@monster-orange/den 0.4.13 → 0.4.15

package/src/shared/agents/conversations.ts

@@ -0,0 +1,256 @@
+/**
+ * AG-17.1, bring in a conversation: the runtime's own recent conversations
+ * for a folder, read from its history without ever reading a whole
+ * transcript.
+ *
+ * Claude Code keeps one JSON-lines file per conversation,
+ * `<projects>/<slug>/<id>.jsonl`, where <slug> is the cwd with every
+ * character that isn't a letter or digit made "-" (`/w/a.b` → `-w-a-b`).
+ * The slug alone can't tell `/w/north` from `/w/north-2`, so a
+ * conversation is listed only when the `cwd` its own records carry is the
+ * folder or inside it.
+ *
+ * Each file is read at its two ends only (ENDS_BYTES each): the head for
+ * its cwd and its first prompt, the tail for its latest `/rename`
+ * (custom-title). Title: the latest custom-title, else the first prompt a
+ * person typed, else null. lastAt is the file's mtime: a conversation
+ * written in the last OPEN_ELSEWHERE_MS is taken to be open in another
+ * terminal (one writer only).
+ */
+import * as fs from "fs";
+import * as path from "path";
+import { claudeProjectsDir } from "../usage/paths.js";
+import { cleanName } from "./transcript-follow.js";
+
+/** One of a runtime's conversations, as Bring in lists it. */
+export interface RuntimeConversation {
+  /** The runtime's own id for it (Claude Code: the transcript's name). */
+  id: string;
+  /** Its name for people, or null when it has none yet. */
+  title: string | null;
+  /** When it was last written (ISO). */
+  lastAt: string;
+  /** The folder it ran in. */
+  cwd: string;
+}
+
+/** Bytes read at each end of a transcript. */
+export const ENDS_BYTES = 64 * 1024;
+/** Written this recently: still open in another terminal (AG-17.1). */
+export const OPEN_ELSEWHERE_MS = 60_000;
+/** The most conversations listed for one folder (the newest). */
+export const MAX_CONVERSATIONS = 50;
+
+export const OPEN_ELSEWHERE_MESSAGE =
+  "Still open in another terminal. Close it there first";
+
+const ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+
+/** Claude Code's project folder name for `dir`. */
+export function claudeSlug(dir: string): string {
+  return dir.replace(/[^A-Za-z0-9]/g, "-");
+}
+
+/** Whether `p` is `dir` or inside it. */
+function within(p: string, dir: string): boolean {
+  const rel = path.relative(dir, p);
+  return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
+}
+
+/**
+ * The complete lines at the two ends of `file`: at most `bytes` from each.
+ * A line cut at either edge is left out; a short file is all head.
+ */
+export function readEnds(
+  file: string,
+  bytes = ENDS_BYTES,
+): { head: string[]; tail: string[] } {
+  const fd = fs.openSync(file, "r");
+  try {
+    const size = fs.fstatSync(fd).size;
+    const read = (at: number, n: number) => {
+      const buf = Buffer.alloc(n);
+      const got = fs.readSync(fd, buf, 0, n, at);
+      return buf.subarray(0, got).toString("utf-8");
+    };
+    const headText = read(0, Math.min(size, bytes));
+    const head = headText.split("\n");
+    // The whole file: every line. Else the last piece was cut.
+    if (size <= bytes) return { head: head.filter(Boolean), tail: [] };
+    head.pop();
+    const start = Math.max(bytes, size - bytes);
+    const tail = read(start, size - start).split("\n");
+    // The first piece was cut (or is the head's).
+    tail.shift();
+    return { head: head.filter(Boolean), tail: tail.filter(Boolean) };
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+function parse(line: string): Record<string, unknown> | null {
+  try {
+    const v = JSON.parse(line) as unknown;
+    return v && typeof v === "object" ? (v as Record<string, unknown>) : null;
+  } catch {
+    return null;
+  }
+}
+
+/** The text a person typed in a user record, or null (tool results, meta). */
+function promptText(rec: Record<string, unknown>): string | null {
+  if (rec.type !== "user" || rec.isMeta === true) return null;
+  const msg = rec.message as { content?: unknown } | undefined;
+  let text: unknown = msg?.content;
+  if (Array.isArray(text)) {
+    const first = text.find(
+      (c) => (c as { type?: unknown })?.type === "text",
+    ) as { text?: unknown } | undefined;
+    text = first?.text;
+  }
+  if (typeof text !== "string") return null;
+  // Slash commands and their output come wrapped in tags: not a prompt.
+  if (text.trimStart().startsWith("<")) return null;
