baychat 0.12.0 → 0.13.0

package/dist/relay/autostart.js

@@ -0,0 +1,324 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTOSTART_IMPLEMENTATIONS = exports.LingerUnavailable = exports.SYSTEMD_UNIT_NAME = exports.SERVICE_LABEL = void 0;
+exports.autostartForPlatform = autostartForPlatform;
+exports.relayCommand = relayCommand;
+// Making the relay come back by itself, on all three platforms.
+//
+// THE BUG THIS EXISTS TO FIX. `baychat relay start` used to write a systemd user
+// unit and, off Linux, print "Automatic startup needs systemd" and hand the user
+// `--foreground` to run themselves. A foreground process dies with the terminal
+// that started it, so on macOS and Windows the "wake my session instantly" half of
+// BayChat was unattended-broken: the relay ran exactly as long as somebody kept a
+// window open, and every reboot silently turned wake-ups off. Recorded as the
+// motivating finding of `docs/prd/desktop_app_spec.md` §2, whose Stage 1 this is.
+//
+// THE SHAPE. One `Autostart` per init system, chosen by `process.platform`. Each
+// splits into two halves on purpose:
+//
+//   - `unit()` — a PURE function from a command line to the text the init system
+//     wants (a systemd unit, a launchd plist, a Task Scheduler XML). No I/O, no
+//     spawning, so the part that is easy to get wrong is the part a test can read.
+//   - `install()` — writes that text and runs the one command that arms it. This
+//     half cannot be tested off its own platform, which is exactly why it is kept
+//     as thin as it is.
+//
+// WHY NOT A DESKTOP APP INSTEAD. Eventually, yes — the same spec's Stage 3 moves
+// the relay inside an Electron main process. This lands first because it is a week
+// rather than a month, it fixes the breakage for people who will never install a
+// desktop app, and the spec says so: "Pays off even if the app is never built."
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const util_1 = require("util");
+const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+/** The reverse-DNS name macOS and Windows both want, and the systemd unit's stem.
+ * One constant so a rename cannot half-happen: a plist labelled one thing and
+ * bootstrapped as another leaves an agent nobody can stop. */
+exports.SERVICE_LABEL = "io.baychat.relay";
+exports.SYSTEMD_UNIT_NAME = "baychat-relay.service";
+/**
+ * Linux — a systemd **user** unit.
+ *
+ * `enable-linger` is what makes "after reboot" true rather than "after the next
+ * login": without it a user manager only runs while somebody is logged in, so a
+ * headless box that rebooted overnight comes back deaf.
+ */
+const systemd = {
+    name: "systemd",
+    unit: ({ node, entry }) => `[Unit]
+Description=BayChat relay — wakes local agent sessions on new messages
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${node} ${entry} relay start --foreground
+Restart=always
+RestartSec=5
+Environment=NODE_ENV=production
+
+[Install]
+WantedBy=default.target
+`,
+    unitPath: () => path.join(os.homedir(), ".config", "systemd", "user", exports.SYSTEMD_UNIT_NAME),
+    async install(cmd) {
+        const target = systemd.unitPath();
+        fs.mkdirSync(path.dirname(target), { recursive: true });
+        fs.writeFileSync(target, systemd.unit(cmd), { mode: 0o644 });
+        await execFileAsync("systemctl", ["--user", "daemon-reload"]);
+        await execFileAsync("systemctl", ["--user", "enable", "--now", exports.SYSTEMD_UNIT_NAME]);
+        try {
+            await execFileAsync("loginctl", ["enable-linger", os.userInfo().username]);
+        }
+        catch {
+            // Not fatal and not silent: the caller prints the degraded promise rather
+            // than claiming boot-time startup it did not get.
+            throw new LingerUnavailable();
+        }
+    },
+    async uninstall() {
+        await execFileAsync("systemctl", ["--user", "disable", "--now", exports.SYSTEMD_UNIT_NAME]).catch(() => undefined);
+        fs.rmSync(systemd.unitPath(), { force: true });
+    },
+};
+/** Thrown when the unit is installed but only starts at login, not at boot. The
+ * relay works; the promise made to the user is the smaller one, and saying so is
+ * the whole point of having a distinct type rather than a swallowed catch. */
+class LingerUnavailable extends Error {
+    constructor() {
+        super("relay will start at login rather than at boot (could not enable linger)");
+        this.name = "LingerUnavailable";
+    }
+}
+exports.LingerUnavailable = LingerUnavailable;
+/**
+ * macOS — a launchd **LaunchAgent** in the user's own domain.
