agent-yes 1.247.0 → 1.247.1

package/dist/{SUPPORTED_CLIS-B1DPQLRV.js → SUPPORTED_CLIS-C2ABCTI-.js}

@@ -1,11 +1,11 @@
 import "./logger-CDIsZ-Pp.js";
-import "./versionChecker-Du1qdZR9.js";
-import "./ts-rCPxI3aR.js";
+import "./versionChecker-Cc3tPea6.js";
+import "./ts-C6cxg8DC.js";
 import "./todoAutomation-Buo457VO.js";
 import "./JsonlStore-CPGIR0Wy.js";
 import "./globalPidIndex-D9DOSd-c.js";
 import "./pidStore-vnX0bgra.js";
 import "./messageLog-C-YIzhRj.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-DUALQTec.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-CUHk1XEQ.js";
 
 export { SUPPORTED_CLIS };

package/dist/{SUPPORTED_CLIS-DUALQTec.js → SUPPORTED_CLIS-CUHk1XEQ.js}

@@ -1,8 +1,8 @@
-import { t as CLIS_CONFIG } from "./ts-rCPxI3aR.js";
+import { t as CLIS_CONFIG } from "./ts-C6cxg8DC.js";
 
 //#region ts/SUPPORTED_CLIS.ts
 const SUPPORTED_CLIS = Object.keys(CLIS_CONFIG);
 
 //#endregion
 export { SUPPORTED_CLIS as t };
-//# sourceMappingURL=SUPPORTED_CLIS-DUALQTec.js.map
+//# sourceMappingURL=SUPPORTED_CLIS-CUHk1XEQ.js.map

package/dist/{agentShare-Clx5QcyE.js → agentShare-DNLrTMuA.js}

@@ -3,7 +3,7 @@ import "./globalPidIndex-D9DOSd-c.js";
 import "./messageLog-C-YIzhRj.js";
 import "./e2e-CEIdJGZ7.js";
 import "./configShared-IBbnn9b8.js";
-import { P as resolveOne } from "./subcommands-DeHlaNOY.js";
+import { P as resolveOne } from "./subcommands-BfAb-n_1.js";
 import "./webrtcLink-BMYneHbu.js";
 import "./remotes-BxQnNxQv.js";
 import { a as startShare } from "./share-BGl3wutJ.js";
@@ -229,4 +229,4 @@ function transformEvent(rawEvent, agentId, forwarded) {
 
 //#endregion
 export { createScopedShare, listShares, revokeAllShares, revokeShare };
-//# sourceMappingURL=agentShare-Clx5QcyE.js.map
+//# sourceMappingURL=agentShare-DNLrTMuA.js.map

package/dist/{callback-BPAlieXe.js → callback-BCtFFO6C.js}

@@ -3,10 +3,10 @@ import "./globalPidIndex-D9DOSd-c.js";
 import "./messageLog-C-YIzhRj.js";
 import "./e2e-CEIdJGZ7.js";
 import "./configShared-IBbnn9b8.js";
-import "./subcommands-DeHlaNOY.js";
+import "./subcommands-BfAb-n_1.js";
 import "./webrtcLink-BMYneHbu.js";
 import "./remotes-BxQnNxQv.js";
 import "./callbackCore-Dd28_cBM.js";
-import { i as loadOrCreateCallbackSecret, n as isCallbackRevoked, r as loadCallbackSecretReadOnly, t as cmdCallback } from "./callback-DPd9PJQA.js";
+import { i as loadOrCreateCallbackSecret, n as isCallbackRevoked, r as loadCallbackSecretReadOnly, t as cmdCallback } from "./callback-D4dvKSSB.js";
 
 export { cmdCallback };

package/dist/{callback-DPd9PJQA.js → callback-D4dvKSSB.js}

@@ -1,5 +1,5 @@
 import { t as agentYesHome } from "./agentYesHome-CtmsY6I-.js";
-import { P as resolveOne } from "./subcommands-DeHlaNOY.js";
+import { P as resolveOne } from "./subcommands-BfAb-n_1.js";
 import { a as mintCapability, o as parseExpires } from "./callbackCore-Dd28_cBM.js";
 import { randomBytes } from "node:crypto";
 import { chmodSync, readFileSync, renameSync, writeFileSync } from "node:fs";
@@ -72,7 +72,7 @@ async function resolveBase(flag) {
 	if (flag) return flag;
 	if (process.env.AGENT_YES_CALLBACK_BASE) return process.env.AGENT_YES_CALLBACK_BASE;
 	try {
-		const { resolveLocalServeUrl } = await import("./serve-D_DP0VBy.js");
+		const { resolveLocalServeUrl } = await import("./serve-BBMEzRhm.js");
 		const url = await resolveLocalServeUrl();
 		if (url) return url;
 	} catch {}
@@ -187,4 +187,4 @@ async function cmdCallback(rest) {
 
