@love-moon/conductor-cli 0.2.20 → 0.2.21

package/src/daemon.js

@@ -11,15 +11,32 @@ import yaml from "js-yaml";
 import { ConductorWebSocketClient, ConductorConfig, loadConfig, ConfigFileNotFound } from "@love-moon/conductor-sdk";
 import { DaemonLogCollector } from "./log-collector.js";
 import { filterRuntimeSupportedAllowCliList, normalizeRuntimeBackendName } from "./runtime-backends.js";
+import {
+  PACKAGE_NAME,
+  fetchLatestVersion,
+  isNewerVersion,
+  detectPackageManager,
+  parseUpdateWindow,
+  isInUpdateWindow,
+  isManagedInstallPath,
+} from "./version-check.js";
 
 dotenv.config();
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
+const PACKAGE_ROOT = path.join(__dirname, "..");
 const moduleRequire = createRequire(import.meta.url);
-const CLI_PATH = path.resolve(__dirname, "..", "bin", "conductor-fire.js");
+const CLI_PATH = path.resolve(PACKAGE_ROOT, "bin", "conductor-fire.js");
 const DAEMON_LOG_DIR = path.join(os.homedir(), ".conductor", "logs");
 const DAEMON_LOG_PATH = path.join(DAEMON_LOG_DIR, "conductor-daemon.log");
+const CLI_VERSION = (() => {
+  try {
+    return JSON.parse(fs.readFileSync(path.join(PACKAGE_ROOT, "package.json"), "utf-8")).version;
+  } catch {
+    return "unknown";
+  }
+})();
 const PLAN_LIMIT_MESSAGES = {
   manual_fire_active_task: "Free plan limit reached: only 1 active fire task is allowed.",
   app_active_task: "Free plan limit reached: only 1 active app task is allowed.",
@@ -200,6 +217,16 @@ function normalizeOptionalString(value) {
   return normalized || null;
 }
 
+function normalizeStringArray(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value
+    .filter((entry) => typeof entry === "string")
+    .map((entry) => entry.trim())
+    .filter(Boolean);
+}
+
 function normalizePositiveInt(value, fallback) {
   const parsed = Number.parseInt(String(value ?? ""), 10);
   if (Number.isFinite(parsed) && parsed > 0) {
@@ -329,6 +356,43 @@ export function startDaemon(config = {}, deps = {}) {
   // Get allow_cli_list from config
   const ALLOW_CLI_LIST = getAllowCliList(userConfig);
   const SUPPORTED_BACKENDS = Object.keys(ALLOW_CLI_LIST);
+  const fetchLatestVersionFn = deps.fetchLatestVersion || fetchLatestVersion;
+  const isNewerVersionFn = deps.isNewerVersion || isNewerVersion;
+  const detectPackageManagerFn = deps.detectPackageManager || detectPackageManager;
+  const parseUpdateWindowFn = deps.parseUpdateWindow || parseUpdateWindow;
+  const isInUpdateWindowFn = deps.isInUpdateWindow || isInUpdateWindow;
+  const isManagedInstallPathFn = deps.isManagedInstallPath || isManagedInstallPath;
+  const installedPackageRoot = deps.packageRoot || PACKAGE_ROOT;
+  const cliVersion = deps.cliVersion || CLI_VERSION;
+  const isBackgroundProcess = deps.isBackgroundProcess ?? !process.stdout.isTTY;
+  const autoUpdateForceLocal = parseBooleanEnv(process.env.CONDUCTOR_AUTO_UPDATE_FORCE_LOCAL);
+  const autoUpdateSupportedInstall =
+    autoUpdateForceLocal || isManagedInstallPathFn(installedPackageRoot);
+  const lockHandoffToken =
+    normalizeOptionalString(config.LOCK_HANDOFF_TOKEN) ||
+    normalizeOptionalString(process.env.CONDUCTOR_LOCK_HANDOFF_TOKEN);
+  const lockHandoffFromPid = normalizePositiveInt(
+    config.LOCK_HANDOFF_FROM_PID || process.env.CONDUCTOR_LOCK_HANDOFF_FROM_PID,
+    null,
+  );
+  const restartLauncherScript = normalizeOptionalString(config.RESTART_LAUNCHER_SCRIPT);
+  const restartLauncherArgs = normalizeStringArray(config.RESTART_LAUNCHER_ARGS);
+  const normalizedVersionCheckArgs = normalizeStringArray(config.VERSION_CHECK_ARGS);
+  const versionCheckScript =
+    normalizeOptionalString(config.VERSION_CHECK_SCRIPT) || restartLauncherScript;
+  const versionCheckArgs =
+    normalizedVersionCheckArgs.length > 0
+      ? normalizedVersionCheckArgs
+      : ["--version"];
+
+  // Auto-update configuration
+  const AUTO_UPDATE_ENABLED =
+    autoUpdateSupportedInstall &&
+    (process.env.CONDUCTOR_AUTO_UPDATE !== "false") &&
+    (userConfig.auto_update !== false);
+  const UPDATE_WINDOW = parseUpdateWindowFn(
+    process.env.CONDUCTOR_UPDATE_WINDOW || userConfig.update_window || "02:00-04:00"
+  );
 
