beehaven 0.8.16

package/dist/composition-repos.js

@@ -0,0 +1,91 @@
+/**
+ * Composition → local repo bindings (#47b).
+ *
+ * A Clearly composition (a canvas "board") can be bound to a real local
+ * git repo on THIS machine, so a daemon-spawned coding agent works in the
+ * actual codebase — and shares a Claude Code project 1:1 with that repo.
+ *
+ *   board  →  /Users/me/projects/motion_studio  →  ~/.claude/projects/<encoded-cwd>
+ *
+ * The binding is inherently LOCAL + per-machine — absolute repo paths
+ * differ from machine to machine, exactly like Claude Code's own project
+ * registry. The composition id is the stable CLOUD identity; this map is
+ * the local answer to "on THIS machine, where does that board live?".
+ *
+ *   ~/.clearly/composition-repos.json
+ *     { "<compositionId>": "/Users/me/projects/motion_studio" }
+ *
+ * Bound  → the daemon uses the repo as the session cwd verbatim and does
+ *          NOT seed/refresh a CLAUDE.md there (the repo owns its own
+ *          context). The agent's conversation lands in the repo's own
+ *          Claude Code project dir → 1:1 with `claude` run from that repo.
+ * Unbound→ the existing `~/.clearly/compositions/<id>` scratch-dir
+ *          behavior is unchanged (no regression).
+ *
+ * Kept in its own module (no Agent-SDK imports) so both the daemon
+ * (`daemon-omni.ts`) and the CLI (`beehaven composition …`) can read/write
+ * it without the CLI dragging in `@anthropic-ai/claude-agent-sdk`.
+ *
+ * The map is read fresh on every cwd resolution, so a new binding takes
+ * effect on the NEXT omni session for that composition — no daemon
+ * restart required to (un)bind.
+ */
+import { homedir } from 'node:os';
+import { join, dirname } from 'node:path';
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+export function compositionRepoMapPath() {
+    return join(homedir(), '.clearly', 'composition-repos.json');
+}
+/** Read the whole map. Returns {} on missing/corrupt file — bindings are
+ *  best-effort enhancements, never a hard dependency of a session. */
+export function readCompositionRepoMap() {
+    try {
+        const parsed = JSON.parse(readFileSync(compositionRepoMapPath(), 'utf8'));
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            // Keep only string→string entries; drop anything malformed.
+            const out = {};
+            for (const [k, v] of Object.entries(parsed)) {
+                if (typeof v === 'string' && v.trim())
+                    out[k] = v;
+            }
+            return out;
+        }
+        return {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * The absolute repo path a composition is bound to, or null.
+ *
+ * Returns a path only when the binding exists AND the directory is
+ * present on disk. A stale binding (repo moved or deleted) resolves to
+ * null so the caller falls back to the scratch dir rather than erroring
+ * on a missing cwd.
+ */
+export function resolveBoundRepo(compositionId) {
+    const bound = readCompositionRepoMap()[compositionId];
+    if (typeof bound === 'string' && bound.trim() && existsSync(bound))
+        return bound;
+    return null;
+}
+/**
+ * Bind (repoPath set) or unbind (repoPath null) a composition. Last write
+ * wins — fine for a single-user local file. Creates `~/.clearly/` if
+ * needed. Returns the resulting map.
+ */
+export function setCompositionRepo(compositionId, repoPath) {
+    const map = readCompositionRepoMap();
+    if (repoPath)
+        map[compositionId] = repoPath;
+    else
+        delete map[compositionId];
+    const p = compositionRepoMapPath();
+    mkdirSync(dirname(p), { recursive: true });
+    writeFileSync(p, `${JSON.stringify(map, null, 2)}\n`, 'utf8');
+    return map;
+}
+export function listCompositionRepos() {
+    return readCompositionRepoMap();
+}

package/dist/daemon-avatar.js

@@ -0,0 +1,130 @@
+/**
+ * daemon-avatar — let the daemon's OWN agent harness (Monet) drive a
+ * local avatar as a first-class agent principal.
