cotal-ai 0.94.4 → 0.94.5

package/dist/daemon/client.js

@@ -59,10 +59,23 @@ function readLine(sock, timeoutMs) {
 }
 /** Send one request and return the daemon's parsed reply. */
 export async function queryDaemon(opts) {
+    const sock = await openVerified(opts);
+    try {
+        const line = opts.rawLine !== undefined ? `${opts.rawLine}\n` : encode({ v: DAEMON_PROTOCOL_VERSION, id: randomUUID().replaceAll("-", ""), op: "status" });
+        (opts.counters ?? { bytesWritten: 0 }).bytesWritten += Buffer.byteLength(line, "utf8");
+        sock.write(line);
+        const reply = await readLine(sock, opts.timeoutMs ?? 5000);
+        return JSON.parse(reply);
+    }
+    finally {
+        sock.destroy();
+    }
+}
+/** Connect only after the directory and socket checks pass, and keep the connection only when the
+ *  kernel reports the listener as this same uid. Nothing is written before both. */
+async function openVerified(opts) {
     assertLinux();
     const uid = opts.uid ?? process.geteuid();
-    const timeoutMs = opts.timeoutMs ?? 5000;
-    const counters = opts.counters ?? { bytesWritten: 0 };
     const { paths } = opts;
     try {
         checkDir(paths.dir, uid);
@@ -73,22 +86,68 @@ export async function queryDaemon(opts) {
             throw new EndpointRefusal("NOT_RUNNING", `no daemon endpoint at ${paths.socket}`);
         throw e;
     }
-    const sock = await connectTo(paths.socket, timeoutMs);
+    const sock = await connectTo(paths.socket, opts.timeoutMs ?? 5000);
+    let peer;
     try {
-        let peer;
-        try {
-            peer = opts.peerUid(sock);
-        }
-        catch (e) {
-            throw new EndpointRefusal("PEER_UID_MISMATCH", `could not read the daemon's peer credentials: ${e.message}`);
-        }
-        if (peer !== uid)
-            throw new EndpointRefusal("PEER_UID_MISMATCH", `the process answering at ${paths.socket} runs as uid ${peer}, not ${uid}; nothing was sent`);
-        const line = opts.rawLine !== undefined ? `${opts.rawLine}\n` : encode({ v: DAEMON_PROTOCOL_VERSION, id: randomUUID().replaceAll("-", ""), op: "status" });
-        counters.bytesWritten += Buffer.byteLength(line, "utf8");
-        sock.write(line);
-        const reply = await readLine(sock, timeoutMs);
-        return JSON.parse(reply);
+        peer = opts.peerUid(sock);
+    }
+    catch (e) {
+        sock.destroy();
+        throw new EndpointRefusal("PEER_UID_MISMATCH", `could not read the daemon's peer credentials: ${e.message}`);
+    }
+    if (peer !== uid) {
+        sock.destroy();
+        throw new EndpointRefusal("PEER_UID_MISMATCH", `the process answering at ${paths.socket} runs as uid ${peer}, not ${uid}; nothing was sent`);
+    }
+    return sock;
+}
+/** Ask the daemon to sign in, show its prompt, and return its single result. */
+export async function loginViaDaemon(opts) {
+    const sock = await openVerified(opts);
+    try {
+        const id = randomUUID().replaceAll("-", "");
+        return await new Promise((resolve, reject) => {
+            let buf = "";
+            let attempt;
+            const cleanup = () => { sock.removeAllListeners("data"); sock.removeAllListeners("end"); sock.removeAllListeners("error"); opts.signal?.removeEventListener("abort", onAbort); };
+            const finish = (r) => { cleanup(); if (r instanceof Error)
+                reject(r);
+            else
+                resolve(r); };
+            const abandoned = { ok: false, code: "ABANDONED", message: "stopped before the daemon showed a prompt; the connection was closed, which cancels the sign-in on the daemon" };
+            const onAbort = () => {
+                if (!attempt)
+                    return finish(abandoned);
+                sock.write(encode({ v: DAEMON_PROTOCOL_VERSION, id: `${id}c`.slice(0, 64), op: "login-cancel", attempt }));
+            };
+            sock.setEncoding("utf8");
+            sock.on("data", (chunk) => {
