parasor 0.1.0

package/server/pty/host-daemon/orphan-cleanup.js

@@ -0,0 +1,84 @@
+/*
+ * - daemon startup orphan reconciliation.
+ *
+ * On startup the daemon reads `appState.sessionRecords` and decides what
+ * to do with each record whose `state === "running"` (we ignore already-
+ * terminal "exited"/"lost"/"orphaned" records -- they only need cleanup
+ * via `pty-host doctor`, not on every boot):
+ *
+ *   - alive + recorded `daemonPid` matches *this* daemon: keep as
+ *     "running" (rare; happens after a fast restart that didn't change
+ *     the PID -- possible under exec-replace).
+ *   - alive + recorded `daemonPid` belongs to a different generation:
+ *     transition to "orphaned". The PTY survived the previous daemon
+ *     so it is still consuming a slot, but we no longer own its master
+ *     fd; only `pty-host doctor` can reap it.
+ *   - dead (kill(pid,0) -> ESRCH/ENOENT): transition to "lost". The PID
+ *     vanished without a recorded exit (SIGKILL, parent crash, OOM).
+ *   - record has no PID (create-stub that never spawned): transition
+ *     to "lost" -- the previous daemon never observed `node-pty.spawn`
+ *     completing, so the underlying child cannot exist.
+ *
+ * The decision is *local to the record*: we never call `ps -ef | grep`
+ * to rediscover untracked PTYs. Records are the source of truth; an
+ * untracked alive PID matching one of our argv signatures is out of
+ * scope here (handled by `pty-host doctor` re-verification).
+ *
+ * Side effect: returns a list of `SessionRecord` snapshots reflecting
+ * the post-reconciliation state. Callers persist them via
+ * `AppStateStore.internalMutate` so the read-only mirror guard is
+ * bypassed (the daemon owns the writer side).
+ */
+function defaultIsPidAlive(pid) {
+    if (!Number.isFinite(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err.code === "EPERM";
+    }
+}
+/**
+ * Pure function -- no side effects. Caller is responsible for persisting
+ * the resulting array via `AppStateStore.internalMutate`.
+ *
+ * Already-terminal records (state in {exited,lost,orphaned}) are passed
+ * through unchanged. Only `state === "running"` records are evaluated.
+ */
+export function reconcileSessionRecords(input, opts) {
+    const isAlive = opts.isPidAlive ?? defaultIsPidAlive;
+    const out = [];
+    const transitions = [];
+    for (const rec of input) {
+        if (rec.state !== "running") {
+            out.push(rec);
+            continue;
+        }
+        if (rec.pid === null || rec.pid === undefined) {
+            out.push({ ...rec, state: "lost" });
+            transitions.push({ type: "lost", id: rec.id, reason: "no-pid" });
+            continue;
+        }
+        if (!isAlive(rec.pid)) {
+            out.push({ ...rec, state: "lost" });
+            transitions.push({ type: "lost", id: rec.id, reason: "dead-pid" });
+            continue;
+        }
+        if (rec.daemonPid === opts.currentDaemonPid &&
+            rec.daemonStartedAt === opts.currentDaemonStartedAt) {
+            out.push(rec);
+            transitions.push({ type: "kept", id: rec.id });
+            continue;
+        }
+        out.push({ ...rec, state: "orphaned" });
+        transitions.push({
+            type: "orphaned",
+            id: rec.id,
+            previousDaemonPid: rec.daemonPid,
+        });
+    }
+    return { records: out, transitions };
+}
+//# sourceMappingURL=orphan-cleanup.js.map

package/server/pty/host-daemon/orphan-cleanup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orphan-cleanup.js","sourceRoot":"","sources":["../../../src/pty/host-daemon/orphan-cleanup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AA+BH,SAAS,iBAAiB,CAAC,GAAW;IACpC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAQ,GAA6B,CAAC,IAAI,KAAK,OAAO,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAA+B,EAC/B,IAAmB;IAEnB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACrD,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,MAAM,WAAW,GAAgC,EAAE,CAAC;IAEpD,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC5B,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QAED,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9C,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACpC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YACjE,SAAS;QACX,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACpC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACnE,SAAS;QACX,CAAC;QAED,IACE,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,gBAAgB;YACvC,GAAG,CAAC,eAAe,KAAK,IAAI,CAAC,sBAAsB,EACnD,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACd,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/C,SAAS;QACX,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACxC,WAAW,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,UAAU;YAChB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,iBAAiB,EAAE,GAAG,CAAC,SAAS;SACjC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;AACvC,CAAC"}