+ *
+ * A terminal Claude Code session signs in via `beehaven agent login` and
+ * carries its token on each call. The daemon's in-process harness has no
+ * CLI to sign in through, so it mints its OWN AgentIdentity here
+ * ('monet', kind 'daemon-agent') and calls the local avatar building with
+ * that identity's CallerContext — exactly like the app-rpc path does for
+ * CLI agents. The result: Monet drives its own avatar instance
+ * (getBuilding('avatar', 'monet')), distinct from every terminal agent's
+ * avatar.
+ *
+ * Wire-up: pass `driveAvatar: (action, args) => driveAvatarAsMonet(
+ * daemonAppManager, action, args)` into `createClearlyMcpServer(...)` so
+ * the harness gets `avatar_say` / `avatar_speak` / `avatar_get_state` /
+ * `avatar_emote` / `avatar_react` tools.
+ */
+import { mintAgentToken, verifyAgentToken } from './agent-identity-daemon.js';
+import { loadAgent, saveAgent } from './agent-state.js';
+/** Default voice per built-in maid avatar — used when auto-minting an
+ *  avatar's agent identity. The user can override per-avatar in the maid
+ *  chat voice settings (which re-mints with the chosen voice). */
+const AVATAR_DEFAULT_VOICE = {
+    mimi: { provider: 'openai', voiceId: 'marin' },
+    lilith: { provider: 'elevenlabs' },
+    omni: { provider: 'openai', voiceId: 'nova' },
+    monet: { provider: 'openai', voiceId: 'marin' },
+};
+export const MONET_AGENT_ID = 'monet';
+export const MONET_AVATAR_ID = 'monet';
+let _monetCaller = null;
+let _monetToken = null;
+/**
+ * Mint (once, then cache) Monet's daemon-agent identity and return both
+ * the token and the CallerContext the avatar building trusts.
+ */
+export async function ensureMonetIdentity(userId = 'local') {
+    if (_monetToken && _monetCaller)
+        return { token: _monetToken, caller: _monetCaller };
+    const token = await mintAgentToken({
+        agentId: MONET_AGENT_ID,
+        kind: 'daemon-agent',
+        displayName: 'Monet',
+        avatarId: MONET_AVATAR_ID,
+        userId,
+        permissions: ['avatar:say', 'avatar:speak', 'avatar:emote'],
+    });
+    const claims = await verifyAgentToken(token);
+    if (!claims)
+        throw new Error('monet identity failed self-verification');
+    _monetCaller = {
+        role: 'agent',
+        agentId: claims.agentId,
+        avatarId: claims.avatarId,
+        userId: claims.userId,
+        displayName: claims.displayName,
+        permissions: claims.permissions,
+    };
+    _monetToken = token;
+    return { token: _monetToken, caller: _monetCaller };
+}
+/**
+ * Drive the local avatar as Monet. `appManager` is the daemon's
+ * LocalAppManager. Resolves the avatar instance for Monet's avatarId and
+ * calls the action with Monet's CallerContext as the 3rd arg.
+ */
+export async function driveAvatarAsMonet(appManager, action, input = {}, userId = 'local') {
+    if (!appManager || typeof appManager.getBuilding !== 'function') {
+        throw new Error('local app manager unavailable — cannot drive avatar');
+    }
+    const { caller } = await ensureMonetIdentity(userId);
+    const handle = appManager.getBuilding('avatar', caller.avatarId);
+    const workspace = handle?.instance;
+    if (!workspace || typeof workspace.call !== 'function') {
+        throw new Error('AGENT_UNAVAILABLE_SIGNED_OUT: the avatar hive is not loaded (daemon signed out?).');
+    }
+    return workspace.call(action, input, caller);
+}
+/** Test seam — clear the cached identity. */
+export function _resetMonetIdentity() {
+    _monetCaller = null;
+    _monetToken = null;
+}
+/**
+ * Ensure a STORED agent identity exists for `avatarId`, so spawning daemon
+ * claude with `BEEHAVEN_AGENT=<avatarId>` resolves to a valid token whose
+ * `meta.voice` drives `beehaven speak`. Auto-mints + persists on first use
+ * (per-avatar, with a sensible default voice), refreshes when near expiry,
+ * and preserves any voice the user has already set. Returns the agent name
+ * to place in `BEEHAVEN_AGENT`.
