openwolf-enhanced 1.26.0 → 1.28.0

package/dist/hooks/session-start.js

@@ -1,6 +1,6 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { getWolfDir, ensureWolfDir, writeJSON, appendMarkdown, readJSON, timestamp, timeShort, buildResumeDigest, readStdin, withLock, SESSION_SUMMARY_SCAFFOLD, bookInjection } from "./shared.js";
+import { getWolfDir, ensureWolfDir, writeJSON, appendMarkdown, readJSON, timestamp, timeShort, buildResumeDigest, readStdin, tryWithLock, sessionFileFor, pruneOldSessionFiles, SESSION_SUMMARY_SCAFFOLD, bookInjection } from "./shared.js";
 import { estimateTokens, getTokenRatios } from "./token-estimator.js";
 async function main() {
     ensureWolfDir();
@@ -19,7 +19,6 @@ async function main() {
     }
     catch { }
     const hooksDir = path.join(wolfDir, "hooks");
-    const sessionFile = path.join(hooksDir, "_session.json");
     const now = new Date();
     const sessionId = `session-${now.toISOString().slice(0, 10)}-${String(now.getHours()).padStart(2, "0")}${String(now.getMinutes()).padStart(2, "0")}`;
     // SessionStart fires for startup/resume/clear/compact. Only startup and clear begin a genuinely
@@ -27,16 +26,26 @@ async function main() {
     // would wipe this session's read/write tracking mid-flight and append a spurious memory header
     // on every compaction (compaction survival).
     let source = "startup";
+    let harnessSessionId;
     try {
         const hookInput = JSON.parse(await readStdin());
         if (typeof hookInput.source === "string")
             source = hookInput.source;
+        if (typeof hookInput.session_id === "string")
+            harnessSessionId = hookInput.session_id;
     }
     catch { }
+    // One state file per session (see sessionFileFor). Two agents in the same project used to share
+    // one, so the second one's startup wiped the first one's in-flight tracking.
+    const sessionFile = sessionFileFor(hooksDir, harnessSessionId);
+    // One file per session accumulates; a finished session is already folded into the ledger.
+    pruneOldSessionFiles(hooksDir);
     const continuing = (source === "compact" || source === "resume") && fs.existsSync(sessionFile);
     if (!continuing) {
-        // Create fresh session state
-        writeJSON(sessionFile, {
+        // Create fresh session state. Under the lock like every other writer of this file: the reset is
+        // a whole-file replacement, so an unlocked write here could land in the middle of another
+        // hook's read-modify-write and hand it a half-written file to parse.
+        tryWithLock(sessionFile, () => writeJSON(sessionFile, {
             session_id: sessionId,
             started: timestamp(),
             files_read: {},
@@ -47,7 +56,7 @@ async function main() {
             repeated_reads_warned: 0,
             cerebrum_warnings: 0,
             stop_count: 0,
-        });
+        }));
         // Append session header to memory.md
         const memoryPath = path.join(wolfDir, "memory.md");
         const header = `\n## Session: ${now.toISOString().slice(0, 10)} ${timeShort()}\n\n${SESSION_SUMMARY_SCAFFOLD}\n\n| Time | Action | File(s) | Outcome | ~Tokens |\n|------|--------|---------|---------|--------|\n`;
@@ -87,7 +96,7 @@ async function main() {
         // Same lock as the stop hook's ledger write — a session ending in one process while another
         // starts must not clobber the read-modify-write.
         const ledgerPath = path.join(wolfDir, "token-ledger.json");
-        withLock(ledgerPath, () => {
+        tryWithLock(ledgerPath, () => {
             const ledger = readJSON(ledgerPath, { version: 1, lifetime: { total_sessions: 0 } });
             ledger.lifetime.total_sessions++;
             writeJSON(ledgerPath, ledger);

package/dist/hooks/shared.js

@@ -74,10 +74,31 @@ export function ensureWolfDir() {
         process.exit(0);
     }
 }
-// Best-effort advisory lock around a read-modify-write cycle so concurrent hook/daemon
-// processes don't clobber each other's updates to the same file (M1). It NEVER blocks a hook
-// for long: it waits up to ~1s for the lock, steals a stale lock (>5s old), and if it still
-// can't acquire it, runs unlocked rather than risk a hook timeout.
+// Advisory lock around a read-modify-write cycle so concurrent hook/daemon processes don't clobber
+// each other's updates to the same file (M1). It waits, steals a lock left behind by a dead process
+// (>5s old), and — if it still cannot acquire — FAILS instead of proceeding.
