@telora/daemon 0.12.33

package/.env.example

@@ -0,0 +1,64 @@
+# Telora Agent Orchestration Daemon Configuration
+#
+# Uses tracker-based authentication - same as Telora MCP server.
+# You can use the same TELORA_TRACKER_ID and TELORA_URL as your MCP config.
+
+# Telora API Connection (required)
+# Copy these from your .mcp.json telora-products config
+TELORA_URL=http://127.0.0.1:54321
+TELORA_TRACKER_ID=your-tracker-uuid
+
+# Organization to watch (required)
+TELORA_ORGANIZATION_ID=your-organization-uuid
+
+# Product to scope the daemon to (optional)
+# If set, daemon only picks up deliveries for this product.
+# If not set, daemon picks up ALL org deliveries.
+# TELORA_PRODUCT_ID=your-product-uuid
+
+# Repository path (optional, defaults to cwd)
+TELORA_REPO_PATH=/path/to/your/repo
+
+# Claude Code executable (optional, defaults to 'claude')
+CLAUDE_CODE_PATH=claude
+
+# MCP configuration file (optional)
+# If set, daemon passes this to spawned Claude Code instances
+MCP_CONFIG_PATH=/path/to/mcp-config.json
+
+# Log directory (optional, defaults to .telora/logs in repo)
+TELORA_LOG_DIR=/path/to/logs
+
+# Worktree directory for parallel agent branches (optional, defaults to .telora/worktrees in repo)
+# Each agent session gets its own worktree for branch isolation
+TELORA_WORKTREE_DIR=/path/to/worktrees
+
+# Integration branch (optional, defaults to 'integration')
+# Agents merge their work to this branch on successful completion instead of main.
+# Human reviewers promote changes from integration to main after review.
+TELORA_INTEGRATION_BRANCH=integration
+
+# Session limits (optional)
+MAX_TOTAL_SESSIONS=5
+SESSION_TIMEOUT_MS=3600000
+TOKEN_LIMIT=200000
+COST_LIMIT=10.0
+
+# Merge lock settings (optional)
+# How long to wait for the merge lock before timing out (ms, default: 300000 = 5 min)
+MERGE_LOCK_TIMEOUT_MS=300000
+# Log a contention warning if lock acquisition takes longer than this (ms, default: 30000 = 30s)
+MERGE_LOCK_CONTENTION_WARNING_MS=30000
+
+# Guard evaluation failure mode (optional, default: fail-open)
+# "fail-open"  = allow transition when guard evaluation errors
+# "fail-closed" = block transition when guard evaluation errors
+TELORA_POLICY_FAILURE_MODE=fail-open
+
+# Log retention policy (optional)
+# Delete log files older than this many days (default: 7)
+LOG_MAX_AGE_DAYS=7
+# Maximum total size of all log files in bytes (default: 1073741824 = 1 GB)
+LOG_MAX_TOTAL_BYTES=1073741824
+# Maximum number of log files to keep (default: 500)
+LOG_MAX_FILES=500

