beehaven 0.8.29 → 0.8.34

package/dist/ipc-server.js

@@ -2,7 +2,7 @@
  * IPC Server — bidirectional Unix socket for local clients (Electron, CLI tools).
  *
  * Provides request-response RPCs and broadcast subscriptions over a line-based
- * JSON protocol on /tmp/beehaven-ipc.sock.
+ * JSON protocol on /tmp/beehaven-ipc.sock (a per-user named pipe on Windows — see ipc-path.ts).
  *
  * Local clients send messages to the daemon, which forwards them to the DO
  * via the relay WebSocket. DO responses and broadcasts are forwarded back
@@ -24,10 +24,11 @@
  *   { "type": "status", "connected": true, "daemonPid": 1234 }
  */
 import { createConnection, createServer } from 'net';
-import { existsSync, unlinkSync, chmodSync, statSync } from 'fs';
 import { EventEmitter } from 'events';
 import { resolveAuthScope } from './ipc-auth.js';
-const IPC_SOCKET_PATH = '/tmp/beehaven-ipc.sock';
+import { ipcSocketPath, socketMayExist, clearStaleSocket, restrictSocketToOwner } from './ipc-path.js';
+/** The default address (Unix socket, or this user's named pipe on Windows) — see `ipc-path.ts`. */
+const IPC_SOCKET_PATH = ipcSocketPath();
 /**
  * Message types the daemon will process without authentication.
  *
@@ -114,9 +115,10 @@ export function actionChain(action, input, depth = 0) {
  */
 function probeIpcSocket(timeoutMs = 400) {
     return new Promise((resolve) => {
-        if (!existsSync(IPC_SOCKET_PATH))
+        const path = ipcSocketPath();
+        if (!socketMayExist(path))
             return resolve(false);
-        const client = createConnection(IPC_SOCKET_PATH);
+        const client = createConnection(path);
         const done = (alive) => {
             try {
                 client.destroy();
@@ -138,6 +140,8 @@ function probeIpcSocket(timeoutMs = 400) {
 export { probeIpcSocket };
 export class IpcServer extends EventEmitter {
     server = null;
+    /** The address this server bound (resolved at `start`, so an env override set before start applies). */
+    path = null;
     clients = new Map();
     clientCounter = 0;
     virtualClientCounter = 0;
@@ -157,12 +161,10 @@ export class IpcServer extends EventEmitter {
      * at this point; a live server would have been caught upstream.
      */
     start() {
-        // Clean up stale socket
-        try {
-            if (existsSync(IPC_SOCKET_PATH))
-                unlinkSync(IPC_SOCKET_PATH);
-        }
-        catch { }
+        // Clean up a stale socket file (a named pipe leaves none).
+        const path = ipcSocketPath();
+        this.path = path;
+        clearStaleSocket(path);
         this.server = createServer((socket) => {
             const clientId = `ipc_${++this.clientCounter}`;
             // Connections start unauthenticated and scope=null. The client must
@@ -235,7 +237,7 @@ export class IpcServer extends EventEmitter {
         // process-wide umask — umask changes are global and race with any
         // other mkdirSync / writeFileSync happening in parallel (e.g.
         // LocalHive pre-creating building data dirs during startup).
-        this.server.listen(IPC_SOCKET_PATH, () => {
+        this.server.listen(path, () => {
             /**
              * ⚠⚠ CHMOD, THEN **VERIFY**. This was `chmodSync(…, 0o600)` inside an empty `catch {}`, and
              * the mode it claims has been wrong on every start measured: the live socket comes up
@@ -266,19 +268,18 @@ export class IpcServer extends EventEmitter {
              * was learned once and not applied here. Import at the top; never reach for `require` in this
              * package.
              */
-            let mode = null;
-            try {
