@indigoai-us/hq-cli 5.108.1 → 5.108.3

package/dist/lib/mesh/live/daemon/install.js

@@ -0,0 +1,330 @@
+/**
+ * User-level service install for hq mesh daemon.
+ *
+ * - macOS: LaunchAgent ai.getindigo.hq-mesh-daemon
+ * - Linux: systemd user unit hq-mesh-daemon.service
+ *   (documented fallback: root-owned unit running as ec2-user)
+ *
+ * The unit embeds the hq binary resolved at install time. Logs go to
+ * ~/.hq/work-mesh/daemon/log (rotation at 5MB handled by the daemon).
+ * Tests must not actually install services — use a temp HOME/prefix.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { resolveDaemonAssetDir } from "./log.js";
+import { LAUNCHD_LABEL, SYSTEMD_UNIT_NAME, daemonDir, daemonLogPath, } from "./paths.js";
+export function detectPlatform(platform = process.platform) {
+    if (platform === "darwin")
+        return "darwin";
+    if (platform === "linux")
+        return "linux";
+    return "other";
+}
+/** Resolve the hq binary the current shell uses (argv[1] or PATH). */
+export function resolveHqBinary(argv = process.argv, env = process.env) {
+    const entry = argv[1];
+    if (entry && fs.existsSync(entry)) {
+        return path.resolve(entry);
+    }
+    const pathEnv = env.PATH ?? "";
+    for (const dir of pathEnv.split(path.delimiter)) {
+        if (!dir)
+            continue;
+        for (const name of ["hq", "hq.js", "hq.mjs"]) {
+            const candidate = path.join(dir, name);
+            if (fs.existsSync(candidate))
+                return candidate;
+        }
+    }
+    throw new Error("Cannot resolve hq binary for daemon install");
+}
+export function resolveNodeBinary(execPath = process.execPath, env = process.env) {
+    if (execPath && fs.existsSync(execPath))
+        return execPath;
+    const pathEnv = env.PATH ?? "";
+    for (const dir of pathEnv.split(path.delimiter)) {
+        const candidate = path.join(dir, "node");
+        if (fs.existsSync(candidate))
+            return candidate;
+    }
+    return "/usr/bin/node";
+}
+export function buildInstallPaths(opts) {
+    const home = opts.home ?? os.homedir();
+    const env = opts.env ?? process.env;
+    const ddir = daemonDir(opts.meshRoot, home, env);
+    const hqBinary = opts.hqBinary ?? resolveHqBinary(opts.argv, env);
+    const nodeBinary = opts.nodeBinary ?? resolveNodeBinary(opts.execPath, env);
+    return {
+        home,
+        hqBinary,
+        nodeBinary,
+        daemonDir: ddir,
+        logPath: daemonLogPath(ddir),
+        launchAgentsDir: path.join(home, "Library", "LaunchAgents"),
+        plistPath: path.join(home, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`),
+        systemdUserDir: path.join(home, ".config", "systemd", "user"),
+        systemdUnitPath: path.join(home, ".config", "systemd", "user", SYSTEMD_UNIT_NAME),
+        systemUser: opts.systemUser,
+    };
+}
+export function renderLaunchdPlist(paths) {
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${LAUNCHD_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${escapeXml(paths.nodeBinary)}</string>
+    <string>${escapeXml(paths.hqBinary)}</string>
+    <string>mesh</string>
+    <string>daemon</string>
+    <string>run</string>
+  </array>
+  <key>WorkingDirectory</key>
+  <string>${escapeXml(paths.daemonDir)}</string>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>StandardOutPath</key>
+  <string>${escapeXml(paths.logPath)}</string>
+  <key>StandardErrorPath</key>
+  <string>${escapeXml(paths.logPath)}</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>HOME</key>
+    <string>${escapeXml(paths.home)}</string>
+    <key>PATH</key>
+    <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>
+  </dict>
+</dict>
+</plist>
+`;
+}
+export function renderSystemdUserUnit(paths) {
+    return `[Unit]
+Description=HQ Work Mesh Live daemon
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${shellQuote(paths.nodeBinary)} ${shellQuote(paths.hqBinary)} mesh daemon run
+WorkingDirectory=${paths.daemonDir}
+Restart=on-failure
+RestartSec=5
+Environment=HOME=${paths.home}
+Environment=PATH=/usr/local/bin:/usr/bin:/bin
+StandardOutput=append:${paths.logPath}
+StandardError=append:${paths.logPath}
+
+[Install]
+WantedBy=default.target
+`;
+}
+/**
+ * Root-owned unit running as ec2-user (agent boxes without a user session bus).
