@open-bus/cli 0.43.0 → 0.43.2

package/dist/index.js

@@ -22214,6 +22214,21 @@ import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
+function readSessionFile(dir, pid) {
+  let text3;
+  try {
+    text3 = readFileSync(join(dir, `${pid}.json`), "utf8");
+  } catch (e) {
+    return e.code === "ENOENT" ? { state: "none" } : { state: "unreadable" };
+  }
+  try {
+    const rec = JSON.parse(text3);
+    if (typeof rec?.sessionId === "string")
+      return { state: "ok", rec };
+  } catch {
+  }
+  return { state: "unreadable" };
+}
 function peerTokenFor(pid, socketPath2, dir, procStart, hash2 = sha256) {
   try {
     const key = JSON.parse(
@@ -22226,15 +22241,10 @@ function peerTokenFor(pid, socketPath2, dir, procStart, hash2 = sha256) {
 }
 function findSession(pid, deps) {
   for (const anc of deps.ancestors(pid)) {
-    let rec;
-    try {
-      rec = JSON.parse(
-        readFileSync(join(deps.sessionsDir, `${anc}.json`), "utf8")
-      );
-    } catch {
-      continue;
-    }
-    if (typeof rec?.sessionId !== "string") continue;
+    const file2 = readSessionFile(deps.sessionsDir, anc);
+    if (file2.state === "none") continue;
+    if (file2.state === "unreadable") return null;
+    const { rec } = file2;
     if (notASession(rec)) return null;
     if (typeof rec.procStart !== "string") return null;
     const start = deps.procStart(anc);
@@ -24779,7 +24789,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes3, createHash: createHash4 } = __require("crypto");
+    var { randomBytes: randomBytes3, createHash: createHash5 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -25460,7 +25470,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash4("sha1").update(key + GUID).digest("base64");
+        const digest = createHash5("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -25829,7 +25839,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash4 } = __require("crypto");
+    var { createHash: createHash5 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -26136,7 +26146,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash4("sha1").update(key + GUID).digest("base64");
+        const digest = createHash5("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -29746,11 +29756,11 @@ var require_codegen = __commonJS({
         const rhs = this.rhs === void 0 ? "" : ` = ${this.rhs}`;
         return `${varKind} ${this.name}${rhs};` + _n;
       }
-      optimizeNames(names2, constants) {
+      optimizeNames(names2, constants2) {
         if (!names2[this.name.str])
           return;
         if (this.rhs)
-          this.rhs = optimizeExpr(this.rhs, names2, constants);
+          this.rhs = optimizeExpr(this.rhs, names2, constants2);
         return this;
       }
       get names() {
@@ -29767,10 +29777,10 @@ var require_codegen = __commonJS({
       render({ _n }) {
         return `${this.lhs} = ${this.rhs};` + _n;
       }
-      optimizeNames(names2, constants) {
+      optimizeNames(names2, constants2) {
         if (this.lhs instanceof code_1.Name && !names2[this.lhs.str] && !this.sideEffects)
           return;
-        this.rhs = optimizeExpr(this.rhs, names2, constants);
+        this.rhs = optimizeExpr(this.rhs, names2, constants2);
         return this;
       }
       get names() {
@@ -29831,8 +29841,8 @@ var require_codegen = __commonJS({
       optimizeNodes() {
         return `${this.code}` ? this : void 0;
       }
-      optimizeNames(names2, constants) {
-        this.code = optimizeExpr(this.code, names2, constants);
+      optimizeNames(names2, constants2) {
+        this.code = optimizeExpr(this.code, names2, constants2);
         return this;
       }
       get names() {
@@ -29861,12 +29871,12 @@ var require_codegen = __commonJS({
         }
         return nodes.length > 0 ? this : void 0;
       }
-      optimizeNames(names2, constants) {
+      optimizeNames(names2, constants2) {
         const { nodes } = this;
         let i = nodes.length;
         while (i--) {
           const n = nodes[i];
-          if (n.optimizeNames(names2, constants))
+          if (n.optimizeNames(names2, constants2))
             continue;
           subtractNames(names2, n.names);
           nodes.splice(i, 1);
@@ -29919,12 +29929,12 @@ var require_codegen = __commonJS({
           return void 0;
         return this;
       }
-      optimizeNames(names2, constants) {
+      optimizeNames(names2, constants2) {
         var _a3;
-        this.else = (_a3 = this.else) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names2, constants);
-        if (!(super.optimizeNames(names2, constants) || this.else))
+        this.else = (_a3 = this.else) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names2, constants2);
+        if (!(super.optimizeNames(names2, constants2) || this.else))
           return;
-        this.condition = optimizeExpr(this.condition, names2, constants);
+        this.condition = optimizeExpr(this.condition, names2, constants2);
         return this;
       }
       get names() {
@@ -29947,10 +29957,10 @@ var require_codegen = __commonJS({
       render(opts) {
         return `for(${this.iteration})` + super.render(opts);
       }
-      optimizeNames(names2, constants) {
-        if (!super.optimizeNames(names2, constants))
+      optimizeNames(names2, constants2) {
+        if (!super.optimizeNames(names2, constants2))
           return;
-        this.iteration = optimizeExpr(this.iteration, names2, constants);
+        this.iteration = optimizeExpr(this.iteration, names2, constants2);
         return this;
       }
       get names() {
@@ -29986,10 +29996,10 @@ var require_codegen = __commonJS({
       render(opts) {
         return `for(${this.varKind} ${this.name} ${this.loop} ${this.iterable})` + super.render(opts);
       }
-      optimizeNames(names2, constants) {
-        if (!super.optimizeNames(names2, constants))
+      optimizeNames(names2, constants2) {
+        if (!super.optimizeNames(names2, constants2))
           return;
-        this.iterable = optimizeExpr(this.iterable, names2, constants);
+        this.iterable = optimizeExpr(this.iterable, names2, constants2);
         return this;
       }
       get names() {
@@ -30031,11 +30041,11 @@ var require_codegen = __commonJS({
         (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNodes();
         return this;
       }
-      optimizeNames(names2, constants) {
+      optimizeNames(names2, constants2) {
         var _a3, _b;
-        super.optimizeNames(names2, constants);
-        (_a3 = this.catch) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names2, constants);
-        (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNames(names2, constants);
+        super.optimizeNames(names2, constants2);
+        (_a3 = this.catch) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names2, constants2);
+        (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNames(names2, constants2);
         return this;
       }
       get names() {
@@ -30336,7 +30346,7 @@ var require_codegen = __commonJS({
     function addExprNames(names2, from) {
       return from instanceof code_1._CodeOrName ? addNames(names2, from.names) : names2;
     }
-    function optimizeExpr(expr, names2, constants) {
+    function optimizeExpr(expr, names2, constants2) {
       if (expr instanceof code_1.Name)
         return replaceName(expr);
       if (!canOptimize(expr))
@@ -30351,14 +30361,14 @@ var require_codegen = __commonJS({
         return items;
       }, []));
       function replaceName(n) {
-        const c = constants[n.str];
+        const c = constants2[n.str];
         if (c === void 0 || names2[n.str] !== 1)
           return n;
         delete names2[n.str];
         return c;
       }
       function canOptimize(e) {
-        return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names2[c.str] === 1 && constants[c.str] !== void 0);
+        return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names2[c.str] === 1 && constants2[c.str] !== void 0);
       }
     }
     function subtractNames(names2, from) {
@@ -37537,8 +37547,8 @@ import { join as join11 } from "node:path";
 
 // ../daemon/src/index.ts
 init_src2();
-import { lstatSync as lstatSync3, writeFileSync as writeFileSync3 } from "node:fs";
-import { basename as basename4, isAbsolute as isAbsolute2, join as join9 } from "node:path";
+import { lstatSync as lstatSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { basename as basename4, isAbsolute as isAbsolute2, join as join8 } from "node:path";
 
