly
+        // when something broke.
+        scheduleSessionDigestRefresh({
+            agentManager,
+            agentId: params.agentId,
+            cwd: agent.cwd,
+            providerSnapshotManager,
+            daemonConfig: null,
+            currentSelection: {
+                provider: agent.provider,
+                model: agent.runtimeInfo?.model ?? agent.config.model ?? null,
+                thinkingOptionId: agent.runtimeInfo?.thinkingOptionId ?? agent.config.thinkingOptionId ?? null,
+            },
+            logger,
+            onSettled: jarvisJudge.enabled ? wakeJudge : undefined,
+        });
+    });
+    // Epic 1, Story 1.2 — first-class workflow entity. WorkflowManager orchestrates
+    // only; every child is spawned through agentManager.createAgent (one-directional:
+    // workflow -> agent, never the reverse). Storage is the flat $PASEO_HOME/workflows
+    // path from Story 1.1.
+    const workflowStorage = new WorkflowStorage(path.join(config.paseoHome, "workflows"), logger);
+    const workflowManager = new WorkflowManager({
+        agentManager,
+        storage: workflowStorage,
+        logger,
+    });
+    // Story 2.1 — read-only HTTP status + SSE phase-transition routes. Gated on the
+    // same WORKFLOWS_FEATURE_ENABLED constant as the server_info handshake flag.
+    registerWorkflowHttpRoutes(app, { manager: workflowManager, featureEnabled: WORKFLOWS_FEATURE_ENABLED }, logger);
+    // Story PASEO-CHAT-ACTIONS-V1 stories 2.2 + 2.4 — rewind + edit HTTP routes.
+    // Reuse truncate-session.ts (Story 2.1) under the hood. Loopback-only, gated
+    // by the same Bearer-token auth middleware as the rest of the API.
+    registerAgentRoutes(app, agentManager, logger);
+    const detachAgentStoragePersistence = attachAgentStoragePersistence(logger, agentManager, agentStorage);
+    await agentStorage.initialize();
+    logger.info({ elapsed: elapsed() }, "Agent storage initialized");
+    await bootstrapWorkspaceRegistries({
+        paseoHome: config.paseoHome,
+        agentStorage,
+        projectRegistry,
+        workspaceRegistry,
+        workspaceGitService,
+        logger,
+    });
+    logger.info({ elapsed: elapsed() }, "Workspace registries bootstrapped");
+    const workspaceReconciliation = new WorkspaceReconciliationService({
+        projectRegistry,
+        workspaceRegistry,
+        logger,
+        workspaceGitService,
+    });
+    void (async () => {
+        try {
+            const result = await workspaceReconciliation.runOnce();
+            logger.info({
+                elapsed: elapsed(),
+                changeCount: result.changesApplied.length,
+            }, "Workspace registries reconciled");
+        }
+        catch (error) {
+            logger.error({ err: error }, "Background workspace reconciliation failed");
+        }
+    })();
+    await chatService.initialize();
+    logger.info({ elapsed: elapsed() }, "Chat service initialized");
+    const checkoutDiffManager = new CheckoutDiffManager({
+        logger,
+        paseoHome: config.paseoHome,
+        workspaceGitService,
+    });
+    const loopService = new LoopService({
+        paseoHome: config.paseoHome,
+        logger,
+        agentManager,
+        providerSnapshotManager,
+    });
+    await loopService.initialize();
+    logger.info({ elapsed: elapsed() }, "Loop service initialized");
+    // EXACTLY ONE IngestionLedger per daemon. Do not construct a second one anywhere:
+    // the manual (Apply now) path and the tick path must share this instance, and
+    // Story 3.4's CapLimiter derives its daily budget from these same rows. A second
+    // connection would also be a second writer to the same sqlite file.
+    //
+    // Constructing it can throw (node:sqlite missing, or the file unreadable/locked).
+    // That is caught HERE rather than left to propagate: a host without a working
+    // ledger must still boot and still run clock schedules. Fail-loud for ingestion
+    // belongs where a { type: "source" } cadence arms, not at daemon boot (epic D1).
+    let ingestionLedger;
+    try {
+        ingestionLedger = new IngestionLedger({ paseoHome: config.paseoHome });
+    }
+    catch (error) {
+        ingestionLedger = undefined;
+        logger.warn({ err: error }, "Ingestion ledger unavailable; source-triggered filters will not arm. Clock schedules are unaffected");
+    }
+    // EXACTLY ONE CapLimiter per daemon, over that same ledger. Do not construct a
+    // second one anywhere.
