@rynx-ai/daemon 0.1.0 → 0.1.9

package/dist/daemon-server.js

@@ -5,19 +5,56 @@
  * channel env hydration, plugin catalog loading, control deps, session log, and
  * session registry. Keeping that wiring here avoids a second app-specific fork.
  */
-import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { randomBytes, randomUUID } from "node:crypto";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { loadConfig, rynxHome } from "@rynx-ai/core";
-import { startServer } from "@rynx-ai/server";
-import { applyChannelEnv } from "./channel-store.js";
+import { REMOTE_RUNTIME_CORE_PROTOCOL } from "@rynx-ai/protocol/remote-runtime";
+import { RUNTIME_BROWSER_SURFACE_SEMANTIC_CAPABILITY } from "@rynx-ai/protocol/runtime-browser-surface";
+import { RUNTIME_EMULATOR_SURFACE_SEMANTIC_CAPABILITY } from "@rynx-ai/protocol/runtime-emulator-surface";
+import { createDaemonRuntimeHost, createDesktopFirstSessionBrowserHost, createRunnerSessionTerminalHost, createSessionRuntimeServices, DesktopBrowserHostRegistry, DirectRuntimeConnectionHub, MachineSessionService, RemoteRuntimeDispatcher, SessionBrowserService, SessionBrowserSurfaceCoordinator, SessionEmulatorService, startServer, startDirectRuntimeServer, } from "@rynx-ai/server";
 import { buildControlDeps } from "./control-deps.js";
+import { BrowserRunnerSessionContextProvider } from "./browser-runner-session-context.js";
+import { isChromeForTestingHostSupported } from "./chrome-for-testing-store.js";
+import { createHeadlessBrowserHost } from "./headless-browser-host.js";
+import { acquireDaemonOwner } from "./daemon-owner.js";
+import { DaemonDirectRuntimeAuthenticator } from "./direct-runtime-authenticator.js";
+import { DurableEmbeddedBrowserProfileHost } from "./embedded-browser-profile-cleanup.js";
+import { loadDirectRuntimeConfig, } from "./direct-runtime-config.js";
+import { isDaemonDirectRuntimeHostingSupported, loadOrCreateDaemonDirectRuntimeEncryptionIdentity, loadOrCreateDaemonInstallationIdentity, } from "./installation-id.js";
 import { cleanupLegacySessions } from "./migrations/cleanup-legacy-sessions.js";
+import { PluginSupervisor } from "./plugin-supervisor.js";
+import { pruneInactivePluginInstallations } from "./plugin-installer.js";
+import { runPluginCliCommand } from "./plugin-cli.js";
+import { getPlugin, isRunnablePluginRecord, listEnabledPlugins } from "./plugin-store.js";
 import { loadPlugins, resolveChannelInstances } from "./registry.js";
 import { SqliteSessionLogStore } from "./session-log-store.js";
+import { SessionBrowserCapabilityStore } from "./session-browser-capability-store.js";
+import { SqliteSessionEmulatorBindingStore } from "./session-emulator-binding-store.js";
 import { sessionRegistry } from "./session-meta-store.js";
+import { RemoteRuntimeAccessStore } from "./remote-runtime-access-store.js";
+import { DaemonRemoteRuntimeAdmin } from "./remote-runtime-admin.js";
+import { FileRemoteRuntimeCredentialStore } from "./remote-runtime-credential-store.js";
+import { DaemonRuntimeConnectionManager } from "./remote-runtime-connection-manager.js";
+import { DaemonRuntimeTargetControl } from "./remote-runtime-target-control.js";
+import { RemoteRuntimeTargetStore } from "./remote-runtime-target-store.js";
+import { ProviderCliService } from "./provider-cli-service.js";
+const PLUGIN_CLI_OUTPUT_MAX_BYTES = 256 * 1024;
+const DIRECT_RUNTIME_HOSTING_UNSUPPORTED = "Direct Runtime hosting is supported only on macOS and Linux until protected server-key storage is available on other operating systems";
 function defaultWarn(message) {
     console.warn(JSON.stringify({ level: "warn", type: "channel-registry", msg: message }));
 }
+function unsupportedRemoteRuntimeAdmin(reason) {
+    const unsupported = () => {
+        throw new Error(reason);
+    };
+    return {