package/README.md

@@ -0,0 +1,229 @@
+# @telora/daemon
+
+Agent orchestration daemon for Telora - spawns and manages Claude Code instances to work on deliveries autonomously.
+
+## Overview
+
+The Telora daemon watches for active strategies in your Telora organization and spawns Claude Code Agent Teams to execute them. Each strategy gets a single Agent Team that coordinates work across all deliveries and issues.
+
+Key features:
+- **Strategy-level Agent Teams**: One team per strategy manages all deliveries, building a task DAG and coordinating parallel execution
+- **Multi-repo support**: Multiple daemons can run against the same Telora org, each handling strategies for different repos
+- **Integration branch workflow**: Teams work on isolated branches, auto-merge to integration on success
+- **Worktree isolation**: Each team gets its own git worktree
+- **Dynamic delivery pickup**: Teams detect and incorporate new deliveries added mid-execution
+
+## Installation
+
+The `@telora/daemon` package is published to an internal Gitea npm registry. You need registry access before installing.
+
+```bash
+# Configure npm to use the Telora registry for @telora packages
+# Replace the URL below with your organization's Gitea instance URL
+echo '@telora:registry=https://<your-gitea-host>/api/packages/syntelyos/npm/' >> ~/.npmrc
+
+# Global installation
+npm install -g @telora/daemon
+
+# Or run directly with npx
+npx @telora/daemon
+```
+
+> **Note:** The registry URL is organization-specific. Ask your team lead for the correct URL if you don't have it. The registry requires a valid npm token for authentication.
+
+## Quick Start
+
+### Option 1: Interactive Setup (Recommended)
+
+```bash
+cd /path/to/your/repo
+npx @telora/daemon init
+```
+
+The setup wizard will guide you through:
+- Telora URL configuration
+- Organization ID
+- Integration branch name
+- Max concurrent agents
+
+Then set your tracker ID and start the daemon:
+
+```bash
+export TELORA_TRACKER_ID=your-tracker-id-here
+telora-daemon
+```
+
+### Option 2: Manual Setup
+
+1. **Get your Tracker ID** from Telora:
+   - Go to Settings → AI Work Trackers
+   - Click "Generate Tracker ID" on your profile
+   - Copy the tracker ID
+
+2. **Configure environment variables** in your repo:
+
+```bash
+cd /path/to/your/repo
+
+# Create .env file
+cat > .env << EOF
+TELORA_URL=https://your-telora-instance.supabase.co
+TELORA_TRACKER_ID=your-tracker-id-here
+TELORA_ORGANIZATION_ID=your-org-id-here
+EOF
+```
+
+3. **Start the daemon**:
+
+```bash
+telora-daemon
+```
+
+## Configuration
+
+The daemon is configured via environment variables:
+
+| Variable | Required | Default | Description |
+|----------|----------|---------|-------------|
+| `TELORA_URL` | Yes | - | Telora API URL |
+| `TELORA_TRACKER_ID` | Yes | - | Your tracker ID for authentication |
+| `TELORA_ORGANIZATION_ID` | Yes | - | Organization to watch for work |
+| `TELORA_REPO_PATH` | No | `cwd()` | Path to git repository |
+| `TELORA_INTEGRATION_BRANCH` | No | `integration` | Branch for agent merges |
+| `TELORA_WORKTREE_DIR` | No | `.telora/worktrees` | Directory for git worktrees |
+| `TELORA_LOG_DIR` | No | `.telora/logs` | Directory for agent logs |
+| `CLAUDE_CODE_PATH` | No | `claude` | Path to Claude Code executable |
+| `MCP_CONFIG_PATH` | No | - | Path to MCP config file |
+| `MAX_TOTAL_SESSIONS` | No | `5` | Max concurrent agents |
+| `SESSION_TIMEOUT_MS` | No | `3600000` | Session timeout (1 hour) |
+| `TOKEN_LIMIT` | No | `200000` | Max tokens per session |
+| `COST_LIMIT` | No | `10.0` | Max cost per session ($) |
+
+## CLI Options
+
+```bash
+telora-daemon [options]
+
+Options:
+  -V, --version        Output version number
+  -v, --verbose        Enable verbose logging
+  -c, --config <path>  Path to config file (default: .telora/daemon.json)
+  --dry-run            Print configuration and exit
+  -h, --help           Display help
+```
+
+## Config File
+
+Instead of environment variables, you can use a JSON config file. The daemon looks for `.telora/daemon.json` by default.
+
+```json
+{
+  "teloraUrl": "https://your-telora-instance.supabase.co",
