@vellumai/assistant 0.3.0

package/src/daemon/server.ts

@@ -0,0 +1,1215 @@
+import * as net from 'node:net';
+import * as tls from 'node:tls';
+import { randomBytes } from 'node:crypto';
+import { existsSync, chmodSync, readFileSync, writeFileSync, readdirSync, watch, type FSWatcher } from 'node:fs';
+import { join } from 'node:path';
+import { getSocketPath, getSessionTokenPath, getRootDir, getWorkspaceDir, getWorkspaceSkillsDir, getSandboxWorkingDir, removeSocketFile, getTCPPort, getTCPHost, isTCPEnabled, isIOSPairingEnabled } from '../util/platform.js';
+import { ensureTlsCert } from './tls-certs.js';
+import { getLocalIPv4 } from '../util/network-info.js';
+import { hasNoAuthOverride } from './connection-policy.js';
+import { getLogger } from '../util/logger.js';
+import { getFailoverProvider, initializeProviders } from '../providers/registry.js';
+import { RateLimitProvider } from '../providers/ratelimit.js';
+import { getConfig, invalidateConfigCache } from '../config/loader.js';
+import { buildSystemPrompt } from '../config/system-prompt.js';
+import { clearCache as clearTrustCache } from '../permissions/trust-store.js';
+import { resetAllowlist, validateAllowlistFile } from '../security/secret-allowlist.js';
+import { checkIngressForSecrets } from '../security/secret-ingress.js';
+import { IngressBlockedError } from '../util/errors.js';
+import { clearEmbeddingBackendCache } from '../memory/embedding-backend.js';
+import * as conversationStore from '../memory/conversation-store.js';
+import * as attachmentsStore from '../memory/attachments-store.js';
+import { Session, DEFAULT_MEMORY_POLICY, type SessionMemoryPolicy } from './session.js';
+import { resolveChannelCapabilities } from './session-runtime-assembly.js';
+import { ComputerUseSession } from './computer-use-session.js';
+import {
+  serialize,
+  createMessageParser,
+  MAX_LINE_SIZE,
+  type ClientMessage,
+  type ServerMessage,
+  normalizeThreadType,
+} from './ipc-protocol.js';
+import { validateClientMessage } from './ipc-validate.js';
+import { handleMessage, type HandlerContext, type SessionCreateOptions } from './handlers.js';
+import { RunOrchestrator } from '../runtime/run-orchestrator.js';
+import { ensureBlobDir, sweepStaleBlobs } from './ipc-blob-store.js';
+import { bootstrapHomeBaseAppLink } from '../home-base/bootstrap.js';
+import { assistantEventHub } from '../runtime/assistant-event-hub.js';
+import { buildAssistantEvent } from '../runtime/assistant-event.js';
+import { SessionEvictor } from './session-evictor.js';
+import { getSubagentManager } from '../subagent/index.js';
+import { tryRouteCallMessage } from '../calls/call-bridge.js';
+import { resolveSlash } from './session-slash.js';
+import { createUserMessage, createAssistantMessage } from '../agent/message-types.js';
+import { registerDaemonCallbacks } from '../work-items/work-item-runner.js';
+import { DebouncerMap } from '../util/debounce.js';
+
+const log = getLogger('server');
+
+function readPackageVersion(): string | undefined {
+  try {
+    const pkgPath = join(import.meta.dir, '../../package.json');
+    const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8')) as { version?: string };
+    return pkg.version;
+  } catch {
+    return undefined;
+  }
+}
+
+const daemonVersion = readPackageVersion();
+
+export class DaemonServer {
+  private server: net.Server | null = null;
+  private tcpServer: tls.Server | null = null;
+  private sessions = new Map<string, Session>();
+  private socketToSession = new Map<net.Socket, string>();
+  private cuSessions = new Map<string, ComputerUseSession>();
+  private socketToCuSession = new Map<net.Socket, Set<string>>();
+  private connectedSockets = new Set<net.Socket>();
+  private socketSandboxOverride = new Map<net.Socket, boolean>();
+  private cuObservationParseSequence = new Map<string, number>();
+  // Persisted session options (e.g. systemPromptOverride, maxResponseTokens)
+  // so that evicted sessions can be recreated with the same overrides.
+  private sessionOptions = new Map<string, SessionCreateOptions>();
+  // Guards against duplicate session creation when multiple clients connect
+  // with the same conversation ID concurrently. The first caller creates the
+  // session; subsequent callers await the same promise.
+  private sessionCreating = new Map<string, Promise<Session>>();
+  // Shared across all sessions so maxRequestsPerMinute is enforced globally.
+  private sharedRequestTimestamps: number[] = [];
+  private socketPath: string;
+  private httpPort: number | undefined;
+  private watchers: FSWatcher[] = [];
+  private debounceTimers = new DebouncerMap({
+    defaultDelayMs: 200,
+    maxEntries: 1000,
+    protectedKeyPrefix: '__',
+  });
+  private suppressConfigReload = false;
+  private lastConfigFingerprint = '';
+  private lastConfigRefreshTime = 0;
+  private blobSweepTimer: ReturnType<typeof setInterval> | null = null;
+  private static readonly CONFIG_REFRESH_INTERVAL_MS = 30_000;
+  private static readonly MAX_CONNECTIONS = 50;
+  private static readonly AUTH_TIMEOUT_MS = 5_000;
+  private sessionToken = '';
+  private authenticatedSockets = new Set<net.Socket>();
+  private authTimeouts = new Map<net.Socket, ReturnType<typeof setTimeout>>();
+  private evictor: SessionEvictor;
+
+  /**
+   * Derive a SessionMemoryPolicy from the conversation's thread type and
+   * memory scope. Private conversations get an isolated scope with strict
+   * side-effect controls and default-fallback recall; standard conversations
+   * use the shared default scope with no restrictions.
