omni-notify-mcp 1.3.306 → 1.3.307

package/dist/daemon.js

@@ -13,8 +13,9 @@ import { spawn } from "child_process";
 import { existsSync, readFileSync, renameSync, writeFileSync, mkdirSync } from "fs";
 import { join } from "path";
 import { fileURLToPath } from "url";
-import { ALWAYS_ON_PATH, CONFIG_DIR, PACKAGE_VERSION, startNotifyServer } from "./notify.js";
+import { ALWAYS_ON_PATH, CONFIG_DIR, PACKAGE_VERSION, startNotifyServer, yieldGateway } from "./notify.js";
 import { startNotifyDoor } from "./gateway/notifyDoor.js";
+import { announceTakeover } from "./shared/webhost/originHandover.js";
 import { TunnelRunner } from "./gateway/tunnel.js";
 const HEARTBEAT_MS = 10_000;
 function beat(pid = process.pid) {
@@ -70,14 +71,22 @@ if (stoppedByHand()) {
     console.log("[BOOT] BullseyeNotify always-on — a Stop was pressed on this machine; nothing started, and nothing beats until Start is pressed in the panel.");
     process.exit(0);
 }
+// The shared hand-over (src/shared/webhost/originHandover.js ensureResidentDoor) puts a later release on the chat door: the new build is started with --takeover over an IPC channel, says it waits, and binds once this build lets the door go.
+const takeover = process.argv.includes("--takeover");
+/** Whether this process writes the heartbeat: the next release only from the moment it holds the chat door, so a takeover that never lands leaves the serving build's beat alone; and a build that let the door go no longer, so the release that took it is the one beat. */
+let beating = !takeover;
 // The server's own timers are unref'd because a bridge lives as long as its stdin; this process lives until it is stopped.
-beat();
-/** Each beat reads the Stop first: a press in a window that may not end this process — the boot task's, in session 0 — stops it all the same, within one beat. */
+if (beating)
+    beat();
+/** Each tick reads the Stop first, beating or not: a press in a window that may not end this process — the boot task's, in session 0, or one still draining its gateway after a hand-over — stops it all the same, within one tick. */
 const beatTimer = setInterval(() => {
     if (stoppedByHand())
         process.exit(0);
-    beat();
+    if (beating)
+        beat();
 }, HEARTBEAT_MS);
+/** Settles once the chat door has closed after the next release's `POST /shutdown`; set only then, when that release is already running and waiting for the port, so this process starts no successor. */
+let handedOver;
 // Only the daemon that owns the gateway port runs the connector and publishes its state: a dormant one has nothing for it to reach.
 const tunnel = new TunnelRunner();
 startNotifyServer({
@@ -86,9 +95,20 @@ startNotifyServer({
         tunnel.beat(port);
         setInterval(() => tunnel.beat(port), HEARTBEAT_MS);
     },
-    onSuperseded: replaceWithInstalledBuild,
+    onSuperseded: () => (handedOver === undefined ? replaceWithInstalledBuild() : void handedOver.then(() => process.exit(0))),
+});
+startNotifyDoor(() => { beating = true; beat(); }, undefined, {
+    version: PACKAGE_VERSION,
+    takeover,
+    onShutdown: (closed) => {
+        beating = false;
+        handedOver = closed;
+        yieldGateway();
+    },
+    onTakeoverGaveUp: () => process.exit(1),
 });
-startNotifyDoor(() => { });
+if (takeover)
+    announceTakeover();
 for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
     process.on(signal, () => process.exit(0));
 }

package/dist/gateway/notifyDoor.js

@@ -23,11 +23,14 @@
 import { createServer, request as httpRequest } from "http";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { createMcpServer, sessionIdentity } from "../notify.js";
+import { answerShutdown, healthBody, TAKEOVER_BIND } from "../shared/webhost/originHandover.js";
 /** BN's own port block: 7470 is the gateway, so the chat tools take the next free one. */
 // GATE: the door's port may be moved ONLY under the test gate, so a suite drives a real always-on process on a port it owns; without the gate it is 7475 and no environment can redirect it. vscode-extension/alwaysOn.js probes the same rule.
 export const NOTIFY_DOOR_PORT = process.env.NOTIFY_MCP_TEST_ENDPOINTS === "1" && Number(process.env.NOTIFY_DOOR_PORT) > 0 ? Number(process.env.NOTIFY_DOOR_PORT) : 7475;
 export const NOTIFY_DOOR_PATH = "/mcp";
 const RETRY_MS = 5_000;
+/** The name the always-on process answers `/health` with: the `server` the boot task's supervisor hands BN's port over by (vscode-extension/originSupervisor.js ORIGINS). */
+export const NOTIFY_SERVER = "bullseye-notify";
 function headerOf(req, name) {
     const value = req.headers[name];
     const one = Array.isArray(value) ? value[0] : value;
@@ -76,18 +79,32 @@ function notifyDoorAnswers(port) {
  * stated, because then notify's chat tools are unreachable machine-wide and nothing else would say so.
