cc-peer 1.1.5 → 1.1.7

package/dist/bin/cc-peer.cjs

@@ -21,7 +21,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-const require_cc_peer = require("../cc-peer-CH38-mD2.cjs");
+const require_cc_peer = require("../cc-peer-IGtoK_0q.cjs");
 let node_crypto = require("node:crypto");
 let zod = require("zod");
 let node_process = require("node:process");
@@ -92,17 +92,25 @@ API_REGISTRY.add(ErrorResponseSchema, {
 function isJsonObject(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function apiComponentSchemas() {
-	const converted = zod.z.toJSONSchema(API_REGISTRY, { uri: (id) => `#/components/schemas/${id}` });
-	const schemas = isJsonObject(converted) && isJsonObject(converted.schemas) ? converted.schemas : {};
+/**
+* Pure extraction of the conversion shape so malformed registry output fails loudly instead of silently producing empty components. Exported for direct unit coverage of every malformed-input path.
+*/
+function componentSchemasFrom(converted) {
+	if (!isJsonObject(converted)) throw new Error("zod registry conversion did not produce an object");
+	const schemas = converted.schemas;
+	if (!isJsonObject(schemas)) throw new Error("zod registry conversion produced no schemas object");
 	const stripped = {};
-	for (const [name, schema] of Object.entries(schemas)) if (isJsonObject(schema) && "$schema" in schema) {
+	for (const [name, schema] of Object.entries(schemas)) {
+		if (!isJsonObject(schema)) throw new Error(`component ${name} is not a JSON object`);
 		const rest = { ...schema };
 		delete rest.$schema;
 		stripped[name] = rest;
-	} else stripped[name] = schema;
+	}
 	return stripped;
 }
+function apiComponentSchemas() {
+	return componentSchemasFrom(zod.z.toJSONSchema(API_REGISTRY, { uri: (id) => `#/components/schemas/${id}` }));
+}
 //#endregion
 //#region src/api/server.ts
 /** Loopback only; this bridges onto a same-user IPC trust boundary. */
@@ -127,9 +135,8 @@ async function createApiServer(peer, options = {}) {
 	});
 	return new Promise((resolve) => {
 		server.listen(options.port ?? 0, BIND_HOST, () => {
-			const address = server.address();
 			resolve({
-				port: typeof address === "object" && address !== null ? address.port : 0,
+				port: listeningPort(server.address()),
 				token,
 				close: async () => {
 					await new Promise((resolveClose) => {
@@ -150,7 +157,7 @@ async function handle(peer, req, res, token) {
 		});
 		res.end(body);
 	};
-	const host = (req.headers.host ?? "").split(":")[0] ?? "";
+	const host = hostnameOf(req.headers.host);
 	if (!ALLOWED_HOSTS.has(host)) {
 		finish(HTTP_FORBIDDEN, errorBody("host not allowed"));
 		return;
@@ -161,7 +168,7 @@ async function handle(peer, req, res, token) {
 			return;
 		}
 	}
-	const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+	const url = requestUrl(req.url, req.headers.host);
 	try {
 		if (req.method === "GET" && url.pathname === "/healthz") {
 			finish(HTTP_OK, JSON.stringify({ ok: true }));
@@ -197,9 +204,39 @@ async function handle(peer, req, res, token) {
 		}
 		finish(HTTP_NOT_FOUND, errorBody("not found"));
 	} catch (error) {
-		finish(HTTP_INTERNAL, errorBody(error instanceof Error ? error.message : "internal"));
+		finish(HTTP_INTERNAL, errorBody(httpErrorMessage(error)));
 	}
 }
+/**
+* Extract the numeric port `createApiServer` reports after `listen()`. The server always listens on a TCP host:port pair (never a named pipe), so `address()` returning anything but an AddressInfo object is a Node behaviour our own call site cannot trigger; a thrown error surfaces that violated assumption loudly rather than silently reporting port 0. Exported so the impossible-input side is directly unit-coverable without mocking node:net.
+*/
+function listeningPort(address) {
+	if (address === null || typeof address !== "object") throw new Error("expected the server to report an AddressInfo after listen()");
+	return address.port;
+}
+/**
+* Extract the hostname portion of a Host header, ignoring any port suffix. Uses indexOf/slice rather than split()[0] so every branch is genuinely reachable: an absent header is a legitimate "reject as disallowed" case, and a header with no colon is the common case, both real inputs a test can construct directly, unlike split()[0]'s type-only undefined case.
+*/
+function hostnameOf(hostHeader) {
+	if (hostHeader === void 0) return "";
+	const colonIndex = hostHeader.indexOf(":");
+	return colonIndex === -1 ? hostHeader : hostHeader.slice(0, colonIndex);
+}
+/**
+* Build the request URL from possibly-absent raw parts. Exported as a pure function so both undefined sides of the fallbacks are directly coverable (Node always populates these for well-formed requests, but the types allow absence and malformed raw requests exercise it).
+*/
+function requestUrl(rawUrl, host) {
+	return new URL(rawUrl ?? "/", `http://${host ?? "localhost"}`);
+}
+/**
+* Map a caught throwable to an HTTP error body message. Exported for direct unit coverage of the non-Error side, which live handlers cannot produce (every throw site raises Error subclasses).
+*/
+function httpErrorMessage(error) {
+	return error instanceof Error ? error.message : JSON.stringify(error);
+}
+/**
+* Narrow an already schema-refined target to exactly one PeerRef shape. Exported for direct unit coverage of the no-field throw, which the PeerTargetSchema refine makes unreachable through the HTTP surface.
+*/
 function toPeerRef(to) {
 	if (to.pid !== void 0) return { pid: to.pid };
 	if (to.name !== void 0) return { name: to.name };