   const spawnFn = deps.spawn || spawn;
   const mkdirSyncFn = deps.mkdirSync || fs.mkdirSync;
@@ -392,6 +456,53 @@ export function startDaemon(config = {}, deps = {}) {
     DEFAULT_TERMINAL_RING_BUFFER_MAX_BYTES,
   );
 
+  const readLockState = () => {
+    const raw = String(readFileSyncFn(LOCK_FILE, "utf-8") || "").trim();
+    if (!raw) {
+      return null;
+    }
+
+    const pid = Number.parseInt(raw, 10);
+    if (!Number.isNaN(pid) && pid > 0) {
+      return {
+        pid,
+        handoffFromPid: null,
+        handoffToken: null,
+        handoffExpiresAt: null,
+      };
+    }
+
+    try {
+      const parsed = JSON.parse(raw);
+      const parsedPid = normalizePositiveInt(parsed?.pid, null);
+      const parsedHandoffFromPid = normalizePositiveInt(parsed?.handoff_from_pid, null);
+      return {
+        pid: parsedPid ?? parsedHandoffFromPid,
+        handoffFromPid: parsedHandoffFromPid,
+        handoffToken: normalizeOptionalString(parsed?.handoff_token),
+        handoffExpiresAt: normalizePositiveInt(parsed?.handoff_expires_at, null),
+      };
+    } catch {
+      return null;
+    }
+  };
+
+  const hasMatchingLockHandoff = (lockState) => {
+    if (!lockState || !lockHandoffToken || !lockHandoffFromPid) {
+      return false;
+    }
+    if (lockState.handoffToken !== lockHandoffToken) {
+      return false;
+    }
+    if (lockState.handoffFromPid !== lockHandoffFromPid) {
+      return false;
+    }
+    if (lockState.handoffExpiresAt && lockState.handoffExpiresAt < Date.now()) {
+      return false;
+    }
+    return true;
+  };
+
   try {
     mkdirSyncFn(WORKSPACE_ROOT, { recursive: true });
   } catch (err) {
@@ -402,44 +513,57 @@ export function startDaemon(config = {}, deps = {}) {
   const LOCK_FILE = path.join(WORKSPACE_ROOT, "daemon.pid");
   try {
     if (existsSyncFn(LOCK_FILE)) {
-      const pid = parseInt(readFileSyncFn(LOCK_FILE, "utf-8"), 10);
-      if (!Number.isNaN(pid)) {
+      const lockState = readLockState();
+      const pid = lockState?.pid;
+      if (pid) {
+        const handoffMatched = hasMatchingLockHandoff(lockState);
         try {
-          const alive = isProcessAlive(pid);
-          if (alive) {
-            if (config.FORCE) {
-              log(`Force enabled: stopping existing daemon PID ${pid}`);
-              try {
-                killFn(pid, "SIGTERM");
-              } catch (killErr) {
-                if (!killErr || killErr.code !== "ESRCH") {
-                  logError(`Failed to stop existing daemon PID ${pid}: ${killErr.message}`);
-                  return exitAndReturn(1);
+          if (handoffMatched) {
+            log(`Taking over daemon lock from PID ${pid} via handoff`);
+          } else {
+            const alive = isProcessAlive(pid);
+            if (alive) {
+              if (config.FORCE) {
+                log(`Force enabled: stopping existing daemon PID ${pid}`);
+                try {
+                  killFn(pid, "SIGTERM");
+                } catch (killErr) {
+                  if (!killErr || killErr.code !== "ESRCH") {
+                    logError(`Failed to stop existing daemon PID ${pid}: ${killErr.message}`);
+                    return exitAndReturn(1);
+                  }
                 }
-              }
-              try {
-                if (isProcessAlive(pid)) {
-                  logError(`Existing daemon PID ${pid} is still running; please stop it manually.`);
+                try {
+                  if (isProcessAlive(pid)) {
+                    logError(`Existing daemon PID ${pid} is still running; please stop it manually.`);
+                    return exitAndReturn(1);