  * Never rejects.
  */
-export function startNotifyDoor(onBound, port = NOTIFY_DOOR_PORT) {
+export function startNotifyDoor(onBound, port = NOTIFY_DOOR_PORT, resident) {
     let bound = false;
     let attempting = false;
+    let stopping = false;
     let lastCause = "";
     let listener = null;
+    const giveUpAt = Date.now() + TAKEOVER_BIND.giveUpMs;
     const say = (line) => { process.stderr.write(`[notify] ${line}\n`); };
     const attempt = () => {
-        if (bound || attempting)
+        if (bound || attempting || stopping)
             return;
         attempting = true;
         const server = listener = createServer((req, res) => {
             const path = new URL(req.url ?? "/", "http://door").pathname;
+            if (resident !== undefined && path === "/health") {
+                res.writeHead(200, { "content-type": "application/json" });
+                res.end(healthBody(NOTIFY_SERVER, port, resident.version));
+                return;
+            }
+            if (resident !== undefined && answerShutdown(req, res, server, NOTIFY_SERVER, port, resident.version, (closed) => {
+                stopping = true;
+                bound = false;
+                say(`the next release asked for the chat door on ${port}; build ${resident.version} lets it go`);
+                resident.onShutdown(closed);
+            }))
+                return;
             if (path !== NOTIFY_DOOR_PATH) {
                 refuse(res, 404, `the notify MCP door answers on ${NOTIFY_DOOR_PATH}`);
                 return;
@@ -113,6 +130,15 @@ export function startNotifyDoor(onBound, port = NOTIFY_DOOR_PORT) {
                 say(`the chat door on ${port} stopped serving (${cause}); rebinding`);
                 return;
             }
+            if (cause === "EADDRINUSE" && resident?.takeover === true) {
+                if (Date.now() >= giveUpAt) {
+                    say(`takeover gave up after ${TAKEOVER_BIND.giveUpMs / 1000}s: the chat door on ${port} was never let go by the release serving it, so build ${resident.version} serves nothing and that release keeps answering`);
+                    resident.onTakeoverGaveUp();
+                    return;
+                }
+                setTimeout(attempt, TAKEOVER_BIND.retryMs);
+                return;
+            }
             if (cause === lastCause)
                 return;
             lastCause = cause;

package/dist/notify.js

@@ -2538,6 +2538,14 @@ let ownershipAttempting = false;
 let door;
 const doorConnections = new Set();
 let supersededSaid = false;
+/** The next release asked for the chat door over `POST /shutdown` (the shared hand-over): this process is superseded by it as it is by a newer manifest, though no manifest beside it moved. */
+let yielding = false;
+let reaskOwnership = () => { };
+/** The always-on process's answer to the hand-over's `POST /shutdown`: the gateway passes to the release that asked, through the same step-aside a newer manifest triggers, so the pollers drain before the port is let go. */
+export function yieldGateway() {
+    yielding = true;
+    reaskOwnership();
+}
 /**
  * Once the extension installs a newer build, this process is superseded and the gateway passes to the installed build:
  * a superseded process never takes it while an always-on process beats, and one that holds it steps aside once no
@@ -2548,9 +2556,9 @@ function tryOwnGateway(polling, host) {
     if (ownershipAttempting)
         return;
     const installed = installedVersion();
-    if (installed !== PACKAGE_VERSION) {
+    if (yielding || installed !== PACKAGE_VERSION) {
         if (!supersededSaid)
-            log("·", "listener", `build ${PACKAGE_VERSION} is superseded by the installed ${installed}; this process hands the gateway to it`);
+            log("·", "listener", `build ${PACKAGE_VERSION} is superseded by ${yielding ? "the release that asked for the chat door" : `the installed ${installed}`}; this process hands the gateway to it`);
         supersededSaid = true;
         if (door !== undefined) {
             if (host.onSuperseded !== undefined || daemonBeats(installed))
@@ -2673,12 +2681,13 @@ export function startNotifyServer(host) {
     // reach nothing but the test's own socket.