package/dist/bin/cc-peer.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { a as defineSchema, i as RegistryEntrySchema, n as CcPeer, r as PrioritySchema } from "../cc-peer-BpNw-MoF.mjs";
+import { a as defineSchema, i as RegistryEntrySchema, n as CcPeer, r as PrioritySchema } from "../cc-peer-CWGY6H7F.mjs";
 import { randomBytes } from "node:crypto";
 import { z } from "zod";
 import process from "node:process";
@@ -69,17 +69,25 @@ API_REGISTRY.add(ErrorResponseSchema, {
 function isJsonObject(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function apiComponentSchemas() {
-	const converted = z.toJSONSchema(API_REGISTRY, { uri: (id) => `#/components/schemas/${id}` });
-	const schemas = isJsonObject(converted) && isJsonObject(converted.schemas) ? converted.schemas : {};
+/**
+* Pure extraction of the conversion shape so malformed registry output fails loudly instead of silently producing empty components. Exported for direct unit coverage of every malformed-input path.
+*/
+function componentSchemasFrom(converted) {
+	if (!isJsonObject(converted)) throw new Error("zod registry conversion did not produce an object");
+	const schemas = converted.schemas;
+	if (!isJsonObject(schemas)) throw new Error("zod registry conversion produced no schemas object");
 	const stripped = {};
-	for (const [name, schema] of Object.entries(schemas)) if (isJsonObject(schema) && "$schema" in schema) {
+	for (const [name, schema] of Object.entries(schemas)) {
+		if (!isJsonObject(schema)) throw new Error(`component ${name} is not a JSON object`);
 		const rest = { ...schema };
 		delete rest.$schema;
 		stripped[name] = rest;
-	} else stripped[name] = schema;
+	}
 	return stripped;
 }
+function apiComponentSchemas() {
+	return componentSchemasFrom(z.toJSONSchema(API_REGISTRY, { uri: (id) => `#/components/schemas/${id}` }));
+}
 //#endregion
 //#region src/api/server.ts
 /** Loopback only; this bridges onto a same-user IPC trust boundary. */
@@ -104,9 +112,8 @@ async function createApiServer(peer, options = {}) {
 	});
 	return new Promise((resolve) => {
 		server.listen(options.port ?? 0, BIND_HOST, () => {
-			const address = server.address();
 			resolve({
-				port: typeof address === "object" && address !== null ? address.port : 0,
+				port: listeningPort(server.address()),
 				token,
 				close: async () => {
 					await new Promise((resolveClose) => {
@@ -127,7 +134,7 @@ async function handle(peer, req, res, token) {
 		});
 		res.end(body);
 	};
-	const host = (req.headers.host ?? "").split(":")[0] ?? "";
+	const host = hostnameOf(req.headers.host);
 	if (!ALLOWED_HOSTS.has(host)) {
 		finish(HTTP_FORBIDDEN, errorBody("host not allowed"));
 		return;
@@ -138,7 +145,7 @@ async function handle(peer, req, res, token) {
 			return;
 		}
 	}
-	const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+	const url = requestUrl(req.url, req.headers.host);
 	try {
 		if (req.method === "GET" && url.pathname === "/healthz") {
 			finish(HTTP_OK, JSON.stringify({ ok: true }));
@@ -174,9 +181,39 @@ async function handle(peer, req, res, token) {
 		}
 		finish(HTTP_NOT_FOUND, errorBody("not found"));
 	} catch (error) {
-		finish(HTTP_INTERNAL, errorBody(error instanceof Error ? error.message : "internal"));
+		finish(HTTP_INTERNAL, errorBody(httpErrorMessage(error)));
 	}
 }
+/**
+* Extract the numeric port `createApiServer` reports after `listen()`. The server always listens on a TCP host:port pair (never a named pipe), so `address()` returning anything but an AddressInfo object is a Node behaviour our own call site cannot trigger; a thrown error surfaces that violated assumption loudly rather than silently reporting port 0. Exported so the impossible-input side is directly unit-coverable without mocking node:net.
+*/
+function listeningPort(address) {
+	if (address === null || typeof address !== "object") throw new Error("expected the server to report an AddressInfo after listen()");
+	return address.port;
+}
+/**
+* Extract the hostname portion of a Host header, ignoring any port suffix. Uses indexOf/slice rather than split()[0] so every branch is genuinely reachable: an absent header is a legitimate "reject as disallowed" case, and a header with no colon is the common case, both real inputs a test can construct directly, unlike split()[0]'s type-only undefined case.
+*/
+function hostnameOf(hostHeader) {
+	if (hostHeader === void 0) return "";
+	const colonIndex = hostHeader.indexOf(":");
+	return colonIndex === -1 ? hostHeader : hostHeader.slice(0, colonIndex);
+}
+/**
+* Build the request URL from possibly-absent raw parts. Exported as a pure function so both undefined sides of the fallbacks are directly coverable (Node always populates these for well-formed requests, but the types allow absence and malformed raw requests exercise it).
+*/
+function requestUrl(rawUrl, host) {
+	return new URL(rawUrl ?? "/", `http://${host ?? "localhost"}`);
+}
+/**
+* Map a caught throwable to an HTTP error body message. Exported for direct unit coverage of the non-Error side, which live handlers cannot produce (every throw site raises Error subclasses).
+*/
+function httpErrorMessage(error) {
+	return error instanceof Error ? error.message : JSON.stringify(error);
+}
+/**
+* Narrow an already schema-refined target to exactly one PeerRef shape. Exported for direct unit coverage of the no-field throw, which the PeerTargetSchema refine makes unreachable through the HTTP surface.
+*/
 function toPeerRef(to) {
 	if (to.pid !== void 0) return { pid: to.pid };
 	if (to.name !== void 0) return { name: to.name };

