@joe-broadhead/messaging-bin-linux-x64-gnu 0.1.0 → 0.1.1

package/bin/messagingd

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/bin/messagingd
-size: 91498464 bytes
-sha256: 276a9658a3c88b8a331dfb55bf31afff12e1bbe0bd9c6050cfed4b1b3685883f
+size: 91514848 bytes
+sha256: c9b193f0158963091819417f416abfe4df1e6661f86650aa0e19641899c9bc41

package/lib/messagingd.mjs

@@ -6756,7 +6756,9 @@ var init_ipc = __esm(() => {
   SessionKey = string2().min(1).max(200);
   SessionHost = strictObject({
     kind: literal("opencode"),
-    location: string2().min(2).max(1024).refine((path) => path.startsWith("/") && !/[\u0000-\u001f\u007f]/.test(path), { message: "an absolute path without control characters" }),
+    location: string2().min(2).max(1024).refine((path) => (path.startsWith("/") || /^[A-Za-z]:[\\/]./s.test(path)) && !/[\u0000-\u001f\u007f]/.test(path), {
+      message: "an absolute path without control characters"
+    }),
     sessionID: string2().min(1).max(200),
     pid: number2().int().min(1).max(2147483647)
   });
@@ -7218,7 +7220,7 @@ var init_b64u = __esm(() => {
 });
 
 // packages/core/dist/version.js
-var VERSION = "0.1.0";
+var VERSION = "0.1.1";
 
 // packages/core/dist/jcs.js
 function hasLoneSurrogate(text) {
@@ -10237,19 +10239,21 @@ function messagingHome(env = process.env) {
   return configured ? resolve(configured) : join(homedir(), ".messaging");
 }
 function socketPath(home, tier) {
-  return join(home, "run", `${tier}.sock`);
+  return join(home, "run", `${tier}.${IS_WINDOWS ? "pipe" : "sock"}`);
 }
-function configuredDaemonUid(env = process.env) {
+function configuredDaemonUid(env = process.env, windows = IS_WINDOWS) {
   const raw = env.MESSAGING_DAEMON_UID;
   if (raw === undefined || raw === "")
     return;
+  if (windows)
+    throw new MessagingError("invalid_request", "MESSAGING_DAEMON_UID is not supported on Windows: messagingd runs as the user of its clients there");
   if (!/^\d{1,10}$/.test(raw) || Number(raw) > 4294967294)
     throw new MessagingError("invalid_request", "MESSAGING_DAEMON_UID must be a numeric uid");
   return Number(raw);
 }
-function daemonEnv(env, home) {
+function daemonEnv(env, home, windows = IS_WINDOWS) {
   const out = {};
-  for (const name of DAEMON_ENV) {
+  for (const name of windows ? [...DAEMON_ENV, ...DAEMON_ENV_WINDOWS] : DAEMON_ENV) {
     const value = env[name];
     if (value !== undefined)
       out[name] = value;
@@ -10257,9 +10261,10 @@ function daemonEnv(env, home) {
   out.MESSAGING_HOME = home;
   return out;
 }
-var MAX_SOCKET_PATH_BYTES = 103, DAEMON_ENV;
+var MAX_SOCKET_PATH_BYTES = 103, IS_WINDOWS, DAEMON_ENV, DAEMON_ENV_WINDOWS;
 var init_paths = __esm(() => {
   init_dist();
+  IS_WINDOWS = process.platform === "win32";
   DAEMON_ENV = [
     "PATH",
     "HOME",
@@ -10285,6 +10290,74 @@ var init_paths = __esm(() => {
     "MESSAGING_LOG_LEVEL",
     "MESSAGING_IDENTITY_STORE"
   ];
+  DAEMON_ENV_WINDOWS = [
+    "SystemRoot",
+    "SystemDrive",
+    "windir",
+    "ComSpec",
+    "PATHEXT",
+    "USERPROFILE",
+    "USERNAME",
+    "USERDOMAIN",
+    "HOMEDRIVE",
+    "HOMEPATH",
+    "APPDATA",
+    "LOCALAPPDATA",
+    "ProgramData",
+    "TEMP",
+    "TMP",
+    "NUMBER_OF_PROCESSORS",
+    "PROCESSOR_ARCHITECTURE"
+  ];
+});
+
+// packages/ipc/dist/pipes.js
+import { randomBytes as randomBytes5 } from "crypto";
+import { readFileSync, renameSync, rmSync, writeFileSync } from "fs";
+function newPipeName(tier) {
+  return `\\\\.\\pipe\\messaging-${randomBytes5(16).toString("hex")}-${tier}`;
+}
+function writePointer(path, pointer) {
+  const temp = `${path}.${process.pid}.${randomBytes5(4).toString("hex")}.tmp`;
+  try {
+    writeFileSync(temp, `${JSON.stringify(pointer)}
+`, { flag: "wx" });
+    renameSync(temp, path);
+  } catch (error) {
+    rmSync(temp, { force: true });
+    throw error;
+  }
+}
+function readPointer(path) {
+  let text;
+  try {
+    const bytes = readFileSync(path);
+    if (bytes.length > POINTER_BYTES)
+      throw new MessagingError("forbidden", "the Messaging daemon's pipe file is too large");
+    text = bytes.toString("utf8");
+  } catch (error) {
+    if (error instanceof MessagingError)
+      throw error;
+    if (error.code === "ENOENT")
+      throw new MessagingError("daemon_unavailable", "the Messaging daemon's pipe file does not exist");
+    throw new MessagingError("forbidden", "cannot read the Messaging daemon's pipe file");
+  }
+  let value;
+  try {
+    value = parseWire(text);
+  } catch {
+    throw new MessagingError("forbidden", "the Messaging daemon's pipe file is not valid JSON");
+  }
+  const { pipe, pid, ...rest } = typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
+  if (typeof pipe !== "string" || !PIPE_NAME.test(pipe) || typeof pid !== "number" || !Number.isSafeInteger(pid) || pid < 1 || Object.keys(rest).length > 0) {
+    throw new MessagingError("forbidden", "the Messaging daemon's pipe file does not name a Messaging pipe");
+  }
+  return { pipe, pid };
+}
+var PIPE_NAME, POINTER_BYTES = 1024;
+var init_pipes = __esm(() => {
+  init_dist();
+  PIPE_NAME = /^\\\\\.\\pipe\\messaging-[0-9a-f]{32}-(?:agent|admin)$/;
 });
 
 // packages/ipc/dist/rpc.js
@@ -10299,8 +10372,227 @@ var init_rpc = __esm(() => {
   };
 });
 