+        listShareAddresses: unsupported,
+        createPairingOffer: unsupported,
+        listClientGrants: unsupported,
+        revokeClientGrant: unsupported,
+    };
+}
 function logLegacyCleanup(config) {
     try {
         const result = cleanupLegacySessions({ codexStorePath: config.AGENT_SESSION_STORE_PATH });
@@ -47,16 +84,24 @@ function dialableHost(host) {
 function controlEndpointFile() {
     return join(rynxHome(), "control.json");
 }
-async function writeControlEndpoint(config) {
+async function writeControlEndpoint(config, managementToken) {
     const file = controlEndpointFile();
+    const temporary = `${file}.tmp-${process.pid}-${randomUUID()}`;
     await mkdir(dirname(file), { recursive: true });
-    await writeFile(file, `${JSON.stringify({
-        origin: `http://${dialableHost(config.HOST)}:${config.PORT}`,
-        host: config.HOST,
-        port: config.PORT,
-        pid: process.pid,
-        updatedAt: new Date().toISOString(),
-    }, null, 2)}\n`, "utf8");
+    try {
+        await writeFile(temporary, `${JSON.stringify({
+            origin: `http://${dialableHost(config.HOST)}:${config.PORT}`,
+            host: config.HOST,
+            port: config.PORT,
+            pid: process.pid,
+            managementToken,
+            updatedAt: new Date().toISOString(),
+        }, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+        await rename(temporary, file);
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
 }
 async function removeControlEndpointForCurrentProcess() {
     try {
@@ -70,21 +115,507 @@ async function removeControlEndpointForCurrentProcess() {
         // Best effort only; stale endpoint files are ignored by the client fallback.
     }
 }
-export async function startRynxDaemonServer({ config, warn = defaultWarn, } = {}) {
-    applyChannelEnv();
-    await loadPlugins(warn);
-    const appConfig = config ?? loadConfig();
-    logLegacyCleanup(appConfig);
-    const server = await startServer({
-        config: appConfig,
-        loadInstances: () => resolveChannelInstances(warn),
-        control: buildControlDeps(),
-        sessionLog: new SqliteSessionLogStore(),
-        sessionRegistry,
-    });
-    await writeControlEndpoint(appConfig);
-    server.on("close", () => {
-        void removeControlEndpointForCurrentProcess();
-    });
-    return server;
+export async function startRynxDaemonServer({ config, warn = defaultWarn, writeEndpoint = writeControlEndpoint, acquireOwner = acquireDaemonOwner, loadDirectConfig = loadDirectRuntimeConfig, startDirectServer = startDirectRuntimeServer, } = {}) {
+    const owner = await acquireOwner();
+    let ownerManagedByServer = false;
+    try {
+        const appConfig = config ?? loadConfig();
+        const directHostingSupported = isDaemonDirectRuntimeHostingSupported();
+        const runtimeBrowserSupported = isChromeForTestingHostSupported();
+        const directConfig = directHostingSupported
+            ? await loadDirectConfig()
+            : undefined;
+        const control = buildControlDeps();
+        const installationIdentity = await loadOrCreateDaemonInstallationIdentity();
+        const directEncryptionIdentity = directHostingSupported
+            ? await loadOrCreateDaemonDirectRuntimeEncryptionIdentity()
+            : undefined;
+        if (!directHostingSupported)
+            warn(DIRECT_RUNTIME_HOSTING_UNSUPPORTED);
+        const daemonInstanceId = randomUUID();
+        const daemonStartedAt = new Date();
+        const remoteRuntime = createDaemonRuntimeHost({
+            daemonId: installationIdentity.installationId,
+            daemonInstanceId,
+            coreProtocolVersion: REMOTE_RUNTIME_CORE_PROTOCOL.currentVersion,
+            minimumCompatibleCoreVersion: REMOTE_RUNTIME_CORE_PROTOCOL.minimumCompatibleVersion,
