@indigoai-us/hq-cli 5.322.0 → 5.324.0

package/dist/lib/daemon/protocol.js

@@ -0,0 +1,154 @@
+/**
+ * hqd wire protocol (hq-anywhere US-008).
+ *
+ * One Unix domain socket (a named pipe on Windows) carrying newline-delimited
+ * JSON. Requests are `{id, op, args}`; each gets exactly one response
+ * `{id, ok: true, result}` or `{id, ok: false, error}`. Responses may arrive
+ * out of order, so clients match them by `id`.
+ */
+import * as net from "node:net";
+import * as os from "node:os";
+import * as path from "node:path";
+export const HQD_SOCKET_NAME = "hqd.sock";
+export const HQD_OPS = [
+    "ping",
+    "resolve",
+    "session.open",
+    "session.get",
+    "session.close",
+    "policy.check",
+    "policy.index",
+    "journal.append",
+    "memory.get",
+    "memory.put",
+    "mesh.presence",
+    "shutdown",
+];
+/** A request line larger than this is rejected and the connection closed. */
+export const HQD_MAX_LINE_BYTES = 1024 * 1024;
+/**
+ * Socket path: HQ_HQD_SOCKET, else <HQ_REGISTRY_DIR or ~/.hq>/hqd.sock.
+ * On Windows the socket is a per-user named pipe.
+ */
+export function hqdSocketPath(home = os.homedir(), env = process.env, platform = process.platform) {
+    const override = env.HQ_HQD_SOCKET?.trim();
+    if (override)
+        return override;
+    if (platform === "win32") {
+        const user = (env.USERNAME ?? os.userInfo().username).replace(/[^A-Za-z0-9_.-]/g, "-");
+        return `\\\\.\\pipe\\hqd-${user}`;
+    }
+    const dir = env.HQ_REGISTRY_DIR?.trim() ? path.resolve(env.HQ_REGISTRY_DIR.trim()) : path.join(home, ".hq");
+    return path.join(dir, HQD_SOCKET_NAME);
+}
+export function encodeMessage(message) {
+    return `${JSON.stringify(message)}\n`;
+}
+/** Validate one request line. Never throws. */
+export function parseRequestLine(line) {
+    let raw;
+    try {
+        raw = JSON.parse(line);
+    }
+    catch {
+        return { ok: false, id: null, error: { code: "bad_json", message: "request is not valid JSON" } };
+    }
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return { ok: false, id: null, error: { code: "bad_request", message: "request must be a JSON object" } };
+    }
+    const obj = raw;
+    const id = typeof obj.id === "string" || typeof obj.id === "number" ? obj.id : null;
+    if (id === null)
+        return { ok: false, id: null, error: { code: "bad_request", message: "request needs a string or number id" } };
+    if (typeof obj.op !== "string" || !obj.op)
+        return { ok: false, id, error: { code: "bad_request", message: "request needs an op" } };
+    if (obj.args !== undefined && (obj.args === null || typeof obj.args !== "object" || Array.isArray(obj.args))) {
+        return { ok: false, id, error: { code: "bad_request", message: "args must be an object" } };
+    }
+    return { ok: true, request: { id, op: obj.op, args: obj.args ?? {} } };
+}
+/**
+ * Split a byte stream into lines. Returns a push function that hands each
+ * complete line to `onLine`, and reports overflow when a partial line grows
+ * past `maxBytes`.
+ */
+export function createLineSplitter(onLine, onOverflow, maxBytes = HQD_MAX_LINE_BYTES) {
+    let buffer = "";
+    let overflowed = false;
+    return (chunk) => {
+        if (overflowed)
+            return;
+        buffer += typeof chunk === "string" ? chunk : chunk.toString("utf8");
+        let nl = buffer.indexOf("\n");
+        while (nl !== -1) {
+            const line = buffer.slice(0, nl).replace(/\r$/, "");
+            buffer = buffer.slice(nl + 1);
+            if (Buffer.byteLength(line, "utf8") > maxBytes) {
+                overflowed = true;
+                buffer = "";
+                onOverflow();
+                return;
+            }
+            if (line.trim())
+                onLine(line);
+            nl = buffer.indexOf("\n");
+        }
+        if (Buffer.byteLength(buffer, "utf8") > maxBytes) {
+            overflowed = true;
+            buffer = "";
+            onOverflow();
+        }
+    };
+}
+export class HqdClientError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "HqdClientError";
+    }
+}
+let nextClientId = 0;
+/**
+ * Send one request and wait for its response. A daemon that is not running
+ * fails fast with the socket error code (ENOENT or ECONNREFUSED).
