codehost 0.23.1 → 0.23.3

package/CHANGELOG.md

@@ -1,3 +1,18 @@
+## [0.23.3](https://github.com/snomiao/codehost/compare/v0.23.2...v0.23.3) (2026-06-20)
+
+
+### Bug Fixes
+
+* **cli:** expand an unexpanded %USERPROFILE% in TEMP/TMP on Windows ([d258ee8](https://github.com/snomiao/codehost/commit/d258ee80131880aa5bc0b2bd283474e65c289184))
+* **cli:** manage the Windows daemon with pm2 instead of oxmgr ([ebade2e](https://github.com/snomiao/codehost/commit/ebade2eb67868a6ace899bba52c47d9c64934dbb))
+
+## [0.23.2](https://github.com/snomiao/codehost/compare/v0.23.1...v0.23.2) (2026-06-16)
+
+
+### Performance Improvements
+
+* **cli:** throttle meta pushes to the signaling room ([654ee10](https://github.com/snomiao/codehost/commit/654ee1088bc88f95ca6b57545fa477ccb77b994f))
+
 ## [0.23.1](https://github.com/snomiao/codehost/compare/v0.23.0...v0.23.1) (2026-06-16)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codehost",
-  "version": "0.23.1",
+  "version": "0.23.3",
   "type": "module",
   "repository": {
     "type": "git",

package/src/cli/commands/list.ts

@@ -9,15 +9,17 @@ export const listCommand: CommandModule = {
   handler: async () => {
     const detached = listFallbackDaemons();
     if (detached.length) {
-      console.log("Detached daemons (no oxmgr):");
+      console.log("Managed daemons (no oxmgr):");
       for (const d of detached) {
-        console.log(`  ${d.name}  pid ${d.pid}  ${d.cwd}  (log: ${d.log})`);
+        const backend = d.pm2 ? "pm2" : d.task ? "task" : `pid ${d.pid}`;
+        console.log(`  ${d.name}  [${backend}]  ${d.cwd}  (log: ${d.log})`);
       }
       console.log("");
     }
-    // Only hit oxmgr if it's actually runnable — `hasOxmgr` doesn't self-heal,
-    // so a broken install won't re-download its binary on every `list`.
-    if (await hasOxmgr()) {
+    // Windows never uses oxmgr (it manages via pm2/schtasks), so don't poke it
+    // there. Elsewhere, only hit oxmgr if it's actually runnable — `hasOxmgr`
+    // doesn't self-heal, so a broken install won't re-download on every `list`.
+    if (process.platform !== "win32" && (await hasOxmgr())) {
       const shown = await listDaemons();
       // listDaemons returns the count of codehost daemons (>=0) or -1 if oxmgr
       // is unusable; only the latter is an error exit. It prints its own

package/src/cli/commands/stop.ts

@@ -23,6 +23,11 @@ export const stopCommand: CommandModule<{}, StopArgs> = {
       console.log(`[codehost] stopped ${full}`);
       process.exit(0);
     }
+    // Windows manages via pm2/schtasks only — don't fall through to oxmgr there.
+    if (process.platform === "win32") {
+      console.error(`[codehost] no daemon named ${full}`);
+      process.exit(1);
+    }
     process.exit(await stopDaemon(argv.name));
   },
 };

package/src/cli/daemonize.ts

@@ -35,9 +35,11 @@ export interface ServeDaemonResult {
 /**
  * Launch a foreground `codehost serve` (without -d) so it survives the shell and
  * restarts on failure. Prefers oxmgr (which also adds login auto-start); when
- * oxmgr can't run here (e.g. broken native binary on Windows) it falls back to a
- * detached, self-restarting child instead of failing. `CODEHOST_NO_OXMGR=1`
- * forces the fallback. Shared by `serve -d` and `setup`.
+ * oxmgr can't run here it falls back to a managed daemon instead of failing —
+ * pm2 on Windows (hidden, restart + logon resurrect), a detached supervisor on
+ * POSIX. Windows skips oxmgr entirely (its native binary tends to hang/fail
+ * there) and goes straight to pm2. `CODEHOST_NO_OXMGR=1` forces the fallback on
+ * any platform. Shared by `serve -d` and `setup`.
  */
 export async function launchServeDaemon(opts: ServeDaemonOptions): Promise<ServeDaemonResult> {
   // Upgrade the global install (if that's how we're running) before spawning, so
@@ -49,7 +51,9 @@ export async function launchServeDaemon(opts: ServeDaemonOptions): Promise<Serve
   const name = daemonName(label);
   const argv = buildForegroundArgv(opts);
 