-                chmodSync(IPC_SOCKET_PATH, 0o600);
-                mode = statSync(IPC_SOCKET_PATH).mode & 0o777;
-            }
-            catch (err) {
-                console.warn(`[ipc] SECURITY: could not set 0600 on ${IPC_SOCKET_PATH} — ${err?.code ?? err?.message ?? err}`);
+            // A Windows named pipe has no file mode (`applicable: false`): its boundary is the per-user
+            // pipe name plus the IPC token — see `ipc-path.ts`.
+            const restricted = restrictSocketToOwner(path);
+            const mode = restricted.mode;
+            if (restricted.error) {
+                console.warn(`[ipc] SECURITY: could not set 0600 on ${path} — ${restricted.error}`);
             }
             if (mode !== null && mode !== 0o600) {
                 console.warn(`[ipc] SECURITY: socket mode is 0${mode.toString(8)}, expected 0600. Other-user connect is still `
                     + `blocked (no write bit), but the documented guarantee does not hold — do not weaken it further.`);
             }
-            console.log(`[ipc] Listening on ${IPC_SOCKET_PATH}${mode !== null ? ` (mode 0${mode.toString(8)})` : ''}`);
+            console.log(`[ipc] Listening on ${path}${mode !== null ? ` (mode 0${mode.toString(8)})` : ''}`);
         });
         this.server.on('error', (err) => {
             console.warn(`[ipc] Server error: ${err.message}`);
@@ -295,11 +296,7 @@ export class IpcServer extends EventEmitter {
             this.server.close();
             this.server = null;
         }
-        try {
-            if (existsSync(IPC_SOCKET_PATH))
-                unlinkSync(IPC_SOCKET_PATH);
-        }
-        catch { }
+        clearStaleSocket(this.path ?? ipcSocketPath());
     }
     /** Broadcast a message from the DO to all subscribed local clients */
     /**
@@ -605,20 +602,23 @@ export class IpcServer extends EventEmitter {
     // IPC bus so the same pipeline/app-rpc handlers serve both Claude and
     // the human UI.
     /** Register a virtual client and return its id. */
-    createVirtualClient(virtualSend, initialSubscriptions = ['*']) {
+    createVirtualClient(virtualSend, initialSubscriptions = ['*'], scope = null) {
         const id = `virt_${++this.virtualClientCounter}`;
+        /**
+         * ⚠⚠ A VIRTUAL CLIENT IS ONLY AS TRUSTED AS WHOEVER IS ON THE OTHER END OF IT (CAN2-64).
+         * This used to be `authenticated: true, scope: 'developer'` for everyone, justified by "the
+         * dashboard bridge enforces its own auth (session cookie, origin check)". It enforced none,
+         * so any web page that opened ws://127.0.0.1:9800/apps/ws could call get-token. The bridge
+         * now judges the connection (dashboard.ts `appBridgeTrust`) and passes 'consumer' or null;
+         * a null client must authenticate with the IPC token, exactly like a socket client.
+         */
         const client = {
             id,
             virtualSend,
             subscriptions: initialSubscriptions,
             buffer: '',
-            // Virtual clients are in-process — they're already inside the trust
-            // boundary. The dashboard /apps/ws bridge enforces its own auth
-            // (session cookie, origin check) before creating the virtual client,
-            // so we hand them developer scope to mirror what a logged-in tray
-            // user can already do.
-            authenticated: true,
-            scope: 'developer',
+            authenticated: scope !== null,
+            scope,
         };
         this.clients.set(id, client);
         // Mimic the on-connect status frame real clients receive so the bridge