 //#endregion
 export { loadOrCreateCallbackSecret as i, isCallbackRevoked as n, loadCallbackSecretReadOnly as r, cmdCallback as t };
-//# sourceMappingURL=callback-DPd9PJQA.js.map
+//# sourceMappingURL=callback-D4dvKSSB.js.map

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env bun
 import { t as invokedCliName } from "./invokedCli-uqM2YYA7.js";
 import { n as logger } from "./logger-CDIsZ-Pp.js";
-import { i as versionString, n as displayVersion, t as checkAndAutoUpdate } from "./versionChecker-Du1qdZR9.js";
-import { n as getRustBinary } from "./rustBinary-BU3E3uMi.js";
+import { i as versionString, n as displayVersion, t as checkAndAutoUpdate } from "./versionChecker-Cc3tPea6.js";
+import { n as getRustBinary } from "./rustBinary-Ai2OdeAn.js";
 import { argv } from "process";
 import { spawn } from "child_process";
 import ms from "ms";
@@ -285,7 +285,7 @@ function buildRustArgs(argv, cliFromScript, supportedClis) {
 	const rawArg = process.argv[2];
 	const managerCommands = !invokedCliName(process.argv);
 	const isHelpFlag = rawArg === "-h" || rawArg === "--help";
-	const { isSubcommand, runSubcommand, cmdHelp, isUnknownManagerToken } = await import("./subcommands-WJz-UHyC.js");
+	const { isSubcommand, runSubcommand, cmdHelp, isUnknownManagerToken } = await import("./subcommands-CJYXODZ1.js");
 	if (isHelpFlag && process.argv.length === 3) {
 		await cmdHelp(managerCommands);
 		process.exit(0);
@@ -295,7 +295,7 @@ function buildRustArgs(argv, cliFromScript, supportedClis) {
 		process.exit(code ?? 0);
 	}
 	{
-		const { SUPPORTED_CLIS } = await import("./SUPPORTED_CLIS-B1DPQLRV.js");
+		const { SUPPORTED_CLIS } = await import("./SUPPORTED_CLIS-C2ABCTI-.js");
 		if (isUnknownManagerToken(rawArg, managerCommands, SUPPORTED_CLIS)) {
 			process.stderr.write(`ay: unknown subcommand or CLI '${rawArg}'.\n    See 'ay help' for subcommands. To run an agent, name a CLI:\n    'ay <cli> …' (e.g. 'ay claude …') or 'ay --cli <cli> …'.\n`);
 			process.exit(1);
@@ -346,7 +346,7 @@ if (config.useRust) {
 		}
 	}
 	if (rustBinary) {
-		const { SUPPORTED_CLIS } = await import("./SUPPORTED_CLIS-B1DPQLRV.js");
+		const { SUPPORTED_CLIS } = await import("./SUPPORTED_CLIS-C2ABCTI-.js");
 		const rustArgs = buildRustArgs(process.argv, config.cli, SUPPORTED_CLIS);
 		if (config.verbose) {
 			console.log(`[rust] Using binary: ${rustBinary}`);

package/dist/index.js

@@ -1,6 +1,6 @@
 import "./logger-CDIsZ-Pp.js";
-import "./versionChecker-Du1qdZR9.js";
-import { a as hasTodoStore, i as answerAsk, l as AgentContext, n as agentYes, o as listAsks, r as config, s as listAsksForProject, t as CLIS_CONFIG } from "./ts-rCPxI3aR.js";
+import "./versionChecker-Cc3tPea6.js";
+import { a as hasTodoStore, i as answerAsk, l as AgentContext, n as agentYes, o as listAsks, r as config, s as listAsksForProject, t as CLIS_CONFIG } from "./ts-C6cxg8DC.js";
 import { _ as isKnownKind, a as renderTree, b as statesOf, c as monitorHint, d as openStore, f as DONE_STATE, g as initialState, h as canTransition, i as renderDigest, l as CycleError, m as ORPHANED_STATE, o as unblockedTasks, p as LIFECYCLES, r as openBlockers, s as describeBlock, t as reconcileTodos, u as TodoStore, v as nextStates, x as removeControlCharacters, y as requiredGate } from "./todoAutomation-Buo457VO.js";
 import "./JsonlStore-CPGIR0Wy.js";
 import "./globalPidIndex-D9DOSd-c.js";