+    //
+    // A second instance would NOT double the day's allowance - the budget is a row
+    // in `ingestion_dispatch_budget`, not a field in memory, so two limiters over
+    // the same PASEO_HOME still spend one budget. The rule stands anyway, for two
+    // reasons. It would duplicate the prepared-statement set for no gain. And, the
+    // load-bearing one: a second construction is a signal that a future reader
+    // believed the budget was per-instance, and that belief is one refactor away
+    // from being true (someone caches `used` in a field to save a query). Two
+    // guards, one of which fails loudly.
+    //
+    const { capLimiter, ingestionCohortStore, ingestionCohorts, ingestionFilterStore, ingestionSourceStore, ingestionGatewayResolver, } = buildIngestionCollaborators(config, ingestionLedger);
+    // Explicit annotation breaks the inference cycle: this options object passes
+    // `schedule: () => scheduleService`, so inferring the type from the initializer
+    // is circular (TS7022/TS7023). The lazy closure itself is correct and intended.
+    const scheduleService = new ScheduleService({
+        paseoHome: config.paseoHome,
+        logger,
+        agentManager,
+        agentStorage,
+        providerSnapshotManager,
+        ledger: ingestionLedger,
+        capLimiter,
+        // Story 5.4. A CALLBACK, never a `CohortStore` import inside `service.ts`:
+        // deleting this one line is the whole rollback, and it leaves
+        // `cohort-store.ts` as code nothing in the scheduler names.
+        ...buildCohortResumerOption({
+            store: ingestionCohortStore,
+            limiter: capLimiter,
+            ledger: ingestionLedger,
+            filterStore: ingestionFilterStore,
+            sourceStore: ingestionSourceStore,
+            gatewayResolver: ingestionGatewayResolver,
+            cohorts: ingestionCohorts,
+            // Referenced lazily inside the returned closure: `start()` is called after
+            // this `const` is assigned, so the binding is initialized by the time the
+            // resumer can run. The scheduler is the daemon's ONE new-agent minting
+            // path, and a resumed group must mint through it like any other.
+            schedule: () => scheduleService,
+            logger,
+        }),
+    });
+    await scheduleService.start();
+    agentManager.setAgentArchivedCallback(async (agentId) => {
+        try {
+            await scheduleService.completeForAgent(agentId);
+        }
+        catch (error) {
+            logger.warn({ err: error, agentId }, "Failed to complete schedules for archived agent");
+        }
+    });
+    logger.info({ elapsed: elapsed() }, "Schedule service initialized");
+    // Ingestion sources. `config.ingestion` is optional on PaseoDaemonConfig, so
+    // fall back to an empty block rather than asserting: with no aggregator
+    // credentials the service is inert by design (no timer, no filesystem, no
+    // network) and simply logs that the health sweep is disabled.
+    const ingestionService = new IngestionService({
+        paseoHome: config.paseoHome,
+        serverId,
+        logger,
+        config: config.ingestion ?? {
+            pipedream: { environment: "development", allowedOrigins: [] },
+            composio: {},
+        },
+    });
+    await ingestionService.start();
+    logger.info({ elapsed: elapsed() }, "Ingestion service initialized");
+    // The read-only ingestion PREVIEW collaborators (Story 5.1).
+    //
+    // Wired beside IngestionService rather than through it, because that service
+    // states an invariant it must keep: no gateway, no McpTarget and no
+    // IngestionConfig ever leaves it. The backfill needs a gateway, so it
+    // resolves one from `adapters.ts` - the SAME single factory the service uses,
+    // so there is one resolver definition, not two.
+    //
+    // `ingestionSourceStore` is a second SourceStore over the same directory, and
+    // that is safe in a way a second IngestionLedger would not be: SourceStore
+    // holds no connection and caches nothing, every method re-reads from disk,
+    // and `ensureDir` is idempotent. The ledger below is the ONE instance,
+    // shared, exactly as its own comment requires.
+    // Plugin platform (opt-in via HYPERPASEO_EXTENSIONS=1). Discovers installed
+    // extensions and runs each in its own extension-host process, wired to the
+    // daemon backend. No-op by default — zero impact on standard daemon behavior.