+  "organizationId": "your-organization-uuid",
+  "productId": "your-product-uuid",
+  "integrationBranch": "integration",
+  "maxTotalSessions": 5
+}
+```
+
+**Configuration priority** (highest to lowest):
+1. Environment variables
+2. Config file values
+3. Default values
+
+**Security note:** The `trackerId` must always be set via the `TELORA_TRACKER_ID` environment variable. It cannot be set in the config file (which is safe to commit to git).
+
+Available config file fields:
+- `teloraUrl` - Telora API URL
+- `organizationId` - Organization UUID
+- `productId` - Product UUID (scopes daemon to one product; omit to handle all)
+- `repoPath` - Repository path
+- `worktreeDir` - Worktree directory
+- `integrationBranch` - Integration branch name
+- `claudeCodePath` - Claude Code executable path
+- `mcpConfigPath` - MCP config file path
+- `logDir` - Log directory
+- `maxTotalSessions` - Max concurrent agents
+- `sessionTimeoutMs` - Session timeout in milliseconds
+- `tokenLimit` - Max tokens per session
+- `costLimit` - Max cost per session in dollars
+
+## How It Works
+
+### Strategy Team Execution Model
+
+1. **Strategy polling**: The daemon polls Telora every 30 seconds for active strategies with an assigned agent role and queued deliveries
+2. **Filtering**: Only picks up strategies for the configured `productId` (if set)
+3. **Team spawning**: For each ready strategy, spawns a single Claude Code Agent Team (one team per strategy)
+4. **Task DAG**: The team lead reads all deliveries and issues, builds a dependency graph respecting delivery priority and file overlap
+5. **Parallel execution**: Workers execute issues in parallel where safe (no file conflicts), sequentially where needed
+6. **Delivery progression**: As issues complete, deliveries advance through workflow stages (coding -> verify -> done)
+7. **Merge on success**: When all deliveries are complete, the strategy branch is merged to integration
+8. **Dynamic pickup**: If new deliveries are added to the strategy mid-execution, the team incorporates them automatically
+
+### Key daemon modules
+
+- `strategy-executor.ts` - Strategy team lifecycle (spawn, monitor, completion)
+- `task-dag-builder.ts` - Pure function that builds dependency graphs from deliveries/issues
+- `strategy-prompt-builder.ts` - Builds the team lead's prompt with all context
+- `delivery-lifecycle.ts` - Extracted guard evaluation, stage transition, git merge functions
+- `completion-handler.ts` - Per-delivery completion (used by team lead for sub-delivery transitions)
+- `spawner.ts` - Process spawning with Agent Teams mode always enabled
+
+## Multi-Repo Setup
+
+To run agents on multiple repositories:
+
+1. Set `productId` in each daemon's `.telora/daemon.json` (or `TELORA_PRODUCT_ID` env var)
+2. Run one daemon per repository:
+
+```bash
+# Terminal 1 - Repo A (productId set in .telora/daemon.json)
+cd /path/to/repo-a
+telora-daemon
+
+# Terminal 2 - Repo B (productId set in .telora/daemon.json)
+cd /path/to/repo-b
+telora-daemon
+```
+
+Each daemon only picks up deliveries for the configured product.
+
+## Signals
+
+- `SIGINT` / `SIGTERM`: Graceful shutdown (waits for agents to checkpoint)
+- `SIGUSR1`: Print status of running agents
+
+## Running in Production vs Development
+
+**For production use**, always run the daemon with the compiled version:
+
+```bash
+# Global install (recommended)
+npm install -g @telora/daemon
+telora-daemon
+
+# Or from source
+cd packages/daemon
+npm run build
+npm start
+```
+
+**Do NOT use `npm run dev`** (watch mode) when agents are running. The file watcher will restart the daemon whenever source files change, which kills any running agents and may leave sessions in a stuck "running" state.
+
+If you need to modify daemon code while agents are working:
+1. Wait for agents to complete
+2. Or stop the daemon gracefully (Ctrl+C)
+3. Make your changes
+4. Restart the daemon
+
+## Requirements
+
+- Node.js 20+
+- Claude Code CLI (`claude`) installed and authenticated
+- Git repository with write access
+- Active Telora account with AI Work Tracker
+
+## License
+
+MIT