package/server/pty/host-daemon/paths.d.ts

@@ -0,0 +1,10 @@
+export interface DaemonPaths {
+    runtimeDir: string;
+    socketPath: string;
+    pidFile: string;
+    lockFile: string;
+    logFile: string;
+}
+export declare function resolveDaemonPaths(env?: NodeJS.ProcessEnv, pid?: number): DaemonPaths;
+export declare function ensureRuntimeDir(dir: string): void;
+//# sourceMappingURL=paths.d.ts.map

package/server/pty/host-daemon/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../src/pty/host-daemon/paths.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,kBAAkB,CAChC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,GAAG,GAAE,MAAoB,GACxB,WAAW,CA4Bb;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAOlD"}

package/server/pty/host-daemon/paths.js

@@ -0,0 +1,56 @@
+/*
+ * -- daemon runtime path resolution.
+ *
+ * Resolution order:
+ *   1. `PARASOR_PTY_SOCK` env override (test / sandbox bypass)
+ *   2. `XDG_RUNTIME_DIR/parasor` (Linux session runtime)
+ *   3. `~/.parasor/run` (default fallback)
+ *
+ * The socket directory is created `0700` so only the spawning user can
+ * connect. `PARASOR_PTY_SOCK` overrides keep the same `<sock>.pid`,
+ * `<sock>.lock`, `<sock>.log` neighbours so all bookkeeping files travel
+ * with the socket override.
+ *
+ *  R5 -- `PARASOR_PTY_SOCK_PER_PID=1` opt-in suffixes
+ * `-${pid}` to all canonical basenames so foreground daemons and
+ * installed daemons can coexist without socket collision. Ignored when
+ * `PARASOR_PTY_SOCK` is set (explicit override always wins).
+ */
+import { mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+export function resolveDaemonPaths(env = process.env, pid = process.pid) {
+    const override = env.PARASOR_PTY_SOCK;
+    if (override && override.length > 0) {
+        return {
+            runtimeDir: dirname(override),
+            socketPath: override,
+            pidFile: `${override}.pid`,
+            lockFile: `${override}.lock`,
+            logFile: `${override}.log`,
+        };
+    }
+    const xdg = env.XDG_RUNTIME_DIR;
+    const runtimeDir = xdg && xdg.length > 0
+        ? join(xdg, "parasor")
+        : join(homedir(), ".parasor", "run");
+    const perPid = env.PARASOR_PTY_SOCK_PER_PID === "1";
+    const stem = perPid ? `parasor-pty-${pid}` : "parasor-pty";
+    return {
+        runtimeDir,
+        socketPath: join(runtimeDir, `${stem}.sock`),
+        pidFile: join(runtimeDir, `${stem}.pid`),
+        lockFile: join(runtimeDir, `${stem}.lock`),
+        logFile: join(runtimeDir, `${stem}.log`),
+    };
+}
+export function ensureRuntimeDir(dir) {
+    const prevMask = process.umask(0o077);
+    try {
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+    finally {
+        process.umask(prevMask);
+    }
+}
+//# sourceMappingURL=paths.js.map

package/server/pty/host-daemon/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../../src/pty/host-daemon/paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAU1C,MAAM,UAAU,kBAAkB,CAChC,MAAyB,OAAO,CAAC,GAAG,EACpC,MAAc,OAAO,CAAC,GAAG;IAEzB,MAAM,QAAQ,GAAG,GAAG,CAAC,gBAAgB,CAAC;IACtC,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC;YAC7B,UAAU,EAAE,QAAQ;YACpB,OAAO,EAAE,GAAG,QAAQ,MAAM;YAC1B,QAAQ,EAAE,GAAG,QAAQ,OAAO;YAC5B,OAAO,EAAE,GAAG,QAAQ,MAAM;SAC3B,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,CAAC;IAChC,MAAM,UAAU,GACd,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QACnB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC;QACtB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IAEzC,MAAM,MAAM,GAAG,GAAG,CAAC,wBAAwB,KAAK,GAAG,CAAC;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,GAAG,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;IAE3D,OAAO;QACL,UAAU;QACV,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,OAAO,CAAC;QAC5C,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,MAAM,CAAC;QACxC,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,OAAO,CAAC;QAC1C,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,MAAM,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC;QACH,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC"}