package/dist/{notifyDaemon-CAML5u0d.js → notifyDaemon-BkxrvCIr.js}

@@ -3,12 +3,14 @@ import "./globalPidIndex-D9DOSd-c.js";
 import "./messageLog-C-YIzhRj.js";
 import "./e2e-CEIdJGZ7.js";
 import "./configShared-IBbnn9b8.js";
-import { $ as shouldStealLock, C as listRecords, J as hostId, K as appendEvent, Q as readInbox, X as listInboxParents, Z as liveWatchers, _ as isPidAlive, c as deriveLiveState, et as daemonLockDir, j as renderLogTailLines, nt as notifyDir, q as gcInboxes, tt as daemonLockOwnerPath } from "./subcommands-DeHlaNOY.js";
+import { $ as shouldStealLock, C as listRecords, J as hostId, K as appendEvent, Q as readInbox, X as listInboxParents, Z as liveWatchers, _ as isPidAlive, c as deriveLiveState, et as daemonLockDir, j as renderLogTailLines, nt as notifyDir, q as gcInboxes, tt as daemonLockOwnerPath } from "./subcommands-BfAb-n_1.js";
 import "./webrtcLink-BMYneHbu.js";
 import "./remotes-BxQnNxQv.js";
 import { mkdir, readFile, rename, rm, stat, writeFile } from "fs/promises";
 import { randomUUID } from "node:crypto";
-import { execFile } from "node:child_process";
+import { execFile, execFileSync } from "node:child_process";
+import { readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { Worker } from "node:worker_threads";
 
 //#region ts/notifyRouter.ts
 const DEFAULT_IDLE_CONFIRM_MS = 3e4;
@@ -146,6 +148,243 @@ function syntheticExited(cs, pid) {
 	};
 }
 
