baychat 0.13.1 → 0.15.0

package/dist/relay/daemon.js

@@ -36,10 +36,16 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.RelayDaemon = void 0;
 const fs = __importStar(require("fs"));
 const net = __importStar(require("net"));
+const path = __importStar(require("path"));
 const config_1 = require("../config");
+const runtime_binary_1 = require("../runtime-binary");
 const adapters_1 = require("./adapters");
+const parent_watch_1 = require("./parent-watch");
 const queue_1 = require("./queue");
+const held_1 = require("./held");
 const registry_1 = require("./registry");
+const mailbox_1 = require("./mailbox");
+const mailbox_watcher_1 = require("./mailbox-watcher");
 const socket_1 = require("./socket");
 const transport_1 = require("./transport");
 const watermarks_1 = require("./watermarks");
@@ -57,6 +63,9 @@ class RelayDaemon {
     abort = new AbortController();
     /** Live attach sockets by session name. */
     attached = new Map();
+    /** Sessions reachable over a mailbox FIFO, by session name. */
+    mailboxes = new Map();
+    mailboxWatchers;
     /** Per (session, conversation) delivery positions — the 409 catch-up baseline. */
     watermarks = new watermarks_1.Watermarks();
     pending = [];
@@ -75,11 +84,100 @@ class RelayDaemon {
     discoveryReasons = new Map();
     discovery;
     spawnHeadless;
+    isAlive;
+    /**
+     * Sessions with a headless turn running right now — the one-session lease.
+     *
+     * `SessionQueue` serialises `deliver()` calls, which is NOT the same thing: a
+     * headless turn is awaited inside one of those calls, and a second delivery
+     * arriving after it resolves would happily start another. Two headless agents
+     * under one name is the same fault as the attach/headless clone, reached by a
+     * different door.
+     *
+     * HONEST LIMIT: this can stop a new headless STARTING. It cannot un-run one
+     * already in flight, so it does not make a duplicate impossible — it makes the
+     * daemon stop creating them.
+     */
+    headlessInFlight = new Set();
+    /**
+     * Batches held for a session that is ALIVE but between wakes.
+     *
+     * A socket attach exits on every wake, and the turn it triggers runs for
+     * MINUTES before the session re-arms. A message arriving in that window is not
+     * undeliverable — it is EARLY. Timing out and recording it pending threw away
+     * two of the owner's own messages on 2026-08-31 while the agent was busy
+     * answering the one before them, which reads to a user as the relay stopping.
+     *
+     * Held here and flushed the instant the session attaches again.
+     *
+     * KEYED BY CONVERSATION as well as session. A session is in several rooms, and
+     * a wake frame carries ONE conversation id — so merging every held batch under
+     * the first one tells the agent that messages from room B came from room A, and
+     * sends it to re-read the wrong room. Rooms are held apart and flushed apart.
+     *
+     * PERSISTED, and that is not a detail. While this was a plain Map a daemon
+     * restart lost every held message, and the poll cursor had already moved past
+     * them, so the server never sent them again — gone, with `relay status`
+     * reporting nothing at all. See `held.ts`.
+     */
+    held = new held_1.HeldStore();
+    /** Beyond this a session is not "busy", it is broken; stop growing and report. */
+    static MAX_HELD = 200;
+    reattachGraceMs;
+    resolveBinary;
+    runTurn;
+    /**
+     * Resolutions already proven this process, by runtime binary name.
+     *
+     * Resolution costs a `--version` spawn per candidate, which must not be paid
+     * per message. The entry is dropped whenever a headless turn fails, so a user
+     * who installs the missing runtime is believed on the next message rather
+     * than after a relay restart nothing would have told them to perform.
+     */
+    binaries = new Map();
     log;
     constructor(opts = {}) {
         this.log = opts.log ?? ((line) => console.log(`[relay] ${line}`));
+        // EVERY candidate root, because the daemon cannot know which one the agent's
+        // sandbox turned out to permit — it may have fallen back past the one this
+        // process would have chosen.
+        this.mailboxWatchers = (0, mailbox_1.mailboxRootCandidates)().map((root) => new mailbox_watcher_1.MailboxWatcher({
+            root,
+            onRegister: (reg) => {
+                this.registry.upsert((0, mailbox_1.registrationToTarget)(reg));
+                // A session that names itself supersedes anything discovery guessed,
+                // exactly as an attach frame does.