+                buf += chunk;
+                if (Buffer.byteLength(buf, "utf8") > MAX_LINE_BYTES && !buf.includes("\n"))
+                    return finish(new Error("daemon reply exceeds the line limit"));
+                let nl;
+                while ((nl = buf.indexOf("\n")) !== -1) {
+                    const msg = JSON.parse(buf.slice(0, nl));
+                    buf = buf.slice(nl + 1);
+                    if (msg.id !== id)
+                        continue;
+                    if (!msg.ok)
+                        return finish({ ok: false, code: msg.error.code, message: msg.error.message });
+                    if ("event" in msg && msg.event === "login-prompt") {
+                        attempt = msg.attempt;
+                        opts.onPrompt(msg.prompt);
+                    }
+                    else if ("event" in msg && msg.event === "login-result")
+                        return finish({ ok: true, attempt: msg.attempt, result: msg.result });
+                }
+            });
+            sock.once("end", () => finish(new Error("the daemon closed the connection before the sign-in finished")));
+            sock.once("error", (e) => finish(e));
+            if (opts.signal?.aborted)
+                return finish(abandoned);
+            opts.signal?.addEventListener("abort", onAbort, { once: true });
+            sock.write(encode({ v: DAEMON_PROTOCOL_VERSION, id, op: "login-start", idp: opts.idp, ...(opts.clientId !== undefined ? { clientId: opts.clientId } : {}) }));
+        });
     }
     finally {
         sock.destroy();

package/dist/daemon/command.js

@@ -3,22 +3,31 @@
  * in an `implementations/*` package so it can later wire `@cotal-ai/auth` and `@cotal-ai/manager`
  * without one implementation importing another (AGENTS.md, repository map).
  *
- * This slice serves a local, authenticated status endpoint and nothing else: no sign-in, no
- * Manager, no service install. Linux only. It is a foreground foundation, not a resilient machine
- * service: a daemon killed without cleanup leaves its socket behind, and the next start refuses
- * until the operator removes it (see the ALREADY_RUNNING remedy). `state: "ready"` means the local
- * control listener is bound and verified; it says nothing about any mesh or Cloud connection.
+ * This slice serves a local, authenticated endpoint for status and sign-in, and nothing else: no
+ * Manager, no mesh or Cloud connection, no service install. Linux only. Sign-in runs inside the
+ * daemon through stock `establishIdpSession`, so the session lands in the machine-home Cotal
+ * directory where `cotal login` keeps it, and no token ever crosses the local endpoint. It is a
+ * foreground foundation, not a resilient machine service: a daemon killed without cleanup leaves
+ * its socket behind, and the next start refuses until the operator removes it (see the
+ * ALREADY_RUNNING remedy). `state: "ready"` means the local control listener is bound and
+ * verified; it says nothing about any mesh or Cloud connection.
  */
 import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { registry } from "@cotal-ai/core";
-import { CommandFailure, jsonFlag, plainFlag, presentationOf, writeResult } from "@cotal-ai/workspace";
+import { CommandFailure, jsonFlag, plainFlag, presentationOf, renderReport, terminalWidth, writeResult } from "@cotal-ai/workspace";
 import { peerCredentials } from "@cotal-ai/seat";
+import { normalizeIdpUrl } from "@cotal-ai/auth";
 import { EndpointRefusal, daemonPaths } from "./endpoint.js";
 import { serveDaemon } from "./server.js";
-import { queryDaemon } from "./client.js";
-export const daemonFlags = [jsonFlag, plainFlag];
+import { loginViaDaemon, queryDaemon } from "./client.js";
+export const daemonFlags = [
+    jsonFlag,
+    plainFlag,
+    { name: "idp", type: "string", value: "<auth base URL>", description: "login: the provider's auth base URL, e.g. <origin>/api/auth" },