+//#endregion
+//#region ts/procStartTime.ts
+/**
+* Best-effort OS process start time, as an OPAQUE token.
+*
+* Why: `ay notifyd`'s singleton lock records `{pid, started_at}` where
+* `started_at` is OUR OWN wall-clock stamp from when the daemon acquired the
+* lock. That proves nothing about the pid the OS currently has: a pid recycled
+* onto an unrelated live process inside the owner TTL would pass `isPidAlive`
+* and be trusted as "the daemon is running" — so `ensureDaemon` would decline to
+* start a real one. Cross-checking the OS's own notion of when that pid started
+* closes the window: the recycled process has a different start time.
+*
+* The token is deliberately opaque (a raw platform string, compared only for
+* equality) — no epoch math, no clock-tick/boot-time arithmetic, nothing to get
+* subtly wrong across platforms. It is only ever compared against a token this
+* same code produced for the same pid.
+*
+* BEST-EFFORT by contract: every reader returns `null` when it cannot answer
+* (unsupported platform, missing /proc, `ps` unavailable or slow). Callers MUST
+* treat null as "no opinion" and fall back to the existing checks — this
+* tightens an edge, it must never introduce a new way to fail.
+*
+* Issue #169 item 1.
+*/
+/**
+* Extract field 22 (`starttime`, in clock ticks since boot) from a Linux
+* `/proc/<pid>/stat` line.
+*
+* The parse must start AFTER the last `)`: field 2 is the executable name in
+* parentheses and may itself contain spaces and parens (`(my prog (v2))`), so
+* naive whitespace splitting mis-indexes every later field. After the last `)`
+* the remaining fields begin at field 3, hence `starttime` is index 19.
+*/
+function parseLinuxStartTime(stat) {
+	const close = stat.lastIndexOf(")");
+	if (close < 0) return null;
+	const starttime = stat.slice(close + 1).trim().split(/\s+/)[19];
+	return starttime && /^\d+$/.test(starttime) ? starttime : null;
+}
+function defaultProcStat(pid) {
+	try {
+		return readFileSync(`/proc/${pid}/stat`, "utf8");
+	} catch {
+		return null;
+	}
+}
+function defaultPsLstart(pid) {
+	try {
+		return execFileSync("ps", [
+			"-o",
+			"lstart=",
+			"-p",
+			String(pid)
+		], {
+			encoding: "utf8",
+			timeout: 500,
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		});
+	} catch {
+		return null;
+	}
+}
+/** Normalize a raw reader result: trim, and treat an empty answer as "unknown". */
+function normalize(raw) {
+	if (raw === null) return null;
+	const trimmed = raw.trim();
+	return trimmed === "" ? null : trimmed;
+}
+/**
+* An opaque token identifying WHEN `pid` started, or null when unknowable.
+*
+* Windows deliberately returns null: the only readily available reader is a
+* PowerShell `Get-Process` spawn (hundreds of ms), far too heavy for a path
+* that runs every couple of seconds under `ay notify watch`.
+*/
+function osProcessStartToken(pid, deps) {
+	if (!Number.isFinite(pid) || pid <= 0) return null;
+	const platform = deps?.platform ?? process.platform;
+	if (platform === "linux") {
+		const stat = (deps?.readProcStat ?? defaultProcStat)(pid);
+		return stat ? parseLinuxStartTime(stat) : null;
+	}
+	if (platform === "darwin" || platform === "freebsd" || platform === "openbsd") return normalize((deps?.readPsLstart ?? defaultPsLstart)(pid));
+	return null;
+}
+/**
+* Does a RECORDED start token prove the pid has been recycled since?
+*
+* True only on positive disagreement — both sides present and different. A
+* missing record (an owner written by an older build, or on a platform with no
+* reader) or an unreadable current value yields false, i.e. "no opinion, keep
+* trusting the other checks". Fail-open is correct here precisely because this
+* is an ADDITIONAL guard layered on pid-liveness + heartbeat freshness.
+*/
+function osStartTokenMismatch(recorded, current) {
+	if (typeof recorded !== "string" || recorded === "") return false;
+	if (current === null) return false;
+	return current !== recorded;
+}
+
+//#endregion
+//#region ts/ownerHeartbeat.ts
+/**
+* The `ay notifyd` singleton lock's owner heartbeat, run on its OWN thread.
+*
+* Why a thread: the daemon proves it is alive by refreshing `ts` in the lock's
+* `owner.json`; another `ay notify watch` steals the lock once that stamp is
+* older than `OWNER_TTL`. On a single-threaded JS timer, a SYNCHRONOUS block in
+* the daemon longer than the TTL would stall the heartbeat, let a second daemon
+* take the lock, and leave two daemons writing the same inboxes. The loop is all
+* `await`s and the TTL sits far above any realistic block, so that was always
