@yunazgr/pi-companion 0.3.5 → 0.3.6

package/README.md

@@ -2,7 +2,9 @@
 
 Lightweight, local-first remote control for Pi sessions.
 
-**New in 0.3.5:** Shared files now have authenticated Download buttons, filename filtering, and You / Agent source badges. Custom terminal popups retain the scrollable claymorphism viewer and touch-friendly controls introduced in 0.3.4.
+**New in 0.3.6:** The extension automatically ensures the background daemon is available, while sessions stay private until `/remote-control`. Per-user services restart the daemon; concurrent startup is locked and upgrades verify the replacement first. Subscription limits are tracked separately for supported OAuth providers, and provider failures appear as clear messages in the activity feed.
+
+When a session is shared, Companion fetches OpenAI Codex and Anthropic subscription usage via Pi's existing OAuth resolver, independently per provider with five-minute caching and failure backoff. Credentials are never sent to the browser or stored by the daemon. API-key accounts and unsupported providers have no built-in subscription lookup; extensions can still publish the neutral telemetry contract. Provider rate-limit, quota and authentication failures are shown in the activity feed with safe remediation guidance rather than raw provider payloads.
 
 Filename search is case-insensitive. New browser uploads are marked **You**; local agent uploads can declare **Agent** by posting to `/api/sessions/{session_id}/files?source=agent`. This query is honored only on the local admin endpoint; remote uploads always remain user uploads. Older files without provenance show **Unknown**. Source badges describe upload provenance, not file-content authorship.
 
@@ -29,9 +31,9 @@ or straight from git:
 
     pi install git:github.com/ygrip/pi-companion
 
-Then start Pi as usual. Installing the Pi extension is enough for normal use: the extension does not probe, connect to, download, or start a daemon until you run `/companion` in that session. On first use it downloads the matching sha256-verified daemon binary from GitHub Releases, caches it under `~/.pi/agent/pi-companion/bin/<version>/`, and reuses the same daemon across Pi sessions.
+Then start Pi as usual. When the extension loads, it checks the local daemon and starts it if needed, downloading the matching sha256-verified release into `~/.pi/agent/pi-companion/bin/<version>/`. Daemon startup does **not** share your session.
 
-Use `/companion` in each session you want to share with paired devices. It enables remote access for that session and prints the local dashboard address. `/companion off` stops sharing that session.
+Use `/remote-control` in any session to toggle sharing; `/remote-control on` and `/remote-control off` are explicit alternatives. No `/companion` prerequisite. `/companion` and `/companion off` remain compatibility aliases.
 
 You do **not** need to run `pi-companion-server` manually for a normal npm install. Manual daemon startup is mainly for local development, debugging, or when `PI_COMPANION_AUTOSTART=0` is set.
 
@@ -82,25 +84,19 @@ For a normal install:
 
     pi install npm:@yunazgr/pi-companion
 
-That is enough. Start Pi normally, then run `/companion` in the session you want to share. Only then does the extension connect or start the daemon on demand and keep its daemon version aligned with the installed extension. Updating the Pi package is therefore enough to update both pieces. You do not need a separate terminal, launch agent, system service, or manual `pi-companion-server` process.
+Start Pi normally; daemon availability is automatic. Sessions stay private until `/remote-control` enables sharing. Updating the package and reloading Pi upgrades the daemon to the matching release; older Pi processes do not downgrade a newer daemon.
 
 The lifecycle is:
 
-1. A Pi session loads the extension without daemon network or startup work.
-2. You run `/companion` in that session; the extension probes `http://127.0.0.1:43721`.
-3. If the daemon is already running, this opted-in session connects to it.
-4. If not, the extension resolves the daemon binary, downloading the matching GitHub Release on first use if necessary.
-5. It starts the daemon detached in the background.
-6. Other Pi sessions reuse the same daemon only after their own `/companion` command. New sessions start disconnected, even when another session has enabled Companion.
-7. On extension upgrades, the extension compares its package version with the running daemon. If they differ, it stops the old local daemon, resolves/downloads the matching release, and starts the new daemon automatically.
-8. The daemon keeps running independently until it is stopped or the machine restarts.
-
-There is exactly one daemon per machine, shared by every Pi session. The extension manages it with no configuration:
+1. Extension startup probes the daemon and repeats the check every 30 seconds while Pi is open, without publishing this session.
+2. A process-owned startup lock serializes concurrent sessions, including long downloads. The daemon also refuses duplicate port binds.
+3. Resolve/download and version-check the replacement **before** stopping the existing daemon. Missing releases or invalid binaries leave the old daemon untouched; there is no latest-release fallback.
+4. When starting a managed daemon, register one per-user background service: macOS `launchd`, Linux `systemd --user`, or Windows Task Scheduler. Its supervisor restarts the daemon after crashes and reads the updated binary configuration after upgrades.
+5. If service registration is unavailable (for example no Linux user systemd or insufficient Windows permissions), warn and start a detached daemon instead. Extension-load and periodic checks remain the fallback.
+6. `/remote-control` toggles only the current session. Session switches reset sharing; turning sharing off never shuts down the daemon.
+7. Upgrades close sockets so browsers and opted-in Pi sessions reconnect. Active automation runs are stopped during daemon shutdown; the in-memory feed and temporary-file registry do not survive daemon replacement.
 