+    { name: "client-id", type: "string", value: "<id>", description: "login: the OAuth device-flow client id" },
+];
 /** This binary's own version: the nearest package.json above this module (bin/ in a source run). */
 export function binVersion() {
     let dir = dirname(fileURLToPath(import.meta.url));
@@ -73,6 +82,70 @@ async function status(args) {
         throw new CommandFailure("failed", "OPERATION_FAILED", `the daemon refused the status request: ${reply.error.code} ${reply.error.message}`);
     writeResult(presentation, { command: "daemon status", target: null, result: reply.result }, statusView);
 }
+/** Sign in through the running daemon. The daemon talks to the IdP and keeps the session; this
+ *  process only shows the approval prompt and the result, and never sees a token. Ctrl-C asks the
+ *  daemon to cancel the attempt and waits for its answer. */
+async function login(args) {
+    const presentation = presentationOf(args.values);
+    const values = args.values;
+    if (typeof values.idp !== "string")
+        throw new CommandFailure("refused", "USAGE_INVALID", "cotal daemon login needs --idp <auth base URL>");
+    let idp;
+    try {
+        idp = normalizeIdpUrl(values.idp);
+    }
+    catch {
+        throw new CommandFailure("refused", "USAGE_INVALID", "use an HTTPS provider auth URL, or an HTTP loopback IP URL, without embedded credentials, a query or a fragment");
+    }
+    if (values["client-id"] !== undefined && !values["client-id"].trim())
+        throw new CommandFailure("refused", "USAGE_INVALID", "--client-id cannot be empty");
+    const abort = new AbortController();
+    const onSignal = () => abort.abort();
+    process.once("SIGINT", onSignal);
+    let reply;
+    try {
+        reply = await loginViaDaemon({
+            paths: daemonPaths(), peerUid, idp, signal: abort.signal,
+            ...(values["client-id"] !== undefined ? { clientId: values["client-id"] } : {}),
+            onPrompt: (p) => {
+                process.stderr.write(`${renderReport({ sections: [{ title: "Approve sign-in", blocks: [
+                                { kind: "fields", rows: [["Provider", idp], ["Open", p.verificationUriComplete], ["Or open", p.verificationUri], ["Approval code", p.userCode], ["Expires", p.expiresAt]] },
+                                { kind: "lines", lines: [{ text: "Waiting for the provider's approval. The daemon keeps the session. Ctrl-C cancels this sign-in on this machine. Do not share the approval link or code.", tone: "hint" }] },
+                            ] }] }, presentation === "plain" ? "plain" : "rich", terminalWidth(process.stderr))}\n`);
+            },
+        });
+    }
+    catch (e) {
+        throw asFailure(e);
+    }
+    finally {
+        process.off("SIGINT", onSignal);
+    }
+    if (!reply.ok) {
+        if (reply.code === "LOGIN_IN_PROGRESS")
+            throw new CommandFailure("refused", "CONFLICT", reply.message, { native: { code: reply.code } });
+        if (reply.code === "ABANDONED")
+            throw new CommandFailure("refused", "USAGE_INVALID", reply.message, { native: { code: reply.code } });
+        throw new CommandFailure("failed", "OPERATION_FAILED", `the daemon refused the sign-in: ${reply.code} ${reply.message}`, { native: { code: reply.code } });
+    }
+    const r = reply.result;
+    if (r.outcome === "cancelled")
+        throw new CommandFailure("refused", "USAGE_INVALID", "the sign-in was cancelled on this machine; nothing was saved and nothing was revoked at the provider", { native: { code: "CANCELLED" } });
+    if (r.outcome === "failed") {
+        const native = { native: { code: r.reason.toUpperCase() } };
+        // Denied, expired and unreachable end before stock writes anything: refusals at the provider's
+        // boundary. Any other failure can come after stock saved the session, so it claims nothing about
+        // what was saved; `cotal daemon login` again replaces whatever is there.