+// packages/ipc/dist/windows-acl.js
+import { spawnSync } from "child_process";
+import { randomBytes as randomBytes6 } from "crypto";
+import { existsSync, readFileSync as readFileSync2, rmSync as rmSync2 } from "fs";
+import { tmpdir } from "os";
+import { join as join2 } from "path";
+function parseSddlDacl(sddl) {
+  const text = sddl.trim();
+  let i = 0;
+  let dacl;
+  while (i < text.length) {
+    const tag = text[i];
+    if (text[i + 1] !== ":" || tag !== "O" && tag !== "G" && tag !== "D" && tag !== "S")
+      throw new Error("not SDDL");
+    i += 2;
+    if (tag === "O" || tag === "G") {
+      const sid = /^(S-1-[0-9-]+|[A-Z]{2})/.exec(text.slice(i));
+      if (!sid)
+        throw new Error("not SDDL: owner or group");
+      i += sid[0].length;
+      continue;
+    }
+    let flagText = /^[A-Z_]*/.exec(text.slice(i))[0];
+    if (text[i + flagText.length] === ":")
+      flagText = flagText.slice(0, -1);
+    i += flagText.length;
+    const aces = [];
+    while (text[i] === "(") {
+      let depth = 0;
+      let end = i;
+      for (;end < text.length; end++) {
+        if (text[end] === "(")
+          depth++;
+        else if (text[end] === ")" && --depth === 0)
+          break;
+      }
+      if (end >= text.length)
+        throw new Error("not SDDL: an unclosed entry");
+      aces.push(parseAce(text.slice(i + 1, end)));
+      i = end + 1;
+    }
+    if (tag === "D")
+      dacl = { nullDacl: flagText.includes("NO_ACCESS_CONTROL"), protected: flagText.replace("NO_ACCESS_CONTROL", "").includes("P"), aces };
+  }
+  return dacl;
+}
+function parseAce(body) {
+  const fields = body.split(";");
+  if (fields.length < 6)
+    throw new Error("not SDDL: an entry");
+  const [type = "", flagText = "", rightsText = "", , , sidText = ""] = fields;
+  const flags = flagText.match(/.{1,2}/g) ?? [];
+  return { type, flags, rights: parseRights(rightsText), sid: ALIASES[sidText] ?? sidText };
+}
+function parseRights(text) {
+  if (/^0[xX][0-9a-fA-F]+$/.test(text))
+    return Number.parseInt(text.slice(2), 16);
+  if (/^\d+$/.test(text))
+    return Number(text);
+  let mask = 0;
+  for (const code of text.match(/.{1,2}/g) ?? [])
+    mask |= RIGHTS[code] ?? 4294967295;
+  return mask >>> 0;
+}
+function resolveSid(sid, self) {
+  const rid = DOMAIN_RIDS[sid];
+  const domain = /^(S-1-5-21-\d+-\d+-\d+)-\d+$/.exec(self)?.[1];
+  return rid !== undefined && domain !== undefined ? `${domain}-${rid}` : sid;
+}
+function applies(ace) {
+  return !ace.flags.includes("IO");
+}
+function daclProblem(dacl, self, { pinnedOwner }) {
+  if (dacl === undefined || dacl.nullDacl)
+    return "has no access control list, so anyone may write it";
+  const trusted = new Set([self, SID_SYSTEM, SID_ADMINISTRATORS]);
+  let ownerPinned = false;
+  for (const ace of dacl.aces) {
+    if (!ALLOW_TYPES.has(ace.type) || !applies(ace))
+      continue;
+    const writes = (ace.rights & WRITE_RIGHTS) !== 0;
+    const sid = resolveSid(ace.sid, self);
+    if (sid === SID_OWNER_RIGHTS) {
+      if (writes)
+        return "lets its owner write it";
+      ownerPinned = true;
+      continue;
+    }
+    if (writes && !trusted.has(sid))
+      return `is writable by ${/^S-1-[0-9-]+$/.test(sid) ? sid : `another principal (${sid.slice(0, 8)})`}`;
+  }
+  if (pinnedOwner && !ownerPinned)
+    return "does not pin its owner's rights (no OWNER RIGHTS entry)";
+  return;
+}
+function system32(exe) {
+  return join2(process.env.SystemRoot || process.env.windir || "C:\\Windows", "System32", exe);
+}
+function run(exe, args) {
+  const result = spawnSync(system32(exe), args, { encoding: "utf8", windowsHide: true, timeout: 15000 });
+  if (result.error)
+    throw new ToolFailed(exe, null, result.error.code ?? "error");
+  if (result.status !== 0)
+    throw new ToolFailed(exe, result.status, `exit ${result.status}`);
+  return result.stdout;
+}
+function currentUserSid() {
+  if (userSid !== undefined)
+    return userSid;
+  const out = run("whoami.exe", ["/user", "/fo", "csv", "/nh"]);
+  const sid = /"(S-1-[0-9-]+)"\s*$/.exec(out.trim())?.[1];
+  if (!sid)
+    throw new MessagingError("forbidden", "cannot tell this user's SID");
+  userSid = sid;
+  return sid;
+}
+function readDacl(path) {
+  const out = join2(tmpdir(), `messaging-acl-${process.pid}-${randomBytes6(8).toString("hex")}.txt`);
+  try {
+    run("icacls.exe", [path, "/save", out, "/q"]);
+    return parseSddlDacl(sddlLine(readFileSync2(out)));
+  } catch (error) {
+    if (error instanceof ToolFailed && (error.status === 2 || error.status === 3 || !existsSync(path))) {
+      throw new MessagingError("daemon_unavailable", `${path} does not exist`);
+    }
+    if (error instanceof MessagingError)
+      throw error;
+    throw new MessagingError("forbidden", "cannot read an access control list");
+  } finally {
+    rmSync2(out, { force: true });
+  }
+}
+function sddlLine(bytes) {
+  const utf16 = bytes.length >= 2 && (bytes[0] === 255 && bytes[1] === 254 ? true : bytes.includes(0));
+  const text = (utf16 ? bytes.toString("utf16le") : bytes.toString("utf8")).replace(/^\uFEFF/, "");
+  const line = text.split(/\r?\n/).find((l) => /^(?:[OGDS]:)/.test(l.trim()));
+  if (line === undefined)
+    throw new MessagingError("forbidden", "cannot read an access control list");
+  return line.trim();
+}
+function aclProblem(path, options) {
+  return daclProblem(readDacl(path), currentUserSid(), options);
+}
+function securePrivate(path, what) {
+  const self = currentUserSid();
+  let others;
+  try {
+    others = [...new Set((readDacl(path)?.aces ?? []).map((ace) => resolveSid(ace.sid, self)))].filter((sid) => sid !== self && sid !== SID_OWNER_RIGHTS && /^S-1-[0-9-]+$/.test(sid));
+    run("icacls.exe", [path, "/inheritance:r", "/grant:r", `*${self}:(OI)(CI)(F)`, `*${SID_OWNER_RIGHTS}:(OI)(CI)(RC)`, "/q"]);
+    if (others.length > 0)
+      run("icacls.exe", [path, "/remove", ...others.map((sid) => `*${sid}`), "/q"]);
+  } catch (error) {
+    throw new MessagingError("forbidden", `cannot make ${what} private: ${error instanceof Error ? error.message : "icacls failed"}`);