+    const extensionService = createExtensionService({
+        agentManager,
+        serverId,
+        paseoHome: config.paseoHome,
+        logger,
+    });
+    logger.info({ elapsed: elapsed() }, "Loading persisted agent registry");
+    const persistedRecords = await agentStorage.list();
+    logger.info({ elapsed: elapsed() }, `Agent registry loaded (${persistedRecords.length} record${persistedRecords.length === 1 ? "" : "s"}); agents will initialize on demand`);
+    logger.info("Voice mode configured for agent-scoped resume flow (no dedicated voice assistant provider)");
+    logger.info({ elapsed: elapsed() }, "Preparing voice and MCP runtime");
+    const archiveWorkspaceRecordExternal = async (workspaceId) => {
+        const sessions = wsServer?.listActiveSessions() ?? [];
+        if (sessions.length > 0) {
+            await Promise.all(sessions.map((session) => session.archiveWorkspaceRecordForExternalMutation(workspaceId)));
+            return;
+        }
+        await archivePersistedWorkspaceRecord({
+            workspaceId,
+            workspaceRegistry,
+        });
+    };
+    // external path→workspace adapter, not ownership: archive-by-path requests that
+    // arrive with a worktree path and no workspaceId (old clients / CLI).
+    const findWorkspaceIdForCwdExternal = async (cwd) => {
+        return resolveWorkspaceIdForPath(cwd, await workspaceRegistry.list());
+    };
+    // Every create that arrives without a workspaceId (MCP create_agent, CLI,
+    // agent-spawned terminals). Reuses the live workspace owning the cwd instead
+    // of minting one per call — see ensure-workspace-for-create.ts for why the
+    // lookup lives at this caller and not inside createLocalCheckoutWorkspace.
+    const ensureWorkspaceForCreateExternal = async (cwd, firstAgentContext) => {
+        const { workspaceId } = await ensureWorkspaceForCreate(cwd, firstAgentContext, {
+            listWorkspaces: () => workspaceRegistry.list(),
+            createWorkspace: (input) => createLocalCheckoutWorkspace(input, {
+                projectRegistry,
+                workspaceRegistry,
+                workspaceGitService,
+            }),
+            scheduleAutoName: (input) => workspaceAutoName.scheduleForDirectory(input),
+            resolveTitle: resolveFirstAgentPromptTitle,
+        });
+        return workspaceId;
+    };
+    const listActiveWorkspacesExternal = async () => {
+        const workspaces = await workspaceRegistry.list();
+        return workspaces
+            .filter((workspace) => !workspace.archivedAt)
+            .map((workspace) => ({
+            workspaceId: workspace.workspaceId,
+            cwd: workspace.cwd,
+            kind: workspace.kind,
+        }));
+    };
+    const markWorkspaceArchivingExternal = (workspaceIds, archivingAt) => {
+        const workspaceIdList = Array.from(workspaceIds);
+        for (const session of wsServer?.listActiveSessions() ?? []) {
+            session.markWorkspaceArchivingForExternalMutation(workspaceIdList, archivingAt);
+        }
+    };
+    const clearWorkspaceArchivingExternal = (workspaceIds) => {
+        const workspaceIdList = Array.from(workspaceIds);
+        for (const session of wsServer?.listActiveSessions() ?? []) {
+            session.clearWorkspaceArchivingForExternalMutation(workspaceIdList);
+        }
+    };
+    const emitWorkspaceUpdatesExternal = async (workspaceIds) => {
+        const workspaceIdList = Array.from(workspaceIds);
+        await Promise.all((wsServer?.listActiveSessions() ?? []).map((session) => session.emitWorkspaceUpdatesForExternalWorkspaceIds(workspaceIdList)));
+    };
+    const emitWorkspaceUpdateForCwdExternal = async (cwd) => {
+        const workspaceIds = workspaceIdsOnCheckout(await workspaceRegistry.list(), cwd);
+        await emitWorkspaceUpdatesExternal(workspaceIds);
+    };
+    const emitExternalSessionMessage = (message) => {
+        wsServer?.broadcast(wrapSessionMessage(message));
+    };
+    const workspaceAutoName = new WorkspaceAutoName({
+        agentManager,
+        workspaceRegistry,
+        workspaceGitService,
+        providerSnapshotManager,
+        readDaemonConfig: () => ({ metadataGeneration: daemonConfigStore.get().metadataGeneration }),
+        gitMutation: createGitMutationService({
+            workspaceGitService,
+            github,
+            logger,
+        }),
+        emitWorkspaceUpdateForCwd: emitWorkspaceUpdateForCwdExternal,
+        emitWorkspaceUpdateForWorkspaceId: async (workspaceId) => {
