@north-light/crouter 0.3.318 → 0.3.319

package/dist/daemon/manage.js

@@ -1,595 +1,2 @@
-// Daemon management helpers — importable without the full command tree.
-//
-// spawnDaemon() is the low-level spawn call shared by `crtr sys daemon start` and
-// ensureDaemon(). ensureDaemon() is the silent "start if not running" front-
-// door helper called by the canvas runtime before spawning child nodes.
-import { spawn, execFileSync } from 'node:child_process';
-import { createRequire } from 'node:module';
-import { dirname, join } from 'node:path';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import { existsSync, lstatSync, mkdirSync, openSync, closeSync } from 'node:fs';
-import { crtrHome } from '../core/canvas/paths.js';
-import { bindDaemonEventSource, eventSource } from '../core/events/source.js';
-import { hostExecPath } from '../core/runtime/branded-host.js';
-// Pulled from the lean db-free pidfile module (NOT crtrd.js, whose module graph
-// reaches openDb) so the CLI daemon front door stays canvas.db-free (plan B-0).
-import { isDaemonRunning, readPidfile, isPidAlive } from './pidfile.js';
-import { DAEMON_STARTUP_WINDOW_MS } from './startup-policy.js';
-import { exclusiveLockOwnerPid } from '../core/exclusive-lock.js';
-import { onDiskMigrationLockPath } from '../core/canvas/paths.js';
-import { envNoDaemonAutostart } from '../shared/env.js';
-import { CrtrClient, waitForDaemonAvailability } from '../api/index.js';
-// Daemon env sanitization
-/** Env keys that must NEVER reach the daemon process. Restarting crtrd is
- *  overwhelmingly done from inside an agent node's own bash tool (`crtr sys
- *  daemon stop && start`), which inherits that node's FULL env — its identity
- *  (`CRTR_NODE_ID`/`CRTR_KIND`/…, the `nodeEnv()` shape in `core/runtime/
- *  nodes.ts`), its front-door recursion-guard flag, and any pi-engine
- *  resolution seam a prior test/dev session left exported. The daemon is a
- *  singleton supervisor, never "a node" itself, so none of this belongs in its
- *  env regardless of whether today's code happens to read it — and at least one
- *  of these IS actively read: `host.ts`'s broker-engine resolution falls back to
- *  `envBrokerEngine()`'s raw `CRTR_BROKER_ENGINE` read verbatim (nodeEnv() never
- *  sets that key, so nothing overrides it per child launch), so a daemon that inherits a
- *  stale/dev override throws inside `headlessBrokerHost.launch()` on EVERY
- *  relaunch it ever attempts, for its whole lifetime — the 2026-07-06 diagnosis
- *  root cause behind 19 nodes killed with "failed to relaunch and is now dead". */
-export const DAEMON_ENV_STRIP_KEYS = [
-    // Node identity (nodeEnv() shape) — meaningless for a process supervising
-    // many nodes rather than being one.
-    'CRTR_NODE_ID',
-    'CRTR_KIND',
-    'CRTR_MODE',
-    'CRTR_LIFECYCLE',
-    'CRTR_NODE_CWD',
-    'CRTR_CONTEXT_DIR',
-    'CRTR_CYCLES',
-    'CRTR_PROFILE_ID',
-    'CRTR_PARENT_NODE_ID',
-    // Recursion-guard flag — only meaningful inside a pi engine process.
-    'CRTR_FRONT_DOOR',
-    // Ambient tmux identity of whatever shell first autostarted the daemon. The
-    // daemon is a headless supervisor with no pane of its own, but `spawnNode`
-    // reads `currentTmux()` for a --root's foreground viewer placement; a stale
-    // inherited $TMUX makes that resolve to an arbitrary "current" pane, so a
-    // front-door root (created through crtrd) opens a SECOND viewer window and
-    // focuses it — stealing focus from the front door's own inline attach in the
-    // user's pane.
-    // Strip them so the daemon is truly paneless and leaves root-viewer placement
-    // to the front door. Explicit `-t <target>` tmux ops (focus/window mgmt) are
-    // unaffected — the tmux CLI reaches the server via its default socket.
-    'TMUX',
-    'TMUX_PANE',
-    // Engine-resolution seams NOT overridden per child launch — the proven and
-    // suspected poison vectors.
-    'CRTR_BROKER_ENGINE',
-    'CRTR_PI_BINARY',
-    // Generic Node.js env poisoning (a stray dev/debug flag from the restarting
-    // shell).
-    'NODE_OPTIONS',
-];
-/** A copy of `process.env` with every `DAEMON_ENV_STRIP_KEYS` entry removed.
