@ravefox/space 0.2.0 → 0.3.0

package/src/lib/daemon-service.js

@@ -1,486 +0,0 @@
-/**
- * ADR-026 D1: install-once service registration for the resident daemon.
- *
- * macOS gets a launchd LaunchAgent, Linux a systemd user unit, Windows a
- * per-user Task Scheduler task (daemon-service-windows.js). All three run the
- * exact interpreter + CLI entry that executed `daemon install`, resolved at
- * install time — a PATH lookup at boot would race version managers and
- * silently run a different install than the one the user tested.
- *
- * Pure generators + injected side effects, same discipline as the
- * supervisor: the unit CONTENT is unit-testable without touching launchctl.
- */
-
-import { randomBytes } from 'crypto';
-import { existsSync, realpathSync, renameSync, unlinkSync, writeFileSync } from 'fs';
-import { homedir, userInfo } from 'os';
-import { basename, join, dirname, resolve } from 'path';
-import {
-  WINDOWS_TASK_NAME, installWindowsService, uninstallWindowsService, windowsServiceAction, windowsServicePaths,
-} from './daemon-service-windows.js';
-import { CLI } from './cli-hint.js';
-
-export const LAUNCHD_LABEL = 'me.commonly.daemon';
-export const SYSTEMD_UNIT = 'commonly-daemon.service';
-
-export const daemonLogPath = (home = homedir()) => join(home, '.commonly', 'logs', 'daemon', 'daemon.log');
-
-export const servicePaths = (platform = process.platform, home = homedir()) => {
-  if (platform === 'darwin') return { kind: 'launchd', file: join(home, 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`) };
-  if (platform === 'win32') return windowsServicePaths(home);
-  return { kind: 'systemd', file: join(home, '.config', 'systemd', 'user', SYSTEMD_UNIT) };
-};
-
-const xmlEscape = (value) => String(value)
-  .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
-
-// The systemd sink is NOT the plist sink, so escaping one is not escaping both.
-// Inside `Environment="…"` a raw `"` closes the quote, and a raw newline ends
-// the assignment so the remainder of the key lands in the unit as a directive.
-// The adversary here is the operator's own environment, so severity is low —
-// but correctness does not need an adversary: a provider key containing a `"`
-// writes a unit that will not start, with nothing on screen to say why.
-// systemd quoted values carry C-style escapes (systemd.syntax(7)), so both
-// values are escaped and neither sink is trusted to be the harmless one. The
-// last replacement is the least obvious: `Environment=` does NOT expand `$VAR`
-// but DOES perform specifier expansion (systemd.exec(5), "Specifier expansion is
-// performed"), and `systemd.unit(5)` gives the escape — `%%` in place of `%`.
-// A key containing `%h` would otherwise be rewritten to the home directory: the
-// unit parses, the daemon starts, the seat gets a key nobody exported, and it
-// fails at the provider with nothing at daemon level naming the cause — the same
-// failure class this code exists to remove, arriving through the escaping.
-const systemdEscape = (value) => String(value)
-  .replace(/%/g, '%%')
-  .replace(/\\/g, '\\\\')
-  .replace(/"/g, '\\"')
-  .replace(/\n/g, '\\n')
-  .replace(/\r/g, '\\r')
-  .replace(/\t/g, '\\t');
-
-// PATH matters for the CHILDREN: the daemon spawns `commonly agent run`,
-// which spawns the user's claude/codex CLI by name. launchd's default PATH
-// has no /opt/homebrew/bin, so without this the daemon comes up and every
-// seat dies at adapter detection.
-const childPath = (nodePath) => [
-  dirname(nodePath), '/opt/homebrew/bin', '/usr/local/bin', '/usr/bin', '/bin',
-].filter((entry, index, all) => all.indexOf(entry) === index).join(':');
-
-// TASK-049: PATH is not the only thing the children need.