+            await emitWorkspaceUpdatesExternal([workspaceId]);
+        },
+        logger,
+    });
+    setupAutoArchiveOnMerge({
+        paseoHome: config.paseoHome,
+        paseoWorktreesBaseRoot: config.worktreesRoot,
+        daemonConfigStore,
+        workspaceGitService,
+        github,
+        agentManager,
+        agentStorage,
+        terminalManager,
+        logger,
+        findWorkspaceIdForCwd: findWorkspaceIdForCwdExternal,
+        listActiveWorkspaces: listActiveWorkspacesExternal,
+        archiveWorkspaceRecord: archiveWorkspaceRecordExternal,
+        markWorkspaceArchiving: markWorkspaceArchivingExternal,
+        clearWorkspaceArchiving: clearWorkspaceArchivingExternal,
+        emitWorkspaceUpdatesForWorkspaceIds: emitWorkspaceUpdatesExternal,
+    });
+    const createPaseoWorktreeForTools = async (input, serviceOptions) => {
+        return createPaseoWorktreeWorkflow({
+            paseoHome: config.paseoHome,
+            worktreesRoot: config.worktreesRoot,
+            createPaseoWorktree: async (workflowInput, workflowOptions) => {
+                return createRegisteredPaseoWorktree(workflowInput, {
+                    github,
+                    ...(workflowOptions?.resolveDefaultBranch
+                        ? {
+                            resolveDefaultBranch: workflowOptions.resolveDefaultBranch,
+                        }
+                        : {}),
+                    projectRegistry,
+                    workspaceRegistry,
+                    workspaceGitService,
+                });
+            },
+            warmWorkspaceGitData: async (workspace) => {
+                await Promise.all(wsServer
+                    ?.listActiveSessions()
+                    .map((session) => session.warmWorkspaceGitDataForWorkspace(workspace)) ?? []);
+            },
+            autoNameWorkspaceBranchForFirstAgent: (autoNameInput) => workspaceAutoName.scheduleForWorktree(autoNameInput),
+            emitWorkspaceUpdateForWorkspaceId: async (workspaceId) => {
+                await emitWorkspaceUpdatesExternal([workspaceId]);
+            },
+            cacheWorkspaceSetupSnapshot: () => { },
+            emit: emitExternalSessionMessage,
+            sessionLogger: logger,
+            terminalManager,
+            archiveWorkspaceRecord: archiveWorkspaceRecordExternal,
+            serviceProxy,
+            scriptRuntimeStore,
+            getDaemonTcpPort: () => (boundListenTarget?.type === "tcp" ? boundListenTarget.port : null),
+            getDaemonTcpHost: () => (boundListenTarget?.type === "tcp" ? boundListenTarget.host : null),
+            serviceProxyPublicBaseUrl,
+            onScriptsChanged: null,
+        }, input, serviceOptions);
+    };
+    const createAgentToolHostDependencies = (runtime) => ({
+        agentManager,
+        agentStorage,
+        terminalManager,
+        getDaemonTcpPort: () => (boundListenTarget?.type === "tcp" ? boundListenTarget.port : null),
+        scheduleService,
+        providerSnapshotManager,
+        github,
+        workspaceGitService,
+        findWorkspaceIdForCwd: findWorkspaceIdForCwdExternal,
+        listActiveWorkspaces: listActiveWorkspacesExternal,
+        archiveWorkspaceRecord: archiveWorkspaceRecordExternal,
+        emitWorkspaceUpdatesForWorkspaceIds: emitWorkspaceUpdatesExternal,
+        workspaceRegistry,
+        markWorkspaceArchiving: markWorkspaceArchivingExternal,
+        clearWorkspaceArchiving: clearWorkspaceArchivingExternal,
+        ensureWorkspaceForCreate: ensureWorkspaceForCreateExternal,
+        createPaseoWorktree: createPaseoWorktreeForTools,
+        browserToolsEnabled: browserToolsPolicy.isEnabled(),
+        browserToolsBroker,
+        paseoHome: config.paseoHome,
+        worktreesRoot: config.worktreesRoot,
+        callerAgentId: runtime.callerAgentId,
+        enableVoiceTools: runtime.enableVoiceTools,
+        voiceOnly: runtime.voiceOnly,
+        // JARVIS-V1-SPEC §6, HARD REQUIREMENT. The judge reads untrusted transcripts,
+        // so it must not hold a mutating tool. Keyed on identity rather than on a
+        // mode, because a mode is something the agent itself could change.
+        readOnly: runtime.readOnly ||
+            (jarvisJudgeConfig.agentId !== null && runtime.callerAgentId === jarvisJudgeConfig.agentId),
+        // Only the judge's own tool sessions get the relay tool, and even then its
+        // handler refuses unless a human turn is driving. Identity-keyed, like the
+        // read-only surface, so the agent cannot grant it to itself.