-  if (process.env.CODEHOST_NO_OXMGR !== "1") {
+  // Windows skips oxmgr (its native binary hangs/fails there) and uses pm2.
+  const useOxmgr = process.env.CODEHOST_NO_OXMGR !== "1" && process.platform !== "win32";
+  if (useOxmgr) {
     console.log(`[codehost] starting daemon "${name}" via oxmgr`);
     // startDaemon attempts to self-heal oxmgr once; false means it's unusable here.
     const ok = await startDaemon({ name, command: argv.map(quote).join(" "), cwd: opts.dir });
@@ -57,12 +61,13 @@ export async function launchServeDaemon(opts: ServeDaemonOptions): Promise<Serve
       console.log(`[codehost] daemon started. View: codehost list · Stop: codehost stop ${name}`);
       return { ok: true, name };
     }
-    console.warn("[codehost] oxmgr unavailable — falling back to a detached daemon (no login auto-start).");
+    console.warn("[codehost] oxmgr unavailable — falling back to a managed daemon.");
   }
 
+  console.log(`[codehost] starting daemon "${name}"…`);
   const ok = startFallbackDaemon({ name, argv, cwd: opts.dir });
   if (ok) {
-    console.log(`[codehost] detached daemon "${name}" started. View: codehost list · Stop: codehost stop ${name}`);
+    console.log(`[codehost] daemon "${name}" started. View: codehost list · Stop: codehost stop ${name}`);
   } else {
     console.error("[codehost] failed to start a detached daemon.");
   }

package/src/cli/fallback-daemon.ts

@@ -4,15 +4,17 @@ import { mkdirSync, openSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { killProcessTree } from "./proc";
+import { hasPm2, pm2Delete, pm2Online, pm2Start } from "./pm2";
 
 // A non-oxmgr daemon manager: keeps a server running across the shell without
-// depending on oxmgr's flaky native binary. Two backends:
-//   - Windows: a Scheduled Task (`schtasks`) — built in, always runnable, and it
-//     also auto-starts the server at logon. Unref'd child processes don't
-//     survive their launcher exiting on Windows, so a task is required.
-//   - POSIX: a detached, unref'd supervisor child (reparents to init).
-// Both run the same `__supervise` loop (restart-on-failure) and read their serve
-// argv from this registry by name, so the task/launch command stays short.
+// depending on oxmgr's flaky native binary. Backends, by platform:
+//   - Windows: pm2 (preferred) — restart-on-failure + logon resurrect, launched
+//     hidden so no console window appears (see pm2.ts). If pm2 isn't installed we
+//     fall back to a Scheduled Task (`schtasks`), which is always available and
+//     also auto-starts at logon. Unref'd children don't survive their launcher on
+//     Windows, so one of these managers is required.
+//   - POSIX: a detached, unref'd supervisor child (reparents to init), running the
+//     `__supervise` restart loop and reading its serve argv from this registry.
 
