baychat 0.13.1 → 0.14.0

package/dist/relay/commands.js

@@ -35,26 +35,36 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.cmdRelayStart = cmdRelayStart;
 exports.ensureRelayInstalled = ensureRelayInstalled;
+exports.tryRelayStatus = tryRelayStatus;
 exports.cmdRelayStatus = cmdRelayStatus;
 exports.cmdRelayStop = cmdRelayStop;
+exports.shouldFallBackToMailbox = shouldFallBackToMailbox;
+exports.attachViaMailbox = attachViaMailbox;
+exports.renderSessionLine = renderSessionLine;
 exports.cmdRelayAttach = cmdRelayAttach;
 exports.resolveRuntimeBin = resolveRuntimeBin;
 const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const net = __importStar(require("net"));
-const path = __importStar(require("path"));
 const util_1 = require("util");
 const adapters_1 = require("./adapters");
 const autostart_1 = require("./autostart");
+const runtime_binary_1 = require("../runtime-binary");
 const daemon_1 = require("./daemon");
 const resume_1 = require("./resume");
+const mailbox_1 = require("./mailbox");
 const socket_1 = require("./socket");
+const parent_watch_1 = require("./parent-watch");
 const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
 /** Connect to a running daemon, or explain that there isn't one. */
 async function connectOrFail() {
     const sockPath = (0, socket_1.socketPath)();
-    if (!(await (0, socket_1.probeSocket)(sockPath))) {
-        throw new Error("no relay is running — start one with `baychat relay start`");
+    const probe = await (0, socket_1.probeSocketDetailed)(sockPath);
+    if (!probe.alive) {
+        // NOT a flat "no relay is running". See `describeProbeFailure`: a refused
+        // pipe and a wedged daemon are both live relays, and telling someone to
+        // start another one is the one instruction that makes those worse.
+        throw new Error((0, socket_1.describeProbeFailure)(sockPath, probe));
     }
     return net.createConnection(sockPath);
 }
@@ -165,6 +175,26 @@ async function ensureRelayInstalled() {
         return `Relay: could not start automatically (${err instanceof Error ? err.message : String(err)}). Run \`baychat relay start\` yourself.`;
     }
 }
+/**
+ * The daemon's status, or null when there is no daemon.
+ *
+ * `cmdRelayStatus` treats an absent relay as an error to report, which is right
+ * for a command whose whole subject is the relay. `doctor` needs the opposite:
+ * "not running" is one finding among several and must not abort the rest of the
+ * report, so the absence is a value here rather than a thrown error.
+ */
+async function tryRelayStatus() {
+    try {
+        return await request(await connectOrFail(), { type: "status" });
+    }
+    catch {
+        // Every failure means the same thing to a caller that only wants to know
+        // whether the relay can answer: no socket, a stale socket, or a daemon too
+        // wedged to reply are all "no usable relay". `doctor` reports that state
+        // itself; there is nothing here worth logging over it.
+        return null;
+    }
+}
 async function cmdRelayStatus() {
     let status;
     try {
@@ -184,7 +214,7 @@ async function cmdRelayStatus() {
         console.log("  none — a session registers itself by running `baychat relay attach`");
     }
     for (const s of status.sessions) {
-        const state = s.attached ? "attached" : s.resumeId ? "detached (headless resume ready)" : "detached (no resume id)";
+        const state = sessionState(s);
         console.log(`  ${s.name}  [${s.runtime}]  ${state}`);
         console.log(`     ${resumeLabel(s)}`);
     }
@@ -265,6 +295,94 @@ async function cmdRelayStop() {
  * which then reads the room properly through the BayChat tools. Exit 2 means
  * the wait lapsed with nothing to report.
  */
+/**
+ * Is this probe failure the sandboxed case, and ONLY that?
+ *
+ * `denied` means a daemon exists and refused us — precisely a sandbox or token
+ * boundary, and precisely what the mailbox is for. Every other reason keeps
+ * today's error, deliberately:
+ *
+ *   - `absent` — there is no relay. A mailbox would be created that no daemon
+ *     is watching, and the agent would block on a FIFO forever believing it was
+ *     reachable. That is the exact failure this transport exists to end, and
+ *     the fallback must not reintroduce it.
