@ouro.bot/cli 0.1.0-alpha.727 → 0.1.0-alpha.728

package/dist/heart/daemon/cli-parse.js

@@ -118,6 +118,7 @@ function usage() {
         "  ouro link <agent> --friend <id> --provider <provider> --external-id <external-id>",
         "  ouro bluebubbles replay [--agent <name>] --message-guid <guid> [--event-type new-message|updated-message] [--json]",
         "  ouro bluebubbles context-smoke [--agent <name>] --message-guid <guid> [--persist] [--json]",
+        "  ouro bluebubbles host <install|status|repair|remove|collect> [--username <name> --uid <uid> --home <path>] [--request-id <id>] [--json]",
         "  ouro rsvp <doctor|incident|cutover|legacy-render|replay|config|habit|import-legacy|refresh|compare|smoke> ...",
         "  ouro friend list [--agent <name>]",
         "  ouro friend show <id> [--agent <name>]",
@@ -1543,6 +1544,7 @@ function parseMcpCommand(args) {
     if (sub === "doctor") {
         let socketOverride;
         let json = false;
+        let hostStallObserved = false;
         for (let i = 0; i < rest.length; i++) {
             if (rest[i] === "--socket") {
                 if (!rest[i + 1])
@@ -1554,6 +1556,10 @@ function parseMcpCommand(args) {
                 json = true;
                 continue;
             }
+            if (rest[i] === "--host-stall-observed") {
+                hostStallObserved = true;
+                continue;
+            }
             throw new Error(`Unknown mcp doctor flag: ${rest[i]}`);
         }
         if (!agent)
@@ -1563,6 +1569,7 @@ function parseMcpCommand(args) {
             agent,
             ...(socketOverride ? { socketOverride } : {}),
             ...(json ? { json: true } : {}),
+            ...(hostStallObserved ? { hostStallObserved: true } : {}),
         };
     }
     throw new Error(`Usage\n${usage()}`);
@@ -1751,6 +1758,62 @@ function parseMigrateToDeskCommand(args) {
 }
 function parseBlueBubblesCommand(args) {
     const subcommand = args[0];
+    if (subcommand === "host") {
+        const action = args[1];
+        const usageText = "Usage: ouro bluebubbles host <install|status|repair|remove|collect> [--username <name> --uid <uid> --home <path>] [--request-id <id>] [--json]";
+        if (action === "collect") {
+            let requestId;
+            let json = false;
+            for (let index = 2; index < args.length; index += 1) {
+                if (args[index] === "--request-id" && args[index + 1]) {
+                    requestId = args[++index];
+                }
+                else if (args[index] === "--json") {
+                    json = true;
+                }
+                else {
+                    throw new Error(usageText);
+                }
+            }
+            if (!requestId)
+                throw new Error(`${usageText}\ncollect requires --request-id <id>`);
+            return { kind: "bluebubbles.host.collect", requestId, ...(json ? { json: true } : {}) };
+        }
+        if (action !== "install" && action !== "status" && action !== "repair" && action !== "remove") {
+            throw new Error(usageText);
+        }
+        let username;
+        let uid;
+        let homeDir;
+        let json = false;
+        for (let index = 2; index < args.length; index += 1) {
+            const token = args[index];
+            if (token === "--username" && args[index + 1])
+                username = args[++index];
+            else if (token === "--uid" && args[index + 1]) {
+                const value = Number(args[++index]);
+                if (!Number.isInteger(value))
+                    throw new Error(`${usageText}\n--uid must be an integer`);
+                uid = value;
+            }
+            else if (token === "--home" && args[index + 1])
+                homeDir = args[++index];
+            else if (token === "--json")
+                json = true;
+            else
+                throw new Error(usageText);
+        }