     const standInApi = !!(process.env.NOTIFY_TELEGRAM_API || process.env.NOTIFY_SLACK_API || process.env.NOTIFY_DISCORD_API || process.env.NOTIFY_TEAMS_GRAPH_API || process.env.NOTIFY_NTFY_API || process.env.NOTIFY_AWS_API || process.env.NOTIFY_IMAP_API);
     const polling = process.env.NOTIFY_MCP_TEST_ENDPOINTS !== "1" || standInApi;
+    reaskOwnership = () => tryOwnGateway(polling, host);
     tryOwnGateway(polling, host);
     // a process holding the door is asked again when the installed build's manifest is written, the one thing that
     // can supersede it; the beat re-asks only a dormant process, whose owner may be a BN on another machine that no local
     // event announces, and a superseded one waiting for its gateway to fall quiet before it steps aside.
     const ownershipTimer = setInterval(() => {
-        if (door === undefined || supersededSaid)
+        if (door === undefined || supersededSaid || yielding)
             tryOwnGateway(polling, host);
     }, OWNERSHIP_RETRY_MS);
     watchNames(dirname(MANIFEST_PATH), [basename(MANIFEST_PATH)], () => tryOwnGateway(polling, host));

package/dist/shared/webhost/originHandover.js

@@ -0,0 +1,480 @@
+"use strict";
+const fs = require("fs");
+const http = require("http");
+const os = require("os");
+const path = require("path");
+const { spawn, spawnSync } = require("child_process");
+const TAKEOVER_READY = "waiting";
+// GATE: a start lock older than this belongs to a window that died mid-start, and the next window takes it over.
+const START_LOCK_STALE_MS = 60_000;
+// GATE: how long a new build is given to reach the wait, and how long it is then given to bind once the old one stops.
+const READY_BOUND_MS = 15_000;
+const BIND_BOUND_MS = 15_000;
+// GATE: how often the waiting build retries the bind — the width of the window the port refuses a new call.
+const BIND_RETRY_MS = 5;
+// GATE: how often a window re-checks that the machine's origin still answers; a crashed origin is started again, under the machine-wide start lock, within this long of any window being open.
+const WATCH_MS = 30_000;
+// GATE: how long a stopping server keeps answering what it already took before it cuts the rest.
+const DRAIN_BOUND_MS = 3_000;
+function ask(port, method, path) {
+    return new Promise((resolve) => {
+        const req = http.request({ host: "127.0.0.1", port, path, method, timeout: 2_000 }, (res) => {
+            let body = "";
+            res.setEncoding("utf8");
+            res.on("data", (chunk) => (body += chunk));
+            res.on("end", () => resolve({ ok: true, status: res.statusCode ?? 0, body }));
+            res.on("error", (err) => resolve({ ok: false, refused: false, why: err.message }));
+        });
+        req.on("timeout", () => {
+            req.destroy();
+            resolve({ ok: false, refused: false, why: `${method} ${path} timed out` });
+        });
+        req.on("error", (err) => resolve({ ok: false, refused: err.code === "ECONNREFUSED", why: err.code ?? err.message }));
+        req.end();
+    });
+}
+/** The machine's start lock for one origin, or undefined when another window holds it: windows racing to start the same origin spawn exactly one process between them. */
+function takeStartLock(origin) {
+    const file = path.join(os.homedir(), ".bullseye", "origin-start-locks", `${origin}.lock`);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    for (let attempt = 0; attempt < 3; attempt++) {
+        try {
+            fs.writeFileSync(file, JSON.stringify({ pid: process.pid, at: Date.now() }), { flag: "wx" });
+            return () => fs.rmSync(file, { force: true });
+        }
+        catch (err) {
+            // OWNER: ITER/LOOP — EEXIST means another window holds the lock, which is the answer this function reports — the stale check below decides whether to take over
+            if (err.code !== "EEXIST")
+                throw err;
+        }
+        let heldMs;
+        try {
+            heldMs = Date.now() - fs.statSync(file).mtimeMs;
+        }
+        catch (err) {
+            // OWNER: ITER/LOOP — ENOENT means the holder released between our create and our stat, so the lock is free now — the next attempt takes it
+            if (err.code === "ENOENT")
+                continue;
+            throw err;
+        }
+        if (heldMs < START_LOCK_STALE_MS)
+            return undefined;
+        fs.rmSync(file, { force: true });
+    }
+    return undefined;
+}
+const holdFile = (server, home) => path.join(home, ".bullseye", "origin-desired", `${server}.json`);
+/**
+ * Meni's standing intent for one origin: `stopped` once his Stop stands, `running` when none does (no file); a file that cannot be read or parsed, or names any other word, throws, because a failed read is never "running".