+                if (reg.resumeId)
+                    this.discoveryReasons.delete(reg.session);
+                // The daemon makes the FIFO, because the agent cannot: creating one
+                // needs `mkfifo(1)` spawned, and a sandbox that lets an agent write
+                // files still refuses it a helper process. This side has the privilege,
+                // so this side does the privileged step.
+                try {
+                    // ENSURE, never recreate: a re-arm must not unlink the FIFO a live
+                    // reader is already blocked on. See `ensureWakeFifo`.
+                    (0, mailbox_1.ensureWakeFifo)(path.dirname(reg.fifo));
+                }
+                catch (err) {
+                    this.log(`could not create the wake FIFO for ${reg.session}: ${errText(err)}`);
+                    return;
+                }
+                this.mailboxes.set(reg.session, reg);
+                this.registry.setAttached(reg.session, true);
+                this.log(`attached via mailbox: ${reg.session} (${reg.runtime}) at ${reg.fifo}`);
+            },
+            onDrop: (session, reason) => {
+                this.mailboxes.delete(session);
+                this.registry.setAttached(session, false);
+                this.log(`detached: ${session} — ${reason}`);
+            },
+        }));
         this.discovery = opts.discovery ?? {};
         this.spawnHeadless = opts.spawnHeadless ?? adapters_1.runHeadless;
+        this.isAlive = opts.isAlive ?? parent_watch_1.processIsAlive;
+        this.reattachGraceMs = opts.reattachGraceMs ?? 4000;
+        this.resolveBinary = opts.resolveBinary ?? ((name) => (0, runtime_binary_1.resolveRuntimeBinary)(name, (0, runtime_binary_1.currentBinaryEnv)()));
+        this.runTurn = opts.runTurn;
         this.queue = new queue_1.SessionQueue((session, batch) => this.deliver(session, batch), (session, err) => {
             this.lastError = `delivery failed for ${session}: ${errText(err)}`;
             this.log(this.lastError);
@@ -99,11 +197,19 @@ class RelayDaemon {
         }
         const auth = { baseUrl: device.baseUrl, token: device.token };
         this.registry.load();
+        // Held messages outlive the process that held them. Loaded before the socket
+        // opens, so a session that re-arms in the first moments of a new daemon is
+        // handed what the previous one was holding rather than a clean slate.
+        this.held.load();
         const sockPath = (0, socket_1.socketPath)();
         if (await (0, socket_1.probeSocket)(sockPath)) {
             throw new Error(`a relay is already listening on ${sockPath} — run \`baychat relay status\``);
         }
         (0, socket_1.unlinkStaleSocket)(sockPath);
+        // Sandboxed agents cannot reach the socket below, so the mailbox has to be
+        // watched from the moment the daemon is up — not lazily on first delivery.
+        for (const w of this.mailboxWatchers)
+            w.start();
         this.server = net.createServer((sock) => this.onConnection(sock));
         await new Promise((resolve, reject) => {
             this.server.once("error", reject);
@@ -181,6 +287,59 @@ class RelayDaemon {
         // could never have matched anything.
         this.queue.push(sessionName, { ...message, conversationId });
     }
+    /**
+     * Hand a freshly attached session everything held while it was mid-turn.
+     *
+     * Sent as ONE wake: the messages arrived while the agent was busy and are read
+     * together, in order, the way a person returning to a chat reads them. Waking
+     * once per held message would spend a turn on each and let the agent answer the
+     * first three not knowing the fourth exists.
+     */
+    async flushHeld(session, sock) {
+        const rooms = this.held.roomsFor(session);
+        if (rooms.length === 0)
+            return;
+        for (const room of rooms) {
+            try {
+                // ACKNOWLEDGED, not fired and forgotten. A hand-over into a socket that
+                // has already died would otherwise clear the hold AND record `woken` —
+                // destroying the only copy of the messages and filing them as
+                // delivered, which is worse than never having held them.
+                await (0, socket_1.writeFrameAck)(sock, { type: "wake", conversationId: room.conversationId, messages: room.messages });
+            }
+            catch (err) {
+                // KEEP IT. This store is the only copy: dropping it because the handoff
+                // failed turns "held" into "lost", which is the failure it exists to
+                // prevent. The next attach gets it instead.