 // ../adapters/opencode/src/version.ts
 var MIN_PROMPT_ID_VERSION = "2.0.0";
@@ -37609,8 +37619,7 @@ var AgentTable = class {
 // ../daemon/src/attest.ts
 init_src2();
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { readFileSync as readFileSync5 } from "node:fs";
-import { basename as basename2, isAbsolute, join as join6 } from "node:path";
+import { basename as basename2, isAbsolute } from "node:path";
 
 // ../daemon/src/liveness/claude.ts
 init_src2();
@@ -37704,6 +37713,7 @@ import { join as join5 } from "node:path";
 // ../daemon/src/config.ts
 init_src2();
 init_dist();
+import { createHash as createHash3 } from "node:crypto";
 import {
   chmodSync as chmodSync2,
   existsSync,
@@ -37787,12 +37797,29 @@ function originOf(url2) {
   }
 }
 var cleanLabel = (raw) => typeof raw === "string" ? newMachineLabel(raw) : "machine";
+var tokenHash = (token) => createHash3("sha256").update(token).digest("hex");
+var revokedMarker = (token, at = /* @__PURE__ */ new Date()) => `${JSON.stringify({ at: at.toISOString(), token_sha256: tokenHash(token) })}
+`;
+function revokedFor(token, h = home()) {
+  const file2 = join4(h, "revoked");
+  if (!existsSync(file2)) return false;
+  try {
+    const m = JSON.parse(readFileSync3(file2, "utf8"));
+    if (typeof m.token_sha256 === "string")
+      return m.token_sha256 === tokenHash(token);
+  } catch {
+  }
+  return true;
+}
+function savedToken(h = home()) {
+  try {
+    const r = JSON.parse(readFileSync3(join4(h, "machine.json"), "utf8"));
+    return typeof r.machine_token === "string" ? r.machine_token : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function readConfig() {
-  if (existsSync(join4(home(), "revoked")))
-    throw new StartError(
-      "REVOKED",
-      "this machine was revoked; run `npx @open-bus/cli install`"
-    );
   const file2 = join4(home(), "machine.json");
   let text3;
   try {
@@ -37823,9 +37850,15 @@ function readConfig() {
     throw notLoggedIn();
   }
   const r = raw;
-  const hub = process.env.OPENBUS_HUB ?? r.hub;
-  if (!hub || r.machine_token === void 0) throw notLoggedIn();
-  if (r.hub && hub !== r.hub && originOf(hub) !== originOf(r.hub))
+  if (typeof r.hub !== "string" || !r.hub || r.machine_token === void 0)
+    throw notLoggedIn();
+  if (revokedFor(String(r.machine_token)))
+    throw new StartError(
+      "REVOKED",
+      "this machine was revoked; run `npx @open-bus/cli install`"
+    );
+  const hub = process.env.OPENBUS_HUB || r.hub;
+  if (hub !== r.hub && originOf(hub) !== originOf(r.hub))
     throw new StartError(
       "HUB_MISMATCH",
       `the hub ${hub} is not the one this machine was approved for (${r.hub}); run \`npx @open-bus/cli login --hub ${hub}\` to approve it there`
@@ -37905,13 +37938,11 @@ function attest(hello, deps = {}) {
 function attestClaude(hello, deps) {
   const dir = deps.sessionsDir ?? claudeSessionsDir();
   for (const pid of (deps.ancestors ?? ancestorChain)(hello.pid)) {
-    let raw;
-    try {
-      raw = JSON.parse(readFileSync5(join6(dir, `${pid}.json`), "utf8"));
-    } catch {
-      continue;
-    }
-    if (typeof raw?.sessionId !== "string") continue;
+    const file2 = readSessionFile(dir, pid);
+    if (file2.state === "none") continue;
+    if (file2.state === "unreadable")
+      return { ok: false, reason: "session file unreadable; retry" };
+    const raw = file2.rec;
     if (raw.sessionId !== hello.agent_ref || notASession(raw)) {
       return {
         ok: false,
@@ -38374,7 +38405,7 @@ var HubConnection = class {
       res.resume();
       limitedUpgrade = res.statusCode === 429;
       this.lastError = limitedUpgrade ? "rate limited" : `HTTP ${res.statusCode}`;
-      if (res.statusCode === 401 || res.statusCode === 403) {
+      if (res.statusCode === 401) {
         this.#ws = void 0;
         this.#revoke();
       }
@@ -38471,8 +38502,15 @@ function defaultBackoff(attempt) {
 // ../daemon/src/namespace.ts
 init_dist();
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { readFileSync as readFileSync6, realpathSync as realpathSync2, statSync as statSync5 } from "node:fs";
-import { basename as basename3, dirname as dirname3, join as join7, resolve as resolve2 } from "node:path";
+import {
+  closeSync,
+  constants,
+  fstatSync,
+  openSync,
+  readFileSync as readFileSync5,
+  realpathSync as realpathSync2
+} from "node:fs";
+import { basename as basename3, dirname as dirname3, join as join6, resolve as resolve2 } from "node:path";
 var warned = /* @__PURE__ */ new Set();
 function resolveNamespace(start, deps = {}) {
   let cwd;
@@ -38489,10 +38527,15 @@ function resolveNamespace(start, deps = {}) {
   const uid = deps.uid ?? process.getuid?.();
   const configs = [];
   for (let dir = cwd; ; dir = dirname3(dir)) {
-    const file2 = join7(dir, CONFIG_FILE);
+    const file2 = join6(dir, CONFIG_FILE);
     let text3;
+    let fd;
     try {
-      const st = statSync5(file2);
+      fd = openSync(
+        file2,
+        constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0)
+      );
+      const st = fstatSync(fd);
       if (uid !== void 0 && st.uid !== uid || st.mode & 18) {
         if (!warned.has(file2)) {
           warned.add(file2);
@@ -38500,8 +38543,10 @@ function resolveNamespace(start, deps = {}) {
             `ignoring ${file2}: not owned by you or writable by others`
           );
         }
-      } else text3 = readFileSync6(file2, "utf8");
+      } else if (st.isFile()) text3 = readFileSync5(fd, "utf8");
     } catch {
+    } finally {
+      if (fd !== void 0) closeSync(fd);
     }
     if (text3 !== void 0) {
       let parsed;
@@ -38917,7 +38962,7 @@ init_src();
 init_dist();
 import {
   chmodSync as chmodSync3,
-  readFileSync as readFileSync7,
+  readFileSync as readFileSync6,
   renameSync as renameSync2,
   rmSync as rmSync2,
   writeFileSync
@@ -39080,7 +39125,7 @@ var SentStore = class {
     if (!this.file) return;
     let raw;
     try {
-      raw = JSON.parse(readFileSync7(this.file, "utf8"));
+      raw = JSON.parse(readFileSync6(this.file, "utf8"));
     } catch {
       return;
     }
@@ -39318,13 +39363,13 @@ var Receipts = class {
 init_src2();
 init_dist();
 import { randomUUID } from "node:crypto";
-import { chmodSync as chmodSync5, mkdirSync as mkdirSync4, rmSync as rmSync3 } from "node:fs";
+import { chmodSync as chmodSync5, lstatSync as lstatSync3, mkdirSync as mkdirSync4, rmSync as rmSync3 } from "node:fs";
 import { createServer as createServer2 } from "node:net";
-import { join as join8 } from "node:path";
+import { dirname as dirname4, join as join7 } from "node:path";
 import { createInterface } from "node:readline";
 