+  }
+  const dacl = readDacl(path);
+  const problem = daclProblem(dacl, self, { pinnedOwner: true });
+  if (problem !== undefined)
+    throw new MessagingError("forbidden", `${what} is not private: it ${problem}`);
+  const strangers = (dacl?.aces ?? []).map((ace) => resolveSid(ace.sid, self)).filter((sid) => sid !== self && sid !== SID_OWNER_RIGHTS);
+  if (strangers.length > 0)
+    throw new MessagingError("forbidden", `${what} is not private: other entries remain in its access control list`);
+}
+var SID_SYSTEM = "S-1-5-18", SID_ADMINISTRATORS = "S-1-5-32-544", SID_OWNER_RIGHTS = "S-1-3-4", ALIASES, RIGHTS, WRITE_RIGHTS, ALLOW_TYPES, DOMAIN_RIDS, ToolFailed, userSid;
+var init_windows_acl = __esm(() => {
+  init_dist();
+  ALIASES = {
+    SY: SID_SYSTEM,
+    BA: SID_ADMINISTRATORS,
+    OW: SID_OWNER_RIGHTS,
+    CO: "S-1-3-0",
+    WD: "S-1-1-0",
+    AU: "S-1-5-11",
+    BU: "S-1-5-32-545",
+    AN: "S-1-5-7",
+    NU: "S-1-5-2",
+    IU: "S-1-5-4"
+  };
+  RIGHTS = {
+    GA: 268435456,
+    GR: 2147483648,
+    GW: 1073741824,
+    GX: 536870912,
+    RC: 131072,
+    SD: 65536,
+    WD: 262144,
+    WO: 524288,
+    RP: 16,
+    WP: 32,
+    CC: 1,
+    DC: 2,
+    LC: 4,
+    SW: 8,
+    LO: 128,
+    DT: 64,
+    CR: 256,
+    FA: 2032127,
+    FR: 1179785,
+    FW: 1179926,
+    FX: 1179808,
+    KA: 983103,
+    KR: 131097,
+    KW: 131078,
+    KX: 131097,
+    NR: 0,
+    NW: 0,
+    NX: 0
+  };
+  WRITE_RIGHTS = 2 | 4 | 16 | 64 | 256 | 65536 | 262144 | 524288 | 1073741824 | 268435456;
+  ALLOW_TYPES = new Set(["A", "OA", "XA", "ZA"]);
+  DOMAIN_RIDS = { LA: 500, LG: 501 };
+  ToolFailed = class ToolFailed extends MessagingError {
+    status;
+    constructor(exe, status, why) {
+      super("forbidden", `${exe} failed (${why})`);
+      this.status = status;
+    }
+  };
+});
+
 // packages/ipc/dist/trust.js
-import { lstatSync, mkdirSync } from "fs";
+import { constants, lstatSync, mkdirSync, openSync } from "fs";
 function checkPrivateDir(path, what, owners = selfOnly()) {
   let stats;
   try {
@@ -10310,19 +10602,51 @@ function checkPrivateDir(path, what, owners = selfOnly()) {
       throw new MessagingError("daemon_unavailable", `${what} does not exist`);
     throw new MessagingError("forbidden", `cannot inspect ${what}`);
   }
-  const problem = privacyProblem(stats, owners);
+  const problem = IS_WINDOWS ? windowsProblem(stats, path, "directory") : privacyProblem(stats, owners);
   if (problem !== undefined)
     throw new MessagingError("forbidden", `${what} is not private: it ${problem}`);
 }
 function ensurePrivateDir(path, what) {
+  let created = false;
   try {
     mkdirSync(path, { mode: 448 });
+    created = true;
   } catch (error) {
     if (error.code !== "EEXIST")
       throw new MessagingError("forbidden", `cannot create ${what}`);
   }
+  if (IS_WINDOWS && created)
+    secureCreated(path, what);
   checkPrivateDir(path, what);
 }
+function secureCreated(path, what) {
+  if (aclProblem(path, { pinnedOwner: true }) !== undefined)
+    securePrivate(path, what);
+}
+function adoptPrivateDir(path, what, created) {
+  if (created) {
+    secureCreated(path, what);
+    return;
+  }
+  let stats;
+  try {
+    stats = lstatSync(path);
+  } catch {
+    throw new MessagingError("forbidden", `cannot inspect ${what}`);
+  }
+  if (stats.isSymbolicLink())
+    throw new MessagingError("forbidden", `${what} is not private: it is a symbolic link`);
+  if (!stats.isDirectory())
+    throw new MessagingError("forbidden", `${what} is not private: it is not a directory`);
+  const self = currentUserSid();
+  const dacl = readDacl(path);
+  const problem = daclProblem(dacl, self, { pinnedOwner: false });
+  if (problem !== undefined)
+    throw new MessagingError("forbidden", `${what} is not private: it ${problem}`);
+  const exact = daclProblem(dacl, self, { pinnedOwner: true }) === undefined && (dacl?.aces ?? []).every((ace) => [self, SID_OWNER_RIGHTS].includes(resolveSid(ace.sid, self)));
+  if (!exact)
+    securePrivate(path, what);
+}
 function privacyProblem(stats, owners = selfOnly()) {
   if (stats.isSymbolicLink())
     return "is a symbolic link";
@@ -10334,6 +10658,13 @@ function privacyProblem(stats, owners = selfOnly()) {
     return "is writable by group or others";
   return;
 }
+function windowsProblem(stats, path, kind) {
+  if (stats.isSymbolicLink())
+    return "is a symbolic link";
+  if (kind === "directory" ? !stats.isDirectory() : !stats.isFile())
+    return `is not a ${kind}`;
+  return aclProblem(path, { pinnedOwner: true });
+}
 function checkSocket(path, owners = selfOnly()) {
   let stats;
   try {
@@ -10343,6 +10674,12 @@ function checkSocket(path, owners = selfOnly()) {
       throw new MessagingError("daemon_unavailable", "the Messaging daemon socket does not exist");
     throw new MessagingError("forbidden", "cannot inspect the Messaging daemon socket");
   }
+  if (IS_WINDOWS) {
+    const problem = windowsProblem(stats, path, "file");
+    if (problem !== undefined)
+      throw new MessagingError("forbidden", `the Messaging daemon's pipe file is not private: it ${problem}`);
+    return;
+  }
   if (!stats.isSocket())
     throw new MessagingError("forbidden", "the Messaging daemon socket path is not a socket");
   if (owners.length > 0 && !owners.includes(stats.uid))
@@ -10358,8 +10695,24 @@ function selfOnly() {
   const euid = process.geteuid?.();
   return euid === undefined ? [] : [euid];
 }
+function openNoFollow(path, flags, mode) {
+  if (!IS_WINDOWS)
+    return openSync(path, flags | constants.O_NOFOLLOW, mode);
+  let link = false;
+  try {
+    link = lstatSync(path).isSymbolicLink();
+  } catch (error) {
+    if (error.code !== "ENOENT")
+      throw error;
+  }
+  if (link)
+    throw Object.assign(new Error(`ELOOP: a symbolic link, open '${path}'`), { code: "ELOOP" });
+  return openSync(path, flags, mode);
+}
 var init_trust = __esm(() => {
   init_dist();
+  init_paths();
+  init_windows_acl();
 });
 
