@love-moon/conductor-cli 0.2.42 → 0.3.1

package/src/daemon.js

@@ -2,7 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import { createRequire } from "node:module";
-import { spawn } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 
 import dotenv from "dotenv";
@@ -163,6 +163,33 @@ function getUserConfig(configFilePath) {
   return {};
 }
 
+// Read whether the daemon should launch each Fire process inside a detached
+// tmux session. When enabled, the daemon spawns `tmux new-session -d ...` so
+// that the Fire process runs under the tmux server with no parent/child
+// relationship to the daemon. The daemon can therefore be restarted or killed
+// without affecting any running Fire process.
+//
+// Resolution order:
+//   1. CONDUCTOR_FIRE_TMUX_MODE env var ("1"/"true"/"on" enable, "0"/"false"/"off" disable)
+//   2. fire_tmux_mode boolean in ~/.conductor/config.yaml
+//   3. Default: false
+function getFireTmuxModeEnabled(userConfig) {
+  const rawEnv = process.env.CONDUCTOR_FIRE_TMUX_MODE;
+  if (typeof rawEnv === "string" && rawEnv.trim()) {
+    const normalized = rawEnv.trim().toLowerCase();
+    if (normalized === "1" || normalized === "true" || normalized === "on" || normalized === "yes") {
+      return true;
+    }
+    if (normalized === "0" || normalized === "false" || normalized === "off" || normalized === "no") {
+      return false;
+    }
+  }
+  if (userConfig && typeof userConfig === "object") {
+    return userConfig.fire_tmux_mode === true;
+  }
+  return false;
+}
+
 function normalizePlanLimitType(limitType) {
   if (typeof limitType !== "string") {
     return null;
@@ -567,6 +594,12 @@ export function startDaemon(config = {}, deps = {}) {
   let shutdownSignalHandled = false;
   let forcedSignalExitHandled = false;
   let processHandlersAttached = false;
+  // Mirrors the later `daemonShuttingDown` flag but is declared up front so
+  // process-level error handlers registered below can safely read it even if
+  // they fire before the main daemon state is initialized. `shutdownDaemon`
+  // flips this alongside `daemonShuttingDown` to signal that late WebSocket
+  // errors should be treated as benign.
+  let daemonShutdownInProgress = false;
 
   const removeProcessListener = (eventName, handler) => {
     if (typeof process.off === "function") {
@@ -644,6 +677,16 @@ export function startDaemon(config = {}, deps = {}) {
   const WORKSPACE_ROOT = expandHomePath(workspaceRootValue, homeDir);
   const CLI_PATH_VAL = config.CLI_PATH || CLI_PATH;
 
+  // When enabled, every Fire process is launched inside a detached tmux
+  // session via `tmux new-session -d`. The daemon-spawned `tmux` client exits
+  // immediately after creating the session, leaving the Fire process running
+  // under the tmux server with no parent/child relationship to the daemon.
+  // The actual runtime activation flag (FIRE_TMUX_MODE_ACTIVE) is computed
+  // below after we verify tmux is installed; if tmux is missing we log a
+  // warning and silently fall back to direct spawn rather than failing every
+  // create_task with ENOENT.
+  const FIRE_TMUX_MODE_ENABLED = getFireTmuxModeEnabled(userConfig);
+
   // Get allow_cli_list from config
   const RAW_ALLOW_CLI_LIST = getRawAllowCliList(userConfig);
   let ALLOW_CLI_LIST = {};
@@ -710,6 +753,7 @@ export function startDaemon(config = {}, deps = {}) {
   );
 
   const spawnFn = deps.spawn || spawn;
+  const spawnSyncFn = deps.spawnSync || spawnSync;
   const mkdirSyncFn = deps.mkdirSync || fs.mkdirSync;
   const writeFileSyncFn = deps.writeFileSync || fs.writeFileSync;
   const existsSyncFn = deps.existsSync || fs.existsSync;
@@ -731,8 +775,384 @@ export function startDaemon(config = {}, deps = {}) {
   const resolveProjectSnapshotFn =
     deps.resolveProjectSnapshot || ((projectPath) => new ProjectContext(projectPath).snapshot());
 