+  return cleanName(text);
+}
+
+/** A transcript's cwd and title, from its two ends. */
+export function transcriptSummary(
+  file: string,
+  bytes = ENDS_BYTES,
+): { cwd: string | null; title: string | null } {
+  const { head, tail } = readEnds(file, bytes);
+  let cwd: string | null = null;
+  let prompt: string | null = null;
+  let title: string | null = null;
+  const titleIn = (line: string) => {
+    if (!line.includes("custom-title")) return;
+    const r = parse(line);
+    if (r?.type === "custom-title") title = cleanName(r.customTitle) ?? title;
+  };
+  for (const line of head) {
+    titleIn(line);
+    if (cwd && prompt) continue;
+    if (!line.includes('"cwd"') && !line.includes('"user"')) continue;
+    const r = parse(line);
+    if (!r) continue;
+    if (!cwd && typeof r.cwd === "string" && path.isAbsolute(r.cwd))
+      cwd = r.cwd;
+    prompt ??= promptText(r);
+  }
+  for (const line of tail) titleIn(line);
+  return { cwd, title: title ?? prompt };
+}
+
+/** A folder's absolute forms: as given and its real path. */
+function forms(dir: string): string[] {
+  const out = [path.resolve(dir)];
+  try {
+    const real = fs.realpathSync(dir);
+    if (!out.includes(real)) out.push(real);
+  } catch {
+    /* gone: as given */
+  }
+  return out;
+}
+
+/**
+ * Claude Code's conversations that ran in `folder` or a folder inside it,
+ * newest first, at most MAX_CONVERSATIONS. Never throws: a history it
+ * can't read is no conversations.
+ */
+/**
+ * Where a workspace's conversations ran (AG-17.1): in or under one of
+ * `under`, or exactly in one of `exact` (a shared repos root: its other
+ * subfolders are other workspaces' or no repo's).
+ */
+export interface ConversationScope {
+  under: string[];
+  exact?: string[];
+}
+
+export function claudeConversations(
+  scope: string | ConversationScope,
+  env: NodeJS.ProcessEnv = process.env,
+): RuntimeConversation[] {
+  const sc = typeof scope === "string" ? { under: [scope] } : scope;
+  const root = claudeProjectsDir(env);
+  const dirs = sc.under.flatMap(forms);
+  const exact = (sc.exact ?? []).flatMap(forms);
+  const slugs = [...dirs, ...exact].map(claudeSlug);
+  let projects: string[];
+  try {
+    projects = fs.readdirSync(root);
+  } catch {
+    return [];
+  }
+  const files: { id: string; file: string; mtimeMs: number }[] = [];
+  for (const p of projects) {
+    if (!slugs.some((s) => p === s || p.startsWith(`${s}-`))) continue;
+    let names: string[];
+    try {
+      names = fs.readdirSync(path.join(root, p));
+    } catch {
+      continue;
+    }
+    for (const n of names) {
+      if (!n.endsWith(".jsonl")) continue;
+      const id = n.slice(0, -".jsonl".length);
+      if (!ID_RE.test(id)) continue;
+      const file = path.join(root, p, n);
+      try {
+        const st = fs.statSync(file);
+        if (st.isFile() && st.size > 0)
+          files.push({ id, file, mtimeMs: st.mtimeMs });
+      } catch {
+        /* gone */
+      }
+    }
+  }
+  files.sort((a, b) => b.mtimeMs - a.mtimeMs);
+  const out: RuntimeConversation[] = [];
+  const seen = new Set<string>();
+  for (const f of files) {
+    if (out.length >= MAX_CONVERSATIONS) break;
+    if (seen.has(f.id)) continue;
+    let s: ReturnType<typeof transcriptSummary>;
+    try {
+      s = transcriptSummary(f.file);
+    } catch {
+      continue;
+    }
+    const cwd = s.cwd;
+    // Filtered before the cap, so others' conversations never crowd out
+    // this workspace's.
+    if (
+      !cwd ||
+      !(
+        dirs.some((d) => within(cwd, d)) ||
+        exact.some((d) => path.resolve(cwd) === d)
+      )
+    )
+      continue;
+    seen.add(f.id);
+    out.push({
+      id: f.id,
+      title: s.title,
+      lastAt: new Date(f.mtimeMs).toISOString(),
+      cwd,
+    });
+  }
+  return out;
+}
+
+/** Whether a conversation that ran in `cwd` is in `scope` (AG-17.1). */
+export function inScope(cwd: string, scope: ConversationScope): boolean {
+  return (
+    scope.under.flatMap(forms).some((d) => within(cwd, d)) ||
+    (scope.exact ?? []).flatMap(forms).some((d) => path.resolve(cwd) === d)
+  );
+}
+
+/** Whether a conversation last written at `lastAt` is still open elsewhere. */
+export function openElsewhere(lastAt: string, now = Date.now()): boolean {
+  const t = Date.parse(lastAt);
+  return Number.isFinite(t) && now - t < OPEN_ELSEWHERE_MS;
+}