+* theoretical — but a single-threaded process can only bound it, never eliminate
+* it. A worker thread does: its timer keeps firing no matter what the main
+* thread is doing.
+*
+* The worker owns the whole beat (read token → verify → atomic rewrite), so a
+* blocked main thread contributes nothing to keeping the lock alive. The owner
+* payload is fixed for the daemon's lifetime — only `ts` moves — so there is no
+* state to synchronize back.
+*
+* FENCING is preserved exactly as on the main thread: the beat refreshes only
+* while `owner.json` still carries OUR token. Any other value — a different
+* token (superseded) or none (another daemon's mkdir→write window) — means we no
+* longer own the lock, so it stops rather than clobber an owner that isn't ours.
+*
+* Deliberately one-way: the beat never signals the daemon. Deciding to shut down
+* stays with the daemon loop, which already re-reads the owner token every tick
+* and exits when it isn't ours. Adding a second, cross-thread path to the same
+* decision would only create a way for the two to disagree.
+*
+* The worker source is passed inline (`eval: true`) rather than shipped as a
+* separate file: it needs no bundler entry, no dist path resolution, and works
+* identically under both `bun` and `node` (verified on both).
+*
+* Falls back to a main-thread timer if a Worker can't be created for any reason,
+* so this can only ever be as good as the previous behaviour — never worse.
+*
+* Issue #169 item 5.
+*/
+const WORKER_SRC = `
+const { workerData } = require("node:worker_threads");
+const fs = require("node:fs");
+const { ownerPath, token, payload, intervalMs } = workerData;
+
+function currentToken() {
+  try {
+    return JSON.parse(fs.readFileSync(ownerPath, "utf8")).token ?? null;
+  } catch {
+    return null;
+  }
+}
+
+function beat() {
+  if (currentToken() !== token) return false;
+  // Atomic (write temp + rename), so a concurrent reader never sees a torn owner
+  // and a null read reliably means "no owner file" rather than "write in flight".
+  const tmp = ownerPath + "." + token + ".beat.tmp";
+  try {
+    fs.writeFileSync(tmp, JSON.stringify(Object.assign({}, payload, { ts: Date.now() })));
+    fs.renameSync(tmp, ownerPath);
+  } catch {
+    try { fs.unlinkSync(tmp); } catch {}
+  }
+  return true;
+}
+
+const timer = setInterval(() => {
+  if (!beat()) clearInterval(timer);
+}, intervalMs);
+`;
+/**
+* Main-thread fallback with identical semantics, used when a Worker can't be
+* created. Exported so the specs can exercise it directly on every platform —
+* it is the path that runs on any runtime where worker threads are unavailable.
+*/
+function startInlineHeartbeat(opts) {
+	const timer = setInterval(() => {
+		let cur = null;
+		try {
+			cur = JSON.parse(readFileSync(opts.ownerPath, "utf8")).token ?? null;
+		} catch {
+			cur = null;
+		}
+		if (cur !== opts.token) {
+			clearInterval(timer);
+			return;
+		}
+		const tmp = `${opts.ownerPath}.${opts.token}.beat.tmp`;
+		try {
+			writeFileSync(tmp, JSON.stringify({
+				...opts.payload,
+				ts: Date.now()
+			}));
+			renameSync(tmp, opts.ownerPath);
+		} catch {
+			try {
+				unlinkSync(tmp);
+			} catch {}
+		}
+	}, opts.intervalMs);
+	if (typeof timer.unref === "function") timer.unref();
+	return {
+		isolated: false,
+		stop: async () => {
+			clearInterval(timer);
+		}
+	};
+}
+function startOwnerHeartbeat(opts) {
+	try {
+		const worker = new Worker(WORKER_SRC, {
+			eval: true,
+			workerData: {
+				ownerPath: opts.ownerPath,
+				token: opts.token,
+				payload: opts.payload,
+				intervalMs: opts.intervalMs
+			}
+		});
+		worker.on("error", () => {});
+		if (typeof worker.unref === "function") worker.unref();
+		return {
+			isolated: true,
+			stop: async () => {
+				await worker.terminate().catch(() => {});
+			}
+		};
+	} catch {
+		return startInlineHeartbeat(opts);
+	}
+}
+
 //#endregion
 //#region ts/notifyDaemon.ts
 /**
@@ -291,6 +530,7 @@ async function liveChildrenSnapshot() {
 }
 const OWNER_TTL_MS = 3e4;
 let daemonStartedAt = 0;
+let daemonOsStart = null;
 let daemonToken = "";
 /** The token currently written in the daemon lock owner file, or null. */
 async function readDaemonOwnerToken() {
@@ -312,7 +552,8 @@ async function writeOwner() {
 			pid: process.pid,
 			started_at: daemonStartedAt,
 			ts: Date.now(),
-			token: daemonToken
+			token: daemonToken,
+			os_start: daemonOsStart
 		}));
 		await rename(tmp, daemonLockOwnerPath());
 		return true;
@@ -335,6 +576,7 @@ async function acquireDaemonLock(isAlive = isPidAlive) {