-  function buildTaskWorktreeRoot(projectWorkspacePath, worktreeId) {
-    const sanitized = String(worktreeId).replace(/[/\\]/g, "_").replace(/\.\./g, "_");
+  // ---- Fire tmux mode helpers ---------------------------------------------
+  // Probe whether the `tmux` binary is available on PATH. Used at daemon
+  // startup so a misconfigured environment falls back gracefully instead of
+  // failing every create_task with ENOENT.
+  function isTmuxAvailable() {
+    try {
+      const result = spawnSyncFn("tmux", ["-V"], {
+        stdio: "ignore",
+        timeout: 2000,
+      });
+      if (!result || result.error) {
+        return false;
+      }
+      // spawnSync sets `status` to the exit code on success and to null when
+      // the process couldn't be started; the `pid` is also unset in the
+      // latter case.
+      return result.status === 0;
+    } catch {
+      return false;
+    }
+  }
+
+  // Resolve the active tmux mode: requested via config AND tmux installed.
+  const FIRE_TMUX_MODE_ACTIVE = FIRE_TMUX_MODE_ENABLED && isTmuxAvailable();
+  if (FIRE_TMUX_MODE_ENABLED && !FIRE_TMUX_MODE_ACTIVE) {
+    logError(
+      "fire_tmux_mode is enabled but `tmux` is not available on PATH; " +
+        "falling back to direct spawn. Install tmux to launch Fire processes " +
+        "in detached tmux sessions.",
+    );
+  } else if (FIRE_TMUX_MODE_ACTIVE) {
+    log("Fire tmux mode enabled: each Fire process will run in a detached tmux session");
+  }
+
+  // Single-quote a value so it can be embedded inside a `bash -c '...'`
+  // command. Embedded single-quotes are escaped via the standard `'\\''`
+  // sequence.
+  function shellQuoteForBash(value) {
+    const str = String(value ?? "");
+    if (str === "") {
+      return "''";
+    }
+    return `'${str.replace(/'/g, `'\\''`)}'`;
+  }
+
+  // Build the deterministic prefix shared by every tmux session belonging to
+  // a given task id. Tmux session names cannot contain `:` or `.`; we
+  // sanitize aggressively and clamp the length. The trailing `-` separates
+  // the prefix from the per-spawn uniqueness suffix added by
+  // `buildFireTmuxSessionName`. Used both by spawn (to construct the full
+  // name) and by orphan cleanup on task delete (to find every session that
+  // belongs to a deleted task — even ones the current daemon never tracked,
+  // e.g. left over from a previous daemon process).
+  function buildFireTmuxSessionPrefix(taskId) {
+    const safe = String(taskId || "")
+      .replace(/[^a-zA-Z0-9_-]/g, "_")
+      .replace(/^_+|_+$/g, "")
+      .slice(0, 32) || "task";
+    return `conductor-fire-${safe}-`;
+  }
+
+  // Build a unique tmux session name for a Fire spawn.
+  //
+  // We append a per-spawn uniqueness suffix (base36 timestamp + 4 random
+  // chars) so re-spawning the same task id while a previous session may
+  // still be alive — for example after a daemon restart that left the old
+  // session running — does not collide with a `duplicate session` error
+  // from tmux.
+  function buildFireTmuxSessionName(taskId) {
+    const uniq = `${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}`;
+    return `${buildFireTmuxSessionPrefix(taskId)}${uniq}`;
+  }
+
+  // Spawn the Fire CLI either directly (default) or inside a detached tmux
+  // session (when FIRE_TMUX_MODE_ACTIVE). In tmux mode the returned `child`
+  // is the short-lived `tmux new-session` client; once it exits with code 0
+  // the Fire process keeps running under the tmux server, fully detached from
+  // the daemon. Fire's stdout/stderr is redirected directly to `logPath` so
+  // the daemon does not need to pipe streams.
+  function spawnFireProcess({ taskId, args, env, cwd, logPath }) {
+    if (!FIRE_TMUX_MODE_ACTIVE) {
+      const child = spawnFn(process.execPath, [CLI_PATH_VAL, ...args], {
+        cwd,
+        env,
+        stdio: ["inherit", "pipe", "pipe"],
+      });
+      return { child, tmuxSession: null };
+    }
+
+    const sessionName = buildFireTmuxSessionName(taskId);
+    const innerCommandParts = [process.execPath, CLI_PATH_VAL, ...args].map(shellQuoteForBash);
+    // Pipe Fire's stdout/stderr through `tee -a <log>` instead of plain
+    // `>> <log> 2>&1`. With redirection alone, the tmux pane's terminal
+    // shows nothing (all output goes straight to the file), so attaching
+    // via `tmux a -t <session>` for live observation is useless. With
+    // `tee` the same bytes go to both the pane (visible to whoever
+    // attaches) and the log file (preserved for offline inspection).
+    const redirectedCommand = logPath
+      ? `${innerCommandParts.join(" ")} 2>&1 | tee -a ${shellQuoteForBash(logPath)}`
+      : innerCommandParts.join(" ");
+
+    // Build `-e KEY=VALUE` flags for the new session.
+    //
+    // Why we cannot rely on the spawn `env` to reach Fire:
+    //   `tmux new-session` is dispatched through the user's tmux server
+    //   process. If a tmux server is already running (which is the common
+    //   case on dev machines that use tmux for other work) the new session
+    //   inherits that server's process environment — NOT the env we pass
+    //   to the freshly spawned `tmux` client. The `update-environment`
+    //   server option only forwards a small allowlist (DISPLAY,
+    //   SSH_AUTH_SOCK, …), none of which are CONDUCTOR_*.
+    //
+    //   Without this fix Fire would start with no CONDUCTOR_TASK_ID /
+    //   CONDUCTOR_AGENT_TOKEN / CONDUCTOR_BACKEND_URL, its
+    //   ConductorClient.connect would either fail authentication or send
+    //   `session_started` to the wrong task id, and the frontend would
+    //   never see the "<backend> session started: <uuid>" line.
+    //
+    // The `-e` flag attaches the variable to *this* session's environment,
+    // bypassing the server's stale environment entirely.
+    const tmuxEnvFlags = [];
+    for (const [key, value] of Object.entries(env || {})) {
+      if (value === undefined || value === null) continue;
+      const stringValue = String(value);
+      // Skip values containing NUL / newline / carriage-return — tmux's
+      // environment storage does not handle them and they would otherwise
+      // corrupt the session env or fail the new-session call. Spaces are
+      // fine because each `-e KEY=VALUE` is a single argv element (e.g.
+      // CONDUCTOR_CLI_COMMAND="codex --dangerously-bypass-...").
+      if (/[\u0000\r\n]/.test(stringValue)) continue;
+      tmuxEnvFlags.push("-e", `${key}=${stringValue}`);
+    }
+
+    // Use a non-login `bash -c` here: node and the CLI script are passed by
+    // absolute path, so we don't need PATH from a login shell, and `-l`
+    // would slow startup and could leak unexpected stderr from user shell
+    // init scripts.
+    const tmuxArgs = [
+      "new-session",
+      "-d",
+      ...tmuxEnvFlags,
+      "-s",
+      sessionName,
+      "-c",
+      cwd,
+      "bash",
+      "-c",
+      `exec ${redirectedCommand}`,
+    ];
+    log(`Spawning Fire via tmux: session=${sessionName} cwd=${cwd}`);
+    const child = spawnFn("tmux", tmuxArgs, {
+      cwd,
+      env,
+      stdio: ["ignore", "pipe", "pipe"],
+      detached: true,
+    });
+    if (typeof child.unref === "function") {
+      child.unref();
+    }
+    return { child, tmuxSession: sessionName };
+  }
+
+  // Async probe: does the named tmux session still exist? Resolves to a
+  // boolean — `true` iff `tmux has-session -t <name>` exits with code 0.
+  // Any spawn error, non-zero exit, or timeout resolves to `false`.
+  //
+  // The hard timeout matters because a wedged tmux server (bad socket perms,
+  // hung server process) would otherwise leave probes pending forever and,
+  // combined with the periodic reaper, leak children + Promises. The
+  // timeout is overridable via `config.TMUX_PROBE_TIMEOUT_MS` (mostly for
+  // tests).