 // ../daemon/src/transports/held.ts
-import { chmodSync as chmodSync4, readFileSync as readFileSync8, renameSync as renameSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { chmodSync as chmodSync4, readFileSync as readFileSync7, renameSync as renameSync3, writeFileSync as writeFileSync2 } from "node:fs";
 var HeldStore = class {
   constructor(file2, opts = {}) {
     this.file = file2;
@@ -39349,7 +39394,7 @@ var HeldStore = class {
   #read() {
     let raw;
     try {
-      raw = JSON.parse(readFileSync8(this.file, "utf8"));
+      raw = JSON.parse(readFileSync7(this.file, "utf8"));
     } catch {
       return {};
     }
@@ -39378,6 +39423,29 @@ var STATUSES = /* @__PURE__ */ new Set([
   "dropped"
 ]);
 var STOPPED = /* @__PURE__ */ Symbol("stopped");
+function unsafeClaudeSocket(path) {
+  const uid = process.getuid?.();
+  let sock;
+  try {
+    sock = lstatSync3(path);
+  } catch (e) {
+    if (e.code === "ENOENT") return null;
+    return `${path} cannot be checked (${e.code ?? String(e)})`;
+  }
+  try {
+    if (!sock.isSocket()) return `${path} is not a socket`;
+    if (sock.uid !== uid) return `${path} belongs to another user`;
+    const dir = dirname4(path);
+    const st = lstatSync3(dir);
+    if (!st.isDirectory()) return `${dir} is not a folder`;
+    if (st.uid !== uid) return `${dir} belongs to another user`;
+    if (st.mode & 18)
+      return `${dir} is open to other users (mode ${(st.mode & 511).toString(8)})`;
+  } catch (e) {
+    return `${path} cannot be checked (${e.code ?? String(e)})`;
+  }
+  return null;
+}
 var UnsafeDir = class extends Error {
 };
 var NOTICE_FROM = "[openbus]";
@@ -39387,7 +39455,7 @@ var ClaudeTransport = class {
     this.opts = opts;
     this.#held = opts.heldFile ? new HeldStore(opts.heldFile) : void 0;
     this.#injected = opts.heldFile ? new HeldStore(opts.heldFile.replace(/(\.json)?$/, ".injected.json")) : void 0;
-    const sample = join8(opts.socketsDir, "00000000.sock");
+    const sample = join7(opts.socketsDir, "00000000.sock");
     if (Buffer.byteLength(sample) > MAX_SOCKET_PATH) {
       this.#disabled = `claude delivery disabled: return socket paths are too long for a unix socket (${Buffer.byteLength(sample)} > ${MAX_SOCKET_PATH} bytes under ${opts.socketsDir}); use a shorter OPENBUS_HOME`;
       opts.log?.(this.#disabled);
@@ -39402,6 +39470,8 @@ var ClaudeTransport = class {
   /** A status can arrive before the caller starts waiting; keep the latest. */
   #buffered = /* @__PURE__ */ new Map();
   #closed = false;
+  /** Claude sockets already logged as unsafe: each is logged once. */
+  #unsafeLogged = /* @__PURE__ */ new Set();
   #held;
   /** Injected, outcome not yet heard: a restart inside the status window must not inject again. */
   #injected;
@@ -39442,6 +39512,14 @@ var ClaudeTransport = class {
     }
     const target2 = this.opts.target(agent.ref);
     if (!target2) return { ok: false, reason: "closed" };
+    const unsafe = unsafeClaudeSocket(target2.socketPath);
+    if (unsafe) {
+      if (!this.#unsafeLogged.has(target2.socketPath)) {
+        this.#unsafeLogged.add(target2.socketPath);
+        this.opts.log?.(`claude delivery refused: ${unsafe}`);
+      }
+      return { ok: false, reason: "closed", cause: "dropped" };
+    }
     let sink;
     try {
       sink = await this.#sink(agent.ref, mail.namespace, mail.from_name);
@@ -39550,7 +39628,7 @@ var ClaudeTransport = class {
     return sink;
   }
   async #listen(key, agentRef, namespace, peerName, notice = false) {
-    const path = join8(this.opts.socketsDir, `${randomUUID().slice(0, 8)}.sock`);
+    const path = join7(this.opts.socketsDir, `${randomUUID().slice(0, 8)}.sock`);
     if (this.opts.prepareDir) {
       const unsafe = this.opts.prepareDir(this.opts.socketsDir);
       if (unsafe) throw new UnsafeDir(unsafe);
@@ -39946,7 +40024,7 @@ async function runDaemon(deps = {}) {
     log,
     promptIdSupported: () => promptIdSupported,
     uncertain: new HeldStore(
-      oc.uncertainFile ?? join9(home(), "opencode-uncertain.json")
+      oc.uncertainFile ?? join8(home(), "opencode-uncertain.json")
     )
   });
   const pi = new PiTransport({
@@ -39958,7 +40036,7 @@ async function runDaemon(deps = {}) {
     },
     ackTimeoutMs: deps.pi?.ackTimeoutMs
   });
-  const sent = new SentStore(deps.sentFile ?? join9(home(), "sent.json"), {
+  const sent = new SentStore(deps.sentFile ?? join8(home(), "sent.json"), {
     log
   });
   const receipts = new Receipts(sent, { after: deps.deliveredTimer });
@@ -40048,7 +40126,7 @@ async function runDaemon(deps = {}) {
     socketsDir: returnDir,
     // A deps.socketsDir is the caller's (tests); ours is re-checked before each bind.
     prepareDir: cl.socketsDir ? void 0 : (d) => prepareReturnDir(d),
-    heldFile: cl.heldFile ?? join9(home(), "claude-held.json"),
+    heldFile: cl.heldFile ?? join8(home(), "claude-held.json"),
     statusWindowMs: cl.statusWindowMs,
     injectTimeoutMs: cl.injectTimeoutMs,
     log,
@@ -40240,13 +40318,21 @@ async function runDaemon(deps = {}) {
       pending.fail(id, error62, "the hub sent a frame this daemon cannot read");
     },
     onRevoked: () => {
+      const saved = savedToken();
+      if (saved !== void 0 && saved !== cfg.machine_token) {
+        log(
+          "the hub refused the token this daemon started with; machine.json holds a newer one: restarting"
+        );
+        process.exitCode = 1;
+        deps.onRevoked?.(true);
+        return;
+      }
       log("this machine was revoked; run `npx @open-bus/cli install`");
       process.exitCode = 1;
       try {
         writeFileSync3(
-          deps.revokedFile ?? join9(home(), "revoked"),
-          `${JSON.stringify({ at: (/* @__PURE__ */ new Date()).toISOString() })}
-`,
+          deps.revokedFile ?? join8(home(), "revoked"),
+          revokedMarker(cfg.machine_token),
           { mode: 384 }
         );
       } catch (e) {
@@ -40494,11 +40580,11 @@ async function runDaemon(deps = {}) {
       announceSessions();
     }
   }).catch(socketInUse);
-  const bound = lstatSync3(listenPath);
+  const bound = lstatSync4(listenPath);
   const socketWatch = setInterval(() => {
     let now;
     try {
-      now = lstatSync3(listenPath);
+      now = lstatSync4(listenPath);
     } catch {
     }
     if (now?.ino === bound.ino && now.dev === bound.dev) return;
@@ -40559,7 +40645,7 @@ async function runDaemon(deps = {}) {
 init_src2();
 init_src();
 import { execFileSync as execFileSync4, spawn as spawn2 } from "node:child_process";
-import { closeSync, openSync, readFileSync as readFileSync10 } from "node:fs";
+import { closeSync as closeSync2, openSync as openSync2, readFileSync as readFileSync9 } from "node:fs";
 import { homedir as homedir2, userInfo } from "node:os";
 