+        judgeRelayGate: jarvisJudgeConfig.agentId !== null && runtime.callerAgentId === jarvisJudgeConfig.agentId
+            ? judgeRelayGate
+            : undefined,
+        resolveSpeakHandler: (agentId) => wsServer?.resolveVoiceSpeakHandler(agentId) ?? null,
+        resolveCallerContext: (agentId) => wsServer?.resolveVoiceCallerContext(agentId) ?? null,
+        logger,
+    });
+    const createAgentToolCatalog = (runtime) => createPaseoToolCatalog(createAgentToolHostDependencies(runtime));
+    agentManager.setPaseoToolCatalogFactory(createAgentToolCatalog);
+    agentManager.setPaseoToolsEnabled(config.mcpInjectIntoAgents !== false);
+    const mcpEnabled = config.mcpEnabled ?? true;
+    let agentMcpBaseUrl = null;
+    if (mcpEnabled) {
+        const agentMcpRoute = "/mcp/agents";
+        const createAgentMcpSession = async (callerAgentId) => {
+            // Adopt the converged host-dependency factory, then thread the daemon-owned
+            // workflowManager so the additive `workflow_*` MCP tools register.
+            const agentMcpServer = await createAgentMcpServer({
+                ...createAgentToolHostDependencies({ callerAgentId }),
+                workflowManager,
+                // API-389: let the open_url MCP tool push to the user's paired client(s).
+                broadcastToClients: emitExternalSessionMessage,
+            });
+            // Stateless mode: each HTTP request builds a fresh server + transport that is
+            // torn down when the response closes, so no per-session state is retained between
+            // requests. The agent control plane only lists and calls tools, neither of which
+            // needs cross-request state, so sessions would only pin memory for the life of the
+            // daemon (agents that exit without a clean DELETE never get reaped).
+            const transport = new StreamableHTTPServerTransport({
+                sessionIdGenerator: undefined,
+                // NOTE: We enforce a Vite-like host allowlist at the app/websocket layer.
+                // StreamableHTTPServerTransport's built-in check requires exact Host header matches.
+                enableDnsRebindingProtection: false,
+            });
+            Object.assign(transport, {
+                onerror: (err) => {
+                    logger.error({ err }, "Agent MCP transport error");
+                },
+            });
+            await agentMcpServer.connect(transport);
+            return { server: agentMcpServer, transport };
+        };
+        const runAgentMcpRequest = async (req, res) => {
+            // This route is exempt from the global daemon-password middleware, so it
+            // authenticates here using the injected capability token (or a valid
+            // daemon password). Without this, a password-protected daemon would be
+            // wide open on its agent control plane.
+            if (!(await isAgentMcpRequestAuthorized({
+                password: config.auth?.password,
+                capabilityToken: agentMcpAuthToken,
+                authorizationHeader: req.header("authorization"),
+            }))) {
+                res.status(401).json({ error: "Unauthorized" });
+                return;
+            }
+            if (config.mcpDebug) {
+                logger.debug({
+                    method: req.method,
+                    url: req.originalUrl,
+                    sessionId: req.header("mcp-session-id"),
+                    authorization: req.header("authorization") ? REDACTED_LOG_VALUE : undefined,
+                    body: summarizeAgentMcpDebugBody(req.body),
+                }, "Agent MCP request");
+            }
+            try {
+                // Stateless: GET (standalone SSE) and DELETE (session termination) have no
+                // meaning without sessions. The MCP client tolerates 405 on the GET stream
+                // and never issues a DELETE because it is never handed a session id.
+                if (req.method !== "POST") {
+                    res.status(405).json({
+                        jsonrpc: "2.0",
+                        error: {
+                            code: -32000,
+                            message: "Method not allowed",
+                        },
+                        id: null,
+                    });
+                    return;
+                }
+                const callerAgentIdRaw = req.query.callerAgentId;
+                let callerAgentId;
+                if (typeof callerAgentIdRaw === "string") {
+                    callerAgentId = callerAgentIdRaw;
+                }
+                else if (Array.isArray(callerAgentIdRaw) && typeof callerAgentIdRaw[0] === "string") {
+                    callerAgentId = callerAgentIdRaw[0];
+                }
+                const { server, transport } = await createAgentMcpSession(callerAgentId);
+                res.on("close", () => {
+                    void transport.close();
+                    void server.close();
+                });
+                await transport.handleRequest(req, res, req.body);
+            }
+            catch (err) {
+                logger.error({ err }, "Failed to handle Agent MCP request");
+                if (!res.headersSent) {
+                    res.status(500).json({
+                        jsonrpc: "2.0",
+                        error: {
+                            code: -32603,
+                            message: "Internal MCP server error",
+                        },
+                        id: null,
+                    });
+                }
+            }
+        };
+        const handleAgentMcpRequest = (req, res) => {
+            void runAgentMcpRequest(req, res);
+        };
+        app.post(agentMcpRoute, handleAgentMcpRequest);
+        app.get(agentMcpRoute, handleAgentMcpRequest);
+        app.delete(agentMcpRoute, handleAgentMcpRequest);
+        logger.info({ route: agentMcpRoute }, "Agent MCP server mounted on main app");
+    }
+    else {
+        logger.info("Agent MCP HTTP endpoint disabled");
+    }
+    const speechService = createSpeechService({
+        logger,
+        openaiConfig: config.openai,
+        speechConfig: config.speech,
+    });
+    logger.info({ elapsed: elapsed() }, "Speech service created");
+    logger.info({ elapsed: elapsed() }, "Bootstrap complete, ready to start listening");
+    // Agents that were RUNNING when the daemon goes down lose their turn
+    // mid-sentence, and nothing ever tells them so. Record that set on the way
+    // out; `resumeAgentsAfterRestart` nudges exactly those on the way back in.