+ *   - `timeout` / `error` — a wedged or unexplained daemon. Papering over it
+ *     with a second channel hides the thing someone needs to fix.
+ */
+function shouldFallBackToMailbox(probe) {
+    return !probe.alive && probe.reason === "denied";
+}
+/**
+ * Arm over the mailbox: register by file, then block on a FIFO read.
+ *
+ * FOREGROUND, and it must stay foreground. A backgrounded process does not
+ * survive the sandbox: measured 2026-08-30, `nohup bash -c 'sleep 25; …' &`
+ * inside Codex never wrote its file, because bubblewrap tears down the mount
+ * namespace and kills the process group when the command returns. Telling a
+ * sandboxed agent to background this would be handing it an instruction that
+ * cannot work — which is how one came to report "Armed and joined the group"
+ * having armed nothing at all.
+ */
+async function attachViaMailbox(opts) {
+    // PROVE the root by creating it, rather than resolving one and hoping. A
+    // sandbox that permits /tmp may still refuse XDG_RUNTIME_DIR, and only this
+    // process can find that out.
+    const dir = (0, mailbox_1.pickUsableMailboxDir)(opts.session);
+    // Declare the path; the daemon creates the FIFO. Making one requires spawning
+    // `mkfifo(1)`, and a sandbox that permits writing files still refuses to spawn
+    // a helper binary (measured 2026-08-30: `spawnSync mkfifo EPERM`).
+    const fifo = (0, mailbox_1.wakeFifoPath)(dir);
+    (0, mailbox_1.writeRegistration)(dir, {
+        session: opts.session,
+        runtime: opts.runtime,
+        resumeId: opts.resume.ok ? opts.resume.resumeId : undefined,
+        resumeSource: opts.resume.ok ? opts.resume.source : undefined,
+        resumeEvidence: opts.resume.ok ? opts.resume.evidence : undefined,
+        resumeCwd: opts.resume.ok ? opts.resume.cwd : undefined,
+        cwd: process.cwd(),
+        // Resolved HERE, inside the session, for the same reason the socket rung
+        // does it: the binary a session was launched with is knowable here and
+        // nowhere else.
+        runtimeBin: resolveRuntimeBin(opts.runtime),
+        fifo,
+        pid: process.pid,
+        registeredAt: new Date().toISOString(),
+    });
+    await (0, mailbox_1.awaitWakeFifo)(fifo);
+    console.log(`Attached as "${opts.session}" over a mailbox FIFO (${fifo}). Waiting for messages…`);
+    // Opening for read blocks until the daemon opens for write. That block IS the
+    // wait, and it costs nothing: no model is running while it holds.
+    const raw = await fs.promises.readFile(fifo, "utf8");
+    const frame = JSON.parse(raw.trim());
+    console.log(`WAKE ${frame.messages.length} message(s) in ${frame.conversationId}:`);
+    for (const m of frame.messages) {
+        const flag = m.shouldRespond ? " [shouldRespond=true]" : "";
+        console.log(`  (${m.id}) ${m.senderType} ${m.senderId}${flag}: ${m.content}`);
+    }
+    return 0;
+}
+/** The state half of one `relay status` session line. */
+function sessionState(s) {
+    // "registered", not "attached", for the FIFO rung — and the difference is not
+    // pedantry. A socket attach IS a held connection, so `attached` is an
+    // observation. A mailbox registration is a file on disk; whether the agent is
+    // still blocked on its FIFO cannot be checked without ending the wait, since
+    // a reader blocked in open() holds no descriptor for /proc to see and opening
+    // the write end to look would signal EOF. Delivery is the only honest probe,
+    // and it makes it: a wake with no reader is recorded pending, never delivered.
+    if (s.attached)
+        return s.transport === "fifo" ? "registered (fifo)" : "attached";
+    return s.resumeId ? "detached (headless resume ready)" : "detached (no resume id)";
+}
+/**
+ * One `relay status` session line.