 // ../ui/src/tokens/terminal.ts
@@ -40711,6 +40797,11 @@ function copy(style) {
     waitingPlain: () => `Waiting for approval (up to 10 minutes)${more}`,
     approved: (label) => done(`Approved as ${clip(label, 15)}`),
     tokenSaved: (path, token) => done(`Token saved to ${path}`, tokenTail(token, more)),
+    // `login` saved a new token; the running daemon keeps the old one.
+    daemonOldToken: (pid) => [
+      warn(`The daemon (pid ${pid}) still uses the old token.`),
+      next("Run npx @open-bus/cli install to restart it with the new one.")
+    ],
     alreadyConnected: (label) => done(`Already connected as ${clip(label, 24)}`),
     configured: (names2) => done(
       `Configured ${listing(
@@ -41099,33 +41190,33 @@ var realDeps = {
 };
 
 // src/steps/service.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import {
   chmodSync as chmodSync7,
   cpSync,
   existsSync as existsSync2,
-  lstatSync as lstatSync4,
+  lstatSync as lstatSync5,
   mkdirSync as mkdirSync6,
   realpathSync as realpathSync3,
   renameSync as renameSync5,
   rmSync as rmSync4,
   writeFileSync as writeFileSync5
 } from "node:fs";
-import { basename as basename5, dirname as dirname5, isAbsolute as isAbsolute3, join as join10, resolve as resolve3 } from "node:path";
+import { basename as basename5, dirname as dirname6, isAbsolute as isAbsolute3, join as join9, resolve as resolve3 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // src/steps/step.ts
 import {
   chmodSync as chmodSync6,
   mkdirSync as mkdirSync5,
-  readFileSync as readFileSync9,
+  readFileSync as readFileSync8,
   renameSync as renameSync4,
   writeFileSync as writeFileSync4
 } from "node:fs";
-import { dirname as dirname4 } from "node:path";
+import { dirname as dirname5 } from "node:path";
 function readInstallFile(path) {
   try {
-    const v = JSON.parse(readFileSync9(path, "utf8"));
+    const v = JSON.parse(readFileSync8(path, "utf8"));
     if (typeof v === "object" && v !== null && !Array.isArray(v))
       return v;
   } catch {
@@ -41134,7 +41225,7 @@ function readInstallFile(path) {
 }
 function updateInstallFile(path, patch) {
   const next = { ...readInstallFile(path), ...patch };
-  mkdirSync5(dirname4(path), { recursive: true, mode: 448 });
+  mkdirSync5(dirname5(path), { recursive: true, mode: 448 });
   const tmp = `${path}.${process.pid}.tmp`;
   writeFileSync4(tmp, `${JSON.stringify(next, null, 2)}
 `, { mode: 384 });
@@ -41235,7 +41326,7 @@ function cliSource() {
     jiti: import.meta.resolve("jiti")
   } : { kind: "bundle", file: here };
 }
-var entryName = (src) => src.kind === "bundle" ? join10(basename5(dirname5(src.file)), basename5(src.file)) : "open-bus.js";
+var entryName = (src) => src.kind === "bundle" ? join9(basename5(dirname6(src.file)), basename5(src.file)) : "open-bus.js";
 var shim = (src) => `// Written by open-bus install: runs the sources it was installed from.
 import { createJiti } from ${JSON.stringify(src.jiti)};
 