+ *
+ * This is the "auto-mint, edit in settings" provisioning: the daemon creates
+ * the identity transparently; the maid voice settings later re-mint it with
+ * the user's chosen voice via `agent rebind --voice` / `agent login --voice`.
+ */
+export async function ensureAvatarAgent(avatarId, userId = 'local') {
+    const name = avatarId;
+    const existing = loadAgent(name);
+    // Reuse while comfortably unexpired (5-min skew margin).
+    if (existing && existing.expiresAt > Date.now() + 5 * 60_000)
+        return name;
+    const voice = existing?.voice ?? AVATAR_DEFAULT_VOICE[avatarId] ?? { provider: 'openai' };
+    const displayName = existing?.displayName ?? avatarId.charAt(0).toUpperCase() + avatarId.slice(1);
+    const token = await mintAgentToken({
+        agentId: avatarId,
+        kind: 'claude-code',
+        displayName,
+        avatarId,
+        userId,
+        permissions: ['avatar:speak', 'avatar:say', 'avatar:emote'],
+        meta: { voice },
+    });
+    const claims = await verifyAgentToken(token);
+    if (!claims)
+        throw new Error(`ensureAvatarAgent: self-verify failed for "${avatarId}"`);
+    const record = {
+        agentId: avatarId,
+        kind: 'claude-code',
+        displayName,
+        avatarId,
+        userId,
+        voice,
+        token,
+        issuedAt: claims.iat,
+        expiresAt: claims.exp,
+    };
+    saveAgent(name, record);
+    return name;
+}

package/dist/daemon-claude-code-auto-install.js

@@ -0,0 +1,52 @@
+/**
+ * claude-code hive auto-install (#24) — ensure the claude-code hive
+ * is loaded into the daemon on every launch in dev mode.
+ *
+ * Why: the dev Mac app ships the `claude-code` hive in its bundled
+ * `Resources/beehaven/hives/claude-code/` directory, but until the
+ * user manually runs `beehaven install claude-code`, the daemon
+ * doesn't load it. That means a fresh `git clone` → `npm run
+ * install:dev` cycle leaves Claude unable to call canvas actions
+ * because the bridge isn't wired.
+ *
+ * Auto-install: on daemon ready, check if claude-code is registered;
+ * if not, install it from the bundled path. Idempotent — subsequent
+ * launches no-op.
+ *
+ * Wiring (Mac app rebuild required):
+ *   In packages/cli/src/daemon.ts, after the IPC server is listening:
+ *
+ *     import { ensureClaudeCodeInstalled } from './daemon-claude-code-auto-install.js';
+ *     await ensureClaudeCodeInstalled(localAppManager, bundledHivesDir);
+ *
+ *   `bundledHivesDir` resolves to:
+ *     - dev:  process.resourcesPath + '/beehaven/hives'
+ *     - cli:  ../../../hives (monorepo path)
+ */
+import { resolve as resolvePath } from 'node:path';
+import { existsSync } from 'node:fs';
+/**
+ * Idempotent — installs the claude-code hive if missing, no-ops
+ * otherwise. Safe to call on every daemon startup.