+   */
+  private deriveMemoryPolicy(conversationId: string): SessionMemoryPolicy {
+    const threadType = conversationStore.getConversationThreadType(conversationId);
+    if (threadType === 'private') {
+      return {
+        scopeId: conversationStore.getConversationMemoryScopeId(conversationId),
+        includeDefaultFallback: true,
+        strictSideEffects: true,
+      };
+    }
+    return DEFAULT_MEMORY_POLICY;
+  }
+
+  private applyTransportMetadata(_session: Session, options: SessionCreateOptions | undefined): void {
+    const transport = options?.transport;
+    if (!transport) return;
+
+    // Transport metadata is available for future use but onboarding context
+    // is now handled via BOOTSTRAP.md in the system prompt.
+    log.debug({ channelId: transport.channelId }, 'Transport metadata received');
+  }
+
+  /**
+   * Logical assistant identifier used when publishing to the assistant-events hub.
+   * Defaults to 'default' for the IPC daemon runtime; override in tests or
+   * multi-tenant deployments where the daemon is scoped to a specific assistant.
+   */
+  assistantId: string = 'default';
+
+  constructor() {
+    this.socketPath = getSocketPath();
+    this.evictor = new SessionEvictor(this.sessions);
+    // Share the global rate-limit timestamps with the subagent manager.
+    getSubagentManager().sharedRequestTimestamps = this.sharedRequestTimestamps;
+    // Abort subagents when their parent session is evicted.
+    this.evictor.onEvict = (sessionId: string) => {
+      getSubagentManager().abortAllForParent(sessionId);
+    };
+    // Protect parent sessions that have active subagents from eviction.
+    this.evictor.shouldProtect = (sessionId: string) => {
+      const children = getSubagentManager().getChildrenOf(sessionId);
+      return children.some((c) => c.status === 'running' || c.status === 'pending');
+    };
+    // When a subagent finishes, inject the result into the parent session
+    // so the LLM automatically informs the user.
+    getSubagentManager().onSubagentFinished = (parentSessionId, message, sendToClient, notification) => {
+      const parentSession = this.sessions.get(parentSessionId);
+      if (!parentSession) {
+        log.warn({ parentSessionId }, 'Subagent finished but parent session not found');
+        return;
+      }
+      const requestId = `subagent-notify-${Date.now()}`;
+      // Store structured notification data in the DB for history reconstruction
+      const metadata = { subagentNotification: notification };
+      const enqueueResult = parentSession.enqueueMessage(message, [], sendToClient, requestId, undefined, undefined, metadata);
+      if (enqueueResult.rejected) {
+        log.warn({ parentSessionId }, 'Parent session queue full, dropping subagent notification');
+        return;
+      }
+      if (!enqueueResult.queued) {
+        // Parent is idle — send directly.
+        const messageId = parentSession.persistUserMessage(message, [], undefined, metadata);
+        parentSession.runAgentLoop(message, messageId, sendToClient).catch((err) => {
+          log.error({ parentSessionId, err }, 'Failed to process subagent notification in parent');
+        });
+      }
+      // If queued, it will be processed when the parent finishes its current turn.
+    };
+  }
+
+  async start(): Promise<void> {
+    // Clean up stale socket (only if it's actually a Unix socket)
+    removeSocketFile(this.socketPath);
+
+    // Initialize providers from config so they're available before any
+    // session is created. Without this, getProvider() throws because the
+    // registry is empty until a config file change triggers a reload.
+    const config = getConfig();
+    initializeProviders(config);
+    this.lastConfigFingerprint = this.configFingerprint(config);
+
+    try {
+      bootstrapHomeBaseAppLink();
+    } catch (err) {
+      log.warn({ err }, 'Failed to bootstrap Home Base app link at daemon startup');
+    }
+
+    this.evictor.start();
+
+    // Register daemon callbacks so tools can trigger work item execution
+    registerDaemonCallbacks({
+      getOrCreateSession: (conversationId) => this.getOrCreateSession(conversationId),
+      broadcast: (msg) => this.broadcast(msg),
+    });
+
+    ensureBlobDir();
+    this.blobSweepTimer = setInterval(() => {
+      sweepStaleBlobs(30 * 60 * 1000).catch((err) => {
+        log.warn({ err }, 'Blob sweep failed');
+      });
+    }, 5 * 60 * 1000);
+
+    this.startFileWatchers();
+
+    // Reuse existing session token from disk if present, so pairing
+    // (e.g. iOS QR code) survives daemon restarts. Only generate a
+    // new token when none exists on disk.
+    const tokenPath = getSessionTokenPath();
+    let existingToken: string | null = null;
+    try {
+      const raw = readFileSync(tokenPath, 'utf-8').trim();
+      if (raw.length >= 32) existingToken = raw;
+    } catch { /* file doesn't exist yet */ }
+
+    if (existingToken) {
+      this.sessionToken = existingToken;
+      log.info({ tokenPath }, 'Reusing existing session token');
+    } else {
+      this.sessionToken = randomBytes(32).toString('hex');
+      writeFileSync(tokenPath, this.sessionToken, { mode: 0o600 });
+      chmodSync(tokenPath, 0o600);
+      log.info({ tokenPath }, 'New session token generated');
+    }
+
+    // Generate TLS certificate before starting listeners so it's
+    // available synchronously in the listen callback.