@@ -41245,35 +41336,35 @@ const code = await main(process.argv.slice(2));
 if (code !== undefined) process.exit(code);
 `;
 function installCli(home2, src) {
-  const bin = join10(home2, "bin");
+  const bin = join9(home2, "bin");
   const tmp = `${bin}.${process.pid}.tmp`;
   mkdirSync6(home2, { recursive: true, mode: 448 });
   chmodSync7(home2, 448);
   rmSync4(tmp, { recursive: true, force: true });
   mkdirSync6(tmp);
   if (src.kind === "bundle") {
-    const pkg = dirname5(dirname5(src.file));
+    const pkg = dirname6(dirname6(src.file));
     for (const name of ["dist", "assets", "package.json"])
-      if (existsSync2(join10(pkg, name)))
-        cpSync(join10(pkg, name), join10(tmp, name), { recursive: true });
-  } else writeFileSync5(join10(tmp, entryName(src)), shim(src));
+      if (existsSync2(join9(pkg, name)))
+        cpSync(join9(pkg, name), join9(tmp, name), { recursive: true });
+  } else writeFileSync5(join9(tmp, entryName(src)), shim(src));
   chmodSync7(tmp, 448);
-  if (!existsSync2(join10(tmp, "package.json")))
-    writeFileSync5(join10(tmp, "package.json"), '{ "type": "module" }\n');
+  if (!existsSync2(join9(tmp, "package.json")))
+    writeFileSync5(join9(tmp, "package.json"), '{ "type": "module" }\n');
   rmSync4(bin, { recursive: true, force: true });
   renameSync5(tmp, bin);
-  return join10(bin, entryName(src));
+  return join9(bin, entryName(src));
 }
 var present = (path) => {
   try {
-    lstatSync4(path);
+    lstatSync5(path);
     return true;
   } catch {
     return false;
   }
 };
 function writeReplacing(path, text3) {
-  mkdirSync6(dirname5(path), { recursive: true });
+  mkdirSync6(dirname6(path), { recursive: true });
   const tmp = `${path}.${process.pid}.tmp`;
   try {
     writeFileSync5(tmp, text3, { mode: 420 });
@@ -41288,13 +41379,13 @@ var real = (path) => {
   try {
     return realpathSync3(abs);
   } catch {
-    const parent = dirname5(abs);
-    return parent === abs ? abs : join10(real(parent), basename5(abs));
+    const parent = dirname6(abs);
+    return parent === abs ? abs : join9(real(parent), basename5(abs));
   }
 };
-var isDefaultHome = (home2, userHome) => real(home2) === real(join10(userHome, ".openbus"));
+var isDefaultHome = (home2, userHome) => real(home2) === real(join9(userHome, ".openbus"));
 function serviceNames(home2, userHome) {
-  const suffix = isDefaultHome(home2, userHome) ? "" : createHash3("sha256").update(real(home2)).digest("hex").slice(0, 8);
+  const suffix = isDefaultHome(home2, userHome) ? "" : createHash4("sha256").update(real(home2)).digest("hex").slice(0, 8);
   return {
     label: suffix ? `${LAUNCHD_LABEL}.${suffix}` : LAUNCHD_LABEL,
     unit: suffix ? `open-bus-${suffix}.service` : SYSTEMD_UNIT
@@ -41319,16 +41410,16 @@ function systemService(d) {
   const manager = d.platform === "darwin" ? "launchd" : d.platform === "linux" ? "systemd" : void 0;
   const home2 = () => resolve3(d.home());
   const names2 = () => serviceNames(home2(), d.userHome);
-  const entryOf = () => join10(home2(), "bin", entryName(d.source()));
-  const installFile = () => join10(home2(), "install.json");
+  const entryOf = () => join9(home2(), "bin", entryName(d.source()));
+  const installFile = () => join9(home2(), "install.json");
   const record4 = () => {
     const r = readInstallFile(installFile()).service;
     return typeof r === "object" && r !== null ? r : {};
   };
   const xdg = d.env.XDG_CONFIG_HOME;
-  const configHome = xdg && isAbsolute3(xdg) ? xdg : join10(d.userHome, ".config");
+  const configHome = xdg && isAbsolute3(xdg) ? xdg : join9(d.userHome, ".config");
   const fileName = () => manager === "launchd" ? `${names2().label}.plist` : names2().unit;
-  const fresh = () => manager === "launchd" ? join10(d.userHome, "Library/LaunchAgents", fileName()) : join10(configHome, "systemd/user", fileName());
+  const fresh = () => manager === "launchd" ? join9(d.userHome, "Library/LaunchAgents", fileName()) : join9(configHome, "systemd/user", fileName());
   const recorded = () => {
     const r = record4().unit;
     return typeof r === "string" && isAbsolute3(r) && basename5(r) === fileName() ? r : void 0;
@@ -41393,17 +41484,17 @@ function systemService(d) {
     async ensure() {
       const h = home2();
       const src = d.source();
-      const logs2 = join10(h, "logs");
+      const logs2 = join9(h, "logs");
       const u = {
         node: d.execPath,
-        entry: join10(h, "bin", entryName(src)),
+        entry: join9(h, "bin", entryName(src)),
         env: {
           PATH: d.env.PATH ?? DEFAULT_PATH,
           ...isDefaultHome(h, d.userHome) ? {} : { OPENBUS_HOME: h }
         },
         // One file: the daemon logs to stderr, and `open-bus logs` tails it.
-        out: join10(logs2, "daemon.log"),
-        err: join10(logs2, "daemon.log")
+        out: join9(logs2, "daemon.log"),
+        err: join9(logs2, "daemon.log")
       };
       const unit = { ...u, env: { ...u.env, OPENBUS_SERVICE: "1" } };
       renderPlist(unit);
@@ -41474,7 +41565,7 @@ function systemService(d) {
       const node2 = record4().node;
       if (typeof node2 === "string" && !existsSync2(node2))
         out.push({ kind: "node-missing", node: node2 });
-      if (manager === "systemd" && !existsSync2(join10(d.lingerDir ?? "/var/lib/systemd/linger", d.user)))
+      if (manager === "systemd" && !existsSync2(join9(d.lingerDir ?? "/var/lib/systemd/linger", d.user)))
         out.push({ kind: "linger-off" });
       return out;
     }
@@ -41487,8 +41578,8 @@ var noService = {
   remove: async () => ({}),
   cli: () => ["open-bus"]
 };
-var VERSION = true ? "0.43.0" : JSON.parse(
-  readFileSync10(new URL("../package.json", import.meta.url), "utf8")
+var VERSION = true ? "0.43.2" : JSON.parse(
+  readFileSync9(new URL("../package.json", import.meta.url), "utf8")
 ).version;
 var which = (cmd) => {
   try {
@@ -41503,7 +41594,7 @@ function processArgs(pid, io = {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "ignore"]
   }),
-  proc: (path) => readFileSync10(path, "utf8")
+  proc: (path) => readFileSync9(path, "utf8")
 }) {
   try {
     return io.ps(pid).trim() || void 0;
@@ -41516,8 +41607,8 @@ function processArgs(pid, io = {
   }
 }
 var spawnDaemon = (cmd, args, opts) => {
-  const out = openSync(opts.out, "a", 384);
-  const err = openSync(opts.err, "a", 384);
+  const out = openSync2(opts.out, "a", 384);
+  const err = openSync2(opts.err, "a", 384);
   try {
     const child = spawn2(cmd, args, {
       detached: true,
@@ -41527,8 +41618,8 @@ var spawnDaemon = (cmd, args, opts) => {
     child.unref();
     return child.pid;
   } finally {
-    closeSync(out);
-    closeSync(err);
+    closeSync2(out);
+    closeSync2(err);
   }
 };
 var userName = () => {
@@ -41572,7 +41663,7 @@ function realCtx(noColor) {
     uid: process.getuid?.() ?? 0,
     user: userName(),
     source: cliSource,
-    daemonPid: () => ctx.status({ path: daemonSocketPath(ctx.home), timeoutMs: 1e3 }).then(
+    daemonPid: () => askDaemon(ctx, { timeoutMs: 1e3 }).then(
       (st) => st.pid,
       () => void 0
     ),
@@ -41587,6 +41678,17 @@ function realCtx(noColor) {
   });
   return ctx;
 }
+function askDaemon(ctx, opts = {}) {
+  const problem = socketDirProblem(ctx.home);
+  if (problem) return Promise.reject(new Error(problem));
+  return ctx.status({ ...opts, path: daemonSocketPath(ctx.home) });
+}
+function socketFolderLines(ctx) {
+  const dirs = shortDirInUse(ctx.home) ? [shortSocketDir(ctx.home), claudeReturnDir(ctx.home)] : [];
+  const bad = dirs.map((d) => ({ d, why: unsafeSocketDir(d) })).find((x) => x.why);
+  if (!bad) return void 0;
+  return bad.why === NOT_OURS ? ctx.copy.socketFolderNotYours(bad.d) : ctx.copy.socketFolderUnsafe(tilde(ctx, bad.d), bad.why);
+}
 var say = (ctx, ...lines) => {
   for (const l of lines.flat()) ctx.stdout.write(`${l}
 `);
@@ -41597,12 +41699,43 @@ var sayErr = (ctx, ...lines) => {
 };
 var tilde = (ctx, path) => path === ctx.userHome ? "~" : path.startsWith(`${ctx.userHome}/`) ? `~${path.slice(ctx.userHome.length)}` : path;
 
+// src/machine.ts
+import { readFileSync as readFileSync10, statSync as statSync5 } from "node:fs";
+import { join as join10 } from "node:path";
+init_dist();
+function readMachine(home2) {
+  const file2 = join10(home2, "machine.json");
+  let text3;
+  let mode;
+  try {
+    mode = statSync5(file2).mode;
+    text3 = readFileSync10(file2, "utf8");
+  } catch (e) {
+    return e.code === "ENOENT" ? { state: "missing" } : { state: "bad" };
+  }
+  try {
+    const m = JSON.parse(text3);
+    if (typeof m.hub === "string" && typeof m.label === "string" && isMachineToken(m.machine_token))
+      return {
+        state: "ok",
+        hub: m.hub,
+        label: m.label,
+        token: m.machine_token,
+        open: process.platform !== "win32" && (mode & 63) !== 0,
+        revoked: revokedFor(m.machine_token, home2)
+      };
+  } catch {
+  }
+  return { state: "bad" };
+}
+
 // src/commands/daemon.ts
 var lasting = (e) => [...START_ERROR_CODES, "EACCES", "EPERM"].includes(
   e?.code
 );
 async function daemon(ctx, run4 = runDaemon, signals = process) {
-  if (existsSync3(join11(ctx.home, "revoked"))) {
+  const m = readMachine(ctx.home);
+  if (existsSync3(join11(ctx.home, "revoked")) && (m.state !== "ok" || m.revoked)) {
     sayErr(ctx, ctx.copy.revoked());
     return 0;
   }
@@ -41621,7 +41754,8 @@ async function daemon(ctx, run4 = runDaemon, signals = process) {
     signals.once("SIGTERM", onSignal);
     run4({
       version: ctx.version,
-      onRevoked: () => end(REVOKED_EXIT),
+      // Only an older token was revoked: a restart picks up the new one.
+      onRevoked: (replaced) => end(replaced ? 1 : REVOKED_EXIT),
       // Exit non-zero: the service restarts the daemon, which binds again.
       onSocketLost: () => end(1)
     }).then(
@@ -41642,9 +41776,8 @@ async function daemon(ctx, run4 = runDaemon, signals = process) {
 }
 
 // src/commands/doctor.ts
-init_src2();
-import { readFileSync as readFileSync13 } from "node:fs";
-import { join as join16 } from "node:path";
+import { readFileSync as readFileSync12 } from "node:fs";
+import { join as join15 } from "node:path";
 
 // ../adapters/opencode/src/index.ts
 init_session2();
@@ -41654,51 +41787,21 @@ var OPENCODE_TUI_PLUGIN = fileURLToPath2(
   new URL("../assets/opencode-tui/tui.js", import.meta.url)
 );
 