 // packages/ipc/dist/client.js
@@ -10406,16 +10759,21 @@ class MessagingClient {
   static async connect(options = {}) {
     const path = options.socketPath ?? socketPath(options.home ?? messagingHome(), options.tier ?? "agent");
     const owners = trustedOwners(options.daemonUid ?? configuredDaemonUid());
+    let pointer;
     try {
       checkPrivateDir(dirname(path), "the Messaging daemon's socket directory", owners);
       checkSocket(path, owners);
+      if (IS_WINDOWS)
+        pointer = readPointer(path);
     } catch (error) {
       if (!(error instanceof MessagingError) || error.code !== "daemon_unavailable")
         throw error;
     }
+    if (IS_WINDOWS && pointer === undefined)
+      throw new MessagingError("daemon_unavailable", "cannot reach the Messaging daemon (ENOENT)");
     const timeout = options.connectTimeoutMs ?? 2000;
     const socket = await new Promise((resolve, reject) => {
-      const s = net.connect(path);
+      const s = net.connect(pointer?.pipe ?? path);
       const timer = setTimeout(() => {
         s.destroy();
         reject(new MessagingError("daemon_unavailable", "timed out connecting to the Messaging daemon"));
@@ -10439,6 +10797,9 @@ class MessagingClient {
           timer = setTimeout(() => reject(new DaemonMismatchError(`the process on the Messaging daemon socket did not say which version it is within ${wait} ms: it is a messagingd from before this version, or it is stuck. ${REMEDY}`)), wait);
         })
       ]);
+      if (pointer !== undefined && hello.pid !== pointer.pid) {
+        throw new MessagingError("forbidden", "the process on the Messaging daemon's pipe is not the daemon that published it");
+      }
       const expected = options.version ?? VERSION;
       if (hello.protocol !== IPC_PROTOCOL || hello.version !== expected) {
         throw new DaemonMismatchError(`the Messaging daemon for this home is version ${shown(hello.version)} (IPC protocol ${hello.protocol}), and this client is version ${shown(expected)} (IPC protocol ${IPC_PROTOCOL}). ${REMEDY}`, hello);
@@ -10589,6 +10950,7 @@ var init_client = __esm(() => {
   init_dist();
   init_framing();
   init_paths();
+  init_pipes();
   init_rpc();
   init_trust();
   DaemonMismatchError = class DaemonMismatchError extends MessagingError {
@@ -10627,15 +10989,20 @@ async function createIpcServer(options) {
     throw new MessagingError("invalid_request", "an IPC server needs a tier: agent or admin");
   if (options.group !== undefined && options.tier !== "agent")
     throw new MessagingError("invalid_request", "only the agent socket may be shared with a group");
-  if (Buffer.byteLength(path) > MAX_SOCKET_PATH_BYTES) {
+  if (options.group !== undefined && IS_WINDOWS)
+    throw new MessagingError("invalid_request", "an agent socket shared with a group is not supported on Windows");
+  if (!IS_WINDOWS && Buffer.byteLength(path) > MAX_SOCKET_PATH_BYTES) {
     throw new MessagingError("invalid_request", `socket path is longer than ${MAX_SOCKET_PATH_BYTES} bytes`);
   }
   const run = dirname2(path);
   const home = dirname2(run);
-  mkdirSync2(home, { recursive: true, mode: 448 });
+  const createdHome = mkdirSync2(home, { recursive: true, mode: 448 }) !== undefined;
+  if (IS_WINDOWS && createdHome)
+    secureCreated(home, "the Messaging home directory");
   checkPrivateDir(home, "the Messaging home directory");
   ensurePrivateDir(run, "the Messaging run directory");
-  await removeStaleSocket(path);
+  await (IS_WINDOWS ? removeStalePointer(path) : removeStaleSocket(path));
+  const listenPath = IS_WINDOWS ? newPipeName(options.tier) : path;
   const contexts = new Map;
   const hello = { jsonrpc: "2.0", method: "hello", params: { daemon: "messagingd", version: options.version ?? VERSION, protocol: IPC_PROTOCOL, pid: process.pid } };
   const server = net2.createServer((socket) => {
@@ -10718,20 +11085,25 @@ async function createIpcServer(options) {
   }
   await new Promise((resolve, reject) => {
     server.once("error", reject);
-    const umask = process.umask(127);
+    const umask = IS_WINDOWS ? undefined : process.umask(127);
     try {
-      server.listen(path, () => {
+      server.listen(listenPath, () => {
         server.off("error", reject);
         resolve();
       });
     } finally {
-      process.umask(umask);
+      if (umask !== undefined)
+        process.umask(umask);
     }
   });
   try {
-    if (options.group !== undefined)
-      await chown(path, process.geteuid?.() ?? -1, options.group);
-    await chmod(path, options.group === undefined ? 384 : 432);
+    if (IS_WINDOWS)
+      writePointer(path, { pipe: listenPath, pid: process.pid });
+    else {
+      if (options.group !== undefined)
+        await chown(path, process.geteuid?.() ?? -1, options.group);
+      await chmod(path, options.group === undefined ? 384 : 432);
+    }
   } catch (error) {
     await new Promise((resolve) => server.close(() => resolve()));
     await rm(path, { force: true });
@@ -10757,7 +11129,17 @@ async function createIpcServer(options) {
       for (const socket of contexts.keys())
         socket.destroy();
       await new Promise((resolve) => server.close(() => resolve()));
-      await rm(path, { force: true });
+      if (IS_WINDOWS) {
+        let ours = false;
+        try {
+          ours = readPointer(path).pipe === listenPath;
+        } catch {
+          ours = false;
+        }
+        if (ours)
+          await rm(path, { force: true });
+      } else
+        await rm(path, { force: true });
     }
   };
 }
@@ -10811,6 +11193,34 @@ function toRpcError(error) {
 function describeIssues(issues) {
   return `invalid params: ${issues.slice(0, 5).map((i) => `${i.path.map(String).join(".") || "(root)"}: ${i.message}`).join("; ")}`.slice(0, 500);
 }
+async function removeStalePointer(path) {
+  const exists = await stat(path).then((s) => s, () => {
+    return;
+  });
+  if (!exists)
+    return;
+  if (!exists.isFile())
+    throw new MessagingError("invalid_request", "pipe file path exists and is not a file");
+  let pipe;
+  try {
+    pipe = readPointer(path).pipe;
+  } catch {
+    pipe = undefined;
+  }
+  if (pipe !== undefined && await answers(pipe))
+    throw new MessagingError("invalid_request", "another daemon is already listening on this socket");
+  await rm(path, { force: true });
+}
+function answers(path) {
+  return new Promise((resolve) => {
+    const probe = net2.connect(path);
+    probe.once("connect", () => {
+      probe.destroy();
+      resolve(true);
+    });
+    probe.once("error", () => resolve(false));
+  });
+}
 async function removeStaleSocket(path) {
   const exists = await stat(path).then((s) => s, () => {
     return;
@@ -10836,6 +11246,7 @@ var init_server = __esm(() => {
   init_dist();
   init_framing();
   init_paths();
+  init_pipes();
   init_rpc();
   init_trust();
   MAX_BUFFERED_BYTES = 8 * 1024 * 1024;
@@ -10849,6 +11260,7 @@ var init_dist2 = __esm(() => {
   init_paths();
   init_rpc();
   init_trust();
+  init_windows_acl();
 });
 