+//
+// [2026-08-31] It used to run the callback unlocked after the wait expired, which defeats the lock
+// for every writer that respects it: the whole point is that exactly one process is inside the
+// critical section, and a participant that proceeds anyway makes the guarantee vacuous for
+// everybody else. Under contention that is not a rare fallback, it is the common path — contention
+// is precisely when the timeout fires. Failing closed loses one update; proceeding unlocked loses
+// somebody else's, and can hand a half-written file to the next reader.
+//
+// The poll also started at a flat 25ms. With seven hooks around one file, a herd needs several
+// rounds to drain and each waiter burned 25ms per attempt whether or not the lock was free a
+// microsecond later. It now starts at 2ms and backs off, so the common case (a lock held for the
+// microseconds of one write) is picked up almost immediately and a herd drains inside the budget.
+export class LockTimeoutError extends Error {
+    targetPath;
+    waitedMs;
+    constructor(targetPath, waitedMs) {
+        super(`could not acquire the lock on ${path.basename(targetPath)} within ${waitedMs}ms — update skipped`);
+        this.targetPath = targetPath;
+        this.waitedMs = waitedMs;
+        this.name = "LockTimeoutError";
+    }
+}
 function sleepSync(ms) {
     try {
         Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
@@ -86,10 +107,11 @@ function sleepSync(ms) {
 }
 export function withLock(targetPath, fn) {
     const lockPath = targetPath + ".lock";
-    const MAX_WAIT_MS = 1000;
+    const MAX_WAIT_MS = 1500; // well inside the tightest hook budget (5s)
     const STALE_MS = 5000;
     const start = Date.now();
     let held = false;
+    let backoff = 2;
     while (Date.now() - start < MAX_WAIT_MS) {
         try {
             const fd = fs.openSync(lockPath, "wx");
@@ -111,21 +133,115 @@ export function withLock(targetPath, fn) {
             catch {
                 continue;
             } // lock vanished — retry immediately
-            sleepSync(25);
+            sleepSync(backoff);
+            backoff = Math.min(backoff * 2, 50);
         }
     }
+    if (!held)
+        throw new LockTimeoutError(targetPath, Date.now() - start);
     try {
         return fn();
     }
     finally {
-        if (held) {
-            try {
-                fs.unlinkSync(lockPath);
-            }
-            catch { /* ignore */ }
+        try {
+            fs.unlinkSync(lockPath);
+        }
+        catch { /* ignore */ }
+    }
+}
+/**
+ * withLock for callers that must never throw — a hook that dies takes the tool call with it.
+ * Returns whether the callback ran; a lost update is reported on stderr rather than silently
+ * dropped, because "the number is wrong and nobody knows why" is the failure this whole lock
+ * exists to prevent.
+ */
+export function tryWithLock(targetPath, fn) {
+    try {
+        withLock(targetPath, fn);
+        return true;
+    }
+    catch (e) {
+        if (e instanceof LockTimeoutError) {
+            process.stderr.write(`[openwolf] ${e.message}\n`);
+            return false;
         }
+        throw e;
     }
 }
+/**
+ * Where this session's tracking state lives.
+ *
+ * There used to be exactly one `_session.json` per project, shared by every session running in it.
+ * Two agents in the same repo — two terminals, or an agent plus a scripted run — meant the second
+ * one's SessionStart reset the first one's tracking mid-flight, and from then on both wrote into
+ * the same file: reads counted against the wrong session, the ledger entry for the first one
+ * ending with whatever the second had accumulated.
+ *
+ * Every harness hands each hook invocation a `session_id`, so the state is keyed by it. When there
+ * is none (an agent that does not provide one), the legacy shared path is used exactly as before —
+ * no worse than it was, and consistent within that agent.
+ */
+export function sessionFileFor(hooksDir, sessionId) {
+    if (typeof sessionId === "string") {
+        // Same reasoning as the cron task slug: this string becomes a file name and arrives from
+        // outside, so it is reduced to something that can only ever name a file in this directory.
+        const safe = sessionId.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^[-.]+|[-.]+$/g, "").slice(0, 64);
+        if (safe)
+            return path.join(hooksDir, `_session-${safe}.json`);
+    }
+    return path.join(hooksDir, "_session.json");
+}
+/**
+ * Delete per-session state files nobody will read again.