+ */
+export async function ensureClaudeCodeInstalled(ctx) {
+    const log = ctx.log ?? (() => { });
+    if (ctx.localAppManager.isInstalled('claude-code')) {
+        log('info', 'auto-install', 'claude-code already installed — skipping');
+        return { alreadyInstalled: true, installed: false };
+    }
+    const sourcePath = resolvePath(ctx.bundledHivesDir, 'claude-code');
+    if (!existsSync(sourcePath)) {
+        log('warn', 'auto-install', `claude-code source missing at ${sourcePath} — bundled-hives directory may be incomplete`);
+        return { alreadyInstalled: false, installed: false, reason: 'source-missing' };
+    }
+    try {
+        await ctx.localAppManager.install(sourcePath);
+        log('info', 'auto-install', `claude-code installed from ${sourcePath}`);
+        return { alreadyInstalled: false, installed: true };
+    }
+    catch (err) {
+        log('warn', 'auto-install', `claude-code install failed: ${err?.message ?? err}`);
+        return { alreadyInstalled: false, installed: false, reason: err?.message ?? 'install-failed' };
+    }
+}

package/dist/daemon-client.js

@@ -0,0 +1,363 @@
+/**
+ * daemon-client — Connect to the local Beehaven daemon over IPC.
+ *
+ * Lets in-process tooling (the `beehaven` CLI itself, scripts, tests) call
+ * worker routes via the daemon's `daemon-fetch` proxy without ever holding
+ * the user's Firebase token directly. The token lives in the daemon process
+ * and is attached as `Authorization: Bearer …` for each forwarded request.
+ *
+ * Usage:
+ *   import { daemonFetch, daemonRpc, isDaemonRunning } from './daemon-client.js';
+ *
+ *   if (await isDaemonRunning()) {
+ *     const res = await daemonFetch('GET', 'https://relay.clearly.sh/admin/users');
+ *     console.log(res.body);
+ *   }
+ */
+import net from 'net';
+import { existsSync } from 'fs';
+import { resolveClientAuthToken } from './ipc-auth.js';
+import { activeAgentWrap } from './agent-attribution.js';
+const SOCKET_PATH = '/tmp/beehaven-ipc.sock';
+const TIMEOUT_MS = 60_000;
+const AUTH_TIMEOUT_MS = 3_000;
+/** One attempt. Resolves, never rejects. */
+function probeOnce(deadlineMs) {
+    return new Promise((resolve) => {
+        let connected = false;
+        const sock = net.createConnection(SOCKET_PATH);
+        const timer = setTimeout(() => {
+            sock.destroy();
+            // ⚠ CONNECTED-BUT-SILENT IS NOT "DOWN". The kernel accepted us, so a listener exists.
+            resolve({ state: connected ? 'silent' : 'down', attempts: 1 });
+        }, deadlineMs);
+        sock.once('connect', () => { connected = true; });
+        sock.once('data', () => {
+            clearTimeout(timer);
+            sock.end();
+            resolve({ state: 'up', attempts: 1 });
+        });
+        sock.once('error', (err) => {
+            clearTimeout(timer);
+            resolve({ state: 'down', attempts: 1, code: err.code });
+        });
+    });
+}
+/** ⚠ Deliberately short — see the measured p90 above. Three of these is still under a second. */
+const PROBE_DEADLINE_MS = 1000;
+const PROBE_ATTEMPTS = 3;
+const PROBE_BACKOFF_MS = 150;
+/**
+ * Probe the daemon, retrying a TRANSIENT failure before concluding anything.
+ *
+ * ⚠⚠ THE RETRY IS FREE ON THE HAPPY PATH AND ON THE COMMON SAD PATH. A first attempt that answers
+ * costs one connect (p50 0.1 ms); an absent socket FILE returns immediately without retrying,
+ * because nothing about a missing socket can change in 300 ms and this runs before many commands.
+ * Retries fire only when the socket file EXISTS and the attempt failed — i.e. a daemon was here
+ * moments ago, which is precisely the world the ticket describes.
+ *
+ * ⚠ `ECONNREFUSED` ON A UNIX SOCKET IS AMBIGUOUS and is therefore retried, not trusted: it means
+ * either a stale socket file left by a dead daemon (permanent) or a full accept backlog on a live
+ * one (transient). One sample cannot tell them apart; three, spread over 300 ms, usually can.
+ *
+ * ⚠ THE STATE IS NOT DOWNGRADED BY A LATER ATTEMPT. If any attempt saw a listener, the answer is
+ * `silent` — a daemon that accepted once and refused once is alive and struggling, and calling
+ * that "down" is the original defect.