 // packages/daemon/dist/direct-config.js
@@ -10932,7 +11344,7 @@ var init_direct_config = __esm(() => {
 
 // packages/daemon/dist/identity/record.js
 import { createPrivateKey as createPrivateKey2 } from "crypto";
-import { closeSync as closeSync2, constants as constants2, fstatSync, fsyncSync, openSync as openSync2, readFileSync as readFileSync2, renameSync, unlinkSync, writeSync } from "fs";
+import { closeSync as closeSync2, constants as constants3, existsSync as existsSync3, fstatSync, fsyncSync, linkSync, readFileSync as readFileSync4, renameSync as renameSync2, rmSync as rmSync3, statSync, unlinkSync, writeSync } from "fs";
 function isQuotable(value) {
   return QUOTABLE.test(value);
 }
@@ -10971,9 +11383,9 @@ function decodeSecret(secret) {
 function readIdentityJson(path) {
   let text;
   try {
-    const fd = openSync2(path, constants2.O_RDONLY | constants2.O_NOFOLLOW);
+    const fd = openNoFollow(path, constants3.O_RDONLY);
     try {
-      text = readFileSync2(fd, "utf8");
+      text = readFileSync4(fd, "utf8");
     } finally {
       closeSync2(fd);
     }
@@ -10997,7 +11409,7 @@ function isPointer(raw) {
 function replaceIdentityFile(path, text) {
   let old;
   try {
-    old = openSync2(path, constants2.O_RDWR | constants2.O_NOFOLLOW);
+    old = openNoFollow(path, constants3.O_RDWR);
   } catch (error) {
     const code = error.code;
     if (code === "ELOOP")
@@ -11005,27 +11417,56 @@ function replaceIdentityFile(path, text) {
     if (code !== "ENOENT")
       throw error;
   }
+  let aside;
+  if (IS_WINDOWS && old !== undefined) {
+    closeSync2(old);
+    old = undefined;
+    aside = `${path}.${process.pid}.old`;
+    dropAside(aside, path);
+    linkSync(path, aside);
+  }
+  let renamed = false;
   try {
     const temp = `${path}.${process.pid}.tmp`;
-    const fd = openSync2(temp, constants2.O_WRONLY | constants2.O_CREAT | constants2.O_TRUNC | constants2.O_NOFOLLOW, 384);
+    const fd = openNoFollow(temp, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_TRUNC, 384);
     try {
       writeSync(fd, text);
       fsyncSync(fd);
     } finally {
       closeSync2(fd);
     }
-    renameSync(temp, path);
+    renameSync2(temp, path);
+    renamed = true;
     if (old !== undefined)
       scrub(old);
+    if (aside !== undefined)
+      scrubFile(aside);
   } finally {
     if (old !== undefined)
       closeSync2(old);
+    if (aside !== undefined && !renamed)
+      rmSync3(aside, { force: true });
   }
 }
+function dropAside(aside, path) {
+  let same = false;
+  try {
+    const a = statSync(aside, { bigint: true });
+    const b = statSync(path, { bigint: true });
+    same = a.ino === b.ino && a.dev === b.dev;
+  } catch (error) {
+    if (error.code === "ENOENT" && !existsSync3(aside))
+      return;
+  }
+  if (same)
+    rmSync3(aside, { force: true });
+  else
+    scrubFile(aside);
+}
 function scrubFile(path) {
   let fd;
   try {
-    fd = openSync2(path, constants2.O_RDWR | constants2.O_NOFOLLOW);
+    fd = openNoFollow(path, constants3.O_RDWR);
   } catch (error) {
     if (error.code === "ENOENT")
       return;
@@ -11055,6 +11496,7 @@ function x25519(d) {
 }
 var MAX_RETAINED = 8, PrivateKey322, KeyRecord, QUOTABLE, KeychainPath, KeychainPointer, X25519_PKCS8;
 var init_record = __esm(() => {
+  init_dist2();
   init_zod();
   init_dist();
   PrivateKey322 = string2().regex(/^[A-Za-z0-9_-]{43}$/, "32 bytes, base64url without padding");
@@ -11082,35 +11524,41 @@ var init_record = __esm(() => {
 });
 
 // packages/daemon/dist/home.js
-import { chmodSync, chownSync, existsSync as existsSync2, lstatSync as lstatSync2, mkdirSync as mkdirSync4, readFileSync as readFileSync3, renameSync as renameSync2, statSync, writeFileSync } from "fs";
-import { join as join3, resolve as resolve2 } from "path";
+import { chmodSync, chownSync, existsSync as existsSync4, lstatSync as lstatSync2, mkdirSync as mkdirSync4, readFileSync as readFileSync5, renameSync as renameSync3, statSync as statSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join4, resolve as resolve2 } from "path";
 function homePaths(home) {
   const root = resolve2(home);
   return {
     home: root,
-    identity: join3(root, "identity.json"),
-    config: join3(root, "config.json"),
-    db: join3(root, "messaging.db"),
-    run: join3(root, "run"),
+    identity: join4(root, "identity.json"),
+    config: join4(root, "config.json"),
+    db: join4(root, "messaging.db"),
+    run: join4(root, "run"),
     agentSocket: socketPath(root, "agent"),
     adminSocket: socketPath(root, "admin"),
-    lock: join3(root, "run", "messagingd.lock"),
-    logs: join3(root, "logs"),
-    log: join3(root, "logs", "messagingd.log")
+    lock: join4(root, "run", "messagingd.lock"),
+    logs: join4(root, "logs"),
+    log: join4(root, "logs", "messagingd.log")
   };
 }
 function ensureHome(paths) {
   for (const dir of [paths.home, paths.run, paths.logs]) {
+    let created = false;
     if (dir === paths.home)
-      mkdirSync4(dir, { recursive: true, mode: 448 });
+      created = mkdirSync4(dir, { recursive: true, mode: 448 }) !== undefined;
     else {
       try {
         mkdirSync4(dir, { mode: 448 });
+        created = true;
       } catch (error) {
         if (error.code !== "EEXIST")
           throw error;
       }
     }
+    if (IS_WINDOWS) {
+      adoptPrivateDir(dir, dir, created);
+      continue;
+    }
     const problem = privacyProblem(lstatSync2(dir));
     if (problem !== undefined)
       throw new MessagingError("forbidden", `${dir} is not private: it ${problem}`);
@@ -11118,6 +11566,8 @@ function ensureHome(paths) {
   }
 }
 function shareAgentSocket(paths, group) {
+  if (IS_WINDOWS)
+    throw new MessagingError("invalid_request", "ipc.agentGroup is not supported on Windows: messagingd and its clients run as one user there");
   for (const dir of [paths.home, paths.run]) {
     try {
       chownSync(dir, process.geteuid?.() ?? -1, group);
@@ -11128,11 +11578,11 @@ function shareAgentSocket(paths, group) {
   }
 }
 function readConfig(path) {
-  if (!existsSync2(path))
+  if (!existsSync4(path))
     return structuredClone(DEFAULT_CONFIG);
   let raw;
   try {
-    raw = parseWire(readFileSync3(path, "utf8"));
+    raw = parseWire(readFileSync5(path, "utf8"));
   } catch {
     throw new MessagingError("invalid_request", `${path} is not valid JSON`);
   }
@@ -11150,16 +11600,16 @@ function writeConfig(path, config) {
 }
 function configStamp(path) {
   try {
-    return statSync(path).mtimeMs;
+    return statSync2(path).mtimeMs;
   } catch {
     return 0;
   }
 }
 function writeAtomic(path, text) {
   const temp = `${path}.${process.pid}.tmp`;
-  writeFileSync(temp, text, { mode: 384 });
+  writeFileSync2(temp, text, { mode: 384 });
   chmodSync(temp, 384);
-  renameSync2(temp, path);
+  renameSync3(temp, path);
 }
 var PRESENCE_FIELDS, PresenceField, Config, DEFAULT_CONFIG, RETENTION_DEFAULTS, ROTATE_ENC_DAYS = 7, QUOTA_DEFAULTS;
 var init_home = __esm(() => {
@@ -11204,10 +11654,10 @@ var init_home = __esm(() => {
 });
 
