@ordewell/web 0.10.12 → 0.11.1

package/dist/server/main.js

@@ -4,9 +4,9 @@
 var hono = require('hono');
 var child_process = require('child_process');
 var crypto = require('crypto');
+var path = require('path');
 var core = require('@ordewell/core');
 var fs = require('fs');
-var path = require('path');
 var ws = require('ws');
 var http = require('http');
 
@@ -28,8 +28,8 @@ function _interopNamespace(e) {
   return Object.freeze(n);
 }
 
-var fs__namespace = /*#__PURE__*/_interopNamespace(fs);
 var path__namespace = /*#__PURE__*/_interopNamespace(path);
+var fs__namespace = /*#__PURE__*/_interopNamespace(fs);
 
 var WebConfig = class extends core.BaseConfig {
   _enabledRunnersOverride;
@@ -144,16 +144,20 @@ function scanWorkspaces() {
   });
 }
 var MAX_OUTPUT_BYTES = 4 * 1024 * 1024;
+var SEALED_OUTPUT_GRACE_MS = 1e3;
 function run(file, args2, opts) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     try {
-      child_process.execFile(file, args2, {
+      const child = child_process.execFile(file, args2, {
         cwd: opts.cwd,
         timeout: opts.timeout,
         maxBuffer: MAX_OUTPUT_BYTES,
         encoding: "utf8",
         shell: opts.shell,
         env: opts.env,
+        // A sealed run's wall-time limit is a kill, not a request it may trap
+        // (ADR-0036 S1); the sandbox takes the processes it started down with it.
+        ...opts.sealed ? { killSignal: "SIGKILL" } : {},
         // Node kills the child when this aborts, and calls back with an
         // ABORT_ERR — which lands on the `code: 1` branch below, i.e. a
         // failed tool call, exactly like any other command that did not
@@ -162,10 +166,14 @@ function run(file, args2, opts) {
         signal: opts.signal
       }, (err, stdout, stderr) => {
         const code = err && typeof err.code === "number" ? err.code : err ? 1 : 0;
-        resolve2({ stdout: stdout ?? "", stderr: stderr ?? "", code });
+        resolve3({ stdout: stdout ?? "", stderr: stderr ?? "", code, timedOut: err?.killed === true });
       });
+      if (opts.sealed) child.once("exit", () => setTimeout(() => {
+        child.stdout?.destroy();
+        child.stderr?.destroy();
+      }, SEALED_OUTPUT_GRACE_MS).unref());
     } catch (err) {
-      resolve2({ stdout: "", stderr: err.message, code: null });
+      resolve3({ stdout: "", stderr: err.message, code: null, timedOut: false });
     }
   });
 }
@@ -321,16 +329,16 @@ var PoolFileSystem = class extends core.BaseFileSystem {
       return { success: false, output: `Error listing ${absPath}: ${err.message}`, truncated: false };
     }
   }
-  async execBashImpl(command, signal) {
-    const { file, args: args2 } = this.researchShell;
-    const result = file === null ? await run(command, [], { cwd: this.workspaceRoot, timeout: BASH_TIMEOUT_MS, shell: true, signal }) : await run(file, [...args2, command], { cwd: this.workspaceRoot, timeout: BASH_TIMEOUT_MS, signal });
+  async execBashImpl(command, shell, signal, cwd) {
+    const { file, args: args2, env, wallTimeMs } = shell;
+    const result = file === null ? await run(command, [], { cwd, timeout: BASH_TIMEOUT_MS, shell: true, env, signal }) : await run(file, [...args2, command], { cwd, timeout: wallTimeMs ?? BASH_TIMEOUT_MS, env, signal, sealed: wallTimeMs !== void 0 });
     const out = (result.stdout || "").trim();
     const err = (result.stderr || "").trim();
     if (signal?.aborted) return { success: false, output: core.STOPPED_TOOL_RESULT, truncated: false };
     if (result.code !== 0) {
       const detail = err || out || `exited with code ${result.code}`;
       return { success: false, output: `Command exited ${result.code}:
-${detail.slice(0, 2e4)}`, truncated: detail.length > 2e4 };
+${detail.slice(0, 2e4)}`, truncated: detail.length > 2e4, ...result.timedOut ? { timedOut: true } : {} };
     }
     const combined = err ? `${out}
 [stderr]
@@ -381,6 +389,12 @@ var PoolAwareRunner = class {
 
 // server/pool/orchestratorPool.ts
 var OrchestratorPool = class {
+  // A daemon serves several workspaces; login selection must never follow
+  // whichever session was opened most recently (ADR-0051).
+  sessionWorkspaces = /* @__PURE__ */ new Map();
+  accountLimits = /* @__PURE__ */ new Map();
+  accountLimitCollectors;
+  limitsRevision = 0;
   sessions = /* @__PURE__ */ new Map();
   clients = /* @__PURE__ */ new Map();
   /**
@@ -394,6 +408,13 @@ var OrchestratorPool = class {
   registry = new core.RunnerRegistry();
   modelResolver;
   runnerInstallation;
+  /**
+   * A host that supplied its own probe (a test, or a surface that owns one).
+   * Everything else asks {@link installationFor}, which keys a real probe by
+   * the workspace whose account it is judging (ADR-0016).