package/build-info.json

@@ -0,0 +1,4 @@
+{
+  "commitSha": "9f5498a7",
+  "builtAt": "2026-03-18T10:09:18.751Z"
+}

package/dist/activity-tracker.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Daemon-specific ActivityTracker -- thin wrapper around @telora/daemon-core.
+ *
+ * Re-exports the shared ActivitySnapshot type and provides a daemon-specific
+ * ActivityTracker subclass that flushes snapshots to agent_sessions via
+ * updateSession().
+ */
+import { ActivityTracker as CoreActivityTracker, type ActivitySnapshot } from '@telora/daemon-core';
+export type { ActivitySnapshot };
+export declare class ActivityTracker extends CoreActivityTracker {
+    constructor(sessionId: string);
+}
+//# sourceMappingURL=activity-tracker.d.ts.map

package/dist/activity-tracker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity-tracker.d.ts","sourceRoot":"","sources":["../src/activity-tracker.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,IAAI,mBAAmB,EAAE,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAGpG,YAAY,EAAE,gBAAgB,EAAE,CAAC;AAEjC,qBAAa,eAAgB,SAAQ,mBAAmB;gBAC1C,SAAS,EAAE,MAAM;CAO9B"}

package/dist/activity-tracker.js

@@ -0,0 +1,19 @@
+/**
+ * Daemon-specific ActivityTracker -- thin wrapper around @telora/daemon-core.
+ *
+ * Re-exports the shared ActivitySnapshot type and provides a daemon-specific
+ * ActivityTracker subclass that flushes snapshots to agent_sessions via
+ * updateSession().
+ */
+import { ActivityTracker as CoreActivityTracker } from '@telora/daemon-core';
+import { updateSession } from './queries/sessions.js';
+export class ActivityTracker extends CoreActivityTracker {
+    constructor(sessionId) {
+        super(sessionId, async (snapshot) => {
+            await updateSession(sessionId, {
+                activity_summary: snapshot,
+            });
+        });
+    }
+}
+//# sourceMappingURL=activity-tracker.js.map

package/dist/activity-tracker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity-tracker.js","sourceRoot":"","sources":["../src/activity-tracker.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,IAAI,mBAAmB,EAAyB,MAAM,qBAAqB,CAAC;AACpG,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAItD,MAAM,OAAO,eAAgB,SAAQ,mBAAmB;IACtD,YAAY,SAAiB;QAC3B,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,QAA0B,EAAE,EAAE;YACpD,MAAM,aAAa,CAAC,SAAS,EAAE;gBAC7B,gBAAgB,EAAE,QAA8C;aACjE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/agent-state.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Shared agent state module -- breaks the circular dependency between
+ * heartbeat.ts and spawner.ts by centralizing state that both modules need.
+ *
+ * Contains:
+ * - Running agents map (read by heartbeat, written by spawner)
+ * - Session completion counters (written by spawner/completion-handler, read by heartbeat)
+ * - Activity tracking (written by spawner/listener, read by heartbeat)
+ */
+import type { RunningAgent } from './types.js';
+/**
+ * Get map of running agents.
+ */
+export declare function getRunningAgents(): Map<string, RunningAgent>;
+/**
+ * Record a completed session (called by spawner when an agent finishes).
+ */
+export declare function recordSessionCompleted(tokens: number, cost: number): void;
+/**
+ * Get current session completion counters (read by heartbeat).
+ */
+export declare function getSessionCounters(): {
+    completedSessionCount: number;
+    totalTokensUsed: number;
+    totalCost: number;
+};
+/**
+ * Bootstrap session counters from database values.
+ * Called by heartbeat on startup to reflect cumulative history.
+ */
+export declare function setSessionCounters(counters: {
+    completedSessionCount: number;
+    totalTokensUsed: number;
+    totalCost: number;
+}): void;
+/**
+ * Record daemon activity. Call this whenever meaningful work occurs
+ * (spawning agents, completing sessions, polling, merges, etc.).
+ */
+export declare function recordActivity(): void;
+/**
+ * Get the last activity timestamp (for diagnostics/testing).
+ */
+export declare function getLastActivityAt(): Date;
+//# sourceMappingURL=agent-state.d.ts.map

package/dist/agent-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-state.d.ts","sourceRoot":"","sources":["../src/agent-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAO/C;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAE5D;AAQD;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAIzE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI;IACpC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB,CAEA;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE;IAC3C,qBAAqB,EAAE,MAAM,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,IAAI,CAIP;AAMD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAExC"}