-//
-// launchd and systemd both start the daemon from a CLEAN environment, so a
-// seat's provider key that exists only in the operator's interactive shell is
-// absent at boot — and the seat then dies inside its own adapter (`pi.js`
-// throws `COMMONLY_LITELLM_KEY is not set`). That is the same defect the PATH
-// line above fixes, one layer over, and it is fixed the same way: carry what
-// the install could see. Installation is the ONLY moment the operator's shell is
-// in reach, so the keys are captured there, and the ones that were missing are
-// named at install time rather than discovered one crash-looping seat at a time.
-//
-// The values are secrets. The daemon's own credential is a 0600 file, so the
-// service file is written 0600 too instead of being left at the umask default a
-// PATH-only unit could safely keep.
-//
-// The mode is guaranteed BY CONSTRUCTION rather than by the order of two calls:
-// the content is written to a sibling temp file CREATED 0600 and then renamed
-// over the target. `writeFileSync`'s mode applies only at creation, so the
-// obvious alternatives each leave a path open — a write straight to the target
-// cannot narrow a file an EARLIER install left at 0644 (its mode survives the
-// write, and a pre-existing 0644 service file is what every upgrade meets),
-// and a chmod after the write closes the door the key already walked through.
-// The rename also removes a second hazard, narrower than it first looks: systemd
-// does NOT re-read a changed unit by itself — it reports the file as changed on
-// disk and keeps the loaded copy until a `systemctl --user daemon-reload`. What
-// is exposed is a reader CONCURRENT with the write, and that is not exotic here:
-// an install ends by running `daemon-reload`, every other install on the machine
-// can run one at the same moment, and `systemctl --user show` reads the file.
-// After a rename each of them sees the old file or the new one, never a
-// truncated unit.
-//
-// POSIX rename replaces the destination atomically, so this needs no
-// chmod-if-exists dance and no cleanup of the old file.
-//
-// The temp NAME and the temp WRITE are each half of the same defence, and
-// neither is sufficient on its own. A predictable name (`<file>.tmp-<pid>`) lets
-// a process running as this user — which is every seat this repo spawns —
-// pre-plant a symlink at that path and capture the key when the write follows
-// it; `O_EXCL` is what actually refuses that, because it fails on a symlink at
-// the final component instead of writing through it. The random suffix only
-// removes the easy target, and the cleanup only deletes a temp this call made.
-export const SERVICE_FILE_MODE = 0o600;
-
-// Exported so the O_EXCL refusal is witnessed against a real symlink at a known
-// path rather than assumed from the absence of a race.
-export const serviceTempPath = (file, suffix = randomBytes(6).toString('hex')) => `${file}.tmp-${suffix}`;
-
-export const writeServiceFile = (file, content, { suffix } = {}) => {
-  const tmp = serviceTempPath(file, suffix);
-  let created = false;
-  try {
-    // `wx` = O_CREAT|O_EXCL: the write either creates the temp itself or does not
-    // happen at all, so a planted path is refused rather than followed.
-    writeFileSync(tmp, content, { encoding: 'utf8', mode: SERVICE_FILE_MODE, flag: 'wx' });
-    created = true;
-    renameSync(tmp, file);
-  } catch (error) {
-    // Only the temp this call created is ours to remove. After a refused write
-    // the path belongs to whoever planted it.
-    if (created) {
-      try {
-        unlinkSync(tmp);
-      } catch {
-        // Nothing to clean up; the original error is the one that matters.