-1. It probes http://127.0.0.1:43721. If anything answers (a daemon started by another session, or one you ran yourself with cargo run), it just connects. It never starts a second copy.
-2. If nothing answers, one Pi session takes a lock (so several sessions starting at once don't race), launches the daemon detached, and waits for it to be ready. The others wait for that daemon.
-3. If a live connection drops, the extension waits 20 seconds before launching a replacement, so restarting a dev daemon doesn't get pre-empted.
-4. The daemon also refuses to run twice: if its ports are taken it prints a message and exits 0.
+Services run with your user privileges, not administrator/root privileges. Login/logout behavior depends on the OS: Linux may need user lingering for logout persistence, and Windows scheduling may be restricted by policy. A pre-existing same-version manual daemon is reused without takeover; service registration happens when Companion needs to start or upgrade it. Package installation alone does not execute a downloader—Pi must load the extension once.
 
 The daemon binary is resolved in this order:
 
@@ -112,13 +108,17 @@ The daemon binary is resolved in this order:
 | 4 | pi-companion-server on PATH |
 | 5 | download of the GitHub release matching the package version, verified against SHA256SUMS, then cached |
 
+To remove background startup, first set `PI_COMPANION_SERVICE=0` for Pi, then disable the per-user service: macOS `launchctl bootout gui/$(id -u)/dev.pi-companion.daemon` and remove `~/Library/LaunchAgents/dev.pi-companion.daemon.plist`; Linux `systemctl --user disable --now pi-companion.service` and remove `~/.config/systemd/user/pi-companion.service`; Windows `schtasks /End /TN "Pi Companion"` then `schtasks /Delete /TN "Pi Companion" /F`. Package removal alone does not uninstall an OS service. The supervisor/configuration lives under the daemon home directory's `service/` folder.
+
 Optional environment variables (none are required):
 
 | Variable | Effect |
 |---|---|
 | PI_COMPANION_SERVER | use this daemon binary |
 | PI_COMPANION_URL | daemon WebSocket URL (default ws://127.0.0.1:43721); autostart only happens for loopback URLs |
-| PI_COMPANION_AUTOSTART=0 | never launch a daemon, only connect |
+| PI_COMPANION_AUTOSTART=0 | disable automatic starts/upgrades and startup monitoring (does not uninstall a previously registered service) |
+| PI_COMPANION_SERVICE=0 | use detached startup instead of registering a background service (does not uninstall an existing service) |
+| PI_COMPANION_QUOTAS=0 | disable Companion's OAuth subscription-limit requests |
 | PI_COMPANION_PUBLIC_URL | daemon-side: public URL embedded in pairing QR codes |
 | PI_COMPANION_ALLOWED_ORIGINS | daemon-side: extra comma-separated browser origins accepted besides the loopback addresses and the public URL |
 | PI_COMPANION_ADMIN_ADDR, PI_COMPANION_DEVICE_ADDR | daemon-side: loopback listen addresses (default `127.0.0.1:43721` / `127.0.0.1:43722`), for running a second daemon next to the usual one, e.g. for screenshots. The extension still looks for 43721 unless `PI_COMPANION_URL` points elsewhere |
@@ -147,7 +147,7 @@ Inside any Pi session:
     /companion off      # stop sharing this session
     /remote-control     # toggle sharing on/off
 
-A paired device cannot access sessions that have not explicitly enabled remote control. Turning `/remote-control` off or running `/companion off` closes this session’s daemon channel: it disappears from paired devices and becomes **Ended** on the local dashboard. Pi continues locally; local Pi history is untouched. Sharing does not reconnect itself while disabled. After the initial opt-in, `/remote-control` can enable sharing again; `/companion` can also resume it. Temporary uploads follow the usual disconnected-session cleanup below.
+A paired device cannot access sessions that have not explicitly enabled remote control. Turning `/remote-control` off or running `/companion off` closes this session’s daemon channel: it disappears from paired devices and becomes **Ended** on the local dashboard. Pi continues locally; local Pi history is untouched. Sharing does not reconnect itself while disabled. `/remote-control` can enable sharing directly, including on a fresh session; `/companion` can also resume it. Temporary uploads follow the usual disconnected-session cleanup below.
 
 ## Questions from Pi
 
@@ -192,7 +192,7 @@ Each paired device shows a live **Connected** / **Disconnected** status (with th
 
 Paired devices (name, browser user agent, pairing and last-seen times, credential hash) and settings survive daemon restarts. They are stored in `~/.pi/agent/pi-companion/state.json`, created with mode 0600 inside a 0700 directory and replaced atomically; a looser mode found on startup is tightened. Override the directory with `PI_COMPANION_HOME`.
 
-A phone pairs once with the daemon. Individual Pi sessions still opt in using /companion.
+A phone pairs once with the daemon. Individual Pi sessions opt in using `/remote-control`.
 
 Network loss and daemon restarts reconnect automatically with bounded backoff. Heartbeats detect silent connections, and returning to the foreground or restoring network access retries immediately. Pairing credentials and unsent drafts survive outages; session snapshots, pending questions, and previously loaded upload lists refresh on reconnect. Recent activity is replayed from the daemon’s bounded log, but prompts/answers are never automatically resent. A deliberate **Disconnect** waits for the device’s explicit retry; **Revoke** removes access and requires pairing again.
 
@@ -426,7 +426,7 @@ To test the same behavior as a published install, stop any development daemon fi
 
     pi install npm:@yunazgr/pi-companion
 
-Then start Pi and run `/companion`. The extension downloads and starts the released daemon on demand; merely starting Pi does neither.
+Then start Pi. Extension startup ensures the released daemon is available; use `/remote-control` only for sessions you want to share.
 
