home-hosted 0.6.2 → 0.6.4

package/dist/cli.js

@@ -263,6 +263,43 @@ var init_io = __esmMin((() => {
 	};
 }));
 //#endregion
+//#region src/helpers/runtime.ts
+/**
+* How to run this CLI again in the same runtime. Under tsx that means passing the
+* resolved loader too, because a spawned child's working directory is the project's,
+* not the package's. Shared by `up` (which re-spawns itself detached) and by the
+* panel (which spawns a persistent entry's nanny).
+*
+* Nothing here reads a state directory, which is why the CLI can import it before
+* `--home`/`--project` have been applied.
+*/
+function runtimeArgs() {
+	let resolved = null;
+	const resolveTsx = () => resolved ??= import.meta.resolve("tsx");
+	return process.execArgv.map((arg) => {
+		if (arg === "tsx") return resolveTsx();
+		if (arg.startsWith("--import=") && arg.slice(9) === "tsx") return `--import=${resolveTsx()}`;
+		return arg;
+	});
+}
+function nannyArgv(entry, id, specPath, statePath) {
+	return [
+		...runtimeArgs(),
+		entry,
+		NANNY_COMMAND,
+		"--id",
+		id,
+		"--spec",
+		specPath,
+		"--state",
+		statePath
+	];
+}
+var NANNY_COMMAND;
+var init_runtime = __esmMin((() => {
+	NANNY_COMMAND = "__nanny";
+}));
+//#endregion
 //#region src/helpers/cookies.ts
 function parseCookies(header) {
 	const cookies = {};
@@ -304,7 +341,7 @@ function parseBind(value) {
 	const parsed = bindSchema(value);
 	return parsed instanceof type.errors ? null : parsed;
 }
-var bindSchema, portSchema, onPortConflictSchema, onPortConflictDefaultSchema, restartSchema, httpCheckSchema, resourcesSchema, healthSchema, stopSchema, bootstrapSchema, bootstrapOrNullSchema, logBufferLinesSchema, serverSchema, authSchema, telegramSchema, notificationsSchema, logsSchema, tlsSchema, hostSchema, backupsSchema, controlSchema, defaultsSchema, restartPatchSchema, httpCheckPatchSchema, resourcesPatchSchema, healthPatchSchema, stopPatchSchema, authPatchSchema, telegramPatchSchema, notificationsPatchSchema, hostPatchSchema, backupsPatchSchema, logsPatchSchema, tlsPatchSchema, controlPatchSchema, defaultsPatchSchema, editableFields, serverPatchSchema, serverCreateSchema, settingsPatchSchema, authStatusSchema, tlsStatusSchema, telegramStatusSchema, notificationViewSchema, sessionViewSchema, loginSchema, passwordValueSchema, passwordSchema, serverStatusSchema, healthStateSchema, portStateSchema, logStreamSchema, logLineSchema, historyEventSchema, serverHistorySchema, processResourcesSchema, hostDiskSchema, hostViewSchema, backupFileSchema, backupPathSchema, backupsViewSchema, restoreItemSchema, restorePlanSchema, backupCreateSchema, restoreRequestSchema, serverViewSchema, controlViewSchema, appStateSchema, logQuerySchema, freePortResultSchema, logHistoryQuerySchema, logFileInfoSchema, logServerViewSchema, logServersViewSchema, notificationActionSchema, telegramTokenSchema, apiErrorSchema, uiMetaSchema, uiStatusSchema, tlsUploadSchema, settingsViewSchema, settingsSavedSchema;
+var bindSchema, portSchema, onPortConflictSchema, onPortConflictDefaultSchema, restartSchema, httpCheckSchema, resourcesSchema, healthSchema, stopSchema, bootstrapSchema, bootstrapOrNullSchema, logBufferLinesSchema, serverSchema, authSchema, telegramSchema, notificationsSchema, logsSchema, tlsSchema, hostSchema, backupsSchema, controlSchema, defaultsSchema, restartPatchSchema, httpCheckPatchSchema, resourcesPatchSchema, healthPatchSchema, stopPatchSchema, authPatchSchema, telegramPatchSchema, notificationsPatchSchema, hostPatchSchema, backupsPatchSchema, logsPatchSchema, tlsPatchSchema, controlPatchSchema, defaultsPatchSchema, editableFields, serverPatchSchema, serverCreateSchema, nannySpecSchema, nannyExitSchema, nannyStateSchema, settingsPatchSchema, authStatusSchema, tlsStatusSchema, telegramStatusSchema, notificationViewSchema, sessionViewSchema, loginSchema, passwordValueSchema, passwordSchema, serverStatusSchema, healthStateSchema, portStateSchema, logStreamSchema, logLineSchema, historyEventSchema, serverHistorySchema, processResourcesSchema, hostDiskSchema, hostViewSchema, backupFileSchema, backupPathSchema, backupsViewSchema, restoreItemSchema, restorePlanSchema, backupCreateSchema, restoreRequestSchema, serverViewSchema, controlViewSchema, appStateSchema, logQuerySchema, freePortResultSchema, logHistoryQuerySchema, logFileInfoSchema, logServerViewSchema, logServersViewSchema, notificationActionSchema, telegramTokenSchema, apiErrorSchema, uiMetaSchema, uiStatusSchema, tlsUploadSchema, settingsViewSchema, settingsSavedSchema;
 var init_contracts = __esmMin((() => {
 	bindSchema = type("\"local\" | \"lan\" | /^\\d{1,3}(?:\\.\\d{1,3}){3}$/");
 	portSchema = type("1 <= number.integer <= 65535 | null");
@@ -368,6 +405,12 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		label: "string?",
 		enabled: "boolean = true",
 		autostart: "boolean = false",
+		/**
+		* Handed to a nanny process that owns the pipes, so the entry keeps running when
+		* this panel stops, restarts or is killed. `down`/`stop-all` leave it alone and
+		* report it; only an explicit stop or restart stops it.