+                  }
+                } catch (checkErr) {
+                  logError(`Failed to verify daemon PID ${pid}: ${checkErr.message}`);
                   return exitAndReturn(1);
                 }
-              } catch (checkErr) {
-                logError(`Failed to verify daemon PID ${pid}: ${checkErr.message}`);
+                log("Removing lock file after force stop");
+                unlinkSyncFn(LOCK_FILE);
+              } else {
+                logError(`Daemon already running with PID ${pid}`);
                 return exitAndReturn(1);
               }
-              log("Removing lock file after force stop");
-              unlinkSyncFn(LOCK_FILE);
             } else {
-              logError(`Daemon already running with PID ${pid}`);
-              return exitAndReturn(1);
+              log("Removing stale lock file");
+              unlinkSyncFn(LOCK_FILE);
             }
-          } else {
-            log("Removing stale lock file");
-            unlinkSyncFn(LOCK_FILE);
           }
         } catch (e) {
-          logError(`Daemon already running with PID ${pid} (access denied)`);
-          return exitAndReturn(1);
+          if (handoffMatched) {
+            log(`Taking over daemon lock from PID ${pid} via handoff`);
+          } else {
+            logError(`Daemon already running with PID ${pid} (access denied)`);
+            return exitAndReturn(1);
+          }
         }
+      } else {
+        log("Removing malformed lock file");
+        unlinkSyncFn(LOCK_FILE);
       }
     }
     writeFileSyncFn(LOCK_FILE, process.pid.toString());
@@ -451,8 +575,8 @@ export function startDaemon(config = {}, deps = {}) {
   const cleanupLock = () => {
     try {
       if (existsSyncFn(LOCK_FILE)) {
-        const pid = parseInt(readFileSyncFn(LOCK_FILE, "utf-8"), 10);
-        if (pid === process.pid) {
+        const lockState = readLockState();
+        if (lockState?.pid === process.pid) {
           unlinkSyncFn(LOCK_FILE);
         }
       }
@@ -461,6 +585,18 @@ export function startDaemon(config = {}, deps = {}) {
     }
   };
 
+  const writeLockHandoff = ({ handoffToken, handoffFromPid, handoffExpiresAt }) => {
+    writeFileSyncFn(
+      LOCK_FILE,
+      JSON.stringify({
+        pid: handoffFromPid,
+        handoff_from_pid: handoffFromPid,
+        handoff_token: handoffToken,
+        handoff_expires_at: handoffExpiresAt,
+      }),
+    );
+  };
+
   process.on("exit", cleanupLock);
   const signalExitCode = (signal) => (signal === "SIGINT" ? 130 : 143);
   const handleSignal = (signal) => {
@@ -544,6 +680,14 @@ export function startDaemon(config = {}, deps = {}) {
   let watchdogLastPresenceMismatchAt = 0;
   let watchdogAwaitingHealthySignalAt = null;
   let watchdogTimer = null;
+
+  // --- Auto-update state ---
+  const VERSION_CHECK_INTERVAL_MS = 6 * 60 * 60 * 1000; // 6 hours
+  let lastVersionCheckAt = 0;
+  let latestKnownVersion = null;
+  let updateAvailable = false;
+  let autoUpdateInProgress = false;
+
   let rtcImplementationPromise = null;
   let rtcAvailabilityLogKey = null;
   const logCollector = createLogCollector(BACKEND_HTTP);
@@ -553,6 +697,7 @@ export function startDaemon(config = {}, deps = {}) {
       "x-conductor-host": AGENT_NAME,
       "x-conductor-backends": SUPPORTED_BACKENDS.join(","),
       "x-conductor-capabilities": "pty_task",
+      "x-conductor-version": cliVersion,
     },
     onConnected: ({ isReconnect, connectedAt } = { isReconnect: false, connectedAt: Date.now() }) => {
       wsConnected = true;
@@ -610,8 +755,15 @@ export function startDaemon(config = {}, deps = {}) {
     logError(`Failed to connect: ${err}`);
   });
 