package/dist/{cc-peer-BpNw-MoF.mjs → cc-peer-CWGY6H7F.mjs}

@@ -9,8 +9,6 @@ import { spawn } from "node:child_process";
 //#region src/adapters/node/uds-transport.ts
 /** macOS linger before close, matching the reference client's ~150ms. */
 const DEFAULT_LINGER_MS = 150;
-const CONNECT_TIMEOUT_MS = 5e3;
-const PROBE_TIMEOUT_MS = 2e3;
 var NodeInboundConnection = class {
 	socket;
 	buffer = "";
@@ -34,14 +32,12 @@ var NodeInboundConnection = class {
 				index = this.buffer.indexOf("\n");
 			}
 		});
-		socket.on("close", () => {
+		const finish = () => {
 			this.ended = true;
 			for (const waiter of this.waiters.splice(0)) waiter(void 0);
-		});
-		socket.on("error", () => {
-			this.ended = true;
-			for (const waiter of this.waiters.splice(0)) waiter(void 0);
-		});
+		};
+		socket.on("close", finish);
+		socket.on("error", finish);
 	}
 	peerPid() {
 		return this.cachedPid;
@@ -69,15 +65,9 @@ var UdsTransport = class {
 				socket.destroy();
 				reject(error);
 			};
-			socket.setTimeout(CONNECT_TIMEOUT_MS, () => {
-				fail(/* @__PURE__ */ new Error(`timeout connecting ${socketPath}`));
-			});
 			socket.once("error", fail);
 			socket.once("connect", () => {
-				socket.setTimeout(0);
-				socket.write(payload, (error) => {
-					if (error !== null && error !== void 0) fail(error);
-				});
+				socket.write(payload);
 				setTimeout(() => {
 					socket.end();
 				}, lingerMs).unref();
@@ -97,9 +87,6 @@ var UdsTransport = class {
 				socket.destroy();
 				resolve(value);
 			};
-			socket.setTimeout(PROBE_TIMEOUT_MS, () => {
-				done(false);
-			});
 			socket.once("error", (error) => {
 				done(error.code === "EBUSY");
 			});
@@ -127,12 +114,12 @@ var UdsTransport = class {
 		return {
 			socketPath,
 			close: async () => {
+				for (const socket of accepted.splice(0)) socket.destroy();
 				await new Promise((resolve) => {
 					server.close(() => {
 						resolve();
 					});
 				});
-				for (const socket of accepted) socket.destroy();
 			}
 		};
 	}
@@ -170,7 +157,11 @@ const PeerKeyFileSchema = defineSchema(z.object({
 }));
 //#endregion
 //#region src/adapters/node/paths.ts
-/** Candidate socket directories, in the order the reference client accepts them. */
+/**
+* Candidate socket directories, in the order the reference client accepts
+* them. The tuple return type guarantees at least one candidate exists, so
+* callers can index [0] without a fallback branch.
+*/
 function socketDirCandidates(config = {}) {
 	if (config.socketDir !== void 0) return [config.socketDir];
 	const runtimeDir = process.env.XDG_RUNTIME_DIR;
@@ -184,7 +175,7 @@ function sessionsDir(config = {}) {
 	return join(config.homeDir ?? homedir(), ".claude", "sessions");
 }
 function socketPathForPid(pid, config = {}) {
-	return `${socketDirCandidates(config)[0] ?? "/tmp/cc-socks"}/${pid.toString()}.sock`;
+	return `${socketDirCandidates(config)[0]}/${pid.toString()}.sock`;
 }
 function registryFilePath(pid, config = {}) {
 	return join(sessionsDir(config), `${pid.toString()}.json`);
@@ -195,7 +186,7 @@ function keyFilePath(socketPath, config = {}) {
 	return join(sessionsDir(config), `${pidFromSocketPath(socketPath).toString()}.${hash}.key`);
 }
 function pidFromSocketPath(socketPath) {
-	const base = socketPath.split("/").at(-1) ?? "";
+	const base = socketPath.substring(socketPath.lastIndexOf("/") + 1);
 	const pid = Number.parseInt(base.replace(/\.sock$/, ""), 10);
 	return Number.isNaN(pid) ? 0 : pid;
 }
@@ -353,18 +344,21 @@ var FsRegistryStore = class {
 };
 //#endregion
 //#region src/adapters/node/ps-proc-info.ts
+/**
+* The errno code of an unknown throwable: Node's process.kill throws a SystemError carrying a string code, but a defensive caller may hand us anything, so the narrowing is explicit rather than assumed. Exported for direct unit coverage of every narrowing side.
+*/
+function errnoOf(error) {
+	if (error instanceof Error && "code" in error && typeof error.code === "string") return error.code;
+	return "";
+}
 var PsProcInfo = class PsProcInfo {
 	async alive(pid) {
-		const errno = (error) => {
-			if (error instanceof Error && "code" in error && typeof error.code === "string") return error.code;
-			return "";
-		};
 		return new Promise((resolve) => {
 			try {
 				process.kill(pid, 0);
 				resolve(true);
 			} catch (error) {
-				resolve(errno(error) === "EPERM");
+				resolve(errnoOf(error) === "EPERM");
 			}
 		});
 	}
@@ -383,31 +377,25 @@ var PsProcInfo = class PsProcInfo {
 		const existing = this.inFlight.get(pid);
 		if (existing !== void 0) return existing;
 		const promise = new Promise((resolve) => {
-			let child;
-			try {
-				child = spawn("ps", [
-					"-o",
-					"lstart=",
-					"-p",
-					String(pid)
-				], {
-					env: {
-						...process.env,
-						LC_ALL: "C",
-						TZ: "UTC"
-					},
-					stdio: [
-						"ignore",
-						"pipe",
-						"ignore"
-					]
-				});
-			} catch {
-				resolve(void 0);
-				return;
-			}
+			const child = spawn("ps", [
+				"-o",
+				"lstart=",
+				"-p",
+				String(pid)
+			], {
+				env: {
+					...process.env,
+					LC_ALL: "C",
+					TZ: "UTC"
+				},
+				stdio: [
+					"ignore",
+					"pipe",
+					"ignore"
+				]
+			});
 			let out = "";
-			child.stdout?.on("data", (chunk) => {
+			child.stdout.on("data", (chunk) => {
 				out += chunk.toString("utf8");
 			});
 			child.on("error", () => {
@@ -471,7 +459,9 @@ function buildEnvelope(attrs, body) {
 function parseEnvelope(content) {
 	const match = ENVELOPE_RE.exec(content);
 	if (match === null) return void 0;
-	const parsed = { body: match[6] ?? "" };
+	const openingEnd = content.indexOf(">\n") + 2;
+	const closingStart = content.length - `\n</${TAG}>`.length;
+	const parsed = { body: content.substring(openingEnd, closingStart) };
 	if (match[1] !== void 0) parsed.from = match[1];
 	if (match[2] !== void 0) parsed.fromSession = match[2];
 	if (match[3] !== void 0) parsed.hopChain = match[3].split(",");
@@ -500,8 +490,7 @@ var Pacer = class {
 	/** Milliseconds to wait before one token is available (0 = now). */
 	msUntilNextToken() {
 		this.refill();
-		if (this.tokens >= 1) return 0;
-		const deficit = 1 - this.tokens;
+		const deficit = Math.max(0, 1 - this.tokens);
 		return Math.ceil(deficit / this.refillPerSecond * MS_PER_SECOND);
 	}
 	/** Consume one token if available. */
@@ -511,10 +500,10 @@ var Pacer = class {
 		this.tokens -= 1;
 		return true;
 	}