+ *
+ * Exported so the rung's wording is testable: a fallback nobody can see in
+ * `status` is a silent fallback, which is the thing this transport must not be.
+ */
+function renderSessionLine(target) {
+    return `  ${target.name}  [${target.runtime}]  ${sessionState(target)}`;
+}
 async function cmdRelayAttach(opts) {
     if (!(0, adapters_1.isKnownRuntime)(opts.runtime)) {
         console.log(`unknown runtime "${opts.runtime}" — expected one of: ${adapters_1.KNOWN_RUNTIMES.join(", ")}`);
@@ -272,14 +390,18 @@ async function cmdRelayAttach(opts) {
     }
     const runtime = opts.runtime;
     const resume = await resolveAttachResumeId(runtime, opts.resumeId, opts.discovery);
-    let sock;
-    try {
-        sock = await connectOrFail();
+    const sockPath = (0, socket_1.socketPath)();
+    const probe = await (0, socket_1.probeSocketDetailed)(sockPath);
+    if (shouldFallBackToMailbox(probe)) {
+        console.log(`Relay socket refused (${probe.alive ? "" : (probe.code ?? "denied")}) — this session is sandboxed.`);
+        console.log("Falling back to a mailbox FIFO, which a sandbox permits. `relay status` will show this session as attached (fifo).");
+        return attachViaMailbox({ session: opts.session, runtime, resume });
     }
-    catch (err) {
-        console.log(err instanceof Error ? err.message : String(err));
+    if (!probe.alive) {
+        console.log((0, socket_1.describeProbeFailure)(sockPath, probe));
         return 1;
     }
+    const sock = net.createConnection(sockPath);
     return new Promise((resolve) => {
         const timer = opts.timeoutMs
             ? setTimeout(() => {
@@ -288,6 +410,19 @@ async function cmdRelayAttach(opts) {
                 resolve(2);
             }, opts.timeoutMs)
             : undefined;
+        // An attach outlives nothing. When the session that launched it goes away,
+        // this process must go with it — otherwise it keeps the socket open, the
+        // daemon keeps believing the session is live, and the next wake is written
+        // into a corpse and recorded as delivered. See ./parent-watch.ts.
+        const parentWatch = (0, parent_watch_1.watchParent)(process.ppid, () => {
+            console.log("Session that started this attach has exited — detaching so the relay stops treating it as live.");
+            sock.end();
+            resolve(3);
+        });
+        const settle = (code) => {
+            parentWatch.stop();
+            resolve(code);
+        };
         sock.on("data", (0, socket_1.createFrameReader)((frame) => {
             if (frame.type === "attached") {
                 console.log(`Attached as "${frame.session}". Waiting for messages…`);
@@ -302,7 +437,7 @@ async function cmdRelayAttach(opts) {
                     console.log(`  (${m.id}) ${m.senderType} ${m.senderId}${flag}: ${m.content}`);
                 }
                 sock.end();
-                resolve(0);
+                settle(0);
                 return;
             }
             if (frame.type === "error") {
@@ -310,19 +445,19 @@ async function cmdRelayAttach(opts) {
                     clearTimeout(timer);
                 console.log(frame.message);
                 sock.end();
-                resolve(1);
+                settle(1);
             }
         }));
         sock.on("error", (err) => {
             if (timer)
                 clearTimeout(timer);
             console.log(err.message);
-            resolve(1);
+            settle(1);
         });
         sock.on("close", () => {
             if (timer)
                 clearTimeout(timer);
-            resolve(2);
+            settle(2);
         });
         (0, socket_1.writeFrame)(sock, {
             type: "attach",
@@ -359,25 +494,36 @@ async function cmdRelayAttach(opts) {
  * machine where PATH is fine keeps working, and one where it is not now works too.
  */
 function resolveRuntimeBin(runtime) {
-    const dirs = (process.env.PATH ?? "").split(path.delimiter).filter(Boolean);
-    for (const dir of dirs) {
-        const candidate = path.join(dir, runtime);
-        try {
-            // X_OK, not existsSync: a same-named directory or an unreadable file on PATH
-            // must not be recorded as the binary, or the recorded path is worse than the
-            // bare name it replaced.