+        const targetFields = [username, uid, homeDir].filter((value) => value !== undefined).length;
+        if (targetFields !== 0 && targetFields !== 3) {
+            throw new Error(`${usageText}\ncross-user setup requires --username, --uid, and --home together`);
+        }
+        return {
+            kind: "bluebubbles.host",
+            action,
+            ...(targetFields === 3 ? { target: { username: username, uid: uid, homeDir: homeDir } } : {}),
+            ...(json ? { json: true } : {}),
+        };
+    }
     if (subcommand !== "replay" && subcommand !== "context-smoke") {
         throw new Error(`Usage\n${usage()}`);
     }
@@ -2442,7 +2505,12 @@ function parseOuroCommand(args) {
     }
     if (head === "up") {
         const noRepair = args.includes("--no-repair");
-        return noRepair ? { kind: "daemon.up", noRepair: true } : { kind: "daemon.up" };
+        const latest = args.includes("--latest");
+        return {
+            kind: "daemon.up",
+            ...(noRepair ? { noRepair: true } : {}),
+            ...(latest ? { latest: true } : {}),
+        };
     }
     if (head === "dev") {
         const devArgs = args.slice(1);

package/dist/heart/daemon/cli-render.js

@@ -48,6 +48,7 @@ exports.buildStoppedStatusPayload = buildStoppedStatusPayload;
 exports.renderRollupStatusLine = renderRollupStatusLine;
 exports.daemonUnavailableStatusOutput = daemonUnavailableStatusOutput;
 exports.isDaemonUnavailableError = isDaemonUnavailableError;
+exports.isDaemonTimeoutError = isDaemonTimeoutError;
 exports.formatMcpResponse = formatMcpResponse;
 const path = __importStar(require("path"));
 const runtime_metadata_1 = require("./runtime-metadata");
@@ -746,6 +747,12 @@ function isDaemonUnavailableError(error) {
         : "";
     return code === "ENOENT" || code === "ECONNREFUSED";
 }
+function isDaemonTimeoutError(error) {
+    const code = typeof error === "object" && error !== null && "code" in error
+        ? String(error.code ?? "")
+        : "";
+    return code === "ETIMEDOUT";
+}
 function formatMcpResponse(command, response) {
     if (command.kind === "mcp.list") {
         const allTools = response.data;

package/dist/heart/daemon/doctor.js

@@ -24,6 +24,7 @@ exports.checkLifecycle = checkLifecycle;
 exports.runDoctorChecks = runDoctorChecks;
 const runtime_1 = require("../../nerves/runtime");
 const bluebubbles_health_diagnostics_1 = require("./bluebubbles-health-diagnostics");
+const webhook_registration_1 = require("../../senses/bluebubbles/webhook-registration");
 const freshness_1 = require("./freshness");
 const ouro_path_installer_1 = require("../versioning/ouro-path-installer");
 const runtime_credentials_1 = require("../runtime-credentials");
@@ -35,6 +36,8 @@ const config_1 = require("../../rsvp/config");
 const cutover_1 = require("../../rsvp/cutover");
 const diagnostics_1 = require("../../rsvp/diagnostics");
 const DEFAULT_BLUEBUBBLES_REQUEST_TIMEOUT_MS = 30_000;
+const DEFAULT_BLUEBUBBLES_PORT = 18_790;
+const DEFAULT_BLUEBUBBLES_WEBHOOK_PATH = "/bluebubbles-webhook";
 // ── Category checkers ──
 function checkCliPath(deps) {
     const resolution = (0, ouro_path_installer_1.diagnoseOuroPath)({
@@ -412,10 +415,11 @@ async function checkSenses(deps) {
                 });
                 let upstreamContext = "upstream probe not run in this pass";
                 if (deps.fetchImpl) {
+                    const requestTimeoutMs = numberField(bluebubblesChannel, "requestTimeoutMs", DEFAULT_BLUEBUBBLES_REQUEST_TIMEOUT_MS);
                     const probe = await (0, bluebubbles_health_diagnostics_1.probeBlueBubblesHealth)({
                         serverUrl,
                         password,
-                        requestTimeoutMs: numberField(bluebubblesChannel, "requestTimeoutMs", DEFAULT_BLUEBUBBLES_REQUEST_TIMEOUT_MS),
+                        requestTimeoutMs,
                         fetchImpl: deps.fetchImpl,