package/src/shared/agents/den-claude.ts

@@ -70,6 +70,7 @@ import { catalogFind } from "./catalog-runtime.js";
 import { locateRuntime, type RuntimeFind } from "./runtime-search.js";
 import { claudeProjectsDir } from "../usage/paths.js";
 import { cleanName, transcriptTitle } from "./transcript-follow.js";
+import { claudeConversations, transcriptSummary } from "./conversations.js";
 
 /**
  * `/rename "x"` keeps the quotes in customTitle: one matching pair around
@@ -488,6 +489,24 @@ export const denClaude: Runtime = {
   conversationExists(token, env = process.env) {
     return transcriptFile(token, env) !== null;
   },
+  // AG-17.1: its transcripts for the folder (conversations.ts).
+  listSessions(scope, env = process.env) {
+    try {
+      return claudeConversations(scope, env);
+    } catch {
+      return [];
+    }
+  },
+  // AG-17.1: the folder a conversation ran in (only the ends of its file),
+  // so a foreign one is refused by name.
+  conversationCwd(token, env = process.env) {
+    try {
+      const file = transcriptFile(token, env);
+      return file ? transcriptSummary(file).cwd : null;
+    } catch {
+      return null;
+    }
+  },
   // AG-4b, unofficial (catalog sessionName): `/rename` appends a
   // {"type":"custom-title","customTitle":…} record to the transcript; the
   // latest one, read on from the last ask (never the whole file), less one

package/src/shared/agents/records.ts

@@ -42,6 +42,11 @@ export interface AgentRecord {
   resumedAt?: string;
   /** The runtime's handle for resume (den-claude: the conversation id). */
   resumeToken?: string;
+  /**
+   * AG-17.1: brought in from a conversation started outside Den (when);
+   * Den's token, hooks and guards apply from then on.
+   */
+  broughtInAt?: string;
   /**
    * The runtime was launched on resumeToken at least once (0.4.8). A
    * resume then always tries the runtime's own resume first, never a new
@@ -161,6 +166,24 @@ export interface AgentUsage {
 /** An agent id: the same rules as a workspace or session name. */
 export const AGENT_ID_RE = WORKSPACE_NAME_RE;
 