-            fs.accessSync(candidate, fs.constants.X_OK);
-            // Resolve symlinks: ~/.local/bin/claude is typically a link into a versioned
-            // directory, and recording the link means a later version bump silently
-            // repoints every wake. The real path is what this session is actually running.
-            return fs.realpathSync(candidate);
-        }
-        catch {
-            // Not here; keep looking. No logging — a PATH entry that does not hold the
-            // binary is the normal case, not a problem.
-        }
+    // Delegates to the prover rather than walking PATH itself. The hand-rolled
+    // walk this replaces had two Windows faults, and both produced a recorded
+    // path the daemon could never spawn:
+    //
+    //   • it joined the BARE name onto each PATH entry, so it never considered
+    //     `codex.cmd` — and every npm-installed CLI on Windows IS a .cmd shim;
+    //   • it accepted a candidate on `fs.accessSync(X_OK)`, which Windows has no
+    //     execute bit to answer, so any readable file passes. The extensionless
+    //     `codex` — an sh script, unrunnable there — sailed through.
+    //
+    // Observed 2026-08-30: runtimeBin recorded as
+    // `C:\Users\…\npm\codex`, and the wake died with `spawn … ENOENT`.
+    //
+    // `resolveRuntimeBinary` tries the platform's real extension order and PROVES
+    // each candidate by running it, which is the same question this function was
+    // always asking — just answered correctly.
+    const override = process.env[`BAYCHAT_${runtime.toUpperCase()}_BIN`];
+    const resolved = (0, runtime_binary_1.resolveRuntimeBinary)(runtime, (0, runtime_binary_1.currentBinaryEnv)(override));
+    if (!resolved.ok)
+        return undefined;
+    try {
+        // Resolve symlinks: ~/.local/bin/claude is typically a link into a versioned
+        // directory, and recording the link means a later version bump silently
+        // repoints every wake. The real path is what this session is actually running.
+        return fs.realpathSync(resolved.path);
+    }
+    catch {
+        // A path we just ran but cannot realpath is still the right answer.
+        return resolved.path;
     }
-    return undefined;
 }
 /**
  * Decide what resume id this attach registers, and say so out loud.

package/dist/relay/daemon.js

@@ -36,10 +36,14 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.RelayDaemon = void 0;
 const fs = __importStar(require("fs"));
 const net = __importStar(require("net"));
+const path = __importStar(require("path"));
 const config_1 = require("../config");
+const runtime_binary_1 = require("../runtime-binary");
 const adapters_1 = require("./adapters");
 const queue_1 = require("./queue");
 const registry_1 = require("./registry");
+const mailbox_1 = require("./mailbox");
+const mailbox_watcher_1 = require("./mailbox-watcher");
 const socket_1 = require("./socket");
 const transport_1 = require("./transport");
 const watermarks_1 = require("./watermarks");
@@ -57,6 +61,9 @@ class RelayDaemon {
     abort = new AbortController();
     /** Live attach sockets by session name. */
     attached = new Map();
+    /** Sessions reachable over a mailbox FIFO, by session name. */
+    mailboxes = new Map();
+    mailboxWatchers;
     /** Per (session, conversation) delivery positions — the 409 catch-up baseline. */
     watermarks = new watermarks_1.Watermarks();
     pending = [];
@@ -75,11 +82,58 @@ class RelayDaemon {
     discoveryReasons = new Map();
     discovery;
     spawnHeadless;
+    resolveBinary;
+    runTurn;
+    /**
+     * Resolutions already proven this process, by runtime binary name.
+     *
+     * Resolution costs a `--version` spawn per candidate, which must not be paid
+     * per message. The entry is dropped whenever a headless turn fails, so a user
+     * who installs the missing runtime is believed on the next message rather
+     * than after a relay restart nothing would have told them to perform.
+     */
+    binaries = new Map();
     log;
     constructor(opts = {}) {
         this.log = opts.log ?? ((line) => console.log(`[relay] ${line}`));
+        // EVERY candidate root, because the daemon cannot know which one the agent's
+        // sandbox turned out to permit — it may have fallen back past the one this
+        // process would have chosen.