 const ROOT = join(homedir(), ".codehost");
 const REGISTRY = join(ROOT, "daemons.json");
@@ -29,7 +31,9 @@ export interface FallbackDaemon {
   startedAt: number;
   /** POSIX: supervisor process pid. */
   pid?: number;
-  /** Windows: scheduled-task name (equals `name`). */
+  /** Windows (pm2 backend): pm2 process name (equals `name`). */
+  pm2?: string;
+  /** Windows (schtasks backend): scheduled-task name (equals `name`). */
   task?: string;
   /** Pid of the serve child the supervisor last spawned (for tree-kill on stop). */
   servePid?: number;
@@ -91,7 +95,18 @@ export function startFallbackDaemon(opts: { name: string; argv: string[]; cwd: s
   const log = join(LOG_DIR, `${opts.name}.log`);
   upsert({ name: opts.name, cwd: opts.cwd, argv: opts.argv, log, startedAt: Date.now() });
 
-  return isWindows ? startWindowsTask(opts.name, log) : startUnixSupervisor(opts.name, log);
+  if (!isWindows) return startUnixSupervisor(opts.name, log);
+  // Windows: pm2 if available (hidden, restart + logon resurrect), else schtasks.
+  if (hasPm2() && startWindowsPm2(opts.name, opts.cwd, opts.argv, log)) return true;
+  return startWindowsTask(opts.name, log);
+}
+
+/** Windows pm2 backend: pm2 runs the serve argv directly (no supervisor loop —
+ *  pm2 owns restart-on-failure), launched hidden. argv[0] is the bun runtime. */
+function startWindowsPm2(name: string, cwd: string, argv: string[], log: string): boolean {
+  const ok = pm2Start({ name, cwd, script: argv[0], args: argv.slice(1), log });
+  if (ok) patch(name, { pm2: name });
+  return ok;
 }
 
 /** POSIX: detached, unref'd supervisor child that survives as an orphan. */
@@ -130,7 +145,9 @@ function startWindowsTask(name: string, log: string): boolean {
  *  long as their task is still registered (a Ready task is a valid auto-start). */
 export function listFallbackDaemons(): FallbackDaemon[] {
   const list = readRegistry();
-  const alive = list.filter((d) => (d.task ? taskExists(d.task) : d.pid != null && isAlive(d.pid)));
+  const alive = list.filter((d) =>
+    d.pm2 ? pm2Online(d.pm2) : d.task ? taskExists(d.task) : d.pid != null && isAlive(d.pid),
+  );
   if (alive.length !== list.length) writeRegistry(alive);
   return alive;
 }
@@ -140,7 +157,9 @@ export function stopFallbackDaemon(name: string): boolean {
   const list = readRegistry();
   const hit = list.find((d) => d.name === name);
   if (!hit) return false;
-  if (hit.task) {
+  if (hit.pm2) {
+    pm2Delete(hit.pm2); // pm2 stops + removes the managed process (incl. its child tree)
+  } else if (hit.task) {
     schtasks(["/end", "/tn", hit.task]);
     schtasks(["/delete", "/tn", hit.task, "/f"]);
     // /end hard-terminates the task's top process; kill the serve subtree (VS

package/src/cli/index.ts

@@ -1,4 +1,6 @@
 #!/usr/bin/env bun
+import "./tempenv"; // must be first: repair an unexpanded TEMP/TMP before any
+// native dep (node-datachannel/bun-pty) or child process reads it.
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 import { setupCommand } from "./commands/setup";