package/server/pty/host-daemon/server-connection.d.ts

@@ -0,0 +1,44 @@
+import type { Duplex } from "node:stream";
+import { type Frame } from "../host-protocol/frames.js";
+import { type NackCode } from "../host-protocol/messages.js";
+export type ServerConnectionState = "awaiting-hello" | "ready" | "evicted" | "closed";
+export interface ServerConnectionDeps {
+    socket: Duplex;
+    /** Initial id; daemon may reassign on HELLO_ACK if it wants different ids. */
+    connectionId: number;
+    generation: bigint;
+    onFrame: (conn: ServerConnection, frame: Frame) => void;
+    onClose: (conn: ServerConnection) => void;
+}
+export declare class ServerConnection {
+    readonly connectionId: number;
+    generation: bigint;
+    private readonly socket;
+    private readonly parser;
+    private state;
+    private readonly onFrame;
+    private readonly onClose;
+    constructor(deps: ServerConnectionDeps);
+    getState(): ServerConnectionState;
+    markReady(): void;
+    /**
+     * Send a frame, auto-filling the (connectionId, generation) header.
+     * No-op once the connection is closed/evicted -- late callbacks from
+     * the daemon are common during eviction races and shouldn't crash.
+     */
+    send(frame: {
+        type: number;
+        requestId: number;
+        payload: Buffer;
+    }): void;
+    /**
+     * Eviction protocol per the protocol: send a NACK telling the peer it has
+     * been superseded, then `end()` the socket so the kernel flushes the
+     * NACK before FIN. We do NOT call `destroy()` -- that drops in-flight
+     * bytes and would race the NACK delivery.
+     */
+    evict(code: NackCode, message: string): void;
+    private handleChunk;
+    private handleClose;
+}
+//# sourceMappingURL=server-connection.d.ts.map

package/server/pty/host-daemon/server-connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-connection.d.ts","sourceRoot":"","sources":["../../../src/pty/host-daemon/server-connection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAEL,KAAK,KAAK,EAIX,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAEL,KAAK,QAAQ,EAEd,MAAM,8BAA8B,CAAC;AAmBtC,MAAM,MAAM,qBAAqB,GAC7B,gBAAgB,GAChB,OAAO,GACP,SAAS,GACT,QAAQ,CAAC;AAEb,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACxD,OAAO,EAAE,CAAC,IAAI,EAAE,gBAAgB,KAAK,IAAI,CAAC;CAC3C;AAED,qBAAa,gBAAgB;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,KAAK,CAA2C;IACxD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAC1D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;gBAE9C,IAAI,EAAE,oBAAoB;IAYtC,QAAQ,IAAI,qBAAqB;IAIjC,SAAS,IAAI,IAAI;IAIjB;;;;OAIG;IACH,IAAI,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAiBvE;;;;;OAKG;IACH,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAY5C,OAAO,CAAC,WAAW;IAyBnB,OAAO,CAAC,WAAW;CAKpB"}