+        this.mailboxWatchers = (0, mailbox_1.mailboxRootCandidates)().map((root) => new mailbox_watcher_1.MailboxWatcher({
+            root,
+            onRegister: (reg) => {
+                this.registry.upsert((0, mailbox_1.registrationToTarget)(reg));
+                // A session that names itself supersedes anything discovery guessed,
+                // exactly as an attach frame does.
+                if (reg.resumeId)
+                    this.discoveryReasons.delete(reg.session);
+                // The daemon makes the FIFO, because the agent cannot: creating one
+                // needs `mkfifo(1)` spawned, and a sandbox that lets an agent write
+                // files still refuses it a helper process. This side has the privilege,
+                // so this side does the privileged step.
+                try {
+                    // ENSURE, never recreate: a re-arm must not unlink the FIFO a live
+                    // reader is already blocked on. See `ensureWakeFifo`.
+                    (0, mailbox_1.ensureWakeFifo)(path.dirname(reg.fifo));
+                }
+                catch (err) {
+                    this.log(`could not create the wake FIFO for ${reg.session}: ${errText(err)}`);
+                    return;
+                }
+                this.mailboxes.set(reg.session, reg);
+                this.registry.setAttached(reg.session, true);
+                this.log(`attached via mailbox: ${reg.session} (${reg.runtime}) at ${reg.fifo}`);
+            },
+            onDrop: (session, reason) => {
+                this.mailboxes.delete(session);
+                this.registry.setAttached(session, false);
+                this.log(`detached: ${session} — ${reason}`);
+            },
+        }));
         this.discovery = opts.discovery ?? {};
         this.spawnHeadless = opts.spawnHeadless ?? adapters_1.runHeadless;
+        this.resolveBinary = opts.resolveBinary ?? ((name) => (0, runtime_binary_1.resolveRuntimeBinary)(name, (0, runtime_binary_1.currentBinaryEnv)()));
+        this.runTurn = opts.runTurn;
         this.queue = new queue_1.SessionQueue((session, batch) => this.deliver(session, batch), (session, err) => {
             this.lastError = `delivery failed for ${session}: ${errText(err)}`;
             this.log(this.lastError);
@@ -104,6 +158,10 @@ class RelayDaemon {
             throw new Error(`a relay is already listening on ${sockPath} — run \`baychat relay status\``);
         }
         (0, socket_1.unlinkStaleSocket)(sockPath);
+        // Sandboxed agents cannot reach the socket below, so the mailbox has to be
+        // watched from the moment the daemon is up — not lazily on first delivery.
+        for (const w of this.mailboxWatchers)
+            w.start();
         this.server = net.createServer((sock) => this.onConnection(sock));
         await new Promise((resolve, reject) => {
             this.server.once("error", reject);
@@ -189,6 +247,26 @@ class RelayDaemon {
     async deliver(session, batch) {
         const target = this.registry.get(session);
         if (!target) {
+            // NOT reported as pending, though an earlier version of this did.
+            //
+            // `liveSessions` lists every session of the USER, not of this machine. A
+            // person with WSL and Windows side by side has BOTH relays receiving
+            // events for BOTH machines' sessions, because the server fans out per
+            // credential and a session's host is not something it records. Treating
+            // "live for this user" as "ours" made each relay report DELIVERY PENDING
+            // for sessions the other machine was serving perfectly well — and a false
+            // pending is worse than none, because the entire value of that signal is
+            // that it means something is genuinely wrong.
+            //
+            // A session in the registry cannot reach here at all (`target` would be
+            // set), so there is no local evidence to appeal to: this name has never
+            // been seen on this machine. Another device is very likely handling it,
+            // and silence is the honest answer.
+            //
+            // The genuinely uncovered case — a session that joined a room and never
+            // attached ANYWHERE — is per-machine, not per-message, and belongs in
+            // `doctor`, which can compare the Bay's live sessions against this
+            // machine's registry without ever firing a false alarm.
             this.record({ kind: "ignored", reason: `unknown session ${session}` }, session, batch);
             return;
         }
@@ -202,10 +280,98 @@ class RelayDaemon {
             return;
         }
         const adapter = (0, adapters_1.adapterFor)(target.runtime);
+        // ORDERED ABOVE THE FIFO, deliberately.