+                this.log(`could not hand ${room.messages.length} held message(s) for ${session} over: ${errText(err)}`);
+                return;
+            }
+            // Removed only once it is actually on the wire, and only for THIS room —
+            // a failure on the second room must not discard the first's receipt or the
+            // third's contents.
+            this.held.clearRoom(session, room.conversationId);
+            this.record({ kind: "woken", via: "attach", session }, session, room.messages);
+            this.log(`delivered ${room.messages.length} held message(s) to ${session} in ${room.conversationId} on re-attach`);
+        }
+    }
+    /**
+     * Wait for a session to re-arm its socket, up to `graceMs`.
+     *
+     * Polled rather than event-driven on purpose: the attach path already evicts
+     * a previous holder and re-registers, so the socket map is the single source
+     * of truth, and subscribing to it would mean a second one to keep in step.
+     */
+    async waitForReattach(session, graceMs) {
+        const deadline = Date.now() + graceMs;
+        for (;;) {
+            const sock = this.attached.get(session);
+            if (sock && !sock.destroyed)
+                return sock;
+            if (Date.now() >= deadline)
+                return undefined;
+            await new Promise((r) => setTimeout(r, 10));
+        }
+    }
     /**
      * Deliver one coalesced batch to one session. Runs under the queue's
      * per-session lock, so an attach wake and a headless resume can never be in
@@ -189,23 +348,224 @@ class RelayDaemon {
     async deliver(session, batch) {
         const target = this.registry.get(session);
         if (!target) {
+            // NOT reported as pending, though an earlier version of this did.
+            //
+            // `liveSessions` lists every session of the USER, not of this machine. A
+            // person with WSL and Windows side by side has BOTH relays receiving
+            // events for BOTH machines' sessions, because the server fans out per
+            // credential and a session's host is not something it records. Treating
+            // "live for this user" as "ours" made each relay report DELIVERY PENDING
+            // for sessions the other machine was serving perfectly well — and a false
+            // pending is worse than none, because the entire value of that signal is
+            // that it means something is genuinely wrong.
+            //
+            // A session in the registry cannot reach here at all (`target` would be
+            // set), so there is no local evidence to appeal to: this name has never
+            // been seen on this machine. Another device is very likely handling it,
+            // and silence is the honest answer.
+            //
+            // The genuinely uncovered case — a session that joined a room and never
+            // attached ANYWHERE — is per-machine, not per-message, and belongs in
+            // `doctor`, which can compare the Bay's live sessions against this
+            // machine's registry without ever firing a false alarm.
             this.record({ kind: "ignored", reason: `unknown session ${session}` }, session, batch);
             return;
         }
         const sock = this.attached.get(session);
         if (sock && !sock.destroyed) {
-            // Live session: hand it the batch and let the harness re-invoke it. The
-            // attach client exits after one wake, which is what makes this a wake
-            // rather than a stream — and why the socket is dropped here.
-            (0, socket_1.writeFrame)(sock, { type: "wake", conversationId: batch[0].conversationId, messages: batch });
-            this.record({ kind: "woken", via: "attach", session }, session, batch);
-            return;
+            // AN OPEN SOCKET IS NOT A LIVE SESSION.
+            //
+            // `watchParent` used to guarantee that by making an orphaned attach exit
+            // with its launcher. Without it — and a `Stop` hook has to detach, so it
+            // cannot rely on ppid — an orphan keeps its socket open, the daemon reads
+            // "socket open" as "session alive", and the wake is written into a corpse
+            // and recorded `woken via attach`. A destroyed message, filed as delivered.
+            // Two orphans were measured doing exactly that on 2026-08-30.
+            //
+            // `ownerPid` answers the same question `watchParent` did, from the other
+            // side and without depending on the attach's own process tree: rung 3.5
+            // uses it to refuse to clone a LIVING session, and this uses it to refuse
+            // to deliver into a DEAD one. Absent (an old registration, or a platform
+            // with no readable process table) means unknown, and unknown must not cost
+            // a live session its delivery — so only a definite "dead" declines.
+            if (target.ownerPid !== undefined && !this.isAlive(target.ownerPid)) {
+                this.log(`socket for ${session} is orphaned — owner ${target.ownerPid} is gone; not delivering into it`);
+                this.attached.delete(session);
+                this.registry.setAttached(session, false);
+                sock.destroy();
+                // Fall through: the session really is gone, which is what the rungs
+                // below are for.