+    let tlsCreds: { cert: string; key: string; fingerprint: string } | null = null;
+    if (isTCPEnabled()) {
+      try {
+        tlsCreds = await ensureTlsCert();
+      } catch (err) {
+        log.error({ err }, 'Failed to generate TLS certificate — TCP listener will not start');
+      }
+    }
+
+    return new Promise((resolve, reject) => {
+      this.server = net.createServer((socket) => {
+        this.handleConnection(socket);
+      });
+
+      const oldUmask = process.umask(0o177);
+
+      this.server.once('error', (err) => {
+        process.umask(oldUmask);
+        log.error({ err, socketPath: this.socketPath }, 'Server failed to start (is another daemon already running?)');
+        reject(err);
+      });
+
+      this.server.listen(this.socketPath, () => {
+        process.umask(oldUmask);
+        // Replace the one-shot startup handler with a permanent one
+        this.server!.removeAllListeners('error');
+        this.server!.on('error', (err) => {
+          log.error({ err, socketPath: this.socketPath }, 'Server socket error while running');
+        });
+        chmodSync(this.socketPath, 0o600);
+        log.info({ socketPath: this.socketPath }, 'Daemon server listening');
+
+        // Start TLS-encrypted TCP listener for iOS clients (alongside the Unix socket)
+        if (tlsCreds) {
+          const tcpPort = getTCPPort();
+          const tcpHost = getTCPHost();
+          this.tcpServer = tls.createServer(
+            { cert: tlsCreds.cert, key: tlsCreds.key },
+            (socket) => { this.handleConnection(socket); },
+          );
+          this.tcpServer.on('error', (err) => {
+            log.error({ err, tcpPort }, 'TLS TCP server error');
+          });
+          const fingerprint = tlsCreds.fingerprint;
+          this.tcpServer.listen(tcpPort, tcpHost, () => {
+            const localIP = getLocalIPv4();
+            log.info(
+              { tcpPort, tcpHost, fingerprint, localIP, iosPairing: isIOSPairingEnabled() },
+              'TLS TCP listener started',
+            );
+            if (isIOSPairingEnabled() && localIP) {
+              log.warn(
+                { localIP, tcpPort },
+                'iOS pairing enabled — daemon is reachable on the local network at %s:%d',
+                localIP, tcpPort,
+              );
+            }
+          });
+        }
+
+        resolve();
+      });
+    });
+  }
+
+  async stop(): Promise<void> {
+    getSubagentManager().disposeAll();
+    this.evictor.stop();
+    if (this.blobSweepTimer) {
+      clearInterval(this.blobSweepTimer);
+      this.blobSweepTimer = null;
+    }
+    this.stopFileWatchers();
+
+    // Session token is intentionally kept on disk so pairing
+    // (e.g. iOS QR code) survives daemon restarts. To regenerate,
+    // delete ~/.vellum/session-token and restart the daemon.
+
+    for (const timer of this.authTimeouts.values()) {
+      clearTimeout(timer);
+    }
+    this.authTimeouts.clear();
+    this.authenticatedSockets.clear();
+
+    // 1. Stop accepting new connections first. server.close() prevents new
+    //    connections from arriving, so the cleanup below won't race with
+    //    handleConnection() adding sockets that never get destroyed.
+    //    Its callback fires once all existing connections have ended.
+    const serverClosed = new Promise<void>((resolve) => {
+      if (this.server) {
+        this.server.close(() => {
+          try {
+            removeSocketFile(this.socketPath);
+          } catch (err) {
+            log.warn({ err, socketPath: this.socketPath }, 'Failed to remove socket file during shutdown');
+          }
+          resolve();
+        });
+      } else {
+        resolve();
+      }
+    });
+
+    const tcpServerClosed = new Promise<void>((resolve) => {
+      if (this.tcpServer) {
+        this.tcpServer.close(() => resolve());
+        this.tcpServer = null;
+      } else {
+        resolve();
+      }
+    });
+
+    // 2. Now dispose sessions and destroy sockets. This lets server.close()
+    //    finish promptly since all connections will be ended.
+    for (const session of this.sessions.values()) {
+      session.dispose();
+    }
+    this.sessions.clear();
+
+    for (const cuSession of this.cuSessions.values()) {
+      cuSession.abort();
+    }
+    this.cuSessions.clear();
+    this.socketToCuSession.clear();
+
+    for (const socket of this.connectedSockets) {
+      socket.destroy();
+    }
+    this.connectedSockets.clear();
+    this.socketToSession.clear();
+    this.socketSandboxOverride.clear();
+    this.cuObservationParseSequence.clear();
+
+    await Promise.all([serverClosed, tcpServerClosed]);
+    log.info('Daemon server stopped');
+  }
+
+  private startFileWatchers(): void {
+    const rootDir = getRootDir();
+    const workspaceDir = getWorkspaceDir();
+    const protectedDir = join(rootDir, 'protected');
+
+    // Watch workspace directory for config + prompt files
+    const workspaceHandlers: Record<string, () => void> = {
+      'config.json': () => {
+        if (this.suppressConfigReload) return;
+        try {
+          this.refreshConfigFromSources();
+        } catch (err) {
+          log.error({ err, configPath: join(workspaceDir, 'config.json') }, 'Failed to reload config after file change. Previous config remains active.');
+          return;
+        }
+      },
+      'SOUL.md': () => this.evictSessionsForReload(),
+      'IDENTITY.md': () => this.evictSessionsForReload(),
+      'USER.md': () => this.evictSessionsForReload(),
+      'LOOKS.md': () => this.evictSessionsForReload(),
+    };
+
+    // Watch protected/ for trust rules and secret allowlist
+    const protectedHandlers: Record<string, () => void> = {
+      'trust.json': () => {
+        clearTrustCache();
+      },
+      'secret-allowlist.json': () => {
+        resetAllowlist();
+        try {
+          const errors = validateAllowlistFile();
+          if (errors && errors.length > 0) {
+            for (const e of errors) {
+              log.warn({ index: e.index, pattern: e.pattern }, `Invalid regex in secret-allowlist.json: ${e.message}`);
+            }
+          }
+        } catch (err) {
+          log.warn({ err }, 'Failed to validate secret-allowlist.json');
+        }
+      },
+    };
+
+    const watchDir = (dir: string, handlers: Record<string, () => void>, label: string): void => {
+      try {
+        const watcher = watch(dir, (_eventType, filename) => {
+          if (!filename) return;
+          const file = String(filename);
+          if (!handlers[file]) return;
+          this.debounceTimers.schedule(`file:${file}`, () => {
+            log.info({ file }, 'File changed, reloading');
+            handlers[file]();
+          });
+        });
+        this.watchers.push(watcher);
+        log.info({ dir }, `Watching ${label}`);
+      } catch (err) {
+        log.warn({ err, dir }, `Failed to watch ${label}. Hot-reload will be unavailable.`);
+      }
+    };
+
+    watchDir(workspaceDir, workspaceHandlers, 'workspace directory for config/prompt changes');
+    if (existsSync(protectedDir)) {
+      watchDir(protectedDir, protectedHandlers, 'protected directory for trust/allowlist changes');
+    }
+
+    this.startSkillsWatchers(() => this.evictSessionsForReload());
+  }
+
+  private configFingerprint(config: ReturnType<typeof getConfig>): string {
+    return JSON.stringify(config);
+  }
+
+  /**
+   * Record the runtime HTTP server port and broadcast it to all
+   * connected clients so they can enable the share UI immediately.
