beehaven 0.8.29 → 0.8.34

package/dist/commands/agents-md.js

@@ -0,0 +1,118 @@
+/**
+ * beehaven agents-md — put the Clearly block in THIS project's AGENTS.md (CAN2-66).
+ *
+ * ⚠⚠ TWO FILES, TWO AUDIENCES. `beehaven login` already writes a GLOBAL block into
+ * ~/.claude/CLAUDE.md, ~/.codex/AGENTS.md and ~/.gemini/GEMINI.md (agent-instructions.ts), so every
+ * agent on THIS machine knows Clearly. A project's AGENTS.md is for everyone else who opens the
+ * repo — a teammate's Codex, a cloud agent, CI — and it is committed and shared. That is why this
+ * is its own command the person (or their agent, asked first) runs, not a side effect of install.
+ *
+ * ⚠ THE MARKERS ARE THE UPDATE MECHANISM, as on every other surface (lib/connections/agentsMd.ts):
+ * re-running replaces only what lies between our markers and leaves the rest byte for byte. The
+ * CLI and MCP blocks have their own markers, so a repo used both ways keeps both.
+ *
+ * ⚠ AGENTS.md IS THE FILE; CLAUDE.md POINTS AT IT with one `@AGENTS.md` line — one copy to keep
+ * current. An existing CLAUDE.md gains the line only if it lacks it; nothing else in it is touched.
+ */
+import { existsSync, readFileSync, writeFileSync } from 'fs';
+import { join, resolve } from 'path';
+import { execFileSync } from 'child_process';
+import { color } from '../spinner.js';
+import { CLI_BLOCK_START, CLI_BLOCK_END, MCP_BLOCK_START, MCP_BLOCK_END, CLAUDE_MD_IMPORT, agentsMdCliBlock, agentsMdMcpBlock, } from '../agents-md-text.js';
+/** Our block replaced between its markers, or appended after one blank line. Keeps CRLF files CRLF. */
+export function spliceBlock(text, block, start, end) {
+    const eol = text.includes('\r\n') ? '\r\n' : '\n';
+    const b = block.split('\n').join(eol);
+    const i = text.indexOf(start);
+    const j = i >= 0 ? text.indexOf(end, i) : -1;
+    if (i >= 0 && j >= 0)
+        return text.slice(0, i) + b + text.slice(j + end.length);
+    if (!text.trim())
+        return b + eol;
+    return text.replace(/\s*$/, '') + eol + eol + b + eol;
+}
+/** Our block taken out, with the blank line that separated it. Everything else stays. */
+export function removeBlock(text, start, end) {
+    const i = text.indexOf(start);
+    const j = i >= 0 ? text.indexOf(end, i) : -1;
+    if (i < 0 || j < 0)
+        return text;
+    const before = text.slice(0, i).replace(/(\r?\n)*$/, '');
+    const after = text.slice(j + end.length).replace(/^(\r?\n)*/, '');
+    const eol = text.includes('\r\n') ? '\r\n' : '\n';
+    if (!before)
+        return after;
+    return after ? before + eol + eol + after : before + eol;
+}
+/** The repository root when `dir` is inside a git work tree, else `dir` itself. */
+export function projectRoot(dir) {
+    try {
+        const top = execFileSync('git', ['rev-parse', '--show-toplevel'], {
+            cwd: dir, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true, timeout: 5_000,
