chorus-codes 0.7.5 → 0.8.0

package/dist/cli/commands/start.js

@@ -9,6 +9,7 @@ const fs_1 = __importDefault(require("fs"));
 const open_1 = __importDefault(require("open"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const daemon_discovery_js_1 = require("../../lib/daemon-discovery.js");
 const port_utils_js_1 = require("../port-utils.js");
 const runtime_env_js_1 = require("../runtime-env.js");
 const shared_js_1 = require("../shared.js");
@@ -17,26 +18,74 @@ function registerStartCommand(program) {
     program
         .command('start')
         .option('--ui', 'Open browser UI after starting daemon')
+        .option('--daemon-only', 'Skip cockpit (Next.js UI). Used by MCP auto-start.')
         .description('Start the Chorus daemon (PM2-style fork)')
         .action(async (options) => {
         try {
             const chorusDir = path_1.default.join(os_1.default.homedir(), '.chorus');
-            const pidFile = path_1.default.join(chorusDir, 'daemon.pid');
-            if (await alreadyRunning(pidFile, options.ui))
+            // First-pass already-running check. If a daemon is up AND
+            // (we don't need the cockpit OR the cockpit is also up),
+            // bail out. Otherwise fall through to the upgrade path
+            // below.
+            const alreadyHandled = await alreadyRunningHealthy(options.ui);
+            if (alreadyHandled === 'satisfied')
                 return;
-            if (await alreadyRunningOnDefaultPort(options.ui))
+            // Upgrade path: daemon is healthy but cockpit isn't running
+            // and the user asked for --ui. Spawn just the cockpit and
+            // update daemon.json. No need to acquire the start.lock —
+            // we're not racing another start, just attaching the missing
+            // process.
+            if (alreadyHandled === 'cockpit_missing_ui_requested') {
+                await spawnCockpitForExistingDaemon(chorusDir);
                 return;
-            await reapOrphans();
-            warnIfTmuxMissing();
-            // Capture the interactive PATH from the user's terminal BEFORE
-            // forking the daemon. The daemon's own spawn loses this — it
-            // runs from a non-interactive shell that skips ~/.bashrc, so
-            // tools installed to ~/.opencode/bin etc. would be missing.
-            // Re-capturing on every start (not just init) means a user who
-            // adds a new tool to PATH and restarts picks it up automatically.
-            await captureAndPersistPath();
-            spawnDaemonAndCockpit(chorusDir, pidFile);
-            scheduleAutoOpenBrowser(options.ui);
+            }
+            // Concurrent-start guard. Two MCP shims hitting auto-start
+            // simultaneously would otherwise both pickPortPair → spawn
+            // a daemon → write daemon.json. Whichever writes second
+            // overwrites the first, leaving an orphan listening on a
+            // forgotten port. Using O_EXCL on the lockfile means the
+            // loser fails fast and falls through to alreadyRunningHealthy
+            // on retry (after the winner finishes spawning).
+            const acquired = acquireStartLock(chorusDir);
+            if (!acquired) {
+                // Another start is in flight. Poll briefly for daemon.json
+                // to appear; if it shows up, we're done. If the lock is
+                // stale (owner PID dead), reclaim it. Never blindly steal
+                // the lock on timeout — the winner may just be slow.
+                await waitForAnotherStartToWin();
+                const second = await alreadyRunningHealthy(options.ui);
+                if (second === 'satisfied')
+                    return;
+                if (second === 'cockpit_missing_ui_requested') {
+                    await spawnCockpitForExistingDaemon(chorusDir);
+                    return;
+                }
+                // No winner appeared. Check whether the lock owner is
+                // actually dead before clearing — a slow but live winner
+                // must NOT be elbowed aside or both processes will spawn.
+                if (!isLockOwnerAlive(chorusDir)) {
+                    clearStartLock(chorusDir);
+                    if (!acquireStartLock(chorusDir)) {
+                        throw new Error('Could not reclaim stale start lock. Try `chorus stop` then retry.');
+                    }
+                }
+                else {
+                    throw new Error('Another `chorus start` is still running. If this persists, run `chorus stop` then retry.');
+                }
+            }
+            try {
+                await reapOrphans();
+                warnIfTmuxMissing();
+                await captureAndPersistPath();
+                const ports = await pickPortPair();
+                await spawnDaemonAndCockpit(chorusDir, ports, {
+                    daemonOnly: options.daemonOnly === true,
+                });
+                scheduleAutoOpenBrowser(options.ui, ports.cockpitPort);
+            }
+            finally {
+                releaseStartLock(chorusDir);
+            }
         }
         catch (error) {
             console.error('Failed to start daemon:', error);
@@ -44,14 +93,77 @@ function registerStartCommand(program) {
         }
     });
 }
+/**
+ * Acquire ~/.chorus/start.lock with O_EXCL. Returns true on success;
+ * false if another start has the lock. Stale-lock recovery is the
+ * caller's responsibility.