+            semanticCapabilities: [
+                "semantic.session.list.v1",
+                "semantic.session.snapshot.v1",
+                "semantic.session.events.v1",
+                "semantic.session.terminal.v1",
+                "semantic.session.terminal-start.v1",
+                "semantic.session.interrupt.v1",
+                "semantic.session.agent-options.v1",
+                "semantic.session.launch-options.v2",
+                "semantic.session.create.v1",
+                "semantic.session.message.v1",
+                "semantic.session.delete.v1",
+                "semantic.session.interaction.v1",
+                "semantic.provider-cli.status.v1",
+                ...(runtimeBrowserSupported ? ["semantic.browser.v1"] : []),
+                ...(runtimeBrowserSupported && directHostingSupported
+                    ? [RUNTIME_BROWSER_SURFACE_SEMANTIC_CAPABILITY]
+                    : []),
+                ...(control.emulator
+                    ? ["semantic.emulator.unary.v1", "semantic.session.emulator.v1"]
+                    : []),
+                ...(control.emulator && directHostingSupported
+                    ? [RUNTIME_EMULATOR_SURFACE_SEMANTIC_CAPABILITY]
+                    : []),
+            ],
+            startedAt: daemonStartedAt,
+        });
+        const managementToken = randomBytes(32).toString("base64url");
+        try {
+            for (const removed of pruneInactivePluginInstallations()) {
+                console.log(JSON.stringify({ level: "info", type: "plugin-gc", removed }));
+            }
+        }
+        catch (error) {
+            warn(`plugin package cleanup failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        const pluginSupervisor = new PluginSupervisor(listEnabledPlugins(), {
+            daemonInstanceId,
+            log: (entry) => {
+                const output = entry.level === "error"
+                    ? console.error
+                    : entry.level === "warn"
+                        ? console.warn
+                        : console.log;
+                output(JSON.stringify(entry));
+            },
+        });
+        await loadPlugins(pluginSupervisor, warn);
+        logLegacyCleanup(appConfig);
+        const reloadPluginRuntime = async (pluginId) => {
+            const record = getPlugin(pluginId);
+            if (!record)
+                throw new Error(`plugin "${pluginId}" is not installed`);
+            if (!record.enabled)
+                throw new Error(`plugin "${pluginId}" is disabled`);
+            if (!isRunnablePluginRecord(record)) {
+                throw new Error(`plugin "${pluginId}" must be reinstalled before its runtime can start`);
+            }
+            const status = await pluginSupervisor.reloadPluginRuntime(record);
+            await loadPlugins(pluginSupervisor, warn);
+            return { pluginId, status };
+        };
+        const ensurePluginRuntime = async (pluginId) => {
+            const record = getPlugin(pluginId);
+            if (!record)
+                throw new Error(`plugin "${pluginId}" is not installed`);
+            if (!record.enabled)
+                throw new Error(`plugin "${pluginId}" is disabled`);
+            if (!isRunnablePluginRecord(record)) {
+                throw new Error(`plugin "${pluginId}" must be reinstalled before its runtime can start`);
+            }
+            const status = await pluginSupervisor.ensurePluginRuntime(record);
+            await loadPlugins(pluginSupervisor, warn);
+            return { pluginId, status };
+        };
+        const invokePluginCli = async ({ pluginId, args, stdin }, { signal }) => {
+            const result = await runPluginCliCommand(pluginId, args, {
+                stdio: "pipe",
+                ...(stdin !== undefined ? { stdin } : {}),