+ *
+ * `RunAtLoad` + `KeepAlive` is launchd's equivalent of `Restart=always`, and the
+ * `gui/<uid>` domain is what makes it a per-user agent rather than a root daemon:
+ * the relay reads `~/.baychat/credentials.json` and must never run as anyone else.
+ *
+ * `bootstrap` (not the deprecated `load`) is used because `load` reports success
+ * for a plist it silently refused, which is the failure mode this whole file
+ * exists to avoid.
+ */
+const launchd = {
+    name: "launchd",
+    unit: ({ node, entry }) => `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${exports.SERVICE_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${escapeXml(node)}</string>
+    <string>${escapeXml(entry)}</string>
+    <string>relay</string>
+    <string>start</string>
+    <string>--foreground</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>NODE_ENV</key>
+    <string>production</string>
+  </dict>
+  <key>ProcessType</key>
+  <string>Background</string>
+</dict>
+</plist>
+`,
+    unitPath: () => path.join(os.homedir(), "Library", "LaunchAgents", `${exports.SERVICE_LABEL}.plist`),
+    async install(cmd) {
+        const target = launchd.unitPath();
+        fs.mkdirSync(path.dirname(target), { recursive: true });
+        fs.writeFileSync(target, launchd.unit(cmd), { mode: 0o644 });
+        const domain = `gui/${os.userInfo().uid}`;
+        // Replacing an agent means removing the old one first; bootout on a label
+        // that was never loaded exits non-zero, which is not a failure here.
+        await execFileAsync("launchctl", ["bootout", `${domain}/${exports.SERVICE_LABEL}`]).catch(() => undefined);
+        await execFileAsync("launchctl", ["bootstrap", domain, target]);
+    },
+    async uninstall() {
+        const domain = `gui/${os.userInfo().uid}`;
+        await execFileAsync("launchctl", ["bootout", `${domain}/${exports.SERVICE_LABEL}`]).catch(() => undefined);
+        fs.rmSync(launchd.unitPath(), { force: true });
+    },
+};
+/**
+ * Windows — a Task Scheduler task, triggered at logon.
+ *
+ * Three candidates were considered and two rejected, because the difference
+ * matters to whether wake-ups survive a crash:
+ *
+ *   - A **Startup-folder shortcut** or a **Run registry key** launches the process
+ *     once and never looks at it again. A relay that dies at 3am stays dead until
+ *     the next login — the same "works while somebody is watching" failure this
+ *     file replaces.
+ *   - A **Windows Service** would restart it, but installing one needs elevation
+ *     and a service wrapper; asking for an admin prompt to receive chat messages
+ *     is the wrong trade.
+ *   - A **scheduled task** needs no elevation in the user's own context, and
+ *     `RestartOnFailure` gives the `Restart=always` behaviour the other two
+ *     platforms have.
+ *
+ * `schtasks /create /xml` is used rather than the flag soup of `/sc onlogon`,
+ * because the flags cannot express the restart policy and cannot turn off the
+ * "stop after 3 days" default that would quietly end the relay every third day.
+ */
+const scheduledTask = {
+    name: "Task Scheduler",
+    unit: (cmd) => `<?xml version="1.0" encoding="UTF-16"?>
+<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
+  <RegistrationInfo>
+    <Description>BayChat relay — wakes local agent sessions on new messages</Description>
+  </RegistrationInfo>
+  <Triggers>
+    <LogonTrigger>
+      <Enabled>true</Enabled>
+      <UserId>${escapeXml(windowsUserId())}</UserId>
+    </LogonTrigger>
+  </Triggers>
+  <Principals>
+    <Principal id="Author">
+      <UserId>${escapeXml(windowsUserId())}</UserId>
+      <LogonType>InteractiveToken</LogonType>
+      <RunLevel>LeastPrivilege</RunLevel>
+    </Principal>
+  </Principals>
+  <Settings>
+    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
+    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
+    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
+    <StartWhenAvailable>true</StartWhenAvailable>
+    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
+    <IdleSettings>
+      <StopOnIdleEnd>false</StopOnIdleEnd>
+      <RestartOnIdle>false</RestartOnIdle>
+    </IdleSettings>
+    <AllowHardTerminate>true</AllowHardTerminate>
+    <Enabled>true</Enabled>
+    <Hidden>true</Hidden>
+    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>
+    <RestartOnFailure>
+      <Interval>PT1M</Interval>
+      <Count>999</Count>
+    </RestartOnFailure>
+  </Settings>
+  <Actions Context="Author">
+    <Exec>
+      <Command>${escapeXml(cmd.node)}</Command>
+      <Arguments>"${escapeXml(cmd.entry)}" relay start --foreground</Arguments>
+    </Exec>
+  </Actions>
+</Task>
+`,
+    // Written beside the credentials rather than in %TEMP%: schtasks reads it once,
+    // but keeping it means `relay status` can show what was actually registered.