+   */
+  suppliedRunnerInstallation;
+  workspaceInstallations = /* @__PURE__ */ new Map();
   cachedProviderLists;
   settingsService = new core.SettingsService();
   plannerModelMemory = new core.PlannerModelMemory(this.settingsService);
@@ -406,13 +427,31 @@ var OrchestratorPool = class {
   runner;
   /** One probe per daemon, asked again whenever the runner list is refreshed (ADR-0033). */
   codexSandbox;
+  leaseHost;
+  isolationPreview;
   constructor(deps = {}) {
     const pluginNotice = core.removedPluginNotice();
     if (pluginNotice) console.warn(pluginNotice);
     this.runner = deps.runner ?? new core.StructuredRunner();
-    this.runnerInstallation = deps.runnerInstallation ?? new core.RunnerInstallation(this.registry);
+    this.suppliedRunnerInstallation = deps.runnerInstallation;
+    this.runnerInstallation = deps.runnerInstallation ?? new core.RunnerInstallation(this.registry, void 0, void 0, {
+      env: () => core.workspaceEnvOf(process.cwd()),
+      workspace: () => process.cwd()
+    });
     this.modelResolver = deps.modelResolver ?? new core.ModelResolver(this.registry, new WebConfig());
     this.codexSandbox = deps.codexSandbox ?? new core.CodexSandboxAvailability(this.registry, { spawn: child_process.spawn, fetch: globalThis.fetch }, { cwd: process.cwd(), env: process.env });
+    this.leaseHost = deps.leaseHost;
+    this.isolationPreview = deps.isolationPreview ?? core.createIsolationPreview({ config: new WebConfig() });
+    this.accountLimitCollectors = deps.accountLimitCollectors ?? ((workspace) => {
+      const workspaceRoot = () => workspace;
+      const isInstalled = (runner) => async () => (await this.runnerInstallation.filterInstalled([runner])).includes(runner);
+      const server2 = this.registry.getManifest("codex")?.modelDiscovery.appServer;
+      return [
+        core.claudeAccountLimitCollector({ workspaceRoot, isInstalled: isInstalled("claude-code") }),
+        core.codexAccountLimitCollector({ workspaceRoot, isInstalled: isInstalled("codex"), command: server2?.command, args: server2?.args }),
+        core.openCodeGoAccountLimitCollector({ workspaceRoot, isInstalled: isInstalled("opencode") })
+      ];
+    });
   }
   /**
    * Not awaited: planning must start at once, and the daemon already warms the
@@ -431,6 +470,15 @@ var OrchestratorPool = class {
   detectInstalledPlanner() {
     return core.detectInstalledPlanner(this.runnerInstallation);
   }
+  /**
+   * A read-only look at the repositories and branches a run would isolate in
+   * `workspace`. Free of side effects on purpose: a first screen may ask before
+   * any plan or run exists, and asking must not create one.
+   */
+  previewIsolation(workspace) {
+    core.assertWorkspaceExists(workspace);
+    return this.isolationPreview.preview(workspace);
+  }
   /**
    * A new session's first planner turn. It waits for that probe at the
    * session's own planner gate, where a reply sent meanwhile queues behind
@@ -448,12 +496,59 @@ var OrchestratorPool = class {
   subscribe(sessionId, ws) {
     if (!this.clients.has(sessionId)) this.clients.set(sessionId, /* @__PURE__ */ new Set());
     this.clients.get(sessionId).add(ws);
+    this.connectAccountLimits(sessionId, ws);
   }
   unsubscribe(sessionId, ws) {
     this.clients.get(sessionId)?.delete(ws);
     if (this.clients.get(sessionId)?.size === 0) this.clients.delete(sessionId);
+    this.releaseUnusedAccountLimits();
+  }
+  connectAccountLimits(sessionId, ws) {
+    const workspace = this.sessionWorkspaces.get(sessionId);
+    if (!workspace) {
+      this.sendAccountLimits(sessionId, ws, []);
+      return;
+    }
+    let monitor = this.accountLimits.get(workspace);
+    if (!monitor) {
+      monitor = new core.AccountLimitMonitor({ collectors: this.accountLimitCollectors(workspace) });
+      this.accountLimits.set(workspace, monitor);
+      monitor.subscribe((limits) => {
+        for (const [id, clients] of this.clients) {
+          if (this.sessionWorkspaces.get(id) !== workspace) continue;
+          for (const client of clients) this.sendAccountLimits(id, client, limits);
+        }
+      });
+    }
+    this.sendAccountLimits(sessionId, ws, monitor.snapshots());
+    monitor.setForeground(true);
+    monitor.surfaceConnected();
+  }
+  sendAccountLimits(sessionId, ws, limits) {
+    if (ws.readyState !== ws.OPEN) return;
+    ws.send(JSON.stringify({ type: "account_limits", sessionId, limits, stream: this.stream, revision: ++this.limitsRevision }));
+  }
+  releaseUnusedAccountLimits() {
+    for (const [workspace, monitor] of this.accountLimits) {
+      if ([...this.clients.keys()].some((id) => this.sessionWorkspaces.get(id) === workspace)) continue;
+      monitor.dispose();
+      this.accountLimits.delete(workspace);
+    }
+  }
+  registerSession(sessionId, workspace, session) {
+    this.sessions.set(sessionId, session);
+    this.sessionWorkspaces.set(sessionId, workspace);
+    for (const ws of this.clients.get(sessionId) ?? []) this.connectAccountLimits(sessionId, ws);
   }
   broadcast(sessionId, msg) {
+    const workspace = this.sessionWorkspaces.get(sessionId);
+    const monitor = workspace ? this.accountLimits.get(workspace) : void 0;
+    if (msg.type === "planner_usage") monitor?.invalidate();
+    else if (msg.type === "task_log" && msg.events.some((event) => event.type === "turn_end")) {
+      const task = core.flattenTasks(this.sessions.get(sessionId)?.planTasks ?? []).find((task2) => task2.id === msg.taskId);
+      const runner = task && core.assignedRunnerOf(task);
+      if (runner) monitor?.invalidate(runner);
+    }
     const seq = (this.sequence.get(sessionId) ?? 0) + 1;
     this.sequence.set(sessionId, seq);
     const payload = JSON.stringify({ ...msg, stream: this.stream, seq });
@@ -495,6 +590,14 @@ var OrchestratorPool = class {
   runSnapshot(sessionId) {
     return this.sessions.get(sessionId)?.runSnapshot() ?? null;
   }
+  /** The planner turn answering in a session this process holds, if one is. */
+  plannerTurnId(sessionId) {
+    return this.sessions.get(sessionId)?.plannerTurnId;
+  }
+  /** The planner compaction running in a session this process holds, as its start was announced; it has no turn to name. */
+  plannerCompaction(sessionId) {
+    return this.sessions.get(sessionId)?.plannerCompaction();
+  }
   /** The planner's approval requests still waiting, as they were announced. */
   announcedApprovals(sessionId) {
     return this.sessions.get(sessionId)?.announcedApprovals() ?? [];
@@ -536,7 +639,8 @@ var OrchestratorPool = class {
       onNotice: (notice) => this.broadcast(sessionId, notice),
       modelResolver: this.modelResolver,
       settings: () => this.runtimeSettings(),
-      sessionId
+      sessionId,
+      ...this.leaseHost ? { leaseHost: this.leaseHost } : {}
     });
   }
   /**
@@ -575,9 +679,10 @@ var OrchestratorPool = class {
       return enabled ? current.includes(id) ? current : [...current, id] : current.filter((r) => r !== id);
     });
   }
-  getSettings() {
+  getSettings(sessionId) {
     const config = this.plannerConfig();
     const userSettings = this.settingsService.getAll();
+    const live = sessionId ? this.sessions.get(sessionId) : void 0;
     return {
       orchestratorModel: config.orchestratorModel,
       // Who plans (ADR-0009) — a vendor id, or one of the three harness
@@ -593,19 +698,21 @@ var OrchestratorPool = class {
       // The model remembered per planner backend (this task), so a surface can
       // render what's remembered without a second round-trip.
       plannerModels: userSettings.plannerModels,
-      run: this.settingsService.getRunSettings()
+      // An open session shows what it was opened with; a closed or unknown id
+      // falls back to the file, which is what a new session starts from (ADR-0030).