+ * Documented fallback — written only when --system-user is passed.
+ */
+export function renderSystemdSystemUnit(paths) {
+    const user = paths.systemUser || "ec2-user";
+    return `[Unit]
+Description=HQ Work Mesh Live daemon (system, user=${user})
+After=network-online.target
+Wants=network-online.target
+
+# Fallback for agent boxes where no user session bus exists:
+# install with: hq mesh daemon install --system-user ${user}
+# then: sudo systemctl enable --now ${SYSTEMD_UNIT_NAME}
+
+[Service]
+Type=simple
+User=${user}
+Group=${user}
+ExecStart=${shellQuote(paths.nodeBinary)} ${shellQuote(paths.hqBinary)} mesh daemon run
+WorkingDirectory=/home/${user}/.hq/work-mesh/daemon
+Restart=on-failure
+RestartSec=5
+Environment=HOME=/home/${user}
+Environment=PATH=/usr/local/bin:/usr/bin:/bin
+Environment=HQ_MACHINE_CREDS_FILE=/home/${user}/.hq-agent/machine-creds.json
+Environment=HQ_AGENT_IDENTITY_FILE=/var/lib/hq-agent/identity.json
+StandardOutput=append:/home/${user}/.hq/work-mesh/daemon/log
+StandardError=append:/home/${user}/.hq/work-mesh/daemon/log
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function escapeXml(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;");
+}
+function shellQuote(value) {
+    if (/^[A-Za-z0-9_./:-]+$/.test(value))
+        return value;
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+export function installDaemonService(opts) {
+    const platform = opts.platform ?? detectPlatform();
+    const paths = opts.paths ??
+        buildInstallPaths({ systemUser: opts.systemUser });
+    const writeFileSync = opts.writeFileSync ?? fs.writeFileSync;
+    const mkdirSync = opts.mkdirSync ?? fs.mkdirSync;
+    mkdirSync(paths.daemonDir, { recursive: true, mode: 0o700 });
+    if (platform === "darwin") {
+        const rendered = renderLaunchdPlist(paths);
+        mkdirSync(paths.launchAgentsDir, { recursive: true });
+        writeFileSync(paths.plistPath, rendered, { mode: 0o600 });
+        opts.activate?.(platform, paths.plistPath);
+        return {
+            platform,
+            action: "install",
+            paths,
+            rendered,
+            dest: paths.plistPath,
+            message: `Installed LaunchAgent ${LAUNCHD_LABEL} → ${paths.plistPath}`,
+        };
+    }
+    if (platform === "linux") {
+        if (opts.systemUser || paths.systemUser) {
+            const rendered = renderSystemdSystemUnit({
+                ...paths,
+                systemUser: opts.systemUser ?? paths.systemUser,
+            });
+            // Write under daemon dir as a template the operator can sudo-install.
+            const dest = path.join(paths.daemonDir, SYSTEMD_UNIT_NAME);
+            writeFileSync(dest, rendered, { mode: 0o644 });
+            return {
+                platform,
+                action: "install",
+                paths,
+                rendered,
+                dest,
+                message: `Wrote system unit template for user ${opts.systemUser ?? paths.systemUser} at ${dest}. ` +
+                    `Install with: sudo cp ${dest} /etc/systemd/system/${SYSTEMD_UNIT_NAME} && ` +
+                    `sudo systemctl daemon-reload && sudo systemctl enable --now ${SYSTEMD_UNIT_NAME}`,
+            };
+        }
+        const rendered = renderSystemdUserUnit(paths);
+        mkdirSync(paths.systemdUserDir, { recursive: true });
+        writeFileSync(paths.systemdUnitPath, rendered, { mode: 0o600 });
+        opts.activate?.(platform, paths.systemdUnitPath);
+        return {
+            platform,
+            action: "install",
+            paths,
+            rendered,
+            dest: paths.systemdUnitPath,
+            message: `Installed systemd user unit ${SYSTEMD_UNIT_NAME} → ${paths.systemdUnitPath}`,
+        };
+    }
+    return {
+        platform,
+        action: "install",
+        paths,
+        message: `Unsupported platform for service install; run: ${paths.nodeBinary} ${paths.hqBinary} mesh daemon run`,
+    };
+}
+export function uninstallDaemonService(opts) {
+    const platform = opts.platform ?? detectPlatform();