+ *
+ * One file per session means the directory grows with every session, forever. The stop hook has
+ * already folded a finished session into token-ledger.json, so the file is spent; a week is
+ * generous room for a session that is somehow still live. The legacy shared `_session.json` is
+ * never removed — it has no session it belongs to, so age says nothing about it.
+ */
+export function pruneOldSessionFiles(hooksDir, maxAgeDays = 7) {
+    const cutoff = Date.now() - maxAgeDays * 24 * 60 * 60 * 1000;
+    let names;
+    try {
+        names = fs.readdirSync(hooksDir);
+    }
+    catch {
+        return;
+    }
+    for (const name of names) {
+        if (!/^_session-.+\.json(\.lock)?$/.test(name))
+            continue;
+        const f = path.join(hooksDir, name);
+        try {
+            if (fs.statSync(f).mtimeMs < cutoff)
+                fs.unlinkSync(f);
+        }
+        catch { /* vanished or unreadable — nothing to clean */ }
+    }
+}
+/**
+ * Read-modify-write `_session.json` under the lock, in one place.
+ *
+ * Every hook in a session mutates this one file, and until now only two of the seven writers took
+ * the lock at all: the rest did `readJSON` … `writeJSON` around unrelated work, so a PostToolUse
+ * hook finishing while PreToolUse was mid-cycle silently dropped one of the two updates. Reads and
+ * writes get counted for the token ledger, so a lost update is a wrong number in a report nobody
+ * can audit afterwards.
+ *
+ * The mutator receives the state as it is ON DISK at the moment the lock is held — not a snapshot
+ * taken earlier — and must apply a DELTA (increment, add a key), never assign a whole object it
+ * captured before. That is what makes the update safe against a concurrent writer.
+ */
+export function updateSession(sessionFile, fallback, mutate) {
+    // tryWithLock, not withLock: a hook that throws takes the tool call with it. Under contention
+    // the update is dropped and SAID SO on stderr — the alternative (writing anyway) is what made
+    // the lock decorative in the first place.
+    return tryWithLock(sessionFile, () => {
+        const session = readJSON(sessionFile, fallback);
+        mutate(session);
+        writeJSON(sessionFile, session);
+    });
+}
 // A missing file is normal (first run) and silently yields the fallback. An EXISTING file that
 // fails to parse is a different situation: whatever it held is about to be treated as empty, and
 // a read-modify-write caller would then overwrite it with defaults. That must at least be visible.
@@ -145,7 +261,7 @@ export function bookInjection(wolfDir, tokens) {
         return;
     const ledgerPath = path.join(wolfDir, "token-ledger.json");
     try {
-        withLock(ledgerPath, () => {
+        tryWithLock(ledgerPath, () => {
             // [2026-08-20, review] The first cut used readJSON with a two-field fallback and then wrote
             // it back. On an UNPARSEABLE ledger that produced a valid-looking file with no `sessions[]`,
             // and the stop hook died on `ledger.sessions.findIndex(...)` from then on — silently, because
@@ -201,10 +317,24 @@ export function readJSON(filePath, fallback) {
         return JSON.parse(raw);
     }
     catch (e) {
-        process.stderr.write(`[openwolf] ${path.basename(filePath)} exists but is not valid JSON — using defaults (${e.message})\n`);
+        // The caller is about to treat this file as empty and, in a read-modify-write, overwrite it
+        // with defaults — so a corrupt token-ledger.json meant months of usage history vanished on the
+        // next Stop hook, with one line on stderr as the only trace. Move it aside first. Recovery is
+        // then a possibility rather than a hope, and because the path no longer exists, the next read
+        // takes the ordinary "missing file" branch instead of warning forever.
+        quarantineCorrupt(filePath);
+        process.stderr.write(`[openwolf] ${path.basename(filePath)} was not valid JSON — moved aside, using defaults (${e.message})\n`);
         return fallback;
     }
 }
+/** Rename a corrupt file to <name>.corrupt-<stamp>. Best-effort: never throws, never blocks a read. */
+function quarantineCorrupt(filePath) {
+    try {
+        const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+        fs.renameSync(filePath, `${filePath}.corrupt-${stamp}`);
+    }
+    catch { /* unwritable directory, race with another process — defaults still apply */ }
+}
 // Duplicated from utils/fs-safe.ts (separate build roots). Never throws — a hook must not kill a
 // session over a failed journal write — but a total failure is reported on stderr instead of
 // vanishing: a silently dropped write once hid a completely broken persistence path (bug-183).