 ## Releases
 
@@ -440,7 +440,7 @@ Before publishing, the workflow requires X.Y.Z to match both package.json and se
 
 Only after the GitHub Release exists, the same tag publishes @yunazgr/pi-companion to npm with provenance through npm Trusted Publishing (GitHub OIDC). No long-lived NPM_TOKEN is required. The trusted publisher should point to GitHub owner ygrip, repository pi-companion, workflow release.yml. Git installs need no npm credential.
 
-On first use the extension downloads `pi-companion-server-<os>-<arch>` for its own package version (`releases/download/v<version>/`), verifies it against `SHA256SUMS`, and caches it under `~/.pi/agent/pi-companion/bin/<version>/`. On later extension upgrades it detects a running daemon with a different version, stops it locally, and starts the matching daemon automatically. A git install from a branch that is ahead of the newest tag falls back to the latest release.
+On extension load, Companion downloads `pi-companion-server-<os>-<arch>` for its own package version (`releases/download/v<version>/`) if needed, verifies `SHA256SUMS` and the binary version, and caches it under `~/.pi/agent/pi-companion/bin/<version>/`. Upgrades prepare the replacement before gracefully stopping the older daemon. Git installs ahead of the newest release must provide a matching local build; missing releases never trigger a downgrade or shutdown.
 
 ## Security boundary
 

package/SECURITY.md

@@ -24,6 +24,8 @@ Strict Origin checks: WebSocket upgrades and POST/DELETE requests must carry an
 
 Pairing invitations are single-use and expire (5 minutes by default). The short typed code is rate limited: ten wrong codes within ten minutes withdraw every open invitation and further code claims get HTTP 429 until the window passes.
 
+Extension startup may download/start the daemon and register a per-user login service (launchd, systemd user service, or Windows scheduled task), but never activates normal session sharing. Services run with the current user's permissions. Downloads are SHA256-verified and version-checked before an older daemon is stopped. `PI_COMPANION_AUTOSTART=0` disables extension-managed starts/upgrades; `PI_COMPANION_SERVICE=0` disables new service registration. Neither setting uninstalls an existing service; see README for removal instructions.
+
 Paired devices can see only sessions that explicitly enabled remote control, including daemon-owned automation sessions created by an authorized automation run. Paired devices may read automation definitions/history and start/stop existing automations, but cannot create, edit, delete, or enable/disable them.
 
 Revoking a device deletes its credential hash and closes its open connections immediately (WebSocket close 4003). Disconnecting closes them without deleting the credential (close 4001).