+  const TMUX_PROBE_TIMEOUT_MS = (() => {
+    const explicit = Number(config.TMUX_PROBE_TIMEOUT_MS);
+    if (Number.isFinite(explicit) && explicit > 0) {
+      return explicit;
+    }
+    return 5000;
+  })();
+  function tmuxSessionExists(sessionName) {
+    return new Promise((resolve) => {
+      if (!sessionName) {
+        resolve(false);
+        return;
+      }
+      let settled = false;
+      let probe = null;
+      let timer = null;
+      const settle = (alive) => {
+        if (settled) return;
+        settled = true;
+        if (timer) {
+          clearTimeout(timer);
+          timer = null;
+        }
+        resolve(alive);
+      };
+      try {
+        probe = spawnFn("tmux", ["has-session", "-t", sessionName], {
+          stdio: "ignore",
+        });
+        probe.on("exit", (code) => settle(code === 0));
+        probe.on("error", () => settle(false));
+        timer = setTimeout(() => {
+          // Probe took too long — assume the session state is unknown,
+          // treat as "not alive" (so the reaper falls back to safe cleanup),
+          // and best-effort kill the stuck child so it doesn't pile up.
+          try {
+            if (probe && typeof probe.kill === "function") {
+              probe.kill("SIGKILL");
+            }
+          } catch {
+            // ignore; we already settled
+          }
+          logError(
+            `tmux has-session probe timed out after ${TMUX_PROBE_TIMEOUT_MS}ms for session ${sessionName}`,
+          );
+          settle(false);
+        }, TMUX_PROBE_TIMEOUT_MS);
+        if (typeof timer.unref === "function") {
+          timer.unref();
+        }
+      } catch {
+        settle(false);
+      }
+    });
+  }
+
+  // Walk every tmux-mode entry in `activeTaskProcesses` and remove the ones
+  // whose tmux session no longer exists. We don't (and can't reliably)
+  // observe the inner Fire process exit when we never owned it as a child,
+  // so this best-effort sweep is what keeps the active map from leaking
+  // across long daemon lifetimes.
+  //
+  // Theoretical startup race (intentionally not guarded against):
+  //   `spawnFireProcess` returns synchronously, and we set the active
+  //   record before the spawned `tmux new-session -d` client has actually
+  //   exited. There is therefore a microsecond-scale window in which an
+  //   active record exists but `tmux has-session` may return false because
+  //   the session has not finished registering with the tmux server. With
+  //   the default 30s poll interval the chance of hitting this window is
+  //   ~negligible, and even when hit Fire's own websocket connection
+  //   subsequently overwrites any stale terminal status the daemon
+  //   reports. If this ever shows up in production, add a `createdAt`
+  //   timestamp to the record and a grace period here.
+  async function reapDeadTmuxSessionsOnce() {
+    const candidates = [];
+    for (const [taskId, record] of activeTaskProcesses.entries()) {
+      if (record?.tmuxMode && record.tmuxSession) {
+        candidates.push([taskId, record]);
+      }
+    }
+    for (const [taskId, record] of candidates) {
+      const alive = await tmuxSessionExists(record.tmuxSession);
+      // Only remove the entry if it still points to the same record; a
+      // concurrent restart_task may have replaced it while we were probing.
+      if (!alive && activeTaskProcesses.get(taskId) === record) {
+        log(
+          `Tmux session ${record.tmuxSession} for task ${taskId} no longer exists; cleaning up activeTaskProcesses entry`,
+        );
+        if (record.stopForceKillTimer) {
+          clearTimeout(record.stopForceKillTimer);
+          record.stopForceKillTimer = null;
+        }
+        activeTaskProcesses.delete(taskId);
+      }
+    }
+  }
+
+  // Best-effort: terminate a Fire process running in tmux by killing the
+  // session. Returns true if the kill command was issued.
+  function killFireTmuxSession(sessionName) {
+    if (!sessionName) {
+      return false;
+    }
+    try {
+      const killChild = spawnFn("tmux", ["kill-session", "-t", sessionName], {
+        stdio: "ignore",
+        detached: true,
+      });
+      if (typeof killChild.unref === "function") {
+        killChild.unref();
+      }
+      killChild.on("error", (err) => {
+        logError(`Failed to issue tmux kill-session for ${sessionName}: ${err?.message || err}`);
+      });
+      return true;
+    } catch (error) {
+      logError(`Failed to spawn tmux kill-session for ${sessionName}: ${error?.message || error}`);
+      return false;
+    }
+  }
+
+  // List every tmux session name visible to the current user. Returns `[]`
+  // on any spawn error, non-zero exit, or timeout (e.g. tmux not available
+  // or the server not running). Subject to TMUX_PROBE_TIMEOUT_MS.
+  function listAllTmuxSessions() {
+    return new Promise((resolve) => {
+      let settled = false;
+      let stdout = "";
+      let timer = null;
+      const settle = (lines) => {
+        if (settled) return;
+        settled = true;
+        if (timer) {
+          clearTimeout(timer);
+          timer = null;
+        }
+        resolve(lines);
+      };
+      try {
+        const probe = spawnFn("tmux", ["list-sessions", "-F", "#{session_name}"], {
+          stdio: ["ignore", "pipe", "ignore"],
+        });
+        if (probe.stdout && typeof probe.stdout.on === "function") {
+          probe.stdout.on("data", (chunk) => {
+            stdout += chunk.toString("utf8");
+          });
+        }
+        probe.on("exit", (code) => {
+          if (code === 0) {
+            settle(
+              stdout
+                .split("\n")
+                .map((s) => s.trim())
+                .filter(Boolean),
+            );
+          } else {
+            // Non-zero exit usually means "no server running" or "no
+            // sessions" — both fine, just return empty.
+            settle([]);
+          }
+        });
+        probe.on("error", () => settle([]));
+        timer = setTimeout(() => {
+          try {
+            if (typeof probe.kill === "function") {
+              probe.kill("SIGKILL");
+            }
+          } catch {
+            // ignore; we already settled
+          }
+          logError(`tmux list-sessions probe timed out after ${TMUX_PROBE_TIMEOUT_MS}ms`);
+          settle([]);
+        }, TMUX_PROBE_TIMEOUT_MS);
+        if (typeof timer.unref === "function") {
+          timer.unref();
+        }
+      } catch {
+        settle([]);
+      }
+    });
+  }
+
+  // Belt-and-suspenders cleanup for `delete_task`: when the frontend deletes
+  // a task, the daemon's in-memory `activeTaskProcesses` map may not contain
+  // its record (e.g. daemon was restarted between spawn and delete, or the
+  // liveness reaper had already removed it). The tmux session itself can
+  // still be alive in those cases, leaking a Fire process. This walks
+  // `tmux list-sessions` and kills every session whose name matches the
+  // deterministic prefix derived from the task id.
+  async function killTmuxSessionsForDeletedTask(taskId) {
+    if (!FIRE_TMUX_MODE_ACTIVE || !taskId) return 0;
+    const prefix = buildFireTmuxSessionPrefix(taskId);
+    const sessions = await listAllTmuxSessions();
+    let killed = 0;
+    for (const name of sessions) {
+      if (name.startsWith(prefix)) {
+        log(`Killing orphaned tmux session ${name} for deleted task ${taskId}`);
+        killFireTmuxSession(name);
+        killed += 1;
+      }
+    }
+    return killed;
+  }
+  // -------------------------------------------------------------------------
+
+  function buildTaskWorktreeRoot(projectWorkspacePath, worktreeBranch) {
+    const sanitized = String(worktreeBranch).replace(/[/\\]/g, "_").replace(/\.\./g, "_");
     return path.join(projectWorkspacePath, ".conductor", "worktrees", sanitized);
   }
 