+   */
+  setHttpPort(port: number): void {
+    this.httpPort = port;
+    // Clients that connected before the HTTP server started received
+    // daemon_status with no httpPort. Broadcast the updated port so
+    // they can enable the share UI without reconnecting.
+    this.broadcast({
+      type: 'daemon_status',
+      httpPort: port,
+      version: daemonVersion,
+    });
+  }
+
+  /**
+   * Dispose and remove all in-memory sessions unconditionally.
+   * Called after `sessions clear` wipes the database so that stale
+   * sessions don't reference deleted conversation rows.
+   */
+  clearAllSessions(): number {
+    const count = this.sessions.size;
+    const subagentManager = getSubagentManager();
+    for (const id of this.sessions.keys()) {
+      this.evictor.remove(id);
+      subagentManager.abortAllForParent(id);
+    }
+    for (const session of this.sessions.values()) {
+      session.dispose();
+    }
+    this.sessions.clear();
+    this.sessionOptions.clear();
+    return count;
+  }
+
+  private evictSessionsForReload(): void {
+    const subagentManager = getSubagentManager();
+    for (const [id, session] of this.sessions) {
+      if (!session.isProcessing()) {
+        subagentManager.abortAllForParent(id);
+        session.dispose();
+        this.sessions.delete(id);
+        this.evictor.remove(id);
+      } else {
+        session.markStale();
+      }
+    }
+  }
+
+  /**
+   * Reload config from disk + secure storage, and refresh providers only
+   * when effective config values (including API keys) have changed.
+   */
+  private refreshConfigFromSources(): boolean {
+    invalidateConfigCache();
+    const config = getConfig();
+    const fingerprint = this.configFingerprint(config);
+    if (fingerprint === this.lastConfigFingerprint) {
+      return false;
+    }
+    // Default trust rules depend on config (e.g. skills.load.extraDirs),
+    // so clear the trust cache so rules are regenerated from fresh config.
+    clearTrustCache();
+    clearEmbeddingBackendCache();
+    const isFirstInit = this.lastConfigFingerprint === '';
+    initializeProviders(config);
+    this.lastConfigFingerprint = fingerprint;
+    if (!isFirstInit) {
+      this.evictSessionsForReload();
+    }
+    return true;
+  }
+
+  private stopFileWatchers(): void {
+    this.debounceTimers.cancelAll();
+    for (const watcher of this.watchers) {
+      watcher.close();
+    }
+    this.watchers = [];
+  }
+
+  private startSkillsWatchers(evictSessions: () => void): void {
+    const skillsDir = getWorkspaceSkillsDir();
+    if (!existsSync(skillsDir)) return;
+
+    const scheduleSkillsReload = (file: string): void => {
+      this.debounceTimers.schedule(`skills:${file}`, () => {
+        log.info({ file }, 'Skill file changed, reloading');
+        evictSessions();
+      });
+    };
+
+    try {
+      const recursiveWatcher = watch(skillsDir, { recursive: true }, (_eventType, filename) => {
+        scheduleSkillsReload(filename ? String(filename) : '(unknown)');
+      });
+      this.watchers.push(recursiveWatcher);
+      log.info({ dir: skillsDir }, 'Watching skills directory recursively');
+      return;
+    } catch (err) {
+      log.info({ err, dir: skillsDir }, 'Recursive skills watch unavailable; using per-directory watchers');
+    }
+
+    const childWatchers = new Map<string, FSWatcher>();
+
+    const watchDir = (dirPath: string, onChange: (filename: string) => void): FSWatcher | null => {
+      try {
+        const watcher = watch(dirPath, (_eventType, filename) => {
+          onChange(filename ? String(filename) : '(unknown)');
+        });
+        this.watchers.push(watcher);
+        return watcher;
+      } catch (err) {
+        log.warn({ err, dirPath }, 'Failed to watch skills directory');
+        return null;
+      }
+    };
+
+    const removeWatcher = (watcher: FSWatcher): void => {
+      const idx = this.watchers.indexOf(watcher);
+      if (idx !== -1) {
+        this.watchers.splice(idx, 1);
+      }
+    };
+
+    const refreshChildWatchers = (): void => {
+      const nextChildDirs = new Set<string>();
+
+      try {
+        const entries = readdirSync(skillsDir, { withFileTypes: true });
+        for (const entry of entries) {
+          if (!entry.isDirectory()) continue;
+          const childDir = join(skillsDir, entry.name);
+          nextChildDirs.add(childDir);
+
+          if (childWatchers.has(childDir)) continue;
+
+          const watcher = watchDir(childDir, (filename) => {
+            const label = filename === '(unknown)' ? entry.name : `${entry.name}/${filename}`;
+            scheduleSkillsReload(label);
+          });
+          if (watcher) {
+            childWatchers.set(childDir, watcher);
+          }
+        }
+      } catch (err) {
+        log.warn({ err, skillsDir }, 'Failed to enumerate skill directories');
+        return;
+      }
+
+      for (const [childDir, watcher] of childWatchers.entries()) {
+        if (nextChildDirs.has(childDir)) continue;
+        watcher.close();
+        childWatchers.delete(childDir);
+        removeWatcher(watcher);
+      }
+    };
+
+    const rootWatcher = watchDir(skillsDir, (filename) => {
+      scheduleSkillsReload(filename);
+      refreshChildWatchers();
+    });
+
+    if (!rootWatcher) return;
+
+    refreshChildWatchers();
+    log.info({ dir: skillsDir }, 'Watching skills directory with non-recursive fallback');
+  }
+
+  private handleConnection(socket: net.Socket): void {
+    if (this.connectedSockets.size >= DaemonServer.MAX_CONNECTIONS) {
+      log.warn({ current: this.connectedSockets.size, max: DaemonServer.MAX_CONNECTIONS }, 'Connection limit reached, rejecting client');
+      socket.once('error', (err) => {
+        log.error({ err }, 'Socket error while rejecting connection');
+      });
+      socket.write(serialize({ type: 'error', message: `Connection limit reached (max ${DaemonServer.MAX_CONNECTIONS})` }));
+      socket.destroy();
+      return;
+    }
+
+    log.info('Client connected');
+    this.connectedSockets.add(socket);
+    const parser = createMessageParser({ maxLineSize: MAX_LINE_SIZE });
+
+    // When the operator explicitly opts into unauthenticated connections
+    // (VELLUM_DAEMON_NOAUTH=1), auto-authenticate so clients that can't
+    // read the local session token file (e.g. SSH-forwarded sockets)
+    // aren't disconnected by the auth timeout. This is intentionally
+    // gated on a separate flag — a custom socket path alone (via
+    // VELLUM_DAEMON_SOCKET) no longer bypasses token auth.