+ */
+function acquireStartLock(chorusDir) {
+    fs_1.default.mkdirSync(chorusDir, { recursive: true });
+    const lockPath = path_1.default.join(chorusDir, 'start.lock');
+    try {
+        // 'wx' = O_CREAT | O_EXCL | O_WRONLY. Atomic create-or-fail.
+        const fd = fs_1.default.openSync(lockPath, 'wx');
+        fs_1.default.writeSync(fd, String(process.pid));
+        fs_1.default.closeSync(fd);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function releaseStartLock(chorusDir) {
+    const lockPath = path_1.default.join(chorusDir, 'start.lock');
+    try {
+        fs_1.default.unlinkSync(lockPath);
+    }
+    catch {
+        /* already gone */
+    }
+}
+function clearStartLock(chorusDir) {
+    releaseStartLock(chorusDir);
+}
+/**
+ * Read the PID stamped into start.lock and check if that process is
+ * still alive. Used to distinguish a stale lock (winner crashed before
+ * unlinking) from a slow-but-live winner. Pre-fix the loser would
+ * blindly steal the lock after an 8s timeout, allowing both processes
+ * to spawn daemons concurrently when the winner happened to be slow.
+ */
+function isLockOwnerAlive(chorusDir) {
+    const lockPath = path_1.default.join(chorusDir, 'start.lock');
+    try {
+        const raw = fs_1.default.readFileSync(lockPath, 'utf-8').trim();
+        const pid = Number.parseInt(raw, 10);
+        if (!Number.isFinite(pid) || pid <= 0)
+            return false;
+        return (0, daemon_discovery_js_1.isPidAlive)(pid);
+    }
+    catch {
+        // Lock file vanished between the failed acquire and this read —
+        // treat as "not alive" so the caller retries acquisition cleanly.
+        return false;
+    }
+}
+/**
+ * The lock-loser polls for daemon.json to appear, then defers to
+ * alreadyRunningHealthy. Bounded wait — the winner's spawn-and-record
+ * flow takes ~5s on healthy machines.
+ */
+async function waitForAnotherStartToWin() {
+    const deadline = Date.now() + 8000;
+    while (Date.now() < deadline) {
+        const live = await (0, daemon_discovery_js_1.readLiveDaemonInfo)({ healthTimeoutMs: 500 });
+        if (live)
+            return;
+        await new Promise((r) => setTimeout(r, 200));
+    }
+}
 /**
  * Run the user's interactive shell once and stash $PATH so the daemon
  * (running in a non-interactive shell that skips .bashrc/.zshrc) can
  * find CLIs the user installed via official curl-bash scripts.
- *
- * Best-effort. Capture or persist failures are swallowed — the daemon
- * has fallback known-install probes and the previous saved value, if
- * any, stays put.
  */
 async function captureAndPersistPath() {
     try {
@@ -65,118 +177,190 @@ async function captureAndPersistPath() {
     }
 }
 /**
- * Pidfile-less variant of `alreadyRunning`. Covers the case where
- * the daemon is healthy on :7707 but the pidfile is missing or stale
- * (manual deletion, /tmp wipe, prior crash before pidfile write,
- * sudo-started daemon vs. user-invoked `chorus start`, etc.).
+ * Detect a healthy chorus already running on this host before we try
+ * to spawn another one. Returns:
+ *   - 'satisfied': nothing to do (or just printed status + opened
+ *     browser). Caller should return immediately.
+ *   - 'cockpit_missing_ui_requested': the daemon is alive but was
+ *     started in --daemon-only mode; user just asked for --ui. Caller
+ *     should upgrade by spawning only the cockpit.
+ *   - 'not_running': fall through to the normal start sequence.
  *
- * Without this, a healthy chorus + missing pidfile would fall through
- * to reapOrphans() and either kill the live daemon or hit the
- * "couldn't identify the PID" dead-end (when the daemon runs as a
- * different user and `ss -p` redacts the PID).
- *
- * The HTTP probe alone is a strong signal — chorus's /api/v1/health
- * returns a versioned envelope no random other process happens to
- * mimic. The PID-cmdline cross-check is belt-and-braces: only treat
- * "already running" as authoritative when both agree it's chorus.