@@ -783,6 +1203,10 @@ export function startDaemon(config = {}, deps = {}) {
     return resolvedPath;
   }
 
+  function normalizeGitPathspec(relativePath) {
+    return String(relativePath || "").split(path.sep).join("/");
+  }
+
   const PROJECT_SETTINGS_TEMPLATE = [
     "worktree:",
     "  sync_branch: false",
@@ -843,7 +1267,30 @@ export function startDaemon(config = {}, deps = {}) {
     };
   }
 
-  function ensureTaskWorktreeSymlinks({ projectWorkspacePath, finalCwd }) {
+  async function isGitTrackedWorktreePath({ projectRepoRoot, sourcePath }) {
+    const relativeToRepo = path.relative(projectRepoRoot, sourcePath);
+    if (
+      !relativeToRepo ||
+      relativeToRepo === "." ||
+      relativeToRepo.startsWith("..") ||
+      path.isAbsolute(relativeToRepo)
+    ) {
+      return false;
+    }
+
+    try {
+      const { stdout } = await runSpawnProcess(
+        "git",
+        ["-C", projectRepoRoot, "ls-files", "--", normalizeGitPathspec(relativeToRepo)],
+        { cwd: projectRepoRoot, timeoutMs: WORKTREE_SYNC_TIMEOUT_MS },
+      );
+      return stdout.trim().length > 0;
+    } catch {
+      return false;
+    }
+  }
+
+  async function ensureTaskWorktreeSymlinks({ projectRepoRoot, projectWorkspacePath, finalCwd }) {
     const { symlinkPaths } = readProjectWorktreeSettings(projectWorkspacePath);
     for (const configuredPath of symlinkPaths) {
       const sourcePath = resolveProjectScopedPath(
@@ -851,6 +1298,11 @@ export function startDaemon(config = {}, deps = {}) {
         configuredPath,
         `worktree.symlink entry ${configuredPath}`,
       );
+      // Git-tracked files and directories should come from the checked-out
+      // worktree itself rather than being overwritten by project-local symlinks.
+      if (await isGitTrackedWorktreePath({ projectRepoRoot, sourcePath })) {
+        continue;
+      }
       const linkPath = resolveProjectScopedPath(
         finalCwd,
         configuredPath,
@@ -977,7 +1429,7 @@ export function startDaemon(config = {}, deps = {}) {
 
     const worktreeRoot = buildTaskWorktreeRoot(
       worktreeConfig.projectWorkspacePath,
-      worktreeConfig.worktreeId,
+      worktreeConfig.worktreeBranch,
     );
     const finalCwd = resolveTaskWorktreeCwd(worktreeRoot, worktreeConfig.projectRelativePath);
     const gitMarkerPath = path.join(worktreeRoot, ".git");
@@ -1069,7 +1521,8 @@ export function startDaemon(config = {}, deps = {}) {
     }
 
     mkdirSyncFn(finalCwd, { recursive: true });
-    ensureTaskWorktreeSymlinks({
+    await ensureTaskWorktreeSymlinks({
+      projectRepoRoot: worktreeConfig.projectRepoRoot,
       projectWorkspacePath: worktreeConfig.projectWorkspacePath,
       finalCwd,
     });
@@ -1339,6 +1792,7 @@ export function startDaemon(config = {}, deps = {}) {
       return;
     }
     shutdownSignalHandled = true;
+    daemonShutdownInProgress = true;
     void (async () => {
       try {
         log(`Received ${signal}, shutting down...`);
@@ -1357,11 +1811,37 @@ export function startDaemon(config = {}, deps = {}) {
   const onSigTerm = () => {
     handleSignal("SIGTERM");
   };
+  const isBenignShutdownError = (err) => {
+    if (!err) return false;
+    const message = (err instanceof Error ? err.message : String(err)) || "";
+    // These errors are expected when the WebSocket is torn down while a
+    // previously queued send is still in flight (e.g., during restart_daemon).
+    // Silencing them prevents a benign late rejection from aborting the
+    // in-progress restart/respawn flow.
+    return (
+      message.includes("WebSocket not connected") ||
+      message.includes("WebSocket is not open") ||
+      message.includes("WebSocket is closed")
+    );
+  };
   const onUncaughtException = (err) => {
+    if (daemonShutdownInProgress && isBenignShutdownError(err)) {
+      logError(`Ignored benign error during shutdown: ${err?.message || err}`);
+      return;
+    }
     logError(`Uncaught exception: ${err}`);
     cleanupLock();
     exitFn(1);
   };
+  const onUnhandledRejection = (reason) => {
+    if (daemonShutdownInProgress && isBenignShutdownError(reason)) {
+      logError(`Ignored benign rejection during shutdown: ${reason?.message || reason}`);
+      return;
+    }
+    // Fall through to the same handling as uncaughtException so we keep a
+    // single, predictable exit path when an unexpected rejection escapes.
+    onUncaughtException(reason instanceof Error ? reason : new Error(String(reason)));
+  };
   const detachProcessHandlers = () => {
     if (!processHandlersAttached) {
       return;
@@ -1371,12 +1851,14 @@ export function startDaemon(config = {}, deps = {}) {
     removeProcessListener("SIGINT", onSigInt);
     removeProcessListener("SIGTERM", onSigTerm);
     removeProcessListener("uncaughtException", onUncaughtException);
+    removeProcessListener("unhandledRejection", onUnhandledRejection);
   };
 
   process.on("exit", cleanupLock);
   process.on("SIGINT", onSigInt);
   process.on("SIGTERM", onSigTerm);
   process.on("uncaughtException", onUncaughtException);
+  process.on("unhandledRejection", onUnhandledRejection);
   processHandlersAttached = true;
 
   if (config.CLEAN_ALL) {
@@ -1426,6 +1908,23 @@ export function startDaemon(config = {}, deps = {}) {
   let watchdogAwaitingHealthySignalAt = null;
   let watchdogTimer = null;
 