-// src/machine.ts
-init_dist();
-import { existsSync as existsSync4, readFileSync as readFileSync11, statSync as statSync6 } from "node:fs";
-import { join as join12 } from "node:path";
-function readMachine(home2) {
-  const file2 = join12(home2, "machine.json");
-  let text3;
-  let mode;
-  try {
-    mode = statSync6(file2).mode;
-    text3 = readFileSync11(file2, "utf8");
-  } catch (e) {
-    return e.code === "ENOENT" ? { state: "missing" } : { state: "bad" };
-  }
-  try {
-    const m = JSON.parse(text3);
-    if (typeof m.hub === "string" && typeof m.label === "string" && isMachineToken(m.machine_token))
-      return {
-        state: "ok",
-        hub: m.hub,
-        label: m.label,
-        token: m.machine_token,
-        open: process.platform !== "win32" && (mode & 63) !== 0,
-        revoked: existsSync4(join12(home2, "revoked"))
-      };
-  } catch {
-  }
-  return { state: "bad" };
-}
-
 // src/steps/adapters.ts
 import { randomBytes } from "node:crypto";
 import {
   chmodSync as chmodSync8,
-  existsSync as existsSync5,
-  lstatSync as lstatSync5,
+  existsSync as existsSync4,
+  lstatSync as lstatSync6,
   mkdirSync as mkdirSync7,
-  readFileSync as readFileSync12,
+  readFileSync as readFileSync11,
   readlinkSync,
   renameSync as renameSync6,
   rmSync as rmSync5,
-  statSync as statSync7,
+  statSync as statSync6,
   writeFileSync as writeFileSync6
 } from "node:fs";
-import { dirname as dirname6, join as join13, resolve as resolve4 } from "node:path";
+import { dirname as dirname7, join as join12, resolve as resolve4 } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 
 // ../../node_modules/.pnpm/jsonc-parser@3.3.1/node_modules/jsonc-parser/lib/esm/impl/scanner.js
@@ -42923,26 +43026,26 @@ var PI_EXTENSION = fileURLToPath3(
 var NAME = "openbus";
 var HARNESSES = ["claude", "opencode", "pi"];
 var readAssets = () => ({
-  pi: readFileSync12(PI_EXTENSION, "utf8"),
-  opencodePlugin: readFileSync12(OPENCODE_TUI_PLUGIN, "utf8")
+  pi: readFileSync11(PI_EXTENSION, "utf8"),
+  opencodePlugin: readFileSync11(OPENCODE_TUI_PLUGIN, "utf8")
 });
 var paths = (deps) => {
   const env = deps.env ?? {};
-  const opencode = env.OPENCODE_CONFIG_DIR ?? join13(env.XDG_CONFIG_HOME ?? join13(deps.home, ".config"), "opencode");
-  const openbus = deps.openbusHome ?? join13(deps.home, ".openbus");
+  const opencode = env.OPENCODE_CONFIG_DIR ?? join12(env.XDG_CONFIG_HOME ?? join12(deps.home, ".config"), "opencode");
+  const openbus = deps.openbusHome ?? join12(deps.home, ".openbus");
   return {
-    claude: join13(env.CLAUDE_CONFIG_DIR ?? deps.home, ".claude.json"),
+    claude: join12(env.CLAUDE_CONFIG_DIR ?? deps.home, ".claude.json"),
     // OpenCode reads both; edit the one the user has, else create .json.
     opencodeConfigs: [
-      join13(opencode, "opencode.json"),
-      join13(opencode, "opencode.jsonc")
+      join12(opencode, "opencode.json"),
+      join12(opencode, "opencode.jsonc")
     ],
-    opencodeCli: join13(opencode, "cli.json"),
-    record: join13(openbus, "install.json"),
+    opencodeCli: join12(opencode, "cli.json"),
+    record: join12(openbus, "install.json"),
     // OpenCode registers the folder that holds tui.js.
-    opencodePlugin: join13(openbus, "integrations/opencode", NAME),
-    pi: join13(
-      env.PI_CODING_AGENT_DIR ?? join13(deps.home, ".pi/agent"),
+    opencodePlugin: join12(openbus, "integrations/opencode", NAME),
+    pi: join12(
+      env.PI_CODING_AGENT_DIR ?? join12(deps.home, ".pi/agent"),
       "extensions/openbus.ts"
     )
   };
@@ -42950,7 +43053,7 @@ var paths = (deps) => {
 function readDoc(path) {
   let text3;
   try {
-    text3 = readFileSync12(path, "utf8");
+    text3 = readFileSync11(path, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return {};
     throw e;
@@ -42965,7 +43068,7 @@ function readDoc(path) {
 }
 function present2(path) {
   try {
-    lstatSync5(path);
+    lstatSync6(path);
     return true;
   } catch {
     return false;
@@ -42974,24 +43077,24 @@ function present2(path) {
 function target(path) {
   let p = path;
   for (let hops = 0; hops < 40; hops++) {
-    if (!present2(p) || !lstatSync5(p).isSymbolicLink()) {
-      if (p !== path && !existsSync5(dirname6(p)))
+    if (!present2(p) || !lstatSync6(p).isSymbolicLink()) {
+      if (p !== path && !existsSync4(dirname7(p)))
         throw new Error(
           `${path} is a dangling symlink to ${p}; left it untouched`
         );
       return p;
     }
-    p = resolve4(dirname6(p), readlinkSync(p));
+    p = resolve4(dirname7(p), readlinkSync(p));
   }
   throw new Error(`${path}: too many symlinks; left it untouched`);
 }
 function writeAtomic(path, data, mode) {
   const dest = target(path);
-  mkdirSync7(dirname6(dest), { recursive: true });
+  mkdirSync7(dirname7(dest), { recursive: true });
   let m = mode ?? 420;
   if (mode === void 0)
     try {
-      m = statSync7(dest).mode & 511;
+      m = statSync6(dest).mode & 511;
     } catch {
     }
   const tmp = `${dest}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
@@ -43007,7 +43110,7 @@ function writeAtomic(path, data, mode) {
 function readJsonc(path) {
   let text3;
   try {
-    text3 = readFileSync12(path, "utf8");
+    text3 = readFileSync11(path, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return "";
     throw e;
@@ -43024,7 +43127,7 @@ function saveText(path, before, next, ok) {
 }
 function readRecord(path) {
   try {
-    const v = JSON.parse(readFileSync12(path, "utf8"));
+    const v = JSON.parse(readFileSync11(path, "utf8"));
     const c = v?.created;
     if (typeof c === "object" && c !== null) return c;
   } catch {
@@ -43035,7 +43138,7 @@ function writeRecord(path, before, created) {
   if (isDeepStrictEqual(before, created)) return;
   let rest = {};
   try {
-    const v = JSON.parse(readFileSync12(path, "utf8"));
+    const v = JSON.parse(readFileSync11(path, "utf8"));
     if (typeof v === "object" && v !== null && !Array.isArray(v))
       rest = v;
   } catch {
@@ -43142,7 +43245,7 @@ var install = {
       created[p.opencodeCli] = add(p.opencodeCli, madeCli);
     writeRecord(p.record, record4, created);
     writeAtomic(
-      join13(p.opencodePlugin, "tui.js"),
+      join12(p.opencodePlugin, "tui.js"),
       deps.assets.opencodePlugin,
       420
     );
@@ -43205,7 +43308,7 @@ var uninstall = {
     const left = { ...record4 };
     for (const { file: file2 } of edits) delete left[file2];
     writeRecord(p.record, record4, left);
-    const hadPlugin = existsSync5(p.opencodePlugin);
+    const hadPlugin = existsSync4(p.opencodePlugin);
     rmSync5(p.opencodePlugin, { recursive: true, force: true });
     if (!saved.some(Boolean) && !hadPlugin) return "none";
     if (deps.which("opencode")) await restartOpencode(deps, notes);
@@ -43213,7 +43316,7 @@ var uninstall = {
   },
   async pi(deps) {
     const path = paths(deps).pi;
-    if (!existsSync5(path)) return "none";
+    if (!existsSync4(path)) return "none";
     rmSync5(path, { force: true });
     return "done";
   }
@@ -43278,14 +43381,14 @@ function checkAdapters(deps) {
     opencode: state(
       "opencode",
       () => p.opencodeConfigs.filter(present2).some((f) => {
-        const d = parseJsonc(readFileSync12(f, "utf8"), f);
+        const d = parseJsonc(readFileSync11(f, "utf8"), f);
         return servers(d)?.[NAME] !== void 0 || d.mcp?.[NAME] !== void 0;
       }) && listed(
-        parseJsonc(readFileSync12(p.opencodeCli, "utf8"), p.opencodeCli),
+        parseJsonc(readFileSync11(p.opencodeCli, "utf8"), p.opencodeCli),
         p.opencodePlugin
-      ) && existsSync5(join13(p.opencodePlugin, "tui.js"))
+      ) && existsSync4(join12(p.opencodePlugin, "tui.js"))
     ),
-    pi: state("pi", () => existsSync5(p.pi))
+    pi: state("pi", () => existsSync4(p.pi))
   };
 }
 