package/server/pty/host-daemon/server-connection.js

@@ -0,0 +1,100 @@
+import { encodeFrame, FrameError, FrameParser, FrameType, } from "../host-protocol/frames.js";
+import { encodeJsonPayload, } from "../host-protocol/messages.js";
+export class ServerConnection {
+    connectionId;
+    generation;
+    socket;
+    parser = new FrameParser();
+    state = "awaiting-hello";
+    onFrame;
+    onClose;
+    constructor(deps) {
+        this.socket = deps.socket;
+        this.connectionId = deps.connectionId;
+        this.generation = deps.generation;
+        this.onFrame = deps.onFrame;
+        this.onClose = deps.onClose;
+        this.socket.on("data", (chunk) => this.handleChunk(chunk));
+        this.socket.on("close", () => this.handleClose());
+        this.socket.on("error", () => this.handleClose());
+    }
+    getState() {
+        return this.state;
+    }
+    markReady() {
+        if (this.state === "awaiting-hello")
+            this.state = "ready";
+    }
+    /**
+     * Send a frame, auto-filling the (connectionId, generation) header.
+     * No-op once the connection is closed/evicted -- late callbacks from
+     * the daemon are common during eviction races and shouldn't crash.
+     */
+    send(frame) {
+        if (this.state === "closed" || this.state === "evicted")
+            return;
+        try {
+            const buf = encodeFrame({
+                type: frame.type,
+                connectionId: this.connectionId,
+                generation: this.generation,
+                requestId: frame.requestId,
+                payload: frame.payload,
+            });
+            this.socket.write(buf);
+        }
+        catch {
+            // Socket may have been destroyed mid-write; falling back to close.
+            this.handleClose();
+        }
+    }
+    /**
+     * Eviction protocol per the protocol: send a NACK telling the peer it has
+     * been superseded, then `end()` the socket so the kernel flushes the
+     * NACK before FIN. We do NOT call `destroy()` -- that drops in-flight
+     * bytes and would race the NACK delivery.
+     */
+    evict(code, message) {
+        if (this.state === "evicted" || this.state === "closed")
+            return;
+        const payload = { code, message };
+        this.send({
+            type: FrameType.NACK,
+            requestId: 0,
+            payload: encodeJsonPayload(payload),
+        });
+        this.state = "evicted";
+        this.socket.end();
+    }
+    handleChunk(chunk) {
+        if (this.state === "evicted" || this.state === "closed")
+            return;
+        let frames;
+        try {
+            frames = this.parser.push(chunk);
+        }
+        catch (err) {
+            if (err instanceof FrameError) {
+                this.evict(err.code === "FRAME_TOO_LARGE" ? "frame-too-large" : "frame-invalid", err.message);
+                return;
+            }
+            this.evict("internal-error", "parser failure");
+            return;
+        }
+        for (const frame of frames) {
+            // onFrame callback may synchronously transition state via evict();
+            // re-read through getState() so TS doesn't carry the narrowing
+            // from the top-of-method guard across the callback boundary.
+            if (this.getState() === "evicted" || this.getState() === "closed")
+                return;
+            this.onFrame(this, frame);
+        }
+    }
+    handleClose() {
+        if (this.state === "closed")
+            return;
+        this.state = "closed";
+        this.onClose(this);
+    }
+}
+//# sourceMappingURL=server-connection.js.map

package/server/pty/host-daemon/server-connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-connection.js","sourceRoot":"","sources":["../../../src/pty/host-daemon/server-connection.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EAEX,UAAU,EACV,WAAW,EACX,SAAS,GACV,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,iBAAiB,GAGlB,MAAM,8BAA8B,CAAC;AAkCtC,MAAM,OAAO,gBAAgB;IAClB,YAAY,CAAS;IAC9B,UAAU,CAAS;IACF,MAAM,CAAS;IACf,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;IACpC,KAAK,GAA0B,gBAAgB,CAAC;IACvC,OAAO,CAAkC;IACzC,OAAO,CAAkC;IAE1D,YAAY,IAA0B;QACpC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAE5B,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,SAAS;QACP,IAAI,IAAI,CAAC,KAAK,KAAK,gBAAgB;YAAE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC;IAC5D,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,KAA2D;QAC9D,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO;QAChE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,WAAW,CAAC;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,IAAc,EAAE,OAAe;QACnC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO;QAChE,MAAM,OAAO,GAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;IAEO,WAAW,CAAC,KAAa;QAC/B,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO;QAChE,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;gBAC9B,IAAI,CAAC,KAAK,CACR,GAAG,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,eAAe,EACpE,GAAG,CAAC,OAAO,CACZ,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,mEAAmE;YACnE,+DAA+D;YAC/D,6DAA6D;YAC7D,IAAI,IAAI,CAAC,QAAQ,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,EAAE,KAAK,QAAQ;gBAAE,OAAO;YAC1E,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAEO,WAAW;QACjB,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO;QACpC,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;CACF"}