+		*/
+		persistent: "boolean = false",
 		command: "string >= 1",
 		args: type("string[]").default(() => []),
 		cwd: "string = \".\"",
@@ -562,6 +605,7 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		label: "string?",
 		enabled: "boolean?",
 		autostart: "boolean?",
+		persistent: "boolean?",
 		command: "string?",
 		args: "string[]?",
 		cwd: "string?",
@@ -587,6 +631,34 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		...editableFields,
 		command: "string"
 	}).onUndeclaredKey("reject");
+	nannySpecSchema = type({
+		serverId: "string",
+		command: "string",
+		args: "string[]",
+		cwd: "string",
+		env: "Record<string, string>",
+		/** Directory of the JSONL the nanny writes; `<dir>/<id>.log`, exactly as the panel names it. */
+		logDir: "string",
+		/** The same retention the panel applies, so the nanny rotates identically. */
+		logs: logsSchema,
+		/** How the nanny stops the child it owns. */
+		stop: stopSchema
+	}).onUndeclaredKey("reject");
+	nannyExitSchema = type({
+		code: "number | null",
+		signal: "string | null",
+		at: "number",
+		runtimeMs: "number"
+	}).onUndeclaredKey("reject");
+	nannyStateSchema = type({
+		"serverId": "string",
+		"nannyPid": "number",
+		"childPid": "number | null",
+		"startedAt": "number",
+		"logFile": "string",
+		"heartbeatAt": "number",
+		"lastExit?": nannyExitSchema
+	}).onUndeclaredKey("reject");
 	settingsPatchSchema = type({
 		control: controlPatchSchema.optional(),
 		defaults: defaultsPatchSchema.optional(),
@@ -1744,6 +1816,7 @@ var paths_exports = /* @__PURE__ */ __exportAll({
 	defaultConfigPath: () => defaultConfigPath,
 	defaultHistoryPath: () => defaultHistoryPath,
 	defaultLogsDir: () => defaultLogsDir,
+	defaultNannyDir: () => defaultNannyDir,
 	defaultSecretsPath: () => defaultSecretsPath,
 	defaultTlsDir: () => defaultTlsDir,
 	projectDir: () => projectDir,
@@ -1781,7 +1854,7 @@ function resolveUserPath(target, base = projectDir) {
 	else if (value.startsWith("~/") || value.startsWith("~\\")) value = path.join(os.homedir(), value.slice(2));
 	return path.isAbsolute(value) ? value : path.resolve(base, value);
 }
-var dataRoot, projectDir, defaultConfigPath, configSchemaPath, defaultSecretsPath, defaultLogsDir, defaultHistoryPath, defaultTlsDir, runtimePath, daemonLogPath;
+var dataRoot, projectDir, defaultConfigPath, configSchemaPath, defaultSecretsPath, defaultLogsDir, defaultHistoryPath, defaultTlsDir, defaultNannyDir, runtimePath, daemonLogPath;
 var init_paths = __esmMin((() => {
 	dataRoot = resolveDataRoot();
 	projectDir = resolveProjectDir();
@@ -1791,6 +1864,7 @@ var init_paths = __esmMin((() => {
 	defaultLogsDir = path.join(dataRoot, ".logs");
 	defaultHistoryPath = path.join(dataRoot, ".logs", "history.json");
 	defaultTlsDir = path.join(dataRoot, ".tls");
+	defaultNannyDir = path.join(dataRoot, ".state");
 	runtimePath = path.join(dataRoot, "run.json");
 	daemonLogPath = path.join(dataRoot, ".logs", "home-hosted.log");
 }));
@@ -4615,6 +4689,33 @@ function collectTree(rootPid, children) {
 	return pids;
 }
 /**
+* The roots and every descendant of theirs, from one scan of the process table.
+*
+* Ownership has to mean the *tree*: a persistent entry runs under a nanny, and a
+* wrapper entry spawns the real server one generation down. Both keep the pid the
+* panel recorded, but the process holding the port is a descendant of it — and a
+* descendant classified as a stranger is one `kill`/`free-port` away from stopping
+* a server this panel is responsible for.
+*
+* A backend that cannot run answers with the roots alone, which is the old,
+* narrower behaviour rather than a wrong one.
+*/
+async function processTreePids(roots) {
+	const pids = new Set(roots);
+	if (roots.length === 0) return pids;
+	try {
+		const rows = await readProcesses();
+		const children = /* @__PURE__ */ new Map();
+		for (const row of rows) {
+			const siblings = children.get(row.ppid) ?? [];
+			siblings.push(row.pid);
+			children.set(row.ppid, siblings);
+		}
+		for (const root of roots) for (const pid of collectTree(root, children)) pids.add(pid);
+	} catch {}
+	return pids;
+}
+/**
 * Does this process carry the environment the supervisor gave the entry?
 *
 * A program that restarts itself — especially a plugin doing it — leaves behind a
@@ -4940,6 +5041,130 @@ var init_identity = __esmMin((() => {
 	windowsFilter = /^\d+$/;
 }));
 //#endregion
+//#region src/providers/nanny.ts
+var nanny_exports$2 = /* @__PURE__ */ __exportAll({
+	NANNY_HEARTBEAT_MS: () => NANNY_HEARTBEAT_MS,
+	SPEC_SUFFIX: () => SPEC_SUFFIX,
+	clearNannySpec: () => clearNannySpec,
+	clearNannyState: () => clearNannyState,
+	describeNannyExit: () => describeNannyExit,
+	nannyEntryPoint: () => nannyEntryPoint,
+	nannyIsAlive: () => nannyIsAlive,
+	nannyLogFile: () => nannyLogFile,
+	nannySpecPath: () => nannySpecPath,
+	nannyStatePath: () => nannyStatePath,
+	readNannyState: () => readNannyState,
+	sweepNannySpecs: () => sweepNannySpecs,
+	takeNannySpec: () => takeNannySpec,
+	writeNannySpec: () => writeNannySpec,
+	writeNannyState: () => writeNannyState
+});
+/**
+* The state directory is passed in rather than read from a global: the panel injects
+* `$HHOSTED_HOME/.state`, and a test injects its own temp directory.
+*/
+function nannySpecPath(dir, id) {
+	return path.join(dir, `${id}${SPEC_SUFFIX}`);
+}
+function nannyStatePath(dir, id) {
+	return path.join(dir, `${id}.json`);
+}
+/** The file a nanny writes and the panel tails; one derivation, so they cannot drift. */
+function nannyLogFile(logDir, id) {
+	return path.join(logDir, `${id}.log`);
+}
+/**
+* How to run this CLI again as a nanny. The panel was itself launched through this
+* entry point (`up` re-spawns itself with it), so `process.argv[1]` is the one path
+* that works under tsx, from `dist/cli.js` and through the published bin alike.
+*/
+function nannyEntryPoint() {
+	return process.argv[1] ?? "";
+}
+/** Written before the spawn, consumed by the nanny, never left behind. */
+function writeNannySpec(file, spec) {
+	writeFileAtomic(file, JSON.stringify(spec), { mode: SPEC_MODE });
+}
+function clearNannySpec(file) {
+	fs.rmSync(file, { force: true });
+}
+/**
+* Reads and unlinks in one step: the spec holds expanded secrets, and a spec left
+* behind — a nanny that died before reading it, a panel killed mid-spawn — is a
+* secret file with no owner. It is consumed even when it cannot be parsed.
+*/
+function takeNannySpec(file) {
+	const raw = fs.readFileSync(file, "utf8");
+	fs.rmSync(file, { force: true });
+	const parsed = nannySpecSchema(JSON.parse(raw));
+	if (parsed instanceof type.errors) throw new Error(`invalid nanny spec: ${parsed.summary}`);
+	return parsed;
+}
+/**
+* Nothing can be waiting on a spec before this panel has spawned a nanny, so every
+* one still on disk at boot belongs to a nanny that never read it.
+*/
+function sweepNannySpecs(dir) {
+	let swept = 0;
+	for (const name of readSpecNames(dir)) {
+		fs.rmSync(path.join(dir, name), { force: true });
+		swept += 1;
+	}
+	return swept;
+}
+function readSpecNames(dir) {
+	try {
+		return fs.readdirSync(dir).filter((name) => name.endsWith(SPEC_SUFFIX));
+	} catch {
+		return [];
+	}
+}
+/** A stale or foreign file reads as "no state", never as a throw. */
+function readNannyState(file) {
+	try {
+		const parsed = nannyStateSchema(JSON.parse(fs.readFileSync(file, "utf8")));
+		return parsed instanceof type.errors ? null : parsed;
+	} catch {
+		return null;
+	}
+}
+function writeNannyState(file, state) {
+	writeFileAtomic(file, JSON.stringify(state));
+}
+function clearNannyState(file) {
+	fs.rmSync(file, { force: true });
+}
+/** The same wording the supervisor uses for a child's exit, so history reads alike. */
+function describeNannyExit(exit) {
+	return exit.signal !== null ? `signal ${exit.signal}` : `code ${exit.code}`;
+}
+/**
+* Is the nanny this state describes still ours? A live pid proves nothing on its
+* own — pids are reused. A fresh heartbeat means a process is still rewriting the
+* file; the environment marker (Linux, macOS) or the argv we spawned it with answers
+* everywhere else, Windows included.