+  if (!AUTO_UPDATE_ENABLED && autoUpdateSupportedInstall === false) {
+    log("[auto-update] Disabled for local/dev install; set CONDUCTOR_AUTO_UPDATE_FORCE_LOCAL=true to override");
+  }
+
   watchdogTimer = setInterval(() => {
     void runDaemonWatchdog();
+    // Auto-update checks (internally throttled)
+    void checkForUpdate().catch(() => {});
+    void tryAutoUpdate().catch(() => {});
   }, DAEMON_WATCHDOG_INTERVAL_MS);
   if (typeof watchdogTimer?.unref === "function") {
     watchdogTimer.unref();
@@ -769,6 +921,260 @@ export function startDaemon(config = {}, deps = {}) {
     }
   }
 
+  // ---------------------------------------------------------------------------
+  // Auto-update: periodic version check (P1) + safe-window update (P2)
+  // ---------------------------------------------------------------------------
+
+  const SEMVER_RE = /^\d+\.\d+\.\d+(-[\w.]+)?$/;
+
+  async function checkForUpdate() {
+    if (!AUTO_UPDATE_ENABLED || cliVersion === "unknown") return;
+    const now = Date.now();
+    if (now - lastVersionCheckAt < VERSION_CHECK_INTERVAL_MS) return;
+    lastVersionCheckAt = now;
+    try {
+      const latest = await fetchLatestVersionFn();
+      if (!latest || !SEMVER_RE.test(latest)) return; // reject malformed versions
+      if (isNewerVersionFn(latest, cliVersion)) {
+        if (latestKnownVersion !== latest) {
+          log(`[auto-update] New version available: ${cliVersion} -> ${latest}`);
+        }
+        latestKnownVersion = latest;
+        updateAvailable = true;
+      } else {
+        updateAvailable = false;
+        latestKnownVersion = latest;
+      }
+    } catch {
+      /* silent — non-critical */
+    }
+  }
+
+  const AUTO_UPDATE_COOLDOWN_MS = 60 * 60 * 1000; // 1 hour cooldown after failure
+  let lastAutoUpdateFailAt = 0;
+
+  function hasActiveTasks() {
+    return activeTaskProcesses.size > 0 || activePtySessions.size > 0;
+  }
+
+  async function tryAutoUpdate() {
+    if (!AUTO_UPDATE_ENABLED || !updateAvailable || !latestKnownVersion) return;
+    if (autoUpdateInProgress || daemonShuttingDown) return;
+    if (hasActiveTasks()) return;
+    if (!isInUpdateWindowFn(UPDATE_WINDOW)) return;
+    if (Date.now() - lastAutoUpdateFailAt < AUTO_UPDATE_COOLDOWN_MS) return;
+
+    autoUpdateInProgress = true;
+    log(`[auto-update] Starting: ${cliVersion} -> ${latestKnownVersion}`);
+    try {
+      await performAutoUpdate(latestKnownVersion);
+    } catch (err) {
+      logError(`[auto-update] Failed: ${err?.message || err}`);
+      lastAutoUpdateFailAt = Date.now();
+    } finally {
+      autoUpdateInProgress = false;
+    }
+  }
+
+  function runInstallCommand(pm, pkgSpec) {
+    return new Promise((resolve) => {
+      let cmd, args;
+      switch (pm) {
+        case "pnpm":
+          cmd = "pnpm";
+          args = ["add", "-g", pkgSpec];
+          break;
+        case "yarn":
+          cmd = "yarn";
+          args = ["global", "add", pkgSpec];
+          break;
+        default:
+          cmd = "npm";
+          args = ["install", "-g", pkgSpec];
+          break;
+      }
+      let stdout = "";
+      let stderr = "";
+      const child = spawnFn(cmd, args, {
+        stdio: ["ignore", "pipe", "pipe"],
+      });
+      const timer = setTimeout(() => {
+        try {
+          child.kill("SIGTERM");
+        } catch {
+          /* ignore */
+        }
+      }, 120_000);
+      child.stdout?.on("data", (d) => {
+        if (stdout.length < 4000) stdout += d.toString().slice(0, 2000);
+      });
+      child.stderr?.on("data", (d) => {
+        if (stderr.length < 4000) stderr += d.toString().slice(0, 2000);
+      });
+      child.on("close", (code) => {
+        clearTimeout(timer);
+        resolve({ success: code === 0, code, stdout, stderr });
+      });
+      child.on("error", (err) => {
+        clearTimeout(timer);
+        resolve({ success: false, code: -1, stdout, stderr: err.message });
+      });
+    });
+  }
+
+  function runCommand(command, args, timeoutMs = 120_000) {
+    return new Promise((resolve) => {
+      let stdout = "";
+      let stderr = "";
+      const child = spawnFn(command, args, {
+        stdio: ["ignore", "pipe", "pipe"],
+        env: { ...process.env },
+      });
+      const timer = setTimeout(() => {
+        try {
+          child.kill("SIGTERM");
+        } catch {
+          /* ignore */
+        }
+      }, timeoutMs);
+      child.stdout?.on("data", (chunk) => {
+        if (stdout.length < 4000) stdout += chunk.toString().slice(0, 2000);
+      });
+      child.stderr?.on("data", (chunk) => {
+        if (stderr.length < 4000) stderr += chunk.toString().slice(0, 2000);