-      }
-    }
-    throw error;
-  }
-};
-export const providerEnvPairs = ({ names = [], env = process.env } = {}) => names
-  .filter((name) => env[name])
-  .map((name) => [name, String(env[name])]);
-
-export const missingProviderKeys = ({ names = [], env = process.env } = {}) => names
-  .filter((name) => !env[name]);
-
-const plistEnvPairs = (pairs) => pairs
-  .map(([name, value]) => `\t\t<key>${xmlEscape(name)}</key>\n\t\t<string>${xmlEscape(value)}</string>\n`)
-  .join('');
-
-export const launchdPlist = ({ nodePath, cliPath, home = homedir(), providerEnv = [] }) => `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-\t<key>Label</key>
-\t<string>${LAUNCHD_LABEL}</string>
-\t<key>EnvironmentVariables</key>
-\t<dict>
-\t\t<key>PATH</key>
-\t\t<string>${xmlEscape(childPath(nodePath))}</string>
-\t\t<key>HOME</key>
-\t\t<string>${xmlEscape(home)}</string>
-${plistEnvPairs(providerEnv)}\t</dict>
-\t<key>ProgramArguments</key>
-\t<array>
-\t\t<string>${xmlEscape(nodePath)}</string>
-\t\t<string>${xmlEscape(cliPath)}</string>
-\t\t<string>daemon</string>
-\t\t<string>run</string>
-\t\t<string>--foreground</string>
-\t</array>
-\t<key>RunAtLoad</key>
-\t<true/>
-\t<key>KeepAlive</key>
-\t<dict>
-\t\t<key>SuccessfulExit</key>
-\t\t<false/>
-\t</dict>
-\t<key>StandardOutPath</key>
-\t<string>${xmlEscape(daemonLogPath(home))}</string>
-\t<key>StandardErrorPath</key>
-\t<string>${xmlEscape(daemonLogPath(home))}</string>
-</dict>
-</plist>
-`;
-
-export const systemdUnit = ({ nodePath, cliPath, providerEnv = [] }) => {
-  const providerLines = providerEnv.length
-    ? `\n${providerEnv.map(([name, value]) => `Environment="${systemdEscape(`${name}=${value}`)}"`).join('\n')}`
-    : '';
-  return `[Unit]
-Description=Space local agent daemon (ADR-026)
-After=network-online.target
-
-[Service]
-ExecStart=${nodePath} ${cliPath} daemon run --foreground
-Restart=always
-RestartPreventExitStatus=77 78
-RestartSec=5
-Environment=PATH=${childPath(nodePath)}${providerLines}
-
-[Install]
-WantedBy=default.target
-`;
-};
-
-// D171: a systemd user unit is started by the user's own systemd manager, and
-// without lingering that manager starts at the user's login, not at boot. On a
-// headless box nobody logs in to, the daemon would then stay down after every
-// reboot. logind records lingering as one file per user, so that file is what
-// says the daemon starts at boot, not the exit code of the call that asked.
-// logind names the file cescape(user name) (src/basic/escape.c): the named
-// escapes, and octal for any other byte below a space or from 127 up.
-const NAMED_ESCAPES = {
-  7: 'a', 8: 'b', 12: 'f', 10: 'n', 13: 'r', 9: 't', 11: 'v', 92: '\\', 34: '"', 39: "'",
-};
-const cescape = (value) => [...Buffer.from(value, 'utf8')].map((byte) => {
-  if (NAMED_ESCAPES[byte]) return `\\${NAMED_ESCAPES[byte]}`;
-  if (byte < 32 || byte >= 127) return `\\${byte.toString(8).padStart(3, '0')}`;
-  return String.fromCharCode(byte);
-}).join('');
-export const lingerFile = (username) => join('/var/lib/systemd/linger', cescape(username));
-
-// The command is printed for a person to paste into a shell, so a user name the
-// shell would split or expand is single-quoted. The call above it takes argv.
-const shellWord = (value) => (/^[A-Za-z0-9._@%+=:,/-]+$/.test(value)
-  ? value : `'${value.replace(/'/g, "'\\''")}'`);
-
-// logind before v253 passes the escaped file name to manager_add_user_by_name at
-// boot, so it never starts a user whose name needs escaping. The version isn't read,
-// so for such a name the file alone doesn't prove a boot start.