                     });
                     checks.push({
@@ -426,6 +430,22 @@ async function checkSenses(deps) {
                     upstreamContext = probe.ok
                         ? "upstream probe reachable — which does not prove inbound delivery"
                         : "upstream probe failing";
+                    const webhook = await (0, webhook_registration_1.inspectBlueBubblesWebhookRegistration)({
+                        serverUrl,
+                        password,
+                        callbackPort: numberField(bluebubblesChannel, "port", DEFAULT_BLUEBUBBLES_PORT),
+                        callbackPath: textField(bluebubblesChannel, "webhookPath") || DEFAULT_BLUEBUBBLES_WEBHOOK_PATH,
+                        agentName,
+                        machineId,
+                        requestTimeoutMs,
+                        listenerReady: true,
+                    }, { fetchImpl: deps.fetchImpl });
+                    checks.push({
+                        id: "senses.bluebubbles.webhook",
+                        label: `${agentDir} bluebubbles webhook`,
+                        status: webhook.ok ? "pass" : "fail",
+                        detail: webhook.detail,
+                    });
                 }
                 const bluebubblesStateRoot = `${deps.bundlesRoot}/${agentDir}/state/senses/bluebubbles`;
                 checks.push(senseInboundDeliveryCheck({

package/dist/heart/daemon/mcp-canary.js

@@ -33,7 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_CANARY_TIMEOUT_MS = void 0;
+exports.SETUP_CANARY_TIMEOUT_MS = exports.DEFAULT_CANARY_TIMEOUT_MS = void 0;
+exports.classifyMcpBoundary = classifyMcpBoundary;
+exports.sanitizeMcpCanaryText = sanitizeMcpCanaryText;
+exports.sanitizeMcpCanaryArgs = sanitizeMcpCanaryArgs;
 exports.buildMcpBridgeRepairGuidance = buildMcpBridgeRepairGuidance;
 exports.formatMcpBridgeRepairDetails = formatMcpBridgeRepairDetails;
 exports.buildMcpDoctorNextSteps = buildMcpDoctorNextSteps;
@@ -47,7 +50,40 @@ const child_process_1 = require("child_process");
 const path = __importStar(require("path"));
 const runtime_1 = require("../../nerves/runtime");
 exports.DEFAULT_CANARY_TIMEOUT_MS = 60_000;
+exports.SETUP_CANARY_TIMEOUT_MS = 10_000;
 const MCP_PROTOCOL_VERSION = "2024-11-05";
+function classifyMcpBoundary(input) {
+    if (!input.bridgeHealthy)
+        return "ouro-bridge-failed";
+    return input.hostStallObserved ? "host-stall-unexplained" : "ouro-bridge-healthy-at-capture";
+}
+function sanitizeMcpCanaryText(text) {
+    return text
+        .replace(/(https?:\/\/[^\s?]+)\?[^\s]*/g, "$1?[redacted]")
+        .replace(/"(?:password|token|secret|api[_-]?key)"\s*:\s*"[^"]*"/gi, '"credential":"[redacted]"')
+        .replace(/\bBearer\s+[^\s]+/gi, "Bearer [redacted]")
+        .replace(/--(?:password|token|secret|api[_-]?key)(\s+|=)[^\s]+/gi, "--credential$1[redacted]")
+        .replace(/\b(?:password|token|secret|api[_-]?key)=([^\s]+)/gi, "credential=[redacted]")
+        .trim();
+}
+function sanitizeMcpCanaryArgs(args) {
+    const sanitized = [];
+    let redactNext = false;
+    for (const arg of args) {
+        if (redactNext) {
+            sanitized.push("[redacted]");
+            redactNext = false;
+            continue;
+        }
+        if (/^--(?:password|token|secret|api[_-]?key)$/i.test(arg)) {
+            sanitized.push("--credential");
+            redactNext = true;
+            continue;
+        }
+        sanitized.push(sanitizeMcpCanaryText(arg));
+    }
+    return sanitized;
+}
 function defaultCommandArgs(agent, socketPath) {
     const entryPath = path.join(__dirname, "ouro-bot-entry.js");
     return [
@@ -58,18 +94,32 @@ function defaultCommandArgs(agent, socketPath) {
         ...(socketPath ? ["--socket", socketPath] : []),
     ];
 }
-function responseText(response) {
-    const result = response.result;
-    if (!result || typeof result !== "object" || Array.isArray(result))