+ * @param {string} server
+ * @param {string} [home] the profile whose hold is read — the boot task names it at install
+ * @returns {{ word: "running", at?: number } | { word: "stopped", at: number }}
+ */
+function holdOf(server, home = os.homedir()) {
+    const file = holdFile(server, home);
+    if (!fs.existsSync(file))
+        return { word: "running" };
+    const read = JSON.parse(fs.readFileSync(file, "utf8"));
+    if (read.desired !== "stopped" && read.desired !== "running")
+        throw new Error(`${file} names desired ${JSON.stringify(read.desired)}, which is neither "stopped" nor "running"`);
+    return { word: read.desired, at: read.at };
+}
+function writeHold(server, desired) {
+    const file = holdFile(server, os.homedir());
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const temp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(temp, JSON.stringify({ desired, at: Date.now() }));
+    fs.renameSync(temp, file);
+}
+/** Records Meni's Stop BEFORE the origin is asked to stop, so no window, activation, release or boot task starts it again until a Start releases it. */
+const holdStopped = (server) => writeHold(server, "stopped");
+/** Releases Meni's Stop: every starter may start the origin again. */
+const releaseHold = (server) => writeHold(server, "running");
+/** The hand-over's answer for an origin Meni stopped, or undefined when no Stop stands. */
+function heldAnswer(server, port) {
+    const hold = holdOf(server);
+    if (hold.word !== "stopped")
+        return undefined;
+    return { state: "held", why: `Meni stopped ${server} on 127.0.0.1:${port} at ${new Date(hold.at).toISOString()} — it stays stopped until Start` };
+}
+/** What answers the port: `serving` with its health, `nothing` (a refused connection), or `unreadable` — a failure to read is never the same answer as a proven absence. */
+async function doorAnswer(port) {
+    const answer = await ask(port, "GET", "/health");
+    if (!answer.ok) {
+        return answer.refused ? { state: "nothing" } : { state: "unreadable", why: `GET /health on 127.0.0.1:${port} failed: ${answer.why}` };
+    }
+    if (answer.status !== 200) {
+        return { state: "unreadable", why: `127.0.0.1:${port}/health answered ${answer.status}, which is not one of our servers` };
+    }
+    let health;
+    try {
+        health = JSON.parse(answer.body);
+    }
+    catch (err) {
+        if (!(err instanceof SyntaxError))
+            throw err;
+        return { state: "unreadable", why: `127.0.0.1:${port}/health answered with a body that is not JSON (${answer.body.slice(0, 120)})` };
+    }
+    if (typeof health.server !== "string" || typeof health.version !== "string") {
+        return { state: "unreadable", why: `127.0.0.1:${port}/health answered without naming itself: ${answer.body.slice(0, 120)}` };
+    }
+    return { state: "serving", health: { server: health.server, version: health.version, pid: typeof health.pid === "number" ? health.pid : undefined } };
+}
+/** Whether the new process reached the point of waiting for the port — its one promise that it can take over. */
+function waitingForThePort(child, boundMs) {
+    return new Promise((resolve) => {
+        let settled = false;
+        const done = (ready) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(bound);
+            child.removeAllListeners("message");
+            child.removeAllListeners("exit");
+            child.removeAllListeners("error");
+            resolve(ready);
+        };
+        const bound = setTimeout(() => done(false), boundMs);
+        child.on("message", (message) => {
+            if (message?.takeover === TAKEOVER_READY)
+                done(true);
+        });
+        child.once("exit", () => done(false));
+        child.once("error", () => done(false));
+    });
+}
+/** Whether `server` answers the port at `wanted` or any later release, within the bound. */
+async function servesUntil(port, server, wanted, boundMs) {
+    const deadline = Date.now() + boundMs;
+    for (;;) {
+        const answer = await doorAnswer(port);
+        if (answer.state === "serving" && answer.health.server === server && !laterThan(wanted, answer.health.version))
+            return true;
+        if (Date.now() >= deadline)
+            return false;
+        await new Promise((resolve) => setTimeout(resolve, 25));
+    }
+}
+/** Whether anything answers the door within the bound — the window that holds the start lock is bringing it up. */
+async function answersUntil(port, boundMs) {
+    const deadline = Date.now() + boundMs;
+    for (;;) {
+        if ((await doorAnswer(port)).state !== "nothing")
+            return true;
+        if (Date.now() >= deadline)
+            return false;
+        await new Promise((resolve) => setTimeout(resolve, 25));
+    }
+}
+/** Whether `candidate` is a later release than `serving` — a daemon is never taken DOWN to an older build. */
+function laterThan(candidate, serving) {
+    const a = candidate.split(".").map(Number);
+    const b = serving.split(".").map(Number);
+    for (let i = 0; i < 3; i++) {
+        if (a[i] !== b[i])
+            return a[i] > b[i];
+    }
+    return false;
+}
+/**
+ * The process LISTENING on the port, asked of the operating system — read only for a build that predates `POST /shutdown`.