+  // Tmux liveness reaper — periodically removes activeTaskProcesses entries
+  // whose underlying tmux session no longer exists. Only used when
+  // FIRE_TMUX_MODE_ACTIVE.
+  //
+  // Set `config.TMUX_LIVENESS_POLL_MS` to 0 to disable polling entirely
+  // (escape hatch — the in-memory map will then accumulate stale entries
+  // until the daemon restarts). Negative or non-numeric values fall back
+  // to the 30s default.
+  let tmuxLivenessTimer = null;
+  const TMUX_LIVENESS_POLL_MS = (() => {
+    const explicit = Number(config.TMUX_LIVENESS_POLL_MS);
+    if (Number.isFinite(explicit) && explicit >= 0) {
+      return explicit;
+    }
+    return 30 * 1000;
+  })();
+
   // --- Auto-update state ---
   const VERSION_CHECK_INTERVAL_MS = 6 * 60 * 60 * 1000; // 6 hours
   let lastVersionCheckAt = 0;
@@ -1603,6 +2102,30 @@ export function startDaemon(config = {}, deps = {}) {
       watchdogTimer.unref();
     }
     void runMaintenanceTick();
+
+    if (FIRE_TMUX_MODE_ACTIVE && TMUX_LIVENESS_POLL_MS > 0) {
+      // Reentrancy guard: setInterval fires at fixed wall-clock intervals
+      // regardless of whether the previous reaper run finished. With many
+      // active tmux tasks (or a slow tmux server), a single sweep can take
+      // longer than the poll interval — without this flag we would fan
+      // out concurrent sweeps that all probe the same sessions and pile
+      // up child processes.
+      let reapInFlight = false;
+      tmuxLivenessTimer = setInterval(() => {
+        if (reapInFlight) return;
+        reapInFlight = true;
+        reapDeadTmuxSessionsOnce()
+          .catch((err) => {
+            logError(`Tmux liveness reaper error: ${err?.message || err}`);
+          })
+          .finally(() => {
+            reapInFlight = false;
+          });
+      }, TMUX_LIVENESS_POLL_MS);
+      if (typeof tmuxLivenessTimer?.unref === "function") {
+        tmuxLivenessTimer.unref();
+      }
+    }
   })();
 
   function markBackendHttpSuccess(at = Date.now()) {
@@ -1673,6 +2196,7 @@ export function startDaemon(config = {}, deps = {}) {
     );
     if (watchdogHealAttempts > DAEMON_WATCHDOG_MAX_SELF_HEALS) {
       daemonShuttingDown = true;
+      daemonShutdownInProgress = true;
       logError("[watchdog] Self-heal budget exceeded; exiting daemon for supervisor restart");
       void requestShutdown("watchdog self-heal budget exceeded")
         .catch((error) => {
@@ -2163,6 +2687,10 @@ export function startDaemon(config = {}, deps = {}) {
       const staleTasks = tasks.filter((task) => {
         const status = String(task?.status || "").trim().toLowerCase();
         const agentHost = String(task?.agent_host || "").trim();
+        // Skip init tasks: they may be waiting for a restart_task outbox
+        // delivery (e.g. branch/fork creates a successor with status "init"
+        // that the daemon hasn't started processing yet).
+        if (status === "init") return false;
         return agentHost === AGENT_NAME && (status === "unknown" || status === "running");
       });
 
@@ -2197,6 +2725,10 @@ export function startDaemon(config = {}, deps = {}) {
     }
   }
 
+  // Grace period: tasks created within this window are excluded from
+  // reconcile to avoid racing with restart_task outbox delivery.
+  const RECONCILE_GRACE_PERIOD_MS = 60_000;
+
   async function reconcileAssignedTasks() {
     try {
       const response = await fetchFn(`${BACKEND_HTTP}/api/tasks`, {
@@ -2219,6 +2751,16 @@ export function startDaemon(config = {}, deps = {}) {
       const assigned = tasks.filter((task) => {
         const agentHost = String(task?.agent_host || "").trim();
         const status = String(task?.status || "").trim().toLowerCase();
+        // Skip init tasks: they may be waiting for a restart_task outbox
+        // delivery (e.g. branch/fork creates a successor with status "init"
+        // that the daemon hasn't started processing yet).
+        if (status === "init") return false;
+        // Skip recently-created tasks to avoid racing with restart_task
+        // delivery: a successor task may have been promoted to "running"
+        // via shouldPromoteInitTask but its conductor-fire process is
+        // still being spawned.
+        const createdAtMs = task?.created_at ? new Date(task.created_at).getTime() : 0;
+        if (createdAtMs && Date.now() - createdAtMs < RECONCILE_GRACE_PERIOD_MS) return false;
         return agentHost === AGENT_NAME && (status === "unknown" || status === "running");
       });
 
@@ -3150,6 +3692,15 @@ export function startDaemon(config = {}, deps = {}) {
       logError(`Failed to report agent_command_ack(cleanup_task_worktree) for ${taskId}: ${error?.message || error}`);
     });
 