+                captureOutputBytes: PLUGIN_CLI_OUTPUT_MAX_BYTES,
+                signal,
+            });
+            if (result.code === 0) {
+                const reload = result.effects.some((effect) => effect.effect === "runtime.reload");
+                const ensure = result.effects.some((effect) => effect.effect === "runtime.ensure");
+                if (reload)
+                    await reloadPluginRuntime(pluginId);
+                else if (ensure)
+                    await ensurePluginRuntime(pluginId);
+            }
+            const output = result.output;
+            return {
+                code: result.code,
+                stdout: output?.stdout ?? "",
+                stderr: output?.stderr ?? "",
+                truncated: Boolean(output?.stdoutTruncated || output?.stderrTruncated),
+            };
+        };
+        const pluginRuntime = {
+            bindHostServices: (services) => pluginSupervisor.bindHostServices({
+                ...services,
+                installationId: installationIdentity.installationId,
+                installationProof: {
+                    algorithm: installationIdentity.algorithm,
+                    publicKey: installationIdentity.publicKey,
+                    sign: installationIdentity.sign,
+                },
+            }),
+            startPluginRuntimes: pluginSupervisor.startPluginRuntimes.bind(pluginSupervisor),
+            reloadPluginRuntime,
+            ensurePluginRuntime,
+            statusSnapshot: pluginSupervisor.statusSnapshot.bind(pluginSupervisor),
+            dispose: pluginSupervisor.dispose.bind(pluginSupervisor),
+        };
+        const daemonManagement = {
+            managementToken,
+            identity: () => ({
+                installationId: installationIdentity.installationId,
+                algorithm: installationIdentity.algorithm,
+                publicKey: installationIdentity.publicKey,
+            }),
+            invokePluginCli,
+        };
+        const remoteRuntimeAccess = new RemoteRuntimeAccessStore();
+        const directConnections = new DirectRuntimeConnectionHub();
+        const sessionLog = new SqliteSessionLogStore();
+        const providerClis = new ProviderCliService();
+        const sessionBrowserCapabilities = new SessionBrowserCapabilityStore();
+        const desktopBrowserHosts = new DesktopBrowserHostRegistry();
+        const durableDesktopBrowserHost = new DurableEmbeddedBrowserProfileHost(desktopBrowserHosts, { warn });
+        const browserRunnerSessionContexts = new BrowserRunnerSessionContextProvider({
+            rootDir: join(rynxHome(), "run", "browser-session-contexts"),
+            capabilities: sessionBrowserCapabilities,
+        });
+        const sessionRuntimeServices = createSessionRuntimeServices({
+            config: appConfig,
+            sessionLog,
+            sessionContextProvider: browserRunnerSessionContexts,
+            onMirrorError: (error, sessionId) => warn(`Session mirror failed for ${sessionId}: ${error instanceof Error ? error.message : String(error)}`),
+        });
+        const sessionBrowsers = new SessionBrowserService({
+            host: createDesktopFirstSessionBrowserHost(durableDesktopBrowserHost, createHeadlessBrowserHost()),
+            sessions: {
+                exists: async (sessionId) => Boolean(sessionRegistry.get(sessionId) ??
+                    await sessionRuntimeServices.sessionStore.get(sessionId)),
+            },
+        });
+        const sessionEmulators = control.emulator
+            ? new SessionEmulatorService({
+                emulator: control.emulator,
+                store: new SqliteSessionEmulatorBindingStore(),
+                sessions: {
+                    exists: async (sessionId) => Boolean(sessionRegistry.get(sessionId) ??