+    unitPath: () => path.join(configHome(), "relay-task.xml"),
+    async install(cmd) {
+        const target = scheduledTask.unitPath();
+        fs.mkdirSync(path.dirname(target), { recursive: true });
+        // UTF-16LE with a BOM, because that is what the XML declaration above claims
+        // and what schtasks refuses the file without.
+        fs.writeFileSync(target, "\ufeff" + scheduledTask.unit(cmd), { encoding: "utf16le" });
+        await execFileAsync("schtasks", ["/create", "/tn", exports.SERVICE_LABEL, "/xml", target, "/f"]);
+        await execFileAsync("schtasks", ["/run", "/tn", exports.SERVICE_LABEL]);
+    },
+    async uninstall() {
+        await execFileAsync("schtasks", ["/delete", "/tn", exports.SERVICE_LABEL, "/f"]).catch(() => undefined);
+        fs.rmSync(scheduledTask.unitPath(), { force: true });
+    },
+};
+/** `DOMAIN\user`, which is what a task's `UserId` wants. `USERDOMAIN` is absent
+ * on a machine that was never joined to a domain; the bare username is correct
+ * there, and inventing a domain would register a task for a principal that does
+ * not exist. */
+function windowsUserId() {
+    const user = process.env.USERNAME || os.userInfo().username;
+    const domain = process.env.USERDOMAIN;
+    return domain ? `${domain}\\${user}` : user;
+}
+/** Duplicated from `config.ts` rather than imported, and deliberately: importing
+ * it here would pull the credentials module into a file that must stay loadable
+ * on a machine with no credentials at all. */
+function configHome() {
+    return process.env.BAYCHAT_CONFIG_DIR || path.join(os.homedir(), ".baychat");
+}
+/** The five characters that would otherwise end the element early. Paths can
+ * legally contain `&` on every platform this ships to, and a home directory with
+ * one in it would produce a plist launchd rejects with no useful message. */
+function escapeXml(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&apos;");
+}
+const BY_PLATFORM = {
+    linux: systemd,
+    darwin: launchd,
+    win32: scheduledTask,
+};
+/**
+ * The init system for this machine, or `undefined` where BayChat has none.
+ *
+ * `undefined` rather than a throwing default, because every caller has something
+ * better to do than fail: `connect` prints the manual command and carries on, and
+ * `relay start` explains itself. The platforms that reach `undefined` are the
+ * BSDs and anything exotic — never the three this product ships to.
+ */
+function autostartForPlatform(platform = process.platform) {
+    return BY_PLATFORM[platform];
+}
+/** The command line the init system should run, resolved from this process.
+ *
+ * `process.argv[1]` is the script node was given; resolving it is what keeps an
+ * npx-run or `npm link`ed CLI producing a unit that still works after the shell
+ * that installed it is gone. */
+function relayCommand() {
+    return { node: process.execPath, entry: path.resolve(process.argv[1] ?? "") };
+}
+/** Exported for tests, which need to reach a platform other than the one they
+ * run on. Production code goes through {@link autostartForPlatform}. */
+exports.AUTOSTART_IMPLEMENTATIONS = { systemd, launchd, scheduledTask };

package/dist/relay/commands.js

@@ -38,18 +38,18 @@ exports.ensureRelayInstalled = ensureRelayInstalled;
 exports.cmdRelayStatus = cmdRelayStatus;
 exports.cmdRelayStop = cmdRelayStop;
 exports.cmdRelayAttach = cmdRelayAttach;
+exports.resolveRuntimeBin = resolveRuntimeBin;
 const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const net = __importStar(require("net"));
-const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const util_1 = require("util");
 const adapters_1 = require("./adapters");
+const autostart_1 = require("./autostart");
 const daemon_1 = require("./daemon");
 const resume_1 = require("./resume");
 const socket_1 = require("./socket");
 const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
-const UNIT_NAME = "baychat-relay.service";
 /** Connect to a running daemon, or explain that there isn't one. */
 async function connectOrFail() {
     const sockPath = (0, socket_1.socketPath)();
@@ -106,53 +106,28 @@ async function cmdRelayStart(opts = {}) {
         console.log("Relay is already running. `baychat relay status` for details.");
         return;
     }
-    if (process.platform !== "linux") {
-        console.log("Automatic startup needs systemd (Linux). Run the daemon yourself with:");
+    const autostart = (0, autostart_1.autostartForPlatform)();
+    if (!autostart) {
+        console.log(`No automatic startup is available on ${process.platform}. Run the daemon`);
+        console.log("yourself with:");
         console.log("  baychat relay start --foreground");
         return;
     }
-    await installUserUnit();
-    console.log("Relay started and enabled at boot.");
-    console.log("  baychat relay status   — see sessions, cursor, pending deliveries");
-    console.log("  baychat relay stop     — stop it");
-}
-/**
- * Write and enable the user unit.