+ *
+ * Windows' `netstat -ano` is NOT that source on the Windows 11 boxes this fleet runs: every PID column reads 0 and a
+ * 127.0.0.1 listener is missing from the table altogether, so a pre-fix daemon could never be named and the first release
+ * to meet one left it serving. The connection table behind `Get-NetTCPConnection` does name it; a listening socket is the
+ * row whose REMOTE PORT is 0 (its State column reads empty there, so State is never the filter). `netstat` stays as the
+ * fallback for a host whose PowerShell refuses.
+ */
+function ownerOfPort(port) {
+    if (process.platform !== "win32") {
+        const asked = spawnSync("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN", "-t"], { encoding: "utf8", windowsHide: true });
+        const printed = asked.stdout ?? "";
+        const absence = asked.status === 1 && printed.trim() === "";
+        if (asked.error !== undefined || (asked.status !== 0 && !absence)) {
+            console.error(`[bullseye] could not ask this machine which process listens on 127.0.0.1:${port}: ${asked.error?.message ?? `the query exited ${asked.status}`}`);
+            return undefined;
+        }
+        const pid = Number(/^\s*(\d+)/m.exec(printed)?.[1]);
+        return Number.isInteger(pid) && pid > 0 ? pid : undefined;
+    }
+    const asked = spawnSync("powershell", ["-NoProfile", "-NonInteractive", "-Command", `(Get-NetTCPConnection -LocalPort ${port} -ErrorAction SilentlyContinue | Where-Object { $_.RemotePort -eq 0 } | Select-Object -First 1 -ExpandProperty OwningProcess)`], { encoding: "utf8", windowsHide: true });
+    const owner = Number((asked.stdout ?? "").trim());
+    if (asked.status === 0 && Number.isInteger(owner) && owner > 0)
+        return owner;
+    return ownerOfPortByNetstat(port);
+}
+/** The fallback reading of the same fact, for a Windows host whose PowerShell will not answer. */
+function ownerOfPortByNetstat(port) {
+    const asked = spawnSync("netstat", ["-ano"], { encoding: "utf8", windowsHide: true });
+    const printed = asked.stdout ?? "";
+    if (asked.error !== undefined || asked.status !== 0) {
+        console.error(`[bullseye] could not ask this machine which process listens on 127.0.0.1:${port}: ${asked.error?.message ?? `the query exited ${asked.status}`}`);
+        return undefined;
+    }
+    const found = /LISTENING\s+(\d+)/i.exec(printed.split("\n").find((line) => new RegExp(`[:.]${port}\\s+\\S+\\s+LISTENING\\s+`, "i").test(line)) ?? "");
+    const pid = Number(found?.[1]);
+    return Number.isInteger(pid) && pid > 0 ? pid : undefined;
+}
+/** Stop the server holding the port: over its own door first (which drains), and only a build older than that door is ended as a process, the pid read from the operating system and never from a remembered hint. */
+async function stopServing(port, health, siblingPid) {
+    const answered = await ask(port, "POST", "/shutdown");
+    if (answered.ok && answered.status >= 200 && answered.status < 300) {
+        return true;
+    }
+    const listening = ownerOfPort(port);
+    if (listening === undefined || listening === siblingPid || (health.pid !== undefined && health.pid !== listening)) {
+        console.error(`[bullseye] the resident server on 127.0.0.1:${port} (${health.version}) does not answer the stop door, and ${listening === undefined ? "no process was found holding the port" : listening === siblingPid ? `the port is now held by this release's own waiting process (pid ${listening})` : `the port is held by pid ${listening} while /health named ${health.pid}`} — nothing was signalled, so it keeps serving this release`);
+        return false;
+    }
+    const now = await doorAnswer(port);
+    if (now.state !== "serving" || now.health.version !== health.version || (now.health.pid !== undefined && now.health.pid !== listening)) {
+        console.error(`[bullseye] 127.0.0.1:${port} no longer answers ${health.version} on pid ${listening} — it now answers ${now.state === "serving" ? `${now.health.version}${now.health.pid === undefined ? "" : ` on pid ${now.health.pid}`}` : now.state}, so nothing was signalled`);
+        return false;
+    }
+    try {
+        process.kill(listening, "SIGTERM");
+        return true;
+    }
+    catch (err) {
+        if (err.code !== "ESRCH" && err.code !== "EPERM")
+            throw err;