package/dist/npm-update.js

@@ -0,0 +1,138 @@
+/**
+ * npm-update — updating a CLI that was installed with `npm install -g` (CAN2-57).
+ *
+ * ⚠⚠ npm IS THE ONLY WINDOWS INSTALL, AND IT NEVER UPDATED. The daemon's hourly updater re-runs the
+ * bash `install.sh`, so it served only `~/.beehaven/cli` installs; `beehaven update` refused npm
+ * installs and printed the npm command instead. A Windows user stayed on whatever version they
+ * first installed until they noticed the notice. Both paths now call this module.
+ *
+ * ⚠ IT UPDATES THE COPY THAT IS RUNNING, OR NOTHING. The npm that sits beside the running Node is
+ * asked for its global root; if this package is not the one installed there (an npx run, a second
+ * Node, a copied folder), installing would create a SECOND copy that shadows or is shadowed by
+ * this one — the failure `self-update.ts` documents for curl installs. So it refuses and says why.
+ *
+ * ⚠ A GLOBAL PREFIX THE USER CANNOT WRITE IS NOT "TRY sudo". Windows (`%AppData%\npm`) and
+ * Homebrew/nvm prefixes are user-writable; a system `/usr/local` usually is not, and an unattended
+ * daemon must never escalate. Not writable → the one-line manual command, nothing else.
+ *
+ * ⚠ THE EXACT VERSION, NOT `@latest`. The caller passes the version from the release manifest
+ * (`latest.json`, stable only), so the channel is decided by our publish script, never by a dist
+ * tag someone moved by hand.
+ */
+import { execFile, execFileSync } from 'child_process';
+import { accessSync, constants, existsSync, readFileSync, realpathSync } from 'fs';
+import { homedir } from 'os';
+import { dirname, join, resolve } from 'path';
+export const PACKAGE = '@clearlysh/beehaven';
+const VERSION_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+/** The npm that belongs to the Node running this process, else whatever `npm` is on PATH. */
+export function npmCommand(platform = process.platform, execPath = process.execPath) {
+    const local = join(dirname(execPath), platform === 'win32' ? 'npm.cmd' : 'npm');
+    return existsSync(local) ? local : platform === 'win32' ? 'npm.cmd' : 'npm';
+}
+/** Windows `.cmd` shims cannot be spawned without a shell (Node refuses with EINVAL since 18.20/20.12). */
+const needsShell = (cmd) => /\.cmd$/i.test(cmd);
+const quoteForShell = (s) => (/[\s"&|<>^]/.test(s) ? `"${s.replace(/"/g, '""')}"` : s);
+/** Run npm synchronously; returns stdout. Never inside the package directory (Windows rename locks). */
+function npmSync(npm, args, timeoutMs) {
+    const shell = needsShell(npm);
+    return execFileSync(shell ? quoteForShell(npm) : npm, args, {
+        encoding: 'utf8',
+        cwd: homedir(),
+        timeout: timeoutMs,
+        stdio: ['ignore', 'pipe', 'pipe'],
+        shell,
+        windowsHide: true,
+    });
+}
+/**
+ * Can this install update itself with npm? `pkgRoot` is the running package's root (the folder
+ * holding its package.json).
+ */
+export function npmUpdatePlan(pkgRoot, platform = process.platform) {
+    const npm = npmCommand(platform);
+    let globalRoot;
+    try {
+        globalRoot = npmSync(npm, ['root', '-g'], 30_000).trim();
+    }
+    catch (e) {
+        return { ok: false, npm, reason: `npm is not available (${String(e?.code ?? e?.message ?? e).slice(0, 80)})` };
+    }
+    const real = (p) => { try {
+        return realpathSync(p);
+    }
+    catch {
+        return resolve(p);
+    } };
+    const installed = join(globalRoot, ...PACKAGE.split('/'));