- *
- * `enable-linger` is what makes "after reboot" true rather than "after the
- * next login": without it a user manager only runs while someone is logged in,
- * so a headless box that rebooted overnight would come back deaf.
- */
-async function installUserUnit() {
-    const unitDir = path.join(os.homedir(), ".config", "systemd", "user");
-    fs.mkdirSync(unitDir, { recursive: true });
-    // Resolve the installed CLI entry point rather than assuming a global name —
-    // an npx-run or locally-linked copy must produce a unit that keeps working.
-    const entry = path.resolve(process.argv[1]);
-    const unit = `[Unit]
-Description=BayChat relay — wakes local agent sessions on new messages
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-ExecStart=${process.execPath} ${entry} relay start --foreground
-Restart=always
-RestartSec=5
-Environment=NODE_ENV=production
-
-[Install]
-WantedBy=default.target
-`;
-    fs.writeFileSync(path.join(unitDir, UNIT_NAME), unit, { mode: 0o644 });
-    await execFileAsync("systemctl", ["--user", "daemon-reload"]);
-    await execFileAsync("systemctl", ["--user", "enable", "--now", UNIT_NAME]);
     try {
-        await execFileAsync("loginctl", ["enable-linger", os.userInfo().username]);
+        await autostart.install((0, autostart_1.relayCommand)());
+        console.log(`Relay started and enabled at boot (${autostart.name}).`);
     }
-    catch {
-        console.log("Note: could not enable linger — the relay will start at login rather than at boot.");
+    catch (err) {
+        if (!(err instanceof autostart_1.LingerUnavailable))
+            throw err;
+        // The relay IS installed and running; only the boot-time half is missing.
+        // Reported rather than swallowed, because "enabled at boot" would be a lie
+        // and the user would not find out until the machine next rebooted unattended.
+        console.log(`Relay started and enabled at login (${autostart.name}).`);
+        console.log(`Note: ${err.message}.`);
     }
+    console.log("  baychat relay status   — see sessions, cursor, pending deliveries");
+    console.log("  baychat relay stop     — stop it");
 }
 /**
  * Best-effort relay setup, run as the last step of `baychat connect`.
@@ -172,10 +147,18 @@ async function ensureRelayInstalled() {
         }
         if (await (0, socket_1.probeSocket)((0, socket_1.socketPath)()))
             return "Relay: already running — sessions wake instantly.";
-        if (process.platform !== "linux") {
-            return "Relay: not installed (needs systemd). Run `baychat relay start --foreground` to wake sessions instantly.";
+        const autostart = (0, autostart_1.autostartForPlatform)();
+        if (!autostart) {
+            return `Relay: no automatic startup on ${process.platform}. Run \`baychat relay start --foreground\` to wake sessions instantly.`;
+        }
+        try {
+            await autostart.install((0, autostart_1.relayCommand)());
+        }
+        catch (err) {
+            if (!(err instanceof autostart_1.LingerUnavailable))
+                throw err;
+            return `Relay: installed and started, but only at login — ${err.message}.`;
         }
-        await installUserUnit();
         return "Relay: installed and started — sessions now wake the moment a message arrives.";
     }
     catch (err) {
@@ -249,10 +232,15 @@ function transportLabel(status) {
     return status.transport === "websocket" ? `websocket${detail}` : `long-poll${detail}`;
 }
 async function cmdRelayStop() {
-    if (process.platform === "linux" && fs.existsSync(path.join(os.homedir(), ".config", "systemd", "user", UNIT_NAME))) {
+    // Disarm the init system FIRST. Stopping the process without it means the
+    // relay is back within the minute — systemd's Restart=always, launchd's
+    // KeepAlive and the scheduled task's RestartOnFailure all exist to make that
+    // happen, and all three would make `relay stop` look like it silently failed.