+        }).trim();
+        return top || dir;
+    }
+    catch {
+        return dir;
+    }
+}
+/** Write (or remove) the block in `<root>/AGENTS.md` and make CLAUDE.md import it. */
+export function writeProjectAgentsMd(opts) {
+    const root = projectRoot(resolve(opts.dir));
+    const [start, end] = opts.mcp ? [MCP_BLOCK_START, MCP_BLOCK_END] : [CLI_BLOCK_START, CLI_BLOCK_END];
+    const agentsPath = join(root, 'AGENTS.md');
+    const claudePath = join(root, 'CLAUDE.md');
+    const files = [];
+    const had = existsSync(agentsPath);
+    const before = had ? readFileSync(agentsPath, 'utf8') : '';
+    if (opts.remove) {
+        const next = removeBlock(before, start, end);
+        if (next !== before)
+            writeFileSync(agentsPath, next);
+        files.push({ path: agentsPath, change: next !== before ? 'removed' : 'absent' });
+        return { root, files };
+    }
+    const next = spliceBlock(before, opts.mcp ? agentsMdMcpBlock() : agentsMdCliBlock(), start, end);
+    if (next !== before)
+        writeFileSync(agentsPath, next);
+    files.push({ path: agentsPath, change: !had ? 'created' : next !== before ? 'updated' : 'current' });
+    const claude = existsSync(claudePath) ? readFileSync(claudePath, 'utf8') : null;
+    if (claude === null) {
+        writeFileSync(claudePath, CLAUDE_MD_IMPORT + '\n');
+        files.push({ path: claudePath, change: 'created' });
+    }
+    else if (!claude.split(/\r?\n/).some((l) => l.trim() === CLAUDE_MD_IMPORT)) {
+        const eol = claude.includes('\r\n') ? '\r\n' : '\n';
+        writeFileSync(claudePath, claude.replace(/\s*$/, '') + (claude.trim() ? eol + eol : '') + CLAUDE_MD_IMPORT + eol);
+        files.push({ path: claudePath, change: 'updated' });
+    }
+    else {
+        files.push({ path: claudePath, change: 'current' });
+    }
+    return { root, files };
+}
+export function cmdAgentsMd(dir, opts) {
+    if (opts.print) {
+        process.stdout.write((opts.mcp ? agentsMdMcpBlock() : agentsMdCliBlock()) + '\n');
+        return 0;
+    }
+    let r;
+    try {
+        r = writeProjectAgentsMd({ dir: dir ?? process.cwd(), mcp: opts.mcp, remove: opts.remove });
+    }
+    catch (err) {
+        console.error(`  ${color.red('✗')} ${err?.message ?? err}`);
+        return 1;
+    }
+    console.log('');
+    for (const f of r.files) {
+        const mark = f.change === 'current' || f.change === 'absent' ? color.dim('·') : color.green('✓');
+        console.log(`  ${mark} ${f.path}  ${color.dim(f.change)}`);
+    }
+    const changed = r.files.some((f) => f.change !== 'current' && f.change !== 'absent');
+    if (changed && !opts.remove) {
+        console.log(color.dim(`\n  Commit ${r.files.map((f) => f.path.slice(r.root.length + 1)).join(' and ')} so every agent that opens this project knows the workspace.`));
+    }
+    console.log('');
+    return 0;
+}