+            }
+            else {
+                // Live session: hand it the batch and let the harness re-invoke it. The
+                // attach client exits after one wake, which is what makes this a wake
+                // rather than a stream — and why the socket is dropped here.
+                //
+                // AWAITED. `sock.write()` buffers and returns, so an EPIPE from a peer
+                // that died between the liveness check and this line used to arrive
+                // after `record` had already filed the batch as `woken` — a lost message
+                // reported as delivered. A write that does not complete is not a
+                // delivery, and the rungs below exist for exactly this case.
+                try {
+                    await (0, socket_1.writeFrameAck)(sock, { type: "wake", conversationId: batch[0].conversationId, messages: batch });
+                    this.record({ kind: "woken", via: "attach", session }, session, batch);
+                    return;
+                }
+                catch (err) {
+                    this.log(`attach socket for ${session} took no frame: ${errText(err)} — falling through`);
+                    this.attached.delete(session);
+                    this.registry.setAttached(session, false);
+                    sock.destroy();
+                    // Fall through: nothing was delivered, so this must not shadow a rung
+                    // that could still reach the session.
+                }
+            }
         }
         const adapter = (0, adapters_1.adapterFor)(target.runtime);
+        // ORDERED ABOVE THE FIFO, deliberately.
+        //
+        // A FIFO hands bytes to a blocked `relay attach`, which prints them and
+        // exits. Where the harness re-invokes on that exit (Claude) it is a wake;
+        // for an interactive TUI it is only a PRINT — the text appears and nothing
+        // makes the agent act on it. Measured 2026-08-31 01:08: delivered via fifo
+        // to a live Codex, which then said nothing.
+        //
+        // `codex queue` puts the message in the session's own turn queue, so the
+        // agent ACTS. Prefer the transport that produces an ANSWER over the one
+        // that only produces a delivery.
+        // RUNG 2: the runtime's OWN inter-session queue, where it has one.
+        //
+        // Preferred over the headless spawn below because it reaches the LIVE
+        // session, where the human already is — so approvals work normally and the
+        // relay never acquires a privilege on a chat message's behalf. The headless
+        // rung must run `approvalPolicy: "never"`, which blocks Codex's own BayChat
+        // write path: observed 2026-08-31, a headlessly-woken Codex read the room
+        // and was structurally unable to answer it.
+        const resolvedForQueue = await this.resolveResume(target);
+        if (adapter.queueMessage && resolvedForQueue.resumeId) {
+            // Same rule as the headless spawn: an ABSOLUTE runtimeBin came from the
+            // session itself and is never re-resolved; only a bare name is looked up.
+            const declared = resolvedForQueue.runtimeBin ?? target.runtime;
+            let queueBin = declared;
+            if (!path.isAbsolute(declared)) {
+                const resolved = this.binaryFor(declared);
+                queueBin = resolved.ok ? resolved.path : "";
+            }
+            if (!queueBin) {
+                this.log(`queue unavailable for ${session}: no usable ${target.runtime} binary`);
+            }
+            else {
+                const outcome = await adapter.queueMessage({
+                    binaryPath: queueBin,
+                    target: resolvedForQueue,
+                    message: (0, adapters_1.buildWakePrompt)(session, batch[0].conversationId, batch, undefined),
+                });
+                if (outcome.kind === "queued") {
+                    this.record({ kind: "woken", via: "queue", session }, session, batch);
+                    return;
+                }
+                // EVERY non-success falls through, including `failed`.
+                //
+                // The queue is an OPTIMISATION, not a gate: it reaches the live session so
+                // approvals work, but the headless rung below is strictly more capable —
+                // it carries the Windows `.cmd` spawn plan, the app-server transport, and
+                // the binary resolution this path does not replicate. A rung that could
+                // not deliver must never shadow one that might; that exact mistake made a
+                // stale FIFO swallow three messages earlier tonight, and it would be the
+                // same mistake to repeat here for a different reason.
+                this.log(`queue did not deliver for ${session} (${outcome.reason}) — falling through to headless`);
+            }
+        }
         // A target with no resume id is the unbounded failure this whole path
         // exists to close: without one, `canResume` says no and the message waits
         // for a human. Ask the runtime's own on-disk state who this session is
         // before accepting that answer.