+      run: live?.runSettings() ?? this.settingsService.getRunSettings()
     };
   }
   /**
    * Save the user's run settings, and apply them at once to `sessionId`'s run
-   * when that session is open here (ADR-0030). Other sessions' runs keep
-   * theirs. Throws a {@link RunSettingsError}, saving nothing, for a value
-   * out of range.
+   * when that session is open here (ADR-0030). Other sessions keep the values
+   * they were opened with. Throws a {@link RunSettingsError}, saving nothing,
+   * for a value out of range.
    */
   updateRunSettings(changes, sessionId) {
     this.settingsService.updateRunSettings(changes);
     if (sessionId) this.sessions.get(sessionId)?.applyRunSettings(changes);
-    return this.getSettings();
+    return this.getSettings(sessionId);
   }
   /**
    * The catalog `selectPlanner` should judge `provider`'s
@@ -629,7 +736,7 @@ var OrchestratorPool = class {
   plannerProviderInEffect() {
     return this.plannerConfig().aiProvider;
   }
-  updateSettings(changes) {
+  updateSettings(changes, sessionId) {
     const current = this.plannerConfig().planner;
     const rawEnv = changes.env && typeof changes.env === "object" && !Array.isArray(changes.env) ? changes.env : void 0;
     const admission = rawEnv ? core.admitSettingsEnv(rawEnv) : void 0;
@@ -675,13 +782,14 @@ var OrchestratorPool = class {
         }
       }
     }
+    if (envChanges) for (const monitor of this.accountLimits.values()) monitor.refresh();
     if (selection?.remember) {
       const { provider, model, effort } = selection.remember;
       const switched = provider !== current.provider;
       this.plannerModelMemory.remember(switched ? provider : this.plannerProviderInEffect(), model, effort);
     }
     const rejectedEnvKeys = admission?.rejected ?? [];
-    const settings = this.getSettings();
+    const settings = this.getSettings(sessionId);
     if (rejectedEnvKeys.length > 0) settings.rejectedEnvKeys = rejectedEnvKeys;
     if (selection?.recall) settings.switchRecall = selection.recall;
     return settings;
@@ -742,40 +850,89 @@ var OrchestratorPool = class {
     const config = this.plannerConfig();
     return { enabledRunners: config.enabledRunners, orchestratorModel: config.orchestratorModel };
   }
+  /**
+   * The probe that judges a login for `workspace`, cached so its install and
+   * auth verdicts survive between runner-list refreshes. Without a workspace
+   * the daemon's cwd is what the request would plan with anyway.
+   */
+  installationFor(workspace) {
+    if (this.suppliedRunnerInstallation) return this.suppliedRunnerInstallation;
+    if (!workspace) return this.runnerInstallation;
+    const key = path.resolve(workspace);
+    let installation = this.workspaceInstallations.get(key);
+    if (!installation) {
+      installation = new core.RunnerInstallation(this.registry, void 0, void 0, {
+        env: () => core.workspaceEnvOf(key),
+        workspace: () => key
+      });
+      this.workspaceInstallations.set(key, installation);
+    }
+    return installation;
+  }
   /**
    * Runners whose CLI is actually installed on the host, with display name and
    * enabled state. Only these should be offered for selection — an uninstalled
-   * runner can't be spawned.
+   * runner can't be spawned. `workspace` names whose account the auth verdict
+   * is about; without it the daemon's cwd stands in.
    */
-  async getInstalledRunners() {
+  async getInstalledRunners(workspace) {
     await this.codexSandbox.refresh();
-    this.runnerInstallation.refresh?.();
+    const installation = this.installationFor(workspace);
+    installation.refresh?.();
     await this.detectInstalledPlanner();
     const config = new WebConfig({ enabledRunners: this.enabledRunnerOverride() });
     const enabled = new Set(config.enabledRunners);
     const runners = this.registry.list();
     const installedIds = new Set(
-      await this.runnerInstallation.filterInstalled(runners.map((p) => p.manifest.name))
+      await installation.filterInstalled(runners.map((p) => p.manifest.name))
+    );
+    const rows = await Promise.all(
+      runners.filter((p) => installedIds.has(p.manifest.name)).map(async (p) => {
+        const { usable, auth } = await installation.plannerUsability(p.manifest.name);
+        if (!usable) return null;
+        return {
+          id: p.manifest.name,
+          name: p.manifest.displayName,
+          enabled: enabled.has(p.manifest.name),
+          ...auth ? { auth } : {}
+        };
+      })
     );
-    return runners.filter((p) => installedIds.has(p.manifest.name)).map((p) => ({
-      id: p.manifest.name,
-      name: p.manifest.displayName,
-      enabled: enabled.has(p.manifest.name)
-    }));
+    return rows.filter((row) => row !== null);
   }
   async generatePlan(sessionId, goal, runners, workspace, modelOverride, options) {
-    const session = this.openPlanningSession(sessionId, workspace, modelOverride, options);
+    const recheck = this.recheckSignedOutPlanner(workspace, this.plannerConfig(modelOverride).aiProvider);
+    if (recheck) await recheck;
+    const session = this.openPlanningSession(sessionId, runners, workspace, modelOverride, options);
     return core.migratePlanState(await this.firstTurn(sessionId, session, () => session.generatePlan(goal, runners)));
   }
+  /**
+   * Judge the planner as the workspace's account is now, not as it was when the
+   * list was last read: the signed-out refusal itself offers the runner's own
+   * `auth login` as a way back, and that happens in another process. Only a
+   * recorded signed-out verdict is asked again — unknown never blocks, and a
+   * signed-in one is the runner's own failure to report. Null when there is
+   * nothing to ask, so the turn registers at once as it always did.
