@love-moon/conductor-cli 0.10.0 → 0.11.0

package/src/daemon.js

@@ -38,6 +38,7 @@ import {
 import { resolveResumeContext } from "./fire/resume.js";
 import {
   filterRuntimeSupportedAllowCliList,
+  inferBuiltInRuntimeBackendFromCommand,
   listAdvertisedBackends,
   resolveConfiguredRuntimeBackend,
   isBuiltInRuntimeBackend,
@@ -46,6 +47,7 @@ import {
   normalizeRuntimeBackendAlias,
   normalizeRuntimeBackendName,
 } from "./runtime-backends.js";
+import { resolveClaudeCommandForRoot } from "@love-moon/ai-sdk";
 import {
   PACKAGE_NAME,
   buildUpgradeCommand,
@@ -67,7 +69,31 @@ import {
   maskErrorForLogs,
   redactSecretsForLogs,
 } from "./handoff-log-mask.js";
+import {
+  DAEMON_LOCK_FILE_NAME,
+  FORCE_KILL_UNKNOWN_OWNER_ENV_VAR,
+  buildDaemonInstanceIdentity,
+  compareDaemonLockIdentity,
+  describeDaemonLockOwner,
+  describeForceRestartRefusal,
+  parseDaemonLockState,
+  serializeDaemonLock,
+} from "./daemon-lock.js";
 import { StringDecoder } from "node:string_decoder";
+import {
+  MAX_GUEST_DAEMONS,
+  buildGuestConfigYaml,
+  buildGuestEnv,
+  filterGuestCapabilities,
+  isGuestAiManagerActionAllowed,
+  isGuestRestartAllowed,
+  isPathInsideGuestRoot,
+  nextRestartDelayMs,
+  reconcileGuests,
+  startOrphanWatchdog,
+  resolveGuestPaths,
+  writeGuestConfig,
+} from "./guest-daemon.js";
 
 dotenv.config();
 
@@ -76,6 +102,10 @@ const __dirname = path.dirname(__filename);
 const PACKAGE_ROOT = path.join(__dirname, "..");
 const moduleRequire = createRequire(import.meta.url);
 const CLI_PATH = path.resolve(PACKAGE_ROOT, "bin", "conductor-fire.js");
+// RFC 0035: the launcher a guest daemon child is spawned with. Same binary as
+// the host daemon, so guests always match the installed version and there is
+// no second update path to keep in sync.
+const DAEMON_LAUNCHER_PATH = path.resolve(PACKAGE_ROOT, "bin", "conductor-daemon.js");
 const CLI_VERSION = (() => {
   try {
     return JSON.parse(fs.readFileSync(path.join(PACKAGE_ROOT, "package.json"), "utf-8")).version;
@@ -493,6 +523,18 @@ export function ensureNodePtySpawnHelperExecutable(deps = {}) {
   return { helperPath, updated: true };
 }
 
+// A tool-preset PTY task runs the configured allow_cli_list command through a
+// login shell, bypassing ai-sdk entirely. claude refuses to start as root with
+// `--dangerously-skip-permissions`, so rewrite the command the same way the
+// ai-sdk session rewrites its permission mode — one shared root check, so the
+// two paths cannot drift.
+export function resolvePtyToolPresetCommand(cliCommand, env = process.env) {
+  if (inferBuiltInRuntimeBackendFromCommand(cliCommand) !== "claude") {
+    return cliCommand;
+  }
+  return resolveClaudeCommandForRoot(cliCommand, env);
+}
+
 export function isSafeTaskWorktreeRoot(projectWorkspacePath, worktreeRoot) {
   const normalizedWorkspacePath =
     typeof projectWorkspacePath === "string" ? projectWorkspacePath.trim() : "";
@@ -675,6 +717,12 @@ function parseTaskWorktreeLaunchConfig(launchConfig) {
     projectRepoRoot,
     projectWorkspacePath,
     projectRelativePath,
+    // Reuse-only members (reviewers in a multi-agent group) share the owner's
+    // worktree but must never run `git worktree add` themselves.
+    worktreeReuseOnly: normalizeBooleanFlag(
+      normalizedLaunchConfig.worktreeReuseOnly ??
+        normalizedLaunchConfig.worktree_reuse_only,
+    ),
   };
 }
 
@@ -772,6 +820,106 @@ function buildPtyTaskEnv(baseEnv = process.env, launchEnv = {}) {
   };
 }
 