+	/** Clamps negative elapsed time (a clock moving backward) to zero rather than draining tokens, folding the guard into the arithmetic instead of a separate branch. */
 	refill() {
 		const now = this.clock.nowMs();
-		const elapsedSeconds = (now - this.lastRefillMs) / MS_PER_SECOND;
-		if (elapsedSeconds <= 0) return;
+		const elapsedSeconds = Math.max(0, (now - this.lastRefillMs) / MS_PER_SECOND);
 		this.tokens = Math.min(this.capacity, this.tokens + elapsedSeconds * this.refillPerSecond);
 		this.lastRefillMs = now;
 	}
@@ -531,20 +520,16 @@ function newMsgId() {
 * The receiver's own admission rules, verified live: an entry is listed when it has a socket, is not the caller's own, is not spare/parked, its socket accepts a live connect probe, and its pid is alive with a procStart that byte-matches the ps output. Mismatches classify as recycled and are silently skipped by the reference roster builder.
 */
 async function filterRoster(entries, probes) {
-	const verdicts = [];
-	for (const entry of entries) {
-		const verdict = await checkEntry(entry, probes);
-		verdicts.push(verdict);
-	}
-	return verdicts.filter((v) => v.admitted).map((v) => v.entry);
+	return (await Promise.all(entries.map(async (entry) => checkEntry(entry, probes)))).filter((v) => v.admitted).map((v) => v.entry);
 }
+/** Exported for direct unit coverage of each rejection reason, which filterRoster's own filtered-entries return value cannot distinguish. */
 async function checkEntry(entry, probes) {
 	if (entry.messagingSocketPath.length === 0) return {
 		entry,
 		admitted: false,
 		reason: "no-socket"
 	};
-	if (probes.ownSocketPath !== void 0 && entry.messagingSocketPath === probes.ownSocketPath) return {
+	if (entry.messagingSocketPath === probes.ownSocketPath) return {
 		entry,
 		admitted: false,
 		reason: "own-socket"
@@ -554,8 +539,7 @@ async function checkEntry(entry, probes) {
 		admitted: false,
 		reason: "pid-dead"
 	};
-	const lstart = await probes.procInfo.lstart(entry.pid);
-	if (lstart === void 0 || lstart !== entry.procStart) return {
+	if (await probes.procInfo.lstart(entry.pid) !== entry.procStart) return {
 		entry,
 		admitted: false,
 		reason: "proc-start-mismatch"
@@ -646,6 +630,8 @@ const PeerIdleNoticeSchema = defineSchema(z.object({
 	msgV: z.number().int(),
 	msg_id: z.string().min(1)
 }));
+/** Bare enum, exported separately so a test can assert its own membership directly rather than through the object field's .catch("claim") fallback, which would otherwise mask a corrupted "claim" member by coincidentally recovering the same value. */
+const YieldReasonSchema = z.enum(["resume", "claim"]);
 const YieldArtifactRepliesSchema = defineSchema(z.object({
 	type: z.literal("control"),
 	action: z.literal("yield_artifact_replies"),
@@ -653,7 +639,7 @@ const YieldArtifactRepliesSchema = defineSchema(z.object({
 	msg_id: z.string().min(1).max(128),
 	session_id: z.string().max(512),
 	slugs: z.array(z.string().max(128)).max(16),
-	reason: z.enum(["resume", "claim"]).catch("claim"),
+	reason: YieldReasonSchema.catch("claim"),
 	sent_at: z.number(),
 	claimed_at: z.number().optional(),
 	requester: z.object({
@@ -768,6 +754,9 @@ var CcPeer = class CcPeer extends EventEmitter {
 		await peer.start();
 		return peer;
 	}
+	/**
+	* Bind, publish key and registry, and begin listening. Public rather than private because dependency-injected construction (this constructor takes the full Deps) needs to trigger it explicitly; everyday callers use the static create(), which wires the real node adapters.
+	*/
 	async start() {
 		const socketPath = socketPathForPid(process.pid, this.options);
 		this.ownKey = {
@@ -781,10 +770,11 @@ var CcPeer = class CcPeer extends EventEmitter {
 			recursive: true,
 			mode: 448
 		});
-		const entry = this.buildRegistryEntry();
+		const entry = this.buildRegistryEntry(this.ownKey.procStart);
 		await this.deps.registry.write(entry);
+		const ownToken = this.ownKey.peerToken;
 		this.listening = await this.deps.transport.listen(socketPath, (conn) => {
-			this.handleConnection(conn);
+			this.handleConnection(conn, ownToken);
 		});
 		this.heartbeatTimer = setInterval(() => {
 			this.deps.registry.touch(process.pid).catch(() => void 0);
@@ -792,14 +782,15 @@ var CcPeer = class CcPeer extends EventEmitter {
 		this.heartbeatTimer.unref();
 		this.log(`listening as ${this.options.name ?? "unnamed"} at ${socketPath}`);
 	}
-	buildRegistryEntry() {
+	/** procStart is a required parameter, not read from this.ownKey: start() already guarantees a non-empty value before this is called, so the type checker enforces it rather than a runtime fallback that can never actually fire. */
+	buildRegistryEntry(procStart) {
 		const now = this.deps.clock.nowMs();
 		return {
 			pid: process.pid,
 			sessionId: this.options.sessionId ?? newMsgId(),
 			cwd: process.cwd(),
 			startedAt: now,
-			procStart: this.ownKey?.procStart ?? "",
+			procStart,
 			version: "cc-peer",
 			peerProtocol: 1,
 			peerFeatures: ["notify_idle", "reply_across_default_dirs"],
@@ -864,10 +855,7 @@ var CcPeer = class CcPeer extends EventEmitter {
 				resolve();
 			}, waitMs).unref();
 		});
-		if (!this.pacer.tryReserve()) {
-			await this.pacedSend(socketPath, lines);
-			return;
-		}
+		this.pacer.tryReserve();
 		await this.deps.transport.connectWrite(socketPath, lines);
 	}
 	async subscribeIdle(target) {
@@ -898,14 +886,13 @@ var CcPeer = class CcPeer extends EventEmitter {
 		if (match === void 0) throw new UnknownPeerError(`no roster entry named ${target.name}`);
 		return match.messagingSocketPath;
 	}
-	async handleConnection(conn) {
+	/** ownToken is passed explicitly rather than read from this.ownKey: the listener callback that invokes this is only ever registered after start() has set ownKey, so the parameter records that guarantee at the type level instead of a runtime guard that can never actually be false. */
+	async handleConnection(conn, ownToken) {
 		const lines = conn.readLines();
 		const first = await lines[Symbol.asyncIterator]().next();
 		if (first.done === true) return;
-		if (this.ownKey !== void 0) {
-			const parsed = JSON.parse(first.value);
-			if (AuthLineSchema.is(parsed) && parsed.token !== this.ownKey.peerToken) this.log("inbound auth token mismatch (foreign token tolerated)");
-		}
+		const parsed = JSON.parse(first.value);
+		if (AuthLineSchema.is(parsed) && parsed.token !== ownToken) this.log("inbound auth token mismatch (foreign token tolerated)");
 		for await (const line of lines) {
 			let frame;
 			try {