+      });
+      child.on("close", (code) => {
+        clearTimeout(timer);
+        resolve({ success: code === 0, code, stdout, stderr });
+      });
+      child.on("error", (err) => {
+        clearTimeout(timer);
+        resolve({ success: false, code: -1, stdout, stderr: err.message || String(err) });
+      });
+    });
+  }
+
+  async function readInstalledCliVersion() {
+    const commandAttempts = versionCheckScript
+      ? [{
+          command: process.execPath,
+          args: [versionCheckScript, ...versionCheckArgs],
+        }]
+      : [{
+          command: "conductor",
+          args: ["--version"],
+        }];
+
+    for (const attempt of commandAttempts) {
+      const commandResult = await runCommand(attempt.command, attempt.args, 15_000);
+      const combinedOutput = `${commandResult.stdout}\n${commandResult.stderr}`.trim();
+      const match = combinedOutput.match(/conductor version ([^\s]+)/);
+      if (match?.[1]) {
+        return match[1];
+      }
+    }
+
+    let pkgPath;
+    try {
+      pkgPath = moduleRequire.resolve(`${PACKAGE_NAME}/package.json`);
+    } catch {
+      pkgPath = path.join(installedPackageRoot, "package.json");
+    }
+    const newPkg = JSON.parse(readFileSyncFn(pkgPath, "utf-8"));
+    return newPkg.version || null;
+  }
+
+  async function performAutoUpdate(targetVersion) {
+    const pm = detectPackageManagerFn({
+      launcherPath: restartLauncherScript || versionCheckScript,
+      packageRoot: installedPackageRoot,
+    });
+    const pkgSpec = `${PACKAGE_NAME}@${targetVersion}`;
+    log(`[auto-update] Installing ${pkgSpec} via ${pm}...`);
+
+    // Step 1: install
+    const result = await runInstallCommand(pm, pkgSpec);
+    if (!result.success) {
+      throw new Error(
+        `Install failed (exit ${result.code}): ${(result.stderr || result.stdout).slice(0, 200)}`
+      );
+    }
+
+    // Step 2: re-check active tasks — a task may have arrived during the install
+    if (hasActiveTasks()) {
+      log("[auto-update] Active tasks appeared during install; aborting restart (will retry later)");
+      return;
+    }
+
+    // Step 3: verify installed version using the globally resolved CLI entry point.
+    try {
+      const installedVersion = await readInstalledCliVersion();
+      if (installedVersion !== targetVersion) {
+        throw new Error(
+          `Version mismatch after install: expected ${targetVersion}, got ${installedVersion}`
+        );
+      }
+    } catch (verifyErr) {
+      throw new Error(`Version verification failed: ${verifyErr?.message || verifyErr}`);
+    }
+
+    log(`[auto-update] Verified ${targetVersion}. Restarting daemon...`);
+
+    let logFd = null;
+    if (isBackgroundProcess) {
+      if (!restartLauncherScript) {
+        throw new Error("Missing daemon restart launcher script");
+      }
+      try {
+        mkdirSyncFn(DAEMON_LOG_DIR, { recursive: true });
+      } catch {
+        /* ignore */
+      }
+      logFd = fs.openSync(DAEMON_LOG_PATH, "a");
+    }
+
+    // Step 4: graceful shutdown
+    await shutdownDaemon("auto-update");
+
+    // Step 5: re-spawn (only in background/nohup mode)
+    if (isBackgroundProcess) {
+      const handoffToken = `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
+      const handoffExpiresAt = Date.now() + 15_000;
+      try {
+        writeLockHandoff({
+          handoffToken,
+          handoffFromPid: process.pid,
+          handoffExpiresAt,
+        });
+        const child = spawnFn(process.execPath, [restartLauncherScript, ...restartLauncherArgs], {
+          detached: true,
+          stdio: ["ignore", logFd, logFd],
+          env: {
+            ...process.env,
+            CONDUCTOR_LOCK_HANDOFF_TOKEN: handoffToken,
+            CONDUCTOR_LOCK_HANDOFF_FROM_PID: String(process.pid),
+            CONDUCTOR_LOCK_HANDOFF_EXPIRES_AT: String(handoffExpiresAt),
+          },
+        });
+        child.unref();
+        log(`[auto-update] New daemon spawned (PID ${child.pid})`);
+      } catch (error) {
+        cleanupLock();
+        exitFn(1);
+        throw new Error(`Restart failed after shutdown: ${error?.message || error}`);
+      } finally {
+        if (typeof logFd === "number") {
+          fs.closeSync(logFd);
+        }
+      }
+    } else {
+      log(
+        `[auto-update] Updated to ${targetVersion}. Foreground mode — please restart the daemon.`
+      );
+    }
+    exitFn(0);
+  }
+
   const getActiveTaskIds = () => [
     ...new Set([...activeTaskProcesses.keys(), ...activePtySessions.keys()]),
   ];
@@ -942,6 +1348,61 @@ export function startDaemon(config = {}, deps = {}) {
     });
   }
 