package/dist/commands/daemon-cmd.js

@@ -42,6 +42,8 @@ export function spawnStandaloneDaemon(values) {
     const child = spawn(process.execPath, [entry], {
         detached: true,
         stdio: 'ignore',
+        // Windows: a detached child gets its OWN console window — closing it kills the daemon. Hide it.
+        windowsHide: true,
         // BEEHAVEN_HEADLESS=1 is REQUIRED, not optional: daemon-entry.ts runs a
         // parent-death watchdog (polls process.ppid, self-exits ~3s after the parent
         // is gone) to enforce the tray-coupled lifecycle. A detached CLI-spawned

package/dist/commands/help.js

@@ -413,6 +413,27 @@ const PAGES = {
     \`beehaven login\` to connect the CLI to it.`,
         related: ['login', 'guide'],
     },
+    'agents-md': {
+        synopsis: 'beehaven agents-md [dir] [--mcp] [--print] [--remove]',
+        description: `Add the Clearly block to this project's AGENTS.md, so every agent that opens the
+    repository — a teammate's Codex or Claude Code, a cloud agent, CI — knows the workspace and how
+    to reach it. Writes at the git root (or the directory given), and makes CLAUDE.md import it with
+    one \`@AGENTS.md\` line. Needs no login.
+
+    The block sits between Clearly's markers: run it again to update the block, and everything
+    else in the file stays as it was. \`beehaven login\` already teaches the agents on THIS machine
+    (their global instruction files); this is the shared, committed copy for everyone else.`,
+        flags: [
+            { name: '--mcp', desc: 'Write the block for agents connected over MCP instead of the CLI' },
+            { name: '--print', desc: 'Print the block and write nothing' },
+            { name: '--remove', desc: 'Take the block out again' },
+        ],
+        examples: [
+            { cmd: 'beehaven agents-md', note: 'AGENTS.md + CLAUDE.md at the repository root' },
+            { cmd: 'beehaven agents-md --mcp', note: 'for a team that connects over MCP' },
+        ],
+        related: ['skills', 'login'],
+    },
     handoff: {
         synopsis: 'beehaven handoff [file.md|-] [--tasks tasks.md|json] [--csv data.csv]… [--title "…"] [--wait] [--json]',
         description: `Give a person your work when they have no Clearly account yet. Needs no login.

package/dist/commands/self-update.js

@@ -43,9 +43,10 @@ import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
 import { homedir, tmpdir } from 'node:os';
-import { join, sep } from 'node:path';
+import { dirname, join, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { usableUpdateDigest } from '../version-utils.js';
+import { compareVersions, usableUpdateDigest } from '../version-utils.js';
+import { npmUpdatePlan, latestNpmVersion, installedNpmVersion, installNpmVersionSync } from '../npm-update.js';
 /**
  * Which install this process is.
  *
@@ -83,8 +84,9 @@ export function updateHint(kind = installKind()) {
         return 'Run \x1b[1mbeehaven update\x1b[0m';
     if (kind === 'npx')
         return 'Run `npx @clearlysh/beehaven@latest` for the current npm release.';
+    // npm installs update themselves since CAN2-57 (the daemon hourly, `beehaven update` on demand).
     if (kind === 'npm')
-        return 'Run `npm install -g @clearlysh/beehaven@latest` to update this npm install.';
+        return 'Run \x1b[1mbeehaven update\x1b[0m (or `npm install -g @clearlysh/beehaven@latest`).';
     return 'This is a linked dev build — `npm run build` in beehaven_sdk/packages/cli.';
 }
 /**
@@ -113,9 +115,11 @@ export function runSelfUpdate(kind = installKind()) {
     if (kind === 'linked') {
         return { ok: false, message: 'This is a linked development build — refusing to overwrite it.\n  cd beehaven_sdk/packages/cli && npm run build' };
     }
-    if (kind === 'npm' || kind === 'npx') {
+    if (kind === 'npx') {
         return { ok: false, message: updateHint(kind) };
     }
+    if (kind === 'npm')
+        return runNpmSelfUpdate();
     const feed = (process.env.BEEHAVEN_CLI_FEED || 'https://downloads.clearly.sh/cli/').replace(/\/+$/, '');
     const installerUrl = process.env.BEEHAVEN_INSTALL_URL || 'https://www.clearly.sh/install.sh';
     const temp = mkdtempSync(join(tmpdir(), 'beehaven-self-update-'));
@@ -154,9 +158,32 @@ export function runSelfUpdate(kind = installKind()) {
         rmSync(temp, { recursive: true, force: true });
     }
 }
+/**
+ * ⚠ npm installs (the only Windows install) update with npm itself — see `npm-update.ts` for why
+ * it refuses rather than guessing when this copy is not npm's global install or the prefix is not
+ * writable. The daemon restarts itself after ITS hourly update; after this manual one the running
+ * daemon keeps the old code until restarted, so the message says so.
+ */
+function runNpmSelfUpdate() {
+    const manual = 'Update it by hand: npm install -g @clearlysh/beehaven@latest';
+    const pkgRoot = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
+    const plan = npmUpdatePlan(pkgRoot);
+    if (!plan.ok)
+        return { ok: false, message: `Can't update this npm install here: ${plan.reason}.\n  ${manual}` };
+    const latest = latestNpmVersion(plan.npm);
+    if (!latest)
+        return { ok: false, message: `Update failed: could not read the latest version from npm.\n  ${manual}` };
+    const current = installedNpmVersion(plan.globalRoot) ?? '0.0.0';
+    if (compareVersions(latest, current) <= 0)
+        return { ok: true, message: `Already up to date (${current}).` };
+    const r = installNpmVersionSync(plan, latest);
+    return r.ok
+        ? { ok: true, message: `${r.message} A daemon that is already running keeps the old version until: beehaven restart` }
+        : { ok: false, message: `${r.message}\n  ${manual}` };
+}
 /** True when this install can update itself at all — what the notifier uses to pick its wording. */
 export function canSelfUpdate(kind = installKind()) {
-    return kind === 'user';
+    return kind === 'user' || kind === 'npm';
 }
 /**
  * Is a bundled CLI present that the shell can NEVER reach, whatever its version?