+    if (real(installed).toLowerCase() !== real(pkgRoot).toLowerCase()) {
+        return { ok: false, npm, globalRoot, reason: `this copy (${pkgRoot}) is not npm's global install (${installed})` };
+    }
+    try {
+        accessSync(globalRoot, constants.W_OK);
+        accessSync(installed, constants.W_OK);
+    }
+    catch {
+        return { ok: false, npm, globalRoot, reason: `npm's global folder is not writable by you (${globalRoot})` };
+    }
+    return { ok: true, npm, globalRoot };
+}
+/** The version npm's global install of this package reports, read from disk. */
+export function installedNpmVersion(globalRoot) {
+    try {
+        return JSON.parse(readFileSync(join(globalRoot, ...PACKAGE.split('/'), 'package.json'), 'utf8')).version ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The newest published version, from npm (for `beehaven update`; the daemon uses the release manifest). */
+export function latestNpmVersion(npm) {
+    try {
+        const v = npmSync(npm, ['view', PACKAGE, 'version', '--registry=https://registry.npmjs.org'], 30_000).trim();
+        return VERSION_RE.test(v) ? v : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The arguments that install exactly `version` globally — exported so the shape is pinned. */
+export function npmInstallArgs(version) {
+    if (!VERSION_RE.test(version))
+        throw new Error(`not a release version: ${version}`);
+    return ['install', '-g', `${PACKAGE}@${version}`, '--no-audit', '--no-fund', '--registry=https://registry.npmjs.org'];
+}
+/** Install `version` (blocking — the CLI's `update`). Verifies what landed on disk. */
+export function installNpmVersionSync(plan, version) {
+    if (!plan.ok || !plan.globalRoot)
+        return { ok: false, message: plan.reason ?? 'npm update not possible here' };
+    try {
+        npmSync(plan.npm, npmInstallArgs(version), 5 * 60_000);
+    }
+    catch (e) {
+        const detail = String(e?.stderr || e?.message || e).trim().split('\n').slice(-3).join(' ').slice(0, 240);
+        return { ok: false, message: `npm install failed: ${detail}` };
+    }
+    const got = installedNpmVersion(plan.globalRoot);
+    return got === version
+        ? { ok: true, message: `Updated to ${version}.` }
+        : { ok: false, message: `npm reported success but ${got ?? 'nothing'} is installed, not ${version}.` };
+}
+/** Install `version` without blocking the event loop (the daemon's hourly updater). */
+export function installNpmVersion(plan, version) {
+    return new Promise((resolveP) => {
+        if (!plan.ok || !plan.globalRoot)
+            return resolveP({ ok: false, message: plan.reason ?? 'npm update not possible here' });
+        const shell = needsShell(plan.npm);
+        execFile(shell ? quoteForShell(plan.npm) : plan.npm, npmInstallArgs(version), {
+            cwd: homedir(), timeout: 5 * 60_000, shell, windowsHide: true,
+        }, (err, _out, stderr) => {
+            if (err)
+                return resolveP({ ok: false, message: `npm install failed: ${String(stderr || err.message).trim().split('\n').slice(-3).join(' ').slice(0, 240)}` });
+            const got = installedNpmVersion(plan.globalRoot);
+            resolveP(got === version
+                ? { ok: true, message: `Updated to ${version}.` }
+                : { ok: false, message: `npm reported success but ${got ?? 'nothing'} is installed, not ${version}.` });
+        });
+    });
+}