+                        await sessionRuntimeServices.sessionStore.get(sessionId)),
+                },
+            })
+            : undefined;
+        const sessionBrowserSurfaces = new SessionBrowserSurfaceCoordinator(sessionBrowsers);
+        const sessionEmulatorSurface = sessionEmulators
+            ? {
+                open: async (frame, context) => {
+                    const surface = await sessionEmulators.openSurface({
+                        sessionId: frame.sessionId,
+                        bindingId: frame.bindingId,
+                        signal: context.signal,
+                    });
+                    let closed = false;
+                    const close = () => {
+                        if (closed)
+                            return;
+                        closed = true;
+                        context.signal.removeEventListener("abort", close);
+                        surface.close();
+                    };
+                    context.signal.addEventListener("abort", close, { once: true });
+                    if (context.signal.aborted)
+                        close();
+                    return {
+                        ready: {
+                            type: "emulator.surface.ready",
+                            surfaceId: frame.surfaceId,
+                            sessionId: frame.sessionId,
+                            bindingId: frame.bindingId,
+                            backend: surface.backend,
+                            deviceId: surface.deviceId,
+                            format: surface.format,
+                        },
+                        capture: () => surface.capture(),
+                        handle: (input) => surface.touch({ type: input.phase, x: input.x, y: input.y }),
+                        close,
+                    };
+                },
+            }
+            : undefined;
+        const sessionResourceLifecycle = {
+            beforeDelete: async (sessionId) => {
+                await Promise.all([
+                    sessionBrowsers.cleanupSession(sessionId),
+                    sessionEmulators?.cleanupSession(sessionId),
+                ]);
+            },
+            afterDelete: (sessionId) => {
+                sessionBrowserCapabilities.revoke(sessionId);
+            },
+        };
+        const machineSessions = new MachineSessionService({
+            registry: sessionRegistry,
+            log: sessionLog,
+            events: sessionRuntimeServices.sessionBus,
+            runtimeState: sessionRuntimeServices.sessionRuntimeIndex,
+            interruption: {
+                interrupt: (sessionId) => sessionRuntimeServices.runnerManager.interruptLiveSession(sessionId),
+            },
+            lifecycle: sessionResourceLifecycle,
+            agents: {
+                list: () => control.listAgents(),
+            },
+            execution: {
+                runtime: sessionRuntimeServices.conversationRuntime,
+                runner: sessionRuntimeServices.runnerManager,
+                sessionStore: sessionRuntimeServices.sessionStore,
+            },
+        });
+        const directAuthenticator = new DaemonDirectRuntimeAuthenticator(installationIdentity, remoteRuntime, remoteRuntimeAccess);
+        const sessionTerminals = createRunnerSessionTerminalHost({
+            runnerManager: sessionRuntimeServices.runnerManager,
+            resolveLiveSession: async (sessionId) => {
+                const bound = await sessionRuntimeServices.sessionStore.get(sessionId);
+                const registered = sessionRegistry.get(sessionId);
+                const cwd = bound?.cwd ?? registered?.config?.osEnv?.cwd;
+                if ((!bound && !registered) ||
+                    !cwd ||
+                    !sessionRuntimeServices.runnerManager.hasLiveSession(sessionId)) {
+                    return undefined;
+                }
+                return { cwd };
+            },
+        });
+        const remoteRuntimeDispatcher = new RemoteRuntimeDispatcher({
+            runtime: remoteRuntime,
+            emulator: control.emulator,