package/server/pty/host-daemon/service-detection.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Returns true when a service-managed PTY-host unit is installed for the
+ * current user -- `~/Library/LaunchAgents/com.parasor.pty-host.plist` on
+ * macOS, `~/.config/systemd/user/parasor-pty-host.service` on linux.
+ *
+ * Filesystem-only: presence of the unit file is the "this machine has a
+ * canonical daemon owner" signal. We deliberately do NOT probe whether
+ * the unit is loaded or running -- a stopped service is still the
+ * canonical owner, and a manual `parasor` invocation must defer to it
+ * rather than spawn a competing daemon and fight over the canonical
+ * socket. `service restart --all` is the user's lever to bring it back.
+ *
+ * Used by host.ts to flip the `PARASOR_PTY_AUTOSTART` default off when
+ * a service unit exists; this prevents the unmanaged-daemon
+ * inconsistency that `service install` and `service restart --all`
+ * exist to heal.
+ */
+export interface ServiceDetectionDeps {
+    platform?: NodeJS.Platform;
+    home?: string;
+    existsSync?: (path: string) => boolean;
+}
+export declare function isServiceManagedDaemonInstalled(deps?: ServiceDetectionDeps): boolean;
+//# sourceMappingURL=service-detection.d.ts.map

package/server/pty/host-daemon/service-detection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-detection.d.ts","sourceRoot":"","sources":["../../../src/pty/host-daemon/service-detection.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACxC;AAED,wBAAgB,+BAA+B,CAC7C,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAeT"}

package/server/pty/host-daemon/service-detection.js

@@ -0,0 +1,16 @@
+import { existsSync } from "node:fs";
+import { homedir, platform } from "node:os";
+import { join } from "node:path";
+export function isServiceManagedDaemonInstalled(deps = {}) {
+    const p = deps.platform ?? platform();
+    const h = deps.home ?? homedir();
+    const exists = deps.existsSync ?? existsSync;
+    if (p === "darwin") {
+        return exists(join(h, "Library", "LaunchAgents", "com.parasor.pty-host.plist"));
+    }
+    if (p === "linux") {
+        return exists(join(h, ".config", "systemd", "user", "parasor-pty-host.service"));
+    }
+    return false;
+}
+//# sourceMappingURL=service-detection.js.map

package/server/pty/host-daemon/service-detection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-detection.js","sourceRoot":"","sources":["../../../src/pty/host-daemon/service-detection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAyBjC,MAAM,UAAU,+BAA+B,CAC7C,OAA6B,EAAE;IAE/B,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,EAAE,CAAC;IACtC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC;IAC7C,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnB,OAAO,MAAM,CACX,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,4BAA4B,CAAC,CACjE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;QAClB,OAAO,MAAM,CACX,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,0BAA0B,CAAC,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/server/pty/host-daemon/socket-ready.d.ts

@@ -0,0 +1,22 @@
+export interface WaitForDaemonSocketOpts {
+    /** Milliseconds before timeout (default 5000). */
+    timeoutMs?: number;
+    /** Poll interval in milliseconds (default 100). */
+    intervalMs?: number;
+    /**
+     * Probe function -- returns true when the socket is accepting connections.
+     * Defaults to `isSocketActive(path, 200)`. Injected in tests.
+     */
+    probeFn?: (path: string) => Promise<boolean>;
+}
+/**
+ * Polls `socketPath` until a daemon is listening or `timeoutMs` elapses.
+ *
+ * On timeout throws:
+ *   Error: daemon socket did not become ready within ${timeoutMs}ms (path=${socketPath})
+ *
+ * Reuses `bootstrap.ts#isSocketActive` for the default probe so the
+ * same kernel-level socket-connect check is shared across both layers.
+ */
+export declare function waitForDaemonSocket(socketPath: string, opts?: WaitForDaemonSocketOpts): Promise<void>;
+//# sourceMappingURL=socket-ready.d.ts.map