- *  Deliberate global config the user actually wants the daemon to see —
- *  `CRTR_HOME`, `CRTR_SUBTREE`, `CRTR_LOG`, `CRTR_DEBUG`, etc. — passes through
- *  untouched; only the node-identity/engine-poisoning surface is stripped. */
-export function sanitizedDaemonEnv() {
-    const env = { ...process.env };
-    for (const key of DAEMON_ENV_STRIP_KEYS)
-        delete env[key];
-    return env;
-}
-// Entry point resolution
-/** Locate the package or generation root from a regular build, the standalone
- *  attach bundle, or a tsx source checkout. */
-function generationRoot() {
-    for (let current = dirname(fileURLToPath(import.meta.url));; current = dirname(current)) {
-        if (existsSync(join(current, 'bin', 'runtime-generation-manifest.mjs')))
-            return current;
-        const parent = dirname(current);
-        if (parent === current)
-            throw new Error(`cannot locate the crouter generation root from ${import.meta.url}`);
-    }
-}
-/** Resolve crtrd's launch argv through the same selector as `bin/crtrd`. The
- *  selector may choose an ABI-compatible sibling of `runtime/selected`, but
- *  never the caller's pinned generation. With no selection, a source checkout
- *  launches through tsx; every other selection failure remains fatal. */
-async function resolveDaemonLaunch() {
-    const root = generationRoot();
-    const manifestUrl = pathToFileURL(join(root, 'bin', 'runtime-generation-manifest.mjs')).href;
-    const { runtimeHome } = (await import(manifestUrl));
-    try {
-        lstatSync(join(runtimeHome(), 'selected'));
-    }
-    catch (error) {
-        if (error.code !== 'ENOENT')
-            throw error;
-        const tsxLoader = pathToFileURL(createRequire(import.meta.url).resolve('tsx/esm')).href;
-        // `crtr-src` maps the package's `#` subpath imports to src/*.ts; without it
-        // a source-checkout launch would silently resolve them into a stale dist/.
-        return ['--conditions', 'crtr-src', '--import', tsxLoader, join(root, 'src', 'daemon', 'crtrd-cli.ts')];
-    }
-    const selectorUrl = pathToFileURL(join(root, 'bin', 'runtime-selector.mjs')).href;
-    const { tryResolveRuntime } = (await import(selectorUrl));
-    const result = tryResolveRuntime('daemon');
-    if (!result.ok) {
-        throw new Error(`cannot resolve the selected runtime generation's daemon entry: ${result.error}`);
-    }
-    return [result.runtime.entryPath];
-}
-// Stray-daemon sweep
-/** A crtrd declares its owning canvas in argv, so ownership is an exact match
- *  on this process's canvas home. Untagged daemons retain their own
- *  supervision and are never counted or killed here. */
-export function daemonCommandDeclaresCanvasHome(command, home) {
-    return command.includes(` --canvas-home ${home} `) || command.endsWith(` --canvas-home ${home}`);
-}
-/** Every crtrd process on this host that declares ownership of this process's
- *  canvas home, by pid. The `daemon/crtrd` argv segment distinguishes daemons
- *  from brokers. `ps` is best-effort: failures return no matches, and the
- *  current process is always excluded. */
-export function findDaemonPids() {
-    let stdout;
-    try {
-        stdout = execFileSync('ps', ['-ax', '-o', 'pid=,command='], { encoding: 'utf8', timeout: 2000 });
-    }
-    catch {
-        return [];
-    }
-    const home = crtrHome();
-    const pids = [];
-    for (const line of stdout.split('\n')) {
-        if (!line.includes('daemon/crtrd'))
-            continue;
-        if (!daemonCommandDeclaresCanvasHome(line, home))
-            continue; // another install/canvas owns it
-        const trimmed = line.trim();
-        const firstSpace = trimmed.indexOf(' ');
-        if (firstSpace < 0)
-            continue;
-        const pid = Number.parseInt(trimmed.slice(0, firstSpace), 10);
-        if (Number.isInteger(pid) && pid !== process.pid)
-            pids.push(pid);
-    }
-    return pids;
-}
-/** SIGTERM (then SIGKILL after a short grace) every crtrd daemon process EXCEPT
- *  `keepPid`. This is the backstop the pidfile alone cannot provide: a daemon
- *  that survived a prior stop (ignored SIGTERM, or released its ownership lock
- *  without exiting) keeps running a supervise loop — reviving brokers and
- *  contending for canvas state — while never appearing in the pidfile again, so
- *  `stop`'s single recorded-pid signal can never reach it. Returns the pids it
- *  reaped. Best-effort throughout: a pid that dies between enumeration and signal
- *  just no-ops. */
-export function sweepStrayDaemons(keepPid) {
-    const strays = findDaemonPids().filter((pid) => pid !== keepPid);
-    for (const pid of strays) {
-        try {
-            process.kill(pid, 'SIGTERM');
-        }
-        catch { /* already gone */ }
-    }
-    if (strays.length === 0)
-        return strays;
-    // Give SIGTERM handlers a beat, then SIGKILL any that ignored it — a stray
-    // daemon that hung its shutdown is exactly the failure mode this exists for.