package/src/cli/pm2.ts

@@ -0,0 +1,134 @@
+import { type SpawnSyncOptions, spawnSync } from "node:child_process";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+// Windows daemon backend built on pm2 (https://pm2.keymetrics.io/). oxmgr's
+// native binary tends to hang/fail on Windows, so `serve -d` / `setup` manage the
+// foreground server with pm2 instead — it's a battle-tested, restart-on-failure
+// process manager the user likely already runs.
+//
+// Two Windows-specific wrinkles this module handles:
+//   1. pm2 is invoked via its resolved JS entry under the current runtime (bun) —
+//      never the bare `pm2` command, whose PATH shim has no .exe/.cmd extension
+//      so spawnSync can't resolve it (same trap as oxmgr).
+//   2. Starting pm2 (which forks its God daemon + the managed child) is routed
+//      through a hidden VBScript launcher so no console window ever flashes. A
+//      plain spawn with windowsHide isn't enough — the detached daemon and its
+//      fork would still pop their own windows.
+
+const require = createRequire(import.meta.url);
+const ROOT = join(homedir(), ".codehost");
+const TASK_DIR = join(ROOT, "tasks");
+
+/** Resolve pm2's CLI entry from a local dep or the bun/npm global install. */
+export function pm2Entry(): string | null {
+  const attempts: Array<() => string> = [
+    () => require.resolve("pm2/bin/pm2"),
+    () => createRequire(join(bunGlobalRoot(), "_")).resolve("pm2/bin/pm2"),
+  ];
+  for (const attempt of attempts) {
+    try {
+      return attempt();
+    } catch {
+      // try next
+    }
+  }
+  return null;
+}
+
+/** Where `bun add -g` drops global packages. */
+function bunGlobalRoot(): string {
+  const base = process.env.BUN_INSTALL ?? join(homedir(), ".bun");
+  return join(base, "install", "global", "node_modules");
+}
+
+/** True if a runnable pm2 is resolvable (so the Windows fallback can use it). */
+export function hasPm2(): boolean {
+  return pm2Entry() != null;
+}
+
+/** Run the pm2 CLI under the current runtime (bun). Window stays hidden. */
+function pm2(args: string[], opts: SpawnSyncOptions = {}) {
+  const entry = pm2Entry();
+  if (!entry) return { status: 1, stdout: "", stderr: "" } as const;
+  return spawnSync(process.execPath, [entry, ...args], { encoding: "utf8", windowsHide: true, ...opts });
+}
+
+/**
+ * Start (replacing any same-named instance) `script args` under pm2 with logs
+ * redirected to `log`, launched hidden so no window appears, and persist the
+ * process list (`pm2 save`). Returns true once pm2 reports the process online.
+ *
+ * Reboot auto-start is intentionally left to pm2's own startup integration
+ * (`pm2 save` records the list for `pm2 resurrect`): the Startup folder is often
+ * blocked by Controlled Folder Access and `schtasks /create` needs elevation, so
+ * auto-installing a logon hook here can't be done reliably.
+ */
+export function pm2Start(opts: { name: string; cwd: string; script: string; args: string[]; log: string }): boolean {
+  const entry = pm2Entry();
+  if (!entry) return false;
+
+  // `--interpreter none` execs the script (bun.exe) directly with the args after
+  // `--`, instead of trying to run it through node.
+  const start = [
+    process.execPath, entry, "start", opts.script,
+    "--name", opts.name,
+    "--cwd", opts.cwd,
+    "--interpreter", "none",
+    "--output", opts.log,
+    "--error", opts.log,
+    "--restart-delay", "2000",
+    "--", ...opts.args,
+  ];
+  const save = [process.execPath, entry, "save", "--force"];
+  runHidden([start, save], opts.name);
+
+  // pm2 start is synchronous (the hidden launcher waits), so liveness is the
+  // source of truth — more reliable than the launcher's exit code, which is the
+  // .cmd's last line.
+  return pm2Online(opts.name);
+}
+
+/** True if pm2 currently has `name` online. */
+export function pm2Online(name: string): boolean {
+  const r = pm2(["jlist"]);
+  if (r.status !== 0 || !r.stdout) return false;
+  try {
+    const list = JSON.parse(String(r.stdout)) as Array<{ name: string; pm2_env?: { status?: string } }>;
+    return list.some((p) => p.name === name && p.pm2_env?.status === "online");
+  } catch {
+    return false;
+  }
+}
+
+/** Stop + deregister a pm2-managed daemon and re-save the list. */
+export function pm2Delete(name: string): void {
+  pm2(["delete", name], { stdio: "ignore" });
+  pm2(["save", "--force"], { stdio: "ignore" });
+}
+
+/**
+ * Run one or more command argv's hidden, in order, waiting for completion. Writes
+ * a launcher .cmd (so we get normal Windows quoting, not VBS string escaping) and
+ * a .vbs that runs it with window style 0 via wscript (no console host at all).
+ */
+function runHidden(commands: string[][], name: string): void {
+  mkdirSync(TASK_DIR, { recursive: true });
+  const cmdPath = join(TASK_DIR, `${name}.pm2.cmd`);
+  const vbsPath = join(TASK_DIR, `${name}.pm2.vbs`);
+  const body = ["@echo off", ...commands.map(quoteCmd)].join("\r\n") + "\r\n";
+  writeFileSync(cmdPath, body);
+  // Hidden launcher: wscript (no console host) runs the .cmd with window style 0
+  // and waits. The path is wrapped in literal quotes — in VBS source a `"` inside
+  // a string is written `""`, so a quoted path becomes `"""<path>"""`.
+  writeFileSync(vbsPath, `Set sh = CreateObject("WScript.Shell")\r\nsh.Run """${cmdPath}""", 0, True\r\n`);
+  spawnSync("wscript", ["//B", "//Nologo", vbsPath], { windowsHide: true });
+}
+
+/** Quote an argv into a single cmd.exe command line. Paths/tokens here never
+ *  contain double quotes, so simple space-aware quoting is sufficient. */
+function quoteCmd(argv: string[]): string {
+  return argv.map((a) => (/[\s&|<>^()]/.test(a) ? `"${a}"` : a)).join(" ");
+}