+*/
+async function nannyIsAlive(state, id) {
+	if (state.nannyPid <= 0 || !isProcessAlive(state.nannyPid)) return false;
+	if (Date.now() - state.heartbeatAt <= HEARTBEAT_STALE_MS) return true;
+	if (await processCarriesServerId(state.nannyPid, id)) return true;
+	const words = await processArgv(state.nannyPid);
+	return words !== null && words.includes("__nanny") && words.some((word) => word.endsWith(`${id}.spec.json`));
+}
+var SPEC_MODE, SPEC_SUFFIX, NANNY_HEARTBEAT_MS, HEARTBEAT_STALE_MS;
+var init_nanny$2 = __esmMin((() => {
+	init_atomic();
+	init_runtime();
+	init_identity();
+	init_port();
+	init_proc();
+	init_contracts();
+	SPEC_MODE = 384;
+	SPEC_SUFFIX = ".spec.json";
+	NANNY_HEARTBEAT_MS = 5e3;
+	HEARTBEAT_STALE_MS = 3e4;
+}));
+//#endregion
 //#region src/providers/process.ts
 /**
 * Resolves a bare command through the entry's own directory and the project's
@@ -4963,14 +5188,14 @@ function resolveCwd(cwd, base = projectDir) {
 function needsShell(command) {
 	return process.platform === "win32" && /\.(?:cmd|bat)$/i.test(command);
 }
-function spawnManaged(spec) {
+function spawnManaged(spec, options = {}) {
 	return spawn(spec.command, spec.args, {
 		cwd: spec.cwd,
 		env: {
 			...process.env,
 			...spec.env
 		},
-		detached: true,
+		detached: options.detached ?? true,
 		stdio: [
 			"ignore",
 			"pipe",
@@ -5174,6 +5399,230 @@ var init_log_buffer = __esmMin((() => {
 	};
 }));
 //#endregion
+//#region src/providers/log-tail.ts
+/**
+* Cheap structural guard rather than a full schema pass: this runs per line on a hot
+* path, and the writer is our own nanny (which serializes `LogLine` unchanged).
+*/
+function parseLogLine(raw) {
+	try {
+		const value = JSON.parse(raw);
+		if (typeof value.ts !== "number" || typeof value.text !== "string" || typeof value.stream !== "string") return null;
+		if (!LOG_STREAMS.has(value.stream)) return null;
+		return {
+			ts: value.ts,
+			stream: value.stream,
+			text: value.text
+		};
+	} catch {
+		return null;
+	}
+}
+var MAX_BYTES_PER_READ, MAX_TAIL_BYTES, MAX_CARRY_CHARS, LOG_STREAMS, LogTailer;
+var init_log_tail = __esmMin((() => {
+	MAX_BYTES_PER_READ = 262144;
+	MAX_TAIL_BYTES = 262144;
+	MAX_CARRY_CHARS = 1048576;
+	LOG_STREAMS = /* @__PURE__ */ new Set([
+		"stdout",
+		"stderr",
+		"system"
+	]);
+	LogTailer = class {
+		file;
+		offset = 0;
+		identity = null;
+		carry = "";
+		constructor(file) {
+			this.file = file;
+		}
+		/** Bytes consumed so far; equal to the file size once it has been drained. */
+		get position() {
+			return this.offset;
+		}
+		/** Start from the beginning again — used when a fresh process takes the entry over. */
+		reset() {
+			this.offset = 0;
+			this.identity = null;
+			this.carry = "";
+		}
+		/**
+		* The last `count` lines, with the read position moved to the end of the file in the
+		* same operation.
+		*
+		* A panel attaching to a running entry wants both a backfill and a live stream, and
+		* only one thing may own the offset. Reading the tail through the same tailer is what
+		* keeps a line from being replayed as news or skipped as history — and it is why this
+		* does not delegate to `LogFiles.readTail()`, which knows nothing of this position.
+		*/
+		readTailLines(count) {
+			let stats;
+			try {
+				stats = fs.statSync(this.file);
+			} catch {
+				return [];
+			}
+			const size = stats.size;
+			this.carry = "";
+			this.offset = size;
+			this.identity = stats.ino === 0 ? stats.birthtimeMs : stats.ino;
+			if (size === 0 || count <= 0) return [];
+			const start = Math.max(0, size - MAX_TAIL_BYTES);
+			let handle;
+			try {
+				handle = fs.openSync(this.file, "r");
+			} catch {
+				return [];
+			}
+			try {
+				const buffer = Buffer$1.alloc(size - start);
+				const bytes = fs.readSync(handle, buffer, 0, buffer.length, start);
+				const raw = buffer.subarray(0, bytes).toString("utf8").split("\n").filter((line) => line.trim().length > 0);
+				return (start > 0 ? raw.slice(1) : raw).slice(-count).map(parseLogLine).filter((line) => line !== null);
+			} catch {
+				return [];
+			} finally {
+				fs.closeSync(handle);
+			}
+		}
+		/**
+		* Ignore what is already in the file and follow it from here.
+		*/
+		skipToEnd() {
+			this.carry = "";
+			try {
+				const stats = fs.statSync(this.file);
+				this.offset = stats.size;
+				this.identity = stats.ino === 0 ? stats.birthtimeMs : stats.ino;
+			} catch {
+				this.offset = 0;
+				this.identity = null;
+			}
+		}
+		/** Every complete line written since the previous call. */
+		read() {
+			let stats;
+			try {
+				stats = fs.statSync(this.file);
+			} catch {
+				return [];
+			}
+			const identity = stats.ino === 0 ? stats.birthtimeMs : stats.ino;
+			if (this.identity !== null && (identity !== this.identity || stats.size < this.offset)) {
+				this.carry = "";
+				this.offset = 0;
+			}
+			this.identity = identity;
+			if (stats.size <= this.offset) return [];
+			const lines = [];
+			let handle;
+			try {
+				handle = fs.openSync(this.file, "r");
+			} catch {
+				return [];
+			}
+			try {
+				const buffer = Buffer$1.alloc(Math.min(MAX_BYTES_PER_READ, stats.size - this.offset));
+				while (this.offset < stats.size) {
+					const length = Math.min(buffer.length, stats.size - this.offset);
+					const bytes = fs.readSync(handle, buffer, 0, length, this.offset);
+					if (bytes <= 0) break;
+					this.offset += bytes;
+					this.consume(buffer.subarray(0, bytes).toString("utf8"), lines);
+					if (bytes < buffer.length) break;
+				}
+			} catch {} finally {
+				fs.closeSync(handle);
+			}
+			return lines;
+		}
+		consume(text, lines) {
+			if (this.carry.length === 0) this.carry = text;
+			else this.carry += text;
+			const parts = this.carry.split("\n");
+			this.carry = parts.pop() ?? "";
+			for (const part of parts) {
+				if (part.trim().length === 0) continue;
+				const line = parseLogLine(part);
+				if (line !== null) lines.push(line);
+			}
+			if (this.carry.length > MAX_CARRY_CHARS) this.carry = "";
+		}
+	};
+}));
+//#endregion
+//#region src/services/log-relay.ts
+var TAIL_INTERVAL_MS, LogRelay;
+var init_log_relay = __esmMin((() => {
+	init_logger();
+	init_log_tail();
+	TAIL_INTERVAL_MS = 250;
+	LogRelay = class {
+		options;
+		followed = /* @__PURE__ */ new Map();
+		timer = null;
+		closed = false;
+		constructor(options) {
+			this.options = options;
+		}
+		/**
+		* Idempotent: following the same file again keeps the position already read.