+    //
+    // Must run before anything tears agents down: `hasInFlightRun` reads
+    // agentManager's live memory, and `closeAllAgents` is about to empty it.
+    const captureInFlightAgentsForResume = async (reason) => {
+        try {
+            const inFlight = collectInFlightAgentIds(agentManager);
+            await writeRestartManifest({
+                paseoHome: config.paseoHome,
+                agentIds: inFlight,
+                reason,
+                logger,
+            });
+        }
+        catch (err) {
+            // Shutdown must never hang or fail on the nudge bookkeeping.
+            logger.warn({ err, reason }, "Failed to capture in-flight agents for resume");
+        }
+    };
+    const start = async () => {
+        let mainStarted = false;
+        try {
+            if (serviceProxyListenTarget) {
+                const boundServiceProxyTarget = await serviceProxy.startStandalone({
+                    listenTarget: serviceProxyListenTarget,
+                });
+                serviceProxyListenTarget = boundServiceProxyTarget;
+                logger.info({
+                    listen: formatListenTarget(serviceProxyListenTarget),
+                    publicBaseUrl: serviceProxyPublicBaseUrl,
+                    elapsed: elapsed(),
+                }, "Service proxy listening");
+            }
+            // Start main HTTP server
+            await new Promise((resolve, reject) => {
+                const onError = (err) => {
+                    httpServer.off("listening", onListening);
+                    reject(err);
+                };
+                const onListening = () => {
+                    httpServer.off("error", onError);
+                    mainStarted = true;
+                    const logAndResolve = async () => {
+                        boundListenTarget = resolveBoundListenTarget(listenTarget, httpServer);
+                        const mcpBaseUrl = mcpEnabled ? createAgentMcpBaseUrl(boundListenTarget) : null;
+                        agentMcpBaseUrl = config.mcpInjectIntoAgents === false ? null : mcpBaseUrl;
+                        agentManager.setMcpBaseUrl(agentMcpBaseUrl);
+                        agentManager.setPaseoToolsEnabled(config.mcpInjectIntoAgents !== false);
+                        daemonConfigStore.onFieldChange("mcp.injectIntoAgents", (value) => {
+                            agentManager.setMcpBaseUrl(value ? mcpBaseUrl : null);
+                            agentManager.setPaseoToolsEnabled(value !== false);
+                        });
+                        daemonConfigStore.onFieldChange("appendSystemPrompt", (value) => {
+                            agentManager.setAppendSystemPrompt(typeof value === "string" ? value : "");
+                        });
+                        const relayEnabled = config.relayEnabled ?? true;
+                        const relayEndpoint = config.relayEndpoint ?? "relay.paseo.sh:443";
+                        const relayPublicEndpoint = config.relayPublicEndpoint ?? relayEndpoint;
+                        const relayUseTls = config.relayUseTls ?? relayEndpoint === "relay.paseo.sh:443";
+                        const relayPublicUseTls = config.relayPublicUseTls ?? relayUseTls;
+                        const appBaseUrl = config.appBaseUrl ?? "https://app.paseo.sh";
+                        if (boundListenTarget.type === "tcp") {
+                            logger.info({
+                                host: boundListenTarget.host,
+                                port: boundListenTarget.port,
+                                authRequired: !!config.auth?.password,
+                                elapsed: elapsed(),
+                            }, `Server listening on http://${boundListenTarget.host}:${boundListenTarget.port}`);
+                        }
+                        else {
+                            logger.info({
+                                path: boundListenTarget.path,
+                                authRequired: !!config.auth?.password,
+                                elapsed: elapsed(),
+                            }, `Server listening on ${boundListenTarget.path}`);
+                        }
+                        if (config.auth?.password) {
+                            logger.info("Daemon password authentication enabled");
+                        }
+                        // Push subsystem wires the pushTrigger channel onto the AgentManager
+                        // attention bus alongside WebSocketServer. Stories 1.3/1.4 will attach
+                        // their delivery workers to `pushSubsystem.triggerEmitter.on(...)`.