package/src/cli/run-server.ts

@@ -56,6 +56,13 @@ export interface RunServerOptions {
 /** How often a daemon re-enumerates its workspaces (manual clones show up). */
 const META_REFRESH_MS = 60_000;
 
+/** Floor between meta pushes to the room. `serve` re-evaluates meta every ~3s so
+ *  live agent titles stay fresh, but each push is a billable DO request that
+ *  fans out to every peer — so coalesce bursts (a churning agent title) into at
+ *  most one push per this interval. The first change in a quiet period goes out
+ *  immediately; rapid follow-ups ride a single trailing push. */
+const MIN_META_PUSH_MS = 15_000;
+
 /**
  * Foreground server loop shared by `serve`, `dev`, and `expose`: register in the
  * signaling room with the given meta and bridge each client's data channel to a
@@ -113,15 +120,36 @@ export async function runServer(opts: RunServerOptions): Promise<never> {
     onSignal: (from, data) => rtc.handleSignal(from, data),
   });
 
-  // Re-advertise when the workspace set changes (provision, manual clone).
-  let lastMeta = JSON.stringify(opts.meta);
+  // Re-advertise when the workspace set changes (provision, manual clone),
+  // throttled so a burst of changes is at most one room push per MIN_META_PUSH_MS.
+  let sentMeta = JSON.stringify(opts.meta); // last meta the room actually has
+  let lastPushAt = 0; // ms of the last updateMeta send (0 = none since connect)
+  let pushTimer: ReturnType<typeof setTimeout> | null = null;
+  const sendMeta = (meta: PeerMeta) => {
+    const s = JSON.stringify(meta);
+    if (s === sentMeta) return; // nothing new since the last push
+    sentMeta = s;
+    lastPushAt = Date.now();
+    client.updateMeta(meta);
+  };
   const refreshMeta = () => {
     if (!opts.refreshMeta) return;
     const meta = opts.refreshMeta();
-    const s = JSON.stringify(meta);
-    if (s === lastMeta) return;
-    lastMeta = s;
-    client.updateMeta(meta);
+    if (JSON.stringify(meta) === sentMeta) return; // unchanged — nothing to do
+    const wait = MIN_META_PUSH_MS - (Date.now() - lastPushAt);
+    if (wait <= 0) {
+      // Cooldown elapsed: push the leading change now, dropping any pending one.
+      if (pushTimer) clearTimeout(pushTimer);
+      pushTimer = null;
+      sendMeta(meta);
+    } else if (!pushTimer) {
+      // Within the cooldown: schedule one trailing push that re-reads the
+      // freshest meta when it fires, so coalesced changes all ship at once.
+      pushTimer = setTimeout(() => {
+        pushTimer = null;
+        sendMeta(opts.refreshMeta!());
+      }, wait);
+    }
   };
   const provision: ProvisionDeps | undefined = opts.provision
     ? { ...opts.provision, onProvisioned: refreshMeta }