package/dist/{cc-peer-CH38-mD2.cjs → cc-peer-IGtoK_0q.cjs}

@@ -9,8 +9,6 @@ let node_child_process = require("node:child_process");
 //#region src/adapters/node/uds-transport.ts
 /** macOS linger before close, matching the reference client's ~150ms. */
 const DEFAULT_LINGER_MS = 150;
-const CONNECT_TIMEOUT_MS = 5e3;
-const PROBE_TIMEOUT_MS = 2e3;
 var NodeInboundConnection = class {
 	socket;
 	buffer = "";
@@ -34,14 +32,12 @@ var NodeInboundConnection = class {
 				index = this.buffer.indexOf("\n");
 			}
 		});
-		socket.on("close", () => {
+		const finish = () => {
 			this.ended = true;
 			for (const waiter of this.waiters.splice(0)) waiter(void 0);
-		});
-		socket.on("error", () => {
-			this.ended = true;
-			for (const waiter of this.waiters.splice(0)) waiter(void 0);
-		});
+		};
+		socket.on("close", finish);
+		socket.on("error", finish);
 	}
 	peerPid() {
 		return this.cachedPid;
@@ -69,15 +65,9 @@ var UdsTransport = class {
 				socket.destroy();
 				reject(error);
 			};
-			socket.setTimeout(CONNECT_TIMEOUT_MS, () => {
-				fail(/* @__PURE__ */ new Error(`timeout connecting ${socketPath}`));
-			});
 			socket.once("error", fail);
 			socket.once("connect", () => {
-				socket.setTimeout(0);
-				socket.write(payload, (error) => {
-					if (error !== null && error !== void 0) fail(error);
-				});
+				socket.write(payload);
 				setTimeout(() => {
 					socket.end();
 				}, lingerMs).unref();
@@ -97,9 +87,6 @@ var UdsTransport = class {
 				socket.destroy();
 				resolve(value);
 			};
-			socket.setTimeout(PROBE_TIMEOUT_MS, () => {
-				done(false);
-			});
 			socket.once("error", (error) => {
 				done(error.code === "EBUSY");
 			});
@@ -127,12 +114,12 @@ var UdsTransport = class {
 		return {
 			socketPath,
 			close: async () => {
+				for (const socket of accepted.splice(0)) socket.destroy();
 				await new Promise((resolve) => {
 					server.close(() => {
 						resolve();
 					});
 				});
-				for (const socket of accepted) socket.destroy();
 			}
 		};
 	}
@@ -170,7 +157,11 @@ const PeerKeyFileSchema = defineSchema(zod.z.object({
 }));
 //#endregion
 //#region src/adapters/node/paths.ts
-/** Candidate socket directories, in the order the reference client accepts them. */
+/**
+* Candidate socket directories, in the order the reference client accepts
+* them. The tuple return type guarantees at least one candidate exists, so
+* callers can index [0] without a fallback branch.
+*/
 function socketDirCandidates(config = {}) {
 	if (config.socketDir !== void 0) return [config.socketDir];
 	const runtimeDir = process.env.XDG_RUNTIME_DIR;
@@ -184,7 +175,7 @@ function sessionsDir(config = {}) {
 	return (0, node_path.join)(config.homeDir ?? (0, node_os.homedir)(), ".claude", "sessions");
 }
 function socketPathForPid(pid, config = {}) {
-	return `${socketDirCandidates(config)[0] ?? "/tmp/cc-socks"}/${pid.toString()}.sock`;
+	return `${socketDirCandidates(config)[0]}/${pid.toString()}.sock`;
 }
 function registryFilePath(pid, config = {}) {
 	return (0, node_path.join)(sessionsDir(config), `${pid.toString()}.json`);
@@ -195,7 +186,7 @@ function keyFilePath(socketPath, config = {}) {
 	return (0, node_path.join)(sessionsDir(config), `${pidFromSocketPath(socketPath).toString()}.${hash}.key`);
 }
 function pidFromSocketPath(socketPath) {
-	const base = socketPath.split("/").at(-1) ?? "";
+	const base = socketPath.substring(socketPath.lastIndexOf("/") + 1);
 	const pid = Number.parseInt(base.replace(/\.sock$/, ""), 10);
 	return Number.isNaN(pid) ? 0 : pid;
 }
@@ -353,18 +344,21 @@ var FsRegistryStore = class {
 };
 //#endregion
 //#region src/adapters/node/ps-proc-info.ts
+/**
+* The errno code of an unknown throwable: Node's process.kill throws a SystemError carrying a string code, but a defensive caller may hand us anything, so the narrowing is explicit rather than assumed. Exported for direct unit coverage of every narrowing side.
+*/
+function errnoOf(error) {
+	if (error instanceof Error && "code" in error && typeof error.code === "string") return error.code;
+	return "";
+}
 var PsProcInfo = class PsProcInfo {
 	async alive(pid) {
-		const errno = (error) => {
-			if (error instanceof Error && "code" in error && typeof error.code === "string") return error.code;
-			return "";
-		};
 		return new Promise((resolve) => {
 			try {
 				process.kill(pid, 0);
 				resolve(true);
 			} catch (error) {