package/dist/session-binding.js

@@ -0,0 +1,135 @@
+/**
+ * session-binding — ONE AGENT SESSION = one identity + one workspace + one env (AWO-394).
+ *
+ * `agent login` used to scatter a session across three places with three different keys:
+ *   · the identity        — `agents/<name>.json`, shared by every terminal using that name
+ *   · the work session id — a field on that SAME shared record, so a second terminal's login
+ *                           ended the first terminal's session and both then wrote under the new one
+ *   · the cursor          — `target-<name>.json`, so two terminals as one agent shared a workspace,
+ *                           and an agent that never connected inherited the daemon's machine-global focus
+ *
+ * Founder, 2026-10-24: "If agent A is working in workspace1 and agent B is working in workspace1
+ * and agent A connects to shopify DO, would that be isolated" — it was not, reliably. This file is
+ * the per-session record that makes it so: keyed on the PROCESS SCOPE (`deriveAgentScope()`: a
+ * Claude/Codex/Gemini session, a terminal tab, or an explicit `BEEHAVEN_AGENT`), written by
+ * `agent login`, moved only by `connect` in that same session, and read by every verb.
+ *
+ * ⚠ A LEAF MODULE, LIKE `agent-scope.ts`. `agent-state` (identity) and `cli-state` (cursor) both
+ * read it, so it may import neither — that is the cycle `agent-scope.ts` documents.
+ *
+ * ⚠ THE ENV IS PART OF THE SESSION. One daemon dials one relay; `beehaven env prod` in any
+ * terminal re-points every session on the machine. A session remembers the env it was opened on so
+ * a call after such a switch is refused with the fix, instead of landing in another environment's
+ * workspace under the same name.
+ */
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { resolveRelaySelection } from './relay-presets.js';
+const SESSIONS_DIR = join(homedir(), '.beehaven', 'sessions');
+/** Filesystem key for a scope — the same sanitising rule the cursor file uses. */
+export function scopeKey(scope) {
+    return String(scope || '').trim().replace(/[^A-Za-z0-9_-]/g, '');
+}
+function fileFor(scope) {
+    const key = scopeKey(scope);
+    return key ? join(SESSIONS_DIR, `${key}.json`) : null;
+}
+export function readSessionBinding(scope) {
+    try {
+        const file = fileFor(scope);
+        if (!file || !existsSync(file))
+            return null;
+        const b = JSON.parse(readFileSync(file, 'utf8'));
+        if (!b || typeof b.agent !== 'string' || !b.agent || typeof b.workspace !== 'string')
+            return null;
+        return { ...b, scope };
+    }
+    catch {
+        return null;
+    }
+}
+export function writeSessionBinding(binding) {
+    const file = fileFor(binding.scope);
+    if (!file)
+        throw new Error('This process has no scope to bind a session to — set BEEHAVEN_AGENT=<name>.');
+    mkdirSync(SESSIONS_DIR, { recursive: true, mode: 0o700 });
+    const tmp = `${file}.tmp-${process.pid}`;
+    writeFileSync(tmp, JSON.stringify(binding, null, 2), { mode: 0o600 });
+    renameSync(tmp, file);
+}
+export function updateSessionBinding(scope, patch) {
+    const cur = readSessionBinding(scope);
+    if (!cur)
+        return null;
+    const next = { ...cur, ...patch, scope };
+    writeSessionBinding(next);
+    return next;
+}
+export function clearSessionBinding(scope) {
+    try {
+        const file = fileFor(scope);
+        if (file && existsSync(file))
+            unlinkSync(file);
+    }
+    catch { /* already gone */ }
+}
+/** Every session bound on this machine — `agent list` shows them, `logout --all` ends them. */
+export function listSessionBindings() {
+    try {
+        if (!existsSync(SESSIONS_DIR))
+            return [];
+        return readdirSync(SESSIONS_DIR)
+            .filter((f) => f.endsWith('.json'))
+            .map((f) => readSessionBinding(f.slice(0, -5)))
+            .filter((b) => !!b);
+    }
+    catch {
+        return [];
+    }
+}
+/** The env this machine's daemon dials right now (`beehaven env`). */
+export function currentEnvName() {
+    try {
+        const p = join(homedir(), '.beehaven', 'config.json');
+        const cfg = existsSync(p) ? JSON.parse(readFileSync(p, 'utf8')) : {};
+        return resolveRelaySelection(cfg).envName;
+    }
+    catch {
+        return 'prod';
+    }
+}
+/**
+ * Why this session must not run here, or null. A session opened on staging is refused after
+ * someone switched the daemon to prod — the same workspace address names different data there.
+ */
+export function envMismatch(binding, now = currentEnvName()) {
+    if (!binding?.env || binding.env === now)
+        return null;
+    return `This session (${binding.agent}) was opened on ${binding.env}, but the daemon is now on ${now}.\n`
+        + `  Switch back:  beehaven env ${binding.env}\n`
+        + `  Or start a ${now} session here:  beehaven agent login ${binding.agent}`;
+}
+/** `workspace` / `team/<id>` / a bare 64-hex id → the address a cursor stores. */
+export function normalizeWorkspaceAddress(input) {
+    const v = String(input || '').trim();
+    if (!v)
+        return null;
+    if (['home', 'me', 'workspace'].includes(v))
+        return 'workspace';
+    if (/^[0-9a-f]{64}$/i.test(v))
+        return `workspace/${v.toLowerCase()}`;
+    if (/^[A-Za-z][A-Za-z0-9]*\/[A-Za-z0-9._:-]{1,200}$/.test(v))
+        return v;
+    return null;
+}
+/** Human label for an address — `home`, `team bld_…`, `shopifyStore clearly-demo`. */
+export function describeAddress(address) {
+    if (!address || ['workspace', 'home', 'me'].includes(address))
+        return 'home (your default workspace)';
+    const i = address.indexOf('/');
+    if (i < 0)
+        return address;
+    const id = address.slice(i + 1);
+    return `${address.slice(0, i)} ${id.length > 20 ? `${id.slice(0, 12)}…` : id}`;
+}