+   */
+  recheckSignedOutPlanner(workspace, provider) {
+    const runner = core.runnerForProvider(provider);
+    if (!runner || core.recordedRunnerAuth(runner, workspace)?.state !== "signed-out") return null;
+    const installation = this.installationFor(workspace);
+    installation.refresh?.();
+    return installation.plannerUsability(runner).then(() => void 0);
+  }
   /**
    * Build the session a new planning conversation runs in and register it in
    * place of any live one, for {@link firstTurn} to run its first turn on.
    */
-  openPlanningSession(sessionId, workspace, modelOverride, options) {
+  openPlanningSession(sessionId, runners, workspace, modelOverride, options) {
     const session = this.createSessionFor(sessionId, workspace, modelOverride, options);
-    if (core.installedPlannerAnswered()) session.assertPlannerReady();
+    if (core.installedPlannerAnswered()) {
+      session.assertPlannerReady();
+      session.assertRunnersEnabled(runners);
+    }
     this.destroy(sessionId);
-    this.sessions.set(sessionId, session);
+    this.registerSession(sessionId, workspace, session);
     this.warmCodexSandbox();
     return session;
   }
@@ -786,7 +943,9 @@ var OrchestratorPool = class {
    * assistant message lives in conversationHistory).
    */
   async startPlanning(sessionId, goal, runners, workspace, modelOverride, options) {
-    const session = this.openPlanningSession(sessionId, workspace, modelOverride, options);
+    const recheck = this.recheckSignedOutPlanner(workspace, this.plannerConfig(modelOverride).aiProvider);
+    if (recheck) await recheck;
+    const session = this.openPlanningSession(sessionId, runners, workspace, modelOverride, options);
     return this.firstTurn(sessionId, session, () => session.startPlanning(goal, runners));
   }
   /**
@@ -797,14 +956,38 @@ var OrchestratorPool = class {
    * it does for every turn.
    */
   async continuePlanning(sessionId, message) {
-    return this.session(sessionId).continueConversation(message);
+    const session = this.session(sessionId);
+    const recheck = this.recheckSignedOutPlanner(session.workspaceRoot, session.plannerProvider);
+    if (recheck) await recheck;
+    return session.continueConversation(message);
   }
   /** Condense a session's conversation. The summary turn is a planner turn, so `cancelPlanning` stops it. */
   async compactConversation(sessionId) {
     const session = this.session(sessionId);
+    const recheck = this.recheckSignedOutPlanner(session.workspaceRoot, session.plannerProvider);
+    if (recheck) await recheck;
     const compaction = await session.compactConversation();
     return { ...compaction, plan: session.planState };
   }
+  /**
+   * Send now (ADR-0023): the Session stops the planner turn in flight and
+   * answers this message in the turn that replaces it, ahead of anything
+   * waiting. The recheck is the one a reply does before the gate: a login done
+   * with the runner's own command is seen here too.
+   */
+  async forceSendPrompt(sessionId, message) {
+    const session = this.session(sessionId);
+    const recheck = this.recheckSignedOutPlanner(session.workspaceRoot, session.plannerProvider);
+    if (recheck) await recheck;
+    return session.forceSendPrompt(message);
+  }
+  /** Retry a compaction paused on the planner's context: a planner turn, and gated as one. */
+  async retryPlannerCompaction(sessionId) {
+    const session = this.session(sessionId);
+    const recheck = this.recheckSignedOutPlanner(session.workspaceRoot, session.plannerProvider);
+    if (recheck) await recheck;
+    return session.retryPlannerCompaction();
+  }
   /**
    * Abort the planner turn in flight for a session, if any. Answers whether
    * there was one to cancel — the route reports that rather than 404ing a
@@ -828,9 +1011,14 @@ var OrchestratorPool = class {
     const saved = core.loadSession(sessionId, workspace);
     if (!saved) throw new core.SessionNotFoundError();
     const session = this.createSessionFor(sessionId, workspace);
-    session.loadPlan(saved.plan, saved.meta.goal, workspace, { sessionId: saved.meta.id });
+    try {
+      session.loadPlan(saved.plan, saved.meta.goal, workspace, { sessionId: saved.meta.id });
+    } catch (err) {
+      session.destroy();
+      throw err;
+    }
     this.destroy(sessionId);
-    this.sessions.set(sessionId, session);
+    this.registerSession(sessionId, workspace, session);
     return session.planState ?? saved.plan;
   }
   /**
@@ -859,9 +1047,26 @@ var OrchestratorPool = class {
     if (!session) throw new core.SessionNotFoundError();
     return session;
   }
-  destroy(sessionId) {
+  /**
+   * Stop a session and drop it. A replacement under the same id (re-planning,
+   * adopting) keeps its subscribers: they are watching the id, and the new
+   * session's broadcasts continue on the same socket. An explicit delete or
+   * close is different — the surface must stop drawing a session that no
+   * longer exists — so those pass `notifyClients`.