+    // cleanup_task_worktree is queued as part of the frontend's task delete
+    // flow. Always sweep any tmux sessions for this task id, including
+    // orphaned sessions that survived a daemon restart and so were not
+    // tracked by `stopActiveTaskProcess` below. Fire-and-forget so we don't
+    // block the worktree cleanup itself.
+    killTmuxSessionsForDeletedTask(taskId).catch((error) => {
+      logError(`Orphan tmux cleanup failed for task ${taskId}: ${error?.message || error}`);
+    });
+
     if (activeTaskProcesses.has(taskId) || activePtySessions.has(taskId)) {
       if (forceCleanup) {
         const stopStarted = stopActiveTaskProcess(taskId, {
@@ -3189,7 +3740,7 @@ export function startDaemon(config = {}, deps = {}) {
 
     const worktreeRoot = buildTaskWorktreeRoot(
       worktreeConfig.projectWorkspacePath,
-      worktreeConfig.worktreeId,
+      worktreeConfig.worktreeBranch,
     );
     if (!isSafeTaskWorktreeRoot(worktreeConfig.projectWorkspacePath, worktreeRoot)) {
       await reportTaskWorktreeCleanupResult({
@@ -3712,6 +4263,10 @@ export function startDaemon(config = {}, deps = {}) {
             typeof snapshot?.lastCommit === "string" && snapshot.lastCommit.trim()
               ? snapshot.lastCommit.trim()
               : null,
+          gitRemoteUrl:
+            typeof snapshot?.gitRemoteUrl === "string" && snapshot.gitRemoteUrl.trim()
+              ? snapshot.gitRemoteUrl.trim()
+              : null,
           fileCount:
             typeof snapshot?.fileCount === "number" && Number.isInteger(snapshot.fileCount)
               ? snapshot.fileCount
@@ -3736,6 +4291,7 @@ export function startDaemon(config = {}, deps = {}) {
           repo_root: result.repoRoot,
           worktree_branch: result.worktreeBranch,
           last_commit: result.lastCommit,
+          git_remote_url: result.gitRemoteUrl,
           file_count: result.fileCount,
           error: result.error,
           error_code: result.errorCode,
@@ -3756,7 +4312,7 @@ export function startDaemon(config = {}, deps = {}) {
   ) {
     const processRecord = activeTaskProcesses.get(taskId);
     const ptyRecord = activePtySessions.get(taskId);
-    if ((!processRecord || !processRecord.child) && !ptyRecord) {
+    if ((!processRecord || (!processRecord.child && !processRecord.tmuxSession)) && !ptyRecord) {
       return false;
     }
 
@@ -3776,6 +4332,46 @@ export function startDaemon(config = {}, deps = {}) {
       cleanupPtyRtcTransport(taskId);
     }
 
+    if (processRecord?.tmuxMode) {
+      // Tmux-managed Fire processes are not direct children. The tmux client
+      // we spawned has already exited; the live Fire process is owned by the
+      // tmux server. Terminate it by killing the session and immediately
+      // remove it from the active map (no force-kill timer needed because
+      // tmux kills the session synchronously).
+      const sessionName = processRecord.tmuxSession;
+      log(`Killing tmux session ${sessionName || "(unknown)"} for task ${taskId}`);
+      killFireTmuxSession(sessionName);
+
+      // Report KILLED to the backend ourselves. Normally a `managedByFireBridge`
+      // task relies on Fire to publish its own terminal status before exiting,
+      // but `tmux kill-session` cascades as SIGHUP → bash → Fire and Fire
+      // typically does not get a chance to flush a final websocket message
+      // before being killed. Without this explicit report the task would stay
+      // RUNNING in the frontend until some external timeout. Skip when the
+      // caller explicitly suppressed status reporting (e.g. refresh_session
+      // _inplace, which will re-spawn and overwrite status anyway).
+      if (!suppressExitStatusReport && processRecord.projectId) {
+        client
+          .sendJson({
+            type: "task_status_update",
+            payload: {
+              task_id: taskId,
+              project_id: processRecord.projectId,
+              status: "KILLED",
+              summary: reason ? `stopped (${reason})` : "stopped via tmux kill-session",
+            },
+          })
+          .catch((err) => {
+            logError(
+              `Failed to report task_status_update(KILLED) for tmux task ${taskId}: ${err?.message || err}`,
+            );
+          });
+      }
+
+      activeTaskProcesses.delete(taskId);
+      return true;
+    }
+
     if (processRecord?.child) {
       try {
         if (typeof processRecord.child.kill === "function") {
@@ -3891,11 +4487,27 @@ export function startDaemon(config = {}, deps = {}) {
     if ((!processRecord || !processRecord.child) && !ptyRecord) {
       log(`Stop requested for task ${taskId}, but no active process found`);
       sendStopAck(false);
+      // Even when we have no in-memory record, the task may still own a
+      // tmux session (e.g. the daemon was restarted between spawn and
+      // stop, or the liveness reaper removed our entry but the session
+      // is alive). Try a name-based orphan kill as a belt-and-suspenders
+      // — fire-and-forget so we don't delay the ack response.
+      killTmuxSessionsForDeletedTask(taskId).catch((error) => {
+        logError(`Orphan tmux cleanup failed for task ${taskId}: ${error?.message || error}`);
+      });
       return;
     }
 
     sendStopAck(true);
     stopActiveTaskProcess(taskId, { reason: payload?.reason });
+    // Belt-and-suspenders: also sweep any tmux sessions matching this
+    // task id that didn't make it into the active map (stale entries
+    // from previous spawns, daemon restarts, etc.). `stopActiveTaskProcess`
+    // already kills the session associated with the current active record;
+    // this catches everything else with the same task-id prefix.
+    killTmuxSessionsForDeletedTask(taskId).catch((error) => {
+      logError(`Orphan tmux cleanup failed for task ${taskId}: ${error?.message || error}`);
+    });
   }
 
   async function getProjectLocalPath(projectId) {
@@ -4329,13 +4941,28 @@ export function startDaemon(config = {}, deps = {}) {
         env.CONDUCTOR_BACKEND_URL = BACKEND_HTTP;
       }
 
-      const child = spawnFn(process.execPath, [CLI_PATH_VAL, ...args], {
-        cwd: taskDir,
+      const { child, tmuxSession } = spawnFireProcess({
+        taskId,
+        args,
         env,
-        stdio: ["inherit", "pipe", "pipe"],
+        cwd: taskDir,
+        logPath,
       });
 