+    const paths = opts.paths ?? buildInstallPaths({});
+    const unlinkSync = opts.unlinkSync ?? fs.unlinkSync;
+    const existsSync = opts.existsSync ?? fs.existsSync;
+    if (platform === "darwin") {
+        if (existsSync(paths.plistPath)) {
+            opts.deactivate?.(platform, paths.plistPath);
+            unlinkSync(paths.plistPath);
+        }
+        return {
+            platform,
+            action: "uninstall",
+            paths,
+            dest: paths.plistPath,
+            message: `Removed LaunchAgent ${LAUNCHD_LABEL}`,
+        };
+    }
+    if (platform === "linux") {
+        if (existsSync(paths.systemdUnitPath)) {
+            opts.deactivate?.(platform, paths.systemdUnitPath);
+            unlinkSync(paths.systemdUnitPath);
+        }
+        const systemTemplate = path.join(paths.daemonDir, SYSTEMD_UNIT_NAME);
+        if (existsSync(systemTemplate)) {
+            unlinkSync(systemTemplate);
+        }
+        return {
+            platform,
+            action: "uninstall",
+            paths,
+            dest: paths.systemdUnitPath,
+            message: `Removed systemd unit ${SYSTEMD_UNIT_NAME}`,
+        };
+    }
+    return {
+        platform,
+        action: "uninstall",
+        paths,
+        message: "Nothing to uninstall on this platform",
+    };
+}
+export function daemonServiceStatus(opts) {
+    const platform = opts.platform ?? detectPlatform();
+    const paths = opts.paths ?? buildInstallPaths({});
+    const existsSync = opts.existsSync ?? fs.existsSync;
+    if (platform === "darwin") {
+        const installed = existsSync(paths.plistPath);
+        const running = installed
+            ? (opts.isLoaded?.(platform, paths.plistPath) ?? false)
+            : false;
+        return {
+            platform,
+            action: "status",
+            paths,
+            dest: paths.plistPath,
+            running,
+            message: installed
+                ? `LaunchAgent ${LAUNCHD_LABEL}: ${running ? "loaded" : "installed (not loaded)"}`
+                : `LaunchAgent ${LAUNCHD_LABEL}: not installed`,
+        };
+    }
+    if (platform === "linux") {
+        const installed = existsSync(paths.systemdUnitPath);
+        const running = installed
+            ? (opts.isLoaded?.(platform, paths.systemdUnitPath) ?? false)
+            : false;
+        return {
+            platform,
+            action: "status",
+            paths,
+            dest: paths.systemdUnitPath,
+            running,
+            message: installed
+                ? `systemd unit ${SYSTEMD_UNIT_NAME}: ${running ? "active" : "installed (inactive)"}`
+                : `systemd unit ${SYSTEMD_UNIT_NAME}: not installed`,
+        };
+    }
+    return {
+        platform,
+        action: "status",
+        paths,
+        running: false,
+        message: "No service manager integration on this platform",
+    };
+}
+/** Read baked template files from assets/ (optional; renderers are primary). */
+export function readAssetTemplate(name) {
+    const dir = resolveDaemonAssetDir();
+    const p = path.join(dir, name);
+    if (!fs.existsSync(p))
+        return null;
+    return fs.readFileSync(p, "utf8");
+}
+//# sourceMappingURL=install.js.map

package/dist/lib/mesh/live/daemon/log.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Daemon log under ~/.hq/work-mesh/daemon/log with rotation at 5MB.
+ * Never writes prompts, tokens, credentials, or message bodies.
+ */
+export declare function ensureDaemonLog(dir: string): string;
+export declare function rotateDaemonLogIfNeeded(dir: string, maxBytes?: number): void;
+export declare function appendDaemonLog(dir: string, line: string): void;
+export declare function daemonLogLine(level: "info" | "warn" | "error", message: string, now?: () => Date): string;
+/** Resolve path to the LaunchAgent / systemd unit template assets. */
+export declare function resolveDaemonAssetDir(fromModuleUrl?: string): string;
+//# sourceMappingURL=log.d.ts.map

package/dist/lib/mesh/live/daemon/log.js

@@ -0,0 +1,79 @@
+/**
+ * Daemon log under ~/.hq/work-mesh/daemon/log with rotation at 5MB.