+        // RUNG 3: a session whose sandbox refuses the socket, waiting on a FIFO.
+        //
+        // Ordered after the socket and before headless because it means the SAME
+        // thing the socket does — a live session is waiting — while headless means
+        // the opposite. `writeWake` never blocks: a FIFO write with no reader would
+        // otherwise stall this daemon on one detached agent and stop it serving
+        // every other session, which is worse than the bug this rung fixes.
+        const mailbox = this.mailboxes.get(session);
+        if (mailbox) {
+            const payload = `${JSON.stringify({ type: "wake", conversationId: batch[0].conversationId, messages: batch })}\n`;
+            const written = (0, mailbox_1.writeWake)(mailbox.fifo, payload);
+            if (written.ok) {
+                // The one rung where `delivered` is EVIDENCED rather than assumed: a
+                // FIFO write completes only when a reader takes the bytes.
+                this.record({ kind: "woken", via: "fifo", session }, session, batch);
+                return;
+            }
+            // NOBODY IS WAITING — so FALL THROUGH, do not stop here.
+            //
+            // A registration is not a listener. The daemon cannot tell a stale
+            // registration from a live one on this rung, because a sandboxed agent
+            // records a NAMESPACED pid that `processIsAlive` reports alive forever
+            // (spec §13). Measured 2026-08-31 00:04: a stale mailbox intercepted three
+            // deliveries in a row and recorded each `pending`, while the session had a
+            // perfectly good resume id and could have been woken headlessly the whole
+            // time. A dead rung was shadowing a working one.
+            //
+            // ENXIO is the only trustworthy evidence available here, and what it
+            // proves is exactly "no live session is waiting" — which is the condition
+            // the rung below exists for. So we take it.
+            this.log(`mailbox for ${session} has no reader (${written.reason}) — falling through to headless`);
+            this.mailboxes.delete(session);
+            this.registry.setAttached(session, false);
+        }
+        // RUNG 3.5: NEVER CLONE A LIVING SESSION.
+        //
+        // A socket attach exits by design on every wake, so a healthy session is
+        // briefly unreachable between wakes — and to every rung above, that is
+        // indistinguishable from a session that has gone. On 2026-08-31 a message
+        // landed in that gap and the ladder spawned a headless twin of a session
+        // that was alive and re-arming: two agents on one name, both authorised to
+        // answer, both able to act. The twin behaved impeccably and still committed
+        // and pushed under an identity that already had an occupant.
+        //
+        // `ownerPid` is the session itself, so it survives the gap that `pid` and
+        // the socket do not. Alive means "wait for it", never "replace it".
+        //
+        // SKIPPED after a mailbox fell through, and that exception is load-bearing:
+        // ENXIO has already PROVEN no reader there, and a sandboxed agent records a
+        // namespaced pid that reads alive forever (spec §13) — so applying this to
+        // fifo sessions would permanently shadow the one rung that can still reach
+        // them, which is the 2026-08-31 00:04 regression in a new costume.
+        if (!mailbox && target.ownerPid !== undefined && this.isAlive(target.ownerPid)) {
+            const rearmed = await this.waitForReattach(session, this.reattachGraceMs);
+            if (rearmed) {
+                try {
+                    await (0, socket_1.writeFrameAck)(rearmed, { type: "wake", conversationId: batch[0].conversationId, messages: batch });
+                    this.record({ kind: "woken", via: "attach", session }, session, batch);
+                    return;
+                }
+                catch (err) {
+                    // The socket appeared and then went. Do NOT record a delivery, and do
+                    // not fall to headless either — the session's process is still alive,
+                    // so this is the held case arriving by a different door.
+                    this.log(`re-armed socket for ${session} took no frame: ${errText(err)} — holding instead`);
+                }
+            }
+            // HELD, not pending. The session's process is still there — it is mid-turn,
+            // which is the normal state of a working agent, not a failure. Recording
+            // this pending threw the message away and told the user their relay had
+            // stopped; spawning a headless one instead is the clone bug. The third
+            // option is the correct one: keep it and hand it over when it re-arms.