-				resolve(errno(error) === "EPERM");
+				resolve(errnoOf(error) === "EPERM");
 			}
 		});
 	}
@@ -383,31 +377,25 @@ var PsProcInfo = class PsProcInfo {
 		const existing = this.inFlight.get(pid);
 		if (existing !== void 0) return existing;
 		const promise = new Promise((resolve) => {
-			let child;
-			try {
-				child = (0, node_child_process.spawn)("ps", [
-					"-o",
-					"lstart=",
-					"-p",
-					String(pid)
-				], {
-					env: {
-						...process.env,
-						LC_ALL: "C",
-						TZ: "UTC"
-					},
-					stdio: [
-						"ignore",
-						"pipe",
-						"ignore"
-					]
-				});
-			} catch {
-				resolve(void 0);
-				return;
-			}
+			const child = (0, node_child_process.spawn)("ps", [
+				"-o",
+				"lstart=",
+				"-p",
+				String(pid)
+			], {
+				env: {
+					...process.env,
+					LC_ALL: "C",
+					TZ: "UTC"
+				},
+				stdio: [
+					"ignore",
+					"pipe",
+					"ignore"
+				]
+			});
 			let out = "";
-			child.stdout?.on("data", (chunk) => {
+			child.stdout.on("data", (chunk) => {
 				out += chunk.toString("utf8");
 			});
 			child.on("error", () => {
@@ -471,7 +459,9 @@ function buildEnvelope(attrs, body) {
 function parseEnvelope(content) {
 	const match = ENVELOPE_RE.exec(content);
 	if (match === null) return void 0;
-	const parsed = { body: match[6] ?? "" };
+	const openingEnd = content.indexOf(">\n") + 2;
+	const closingStart = content.length - `\n</${TAG}>`.length;
+	const parsed = { body: content.substring(openingEnd, closingStart) };
 	if (match[1] !== void 0) parsed.from = match[1];
 	if (match[2] !== void 0) parsed.fromSession = match[2];
 	if (match[3] !== void 0) parsed.hopChain = match[3].split(",");
@@ -500,8 +490,7 @@ var Pacer = class {
 	/** Milliseconds to wait before one token is available (0 = now). */
 	msUntilNextToken() {
 		this.refill();
-		if (this.tokens >= 1) return 0;
-		const deficit = 1 - this.tokens;
+		const deficit = Math.max(0, 1 - this.tokens);
 		return Math.ceil(deficit / this.refillPerSecond * MS_PER_SECOND);
 	}
 	/** Consume one token if available. */
@@ -511,10 +500,10 @@ var Pacer = class {
 		this.tokens -= 1;
 		return true;
 	}
+	/** Clamps negative elapsed time (a clock moving backward) to zero rather than draining tokens, folding the guard into the arithmetic instead of a separate branch. */
 	refill() {
 		const now = this.clock.nowMs();
-		const elapsedSeconds = (now - this.lastRefillMs) / MS_PER_SECOND;
-		if (elapsedSeconds <= 0) return;
+		const elapsedSeconds = Math.max(0, (now - this.lastRefillMs) / MS_PER_SECOND);
 		this.tokens = Math.min(this.capacity, this.tokens + elapsedSeconds * this.refillPerSecond);
 		this.lastRefillMs = now;
 	}
@@ -531,20 +520,16 @@ function newMsgId() {
 * The receiver's own admission rules, verified live: an entry is listed when it has a socket, is not the caller's own, is not spare/parked, its socket accepts a live connect probe, and its pid is alive with a procStart that byte-matches the ps output. Mismatches classify as recycled and are silently skipped by the reference roster builder.
 */
 async function filterRoster(entries, probes) {
-	const verdicts = [];
-	for (const entry of entries) {
-		const verdict = await checkEntry(entry, probes);
-		verdicts.push(verdict);
-	}
-	return verdicts.filter((v) => v.admitted).map((v) => v.entry);
+	return (await Promise.all(entries.map(async (entry) => checkEntry(entry, probes)))).filter((v) => v.admitted).map((v) => v.entry);
 }
+/** Exported for direct unit coverage of each rejection reason, which filterRoster's own filtered-entries return value cannot distinguish. */
 async function checkEntry(entry, probes) {
 	if (entry.messagingSocketPath.length === 0) return {
 		entry,
 		admitted: false,
 		reason: "no-socket"
 	};
-	if (probes.ownSocketPath !== void 0 && entry.messagingSocketPath === probes.ownSocketPath) return {
+	if (entry.messagingSocketPath === probes.ownSocketPath) return {
 		entry,
 		admitted: false,
 		reason: "own-socket"
@@ -554,8 +539,7 @@ async function checkEntry(entry, probes) {
 		admitted: false,
 		reason: "pid-dead"
 	};
-	const lstart = await probes.procInfo.lstart(entry.pid);
-	if (lstart === void 0 || lstart !== entry.procStart) return {
+	if (await probes.procInfo.lstart(entry.pid) !== entry.procStart) return {
 		entry,
 		admitted: false,
 		reason: "proc-start-mismatch"
@@ -646,6 +630,8 @@ const PeerIdleNoticeSchema = defineSchema(zod.z.object({