+        if (r.reason === "unreachable")
+            throw new CommandFailure("refused", "DEPENDENCY_UNAVAILABLE", `${r.message}; no session was saved`, native);
+        if (r.reason === "denied" || r.reason === "expired")
+            throw new CommandFailure("refused", "PERMISSION_DENIED", `${r.message}; no session was saved`, native);
+        throw new CommandFailure("failed", "OPERATION_FAILED", `${r.message}; a session may have been saved before the failure, so sign in again`, native);
+    }
+    writeResult(presentation, { command: "daemon login", target: { idp }, result: { attempt: reply.attempt, ...r } }, () => ({ sections: [
+            { title: "Signed in", blocks: [{ kind: "fields", rows: [["Account", r.label || r.sub], ["Subject", r.sub], ["Provider", r.idp]] }, { kind: "lines", lines: [{ text: "The daemon holds this session in the machine's Cotal home. No session token is printed. Each space's grants decide access separately.", tone: "hint" }] }] },
+        ] }));
+}
 async function serve() {
     let running;
     try {
@@ -96,21 +169,24 @@ async function run(args) {
         return status(args);
     if (mode === "serve")
         return serve();
-    throw new CommandFailure("refused", "USAGE_INVALID", mode === undefined ? "cotal daemon needs a mode: status or serve" : `unknown daemon mode ${JSON.stringify(mode)}`, { remedy: "cotal daemon status" });
+    if (mode === "login")
+        return login(args);
+    throw new CommandFailure("refused", "USAGE_INVALID", mode === undefined ? "cotal daemon needs a mode: status, serve or login" : `unknown daemon mode ${JSON.stringify(mode)}`, { remedy: "cotal daemon status" });
 }
 const daemonCommand = {
     kind: "command",
     name: "daemon",
     group: "Manager",
-    summary: "the local machine daemon (Linux): serve its control endpoint, read its status",
-    positionals: "<status|serve>",
+    summary: "the local machine daemon (Linux): serve its control endpoint, read its status, sign it in",
+    positionals: "<status|serve|login>",
     flags: daemonFlags,
     subcommands: [
-        { name: "status", summary: "ask the running daemon for its status over the local endpoint", outputs: ["json", "plain"], reads: true, prepareMeshTarget: false },
+        { name: "status", summary: "ask the running daemon for its status over the local endpoint", flagNames: ["json", "plain"], outputs: ["json", "plain"], reads: true, prepareMeshTarget: false },
         { name: "serve", summary: "run the daemon in the foreground and serve its local endpoint (refusals honor --json)", flagNames: ["json", "plain"], outputs: ["json", "plain"], prepareMeshTarget: false },
+        { name: "login", summary: "sign the running daemon in to a provider with device approval; the daemon keeps the session", flagNames: ["idp", "client-id", "json", "plain"], outputs: ["json", "plain"], prepareMeshTarget: false },
     ],
     prepareMeshTarget: false,
-    examples: ["cotal daemon serve", "cotal daemon status", "cotal daemon status --json"],
+    examples: ["cotal daemon serve", "cotal daemon status", "cotal daemon status --json", "cotal daemon login --idp https://example.org/api/auth"],
     run,
 };
 registry.register(daemonCommand);

package/dist/daemon/login.js

@@ -0,0 +1,111 @@
+/**
+ * The daemon's local sign-in: one attempt at a time, driven through stock `establishIdpSession`,
+ * which persists the session through the stock writer and fences persistence on its AbortSignal.
+ *
+ * Attempts are named by a daemon-minted id. A cancel names the attempt it means, so a cancel aimed
+ * at a finished attempt can never stop its successor. A cancel is answered only after the attempt
+ * has settled, meaning its result has been delivered to the requester, and it answers with what
+ * actually happened: `cancelled` when the stock fence stopped it before anything was persisted,
+ * `completed` when it had already finished (or finished while the cancel raced it), and `not-found`
+ * for an attempt this daemon never started or no longer remembers. Until that delivery the attempt
+ * stays in flight, so no second sign-in starts underneath an undelivered result.
+ *
+ * A failure crosses the endpoint as a fixed sentence per reason. Stock error text can quote the
+ * provider's answer, so none of it is relayed.
+ *
+ * Cancelling stops this local sign-in. It does not revoke anything at the IdP.