+ */
+export async function probeDaemon() {
+    if (!existsSync(SOCKET_PATH))
+        return { state: 'down', attempts: 0 };
+    let sawListener = false;
+    let last = { state: 'down', attempts: 0 };
+    for (let i = 1; i <= PROBE_ATTEMPTS; i++) {
+        const r = await probeOnce(PROBE_DEADLINE_MS);
+        last = { ...r, attempts: i };
+        if (r.state === 'up')
+            return last;
+        if (r.state === 'silent')
+            sawListener = true;
+        if (i < PROBE_ATTEMPTS)
+            await new Promise((r2) => setTimeout(r2, PROBE_BACKOFF_MS));
+    }
+    return sawListener ? { ...last, state: 'silent' } : last;
+}
+/**
+ * Is the daemon usable?
+ *
+ * ⚠ KEPT AS THE BOOLEAN FACE OF `probeDaemon`, never a second implementation — the same shape
+ * `exampleMutates`/`classifyExample` uses in `commands/explain.ts`. ~15 call sites want a yes/no
+ * and must not each re-derive one; the callers that need to tell "wedged" from "absent" (`status`,
+ * `start`) ask for the probe.
+ */
+export async function isDaemonRunning() {
+    return (await probeDaemon()).state === 'up';
+}
+/**
+ * Complete the IPC auth handshake on a freshly-connected socket.
+ *
+ * Reads the status frame, sends `{ type: 'auth', token }`, waits for
+ * `auth-result`. Resolves when ok=true. If the daemon reports
+ * `requireAuth: false` (backward-compat with a daemon built before auth
+ * was added), we skip the handshake silently.
+ */
+function handshake(socket) {
+    return new Promise((resolve, reject) => {
+        let buffer = '';
+        let statusSeen = false;
+        const timer = setTimeout(() => {
+            socket.removeListener('data', onData);
+            reject(new Error('IPC auth handshake timeout'));
+        }, AUTH_TIMEOUT_MS);
+        const onData = (chunk) => {
+            buffer += chunk.toString();
+            const lines = buffer.split('\n');
+            buffer = lines.pop() || '';
+            for (const line of lines) {
+                if (!line.trim())
+                    continue;
+                let msg;
+                try {
+                    msg = JSON.parse(line);
+                }
+                catch {
+                    continue;
+                }
+                if (msg.type === 'status' && !statusSeen) {
+                    statusSeen = true;
+                    if (msg.requireAuth === false) {
+                        clearTimeout(timer);
+                        socket.removeListener('data', onData);
+                        resolve();
+                        return;
+                    }
+                    const token = resolveClientAuthToken();
+                    if (!token) {
+                        clearTimeout(timer);
+                        socket.removeListener('data', onData);
+                        reject(new Error(
+                        /**
+                         * ⚠⚠ THE OLD ADVICE NAMED ONLY THE MAC APP, AND THE COMMON CAUSE IS A
+                         * CLI-OWNED DAEMON — so the single instruction given was the one that
+                         * could not possibly help.
+                         *
+                         * `beehaven stop` clears both token files. If the process survives it
+                         * (or a follow-up `start` refuses because the socket is still held),
+                         * you are left with a LIVE daemon and NO tokens: the socket connects,
+                         * the handshake fails, and every command reports this. Relaunching an
+                         * app that does not own that daemon changes nothing, which is exactly
+                         * how this looked unfixable for an hour.
+                         *
+                         * Restarting the daemon re-mints both scopes — verified: the files
+                         * reappear within seconds of a clean `stop` then `start`.
+                         */
+                        /**
+                         * ⚠⚠ THE OLD TEXT BLAMED THE DAEMON AND ADVISED THE RESTART THAT CAUSES THIS.
+                         *
+                         * `stop` scrubs both tokens on shutdown, and `start --headless` used to return
+                         * BEFORE the replacement was minted — so the common way to reach this message was
+                         * a `stop && start && call` sequence landing in that window. Telling the reader to
+                         * restart deleted the fresh token and put them back in it. Observed repeatedly.