 // packages/daemon/dist/lock.js
-import { chmodSync as chmodSync2, closeSync as closeSync3, openSync as openSync3, readFileSync as readFileSync4, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "fs";
+import { chmodSync as chmodSync2, closeSync as closeSync3, openSync as openSync2, readFileSync as readFileSync6, renameSync as renameSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync3 } from "fs";
 function readPid(path) {
   try {
-    const text = readFileSync4(path, "utf8").trim();
+    const text = readFileSync6(path, "utf8").trim();
     return /^\d+$/.test(text) ? Number(text) : undefined;
   } catch {
     return;
@@ -11220,7 +11670,7 @@ function isBusy(error) {
 function acquireLock(path) {
   const dbPath = `${path}.db`;
   try {
-    closeSync3(openSync3(dbPath, "wx", 384));
+    closeSync3(openSync2(dbPath, "wx", 384));
   } catch (error) {
     if (error.code !== "EEXIST")
       throw error;
@@ -11238,10 +11688,10 @@ function acquireLock(path) {
   }
   try {
     const temp = `${path}.${process.pid}.tmp`;
-    writeFileSync2(temp, `${process.pid}
+    writeFileSync3(temp, `${process.pid}
 `, { mode: 384 });
     chmodSync2(temp, 384);
-    renameSync3(temp, path);
+    renameSync4(temp, path);
   } catch (error) {
     db.close();
     throw error;
@@ -11281,14 +11731,14 @@ var init_lock = __esm(() => {
 });
 
 // packages/daemon/dist/identity/keychain.js
-import { spawnSync } from "child_process";
-import { existsSync as existsSync3 } from "fs";
+import { spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync5 } from "fs";
 function keychainAvailable(run = runSecurity) {
-  if (process.platform !== "darwin" || !existsSync3(SECURITY))
+  if (process.platform !== "darwin" || !existsSync5(SECURITY))
     return false;
   const result = run(["default-keychain", "-d", "user"], { timeoutMs: 5000 });
   const path = result.status === 0 ? /"(.+)"/.exec(result.stdout)?.[1] : undefined;
-  return path !== undefined && existsSync3(path);
+  return path !== undefined && existsSync5(path);
 }
 
 class KeychainStore {
@@ -11457,7 +11907,7 @@ function keychainError(op, result) {
   }
 }
 var SECURITY = "/usr/bin/security", KEYCHAIN_SERVICE = "messaging-identity", LABEL = "messaging-identity", COMMENT = "Messaging machine keys: see messaging identity show", MAX_SECRET = 2000, READ_TIMEOUT_MS = 120000, WRITE_TIMEOUT_MS = 60000, runSecurity = (args, { input, timeoutMs }) => {
-  const result = spawnSync(SECURITY, args, {
+  const result = spawnSync2(SECURITY, args, {
     input: input ?? "",
     encoding: "utf8",
     timeout: timeoutMs,
@@ -11604,18 +12054,18 @@ var init_identity2 = __esm(() => {
 });
 
 // packages/daemon/dist/pairing.js
-import { chmodSync as chmodSync3, closeSync as closeSync4, constants as constants3, fstatSync as fstatSync2, openSync as openSync4, readFileSync as readFileSync5, renameSync as renameSync4, unlinkSync as unlinkSync3, writeFileSync as writeFileSync3 } from "fs";
-import { join as join5 } from "path";
+import { chmodSync as chmodSync3, closeSync as closeSync4, constants as constants4, fstatSync as fstatSync2, readFileSync as readFileSync7, renameSync as renameSync5, unlinkSync as unlinkSync3, writeFileSync as writeFileSync4 } from "fs";
+import { join as join6 } from "path";
 function pairingPath(home) {
-  return join5(home, "pairing.json");
+  return join6(home, "pairing.json");
 }
 function readPairing(home) {
   const path = pairingPath(home);
   let text;
   try {
-    const fd = openSync4(path, constants3.O_RDONLY | constants3.O_NOFOLLOW);
+    const fd = openNoFollow(path, constants4.O_RDONLY);
     try {
-      text = readFileSync5(fd, "utf8");
+      text = readFileSync7(fd, "utf8");
     } finally {
       closeSync4(fd);
     }
@@ -11644,15 +12094,15 @@ function writePairing(home, pending) {
   const { identity, ...rest } = pending;
   const body = JSON.stringify({ v: PROTOCOL, ...rest, identity: exportIdentity(identity) });
   const temp = `${path}.${process.pid}.tmp`;
-  writeFileSync3(temp, body, { mode: 384 });
+  writeFileSync4(temp, body, { mode: 384 });
   chmodSync3(temp, 384);
-  renameSync4(temp, path);
+  renameSync5(temp, path);
 }
 function removePairing(home) {
   const path = pairingPath(home);
   let fd;
   try {
-    fd = openSync4(path, constants3.O_WRONLY | constants3.O_NOFOLLOW);
+    fd = openNoFollow(path, constants4.O_WRONLY);
   } catch (error) {
     const code = error.code;
     if (code === "ENOENT")
@@ -11662,7 +12112,7 @@ function removePairing(home) {
     throw error;
   }
   try {
-    writeFileSync3(fd, Buffer.alloc(fstatSync2(fd).size));
+    writeFileSync4(fd, Buffer.alloc(fstatSync2(fd).size));
   } finally {
     closeSync4(fd);
   }
@@ -11670,6 +12120,7 @@ function removePairing(home) {
 }
 var PairingFile;
 var init_pairing = __esm(() => {
+  init_dist2();
   init_zod();
   init_dist();
   PairingFile = discriminatedUnion("kind", [
@@ -12240,7 +12691,7 @@ var init_chat = __esm(() => {
 });
 
 // packages/daemon/dist/log.js
-import { closeSync as closeSync5, constants as constants4, lstatSync as lstatSync3, openSync as openSync5, renameSync as renameSync5, writeSync as writeSync2 } from "fs";
+import { closeSync as closeSync5, constants as constants5, lstatSync as lstatSync3, renameSync as renameSync6, writeSync as writeSync2 } from "fs";
 function formatLine(level, event, fields = {}) {
   const record = { t: new Date().toISOString(), level, event };
   for (const [name, value] of Object.entries(fields))
@@ -12267,7 +12718,7 @@ function createLogger(options) {
           rotate2(file, keep);
           size = 0;
         }
-        const fd = openSync5(file, constants4.O_WRONLY | constants4.O_APPEND | constants4.O_CREAT | constants4.O_NOFOLLOW, 384);
+        const fd = openNoFollow(file, constants5.O_WRONLY | constants5.O_APPEND | constants5.O_CREAT, 384);
         try {
           writeSync2(fd, line);
         } finally {
@@ -12292,10 +12743,10 @@ function currentSize(file) {
 function rotate2(file, keep) {
   for (let n = keep - 1;n >= 1; n--) {
     try {
-      renameSync5(`${file}.${n}`, `${file}.${n + 1}`);
+      renameSync6(`${file}.${n}`, `${file}.${n + 1}`);
     } catch {}
   }
-  renameSync5(file, `${file}.1`);
+  renameSync6(file, `${file}.1`);
 }
 
 class LogBudget {
@@ -12330,6 +12781,7 @@ function codeOf(error) {
 }
 var RANK, LOG_MAX_BYTES, LOG_KEEP = 3;
 var init_log = __esm(() => {
+  init_dist2();
   RANK = { debug: 0, info: 1, warn: 2, error: 3 };
   LOG_MAX_BYTES = 10 * 1024 * 1024;
 });
@@ -13401,7 +13853,7 @@ var init_storage_errors = __esm(() => {
 });
 