+ */
+import { randomBytes } from "node:crypto";
+import { establishIdpSession, IdpLoginCancelled, IdpUnreachableError } from "@cotal-ai/auth";
+/** The client id stock `cotal login` presents by default. */
+export const DEFAULT_CLIENT_ID = "cotal-cli";
+/** How many finished attempt ids are remembered, so a late cancel still gets a truthful answer. */
+const REMEMBERED = 16;
+/** The only failure text a requester sees. It never quotes the provider or a stock error. */
+const FAILURE = {
+    denied: "the sign-in was denied at the verification page",
+    expired: "the approval code expired before the sign-in was approved",
+    unreachable: "the provider could not be reached",
+    refused: "the provider's answer could not be used to sign in",
+};
+const failed = (reason) => ({ outcome: "failed", reason, message: FAILURE[reason] });
+export function createLoginCoordinator(opts) {
+    const establish = opts.establish ?? establishIdpSession;
+    let current;
+    const finished = new Map();
+    const remember = (id, outcome) => {
+        finished.set(id, outcome);
+        while (finished.size > REMEMBERED)
+            finished.delete(finished.keys().next().value);
+    };
+    const run = async (id, abort, req) => {
+        try {
+            const r = await establish({
+                dir: opts.sessionDir,
+                idpUrl: req.idp,
+                clientId: req.clientId ?? DEFAULT_CLIENT_ID,
+                signal: abort.signal,
+                onPrompt: (p) => req.onPrompt(id, {
+                    verificationUri: p.verificationUri,
+                    verificationUriComplete: p.verificationUriComplete,
+                    userCode: p.userCode,
+                    expiresAt: new Date(Date.now() + p.expiresInSec * 1000).toISOString(),
+                }),
+            });
+            return { outcome: "signed-in", idp: req.idp, sub: r.sub, ...(r.label ? { label: r.label } : {}), ...(r.previousSub ? { previousSub: r.previousSub } : {}) };
+        }
+        catch (e) {
+            if (e instanceof IdpLoginCancelled)
+                return { outcome: "cancelled" };
+            if (e instanceof IdpUnreachableError)
+                return failed("unreachable");
+            // Stock throws plain Errors for these two IdP answers; match their exact sentences.
+            const message = e instanceof Error ? e.message : "";
+            if (message.startsWith("idp login: the sign-in was denied at the verification page"))
+                return failed("denied");
+            if (message.startsWith("idp login: the device code expired"))
+                return failed("expired");
+            return failed("refused");
+        }
+    };
+    return {
+        start(req) {
+            if (current)
+                return undefined;
+            const id = randomBytes(16).toString("base64url").slice(0, 22);
+            const abort = new AbortController();
+            const settled = run(id, abort, req).then(async (result) => {
+                try {
+                    await req.onResult(id, result);
+                }
+                finally {
+                    remember(id, result.outcome);
+                    if (current?.id === id)
+                        current = undefined;
+                }
+                return result;
+            });
+            current = { id, abort, settled };
+            return { attempt: id, settled };
+        },
+        async cancel(attempt) {
+            if (current?.id === attempt) {
+                const live = current;
+                live.abort.abort();
+                const result = await live.settled;
+                return { outcome: result.outcome === "cancelled" ? "cancelled" : "completed", attempt };
+            }
+            const past = finished.get(attempt);
+            if (past === undefined)
+                return { outcome: "not-found", attempt };
+            return { outcome: past === "cancelled" ? "cancelled" : "completed", attempt };
+        },
+        async close() {
+            const live = current;
+            if (!live)
+                return;
+            live.abort.abort();
+            await live.settled;
+        },
+    };
+}

package/dist/daemon/protocol.js

@@ -1,14 +1,31 @@
 /**
  * The closed, versioned wire contract of the local daemon endpoint: one JSON object per line.
  *
- * A request is exactly `{ v, id, op }`. Any other key, any other version, an unknown op, a line
- * that is not a JSON object, or a line over {@link MAX_LINE_BYTES} is refused before any effect,
- * with a typed error. Responses echo the request id when one could be read.
+ * A request names `{ v, id, op }` plus exactly the fields its op declares. Any other key, any other
+ * version, an unknown op, a field of the wrong shape, a line that is not a JSON object, or a line
+ * over {@link MAX_LINE_BYTES} is refused before any effect, with a typed error. Responses echo the
+ * request id when one could be read.
+ *
+ * Sign-in streams: `login-start` answers with one `login-prompt` event, then exactly one
+ * `login-result` event, both tagged with the request id and the attempt id. No frame carries a
+ * session, token, JWT or device code; the verification URL and user code are the only IdP values
+ * the requester sees, because a person must type them.