+   */
+  destroy(sessionId, options) {
     this.sessions.get(sessionId)?.destroy();
     this.sessions.delete(sessionId);
+    this.sessionWorkspaces.delete(sessionId);
+    this.releaseUnusedAccountLimits();
+    if (!options?.notifyClients) return;
+    const clients = this.clients.get(sessionId);
+    if (!clients) return;
+    this.broadcast(sessionId, { type: "notice", level: "info", message: "Session closed." });
+    for (const ws of clients) {
+      if (ws.readyState === ws.OPEN) ws.close(1001, "Session closed");
+    }
+    this.clients.delete(sessionId);
   }
   destroyAll() {
     for (const id of this.sessions.keys()) this.destroy(id);
@@ -877,8 +1082,28 @@ function removeSession(sessionId, workspace) {
 function stringField(value) {
   return typeof value === "string" ? value : void 0;
 }
+var InvalidBodyError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "InvalidBodyError";
+  }
+};
+async function jsonObject(c) {
+  let parsed;
+  try {
+    parsed = await c.req.json();
+  } catch {
+    throw new InvalidBodyError("The request body must be valid JSON.");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new InvalidBodyError("The request body must be a JSON object.");
+  }
+  return parsed;
+}
 function classify(err) {
+  if (err instanceof InvalidBodyError) return { status: 400, code: "refused" };
   if (err instanceof core.SessionNotFoundError) return { status: 404, code: "session_not_found" };
+  if (err instanceof core.SessionHeldError) return { status: 409, code: "session_held" };
   if (err instanceof core.NoPlanError) return { status: 400, code: "no_plan" };
   if (err instanceof core.AlreadyExecutingError) return { status: 409, code: "already_executing" };
   if (err instanceof core.WorkspaceNotAProjectError) return { status: 400, code: "workspace_not_a_project" };
@@ -904,7 +1129,8 @@ function failure(c, err, label, { fallback = 500, message = "Internal error" } =
     error: err instanceof Error && err.message || message,
     ...classified ? { code: classified.code } : {},
     ...err instanceof core.WorkspaceNotAProjectError ? { workspace: err.workspace } : {},
-    ...err instanceof core.PlannerNotReadyError ? { plannerNotReady: err.reason } : {}
+    ...err instanceof core.PlannerNotReadyError ? { plannerNotReady: err.reason } : {},
+    ...err instanceof core.SessionHeldError ? { sessionHeld: err.held } : {}
   };
   return c.json(body, status);
 }
@@ -923,7 +1149,13 @@ function sessionsRoute(pool2) {
     const saved = core.loadSessionPlanState(id, ws);
     if (!saved) return refuse(c, 404, "Session not found", "session_not_found");
     const run2 = pool2.runSnapshot(id);
-    return c.json({ meta: saved.meta, plan: core.surfacePlanState(pool2.getPlanState(id) ?? saved.plan), ...run2 ? { run: run2 } : {} });
+    const plannerCompaction = pool2.plannerCompaction(id);
+    return c.json({
+      meta: saved.meta,
+      plan: core.surfacePlanState(pool2.getPlanState(id) ?? saved.plan),
+      ...run2 ? { run: run2 } : {},
+      ...plannerCompaction ? { plannerCompaction } : {}
+    });
   });
   router.post("/:id/load", (c) => {
     const ws = c.req.query("workspace") || process.cwd();
@@ -931,7 +1163,16 @@ function sessionsRoute(pool2) {
       const id = c.req.param("id");
       const plan = pool2.adoptSavedSession(id, ws);
       const run2 = pool2.runSnapshot(id);
-      return c.json({ ok: true, plan: core.surfacePlan(plan), goal: pool2.getGoal(id), ...run2 ? { run: run2 } : {} });
+      const plannerTurnId = pool2.plannerTurnId(id);
+      const plannerCompaction = pool2.plannerCompaction(id);
+      return c.json({
+        ok: true,
+        plan: core.surfacePlan(plan),
+        goal: pool2.getGoal(id),
+        ...run2 ? { run: run2 } : {},
+        ...plannerTurnId ? { plannerTurnId } : {},
+        ...plannerCompaction ? { plannerCompaction } : {}
+      });
     } catch (err) {
       return failure(c, err, "load session", { message: "Failed to load session" });
     }
@@ -949,12 +1190,17 @@ function sessionsRoute(pool2) {
   router.delete("/:id", (c) => {
     const ws = c.req.query("workspace") || process.cwd();
     const id = c.req.param("id");
-    pool2.destroy(id);
-    const ok = removeSession(id, ws);
-    return c.json({ ok });
+    const held = pool2.hasSession(id);
+    pool2.destroy(id, { notifyClients: true });
+    const removed = removeSession(id, ws);
+    const ok = held || removed;
+    return c.json({
+      ok,
+      ...ok ? {} : { message: `No session "${id}" was found in ${ws}.` }
+    });
   });
   router.post("/:id/close", (c) => {
-    pool2.destroy(c.req.param("id"));
+    pool2.destroy(c.req.param("id"), { notifyClients: true });
     return c.json({ ok: true });
   });
   return router;
@@ -972,7 +1218,7 @@ function plansRoute(pool2) {
   const router = new hono.Hono();
   router.post("/:sessionId/generate", async (c) => {
     try {
-      const { goal, runners, workspace, model, allowInit } = await c.req.json();
+      const { goal, runners, workspace, model, allowInit } = await jsonObject(c);
       if (!goal) return c.json({ error: "goal is required" }, 400);
       const ws = workspace || c.req.query("workspace") || process.cwd();
       const queryRunners = c.req.query("runners");
@@ -1012,68 +1258,19 @@ function plansRoute(pool2) {
     const cancelled = pool2.cancelPlanning(c.req.param("sessionId"));
     return c.json({ cancelled });
   });
-  router.post("/:sessionId/tasks/:taskId/resume/cancel", async (c) => {
+  router.post("/:sessionId/execute-command", async (c) => {
     try {
-      const { message } = await runUserCommand(pool2.session(c.req.param("sessionId")), { command: "cancel_resume", task: c.req.param("taskId") });
-      return c.json({ cancelled: true, message });
-    } catch (err) {
-      return failure(c, err, "cancel resume");
-    }
-  });
-  for (const [segment, command] of [
-    ["run", (id) => ({ command: "run_task", task: id })],
-    ["retry", (id) => ({ command: "retry_task", task: id, from: "fresh" })],
-    ["cancel", (id) => ({ command: "stop_task", task: id })],
-    ["complete", (id) => ({ command: "mark_complete", task: id })],
-    ["uncomplete", (id) => ({ command: "mark_not_done", task: id })],
-    // The user says the limit has reset early: the task, and every other one waiting on its runner's reset, resumes in its saved session now.