+ */
+export function hqdRequest(op, args = {}, opts = {}) {
+    const socketPath = opts.socketPath ?? hqdSocketPath();
+    const timeoutMs = opts.timeoutMs ?? 2_000;
+    const id = `c${process.pid}-${(nextClientId += 1)}`;
+    return new Promise((resolve, reject) => {
+        const socket = net.createConnection(socketPath);
+        let settled = false;
+        const finish = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            socket.destroy();
+            fn();
+        };
+        const timer = setTimeout(() => finish(() => reject(new HqdClientError("ETIMEDOUT", `hqd did not answer ${op} within ${timeoutMs}ms`))), timeoutMs);
+        const push = createLineSplitter((line) => {
+            let msg;
+            try {
+                msg = JSON.parse(line);
+            }
+            catch {
+                finish(() => reject(new HqdClientError("bad_response", "hqd sent a line that is not JSON")));
+                return;
+            }
+            if (msg.id !== id)
+                return;
+            if (msg.ok)
+                finish(() => resolve(msg.result));
+            else
+                finish(() => reject(new HqdClientError(msg.error.code, msg.error.message)));
+        }, () => finish(() => reject(new HqdClientError("bad_response", "hqd response too large"))));
+        socket.on("connect", () => socket.write(encodeMessage({ id, op, args })));
+        socket.on("data", push);
+        socket.on("error", (err) => finish(() => reject(new HqdClientError(err.code ?? "ESOCKET", `hqd is not reachable at ${socketPath}: ${err.message}`))));
+        socket.on("close", () => finish(() => reject(new HqdClientError("ECONNRESET", "hqd closed the connection before answering"))));
+    });
+}
+//# sourceMappingURL=protocol.js.map

package/dist/lib/daemon/run.d.ts

@@ -7,11 +7,21 @@
  */
 import { type UnitPlan } from "./catalog.js";
 import { type LegacyUnit } from "./legacy.js";
+import { type DaemonLockResult } from "./lock.js";
 import { type MachineType } from "./machine-type.js";
 import { type HostApp } from "./supervisor.js";
 export declare const LOG_ROTATE_BYTES: number;
 /** Exit code for "restart me": non-zero so every service manager relaunches (Windows tasks only restart on failure). */
 export declare const RESTART_EXIT_CODE = 75;
+export interface DaemonLockConflictOutcome {
+    exitCode: 0 | 1;
+    stdout?: string;
+    stderr?: string;
+}
+/** Preserve the legacy lock failure unless Anywhere explicitly enables the no-op behavior. */
+export declare function daemonLockConflictOutcome(lock: DaemonLockResult, anywhereEnabled: boolean): DaemonLockConflictOutcome | null;
+/** Node's Windows named-pipe API uses a default DACL that is not user-scoped. */
+export declare function hqdStartupRefusal(platform: NodeJS.Platform, anywhereEnabled: boolean): string | null;
 /** Route an updater request through the daemon's existing graceful handoff. */
 export declare function handoffForPackageUpdateRequest(requested: boolean, restartDaemon: () => void): void;
 export interface RunDaemonOptions {

package/dist/lib/daemon/run.js

@@ -12,6 +12,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { loadCachedTokens } from "@indigoai-us/hq-cloud";
 import { CLI_VERSION } from "../../cli-version.js";
+import { anywhereRuntimeEnabled } from "../../commands/anywhere-runtime-flag.js";
 import { currentPackageUseUpdateRequested } from "../../utils/package-use-lease.js";
 import { isLocalDependencyInstall, resolveRunningInstall } from "../../utils/version-gate.js";