+    if (hasNoAuthOverride()) {
+      this.authenticatedSockets.add(socket);
+      log.warn('Auto-authenticated client (VELLUM_DAEMON_NOAUTH is set — token auth bypassed)');
+      this.send(socket, { type: 'auth_result', success: true });
+      this.sendInitialSession(socket).catch((err) => {
+        log.error({ err }, 'Failed to send initial session info after auto-auth');
+      });
+    }
+
+    // Require authentication before sending session info or accepting
+    // commands. Clients must send { type: 'auth', token } as their
+    // first message within AUTH_TIMEOUT_MS.
+    const authTimer = setTimeout(() => {
+      if (!this.authenticatedSockets.has(socket)) {
+        log.warn('Client failed to authenticate within timeout, disconnecting');
+        this.send(socket, { type: 'error', message: 'Authentication timeout' });
+        socket.destroy();
+      }
+    }, DaemonServer.AUTH_TIMEOUT_MS);
+    this.authTimeouts.set(socket, authTimer);
+
+    socket.on('data', (data) => {
+      const chunkReceivedAtMs = Date.now();
+      const parseStartNs = process.hrtime.bigint();
+      let parsed;
+      try {
+        parsed = parser.feedRaw(data.toString());
+      } catch (err) {
+        log.error({ err }, 'IPC parse error (malformed JSON or message exceeded size limit), dropping client');
+        socket.write(serialize({ type: 'error', message: `IPC parse error: ${(err as Error).message}` }));
+        socket.destroy();
+        return;
+      }
+      const parsedAtMs = Date.now();
+      const parseDurationMs = Number(process.hrtime.bigint() - parseStartNs) / 1_000_000;
+      for (const entry of parsed) {
+        const msg = entry.msg;
+        if (typeof msg === 'object' && msg !== null && (msg as { type?: unknown }).type === 'cu_observation') {
+          const maybeSessionId = (msg as { sessionId?: unknown }).sessionId;
+          const sessionId = typeof maybeSessionId === 'string' ? maybeSessionId : 'unknown';
+          const previousSequence = this.cuObservationParseSequence.get(sessionId) ?? 0;
+          const sequence = previousSequence + 1;
+          this.cuObservationParseSequence.set(sessionId, sequence);
+          log.info({
+            sessionId,
+            sequence,
+            chunkReceivedAtMs,
+            parsedAtMs,
+            parseDurationMs,
+            messageBytes: entry.rawByteLength,
+          }, 'IPC_METRIC cu_observation_parse');
+        }
+        const result = validateClientMessage(msg);
+        if (!result.valid) {
+          log.warn({ reason: result.reason }, 'Invalid IPC message, dropping client');
+          socket.write(serialize({ type: 'error', message: `Invalid message: ${result.reason}` }));
+          socket.destroy();
+          return;
+        }
+
+        // Auth gate: first message must be 'auth' with a valid token.
+        if (!this.authenticatedSockets.has(socket)) {
+          const pendingTimer = this.authTimeouts.get(socket);
+          if (pendingTimer) {
+            clearTimeout(pendingTimer);
+            this.authTimeouts.delete(socket);
+          }
+
+          if (result.message.type === 'auth') {
+            const authMsg = result.message as { type: 'auth'; token: string };
+            if (authMsg.token === this.sessionToken) {
+              this.authenticatedSockets.add(socket);
+              this.send(socket, { type: 'auth_result', success: true });
+              this.sendInitialSession(socket).catch((err) => {
+                log.error({ err }, 'Failed to send initial session info after auth');
+              });
+            } else {
+              log.warn('Client provided invalid auth token');
+              this.send(socket, { type: 'auth_result', success: false, message: 'Invalid token' });
+              socket.destroy();
+            }
+            continue;
+          }
+
+          // Non-auth message from unauthenticated socket
+          log.warn({ type: result.message.type }, 'Unauthenticated client sent non-auth message, disconnecting');
+          this.send(socket, { type: 'error', message: 'Authentication required' });
+          socket.destroy();
+          return;
+        }
+
+        // If an already-authenticated socket sends an auth message (e.g.
+        // auto-auth'd client that also has a local token), respond with
+        // auth_result so the client doesn't hang waiting for the handshake.