+ * Cross-uid hardening: daemon.json lives in $HOME, so we only see
+ * *our* daemon. A sudo-started daemon's daemon.json lives in root's
+ * $HOME and is invisible to the unprivileged probe. The orphan reaper
+ * handles that case via cmdline + cwd matching.
  */
-async function alreadyRunningOnDefaultPort(uiFlag) {
-    // Short timeout — we're trying to fail fast and fall through to reap
-    // logic when the daemon is actually dead. 1.5s covers a slow loopback
-    // round-trip on resource-starved CI runners without making a healthy
-    // system feel sluggish.
-    let healthyVersion = null;
-    try {
-        const ac = new AbortController();
-        const timer = setTimeout(() => ac.abort(), 1500);
-        const res = await fetch(`${shared_js_1.DAEMON_URL}/api/v1/health`, {
-            signal: ac.signal,
-        });
-        clearTimeout(timer);
-        if (!res.ok)
-            return false;
-        const envelope = (await res.json());
-        if (envelope.ok !== true || !envelope.data?.version)
-            return false;
-        healthyVersion = envelope.data.version;
-    }
-    catch {
-        // ECONNREFUSED / abort / parse error → not a healthy chorus on :7707.
-        return false;
+async function alreadyRunningHealthy(uiFlag) {
+    // Longer health timeout than runtime resolution: WSL loopback is
+    // slow on cold start (3-4s observed). We'd rather wait 5s once than
+    // mis-diagnose a healthy daemon and pile a second one on top.
+    const live = await (0, daemon_discovery_js_1.readLiveDaemonInfo)({ healthTimeoutMs: 5000 });
+    if (!live)
+        return 'not_running';
+    const cockpitRunning = live.cockpitPid !== null && (0, daemon_discovery_js_1.isPidAlive)(live.cockpitPid);
+    // Upgrade path: daemon up, no cockpit, user wants --ui. Tell the
+    // caller to handle this without printing anything; the cockpit
+    // spawn will print the URL when it lands.
+    if (uiFlag && !cockpitRunning) {
+        return 'cockpit_missing_ui_requested';
     }
-    // Cross-check: the PID listening on :7707 must look like chorus.
-    // Without this, a foreign service that happens to respond 200 on
-    // /api/v1/health with a matching envelope shape could fool us into
-    // sending the user to a wrong cockpit URL. Belt-and-braces.
-    const pids = (0, port_utils_js_1.findPidsOnPort)(7707);
-    const looksLikeChorus = pids.some((pid) => (0, port_utils_js_1.pidLooksLikeChorus)(pid).match);
-    if (pids.length > 0 && !looksLikeChorus)
-        return false;
     console.log('');
-    console.log((0, ui_js_1.header)(ui_js_1.sym.ok, 'Chorus is already running', `version ${healthyVersion}`));
-    (0, shared_js_1.printCockpitAccessHint)();
-    if (uiFlag && (0, runtime_env_js_1.shouldAutoOpenBrowser)((0, runtime_env_js_1.detectRuntimeEnv)())) {
-        (0, open_1.default)(shared_js_1.COCKPIT_URL);
-    }
-    return true;
-}
-async function alreadyRunning(pidFile, uiFlag) {
-    if (!fs_1.default.existsSync(pidFile))
-        return false;
-    const oldPid = parseInt(fs_1.default.readFileSync(pidFile, 'utf-8'), 10);
-    try {
-        // Cross-platform liveness probe. process.kill(pid, 0) throws if no
-        // process with that pid exists; works on Windows/macOS/Linux unlike
-        // the unix-only `kill -0` shell command we used to invoke here.
-        if (Number.isFinite(oldPid) && oldPid > 0) {
-            process.kill(oldPid, 0);
-        }
-        else {
-            throw new Error('invalid pid');
+    console.log((0, ui_js_1.header)(ui_js_1.sym.ok, 'Chorus is already running', `version ${live.version || shared_js_1.pkg.version}`));
+    if (cockpitRunning) {
+        const cockpitUrl = `http://127.0.0.1:${live.cockpitPort}`;
+        console.log('');
+        console.log(`   ${ui_js_1.c.gray('Open')}  ${ui_js_1.c.cyan(cockpitUrl)}`);
+        const env = (0, runtime_env_js_1.detectRuntimeEnv)();
+        if (env.hint) {
+            console.log('');
+            console.log((0, ui_js_1.tip)(env.hint));
         }
         console.log('');
-        console.log((0, ui_js_1.header)(ui_js_1.sym.ok, 'Chorus is already running', `daemon PID ${oldPid}`));
-        (0, shared_js_1.printCockpitAccessHint)();
-        if (uiFlag && (0, runtime_env_js_1.shouldAutoOpenBrowser)((0, runtime_env_js_1.detectRuntimeEnv)())) {
-            (0, open_1.default)(shared_js_1.COCKPIT_URL);
+        if (uiFlag && (0, runtime_env_js_1.shouldAutoOpenBrowser)(env)) {
+            (0, open_1.default)(cockpitUrl);
         }
-        return true;
     }
-    catch {
-        // Process doesn't exist, clean up the stale pidfile.