-    ["resume/now", (id) => ({ command: "retry_task", task: id, from: "session" })],
-    ["interrupt", (id) => ({ command: "interrupt_task", task: id })]
-  ]) {
-    router.post(`/:sessionId/tasks/:taskId/${segment}`, async (c) => {
-      try {
-        const { message } = await runUserCommand(pool2.session(c.req.param("sessionId")), command(c.req.param("taskId")));
-        return c.json({ ok: true, message });
-      } catch (err) {
-        return failure(c, err, segment);
+      const parsed = core.parseExecutionCommand(await jsonObject(c));
+      if (!parsed.ok) return refuse(c, 400, parsed.message, "refused");
+      const outcome = await pool2.session(c.req.param("sessionId")).execute(parsed.command, { kind: "user" });
+      if (!outcome.ok) {
+        return c.json({ error: outcome.message, code: "refused", ...outcome.payload ? { payload: outcome.payload } : {} }, 400);
       }
-    });
-  }
-  router.post("/:sessionId/tasks/:taskId/skip", async (c) => {
-    try {
-      const body = await c.req.json().catch(() => ({}));
-      const reason = typeof body === "object" && body !== null && "reason" in body && typeof body.reason === "string" ? body.reason : void 0;
-      const { message } = await runUserCommand(pool2.session(c.req.param("sessionId")), { command: "skip_task", task: c.req.param("taskId"), ...reason ? { reason } : {} });
-      return c.json({ ok: true, message });
-    } catch (err) {
-      return failure(c, err, "skip");
-    }
-  });
-  router.post("/:sessionId/tasks/:taskId/force-start", async (c) => {
-    try {
-      const { message, payload } = await runUserCommand(pool2.session(c.req.param("sessionId")), { command: "force_start", task: c.req.param("taskId") });
-      return c.json({ ok: true, ...payload?.kind === "queued" ? { queued: payload.line } : {}, message });
-    } catch (err) {
-      return failure(c, err, "force-start");
-    }
-  });
-  const messageHandler = (send) => async (c) => {
-    try {
-      const body = await c.req.json().catch(() => ({}));
-      const text = typeof body === "object" && body !== null && "text" in body ? body.text : void 0;
-      if (typeof text !== "string" || !text.trim()) return c.json({ error: "text is required" }, 400);
-      const id = await send(pool2.session(c.req.param("sessionId")), c.req.param("taskId"), text);
-      return c.json({ id });
+      return c.json({ ok: true, message: outcome.message, ...outcome.payload ? { payload: outcome.payload } : {} });
     } catch (err) {
-      return failure(c, err, "task edit");
+      return failure(c, err, "execute-command");
     }
-  };
-  const sendMessage = (force) => messageHandler(async (session, taskId, text) => {
-    const { payload } = await runUserCommand(session, { command: "message_task", task: taskId, text, ...force ? { force } : {} });
-    return payload?.kind === "message" ? payload.id : "";
   });
-  router.post("/:sessionId/tasks/:taskId/messages", sendMessage(false));
-  router.post("/:sessionId/tasks/:taskId/messages/now", sendMessage(true));
   router.post("/:sessionId/tasks/:taskId/commands", async (c) => {
     try {
       const body = await c.req.json().catch(() => ({}));
@@ -1086,33 +1283,6 @@ function plansRoute(pool2) {
       return failure(c, err, "task edit");
     }
   });
-  router.post("/:sessionId/tasks/:taskId/messages/:messageId/now", async (c) => {
-    try {
-      const { message } = await runUserCommand(pool2.session(c.req.param("sessionId")), { command: "force_send_queued", task: c.req.param("taskId"), id: c.req.param("messageId") });
-      return c.json({ sent: true, message });
-    } catch (err) {
-      return failure(c, err, "task edit");
-    }
-  });
-  router.post("/:sessionId/tasks/:taskId/continue", async (c) => {
-    try {
-      const body = await c.req.json().catch(() => ({}));
-      const text = typeof body === "object" && body !== null && "text" in body ? body.text : void 0;
-      if (typeof text !== "string" || !text.trim()) return c.json({ error: "text is required" }, 400);
-      const { message } = await runUserCommand(pool2.session(c.req.param("sessionId")), { command: "retry_task", task: c.req.param("taskId"), from: "session", message: text });
-      return c.json({ ok: true, message });
-    } catch (err) {
-      return failure(c, err, "task edit");
-    }
-  });
-  router.delete("/:sessionId/tasks/:taskId/messages/:messageId", async (c) => {
-    try {
-      const { message } = await runUserCommand(pool2.session(c.req.param("sessionId")), { command: "remove_queued", task: c.req.param("taskId"), id: c.req.param("messageId") });
-      return c.json({ removed: true, message });
-    } catch (err) {
-      return failure(c, err, "task edit");
-    }
-  });
   for (const answer of ["approve", "reject"]) {
     router.post(`/:sessionId/tasks/:taskId/checkpoint/${answer}`, async (c) => {
       try {
@@ -1183,7 +1353,7 @@ function plansRoute(pool2) {
   });
   router.put("/:sessionId/tasks/:taskId", async (c) => {
     try {
-      const changes = await c.req.json();
+      const changes = await jsonObject(c);
       if (changes.assignedModel === null) changes.assignedModel = void 0;
       const result = await pool2.session(c.req.param("sessionId")).updateTask(c.req.param("taskId"), changes);
       if (!result) return refuse(c, 404, "Task not found", "task_not_found");
@@ -1203,7 +1373,7 @@ function plansRoute(pool2) {
   });
   router.post("/:sessionId/tasks", async (c) => {
     try {
-      const body = await c.req.json();
+      const body = await jsonObject(c);
       const result = await pool2.session(c.req.param("sessionId")).addTask(body);
       if (!result) return refuse(c, 404, "Session not found", "session_not_found");
       return c.json({ ok: true });
@@ -1222,29 +1392,9 @@ function plansRoute(pool2) {
       return failure(c, err, "review approve");
     }
   });
-  router.post("/:sessionId/tasks/merge", async (c) => {
-    try {
-      const { taskIds } = await c.req.json();
-      if (!taskIds || !Array.isArray(taskIds) || taskIds.length < 2) {
-        return c.json({ error: "taskIds array with at least two ids is required" }, 400);
-      }
-      const plan = await pool2.session(c.req.param("sessionId")).requestMerge(taskIds);
-      return c.json({ plan: core.surfacePlan(plan) });
-    } catch (err) {
-      return failure(c, err, "merge", { fallback: 400 });
-    }
-  });
-  router.post("/:sessionId/tasks/:taskId/split", async (c) => {
-    try {
-      const plan = await pool2.session(c.req.param("sessionId")).requestSplit(c.req.param("taskId"));
-      return c.json({ plan: core.surfacePlan(plan) });
-    } catch (err) {
-      return failure(c, err, "split", { fallback: 400 });
-    }
-  });
   router.post("/:sessionId/converse/start", async (c) => {
     try {
-      const { goal, runners, workspace, model, allowInit } = await c.req.json();
+      const { goal, runners, workspace, model, allowInit } = await jsonObject(c);
       if (!goal) return c.json({ error: "goal is required" }, 400);
       const ws = workspace || c.req.query("workspace") || process.cwd();
       const runnerList = Array.isArray(runners) ? runners : runners ? [runners] : void 0;
@@ -1256,7 +1406,7 @@ function plansRoute(pool2) {
   });
   router.post("/:sessionId/converse/message", async (c) => {
     try {
-      const { message } = await c.req.json();
+      const { message } = await jsonObject(c);
       if (!message) return c.json({ error: "message is required" }, 400);
       const plan = await pool2.continuePlanning(c.req.param("sessionId"), message);
       return c.json({ plan: core.surfacePlan(plan) });
@@ -1266,9 +1416,9 @@ function plansRoute(pool2) {