 import { agentKitPaths } from "../agent-kit/paths.js";
@@ -26,9 +27,13 @@ import { acquireDaemonLock, isProcessAlive, processCommandLine, releaseDaemonLoc
 import { retireLegacyMeshUnits } from "./migrate.js";
 import { daemonDir as meshDaemonDir, daemonPidPath as meshDaemonPidPath } from "../mesh/live/daemon/paths.js";
 import { readPidLock } from "../mesh/live/daemon/pid-lock.js";
+import { registryDir, registryFile } from "../registry/registry.js";
 import { daemonRootRefusal } from "./install.js";
 import { detectMachineType } from "./machine-type.js";
 import { appendPrivate, daemonPaths, ensurePrivateDir, openPrivateAppend } from "./paths.js";
+import { hqdSocketPath } from "./protocol.js";
+import { startHqdServer } from "./server.js";
+import { heartbeatFile, startHeartbeat } from "./heartbeat.js";
 import { createProtocolTail, ensureProtocolFifo, openProtocolWriter } from "./protocol-tail.js";
 import { takeControlRequests } from "./requests.js";
 import { currentHqCloud, hqCloudRunners } from "./hq-cloud.js";
@@ -40,6 +45,26 @@ import { userToolDirs } from "./tools.js";
 export const LOG_ROTATE_BYTES = 5 * 1024 * 1024;
 /** Exit code for "restart me": non-zero so every service manager relaunches (Windows tasks only restart on failure). */
 export const RESTART_EXIT_CODE = 75;
+/** Preserve the legacy lock failure unless Anywhere explicitly enables the no-op behavior. */
+export function daemonLockConflictOutcome(lock, anywhereEnabled) {
+    if (lock.ok)
+        return null;
+    if (lock.owner && anywhereEnabled) {
+        return { exitCode: 0, stdout: `hq daemon is already running (pid ${lock.owner.pid}).\n` };
+    }
+    return {
+        exitCode: 1,
+        stderr: lock.owner
+            ? `hq daemon is already running (pid ${lock.owner.pid}).\n`
+            : "another hq daemon is starting up.\n",
+    };
+}
+/** Node's Windows named-pipe API uses a default DACL that is not user-scoped. */
+export function hqdStartupRefusal(platform, anywhereEnabled) {
+    if (platform !== "win32" || !anywhereEnabled)
+        return null;
+    return "hqd is disabled on Windows because the default named-pipe ACL grants read access to Everyone and Anonymous accounts.";
+}
 /** Route an updater request through the daemon's existing graceful handoff. */
 export function handoffForPackageUpdateRequest(requested, restartDaemon) {
     if (requested)
@@ -280,9 +305,13 @@ export async function runDaemon(opts) {
     const paths = daemonPaths(home, env);
     const log = makeLogger(paths, opts.foreground === true);
     const lock = acquireDaemonLock(paths.lockPath);
-    if (!lock.ok) {
-        process.stderr.write(lock.owner ? `hq daemon is already running (pid ${lock.owner.pid}).\n` : "another hq daemon is starting up.\n");
-        return 1;
+    const lockConflict = daemonLockConflictOutcome(lock, !lock.ok && lock.owner ? anywhereRuntimeEnabled(env) : false);
+    if (lockConflict) {
+        if (lockConflict.stdout)
+            process.stdout.write(lockConflict.stdout);
+        if (lockConflict.stderr)
+            process.stderr.write(lockConflict.stderr);
+        return lockConflict.exitCode;
     }
     const initial = readDaemonConfig(paths.configPath);
     const detected = detectMachineType(undefined, {
@@ -659,6 +688,45 @@ export async function runDaemon(opts) {
         clearTimeout(timer);
         return on;
     };
+    // hqd: the session/company socket every runtime talks to (hq-anywhere US-008).