-      if (!boundPath && runTimestampPart && Number.isInteger(child?.pid) && child.pid > 0) {
+      // In normal mode we rename the placeholder run-timestamp dir to embed
+      // the freshly spawned child pid. We must NOT do this in tmux mode:
+      // 1) child.pid is the short-lived tmux client, not Fire — misleading.
+      // 2) Fire's stdout/stderr is redirected to logPath inside the tmux
+      //    `bash -c ...` command, which captures the path *before* this
+      //    rename runs. Renaming the parent dir afterwards would break that
+      //    redirection (file open would fail) and Fire would never start.
+      if (
+        !tmuxSession &&
+        !boundPath &&
+        runTimestampPart &&
+        Number.isInteger(child?.pid) &&
+        child.pid > 0
+      ) {
         const desiredTaskDir = path.join(path.dirname(taskDir), `${runTimestampPart}_pid_${child.pid}`);
         if (desiredTaskDir !== taskDir) {
           try {
@@ -4378,6 +5005,8 @@ export function startDaemon(config = {}, deps = {}) {
         logPath,
         stopForceKillTimer: null,
         managedByFireBridge: true,
+        tmuxSession: tmuxSession || null,
+        tmuxMode: Boolean(tmuxSession),
       });
 
       client
@@ -4393,15 +5022,29 @@ export function startDaemon(config = {}, deps = {}) {
           logError(`Failed to report task status (RUNNING) for ${taskId}: ${err?.message || err}`);
         });
 
-      if (child.stdout && typeof child.stdout.pipe === "function" && logStream) {
-        child.stdout.pipe(logStream, { end: false });
-      } else if (child.stdout && typeof child.stdout.on === "function" && logStream) {
-        child.stdout.on("data", (chunk) => logStream.write(chunk));
-      }
-      if (child.stderr && typeof child.stderr.pipe === "function" && logStream) {
-        child.stderr.pipe(logStream, { end: false });
-      } else if (child.stderr && typeof child.stderr.on === "function" && logStream) {
-        child.stderr.on("data", (chunk) => logStream.write(chunk));
+      // In tmux mode the Fire process writes directly to logPath via the
+      // shell redirection inside the tmux session, so the daemon does not
+      // pipe stdout/stderr. We only attach the data listeners in normal mode.
+      if (!tmuxSession) {
+        if (child.stdout && typeof child.stdout.pipe === "function" && logStream) {
+          child.stdout.pipe(logStream, { end: false });
+        } else if (child.stdout && typeof child.stdout.on === "function" && logStream) {
+          child.stdout.on("data", (chunk) => logStream.write(chunk));
+        }
+        if (child.stderr && typeof child.stderr.pipe === "function" && logStream) {
+          child.stderr.pipe(logStream, { end: false });
+        } else if (child.stderr && typeof child.stderr.on === "function" && logStream) {
+          child.stderr.on("data", (chunk) => logStream.write(chunk));
+        }
+      } else if (child.stderr && typeof child.stderr.on === "function") {
+        // Capture any error output emitted by the tmux client itself so
+        // problems during session creation surface in daemon logs.
+        child.stderr.on("data", (chunk) => {
+          const text = chunk?.toString?.("utf8") ?? String(chunk ?? "");
+          if (text.trim()) {
+            logError(`tmux(${tmuxSession}) stderr: ${text.trim()}`);
+          }
+        });
       }
 
       child.on("error", (err) => {
@@ -4414,6 +5057,37 @@ export function startDaemon(config = {}, deps = {}) {
 
       child.on("exit", (code, signal) => {
         const active = activeTaskProcesses.get(taskId);
+
+        // In tmux mode the `tmux new-session -d` client always exits
+        // shortly after launching the Fire session. A clean exit (code 0,
+        // no signal) just means the session was successfully created and
+        // Fire is now running detached under the tmux server. We must NOT
+        // remove the task from activeTaskProcesses or report a terminal
+        // status in that case — Fire is still alive.
+        if (active?.tmuxMode && !signal && code === 0) {
+          log(`Fire launched in detached tmux session: ${active.tmuxSession || "(unknown)"}`);
+          if (logStream) {
+            const ts = new Date().toLocaleString("sv-SE", { timeZone: "Asia/Shanghai" }).replace(" ", "T");
+            logStream.write(
+              `[daemon ${ts}] tmux session ${active.tmuxSession || "?"} created; Fire detached from daemon\n`,
+            );
+          }
+          return;
+        }
+
+        // tmux mode + non-zero/signaled exit means `tmux new-session` itself
+        // failed (duplicate session, invalid args, tmux server crashed, …).
+        // Fire never started, so the bridge-managed assumption that "Fire
+        // will report its own terminal status" no longer holds — force the
+        // daemon to report failure so the backend doesn't get stuck on
+        // RUNNING.
+        if (active?.tmuxMode) {
+          active.forceDaemonTerminalStatusReport = true;
+          logError(
+            `tmux session ${active.tmuxSession || "?"} for task ${taskId} failed to launch (code=${code}, signal=${signal || "null"})`,
+          );
+        }
+
         if (active?.stopForceKillTimer) {
           clearTimeout(active.stopForceKillTimer);
         }
@@ -4565,7 +5239,31 @@ export function startDaemon(config = {}, deps = {}) {
     let refreshStoppedActiveTask = false;
     let startupTerminalStatusReported = false;
     try {
-    const activeTarget = activeTaskProcesses.get(normalizedTargetTaskId);
+    let activeTarget = activeTaskProcesses.get(normalizedTargetTaskId);
+
+    // For tmux-mode entries, `activeTarget.child` is the long-dead
+    // `tmux new-session` client object — truthy regardless of whether
+    // the underlying tmux session (and Fire inside it) is still alive.
+    // Probe the actual session and clean up stale entries on demand so
+    // the restart gating below reflects reality, not the stale record.
+    if (activeTarget?.tmuxMode && activeTarget.tmuxSession) {
+      const sessionAlive = await tmuxSessionExists(activeTarget.tmuxSession);
+      if (
+        !sessionAlive &&
+        activeTaskProcesses.get(normalizedTargetTaskId) === activeTarget
+      ) {
+        log(
+          `Tmux session ${activeTarget.tmuxSession} for task ${normalizedTargetTaskId} no longer exists; clearing stale activeTaskProcesses entry before restart`,
+        );
+        if (activeTarget.stopForceKillTimer) {
+          clearTimeout(activeTarget.stopForceKillTimer);
+          activeTarget.stopForceKillTimer = null;
+        }
+        activeTaskProcesses.delete(normalizedTargetTaskId);
+        activeTarget = undefined;
+      }
+    }
+
     if (isRefreshSessionInplace) {
       if (!activeTarget?.child) {
         reportRestartFailure({
@@ -4579,12 +5277,16 @@ export function startDaemon(config = {}, deps = {}) {
         return;
       }
     } else if (activeTarget?.child) {
+      // tmux-mode failures point at the tmux session, not a meaningless pid.
+      const description = activeTarget.tmuxMode
+        ? `task already active in tmux session ${activeTarget.tmuxSession || "(unknown)"} — stop the task before restarting`
+        : `task already active (pid=${activeTarget.child.pid ?? "unknown"})`;
       reportRestartFailure({
         taskId: normalizedTargetTaskId,
         projectId: normalizedProjectId,
         requestId,
         mode: normalizedMode,
-        error: new Error(`task already active (pid=${activeTarget.child.pid ?? "unknown"})`),
+        error: new Error(description),
       });
       return;
     }
@@ -4882,10 +5584,12 @@ export function startDaemon(config = {}, deps = {}) {
       env.CONDUCTOR_BACKEND_URL = BACKEND_HTTP;
     }
 