+        console.error(`[bullseye] the resident server on 127.0.0.1:${port} (${health.version}, pid ${listening}) could not be stopped: ${err.message}`);
+        return false;
+    }
+}
+/** The release a bundle at `<root>/dist/<file>` serves: the `version` of the `<root>/package.json` beside it, which is where its `/health` reads it from. */
+function bundleRelease(bundle) {
+    return JSON.parse(fs.readFileSync(path.join(path.dirname(bundle), "..", "package.json"), "utf8")).version;
+}
+/**
+ * ONE hand-over protocol for every resident MCP origin (BB, FV, DA). Start the origin when nothing answers its port
+ * (under the machine's start lock, re-checked once held), and hand the port to `wanted` when the one answering is an
+ * older release of the same server: the new build is spawned FIRST with `--takeover` and waits for the port, and only
+ * once it has said so is the old process asked to stop over its own `POST /shutdown`, which drains what it is
+ * answering before it closes the listener. A new build that never reached the wait leaves the old server serving.
+ * `door` = { port, server, wanted, spawnDoor(takeover) -> ChildProcess } where spawnDoor
+ * starts the bundle detached (with an IPC channel and `--takeover` when asked). Returns what happened:
+ * serving | left alone | failed | held (Meni's Stop stands, so nothing is started).
+ */
+async function ensureResidentDoor(door) {
+    const { port, server, wanted } = door;
+    const answer = await doorAnswer(port);
+    if (answer.state === "nothing") {
+        const heldBefore = heldAnswer(server, port);
+        if (heldBefore !== undefined)
+            return heldBefore;
+        const release = takeStartLock(server);
+        if (release === undefined) {
+            if (!(await answersUntil(port, READY_BOUND_MS)))
+                return { state: "failed", why: `another window was starting ${server} on 127.0.0.1:${port} but nothing answered it` };
+            return ensureResidentDoor(door);
+        }
+        try {
+            if ((await doorAnswer(port)).state === "nothing") {
+                const held = heldAnswer(server, port);
+                if (held !== undefined)
+                    return held;
+                door.spawnDoor(false).unref();
+                return (await servesUntil(port, server, wanted, READY_BOUND_MS)) ? { state: "serving", version: wanted } : { state: "failed", why: `${wanted} was started on 127.0.0.1:${port} but never answered` };
+            }
+        }
+        finally {
+            release();
+        }
+        return ensureResidentDoor(door);
+    }
+    if (answer.state === "unreadable") {
+        return { state: "left alone", why: answer.why };
+    }
+    const { health } = answer;
+    if (health.server !== server) {
+        return { state: "left alone", why: `127.0.0.1:${port} is answered by "${health.server}" (${health.version}), not by ${server}` };
+    }
+    if (!laterThan(wanted, health.version)) {
+        return { state: "serving", version: health.version };
+    }
+    const release = takeStartLock(server);
+    if (release === undefined) {
+        return (await servesUntil(port, server, wanted, READY_BOUND_MS + 2 * BIND_BOUND_MS)) ? { state: "serving", version: wanted } : { state: "failed", why: `another window was putting ${wanted} on 127.0.0.1:${port} but it never answered` };
+    }
+    try {
+        const held = await doorAnswer(port);
+        if (held.state === "serving" && held.health.server === server && laterThan(wanted, held.health.version)) {
+            const stopped = heldAnswer(server, port);
+            if (stopped !== undefined)
+                return stopped;
+            return await takeThePort(door, held.health);
+        }
+    }
+    finally {
+        release();
+    }
+    return ensureResidentDoor(door);
+}
+/** The swap itself, run under the start lock so one window at a time puts a release on the port. */
+async function takeThePort(door, health) {
+    const { port, server, wanted } = door;
+    const next = door.spawnDoor(true);
+    if (!(await waitingForThePort(next, READY_BOUND_MS))) {
+        next.kill();
+        next.unref();
+        return { state: "failed", why: `the new build ${wanted} never reached the point of waiting for 127.0.0.1:${port}; ${health.version} is still serving` };
+    }