package/src/cli/tempenv.test.ts

@@ -0,0 +1,32 @@
+import { describe, expect, test } from "bun:test";
+import { expandWinVars, normalizeTempEnv } from "./tempenv";
+
+describe("expandWinVars", () => {
+  test("expands a known %VAR% from the given env", () => {
+    expect(expandWinVars("%USERPROFILE%\\AppData\\Local\\Temp", { USERPROFILE: "C:\\Users\\x" })).toBe(
+      "C:\\Users\\x\\AppData\\Local\\Temp",
+    );
+  });
+
+  test("leaves unknown vars untouched", () => {
+    expect(expandWinVars("%NOPE%\\a", {})).toBe("%NOPE%\\a");
+  });
+
+  test("passes through a path with no vars", () => {
+    expect(expandWinVars("C:\\Users\\x\\AppData\\Local\\Temp", {})).toBe("C:\\Users\\x\\AppData\\Local\\Temp");
+  });
+});
+
+describe("normalizeTempEnv", () => {
+  test("rewrites a literal %USERPROFILE% TEMP to a real path (win32)", () => {
+    if (process.platform !== "win32") return; // no-op off Windows
+    const saved = process.env.TEMP;
+    try {
+      process.env.TEMP = "%USERPROFILE%\\AppData\\Local\\Temp";
+      normalizeTempEnv();
+      expect(process.env.TEMP).not.toContain("%");
+    } finally {
+      process.env.TEMP = saved;
+    }
+  });
+});

package/src/cli/tempenv.ts

@@ -0,0 +1,53 @@
+import { mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+// Importing this module repairs a broken TEMP/TMP as a side effect, as early as
+// possible — before any native dep (node-datachannel/bun-pty) or child process
+// reads it. See normalizeTempEnv for the why.
+
+/** Expand `%VAR%` references in `value` against `env`; unknown vars are left
+ *  as-is. (`%VAR%` is cmd.exe syntax — bun/node/bash never expand it.) */
+export function expandWinVars(value: string, env: NodeJS.ProcessEnv = process.env): string {
+  return value.replace(/%([^%]+)%/g, (whole, name) => env[name] ?? whole);
+}
+
+/**
+ * Repair an unexpanded TEMP/TMP on Windows. Windows stores them in the registry
+ * as REG_EXPAND_SZ — literally `%USERPROFILE%\AppData\Local\Temp` — and some
+ * launch contexts (services, scheduled tasks, a parent started by one) pass that
+ * string through without expanding it. bun/node/bash don't expand `%VAR%`, so
+ * every temp write then resolves *relative to cwd*, littering the working dir
+ * with a `%USERPROFILE%/AppData/Local/Temp` tree (we hit ~1GB of this inside
+ * provisioned worktrees). Expand it in-process so the server, its native deps,
+ * and every spawned child get a real temp dir. Idempotent; no-op off Windows.
+ */
+export function normalizeTempEnv(): void {
+  if (process.platform !== "win32") return;
+  for (const key of ["TEMP", "TMP"]) {
+    const raw = process.env[key];
+    if (!raw || !raw.includes("%")) continue; // already a real path
+    const expanded = expandWinVars(raw);
+    // If any var was still unresolved, or the dir can't be created, fall back to
+    // the canonical per-user temp under the (always-expanded) home dir.
+    const fixed = expanded.includes("%") || !ensureDir(expanded) ? fallbackTemp() : expanded;
+    process.env[key] = fixed;
+  }
+}
+
+function fallbackTemp(): string {
+  const dir = join(homedir(), "AppData", "Local", "Temp");
+  ensureDir(dir);
+  return dir;
+}
+
+function ensureDir(path: string): boolean {
+  try {
+    mkdirSync(path, { recursive: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+normalizeTempEnv();