+		*
+		* With `backfill`, the last lines already on disk are returned *and* the live position
+		* is set past them by the same tailer, so the caller can fill a buffer without a line
+		* being both history and news. Without it, the live stream simply starts at the end.
+		*/
+		follow(serverId, file, options = {}) {
+			if (this.closed) return [];
+			const current = this.followed.get(serverId);
+			if (current !== void 0 && current.file === file) return [];
+			const tailer = new LogTailer(file);
+			const backfill = options.backfill ?? 0;
+			const history = backfill > 0 ? tailer.readTailLines(backfill) : [];
+			if (backfill <= 0) tailer.skipToEnd();
+			this.followed.set(serverId, {
+				file,
+				tailer
+			});
+			this.start();
+			return history;
+		}
+		unfollow(serverId) {
+			this.followed.delete(serverId);
+			if (this.followed.size === 0) this.stopTimer();
+		}
+		followedIds() {
+			return [...this.followed.keys()];
+		}
+		dispose() {
+			this.closed = true;
+			this.followed.clear();
+			this.stopTimer();
+		}
+		start() {
+			if (this.timer !== null) return;
+			this.timer = setInterval(() => {
+				try {
+					this.poll();
+				} catch (error) {
+					logger.warn(`tail failed: ${error instanceof Error ? error.message : String(error)}`);
+				}
+			}, this.options.intervalMs ?? TAIL_INTERVAL_MS);
+			this.timer.unref();
+		}
+		stopTimer() {
+			if (this.timer !== null) clearInterval(this.timer);
+			this.timer = null;
+		}
+		poll() {
+			for (const [serverId, { tailer }] of this.followed) {
+				const lines = tailer.read();
+				if (lines.length > 0) this.options.onLines(serverId, lines);
+			}
+		}
+	};
+}));
+//#endregion
 //#region src/services/supervisor.ts
 function delay(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
@@ -5194,32 +5643,41 @@ function serverTemplateVars(config) {
 		home: os.homedir()
 	};
 }
-var HISTORY_WINDOW_MS, HISTORY_CACHE_MS, TICK_INTERVAL_MS, PORT_STATE_INTERVAL_MS, PORT_RELEASE_RECHECK_MS, RESOURCE_SAMPLE_INTERVAL_MS, Supervisor;
+var HISTORY_WINDOW_MS, HISTORY_CACHE_MS, TICK_INTERVAL_MS, PORT_STATE_INTERVAL_MS, PORT_RELEASE_RECHECK_MS, RESOURCE_SAMPLE_INTERVAL_MS, PERSISTENT_BACKFILL_LINES, Supervisor;
 var init_supervisor = __esmMin((() => {
 	init_backoff();
 	init_bind();
 	init_env_file();
 	init_logger();
 	init_paths();
+	init_runtime();
 	init_template();
 	init_health_check();
 	init_identity();
+	init_nanny$2();
 	init_port();
 	init_proc();
 	init_process();
 	init_dependencies();
 	init_log_buffer();
+	init_log_relay();
 	HISTORY_WINDOW_MS = 864e5;
 	HISTORY_CACHE_MS = 5e3;
 	TICK_INTERVAL_MS = 1e3;
 	PORT_STATE_INTERVAL_MS = 1e4;
 	PORT_RELEASE_RECHECK_MS = 300;
 	RESOURCE_SAMPLE_INTERVAL_MS = 5e3;
+	PERSISTENT_BACKFILL_LINES = 200;
 	Supervisor = class {
 		store;
 		hub;
 		options;
 		sampler = new ProcessSampler();
+		/**
+		* Live output of persistent entries. A normal entry's logs arrive down the pipe the
+		* panel owns; a persistent one's are written by its nanny, so they are read back.
+		*/
+		relay = new LogRelay({ onLines: (serverId, lines) => this.ingestExternalLines(serverId, lines) });
 		entries = /* @__PURE__ */ new Map();
 		tickTimer;
 		disposed = false;
@@ -5228,6 +5686,8 @@ var init_supervisor = __esmMin((() => {
 			this.store = store;
 			this.hub = hub;
 			this.options = options;
+			const swept = sweepNannySpecs(this.options.nannyDir);
+			if (swept > 0) logger.warn(`removed ${swept} unread nanny spec file(s) from ${this.options.nannyDir}`);
 			this.sync();
 			this.store.onChange(() => this.sync());
 			this.tickTimer = setInterval(() => {
@@ -5245,12 +5705,38 @@ var init_supervisor = __esmMin((() => {
 			return this.entries.get(id)?.logs.list(limit) ?? [];
 		}
 		async startAll(options = {}) {
+			for (const entry of [...this.entries.values()]) {
+				if (!entry.config.persistent || this.isActive(entry)) continue;
+				if (entry.config.enabled) {
+					await this.resumePersistent(entry).catch((error) => {
+						logger.error(`could not reattach the persistent server ${entry.config.id}`, error);
+					});
+					continue;
+				}
+				try {
+					if (await this.resumePersistent(entry)) await this.stop(entry.config.id);
+				} catch (error) {
+					logger.error(`could not stop the disabled persistent server ${entry.config.id}`, error);
+				}
+			}
 			const targets = [...this.entries.values()].filter((entry) => !options.autostartOnly || entry.config.autostart).map((entry) => entry.config);
 			for (const config of orderByDependencies(targets)) await this.start(config.id);
 		}
+		/**
+		* Stops every entry this command owns. A persistent entry is deliberately not among
+		* them: that is the whole point of the flag, and it is said out loud rather than
+		* silently skipped, so "stopped everything" is never claimed about a running server.
+		*/
 		async stopAll() {
 			const targets = orderByDependencies([...this.entries.values()].map((entry) => entry.config)).reverse();
-			for (const config of targets) await this.stop(config.id);
+			for (const config of targets) {
+				const entry = this.entries.get(config.id);
+				if (entry !== void 0 && entry.config.persistent) {
+					if (this.isActive(entry)) this.log(entry, "system", "persistent: left running (stop it explicitly to end it)");
+					continue;
+				}
+				await this.stop(config.id);
+			}
 		}
 		async start(id, options = {}) {
 			const entry = this.entries.get(id);
@@ -5284,6 +5770,7 @@ var init_supervisor = __esmMin((() => {
 				entry.status = "starting";
 				entry.health = entry.config.health.enabled ? "unknown" : "disabled";
 				this.publishServer(entry);
+				if (entry.config.persistent && await this.resumePersistent(entry)) return { ok: true };
 				await this.runBootstrap(entry);
 				if (entry.stopping) return {
 					ok: false,
@@ -5396,17 +5883,32 @@ var init_supervisor = __esmMin((() => {
 		* in an old banner from killing a recycled pid.
 		*/
 		async portHolders(port) {
-			const supervised = this.supervisedPids();
+			const supervised = await this.supervisedPids();
 			const holders = await listPortHolders(port);
 			return {
 				ours: holders.filter((pid) => supervised.has(pid)),
 				foreign: holders.filter((pid) => !supervised.has(pid))
 			};
 		}
-		/** Pids of the child processes this panel owns, plus itself. */
-		supervisedPids() {
-			const pids = /* @__PURE__ */ new Set([process.pid]);
-			for (const entry of this.entries.values()) if (entry.pid !== null) pids.add(entry.pid);
+		/**
+		* Pids of the processes this panel owns, plus itself — the whole *tree* of every
+		* entry, not just the pid it recorded.