+/**
+ * AG-10.10b: the agent id a Name gives, so the name works in the CLI too:
+ * lowercase, spaces to "-", only id characters, at most 64. Null when
+ * nothing of it is left ("!!!"). The page's nameSlug is the same rule.
+ */
+export function nameSlug(name: string): string | null {
+  const s = name
+    .trim()
+    .toLowerCase()
+    .replace(/\s+/g, "-")
+    .replace(/[^a-z0-9._-]/g, "")
+    .replace(/-{2,}/g, "-")
+    .replace(/^[^a-z0-9]+/, "")
+    .slice(0, 64)
+    .replace(/[-._]+$/, "");
+  return s && AGENT_ID_RE.test(s) ? s : null;
+}
+
 export function agentsDir(stateDir: string): string {
   return path.join(stateDir, "agents");
 }

package/src/shared/agents/runtime.ts

@@ -21,6 +21,7 @@ import type { AgentRecord } from "./records.js";
 import type { Persona } from "./personas.js";
 import type { BinSource, RuntimeFind } from "./runtime-search.js";
 import type { PermissionIntent } from "./permissions.js";
+import type { RuntimeConversation } from "./conversations.js";
 
 export const RUNTIME_KIND = "runtime";
 
@@ -193,6 +194,19 @@ export interface Runtime {
    * just mean it isn't written yet.
    */
   conversationExists?(token: string, env?: NodeJS.ProcessEnv): boolean;
+  /**
+   * AG-17.1, bring in a conversation: the runtime's own recent
+   * conversations that ran in `cwd` or a folder inside it, newest first,
+   * read from its history (only the ends of each file, never a whole
+   * transcript). Each id is one `resume` continues. None: this runtime
+   * can't bring one in yet. Must never throw.
+   */
+  listSessions?(
+    scope: string | { under: string[]; exact?: string[] },
+    env?: NodeJS.ProcessEnv,
+  ): RuntimeConversation[];
+  /** AG-17.1: the folder conversation `token` ran in, or null. Never throws. */
+  conversationCwd?(token: string, env?: NodeJS.ProcessEnv): string | null;
   /**
    * What the runtime prints when it exits at once (0.4.8): `noConversation`
    * when a resume finds nothing to continue, `idInUse` when a new