-        return JSON.stringify(response);
-    const content = result.content;
-    if (!Array.isArray(content))
-        return JSON.stringify(response);
-    const first = content[0];
-    if (!first || typeof first !== "object" || Array.isArray(first))
-        return JSON.stringify(response);
-    const text = first.text;
-    return typeof text === "string" ? text : JSON.stringify(response);
+function isRecord(value) {
+    return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function requireInitializeResult(response) {
+    if (!isRecord(response.result)) {
+        throw new Error("MCP canary received invalid initialize result");
+    }
+}
+function requireStatusText(response) {
+    if (!isRecord(response.result)) {
+        throw new Error("MCP canary received invalid status result");
+    }
+    if (response.result.isError === true) {
+        const errorContent = response.result.content;
+        const errorFirst = Array.isArray(errorContent) ? errorContent[0] : undefined;
+        const errorText = isRecord(errorFirst) && typeof errorFirst.text === "string"
+            ? errorFirst.text
+            : "MCP status tool returned an error";
+        throw new Error(errorText);
+    }
+    const content = response.result.content;
+    const first = Array.isArray(content) ? content[0] : undefined;
+    if (!isRecord(first) || typeof first.text !== "string") {
+        throw new Error("MCP canary received invalid status result");
+    }
+    return first.text;
 }
 function parseFields(line) {
     const parsed = {};
@@ -214,7 +264,23 @@ function validateMcpStatus(parsed, requiredSenses, options = {}) {
     };
 }
 async function runMcpStatusCanary(options) {
+    const startedAt = Date.now();
     const timeoutMs = options.timeoutMs ?? exports.DEFAULT_CANARY_TIMEOUT_MS;
+    const deadlineAt = startedAt + timeoutMs;
+    const evidence = {
+        capturedAt: new Date(startedAt).toISOString(),
+        durationMs: 0,
+        childPid: null,
+        phase: "spawn",
+        exitCode: null,
+        exitSignal: null,
+        stderr: "",
+    };
+    const decorate = (result, bridgeHealthy = false) => ({
+        ...result,
+        classification: classifyMcpBoundary({ bridgeHealthy, hostStallObserved: options.hostStallObserved === true }),
+        evidence,
+    });
     /* v8 ignore next -- default spawn is exercised by live canaries, while unit tests inject a fake child @preserve */
     const spawnImpl = options.spawnImpl ?? child_process_1.spawn;
     const command = options.command ?? process.execPath;
@@ -227,17 +293,38 @@ async function runMcpStatusCanary(options) {
         meta: {
             agent: options.agent,
             command,
-            commandArgs,
+            commandArgs: sanitizeMcpCanaryArgs(commandArgs),
             timeoutMs,
             requiredSenses,
             ignoreOverviewHealth: options.ignoreOverviewHealth === true,
             ignoreSenseHealth: options.ignoreSenseHealth === true,
         },
     });
-    const child = spawnImpl(command, commandArgs, { stdio: ["pipe", "pipe", "pipe"] });
+    let child;
+    try {
+        child = spawnImpl(command, commandArgs, { stdio: ["pipe", "pipe", "pipe"] });
+        evidence.childPid = child.pid ?? null;
+    }
+    catch (error) {
+        const reason = sanitizeMcpCanaryText(error instanceof Error ? error.message : String(error));
+        evidence.durationMs = Date.now() - startedAt;
+        (0, runtime_1.emitNervesEvent)({
+            component: "daemon",
+            event: "daemon.mcp_canary_error",
+            level: "error",
+            message: "MCP status canary failed to spawn",
+            meta: { agent: options.agent, reason },
+        });
+        return decorate({ ok: false, summary: `mcp canary failed: ${reason}`, details: [reason] });
+    }
     let buffer = "";
     let stderr = "";
     const pending = new Map();
+    let resolveExit;