   });
   router.post("/:sessionId/converse/message/now", async (c) => {
     try {
-      const { message } = await c.req.json();
+      const { message } = await jsonObject(c);
       if (!message) return c.json({ error: "message is required" }, 400);
-      const plan = await pool2.session(c.req.param("sessionId")).forceSendPrompt(message);
+      const plan = await pool2.forceSendPrompt(c.req.param("sessionId"), message);
       return c.json({ plan: core.surfacePlan(plan) });
     } catch (err) {
       return failure(c, err, "conversation message");
@@ -1299,8 +1449,8 @@ function plansRoute(pool2) {
   });
   router.post("/:sessionId/conversation/rewind", async (c) => {
     try {
-      const { index } = await c.req.json();
-      if (!Number.isInteger(index) || index < 0) return c.json({ error: "index must be a non-negative integer" }, 400);
+      const { index } = await jsonObject(c);
+      if (typeof index !== "number" || !Number.isInteger(index) || index < 0) return c.json({ error: "index must be a non-negative integer" }, 400);
       const rewound = pool2.rewindConversation(c.req.param("sessionId"), index);
       return c.json({ ...rewound, plan: core.surfacePlan(rewound.plan) });
     } catch (err) {
@@ -1315,6 +1465,14 @@ function plansRoute(pool2) {
       return failure(c, err, "conversation edit");
     }
   });
+  router.post("/:sessionId/conversation/compact/retry", async (c) => {
+    try {
+      const plan = await pool2.retryPlannerCompaction(c.req.param("sessionId"));
+      return c.json({ plan: core.surfacePlan(plan) });
+    } catch (err) {
+      return failure(c, err, "retry compaction");
+    }
+  });
   router.get("/:sessionId/prd", (c) => {
     const plan = pool2.getPlan(c.req.param("sessionId"));
     if (!plan?.prdMarkdown) return refuse(c, 404, "No PRD found");
@@ -1325,7 +1483,7 @@ function plansRoute(pool2) {
 function runnersRoute(pool2) {
   const router = new hono.Hono();
   router.get("/", async (c) => {
-    const runners = await pool2.getInstalledRunners();
+    const runners = await pool2.getInstalledRunners(c.req.query("workspace"));
     const state = pool2.getRunnerState();
     return c.json({
       runners,
@@ -1333,11 +1491,16 @@ function runnersRoute(pool2) {
     });
   });
   router.put("/:id", async (c) => {
-    await core.installedPlannerDetected();
-    const id = c.req.param("id");
-    const body = await c.req.json();
-    pool2.setRunnerEnabled(id, body.enabled);
-    return c.json({ ok: true });
+    try {
+      await core.installedPlannerDetected();
+      const id = c.req.param("id");
+      const { enabled } = await jsonObject(c);
+      if (typeof enabled !== "boolean") return refuse(c, 400, "enabled must be true or false");
+      pool2.setRunnerEnabled(id, enabled);
+      return c.json({ ok: true });
+    } catch (err) {
+      return failure(c, err, "runner toggle", { fallback: 400 });
+    }
   });
   return router;
 }
@@ -1349,8 +1512,18 @@ function modelsRoute(pool2) {
   });
   return router;
 }
-function workspacesRoute() {
+function workspacesRoute(pool2) {
   const router = new hono.Hono();
+  router.get("/isolation-preview", async (c) => {
+    try {
+      const workspace = c.req.query("workspace") || process.cwd();
+      core.assertWorkspaceExists(workspace);
+      const preview = await pool2.previewIsolation(workspace);
+      return c.json({ preview });
+    } catch (err) {
+      return failure(c, err, "read isolation preview", { message: "Could not read the repositories" });
+    }
+  });
   router.get("/", (c) => {
     const workspaces = scanWorkspaces2();
     return c.json({ workspaces });
@@ -1399,28 +1572,33 @@ function settingsRoute(pool2) {
   const router = new hono.Hono();
   router.get("/", async (c) => {
     await core.installedPlannerDetected();
-    const settings = pool2.getSettings();
+    const settings = pool2.getSettings(c.req.query("sessionId") || void 0);
     return c.json(settings);
   });
   router.patch("/", async (c) => {
-    await core.installedPlannerDetected();
-    const body = await c.req.json();
-    if (!body || typeof body !== "object" || Array.isArray(body) || Object.keys(body).length === 0) {
-      return refuse(c, 400, "At least one setting field is required");
-    }
-    const { run: run2, sessionId, ...rest } = body;
-    if (run2 !== void 0) {
-      if (!run2 || typeof run2 !== "object" || Array.isArray(run2)) return refuse(c, 400, "run must be an object of run settings");
-      if (sessionId !== void 0 && typeof sessionId !== "string") return refuse(c, 400, "sessionId must be a string");
-      try {
-        pool2.updateRunSettings(run2, sessionId);
-      } catch (err) {
-        if (err instanceof core.RunSettingsError) return refuse(c, 400, err.message);
-        throw err;
+    try {
+      await core.installedPlannerDetected();
+      const body = await jsonObject(c);
+      if (Object.keys(body).length === 0) {
+        return refuse(c, 400, "At least one setting field is required");
+      }
+      const { run: run2, sessionId: namedSession, ...rest } = body;
+      if (namedSession !== void 0 && typeof namedSession !== "string") return refuse(c, 400, "sessionId must be a string");
+      const sessionId = namedSession || void 0;
+      if (run2 !== void 0) {
+        if (!run2 || typeof run2 !== "object" || Array.isArray(run2)) return refuse(c, 400, "run must be an object of run settings");
+        try {
+          pool2.updateRunSettings(run2, sessionId);
+        } catch (err) {
+          if (err instanceof core.RunSettingsError) return refuse(c, 400, err.message);
+          throw err;
+        }
       }
+      const result = Object.keys(rest).length > 0 ? sessionId ? pool2.updateSettings(rest, sessionId) : pool2.updateSettings(rest) : pool2.getSettings(sessionId);
+      return c.json(result);
+    } catch (err) {
+      return failure(c, err, "settings update", { fallback: 400 });
     }
-    const result = Object.keys(rest).length > 0 ? pool2.updateSettings(rest) : pool2.getSettings();
-    return c.json(result);
   });
   return router;
 }
@@ -1464,6 +1642,8 @@ function createWsHandler(pool2) {
         ...pool2.streamPosition(sessionId)
       }));
     }
+    const compaction = pool2.plannerCompaction(sessionId);
+    if (compaction) ws.send(JSON.stringify(compaction));
     pool2.subscribe(sessionId, ws);
   });
   return (request, socket, head) => {
@@ -1543,13 +1723,14 @@ function createApp(pool2, admission) {
     if (!decision.admit) return c.json({ error: decision.reason }, decision.status);
     await next();
   });
+  app.get("/api/server", (c) => c.json({ pid: process.pid, port: admission.port }));
   app.route("/api/sessions", sessionsRoute(pool2));
   app.route("/api/plans", plansRoute(pool2));
   app.route("/api/runners", runnersRoute(pool2));
   app.route("/api/models", modelsRoute(pool2));
   app.route("/api/settings", settingsRoute(pool2));
   app.route("/api/commands", commandsRoute());
-  app.route("/api/workspaces", workspacesRoute());
+  app.route("/api/workspaces", workspacesRoute(pool2));
   app.route("/api/approvals", approvalsRoute(pool2));
   return app;
 }
@@ -1589,11 +1770,77 @@ ${body}`
 }
 
 // server/nodeAdapter.ts
-function createRequestListener(app) {
+var MAX_BODY_BYTES = 10 * 1024 * 1024;
+var BodyTooLargeError = class extends Error {
+};
+function refuse2(req, res, status, message) {
+  const payload = JSON.stringify({ error: message });
+  res.writeHead(status, {
+    "Content-Type": "application/json",
+    "Content-Length": Buffer.byteLength(payload),
+    // Nothing more is read from this request, so its connection cannot be reused.