+    next.unref();
+    if (!(await stopServing(port, health, next.pid))) {
+        if (await servesUntil(port, server, wanted, BIND_BOUND_MS)) {
+            console.error(`[bullseye] the resident server on 127.0.0.1:${port} took this release: ${health.version} → ${wanted}`);
+            return { state: "serving", version: wanted };
+        }
+        return { state: "failed", why: `${health.version} would not stop, so ${wanted} was not put on 127.0.0.1:${port}` };
+    }
+    if (!(await servesUntil(port, server, wanted, BIND_BOUND_MS))) {
+        const now = await doorAnswer(port);
+        return { state: "failed", why: `${wanted} was started and ${health.version} was stopped, but 127.0.0.1:${port} now answers ${now.state === "serving" ? now.health.version : now.state}; start the extension again to take the port` };
+    }
+    console.error(`[bullseye] the resident server on 127.0.0.1:${port} took this release: ${health.version} → ${wanted}`);
+    return { state: "serving", version: wanted };
+}
+/** The per-day file the resident origin on `port` writes its stderr to, under the user's local app data. */
+function residentLogFile(port, now = new Date()) {
+    const base = process.env.LOCALAPPDATA ?? path.join(os.homedir(), ".local", "state");
+    const day = `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, "0")}-${String(now.getDate()).padStart(2, "0")}`;
+    return path.join(base, "Bullseye", "origin-logs", `origin-${port}-${day}.log`);
+}
+/** Starts `bundle` as the origin on `port`: detached and windowless so closing the window leaves it up, run as node by Electron's own binary, stderr appended to its per-day log, with an IPC channel and `--takeover` when it is the next release. */
+function spawnBundle(bundle, port, cwd, takeover) {
+    const file = residentLogFile(port);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const log = fs.openSync(file, "a");
+    try {
+        return spawn(process.execPath, [bundle, `--http=${port}`, ...(takeover ? ["--takeover"] : [])], {
+            detached: true,
+            stdio: takeover ? ["ignore", "ignore", log, "ipc"] : ["ignore", "ignore", log],
+            windowsHide: true,
+            cwd,
+            env: { ...process.env, ELECTRON_RUN_AS_NODE: "1" },
+        });
+    }
+    finally {
+        fs.closeSync(log);
+    }
+}
+/**
+ * Keeps the machine's one origin up and current for as long as this window lives: an immediate pass, then one per
+ * `WATCH_MS`. `origin` = { port, start() -> Promise } where `start` runs the hand-over and throws when it did not
+ * serve. A failure is reported once per distinct reason through `report`. Returns what the window disposes on close.
+ */
+function keepDoor(origin, report) {
+    let lastWhy;
+    let running = false;
+    const pass = async () => {
+        if (running)
+            return;
+        running = true;
+        let why;
+        try {
+            await origin.start();
+        }
+        catch (err) {
+            // OWNER: the watch timer is this pass's trigger root — a pass that throws is reported once and the next tick tries again
+            if (!(err instanceof Error))
+                throw err;
+            why = err.message;
+        }
+        finally {
+            running = false;
+        }
+        if (why !== undefined && why !== lastWhy)
+            report(`the MCP origin on 127.0.0.1:${origin.port} is not serving this release — ${why}`);
+        lastWhy = why;
+    };
+    void pass();
+    const timer = setInterval(() => void pass(), WATCH_MS);
+    return { dispose: () => clearInterval(timer) };
+}
+/** The body of `GET /health` a resident origin answers — the pid lets the next release stop a build that predates `/shutdown`. */
+function healthBody(server, port, version) {
+    return JSON.stringify({ ok: true, server, port, pid: process.pid, version });
+}
+/**
+ * Answers `POST /shutdown` on an origin's own door: replies 202 (flushed before the listener closes, since the asker
+ * is the process taking the port), then drains and exits. A request carrying an `Origin` header comes from a web page
+ * and is refused. Returns true when the request was this door's. A process with more to let go of than this door (BN's
+ * gateway pollers) passes `onStopping`: it is handed the listener's close in place of the exit, and ends itself.