-const lingeringStartsAtBoot = (username, warn) => {
-  if (cescape(username) === username) return true;
-  warn(`Lingering is on for ${username}, but systemd before v253 cannot start a user whose name needs escaping at boot, so the daemon is only sure to start when ${username} logs in.`);
-  return false;
-};
-
-const ensureLinger = async ({ username, existsFile, execCmd, warn }) => {
-  if (existsFile(lingerFile(username))) return lingeringStartsAtBoot(username, warn);
-  let failure = '';
-  try {
-    // --no-ask-password: the install must not stop at a polkit prompt; a refusal
-    // is answered below with the command to run instead.
-    await execCmd(['loginctl', '--no-ask-password', 'enable-linger', username]);
-  } catch (error) {
-    failure = ` (${error.message})`;
-  }
-  if (existsFile(lingerFile(username))) return lingeringStartsAtBoot(username, warn);
-  warn(`Lingering is off for ${username}${failure}, so the daemon starts when ${username} logs in, not at boot. On a machine nobody logs in to, it stays down after a reboot. To start it at boot, run: sudo loginctl enable-linger ${shellWord(username)}`);
-  return false;
-};
-
-// The line the install command ends with. "Survives reboots" is said only when
-// the service starts at boot: a LaunchAgent, like a systemd user unit without
-// lingering, starts at login.
-// A launchd label, a systemd user unit and a scheduled-task name are one per OS
-// user, not one per HOME. Without this check a second Commonly account's
-// install on the same computer account unloaded the first account's running
-// daemon and loaded its own under the same name, and nothing said so (Growth's
-// F370 walk). So install first asks the service manager which file the live
-// service came from, and goes ahead only when it is this HOME's own file.
-export const serviceOwnerQuery = (platform = process.platform, uid = process.getuid?.()) => {
-  if (platform === 'darwin') return ['launchctl', 'print', `gui/${uid}/${LAUNCHD_LABEL}`];
-  if (platform === 'win32') return ['schtasks', '/Query', '/TN', WINDOWS_TASK_NAME, '/XML'];
-  return ['systemctl', '--user', 'show', SYSTEMD_UNIT, '-p', 'FragmentPath', '--value'];
-};
-
-// schtasks may answer in UTF-16 (BOM or NUL bytes) or in the console's code
-// page; anything that did not decode cleanly is treated as no answer, so a
-// non-ASCII user name never turns into a false "another account".
-export const decodeCmdOutput = (buffer) => {
-  const bytes = Buffer.isBuffer(buffer) ? buffer : Buffer.from(String(buffer ?? ''));
-  const utf16 = (bytes[0] === 0xff && bytes[1] === 0xfe) || bytes.subarray(0, 64).includes(0);
-  return bytes.toString(utf16 ? 'utf16le' : 'utf8').replace(/^\uFEFF/, '');
-};
-
-const xmlUnescape = (value) => value
-  .replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&lt;/g, '<').replace(/&gt;/g, '>')
-  .replace(/&amp;/g, '&');
-
-// The path in the query's answer, or null when the answer names none.
-export const loadedServiceFile = (kind, stdout = '') => {
-  const text = String(stdout).replace(/\0/g, '');
-  let found;
-  if (kind === 'launchd') found = /^\s*path = (.+)$/m.exec(text)?.[1].trim();
-  // schtasks prints the definition it holds, whose action runs this HOME's launcher.
-  else if (kind === 'schtasks') found = /-File (?:"|&quot;)(.+?)(?:"|&quot;)/.exec(text)?.[1];
-  else found = text.trim();
-  if (!found) return null;
-  if (kind === 'schtasks') found = xmlUnescape(found);
-  return found.includes('\uFFFD') ? null : found;
-};
-
-// The same file under another spelling (a symlinked HOME) is not foreign.
-// The file itself may not exist yet, so the nearest folder that does is resolved.