-    const deadline = Date.now() + 2_000;
-    while (Date.now() < deadline) {
-        if (!strays.some((pid) => isPidAlive(pid)))
-            break;
-        execFileSync('sleep', ['0.1']);
-    }
-    for (const pid of strays) {
-        if (isPidAlive(pid)) {
-            try {
-                process.kill(pid, 'SIGKILL');
-            }
-            catch { /* already gone */ }
-        }
-    }
-    return strays;
-}
-// daemon launch — low-level spawn/exec
-/** Replace PID 1 with the selected daemon generation. Docker keeps a container
- *  alive only while PID 1 lives, so a handover there must preserve its pid. */
-export async function execDaemon() {
-    const execve = process.execve;
-    if (execve === undefined) {
-        throw new Error(`this Node.js ${process.version} runtime cannot replace PID 1 with the successor daemon`);
-    }
-    const executable = hostExecPath();
-    const launchArgs = await resolveDaemonLaunch();
-    return execve(executable, [executable, ...launchArgs, '--canvas-home', crtrHome()], sanitizedDaemonEnv());
-}
-// Shutdown stays short even though startup may include corpus migration.
-const DAEMON_SHUTDOWN_WINDOW_MS = 20_000;
-const DAEMON_VERIFY_POLL_MS = 10;
-/** A status/start readiness probe must not hang behind a daemon that accepts a
- * Unix connection but never answers it. */
-const DAEMON_HEALTH_PROBE_TIMEOUT_MS = 1_000;
-/** Make one `/healthz` observation without client-side recovery. The caller owns the availability window, so this probe cannot extend it. */
-export async function probeDaemonHealth(timeoutMs = DAEMON_HEALTH_PROBE_TIMEOUT_MS) {
-    const probeTimeoutMs = Math.min(timeoutMs, DAEMON_HEALTH_PROBE_TIMEOUT_MS);
-    return CrtrClient.forLocalSocket({ autostart: false, timeoutMs: probeTimeoutMs }).probeHealthz(probeTimeoutMs);
-}
-/** True only when one mandatory Unix API socket probe answers the existing ready health contract. */
-export async function probeDaemonServing(timeoutMs = DAEMON_HEALTH_PROBE_TIMEOUT_MS) {
-    const health = await probeDaemonHealth(timeoutMs);
-    if (health.startup_blocked !== undefined) {
-        const pid = readPidfile() ?? process.pid;
-        throw new DaemonStartupBlockedError(pid, health.startup_blocked);
-    }
-    if (!health.ok)
-        throw new Error('crtrd health check reported not ready');
-}
-/** True only when one mandatory Unix API socket probe answers `/healthz`.
- * A pidfile identifies an owner; it is never readiness. */
-export async function isDaemonServing() {
-    try {
-        await probeDaemonServing();
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function sleepMs(ms) {
-    return new Promise((resolve) => {
-        setTimeout(resolve, ms);
-    });
-}
-/** A live daemon has bound its repair socket but cannot serve normal work
- *  until its corpus migration succeeds. */
-export class DaemonStartupBlockedError extends Error {
-    constructor(pid, message) {
-        super(`daemon ${pid} is running but normal startup is blocked: ${message}`);
-        this.name = 'DaemonStartupBlockedError';
-    }
-}
-/** A preparation request cannot succeed unless the live daemon explicitly reports prepared. */
-export class DaemonNotPreparedError extends Error {
-    constructor(pid, startupPhase) {
-        super(startupPhase === undefined
-            ? `daemon ${pid} is serving but did not report the prepared startup phase`
-            : `daemon ${pid} reported startup phase ${startupPhase}, not prepared`);
-        this.name = 'DaemonNotPreparedError';
-    }
-}
-/** Tiny bounded post-spawn guard: wait for the daemon pidfile and live pid to
- *  appear before reporting success. This catches the "started:true but not yet
- *  plausibly alive" race without turning startup into a retry loop.
- *
- *  One deadline, owner-first polling. A signal or non-zero child exit fails
- *  immediately. A clean code-0 exit is treated only as a possible ownership-
- *  claim loser (never readiness on its own): polling continues on the SAME
- *  deadline for a different live pidfile owner — the winner may publish its
- *  pidfile deliberately late — and fails at that deadline if none appears. No
- *  deadline extension and no retry spawn.