+// Module-level so the PTY launch wiring is directly testable: the tool-preset
+// branch has to hand the *child's* env to the root check, and that seam is
+// exactly where a bug hid before (the check read the daemon's own process.env,
+// silently ignoring a per-task IS_SANDBOX=1 opt-out).
+export function buildPtyLaunchSpec(launchConfig, fallbackCwd, deps = {}) {
+  const allowCliList = deps.allowCliList || {};
+  const supportedBackends = Array.isArray(deps.supportedBackends) ? deps.supportedBackends : [];
+  const existsSyncFn = deps.existsSync || fs.existsSync;
+  const baseEnv = deps.baseEnv || process.env;
+  const log = typeof deps.log === "function" ? deps.log : () => {};
+  const normalizedLaunchConfig = normalizeLaunchConfig(launchConfig);
+  const entrypointType =
+    normalizeOptionalString(normalizedLaunchConfig.entrypoint_type) ||
+    normalizeOptionalString(normalizedLaunchConfig.entrypointType) ||
+    (normalizeOptionalString(normalizedLaunchConfig.tool_preset) ||
+    normalizeOptionalString(normalizedLaunchConfig.toolPreset)
+      ? "tool_preset"
+      : "shell");
+  const preferredShell = resolveDefaultPtyShell({
+    explicitShell: normalizedLaunchConfig.shell,
+    envShell: process.env.SHELL,
+    comspec: process.env.COMSPEC,
+    platform: process.platform,
+    existsSync: existsSyncFn,
+  });
+  const cwd =
+    normalizeOptionalString(normalizedLaunchConfig.cwd) ||
+    fallbackCwd;
+  const env = normalizeTerminalEnv(normalizedLaunchConfig.env);
+  const cols = normalizePositiveInt(
+    normalizedLaunchConfig.cols ?? normalizedLaunchConfig.columns,
+    DEFAULT_TERMINAL_COLS,
+  );
+  const rows = normalizePositiveInt(
+    normalizedLaunchConfig.rows,
+    DEFAULT_TERMINAL_ROWS,
+  );
+
+  if (entrypointType === "tool_preset") {
+    const toolPreset =
+      normalizeOptionalString(normalizedLaunchConfig.tool_preset) ||
+      normalizeOptionalString(normalizedLaunchConfig.toolPreset) ||
+      supportedBackends[0] ||
+      "codex";
+    const cliCommand = allowCliList[toolPreset];
+    if (!cliCommand) {
+      throw new Error(`Unsupported tool preset: ${toolPreset}`);
+    }
+    const launchCommand = resolvePtyToolPresetCommand(cliCommand, buildPtyTaskEnv(baseEnv, env));
+    if (launchCommand !== cliCommand) {
+      log(`[pty] Adjusted ${toolPreset} command for root: ${launchCommand}`);
+    }
+    return {
+      entrypointType,
+      toolPreset,
+      command: preferredShell,
+      args: ["-lc", launchCommand],
+      shell: preferredShell,
+      cwd,
+      env,
+      cols,
+      rows,
+    };
+  }
+
+  if (entrypointType === "custom") {
+    const command = normalizeOptionalString(normalizedLaunchConfig.command);
+    if (!command) {
+      throw new Error("launch_config.command is required for custom entrypoint");
+    }
+    const args = Array.isArray(normalizedLaunchConfig.args)
+      ? normalizedLaunchConfig.args.filter((value) => typeof value === "string")
+      : [];
+    return {
+      entrypointType,
+      toolPreset: null,
+      command,
+      args,
+      shell: preferredShell,
+      cwd,
+      env,
+      cols,
+      rows,
+    };
+  }
+
+  return {
+    entrypointType: "shell",
+    toolPreset: null,
+    command: preferredShell,
+    args: ["-l"],
+    shell: preferredShell,
+    cwd,
+    env,
+    cols,
+    rows,
+  };
+}
+
+
 export function startDaemon(config = {}, deps = {}) {
   const exitFn = deps.exit || process.exit;
   const killFn = deps.kill || process.kill;
@@ -881,6 +1029,24 @@ export function startDaemon(config = {}, deps = {}) {
   // warning and silently fall back to direct spawn rather than failing every
   // create_task with ENOENT.
   const FIRE_TMUX_MODE_ENABLED = getFireTmuxModeEnabled(userConfig);
+  // RFC 0035: a guest daemon runs on someone else's machine as a different
+  // account. It keeps the ordinary daemon code path but drops the capabilities
+  // that would mutate state the machine's OWNER depends on.
+  const IS_GUEST_DAEMON =
+    userConfig.conductor_guest === true ||
+    fileConfig?.conductorGuest === true ||
+    Boolean(normalizeOptionalString(process.env.CONDUCTOR_GUEST_SHARE_ID));
+  // Only set when the share carries an explicit `workspaceRoot`, i.e. the owner
+  // deliberately scoped where the guest should work. Absent that, a guest binds
+  // projects wherever any other daemon could -- inventing a confinement the
+  // owner never asked for would make the guest gratuitously less capable, and
+  // it was never a security boundary anyway (the grantee's agent runs a shell).
+  const GUEST_ROOT = normalizeOptionalString(process.env.CONDUCTOR_GUEST_ROOT);
+  // A guest resolves `remote_exec` from its own config exactly like any other
+  // daemon. It is not withheld: the grantee already has a shell here through
+  // AI tasks and `pty_task`'s custom entrypoint, so blocking the scriptable
+  // path would cost function without removing reach (RFC 0034 makes the same
+  // argument). An owner who wants it off can set `remote_exec: false`.
   const remoteExecEnabled = getRemoteExecEnabled(userConfig);
 
   // Get allow_cli_list from config
@@ -911,6 +1077,17 @@ export function startDaemon(config = {}, deps = {}) {
       readFileSync: deps.readFileSync || fs.readFileSync,
     }));
   const skipPidLockCheck = parseBooleanEnv(process.env.CONDUCTOR_TUI_DEBUG);
+  // Fingerprint of *this* daemon instance, persisted into daemon.pid so that a
+  // later `--force` can tell "restart myself" apart from "kill whoever happens
+  // to hold the lock". WORKSPACE_ROOT defaults to $HOME/ws, so unrelated
+  // instances collide on the same lock file by default.
+  const daemonInstanceIdentity = buildDaemonInstanceIdentity({
+    conductorHome: materializedConductorPathEnv.CONDUCTOR_HOME,
+    configPath: effectiveConfigPath,
+    workspaceRoot: WORKSPACE_ROOT,
+    daemonName: AGENT_NAME,
+    backendUrl: BACKEND_HTTP,
+  });
   const lockHandoffToken =
     normalizeOptionalString(config.LOCK_HANDOFF_TOKEN) ||
     normalizeOptionalString(process.env.CONDUCTOR_LOCK_HANDOFF_TOKEN);
@@ -2453,6 +2630,79 @@ export function startDaemon(config = {}, deps = {}) {
     });
   }
 