+ * Never writes prompts, tokens, credentials, or message bodies.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { DAEMON_LOG_MAX_BYTES, daemonLogPath } from "./paths.js";
+export function ensureDaemonLog(dir) {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const logPath = daemonLogPath(dir);
+    if (!fs.existsSync(logPath)) {
+        fs.writeFileSync(logPath, "", { mode: 0o600 });
+    }
+    try {
+        fs.chmodSync(logPath, 0o600);
+    }
+    catch {
+        /* best-effort */
+    }
+    return logPath;
+}
+export function rotateDaemonLogIfNeeded(dir, maxBytes = DAEMON_LOG_MAX_BYTES) {
+    const logPath = daemonLogPath(dir);
+    try {
+        if (!fs.existsSync(logPath))
+            return;
+        const size = fs.statSync(logPath).size;
+        if (size <= maxBytes)
+            return;
+        const rotated = `${logPath}.1`;
+        try {
+            fs.unlinkSync(rotated);
+        }
+        catch {
+            /* ignore */
+        }
+        fs.renameSync(logPath, rotated);
+        fs.writeFileSync(logPath, "", { mode: 0o600 });
+    }
+    catch {
+        /* best-effort */
+    }
+}
+export function appendDaemonLog(dir, line) {
+    rotateDaemonLogIfNeeded(dir);
+    const logPath = ensureDaemonLog(dir);
+    const text = line.endsWith("\n") ? line : `${line}\n`;
+    try {
+        fs.appendFileSync(logPath, text);
+    }
+    catch {
+        /* best-effort */
+    }
+}
+export function daemonLogLine(level, message, now = () => new Date()) {
+    // Sanitize: strip anything that looks like a token/bearer.
+    const safe = message
+        .replace(/Bearer\s+[A-Za-z0-9._-]+/gi, "Bearer [REDACTED]")
+        .replace(/op:\/\/[^\s"]+/g, "op://[REDACTED]")
+        .slice(0, 500);
+    return `${now().toISOString()} ${level} ${safe}`;
+}
+/** Resolve path to the LaunchAgent / systemd unit template assets. */
+export function resolveDaemonAssetDir(fromModuleUrl = import.meta.url) {
+    // dist/lib/mesh/live/daemon/*.js → repo assets/mesh-daemon
+    // or src/... during vitest (tsx/vite).
+    const here = path.dirname(new URL(fromModuleUrl).pathname);
+    const candidates = [
+        path.resolve(here, "../../../../../../assets/mesh-daemon"),
+        path.resolve(here, "../../../../../assets/mesh-daemon"),
+        path.resolve(process.cwd(), "assets/mesh-daemon"),
+    ];
+    for (const c of candidates) {
+        if (fs.existsSync(c))
+            return c;
+    }
+    return candidates[0];
+}
+//# sourceMappingURL=log.js.map

package/dist/lib/mesh/live/daemon/paths.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Daemon local paths under ~/.hq/work-mesh/daemon/.
+ * Injectable root for tests. Files are owner 0600.
+ */
+export declare const DAEMON_DIRNAME = "daemon";
+export declare const DAEMON_PID_NAME = "pid";
+export declare const DAEMON_STATE_NAME = "state.json";
+export declare const DAEMON_LOG_NAME = "log";
+export declare const DAEMON_LOG_MAX_BYTES: number;
+export declare const LAUNCHD_LABEL = "ai.getindigo.hq-mesh-daemon";
+export declare const SYSTEMD_UNIT_NAME = "hq-mesh-daemon.service";
+export declare function daemonDir(meshRoot?: string, home?: string, env?: NodeJS.ProcessEnv): string;
+export declare function daemonPidPath(dir?: string): string;
+export declare function daemonStatePath(dir?: string): string;
+export declare function daemonLogPath(dir?: string): string;
+/** Session board snapshot: ~/.hq/work-context/sessions/<sid>/board.md */
+export declare function sessionBoardPath(workContextRoot: string, sessionId: string): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/lib/mesh/live/daemon/paths.js

@@ -0,0 +1,31 @@
+/**
+ * Daemon local paths under ~/.hq/work-mesh/daemon/.
+ * Injectable root for tests. Files are owner 0600.