package/src/shared/claim-code.ts

@@ -0,0 +1,163 @@
+/**
+ * The claim code (0.4.15, Ward 2026-11-07): how the browser the person
+ * opens at the end of the install signs in without a sign-in step, so that
+ * approving an agent's changes (which needs a signed-in browser session,
+ * even on localhost) works from the first page.
+ *
+ *  - `c1.<nonce>.<expiry>.<mac>`, the mac HMAC-SHA256(web.secret, context +
+ *    the rest), its context its own: a login code (web-session.ts) is never
+ *    a claim code, and the other way round.
+ *  - Valid for 30 minutes: an install hands it over, and the person may take
+ *    a while to open it. An expiry further out than that is refused.
+ *  - Single use. Used nonces are kept in `<state dir>/claim-nonces.json`
+ *    (0600) until they expire, so a server restart can't revive one. The
+ *    file holds nonces only, never a code. A file that won't parse refuses
+ *    every claim (fail closed); the sign-in flows still work.
+ *  - Minted by the CLI (`<cli> web claim-link`), which reads web.secret as
+ *    the same OS user. The CLI refuses inside an agent's session
+ *    (claimRefusalForAgent): an agent must never hold one.
+ *
+ * Limit: an agent running as the same OS user could, in principle, read
+ * web.secret or the browser's cookie store from disk. That is the strength
+ * of Den's other person-only routes too; only an OS boundary is stronger.
+ */
+import { createHmac, randomBytes, timingSafeEqual } from "crypto";
+import * as fs from "fs";
+import * as path from "path";
+import { ACTOR_TOKEN_ENV } from "./actor-token.js";
+import { AGENT_ACTOR_ENV } from "./sessions/env.js";
+
+export const CLAIM_CODE_TTL_MS = 30 * 60_000;
+const SKEW_MS = 5_000;
+const CONTEXT = "den-claim-v1:";
+export const CLAIM_NONCES_FILE = "claim-nonces.json";
+
+function mac(secret: Buffer, body: string): Buffer {
+  return createHmac("sha256", secret)
+    .update(CONTEXT + body)
+    .digest();
+}
+
+/** A fresh claim code, valid for 30 minutes from `now`. */
+export function mintClaimCode(
+  secret: Buffer,
+  now: number = Date.now(),
+): string {
+  const nonce = randomBytes(16).toString("base64url");
+  const body = `c1.${nonce}.${(now + CLAIM_CODE_TTL_MS).toString(36)}`;
+  return `${body}.${mac(secret, body).toString("base64url")}`;
+}
+
+export type ClaimCodeCheck =
+  | { ok: true; nonce: string; expiresAt: number }
+  | { ok: false; reason: "malformed" | "bad_mac" | "expired" };
+
+/**
+ * Whether `code` is a claim code this secret minted, still in its 30
+ * minutes. Constant-time mac. Single use is ClaimNonces'.
+ */
+export function checkClaimCode(
+  code: string,
+  secret: Buffer,
+  now: number = Date.now(),
+): ClaimCodeCheck {
+  const m =
+    /^(c1\.([A-Za-z0-9_-]{22})\.([0-9a-z]{1,11}))\.([A-Za-z0-9_-]{43})$/.exec(
+      code,
+    );
+  if (!m) return { ok: false, reason: "malformed" };
+  const given = Buffer.from(m[4], "base64url");
+  const want = mac(secret, m[1]);
+  if (given.length !== want.length || !timingSafeEqual(given, want))
+    return { ok: false, reason: "bad_mac" };
+  const expiresAt = parseInt(m[3], 36);
+  if (
+    !Number.isFinite(expiresAt) ||
+    now >= expiresAt ||
+    expiresAt - now > CLAIM_CODE_TTL_MS + SKEW_MS
+  )
+    return { ok: false, reason: "expired" };
+  return { ok: true, nonce: m[2], expiresAt };
+}
+
+/**
+ * `<origin>/auth?claim=<code>`: the sign-in route, so it is classed as one
+ * (a mutating GET: another site can't open it; an agent's token can't).
+ */
+export function claimLink(origin: string, code: string): string {
+  return `${origin.replace(/\/+$/, "")}/auth?claim=${encodeURIComponent(code)}`;
+}
+
+/**
+ * Why the CLI won't let a browser in from here (a claim link, a sign-in
+ * link, pairing a device, the GitHub owner), or null when it may: inside
+ * an agent's session (DEN_AGENT or DEN_ACTOR_TOKEN set) it never does.
+ */
+export function personGrantRefusal(env: NodeJS.ProcessEnv): string | null {
+  if (env[AGENT_ACTOR_ENV] !== undefined || env[ACTOR_TOKEN_ENV] !== undefined)
+    return "An agent can't do this: it lets a browser in as you. Run it in your own terminal.";
+  return null;
+}
+
+/** Why the CLI won't mint a claim code here, or null when it may. */
+export function claimRefusalForAgent(env: NodeJS.ProcessEnv): string | null {
+  return personGrantRefusal(env)
+    ? "An agent can't make a claim link: it signs a browser in as the person. Run it in your own terminal."
+    : null;
+}
+
+/** The used claim nonces, kept until they expire (a file, 0600). */
+export class ClaimNonces {
+  constructor(private readonly stateDir: string) {}
+
+  private file(): string {
+    return path.join(this.stateDir, CLAIM_NONCES_FILE);
+  }
+
+  /** The used nonces; null when the file is there but won't parse (fail closed). */
+  private read(): Record<string, number> | null {
+    let raw: string;
+    try {
+      raw = fs.readFileSync(this.file(), "utf-8");
+    } catch (e) {
+      return (e as NodeJS.ErrnoException).code === "ENOENT" ? {} : null;
+    }
+    let o: unknown;
+    try {
+      o = JSON.parse(raw);
+    } catch {
+      return null;
+    }
+    if (!o || typeof o !== "object" || Array.isArray(o)) return null;
+    const out: Record<string, number> = {};
+    for (const [k, v] of Object.entries(o as Record<string, unknown>))
+      if (/^[A-Za-z0-9_-]{22}$/.test(k) && typeof v === "number") out[k] = v;
+    return out;
+  }
+
+  private write(used: Record<string, number>): void {
+    fs.mkdirSync(this.stateDir, { recursive: true });
+    const tmp = `${this.file()}.${process.pid}.${randomBytes(4).toString("hex")}`;
+    fs.writeFileSync(tmp, JSON.stringify(used) + "\n", { mode: 0o600 });
+    fs.chmodSync(tmp, 0o600);
+    fs.renameSync(tmp, this.file());
+  }
+
+  /**
+   * Use `nonce` (its code expires at `expiresAt`): true the first time,
+   * false once used. Expired entries are pruned on the way.
+   */
+  consume(nonce: string, expiresAt: number, now: number = Date.now()): boolean {
+    const used = this.read();
+    // Unreadable: refuse every claim rather than forget which were used.
+    if (!used) return false;
+    for (const [k, exp] of Object.entries(used)) if (exp <= now) delete used[k];
+    if (nonce in used) {
+      this.write(used);
+      return false;
+    }
+    used[nonce] = expiresAt;
+    this.write(used);
+    return true;
+  }
+}