+                        // The PASEO_PUSH_ENABLED=false kill switch is honored inside the emitter.
+                        pushSubsystem = createPushSubsystem({
+                            agentManager,
+                            serverId,
+                            logger,
+                            subscriptionStore: pushSubscriptionStore,
+                            vapidKeys,
+                        });
+                        wsServer = new VoiceAssistantWebSocketServer(httpServer, logger, serverId, agentManager, agentStorage, downloadTokenStore, config.paseoHome, daemonConfigStore, mcpBaseUrl, { allowedOrigins, hostnames: configuredHostnames }, workspaceAutoName, config.auth, speechService, terminalManager, {
+                            finalTimeoutMs: config.dictationFinalTimeoutMs,
+                        }, daemonVersion, (intent) => {
+                            try {
+                                config.onLifecycleIntent?.(intent);
+                            }
+                            catch (error) {
+                                logger.error({ err: error, intent }, "Failed to handle daemon lifecycle intent");
+                            }
+                        }, projectRegistry, workspaceRegistry, chatService, loopService, scheduleService, ingestionService, checkoutDiffManager, serviceProxy, scriptRuntimeStore, handleBranchChange, () => (boundListenTarget?.type === "tcp" ? boundListenTarget.port : null), () => (boundListenTarget?.type === "tcp" ? boundListenTarget.host : null), (hostname) => scriptHealthMonitor.getHealthForHostname(hostname), workspaceGitService, github, config.pushNotificationSender, providerSnapshotManager, {
+                            listen: formatListenTarget(boundListenTarget ?? listenTarget),
+                            worktreesRoot: config.worktreesRoot,
+                            appBaseUrl: config.appBaseUrl,
+                            relay: {
+                                enabled: relayEnabled,
+                                endpoint: relayEndpoint,
+                                publicEndpoint: relayPublicEndpoint,
+                                useTls: relayUseTls,
+                                publicUseTls: relayPublicUseTls,
+                            },
+                        }, 
+                        // Story 1.3 — inject the WorkflowManager so Session can serve
+                        // `workflow.*` RPCs (Session -> WorkflowManager, one-directional).
+                        workflowManager, serviceProxyPublicBaseUrl, browserToolsBroker, {
+                            filterStore: ingestionFilterStore,
+                            sourceStore: ingestionSourceStore,
+                            gatewayResolver: ingestionGatewayResolver,
+                            ledger: ingestionLedger,
+                            cohorts: ingestionCohorts,
+                            cohortStore: ingestionCohortStore,
+                        }, 
+                        // JARVIS-V1-SPEC §8. A getter so every server_info broadcast carries
+                        // the CURRENT availability, not whatever it was at daemon start.
+                        () => jarvisJudge.describe());
+                        // Story 1.3 bridge: re-publish Expo tokens registered via the legacy
+                        // `register_push_token` WebSocket message into the Story 1.2
+                        // PushSubscriptionStore so the Expo Push worker sees them.
+                        wsServer.setExpoTokenBridge((token) => {
+                            pushSubscriptionStore.upsert({ type: "expo", token });
+                        });
+                        // Chat-actions ws bridges (2026-05): expose the Story 1.2 push
+                        // subscription store + VAPID public key to every Session so
+                        // relay-connected clients can persist subscriptions and fetch the
+                        // VAPID key without round-tripping the HTTP /push/* routes
+                        // (which are unreachable over the relay transport).
+                        wsServer.setPushSubscriptionBridge(pushSubscriptionStore, vapidKeys.publicKey);
+                        // COMPAT(extensions): route client-invoked plugin commands to the
+                        // extension-service. No-op until HYPERPASEO_EXTENSIONS=1 spawns hosts
+                        // (executeCommand then throws "no extension provides …" → ok:false).