+            sessionEmulators,
+            sessions: machineSessions,
+            terminals: sessionTerminals,
+            browsers: sessionBrowsers,
+            providerClis,
+            onError: (error) => warn(`Remote Runtime dispatch failed: ${error instanceof Error ? error.message : String(error)}`),
+        });
+        const remoteRuntimeAdmin = directConfig && directEncryptionIdentity
+            ? new DaemonRemoteRuntimeAdmin(installationIdentity, directEncryptionIdentity, remoteRuntimeAccess, directConfig, directConnections)
+            : unsupportedRemoteRuntimeAdmin(DIRECT_RUNTIME_HOSTING_UNSUPPORTED);
+        const runtimeTargets = new RemoteRuntimeTargetStore();
+        const runtimeCredentials = new FileRemoteRuntimeCredentialStore();
+        const runtimeConnectionManager = new DaemonRuntimeConnectionManager({
+            localDaemonId: remoteRuntime.status().daemonId,
+            dispatcher: remoteRuntimeDispatcher,
+            localBrowserSurface: sessionBrowserSurfaces,
+            localEmulatorSurface: sessionEmulatorSurface,
+            targets: runtimeTargets,
+            credentials: runtimeCredentials,
+        });
+        const runtimeTargetControl = new DaemonRuntimeTargetControl(remoteRuntime, runtimeTargets, runtimeCredentials, runtimeConnectionManager);
+        const server = await startServer({
+            config: appConfig,
+            loadInstances: () => resolveChannelInstances(warn),
+            control,
+            sessionLog,
+            sessionRegistry,
+            sessionRuntimeServices,
+            pluginRuntime,
+            daemonManagement,
+            remoteRuntime,
+            remoteRuntimeAdmin,
+            runtimeTargetControl,
+            runtimeConnectionResolver: runtimeConnectionManager,
+            providerClis,
+            sessionEmulators,
+            sessionLifecycle: sessionResourceLifecycle,
+            runtimeLocalBrowser: {
+                authorizeCredential: (credential) => sessionBrowserCapabilities.verify(credential.sessionId, credential.capability),
+                endpointForCredential: async (credential) => {
+                    if (!sessionBrowserCapabilities.verify(credential.sessionId, credential.capability))
+                        return undefined;
+                    return sessionBrowsers.getRuntimeLocalEndpoint(credential.sessionId);
+                },
+                endpointForSession: (sessionId) => sessionBrowsers.getRuntimeLocalEndpoint(sessionId),
+            },
+            desktopBrowserHost: {
+                registry: desktopBrowserHosts,
+                daemonInstanceId,
+            },
+        });
+        const baseShutdown = server.shutdown.bind(server);
+        let directServer;
+        try {
+            if (directConfig && directEncryptionIdentity) {
+                const startedDirect = await startDirectListener(startDirectServer, directConfig, {
+                    e2ee: {
+                        serverPublicKey: directEncryptionIdentity.publicKey,
+                        deriveSharedSecret: (clientPublicKey) => directEncryptionIdentity.deriveSharedSecret(clientPublicKey),
+                    },
+                    authenticator: directAuthenticator,
+                    dispatcher: remoteRuntimeDispatcher,
+                    isPeerActive: (peer) => remoteRuntimeAccess.isClientGrantActive(peer.grantId, peer.clientId),
+                    connectionHub: directConnections,
+                    browserSurface: { host: sessionBrowserSurfaces },
+                    ...(sessionEmulatorSurface
+                        ? { emulatorSurface: { host: sessionEmulatorSurface } }
+                        : {}),
+                    onError: (error, context) => warn(`Direct Runtime ${context} failed: ${error instanceof Error ? error.message : String(error)}`),
+                });
+                directServer = startedDirect.server;
+                // The admin object retains this config reference, so pairing links use
+                // the actual OS-selected fallback port instead of the requested zero.