package/dist/session-target.js

@@ -0,0 +1,91 @@
+/**
+ * session-target — THE ONE ANSWER TO "WHERE DOES THIS CALL LAND?" (CLR-1161, AWO-393, AWO-394).
+ *
+ * `call`, `actions`, `batch`, `explain`, `code-run` and `watch git` resolved the cursor here (it
+ * lived inline in cli.ts); the typed verbs — `ticket`, `sheet`, `slides`, `design`, `mention`,
+ * `trash` — went through `agentRpc`, which never asked. So an agent connected to a team workspace
+ * ran `beehaven call ticket-create` in the team and `beehaven ticket create` in its home, in one
+ * terminal, with no warning (AWO-393). Every verb now resolves through this function.
+ *
+ * ⚠⚠ AN AGENT SESSION NEVER READS OR MOVES THE DAEMON'S FOCUS. The daemon's `connectedBuilding` is
+ * one variable for the whole machine: any terminal's `connect` sets it and any `connect home`
+ * clears it. A human with no cursor file still inherits it (that is the long-standing behaviour a
+ * person can see and correct); an agent with no cursor is at HOME, full stop — that is what makes
+ * agent A connecting to a Shopify store invisible to agent B in the same workspace.
+ *
+ * ⚠ THE SESSION'S ENV IS CHECKED HERE TOO, so every verb that routes also refuses a session opened
+ * on another environment (see `envMismatch`).
+ */
+import { getTarget, isHomeAddress } from './cli-state.js';
+import { activeAgentName, activeSessionBinding } from './agent-state.js';
+import { isAgentRuntime } from './agent-scope.js';
+import { envMismatch } from './session-binding.js';
+/** Is this invocation an agent's (a signed-in identity, or a harness that must sign in)? */
+export function isAgentInvocation(values = {}) {
+    try {
+        return !!activeAgentName(values) || isAgentRuntime();
+    }
+    catch {
+        return isAgentRuntime();
+    }
+}
+/** Why this session must not run (another env), or null. */
+export function sessionRefusal(values = {}) {
+    try {
+        return envMismatch(activeSessionBinding(activeAgentName(values)));
+    }
+    catch {
+        return null;
+    }
+}
+export async function resolveTargetBuilding(values) {
+    const refusal = sessionRefusal(values);
+    if (refusal) {
+        console.error(`  ${refusal}`);
+        process.exit(1);
+    }
+    if (values.building)
+        return; // an explicit flag always wins
+    const t = getTarget();
+    if (t?.address?.includes('/')) {
+        const [bType, ...bIdParts] = t.address.split('/');
+        values.building = `${bType}:${bIdParts.join('/')}`;
+        return;
+    }
+    // ⚠ An agent: no file, or a home file, both mean HOME — never the machine-global focus, and an
+    // agent's call never clears the focus a person in another terminal set.
+    if (isAgentInvocation(values))
+        return;
+    if (t && isHomeAddress(t.address)) {
+        /**
+         * ⚠ HOME IS A POSITIVE STATEMENT, NOT AN ABSENCE. The daemon's focus is a routing
+         * optimisation; the file is where the user said to be. If they disagree the daemon is
+         * stale — drop it, so the call lands where `pwd` says it will, and SAY so.
+         */
+        try {
+            const { daemonGetConnection, daemonDisconnect } = await import('./daemon-client.js');
+            const conn = await daemonGetConnection();
+            if (conn?.buildingId) {
+                await daemonDisconnect();
+                console.error(`\x1b[2m  (dropped a stale daemon focus on ${conn.buildingType}/${conn.buildingId}`
+                    + ` — your target is home)\x1b[0m`);
+            }
+        }
+        catch { /* no daemon, or it refused — home is the default route anyway */ }
+        return;
+    }
+    if (!t) {
+        /**
+         * ⚠ A PERSON WITH NO TARGET EVER SET inherits the daemon's connection — kept for back-compat
+         * with terminals that `connect` through the daemon and never wrote a file. Agents are handled
+         * above and never reach this.
+         */
+        try {
+            const { daemonGetConnection } = await import('./daemon-client.js');
+            const conn = await daemonGetConnection();
+            if (conn)
+                values.building = `${conn.buildingType}:${conn.buildingId}`;
+        }
+        catch { /* fall through to home */ }
+    }
+}

package/dist/setup-service.js

@@ -391,8 +391,12 @@ export async function cleanupAll() {
     }
     // 3. Socket + event log
     const { existsSync, unlinkSync, readdirSync, rmSync, readFileSync, writeFileSync } = await import('node:fs');
-    const { join } = await import('node:path');
-    for (const p of ['/tmp/beehaven.sock', '/tmp/beehaven-ipc.sock', '/tmp/beehaven-events.jsonl']) {
+    const { join, dirname } = await import('node:path');
+    const { watcherSocketPath, ipcSocketPath, eventsFilePath, isNamedPipe } = await import('./ipc-path.js');
+    const eventsFile = eventsFilePath();
+    for (const p of [watcherSocketPath(), ipcSocketPath(), eventsFile]) {
+        if (isNamedPipe(p))
+            continue; // a Windows pipe disappears with the daemon that held it
         try {
             if (existsSync(p)) {
                 unlinkSync(p);
@@ -402,10 +406,11 @@ export async function cleanupAll() {
         catch { }
     }
     try {
-        for (const f of readdirSync('/tmp')) {
+        const eventsDir = dirname(eventsFile);
+        for (const f of readdirSync(eventsDir)) {
             if (f.startsWith('beehaven-events.jsonl.') && f.endsWith('.old')) {
                 try {
-                    unlinkSync(join('/tmp', f));
+                    unlinkSync(join(eventsDir, f));
                 }
                 catch { }
             }