+    let hqd = null;
+    let hqdShutdown = null;
+    if (anywhereRuntimeEnabled()) {
+        const refusal = hqdStartupRefusal(platform, true);
+        if (refusal) {
+            log("error", refusal);
+        }
+        else {
+            try {
+                const startConfig = readDaemonConfig(paths.configPath);
+                hqd = await startHqdServer({
+                    socketPath: hqdSocketPath(home, env),
+                    registryPath: registryFile(registryDir(home, env)),
+                    hqRoot: startConfig.hqRoot ?? (env.HQ_ROOT?.trim() || undefined),
+                    log,
+                    onShutdown: () => hqdShutdown?.(),
+                    reportError: reportHqdCrash,
+                });
+            }
+            catch (err) {
+                log("error", `hqd socket did not start; services run without it: ${err.message}`);
+            }
+        }
+    }
+    // US-012: 60s presence heartbeat with version and session count.
+    const liveHqd = hqd;
+    const stopHeartbeat = liveHqd
+        ? startHeartbeat({
+            version: CLI_VERSION,
+            sessionCount: () => liveHqd.sessions.size,
+            file: heartbeatFile(home, env),
+            log,
+        })
+        : () => { };
+    const closeHqd = () => {
+        stopHeartbeat();
+        void hqd?.close().catch((err) => log("warn", `hqd socket did not close cleanly: ${err.message}`));
+    };
     return await new Promise((resolve) => {
         let stopping = false;
         let restartPending = false;
@@ -667,6 +735,7 @@ export async function runDaemon(opts) {
                 return;
             stopping = true;
             log("info", `${why}; stopping services`);
+            closeHqd();
             // The supervisor escalates to SIGKILL after STOP_ESCALATION_MS; the extra
             // margin only covers a child that survives even that.
             let capTimer;
@@ -691,6 +760,7 @@ export async function runDaemon(opts) {
             if (stopping)
                 return;
             stopping = true;
+            closeHqd();
             const released = supervisor.release();
             // What these readers have not read stays in the FIFO for the next daemon.
             for (const tail of protocolTails)
@@ -748,6 +818,7 @@ export async function runDaemon(opts) {
                 return true;
             });
         };
+        hqdShutdown = () => shutdown("hqd shutdown request");
         process.on("SIGTERM", () => shutdown("received SIGTERM"));
         process.on("SIGINT", () => shutdown("received SIGINT"));
         if (platform !== "win32")
@@ -757,9 +828,20 @@ export async function runDaemon(opts) {
         }
         catch (err) {
             log("error", `supervisor failed to start: ${err.message}`);
+            closeHqd();
             releaseDaemonLock(paths.lockPath);
             resolve(1);
         }
     });
 }
+/** Report an hqd op crash to the CLI's existing Sentry integration, tagged with the failing op. */
+function reportHqdCrash(op, err) {
+    void import("../../sentry.js").then(({ Sentry }) => {
+        Sentry.withScope((scope) => {
+            scope.setTag("component", "hqd");
+            scope.setTag("hqd.op", op);
+            Sentry.captureException(err);
+        });
+    }, (importErr) => process.stderr.write(`hqd could not load Sentry to report a ${op} failure: ${String(importErr)}\n`));
+}
 //# sourceMappingURL=run.js.map

package/dist/lib/daemon/server.d.ts

@@ -0,0 +1,36 @@
+/**
+ * hqd socket server (hq-anywhere US-008).
+ *
+ * Hosted inside the `hq daemon run` supervisor, which already runs the mesh
+ * drainer as one of its services, so there is still one resident process per
+ * machine. Sessions in any repo ask it which company they belong to and
+ * register themselves here.
+ */
+import { type ResolveResult } from "../registry/registry.js";
+import { SessionRegistry } from "./session-registry.js";
+export interface HqdServerOptions {
+    socketPath: string;
+    /** registry.json to resolve against (US-004). */
+    registryPath?: string;
+    hqRoot?: string;
+    version?: string;
+    now?: () => Date;
+    /** Called after a `shutdown` request has been answered. */
+    onShutdown?: () => void;
+    log?: (level: "info" | "warn" | "error", message: string) => void;
+    /** Environment for policy scripts and the mesh spool (tests sandbox HOME here). */
+    env?: NodeJS.ProcessEnv;
+    /** Work-mesh root override for mesh.presence (tests). */
+    workMeshRoot?: string;
+    /** Crash reporter for internal op failures (US-012); run.ts wires Sentry here. */
+    reportError?: (op: string, err: unknown) => void;
+}
+export interface HqdServer {
+    socketPath: string;
+    sessions: SessionRegistry;
+    close(): Promise<void>;
+}
+/** Resolve cwd → company through the registry, cached until registry.json changes. */
+export declare function createResolver(registryPath: string): (cwd: string) => ResolveResult;
+export declare function startHqdServer(opts: HqdServerOptions): Promise<HqdServer>;
+//# sourceMappingURL=server.d.ts.map

package/dist/lib/daemon/server.js

@@ -0,0 +1,306 @@
+/**
+ * hqd socket server (hq-anywhere US-008).