+                directConfig.port = startedDirect.port;
+                try {
+                    await directConfig.recordListeningPort?.(startedDirect.port);
+                }
+                catch (error) {
+                    warn(`Direct Runtime fallback port could not be persisted: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+        }
+        catch (startupError) {
+            const rollbackErrors = [startupError];
+            if (directServer) {
+                try {
+                    await directServer.shutdown();
+                }
+                catch (shutdownError) {
+                    rollbackErrors.push(shutdownError);
+                }
+            }
+            try {
+                await baseShutdown();
+            }
+            catch (shutdownError) {
+                rollbackErrors.push(shutdownError);
+            }
+            try {
+                await sessionBrowsers.closeAll();
+            }
+            catch (shutdownError) {
+                rollbackErrors.push(shutdownError);
+            }
+            finally {
+                durableDesktopBrowserHost.dispose();
+            }
+            try {
+                await runtimeConnectionManager.close();
+            }
+            catch (shutdownError) {
+                rollbackErrors.push(shutdownError);
+            }
+            if (rollbackErrors.length > 1) {
+                throw new AggregateError(rollbackErrors, "failed to start Direct Runtime and roll back the local server");
+            }
+            throw startupError;
+        }
+        let shutdownPromise;
+        server.shutdown = () => {
+            if (shutdownPromise)
+                return shutdownPromise;
+            shutdownPromise = (async () => {
+                let shutdownComplete = false;
+                try {
+                    const shutdownErrors = [];
+                    if (directServer) {
+                        try {
+                            await directServer.shutdown();
+                        }
+                        catch (error) {
+                            shutdownErrors.push(error);
+                        }
+                    }
+                    try {
+                        await baseShutdown();
+                    }
+                    catch (error) {
+                        shutdownErrors.push(error);
+                    }
+                    try {
+                        await runtimeConnectionManager.close();
+                    }
+                    catch (error) {
+                        shutdownErrors.push(error);
+                    }
+                    try {
+                        await sessionBrowsers.closeAll();
+                    }
+                    catch (error) {
+                        shutdownErrors.push(error);
+                    }
+                    finally {
+                        durableDesktopBrowserHost.dispose();
+                    }
+                    try {
+                        browserRunnerSessionContexts.closeAll();
+                        sessionBrowserCapabilities.revokeAll();
+                    }
+                    catch (error) {
+                        shutdownErrors.push(error);
+                    }
+                    if (shutdownErrors.length > 0) {
+                        throw new AggregateError(shutdownErrors, "failed to shut down all daemon listeners");
+                    }
+                    shutdownComplete = true;
+                }
+                finally {
+                    await removeControlEndpointForCurrentProcess();
+                    // A failed resource shutdown may leave plugin transports alive. Keep
+                    // the process-scoped owner lease in that fail-closed state; it will be
+                    // released by the OS when the process exits.
+                    if (shutdownComplete)
+                        await owner.release();
+                }
+            })();
+            return shutdownPromise;
+        };
+        ownerManagedByServer = true;
+        try {
+            await writeEndpoint(appConfig, managementToken);
+        }
+        catch (startupError) {
+            try {
+                await server.shutdown();
+            }
+            catch (shutdownError) {
+                throw new AggregateError([startupError, shutdownError], "failed to publish the daemon endpoint and roll back the server");
+            }
+            throw startupError;
+        }
+        return server;
+    }
+    catch (error) {
+        if (!ownerManagedByServer)
+            await owner.release();
+        throw error;
+    }
+}
+async function startDirectListener(start, config, options) {
+    const candidates = [...new Set([config.port, ...(config.fallbackPorts ?? [])])];
+    for (let index = 0; index < candidates.length; index += 1) {
+        const requestedPort = candidates[index];
+        try {
+            const server = await start({
+                ...options,
+                host: config.bindHost,
+                port: requestedPort,
+            });
+            const address = server.address();
+            if (address && typeof address !== "string" && address.port > 0) {
+                return { server, port: address.port };
+            }
+            if (requestedPort > 0)
+                return { server, port: requestedPort };
+            try {
+                await server.shutdown();
+            }
+            catch (shutdownError) {
+                throw new AggregateError([new Error("Direct Runtime did not report its OS-selected port"), shutdownError], "failed to resolve Direct Runtime listening port");
+            }
+            throw new Error("Direct Runtime did not report its OS-selected port");
+        }
+        catch (error) {
+            const hasAnotherCandidate = index + 1 < candidates.length;
+            const failedPersistedPreference = index === 0 && config.preferredPortIsPersistedFallback === true;
+            if (!hasAnotherCandidate || (!failedPersistedPreference && !isAddressInUse(error))) {
+                throw error;
+            }
+        }
+    }
+    throw new Error("Direct Runtime has no listener port candidate");
+}
+function isAddressInUse(error) {
+    return Boolean(error &&
+        typeof error === "object" &&
+        "code" in error &&
+        error.code === "EADDRINUSE");
 }