+            const conversationId = batch[0].conversationId;
+            const total = this.held.countFor(session);
+            if (total + batch.length > RelayDaemon.MAX_HELD) {
+                this.record({
+                    kind: "pending",
+                    session,
+                    reason: `session process ${target.ownerPid} is alive but has not re-attached, and ${total} message(s) are already held — not holding more`,
+                }, session, batch);
+                return;
+            }
+            this.held.add(session, conversationId, batch);
+            this.log(`holding ${batch.length} message(s) for ${session} in ${conversationId} until it re-attaches (${this.held.countFor(session)} held)`);
+            return;
+        }
         const resolved = await this.resolveResume(target);
         const check = adapter.canResume(resolved);
         if (!check.ok) {
@@ -215,19 +575,158 @@ class RelayDaemon {
             this.record({ kind: "pending", session, reason }, session, batch);
             return;
         }
-        const prompt = (0, adapters_1.buildWakePrompt)(session, batch[0].conversationId, batch);
+        // The daemon knows both absolute paths because it IS them — and a session it
+        // resumes inherits ITS environment, where neither `node` nor `baychat` is on
+        // PATH. Without this the woken session is told to re-arm with a command it
+        // cannot run, answers once, and goes quiet.
+        const prompt = (0, adapters_1.buildWakePrompt)(session, batch[0].conversationId, batch, {
+            node: process.execPath,
+            cli: process.argv[1] ?? "",
+            runtime: target.runtime,
+            // A session that last armed over a mailbox is sandboxed, and a sandboxed
+            // session cannot background its re-arm. Telling it to would hand it an
+            // instruction that silently does nothing.
+            transport: target.transport,
+        });
         const { file, args } = adapter.headlessCommand(resolved, prompt);
-        // The session's own directory when we know it: `cwd` is only where the
-        // attach process ran, and `codex exec` refuses to start outside a trusted
-        // directory at all.
-        const { exitCode, stderr } = await this.spawnHeadless(file, args, { cwd: resolved.resumeCwd ?? resolved.cwd });
-        if (exitCode !== 0) {
-            // A non-zero headless turn did not necessarily reply. Recording it as
-            // delivered would claim an answer we cannot evidence.
-            this.record({ kind: "pending", session, reason: `headless ${target.runtime} exited ${exitCode}: ${stderr.slice(0, 200)}` }, session, batch);
+        // An ABSOLUTE path came from `SessionTarget.runtimeBin` — recorded by
+        // `attach`, inside the session, because the binary a session was launched
+        // with is knowable there and nowhere else. Re-resolving it against the
+        // daemon's PATH is precisely the guess that rule exists to forbid, and
+        // doing so broke a live session: the path ended in `claude.exe`, PATH
+        // resolution was asked for a file of that name, and every wake died with
+        // "not found on PATH".
+        //
+        // A BARE NAME has no such provenance, and is where PATH gets it wrong —
+        // a Windows shim ahead of the real binary under WSL. That one is resolved.
+        let executable = file;
+        if (!path.isAbsolute(file)) {
+            const binary = this.binaryFor(file);
+            if (!binary.ok) {
+                this.record({ kind: "pending", session, reason: (0, runtime_binary_1.summarizeResolutionFailure)(binary) }, session, batch);
+                return;
+            }
+            executable = binary.path;
+        }
+        // THE LEASE — around the WHOLE headless phase, rich transport included.
+        //
+        // `SessionQueue` already serialises `deliver()`, so this is NOT what stops
+        // a second headless turn under normal flow; it is the guard for the paths
+        // that do not go through the queue, and the place the invariant is stated
+        // rather than assumed. It sits ABOVE `richTransport` because Codex's real
+        // headless turn runs there — a lease that wrapped only the plain spawn left
+        // the primary path uncovered, which is worse than none: it reads as
+        // protection while protecting the branch least likely to be taken.
+        //
+        // WHAT IT DOES NOT DO, deliberately. An attach arriving mid-turn is still
+        // accepted and only logged. Declining it would make a session with a HUMAN
+        // sitting at it unreachable in order to protect a spawned proxy, which is a
+        // worse failure than the overlap: the person gets silence and no way to see
+        // why. So this is mutual exclusion between headless turns, and observability
+        // for attach-vs-headless. Claiming more than that is what the review caught.
+        if (this.headlessInFlight.has(session)) {
+            this.record({ kind: "pending", session, reason: "a headless turn is already running for this session — refusing to start a second" }, session, batch);
             return;
         }
-        this.record({ kind: "woken", via: "headless", session, exitCode }, session, batch);
+        this.headlessInFlight.add(session);
+        // DELIBERATELY NOT AWAITED.