package/dist/agent-state.js

@@ -0,0 +1,61 @@
+/**
+ * Shared agent state module -- breaks the circular dependency between
+ * heartbeat.ts and spawner.ts by centralizing state that both modules need.
+ *
+ * Contains:
+ * - Running agents map (read by heartbeat, written by spawner)
+ * - Session completion counters (written by spawner/completion-handler, read by heartbeat)
+ * - Activity tracking (written by spawner/listener, read by heartbeat)
+ */
+// ── Running agents map ──────────────────────────────────────────────
+/** Running agents map: sessionId -> RunningAgent */
+const runningAgents = new Map();
+/**
+ * Get map of running agents.
+ */
+export function getRunningAgents() {
+    return runningAgents;
+}
+// ── Session completion counters ─────────────────────────────────────
+let completedSessionCount = 0;
+let totalTokensUsed = 0;
+let totalCost = 0;
+/**
+ * Record a completed session (called by spawner when an agent finishes).
+ */
+export function recordSessionCompleted(tokens, cost) {
+    completedSessionCount++;
+    totalTokensUsed += tokens;
+    totalCost += cost;
+}
+/**
+ * Get current session completion counters (read by heartbeat).
+ */
+export function getSessionCounters() {
+    return { completedSessionCount, totalTokensUsed, totalCost };
+}
+/**
+ * Bootstrap session counters from database values.
+ * Called by heartbeat on startup to reflect cumulative history.
+ */
+export function setSessionCounters(counters) {
+    completedSessionCount = counters.completedSessionCount;
+    totalTokensUsed = counters.totalTokensUsed;
+    totalCost = counters.totalCost;
+}
+// ── Activity tracking ───────────────────────────────────────────────
+let lastActivityAt = new Date();
+/**
+ * Record daemon activity. Call this whenever meaningful work occurs
+ * (spawning agents, completing sessions, polling, merges, etc.).
+ */
+export function recordActivity() {
+    lastActivityAt = new Date();
+}
+/**
+ * Get the last activity timestamp (for diagnostics/testing).
+ */
+export function getLastActivityAt() {
+    return lastActivityAt;
+}
+//# sourceMappingURL=agent-state.js.map

package/dist/agent-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-state.js","sourceRoot":"","sources":["../src/agent-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,uEAAuE;AAEvE,oDAAoD;AACpD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAwB,CAAC;AAEtD;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,uEAAuE;AAEvE,IAAI,qBAAqB,GAAG,CAAC,CAAC;AAC9B,IAAI,eAAe,GAAG,CAAC,CAAC;AACxB,IAAI,SAAS,GAAG,CAAC,CAAC;AAElB;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAE,IAAY;IACjE,qBAAqB,EAAE,CAAC;IACxB,eAAe,IAAI,MAAM,CAAC;IAC1B,SAAS,IAAI,IAAI,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAKhC,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAIlC;IACC,qBAAqB,GAAG,QAAQ,CAAC,qBAAqB,CAAC;IACvD,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;IAC3C,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;AACjC,CAAC;AAED,uEAAuE;AAEvE,IAAI,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC;AAEhC;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,cAAc,CAAC;AACxB,CAAC"}

package/dist/audit-hooks.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Pre-commit hook management for read-only audit sessions.
+ *
+ * Installs a git pre-commit hook in a worktree that blocks all commits,
+ * providing an informative message about the read-only audit mode.
+ */
+/**
+ * Install a pre-commit hook in a worktree that blocks all commits.
+ * Used for read-only audit sessions.
+ */
+export declare function installAuditPreCommitHook(worktreePath: string): void;
+//# sourceMappingURL=audit-hooks.d.ts.map

package/dist/audit-hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-hooks.d.ts","sourceRoot":"","sources":["../src/audit-hooks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAiCpE"}