- *
- *  Returns null when the spawned pid owns the pidfile; returns a different live
- *  daemon pid when startup lost the race to an already-running daemon. */
-export async function verifyDaemonStartup(pid, timeoutMs = DAEMON_STARTUP_WINDOW_MS, deps = {}, targetPhase = 'ready') {
-    const read = deps.readPidfile ?? readPidfile;
-    const alive = deps.isPidAlive ?? isPidAlive;
-    const exited = deps.childExited;
-    const serving = deps.isDaemonServing;
-    const probeServing = deps.probeDaemonServing ?? (async (remainingMs) => {
-        if (serving !== undefined) {
-            if (await serving())
-                return;
-            throw new Error('crtrd health check reported not ready');
-        }
-        await probeDaemonServing(remainingMs);
-    });
-    const probeHealth = deps.probeDaemonHealth ?? probeDaemonHealth;
-    const sleep = deps.sleepMs ?? sleepMs;
-    const now = deps.now ?? Date.now;
-    let owner = null;
-    let terminalError = null;
-    await waitForDaemonAvailability({
-        windowMs: timeoutMs,
-        pollIntervalMs: DAEMON_VERIFY_POLL_MS,
-        now,
-        sleep,
-        retry: (error) => error !== terminalError,
-        probe: async (remainingMs) => {
-            const candidate = read();
-            if (candidate === null || !alive(candidate)) {
-                const exitState = exited?.();
-                if (exitState !== null && exitState !== undefined) {
-                    if (exitState.signal !== null)
-                        terminalError = new Error(`daemon ${pid} exited before becoming ready (by ${exitState.signal})`);
-                    else if (exitState.code !== 0)
-                        terminalError = new Error(`daemon ${pid} exited before becoming ready (with exit code ${exitState.code ?? '?'})`);
-                    if (terminalError !== null)
-                        throw terminalError;
-                }
-                throw new Error(`daemon ${pid} has no live pidfile owner`);
-            }
-            if (targetPhase === 'ready') {
-                try {
-                    await probeServing(remainingMs);
-                }
-                catch (error) {
-                    if (error instanceof DaemonStartupBlockedError)
-                        terminalError = error;
-                    throw error;
-                }
-                owner = candidate;
-                return;
-            }
-            const health = await probeHealth(remainingMs);
-            if (health.startup_phase === 'prepared') {
-                owner = candidate;
-                return;
-            }
-            if (health.startup_phase === 'blocked') {
-                terminalError = new DaemonStartupBlockedError(candidate, health.startup_blocked ?? 'on-disk migration is blocked');
-                throw terminalError;
-            }
-            if (health.startup_phase === 'ready') {
-                terminalError = new DaemonNotPreparedError(candidate, health.startup_phase);
-                throw terminalError;
-            }
-            throw new Error(`daemon ${candidate} is ${health.startup_phase ?? 'not reporting a startup phase'}; waiting for prepared`);
-        },
-    });
-    return owner === pid ? null : owner;
-}
-/** Wait until a signaled daemon has exited and relinquished its pidfile. This
- *  makes a following start safe to claim the singleton rather than racing its
- *  previous owner. */
-export async function waitForDaemonExit(pid, timeoutMs = DAEMON_SHUTDOWN_WINDOW_MS, deps = {}) {
-    const read = deps.readPidfile ?? readPidfile;
-    const alive = deps.isPidAlive ?? isPidAlive;
-    const sleep = deps.sleepMs ?? sleepMs;
-    const now = deps.now ?? Date.now;
-    const deadline = now() + timeoutMs;
-    while (now() <= deadline) {
-        if (!alive(pid) && read() !== pid)
-            return;
-        await sleep(DAEMON_VERIFY_POLL_MS);
-    }
-    throw new Error(`daemon ${pid} did not exit and release its pidfile within ${timeoutMs}ms`);
-}
-/** How long a SIGKILL'd daemon gets to actually leave the process table before
- *  `stopDaemonProcess` gives up. A killed process is reaped by the kernel, so
- *  this only absorbs scheduling latency (or an uninterruptible wait). */
-const DAEMON_KILL_WINDOW_MS = 2_000;
-/** How long a failed-to-start daemon gets to go down before the reap gives up.
- *  Short on purpose: nothing is waiting on this process any more. */
-const DAEMON_REAP_WINDOW_MS = 5_000;
-/** Stop the RECORDED daemon: SIGTERM, and if it does not exit within the wait
- *  window, escalate to SIGKILL exactly as `sweepStrayDaemons` does for a stray.
- *
- *  The escalation is the point. Without it — SIGTERM, wait, throw on timeout,
- *  never reaching the stray sweep — the one daemon `stop` is actually aimed at
- *  would be the only crtrd process exempt from the SIGKILL backstop, and a
- *  daemon whose shutdown hangs (or outruns the window) becomes permanently
- *  unstoppable from the CLI: every retry re-sends a SIGTERM it is already
- *  ignoring, and `start` keeps refusing as "already running".
- *
- *  A SIGKILL'd daemon runs no exit handler, so it leaves its pidfile behind
- *  pointing at a dead pid. That is a stale record, not an owner: `readPidfile`
- *  callers gate on `isPidAlive`, and the next `start` overwrites it. So this
- *  waits on process death alone after a kill, never on pidfile release.
- *
- *  Returns how the daemon went down, for a truthful report. */
-export async function stopDaemonProcess(pid, timeoutMs = DAEMON_SHUTDOWN_WINDOW_MS, deps = {}) {
-    const alive = deps.isPidAlive ?? isPidAlive;
-    const sleep = deps.sleepMs ?? sleepMs;
-    const now = deps.now ?? Date.now;
-    try {
-        process.kill(pid, 'SIGTERM');
-    }
-    catch { /* already gone */ }
-    try {
-        await waitForDaemonExit(pid, timeoutMs, deps);
-        return 'terminated';
-    }
-    catch {
-        // Ignored or hung SIGTERM — the exact failure the stray sweep already kills for.