+                        wsServer.setExtensionExecuteCommand((commandId, args) => extensionService.executeCommand(commandId, args));
+                        if (relayEnabled) {
+                            const offer = await createConnectionOfferV2({
+                                serverId,
+                                daemonPublicKeyB64: daemonKeyPair.publicKeyB64,
+                                relay: {
+                                    endpoint: relayPublicEndpoint,
+                                    useTls: relayPublicUseTls,
+                                },
+                            });
+                            encodeOfferToFragmentUrl({ offer, appBaseUrl });
+                            relayTransport?.stop().catch(() => undefined);
+                            relayTransport = startRelayTransport({
+                                logger,
+                                attachSocket: (ws, metadata) => {
+                                    if (!wsServer) {
+                                        throw new Error("WebSocket server not initialized");
+                                    }
+                                    return wsServer.attachExternalSocket(ws, metadata);
+                                },
+                                relayEndpoint,
+                                relayUseTls,
+                                serverId,
+                                daemonKeyPair: daemonKeyPair.keyPair,
+                            });
+                        }
+                    };
+                    logAndResolve().then(resolve, reject);
+                };
+                httpServer.once("error", onError);
+                httpServer.once("listening", onListening);
+                if (listenTarget.type === "tcp") {
+                    httpServer.listen(listenTarget.port, listenTarget.host);
+                }
+                else {
+                    if (listenTarget.type === "socket" && existsSync(listenTarget.path)) {
+                        unlinkSync(listenTarget.path);
+                    }
+                    httpServer.listen(listenTarget.path);
+                }
+            });
+            // Start speech service after listening so synchronous Sherpa native
+            // model loading doesn't block the server from accepting connections.
+            speechService.start();
+            scriptHealthMonitor.start();
+            await extensionService.start();
+            // Nudge the agents the previous shutdown interrupted.
+            //
+            // After the listen, not before: `agentManager.setMcpBaseUrl` is only
+            // called from the `onListening` callback above, so an agent resumed
+            // earlier would come back without paseo's own MCP tools.
+            //
+            // Not awaited: `start()` gates the supervisor's readiness message, and
+            // each nudge is a full provider turn. Blocking on them would report a
+            // healthy daemon as slow to boot.
+            void resumeAgentsAfterRestart({
+                paseoHome: config.paseoHome,
+                agentManager,
+                agentStorage,
+                logger,
+            }).catch((err) => {
+                logger.warn({ err }, "Resume after restart failed");
+            });
+        }
+        catch (error) {
+            await serviceProxy.stopStandalone().catch(() => undefined);
+            if (mainStarted) {
+                httpServer.closeAllConnections();
+                await new Promise((resolve) => httpServer.close(() => resolve()));
+            }
+            throw error;
+        }
+    };
+    const stop = async () => {
+        await captureInFlightAgentsForResume("daemon_stop");
+        scriptHealthMonitor.stop();
+        await extensionService.stop().catch(() => undefined);
+        await closeAllAgents(logger, agentManager);
+        await agentManager.flush().catch(() => undefined);
+        detachAgentStoragePersistence();
+        await agentStorage.flush().catch(() => undefined);
+        await providerSnapshotManager.shutdown();
+        terminalManager.killAll();
+        speechService.stop();
+        await scheduleService.stop().catch(() => undefined);
+        // Closing checkpoints the WAL away. Optional-chained because construction above
+        // is allowed to have failed without stopping the daemon.
+        ingestionLedger?.close();
+        await ingestionService.stop().catch(() => undefined);
+        await relayTransport?.stop().catch(() => undefined);
+        if (wsServer) {
+            await wsServer.close();
+        }
+        pushSubsystem?.dispose();
+        await serviceProxy.stopStandalone();
+        // Force-drop remaining sockets so httpServer.close() resolves promptly.
+        // We've already closed wsServer (which sent ws-layer close frames) and
+        // stopped every other service, so anything still attached is a TCP
+        // socket whose higher-level shutdown hasn't fully released it (e.g.
+        // upgraded WS sockets in the closing handshake, or HTTP keep-alive
+        // sockets in CLOSE_WAIT). closeIdleConnections() does not catch
+        // upgraded sockets, so we use closeAllConnections() here.
+        httpServer.closeAllConnections();
+        await new Promise((resolve) => {
+            httpServer.close(() => resolve());
+        });
+        // Clean up socket files
+        if (listenTarget.type === "socket" && existsSync(listenTarget.path)) {
+            unlinkSync(listenTarget.path);
+        }
+    };
+    return {
+        config,
+        agentManager,
+        agentStorage,
+        workflowManager,
+        terminalManager,
+        serviceProxy,
+        scriptRuntimeStore,
+        browserToolsBroker,
+        start,
+        stop,
+        getListenTarget: () => boundListenTarget,
+    };
+}
+async function closeAllAgents(logger, agentManager) {
+    const agents = agentManager.listAgents();
+    await Promise.all(agents.map(async (agent) => {
+        try {
+            await agentManager.closeAgent(agent.id);
+        }
+        catch (err) {
+            logger.error({ err, agentId: agent.id }, "Failed to close agent");
+        }
+    }));
+}
+//# sourceMappingURL=bootstrap.js.map