package/dist/audit-hooks.js

@@ -0,0 +1,45 @@
+/**
+ * Pre-commit hook management for read-only audit sessions.
+ *
+ * Installs a git pre-commit hook in a worktree that blocks all commits,
+ * providing an informative message about the read-only audit mode.
+ */
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { runGitSync } from './git-types.js';
+/**
+ * Install a pre-commit hook in a worktree that blocks all commits.
+ * Used for read-only audit sessions.
+ */
+export function installAuditPreCommitHook(worktreePath) {
+    // Create a custom hooks directory inside the worktree
+    const hooksDir = join(worktreePath, '.telora-hooks');
+    if (!existsSync(hooksDir)) {
+        mkdirSync(hooksDir, { recursive: true });
+    }
+    const hookScript = [
+        '#!/bin/bash',
+        'echo ""',
+        'echo "========================================================"',
+        'echo "  READ-ONLY AUDIT SESSION"',
+        'echo "========================================================"',
+        'echo ""',
+        'echo "  Commits are blocked. This session operates in"',
+        'echo "  read-only audit mode by design."',
+        'echo ""',
+        'echo "  Your job is discovery only:"',
+        'echo "  - Log findings as issues via MCP tools"',
+        'echo "  - Create remediation deliveries for fixes"',
+        'echo "  - Do NOT modify or commit code changes"',
+        'echo ""',
+        'echo "========================================================"',
+        'echo ""',
+        'exit 1',
+        '',
+    ].join('\n');
+    const hookPath = join(hooksDir, 'pre-commit');
+    writeFileSync(hookPath, hookScript, { mode: 0o755 });
+    // Point this worktree's git config at the custom hooks directory
+    runGitSync(['config', 'core.hooksPath', hooksDir], worktreePath);
+}
+//# sourceMappingURL=audit-hooks.js.map

package/dist/audit-hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-hooks.js","sourceRoot":"","sources":["../src/audit-hooks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,YAAoB;IAC5D,sDAAsD;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,UAAU,GAAG;QACjB,aAAa;QACb,SAAS;QACT,iEAAiE;QACjE,kCAAkC;QAClC,iEAAiE;QACjE,SAAS;QACT,wDAAwD;QACxD,0CAA0C;QAC1C,SAAS;QACT,sCAAsC;QACtC,iDAAiD;QACjD,oDAAoD;QACpD,iDAAiD;QACjD,SAAS;QACT,iEAAiE;QACjE,SAAS;QACT,QAAQ;QACR,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC9C,aAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAErD,iEAAiE;IACjE,UAAU,CAAC,CAAC,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAC;AACnE,CAAC"}

package/dist/auto-update.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Daemon auto-update module.
+ *
+ * Periodically checks the npm registry for a newer version of @telora/daemon.
+ * When an update is detected and all engines are idle, installs the new version
+ * globally and signals the process to exit with code 75 (restart-after-update).
+ *
+ * A wrapper script or systemd RestartForceExitStatus=75 handles the actual
+ * process restart, which then runs the newly installed version.
+ */
+/** Exit code that signals "restart after self-update". */
+export declare const EXIT_CODE_UPDATE = 75;
+export interface AutoUpdateOptions {
+    /** Current daemon version string (e.g., "0.10.48"). */
+    currentVersion: string;
+    /** npm package name (default: "@telora/daemon"). */
+    packageName?: string;
+    /** Check interval in milliseconds (default: 3600000 = 1 hour). */
+    intervalMs?: number;
+    /** Callback that returns true when all engines are idle. */
+    isIdle: () => boolean;
+    /** Called when update is installed and the process should exit with code 75. */
+    onUpdateReady: () => void;
+}
+/**
+ * Run `npm install -g <package>@latest` as a child process.
+ * Returns true on success, false on failure.
+ */
+export declare function performSelfUpdate(packageName: string): Promise<boolean>;
+/**
+ * Start a periodic auto-update check loop.
+ *
+ * Each cycle:
+ *   1. Check npm registry for a newer version
+ *   2. If update available and engines are idle, install it
+ *   3. On successful install, call onUpdateReady (which triggers exit 75)
+ *   4. If engines are busy, defer to the next cycle
+ *
+ * Returns a cleanup function that stops the timer.
+ */
+export declare function startAutoUpdateLoop(opts: AutoUpdateOptions): () => void;
+//# sourceMappingURL=auto-update.d.ts.map