+                         *
+                         * ⚠ THE SOCKET IS THE DISCRIMINATOR. A live socket with no token means the daemon
+                         * is still coming up — wait. No socket means nothing is running — start one. Those
+                         * are opposite actions and the old message gave the wrong one for the common case.
+                         *
+                         * ⚠ `start --headless` NOW WAITS for the socket (see `daemon-cmd.ts`), so a script
+                         * that uses it should no longer reach this at all.
+                         */
+                        (existsSync(SOCKET_PATH)
+                            ? 'The daemon is still starting — its socket is up but it has not minted an IPC token yet. ' +
+                                'Wait a second and retry. (Do NOT restart: `stop` scrubs the token, which re-enters this window.)'
+                            : 'No IPC auth token and no daemon socket — nothing is running. ' +
+                                'Start one: `beehaven start --headless` (prefix HIVE_DEV_MODE=1 for admin/shell verbs), ' +
+                                'or open the Clearly Dev Mac app if it owns the daemon.')));
+                        return;
+                    }
+                    socket.write(JSON.stringify({ type: 'auth', token }) + '\n');
+                    continue;
+                }
+                if (msg.type === 'auth-result') {
+                    clearTimeout(timer);
+                    socket.removeListener('data', onData);
+                    if (msg.ok)
+                        resolve();
+                    else
+                        reject(new Error(msg.error || 'IPC auth rejected by daemon'));
+                    return;
+                }
+            }
+        };
+        socket.on('data', onData);
+    });
+}
+/** Open a socket, complete auth handshake, run a single request, close. */
+async function withSocket(fn) {
+    const socket = net.createConnection(SOCKET_PATH);
+    await new Promise((resolve, reject) => {
+        socket.once('connect', () => resolve());
+        socket.once('error', reject);
+    });
+    await handshake(socket);
+    try {
+        return await fn(socket);
+    }
+    finally {
+        socket.end();
+    }
+}
+/** Generic IPC RPC: send a typed message, await matching `rpc-result`/`rpc-error`. */
+function sendIpc(socket, msg) {
+    return new Promise((resolve, reject) => {
+        const rid = `req_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+        let buffer = '';
+        const timer = setTimeout(() => {
+            socket.removeListener('data', onData);
+            reject(new Error(`Daemon RPC timeout after ${TIMEOUT_MS}ms`));
+        }, TIMEOUT_MS);
+        const onData = (chunk) => {
+            buffer += chunk.toString();
+            const lines = buffer.split('\n');
+            buffer = lines.pop() || '';
+            for (const line of lines) {
+                if (!line.trim())
+                    continue;
+                let parsed;
+                try {
+                    parsed = JSON.parse(line);
+                }
+                catch {
+                    continue;
+                }
+                if (parsed.type === 'rpc-result' && parsed.rid === rid) {
+                    clearTimeout(timer);
+                    socket.removeListener('data', onData);
+                    resolve(parsed.result);
+                    return;
+                }
+                if (parsed.type === 'rpc-error' && parsed.rid === rid) {
+                    clearTimeout(timer);
+                    socket.removeListener('data', onData);
+                    reject(new Error(parsed.error || 'Daemon RPC failed'));
+                    return;
+                }
+            }
+        };
+        socket.on('data', onData);
+        socket.write(JSON.stringify({ ...msg, rid }) + '\n');
+    });
+}
+/**
+ * Make an HTTP request through the daemon. The daemon attaches its
+ * Firebase ID token as `Authorization: Bearer …`. The token never leaves
+ * the daemon process.
+ */
+export async function daemonFetch(method, url, body, headers) {
+    return withSocket(async (sock) => {
+        return await sendIpc(sock, {
+            type: 'daemon-fetch',
+            method,
+            url,
+            body: typeof body === 'object' ? JSON.stringify(body) : body,
+            headers,
+        });
+    });
+}
+/**
+ * Forward an action RPC through the daemon → relay → DO chain.