@@ -43294,16 +43397,16 @@ init_dist();
 import { randomBytes as randomBytes2 } from "node:crypto";
 import {
   chmodSync as chmodSync9,
-  closeSync as closeSync2,
+  closeSync as closeSync3,
   mkdirSync as mkdirSync8,
-  openSync as openSync2,
+  openSync as openSync3,
   renameSync as renameSync7,
   rmSync as rmSync6,
   unlinkSync,
   writeSync
 } from "node:fs";
 import { hostname as hostname3 } from "node:os";
-import { join as join14 } from "node:path";
+import { join as join13 } from "node:path";
 var LoginFailed = class extends Error {
   constructor(kind2, message, detail = {}) {
     super(message);
@@ -43336,19 +43439,19 @@ function checkVerificationUri(uri, hub, userCode) {
 function writeMachineFile(home2, body) {
   mkdirSync8(home2, { recursive: true, mode: 448 });
   chmodSync9(home2, 448);
-  const tmp = join14(home2, `.machine.json.${randomBytes2(8).toString("hex")}.tmp`);
-  const fd = openSync2(tmp, "wx", 384);
+  const tmp = join13(home2, `.machine.json.${randomBytes2(8).toString("hex")}.tmp`);
+  const fd = openSync3(tmp, "wx", 384);
   try {
     writeSync(fd, body);
   } catch (e) {
-    closeSync2(fd);
+    closeSync3(fd);
     unlinkSync(tmp);
     throw e;
   }
-  closeSync2(fd);
+  closeSync3(fd);
   try {
     chmodSync9(tmp, 384);
-    renameSync7(tmp, join14(home2, "machine.json"));
+    renameSync7(tmp, join13(home2, "machine.json"));
   } catch (e) {
     unlinkSync(tmp);
     throw e;
@@ -43472,7 +43575,7 @@ async function login(args) {
           `${JSON.stringify({ hub, machine_id: poll.machine_id, label, machine_token: poll.token }, null, 2)}
 `
         );
-        rmSync6(join14(args.home, "revoked"), { force: true });
+        rmSync6(join13(args.home, "revoked"), { force: true });
         if (!events?.code) print(`Approved this machine as ${label}.`);
         return {
           machineToken: poll.token,
@@ -43492,12 +43595,11 @@ async function login(args) {
 }
 
 // src/commands/status.ts
-init_src2();
 init_src();
 
 // src/commands/install.ts
 init_src2();
-import { join as join15 } from "node:path";
+import { join as join14 } from "node:path";
 
 // src/live.ts
 var FRAME_MS = 80;
@@ -43624,7 +43726,7 @@ async function loginStep(ctx, opts) {
       ctx,
       c.approved(result.label),
       c.tokenSaved(
-        tilde(ctx, join15(ctx.home, "machine.json")),
+        tilde(ctx, join14(ctx.home, "machine.json")),
         result.machineToken
       ),
       ""
@@ -43684,15 +43786,14 @@ function shownSocket(ctx) {
   const real2 = `${canonicalHome(ctx.home)}/`;
   return tilde(
     ctx,
-    path.startsWith(real2) ? join15(ctx.home, path.slice(real2.length)) : path
+    path.startsWith(real2) ? join14(ctx.home, path.slice(real2.length)) : path
   );
 }
 async function waitForDaemon(ctx) {
   const start = ctx.now();
-  const path = daemonSocketPath(ctx.home);
   for (; ; ) {
     try {
-      return await ctx.status({ path, cwd: ctx.cwd, timeoutMs: 1e3 });
+      return await askDaemon(ctx, { cwd: ctx.cwd, timeoutMs: 1e3 });
     } catch {
     }
     if (ctx.now() - start >= DAEMON_WAIT_MS) return void 0;
@@ -43706,9 +43807,10 @@ async function daemonStep(ctx) {
     sayErr(ctx, c.daemonInTheWay(shownSocket(ctx), running));
     return false;
   }
-  const st = await waitForDaemon(ctx);
+  const unsafe = socketFolderLines(ctx);
+  const st = unsafe ? void 0 : await waitForDaemon(ctx);
   if (!st) {
-    sayErr(ctx, c.daemonTimeout());
+    sayErr(ctx, unsafe ?? c.daemonTimeout());
     return false;
   }
   say(ctx, c.daemonRunning(st.pid, ctx.service.kind, ctx.service.fallback), "");
@@ -43779,10 +43881,7 @@ var installSteps = (opts) => [
     action: "Run npx @open-bus/cli to start it.",
     check: async (ctx) => {
       try {
-        await ctx.status({
-          path: daemonSocketPath(ctx.home),
-          timeoutMs: 1e3
-        });
+        await askDaemon(ctx, { timeoutMs: 1e3 });
         return "done";
       } catch {
         return "todo";
@@ -43804,7 +43903,7 @@ async function install2(opts, ctx) {
     return results.every((r) => r.state === "done") ? 0 : 1;
   }
   const ok = await runSteps(steps, ctx, {
-    path: join15(ctx.home, "install.json"),
+    path: join14(ctx.home, "install.json"),
     now: ctx.now
   });
   return ok ? 0 : 1;
@@ -43834,12 +43933,9 @@ async function status(ctx) {
   }
   let st;
   try {
-    st = await ctx.status({
-      path: daemonSocketPath(ctx.home),
-      timeoutMs: 3e3
-    });
+    st = await askDaemon(ctx, { timeoutMs: 3e3 });
   } catch {
-    sayErr(ctx, c.statusDaemonDown());
+    sayErr(ctx, socketFolderLines(ctx) ?? c.statusDaemonDown());
     return 1;
   }
   say(ctx, c.daemonRunning(st.pid, ctx.service.kind, ctx.service.fallback));
@@ -43876,7 +43972,7 @@ async function healthz(ctx, hub) {
 function claudeIsolates(path) {
   let text3;
   try {
-    text3 = readFileSync13(path, "utf8");
+    text3 = readFileSync12(path, "utf8");
   } catch {
     return void 0;
   }
@@ -43905,16 +44001,13 @@ async function doctor(ctx) {
   const node2 = ctx.nodeVersion.replace(/^v/, "");
   if (Number(node2.split(".")[0]) >= MIN_NODE) pass(c.nodeOk(node2));
   else fail(c.nodeOld(node2));
-  const machineFile = tilde(ctx, join16(ctx.home, "machine.json"));
+  const machineFile = tilde(ctx, join15(ctx.home, "machine.json"));
   const m = readMachine(ctx.home);
   if (m.state !== "ok") fail(c.noCredentials(machineFile));
   else if (m.revoked) fail(c.revokedCheck());
   else pass(c.credentials(machineFile, m.token));
   try {
-    const st = await ctx.status({
-      path: daemonSocketPath(ctx.home),
-      timeoutMs: 3e3
-    });
+    const st = await askDaemon(ctx, { timeoutMs: 3e3 });
     const lines = c.daemonRunning(
       st.pid,
       ctx.service.kind,
@@ -43923,11 +44016,7 @@ async function doctor(ctx) {
     if (ctx.service.kind) pass(lines[0]);
     else warn(lines);
   } catch {
-    const dirs = shortDirInUse(ctx.home) ? [shortSocketDir(ctx.home), claudeReturnDir(ctx.home)] : [];
-    const bad = dirs.map((d) => ({ d, why: unsafeSocketDir(d) })).find((x) => x.why);
-    fail(
-      !bad ? c.daemonNotRunning() : bad.why === NOT_OURS ? c.socketFolderNotYours(bad.d) : c.socketFolderUnsafe(tilde(ctx, bad.d), bad.why)
-    );
+    fail(socketFolderLines(ctx) ?? c.daemonNotRunning());
   }
   for (const p of ctx.service.problems?.() ?? [])
     if (p.kind === "node-missing") fail(c.serviceNodeMissing(p.node));
@@ -43961,8 +44050,8 @@ async function doctor(ctx) {
     if (wiring[h] === "configured") pass(c.wired(h, version2));
     else fail(c.notWired(h));
     if (h === "claude") {
-      const settings = join16(
-        ctx.env.CLAUDE_CONFIG_DIR ?? join16(ctx.userHome, ".claude"),
+      const settings = join15(
+        ctx.env.CLAUDE_CONFIG_DIR ?? join15(ctx.userHome, ".claude"),
         "settings.json"
       );
       const isolates = claudeIsolates(settings);
@@ -43975,14 +44064,14 @@ async function doctor(ctx) {
 }
 