+        //
+        // A FIFO hands bytes to a blocked `relay attach`, which prints them and
+        // exits. Where the harness re-invokes on that exit (Claude) it is a wake;
+        // for an interactive TUI it is only a PRINT — the text appears and nothing
+        // makes the agent act on it. Measured 2026-08-31 01:08: delivered via fifo
+        // to a live Codex, which then said nothing.
+        //
+        // `codex queue` puts the message in the session's own turn queue, so the
+        // agent ACTS. Prefer the transport that produces an ANSWER over the one
+        // that only produces a delivery.
+        // RUNG 2: the runtime's OWN inter-session queue, where it has one.
+        //
+        // Preferred over the headless spawn below because it reaches the LIVE
+        // session, where the human already is — so approvals work normally and the
+        // relay never acquires a privilege on a chat message's behalf. The headless
+        // rung must run `approvalPolicy: "never"`, which blocks Codex's own BayChat
+        // write path: observed 2026-08-31, a headlessly-woken Codex read the room
+        // and was structurally unable to answer it.
+        const resolvedForQueue = await this.resolveResume(target);
+        if (adapter.queueMessage && resolvedForQueue.resumeId) {
+            // Same rule as the headless spawn: an ABSOLUTE runtimeBin came from the
+            // session itself and is never re-resolved; only a bare name is looked up.
+            const declared = resolvedForQueue.runtimeBin ?? target.runtime;
+            let queueBin = declared;
+            if (!path.isAbsolute(declared)) {
+                const resolved = this.binaryFor(declared);
+                queueBin = resolved.ok ? resolved.path : "";
+            }
+            if (!queueBin) {
+                this.log(`queue unavailable for ${session}: no usable ${target.runtime} binary`);
+            }
+            else {
+                const outcome = await adapter.queueMessage({
+                    binaryPath: queueBin,
+                    target: resolvedForQueue,
+                    message: (0, adapters_1.buildWakePrompt)(session, batch[0].conversationId, batch, undefined),
+                });
+                if (outcome.kind === "queued") {
+                    this.record({ kind: "woken", via: "queue", session }, session, batch);
+                    return;
+                }
+                // EVERY non-success falls through, including `failed`.
+                //
+                // The queue is an OPTIMISATION, not a gate: it reaches the live session so
+                // approvals work, but the headless rung below is strictly more capable —
+                // it carries the Windows `.cmd` spawn plan, the app-server transport, and
+                // the binary resolution this path does not replicate. A rung that could
+                // not deliver must never shadow one that might; that exact mistake made a
+                // stale FIFO swallow three messages earlier tonight, and it would be the
+                // same mistake to repeat here for a different reason.
+                this.log(`queue did not deliver for ${session} (${outcome.reason}) — falling through to headless`);
+            }
+        }
         // A target with no resume id is the unbounded failure this whole path
         // exists to close: without one, `canResume` says no and the message waits
         // for a human. Ask the runtime's own on-disk state who this session is
         // before accepting that answer.
+        // RUNG 3: a session whose sandbox refuses the socket, waiting on a FIFO.
+        //
+        // Ordered after the socket and before headless because it means the SAME
+        // thing the socket does — a live session is waiting — while headless means
+        // the opposite. `writeWake` never blocks: a FIFO write with no reader would
+        // otherwise stall this daemon on one detached agent and stop it serving
+        // every other session, which is worse than the bug this rung fixes.
+        const mailbox = this.mailboxes.get(session);
+        if (mailbox) {
+            const payload = `${JSON.stringify({ type: "wake", conversationId: batch[0].conversationId, messages: batch })}\n`;
+            const written = (0, mailbox_1.writeWake)(mailbox.fifo, payload);
+            if (written.ok) {
+                // The one rung where `delivered` is EVIDENCED rather than assumed: a
+                // FIFO write completes only when a reader takes the bytes.