+		*
+		* Both kinds of indirection are covered by that: a persistent entry runs under a
+		* nanny, and a wrapper entry spawns the real server one generation down. The process
+		* holding the port is a descendant in both cases, and a descendant mistaken for a
+		* stranger is one `kill`/`free-port` away from stopping a server we own.
+		*
+		* The panel's own tree is deliberately *not* walked: "ours" has to mean a process a
+		* server owns, or anything the panel happened to spawn would be unkillable and
+		* unattributable.
+		*/
+		async supervisedPids() {
+			const roots = [];
+			for (const entry of this.entries.values()) if (entry.pid !== null) roots.push(entry.pid);
+			else if (entry.child?.pid !== void 0) roots.push(entry.child.pid);
+			const pids = await processTreePids(roots);
+			pids.add(process.pid);
 			return pids;
 		}
 		/** The port's own answer, with the same short recheck the preflight uses. */
@@ -5428,7 +5930,8 @@ var init_supervisor = __esmMin((() => {
 			this.disposed = true;
 			clearInterval(this.tickTimer);
 			for (const entry of this.entries.values()) this.clearRetry(entry);
-			await Promise.all([...this.entries.values()].map((entry) => this.stopEntry(entry)));
+			await Promise.all([...this.entries.values()].filter((entry) => !entry.config.persistent).map((entry) => this.stopEntry(entry)));
+			this.relay.dispose();
 		}
 		/**
 		* Starts whatever this server depends on and waits for it to accept
@@ -5497,20 +6000,38 @@ var init_supervisor = __esmMin((() => {
 			}
 			entry.status = "stopping";
 			this.publishServer(entry);
+			const nannyState = entry.config.persistent ? readNannyState(nannyStatePath(this.options.nannyDir, entry.config.id)) : null;
 			if ((entry.child === null && entry.pid !== null ? await terminatePid(entry.pid, entry.config.stop) : await terminate(entry.child, entry.config.stop)) === "force-killed") this.log(entry, "system", "force-killed after grace period");
+			if (nannyState?.childPid != null && !entry.config.stop.killGroup) await terminatePid(nannyState.childPid, {
+				...entry.config.stop,
+				killGroup: false
+			});
 			const { port, stop } = entry.config;
 			if (stop.killPortHolders && port !== null) {
-				const leftover = await killPortHolders(port, this.supervisedPids());
+				const leftover = await killPortHolders(port, await this.supervisedPids());
 				if (leftover.length > 0) this.log(entry, "system", `port ${port} was still held by pid ${leftover.join(", ")} — killed`);
 			}
+			const survivor = entry.config.persistent && entry.pid !== null && isProcessAlive(entry.pid) ? entry.pid : null;
+			if (entry.config.persistent) {
+				if (survivor === null) {
+					clearNannyState(nannyStatePath(this.options.nannyDir, entry.config.id));
+					clearNannySpec(nannySpecPath(this.options.nannyDir, entry.config.id));
+				} else this.log(entry, "system", `pid ${survivor} is still alive after the stop — its state file is kept`);
+				this.relay.unfollow(entry.config.id);
+			}
 			entry.stopping = false;
 			entry.child = null;
 			entry.pid = null;
 			entry.adopted = false;
-			entry.status = "stopped";
-			this.log(entry, "system", "stopped");
+			entry.nannyExit = null;
+			entry.status = survivor === null ? "stopped" : "conflict";
+			if (survivor !== null) entry.lastError = `pid ${survivor} survived the stop`;
+			this.log(entry, "system", survivor === null ? "stopped" : entry.lastError);
 			this.publishServer(entry);
-			return { ok: true };
+			return survivor === null ? { ok: true } : {
+				ok: false,
+				error: entry.lastError
+			};
 		}
 		createEntry(config) {
 			return {
@@ -5533,6 +6054,7 @@ var init_supervisor = __esmMin((() => {
 				lastOccupancyProbeAt: 0,
 				probing: false,
 				adopted: false,
+				nannyExit: null,
 				starting: false,
 				stopping: false,
 				bootstrapDone: !config.bootstrap,
@@ -5549,6 +6071,7 @@ var init_supervisor = __esmMin((() => {
 				const config = wanted.get(id);
 				if (!config) {
 					this.entries.delete(id);
+					this.relay.unfollow(id);
 					this.stopEntry(entry).catch((error) => {
 						logger.error(`could not stop the removed server ${id}`, error);
 					});
@@ -5556,6 +6079,7 @@ var init_supervisor = __esmMin((() => {
 				}
 				const bufferChanged = entry.config.logBufferLines !== config.logBufferLines;
 				entry.config = config;
+				if (!config.persistent) this.relay.unfollow(id);
 				if (bufferChanged) {
 					const kept = entry.logs.list(config.logBufferLines);
 					entry.logs = new LogBuffer(config.logBufferLines);
@@ -5701,6 +6225,11 @@ var init_supervisor = __esmMin((() => {
 		* Takes over a detached successor: no spawn, no duplicate. The pid is supervised
 		* from here on (liveness, health probe, resources, stop), while its output stays
 		* wherever it was redirected.
+		*
+		* For a persistent entry that output is not a mystery: its nanny is still writing
+		* the entry's log file, so the relay is started here too. Without this, adopting a
+		* persistent entry whose state file was lost would show its history but never
+		* another live line.
 		*/
 		adoptEntry(entry, pid) {
 			entry.adopted = true;
@@ -5711,13 +6240,17 @@ var init_supervisor = __esmMin((() => {
 			entry.startedAt = Date.now();
 			entry.lastError = null;
 			this.log(entry, "system", `adopted pid ${pid}: a detached restart of this entry is already serving port ${entry.config.port}`);
+			if (entry.config.persistent) this.followPersistent(entry);
 			this.publishServer(entry);
 			return { ok: true };
 		}
 		/** An adopted successor disappeared: fall back to the normal lifecycle. */
 		handleAdoptedExit(entry) {
 			if (entry.pid !== null) this.sampler.forget(entry.pid);
-			const ranForMs = entry.startedAt === null ? 0 : Date.now() - entry.startedAt;
+			if (entry.config.persistent) this.consumeNannyExit(entry);
+			const ranForMs = entry.nannyExit?.runtimeMs ?? (entry.startedAt === null ? 0 : Date.now() - entry.startedAt);
+			const detail = entry.nannyExit === null ? "adopted process exited" : describeNannyExit(entry.nannyExit);
+			entry.nannyExit = null;
 			entry.adopted = false;
 			entry.pid = null;
 			entry.resources = null;
@@ -5726,11 +6259,11 @@ var init_supervisor = __esmMin((() => {
 			entry.exitSignal = null;
 			this.options.history.record(entry.config.id, {
 				type: "exit",
-				detail: "adopted process exited",
+				detail,
 				runtimeMs: ranForMs
 			});
 			this.log(entry, "system", `the adopted process is gone after ${Math.max(1, Math.round(ranForMs / 1e3))}s`);
-			this.afterExit(entry, "adopted process exited", ranForMs, false);
+			this.afterExit(entry, detail, ranForMs, false);
 		}
 		async runBootstrap(entry) {
 			const spec = entry.config.bootstrap;
@@ -5818,6 +6351,9 @@ var init_supervisor = __esmMin((() => {
 			};
 		}
 		spawnEntry(entry) {
+			return entry.config.persistent ? this.spawnNanny(entry) : this.spawnDirect(entry);
+		}
+		spawnDirect(entry) {
 			const { command, args, env, cwd, loggedArgs } = this.resolveSpawn(entry);
 			this.log(entry, "system", `start: ${command} ${loggedArgs.join(" ")}`);
 			let child;
@@ -5829,46 +6365,198 @@ var init_supervisor = __esmMin((() => {
 					env
 				});
 			} catch (error) {
-				entry.status = "crashed";
-				entry.lastError = error.message;
-				this.log(entry, "system", `spawn failed: ${entry.lastError}`);
-				this.publishServer(entry);
-				return {
-					ok: false,
-					error: entry.lastError
-				};
+				return this.failSpawn(entry, error.message);
 			}
+			const stdout = new LineSplitter((stream, text) => this.log(entry, stream, text));
+			const stderr = new LineSplitter((stream, text) => this.log(entry, stream, text));
+			child.stdout?.on("data", (chunk) => stdout.push("stdout", chunk));
+			child.stderr?.on("data", (chunk) => stderr.push("stderr", chunk));
+			this.attachChild(entry, child, `${command} ${args.join(" ")}`.trim(), () => {
+				stdout.flush("stdout");
+				stderr.flush("stderr");
+			});
+			return { ok: true };
+		}
+		/**
+		* Starts a persistent entry: the panel spawns a *nanny*, which spawns the entry and
+		* owns its pipes. From here the nanny is the child this supervisor tracks — its exit
+		* event drives the normal lifecycle (backoff, history, notifications) — while the
+		* real exit cause is read back from the state file the nanny leaves behind.