+    const autostart = (0, autostart_1.autostartForPlatform)();
+    if (autostart && fs.existsSync(autostart.unitPath())) {
         try {
-            await execFileAsync("systemctl", ["--user", "disable", "--now", UNIT_NAME]);
-            console.log("Relay stopped and disabled at boot.");
+            await autostart.uninstall();
+            console.log(`Relay stopped and disabled at boot (${autostart.name}).`);
             return 0;
         }
         catch {
@@ -345,9 +333,52 @@ async function cmdRelayAttach(opts) {
             resumeEvidence: resume.ok ? resume.evidence : undefined,
             resumeCwd: resume.ok ? resume.cwd : undefined,
             cwd: process.cwd(),
+            // Resolved HERE, inside the session, because this is the only process that
+            // can answer it correctly — see SessionTarget.runtimeBin.
+            runtimeBin: resolveRuntimeBin(runtime),
         });
     });
 }
+/**
+ * The absolute path to the runtime binary this session is running under, or
+ * `undefined` if it cannot be established.
+ *
+ * WHY THE ATTACHING PROCESS AND NOT THE DAEMON. The daemon inherits whatever
+ * environment started it — typically a systemd unit or a login shell from days ago
+ * — and spawning a bare `claude` asks THAT environment to find the binary. On the
+ * machine where this bug was found it could not: `claude` lived on an interactive
+ * shell's PATH and not the daemon's, so every detached wake died with ENOENT and no
+ * message ever said so. `attach` runs inside the session itself, so its PATH is the
+ * one the human actually uses.
+ *
+ * `process.execPath` is deliberately NOT used: that is the Node binary running this
+ * CLI, which for a globally-installed `baychat` is not the runtime at all.
+ *
+ * Returns undefined rather than throwing or guessing. The adapters fall back to the
+ * bare name, which is exactly the behaviour that shipped before this existed — a
+ * machine where PATH is fine keeps working, and one where it is not now works too.
+ */
+function resolveRuntimeBin(runtime) {
+    const dirs = (process.env.PATH ?? "").split(path.delimiter).filter(Boolean);
+    for (const dir of dirs) {
+        const candidate = path.join(dir, runtime);
+        try {
+            // X_OK, not existsSync: a same-named directory or an unreadable file on PATH
+            // must not be recorded as the binary, or the recorded path is worse than the
+            // bare name it replaced.
+            fs.accessSync(candidate, fs.constants.X_OK);
+            // Resolve symlinks: ~/.local/bin/claude is typically a link into a versioned
+            // directory, and recording the link means a later version bump silently
+            // repoints every wake. The real path is what this session is actually running.
+            return fs.realpathSync(candidate);
+        }
+        catch {
+            // Not here; keep looking. No logging — a PATH entry that does not hold the
+            // binary is the normal case, not a problem.
+        }
+    }
+    return undefined;
+}
 /**
  * Decide what resume id this attach registers, and say so out loud.
  *

package/dist/relay/daemon.js

@@ -303,6 +303,7 @@ class RelayDaemon {
                     resumeEvidence: frame.resumeEvidence,
                     resumeCwd: frame.resumeCwd,
                     cwd: frame.cwd,
+                    runtimeBin: frame.runtimeBin,
                 });
                 // A session that names itself supersedes anything discovery guessed
                 // for it, so drop the throttle and let the next wake use the new id.

package/dist/relay/socket.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.socketPath = socketPath;
+exports.isNamedPipe = isNamedPipe;
 exports.pidFilePath = pidFilePath;
 exports.createFrameReader = createFrameReader;
 exports.writeFrame = writeFrame;
@@ -41,24 +42,60 @@ exports.probeSocket = probeSocket;
 exports.unlinkStaleSocket = unlinkStaleSocket;
 const fs = __importStar(require("fs"));
 const net = __importStar(require("net"));
+const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const config_1 = require("../config");
 /**
- * Where the attach socket lives.
+ * Where the attach channel lives.