+                this.record({ kind: "woken", via: "fifo", session }, session, batch);
+                return;
+            }
+            // NOBODY IS WAITING — so FALL THROUGH, do not stop here.
+            //
+            // A registration is not a listener. The daemon cannot tell a stale
+            // registration from a live one on this rung, because a sandboxed agent
+            // records a NAMESPACED pid that `processIsAlive` reports alive forever
+            // (spec §13). Measured 2026-08-31 00:04: a stale mailbox intercepted three
+            // deliveries in a row and recorded each `pending`, while the session had a
+            // perfectly good resume id and could have been woken headlessly the whole
+            // time. A dead rung was shadowing a working one.
+            //
+            // ENXIO is the only trustworthy evidence available here, and what it
+            // proves is exactly "no live session is waiting" — which is the condition
+            // the rung below exists for. So we take it.
+            this.log(`mailbox for ${session} has no reader (${written.reason}) — falling through to headless`);
+            this.mailboxes.delete(session);
+            this.registry.setAttached(session, false);
+        }
         const resolved = await this.resolveResume(target);
         const check = adapter.canResume(resolved);
         if (!check.ok) {
@@ -215,13 +381,75 @@ class RelayDaemon {
             this.record({ kind: "pending", session, reason }, session, batch);
             return;
         }
-        const prompt = (0, adapters_1.buildWakePrompt)(session, batch[0].conversationId, batch);
+        // The daemon knows both absolute paths because it IS them — and a session it
+        // resumes inherits ITS environment, where neither `node` nor `baychat` is on
+        // PATH. Without this the woken session is told to re-arm with a command it
+        // cannot run, answers once, and goes quiet.
+        const prompt = (0, adapters_1.buildWakePrompt)(session, batch[0].conversationId, batch, {
+            node: process.execPath,
+            cli: process.argv[1] ?? "",
+            runtime: target.runtime,
+            // A session that last armed over a mailbox is sandboxed, and a sandboxed
+            // session cannot background its re-arm. Telling it to would hand it an
+            // instruction that silently does nothing.
+            transport: target.transport,
+        });
         const { file, args } = adapter.headlessCommand(resolved, prompt);
+        // An ABSOLUTE path came from `SessionTarget.runtimeBin` — recorded by
+        // `attach`, inside the session, because the binary a session was launched
+        // with is knowable there and nowhere else. Re-resolving it against the
+        // daemon's PATH is precisely the guess that rule exists to forbid, and
+        // doing so broke a live session: the path ended in `claude.exe`, PATH
+        // resolution was asked for a file of that name, and every wake died with
+        // "not found on PATH".
+        //
+        // A BARE NAME has no such provenance, and is where PATH gets it wrong —
+        // a Windows shim ahead of the real binary under WSL. That one is resolved.
+        let executable = file;
+        if (!path.isAbsolute(file)) {
+            const binary = this.binaryFor(file);
+            if (!binary.ok) {
+                this.record({ kind: "pending", session, reason: (0, runtime_binary_1.summarizeResolutionFailure)(binary) }, session, batch);
+                return;
+            }
+            executable = binary.path;
+        }
+        // A runtime with a richer transport than "spawn a command" gets to use it.
+        // Only a transport that could not be used AT ALL falls through to the spawn:
+        // a failure that is a real answer about this session — an id that names no
+        // thread, a turn the runtime refused — would say exactly the same thing
+        // again down the older path, more slowly and less clearly.
+        const richTransport = this.runTurn
+            ? (input) => this.runTurn({ runtime: target.runtime, ...input })
+            : adapter.runTurn?.bind(adapter);
+        if (richTransport) {
+            const outcome = await richTransport({ binaryPath: executable, target: resolved, prompt });
+            if (outcome.kind === "completed") {
+                this.record({ kind: "woken", via: "headless", session, exitCode: 0 }, session, batch);
+                return;
+            }
+            if (!outcome.transportUnusable) {
+                this.record({ kind: "pending", session, reason: outcome.reason }, session, batch);
+                return;
+            }
+            this.log(`${target.runtime}: falling back to a plain spawn — ${outcome.reason}`);
+        }
+        // A Windows .cmd needs its interpreter named explicitly, whatever produced
+        // the path — resolution or the session's own runtimeBin — so the decision
+        // lives here, after both, rather than inside either. Never a shell: these
+        // args carry the wake prompt, and therefore other people's message text.