+        //
+        // `deliver()` runs under `SessionQueue`'s per-session lock, and a headless
+        // turn takes MINUTES. Awaiting it here holds that lock for the whole turn,
+        // so every later message for this session parks in the queue: not delivered,
+        // not recorded pending, not logged. Measured 2026-08-31 — three messages
+        // from the room vanished exactly this way while a twin ran, and the only
+        // reason anyone noticed was the human asking whether the agent was alive.
+        //
+        // Released here, the lease still stops a SECOND headless turn starting, and
+        // the message that would have started it is now recorded pending with a
+        // reason a person can read. Silence becomes a visible refusal.
+        void this.runHeadlessTurn({ session, batch, target, adapter, resolved, executable, prompt, args, file })
+            .catch((err) => {
+            // Nothing awaits this promise any more, so an escaping rejection would
+            // be an unhandled one — which can take the whole daemon down and with it
+            // every other session. A turn that threw also did not answer anybody, so
+            // the honest record is pending.
+            const reason = err instanceof Error ? err.message : String(err);
+            this.log(`headless turn for ${session} threw: ${reason}`);
+            this.record({ kind: "pending", session, reason: `headless turn threw: ${reason}` }, session, batch);
+        })
+            .finally(() => {
+            this.headlessInFlight.delete(session);
+        });
+    }
+    /**
+     * The headless turn itself, outside the delivery lock.
+     *
+     * Split from `deliver()` for one reason: its duration must not decide whether
+     * OTHER messages for this session are handled. Everything it records — woken,
+     * or pending with a reason — happens whenever the turn actually ends.
+     */
+    async runHeadlessTurn(ctx) {
+        const { session, batch, target, adapter, resolved, executable, prompt, args, file } = ctx;
+        try {
+            // A runtime with a richer transport than "spawn a command" gets to use it.
+            // Only a transport that could not be used AT ALL falls through to the spawn:
+            // a failure that is a real answer about this session — an id that names no
+            // thread, a turn the runtime refused — would say exactly the same thing
+            // again down the older path, more slowly and less clearly.
+            const richTransport = this.runTurn
+                ? (input) => this.runTurn({ runtime: target.runtime, ...input })
+                : adapter.runTurn?.bind(adapter);
+            if (richTransport) {
+                const outcome = await richTransport({ binaryPath: executable, target: resolved, prompt });
+                if (outcome.kind === "completed") {
+                    this.record({ kind: "woken", via: "headless", session, exitCode: 0 }, session, batch);
+                    return;
+                }
+                if (!outcome.transportUnusable) {
+                    this.record({ kind: "pending", session, reason: outcome.reason }, session, batch);
+                    return;
+                }
+                this.log(`${target.runtime}: falling back to a plain spawn — ${outcome.reason}`);
+            }
+            // A Windows .cmd needs its interpreter named explicitly, whatever produced
+            // the path — resolution or the session's own runtimeBin — so the decision
+            // lives here, after both, rather than inside either. Never a shell: these
+            // args carry the wake prompt, and therefore other people's message text.
+            const plan = (0, runtime_binary_1.spawnPlanFor)(executable, process.platform);
+            // The session's own directory when we know it: `cwd` is only where the
+            // attach process ran, and `codex exec` refuses to start outside a trusted
+            // directory at all.
+            const { exitCode, stderr } = await this.spawnHeadless(plan.file, [...plan.prefixArgs, ...args], {
+                cwd: resolved.resumeCwd ?? resolved.cwd,
+            });
+            if (exitCode !== 0) {
+                // The binary ran and the turn still failed, so what we resolved may be
+                // stale — a half-finished upgrade, a runtime removed since. Drop it and
+                // prove it again next time rather than trusting it for the process's life.
+                this.binaries.delete(file);
+                // A non-zero headless turn did not necessarily reply. Recording it as
+                // delivered would claim an answer we cannot evidence.
+                this.record({ kind: "pending", session, reason: `headless ${target.runtime} exited ${exitCode}: ${stderr.slice(0, 200)}` }, session, batch);
+                return;
+            }
+            this.record({ kind: "woken", via: "headless", session, exitCode }, session, batch);
+        }
+        finally {
+            // Nothing to release here — the lease is cleared by the caller's
+            // `.finally`, which owns it for exactly as long as this turn runs.