  */
+import { normalizeIdpUrl } from "@cotal-ai/auth";
 import { DAEMON_PROTOCOL_VERSION, MAX_LINE_BYTES } from "./endpoint.js";
-export const DAEMON_OPS = ["status"];
-const REQUEST_KEYS = new Set(["v", "id", "op"]);
+export const DAEMON_OPS = ["status", "login-start", "login-cancel"];
+/** The fields each op takes besides `v`, `id` and `op`. Required ones must be present. */
+const OP_FIELDS = {
+    status: { required: [], optional: [] },
+    "login-start": { required: ["idp"], optional: ["clientId"] },
+    "login-cancel": { required: ["attempt"], optional: [] },
+};
+const ENVELOPE_KEYS = new Set(["v", "id", "op"]);
 const ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+/** An attempt id is daemon-minted: 22 characters of base64url. */
+export const ATTEMPT_PATTERN = /^[A-Za-z0-9_-]{22}$/;
+const MAX_CLIENT_ID = 128;
+const bad = (id, message) => ({ ok: false, id, code: "BAD_FIELD", message });
 /** Parse one line (without its newline). Pure: it decides, it does nothing. */
 export function parseRequest(line) {
     if (Buffer.byteLength(line, "utf8") + 1 > MAX_LINE_BYTES)
@@ -24,17 +41,38 @@ export function parseRequest(line) {
         return { ok: false, id: null, code: "NOT_OBJECT", message: "request must be a JSON object" };
     const obj = raw;
     const id = typeof obj.id === "string" && ID_PATTERN.test(obj.id) ? obj.id : null;
+    const op = typeof obj.op === "string" && DAEMON_OPS.includes(obj.op) ? obj.op : undefined;
+    const fields = op ? OP_FIELDS[op] : { required: [], optional: [] };
     for (const k of Object.keys(obj)) {
-        if (!REQUEST_KEYS.has(k))
+        if (!ENVELOPE_KEYS.has(k) && !fields.required.includes(k) && !fields.optional.includes(k))
             return { ok: false, id, code: "UNKNOWN_FIELD", message: `unknown request field ${JSON.stringify(k)}` };
     }
     if (obj.v !== DAEMON_PROTOCOL_VERSION)
         return { ok: false, id, code: "BAD_VERSION", message: `unsupported protocol version ${JSON.stringify(obj.v)}; this daemon speaks ${DAEMON_PROTOCOL_VERSION}` };
     if (id === null)
         return { ok: false, id: null, code: "BAD_ID", message: "request id must be 1-64 characters of [A-Za-z0-9_-]" };
-    if (typeof obj.op !== "string" || !DAEMON_OPS.includes(obj.op))
+    if (!op)
         return { ok: false, id, code: "UNKNOWN_OP", message: `unknown op ${JSON.stringify(obj.op)}` };
-    return { ok: true, request: { v: DAEMON_PROTOCOL_VERSION, id, op: obj.op } };
+    const v = DAEMON_PROTOCOL_VERSION;
+    if (op === "status")
+        return { ok: true, request: { v, id, op } };
+    if (op === "login-cancel") {
+        if (typeof obj.attempt !== "string" || !ATTEMPT_PATTERN.test(obj.attempt))
+            return bad(id, "attempt must be the 22-character attempt id from login-prompt");
+        return { ok: true, request: { v, id, op, attempt: obj.attempt } };
+    }
+    if (typeof obj.idp !== "string")
+        return bad(id, "idp must be the provider's auth base URL");
+    let idp;
+    try {
+        idp = normalizeIdpUrl(obj.idp);
+    }
+    catch {
+        return bad(id, "idp must be an HTTPS auth URL, or an HTTP loopback IP URL, without embedded credentials, a query or a fragment");
+    }
+    if (obj.clientId !== undefined && (typeof obj.clientId !== "string" || !obj.clientId.trim() || obj.clientId.length > MAX_CLIENT_ID))
+        return bad(id, `clientId must be a non-empty string of at most ${MAX_CLIENT_ID} characters`);
+    return { ok: true, request: { v, id, op, idp, ...(obj.clientId !== undefined ? { clientId: obj.clientId } : {}) } };
 }
 export function encode(msg) {
     return `${JSON.stringify(msg)}\n`;

package/dist/daemon/server.js

@@ -14,6 +14,10 @@ import { join } from "node:path";
 import { createServer } from "node:net";
 import { DAEMON_PROTOCOL_VERSION, MAX_LINE_BYTES, EndpointRefusal, assertLinux, checkSocket, ensureDir, refuseExisting } from "./endpoint.js";
 import { encode, parseRequest } from "./protocol.js";
+import { createLoginCoordinator } from "./login.js";
+import { homeCotalDir } from "@cotal-ai/workspace";
+/** Requests one connection may send. A sign-in needs two (start, cancel); status polling a few. */
+export const MAX_REQUESTS_PER_CONNECTION = 64;
 function listen(server, path) {
     return new Promise((resolve, reject) => {
         const onError = (e) => {
@@ -36,7 +40,8 @@ export async function serveDaemon(opts) {
     const { paths } = opts;