package/src/shared/cli-command.ts

@@ -143,6 +143,37 @@ export function sshTarget(
   return /^[a-z0-9._:-]+$/.test(h) && !h.startsWith("-") ? h : fallback;
 }
 
+/** An account name ssh can take before `@`: letters, digits, `.`, `_`, `-`. */
+const SSH_USER_RE = /^[A-Za-z0-9_][A-Za-z0-9._-]{0,63}$/;
+
+/**
+ * `web.ssh_user` as stored (SEC-2a-UX): the account the signed-out page's
+ * ssh link and command log in as. undefined when unset (the account Den
+ * runs as); "" leaves the account off. Throws naming the key otherwise.
+ */
+export function parseSshUser(v: unknown): string | undefined {
+  if (v === undefined || v === null) return undefined;
+  if (typeof v !== "string" || (v.trim() !== "" && !SSH_USER_RE.test(v.trim())))
+    throw new Error(
+      `web.ssh_user must be an account name (letters, digits, ".", "_", "-"), or "" to leave it off; got ${JSON.stringify(v)}`,
+    );
+  return v.trim();
+}
+
+/**
+ * The account for the ssh link: `setting` when set ("" for none), else
+ * `osUser` when ssh can take it, else none.
+ */
+export function sshUser(setting: string | undefined, osUser: string): string {
+  if (setting !== undefined) return setting;
+  return SSH_USER_RE.test(osUser) ? osUser : "";
+}
+
+/** `user@target`, or the bare target when there's no user. */
+export function sshLogin(target: string, user: string): string {
+  return user ? `${user}@${target}` : target;
+}
+
 /** `Mac-Studio.localdomain` → `Mac-Studio`; an IP literal stays whole. */
 export function shortHostname(hostname: string): string {
   const h = hostname.trim();

package/src/shared/den-config.ts

@@ -818,6 +818,8 @@ export const MCP_ACTIONS = [
   "run_tests",
   // AG-14.4: resume another agent of its workspace (or a granted one).
   "agent_resume",
+  // AG-17.1: bring in a conversation started outside Den, as an agent.
+  "agent_import",
 ] as const;
 export type McpAction = (typeof MCP_ACTIONS)[number];
 