+ *
+ * Hosted inside the `hq daemon run` supervisor, which already runs the mesh
+ * drainer as one of its services, so there is still one resident process per
+ * machine. Sessions in any repo ask it which company they belong to and
+ * register themselves here.
+ */
+import * as fs from "node:fs";
+import * as net from "node:net";
+import * as path from "node:path";
+import { CLI_VERSION } from "../../cli-version.js";
+import { canonicalDir, readRegistry, registryFile, resolveCompanyForDir } from "../registry/registry.js";
+import { createLineSplitter, encodeMessage, parseRequestLine } from "./protocol.js";
+import { SessionRegistry } from "./session-registry.js";
+import { journalAppend, JournalOpError } from "./ops/journal.js";
+import { memoryGet, memoryPut, MemoryOpError } from "./ops/memory.js";
+import { meshPresence, MeshOpError } from "./ops/mesh.js";
+import { PolicyIndex, PolicyOpError, policyCheck } from "./ops/policy.js";
+class OpError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+function stringArg(args, name, required = true) {
+    const value = args[name];
+    if (typeof value === "string" && value.trim())
+        return value;
+    if (value === undefined && !required)
+        return undefined;
+    throw new OpError("bad_args", `${name} must be a non-empty string`);
+}
+/** Resolve cwd → company through the registry, cached until registry.json changes. */
+export function createResolver(registryPath) {
+    const cache = new Map();
+    let stamp = "";
+    return (cwd) => {
+        let current = "missing";
+        try {
+            const st = fs.statSync(registryPath);
+            current = `${st.mtimeMs}:${st.size}:${st.ino}`;
+        }
+        catch (err) {
+            if (err.code !== "ENOENT")
+                throw err;
+        }
+        if (current !== stamp) {
+            cache.clear();
+            stamp = current;
+        }
+        const key = canonicalDir(cwd);
+        const hit = cache.get(key);
+        if (hit)
+            return hit;
+        const result = resolveCompanyForDir(readRegistry(registryPath), key);
+        cache.set(key, result);
+        return result;
+    };
+}
+/** Is something answering on this socket? */
+function socketIsLive(socketPath) {
+    return new Promise((resolve) => {
+        const probe = net.createConnection(socketPath);
+        const done = (live) => {
+            probe.destroy();
+            resolve(live);
+        };
+        probe.once("connect", () => done(true));
+        probe.once("error", () => done(false));
+        setTimeout(() => done(false), 500).unref();
+    });
+}
+export async function startHqdServer(opts) {
+    const { socketPath } = opts;
+    const isPipe = process.platform === "win32";
+    const startedAtMs = (opts.now ?? (() => new Date()))().getTime();
+    const sessions = new SessionRegistry(opts.now);
+    const resolve = createResolver(opts.registryPath ?? registryFile());
+    const log = opts.log ?? (() => { });
+    const clock = opts.now ?? (() => new Date());
+    const env = opts.env ?? process.env;
+    const policyIndex = opts.hqRoot ? new PolicyIndex(opts.hqRoot, log) : null;
+    const requireRoot = () => {
+        if (!opts.hqRoot)
+            throw new OpError("no_hq_root", "hqd has no HQ root configured (set hqRoot in daemon config or HQ_ROOT)");
+        return opts.hqRoot;
+    };
+    /** Company for a call: explicit arg, else the open session's, else the registry's answer for cwd. */
+    const companyFor = (args) => {
+        const explicit = stringArg(args, "company", false);
+        if (explicit)
+            return explicit;
+        const runtime = stringArg(args, "runtime", false);
+        const sessionId = stringArg(args, "sessionId", false);
+        const session = runtime && sessionId ? sessions.get(runtime, sessionId) : null;
+        if (session?.company)
+            return session.company;
+        const cwd = stringArg(args, "cwd", false);
+        return cwd ? (resolve(cwd).company ?? undefined) : undefined;
+    };
+    if (!isPipe) {
+        fs.mkdirSync(path.dirname(socketPath), { recursive: true, mode: 0o700 });
+        if (fs.existsSync(socketPath)) {
+            if (await socketIsLive(socketPath))
+                throw new Error(`hqd is already listening on ${socketPath}`);
+            fs.unlinkSync(socketPath);
+        }
+    }
+    /** Synchronous ops answer in request order; only policy.check returns a promise. */