+ */
+import * as os from "node:os";
+import * as path from "node:path";
+import { workMeshRoot } from "../paths.js";
+export const DAEMON_DIRNAME = "daemon";
+export const DAEMON_PID_NAME = "pid";
+export const DAEMON_STATE_NAME = "state.json";
+export const DAEMON_LOG_NAME = "log";
+export const DAEMON_LOG_MAX_BYTES = 5 * 1024 * 1024;
+export const LAUNCHD_LABEL = "ai.getindigo.hq-mesh-daemon";
+export const SYSTEMD_UNIT_NAME = "hq-mesh-daemon.service";
+export function daemonDir(meshRoot, home = os.homedir(), env = process.env) {
+    return path.join(meshRoot ?? workMeshRoot(home, env), DAEMON_DIRNAME);
+}
+export function daemonPidPath(dir) {
+    return path.join(dir ?? daemonDir(), DAEMON_PID_NAME);
+}
+export function daemonStatePath(dir) {
+    return path.join(dir ?? daemonDir(), DAEMON_STATE_NAME);
+}
+export function daemonLogPath(dir) {
+    return path.join(dir ?? daemonDir(), DAEMON_LOG_NAME);
+}
+/** Session board snapshot: ~/.hq/work-context/sessions/<sid>/board.md */
+export function sessionBoardPath(workContextRoot, sessionId) {
+    return path.join(workContextRoot, "sessions", sessionId, "board.md");
+}
+//# sourceMappingURL=paths.js.map

package/dist/lib/mesh/live/daemon/pid-lock.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Single-file daemon pid lock (avoids the stale watch-lock directory bug).
+ *
+ * Format (0600):
+ *   pid=<n>
+ *   ts=<unix seconds>
+ *
+ * Stale takeover when the recorded pid is not alive. Never uses a lock
+ * directory with a temp file inside (rmdir can never clear that class).
+ */
+import * as fs from "node:fs";
+export interface PidLockRecord {
+    pid: number;
+    ts: number;
+}
+export type PidLockResult = {
+    ok: true;
+    path: string;
+} | {
+    ok: false;
+    reason: "held";
+    owner: PidLockRecord;
+    path: string;
+};
+export interface PidLockDeps {
+    pid: number;
+    now: () => number;
+    isProcessAlive: (pid: number) => boolean;
+    mkdirSync?: typeof fs.mkdirSync;
+    writeFileSync?: typeof fs.writeFileSync;
+    readFileSync?: typeof fs.readFileSync;
+    unlinkSync?: typeof fs.unlinkSync;
+    existsSync?: typeof fs.existsSync;
+    chmodSync?: typeof fs.chmodSync;
+}
+export declare function parsePidLock(content: string): PidLockRecord | null;
+export declare function readPidLock(lockPath: string, deps?: Pick<PidLockDeps, "readFileSync" | "existsSync">): PidLockRecord | null;
+export declare function pidLockStatus(lockPath: string, deps: Pick<PidLockDeps, "isProcessAlive" | "readFileSync" | "existsSync">): "free" | "held" | "stale";
+/**
+ * Acquire the single-file pid lock via exclusive create (`wx`).
+ * Stale takeover: verify recorded pid is dead, unlink, retry exclusive create.
+ * Never rename over a live contender.
+ */
+export declare function acquirePidLock(dir: string, deps: PidLockDeps): PidLockResult;
+export declare function releasePidLock(dir: string, deps: Pick<PidLockDeps, "pid" | "readFileSync" | "unlinkSync" | "existsSync">): void;
+export declare function defaultPidLockDeps(overrides?: Partial<PidLockDeps>): PidLockDeps;
+export declare function resolveDaemonDir(meshRoot?: string, home?: string, env?: NodeJS.ProcessEnv): string;
+//# sourceMappingURL=pid-lock.d.ts.map

package/dist/lib/mesh/live/daemon/pid-lock.js

@@ -0,0 +1,134 @@
+/**
+ * Single-file daemon pid lock (avoids the stale watch-lock directory bug).
+ *
+ * Format (0600):
+ *   pid=<n>
+ *   ts=<unix seconds>
+ *
+ * Stale takeover when the recorded pid is not alive. Never uses a lock
+ * directory with a temp file inside (rmdir can never clear that class).