+        }
+    }
+    /**
+     * The proven executable for a runtime, resolved at most once per process
+     * until something gives us reason to doubt it.
+     */
+    binaryFor(name) {
+        const known = this.binaries.get(name);
+        if (known)
+            return known;
+        const resolved = this.resolveBinary(name);
+        this.binaries.set(name, resolved);
+        this.log(resolved.ok
+            ? `${name} resolved to ${resolved.path} (${resolved.version})`
+            : `${name} unresolved: ${(0, runtime_binary_1.summarizeResolutionFailure)(resolved)}`);
+        return resolved;
     }
     /**
      * Fill in a missing resume id from the runtime's on-disk state, at most once
@@ -269,6 +768,13 @@ class RelayDaemon {
     record(outcome, session, batch) {
         if (outcome.kind === "woken") {
             this.delivered += batch.length;
+            // The one witness `relay status` may treat as proof that a session is
+            // reachable again. A headless turn only counts when it exited cleanly: a
+            // spawn that ran and failed delivered nothing, and recording it would
+            // clear the very failure it just repeated.
+            if (outcome.via !== "headless" || outcome.exitCode === 0) {
+                this.registry.markDelivered(session, new Date().toISOString());
+            }
             this.log(`woke ${session} via ${outcome.via} with ${batch.length} message(s)`);
             return;
         }
@@ -304,15 +810,35 @@ class RelayDaemon {
                     resumeCwd: frame.resumeCwd,
                     cwd: frame.cwd,
                     runtimeBin: frame.runtimeBin,
+                    ownerPid: frame.ownerPid,
                 });
                 // A session that names itself supersedes anything discovery guessed
                 // for it, so drop the throttle and let the next wake use the new id.
                 if (frame.resumeId)
                     this.discoveryReasons.delete(frame.session);
+                // OVERLAP, AND WE CANNOT PREVENT IT — only report it. A headless turn
+                // already running was spawned because this session looked gone; it is
+                // mid-turn now, and the daemon will not kill a model that may be part
+                // way through writing something. Two agents briefly hold this name.
+                // Said out loud because the alternative is that nobody ever knows.
+                if (this.headlessInFlight.has(frame.session)) {
+                    this.log(`WARNING: ${frame.session} attached while a headless turn for it is still running — two agents hold this session name until that turn ends`);
+                }
+                // EVICT THE PREVIOUS HOLDER. A session name has exactly one listener,
+                // and `set` alone would leave the old socket open and its process
+                // running — which is how two orphaned attaches came to be stacked on
+                // one name on 2026-08-30, each one a place a wake could vanish into.
+                // Destroying it makes the displaced attach exit instead of lingering.
+                const previous = this.attached.get(frame.session);
+                if (previous && previous !== sock) {
+                    this.log(`replacing attach for ${frame.session}: dropping the previous one`);
+                    previous.destroy();
+                }
                 this.attached.set(frame.session, sock);
                 this.registry.setAttached(frame.session, true);
                 (0, socket_1.writeFrame)(sock, { type: "attached", session: frame.session });
                 this.log(`attached: ${frame.session} (${frame.runtime})`);
+                void this.flushHeld(frame.session, sock);
                 return;
             }
             if (frame.type === "status") {
@@ -340,7 +866,8 @@ class RelayDaemon {
     status() {
         const sessions = this.registry.all().map((t) => ({
             ...t,
-            attached: this.attached.has(t.name),
+            attached: this.attached.has(t.name) || this.mailboxes.has(t.name),
+            transport: this.attached.has(t.name) ? "socket" : this.mailboxes.has(t.name) ? "fifo" : undefined,
         }));
         return {
             running: true,
@@ -353,6 +880,7 @@ class RelayDaemon {
             delivered: this.delivered,
             sessions,
             pending: this.pending,
+            held: this.held.summary(),
             lastError: this.lastError,
         };
     }
@@ -362,6 +890,8 @@ class RelayDaemon {
             sock.destroy();
         this.attached.clear();
         await this.queue.idle();
+        for (const w of this.mailboxWatchers)
+            w.stop();
         await new Promise((resolve) => (this.server ? this.server.close(() => resolve()) : resolve()));
         (0, socket_1.unlinkStaleSocket)((0, socket_1.socketPath)());
         try {