+		*/
+		spawnNanny(entry) {
+			const { command, args, env, cwd, loggedArgs } = this.resolveSpawn(entry);
+			this.log(entry, "system", `start (persistent): ${command} ${loggedArgs.join(" ")}`);
+			const entryPoint = nannyEntryPoint();
+			if (entryPoint.length === 0) return this.failSpawn(entry, "cannot locate this CLI to start a persistent entry");
+			const id = entry.config.id;
+			const specPath = nannySpecPath(this.options.nannyDir, id);
+			const statePath = nannyStatePath(this.options.nannyDir, id);
+			const spec = {
+				serverId: id,
+				command,
+				args,
+				cwd,
+				env,
+				logDir: this.options.logFiles.directory,
+				logs: this.options.logFiles.config,
+				stop: entry.config.stop
+			};
+			let child;
+			try {
+				writeNannySpec(specPath, spec);
+				child = spawn(process.execPath, nannyArgv(entryPoint, id, specPath, statePath), {
+					cwd,
+					env: {
+						...process.env,
+						...env,
+						HHOSTED_HOME: dataRoot,
+						HHOSTED_PROJECT: projectDir
+					},
+					stdio: [
+						"ignore",
+						"ignore",
+						"ignore"
+					],
+					detached: true,
+					windowsHide: true
+				});
+			} catch (error) {
+				clearNannySpec(specPath);
+				return this.failSpawn(entry, error.message);
+			}
+			child.unref();
+			this.attachChild(entry, child, `nanny → ${command} ${args.join(" ")}`.trim());
+			this.followPersistent(entry);
+			return { ok: true };
+		}
+		failSpawn(entry, message) {
+			entry.status = "crashed";
+			entry.lastError = message;
+			this.log(entry, "system", `spawn failed: ${message}`);
+			this.publishServer(entry);
+			return {
+				ok: false,
+				error: message
+			};
+		}
+		/** The bookkeeping every spawn shares, plus the exit events that end it. */
+		attachChild(entry, child, detail, flush) {
 			entry.child = child;
 			entry.pid = child.pid ?? null;
 			entry.startedAt = Date.now();
 			this.options.history.record(entry.config.id, {
 				type: "start",
-				detail: `${command} ${args.join(" ")}`.trim()
+				detail
 			});
 			entry.exitCode = null;
 			entry.exitSignal = null;
+			entry.nannyExit = null;
 			entry.lastProbeAt = 0;
 			entry.healthFailures = 0;
 			entry.unhealthySince = null;
 			this.publishServer(entry);
-			const stdout = new LineSplitter((stream, text) => this.log(entry, stream, text));
-			const stderr = new LineSplitter((stream, text) => this.log(entry, stream, text));
-			child.stdout?.on("data", (chunk) => stdout.push("stdout", chunk));
-			child.stderr?.on("data", (chunk) => stderr.push("stderr", chunk));
 			child.once("error", (error) => {
 				entry.lastError = error.message;
 				this.log(entry, "system", `process error: ${entry.lastError}`);
-				stdout.flush("stdout");
-				stderr.flush("stderr");
+				flush?.();
 				this.handleExit(entry, child, null, null);
 			});
 			child.once("exit", (code, signal) => {
-				stdout.flush("stdout");
-				stderr.flush("stderr");
+				flush?.();
 				this.handleExit(entry, child, code, signal);
 			});
 			this.awaitReadiness(entry, child);
-			return { ok: true };
+		}
+		/**
+		* Live output for a persistent entry, which arrives by reading its log file rather
+		* than down a pipe. It is pushed into the same ring buffer and published as the same
+		* SSE frame a normal entry's output is, so nothing downstream knows the difference.
+		*/
+		ingestExternalLines(serverId, lines) {
+			const entry = this.entries.get(serverId);
+			if (entry === void 0 || !entry.config.persistent || lines.length === 0) return;
+			for (const line of lines) entry.logs.push(line);
+			this.hub.publish({
+				type: "log",
+				ts: lines[lines.length - 1].ts,
+				serverId,
+				lines
+			});
+		}
+		/**
+		* Follows a persistent entry's log file, filling the ring buffer from what is on disk.
+		*
+		* The backfill is read *through* the tailer, which is the only thing that may own the
+		* offset: reading it from `LogFiles` first and seeking to EOF second would either
+		* replay a line as news or skip one as history, depending on which order the two
+		* syscalls happen to land in.
+		*/
+		followPersistent(entry) {
+			const id = entry.config.id;
+			const backfill = entry.logs.size === 0 && this.options.logFiles.config.persist ? PERSISTENT_BACKFILL_LINES : 0;
+			const history = this.relay.follow(id, nannyLogFile(this.options.logFiles.directory, id), { backfill });
+			if (history.length > 0) entry.logs.extend(history);
+		}
+		/**
+		* Reattaches to a persistent entry that is still running, or reports how it ended
+		* while nobody was watching. Never starts anything: that is `start()`'s job, and it
+		* is what keeps this honest about "not starting entries on your own".