-const canonicalPath = (p, platform) => {
-  let dir = resolve(p);
-  let rest = '';
-  let out = null;
-  while (out === null) {
-    try {
-      out = join(realpathSync(dir), rest);
-    } catch {
-      const up = dirname(dir);
-      if (up === dir) out = resolve(p);
-      else { rest = rest ? join(basename(dir), rest) : basename(dir); dir = up; }
-    }
-  }
-  return platform === 'win32' ? out.toLowerCase() : out;
-};
-
-export const foreignServiceRefusal = ({ target, loadedFile, platform = process.platform }) => {
-  if (!loadedFile) return null;
-  const own = target.kind === 'schtasks' ? target.launcher : target.file;
-  if (canonicalPath(loadedFile, platform) === canonicalPath(own, platform)) return null;
-  const head = `This computer already runs a Space daemon for another account (its service file is ${loadedFile}), `
-    + `and installing here would stop it. To see it, run \`${CLI} daemon status\` as that account. `;
-  // The systemd user manager reads units only from its own account's folder,
-  // so a unit written under another HOME is never loaded: --replace can't help,
-  // and neither would uninstalling the other one first.
-  if (target.kind === 'systemd') {
-    return `${head}On Linux one computer account runs one Space daemon, from its own home folder. `
-      + 'To run another, sign in to this computer as a different user and set it up there.';
-  }
-  return `${head}To replace it with this one on purpose, run this command again with --replace.`;
-};
-
-export const installSummary = ({ startsAtBoot }) => (startsAtBoot
-  ? `The daemon now starts at boot and is kept alive, so it survives reboots. Uninstall with: ${CLI} daemon uninstall`
-  : `The daemon now starts at login and is kept alive. Uninstall with: ${CLI} daemon uninstall`);
-
-export const installDaemonService = async ({
-  platform = process.platform,
-  home = homedir(),
-  nodePath = process.execPath,
-  cliPath = resolve(process.argv[1]),
-  // The provider keys the seats' adapters declare (adapters/index.js).
-  providerKeyEnvNames = [],
-  // Settings carried only when set, never warned about when absent: the
-  // operator's opt-outs (COMMONLY_NO_UPDATE_CHECK), which reach the seats the
-  // daemon spawns only through this file.
-  optionalEnvNames = [],
-  env = process.env,
-  writeFile = writeServiceFile,
-  mkdirp,
-  execCmd, // async (argv: string[]) => void — throws on failure
-  chmod = () => {},
-  ensureFile,
-  existsFile = existsSync,
-  // Resolved only on Linux, and only after the unit is up: userInfo() throws
-  // for a uid with no passwd entry.
-  username,
-  lookupUsername = () => userInfo().username,
-  log = () => {},
-  warn = log,
-  // argv => stdout; rejects when the service manager has no such service.
-  // Absent, the owner check is skipped (callers that only test the writers).
-  readCmd,
-  uid = process.getuid?.(),
-  // Take over a daemon another HOME installed, on purpose. Not on Linux: the
-  // user manager loads units only from its own home, so the check still runs.
-  replace = false,
-}) => {
-  const target = servicePaths(platform, home);
-  if (readCmd && (!replace || target.kind === 'systemd')) {
-    const loadedFile = loadedServiceFile(target.kind, await readCmd(serviceOwnerQuery(platform, uid)).catch(() => ''));
-    const refusal = foreignServiceRefusal({ target, loadedFile, platform });
-    if (refusal) throw new Error(refusal);
-  }
-  mkdirp(dirname(target.file));
-  mkdirp(dirname(daemonLogPath(home)));
-  chmod(dirname(daemonLogPath(home)), 0o700);
-  if (ensureFile) {
-    ensureFile(daemonLogPath(home));
-    chmod(daemonLogPath(home), 0o600);
-  }
-
-  const providerEnv = providerEnvPairs({ names: [...new Set([...providerKeyEnvNames, ...optionalEnvNames])], env });
-  const missing = missingProviderKeys({ names: providerKeyEnvNames, env });
-
-  let startsAtBoot = false;
-  if (target.kind === 'schtasks') {
-    // A logon task, like a LaunchAgent: it starts when this user logs in.