-    }
-    try {
-        process.kill(pid, 'SIGKILL');
-    }
-    catch { /* already gone */ }
-    const deadline = now() + DAEMON_KILL_WINDOW_MS;
-    while (now() <= deadline) {
-        if (!alive(pid))
-            return 'killed';
-        await sleep(DAEMON_VERIFY_POLL_MS);
-    }
-    throw new Error(`daemon ${pid} survived both SIGTERM and SIGKILL`);
-}
-/** Spawn crtrd detached. Returns immediately; the child outlives this process.
- *
- *  If the daemon is already running, returns {started:false, existing_pid}.
- *  If spawning fails (e.g. missing dist — run `npm run build` first), throws. */
-export async function spawnDaemon(opts = {}) {
-    const targetPhase = opts.targetPhase ?? 'ready';
-    const recordedPid = readPidfile();
-    if (recordedPid !== null && isPidAlive(recordedPid)) {
-        try {
-            const health = await probeDaemonHealth();
-            if (targetPhase === 'prepared') {
-                if (health.startup_phase === 'prepared') {
-                    return { started: false, existing_pid: recordedPid, startup_phase: health.startup_phase };
-                }
-                throw new DaemonNotPreparedError(recordedPid, health.startup_phase);
-            }
-            if (health.ok) {
-                return {
-                    started: false,
-                    existing_pid: recordedPid,
-                    ...(health.startup_phase === undefined ? {} : { startup_phase: health.startup_phase }),
-                };
-            }
-            return {
-                started: false,
-                existing_pid: recordedPid,
-                running: true,
-                serving: false,
-                probe_error: health.startup_blocked ?? 'crtrd health check reported not ready',
-                ...(health.startup_phase === undefined ? {} : { startup_phase: health.startup_phase }),
-            };
-        }
-        catch (error) {
-            if (error instanceof DaemonNotPreparedError)
-                throw error;
-            return {
-                started: false,
-                existing_pid: recordedPid,
-                running: true,
-                serving: false,
-                probe_error: error.message,
-            };
-        }
-    }
-    // Ensure the canvas home directory exists so the daemon can write its pidfile.
-    mkdirSync(crtrHome(), { recursive: true });
-    // Launch from the crouter-branded host binary so the daemon shows "crouter"
-    // in macOS Full Disk Access, not "node" (see branded-host). NOTE: when crtrd
-    // is launchd-owned, the plist's ProgramArguments must point at the branded
-    // binary too — this path only covers a manual `crtr sys daemon start`.
-    const launchArgs = await resolveDaemonLaunch();
-    // Route stdout+stderr to an append-mode file instead of discarding them
-    // (stdio:'ignore'). This fd is RAW RESIDUE only — third-party/runtime
-    // output the daemon doesn't control, plus the narrow set of authorized raw
-    // `[crtrd] …` bootstrap/fatal lines that by construction predate or escape
-    // canonical event emission (the pre-bind losing-claim line and a cleanup-
-    // fatal write in crtrd.ts). Without this fd all of it is discarded for any
-    // manually-started daemon, the common case (only a launchd-owned daemon has a
-    // logging plist). Every other daemon diagnostic — including per-node
-    // supervise/relaunch failures — is a canonical `emitEvent` write, not raw
-    // stderr; this file is not where those live. Mirrors host.ts's broker.log
-    // pattern: one fd, both streams, append so a restart keeps history.
-    const errLogPath = join(crtrHome(), 'crtrd.err');
-    const errFd = openSync(errLogPath, 'a');
-    if (eventSource() === undefined)
-        bindDaemonEventSource();
-    // `--canvas-home` declares this daemon's canvas ownership in argv so
-    // findDaemonPids()/sweepStrayDaemons (above) can match its own daemon
-    // exactly instead of scanning the whole machine. crtrd-cli.ts's argv
-    // parsing only looks for `--tcp`, so this extra pair of tokens is inert
-    // there — it exists purely for `ps` visibility.
-    const child = spawn(hostExecPath(), [...launchArgs, '--canvas-home', crtrHome(), ...(targetPhase === 'prepared' ? ['--prepare'] : [])], {
-        detached: true,
-        stdio: ['ignore', errFd, errFd],
-        env: sanitizedDaemonEnv(),
-    });
-    // The child holds its own dup of the fd; release the parent's copy so the
-    // launching process never leaks it.
-    closeSync(errFd);
-    const pid = child.pid;
-    if (pid === undefined) {
-        throw new Error('daemon spawn did not return a pid');
-    }
-    let exitState = null;
-    child.once('exit', (code, signal) => {
-        exitState = { code, signal };
-    });
-    child.unref();
-    // Reap on failure. verifyDaemonStartup gives up at its deadline but the child
-    // it was watching is still running — and a daemon that failed to become ready
-    // is typically parked deep in startup (blocked on the migration lock, whose
-    // own window is DAEMON_STARTUP_WINDOW_MS), so it lingers long after the
-    // spawner walked away. Leaving it is what let repeated autostarts ACCUMULATE
-    // instead of merely repeating: each attempt added a resident process that
-    // outlived the attempt, and the machine went down under the pile rather than
-    // under any single failure.