package/docs/automations.md

@@ -78,7 +78,7 @@ The extension registers `companion_automation` and ships the `companion-automati
 {"action":"create","automation":{"name":"Check","enabled":true,"schedule":null,"preconditions":[],"actions":[{"type":"command","command":"git","args":["status","--short"],"cwd":"/absolute/project"}],"postActions":[]}}
 ```
 
-Tools only contact an already-running daemon. They never download/start one or activate sharing for a normal Pi session. Start Companion explicitly via `/companion` or `npm run serve` first. Inspect the final run status rather than assuming an accepted start means success.
+Tools only contact an already-running daemon. They never download/start one or activate sharing for a normal Pi session. The extension checks/starts the daemon automatically on load, without sharing a session. Standalone MCP users can start it via `npm run serve`. Inspect the final run status rather than assuming an accepted start means success.
 
 ## Standalone MCP
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yunazgr/pi-companion",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "description": "Local-first remote control for Pi sessions: live activity feed, steering, git diff, file drop and phone pairing from a single Rust daemon.",
   "keywords": [
     "pi-package",

package/skills/companion-automations/SKILL.md

@@ -5,7 +5,7 @@ description: Create, update, delete, enable, disable, run, stop, and inspect Pi
 
 # Companion automations
 
-Use `companion_automation` (native extension or standalone MCP surface). It talks only to the local admin daemon; it does not launch the daemon or enable session sharing. If unavailable, ask the user to start Companion with `/companion` or `npm run serve`.
+Use `companion_automation` (native extension or standalone MCP surface). It talks only to the local admin daemon; it does not launch the daemon or enable session sharing. The Pi extension checks/starts the daemon on load independently of session sharing. If unavailable, reload the extension or start a development daemon with `npm run serve`. `/remote-control` is only needed to share a normal session.
 
 ## Safety
 

package/src/background-service.ts

@@ -0,0 +1,65 @@
+import { execFile } from 'node:child_process';
+import { mkdir, writeFile, rename } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { promisify } from 'node:util';
+const exec = promisify(execFile);
+const name = 'pi-companion';
+
+/** A fixed, per-user service name: multiple extensions update the same service under the spawn lock. */
+export async function startBackgroundService(binary: string): Promise<void> {
+  const home = process.env.PI_COMPANION_HOME ?? join(homedir(), '.pi', 'agent', 'pi-companion');
+  const dir = join(home, 'service');
+  await mkdir(dir, { recursive: true, mode: 0o700 });
+  const script = join(dir, 'supervisor.mjs');
+  const config = join(dir, 'daemon.json');
+  const env = Object.fromEntries(Object.entries(process.env).filter(([key, value]) => value && (key.startsWith('PI_COMPANION_') || key === 'PATH')));
+  await writeFile(config + '.tmp', JSON.stringify({ binary, env }), { mode: 0o600 });
+  await rename(config + '.tmp', config);
+  await writeFile(script, `import { spawn } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+let child; let stopping = false;
+function run() {
+  if (stopping) return;
+  try {
+    const { binary, env } = JSON.parse(readFileSync(new URL('./daemon.json', import.meta.url), 'utf8'));
+    child = spawn(binary, [], { env: { ...process.env, ...env }, stdio: 'ignore', windowsHide: true });
+    let scheduled = false;
+    const retry = () => { if (!scheduled && !stopping) { scheduled = true; setTimeout(run, 3000); } };
+    child.once('error', retry); child.once('exit', retry);
+  } catch { setTimeout(run, 3000); }
+}
+for (const signal of ['SIGTERM', 'SIGINT']) process.on(signal, () => { stopping = true; child?.kill('SIGTERM'); setTimeout(() => process.exit(), 1000); });
+run();
+`, { mode: 0o600 });
+  const run = (command: string, args: string[]) => exec(command, args, { timeout: 15_000 });
+  if (process.platform === 'darwin') {
+    const escape = (text: string) => text.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;').replaceAll('"', '&quot;');
+    const label = 'dev.pi-companion.daemon';
+    const plist = join(homedir(), 'Library', 'LaunchAgents', label + '.plist');
+    await mkdir(join(homedir(), 'Library', 'LaunchAgents'), { recursive: true });
+    await writeFile(plist, `<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>Label</key><string>${label}</string><key>ProgramArguments</key><array><string>${escape(process.execPath)}</string><string>${escape(script)}</string></array><key>RunAtLoad</key><true/><key>KeepAlive</key><true/></dict></plist>`, { mode: 0o600 });
+    const domain = 'gui/' + process.getuid!();
+    try { await run('launchctl', ['print', domain + '/' + label]); }
+    catch { await run('launchctl', ['bootstrap', domain, plist]); }
+    await run('launchctl', ['kickstart', domain + '/' + label]);
+  } else if (process.platform === 'linux') {
+    const unitDir = join(homedir(), '.config', 'systemd', 'user');
+    await mkdir(unitDir, { recursive: true });
+    const quote = (text: string) => '"' + text.replaceAll('\\', '\\\\').replaceAll('"', '\\"').replaceAll('%', '%%').replaceAll('$', '$$') + '"';
+    await writeFile(join(unitDir, name + '.service'), `[Unit]\nDescription=Pi Companion daemon\n[Service]\nExecStart=${quote(process.execPath)} ${quote(script)}\nRestart=always\nRestartSec=3\n[Install]\nWantedBy=default.target\n`, { mode: 0o600 });
+    await run('systemctl', ['--user', 'daemon-reload']);
+    await run('systemctl', ['--user', 'enable', '--now', name + '.service']);
+  } else if (process.platform === 'win32') {
+    const escape = (text: string) => text.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;').replaceAll('"', '&quot;');