-    mkdirp(dirname(target.launcher));
-    await installWindowsService({
-      home,
-      nodePath,
-      cliPath,
-      logPath: daemonLogPath(home),
-      providerEnv,
-      env,
-      writeFile,
-      execCmd,
-      lookupUsername,
-      warn,
-    });
-  } else if (target.kind === 'launchd') {
-    // The mode and the atomicity are the WRITER's, not an ordering rule here:
-    // `writeServiceFile` creates a 0600 sibling and renames it over the target,
-    // so no chmod is needed on this path and no half-written unit is ever
-    // visible to launchd (see the writer for why neither half could cover both).
-    writeFile(target.file, launchdPlist({ nodePath, cliPath, home, providerEnv }));
-    // Reload cleanly if a previous version is loaded; the unload of an
-    // unknown label fails by design and is ignored.
-    await execCmd(['launchctl', 'unload', target.file]).catch(() => {});
-    await execCmd(['launchctl', 'load', '-w', target.file]);
-  } else {
-    writeFile(target.file, systemdUnit({ nodePath, cliPath, providerEnv }));
-    await execCmd(['systemctl', '--user', 'daemon-reload']);
-    // restart, not `enable --now`: a unit that is already running must pick up
-    // the environment just written, the way launchd's unload/load does.
-    await execCmd(['systemctl', '--user', 'enable', SYSTEMD_UNIT]);
-    await execCmd(['systemctl', '--user', 'restart', SYSTEMD_UNIT]);
-    // After the unit is up, so a refused linger leaves a working login service.
-    let lingerUser = username;
-    if (!lingerUser) {
-      try {
-        lingerUser = lookupUsername();
-      } catch (error) {
-        warn(`Could not read this account's user name (${error.message}), so lingering could not be checked: the daemon starts at login, and at boot only if lingering is already on for this account.`);
-      }
-    }
-    if (lingerUser) startsAtBoot = await ensureLinger({ username: lingerUser, existsFile, execCmd, warn });
-  }
-  for (const name of missing) {
-    warn(`${name} is not set in this shell, so it is NOT in the service file. A seat that relies on it will fail to start (one with its own provider.keyFile won't); export it and re-run: ${CLI} daemon install (docs/agents/daemon-service-environment.md)`);
-  }
-  log(`Installed ${target.kind} service (${target.file}). Logs: ${daemonLogPath(home)}`);
-  return { ...target, startsAtBoot };
-};
-
-export const uninstallDaemonService = async ({
-  platform = process.platform,
-  home = homedir(),
-  existsFile,
-  removeFile,
-  execCmd,
-  log = () => {},
-}) => {
-  const target = servicePaths(platform, home);
-  if (!existsFile(target.file)) {
-    log('No installed daemon service found.');
-    return null;
-  }
-  if (target.kind === 'schtasks') {
-    await uninstallWindowsService({ home, execCmd, removeFile, existsFile });
-    log(`Removed the ${target.taskName} scheduled task and its files (${dirname(target.file)}).`);
-    return target;
-  }
-  if (target.kind === 'launchd') {
-    await execCmd(['launchctl', 'unload', '-w', target.file]).catch(() => {});
-  } else {
-    await execCmd(['systemctl', '--user', 'disable', '--now', SYSTEMD_UNIT]).catch(() => {});
-  }
-  removeFile(target.file);
-  log(`Removed ${target.kind} service (${target.file}).`);
-  return target;
-};
-
-const serviceAction = async ({
-  action,
-  platform = process.platform,
-  home = homedir(),
-  execCmd,
-}) => {
-  const target = servicePaths(platform, home);
-  if (target.kind === 'schtasks') return windowsServiceAction({ action, home, execCmd });
-  if (target.kind === 'launchd') {
-    if (action === 'start') {
-      // `install` already loads the plist. A second `start` should be
-      // idempotent rather than failing with "already loaded".