-    let existingPid;
-    try {
-        existingPid = await verifyDaemonStartup(pid, DAEMON_STARTUP_WINDOW_MS, {
-            childExited: () => exitState,
-        }, targetPhase);
-    }
-    catch (error) {
-        // Reap ONLY a child that is not doing the work. A child holding the on-disk
-        // migration lock is mid-corpus-rewrite: the reap escalates to SIGKILL, and
-        // killing a migration partway through is far worse than the resident
-        // process the reap exists to avoid. Startup verification giving up is a
-        // statement about our patience, not proof the child is stuck — a large
-        // corpus can legitimately outlast the window, and that daemon should be
-        // allowed to finish and serve.
-        const childOwnsMigrationLock = exclusiveLockOwnerPid(onDiskMigrationLockPath()) === pid;
-        if (exitState === null && !childOwnsMigrationLock && !(error instanceof DaemonStartupBlockedError)) {
-            try {
-                await stopDaemonProcess(pid, DAEMON_REAP_WINDOW_MS);
-            }
-            catch { /* best effort */ }
-        }
-        throw error;
-    }
-    if (existingPid !== null) {
-        return { started: false, existing_pid: existingPid, startup_phase: targetPhase };
-    }
-    return { started: true, pid, startup_phase: targetPhase };
-}
-// ensureDaemon — fire-and-forget front-door helper
-/** Whether autostart is suppressed for this invocation. `--no-autostart` or
- *  `CRTR_NO_DAEMON_AUTOSTART=1` forces fail-loud on a cold socket (spec §7.1) —
- *  for environments that manage crtrd externally and want the diagnostic, and
- *  for test lanes, which point `CRTR_HOME` at a throwaway directory: an
- *  autostarted daemon there is detached and resident, so it outlives both the
- *  test process and the deleted temp home with nothing left to stop it.
- *
- *  This is the ONE gate. `ensureDaemon` below is the only path that spawns a
- *  daemon implicitly, so the check belongs here rather than at each caller —
- *  `cliClient()` reads it too, but the in-process spawn/recycle/promote callers
- *  reach `ensureDaemon` without going through the CLI client at all. An
- *  explicit `crtr sys daemon start` calls `spawnDaemon` directly and is
- *  deliberately unaffected. */
-export function autostartDisabled() {
-    return envNoDaemonAutostart() || process.argv.includes('--no-autostart');
-}
-// Autostart rate limiting. `ensureDaemon` is the one implicit spawn path and is
-// reached on every cold socket — including each redial of a long-lived attach
-// client. Unguarded that is an open loop: a daemon that cannot start is retried
-// forever, by every client, with nothing tracking that the last attempt failed
-// for a reason the next one will hit too.
-const AUTOSTART_BACKOFF_BASE_MS = 5_000;
-const AUTOSTART_BACKOFF_MAX_MS = 60_000;
-let autostartInFlight = false;
-let autostartFailures = 0;
-let autostartNextAttemptAt = 0;
-function autostartBackoffMs(failures) {
-    return Math.min(AUTOSTART_BACKOFF_BASE_MS * 2 ** (failures - 1), AUTOSTART_BACKOFF_MAX_MS);
-}
-/** Reset in-process spawn backoff after a daemon is observed alive. */
-export function resetDaemonAutostart() {
-    autostartFailures = 0;
-    autostartNextAttemptAt = 0;
-}
-/** Start the daemon if it is not already running. No-op if already up, if
- *  autostart is suppressed for this invocation, while an attempt is in flight,
- *  or while backing off from a recent failure.
- *  Silently swallows spawn errors (the canvas still works without the daemon;
- *  nodes just won't be auto-revived). */
-export function ensureDaemon(deps = {}) {
-    const running = deps.isDaemonRunning ?? isDaemonRunning;
-    const spawn = deps.spawnDaemon ?? spawnDaemon;
-    const now = deps.now ?? Date.now;
-    if (autostartDisabled())
-        return;
-    if (autostartInFlight)
-        return;
-    if (now() < autostartNextAttemptAt)
-        return;
-    if (running()) {
-        resetDaemonAutostart();
-        return;
-    }
-    autostartInFlight = true;
-    void spawn().then(() => {
-        autostartFailures = 0;
-        autostartNextAttemptAt = 0;
-    }, (error) => {
-        // Intentionally silent — a missing dist/daemon/crtrd-cli.js (dev mode,
-        // pre-build) must not break the calling command.