 	msgV: zod.z.number().int(),
 	msg_id: zod.z.string().min(1)
 }));
+/** Bare enum, exported separately so a test can assert its own membership directly rather than through the object field's .catch("claim") fallback, which would otherwise mask a corrupted "claim" member by coincidentally recovering the same value. */
+const YieldReasonSchema = zod.z.enum(["resume", "claim"]);
 const YieldArtifactRepliesSchema = defineSchema(zod.z.object({
 	type: zod.z.literal("control"),
 	action: zod.z.literal("yield_artifact_replies"),
@@ -653,7 +639,7 @@ const YieldArtifactRepliesSchema = defineSchema(zod.z.object({
 	msg_id: zod.z.string().min(1).max(128),
 	session_id: zod.z.string().max(512),
 	slugs: zod.z.array(zod.z.string().max(128)).max(16),
-	reason: zod.z.enum(["resume", "claim"]).catch("claim"),
+	reason: YieldReasonSchema.catch("claim"),
 	sent_at: zod.z.number(),
 	claimed_at: zod.z.number().optional(),
 	requester: zod.z.object({
@@ -768,6 +754,9 @@ var CcPeer = class CcPeer extends node_events.EventEmitter {
 		await peer.start();
 		return peer;
 	}
+	/**
+	* Bind, publish key and registry, and begin listening. Public rather than private because dependency-injected construction (this constructor takes the full Deps) needs to trigger it explicitly; everyday callers use the static create(), which wires the real node adapters.
+	*/
 	async start() {
 		const socketPath = socketPathForPid(process.pid, this.options);
 		this.ownKey = {
@@ -781,10 +770,11 @@ var CcPeer = class CcPeer extends node_events.EventEmitter {
 			recursive: true,
 			mode: 448
 		});
-		const entry = this.buildRegistryEntry();
+		const entry = this.buildRegistryEntry(this.ownKey.procStart);
 		await this.deps.registry.write(entry);
+		const ownToken = this.ownKey.peerToken;
 		this.listening = await this.deps.transport.listen(socketPath, (conn) => {
-			this.handleConnection(conn);
+			this.handleConnection(conn, ownToken);
 		});
 		this.heartbeatTimer = setInterval(() => {
 			this.deps.registry.touch(process.pid).catch(() => void 0);
@@ -792,14 +782,15 @@ var CcPeer = class CcPeer extends node_events.EventEmitter {
 		this.heartbeatTimer.unref();
 		this.log(`listening as ${this.options.name ?? "unnamed"} at ${socketPath}`);
 	}
-	buildRegistryEntry() {
+	/** procStart is a required parameter, not read from this.ownKey: start() already guarantees a non-empty value before this is called, so the type checker enforces it rather than a runtime fallback that can never actually fire. */
+	buildRegistryEntry(procStart) {
 		const now = this.deps.clock.nowMs();
 		return {
 			pid: process.pid,
 			sessionId: this.options.sessionId ?? newMsgId(),
 			cwd: process.cwd(),
 			startedAt: now,
-			procStart: this.ownKey?.procStart ?? "",
+			procStart,
 			version: "cc-peer",
 			peerProtocol: 1,
 			peerFeatures: ["notify_idle", "reply_across_default_dirs"],
@@ -864,10 +855,7 @@ var CcPeer = class CcPeer extends node_events.EventEmitter {
 				resolve();
 			}, waitMs).unref();
 		});
-		if (!this.pacer.tryReserve()) {
-			await this.pacedSend(socketPath, lines);
-			return;
-		}
+		this.pacer.tryReserve();
 		await this.deps.transport.connectWrite(socketPath, lines);
 	}
 	async subscribeIdle(target) {
@@ -898,14 +886,13 @@ var CcPeer = class CcPeer extends node_events.EventEmitter {
 		if (match === void 0) throw new UnknownPeerError(`no roster entry named ${target.name}`);
 		return match.messagingSocketPath;
 	}
-	async handleConnection(conn) {
+	/** ownToken is passed explicitly rather than read from this.ownKey: the listener callback that invokes this is only ever registered after start() has set ownKey, so the parameter records that guarantee at the type level instead of a runtime guard that can never actually be false. */
+	async handleConnection(conn, ownToken) {
 		const lines = conn.readLines();
 		const first = await lines[Symbol.asyncIterator]().next();
 		if (first.done === true) return;
-		if (this.ownKey !== void 0) {
-			const parsed = JSON.parse(first.value);
-			if (AuthLineSchema.is(parsed) && parsed.token !== this.ownKey.peerToken) this.log("inbound auth token mismatch (foreign token tolerated)");
-		}
+		const parsed = JSON.parse(first.value);
+		if (AuthLineSchema.is(parsed) && parsed.token !== ownToken) this.log("inbound auth token mismatch (foreign token tolerated)");
 		for await (const line of lines) {
 			let frame;
 			try {