package/server/pty/host-daemon/socket-ready.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"socket-ready.d.ts","sourceRoot":"","sources":["../../../src/pty/host-daemon/socket-ready.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,uBAAuB;IACtC,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9C;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,uBAA4B,GACjC,OAAO,CAAC,IAAI,CAAC,CA0Bf"}

package/server/pty/host-daemon/socket-ready.js

@@ -0,0 +1,33 @@
+import { isSocketActive } from "./bootstrap.js";
+/**
+ * Polls `socketPath` until a daemon is listening or `timeoutMs` elapses.
+ *
+ * On timeout throws:
+ *   Error: daemon socket did not become ready within ${timeoutMs}ms (path=${socketPath})
+ *
+ * Reuses `bootstrap.ts#isSocketActive` for the default probe so the
+ * same kernel-level socket-connect check is shared across both layers.
+ */
+export async function waitForDaemonSocket(socketPath, opts = {}) {
+    const timeoutMs = opts.timeoutMs ?? 5000;
+    const intervalMs = opts.intervalMs ?? 100;
+    const probeFn = opts.probeFn ?? ((p) => isSocketActive(p, 200));
+    const deadline = Date.now() + timeoutMs;
+    while (true) {
+        const ready = await probeFn(socketPath);
+        if (ready)
+            return;
+        const remaining = deadline - Date.now();
+        if (remaining <= 0) {
+            throw new Error(`daemon socket did not become ready within ${timeoutMs}ms (path=${socketPath})`);
+        }
+        await sleep(Math.min(intervalMs, remaining));
+        if (Date.now() >= deadline) {
+            throw new Error(`daemon socket did not become ready within ${timeoutMs}ms (path=${socketPath})`);
+        }
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=socket-ready.js.map

package/server/pty/host-daemon/socket-ready.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"socket-ready.js","sourceRoot":"","sources":["../../../src/pty/host-daemon/socket-ready.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAchD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAkB,EAClB,OAAgC,EAAE;IAElC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAExE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IAExC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,KAAK;YAAE,OAAO;QAElB,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,6CAA6C,SAAS,YAAY,UAAU,GAAG,CAChF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;QAE7C,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,6CAA6C,SAAS,YAAY,UAAU,GAAG,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AACjE,CAAC"}

package/server/pty/host-daemon/spawn-daemon.d.ts

@@ -0,0 +1,45 @@
+import { spawn } from "node:child_process";
+import type { DaemonPaths } from "./paths.js";
+export interface SpawnDaemonOptions {
+    paths: DaemonPaths;
+    /**
+     * Cap how long we wait for the daemon to start accepting connections.
+     * Tests may shrink this; production keeps the configured 5s ceiling.
+     */
+    startupTimeoutMs?: number;
+    /**
+     * Override how the entry script is located. Defaults to the bundled
+     * dist path resolved from this module's URL -- covers both `tsc` build
+     * output and `tsx` dev runtime.
+     */
+    entryScriptPath?: string;
+    /**
+     * Test seam -- replaces `child_process.spawn`. Production passes the
+     * real spawn so the daemon goes detached; tests pass a stub that
+     * simulates the side-effects without forking.
+     */
+    spawnFn?: typeof spawn;
+    /** Test seam for the connect probe. Defaults to net.connect. */
+    probeFn?: (path: string) => Promise<boolean>;
+    /** Test seam for the polling sleep. Defaults to setTimeout. */
+    sleepFn?: (ms: number) => Promise<void>;
+    /** Inherit env so the child sees PARASOR_PTY_SOCK / DEBUG flags. */
+    env?: NodeJS.ProcessEnv;
+}
+export declare class DaemonSpawnError extends Error {
+    readonly cause?: Error | undefined;
+    constructor(message: string, cause?: Error | undefined);
+}
+/**
+ * Attempt to start the `parasor-pty-host` daemon and wait until its
+ * socket is ready. Throws `DaemonSpawnError` on:
+ *   - entry script missing (clearer than node's "ENOENT" exec error)
+ *   - spawn() throws synchronously (permissions, exec format)
+ *   - timeout waiting for socket (caller should treat as fatal:
+ *     daemon may have crashed during boot, see paths.logFile)
+ *
+ * The returned Promise resolves once the socket *passes* a connect
+ * probe. Caller is expected to retry its own connect() afterwards.
+ */
+export declare function spawnDaemon(opts: SpawnDaemonOptions): Promise<void>;
+//# sourceMappingURL=spawn-daemon.d.ts.map