@@ -298,12 +428,17 @@ export function makeIgnoreMatcher(patterns) {
             if (pat.startsWith("*.") && norm.endsWith(pat.slice(1)))
                 return true;
         }
-        if (pat.includes("*")) {
+        // `?` is a gitignore wildcard for exactly one character, and it also has to be handled BEFORE
+        // this becomes a regex — it used to be neither escaped nor translated, so it survived into the
+        // pattern as a regex quantifier and made the preceding character OPTIONAL. `build?/*.js` then
+        // matched `buil/x.js` and missed `build2/x.js`: the rule silently covered the wrong files.
+        if (pat.includes("*") || pat.includes("?")) {
             const re = new RegExp("^" +
                 pat
                     .replace(/[.+^${}()|[\]\\]/g, "\\$&")
                     .replace(/\*\*/g, "\u0000")
                     .replace(/\*/g, "[^/]*")
+                    .replace(/\?/g, "[^/]")
                     .replace(/\u0000/g, ".*") +
                 "$");
             if (re.test(norm) || (!anchored && re.test(base)))
@@ -1054,6 +1189,78 @@ export function readStdin() {
 export function normalizePath(p) {
     return p.replace(/\\/g, "/");
 }
+/**
+ * The file's path relative to the project root, or "" when it is outside.
+ *
+ * Lexical first — cheap, and correct for the overwhelming majority. But a lexical comparison alone
+ * silently drops a whole project whenever the root is reached through a symlink: /home/me/work is
+ * a link to /mnt/data/work, the agent opens /mnt/data/work/src/a.ts, the prefix does not match, and
+ * every read in that project goes untracked with no error anywhere. macOS makes this the default
+ * case for anything under /tmp (-> /private/tmp).
+ *
+ * So a lexical miss gets a second opinion from realpath, on both sides. Resolution only runs when
+ * the cheap answer already said no, so the common path costs nothing.
+ */
+export function relativeToProject(absFile, projectDir) {
+    const file = normalizePath(absFile);
+    const root = normalizePath(projectDir);
+    // Require the SEPARATOR after the root — a bare startsWith also matched a sibling directory
+    // sharing the prefix (/root/orderflow2 counted as inside /root/orderflow).
+    if (file.startsWith(root + "/"))
+        return file.slice(root.length + 1);
+    if (file === root)
+        return "";
+    try {
+        const realFile = normalizePath(fs.realpathSync(absFile));
+        const realRoot = normalizePath(fs.realpathSync(projectDir));
+        if (realFile.startsWith(realRoot + "/"))
+            return realFile.slice(realRoot.length + 1);
+    }
+    catch { /* the file may not exist yet, or the root is gone — outside, then */ }
+    return "";
+}
+/**
+ * Does an absolute (forward-slashed) file path correspond to this anatomy.md entry?
+ *
+ * anatomy entries are project-relative ("src/api/client.ts"); the hooks see an absolute path. The
+ * old test was `abs.endsWith(rel) || abs.endsWith("/" + rel)`, and the first half of that had no
+ * path-segment boundary: `/home/me/vendor/src/api/client.ts` and `/tmp/other-src/api/client.ts`
+ * both "matched" an entry for `src/api/client.ts`, so the hook printed another file's description
+ * and token estimate and booked an anatomy HIT for a file anatomy.md had never seen. The second
+ * half of the old expression was already correct, so this keeps that and drops the loose one — an
+ * exact equality covers the case where the path is already relative.
+ */
+export function matchesAnatomyEntry(filePath, entryRelPath) {
+    return filePath === entryRelPath || filePath.endsWith("/" + entryRelPath);
+}
+/**
+ * Does this project-relative path point OUTSIDE the project root?
+ *
+ * Input is the output of `normalizePath(path.relative(root, file))`. The obvious test —
+ * "does it start with `..`" — is complete on POSIX and wrong on Windows, because `path.relative`
+ * cannot express a route between two drives and gives up by returning the target ABSOLUTE:
+ *
+ *   path.win32.relative("C:\\proj", "F:\\secrets\\x")  ===  "F:\\secrets\\x"
+ *
+ * That has no leading `..`, so the guard passed it and the full foreign path was written into
+ * anatomy.md and memory.md — precisely the leak (upstream #56) the guard exists to prevent, on the
+ * one platform nobody tested it on. An absolute result means "no relative route exists", i.e. the
+ * strongest possible outside-the-root signal.