-        fs_1.default.unlinkSync(pidFile);
-        return false;
+    else {
+        console.log('');
+        console.log(ui_js_1.c.dim('   Daemon-only mode. Run `chorus start --ui` to bring up the cockpit.'));
+        console.log('');
     }
+    return 'satisfied';
 }
 /**
- * Pre-spawn orphan reap. Pidfile-based liveness only catches the
- * recorded daemon PID — it misses a stale next-server (cockpit) or
- * daemon that survived a previous `chorus stop` because the SIGTERM
- * was ignored or the pidfile got out of sync. Without this sweep, a
- * fresh `chorus start` would race against the orphan on :5050 / :7707,
- * the new spawn would lose, and the user would see 500s served by the
- * ghost (incident 2026-05-03).
+ * Bring up just the Next.js cockpit and re-write daemon.json with the
+ * new cockpitPid. Used when a `--daemon-only` daemon is already running
+ * and the user now passes `--ui` to attach the UI without restarting.
+ */
+async function spawnCockpitForExistingDaemon(chorusDir) {
+    const live = await (0, daemon_discovery_js_1.readLiveDaemonInfo)({ healthTimeoutMs: 5000 });
+    if (!live) {
+        // Edge case: daemon died between the alreadyRunningHealthy check
+        // and this call. Caller's own logic will pick it up on retry.
+        throw new Error('Daemon disappeared while attaching cockpit. Retry `chorus start`.');
+    }
+    const packageRoot = path_1.default.resolve(__dirname, '..', '..', '..');
+    const nextEntry = path_1.default.resolve(packageRoot, 'node_modules', 'next', 'dist', 'bin', 'next');
+    if (!fs_1.default.existsSync(nextEntry) ||
+        !fs_1.default.existsSync(path_1.default.join(packageRoot, '.next'))) {
+        console.log('');
+        console.log(ui_js_1.c.red('  ✗ Cockpit UI not found. Try `npm install -g chorus-codes` to repair.'));
+        console.log('');
+        return;
+    }
+    const logsDir = path_1.default.join(chorusDir, 'logs');
+    fs_1.default.mkdirSync(logsDir, { recursive: true });
+    const webLogPath = path_1.default.join(logsDir, 'web.log');
+    const webLogFd = fs_1.default.openSync(webLogPath, 'a');
+    const webPidFile = path_1.default.join(chorusDir, 'web.pid');
+    const webChild = (0, child_process_1.spawn)('node', [
+        nextEntry,
+        'start',
+        '-p',
+        String(live.cockpitPort),
+        '-H',
+        '127.0.0.1',
+    ], {
+        cwd: packageRoot,
+        detached: true,
+        stdio: ['ignore', webLogFd, webLogFd],
+        env: {
+            ...process.env,
+            CHORUS_DAEMON_URL: `http://127.0.0.1:${live.daemonPort}`,
+            PORT: String(live.cockpitPort),
+        },
+    });
+    if (!webChild.pid) {
+        throw new Error('Failed to spawn cockpit process');
+    }
+    fs_1.default.writeFileSync(webPidFile, webChild.pid.toString());
+    webChild.unref();
+    // Update daemon.json so future stops know about the cockpit PID.