+        if (result.message.type === 'auth') {
+          this.send(socket, { type: 'auth_result', success: true });
+          continue;
+        }
+
+        this.dispatchMessage(result.message, socket);
+      }
+    });
+
+    socket.on('close', () => {
+      const pendingAuthTimer = this.authTimeouts.get(socket);
+      if (pendingAuthTimer) {
+        clearTimeout(pendingAuthTimer);
+        this.authTimeouts.delete(socket);
+      }
+      this.authenticatedSockets.delete(socket);
+      this.connectedSockets.delete(socket);
+      this.socketSandboxOverride.delete(socket);
+      const sessionId = this.socketToSession.get(socket);
+      if (sessionId) {
+        const session = this.sessions.get(sessionId);
+        if (session) {
+          session.abort();
+        }
+        getSubagentManager().abortAllForParent(sessionId);
+      }
+      this.socketToSession.delete(socket);
+      const cuSessionIds = this.socketToCuSession.get(socket);
+      if (cuSessionIds) {
+        for (const cuSessionId of cuSessionIds) {
+          this.cuObservationParseSequence.delete(cuSessionId);
+          const cuSession = this.cuSessions.get(cuSessionId);
+          if (cuSession) {
+            cuSession.abort();
+            this.cuSessions.delete(cuSessionId);
+          }
+        }
+      }
+      this.socketToCuSession.delete(socket);
+      log.info('Client disconnected');
+    });
+
+    socket.on('error', (err) => {
+      log.error({ err, remoteAddress: socket.remoteAddress }, 'Client socket error');
+    });
+  }
+
+  /** Low-level wire write — does not publish to the assistant-events hub. */
+  private writeToSocket(socket: net.Socket, msg: ServerMessage): void {
+    if (!socket.destroyed && socket.writable) {
+      socket.write(serialize(msg));
+    }
+  }
+
+  private send(socket: net.Socket, msg: ServerMessage): void {
+    this.writeToSocket(socket, msg);
+    // Best-effort sessionId: prefer message field, fall back to socket binding.
+    const msgRecord = msg as unknown as Record<string, unknown>;
+    const sessionId =
+      ('sessionId' in msg && typeof msgRecord.sessionId === 'string'
+        ? msgRecord.sessionId as string
+        : undefined) ?? this.socketToSession.get(socket);
+    this.publishAssistantEvent(msg, sessionId, this.assistantId);
+  }
+
+  broadcast(msg: ServerMessage, excludeSocket?: net.Socket): void {
+    for (const socket of this.authenticatedSockets) {
+      if (socket === excludeSocket) continue;
+      this.writeToSocket(socket, msg);  // bypass per-socket hub publish
+    }
+    // Publish once for the broadcast. Prefer message-level sessionId; fall back
+    // to excludeSocket's session binding so session-scoped events (e.g.
+    // assistant_text_delta emitted without a sessionId field) are correctly tagged.
+    const msgRecord = msg as unknown as Record<string, unknown>;
+    const sessionId =
+      ('sessionId' in msg && typeof msgRecord.sessionId === 'string'
+        ? msgRecord.sessionId as string
+        : undefined) ?? (excludeSocket ? this.socketToSession.get(excludeSocket) : undefined);
+    this.publishAssistantEvent(msg, sessionId, this.assistantId);
+  }
+
+  /**
+   * Publish `msg` as an `AssistantEvent` to the process-level hub.
+   * Publishes are serialized via a promise chain so that subscribers always
+   * observe events in the order they were sent (e.g. text deltas before
+   * message_complete), even when subscriber callbacks are async.
+   */
+  private _hubChain: Promise<void> = Promise.resolve();
+
+  private publishAssistantEvent(msg: ServerMessage, sessionId?: string, assistantId?: string): void {
+    const event = buildAssistantEvent(assistantId ?? this.assistantId, msg, sessionId);
+    this._hubChain = this._hubChain
+      .then(() => assistantEventHub.publish(event))
+      .catch((err: unknown) => {
+        log.warn({ err }, 'assistant-events hub subscriber threw during IPC send');
+      });
+  }
+
+  private async sendInitialSession(socket: net.Socket): Promise<void> {
+    // Only send session info for an existing conversation. Don't create one —
+    // the client will create its own session via session_create when the user
+    // sends a message. Creating one here would produce an orphaned session
+    // that the macOS client rejects (correlation ID mismatch) but that still
+    // appears in session_list on subsequent launches.
+    const conversation = conversationStore.getLatestConversation();
+    if (!conversation) {
+      this.send(socket, {
+        type: 'daemon_status',
+        httpPort: this.httpPort,
+        version: daemonVersion,
+      });
+      return;
+    }
+
+    // Warm session state for commands like undo/usage after reconnect without
+    // rebinding the active IPC output client to this passive socket.
+    await this.getOrCreateSession(conversation.id, undefined, false);
+
+    this.send(socket, {
+      type: 'session_info',
+      sessionId: conversation.id,
+      title: conversation.title ?? 'New Conversation',
+      threadType: normalizeThreadType(conversation.threadType),
+    });
+
+    this.send(socket, {
+      type: 'daemon_status',
+      httpPort: this.httpPort,
+      version: daemonVersion,
+    });
+  }
+
+  private async getOrCreateSession(
+    conversationId: string,
+    socket?: net.Socket,
+    rebindClient = true,
+    options?: SessionCreateOptions,
+  ): Promise<Session> {
+    let session = this.sessions.get(conversationId);
+    const sendToClient = socket
+      ? (msg: ServerMessage) => this.send(socket, msg)
+      : () => {};
+    const maybeBindClient = (target: Session): void => {
+      if (!rebindClient || !socket) return;
+      target.updateClient(sendToClient);
+      target.setSandboxOverride(this.socketSandboxOverride.get(socket));
+      // Update the sender for any active child subagents so they route
+      // through the new socket instead of the stale one from spawn time.
+      getSubagentManager().updateParentSender(conversationId, sendToClient);
+    };
+
+    // Persist session options so they survive eviction/recreation.
+    if (options && Object.values(options).some(v => v !== undefined)) {
+      this.sessionOptions.set(conversationId, {
+        ...this.sessionOptions.get(conversationId),
+        ...options,
+      });
+    }
+
+    if (!session || (session.isStale() && !session.isProcessing())) {
+      // Dispose the outgoing stale session before replacing it.
+      if (session) {
+        getSubagentManager().abortAllForParent(conversationId);
+        session.dispose();
+      }
+
+      // Check if another caller is already creating this session.
+      // Without this guard, two concurrent getOrCreateSession calls for the
+      // same conversationId would both pass the null/stale check, both create
+      // a Session + loadFromDb(), and the second set() would orphan the first.
+      const pending = this.sessionCreating.get(conversationId);
+      if (pending) {
+        session = await pending;
+        maybeBindClient(session);
+        return session;
+      }
+
+      // Recover stored options for this conversation (survives eviction).