+  // In-flight worktree preparations keyed on the on-disk root. Group members
+  // (worker + reviewers) start almost simultaneously and would otherwise all
+  // pass the `.git` existence check below and race on `git worktree add -b`
+  // for the same branch: one wins and the losers fail with
+  // "Failed to prepare git worktree". Serializing per root also benefits the
+  // pre-existing fork/branch sharing path.
+  const taskWorktreePreparations = new Map();
+
+  // Readiness marker, written by the owner only after the worktree is FULLY
+  // prepared. `.git` alone is not a readiness signal: it appears the moment
+  // `git worktree add` returns, while submodules and symlinks are still
+  // pending. An owner that dies in between (e.g. submodule sync hits its
+  // timeout) would otherwise leave `.git` behind and let reuse-only members
+  // walk into a half-built directory.
+  //
+  // It lives NEXT TO the worktree, not inside it: an untracked file inside
+  // would make `git status --porcelain` report the worktree as dirty and block
+  // non-forced cleanup.
+  function taskWorktreeReadyMarkerPath(worktreeRoot) {
+    return `${worktreeRoot}.ready`;
+  }
+
+  function removeTaskWorktreeReadyMarker(worktreeRoot) {
+    const markerPath = taskWorktreeReadyMarkerPath(worktreeRoot);
+    if (!existsSyncFn(markerPath)) {
+      return;
+    }
+    try {
+      unlinkSyncFn(markerPath);
+    } catch (error) {
+      if (error?.code !== "ENOENT") {
+        logError(
+          `[worktree] failed to clear ready marker for ${worktreeRoot}: ${error?.message || error}`,
+        );
+      }
+    }
+  }
+
+  // Both must hold. Requiring `.git` too means a marker left behind by a
+  // worktree that was removed outside our cleanup path cannot fake readiness.
+  function isTaskWorktreeReady(worktreeRoot, gitMarkerPath) {
+    return (
+      existsSyncFn(gitMarkerPath) &&
+      existsSyncFn(taskWorktreeReadyMarkerPath(worktreeRoot))
+    );
+  }
+
+  async function waitForSharedTaskWorktree({ taskId, worktreeRoot, gitMarkerPath }) {
+    const deadline = Date.now() + TASK_WORKTREE_REUSE_WAIT_TIMEOUT_MS;
+    for (;;) {
+      // When the owner is preparing in this same daemon process we await the
+      // whole preparation (worktree add + submodules + symlinks). Polling the
+      // marker additionally covers an owner that already finished, or one
+      // running in a different process.
+      const inflight = taskWorktreePreparations.get(worktreeRoot);
+      if (inflight) {
+        await inflight;
+      }
+      if (isTaskWorktreeReady(worktreeRoot, gitMarkerPath)) {
+        return;
+      }
+      if (Date.now() >= deadline) {
+        throw new Error(
+          `Timed out waiting for shared git worktree ${worktreeRoot} for ${taskId}. ` +
+            `Its owner task may have failed midway through preparation.`,
+        );
+      }
+      await new Promise((resolve) =>
+        setTimeout(resolve, TASK_WORKTREE_REUSE_POLL_INTERVAL_MS),
+      );
+    }
+  }
+
   async function ensureTaskWorktree({ taskId, projectId, launchConfig }) {
     const worktreeConfig = parseTaskWorktreeLaunchConfig(launchConfig);
     if (!worktreeConfig) {
@@ -2465,7 +2715,50 @@ export function startDaemon(config = {}, deps = {}) {
     );
     const finalCwd = resolveTaskWorktreeCwd(worktreeRoot, worktreeConfig.projectRelativePath);
     const gitMarkerPath = path.join(worktreeRoot, ".git");
+
+    if (worktreeConfig.worktreeReuseOnly) {
+      await waitForSharedTaskWorktree({ taskId, worktreeRoot, gitMarkerPath });
+      mkdirSyncFn(finalCwd, { recursive: true });
+      return finalCwd;
+    }
+
+    const inflight = taskWorktreePreparations.get(worktreeRoot);
+    if (inflight) {
+      await inflight;
+    }
+    // Prepare when we are the first owner here, or when the preparation we
+    // waited on did not leave a fully-prepared worktree (then we take over).
+    if (!inflight || !isTaskWorktreeReady(worktreeRoot, gitMarkerPath)) {
+      const preparation = prepareTaskWorktree({
+        taskId,
+        worktreeConfig,
+        worktreeRoot,
+        gitMarkerPath,
+        finalCwd,
+      });
+      // Waiters must never inherit our rejection; they re-check `.git` instead.
+      taskWorktreePreparations.set(worktreeRoot, preparation.catch(() => {}));
+      try {
+        await preparation;
+      } finally {
+        taskWorktreePreparations.delete(worktreeRoot);
+      }
+    }
+    return finalCwd;
+  }
+
+  async function prepareTaskWorktree({
+    taskId,
+    worktreeConfig,
+    worktreeRoot,
+    gitMarkerPath,
+    finalCwd,
+  }) {
     if (!existsSyncFn(gitMarkerPath)) {
+      // A worktree removed outside our cleanup path can leave a stale marker
+      // behind. Clear it before recreating, so a reuse-only member cannot read
+      // "ready" while `git worktree add` is still running.
+      removeTaskWorktreeReadyMarker(worktreeRoot);
       const { syncBranch } = readProjectWorktreeSettings(worktreeConfig.projectWorkspacePath);
       if (syncBranch) {
         try {
@@ -2563,7 +2856,8 @@ export function startDaemon(config = {}, deps = {}) {
       projectWorkspacePath: worktreeConfig.projectWorkspacePath,
       finalCwd,
     });
-    return finalCwd;
+    // Publish readiness last: every step above has to have succeeded.
+    writeFileSyncFn(taskWorktreeReadyMarkerPath(worktreeRoot), "");
   }
 