+    (0, daemon_discovery_js_1.writeDaemonInfo)({
+        schemaVersion: 1,
+        daemonPort: live.daemonPort,
+        cockpitPort: live.cockpitPort,
+        daemonPid: live.daemonPid,
+        cockpitPid: webChild.pid,
+        startedAt: live.startedAt,
+        version: live.version,
+    });
+    console.log('');
+    console.log((0, ui_js_1.header)(ui_js_1.sym.ok, 'Cockpit attached', `cockpit PID ${webChild.pid}`));
+    const cockpitUrl = `http://127.0.0.1:${live.cockpitPort}`;
+    console.log('');
+    console.log(`   ${ui_js_1.c.gray('Open')}  ${ui_js_1.c.cyan(cockpitUrl)}`);
+    const env = (0, runtime_env_js_1.detectRuntimeEnv)();
+    if (env.hint) {
+        console.log('');
+        console.log((0, ui_js_1.tip)(env.hint));
+    }
+    console.log('');
+    if ((0, runtime_env_js_1.shouldAutoOpenBrowser)(env)) {
+        (0, open_1.default)(cockpitUrl);
+    }
+}
+/**
+ * Pick a free (daemon, cockpit) port pair. Honours CHORUS_DAEMON_PORT
+ * and CHORUS_COCKPIT_PORT env overrides as the *preferred* starting
+ * point — the walk still fires off them if taken. If the walk
+ * exhausts, exit with the same actionable diagnostic the v0.7 reaper
+ * used.
+ */
+async function pickPortPair() {
+    const preferredDaemon = parseEnvPort('CHORUS_DAEMON_PORT', daemon_discovery_js_1.DEFAULT_DAEMON_PORT);
+    const preferredCockpit = parseEnvPort('CHORUS_COCKPIT_PORT', daemon_discovery_js_1.DEFAULT_COCKPIT_PORT);
+    const daemonPort = await (0, daemon_discovery_js_1.pickFreePort)(preferredDaemon, daemon_discovery_js_1.DAEMON_PORT_RANGE, port_utils_js_1.isPortInUse);
+    if (daemonPort === null) {
+        failPortWalk('daemon', preferredDaemon, daemon_discovery_js_1.DAEMON_PORT_RANGE);
+    }
+    const cockpitPort = await (0, daemon_discovery_js_1.pickFreePort)(preferredCockpit, daemon_discovery_js_1.COCKPIT_PORT_RANGE, port_utils_js_1.isPortInUse);
+    if (cockpitPort === null) {
+        failPortWalk('cockpit', preferredCockpit, daemon_discovery_js_1.COCKPIT_PORT_RANGE);
+    }
+    return { daemonPort: daemonPort, cockpitPort: cockpitPort };
+}
+function parseEnvPort(name, fallback) {
+    const raw = process.env[name];
+    if (!raw)
+        return fallback;
+    const n = Number.parseInt(raw, 10);
+    return Number.isFinite(n) && n > 0 && n < 65536 ? n : fallback;
+}
+function failPortWalk(label, start, range) {
+    const end = start + range - 1;
+    console.log('');
+    console.log((0, ui_js_1.header)(ui_js_1.sym.err, `No free ${label} port in range :${start}–:${end}`, 'every candidate port is held by another process'));
+    console.log('');
+    console.log(ui_js_1.c.dim('  Find what owns these ports:'));
+    for (let p = start; p <= end; p += 1) {
+        console.log(`    sudo lsof -iTCP:${p} -sTCP:LISTEN`);
+    }
+    console.log('');
+    console.log(ui_js_1.c.dim('  Or pick a different starting port:'));
+    console.log(`    CHORUS_${label.toUpperCase()}_PORT=<port> chorus start`);
+    console.log('');
+    process.exit(1);
+}
+/**
+ * Pre-spawn orphan reap. Sweeps the *default* daemon + cockpit ports
+ * because that's where v0.7 daemons would have bound — we want to
+ * absorb stale v0.7 processes during the v0.8 transition. The picker
+ * still walks past whatever survives, so the reap is best-effort
+ * cleanup, not a prerequisite.
  *
  * Foreign-process guard: only reap PIDs whose cmdline looks like a
- * chorus daemon/cockpit. If something else (Grafana on :5050, a
- * colleague's `next dev` on :7707) is bound, refuse to kill it and ask
- * the user to free the port. Pre-fix the reaper would silently SIGKILL
- * whatever it found.
+ * chorus daemon/cockpit. If something else is bound, refuse to kill
+ * it and ask the user to free the port — same behaviour as v0.7.