 		await mkdir(daemonLockDir(), { recursive: false });
 		daemonStartedAt = Date.now();
 		daemonToken = randomUUID();
+		daemonOsStart = osProcessStartToken(process.pid);
 		if (!await writeOwner()) {
 			await rm(daemonLockDir(), {
 				recursive: true,
@@ -352,10 +594,12 @@ async function acquireDaemonLock(isAlive = isPidAlive) {
 		try {
 			owner = JSON.parse(raw);
 		} catch {}
-		if (owner && typeof owner.pid === "number" && owner.pid > 0 && owner.pid !== process.pid && typeof owner.ts === "number" && now - owner.ts <= OWNER_TTL_MS && isAlive(owner.pid)) return false;
-		if (shouldStealLock(raw, now, {
+		const recycled = owner && typeof owner.pid === "number" && owner.pid > 0 ? osStartTokenMismatch(owner.os_start, osProcessStartToken(owner.pid)) : false;
+		if (owner && typeof owner.pid === "number" && owner.pid > 0 && owner.pid !== process.pid && typeof owner.ts === "number" && now - owner.ts <= OWNER_TTL_MS && isAlive(owner.pid) && !recycled) return false;
+		const lockAgeMs = now - await stat(daemonLockDir()).then((s) => s.mtimeMs).catch(() => now);
+		if (recycled || shouldStealLock(raw, now, {
 			staleMs: OWNER_TTL_MS,
-			lockAgeMs: now - await stat(daemonLockDir()).then((s) => s.mtimeMs).catch(() => now),
+			lockAgeMs,
 			selfPid: process.pid,
 			isAlive
 		})) {
@@ -386,19 +630,20 @@ async function runDaemon(opts = {}) {
 		return 0;
 	}
 	let running = true;
-	const ownerBeat = setInterval(() => {
-		(async () => {
-			if (await readDaemonOwnerToken() !== daemonToken) {
-				clearInterval(ownerBeat);
-				return;
-			}
-			await writeOwner();
-		})();
-	}, Math.max(1e3, Math.floor(OWNER_TTL_MS / 3)));
-	if (typeof ownerBeat.unref === "function") ownerBeat.unref();
+	const ownerBeat = startOwnerHeartbeat({
+		ownerPath: daemonLockOwnerPath(),
+		token: daemonToken,
+		payload: {
+			pid: process.pid,
+			started_at: daemonStartedAt,
+			token: daemonToken,
+			os_start: daemonOsStart
+		},
+		intervalMs: Math.max(1e3, Math.floor(OWNER_TTL_MS / 3))
+	});
 	const cleanup = async () => {
 		running = false;
-		clearInterval(ownerBeat);
+		await ownerBeat.stop();
 		if (await readDaemonOwnerToken() === daemonToken) await rm(daemonLockDir(), {
 			recursive: true,
 			force: true
@@ -512,23 +757,25 @@ async function gcTick(host) {
 * kill an unrelated process. `stop` re-reads and re-checks this identity right
 * before signalling, so it can't SIGTERM a pid recycled between status and stop.
 *
-* Residual edge (documented, not yet closed): a pid recycled onto an UNRELATED
-* live process WITHIN the tight OWNER_TTL window (a few ticks) could be briefly
-* trusted, since we compare our recorded `started_at` against the owner file, not
-* against the OS's actual process start time (which is non-portable to read:
-* `/proc/<pid>/stat` on Linux vs `proc_pidinfo`/`ps -o lstart` on macOS). The
-* heartbeat freshness + tight TTL keep the window to seconds; a real OS
-* start-time cross-check is deferred to a future issue.
+* The pid-recycled-inside-the-TTL window is closed by an OS start-time
+* cross-check (issue #169 item 1): the owner file records the OS's own start
+* time for the daemon pid at acquire, and every read re-reads it and rejects a
+* disagreement — an unrelated process that inherited the pid has a different
+* start time and is never reported as "the daemon". The reader is best-effort
+* per platform (`/proc/<pid>/stat` on Linux, `ps -o lstart` on macOS/BSD, none
+* on Windows); where it can't answer, behaviour is exactly as before — the
+* heartbeat freshness + tight TTL still bound the window to seconds.
 */
 async function daemonIdentity(now = Date.now()) {
 	const raw = await readFile(daemonLockOwnerPath(), "utf8").catch(() => "");
 	try {
 		const o = JSON.parse(raw);
-		if (typeof o?.pid === "number" && o.pid > 0 && typeof o.started_at === "number" && o.started_at > 0 && typeof o.ts === "number" && now - o.ts <= OWNER_TTL_MS && isPidAlive(o.pid)) return {
+		if (typeof o?.pid === "number" && o.pid > 0 && typeof o.started_at === "number" && o.started_at > 0 && typeof o.ts === "number" && now - o.ts <= OWNER_TTL_MS && isPidAlive(o.pid) && !osStartTokenMismatch(o.os_start, osProcessStartToken(o.pid))) return {
 			pid: o.pid,
 			started_at: o.started_at,
 			ts: o.ts,
-			token: typeof o.token === "string" ? o.token : null
+			token: typeof o.token === "string" ? o.token : null,
+			os_start: typeof o.os_start === "string" ? o.os_start : null
 		};
 	} catch {}
 	return null;
@@ -589,4 +836,4 @@ async function ensureDaemon() {
 