+    const exitObserved = new Promise((resolve) => { resolveExit = resolve; });
+    function safeStderr() {
+        return sanitizeMcpCanaryText(stderr);
+    }
     function cleanup() {
         for (const [, request] of pending) {
             clearTimeout(request.timer);
@@ -268,14 +355,19 @@ async function runMcpStatusCanary(options) {
             buffer = buffer.slice(idx + 1);
             if (!line)
                 continue;
-            let response;
+            let parsedResponse;
             try {
-                response = JSON.parse(line);
+                parsedResponse = JSON.parse(line);
             }
             catch {
                 failAll(new Error(`MCP canary received malformed JSON: ${line}`));
                 return;
             }
+            if (!isRecord(parsedResponse)) {
+                failAll(new Error("MCP canary received malformed JSON-RPC response"));
+                return;
+            }
+            const response = parsedResponse;
             const id = typeof response.id === "number" ? response.id : null;
             if (id === null)
                 continue;
@@ -284,14 +376,27 @@ async function runMcpStatusCanary(options) {
                 continue;
             pending.delete(id);
             clearTimeout(request.timer);
+            const hasResult = Object.prototype.hasOwnProperty.call(response, "result");
+            const hasError = Object.prototype.hasOwnProperty.call(response, "error");
+            if (response.jsonrpc !== "2.0" || (!hasResult && !hasError)) {
+                request.reject(new Error("MCP canary received malformed JSON-RPC response"));
+                continue;
+            }
+            if (hasError) {
+                request.reject(new Error(`MCP canary received JSON-RPC error: ${JSON.stringify(response.error)}`));
+                continue;
+            }
             request.resolve(response);
         }
     });
     child.on("error", (error) => failAll(error));
     child.on("close", (code, signal) => {
+        evidence.exitCode = code;
+        evidence.exitSignal = signal;
+        resolveExit();
         if (pending.size === 0)
             return;
-        failAll(new Error(`MCP canary process closed before response code=${code} signal=${signal ?? "none"} stderr=${stderr.trim()}`));
+        failAll(new Error(`MCP canary process closed before response code=${code} signal=${signal ?? "none"} stderr=${safeStderr()}`));
     });
     let nextId = 1;
     function request(method, params) {
@@ -300,36 +405,43 @@ async function runMcpStatusCanary(options) {
                 reject(new Error("MCP canary stdin is not writable"));
                 return;
             }
+            const remainingMs = deadlineAt - Date.now();
+            if (remainingMs <= 0) {
+                reject(new Error(`MCP canary timed out waiting for ${method}; stderr=${safeStderr()}`));
+                return;
+            }
             const id = nextId++;
             const timer = setTimeout(() => {
                 pending.delete(id);
-                reject(new Error(`MCP canary timed out waiting for ${method}; stderr=${stderr.trim()}`));
-            }, timeoutMs);
+                reject(new Error(`MCP canary timed out waiting for ${method}; stderr=${safeStderr()}`));
+            }, remainingMs);
             pending.set(id, { resolve, reject, timer });
             child.stdin.write(JSON.stringify({ jsonrpc: "2.0", id, method, params }) + "\n");
         });
     }
     try {
-        await request("initialize", {
+        evidence.phase = "initialize";
+        const initializeResponse = await request("initialize", {
             protocolVersion: MCP_PROTOCOL_VERSION,
             capabilities: {},
             clientInfo: { name: "ouro-mcp-canary", version: "1.0" },
         });
+        requireInitializeResult(initializeResponse);
         child.stdin?.write(JSON.stringify({ jsonrpc: "2.0", method: "initialized" }) + "\n");