   const RTC_MODULE_CANDIDATES = resolveRtcModuleCandidates(process.env.CONDUCTOR_PTY_RTC_MODULES);
@@ -2596,6 +2890,17 @@ export function startDaemon(config = {}, deps = {}) {
     process.env.CONDUCTOR_WORKTREE_SUBMODULE_SYNC_TIMEOUT_MS,
     120_000,
   );
+  // A reuse-only member waits for the owner to create the shared worktree.
+  // The bound has to cover a cold clone's submodule sync, hence the generous
+  // default; it only ever elapses when the owner never starts or hard-fails.
+  const TASK_WORKTREE_REUSE_WAIT_TIMEOUT_MS = parsePositiveInt(
+    process.env.CONDUCTOR_WORKTREE_REUSE_WAIT_TIMEOUT_MS,
+    180_000,
+  );
+  const TASK_WORKTREE_REUSE_POLL_INTERVAL_MS = parsePositiveInt(
+    process.env.CONDUCTOR_WORKTREE_REUSE_POLL_INTERVAL_MS,
+    250,
+  );
   const SHUTDOWN_STATUS_REPORT_TIMEOUT_MS = parsePositiveInt(
     process.env.CONDUCTOR_SHUTDOWN_STATUS_REPORT_TIMEOUT_MS,
     1000,
@@ -2637,36 +2942,7 @@ export function startDaemon(config = {}, deps = {}) {
     DEFAULT_TERMINAL_RESUME_SNAPSHOT_MAX_BYTES,
   );
 
-  const readLockState = () => {
-    const raw = String(readFileSyncFn(LOCK_FILE, "utf-8") || "").trim();
-    if (!raw) {
-      return null;
-    }
-
-    const pid = Number.parseInt(raw, 10);
-    if (!Number.isNaN(pid) && pid > 0) {
-      return {
-        pid,
-        handoffFromPid: null,
-        handoffToken: null,
-        handoffExpiresAt: null,
-      };
-    }
-
-    try {
-      const parsed = JSON.parse(raw);
-      const parsedPid = normalizePositiveInt(parsed?.pid, null);
-      const parsedHandoffFromPid = normalizePositiveInt(parsed?.handoff_from_pid, null);
-      return {
-        pid: parsedPid ?? parsedHandoffFromPid,
-        handoffFromPid: parsedHandoffFromPid,
-        handoffToken: normalizeOptionalString(parsed?.handoff_token),
-        handoffExpiresAt: normalizePositiveInt(parsed?.handoff_expires_at, null),
-      };
-    } catch {
-      return null;
-    }
-  };
+  const readLockState = () => parseDaemonLockState(readFileSyncFn(LOCK_FILE, "utf-8"));
 
   const hasMatchingLockHandoff = (lockState) => {
     if (!lockState || !lockHandoffToken || !lockHandoffFromPid) {
@@ -2705,7 +2981,7 @@ export function startDaemon(config = {}, deps = {}) {
     return exitAndReturn(1);
   }
 
-  const LOCK_FILE = path.join(WORKSPACE_ROOT, "daemon.pid");
+  const LOCK_FILE = path.join(WORKSPACE_ROOT, DAEMON_LOCK_FILE_NAME);
   try {
     if (skipPidLockCheck) {
       log("CONDUCTOR_TUI_DEBUG enabled; skipping daemon PID lock enforcement");
@@ -2722,6 +2998,21 @@ export function startDaemon(config = {}, deps = {}) {
               const alive = isProcessAlive(pid);
               if (alive) {
                 if (config.FORCE) {
+                  const forceRefusal = describeForceRestartRefusal({
+                    lockState,
+                    identity: daemonInstanceIdentity,
+                    lockFile: LOCK_FILE,
+                    env: process.env,
+                  });
+                  if (forceRefusal) {
+                    logError(forceRefusal);
+                    return exitAndReturn(1);
+                  }
+                  if (compareDaemonLockIdentity(lockState, daemonInstanceIdentity) === "unknown") {
+                    log(
+                      `${FORCE_KILL_UNKNOWN_OWNER_ENV_VAR} is set: stopping PID ${pid} even though the lock file carries no instance identity`,
+                    );
+                  }
                   log(`Force enabled: stopping existing daemon PID ${pid}`);
                   let alreadyExited = false;
                   try {
@@ -2763,7 +3054,9 @@ export function startDaemon(config = {}, deps = {}) {
                     unlinkSyncFn(LOCK_FILE);
                   }
                 } else {
-                  logError(`Daemon already running with PID ${pid}`);
+                  logError(
+                    `Daemon already running with PID ${pid} — ${describeDaemonLockOwner(lockState)}. Use --force to restart it.`,
+                  );
                   return exitAndReturn(1);
                 }
               } else {
@@ -2784,7 +3077,10 @@ export function startDaemon(config = {}, deps = {}) {
           unlinkSyncFn(LOCK_FILE);
         }
       }
-      writeFileSyncFn(LOCK_FILE, process.pid.toString());
+      writeFileSyncFn(
+        LOCK_FILE,
+        serializeDaemonLock({ pid: process.pid, identity: daemonInstanceIdentity }),
+      );
     }
   } catch (err) {
     logError("Failed to acquire lock:", err);
@@ -2811,13 +3107,15 @@ export function startDaemon(config = {}, deps = {}) {
     if (skipPidLockCheck) {
       return;
     }
+    // Keeps the instance identity attached while the handoff window is open so
+    // an unrelated instance racing a `--force` during a restart still sees who
+    // owns the lock.
     writeFileSyncFn(
       LOCK_FILE,
-      JSON.stringify({
+      serializeDaemonLock({
         pid: handoffFromPid,
-        handoff_from_pid: handoffFromPid,
-        handoff_token: handoffToken,
-        handoff_expires_at: handoffExpiresAt,
+        identity: daemonInstanceIdentity,
+        handoff: { handoffFromPid, handoffToken, handoffExpiresAt },
       }),
     );
   };
@@ -2895,6 +3193,18 @@ export function startDaemon(config = {}, deps = {}) {
     removeProcessListener("unhandledRejection", onUnhandledRejection);
   };
 