+      const storedOptions = this.sessionOptions.get(conversationId);
+
+      const createPromise = (async () => {
+        const config = getConfig();
+        let provider = getFailoverProvider(config.provider, config.providerOrder);
+        const { rateLimit } = config;
+        if (rateLimit.maxRequestsPerMinute > 0 || rateLimit.maxTokensPerSession > 0) {
+          provider = new RateLimitProvider(provider, rateLimit, this.sharedRequestTimestamps);
+        }
+        const workingDir = getSandboxWorkingDir();
+
+        const systemPrompt = storedOptions?.systemPromptOverride ?? buildSystemPrompt();
+        const maxTokens = storedOptions?.maxResponseTokens ?? config.maxTokens;
+
+        const memoryPolicy = this.deriveMemoryPolicy(conversationId);
+        const newSession = new Session(
+          conversationId,
+          provider,
+          systemPrompt,
+          maxTokens,
+          rebindClient ? sendToClient : () => {},
+          workingDir,
+          (msg) => this.broadcast(msg, socket),
+          memoryPolicy,
+        );
+        // When created without a socket (HTTP path), mark the session
+        // so interactive prompts (e.g. host attachment reads) can fail
+        // fast instead of waiting for a timeout with no client to respond.
+        if (!socket) {
+          newSession.updateClient(sendToClient, true);
+        }
+        await newSession.loadFromDb();
+        this.applyTransportMetadata(newSession, storedOptions);
+        if (rebindClient && socket) {
+          newSession.setSandboxOverride(this.socketSandboxOverride.get(socket));
+        }
+        this.sessions.set(conversationId, newSession);
+        return newSession;
+      })();
+
+      this.sessionCreating.set(conversationId, createPromise);
+      try {
+        session = await createPromise;
+      } finally {
+        this.sessionCreating.delete(conversationId);
+      }
+      this.evictor.touch(conversationId);
+    } else {
+      // Rebind to the new socket so IPC goes to the current client.
+      maybeBindClient(session);
+      this.applyTransportMetadata(session, options);
+      this.evictor.touch(conversationId);
+    }
+    return session;
+  }
+
+  private handlerContext(): HandlerContext {
+    return {
+      sessions: this.sessions,
+      socketToSession: this.socketToSession,
+      cuSessions: this.cuSessions,
+      socketToCuSession: this.socketToCuSession,
+      cuObservationParseSequence: this.cuObservationParseSequence,
+      socketSandboxOverride: this.socketSandboxOverride,
+      sharedRequestTimestamps: this.sharedRequestTimestamps,
+      debounceTimers: this.debounceTimers,
+      suppressConfigReload: this.suppressConfigReload,
+      setSuppressConfigReload: (value: boolean) => { this.suppressConfigReload = value; },
+      updateConfigFingerprint: () => {
+        this.lastConfigFingerprint = this.configFingerprint(getConfig());
+        this.lastConfigRefreshTime = Date.now();
+      },
+      send: (socket, msg) => this.send(socket, msg),
+      broadcast: (msg) => this.broadcast(msg),
+      clearAllSessions: () => this.clearAllSessions(),
+      getOrCreateSession: (id, socket?, rebind?, options?) =>
+        this.getOrCreateSession(id, socket, rebind, options),
+      touchSession: (id) => this.evictor.touch(id),
+    };
+  }
+
+  private dispatchMessage(msg: ClientMessage, socket: net.Socket): void {
+    if (msg.type !== 'ping') {
+      const now = Date.now();
+      if (now - this.lastConfigRefreshTime >= DaemonServer.CONFIG_REFRESH_INTERVAL_MS) {
+        try {
+          this.refreshConfigFromSources();
+          this.lastConfigRefreshTime = now;
+        } catch (err) {
+          log.warn({ err }, 'Failed to refresh config from secure sources before handling IPC message');
+        }
+      }
+    }
+    handleMessage(msg, socket, this.handlerContext());
+  }
+
+  /**
+   * Persist a user message and start the agent loop in the background.
+   * Returns the messageId immediately without waiting for the agent loop
+   * to complete. Used by the HTTP sendMessage endpoint so the response
+   * is not blocked for the duration of the agent loop.
+   */
+  async persistAndProcessMessage(
+    conversationId: string,
+    content: string,
+    attachmentIds?: string[],
+    options?: SessionCreateOptions,
+    sourceChannel?: string,
+  ): Promise<{ messageId: string }> {
+    // Block inbound content that contains secrets — mirrors the IPC check in sessions.ts
+    const ingressCheck = checkIngressForSecrets(content);
+    if (ingressCheck.blocked) {
+      throw new IngressBlockedError(ingressCheck.userNotice!, ingressCheck.detectedTypes);
+    }
+
+    const session = await this.getOrCreateSession(conversationId, undefined, true, options);
+
+    // Reject concurrent requests upfront. The HTTP path should never use
+    // the message queue — it returns 409 to the caller instead.
+    if (session.isProcessing()) {
+      throw new Error('Session is already processing a message');
+    }
+
+    session.setChannelCapabilities(resolveChannelCapabilities(sourceChannel));
+
+    // Resolve attachment IDs to full attachment data for the session
+    const attachments = attachmentIds
+      ? attachmentsStore.getAttachmentsByIds(attachmentIds).map((a) => ({
+          id: a.id,
+          filename: a.originalFilename,
+          mimeType: a.mimeType,
+          data: a.dataBase64,
+        }))
+      : [];
+
+    // Persist the user message immediately after the isProcessing() guard.
+    // This synchronously sets session.processing = true, closing the race
+    // window that previously existed between the guard and the async bridge
+    // check (two concurrent requests could both pass isProcessing() and
+    // race into message handling).
+    const requestId = crypto.randomUUID();
+    const messageId = session.persistUserMessage(content, attachments, requestId);
+
+    // Now that the processing lock is held, check the call-answer bridge.
+    let bridgeHandled = false;
+    try {
+      const bridgeResult = await tryRouteCallMessage(conversationId, content, messageId);
+      bridgeHandled = bridgeResult.handled;
+    } catch (err) {
+      log.warn({ err, conversationId }, 'Call bridge check failed (non-fatal), proceeding with agent loop');
+    }
+
+    if (bridgeHandled) {
+      // The message was consumed by the call system. Release the session.