-        autostartFailures += 1;
-        autostartNextAttemptAt = now() + autostartBackoffMs(autostartFailures);
-    }).finally(() => {
-        autostartInFlight = false;
-    });
-}
+var H=Object.defineProperty;var o=(e,t)=>H(e,"name",{value:t,configurable:!0});import{spawn as B,execFileSync as k}from"node:child_process";import{createRequire as K}from"node:module";import{dirname as T,join as h}from"node:path";import{fileURLToPath as G,pathToFileURL as b}from"node:url";import{existsSync as j,lstatSync as Y,mkdirSync as X,openSync as z,closeSync as V}from"node:fs";import{crtrHome as x}from"../core/canvas/paths.js";import{bindDaemonEventSource as q,eventSource as J}from"../core/events/source.js";import{hostExecPath as L}from"../core/runtime/branded-host.js";import{isDaemonRunning as Q,readPidfile as y,isPidAlive as w}from"./pidfile.js";import{DAEMON_STARTUP_WINDOW_MS as C}from"./startup-policy.js";import{exclusiveLockOwnerPid as Z}from"../core/exclusive-lock.js";import{onDiskMigrationLockPath as ee}from"../core/canvas/paths.js";import{envNoDaemonAutostart as te}from"../shared/env.js";import{CrtrClient as re,waitForDaemonAvailability as ne}from"../api/index.js";const oe=["CRTR_NODE_ID","CRTR_KIND","CRTR_MODE","CRTR_LIFECYCLE","CRTR_NODE_CWD","CRTR_CONTEXT_DIR","CRTR_CYCLES","CRTR_PROFILE_ID","CRTR_PARENT_NODE_ID","CRTR_FRONT_DOOR","TMUX","TMUX_PANE","CRTR_BROKER_ENGINE","CRTR_PI_BINARY","NODE_OPTIONS"];function $(){const e={...process.env};for(const t of oe)delete e[t];return e}o($,"sanitizedDaemonEnv");function ae(){for(let e=T(G(import.meta.url));;e=T(e)){if(j(h(e,"bin","runtime-generation-manifest.mjs")))return e;if(T(e)===e)throw new Error(`cannot locate the crouter generation root from ${import.meta.url}`)}}o(ae,"generationRoot");async function F(){const e=ae(),t=b(h(e,"bin","runtime-generation-manifest.mjs")).href,{runtimeHome:r}=await import(t);try{Y(h(r(),"selected"))}catch(s){if(s.code!=="ENOENT")throw s;return["--conditions","crtr-src","--import",b(K(import.meta.url).resolve("tsx/esm")).href,h(e,"src","daemon","crtrd-cli.ts")]}const n=b(h(e,"bin","runtime-selector.mjs")).href,{tryResolveRuntime:c}=await import(n),i=c("daemon");if(!i.ok)throw new Error(`cannot resolve the selected runtime generation's daemon entry: ${i.error}`);return[i.runtime.entryPath]}o(F,"resolveDaemonLaunch");function ie(e,t){return e.includes(` --canvas-home ${t} `)||e.endsWith(` --canvas-home ${t}`)}o(ie,"daemonCommandDeclaresCanvasHome");function se(){let e;try{e=k("ps",["-ax","-o","pid=,command="],{encoding:"utf8",timeout:2e3})}catch{return[]}const t=x(),r=[];for(const n of e.split(`
+`)){if(!n.includes("daemon/crtrd")||!ie(n,t))continue;const c=n.trim(),i=c.indexOf(" ");if(i<0)continue;const s=Number.parseInt(c.slice(0,i),10);Number.isInteger(s)&&s!==process.pid&&r.push(s)}return r}o(se,"findDaemonPids");function ke(e){const t=se().filter(n=>n!==e);for(const n of t)try{process.kill(n,"SIGTERM")}catch{}if(t.length===0)return t;const r=Date.now()+2e3;for(;Date.now()<r&&t.some(n=>w(n));)k("sleep",["0.1"]);for(const n of t)if(w(n))try{process.kill(n,"SIGKILL")}catch{}return t}o(ke,"sweepStrayDaemons");async function Le(){const e=process.execve;if(e===void 0)throw new Error(`this Node.js ${process.version} runtime cannot replace PID 1 with the successor daemon`);const t=L(),r=await F();return e(t,[t,...r,"--canvas-home",x()],$())}o(Le,"execDaemon");const U=2e4,O=10,N=1e3;async function M(e=N){const t=Math.min(e,N);return re.forLocalSocket({autostart:!1,timeoutMs:t}).probeHealthz(t)}o(M,"probeDaemonHealth");async function W(e=N){const t=await M(e);if(t.startup_blocked!==void 0){const r=y()??process.pid;throw new g(r,t.startup_blocked)}if(!t.ok)throw new Error("crtrd health check reported not ready")}o(W,"probeDaemonServing");async function Ce(){try{return await W(),!0}catch{return!1}}o(Ce,"isDaemonServing");function I(e){return new Promise(t=>{setTimeout(t,e)})}o(I,"sleepMs");class g extends Error{static{o(this,"DaemonStartupBlockedError")}constructor(t,r){super(`daemon ${t} is running but normal startup is blocked: ${r}`),this.name="DaemonStartupBlockedError"}}class A extends Error{static{o(this,"DaemonNotPreparedError")}constructor(t,r){super(r===void 0?