 // packages/daemon/dist/store.js
-import { chmodSync as chmodSync4, closeSync as closeSync6, openSync as openSync6 } from "fs";
+import { chmodSync as chmodSync4, closeSync as closeSync6, openSync as openSync3 } from "fs";
 import { DatabaseSync } from "node:sqlite";
 function additiveColumn(decl) {
   if (/\b(PRIMARY|UNIQUE|CHECK|REFERENCES|COLLATE|GENERATED|AS)\b/i.test(decl))
@@ -13454,7 +13906,7 @@ class Store {
   #depth = 0;
   constructor(path) {
     if (path !== ":memory:") {
-      closeSync6(openSync6(path, "a", 384));
+      closeSync6(openSync3(path, "a", 384));
       chmodSync4(path, 384);
     }
     this.#db = new DatabaseSync(path, { timeout: 5000 });
@@ -14374,13 +14826,14 @@ var init_version = __esm(() => {
 });
 
 // packages/daemon/dist/wake-bridge.js
-import { closeSync as closeSync7, constants as constants5, fstatSync as fstatSync3, openSync as openSync7, readSync } from "fs";
+import { closeSync as closeSync7, constants as constants6, fstatSync as fstatSync3, lstatSync as lstatSync4, openSync as openSync4, readSync } from "fs";
 import { request } from "http";
 import { homedir as homedir2 } from "os";
-import { isAbsolute, join as join6 } from "path";
-function serviceFile(env = process.env) {
-  const state = env.XDG_STATE_HOME && isAbsolute(env.XDG_STATE_HOME) ? env.XDG_STATE_HOME : join6(env.HOME || homedir2(), ".local", "state");
-  return join6(state, "opencode", "service.json");
+import { isAbsolute, join as join7 } from "path";
+function serviceFile(env = process.env, windows = IS_WINDOWS) {
+  const home = (windows ? env.USERPROFILE : env.HOME) || homedir2();
+  const state = env.XDG_STATE_HOME && isAbsolute(env.XDG_STATE_HOME) ? env.XDG_STATE_HOME : join7(home, ".local", "state");
+  return join7(state, "opencode", "service.json");
 }
 function loopbackOrigin(url) {
   let parsed;
@@ -14397,16 +14850,27 @@ function loopbackOrigin(url) {
   return parsed.origin;
 }
 function readService(file) {
+  if (IS_WINDOWS) {
+    try {
+      const stats = lstatSync4(file);
+      if (stats.isSymbolicLink() || !stats.isFile() || aclProblem(file, { pinnedOwner: false }) !== undefined)
+        return "service_unsafe";
+    } catch (error) {
+      if (error instanceof MessagingError && error.code === "daemon_unavailable")
+        return "no_service";
+      return error.code === "ENOENT" ? "no_service" : "service_unsafe";
+    }
+  }
   let fd;
   try {
-    fd = openSync7(file, constants5.O_RDONLY | constants5.O_NOFOLLOW);
+    fd = openSync4(file, constants6.O_RDONLY | constants6.O_NOFOLLOW);
   } catch (error) {
     return error.code === "ENOENT" ? "no_service" : "service_unsafe";
   }
   try {
     const stats = fstatSync3(fd);
     const euid = process.geteuid?.();
-    if (!stats.isFile() || euid !== undefined && stats.uid !== euid || (stats.mode & 18) !== 0)
+    if (!stats.isFile() || !IS_WINDOWS && (euid !== undefined && stats.uid !== euid || (stats.mode & 18) !== 0))
       return "service_unsafe";
     const buffer = Buffer.alloc(SERVICE_BYTES + 1);
     const length = readSync(fd, buffer, 0, buffer.length, 0);
@@ -14621,6 +15085,7 @@ function post2(url, headers, body, signal) {
 var WAKE_RPC, BRIDGE_TIMING, SERVICE_BYTES = 4096, ANSWER_BYTES = 65536, AnswerTooLarge;
 var init_wake_bridge = __esm(() => {
   init_dist();
+  init_dist2();
   WAKE_RPC = { id: "messaging.opencode", method: "wake" };
   BRIDGE_TIMING = { timeoutMs: 1e4, retryMs: [1000, 2000, 4000], concurrency: 4, batch: 16 };
   AnswerTooLarge = class AnswerTooLarge extends Error {
@@ -18479,20 +18944,20 @@ var CHAT_COMMANDS = [list, read, post, search];
 init_dist();
 init_dist2();
 import { spawn } from "child_process";
-import { closeSync, constants, existsSync, mkdirSync as mkdirSync3, openSync, readFileSync } from "fs";
-import { join as join2 } from "path";
+import { closeSync, constants as constants2, existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync3 } from "fs";
+import { join as join3 } from "path";
 function logPath(home) {
-  return join2(home, "logs", "messagingd.log");
+  return join3(home, "logs", "messagingd.log");
 }
 function outputPath(home) {
-  return join2(home, "logs", "messagingd.out");
+  return join3(home, "logs", "messagingd.out");
 }
 function lockPath(home) {
-  return join2(home, "run", "messagingd.lock");
+  return join3(home, "run", "messagingd.lock");
 }
 function openOutput(path) {
   try {
-    return openSync(path, constants.O_WRONLY | constants.O_APPEND | constants.O_CREAT | constants.O_NOFOLLOW, 384);
+    return openNoFollow(path, constants2.O_WRONLY | constants2.O_APPEND | constants2.O_CREAT, 384);
   } catch (error) {
     const code = error.code ?? "error";
     const why = code === "ELOOP" ? "it is a symlink" : code;
@@ -18508,7 +18973,7 @@ function positive(n) {
 }
 function readLockPid(home) {
   try {
-    return parseLockPid(readFileSync(lockPath(home), "utf8"));
+    return parseLockPid(readFileSync3(lockPath(home), "utf8"));
   } catch {
     return;
   }
@@ -18568,7 +19033,7 @@ var start = {
       return;
     }
     const command = daemonCommand(ctx.io);
-    mkdirSync3(join2(ctx.home, "logs"), { recursive: true, mode: 448 });
+    mkdirSync3(join3(ctx.home, "logs"), { recursive: true, mode: 448 });
     const output = outputPath(ctx.home);
     const fd = openOutput(output);
     let exited;
@@ -18576,6 +19041,7 @@ var start = {
       const child = spawn(command[0], [...command.slice(1), "--home", ctx.home], {
         cwd: ctx.home,
         detached: true,
+        windowsHide: true,
         env: daemonEnv(ctx.io.env, ctx.home),
         stdio: ["ignore", fd, fd]
       });
@@ -18603,12 +19069,12 @@ var start = {
 };
 function daemonCommand(io) {
   if (io.daemonCommand) {
-    if (!existsSync(io.daemonCommand[0]))
+    if (!existsSync2(io.daemonCommand[0]))
       throw new MessagingError("internal", "cannot find the messagingd executable");
     return io.daemonCommand;
   }
   const script = io.messagingd;
-  if (!script || !existsSync(script))
+  if (!script || !existsSync2(script))
     throw new MessagingError("internal", "cannot find messagingd.js next to messaging.js");
   return [io.execPath ?? process.execPath, script];
 }
@@ -18658,8 +19124,10 @@ var stop = {
   details: [
     "Asks messagingd to shut down (daemon.stop) and waits for its socket to go away.",
     "If messagingd does not answer it, sends SIGTERM instead, but only to the pid the daemon on the",
-    "socket reports, and only when <home>/run/messagingd.lock names the same pid.",
-    "A messagingd of another Messaging version gets SIGTERM the same way, at the pid its hello reports."
+    "socket reports, and only when <home>/run/messagingd.lock names the same pid, then and at the moment of the signal.",
+    "A messagingd of another Messaging version gets SIGTERM the same way, at the pid its hello reports.",
+    `On Windows, which has no signals, "SIGTERM" ends the process at once (TerminateProcess); the home's`,
+    "lock is released and the store stays consistent."
   ].join(`
 `),
   args: { min: 0, max: 0 },
@@ -18672,8 +19140,8 @@ var stop = {
         throw new MessagingError("daemon_mismatch", `the process on the messagingd socket does not say which version it is${locked !== undefined ? `, and its lock names pid ${locked}` : ""}; stop it with the \`messaging daemon stop\` of its own version, or end that process yourself`);
       }
       const pid = verifiedPid(locked, hello.pid);
-      ctx.out.note(`messagingd for this home is version ${inline(hello.version, 64)}, not this messaging's; sending SIGTERM to pid ${pid}.`);
-      await terminate(ctx, pid, "SIGTERM");
+      ctx.out.note(`messagingd for this home is version ${inline(hello.version, 64)}, not this messaging's; ${SIGNAL_NOTE} pid ${pid}.`);
+      await terminate(ctx, pid, "SIGTERM", locked);
       return;
     }
     if (!running) {
@@ -18690,23 +19158,30 @@ var stop = {
     const request = await requestStop(ctx);
     if (request !== "accepted") {
       pid = verifiedPid(locked, pid);
-      ctx.out.note(`messagingd did not answer daemon.stop; sending SIGTERM to pid ${pid}.`);
+      ctx.out.note(`messagingd did not answer daemon.stop; ${SIGNAL_NOTE} pid ${pid}.`);
     }
-    await terminate(ctx, pid, request === "accepted" ? "daemon.stop" : "SIGTERM");
+    await terminate(ctx, pid, request === "accepted" ? "daemon.stop" : "SIGTERM", locked);
   }
 };
-async function terminate(ctx, pid, method) {
+var SIGNAL_NOTE = IS_WINDOWS ? "ending (TerminateProcess)" : "sending SIGTERM to";
+async function terminate(ctx, pid, method, locked) {
   if (method === "SIGTERM" && pid !== undefined) {
-    try {
-      process.kill(pid, "SIGTERM");
-    } catch (error) {
-      if (error.code !== "ESRCH")
-        throw new MessagingError("forbidden", `cannot signal messagingd (pid ${pid})`);
-    }
+    const now = locked === undefined ? pid : readLockPid(ctx.home);
+    if (now !== pid) {
+      if (now !== undefined)
+        throw new MessagingError("internal", `the lock now names pid ${now}, not ${pid}; not sending a signal`);
+      ctx.out.note(`messagingd (pid ${pid}) released its lock; not sending a signal.`);
+    } else
+      try {
+        process.kill(pid, "SIGTERM");
+      } catch (error) {
+        if (error.code !== "ESRCH")
+          throw new MessagingError("forbidden", `cannot signal messagingd (pid ${pid})`);
+      }
   }
   const which = pid !== undefined ? `messagingd (pid ${pid})` : "messagingd";
   const deadline = Date.now() + ctx.timing.stopTimeoutMs;
-  while (existsSync(ctx.socketPath) && (pid === undefined || alive(pid))) {
+  while (existsSync2(ctx.socketPath) && (pid === undefined || alive(pid))) {
     if (Date.now() >= deadline) {
       throw new MessagingError("internal", `${which} ${method === "daemon.stop" ? "accepted daemon.stop but " : ""}did not stop within ${duration2(ctx.timing.stopTimeoutMs)}`);
     }
@@ -19462,7 +19937,7 @@ var invite = {
     ctx.out.note(`${person} joins with: messaging team join - --label <label>   (then paste the ticket and press Ctrl-D)`);
   }
 };
-var join4 = {
+var join5 = {
   name: "team join",
   summary: "Join a team with an invite ticket",
   usage: "<ticket|-> --label <label>",
@@ -19752,7 +20227,7 @@ var prepare = {
     ctx.out.note("Give this machine id to the relay operator for --allow-team-create, then run `messaging team create`.");
   }
 };
-var TEAM_COMMANDS = [prepare, create, invite, join4, members2, remove, role, revokeInvite, card, add, pair, claim2, pairCancel];
+var TEAM_COMMANDS = [prepare, create, invite, join5, members2, remove, role, revokeInvite, card, add, pair, claim2, pairCancel];
 