+  // RFC 0035: never leave guest daemons orphaned. They are children of this
+  // process, so without this they would survive the host daemon and keep
+  // serving a share the owner believes is stopped.
+  const stopGuestsOnExit = () => {
+    try {
+      stopAllGuestDaemons("host daemon exiting");
+    } catch {
+      // best effort during shutdown
+    }
+  };
+  process.on("exit", stopGuestsOnExit);
+
   process.on("exit", cleanupLock);
   process.on("SIGINT", onSigInt);
   process.on("SIGTERM", onSigTerm);
@@ -3022,6 +3332,7 @@ export function startDaemon(config = {}, deps = {}) {
   };
   const advertisedCapabilities = [
     "project_path_validation",
+    "project_path_create",
     "project_agents_registry",
     "restart_daemon",
     "refresh_session_inplace",
@@ -3036,10 +3347,31 @@ export function startDaemon(config = {}, deps = {}) {
   if (ptyTaskCapabilityEnabled) {
     advertisedCapabilities.push("pty_task", "terminal_snapshot");
   }
-  if (advertisedCapabilities.length > 0) {
-    extraHeaders["x-conductor-capabilities"] = advertisedCapabilities.join(",");
+  // RFC 0035: strip capabilities a guest must never offer. `ai_manager` stays
+  // advertised on purpose -- the grantee needs to see how much AI quota is left
+  // on the borrowed machine -- but its `switch_account` action is refused at
+  // dispatch, because that one rewrites `~/.codex/auth.json` and would change
+  // the machine owner's own active account.
+  const effectiveCapabilities = IS_GUEST_DAEMON
+    ? filterGuestCapabilities(advertisedCapabilities)
+    : advertisedCapabilities;
+  if (IS_GUEST_DAEMON) {
+    log(
+      `[guest] Running as a shared guest daemon; capabilities=${effectiveCapabilities.join(",")}` +
+        (GUEST_ROOT ? `, root=${GUEST_ROOT}` : "")
+    );
+    // If the host daemon is SIGKILLed, nothing else would stop this process.
+    startOrphanWatchdog({
+      onOrphaned: () => {
+        logError("[guest] Host daemon is gone; shutting down to avoid an orphaned share");
+        exitAndReturn(0);
+      },
+    });
+  }
+  if (effectiveCapabilities.length > 0) {
+    extraHeaders["x-conductor-capabilities"] = effectiveCapabilities.join(",");
   }
-  const aiManagerHandlers = createAiManagerHandlers({ configPath: effectiveConfigPath });
+  const aiManagerHandlers = (deps.createAiManagerHandlers || createAiManagerHandlers)({ configPath: effectiveConfigPath });
   const customCommandHandlers = createCustomCommandHandlers({ configPath: effectiveConfigPath });
   const remoteExecHandlers = remoteExecEnabled
     ? createRemoteExecHandlers({ defaultWorkspace: homeDir })
@@ -3173,6 +3505,12 @@ export function startDaemon(config = {}, deps = {}) {
       logError(`Failed to connect: ${err}`);
     });
 
+    // RFC 0035: keep one child daemon per accepted share. A guest never
+    // supervises anything itself, or a share chain could nest.
+    if (!IS_GUEST_DAEMON) {
+      void reconcileGuestDaemons();
+    }
+
     if (!AUTO_UPDATE_ENABLED && autoUpdateSupportedInstall === false) {
       if (installMethod === "homebrew") {
         log(`[auto-update] Disabled for Homebrew install; use ${buildUpgradeCommand({ env: process.env })}`);
@@ -3183,6 +3521,9 @@ export function startDaemon(config = {}, deps = {}) {
 
     const runMaintenanceTick = async () => {
       void runDaemonWatchdog();
+      if (!IS_GUEST_DAEMON) {
+        void reconcileGuestDaemons();
+      }
       try {
         await checkForUpdate();
       } catch {
@@ -3683,6 +4024,165 @@ export function startDaemon(config = {}, deps = {}) {
     await restartDaemonProcess("auto-update");
   }
 