+ */
+import * as fs from "node:fs";
+import { daemonDir, daemonPidPath } from "./paths.js";
+function defaultAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function parsePidLock(content) {
+    const fields = {};
+    for (const line of content.split("\n")) {
+        const i = line.indexOf("=");
+        if (i === -1)
+            continue;
+        fields[line.slice(0, i)] = line.slice(i + 1);
+    }
+    if (!/^\d+$/.test(fields.pid ?? "") || !/^\d+$/.test(fields.ts ?? "")) {
+        return null;
+    }
+    return { pid: Number(fields.pid), ts: Number(fields.ts) };
+}
+export function readPidLock(lockPath, deps = {}) {
+    const existsSync = deps.existsSync ?? fs.existsSync;
+    const readFileSync = deps.readFileSync ?? fs.readFileSync;
+    if (!existsSync(lockPath))
+        return null;
+    try {
+        return parsePidLock(readFileSync(lockPath, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+export function pidLockStatus(lockPath, deps) {
+    const record = readPidLock(lockPath, deps);
+    if (!record)
+        return "free";
+    return deps.isProcessAlive(record.pid) ? "held" : "stale";
+}
+/** Bounded stale-takeover retries (exclusive create after unlink). */
+const STALE_TAKEOVER_ATTEMPTS = 3;
+/**
+ * Acquire the single-file pid lock via exclusive create (`wx`).
+ * Stale takeover: verify recorded pid is dead, unlink, retry exclusive create.
+ * Never rename over a live contender.
+ */
+export function acquirePidLock(dir, deps) {
+    const mkdirSync = deps.mkdirSync ?? fs.mkdirSync;
+    const writeFileSync = deps.writeFileSync ?? fs.writeFileSync;
+    const unlinkSync = deps.unlinkSync ?? fs.unlinkSync;
+    const existsSync = deps.existsSync ?? fs.existsSync;
+    const chmodSync = deps.chmodSync ?? fs.chmodSync;
+    const readFileSync = deps.readFileSync ?? fs.readFileSync;
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const lockPath = daemonPidPath(dir);
+    const body = `pid=${deps.pid}\nts=${deps.now()}\n`;
+    for (let attempt = 0; attempt < STALE_TAKEOVER_ATTEMPTS; attempt += 1) {
+        try {
+            writeFileSync(lockPath, body, { flag: "wx", mode: 0o600 });
+            try {
+                chmodSync(lockPath, 0o600);
+            }
+            catch {
+                /* best-effort */
+            }
+            return { ok: true, path: lockPath };
+        }
+        catch (err) {
+            const code = err?.code;
+            if (code !== "EEXIST")
+                throw err;
+            const owner = readPidLock(lockPath, { readFileSync, existsSync });
+            if (owner && deps.isProcessAlive(owner.pid)) {
+                return { ok: false, reason: "held", owner, path: lockPath };
+            }
+            // Stale or unreadable: unlink and retry exclusive create.
+            try {
+                unlinkSync(lockPath);
+            }
+            catch (unlinkErr) {
+                const ucode = unlinkErr?.code;
+                if (ucode !== "ENOENT") {
+                    const raced = readPidLock(lockPath, { readFileSync, existsSync });
+                    if (raced && deps.isProcessAlive(raced.pid)) {
+                        return { ok: false, reason: "held", owner: raced, path: lockPath };
+                    }
+                    throw unlinkErr;
+                }
+            }
+        }
+    }
+    const finalOwner = readPidLock(lockPath, { readFileSync, existsSync });
+    if (finalOwner && deps.isProcessAlive(finalOwner.pid)) {
+        return { ok: false, reason: "held", owner: finalOwner, path: lockPath };
+    }
+    throw new Error(`pid lock acquire failed after ${STALE_TAKEOVER_ATTEMPTS} attempts`);
+}
+export function releasePidLock(dir, deps) {
+    const lockPath = daemonPidPath(dir);
+    const record = readPidLock(lockPath, deps);
+    if (!record || record.pid !== deps.pid)
+        return;
+    try {
+        (deps.unlinkSync ?? fs.unlinkSync)(lockPath);
+    }
+    catch {
+        /* ignore */
+    }
+}
+export function defaultPidLockDeps(overrides = {}) {
+    return {
+        pid: process.pid,
+        now: () => Math.floor(Date.now() / 1000),
+        isProcessAlive: defaultAlive,
+        ...overrides,
+    };
+}
+export function resolveDaemonDir(meshRoot, home, env) {
+    return daemonDir(meshRoot, home, env);
+}
+//# sourceMappingURL=pid-lock.js.map