+		*/
+		async resumePersistent(entry) {
+			const id = entry.config.id;
+			const state = readNannyState(nannyStatePath(this.options.nannyDir, id));
+			if (state !== null && state.serverId === id && await nannyIsAlive(state, id)) {
+				entry.adopted = true;
+				entry.child = null;
+				entry.pid = state.nannyPid;
+				entry.startedAt = state.startedAt;
+				entry.status = "running";
+				entry.health = entry.config.health.enabled ? "unknown" : "disabled";
+				entry.portState = entry.config.port === null ? "unknown" : "in-use";
+				entry.lastError = null;
+				entry.nannyExit = null;
+				const child = state.childPid === null ? "" : `, server pid ${state.childPid}`;
+				this.log(entry, "system", `persistent: still running (nanny pid ${state.nannyPid}${child}) — reattached`);
+				this.followPersistent(entry);
+				this.publishServer(entry);
+				return true;
+			}
+			if (state === null) return false;
+			this.consumeNannyExit(entry);
+			const exit = entry.nannyExit;
+			entry.nannyExit = null;
+			if (exit === null) return false;
+			const detail = exit.code === null && exit.signal === null ? "it could not start" : describeNannyExit(exit);
+			const ranFor = `${Math.max(1, Math.round(exit.runtimeMs / 1e3))}s`;
+			this.options.history.record(id, {
+				type: "exit",
+				detail: `while the panel was away: ${detail}`,
+				runtimeMs: exit.runtimeMs
+			});
+			this.log(entry, "system", `persistent: exited while the panel was away with ${detail} after ${ranFor}`);
+			if (exit.code !== 0 || exit.signal !== null) {
+				entry.status = "crashed";
+				entry.lastError = `exited while the panel was away with ${detail}`;
+				this.options.history.record(id, {
+					type: "crash",
+					detail: entry.lastError,
+					runtimeMs: exit.runtimeMs
+				});
+				this.notify(entry, "crash", entry.lastError);
+			}
+			this.publishServer(entry);
+			return false;
+		}
+		/**
+		* The nanny's last word, then the state file goes: a panel that has read how the
+		* entry ended must not report it twice.
+		*/
+		consumeNannyExit(entry) {
+			const statePath = nannyStatePath(this.options.nannyDir, entry.config.id);
+			const state = readNannyState(statePath);
+			if (state?.lastExit !== void 0) entry.nannyExit = state.lastExit;
+			clearNannyState(statePath);
+			this.relay.unfollow(entry.config.id);
 		}
 		/** One probe using the configured mode (TCP or HTTP), with timing. */
 		async probeEntryHealth(entry) {
@@ -5921,6 +6609,9 @@ var init_supervisor = __esmMin((() => {
 		handleExit(entry, child, code, signal) {
 			if (entry.child !== child) return;
 			if (entry.pid !== null) this.sampler.forget(entry.pid);
+			if (entry.config.persistent) this.consumeNannyExit(entry);
+			const nannyExit = entry.nannyExit;
+			entry.nannyExit = null;
 			entry.child = null;
 			entry.pid = null;
 			entry.adopted = false;
@@ -5928,9 +6619,9 @@ var init_supervisor = __esmMin((() => {
 			entry.responseMs = null;
 			entry.exitCode = code;
 			entry.exitSignal = signal;
-			const neverStarted = code === null && signal === null && entry.lastError !== null;
-			const detail = neverStarted ? entry.lastError : signal !== null ? `signal ${signal}` : `code ${code}`;
-			const ranForMs = entry.startedAt === null ? 0 : Date.now() - entry.startedAt;
+			const neverStarted = nannyExit !== null ? nannyExit.code === null && nannyExit.signal === null : code === null && signal === null && entry.lastError !== null;
+			const detail = neverStarted ? entry.lastError ?? "the entry could not start" : nannyExit !== null ? describeNannyExit(nannyExit) : signal !== null ? `signal ${signal}` : `code ${code}`;
+			const ranForMs = nannyExit?.runtimeMs ?? (entry.startedAt === null ? 0 : Date.now() - entry.startedAt);
 			this.options.history.record(entry.config.id, {
 				type: "exit",
 				detail,
@@ -7342,6 +8033,10 @@ var init_log_files = __esmMin((() => {
 		get directory() {
 			return this.dir;
 		}
+		/** The retention a nanny has to apply itself, on the same files. */
+		get config() {
+			return this.getConfig();
+		}
 		append(serverId, line) {
 			if (this.closed || !this.getConfig().persist) return;
 			const bucket = this.pending.get(serverId) ?? [];
@@ -7369,6 +8064,11 @@ var init_log_files = __esmMin((() => {
 			const config = this.getConfig();
 			const files = [];
 			let sizeBytes = 0;
+			if (!config.persist) return {
+				enabled: false,
+				sizeBytes,
+				files
+			};
 			for (const file of this.rotateTargets(serverId)) try {
 				const stats = fs.statSync(file);
 				files.push({
@@ -7383,8 +8083,15 @@ var init_log_files = __esmMin((() => {
 				files
 			};
 		}
-		/** Reads the last `tail` lines, newest file first, padding from one rotation back. */
+		/**
+		* Reads the last `tail` lines, newest file first, padding from one rotation back.
+		*
+		* With `persist` off there is nothing this panel is willing to serve, even though a
+		* persistent entry's nanny still writes its file: that file is the log's transport —
+		* there is no pipe to carry it — and `persist` decides what counts as history.
+		*/
 		readTail(serverId, tail) {
+			if (!this.getConfig().persist) return [];
 			const sources = [this.currentPath(serverId), this.rotatedPath(serverId, 1)];
 			const lines = [];
 			for (const file of sources) {
@@ -8608,7 +9315,8 @@ async function runControlPlane(options) {
 		history,
 		logFiles,
 		notifications,
-		hostMonitor
+		hostMonitor,
+		nannyDir: defaultNannyDir
 	});
 	/**
 	* A config edited by hand — a text editor, a `git checkout`, a config-management
@@ -8790,20 +9498,6 @@ function toUpFlags(args) {
 		printConfig: args.printConfig === true
 	};
 }
-/**
-* How to run this CLI again in the same runtime. Under tsx that means passing the
-* resolved loader too, because the daemon's working directory is the project's,
-* not the package's.
-*/
-function runtimeArgs() {
-	let resolved = null;
-	const resolveTsx = () => resolved ??= import.meta.resolve("tsx");
-	return process.execArgv.map((arg) => {
-		if (arg === "tsx") return resolveTsx();
-		if (arg.startsWith("--import=") && arg.slice(9) === "tsx") return `--import=${resolveTsx()}`;
-		return arg;
-	});
-}
 /** One rotation is enough for a console log. */
 function rotateLog(file) {
 	try {
@@ -8905,6 +9599,7 @@ var DEFAULT_PORT$1, LOG_ROTATE_BYTES, upArgs;
 var init_up = __esmMin((() => {
 	init_args();
 	init_io();
+	init_runtime();
 	DEFAULT_PORT$1 = 3999;
 	LOG_ROTATE_BYTES = 5242880;
 	upArgs = {
@@ -8965,6 +9660,7 @@ async function runDown() {
 	if (await waitForExit(runtime.pid, 2e4)) {
 		clearRuntime();
 		process.stdout.write(`${green("stopped")}\n`);
+		await reportPersistent();
 		return;
 	}
 	process.stdout.write(`${dim("it did not stop in time — forcing")}\n`);
@@ -8972,6 +9668,32 @@ async function runDown() {
 	await waitForExit(runtime.pid, 5e3);
 	clearRuntime();
 	process.stdout.write(`${green("stopped")} (forced)\n`);
+	await reportPersistent();
+}
+/**
+* `down` stops what this panel supervises — a persistent entry is the one thing it
+* deliberately does not, so the silence about it has to be broken here. The state
+* files are the only record that survives the panel, so they answer it.