  */
 async function reapOrphans() {
     for (const [port, label] of [
-        [7707, 'daemon'],
-        [5050, 'cockpit'],
+        [daemon_discovery_js_1.DEFAULT_DAEMON_PORT, 'daemon'],
+        [daemon_discovery_js_1.DEFAULT_COCKPIT_PORT, 'cockpit'],
     ]) {
         if (!(await (0, port_utils_js_1.isPortInUse)(port)))
             continue;
-        // Two-tier PID lookup. The unprivileged probe (ss / lsof without
-        // sudo) returns [] when the port is held by a process owned by a
-        // different uid — typically a daemon a prior `sudo chorus start`
-        // left behind. Falling back to `sudo -n` recovers the PID when the
-        // user has passwordless sudo configured. If sudo would prompt, the
-        // -n flag fails fast and we drop to the actionable diagnostic
-        // instead of blocking the terminal on a password prompt.
         let pids = (0, port_utils_js_1.findPidsOnPort)(port);
         let needsSudoToKill = false;
         if (pids.length === 0) {
@@ -184,43 +368,21 @@ async function reapOrphans() {
             needsSudoToKill = pids.length > 0;
         }
         if (pids.length === 0) {
-            // sudo also couldn't see — either no passwordless sudo, or
-            // something exotic (Windows-host port reservation through WSL2,
-            // a docker bridge, etc.). Print the exact remediation commands
-            // so the user can self-rescue without guessing.
+            // Couldn't see who owns the default port — the picker will walk
+            // past it. Don't fail; just note it.
             console.log('');
-            console.log((0, ui_js_1.header)(ui_js_1.sym.err, `Port :${port} is in use, but I can't see which process owns it`, `likely cause: the holder is owned by another user (or sudo)`));
-            console.log('');
-            console.log(ui_js_1.c.dim('  Find it:'));
-            console.log(`    sudo lsof -iTCP:${port} -sTCP:LISTEN`);
-            console.log('');
-            console.log(ui_js_1.c.dim('  Free it:'));
-            console.log(`    sudo fuser -k ${port}/tcp`);
-            console.log(ui_js_1.c.dim(`    (macOS: kill $(sudo lsof -ti :${port}))`));
-            if (label === 'daemon') {
-                console.log('');
-                console.log(ui_js_1.c.dim('  Or relocate the daemon:'));
-                console.log(`    CHORUS_DAEMON_PORT=${port + 1} chorus start`);
-            }
-            console.log('');
-            process.exit(1);
+            console.log(ui_js_1.c.dim(`  ${ui_js_1.sym.info} Port :${port} is in use but the owner isn't visible. Will pick the next free port.`));
+            continue;
         }
         for (const pid of pids) {
             const { match, cmdline } = (0, port_utils_js_1.pidLooksLikeChorus)(pid);
             if (!match) {
+                // Foreign process on the default port — let the picker walk
+                // past it. Don't fail.
                 console.log('');
-                console.log((0, ui_js_1.header)(ui_js_1.sym.err, `Port :${port} is in use by a non-chorus process`, `PID ${pid}: ${cmdline ?? '(unreadable)'}`));
-                console.log('');
-                console.log((0, ui_js_1.tip)(label === 'daemon'
-                    ? `Free :${port} (stop the other process, or relocate the daemon via CHORUS_DAEMON_PORT) and retry \`chorus start\`.`
-                    : `Free :${port} (stop the other process listening on the cockpit port) and retry \`chorus start\`.`));
-                console.log('');
-                process.exit(1);
+                console.log(ui_js_1.c.dim(`  ${ui_js_1.sym.info} Port :${port} is held by ${cmdline ?? `PID ${pid}`} — will pick the next free port.`));
+                continue;
             }
-            // Cross-uid orphan: must use sudo -n kill or the SIGTERM bounces
-            // off with EPERM. Same chorus-shape match guard means we only
-            // ever sudo-kill processes whose cmdline already proved they're
-            // chorus orphans — never escalate against foreign code.
             const dead = needsSudoToKill
                 ? await (0, port_utils_js_1.killWithSudoAndVerify)(pid, `${label} orphan`)
                 : await (0, port_utils_js_1.killAndVerify)(pid, `${label} orphan`);
@@ -234,8 +396,6 @@ async function reapOrphans() {
  * Default transport is 'headless' (no tmux needed). tmux is the
  * OPTIONAL backup mode for users who want to attach to a live voice
  * session and take over / watch step-by-step / hand off mid-run.
- * Surfaced once at start so power users know the feature exists.
- * Soft-info (not a warning) so we don't scare default-path users.