 // packages/daemon/dist/cli/version.js
 init_dist();
@@ -19815,7 +20290,7 @@ function resolveTarget(words) {
   const spec = BY_NAME.get(first);
   return spec ? { kind: "command", spec, rest: words.slice(1) } : { kind: "unknown", name: first };
 }
-async function run(argv, io) {
+async function run2(argv, io) {
   const args = [...argv];
   let values;
   let positionals;
@@ -19982,7 +20457,7 @@ function cliMain(argv, start) {
       process.exit(process.exitCode ?? 0);
   });
   const env = process.env;
-  return run([...argv], {
+  return run2([...argv], {
     stdout: process.stdout,
     stderr: process.stderr,
     get stdin() {
@@ -20074,17 +20549,18 @@ ${USAGE}`);
 `);
     return 1;
   }
+  const signals = process.platform === "win32" ? ["SIGINT", "SIGBREAK"] : ["SIGTERM", "SIGINT"];
   const signal = await Promise.race([
     new Promise((done) => {
-      process.once("SIGTERM", () => done("SIGTERM"));
-      process.once("SIGINT", () => done("SIGINT"));
+      for (const name of signals)
+        process.once(name, () => done(name));
     }),
     daemon.closed.then(() => {
       return;
     })
   ]);
   if (signal !== undefined) {
-    for (const name of ["SIGTERM", "SIGINT"])
+    for (const name of signals)
       process.once(name, () => process.exit(1));
     log("info", "daemon.signal", { signal });
   }
@@ -20093,9 +20569,10 @@ ${USAGE}`);
 }
 
 // packages/daemon/dist/bin/dispatch.js
-import { basename } from "path";
-function dispatch(argv0, argv) {
-  if (basename(argv0) === "messaging")
+import { basename, win32 } from "path";
+function dispatch(argv0, argv, windows = process.platform === "win32") {
+  const name = windows ? win32.basename(argv0).toLowerCase().replace(/\.exe$/, "") : basename(argv0);
+  if (name === "messaging")
     return { mode: "cli", args: argv };
   if (argv[0] === "cli")
     return { mode: "cli", args: argv.slice(1) };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@joe-broadhead/messaging-bin-linux-x64-gnu",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "The self-contained messagingd executable for one platform: the Messaging daemon and its CLI (`messagingd cli …`, or invoked as `messaging`), with no Node.js, npm install or install script on the machine",
   "license": "MIT",
   "author": "Joe Broadhead",