package/dist/auto-update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-update.d.ts","sourceRoot":"","sources":["../src/auto-update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAInC,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,cAAc,EAAE,MAAM,CAAC;IACvB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,MAAM,EAAE,MAAM,OAAO,CAAC;IACtB,gFAAgF;IAChF,aAAa,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAmBvE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,IAAI,CAgEvE"}

package/dist/auto-update.js

@@ -0,0 +1,96 @@
+/**
+ * Daemon auto-update module.
+ *
+ * Periodically checks the npm registry for a newer version of @telora/daemon.
+ * When an update is detected and all engines are idle, installs the new version
+ * globally and signals the process to exit with code 75 (restart-after-update).
+ *
+ * A wrapper script or systemd RestartForceExitStatus=75 handles the actual
+ * process restart, which then runs the newly installed version.
+ */
+import { execFile } from 'node:child_process';
+import { checkForUpdates } from './version-check.js';
+/** Exit code that signals "restart after self-update". */
+export const EXIT_CODE_UPDATE = 75;
+const DEFAULT_INTERVAL_MS = 3_600_000; // 1 hour
+/**
+ * Run `npm install -g <package>@latest` as a child process.
+ * Returns true on success, false on failure.
+ */
+export function performSelfUpdate(packageName) {
+    return new Promise((resolve) => {
+        const target = `${packageName}@latest`;
+        console.log(`[auto-update] Installing ${target}...`);
+        execFile('npm', ['install', '-g', target], { timeout: 120_000 }, (err, stdout, stderr) => {
+            if (err) {
+                console.warn(`[auto-update] npm install failed: ${err.message}`);
+                if (stderr)
+                    console.warn(`[auto-update] stderr: ${stderr.trim()}`);
+                resolve(false);
+                return;
+            }
+            if (stdout.trim())
+                console.log(`[auto-update] ${stdout.trim()}`);
+            console.log(`[auto-update] Successfully installed ${target}`);
+            resolve(true);
+        });
+    });
+}
+/**
+ * Start a periodic auto-update check loop.
+ *
+ * Each cycle:
+ *   1. Check npm registry for a newer version
+ *   2. If update available and engines are idle, install it
+ *   3. On successful install, call onUpdateReady (which triggers exit 75)
+ *   4. If engines are busy, defer to the next cycle
+ *
+ * Returns a cleanup function that stops the timer.
+ */
+export function startAutoUpdateLoop(opts) {
+    const { currentVersion, packageName = '@telora/daemon', intervalMs = DEFAULT_INTERVAL_MS, isIdle, onUpdateReady, } = opts;
+    let pendingVersion = null;
+    let stopped = false;
+    async function tick() {
+        if (stopped)
+            return;
+        try {
+            // If we already know about a pending update, skip the registry check
+            if (!pendingVersion) {
+                const result = await checkForUpdates(currentVersion, packageName);
+                if (result?.updateAvailable) {
+                    pendingVersion = result.latestVersion;
+                    console.log(`[auto-update] Update available: v${result.latestVersion} (current: v${currentVersion})`);
+                }
+            }
+            if (!pendingVersion)
+                return;
+            // Only update when idle
+            if (!isIdle()) {
+                console.log('[auto-update] Engines are busy, deferring update to next cycle');
+                return;
+            }
+            // Install the update
+            const ok = await performSelfUpdate(packageName);
+            if (!ok) {
+                // Reset so we retry the install next cycle
+                console.warn('[auto-update] Install failed, will retry next cycle');
+                return;
+            }
+            // Signal the shell to restart
+            onUpdateReady();
+        }
+        catch (err) {
+            console.warn(`[auto-update] Unexpected error: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    const timer = setInterval(() => void tick(), intervalMs);
+    // Don't block process exit
+    timer.unref();
+    console.log(`[auto-update] Enabled (check every ${Math.round(intervalMs / 60_000)}min)`);
+    return () => {
+        stopped = true;
+        clearInterval(timer);
+    };
+}
+//# sourceMappingURL=auto-update.js.map