package/dist/commands/workspace.js

@@ -26,8 +26,8 @@ import { resolveActiveAgent } from '../agent-state.js';
 import { isAgentRuntime } from '../agent-scope.js';
 import { getTarget } from '../cli-state.js';
 import { attachShellCwd, absorbShellCwd, shellTargetKey } from '../shell-session.js';
-/** Workspace-agent turns wait for the server's turn ceiling (300s) plus the report's tail. */
-export const AGENT_TURN_TIMEOUT_MS = 330_000;
+/** Workspace-agent jobs wait for the server's ceiling (900s) plus the report's tail. */
+export const AGENT_TURN_TIMEOUT_MS = 930_000;
 const AGENT_TURN_ACTIONS = new Set(['agent-prompt', 'agent-turn']);
 export function getTimeout(values, action) {
     // Precedence: explicit --timeout flag → BEEHAVEN_RPC_TIMEOUT_MS env → default.
@@ -40,7 +40,7 @@ export function getTimeout(values, action) {
     const env = process.env.BEEHAVEN_RPC_TIMEOUT_MS;
     if (env && Number.isFinite(Number(env)) && Number(env) > 0)
         return parseInt(env, 10);
-    // An agent turn may run to the server's 300s ceiling (clearly CDS-90); waiting less abandons it.
+    // An agent job may run to the server's 900s ceiling (WDP3-62); waiting less abandons it.
     return action && AGENT_TURN_ACTIONS.has(action) ? AGENT_TURN_TIMEOUT_MS : 180_000;
 }
 /**
@@ -725,8 +725,18 @@ export { activeAgentWrap, setCliDoor, cliDoor, alreadyAttributed, BOOTSTRAP_ACTI
  * ambient identity and is correct for every verb that does not offer that flag.
  */
 export async function agentRpc(action, input, timeout, values = {}) {
-    const wrapped = activeAgentWrap(action, input, values);
-    return rpcOnce(wrapped.action, wrapped.input, timeout);
+    /**
+     * ⚠⚠ THE TYPED VERBS FOLLOW THE SESSION'S WORKSPACE, LIKE `call` (AWO-393). This sent a bare
+     * `rpcOnce` to the daemon's default workspace: after `connect team/<id>`, `beehaven call
+     * ticket-create` filed in the team and `beehaven ticket create` filed at home. Same resolver,
+     * same order as `cmdCall` — wrap as the agent first, then the building envelope around it.
+     */
+    const routed = { ...values };
+    const { resolveTargetBuilding } = await import('../session-target.js');
+    await resolveTargetBuilding(routed);
+    const wrapped = activeAgentWrap(action, input, routed);
+    const resolved = resolveBuilding(wrapped.action, wrapped.input, routed.building);
+    return rpcOnce(resolved.action, resolved.input, timeout);
 }
 /**
  * Does this result payload represent a failure? Mirrors `isFailurePayload` in the worker's
@@ -1260,7 +1270,13 @@ function printCallErrorHints(msg, action, values) {
     if (!values.json) {
         console.error('');
         console.error('\x1b[2m  Try:\x1b[0m');
-        if (s.includes('unknown action') || s.includes('404')) {
+        if (/admin:(store|team|workspace)-rpc/.test(s) && s.includes('not allowed')) {
+            // A store/team target is reached through an admin:*-rpc proxy, which the workspace refuses
+            // to members over the daemon. Platform admins have the HTTP door instead (PPO-444).
+            console.error(`\x1b[2m    beehaven admin do shopifyStore/<id> ${action} '<json>'   # platform admins: the operator door\x1b[0m`);
+            console.error(`\x1b[2m    beehaven admin dashboard shopifyStore/<id>         # state, logs, snapshots\x1b[0m`);
+        }
+        else if (s.includes('unknown action') || s.includes('404')) {
             console.error(`\x1b[2m    beehaven actions --search <name>  # find the mounted action\x1b[0m`);
             console.error(`\x1b[2m    beehaven pwd                      # confirm you\'re on the right DO\x1b[0m`);
         }