+ *
+ * ⚠⚠ THE SECOND GENERAL TRANSPORT, AND IT WAS THE LAST UN-ATTRIBUTED DOOR. `IpcClient` is the
+ * other; this one builds the `type:'rpc'` frame itself, so it reaches the workspace without ever
+ * touching `IpcClient.call` and therefore without the agent wrap. Its callers are not marginal —
+ * `beehaven logs`, `shop`, `costs`, the `--building` gateway path in `cli.ts` and the shell's
+ * fallback all come through here, so the whole set was writing no `agent_activity` row.
+ *
+ * ⚠ Found by RUNNING the verbs, not by reading the diff: `beehaven logs` produced no row after
+ * the `IpcClient` fix, which is what exposed a transport nobody had counted.
+ *
+ * ⚠ THE SPECIFIC HELPERS BELOW ARE FINE UNWRAPPED — `daemonConnect`, `daemonAppList` and their
+ * siblings all name `building:*` / `daemon:*` actions the daemon answers itself, which
+ * `DAEMON_LOCAL_ACTIONS` exempts anyway. It is this GENERAL form, which forwards whatever it is
+ * handed, that had to learn about identity.
+ */
+export async function daemonRpc(action, input = {}) {
+    const wrapped = activeAgentWrap(action, input ?? {}, {});
+    return withSocket(async (sock) => {
+        return await sendIpc(sock, { type: 'rpc', action: wrapped.action, input: wrapped.input });
+    });
+}
+/** Get the daemon's current Firebase ID token. Use `daemonFetch` if possible. */
+export async function daemonGetToken() {
+    return withSocket(async (sock) => {
+        const result = await sendIpc(sock, { type: 'get-token' });
+        return result.token;
+    });
+}
+/**
+ * Connect to a building — tells the daemon to open a persistent session
+ * via FocusManager on the Home DO. All subsequent `daemonRpc` calls
+ * without an explicit target route to this building.
+ *
+ * The Home DO holds a WebSocket to the target building. Messages tagged
+ * with `_building` forward through it. Streaming, live queries, and
+ * presence all work over the persistent connection.
+ */
+export async function daemonConnect(buildingType, buildingId) {
+    return withSocket(async (sock) => {
+        return await sendIpc(sock, {
+            type: 'rpc',
+            action: 'building:connect',
+            input: { buildingType, buildingId },
+        });
+    });
+}
+/** Disconnect from the currently connected building. */
+export async function daemonDisconnect() {
+    return withSocket(async (sock) => {
+        return await sendIpc(sock, {
+            type: 'rpc',
+            action: 'building:disconnect',
+            input: {},
+        });
+    });
+}
+/** Get the currently connected building (if any). */
+export async function daemonGetConnection() {
+    return withSocket(async (sock) => {
+        const result = await sendIpc(sock, {
+            type: 'rpc',
+            action: 'building:connection',
+            input: {},
+        });
+        return result?.connected
+            ? { buildingType: result.buildingType, buildingId: result.buildingId }
+            : null;
+    });
+}
+/** Get full session status — connected building, active sessions, local app state. */
+export async function daemonGetSessionStatus() {
+    return withSocket(async (sock) => {
+        return await sendIpc(sock, {
+            type: 'rpc',
+            action: 'daemon:session-status',
+            input: {},
+        });
+    });
+}
+/** List installed apps. */
+export async function daemonAppList() {
+    return withSocket(async (sock) => {
+        return await sendIpc(sock, { type: 'rpc', action: 'daemon:app-list', input: {} });
+    });
+}
+/** Install an app from a local path or URL. */
+export async function daemonAppInstall(source) {
+    return withSocket(async (sock) => {
+        return await sendIpc(sock, { type: 'rpc', action: 'daemon:app-install', input: { source } });
+    });
+}
+/** Uninstall an app by name. */
+export async function daemonAppUninstall(name) {
+    return withSocket(async (sock) => {
+        return await sendIpc(sock, { type: 'rpc', action: 'daemon:app-uninstall', input: { name } });
+    });
+}