+ *
+ * The `..` test is also anchored to a whole segment now: a file genuinely named `..config` in the
+ * root is inside the project, and used to be counted as external.
+ */
+export function isOutsideProject(relPath) {
+    if (relPath === "")
+        return true; // the path IS the root, not a file in it
+    if (relPath === ".." || relPath.startsWith("../"))
+        return true;
+    if (path.isAbsolute(relPath))
+        return true; // win32 cross-drive ("F:/secrets/x")
+    if (/^[a-zA-Z]:/.test(relPath))
+        return true; // drive-relative ("F:x"), also not ours
+    return false;
+}
 // Count non-mechanical (semantic) entries written to memory.md today. Mechanical rows
 // (auto file-op / session-end lines) don't count. Used by the stop hook to detect whether
 // a meaningful session summary was written. (upstream #55)

package/dist/hooks/stop.js

@@ -1,6 +1,6 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { getWolfDir, ensureWolfDir, readJSON, writeJSON, appendMarkdown, timeShort, getRetention, compactMemoryIfLarge, countSemanticEntries, withLock, readStdin, readTranscriptUsage, detectAgent, bookInjection } from "./shared.js";
+import { getWolfDir, ensureWolfDir, readJSON, writeJSON, appendMarkdown, timeShort, getRetention, compactMemoryIfLarge, countSemanticEntries, tryWithLock, updateSession, sessionFileFor, readStdin, readTranscriptUsage, detectAgent, bookInjection } from "./shared.js";
 import { estimateTokens, getTokenRatios } from "./token-estimator.js";
 const NOTHING_BOOKED = {
     reads: 0, writes: 0, tokens: 0, anatomy_hits: 0, anatomy_misses: 0, repeated_reads_blocked: 0,
@@ -18,13 +18,16 @@ async function main() {
     ensureWolfDir();
     const wolfDir = getWolfDir();
     const hooksDir = path.join(wolfDir, "hooks");
-    const sessionFile = path.join(hooksDir, "_session.json");
     // Stop payload carries the harness transcript path — the source of real, measured token usage.
     let hookInput = {};
     try {
         hookInput = JSON.parse(await readStdin());
     }
     catch { }
+    // Must be resolved from the payload, like every other hook — this hook is what folds the
+    // session into the ledger, so reading a different session's file here would attribute one
+    // session's whole turn to another.
+    const sessionFile = sessionFileFor(hooksDir, hookInput.session_id);
     const session = readJSON(sessionFile, {
         session_id: "",
         started: "",
@@ -49,7 +52,11 @@ async function main() {
     const unnamedWrites = externalWrites + bashWrites;
     const totalWrites = writeCount + unnamedWrites;
     if (readCount === 0 && totalWrites === 0) {
-        writeJSON(sessionFile, session);
+        // Only stop_count moved; apply it as a delta so an idle turn cannot overwrite a sibling
+        // hook's concurrent update with this hook's stale snapshot.
+        updateSession(sessionFile, session, (s) => {
+            s.stop_count = Math.max(s.stop_count ?? 0, session.stop_count);
+        });
         process.exit(0);
         return;
     }
@@ -110,7 +117,10 @@ async function main() {
     // token report don't clobber each other (M1).
     const ret = getRetention(wolfDir);
     const ledgerPath = path.join(wolfDir, "token-ledger.json");
-    withLock(ledgerPath, () => {
+    // A contended ledger write is skipped, not forced: this hook's numbers are cumulative and the
+    // next Stop re-books the same deltas, so one skipped turn costs nothing. Forcing it would
+    // overwrite whichever process is inside the critical section right now.
+    tryWithLock(ledgerPath, () => {
         const ledger = readJSON(ledgerPath, {
             version: 1,
             created_at: "",
@@ -180,8 +190,15 @@ async function main() {
             lt.real_cache_creation_tokens = (lt.real_cache_creation_tokens ?? 0) + delta(realUsage.cache_creation_input_tokens, booked.real_cache_creation);
             lt.real_api_calls = (lt.real_api_calls ?? 0) + delta(realUsage.api_calls, booked.real_api_calls);
         }
-        // Mark what is now booked. Set inside the lock, right after the numbers went in, so a crash
-        // between the two writes cannot leave the ledger credited and the session unmarked.
+        // Mark what is now booked.