+    const user = [process.env.USERDOMAIN, process.env.USERNAME].filter(Boolean).join('\\');
+    if (!user) throw new Error('Cannot resolve the current Windows account');
+    const task = join(dir, 'task.xml');
+    // No default 72-hour limit, battery/idle stop, or overlapping task instances.
+    await writeFile(task, `\uFEFF<?xml version="1.0" encoding="UTF-16"?><Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"><Triggers><LogonTrigger><Enabled>true</Enabled><UserId>${escape(user)}</UserId></LogonTrigger></Triggers><Principals><Principal id="User"><UserId>${escape(user)}</UserId><LogonType>InteractiveToken</LogonType><RunLevel>LeastPrivilege</RunLevel></Principal></Principals><Settings><MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy><DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries><StopIfGoingOnBatteries>false</StopIfGoingOnBatteries><ExecutionTimeLimit>PT0S</ExecutionTimeLimit><RestartOnFailure><Interval>PT1M</Interval><Count>999</Count></RestartOnFailure></Settings><Actions Context="User"><Exec><Command>${escape(process.execPath)}</Command><Arguments>&quot;${escape(script)}&quot;</Arguments></Exec></Actions></Task>`, { encoding: 'utf16le', mode: 0o600 });
+    await run('schtasks', ['/Create', '/F', '/TN', 'Pi Companion', '/XML', task]);
+    await run('schtasks', ['/Run', '/TN', 'Pi Companion']);
+  } else {
+    throw new Error('No supported per-user background service on ' + process.platform);
+  }
+}

package/src/bridge.ts

@@ -147,7 +147,7 @@ export class CompanionBridge implements AskChannel {
     return [...this.tempFiles];
   }
 
-  /** Only an explicit /companion command may activate this session's bridge. */
+  /** Only an explicit sharing command may activate this session's bridge. */
   activate() {
     this.activated = true;
     if (this.snapshot.remoteEnabled && this.ctx?.hasUI && !this.restoreDialogs) this.restoreDialogs = relayDialogs(this.ctx.ui, this, this.toolDialogs, this.popups);
@@ -287,7 +287,7 @@ export class CompanionBridge implements AskChannel {
   }
 
   async deleteTempFile(fileId: string) {
-    if (!this.isActivated()) return { ok: false, error: "Run /companion first to enable this session." };
+    if (!this.isActivated()) return { ok: false, error: "Run /remote-control to share this session." };
     const requestId = randomUUID();
     this.send({ type: "file.delete", requestId, fileId });
     return await new Promise<{ ok: boolean; error?: string }>(resolve => {

package/src/daemon.ts

@@ -102,17 +102,9 @@ async function downloadRelease(version: string, log: DaemonLog) {
   const dir = cacheDir(version);
   const target = join(dir, EXE);
   const exact = "https://github.com/" + REPO + "/releases/download/v" + version + "/";
-  // A git install from a branch can be ahead of the newest tag; fall back to the latest release.
-  const latest = "https://github.com/" + REPO + "/releases/latest/download/";
-
   log("Downloading Pi Companion daemon v" + version + "…");
-  let base = exact;
-  let archiveRes = await fetch(base + asset, { signal: AbortSignal.timeout(120_000) });
-  if (archiveRes.status === 404) {
-    log("No daemon release for v" + version + "; using the latest release.", "warning");
-    base = latest;
-    archiveRes = await fetch(base + asset, { signal: AbortSignal.timeout(120_000) });
-  }
+  const base = exact;
+  const archiveRes = await fetch(base + asset, { signal: AbortSignal.timeout(120_000) });
   if (!archiveRes.ok) throw new Error("download failed: " + archiveRes.status + " " + asset);
   const sumsRes = await fetch(base + "SHA256SUMS", { signal: AbortSignal.timeout(30_000) });
   if (!sumsRes.ok) throw new Error("checksum download failed: " + sumsRes.status);
@@ -180,7 +172,14 @@ async function acquireLock() {
   } catch {
     try {
       const info = await stat(lock);
-      if (Date.now() - info.mtimeMs > LOCK_STALE_MS) {
+      const owner = Number(readFileSync(lock, "utf8").trim());
+      let alive = false;
+      if (Number.isInteger(owner) && owner > 1) {
+        try { process.kill(owner, 0); alive = true; }
+        catch (error) { alive = (error as NodeJS.ErrnoException).code !== "ESRCH"; }
+      }
+      // Downloads can take minutes. Age alone must never steal a live owner's lock.
+      if (!alive && Date.now() - info.mtimeMs > LOCK_STALE_MS) {
         await rm(lock, { force: true });
         return await acquireLock();
       }
@@ -199,22 +198,31 @@ async function waitForDaemon(ms: number, expectedVersion?: string) {
   return false;
 }
 
-async function waitForDaemonDown(ms: number) {
+async function waitForDaemonDown(ms: number, old: DaemonContext) {
   const deadline = Date.now() + ms;
   while (Date.now() < deadline) {
-    if (!(await isDaemonUp(300))) return true;
+    const current = await daemonContext(300);
+    if (!current || (current.pid !== undefined && old.pid !== undefined && current.pid !== old.pid)) return true;
     await new Promise(resolve => setTimeout(resolve, 200));
   }
   return false;
 }
 
+export function versionAtLeast(actual: string | undefined, expected: string): boolean {
+  if (actual === expected) return true;
+  if (!actual || !/^\d+\.\d+\.\d+$/.test(actual) || !/^\d+\.\d+\.\d+$/.test(expected)) return false;
+  const a = actual.split('.').map(Number), b = expected.split('.').map(Number);
+  for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] > b[i];
+  return true;
+}
+
 async function stopDaemonForUpgrade(context: DaemonContext, log: DaemonLog) {
   try {
     const response = await fetch(adminHttpUrl() + "/api/shutdown", {
       method: "POST",
       signal: AbortSignal.timeout(2_000)
     });
-    if (response.ok && await waitForDaemonDown(5_000)) return true;
+    if (response.ok && await waitForDaemonDown(5_000, context)) return true;
   } catch {