@@ -829,6 +831,11 @@ export interface McpConfig {
   run_tests?: { envs?: string[] };
   /** `remote: true` lets the log tools read non-local sources (e.g. CloudWatch). */
   logs?: { remote?: boolean };
+  /**
+   * The held writes (workspace_create, repo_add, service_try): on by
+   * default, each run only after the person's Allow. false hides them.
+   */
+  approvals?: boolean;
 }
 
 /** `mcp:` with its defaults applied. */
@@ -836,6 +843,8 @@ export interface ResolvedMcpConfig {
   actions: McpAction[];
   runTestsEnvs: Environment[];
   logsRemote: boolean;
+  /** Whether the held writes are registered (default true). */
+  approvals: boolean;
 }
 
 /**
@@ -863,10 +872,15 @@ export function readMcpConfig(
       return e as Environment;
     },
   );
+  if (raw.approvals !== undefined && typeof raw.approvals !== "boolean")
+    throw new Error(
+      `mcp.approvals: true or false, not ${JSON.stringify(raw.approvals)}`,
+    );
   return {
     actions: [...new Set(actions)],
     runTestsEnvs: [...new Set(runTestsEnvs)],
     logsRemote: raw.logs?.remote === true,
+    approvals: raw.approvals !== false,
   };
 }
 

package/src/shared/environment-manager/service-runner.ts

@@ -2794,18 +2794,13 @@ export function runServiceCommand(
   // later down signalled the dead group while the real listener ran on).
   // A failed start keeps no record at all.
   const serviceExited = (exitCode: number): void => {
-    const rec = recorded;
-    if (rec && processGroupStateSync(rec)?.state === "gone") {
-      const now = findDaemonByAddress(resolved.address);
-      // A non-zero exit is a failed start: nothing of it runs, so no
-      // record (its containers, if any, still run: then only the group
-      // goes). A zero exit handed off (`make up`): its group stays, and
-      // down says it already exited.
-      if (now?.pgid === rec.pgid && exitCode !== 0) {
-        if (!(now.containers?.length ?? 0)) unregisterDaemon(resolved.address);
-        else clearDaemonProcessGroup(resolved.address);
-      }
-    }
+    const rec: RecordedProcessGroup | null = recorded;
+    const state = rec ? (processGroupStateSync(rec)?.state ?? null) : null;
+    const now = findDaemonByAddress(resolved.address);
+    const action = failedStartCleanup(exitCode, rec, state, now);
+    if (action === "unregister") unregisterDaemon(resolved.address);
+    else if (action === "clear-group")
+      clearDaemonProcessGroup(resolved.address);
     onServiceExit?.(exitCode);
   };
   const proc = recordGroup
@@ -2835,6 +2830,30 @@ export function runServiceCommand(
   return { proc, detachable, interactive: false, logPath };
 }
 
+/**
+ * What a detached up does with its record when the service process exits.
+ * A non-zero exit is a failed start: nothing of it runs, so no record (its
+ * containers, if any, still run: then only the group goes). A zero exit
+ * handed off (`make up`): its group stays, and down says it already exited.
+ * The record goes only if it is this run's: its group is the one this run
+ * recorded and that group is gone, or this run could not record a group
+ * (the command exited, a zombie, before `ps` saw it) and the record names
+ * none.
+ */
+export function failedStartCleanup(
+  exitCode: number,
+  rec: RecordedProcessGroup | null,
+  groupState: string | null,
+  now: { pgid?: number; containers?: unknown[] } | undefined,
+): "unregister" | "clear-group" | "keep" {
+  if (exitCode === 0 || !now) return "keep";
+  const ours = rec
+    ? groupState === "gone" && now.pgid === rec.pgid
+    : now.pgid === undefined;
+  if (!ours) return "keep";
+  return (now.containers?.length ?? 0) ? "clear-group" : "unregister";
+}
+
 // ── Health checks ─────────────────────────────────────────────────────────────
 // (implementation lives in health.ts — re-exported above)