+    Connection: "close"
+  });
+  res.end(payload, () => req.destroy());
+}
+function readBody(req, max) {
+  return new Promise((resolve3, reject) => {
+    const chunks = [];
+    let size = 0;
+    const cleanup = () => {
+      req.off("data", onData);
+      req.off("end", onEnd);
+      req.off("error", onError);
+    };
+    const onData = (chunk) => {
+      size += chunk.length;
+      if (size > max) {
+        cleanup();
+        req.pause();
+        reject(new BodyTooLargeError());
+        return;
+      }
+      chunks.push(chunk);
+    };
+    const onEnd = () => {
+      cleanup();
+      resolve3(chunks.length > 0 ? Buffer.concat(chunks).toString() : void 0);
+    };
+    const onError = (err) => {
+      cleanup();
+      reject(err);
+    };
+    req.on("data", onData);
+    req.on("end", onEnd);
+    req.on("error", onError);
+  });
+}
+function createRequestListener(app, admission, maxBodyBytes = MAX_BODY_BYTES) {
   return async (req, res) => {
-    const bufs = [];
-    for await (const chunk of req) bufs.push(chunk);
-    const body = bufs.length > 0 ? Buffer.concat(bufs).toString() : void 0;
+    const decision = decideAdmission({
+      origin: req.headers.origin ?? null,
+      host: req.headers.host ?? null,
+      authorization: req.headers.authorization ?? null
+    }, admission);
+    if (!decision.admit) {
+      refuse2(req, res, decision.status, decision.reason);
+      return;
+    }
+    const declared = Number(req.headers["content-length"]);
+    if (Number.isFinite(declared) && declared > maxBodyBytes) {
+      refuse2(req, res, 413, `Request body must be at most ${maxBodyBytes} bytes.`);
+      return;
+    }
+    let body;
+    try {
+      body = await readBody(req, maxBodyBytes);
+    } catch (err) {
+      if (err instanceof BodyTooLargeError) {
+        refuse2(req, res, 413, `Request body must be at most ${maxBodyBytes} bytes.`);
+        return;
+      }
+      throw err;
+    }
     const url = `http://${req.headers.host || "localhost"}${req.url}`;
     const headers = new Headers();
     for (const [k, v] of Object.entries(req.headers)) {
@@ -1636,6 +1883,10 @@ if (portIdx !== -1 && args[portIdx + 1]) {
 }
 var watchParentIdx = args.indexOf("--watch-parent");
 var watchParentPid = watchParentIdx !== -1 ? parseInt(args[watchParentIdx + 1], 10) : void 0;
+var pidFileIdx = args.indexOf("--pid-file");
+var pidFile = pidFileIdx !== -1 ? args[pidFileIdx + 1] : void 0;
+var ownsPidFile = false;
+core.processLeaseHost().describe({ kind: "daemon", port, ...watchParentPid ? { ownerPid: watchParentPid } : {} });
 var pool = new OrchestratorPool({ runner: new core.StructuredRunner() });
 void pool.detectInstalledPlanner();
 var server = http.createServer();
@@ -1643,10 +1894,15 @@ var ownsToken = false;
 server.listen(port, "127.0.0.1", () => {
   const { token, file: tokenFile } = core.mintDaemonToken(port);
   ownsToken = true;
+  if (pidFile) {
+    fs.mkdirSync(path.dirname(pidFile), { recursive: true });
+    fs.writeFileSync(pidFile, String(process.pid), { mode: 384 });
+    ownsPidFile = true;
+  }
   const admission = { port, token, tokenFile };
   const app = createApp(pool, admission);
   app.get("/", (c) => c.json({ message: "Ordewell API", docs: "/api/workspaces" }));
-  server.on("request", createRequestListener(app));
+  server.on("request", createRequestListener(app, admission));
   attachWsHandler(server, pool, admission);
   pool.getProviderModels().catch((err) => {
     console.error(`[web] model discovery warmup failed: ${err?.message ?? err}`);
@@ -1655,6 +1911,12 @@ server.listen(port, "127.0.0.1", () => {
 });
 function shutdown() {
   if (ownsToken) core.clearDaemonToken(port);
+  if (ownsPidFile && pidFile) {
+    try {
+      fs.unlinkSync(pidFile);
+    } catch {
+    }
+  }
   pool.destroyAll();
   server.close();
   process.exit(0);
@@ -1663,7 +1925,7 @@ process.on("unhandledRejection", (reason) => {
   console.error(`[web] unhandled rejection: ${reason instanceof Error ? reason.stack ?? reason.message : String(reason)}`);
 });
 process.on("SIGINT", () => {
-  shutdown();
+  if (!watchParentPid) shutdown();
 });
 process.on("SIGTERM", () => {
   shutdown();