     // Older daemons do not have /api/shutdown. Fall through to a local process stop.
   }
@@ -222,16 +230,15 @@ async function stopDaemonForUpgrade(context: DaemonContext, log: DaemonLog) {
   try {
     if (typeof context.pid === "number" && Number.isInteger(context.pid) && context.pid > 1) {
       process.kill(context.pid, "SIGTERM");
-    } else if (process.platform === "win32") {
-      await execFileAsync("taskkill", ["/IM", "pi-companion-server.exe", "/F"]);
     } else {
-      await execFileAsync("pkill", ["-f", "pi-companion-server"]);
+      log("The older daemon has no verifiable PID; refusing to stop unrelated processes.", "warning");
+      return false;
     }
   } catch {
     // The process may already have exited between the probe and the stop attempt.
   }
 
-  const stopped = await waitForDaemonDown(5_000);
+  const stopped = await waitForDaemonDown(5_000, context);
   if (!stopped) log("Could not stop the older Pi Companion daemon automatically.", "warning");
   return stopped;
 }
@@ -243,15 +250,29 @@ async function stopDaemonForUpgrade(context: DaemonContext, log: DaemonLog) {
 export async function ensureDaemon(log: DaemonLog) {
   const expectedVersion = packageVersion();
   const running = await daemonContext();
-  if (running?.version === expectedVersion) return true;
+  if (running && versionAtLeast(running.version, expectedVersion)) return true;
   if (process.env.PI_COMPANION_AUTOSTART === "0" || !isLocalTarget()) return Boolean(running);
 
   const release = await acquireLock();
   if (!release) return await waitForDaemon(10_000, expectedVersion); // another Pi session is starting/upgrading it
   try {
     const current = await daemonContext();
-    if (current?.version === expectedVersion) return true;
+    if (current && versionAtLeast(current.version, expectedVersion)) return true;
 
+    // Download and validate before touching the healthy running process.
+    const binary = await resolveDaemonBinary(log);
+    const { stdout } = await execFileAsync(binary, ["--version"], { timeout: 10_000 });
+    if (stdout.trim() !== "pi-companion-server " + expectedVersion) {
+      throw new Error("replacement daemon version does not match installed extension v" + expectedVersion);
+    }
+    let managed = false;
+    if (process.env.PI_COMPANION_SERVICE !== "0") {
+      try {
+        const { startBackgroundService } = await import("./background-service.js");
+        await startBackgroundService(binary); managed = true;
+      }
+      catch (error) { log("Background service unavailable; using detached daemon: " + (error instanceof Error ? error.message : String(error)), "warning"); }
+    }
     if (current) {
       log(
         "Updating Pi Companion daemon from v" + (current.version ?? "unknown") + " to v" + expectedVersion + "…"
@@ -259,7 +280,10 @@ export async function ensureDaemon(log: DaemonLog) {
       if (!(await stopDaemonForUpgrade(current, log))) return false;
     }
 
-    const binary = await resolveDaemonBinary(log);
+    if (managed) {
+      // A supervisor already running the old binary restarts using the updated config.
+      return await waitForDaemon(15_000, expectedVersion);
+    }
     await new Promise<void>((resolve, reject) => {
       const child = spawn(binary, [], { detached: true, stdio: "ignore", windowsHide: true });
       child.once("error", reject);

package/src/index.ts

@@ -1,8 +1,9 @@
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import { formatAnswers, toQuestions } from "./ask.js";
 import { CompanionBridge } from "./bridge.js";
 import { adminHttpUrl, ensureDaemon } from "./daemon.js";
+import { ProviderQuotaPoller, providerError } from "./provider-status.ts";
 import { automationTool, executeAutomation, type AutomationParams } from "./automation.ts";
 
 const AskOptionParam = Type.Union([
@@ -71,6 +72,19 @@ function resultText(result: unknown) {
 export default function companionExtension(pi: ExtensionAPI) {
   let bridge = new CompanionBridge(pi);
   let sharingGeneration = 0;
+  let quotas = new ProviderQuotaPoller(value => bridge.ingestTelemetry(value, 'subscription limits'));
+  let daemonCheck: Promise<boolean> | undefined;
+  let daemonMonitor: ReturnType<typeof setInterval> | undefined;
+  const checkDaemon = (ctx: ExtensionContext) => {
+    if (process.env.PI_COMPANION_AUTOSTART === "0") return Promise.resolve(false);
+    if (!daemonCheck) {
+      daemonCheck = ensureDaemon((message, level = "info") => {
+        // Background startup should not interrupt the user unless something fails.
+        if (level !== "info") ctx.ui.notify(message, level);
+      }).finally(() => { daemonCheck = undefined; });
+    }
+    return daemonCheck;
+  };
 
   // Any extension can publish the neutral contract. No dependency on a particular footer/provider.
   for (const channel of ["companion:telemetry", "usage:update", "session:usage", "provider:usage"]) {
@@ -80,16 +94,26 @@ export default function companionExtension(pi: ExtensionAPI) {
   pi.on("session_start", (_event, ctx) => {
     // Switching or starting a Pi session must not inherit the previous opt-in.
     sharingGeneration += 1;
+    quotas.stop();
+    quotas = new ProviderQuotaPoller(value => bridge.ingestTelemetry(value, 'subscription limits'));
     bridge.close();
     bridge = new CompanionBridge(pi);
     bridge.setContext(ctx);
     bridge.emit("session.start", { cwd: ctx.cwd });
+    void checkDaemon(ctx);
+    if (daemonMonitor) clearInterval(daemonMonitor);
+    daemonMonitor = setInterval(() => {
+      void checkDaemon(ctx);
+      if (bridge.isRemoteEnabled()) void quotas.refresh(ctx);
+    }, 30_000);
+    daemonMonitor.unref();
   });
   pi.on("session_info_changed", (event, ctx) => {
     bridge.setContext(ctx);
     bridge.setName(event.name);
   });
   pi.on("model_select", (_event, ctx) => {
+    if (bridge.isRemoteEnabled()) void quotas.refresh(ctx);