+  // ---------------------------------------------------------------------
+  // RFC 0035: guest daemon supervision.
+  //
+  // For each share the backend reports as active, run one child
+  // `conductor daemon` that authenticates as the grantee. The child is an
+  // ordinary daemon in every respect; what makes it a guest is its isolated
+  // CONDUCTOR_HOME/CONDUCTOR_WS and the grantee's scoped token.
+  // ---------------------------------------------------------------------
+  /** shareId -> { child, guestHost, restartTimer, stopping } */
+  const guestDaemons = new Map();
+  // Failure counts must outlive the entry they describe. The restart path
+  // deletes the entry and re-asks the backend (so a share revoked during
+  // backoff stays dead), which means a per-entry counter resets to 0 on every
+  // respawn and the exponential backoff degrades into a permanent 10s loop.
+  const guestFailureCounts = new Map();
+  let guestReconcileInFlight = false;
+
+  function stopGuestDaemon(shareId, reason) {
+    const entry = guestDaemons.get(shareId);
+    if (!entry) return;
+    entry.stopping = true;
+    if (entry.restartTimer) clearTimeout(entry.restartTimer);
+    guestDaemons.delete(shareId);
+    guestFailureCounts.delete(shareId);
+    if (entry.child && entry.child.exitCode === null && !entry.child.killed) {
+      log(`[guest] Stopping guest ${entry.guestHost} (${reason})`);
+      try {
+        entry.child.kill("SIGTERM");
+      } catch {
+        // already gone
+      }
+    }
+  }
+
+  function stopAllGuestDaemons(reason) {
+    for (const shareId of [...guestDaemons.keys()]) {
+      stopGuestDaemon(shareId, reason);
+    }
+  }
+
+  function spawnGuestDaemon(share) {
+    const paths = resolveGuestPaths(share.id, share.workspaceRoot, homeDir);
+    try {
+      writeGuestConfig(
+        paths,
+        buildGuestConfigYaml({
+          agentToken: share.agentToken,
+          backendUrl: BACKEND_HTTP,
+          guestHost: share.guestHost,
+          workspace: paths.workspace,
+          allowCliList: RAW_ALLOW_CLI_LIST,
+        })
+      );
+    } catch (error) {
+      logError(`[guest] Failed to materialize config for ${share.guestHost}: ${error?.message || error}`);
+      return;
+    }
+
+    const env = buildGuestEnv(process.env, paths, {
+      shareId: share.id,
+      explicitRoot: Boolean(share.workspaceRoot),
+    });
+    const child = spawn(
+      process.execPath,
+      [DAEMON_LAUNCHER_PATH, "--config-file", paths.configPath],
+      { env, stdio: "ignore", detached: false }
+    );
+
+    const entry = {
+      child,
+      guestHost: share.guestHost,
+      restartTimer: null,
+      stopping: false,
+    };
+    guestDaemons.set(share.id, entry);
+    log(`[guest] Started guest ${share.guestHost} for ${share.granteeLabel || "grantee"} (pid=${child.pid})`);
+
+    child.on("exit", (code, signal) => {
+      const current = guestDaemons.get(share.id);
+      // Either we asked it to stop, or a newer entry already replaced it.
+      if (!current || current.child !== child || current.stopping) return;
+      const failures = (guestFailureCounts.get(share.id) || 0) + 1;
+      guestFailureCounts.set(share.id, failures);
+      const delay = nextRestartDelayMs(failures);
+      log(
+        `[guest] Guest ${share.guestHost} exited (code=${code}, signal=${signal}); ` +
+          `restarting in ${Math.round(delay / 1000)}s (failure ${failures})`
+      );
+      current.restartTimer = setTimeout(() => {
+        // Don't resurrect from a stale timer: re-check with the backend
+        // instead, so a share revoked while we were backing off stays dead.
+        guestDaemons.delete(share.id);
+        void reconcileGuestDaemons();
+      }, delay);
+      if (typeof current.restartTimer.unref === "function") current.restartTimer.unref();
+    });
+
+    child.on("error", (error) => {
+      // Node emits `error` without `exit` for e.g. ENOENT. Without this the
+      // entry would sit in the map forever: reconcile counts it as running, so
+      // it is never retried and never started.
+      logError(`[guest] Guest ${share.guestHost} failed to spawn: ${error?.message || error}`);
+      const current = guestDaemons.get(share.id);
+      if (!current || current.child !== child || current.stopping) return;
+      const failures = (guestFailureCounts.get(share.id) || 0) + 1;
+      guestFailureCounts.set(share.id, failures);
+      guestDaemons.delete(share.id);
+      const timer = setTimeout(() => void reconcileGuestDaemons(), nextRestartDelayMs(failures));
+      if (typeof timer.unref === "function") timer.unref();
+    });
+  }
+
+  async function fetchActiveShares() {
+    const url = `${BACKEND_HTTP}/api/daemon-shares/mine?daemonHost=${encodeURIComponent(AGENT_NAME)}`;
+    // Without a deadline a hung backend pins `guestReconcileInFlight` for
+    // undici's 300s default, and nothing else clears it -- the supervisor goes
+    // silently deaf for five minutes.
+    const response = await fetch(url, {
+      headers: { Authorization: `Bearer ${AGENT_TOKEN}` },
+      signal: AbortSignal.timeout(15_000),
+    });
+    if (!response.ok) {
+      // A backend that predates this feature returns 404; that is not an error
+      // worth logging on every maintenance tick.
+      if (response.status === 404) return null;
+      throw new Error(`HTTP ${response.status}`);
+    }
+    const body = await response.json();
+    return Array.isArray(body?.shares) ? body.shares : [];
+  }
+
+  async function reconcileGuestDaemons() {
+    if (guestReconcileInFlight || daemonShuttingDown) return;
+    guestReconcileInFlight = true;
+    try {
+      const shares = await fetchActiveShares();
+      if (shares === null) return;
+      const running = new Set(guestDaemons.keys());
+      const { start, stop, skipped } = reconcileGuests(shares, running, MAX_GUEST_DAEMONS);
+      for (const shareId of stop) {
+        stopGuestDaemon(shareId, "share no longer active");
+      }
+      for (const share of start) {
+        spawnGuestDaemon(share);
+      }
+      if (skipped > 0) {
+        // Never drop guests silently -- a share that looks accepted in the UI
+        // but never runs is the hardest kind of bug to report.
+        log(
+          `[guest] ${skipped} share(s) not started: at the ${MAX_GUEST_DAEMONS}-guest limit for this daemon`
+        );
+      }
+    } catch (error) {
+      logError(`[guest] Failed to reconcile guest daemons: ${error?.message || error}`);
+    } finally {
+      guestReconcileInFlight = false;
+    }
+  }
+
   async function handleRestartDaemon(payload) {
     const requestId = payload?.request_id ? String(payload.request_id) : "";
     const targetVersionRaw = payload?.target_version
@@ -3708,6 +4208,22 @@ export function startDaemon(config = {}, deps = {}) {
       return;
     }
 