+      resetSessionProcessingState(session);
+      // Drain any queued messages that arrived while processing was true.
+      session.drainQueue('loop_complete');
+      log.info({ conversationId, messageId }, 'User message consumed by call bridge, skipping agent loop');
+      return { messageId };
+    }
+
+    // Fire-and-forget the agent loop. Errors are logged but do not
+    // affect the HTTP response (the client polls GET /messages).
+    session.runAgentLoop(content, messageId, () => {}).catch((err) => {
+      log.error({ err, conversationId }, 'Background agent loop failed');
+    });
+
+    return { messageId };
+  }
+
+  /**
+   * Process a message from the HTTP runtime API (blocking).
+   * Gets or creates a session and runs the full agent loop before returning.
+   * Used by the channel inbound endpoint which needs the assistant reply.
+   */
+  async processMessage(
+    conversationId: string,
+    content: string,
+    attachmentIds?: string[],
+    options?: SessionCreateOptions,
+    sourceChannel?: string,
+  ): Promise<{ messageId: string }> {
+    // Block inbound content that contains secrets — mirrors the IPC check in sessions.ts
+    const ingressCheck = checkIngressForSecrets(content);
+    if (ingressCheck.blocked) {
+      throw new IngressBlockedError(ingressCheck.userNotice!, ingressCheck.detectedTypes);
+    }
+
+    const session = await this.getOrCreateSession(conversationId, undefined, true, options);
+
+    if (session.isProcessing()) {
+      throw new Error('Session is already processing a message');
+    }
+
+    session.setChannelCapabilities(resolveChannelCapabilities(sourceChannel));
+
+    // Resolve attachment IDs to full attachment data for the session
+    const attachments = attachmentIds
+      ? attachmentsStore.getAttachmentsByIds(attachmentIds).map((a) => ({
+          id: a.id,
+          filename: a.originalFilename,
+          mimeType: a.mimeType,
+          data: a.dataBase64,
+        }))
+      : [];
+
+    // Resolve slash commands before persistence (synchronous — no race window).
+    const slashResult = resolveSlash(content);
+
+    // Unknown slash command — persist the exchange (user + assistant) and
+    // return immediately. This path doesn't set processing=true since no
+    // agent loop runs, so there is no race concern.
+    if (slashResult.kind === 'unknown') {
+      const userMsg = createUserMessage(content, attachments);
+      const persisted = conversationStore.addMessage(
+        conversationId,
+        'user',
+        JSON.stringify(userMsg.content),
+      );
+      session.getMessages().push(userMsg);
+
+      const assistantMsg = createAssistantMessage(slashResult.message);
+      conversationStore.addMessage(
+        conversationId,
+        'assistant',
+        JSON.stringify(assistantMsg.content),
+      );
+      session.getMessages().push(assistantMsg);
+      return { messageId: persisted.id };
+    }
+
+    const resolvedContent = slashResult.content;
+
+    // Preactivate skill tools when slash resolution identifies a known skill
+    if (slashResult.kind === 'rewritten') {
+      (session as unknown as { preactivatedSkillIds?: string[] }).preactivatedSkillIds = [slashResult.skillId];
+    }
+
+    // Persist the user message immediately after the isProcessing() guard.
+    // This synchronously sets session.processing = true, closing the race
+    // window that previously existed between the guard and the async bridge
+    // check.
+    const requestId = crypto.randomUUID();
+    let messageId: string;
+    try {
+      messageId = session.persistUserMessage(resolvedContent, attachments, requestId);
+    } catch (err) {
+      // runAgentLoop never ran, so its finally block won't clear this
+      (session as unknown as { preactivatedSkillIds?: string[] }).preactivatedSkillIds = undefined;
+      throw err;
+    }
+
+    // Now that the processing lock is held, check the call-answer bridge.
+    let bridgeHandled = false;
+    try {
+      const bridgeResult = await tryRouteCallMessage(conversationId, resolvedContent, messageId);
+      bridgeHandled = bridgeResult.handled;
+    } catch (err) {
+      log.warn({ err, conversationId }, 'Call bridge check failed (non-fatal), proceeding with agent loop');
+    }
+
+    if (bridgeHandled) {
+      // The message was consumed by the call system. Release the session.
+      (session as unknown as { preactivatedSkillIds?: string[] }).preactivatedSkillIds = undefined;
+      resetSessionProcessingState(session);
+      // Drain any queued messages that arrived while processing was true.
+      session.drainQueue('loop_complete');
+      log.info({ conversationId, messageId }, 'User message consumed by call bridge, skipping agent loop');
+      return { messageId };
+    }
+
+    // Run the agent loop (blocking — the channel inbound endpoint needs the reply).
+    await session.runAgentLoop(resolvedContent, messageId, () => {});
+
+    return { messageId };
+  }
+
+  /**
+   * Create a RunOrchestrator wired to this server's session management.
+   */
+  createRunOrchestrator(): RunOrchestrator {
+    return new RunOrchestrator({
+      getOrCreateSession: (conversationId) =>
+        this.getOrCreateSession(conversationId),
+      resolveAttachments: (attachmentIds) =>
+        attachmentsStore.getAttachmentsByIds(attachmentIds).map((a) => ({
+          id: a.id,
+          filename: a.originalFilename,
+          mimeType: a.mimeType,
+          data: a.dataBase64,
+        })),
+      deriveDefaultStrictSideEffects: (conversationId) =>
+        this.deriveMemoryPolicy(conversationId).strictSideEffects,
+    });
+  }
+
+}
+
+/**
+ * Reset the processing state set by `persistUserMessage` when the agent loop
+ * is intentionally skipped (e.g. call-answer bridge consumed the message).
+ */
+function resetSessionProcessingState(session: Session): void {
+  const s = session as unknown as {
+    processing: boolean;
+    abortController: AbortController | null;
+    currentRequestId: string | undefined;
+  };
+  s.processing = false;
+  s.abortController = null;
+  s.currentRequestId = undefined;
+}