+ */
+function answerShutdown(req, res, httpServer, server, port, version, onStopping) {
+    if ((req.url ?? "/").split("?")[0] !== "/shutdown")
+        return false;
+    if (req.headers.origin !== undefined) {
+        res.writeHead(403, { "content-type": "application/json" });
+        res.end(JSON.stringify({ error: "POST /shutdown is for the next release of this server, never for a web page" }));
+        return true;
+    }
+    if (req.method !== "POST") {
+        res.writeHead(405, { "content-type": "application/json", allow: "POST" });
+        res.end(JSON.stringify({ error: `${req.method} /shutdown is not this server's door; POST it to stop a process the next release replaces` }));
+        return true;
+    }
+    res.writeHead(202, { "content-type": "application/json" });
+    res.end(JSON.stringify({ ok: true, stopping: true, server, port, version }), () => {
+        const closed = new Promise((resolve) => httpServer.close(() => resolve()));
+        httpServer.closeIdleConnections();
+        if (onStopping !== undefined) {
+            setTimeout(() => httpServer.closeAllConnections(), DRAIN_BOUND_MS).unref();
+            onStopping(closed);
+            return;
+        }
+        void closed.then(() => process.exit(0));
+        setTimeout(() => {
+            httpServer.closeAllConnections();
+            process.exit(0);
+        }, DRAIN_BOUND_MS).unref();
+    });
+    return true;
+}
+/** The next release's one promise to the process that started it: it now waits for the port (what takeThePort waits for), and the IPC channel is let go. */
+function announceTakeover() {
+    if (process.connected)
+        process.send({ takeover: TAKEOVER_READY }, () => process.disconnect());
+}
+/** How the next release waits for the port: it retries the bind every `retryMs` and gives up once `giveUpMs` has passed since it started. */
+const TAKEOVER_BIND = { retryMs: BIND_RETRY_MS, giveUpMs: READY_BOUND_MS };
+/**
+ * Binds `httpServer` on the loopback port. Without `--takeover` the first refusal means another process already
+ * serves it and this one leaves quietly. With `--takeover` it is the next release: it tells its parent over IPC that it
+ * waits, retries the bind until the old build closes its listener, and gives up only when the bound passes. While
+ * Meni's Stop stands the process exits before it binds, whoever started it — a window, a release or a boot-task
+ * supervisor that predates the hold.
+ */
+function listenWithHandover(httpServer, { server, port, version, onServing }) {
+    const takeover = process.argv.includes("--takeover");
+    if (!takeover && holdOf(server).word === "stopped") {
+        console.error(`[${server}-mcp] Meni stopped ${server} on 127.0.0.1:${port} — it stays stopped until Start, so this process serves nothing`);
+        process.exit(0);
+    }
+    const giveUpAt = Date.now() + READY_BOUND_MS;
+    httpServer.on("error", (err) => {
+        if (err.code !== "EADDRINUSE")
+            throw err;
+        if (!takeover) {
+            console.error(`[${server}-mcp] 127.0.0.1:${port} is already served by another process — nothing to start here`);
+            process.exit(0);
+        }
+        if (Date.now() >= giveUpAt) {
+            console.error(`[${server}-mcp] takeover gave up after ${READY_BOUND_MS}ms: 127.0.0.1:${port} was never released by the process serving it — this release is NOT serving, and the one that is has been left to answer`);
+            process.exit(1);
+        }
+        void doorAnswer(port).then((now) => {
+            if (now.state === "serving" && now.health.version === version)
+                process.exit(0);
+            setTimeout(() => httpServer.listen(port, "127.0.0.1"), BIND_RETRY_MS);
+        });
+    });
+    if (takeover) {
+        console.error(`[${server}-mcp] takeover: waiting for 127.0.0.1:${port}, which an earlier release holds`);
+        announceTakeover();
+    }
+    httpServer.once("listening", onServing);
+    httpServer.listen(port, "127.0.0.1");
+}
+module.exports = { takeStartLock, bundleRelease, spawnBundle, residentLogFile, keepDoor, ensureResidentDoor, doorAnswer, healthBody, answerShutdown, announceTakeover, TAKEOVER_BIND, listenWithHandover, holdOf, holdStopped, releaseHold };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omni-notify-mcp",
-  "version": "1.3.306",
+  "version": "1.3.307",
   "description": "Reach your AI agents from anywhere — and let them reach you. One stdio process serves the whole tool surface to Claude Code, GitHub Copilot Chat and Codex: desktop, Telegram, Slack, ntfy, Discord, Teams and SMS are configured in one file, and agents notify you when long work finishes or a decision is needed, ask you a question and wait for your answer, and receive and reply to the messages you send them — with Do Not Disturb and idle detection deciding what actually gets through.",
   "main": "dist/index.js",
   "type": "module",