+        //
+        // [fix] Setting this field inside the lock was never the point — PERSISTING it was. The write to
+        // _session.json used to sit ~30 lines further down, past two memory.md appends and a memory
+        // compaction, outside this lock. Anything that ended the process in that window (a hook timeout,
+        // the user quitting, a full disk during compactMemoryIfLarge) left the ledger credited and the
+        // session file still carrying the OLD booked values, so the next Stop re-booked every delta on
+        // top. The comment claimed that could not happen. It is now written under the same lock, one
+        // statement after the ledger, which is what the comment always described.
         session.booked = {
             reads: Math.max(readCount, booked.reads),
             writes: Math.max(totalWritesNow, booked.writes),
@@ -197,6 +214,16 @@ async function main() {
             real_api_calls: Math.max(realUsage?.api_calls ?? 0, booked.real_api_calls),
         };
         writeJSON(ledgerPath, ledger);
+        // Persist the session's own bookkeeping here, still holding the ledger lock. The deltas are
+        // re-applied to whatever is on disk right now, so a PostToolUse hook that wrote between this
+        // hook's initial read and this line does not lose its update.
+        const bookedNow = session.booked;
+        const remindersNow = session.reminders_shown;
+        updateSession(sessionFile, session, (s) => {
+            s.booked = bookedNow;
+            s.reminders_shown = remindersNow;
+            s.stop_count = Math.max(s.stop_count ?? 0, session.stop_count);
+        });
     });
     // Write a session summary line to memory.md if there was meaningful activity
     const memoryPath = path.join(wolfDir, "memory.md");
@@ -227,7 +254,6 @@ async function main() {
         compactMemoryIfLarge(wolfDir, ret.memory_max_bytes);
     }
     catch { }
-    writeJSON(sessionFile, session);
     // Surface reminders into Claude's next context window (Stop hooks can inject via stdout JSON).
     if (reminders.length > 0) {
         const additionalContext = `⚠️ OpenWolf end-of-turn reminders:\n${reminders.map((r) => `• ${r}`).join("\n")}`;

package/dist/src/cli/cron-cmd.js

@@ -1,7 +1,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { findProjectRoot } from "../scanner/project-root.js";
-import { readJSON, writeJSON, withLock } from "../utils/fs-safe.js";
+import { readJSON, writeJSON, withLockOr } from "../utils/fs-safe.js";
 import { readDashboardToken } from "../utils/dashboard-auth.js";
 import { Logger } from "../utils/logger.js";
 import { CronEngine } from "../daemon/cron-engine.js";
@@ -92,7 +92,7 @@ export function cronRetry(id) {
     // This CLI runs in its own process while the daemon's cron engine may be appending to the same
     // file — read-modify-write under the shared lock so neither side clobbers the other.
     const statePath = path.join(wolfDir, "cron-state.json");
-    const removed = withLock(statePath, () => {
+    const removed = withLockOr(statePath, () => false, () => {
         const state = readJSON(statePath, {
             engine_status: "unknown",
             execution_log: [],

package/dist/src/cli/cron-cmd.js.map

@@ -1 +1 @@
-{"version":3,"file":"cron-cmd.js","sourceRoot":"","sources":["../../../src/cli/cron-cmd.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAqBtD,MAAM,UAAU,QAAQ;IACtB,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAEhD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAe,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,EAAE;QAChF,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,EAAE;KACV,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,QAAQ,CAAY,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE;QACvE,aAAa,EAAE,SAAS;QACxB,aAAa,EAAE,EAAE;QACjB,iBAAiB,EAAE,EAAE;KACtB,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1B,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAE5B,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;QACrD,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa;aAChC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;aACpC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,OAAO,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QACnF,MAAM,MAAM,GAAG,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC;QAE1E,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,iBAAiB,UAAU,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAAU;IACtC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAEhD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IAID,MAAM,MAAM,GAAG,QAAQ,CAAa,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE;QACrE,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;KACzC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC;IAE5C,+CAA+C;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,iBAAiB,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE;YACzF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE;SACjG,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAyC,CAAC;QACrE,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;IAChE,CAAC;IAED,iDAAiD;IACjD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,EAAU;IAClC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAEhD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IAED,+FAA+F;IAC/F,qFAAqF;IACrF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE;QACvC,MAAM,KAAK,GAAG,QAAQ,CAAY,SAAS,EAAE;YAC3C,aAAa,EAAE,SAAS;YACxB,aAAa,EAAE,EAAE;YACjB,iBAAiB,EAAE,EAAE;SACtB,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;QACvE,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7B,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACvC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,kCAAkC,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,0DAA0D,CAAC,CAAC;AACvF,CAAC"}