package/dist/cc-peer.cjs

@@ -1,4 +1,4 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_cc_peer = require("./cc-peer-CH38-mD2.cjs");
+const require_cc_peer = require("./cc-peer-IGtoK_0q.cjs");
 exports.CC_PEER_VERSION = require_cc_peer.CC_PEER_VERSION;
 exports.CcPeer = require_cc_peer.CcPeer;

package/dist/cc-peer.d.cts

@@ -287,7 +287,11 @@ export declare class CcPeer extends EventEmitter {
   private stopped;
   constructor(options: Readonly<CcPeerOptions>, deps: Deps);
   static create(options?: Readonly<CcPeerOptions>): Promise<CcPeer>;
-  private start;
+  /**
+   * Bind, publish key and registry, and begin listening. Public rather than private because dependency-injected construction (this constructor takes the full Deps) needs to trigger it explicitly; everyday callers use the static create(), which wires the real node adapters.
+   */
+  start(): Promise<void>;
+  /** procStart is a required parameter, not read from this.ownKey: start() already guarantees a non-empty value before this is called, so the type checker enforces it rather than a runtime fallback that can never actually fire. */
   private buildRegistryEntry;
   roster(): Promise<RegistryEntry[]>;
   send(target: PeerRef, body: string, options?: Readonly<SendOptions>): Promise<{
@@ -298,6 +302,7 @@ export declare class CcPeer extends EventEmitter {
     msgId: string;
   }>;
   private resolveTarget;
+  /** ownToken is passed explicitly rather than read from this.ownKey: the listener callback that invokes this is only ever registered after start() has set ownKey, so the parameter records that guarantee at the type level instead of a runtime guard that can never actually be false. */
   private handleConnection;
   stop(): Promise<void>;
 }

package/dist/cc-peer.d.mts

@@ -287,7 +287,11 @@ export declare class CcPeer extends EventEmitter {
   private stopped;
   constructor(options: Readonly<CcPeerOptions>, deps: Deps);
   static create(options?: Readonly<CcPeerOptions>): Promise<CcPeer>;
-  private start;
+  /**
+   * Bind, publish key and registry, and begin listening. Public rather than private because dependency-injected construction (this constructor takes the full Deps) needs to trigger it explicitly; everyday callers use the static create(), which wires the real node adapters.
+   */
+  start(): Promise<void>;
+  /** procStart is a required parameter, not read from this.ownKey: start() already guarantees a non-empty value before this is called, so the type checker enforces it rather than a runtime fallback that can never actually fire. */
   private buildRegistryEntry;
   roster(): Promise<RegistryEntry[]>;
   send(target: PeerRef, body: string, options?: Readonly<SendOptions>): Promise<{
@@ -298,6 +302,7 @@ export declare class CcPeer extends EventEmitter {
     msgId: string;
   }>;
   private resolveTarget;
+  /** ownToken is passed explicitly rather than read from this.ownKey: the listener callback that invokes this is only ever registered after start() has set ownKey, so the parameter records that guarantee at the type level instead of a runtime guard that can never actually be false. */
   private handleConnection;
   stop(): Promise<void>;
 }

package/dist/cc-peer.mjs

@@ -1,2 +1,2 @@
-import { n as CcPeer, t as CC_PEER_VERSION } from "./cc-peer-BpNw-MoF.mjs";
+import { n as CcPeer, t as CC_PEER_VERSION } from "./cc-peer-CWGY6H7F.mjs";
 export { CC_PEER_VERSION, CcPeer };

package/docs/PROTOCOL.md

@@ -180,7 +180,7 @@ A receiving peer is the mirror: bind the socket, write key file and registry (pr
 | Holds, attestation, self-sent verdict, `crossSessionInbound` parity | verified live |
 | Peer registration, roster admission, name discovery | verified live (standalone peer in `ListAgents`, named `SendMessage`) |
 | Receipts: held / delivered / denied / expired / dropped{duplicate, rate-limited, hop-loop, hop-runaway} | verified live |
-| `queue-full` | code-verified; trigger attempted (55 queued), effective cap dynamically raised |
+| `queue-full` | code-verified; trigger attempted (55 queued behind a hold dialog, no drop). The `tengu_harbor_kite_limits` dynamic override has never been served to this account (absent from the Statsig evaluations cache), so the effective cap is the code default of 50 — the non-firing therefore reflects queue accounting (messages parked behind the approval dialog do not count toward the undelivered-peer-message queue), not a raised cap |
 | Idle subscriptions (`idle`, `exited`) | verified live |
 | artifact_yield admission + answer | verified live (refused and admitted paths); populated handover not exercised |
 | File transfer | staging + wire replicated; receive path behind a never-served server flag (evidenced) |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-peer",
-  "version": "1.1.5",
+  "version": "1.1.7",
   "description": "Communicate with local Claude Code instances over their native cross-session peer messaging: send and receive messages, register as a named discoverable peer, receipts, idle subscriptions, and a REST facade via `npx cc-peer`.",
   "type": "module",
   "license": "MIT",
@@ -55,7 +55,7 @@
     "_typecheck": "tsc --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",
-    "test:mutation": "stryker run",
+    "test:mutation": "stryker run stryker.config.ts",
     "prepublishOnly": "pnpm lint && pnpm typecheck && pnpm test:coverage && pnpm build && publint && attw --pack",
     "prepare": "husky",
     "test:coverage": "vitest run --coverage"
@@ -72,7 +72,8 @@
     ],
     "overrides": {
       "eslint-plugin-jsdoc": "64.3.6",
-      "conventional-changelog-writer": "9.2.1"
+      "conventional-changelog-writer": "9.2.1",
+      "qs": "6.15.2"
     }
   },
   "devDependencies": {
@@ -91,7 +92,7 @@
     "@stryker-mutator/core": "10.0.0",
     "@stryker-mutator/vitest-runner": "10.0.0",
     "@types/node": "26.4.1",
-    "@vitest/coverage-v8": "5.0.0",
+    "@vitest/coverage-v8": "4.1.11",
     "commitlint": "21.2.2",
     "eslint": "10.10.0",
     "eslint-config-prettier": "10.1.8",
@@ -107,6 +108,6 @@
     "tsx": "4.23.13",
     "turbo": "2.10.12",
     "typescript": "6.0.3",
-    "vitest": "5.0.0"
+    "vitest": "4.1.11"
   }
 }