 //#endregion
 export { daemonStatus, ensureDaemon, requestDaemonStop, runDaemon };
-//# sourceMappingURL=notifyDaemon-CAML5u0d.js.map
+//# sourceMappingURL=notifyDaemon-BkxrvCIr.js.map

package/dist/{rustBinary-BU3E3uMi.js → rustBinary-Ai2OdeAn.js}

@@ -1,4 +1,4 @@
-import { r as getInstalledPackage } from "./versionChecker-Du1qdZR9.js";
+import { r as getInstalledPackage } from "./versionChecker-Cc3tPea6.js";
 import { execFileSync } from "child_process";
 import { existsSync, mkdirSync, unlinkSync } from "fs";
 import { chmod, copyFile } from "fs/promises";
@@ -225,4 +225,4 @@ async function getRustBinary(options = {}) {
 
 //#endregion
 export { getRustBinary as n, findSpawnHiddenLauncher as t };
-//# sourceMappingURL=rustBinary-BU3E3uMi.js.map
+//# sourceMappingURL=rustBinary-Ai2OdeAn.js.map

package/dist/{schedule-C8wzhq0y.js → schedule-CLxwtJLH.js}

@@ -1,12 +1,12 @@
 import "./logger-CDIsZ-Pp.js";
-import "./versionChecker-Du1qdZR9.js";
-import "./ts-rCPxI3aR.js";
+import "./versionChecker-Cc3tPea6.js";
+import "./ts-C6cxg8DC.js";
 import "./todoAutomation-Buo457VO.js";
 import "./JsonlStore-CPGIR0Wy.js";
 import "./globalPidIndex-D9DOSd-c.js";
 import "./pidStore-vnX0bgra.js";
 import "./messageLog-C-YIzhRj.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-DUALQTec.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-CUHk1XEQ.js";
 import { f as resolveSpawnCwd } from "./workspaceConfig-CpilQzMY.js";
 import { n as liveEnv, t as ensureNodeRuntime } from "./nodeRuntime-BtL6Oo1o.js";
 import { createHash } from "node:crypto";
@@ -153,4 +153,4 @@ async function cmdSchedule(rest) {
 
 //#endregion
 export { cmdSchedule };
-//# sourceMappingURL=schedule-C8wzhq0y.js.map
+//# sourceMappingURL=schedule-CLxwtJLH.js.map