+        evidence.phase = "status";
         const statusResponse = await request("tools/call", {
             name: "status",
             arguments: {},
         });
-        const result = statusResponse.result;
-        if (result && typeof result === "object" && !Array.isArray(result) && result.isError === true) {
-            throw new Error(responseText(statusResponse));
-        }
-        const parsed = parseMcpStatusText(responseText(statusResponse));
+        const statusText = requireStatusText(statusResponse);
+        const bridgeHealthy = true;
+        const parsed = parseMcpStatusText(sanitizeMcpCanaryText(statusText));
         const canary = validateMcpStatus(parsed, requiredSenses, {
             agent: options.agent,
             ignoreOverviewHealth: options.ignoreOverviewHealth,
             ignoreSenseHealth: options.ignoreSenseHealth,
         });
+        evidence.phase = "complete";
         (0, runtime_1.emitNervesEvent)({
             component: "daemon",
             event: canary.ok ? "daemon.mcp_canary_end" : "daemon.mcp_canary_error",
@@ -337,10 +449,10 @@ async function runMcpStatusCanary(options) {
             message: canary.summary,
             meta: { agent: options.agent, ok: canary.ok },
         });
-        return canary;
+        return decorate(canary, bridgeHealthy);
     }
     catch (error) {
-        const reason = error instanceof Error ? error.message : String(error);
+        const reason = sanitizeMcpCanaryText(error instanceof Error ? error.message : String(error));
         (0, runtime_1.emitNervesEvent)({
             component: "daemon",
             event: "daemon.mcp_canary_error",
@@ -348,16 +460,30 @@ async function runMcpStatusCanary(options) {
             message: "MCP status canary failed",
             meta: { agent: options.agent, reason },
         });
-        return { ok: false, summary: `mcp canary failed: ${reason}`, details: [reason] };
+        return decorate({ ok: false, summary: `mcp canary failed: ${reason}`, details: [reason] });
     }
     finally {
         child.stdin?.end();
         cleanup();
+        let exitTimer;
+        const remainingExitWaitMs = Math.min(100, Math.max(0, deadlineAt - Date.now()));
+        await Promise.race([
+            exitObserved,
+            new Promise((resolve) => { exitTimer = setTimeout(resolve, remainingExitWaitMs); }),
+        ]);
+        clearTimeout(exitTimer);
+        evidence.stderr = safeStderr();
+        evidence.durationMs = Date.now() - startedAt;
     }
 }
 function formatMcpStatusCanaryResult(result) {
     return [
         result.ok ? "mcp canary: ok" : "mcp canary: failed",
+        ...(result.classification ? [`classification: ${result.classification}`] : []),
+        ...(result.evidence ? [
+            `captured=${result.evidence.capturedAt} durationMs=${result.evidence.durationMs} childPid=${result.evidence.childPid ?? "none"} phase=${result.evidence.phase} exitCode=${result.evidence.exitCode ?? "none"} exitSignal=${result.evidence.exitSignal ?? "none"}`,
+            ...(result.evidence.stderr ? [`stderr=${result.evidence.stderr}`] : []),
+        ] : []),
         result.summary,
         ...result.details.map((line) => `  ${line}`),
     ].join("\n");
@@ -368,6 +494,11 @@ function formatMcpStatusDoctorResult(result, agent) {
         && !line.startsWith("verify command="));
     const lines = [
         result.ok ? "mcp doctor: ok" : "mcp doctor: failed",
+        ...(result.classification ? [`classification: ${result.classification}`] : []),
+        ...(result.evidence ? [
+            `captured=${result.evidence.capturedAt} durationMs=${result.evidence.durationMs} childPid=${result.evidence.childPid ?? "none"} phase=${result.evidence.phase} exitCode=${result.evidence.exitCode ?? "none"} exitSignal=${result.evidence.exitSignal ?? "none"}`,
+            ...(result.evidence.stderr ? [`stderr=${result.evidence.stderr}`] : []),