package/dist/daemon-client.js

@@ -15,17 +15,16 @@
  *   }
  */
 import net from 'net';
-import { existsSync } from 'fs';
 import { resolveClientAuthToken } from './ipc-auth.js';
 import { activeAgentWrap } from './agent-attribution.js';
-const SOCKET_PATH = '/tmp/beehaven-ipc.sock';
+import { ipcSocketPath, socketMayExist } from './ipc-path.js';
 const TIMEOUT_MS = 60_000;
 const AUTH_TIMEOUT_MS = 3_000;
 /** One attempt. Resolves, never rejects. */
 function probeOnce(deadlineMs) {
     return new Promise((resolve) => {
         let connected = false;
-        const sock = net.createConnection(SOCKET_PATH);
+        const sock = net.createConnection(ipcSocketPath());
         const timer = setTimeout(() => {
             sock.destroy();
             // ⚠ CONNECTED-BUT-SILENT IS NOT "DOWN". The kernel accepted us, so a listener exists.
@@ -65,7 +64,7 @@ const PROBE_BACKOFF_MS = 150;
  * that "down" is the original defect.
  */
 export async function probeDaemon() {
-    if (!existsSync(SOCKET_PATH))
+    if (!socketMayExist(ipcSocketPath()))
         return { state: 'down', attempts: 0 };
     let sawListener = false;
     let last = { state: 'down', attempts: 0 };
@@ -74,6 +73,11 @@ export async function probeDaemon() {
         last = { ...r, attempts: i };
         if (r.state === 'up')
             return last;
+        // Nothing at the address (no socket file, or no such Windows pipe): permanent, like the
+        // missing-file check above — a named pipe cannot be checked before connecting, so this is
+        // where "nothing is running" is learned on Windows. Retrying would only add ~300 ms.
+        if (r.code === 'ENOENT' && !sawListener)
+            return last;
         if (r.state === 'silent')
             sawListener = true;
         if (i < PROBE_ATTEMPTS)
@@ -165,7 +169,7 @@ function handshake(socket) {
                          * ⚠ `start --headless` NOW WAITS for the socket (see `daemon-cmd.ts`), so a script
                          * that uses it should no longer reach this at all.
                          */
-                        (existsSync(SOCKET_PATH)
+                        (socketMayExist(ipcSocketPath())
                             ? 'The daemon is still starting — its socket is up but it has not minted an IPC token yet. ' +
                                 'Wait a second and retry. (Do NOT restart: `stop` scrubs the token, which re-enters this window.)'
                             : 'No IPC auth token and no daemon socket — nothing is running. ' +
@@ -192,7 +196,7 @@ function handshake(socket) {
 }
 /** Open a socket, complete auth handshake, run a single request, close. */
 async function withSocket(fn) {
-    const socket = net.createConnection(SOCKET_PATH);
+    const socket = net.createConnection(ipcSocketPath());
     await new Promise((resolve, reject) => {
         socket.once('connect', () => resolve());
         socket.once('error', reject);