package/dist/{serve-D_DP0VBy.js → serve-BBMEzRhm.js}

@@ -1,7 +1,7 @@
 import "./logger-CDIsZ-Pp.js";
-import { r as getInstalledPackage } from "./versionChecker-Du1qdZR9.js";
-import { t as findSpawnHiddenLauncher } from "./rustBinary-BU3E3uMi.js";
-import { c as permissionBadge, i as answerAsk, o as listAsks, u as CLAUDE_SESSION_PIN_ENV } from "./ts-rCPxI3aR.js";
+import { r as getInstalledPackage } from "./versionChecker-Cc3tPea6.js";
+import { t as findSpawnHiddenLauncher } from "./rustBinary-Ai2OdeAn.js";
+import { c as permissionBadge, i as answerAsk, o as listAsks, u as CLAUDE_SESSION_PIN_ENV } from "./ts-C6cxg8DC.js";
 import { t as agentYesHome$1 } from "./agentYesHome-CtmsY6I-.js";
 import { x as removeControlCharacters } from "./todoAutomation-Buo457VO.js";
 import "./JsonlStore-CPGIR0Wy.js";
@@ -11,12 +11,12 @@ import { r as recordInbox } from "./messageLog-C-YIzhRj.js";
 import { t as pgidForWrapper } from "./reaper-DP49VCKx.js";
 import "./e2e-CEIdJGZ7.js";
 import "./configShared-IBbnn9b8.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-DUALQTec.js";
-import { A as recentReadEdges, C as listRecords, D as readNotes, G as writeToIpc, M as renderRawLog, N as renderRawLogLines, O as readPtysize, P as resolveOne, Y as isTransientLockMkdirError, f as extractNeedsInput, j as renderLogTailLines, k as recentMessageEdges, l as deriveLiveStatus, o as controlCodeFromName, p as extractTaskCounts, rt as TYPING_BADGE, u as extractBadges, x as isUserTyping, z as snapshotStatus } from "./subcommands-DeHlaNOY.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-CUHk1XEQ.js";
+import { A as recentReadEdges, C as listRecords, D as readNotes, G as writeToIpc, M as renderRawLog, N as renderRawLogLines, O as readPtysize, P as resolveOne, Y as isTransientLockMkdirError, f as extractNeedsInput, j as renderLogTailLines, k as recentMessageEdges, l as deriveLiveStatus, o as controlCodeFromName, p as extractTaskCounts, rt as TYPING_BADGE, u as extractBadges, x as isUserTyping, z as snapshotStatus } from "./subcommands-BfAb-n_1.js";
 import "./webrtcLink-BMYneHbu.js";
 import "./remotes-BxQnNxQv.js";
 import { i as frameVisitorMessage, s as verifyCapability, t as MAX_CALLBACK_MSG_BYTES } from "./callbackCore-Dd28_cBM.js";
-import { n as isCallbackRevoked, r as loadCallbackSecretReadOnly } from "./callback-DPd9PJQA.js";
+import { n as isCallbackRevoked, r as loadCallbackSecretReadOnly } from "./callback-D4dvKSSB.js";
 import { a as getProvisionRoot, d as isProvisionAllowed, f as resolveSpawnCwd, i as getProvisionHook, l as hasProvisionHook, o as getSpawnHook, t as allowsSkipPermissions, u as hasSpawnHook } from "./workspaceConfig-CpilQzMY.js";
 import { n as liveEnv, t as ensureNodeRuntime } from "./nodeRuntime-BtL6Oo1o.js";
 import { r as spawnRejectionReason } from "./spawnGate-BFJPdHCQ.js";
@@ -2306,7 +2306,7 @@ Options:
 			}
 		});
 		if (req.method === "GET" && p === "/api/ws") {
-			const ws = await import("./ws-1vGWz9c9.js");
+			const ws = await import("./ws-BTGDj3Hj.js");
 			try {
 				await ws.loadProvision();
 			} catch (e) {
@@ -2326,7 +2326,7 @@ Options:
 		if (req.method === "GET" && p === "/api/ws/status") {
 			const dirRaw = url.searchParams.get("path");
 			if (!dirRaw) return new Response("missing ?path=<workspace dir>", { status: 400 });
-			const ws = await import("./ws-1vGWz9c9.js");
+			const ws = await import("./ws-BTGDj3Hj.js");
 			let prov;
 			try {
 				prov = await ws.loadProvision();
@@ -3079,7 +3079,7 @@ Options:
 			const perm = body.perm ?? "r";
 			if (perm !== "r" && perm !== "rw") return new Response(`invalid perm ${perm} (want r or rw)`, { status: 400 });
 			try {
-				const { createScopedShare } = await import("./agentShare-Clx5QcyE.js");
+				const { createScopedShare } = await import("./agentShare-DNLrTMuA.js");
 				const share = await createScopedShare({
 					agent: body.agent,
 					perm,
@@ -3094,12 +3094,12 @@ Options:
 			}
 		}
 		if (req.method === "GET" && p === "/api/shares") {
-			const { listShares } = await import("./agentShare-Clx5QcyE.js");
+			const { listShares } = await import("./agentShare-DNLrTMuA.js");
 			return Response.json(listShares());
 		}
 		const revokeM = /^\/api\/share\/([^/]+)$/.exec(p);
 		if (req.method === "DELETE" && revokeM) {
-			const { revokeShare } = await import("./agentShare-Clx5QcyE.js");
+			const { revokeShare } = await import("./agentShare-DNLrTMuA.js");
 			const ok = revokeShare(decodeURIComponent(revokeM[1]));
 			return new Response(ok ? "revoked" : "no such share", { status: ok ? 200 : 404 });
 		}
@@ -3401,7 +3401,7 @@ Options:
 	const shutdown = (resolve) => {
 		if (heartbeat) clearInterval(heartbeat);
 		closeShare?.();
-		import("./agentShare-Clx5QcyE.js").then((m) => m.revokeAllShares()).catch(() => {});
+		import("./agentShare-DNLrTMuA.js").then((m) => m.revokeAllShares()).catch(() => {});
 		server?.stop();
 		Promise.resolve(releaseHostLock?.()).catch(() => {}).then(resolve);
 	};
@@ -3414,4 +3414,4 @@ Options:
 
 //#endregion
 export { cmdServe, loadTokenReadOnly, mintScopedTermToken, resolveDaemonHttpBase, resolveLocalServeUrl };
-//# sourceMappingURL=serve-D_DP0VBy.js.map
+//# sourceMappingURL=serve-BBMEzRhm.js.map

package/dist/{setup-DIa8Y-lx.js → setup-RZycHxht.js}

@@ -32,7 +32,7 @@ async function cmdSetup(rest) {
 	if (!existsSync(abs)) process.stderr.write(`  note: that directory doesn't exist yet — create it, or agents spawned there will fail\n`);
 	if (noShare) return 0;
 	process.stdout.write(`\nsharing this machine to agent-yes.com…\n`);
-	const { cmdServe } = await import("./serve-D_DP0VBy.js");
+	const { cmdServe } = await import("./serve-BBMEzRhm.js");
 	return cmdServe([
 		"install",
 		"--share",
@@ -42,4 +42,4 @@ async function cmdSetup(rest) {
 
 //#endregion
 export { cmdSetup };
-//# sourceMappingURL=setup-DIa8Y-lx.js.map
+//# sourceMappingURL=setup-RZycHxht.js.map