  */
 function warnIfTmuxMissing() {
     try {
@@ -245,26 +405,18 @@ function warnIfTmuxMissing() {
         console.log('');
         console.log(ui_js_1.c.dim(`  ${ui_js_1.sym.info} tmux not detected. Chorus runs headless by default — this is fine.`));
         console.log(ui_js_1.c.dim('    Optional backup mode: install tmux, then open'));
-        console.log(ui_js_1.c.dim('    http://127.0.0.1:5050/settings#transport and pick "Tmux — attach & take over".'));
+        console.log(ui_js_1.c.dim('    /settings#transport in the cockpit and pick "Tmux — attach & take over".'));
         console.log(ui_js_1.c.dim('    `tmux attach -t <name>` lets you watch step-by-step or take over mid-run.'));
         console.log(ui_js_1.c.dim('    macOS: brew install tmux · Ubuntu/Debian: apt install tmux · Fedora: dnf install tmux'));
         console.log('');
     }
 }
-function spawnDaemonAndCockpit(chorusDir, pidFile) {
-    // Prefer the compiled JS so a global install works (no src/ shipped,
-    // no tsx loader registered); fall back to the .ts source when running
-    // in dev mode where the user only has src/ on disk.
+async function spawnDaemonAndCockpit(chorusDir, ports, options = { daemonOnly: false }) {
     const daemonJs = path_1.default.resolve(__dirname, '..', '..', 'daemon', 'index.js');
     const daemonTs = path_1.default.resolve(__dirname, '..', '..', '..', 'src', 'daemon', 'index.ts');
     const useCompiled = fs_1.default.existsSync(daemonJs);
     const daemonPath = useCompiled ? daemonJs : daemonTs;
     const spawnArgs = useCompiled ? [daemonPath] : ['-r', 'tsx/cjs', daemonPath];
-    // Pipe daemon stdout + stderr to a log file so the user (and we, when
-    // debugging) can see why a chat went sideways. Previously stdio was
-    // 'ignore' which made silent failures impossible to diagnose. Logs
-    // rotate manually; truncated to 10 MB max via periodic rotate inside
-    // the daemon (TODO).
     fs_1.default.mkdirSync(chorusDir, { recursive: true });
     const logsDir = path_1.default.join(chorusDir, 'logs');
     fs_1.default.mkdirSync(logsDir, { recursive: true });
@@ -273,37 +425,57 @@ function spawnDaemonAndCockpit(chorusDir, pidFile) {
     const child = (0, child_process_1.spawn)('node', spawnArgs, {
         detached: true,
         stdio: ['ignore', daemonLogFd, daemonLogFd],
+        env: {
+            ...process.env,
+            CHORUS_DAEMON_PORT: String(ports.daemonPort),
+            CHORUS_COCKPIT_PORT: String(ports.cockpitPort),
+        },
     });
     if (!child.pid) {
         throw new Error('Failed to spawn daemon process');
     }
+    const pidFile = path_1.default.join(chorusDir, 'daemon.pid');
     fs_1.default.writeFileSync(pidFile, child.pid.toString());
-    // Spawn the cockpit web UI alongside the daemon. The package ships a
-    // built .next directory; run next from the package root so it picks
-    // up the bundled bun_modules. Web PID is tracked separately so
-    // `chorus stop` can clean up both.
     const packageRoot = path_1.default.resolve(__dirname, '..', '..', '..');
     const nextEntry = path_1.default.resolve(packageRoot, 'node_modules', 'next', 'dist', 'bin', 'next');
     const webPidFile = path_1.default.join(chorusDir, 'web.pid');
-    if (fs_1.default.existsSync(nextEntry) &&
+    let cockpitPid = null;
+    if (options.daemonOnly) {
+        // Skip cockpit spawn — used by MCP auto-start where the user
+        // hasn't asked for the UI. Daemon API alone is enough for the
+        // editor to make tool calls.
+    }
+    else if (fs_1.default.existsSync(nextEntry) &&
         fs_1.default.existsSync(path_1.default.join(packageRoot, '.next'))) {
         const webLogPath = path_1.default.join(logsDir, 'web.log');
         const webLogFd = fs_1.default.openSync(webLogPath, 'a');
-        const webChild = (0, child_process_1.spawn)('node', [nextEntry, 'start', '-p', '5050', '-H', '127.0.0.1'], {
+        const webChild = (0, child_process_1.spawn)('node', [
+            nextEntry,
+            'start',
+            '-p',
+            String(ports.cockpitPort),
+            '-H',
+            '127.0.0.1',
+        ], {
             cwd: packageRoot,
             detached: true,
             stdio: ['ignore', webLogFd, webLogFd],
+            env: {
+                ...process.env,
+                // Tell the cockpit's server-side proxy where the daemon is.
+                // Without this the proxy would fall through to the legacy
+                // 7707 default and miss our shifted port.