     const dirOutcome = ensureDir(paths.dir, uid);
     refuseExisting(paths.socket);
-    const counters = { accepted: 0, peerRejected: 0, framesDecoded: 0, requestsRefused: 0, statusAnswered: 0 };
+    const counters = { accepted: 0, peerRejected: 0, framesDecoded: 0, requestsRefused: 0, statusAnswered: 0, loginsStarted: 0, loginsRefused: 0, cancelsAnswered: 0 };
+    const login = opts.login ?? createLoginCoordinator({ sessionDir: opts.sessionDir ?? homeCotalDir() });
     const startedAt = new Date();
     const status = () => ({
         state: "ready",
@@ -70,6 +75,64 @@ export async function serveDaemon(opts) {
         counters.accepted++;
         let buf = "";
         let bufBytes = 0;
+        let requests = 0;
+        // Sign-in attempts this connection started that have not settled. Closing the connection
+        // before the result cancels them through the stock fence, so nothing is persisted for a
+        // requester that went away. Once the result is delivered the attempt is no longer here, so a
+        // close after it changes nothing.
+        const owned = new Set();
+        const write = (r) => new Promise((resolve) => {
+            if (sock.destroyed || !sock.writable)
+                return resolve();
+            sock.write(encode(r), () => resolve());
+        });
+        const refuse = (id, code, message) => {
+            counters.requestsRefused++;
+            return write({ v: DAEMON_PROTOCOL_VERSION, id, ok: false, error: { code, message } });
+        };
+        sock.once("close", () => {
+            for (const attempt of owned)
+                void login.cancel(attempt);
+            owned.clear();
+        });
+        const handle = (line) => {
+            counters.framesDecoded++;
+            const parsed = parseRequest(line);
+            if (!parsed.ok) {
+                counters.requestsRefused++;
+                void write({ v: DAEMON_PROTOCOL_VERSION, id: parsed.id, ok: false, error: { code: parsed.code, message: parsed.message } });
+                return;
+            }
+            const req = parsed.request;
+            if (req.op === "status") {
+                counters.statusAnswered++;
+                void write({ v: DAEMON_PROTOCOL_VERSION, id: req.id, ok: true, result: status() });
+                return;
+            }
+            if (req.op === "login-cancel") {
+                void login.cancel(req.attempt).then((result) => {
+                    counters.cancelsAnswered++;
+                    return write({ v: DAEMON_PROTOCOL_VERSION, id: req.id, ok: true, result });
+                });
+                return;
+            }
+            const started = login.start({
+                idp: req.idp,
+                ...(req.clientId !== undefined ? { clientId: req.clientId } : {}),
+                onPrompt: (attempt, prompt) => void write({ v: DAEMON_PROTOCOL_VERSION, id: req.id, ok: true, event: "login-prompt", attempt, prompt }),
+                onResult: async (attempt, result) => {
+                    owned.delete(attempt);
+                    await write({ v: DAEMON_PROTOCOL_VERSION, id: req.id, ok: true, event: "login-result", attempt, result });
+                },
+            });
+            if (!started) {
+                counters.loginsRefused++;
+                void refuse(req.id, "LOGIN_IN_PROGRESS", "a sign-in is already in progress on this daemon; cancel it or wait for its result");
+                return;
+            }
+            counters.loginsStarted++;
+            owned.add(started.attempt);
+        };
         sock.setEncoding("utf8");
         sock.on("data", (chunk) => {
             buf += chunk;
@@ -91,15 +154,15 @@ export async function serveDaemon(opts) {
                 const line = buf.slice(0, nl);
                 buf = buf.slice(nl + 1);
                 bufBytes = Buffer.byteLength(buf, "utf8");
-                counters.framesDecoded++;
-                const parsed = parseRequest(line);
-                if (!parsed.ok) {
-                    counters.requestsRefused++;
-                    sock.write(encode({ v: DAEMON_PROTOCOL_VERSION, id: parsed.id, ok: false, error: { code: parsed.code, message: parsed.message } }));
-                    continue;
+                if (++requests > MAX_REQUESTS_PER_CONNECTION) {
+                    // Bounded per connection: one refusal, then the connection closes and its unread input is dropped.