`daemon ${t} is serving but did not report the prepared startup phase`:`daemon ${t} reported startup phase ${r}, not prepared`),this.name="DaemonNotPreparedError"}}async function ce(e,t=C,r={},n="ready"){const c=r.readPidfile??y,i=r.isPidAlive??w,s=r.childExited,u=r.isDaemonServing,_=r.probeDaemonServing??(async f=>{if(u!==void 0){if(await u())return;throw new Error("crtrd health check reported not ready")}await W(f)}),D=r.probeDaemonHealth??M,a=r.sleepMs??I,E=r.now??Date.now;let R=null,l=null;return await ne({windowMs:t,pollIntervalMs:O,now:E,sleep:a,retry:o(f=>f!==l,"retry"),probe:o(async f=>{const d=c();if(d===null||!i(d)){const p=s?.();throw p!=null&&(p.signal!==null?l=new Error(`daemon ${e} exited before becoming ready (by ${p.signal})`):p.code!==0&&(l=new Error(`daemon ${e} exited before becoming ready (with exit code ${p.code??"?"})`)),l!==null)?l:new Error(`daemon ${e} has no live pidfile owner`)}if(n==="ready"){try{await _(f)}catch(p){throw p instanceof g&&(l=p),p}R=d;return}const m=await D(f);if(m.startup_phase==="prepared"){R=d;return}throw m.startup_phase==="blocked"?(l=new g(d,m.startup_blocked??"on-disk migration is blocked"),l):m.startup_phase==="ready"?(l=new A(d,m.startup_phase),l):new Error(`daemon ${d} is ${m.startup_phase??"not reporting a startup phase"}; waiting for prepared`)},"probe")}),R===e?null:R}o(ce,"verifyDaemonStartup");async function ue(e,t=U,r={}){const n=r.readPidfile??y,c=r.isPidAlive??w,i=r.sleepMs??I,s=r.now??Date.now,u=s()+t;for(;s()<=u;){if(!c(e)&&n()!==e)return;await i(O)}throw new Error(`daemon ${e} did not exit and release its pidfile within ${t}ms`)}o(ue,"waitForDaemonExit");const le=2e3,pe=5e3;async function de(e,t=U,r={}){const n=r.isPidAlive??w,c=r.sleepMs??I,i=r.now??Date.now;try{process.kill(e,"SIGTERM")}catch{}try{return await ue(e,t,r),"terminated"}catch{}try{process.kill(e,"SIGKILL")}catch{}const s=i()+le;for(;i()<=s;){if(!n(e))return"killed";await c(O)}throw new Error(`daemon ${e} survived both SIGTERM and SIGKILL`)}o(de,"stopDaemonProcess");async function fe(e={}){const t=e.targetPhase??"ready",r=y();if(r!==null&&w(r))try{const a=await M();if(t==="prepared"){if(a.startup_phase==="prepared")return{started:!1,existing_pid:r,startup_phase:a.startup_phase};throw new A(r,a.startup_phase)}return a.ok?{started:!1,existing_pid:r,...a.startup_phase===void 0?{}:{startup_phase:a.startup_phase}}:{started:!1,existing_pid:r,running:!0,serving:!1,probe_error:a.startup_blocked??"crtrd health check reported not ready",...a.startup_phase===void 0?{}:{startup_phase:a.startup_phase}}}catch(a){if(a instanceof A)throw a;return{started:!1,existing_pid:r,running:!0,serving:!1,probe_error:a.message}}X(x(),{recursive:!0});const n=await F(),c=h(x(),"crtrd.err"),i=z(c,"a");J()===void 0&&q();const s=B(L(),[...n,"--canvas-home",x(),...t==="prepared"?["--prepare"]:[]],{detached:!0,stdio:["ignore",i,i],env:$()});V(i);const u=s.pid;if(u===void 0)throw new Error("daemon spawn did not return a pid");let _=null;s.once("exit",(a,E)=>{_={code:a,signal:E}}),s.unref();let D;try{D=await ce(u,C,{childExited:o(()=>_,"childExited")},t)}catch(a){const E=Z(ee())===u;if(_===null&&!E&&!(a instanceof g))try{await de(u,pe)}catch{}throw a}return D!==null?{started:!1,existing_pid:D,startup_phase:t}:{started:!0,pid:u,startup_phase:t}}o(fe,"spawnDaemon");function me(){return te()||process.argv.includes("--no-autostart")}o(me,"autostartDisabled");const he=5e3,we=6e4;let P=!1,v=0,S=0;function _e(e){return Math.min(he*2**(e-1),we)}o(_e,"autostartBackoffMs");function De(){v=0,S=0}o(De,"resetDaemonAutostart");function $e(e={}){const t=e.isDaemonRunning??Q,r=e.spawnDaemon??fe,n=e.now??Date.now;if(!me()&&!P&&!(n()<S)){if(t()){De();return}P=!0,r().then(()=>{v=0,S=0},c=>{v+=1,S=n()+_e(v)}).finally(()=>{P=!1})}}o($e,"ensureDaemon");export{oe as DAEMON_ENV_STRIP_KEYS,A as DaemonNotPreparedError,g as DaemonStartupBlockedError,me as autostartDisabled,ie as daemonCommandDeclaresCanvasHome,$e as ensureDaemon,Le as execDaemon,se as findDaemonPids,Ce as isDaemonServing,M as probeDaemonHealth,W as probeDaemonServing,De as resetDaemonAutostart,$ as sanitizedDaemonEnv,fe as spawnDaemon,de as stopDaemonProcess,ke as sweepStrayDaemons,ce as verifyDaemonStartup,ue as waitForDaemonExit};