     bridge.invalidateContext();
     bridge.setContext(ctx);
   });
@@ -106,7 +130,11 @@ export default function companionExtension(pi: ExtensionAPI) {
     bridge.updateStatus("idle");
     bridge.emit("agent.end", { messages: Array.isArray((event as { messages?: unknown[] }).messages) ? (event as { messages: unknown[] }).messages.length : 0 });
   });
-  pi.on("message_end", (_event, ctx) => bridge.setContext(ctx));
+  pi.on("message_end", (event, ctx) => {
+    bridge.setContext(ctx);
+    const failure = providerError(event.message);
+    if (failure) bridge.emit('provider.error', failure);
+  });
   pi.on("session_compact", (_event, ctx) => {
     bridge.invalidateContext();
     bridge.setContext(ctx);
@@ -138,6 +166,9 @@ export default function companionExtension(pi: ExtensionAPI) {
     });
   });
   pi.on("session_shutdown", event => {
+    quotas.stop();
+    if (daemonMonitor) clearInterval(daemonMonitor);
+    daemonMonitor = undefined;
     sharingGeneration += 1;
     bridge.updateStatus("stopped");
     bridge.emit("session.shutdown", event);
@@ -275,52 +306,42 @@ export default function companionExtension(pi: ExtensionAPI) {
     }
   });
 
+  async function setSharing(enabled: boolean, ctx: ExtensionContext) {
+    const generation = ++sharingGeneration;
+    bridge.setContext(ctx);
+    if (!enabled) {
+      bridge.setRemoteEnabled(false);
+      ctx.ui.notify("Remote control disabled; Pi continues locally. The daemon remains available.", "info");
+      return;
+    }
+    const currentBridge = bridge;
+    const up = await ensureDaemon((message, level = "info") => ctx.ui.notify(message, level));
+    if (bridge !== currentBridge || generation !== sharingGeneration) return;
+    if (!up) {
+      ctx.ui.notify("Pi Companion daemon is not reachable at " + adminHttpUrl(), "warning");
+      return;
+    }
+    bridge.activate();
+    bridge.setRemoteEnabled(true);
+    void quotas.refresh(ctx);
+    void bridge.connect();
+    ctx.ui.notify("Remote control enabled for this session: " + adminHttpUrl(), "info");
+  }
+
   pi.registerCommand("companion", {
     description: "Enable Pi Companion for this session and show the dashboard address (`/companion off` to stop sharing)",
-    handler: async (args, ctx) => {
-      const generation = ++sharingGeneration;
-      bridge.setContext(ctx);
-      if (args.trim().toLowerCase() === "off") {
-        bridge.setRemoteEnabled(false);
-        ctx.ui.notify("Pi Companion sharing ended for this session. Pi continues locally.", "info");
-        return;
-      }
-      const currentBridge = bridge;
-      const up = await ensureDaemon((message, level = "info") => ctx.ui.notify(message, level));
-      if (bridge !== currentBridge || generation !== sharingGeneration) return;
-      if (!up) {
-        ctx.ui.notify("Pi Companion daemon is not reachable at " + adminHttpUrl(), "warning");
-        return;
-      }
-      bridge.activate();
-      void bridge.connect();
-      const enabled = true;
-      bridge.setRemoteEnabled(enabled);
-      ctx.ui.notify(
-        enabled
-          ? "Pi Companion enabled for this session: " + adminHttpUrl() + " (paired devices can now see it)"
-          : "Pi Companion sharing ended for this session. Pi continues locally.",
-        "info"
-      );
-    }
+    handler: async (args, ctx) => setSharing(args.trim().toLowerCase() !== "off", ctx)
   });
 
   pi.registerCommand("remote-control", {
     description: "Toggle remote control for this Pi session",
-    handler: async (_args, ctx) => {
-      sharingGeneration += 1;
-      if (!bridge.isActivated()) {
-        ctx.ui.notify("Run /companion first to enable this session's daemon connection.", "warning");
+    handler: async (args, ctx) => {
+      const mode = args.trim().toLowerCase();
+      if (mode && mode !== "on" && mode !== "off") {
+        ctx.ui.notify("Usage: /remote-control [on|off]", "warning");
         return;
       }
-      const enabled = !bridge.isRemoteEnabled();
-      bridge.setRemoteEnabled(enabled);
-      ctx.ui.notify(
-        enabled
-          ? "Remote control enabled for this session. Pair a device from Pi Companion."
-          : "Remote control disabled; this Companion session has ended. Pi continues locally.",
-        enabled ? "info" : "warning"
-      );
+      await setSharing(mode === "on" || (mode !== "off" && !bridge.isRemoteEnabled()), ctx);
     }
   });
 }

package/src/provider-status.ts

@@ -0,0 +1,85 @@
+import type { ExtensionContext } from '@earendil-works/pi-coding-agent';
+import type { ProviderUsage, UsageWindow } from './protocol.js';
+const object = (v: unknown): Record<string, unknown> => v && typeof v === 'object' ? v as Record<string, unknown> : {};
+const window = (used: unknown, reset: unknown): UsageWindow | undefined => {
+  if (typeof used !== 'number' || !Number.isFinite(used) || used < 0 || used > 100) return;
+  const date = typeof reset === 'number' ? new Date(reset * 1000) : typeof reset === 'string' ? new Date(reset) : undefined;
+  return { usedPercent: used, ...(date && Number.isFinite(date.getTime()) ? { resetsAt: date.toISOString() } : {}) };
+};
+export function parseProviderQuota(provider: string, value: unknown): Pick<ProviderUsage, 'weekly' | 'fiveHour'> {
+  const body = object(value);
+  if (provider === 'anthropic') return {
+    weekly: window(object(body.seven_day).utilization, object(body.seven_day).resets_at),
+    fiveHour: window(object(body.five_hour).utilization, object(body.five_hour).resets_at)
+  };
+  const quota: Pick<ProviderUsage, 'weekly' | 'fiveHour'> = {};
+  const rate = object(body.rate_limit);
+  for (const [raw, fallback] of [[rate.primary_window, 'fiveHour'], [rate.secondary_window, 'weekly']] as const) {
+    const item = object(raw), parsed = window(item.used_percent, item.reset_at);
+    if (!parsed) continue;