+    const handle = (req) => {
+        const args = req.args ?? {};
+        switch (req.op) {
+            case "ping":
+                return {
+                    version: opts.version ?? CLI_VERSION,
+                    hqRoot: opts.hqRoot ?? null,
+                    uptimeMs: clock().getTime() - startedAtMs,
+                    pid: process.pid,
+                    sessions: sessions.size,
+                };
+            case "resolve": {
+                const cwd = stringArg(args, "cwd");
+                return resolve(cwd);
+            }
+            case "session.open": {
+                const runtime = stringArg(args, "runtime");
+                const sessionId = stringArg(args, "sessionId");
+                const cwd = stringArg(args, "cwd");
+                const explicit = stringArg(args, "company", false);
+                const company = explicit ?? resolve(cwd).company;
+                return sessions.open({ runtime, sessionId, cwd: canonicalDir(cwd), company });
+            }
+            case "session.get": {
+                const runtime = stringArg(args, "runtime", false);
+                const sessionId = stringArg(args, "sessionId", false);
+                if (!sessionId) {
+                    const all = sessions.list();
+                    return { sessions: runtime ? all.filter((s) => s.runtime === runtime) : all };
+                }
+                if (!runtime)
+                    throw new OpError("bad_args", "runtime is required with sessionId");
+                return { session: sessions.get(runtime, sessionId) };
+            }
+            case "session.close": {
+                const runtime = stringArg(args, "runtime");
+                const sessionId = stringArg(args, "sessionId");
+                return { closed: sessions.close(runtime, sessionId) };
+            }
+            case "policy.check": {
+                const hqRoot = requireRoot();
+                const company = companyFor(args);
+                if (!company)
+                    throw new OpError("bad_args", "company is required (or a cwd linked to a company)");
+                const input = args.input;
+                if (input !== undefined && (input === null || typeof input !== "object" || Array.isArray(input))) {
+                    throw new OpError("bad_args", "input must be an object");
+                }
+                return policyCheck({
+                    company,
+                    event: stringArg(args, "event", false),
+                    tool: stringArg(args, "tool"),
+                    input: input,
+                    sessionId: stringArg(args, "sessionId", false),
+                    cwd: stringArg(args, "cwd", false),
+                }, { hqRoot, index: policyIndex, env, now: clock });
+            }
+            case "policy.index": {
+                requireRoot();
+                const company = stringArg(args, "company", false);
+                return { version: policyIndex.version, policies: policyIndex.list(company) };
+            }
+            case "journal.append": {
+                const company = companyFor(args);
+                if (!company)
+                    throw new OpError("bad_args", "company is required (or a cwd linked to a company)");
+                return journalAppend({ company, project: stringArg(args, "project"), section: stringArg(args, "section"), text: stringArg(args, "text") }, requireRoot(), clock());
+            }
+            case "memory.get":
+                return memoryGet(requireRoot(), stringArg(args, "sessionId"), stringArg(args, "key", false));
+            case "memory.put":
+                return memoryPut(requireRoot(), stringArg(args, "sessionId"), stringArg(args, "key"), args.value, clock());
+            case "mesh.presence": {
+                const harness = stringArg(args, "harness", false) ?? stringArg(args, "runtime");
+                return meshPresence({
+                    sessionId: stringArg(args, "sessionId"),
+                    harness,
+                    kind: stringArg(args, "kind"),
+                    cwd: stringArg(args, "cwd", false),
+                    company: companyFor(args),
+                    project: stringArg(args, "project", false),
+                    task: stringArg(args, "task", false),
+                    taskId: stringArg(args, "taskId", false),