+        const plan = (0, runtime_binary_1.spawnPlanFor)(executable, process.platform);
         // The session's own directory when we know it: `cwd` is only where the
         // attach process ran, and `codex exec` refuses to start outside a trusted
         // directory at all.
-        const { exitCode, stderr } = await this.spawnHeadless(file, args, { cwd: resolved.resumeCwd ?? resolved.cwd });
+        const { exitCode, stderr } = await this.spawnHeadless(plan.file, [...plan.prefixArgs, ...args], {
+            cwd: resolved.resumeCwd ?? resolved.cwd,
+        });
         if (exitCode !== 0) {
+            // The binary ran and the turn still failed, so what we resolved may be
+            // stale — a half-finished upgrade, a runtime removed since. Drop it and
+            // prove it again next time rather than trusting it for the process's life.
+            this.binaries.delete(file);
             // A non-zero headless turn did not necessarily reply. Recording it as
             // delivered would claim an answer we cannot evidence.
             this.record({ kind: "pending", session, reason: `headless ${target.runtime} exited ${exitCode}: ${stderr.slice(0, 200)}` }, session, batch);
@@ -229,6 +457,21 @@ class RelayDaemon {
         }
         this.record({ kind: "woken", via: "headless", session, exitCode }, session, batch);
     }
+    /**
+     * The proven executable for a runtime, resolved at most once per process
+     * until something gives us reason to doubt it.
+     */
+    binaryFor(name) {
+        const known = this.binaries.get(name);
+        if (known)
+            return known;
+        const resolved = this.resolveBinary(name);
+        this.binaries.set(name, resolved);
+        this.log(resolved.ok
+            ? `${name} resolved to ${resolved.path} (${resolved.version})`
+            : `${name} unresolved: ${(0, runtime_binary_1.summarizeResolutionFailure)(resolved)}`);
+        return resolved;
+    }
     /**
      * Fill in a missing resume id from the runtime's on-disk state, at most once
      * every `DISCOVERY_INTERVAL_MS` per session.
@@ -309,6 +552,16 @@ class RelayDaemon {
                 // for it, so drop the throttle and let the next wake use the new id.
                 if (frame.resumeId)
                     this.discoveryReasons.delete(frame.session);
+                // EVICT THE PREVIOUS HOLDER. A session name has exactly one listener,
+                // and `set` alone would leave the old socket open and its process
+                // running — which is how two orphaned attaches came to be stacked on
+                // one name on 2026-08-30, each one a place a wake could vanish into.
+                // Destroying it makes the displaced attach exit instead of lingering.
+                const previous = this.attached.get(frame.session);
+                if (previous && previous !== sock) {
+                    this.log(`replacing attach for ${frame.session}: dropping the previous one`);
+                    previous.destroy();
+                }
                 this.attached.set(frame.session, sock);
                 this.registry.setAttached(frame.session, true);
                 (0, socket_1.writeFrame)(sock, { type: "attached", session: frame.session });
@@ -340,7 +593,8 @@ class RelayDaemon {
     status() {
         const sessions = this.registry.all().map((t) => ({
             ...t,
-            attached: this.attached.has(t.name),
+            attached: this.attached.has(t.name) || this.mailboxes.has(t.name),
+            transport: this.attached.has(t.name) ? "socket" : this.mailboxes.has(t.name) ? "fifo" : undefined,
         }));
         return {
             running: true,
@@ -362,6 +616,8 @@ class RelayDaemon {
             sock.destroy();
         this.attached.clear();
         await this.queue.idle();
+        for (const w of this.mailboxWatchers)
+            w.stop();
         await new Promise((resolve) => (this.server ? this.server.close(() => resolve()) : resolve()));
         (0, socket_1.unlinkStaleSocket)((0, socket_1.socketPath)());
         try {