package/dist/daemon-entry.js

@@ -23,6 +23,7 @@
  *     startup errors (those usually need user intervention — expired token,
  *     missing config, etc).
  */
+import './windows-hide.js'; // FIRST: no console windows flashing on Windows (CAN2-56)
 import { startDaemon } from './daemon.js';
 // ── Parent-watcher (tray-coupled enforcement) ──
 // The daemon is documented as tray-coupled: it must not outlive the

package/dist/daemon-process.js

@@ -0,0 +1,125 @@
+/**
+ * daemon-process — "is this process a beehaven daemon?", on every platform (CAN2-56).
+ *
+ * Split out of `daemon.ts` so the rule is testable without importing the daemon, and so Windows has
+ * an answer at all: `findLiveDaemons` read a command line with `ps` (macOS) or `/proc/<pid>/cmdline`
+ * (Linux) and found orphans with `pgrep`. Windows has none of those, so every lookup threw, was
+ * swallowed as "not ours", and `stop` / `restart` / the single-instance guard never saw a running
+ * daemon. Windows reads command lines from one CIM query instead.
+ */
+import { execFileSync } from 'child_process';
+/**
+ * Whether a full command line is a beehaven daemon or CLI process.
+ *
+ * Strict two-condition test (unchanged on macOS/Linux):
+ *   1. argv[0] is a node/tsx/beehaven binary — not a shell, an editor, a grep, etc.;
+ *   2. a later argument is a beehaven cli/daemon-entry script (under a beehaven* directory OR a
+ *      Clearly*.app bundle).
+ *
+ * ⚠ WINDOWS COMMAND LINES ARE NORMALISED FIRST: argv[0] arrives quoted with backslashes, spaces and
+ * an extension (`"C:\Program Files\nodejs\node.exe" C:\…\daemon-entry.js`). It is reduced to the
+ * Unix shape (`C:/Program_Files/nodejs/node …`) so the same two conditions apply, unquoted.
+ */
+export function isBeehavenCommandLine(raw, platform = process.platform) {
+    let cmd = (raw ?? '').trim();
+    if (!cmd)
+        return false;
+    if (platform === 'win32') {
+        const m = /^"([^"]*)"\s*(.*)$/s.exec(cmd) ?? /^(\S+)\s*(.*)$/s.exec(cmd);
+        if (!m)
+            return false;
+        const argv0 = m[1].replace(/\\/g, '/').replace(/\.(exe|cmd)$/i, '').replace(/\s+/g, '_').toLowerCase();
+        cmd = `${argv0} ${m[2].replace(/"/g, '')}`.trim();
+    }
+    // Condition 1: argv[0] must be a node/tsx/beehaven-wrapper binary. Anchored with ^ so a shell
+    // running a heredoc that contains "node .../cli.js" deeper in its argv doesn't false-positive.
+    const argv0Ok = /^(\S*\/)?node(\s|$)/.test(cmd) ||
+        /^(\S*\/)?tsx(\s|$)/.test(cmd) ||
+        /^(\S*\/)?beehaven(\s|$)/.test(cmd);
+    if (!argv0Ok)
+        return false;
+    // ⚠⚠ ON WINDOWS ONLY THE DAEMON ENTRY COUNTS. The `cli.js` patterns below exist for LEGACY daemons
+    // (`node cli.js start`, before daemon-entry.js) — and on macOS `pgrep` never surfaced ordinary CLI
+    // runs anyway (it reads its pattern as a BASIC regex, where `(js|ts)` matches nothing). Windows
+    // lists every node process, so with them a `start --headless` parent waiting for its child was
+    // "another daemon" (the child refused to start — the second Windows CI run), and `stop` would
+    // have killed an agent's in-flight `beehaven call`. There are no legacy Windows daemons to find.
+    if (platform === 'win32')
+        return /[/\\]\.?beehaven([-_]sdk)?[/\\].*daemon-entry\.(js|ts)\b/.test(cmd);
+    // Condition 2: a subsequent argument must reference a beehaven script.
+    //
+    // NOTE THE `\.?` — the directory may be `beehaven/` OR the DOTFILE `.beehaven/`. And `[-_]sdk`:
+    // the monorepo checkout is `beehaven_sdk/`, but a clone of the GitHub repo is `beehaven-sdk/` —
+    // the first Windows CI run could not find its own daemon for exactly that reason (CAN2-56).
+    // `public/install.sh` installs to `~/.beehaven/cli/`, the canonical location for every
+    // `curl … | sh` user; requiring exactly "beehaven" once made the CLI blind to its own standard
+    // install (`stop` said "No daemon running" while one was).
+    return (
+    // Dedicated daemon entry — what the Mac app tray and `start --headless` spawn.
+    /[/\\]\.?beehaven([-_]sdk)?[/\\].*daemon-entry\.(js|ts)\b/.test(cmd) ||
+        /Clearly[^/\\]*\.app[/\\]Contents[/\\]Resources[/\\]beehaven[/\\]daemon-entry\.js\b/.test(cmd) ||
+        // Legacy `cli.js start` — for old bundles pre-dating daemon-entry.js.
+        /[/\\]\.?beehaven([-_]sdk)?[/\\].*cli\.(js|ts)\b/.test(cmd) ||
+        /Clearly[^/\\]*\.app[/\\]Contents[/\\]Resources[/\\]beehaven[/\\]cli\.js\b/.test(cmd) ||
+        // Bare `beehaven start` — wrapper already matched argv[0].
+        /^(\S*\/)?beehaven\s+start\b/.test(cmd));
+}
+/** Parse `ConvertTo-Json` output of `{ProcessId, CommandLine}` rows (one object, or an array). */
+export function parseWindowsProcessJson(out) {
+    const text = (out ?? '').trim();
+    if (!text)
+        return [];
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return [];
+    }
+    const rows = Array.isArray(parsed) ? parsed : [parsed];
+    const result = [];
+    for (const r of rows) {
+        const pid = Number(r?.ProcessId);
+        if (Number.isFinite(pid) && pid > 0)
+            result.push([pid, typeof r?.CommandLine === 'string' ? r.CommandLine : '']);
+    }
+    return result;
+}
+/**
+ * Node processes on Windows with their command lines — one `Get-CimInstance` call (~0.5–1 s, so it
+ * runs only on start/stop/status paths, never per RPC). `pid` narrows it to one process.
+ * Returns `null` when the query itself failed (no PowerShell, blocked by policy, timed out) — which
+ * is NOT the same as "no node processes", and `selectWindowsDaemons` treats it differently.
+ */
+export function windowsNodeProcesses(pid) {
+    const filter = pid ? `ProcessId=${Math.trunc(pid)}` : "Name='node.exe'";
+    const script = `Get-CimInstance Win32_Process -Filter "${filter}" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress`;
+    try {
+        const out = execFileSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: 8000,
+            windowsHide: true,
+        });
+        return parseWindowsProcessJson(out);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Which of these Windows processes are beehaven daemons (never this process).
+ *
+ * ⚠ WHEN THE PROCESS QUERY FAILED (`rows === null`), THE PID FILE IS THE ONLY WITNESS LEFT. Seeing
+ * nothing would make `stop` say "No daemon running" over a live one and let `start` spawn a second
+ * daemon beside it — the failure the first Windows CI run showed. A live process at the recorded
+ * PID is trusted then, and only then: with a working query, the command line decides, so a PID
+ * recycled by an unrelated program is never taken for the daemon.
+ */
+export function selectWindowsDaemons(rows, opts) {
+    if (rows === null) {
+        const p = opts.pidFilePid;
+        return p && p > 0 && p !== opts.selfPid && opts.isAlive(p) ? [p] : [];
+    }
+    return rows.filter(([pid, cmd]) => pid !== opts.selfPid && isBeehavenCommandLine(cmd, 'win32')).map(([pid]) => pid);
+}