 // src/commands/logs.ts
-import { readFileSync as readFileSync14 } from "node:fs";
-import { join as join17 } from "node:path";
+import { readFileSync as readFileSync13 } from "node:fs";
+import { join as join16 } from "node:path";
 var TAIL = 50;
 async function logs(ctx) {
-  const path = join17(ctx.home, "logs", "daemon.log");
+  const path = join16(ctx.home, "logs", "daemon.log");
   let text3;
   try {
-    text3 = readFileSync14(path, "utf8");
+    text3 = readFileSync13(path, "utf8");
   } catch {
     say(ctx, ctx.copy.noLog(tilde(ctx, path)));
     return 1;
@@ -44007,13 +44096,12 @@ async function mcp(harness, ctx, load = (h) => MCP_SERVER[h]()) {
 }
 
 // src/commands/uninstall.ts
-init_src2();
-import { join as join19 } from "node:path";
+import { join as join18 } from "node:path";
 
 // src/steps/purge.ts
 init_src2();
-import { lstatSync as lstatSync6, readdirSync as readdirSync3, rmdirSync, rmSync as rmSync7 } from "node:fs";
-import { join as join18 } from "node:path";
+import { lstatSync as lstatSync7, readdirSync as readdirSync3, rmdirSync, rmSync as rmSync7 } from "node:fs";
+import { join as join17 } from "node:path";
 var FILES = [
   "machine.json",
   "install.json",
@@ -44045,7 +44133,7 @@ var FOLDERS = [
 ];
 function kind(path) {
   try {
-    const st = lstatSync6(path);
+    const st = lstatSync7(path);
     return st.isDirectory() ? "dir" : st.isSocket() ? "socket" : "other";
   } catch {
     return void 0;
@@ -44062,14 +44150,14 @@ var rmdirIfEmpty = (path) => {
 };
 function purgeShort(dir, removed) {
   if (kind(dir) !== "dir" || unsafeSocketDir(dir)) return;
-  const ret = join18(dir, "claude-return");
+  const ret = join17(dir, "claude-return");
   for (const [d, ours] of [
     [ret, (_n, p) => kind(p) === "socket"],
     [dir, (n) => /^daemon\.sock(\.keep-\d+)?$/.test(n)]
   ]) {
     if (kind(d) !== "dir") continue;
     for (const name of readdirSync3(d)) {
-      const path = join18(d, name);
+      const path = join17(d, name);
       const k = kind(path);
       if (k === void 0 || k === "dir" || !ours(name, path)) continue;
       remove(path, k);
@@ -44094,21 +44182,21 @@ function purge(home2, opts) {
     ...FILES,
     ...entries.filter((n) => TEMP.some((re) => re.test(n)))
   ]) {
-    const path = join18(home2, name);
+    const path = join17(home2, name);
     const k = kind(path);
     if (k === void 0 || k === "dir") continue;
     remove(path, k);
     removed.push(name);
   }
   for (const folder of FOLDERS) {
-    const dir = join18(home2, folder.path);
+    const dir = join17(home2, folder.path);
     if (kind(dir) !== "dir") continue;
     for (const name of readdirSync3(dir)) {
-      const path = join18(dir, name);
+      const path = join17(dir, name);
       const k = kind(path);
       if (k === void 0 || !folder.ours(name, path)) continue;
       remove(path, k);
-      removed.push(join18(folder.path, name));
+      removed.push(join17(folder.path, name));
     }
     if (rmdirIfEmpty(dir)) removed.push(folder.path);
   }
@@ -44147,18 +44235,18 @@ async function uninstall2(opts, ctx) {
       r.opencodeRestarted ? c.restartedUnload() : c.opencodeNotRunningUnload()
     );
   if (!opts.purge) {
-    say(ctx, "", c.kept(tilde(ctx, join19(ctx.home, "machine.json"))));
+    say(ctx, "", c.kept(tilde(ctx, join18(ctx.home, "machine.json"))));
     return 0;
   }
   const home2 = tilde(ctx, ctx.home);
   try {
-    await ctx.status({ path: daemonSocketPath(ctx.home), timeoutMs: 1e3 });
+    await askDaemon(ctx, { timeoutMs: 1e3 });
     sayErr(ctx, c.purgeDaemonRunning(home2));
     return 1;
   } catch {
   }
   const out = purge(ctx.home, {
-    isDefault: ctx.home === join19(ctx.userHome, ".openbus")
+    isDefault: ctx.home === join18(ctx.userHome, ".openbus")
   });
   if ("refused" in out) {
     sayErr(ctx, c.purgeRefused(home2));
@@ -44287,13 +44375,21 @@ async function dispatch(cmd, ctx) {
         { hub: cmd.hub, noOpen: cmd.noOpen, check: cmd.check },
         ctx
       );
-    case "login":
+    case "login": {
       say(ctx, ctx.copy.header(ctx.version), "");
-      return await loginStep(ctx, {
+      const ok = await loginStep(ctx, {
         hub: cmd.hub,
         noOpen: cmd.noOpen,
         force: true
-      }) ? 0 : 1;
+      });
+      if (!ok) return 1;
+      const pid = await askDaemon(ctx, { timeoutMs: 1e3 }).then(
+        (st) => st.pid,
+        () => void 0
+      );
+      if (pid !== void 0) say(ctx, ctx.copy.daemonOldToken(pid));
+      return 0;
+    }
     case "daemon":
       if (cmd.home) process.env.OPENBUS_HOME = ctx.home;
       if (cmd.hub) process.env.OPENBUS_HUB = cmd.hub;