package/dist/verb-surface.js

@@ -60,6 +60,7 @@ export const VERB_SURFACE = {
     logout: { cls: 'STRUCTURAL', why: 'clears local credentials' },
     signup: { cls: 'STRUCTURAL', why: 'opens a browser' },
     handoff: { cls: 'STRUCTURAL', why: 'posts a local file to the anonymous door; no account, no workspace' },
+    'agents-md': { cls: 'STRUCTURAL', why: "writes the Clearly block into this repo's AGENTS.md; no workspace" },
     whoami: { cls: 'STRUCTURAL', why: 'reads local credentials' },
     start: { cls: 'STRUCTURAL', why: 'spawns the daemon `call` needs' },
     stop: { cls: 'STRUCTURAL', why: 'daemon lifecycle' },

package/dist/watcher.js

@@ -1,18 +1,19 @@
 // ============================================================================
 // Beehaven Office - Claude Code Event Watcher
-// Primary: Unix domain socket HTTP server at /tmp/beehaven.sock
+// Primary: HTTP server on a local socket — /tmp/beehaven.sock, or a named pipe on Windows (ipc-path.ts)
 // Fallback: Watches the JSONL events file written by the hook script
 // ============================================================================
 // chokidar is imported lazily so a missing bundle (e.g. when the daemon ships
 // inside an Electron app whose node_modules layout doesn't include chokidar)
 // degrades the file-watcher to a no-op rather than crashing the whole daemon.
 // The primary Unix-socket path does not depend on chokidar.
-import { createReadStream, existsSync, writeFileSync, statSync, renameSync, unlinkSync, chmodSync, watch as fsWatch, } from 'fs';
+import { createReadStream, existsSync, writeFileSync, statSync, renameSync, chmodSync, watch as fsWatch, } from 'fs';
 import { createInterface } from 'readline';
 import { createServer } from 'http';
 import { EventEmitter } from 'events';
-const EVENTS_FILE = '/tmp/beehaven-events.jsonl';
-const SOCKET_PATH = '/tmp/beehaven.sock';
+import { watcherSocketPath, eventsFilePath, clearStaleSocket, restrictSocketToOwner } from './ipc-path.js';
+const EVENTS_FILE = eventsFilePath();
+const SOCKET_PATH = watcherSocketPath();
 const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10 MB
 export { SOCKET_PATH };
 export class ClaudeWatcher extends EventEmitter {
@@ -32,14 +33,8 @@ export class ClaudeWatcher extends EventEmitter {
     // ── Unix Domain Socket ───────────────────────────────────────────────
     /** Start HTTP server on Unix domain socket for direct event delivery */
     startSocket() {
-        // Remove stale socket file
-        try {
-            if (existsSync(SOCKET_PATH))
-                unlinkSync(SOCKET_PATH);
-        }
-        catch {
-            /* may not exist */
-        }
+        // Remove a stale socket file (a Windows named pipe leaves none)
+        clearStaleSocket(SOCKET_PATH);
         this.socketServer = createServer((req, res) => {
             if (req.method !== 'POST' || req.url !== '/event') {
                 res.writeHead(404);
@@ -71,10 +66,7 @@ export class ClaudeWatcher extends EventEmitter {
         // during startup). A post-bind chmod achieves the same security
         // without the race.
         this.socketServer.listen(SOCKET_PATH, () => {
-            try {
-                chmodSync(SOCKET_PATH, 0o600);
-            }
-            catch { }
+            restrictSocketToOwner(SOCKET_PATH); // no-op for a named pipe
             console.log(`[watcher] Socket listening on ${SOCKET_PATH}`);
         });
     }
@@ -84,13 +76,7 @@ export class ClaudeWatcher extends EventEmitter {
             this.socketServer.close();
             this.socketServer = null;
         }
-        try {
-            if (existsSync(SOCKET_PATH))
-                unlinkSync(SOCKET_PATH);
-        }
-        catch {
-            /* may already be gone */
-        }
+        clearStaleSocket(SOCKET_PATH);
     }
     // ── File Watcher (fallback) ──────────────────────────────────────────
     /** Start file watcher as fallback for when socket isn't available */