+    // RFC 0035: a versioned restart runs a *global* `npm install -g`, which
+    // would swap the CLI binary out from under the machine owner's own daemon
+    // and every one of their fire processes. A guest may restart itself, but
+    // it may not change the machine's installed version.
+    if (IS_GUEST_DAEMON && !isGuestRestartAllowed(payload)) {
+      log(
+        `[restart_daemon] Refused (${requestId}): guest daemons cannot install version ${targetVersionRaw}`
+      );
+      sendAgentCommandAck({
+        requestId,
+        eventType: "restart_daemon",
+        accepted: false,
+      }).catch(() => {});
+      return;
+    }
+
     autoUpdateInProgress = true;
     try {
       log(
@@ -4315,89 +4831,12 @@ export function startDaemon(config = {}, deps = {}) {
   }
 
   function resolvePtyLaunchSpec(launchConfig, fallbackCwd) {
-    const normalizedLaunchConfig = normalizeLaunchConfig(launchConfig);
-    const entrypointType =
-      normalizeOptionalString(normalizedLaunchConfig.entrypoint_type) ||
-      normalizeOptionalString(normalizedLaunchConfig.entrypointType) ||
-      (normalizeOptionalString(normalizedLaunchConfig.tool_preset) ||
-      normalizeOptionalString(normalizedLaunchConfig.toolPreset)
-        ? "tool_preset"
-        : "shell");
-    const preferredShell = resolveDefaultPtyShell({
-      explicitShell: normalizedLaunchConfig.shell,
-      envShell: process.env.SHELL,
-      comspec: process.env.COMSPEC,
-      platform: process.platform,
+    return buildPtyLaunchSpec(launchConfig, fallbackCwd, {
+      allowCliList: ALLOW_CLI_LIST,
+      supportedBackends: SUPPORTED_BACKENDS,
       existsSync: existsSyncFn,
+      log,
     });
-    const cwd =
-      normalizeOptionalString(normalizedLaunchConfig.cwd) ||
-      fallbackCwd;
-    const env = normalizeTerminalEnv(normalizedLaunchConfig.env);
-    const cols = normalizePositiveInt(
-      normalizedLaunchConfig.cols ?? normalizedLaunchConfig.columns,
-      DEFAULT_TERMINAL_COLS,
-    );
-    const rows = normalizePositiveInt(
-      normalizedLaunchConfig.rows,
-      DEFAULT_TERMINAL_ROWS,
-    );
-
-    if (entrypointType === "tool_preset") {
-      const toolPreset =
-        normalizeOptionalString(normalizedLaunchConfig.tool_preset) ||
-        normalizeOptionalString(normalizedLaunchConfig.toolPreset) ||
-        SUPPORTED_BACKENDS[0] ||
-        "codex";
-      const cliCommand = ALLOW_CLI_LIST[toolPreset];
-      if (!cliCommand) {
-        throw new Error(`Unsupported tool preset: ${toolPreset}`);
-      }
-      return {
-        entrypointType,
-        toolPreset,
-        command: preferredShell,
-        args: ["-lc", cliCommand],
-        shell: preferredShell,
-        cwd,
-        env,
-        cols,
-        rows,
-      };
-    }
-
-    if (entrypointType === "custom") {
-      const command = normalizeOptionalString(normalizedLaunchConfig.command);
-      if (!command) {
-        throw new Error("launch_config.command is required for custom entrypoint");
-      }
-      const args = Array.isArray(normalizedLaunchConfig.args)
-        ? normalizedLaunchConfig.args.filter((value) => typeof value === "string")
-        : [];
-      return {
-        entrypointType,
-        toolPreset: null,
-        command,
-        args,
-        shell: preferredShell,
-        cwd,
-        env,
-        cols,
-        rows,
-      };
-    }
-
-    return {
-      entrypointType: "shell",
-      toolPreset: null,
-      command: preferredShell,
-      args: ["-l"],
-      shell: preferredShell,
-      cwd,
-      env,
-      cols,
-      rows,
-    };
   }
 