+                    sock.removeAllListeners("data");
+                    buf = "";
+                    bufBytes = 0;
+                    void refuse(null, "TOO_MANY_REQUESTS", `a connection may send at most ${MAX_REQUESTS_PER_CONNECTION} requests`).then(() => sock.end());
+                    return;
                 }
-                counters.statusAnswered++;
-                sock.write(encode({ v: DAEMON_PROTOCOL_VERSION, id: parsed.request.id, ok: true, result: status() }));
+                handle(line);
             }
         });
         sock.resume();
@@ -147,6 +210,8 @@ export async function serveDaemon(opts) {
     let closed;
     const close = () => {
         closed ??= (async () => {
+            // An in-flight sign-in is cancelled through the stock fence before the listener goes away.
+            await login.close();
             for (const s of sockets)
                 s.destroy();
             await new Promise((r) => server.close(() => r()));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cotal-ai",
-  "version": "0.94.4",
+  "version": "0.94.5",
   "description": "Cotal — lateral agent coordination over NATS. Run `npx cotal-ai` for the CLI.",
   "license": "Apache-2.0",
   "keywords": [
@@ -33,26 +33,26 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@cotal-ai/auth": "0.94.4",
-    "@cotal-ai/cli": "0.94.4",
-    "@cotal-ai/connector-core": "0.94.4",
-    "@cotal-ai/core": "0.94.4",
-    "@cotal-ai/delivery": "0.94.4",
-    "@cotal-ai/manager": "0.94.4",
-    "@cotal-ai/runtime": "0.94.4",
-    "@cotal-ai/seat": "0.94.4",
-    "@cotal-ai/workspace": "0.94.4"
+    "@cotal-ai/auth": "0.94.5",
+    "@cotal-ai/cli": "0.94.5",
+    "@cotal-ai/connector-core": "0.94.5",
+    "@cotal-ai/core": "0.94.5",
+    "@cotal-ai/delivery": "0.94.5",
+    "@cotal-ai/manager": "0.94.5",
+    "@cotal-ai/runtime": "0.94.5",
+    "@cotal-ai/seat": "0.94.5",
+    "@cotal-ai/workspace": "0.94.5"
   },
   "devDependencies": {
-    "@cotal-ai/connector-claude-code": "0.94.4",
-    "@cotal-ai/connector-codex": "0.94.4",
-    "@cotal-ai/connector-hermes": "0.94.4",
-    "@cotal-ai/connector-jcode": "0.94.4",
-    "@cotal-ai/connector-opencode": "0.94.4",
-    "@cotal-ai/linear": "0.94.4",
-    "@cotal-ai/pi": "0.94.4",
+    "@cotal-ai/connector-claude-code": "0.94.5",
+    "@cotal-ai/connector-codex": "0.94.5",
+    "@cotal-ai/connector-hermes": "0.94.5",
+    "@cotal-ai/connector-jcode": "0.94.5",
+    "@cotal-ai/connector-opencode": "0.94.5",
+    "@cotal-ai/linear": "0.94.5",
+    "@cotal-ai/pi": "0.94.5",
     "@cotal-ai/smoke-kit": "0.0.0",
-    "@cotal-ai/web": "0.94.4",
+    "@cotal-ai/web": "0.94.5",
     "@nats-io/jetstream": "^3.4.0",
     "@nats-io/transport-node": "^3.4.0",
     "typescript": "^5.9.3"