+                    status: stringArg(args, "status", false),
+                    summary: stringArg(args, "summary", false),
+                    reason: stringArg(args, "reason", false),
+                }, { hqRoot: opts.hqRoot, workMeshRoot: opts.workMeshRoot, env, now: clock });
+            }
+            case "shutdown":
+                return { stopping: true };
+            default:
+                throw new OpError("unknown_op", `unknown op ${req.op}`);
+        }
+    };
+    const respond = (socket, msg) => {
+        if (!socket.destroyed)
+            socket.write(encodeMessage(msg));
+    };
+    const clients = new Set();
+    const server = net.createServer((socket) => {
+        clients.add(socket);
+        socket.on("close", () => clients.delete(socket));
+        socket.on("error", (err) => log("warn", `hqd client error: ${err.message}`));
+        const push = createLineSplitter((line) => {
+            const parsed = parseRequestLine(line);
+            if (!parsed.ok) {
+                respond(socket, { id: parsed.id, ok: false, error: parsed.error });
+                return;
+            }
+            const req = parsed.request;
+            const succeed = (result) => {
+                respond(socket, { id: req.id, ok: true, result });
+                if (req.op === "shutdown") {
+                    log("info", "hqd received a shutdown request");
+                    setImmediate(() => opts.onShutdown?.());
+                }
+            };
+            const fail = (err) => {
+                const error = err instanceof OpError ||
+                    err instanceof PolicyOpError ||
+                    err instanceof JournalOpError ||
+                    err instanceof MemoryOpError ||
+                    err instanceof MeshOpError
+                    ? { code: err.code, message: err.message }
+                    : { code: "internal", message: err instanceof Error ? err.message : String(err) };
+                if (error.code === "internal") {
+                    log("error", `hqd ${req.op} failed: ${error.message}`);
+                    try {
+                        opts.reportError?.(req.op, err);
+                    }
+                    catch (reportErr) {
+                        log("warn", `hqd could not report the ${req.op} failure: ${reportErr.message}`);
+                    }
+                }
+                respond(socket, { id: req.id, ok: false, error });
+            };
+            let result;
+            try {
+                result = handle(req);
+            }
+            catch (err) {
+                fail(err);
+                return;
+            }
+            if (result instanceof Promise)
+                result.then(succeed, fail);
+            else
+                succeed(result);
+        }, () => {
+            respond(socket, { id: null, ok: false, error: { code: "too_large", message: "request line too large" } });
+            socket.end();
+        });
+        socket.on("data", push);
+    });
+    await new Promise((resolveListen, rejectListen) => {
+        server.once("error", rejectListen);
+        // Bind with a user-only umask so the socket is never briefly group/world accessible.
+        const prior = isPipe ? null : process.umask(0o177);
+        try {
+            server.listen(socketPath, () => {
+                server.off("error", rejectListen);
+                resolveListen();
+            });
+        }
+        finally {
+            if (prior !== null)
+                process.umask(prior);
+        }
+    });
+    if (!isPipe)
+        fs.chmodSync(socketPath, 0o600);
+    log("info", `hqd listening on ${socketPath}`);
+    let closing = null;
+    return {
+        socketPath,
+        sessions,
+        close: () => (closing ??= new Promise((done) => {
+            policyIndex?.close();
+            server.close(() => done());
+            // Answered-but-idle clients would otherwise hold close() open.
+            for (const client of clients)
+                client.destroy();
+            if (!isPipe) {
+                try {
+                    fs.unlinkSync(socketPath);
+                }
+                catch (err) {
+                    if (err.code !== "ENOENT")
+                        log("warn", `could not remove ${socketPath}: ${err.message}`);
+                }
+            }
+        })),
+    };
+}
+//# sourceMappingURL=server.js.map