+        ] : []),
         result.summary,
         ...rawDetails.map((line) => `  ${line}`),
     ];

package/dist/heart/daemon/socket-client.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_DAEMON_COMMAND_TIMEOUT_MS = exports.DEFAULT_DAEMON_SOCKET_PATH = void 0;
+exports.DEFAULT_DAEMON_STATUS_TIMEOUT_MS = exports.DEFAULT_DAEMON_COMMAND_TIMEOUT_MS = exports.DEFAULT_DAEMON_SOCKET_PATH = void 0;
 exports.__bypassVitestGuardForTests = __bypassVitestGuardForTests;
 exports.sendDaemonCommand = sendDaemonCommand;
 exports.checkDaemonSocketAlive = checkDaemonSocketAlive;
@@ -44,6 +44,7 @@ const net = __importStar(require("net"));
 const runtime_1 = require("../../nerves/runtime");
 exports.DEFAULT_DAEMON_SOCKET_PATH = "/tmp/ouroboros-daemon.sock";
 exports.DEFAULT_DAEMON_COMMAND_TIMEOUT_MS = 10 * 60 * 1000;
+exports.DEFAULT_DAEMON_STATUS_TIMEOUT_MS = 5_000;
 /**
  * Defense-in-depth: detect if we're running under vitest. Tests that forget
  * to `vi.mock("../../heart/daemon/socket-client")` would otherwise leak real
@@ -130,11 +131,16 @@ function sendDaemonCommand(socketPath, command, options = {}) {
         let raw = "";
         let settled = false;
         const timeoutMs = options.timeoutMs ?? exports.DEFAULT_DAEMON_COMMAND_TIMEOUT_MS;
+        let deadlineTimer;
+        const clearDeadline = () => {
+            clearTimeout(deadlineTimer);
+        };
         const resolveOnce = (response) => {
             /* v8 ignore next -- duplicate settlement guard; callers also guard event handlers before reaching this helper @preserve */
             if (settled)
                 return;
             settled = true;
+            clearDeadline();
             resolve(response);
         };
         const rejectOnce = (error) => {
@@ -142,27 +148,30 @@ function sendDaemonCommand(socketPath, command, options = {}) {
             if (settled)
                 return;
             settled = true;
+            clearDeadline();
             reject(error);
         };
-        if ("setTimeout" in client && typeof client.setTimeout === "function") {
-            client.setTimeout(timeoutMs, () => {
-                const error = new Error(`Daemon command ${command.kind} timed out after ${timeoutMs}ms waiting for a response.`);
-                (0, runtime_1.emitNervesEvent)({
-                    level: "error",
-                    component: "daemon",
-                    event: "daemon.socket_command_timeout",
-                    message: "daemon socket command timed out",
-                    meta: {
-                        socketPath,
-                        kind: command.kind,
-                        timeoutMs,
-                        error: error.message,
-                    },
-                });
-                client.destroy();
-                rejectOnce(error);
+        deadlineTimer = setTimeout(() => {
+            /* v8 ignore next -- terminal socket events clear this timer; guard protects a queued timer callback race @preserve */
+            if (settled)
+                return;
+            const error = new Error(`Daemon command ${command.kind} timed out after ${timeoutMs}ms waiting for a response.`);
+            error.code = "ETIMEDOUT";
+            (0, runtime_1.emitNervesEvent)({
+                level: "error",
+                component: "daemon",
+                event: "daemon.socket_command_timeout",
+                message: "daemon socket command timed out",
+                meta: {
+                    socketPath,
+                    kind: command.kind,
+                    timeoutMs,
+                    error: error.message,
+                },
             });
-        }
+            client.destroy();
+            rejectOnce(error);
+        }, timeoutMs);
         client.on("connect", () => {
             // Write the command + newline delimiter. DO NOT call client.end()
             // afterwards — the server closes the connection once it has written