  *
- * `XDG_RUNTIME_DIR` is the right home: it is user-private (0700), on tmpfs, and
- * cleared on logout, so a stale socket never outlives the session that made it.
- * The config-dir fallback covers boxes without it (some containers, macOS).
+ * On Unix this is a filesystem path to a socket. `XDG_RUNTIME_DIR` is the right
+ * home: it is user-private (0700), on tmpfs, and cleared on logout, so a stale
+ * socket never outlives the session that made it. The config-dir fallback covers
+ * boxes without it — some containers, and macOS, which has no XDG_RUNTIME_DIR at
+ * all.
+ *
+ * ON WINDOWS IT IS NOT A PATH. Windows has no filesystem-visible Unix sockets:
+ * `net.createServer().listen("C:\\Users\\…\\relay.sock")` does not create a
+ * listener a peer can reach, and `net.createConnection` on the same string does
+ * not connect. Node's `net` speaks NAMED PIPES there instead, addressed as
+ * `\\.\pipe\<name>` — the same API, a different namespace, so every call site
+ * that already went through this function keeps working untouched.
+ *
+ * The name carries the username because the pipe namespace is machine-wide while
+ * the relay is per-user: two people signed in to one Windows box must not collide
+ * on one pipe, and must not be able to reach each other's daemon by opening it.
+ * (Reaching it is separately refused by the pipe's default ACL, which admits only
+ * the creating user — the name keeps the two daemons from fighting over it.)
  */
 function socketPath() {
     const override = process.env.BAYCHAT_RELAY_SOCKET;
     if (override)
         return override;
+    if (process.platform === "win32") {
+        return `\\\\.\\pipe\\baychat-relay-${sanitizePipeName(os.userInfo().username)}`;
+    }
     const runtimeDir = process.env.XDG_RUNTIME_DIR;
     if (runtimeDir)
         return path.join(runtimeDir, "baychat-relay.sock");
     return path.join((0, config_1.configDir)(), "relay.sock");
 }
+/** A pipe name may not contain a backslash — it would read as another level of
+ * the pipe namespace — and Windows usernames legally can (`DOMAIN\user` reaches
+ * `os.userInfo()` that way on some setups). Everything outside the safe set is
+ * collapsed rather than dropped, so two different users cannot sanitize to one
+ * name. */
+function sanitizePipeName(value) {
+    return value.replace(/[^A-Za-z0-9_-]/g, "_") || "default";
+}
+/** Is this endpoint a file on disk, or a Windows named pipe?
+ *
+ * A pipe is not a file: it has no directory entry, `fs.existsSync` is always
+ * false for it, and unlinking it is meaningless — the OS reclaims it when the
+ * last handle closes, which is exactly why a Windows relay never leaves a stale
+ * endpoint the way a hard-killed Unix one does. */
+function isNamedPipe(endpoint) {
+    return endpoint.startsWith("\\\\.\\pipe\\") || endpoint.startsWith("\\\\?\\pipe\\");
+}
 function pidFilePath() {
     return path.join((0, config_1.configDir)(), "relay.pid");
 }
@@ -101,7 +138,11 @@ function writeFrame(sock, frame) {
  */
 function probeSocket(sockPath, timeoutMs = 1_000) {
     return new Promise((resolve) => {
-        if (!fs.existsSync(sockPath))
+        // The existence check is a cheap way to skip a connect that cannot succeed —
+        // but a named pipe has no directory entry, so on Windows it answers "false"
+        // for a perfectly healthy daemon. Skipped there; the connect below is the
+        // honest test on every platform anyway.
+        if (!isNamedPipe(sockPath) && !fs.existsSync(sockPath))
             return resolve(false);
         const sock = net.createConnection(sockPath);
         const done = (alive) => {
@@ -113,8 +154,16 @@ function probeSocket(sockPath, timeoutMs = 1_000) {
         sock.on("error", () => done(false));
     });
 }
-/** Remove a socket file we have already proven dead. */
+/** Remove a socket file we have already proven dead.
+ *
+ * A no-op for a named pipe, which has nothing on disk to remove: Windows tears
+ * the pipe down when the last handle closes, so there is no stale-endpoint case
+ * to recover from there. Calling `fs.unlinkSync` on the pipe name would fail
+ * harmlessly, but silently — and a reader would be left believing this function
+ * had done something. */
 function unlinkStaleSocket(sockPath) {
+    if (isNamedPipe(sockPath))
+        return;
     try {
         fs.unlinkSync(sockPath);
     }