+*/
+async function reportPersistent() {
+	const { readNannyState, nannyIsAlive, SPEC_SUFFIX } = await Promise.resolve().then(() => (init_nanny$2(), nanny_exports$2));
+	const { defaultNannyDir } = await Promise.resolve().then(() => (init_paths(), paths_exports));
+	const { readdirSync } = await import("node:fs");
+	const path = await import("node:path");
+	let files = [];
+	try {
+		files = readdirSync(defaultNannyDir).filter((name) => name.endsWith(".json") && !name.endsWith(SPEC_SUFFIX));
+	} catch {
+		return;
+	}
+	const running = [];
+	for (const file of files) {
+		const state = readNannyState(path.join(defaultNannyDir, file));
+		if (state !== null && await nannyIsAlive(state, state.serverId)) running.push(state.serverId);
+	}
+	if (running.length === 0) return;
+	process.stdout.write(`${dim(`${running.length} persistent server(s) left running: ${running.join(", ")}`)}\n`);
+	process.stdout.write(`${dim("stop one from the panel, or restart it here to reattach")}\n`);
 }
 async function waitForExit(pid, timeoutMs) {
 	const { isProcessAlive } = await Promise.resolve().then(() => (init_daemon(), daemon_exports));
@@ -10000,9 +10722,150 @@ var init_ui_revert = __esmMin((() => {
 	});
 }));
 //#endregion
+//#region src/services/nanny.ts
+var nanny_exports$1 = /* @__PURE__ */ __exportAll({ runNanny: () => runNanny });
+/**
+* The nanny of one persistent entry: it spawns the child, owns its pipes, writes its
+* output to the entry's JSONL log and mirrors the child's exit.
+*
+* This is the whole reason a persistent entry survives the panel. The pipes belong to
+* a process that is not the panel, so a panel stop, restart or SIGKILL cannot break
+* them; the log keeps being written; and the exit code the panel would have collected
+* as a parent is left in the state file for whoever comes back.
+*
+* It deliberately does *not* restart anything: retries, backoff and health stay the
+* panel's business, so there is only ever one supervisor making that decision.
+*/
+async function runNanny(spec, statePath) {
+	const id = spec.serverId;
+	const startedAt = Date.now();
+	const logFile = nannyLogFile(spec.logDir, id);
+	const logFiles = new LogFiles(spec.logDir, () => ({
+		...spec.logs,
+		persist: true
+	}));
+	let childPid = null;
+	let lastExit = null;
+	let exitCode = 0;
+	const persistState = () => {
+		const state = {
+			serverId: id,
+			nannyPid: process.pid,
+			childPid,
+			startedAt,
+			logFile,
+			heartbeatAt: Date.now()
+		};
+		if (lastExit !== null) state.lastExit = lastExit;
+		writeNannyState(statePath, state);
+	};
+	const emit = (stream, text) => {
+		logFiles.append(id, {
+			ts: Date.now(),
+			stream,
+			text
+		});
+	};
+	const child = spawnManaged({
+		command: spec.command,
+		args: spec.args,
+		cwd: spec.cwd,
+		env: spec.env
+	}, { detached: false });
+	childPid = child.pid ?? null;
+	persistState();
+	emit("system", `persistent: nanny pid ${process.pid} runs this entry`);
+	const stdout = new LineSplitter((stream, text) => emit(stream, text));
+	const stderr = new LineSplitter((stream, text) => emit(stream, text));
+	child.stdout?.on("data", (chunk) => stdout.push("stdout", chunk));
+	child.stderr?.on("data", (chunk) => stderr.push("stderr", chunk));
+	const heartbeat = setInterval(persistState, NANNY_HEARTBEAT_MS);
+	heartbeat.unref();
+	let stopping = false;
+	const onSignal = (signal) => {
+		if (stopping) return;
+		stopping = true;
+		emit("system", `${signal} — stopping this entry (grace ${spec.stop.graceMs}ms)`);
+		terminate(child, {
+			signal: spec.stop.signal,
+			killGroup: false,
+			graceMs: spec.stop.graceMs
+		});
+	};
+	process.on("SIGTERM", () => onSignal("SIGTERM"));
+	process.on("SIGINT", () => onSignal("SIGINT"));
+	await new Promise((resolve) => {
+		let settled = false;
+		const finish = (code, signal, runtimeMs, note) => {
+			if (settled) return;
+			settled = true;
+			clearInterval(heartbeat);
+			stdout.flush("stdout");
+			stderr.flush("stderr");
+			lastExit = {
+				code,
+				signal,
+				at: Date.now(),
+				runtimeMs
+			};
+			emit("system", note ?? (signal !== null ? `persistent: exited with signal ${signal}` : `persistent: exited with code ${code}`));
+			persistState();
+			logFiles.dispose();
+			exitCode = code ?? (signal === null ? 0 : 1);
+			resolve();
+		};
+		child.once("exit", (code, signal) => finish(code, signal, Date.now() - startedAt));
+		child.once("error", (error) => {
+			finish(null, null, 0, `persistent: could not start the entry: ${error.message}`);
+		});
+	});
+	process.exit(exitCode);
+}
+var init_nanny$1 = __esmMin((() => {
+	init_nanny$2();
+	init_process();
+	init_log_buffer();
+	init_log_files();
+}));
+//#endregion
+//#region src/cli/nanny.ts
+var nanny_exports = /* @__PURE__ */ __exportAll({ nannyCommand: () => nannyCommand });
+var nannyCommand;
+var init_nanny = __esmMin((() => {
+	init_runtime();
+	nannyCommand = defineCommand({
+		meta: {
+			name: NANNY_COMMAND,
+			description: "internal: run one persistent entry"
+		},
+		args: {
+			id: {
+				type: "string",
+				required: true
+			},
+			spec: {
+				type: "string",
+				required: true
+			},
+			state: {
+				type: "string",
+				required: true
+			}
+		},
+		run: async ({ args }) => {
+			const { takeNannySpec } = await Promise.resolve().then(() => (init_nanny$2(), nanny_exports$2));
+			const { runNanny } = await Promise.resolve().then(() => (init_nanny$1(), nanny_exports$1));
+			const spec = takeNannySpec(args.spec);
+			if (spec.serverId !== args.id) throw new Error(`this spec runs "${spec.serverId}", not "${args.id}"`);
+			await runNanny(spec, args.state);
+		}
+	});
+}));
+//#endregion
 //#region src/cli.ts
 init_args();
 init_io();
+init_runtime();
 /**
 * The command line, and nothing else. Two things happen before citty is asked
 * anything: `--home`/`--project` are peeled off and applied (because
@@ -10012,9 +10875,10 @@ init_io();
 * own `#src` imports are safe: by the time one is imported, the directories are
 * already in the environment.
 *
-* The only static imports here are node builtins, citty, and the two path-free
-* local modules the pre-pass needs; every command (and so every state-reading
-* module) is a dynamic import behind `subCommands`.
+* The only static imports here are node builtins, citty, and the path-free local
+* modules the pre-pass needs (`helpers/runtime.ts` only names the hidden nanny
+* command); every command (and so every state-reading module) is a dynamic import
+* behind `subCommands`.
 */
 var CLI_ENTRY = fileURLToPath(import.meta.url);
 /**
@@ -10252,6 +11116,15 @@ async function main() {
 	const dirFlags = extractDirFlags(process.argv.slice(2));
 	if (dirFlags.error !== void 0) fail(dirFlags.error);
 	applyDirFlags(dirFlags);
+	if (dirFlags.rest[0] === "__nanny") {
+		const { nannyCommand } = await Promise.resolve().then(() => (init_nanny(), nanny_exports));
+		try {
+			await runCommand(nannyCommand, { rawArgs: dirFlags.rest });
+		} catch (error) {
+			fail(error instanceof Error ? error.message : String(error));
+		}
+		return;
+	}
 	const invocation = resolveInvocation(dirFlags.rest, commandNames);
 	if (invocation.kind === "help") {
 		process.stdout.write(invocation.command === void 0 ? USAGE : commandHelp(invocation.command));