+  function rejectCreateTaskDuringShutdown(payload, { sendAck = true } = {}) {
+    const taskId = payload?.task_id ? String(payload.task_id) : "";
+    const projectId = payload?.project_id ? String(payload.project_id) : "";
+    const requestId = payload?.request_id ? String(payload.request_id) : "";
+    log(`Rejecting create_task for ${taskId || "unknown"}: daemon is shutting down`);
+    if (sendAck) {
+      sendAgentCommandAck({
+        requestId,
+        taskId,
+        eventType: "create_task",
+        accepted: false,
+      }).catch(() => {});
+    }
+    if (!taskId || !projectId) {
+      return;
+    }
+    client
+      .sendJson({
+        type: "task_status_update",
+        payload: {
+          task_id: taskId,
+          project_id: projectId,
+          status: "KILLED",
+          summary: "daemon shutting down",
+        },
+      })
+      .catch((err) => {
+        logError(`Failed to report shutdown rejection for ${taskId}: ${err?.message || err}`);
+      });
+  }
+
+  function rejectCreatePtyTaskDuringShutdown(payload, { sendAck = true } = {}) {
+    const taskId = payload?.task_id ? String(payload.task_id) : "";
+    const projectId = payload?.project_id ? String(payload.project_id) : "";
+    const ptySessionId = payload?.pty_session_id ? String(payload.pty_session_id) : null;
+    const requestId = payload?.request_id ? String(payload.request_id) : "";
+    log(`Rejecting create_pty_task for ${taskId || "unknown"}: daemon is shutting down`);
+    if (sendAck) {
+      sendAgentCommandAck({
+        requestId,
+        taskId,
+        eventType: "create_pty_task",
+        accepted: false,
+      }).catch(() => {});
+    }
+    sendTerminalEvent("terminal_error", {
+      task_id: taskId || undefined,
+      project_id: projectId || undefined,
+      pty_session_id: ptySessionId,
+      message: "daemon shutting down",
+    }).catch((err) => {
+      logError(`Failed to report PTY shutdown rejection for ${taskId || "unknown"}: ${err?.message || err}`);
+    });
+  }
+
   function sendPtyTransportSignal(payload) {
     return client.sendJson({
       type: "pty_transport_signal",
@@ -1430,6 +1891,11 @@ export function startDaemon(config = {}, deps = {}) {
       return;
     }
 