+                CHORUS_DAEMON_URL: `http://127.0.0.1:${ports.daemonPort}`,
+                PORT: String(ports.cockpitPort),
+            },
         });
         if (webChild.pid) {
             fs_1.default.writeFileSync(webPidFile, webChild.pid.toString());
+            cockpitPid = webChild.pid;
             webChild.unref();
         }
     }
     else {
-        // Loud, actionable error — the previous yellow warning was easy to
-        // miss and left users at a blank cockpit URL with no idea why. We
-        // keep the daemon running (MCP + API still work) but make the
-        // remediation steps obvious.
         console.log('');
         console.log(ui_js_1.c.red('  ✗ Cockpit UI not found.'));
         if (fs_1.default.existsSync(path_1.default.join(packageRoot, 'src'))) {
@@ -314,18 +486,74 @@ function spawnDaemonAndCockpit(chorusDir, pidFile) {
             console.log(ui_js_1.c.dim('    The published install should ship a built UI. Try reinstalling:'));
             console.log(`    ${ui_js_1.c.bold('npm install -g chorus-codes')}`);
         }
-        console.log(ui_js_1.c.dim('    The daemon API is still up on port 7707 if you only need MCP.'));
+        console.log(ui_js_1.c.dim(`    The daemon API is still up on port ${ports.daemonPort} if you only need MCP.`));
         console.log('');
     }
+    // Wait for the daemon to answer health, THEN write daemon.json.
+    // Must await: the parent CLI process exits as soon as this function
+    // returns; if we fire-and-forget, the file never gets written and
+    // every consumer falls back to defaults forever.
+    await waitForDaemonListenerThenRecord(ports, child.pid, cockpitPid);
     child.unref();
     console.log('');
     console.log((0, ui_js_1.header)(ui_js_1.sym.ok, 'Chorus started', `daemon PID ${child.pid}`));
-    (0, shared_js_1.printCockpitAccessHint)();
+    if (!options.daemonOnly) {
+        const cockpitUrl = `http://127.0.0.1:${ports.cockpitPort}`;
+        console.log('');
+        console.log(`   ${ui_js_1.c.gray('Open')}  ${ui_js_1.c.cyan(cockpitUrl)}`);
+        const env = (0, runtime_env_js_1.detectRuntimeEnv)();
+        if (env.hint) {
+            console.log('');
+            console.log((0, ui_js_1.tip)(env.hint));
+        }
+    }
+    console.log('');
+}
+/**
+ * Poll the daemon's health endpoint up to 5 seconds, then write
+ * daemon.json once it responds. Background fire-and-forget — the
+ * caller has already returned to the user; we just need to make sure
+ * the file is in place before any consumer reads it.
+ *
+ * If the daemon never comes up, write the file anyway with the recorded
+ * ports — better stale data than no data, since the next `chorus start`
+ * will detect the dead daemon via PID liveness and overwrite.
+ */
+async function waitForDaemonListenerThenRecord(ports, daemonPid, cockpitPid) {
+    const deadline = Date.now() + 5000;
+    while (Date.now() < deadline) {
+        try {
+            const ac = new AbortController();
+            const timer = setTimeout(() => ac.abort(), 500);
+            const res = await fetch(`http://127.0.0.1:${ports.daemonPort}/api/v1/health`, { signal: ac.signal });
+            clearTimeout(timer);
+            if (res.ok)
+                break;
+        }
+        catch {
+            /* not up yet */
+        }
+        if (!(0, daemon_discovery_js_1.isPidAlive)(daemonPid)) {
+            // Spawned process died before the listener came up — bail rather
+            // than write a junk daemon.json.
+            return;
+        }
+        await new Promise((r) => setTimeout(r, 100));
+    }
+    (0, daemon_discovery_js_1.writeDaemonInfo)({
+        schemaVersion: 1,
+        daemonPort: ports.daemonPort,
+        cockpitPort: ports.cockpitPort,
+        daemonPid,
+        cockpitPid,
+        startedAt: new Date().toISOString(),
+        version: shared_js_1.pkg.version,
+    });
 }
-function scheduleAutoOpenBrowser(uiFlag) {
+function scheduleAutoOpenBrowser(uiFlag, cockpitPort) {
     setTimeout(() => {
         if (uiFlag && (0, runtime_env_js_1.shouldAutoOpenBrowser)((0, runtime_env_js_1.detectRuntimeEnv)())) {
-            (0, open_1.default)(shared_js_1.COCKPIT_URL);
+            (0, open_1.default)(`http://127.0.0.1:${cockpitPort}`);
         }
     }, 1000);
 }