+    const seconds = item.limit_window_seconds;
+    const key = typeof seconds === 'number' && seconds > 0 ? (seconds <= 86400 ? 'fiveHour' : 'weekly') : fallback;
+    quota[key] = parsed;
+  }
+  return quota;
+}
+
+/** Fetch only known subscription endpoints using Pi's OAuth resolver. No credentials leave Pi. */
+export class ProviderQuotaPoller {
+  private pending = new Set<string>();
+  private next = new Map<string, number>();
+  private failures = new Map<string, number>();
+  private stopped = false;
+  private controllers = new Set<AbortController>();
+  constructor(private publish: (value: unknown) => void) {}
+  stop() { this.stopped = true; for (const controller of this.controllers) controller.abort(); }
+  async refresh(ctx: ExtensionContext) {
+    if (this.stopped || process.env.PI_COMPANION_QUOTAS === '0') return;
+    let available: ReturnType<ExtensionContext['modelRegistry']['getAvailable']>;
+    try { available = ctx.modelRegistry?.getAvailable?.() ?? []; } catch { return; }
+    for (const provider of ['openai-codex', 'anthropic']) {
+      const model = available.find(item => item.provider === provider);
+      let oauth = false;
+      try { oauth = Boolean(model && ctx.modelRegistry.isUsingOAuth(model)); } catch { /* unsupported registry */ }
+      if (!model || !oauth || this.pending.has(provider) || Date.now() < (this.next.get(provider) ?? 0)) continue;
+      this.pending.add(provider);
+      const controller = new AbortController(); this.controllers.add(controller);
+      this.next.set(provider, Date.now() + 300_000);
+      try {
+        const auth = await ctx.modelRegistry.getApiKeyAndHeaders(model);
+        if (!auth.ok || !auth.apiKey || this.stopped) continue;
+        const headers: Record<string, string> = { Authorization: 'Bearer ' + auth.apiKey, Accept: 'application/json' };
+        let url = 'https://api.anthropic.com/api/oauth/usage';
+        if (provider === 'openai-codex') {
+          const payload = JSON.parse(Buffer.from(auth.apiKey.split('.')[1] ?? '', 'base64url').toString('utf8'));
+          const id = object(payload['https://api.openai.com/auth']).chatgpt_account_id;
+          if (typeof id !== 'string' || !id) continue;
+          headers['ChatGPT-Account-Id'] = id;
+          url = 'https://chatgpt.com/backend-api/wham/usage';
+        } else headers['anthropic-beta'] = 'oauth-2025-04-20';
+        const response = await fetch(url, { headers, signal: AbortSignal.any([controller.signal, AbortSignal.timeout(5000)]) });
+        if (!response.ok) throw new Error('quota lookup failed');
+        const quota = parseProviderQuota(provider, await response.json());
+        if (!this.stopped && (quota.weekly || quota.fiveHour)) this.publish({ source: 'Companion subscription limits', providers: [{ provider, ...quota, updatedAt: new Date().toISOString() }] });
+        this.failures.delete(provider);
+      } catch {
+        // Never forward response bodies or authentication data. Back off per provider.
+        const failures = Math.min(6, (this.failures.get(provider) ?? 0) + 1);
+        this.failures.set(provider, failures);
+        this.next.set(provider, Date.now() + Math.min(1800_000, 300_000 * 2 ** failures));
+      } finally { this.pending.delete(provider); this.controllers.delete(controller); }
+    }
+  }
+}
+
+export function providerError(value: unknown): { provider: string; title: string; message: string } | undefined {
+  const raw = object(value);
+  if (raw.role !== 'assistant' || raw.stopReason !== 'error') return;
+  const text = typeof raw.errorMessage === 'string' ? raw.errorMessage : '';
+  const provider = typeof raw.provider === 'string' ? raw.provider : 'Provider';
+  const quota = /quota|usage.limit|credit|billing|insufficient_quota|exhausted/i.test(text);
+  const rate = /rate.limit|429|too many requests/i.test(text);
+  const auth = /401|403|unauthori[sz]ed|authentication|invalid.api.key/i.test(text);
+  return { provider, title: quota ? 'Provider quota exhausted' : rate ? 'Provider rate limit' : auth ? 'Provider authentication failed' : 'Provider request failed',
+    message: quota ? 'The provider reports that your usage allowance or credits are exhausted. Check your plan or wait for the limit to reset, then retry or switch provider.' : rate ? 'The provider is limiting requests. Wait before retrying, or switch provider. Pi may retry automatically.' : auth ? 'Your provider login or credentials were rejected. Reauthenticate in Pi, then retry.' : 'The provider could not complete this request. Check the Pi terminal for details, then retry or switch provider.' };
+}

package/src/telemetry.ts

@@ -87,6 +87,19 @@ export class TelemetryRelay {
   status(key: string, value: string | undefined) {
     if (!value) { this.sources.delete("status:" + key); return; }
     const plain = value.replace(/\x1b\[[0-9;]*m/g, "");
+    if (key.startsWith('pi-jar.quota.')) {
+      try {
+        const quota = record(JSON.parse(plain));
+        const expiresAt = number(quota?.expiresAt);
+        if (!quota || !expiresAt || expiresAt <= Date.now() || expiresAt > Date.now() + 300_000) return;
+        const convert = (value: unknown) => {
+          const item = record(value);
+          return item ? { usedPercent: item.used, resetsAt: typeof item.resetsAt === 'number' ? new Date(item.resetsAt).toISOString() : undefined } : undefined;
+        };
+        this.ingest({ providers: [{ provider: key.slice('pi-jar.quota.'.length), weekly: convert(quota.week), fiveHour: convert(quota.fiveHour) }] }, 'status:' + key);
+      } catch { /* Malformed or expired quota reports are not authoritative. */ }
+      return;
+    }
     const telemetry: Record<string, unknown> = { source: "status:" + key };
     const context = plain.match(/(?:context|ctx)\s*[:=]?\s*([\d.]+)%/i);
     const labelledCost = plain.match(/cost\s*[:=]?\s*\$([\d.]+)/i);