-    const child = spawnFn(process.execPath, [CLI_PATH_VAL, ...args], {
-      cwd: taskDir,
+    const { child, tmuxSession } = spawnFireProcess({
+      taskId: normalizedTargetTaskId,
+      args,
       env,
-      stdio: ["inherit", "pipe", "pipe"],
+      cwd: taskDir,
+      logPath,
     });
 
     let logStream;
@@ -4919,18 +5623,32 @@ export function startDaemon(config = {}, deps = {}) {
       logPath,
       stopForceKillTimer: null,
       managedByFireBridge: true,
+      tmuxSession: tmuxSession || null,
+      tmuxMode: Boolean(tmuxSession),
     };
     activeTaskProcesses.set(normalizedTargetTaskId, activeProcessRecord);
 
-    if (child.stdout && typeof child.stdout.pipe === "function" && logStream) {
-      child.stdout.pipe(logStream, { end: false });
-    } else if (child.stdout && typeof child.stdout.on === "function" && logStream) {
-      child.stdout.on("data", (chunk) => logStream.write(chunk));
-    }
-    if (child.stderr && typeof child.stderr.pipe === "function" && logStream) {
-      child.stderr.pipe(logStream, { end: false });
-    } else if (child.stderr && typeof child.stderr.on === "function" && logStream) {
-      child.stderr.on("data", (chunk) => logStream.write(chunk));
+    // In tmux mode the Fire process writes directly to logPath via shell
+    // redirection inside the tmux session, so the daemon does not pipe
+    // stdout/stderr. We only attach the data listeners in normal mode.
+    if (!tmuxSession) {
+      if (child.stdout && typeof child.stdout.pipe === "function" && logStream) {
+        child.stdout.pipe(logStream, { end: false });
+      } else if (child.stdout && typeof child.stdout.on === "function" && logStream) {
+        child.stdout.on("data", (chunk) => logStream.write(chunk));
+      }
+      if (child.stderr && typeof child.stderr.pipe === "function" && logStream) {
+        child.stderr.pipe(logStream, { end: false });
+      } else if (child.stderr && typeof child.stderr.on === "function" && logStream) {
+        child.stderr.on("data", (chunk) => logStream.write(chunk));
+      }
+    } else if (child.stderr && typeof child.stderr.on === "function") {
+      child.stderr.on("data", (chunk) => {
+        const text = chunk?.toString?.("utf8") ?? String(chunk ?? "");
+        if (text.trim()) {
+          logError(`tmux(${tmuxSession}) stderr: ${text.trim()}`);
+        }
+      });
     }
 
     child.on("error", (err) => {
@@ -4943,6 +5661,33 @@ export function startDaemon(config = {}, deps = {}) {
 
     child.on("exit", (code, signal) => {
       const active = activeTaskProcesses.get(normalizedTargetTaskId);
+
+      // In tmux mode the `tmux new-session -d` client always exits soon
+      // after launching the session. A clean exit (code 0, no signal) means
+      // Fire is now running detached under the tmux server — keep the task
+      // record and skip terminal-status reporting.
+      if (active?.tmuxMode && !signal && code === 0) {
+        log(`Fire restart launched in detached tmux session: ${active.tmuxSession || "(unknown)"}`);
+        if (logStream) {
+          const ts = new Date().toLocaleString("sv-SE", { timeZone: "Asia/Shanghai" }).replace(" ", "T");
+          logStream.write(
+            `[daemon ${ts}] tmux session ${active.tmuxSession || "?"} created; Fire detached from daemon\n`,
+          );
+        }
+        return;
+      }
+
+      // tmux mode + non-zero/signaled exit means the `tmux new-session` call
+      // failed before Fire could start (e.g. duplicate session for the same
+      // task id, tmux server crashed). Force the daemon to report failure so
+      // the backend doesn't get stuck on RUNNING.
+      if (active?.tmuxMode) {
+        active.forceDaemonTerminalStatusReport = true;
+        logError(
+          `tmux session ${active.tmuxSession || "?"} for restart of task ${normalizedTargetTaskId} failed to launch (code=${code}, signal=${signal || "null"})`,
+        );
+      }
+
       if (active?.stopForceKillTimer) {
         clearTimeout(active.stopForceKillTimer);
       }
@@ -5056,10 +5801,15 @@ export function startDaemon(config = {}, deps = {}) {
 
     closePromise = (async () => {
       daemonShuttingDown = true;
+      daemonShutdownInProgress = true;
       if (watchdogTimer) {
         clearInterval(watchdogTimer);
         watchdogTimer = null;
       }
+      if (tmuxLivenessTimer) {
+        clearInterval(tmuxLivenessTimer);
+        tmuxLivenessTimer = null;
+      }
       const activeProcessEntries = [...activeTaskProcesses.entries()];
       const activePtyEntries = [...activePtySessions.entries()];
       const activeEntries = [...activeProcessEntries, ...activePtyEntries];
@@ -5097,6 +5847,16 @@ export function startDaemon(config = {}, deps = {}) {
         if (record?.stopForceKillTimer) {
           clearTimeout(record.stopForceKillTimer);
         }
+        // In tmux mode the Fire process runs detached under the tmux server.
+        // Daemon shutdown must NOT terminate those Fire processes — that's
+        // the whole purpose of the mode. Skip the kill and let them keep
+        // running.
+        if (record?.tmuxMode) {
+          log(
+            `Daemon shutting down: leaving tmux-detached Fire task ${taskId} (session=${record.tmuxSession || "?"}) running`,
+          );
+          continue;
+        }
         try {
           if (typeof record.child?.kill === "function") {
             record.child.kill("SIGTERM");