+    if (daemonShuttingDown) {
+      rejectCreatePtyTaskDuringShutdown(payload);
+      return;
+    }
+
     if (activeTaskProcesses.has(taskId) || activePtySessions.has(taskId)) {
       log(`Duplicate create_pty_task ignored for ${taskId}: task already active`);
       sendAgentCommandAck({
@@ -1442,6 +1908,10 @@ export function startDaemon(config = {}, deps = {}) {
     }
 
     let boundPath = await getProjectLocalPath(projectId);
+    if (daemonShuttingDown) {
+      rejectCreatePtyTaskDuringShutdown(payload);
+      return;
+    }
     let taskDir = normalizeOptionalString(launchConfig.cwd) || boundPath;
     if (!taskDir) {
       const now = new Date();
@@ -1534,6 +2004,20 @@ export function startDaemon(config = {}, deps = {}) {
         cwd: launchSpec.cwd,
         env,
       });
+      if (daemonShuttingDown) {
+        try {
+          if (typeof pty?.kill === "function") {
+            pty.kill("SIGTERM");
+          }
+        } catch (killError) {
+          logError(`Failed to stop PTY task ${taskId} during shutdown: ${killError?.message || killError}`);
+        }
+        if (logStream) {
+          logStream.end();
+        }
+        rejectCreatePtyTaskDuringShutdown(payload, { sendAck: false });
+        return;
+      }
       const resolvedLogPath = path.join(taskDir, "conductor-terminal.log");
 
       const startedAt = new Date().toISOString();
@@ -1800,6 +2284,17 @@ export function startDaemon(config = {}, deps = {}) {
       return;
     }
 
+    if (daemonShuttingDown) {
+      if (event.type === "create_task") {
+        rejectCreateTaskDuringShutdown(event.payload);
+        return;
+      }
+      if (event.type === "create_pty_task") {
+        rejectCreatePtyTaskDuringShutdown(event.payload);
+        return;
+      }
+    }
+
     if (event.type === "create_task") {
       handleCreateTask(event.payload);
       return;
@@ -2101,6 +2596,11 @@ export function startDaemon(config = {}, deps = {}) {
       return;
     }
 
+    if (daemonShuttingDown) {
+      rejectCreateTaskDuringShutdown(payload);
+      return;
+    }
+
     const existingTaskRecord = activeTaskProcesses.get(taskId);
     if (existingTaskRecord?.child) {
       log(
@@ -2168,6 +2668,10 @@ export function startDaemon(config = {}, deps = {}) {
 
     // Check if project has a bound local path for this daemon
     const boundPath = await getProjectLocalPath(projectId);
+    if (daemonShuttingDown) {
+      rejectCreateTaskDuringShutdown(payload, { sendAck: false });
+      return;
+    }
     let taskDir;
     let logPath;
     let runTimestampPart = null;