-      await execCmd(['launchctl', 'load', '-w', target.file]).catch(async () => {
-        await execCmd(['launchctl', 'start', LAUNCHD_LABEL]);
-      });
-    }
-    else if (action === 'stop') await execCmd(['launchctl', 'unload', '-w', target.file]);
-    else {
-      await execCmd(['launchctl', 'unload', '-w', target.file]).catch(() => {});
-      await execCmd(['launchctl', 'load', '-w', target.file]);
-    }
-  } else {
-    await execCmd(['systemctl', '--user', action, SYSTEMD_UNIT]);
-  }
-  return target;
-};
-
-export const startDaemonService = (options) => serviceAction({ ...options, action: 'start' });
-export const stopDaemonService = (options) => serviceAction({ ...options, action: 'stop' });
-export const restartDaemonService = (options) => serviceAction({ ...options, action: 'restart' });

package/src/lib/daemon-state.js

@@ -1,84 +0,0 @@
-import {
-  chmodSync,
-  mkdirSync,
-  readFileSync,
-  renameSync,
-  unlinkSync,
-  writeFileSync,
-} from 'node:fs';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
-
-// The state file is deliberately next to the daemon credential, but it never
-// contains one. Keeping both under the already-private daemon directory makes
-// it difficult for a future status field to accidentally become world-readable.
-export const daemonStateDir = (home = homedir()) => join(home, '.commonly', 'daemon');
-export const daemonStatePath = (home = homedir()) => join(daemonStateDir(home), 'state.json');
-
-const fixedLastError = (value) => {
-  if (!value) return null;
-  const match = typeof value === 'string'
-    ? value.match(/^child exited with code (-?\d+|null)$/)
-    : null;
-  return match ? `child exited with code ${match[1]}` : 'child process error';
-};
-
-const seatState = (seat = {}) => ({
-  agentName: seat.agentName,
-  instanceId: seat.instanceId,
-  // The local record the seat runs from (`<name>` or `<name>@<id>`, F427):
-  // a file name, not a secret. Status reads its log and last turn by it.
-  recordKey: typeof seat.recordKey === 'string' ? seat.recordKey : null,
-  state: seat.state,
-  restarts: seat.restarts,
-  adapter: seat.adapter || null,
-  model: seat.model || null,
-  effort: seat.effort || null,
-  pid: Number.isInteger(seat.pid) ? seat.pid : null,
-  lastTurnAt: seat.lastTurnAt || null,
-  lastError: fixedLastError(seat.lastError),
-});
-
-// Pick fields rather than serializing arbitrary supervisor objects. This is a
-// security boundary: no token, environment, or child-process metadata can be
-// persisted merely because a future caller adds it to a runtime row.
-export const publicDaemonState = (state = {}) => ({
-  machineName: state.machineName || null,
-  machineDbId: state.machineDbId || null,
-  updatedAt: state.updatedAt || new Date().toISOString(),
-  seats: Array.isArray(state.seats) ? state.seats.map(seatState) : [],
-});
-
-export const saveDaemonState = (state, { home = homedir() } = {}) => {
-  const dir = daemonStateDir(home);
-  mkdirSync(dir, { recursive: true, mode: 0o700 });
-  chmodSync(dir, 0o700);
-  const path = daemonStatePath(home);
-  const temp = `${path}.${process.pid}.tmp`;
-  writeFileSync(temp, `${JSON.stringify(publicDaemonState(state), null, 2)}\n`, {
-    encoding: 'utf8',
-    mode: 0o600,
-  });
-  chmodSync(temp, 0o600);
-  renameSync(temp, path);
-  chmodSync(path, 0o600);
-  return path;
-};
-
-export const loadDaemonState = ({ home = homedir() } = {}) => {
-  try {
-    const parsed = JSON.parse(readFileSync(daemonStatePath(home), 'utf8'));
-    return publicDaemonState(parsed);
-  } catch (error) {
-    if (error?.code === 'ENOENT') return null;
-    throw new Error(`Could not read daemon state: ${error.message}`);
-  }
-};
-
-export const removeDaemonState = ({ home = homedir() } = {}) => {
-  try {
-    unlinkSync(daemonStatePath(home));
-  } catch (error) {
-    if (error?.code !== 'ENOENT') throw error;
-  }
-};