+{"version":3,"file":"cron-cmd.js","sourceRoot":"","sources":["../../../src/cli/cron-cmd.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAY,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAqBtD,MAAM,UAAU,QAAQ;IACtB,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAEhD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAe,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,EAAE;QAChF,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,EAAE;KACV,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,QAAQ,CAAY,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE;QACvE,aAAa,EAAE,SAAS;QACxB,aAAa,EAAE,EAAE;QACjB,iBAAiB,EAAE,EAAE;KACtB,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1B,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAE5B,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;QACrD,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa;aAChC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;aACpC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,OAAO,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QACnF,MAAM,MAAM,GAAG,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC;QAE1E,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,iBAAiB,UAAU,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAAU;IACtC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAEhD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IAID,MAAM,MAAM,GAAG,QAAQ,CAAa,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE;QACrE,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;KACzC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC;IAE5C,+CAA+C;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,iBAAiB,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE;YACzF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE;SACjG,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAyC,CAAC;QACrE,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;IAChE,CAAC;IAED,iDAAiD;IACjD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,EAAU;IAClC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAEhD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IAED,+FAA+F;IAC/F,qFAAqF;IACrF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;QACtD,MAAM,KAAK,GAAG,QAAQ,CAAY,SAAS,EAAE;YAC3C,aAAa,EAAE,SAAS;YACxB,aAAa,EAAE,EAAE;YACjB,iBAAiB,EAAE,EAAE;SACtB,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;QACvE,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7B,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACvC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,kCAAkC,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,0DAA0D,CAAC,CAAC;AACvF,CAAC"}

package/dist/src/cli/daemon-cmd.js

@@ -3,10 +3,11 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import { findProjectRoot } from "../scanner/project-root.js";
-import { readJSON, writeJSON, withLock } from "../utils/fs-safe.js";
+import { readJSON, writeJSON, tryWithLock } from "../utils/fs-safe.js";
 import { readDashboardToken } from "../utils/dashboard-auth.js";
 import { isPortFree } from "../utils/ports.js";
-import { isWindows } from "../utils/platform.js";
+import { isWindows, execShim } from "../utils/platform.js";
+import { readOwnDaemonPid, clearDaemonRecord } from "../utils/daemon-pid.js";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 function getDashboardPort() {
@@ -15,7 +16,9 @@ function getDashboardPort() {
     const config = readJSON(path.join(wolfDir, "config.json"), { openwolf: { dashboard: { port: 18791 } } });
     return config.openwolf.dashboard.port;
 }
-// On Windows the pm2 shim is pm2.cmd; execFileSync needs the exact name (no shell).
+// On Windows the pm2 shim is pm2.cmd. Node cannot spawn a .cmd without a shell (CVE-2024-27980
+// hardening), so every call goes through execShim(), which routes it via cmd.exe with the
+// arguments still quoted individually rather than joined into a parseable string.
 const PM2 = isWindows() ? "pm2.cmd" : "pm2";
 function getPm2Name() {
     const projectRoot = findProjectRoot();
@@ -102,7 +105,7 @@ function killPid(pid) {
 function markDaemonStopped(wolfDir) {
     const statePath = path.join(wolfDir, "cron-state.json");
     try {
-        withLock(statePath, () => {
+        tryWithLock(statePath, () => {
             const state = readJSON(statePath, {});
             // No cron state at all means the daemon never wrote one — nothing to correct, and inventing
             // a file here would only confuse the next start.
@@ -157,11 +160,11 @@ export function daemonStart() {
     // Resolve daemon script relative to openwolf's install dir, not the target project
     const daemonScript = path.resolve(__dirname, "..", "daemon", "wolf-daemon.js");
     try {
-        execFileSync(PM2, ["start", daemonScript, "--name", name, "--cwd", projectRoot, "--", "--env", `OPENWOLF_PROJECT_ROOT=${projectRoot}`], {
+        execShim(PM2, ["start", daemonScript, "--name", name, "--cwd", projectRoot, "--", "--env", `OPENWOLF_PROJECT_ROOT=${projectRoot}`], {
             stdio: "inherit",
             env: { ...process.env, OPENWOLF_PROJECT_ROOT: projectRoot },
         });
-        execFileSync(PM2, ["save"], { stdio: "ignore" });
+        execShim(PM2, ["save"], { stdio: "ignore" });
         console.log(`\n  ✓ Daemon started: ${name}`);
         if (isWindows()) {
             console.log("  Tip: Run 'pm2-windows-startup' for boot persistence.");
@@ -185,7 +188,7 @@ export async function daemonStop() {
     if (hasPm2()) {
         const name = getPm2Name();
         try {
-            execFileSync(PM2, ["stop", name], { stdio: "ignore" });
+            execShim(PM2, ["stop", name], { stdio: "ignore" });
             markDaemonStopped(wolfDir);
             console.log(`  ✓ Daemon stopped (PM2): ${name}`);
             return;
@@ -201,19 +204,36 @@ export async function daemonStop() {
         console.log(`  ✓ Daemon stopped cleanly (port ${port})`);
         return;
     }
-    // Last resort: kill whatever is listening, then write the state the handler never got to write.