   function getTerminalChunkByteLength(data) {
@@ -4913,6 +5352,10 @@ export function startDaemon(config = {}, deps = {}) {
           { cwd: worktreeConfig.projectRepoRoot },
         );
       }
+      // The marker lives outside the worktree, so `git worktree remove` does
+      // not take it with the directory. Leaving it behind would let a worktree
+      // later recreated on this path look ready before it is prepared.
+      removeTaskWorktreeReadyMarker(worktreeRoot);
 
       await reportTaskWorktreeCleanupResult({
         requestId,
@@ -5284,6 +5727,26 @@ export function startDaemon(config = {}, deps = {}) {
       return;
     }
     if (event.type === "ai_manager_request") {
+      // RFC 0035: reads are fine and genuinely useful to a guest (it needs to
+      // know how much quota the borrowed machine has left). `switch_account` is
+      // not: `AiManager` resolves the codex auth path from `homedir()`, so a
+      // guest switching accounts renames over `~/.codex/auth.json` and changes
+      // the machine owner's own daemon, running fires, and interactive `codex`.
+      const aiAction = event.payload?.action;
+      if (IS_GUEST_DAEMON && !isGuestAiManagerActionAllowed(aiAction)) {
+        log(`[guest] Refused ai_manager action '${aiAction}' on a shared daemon`);
+        client
+          .send({
+            type: "ai_manager_response",
+            payload: {
+              request_id: event.payload?.request_id,
+              error: "Account switching is disabled on a shared daemon",
+              error_code: "guest_forbidden",
+            },
+          })
+          .catch(() => {});
+        return;
+      }
       handleAiManagerRequest(client, aiManagerHandlers, event.payload).catch((error) => {
         logError(`Unhandled ai_manager_request failure: ${error?.message || error}`);
       });
@@ -5406,6 +5869,7 @@ export function startDaemon(config = {}, deps = {}) {
   async function handleValidateProjectPath(payload) {
     const requestId = payload?.request_id ? String(payload.request_id).trim() : "";
     const rawWorkspacePath = payload?.workspace_path ? String(payload.workspace_path).trim() : "";
+    const createIfMissing = payload?.create_if_missing === true;
     const validatedAt = new Date().toISOString();
 
     if (!requestId || !rawWorkspacePath) {
@@ -5413,6 +5877,27 @@ export function startDaemon(config = {}, deps = {}) {
       return;
     }
 
+    // RFC 0035: keep a guest inside the directory its owner set aside. This is
+    // misuse prevention, not a security boundary -- the guest's AI agent runs a
+    // shell and can reach anything the OS user can. It matters because neither
+    // handler is otherwise bounded: this one will `mkdirSync(recursive)` any
+    // absolute path it is handed.
+    if (IS_GUEST_DAEMON && GUEST_ROOT && !isPathInsideGuestRoot(rawWorkspacePath, GUEST_ROOT)) {
+      await client.sendJson({
+        type: "project_path_validated",
+        payload: {
+          request_id: requestId,
+          daemon_host: AGENT_NAME,
+          workspace_path: rawWorkspacePath,
+          error: `Path is outside the shared workspace root (${GUEST_ROOT})`,
+          error_code: "outside_guest_root",
+          validated_at: new Date().toISOString(),
+        },
+      });
+      return;
+    }
+
+
     let result = {
       workspacePath: null,
       repoRoot: null,
@@ -5429,7 +5914,22 @@ export function startDaemon(config = {}, deps = {}) {
 
     try {
       const resolvedPath = path.resolve(rawWorkspacePath);
-      if (!existsSyncFn(resolvedPath)) {
+      let createError = null;
+      if (createIfMissing && !existsSyncFn(resolvedPath)) {
+        try {
+          mkdirSyncFn(resolvedPath, { recursive: true });
+          log(`Created workspace path on request: ${resolvedPath}`);
+        } catch (error) {
+          createError = error;
+        }
+      }
+      if (createError) {
+        result = {
+          ...result,
+          error: `Failed to create workspace path on daemon ${AGENT_NAME}: ${createError?.message || createError}`,
+          errorCode: "workspace_create_failed",
+        };
+      } else if (!existsSyncFn(resolvedPath)) {
         result = {
           ...result,
           error: `Workspace path does not exist on daemon ${AGENT_NAME}: ${rawWorkspacePath}`,
@@ -5522,6 +6022,27 @@ export function startDaemon(config = {}, deps = {}) {
       return;
     }
 
+    // RFC 0035: keep a guest inside the directory its owner set aside. This is
+    // misuse prevention, not a security boundary -- the guest's AI agent runs a
+    // shell and can reach anything the OS user can. It matters because neither
+    // handler is otherwise bounded: this one will `mkdirSync(recursive)` any
+    // absolute path it is handed.
+    if (IS_GUEST_DAEMON && GUEST_ROOT && !isPathInsideGuestRoot(rawWorkspacePath, GUEST_ROOT)) {
+      await client.sendJson({
+        type: "project_agents_resolved",
+        payload: {
+          request_id: requestId,
+          daemon_host: AGENT_NAME,
+          workspace_path: rawWorkspacePath,
+          error: `Path is outside the shared workspace root (${GUEST_ROOT})`,
+          error_code: "outside_guest_root",
+          resolved_at: new Date().toISOString(),
+        },
+      });
+      return;
+    }
+
+
     let result = {
       workspacePath: null,
       agents: [],