-    const pid = findPidOnPort(port);
-    if (pid) {
-        if (killPid(pid)) {
-            markDaemonStopped(wolfDir);
-            console.log(`  ✓ Daemon stopped (PID ${pid} on port ${port})`);
+    // Last resort: kill the daemon — and ONLY the daemon.
+    //
+    // This used to kill whatever was listening on the configured port. That port is a number in a
+    // committed config file, the daemon may have been moved off it by `openwolf dashboard`, and on a
+    // developer machine it is just as likely to be a dev server or another project's daemon. Killing
+    // that and printing "✓ Daemon stopped" is the worst possible combination.
+    //
+    // The daemon now records its own pid, project root and host after a successful bind. A process is
+    // killed only when that record vouches for it. Anything else on the port is reported, not touched.
+    const ownPid = readOwnDaemonPid(wolfDir, projectRoot);
+    const listening = findPidOnPort(port);
+    if (ownPid === null) {
+        if (listening) {
+            console.log(`  No daemon of this project is running. Port ${port} is held by PID ${listening}, which OpenWolf did not start — left alone.`);
         }
         else {
-            console.error(`  Failed to kill process ${pid} on port ${port}.`);
+            console.log(`  No daemon running on port ${port}.`);
         }
+        return;
+    }
+    if (listening !== null && listening !== ownPid) {
+        console.log(`  Stopping this project's daemon (PID ${ownPid}). Note: port ${port} is held by a different process (PID ${listening}), which is left alone.`);
+    }
+    if (killPid(ownPid)) {
+        markDaemonStopped(wolfDir);
+        clearDaemonRecord(wolfDir);
+        console.log(`  ✓ Daemon stopped (PID ${ownPid})`);
     }
     else {
-        console.log(`  No daemon running on port ${port}.`);
+        console.error(`  Failed to stop the daemon (PID ${ownPid}).`);
     }
 }
 export async function daemonRestart() {
@@ -227,7 +247,7 @@ export async function daemonRestart() {
     if (hasPm2()) {
         const name = getPm2Name();
         try {
-            execFileSync(PM2, ["restart", name], { stdio: "ignore" });
+            execShim(PM2, ["restart", name], { stdio: "ignore" });
             console.log(`  ✓ Daemon restarted (PM2): ${name}`);
             return;
         }
@@ -242,11 +262,19 @@ export async function daemonRestart() {
         console.log("  Stopped old daemon cleanly.");
     }
     else {
-        const pid = findPidOnPort(port);
-        if (pid) {
-            killPid(pid);
+        // Same ownership rule as daemonStop: a restart that kills a stranger on the port is a restart
+        // that took down somebody else's server and then told you it restarted yours.
+        const ownPid = readOwnDaemonPid(wolfDir, projectRoot);
+        if (ownPid !== null) {
+            killPid(ownPid);
             markDaemonStopped(wolfDir);
-            console.log(`  Stopped old daemon (PID ${pid}).`);
+            clearDaemonRecord(wolfDir);
+            console.log(`  Stopped old daemon (PID ${ownPid}).`);
+        }
+        else {
+            const listening = findPidOnPort(port);
+            if (listening)
+                console.log(`  Port ${port} is held by PID ${listening}, which OpenWolf did not start — left alone.`);
         }
     }
     console.log("  Use 'openwolf dashboard' to start a new daemon.");
@@ -264,7 +292,7 @@ export function daemonLogs() {
     }
     const name = getPm2Name();
     try {
-        execFileSync(PM2, ["logs", name, "--lines", "50", "--nostream"], { stdio: "inherit" });
+        execShim(PM2, ["logs", name, "--lines", "50", "--nostream"], { stdio: "inherit" });
     }
     catch {
         console.error("Failed to get daemon logs.");