package/server/pty/host-daemon/spawn-daemon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn-daemon.d.ts","sourceRoot":"","sources":["../../../src/pty/host-daemon/spawn-daemon.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAM3C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,WAAW,CAAC;IACnB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,gEAAgE;IAChE,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,+DAA+D;IAC/D,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IAGvC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK;gBADtB,OAAO,EAAE,MAAM,EACN,KAAK,CAAC,EAAE,KAAK,YAAA;CAKzB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkFzE"}

package/server/pty/host-daemon/spawn-daemon.js

@@ -0,0 +1,155 @@
+/*
+ * -- best-effort daemon auto-spawn for the
+ * `createPtyHost("remote")` factory path. When the server is configured
+ * for daemon mode but `connect(socketPath)` fails with ECONNREFUSED /
+ * ENOENT, we fork a detached `parasor-pty-host` child, wait for the
+ * socket to become connectable (capped at ~5s), then let the caller
+ * retry the original connect().
+ *
+ * Auto-spawn is *opt-out* via `PARASOR_PTY_AUTOSTART=0` for ops who
+ * prefer a dedicated supervisor (launchd / systemd). The exit
+ * code from the daemon entry script is *not* awaited -- once the socket
+ * accepts connections, the supervisor relationship is over (detached +
+ * unref + stdio:"ignore"). If the daemon prints diagnostics they go to
+ * its own log file via the entry script.
+ *
+ * Why not retry inside the connect() loop? Because startup should attempt
+ * auto-spawn at most once per process boot. If the spawn fails (binary
+ * missing, permission denied), we surface the error rather than thrashing
+ * the lockfile.
+ */
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import * as net from "node:net";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+export class DaemonSpawnError extends Error {
+    cause;
+    constructor(message, cause) {
+        super(message);
+        this.cause = cause;
+        this.name = "DaemonSpawnError";
+    }
+}
+/**
+ * Attempt to start the `parasor-pty-host` daemon and wait until its
+ * socket is ready. Throws `DaemonSpawnError` on:
+ *   - entry script missing (clearer than node's "ENOENT" exec error)
+ *   - spawn() throws synchronously (permissions, exec format)
+ *   - timeout waiting for socket (caller should treat as fatal:
+ *     daemon may have crashed during boot, see paths.logFile)
+ *
+ * The returned Promise resolves once the socket *passes* a connect
+ * probe. Caller is expected to retry its own connect() afterwards.
+ */
+export async function spawnDaemon(opts) {
+    const timeoutMs = opts.startupTimeoutMs ?? 5_000;
+    const entry = opts.entryScriptPath ?? defaultEntryScriptPath();
+    const spawnFn = opts.spawnFn ?? spawn;
+    const probe = opts.probeFn ?? probeSocket;
+    const sleep = opts.sleepFn ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    /*
+     * production runs after `pnpm build`, but the
+     * dev/test path (`tsx --watch`) never produces `entry.js`. Resolve
+     * to `entry.ts` and prepend `--import tsx` to the node args so the
+     * tsx loader handles the TypeScript transparently. We pick the
+     * fallback only when `entry.js` is genuinely missing -- this keeps
+     * production unchanged.
+     */
+    const tsFallback = entry.endsWith(".js") ? `${entry.slice(0, -3)}.ts` : null;
+    let resolvedEntry = entry;
+    let nodeArgs;
+    if (existsSync(entry)) {
+        nodeArgs = [entry];
+    }
+    else if (tsFallback && existsSync(tsFallback)) {
+        resolvedEntry = tsFallback;
+        nodeArgs = ["--import", "tsx", tsFallback];
+    }
+    else {
+        throw new DaemonSpawnError(`parasor-pty-host entry script not found at ${entry} ` +
+            `(also tried ${tsFallback ?? "(no .ts fallback)"}). ` +
+            "Run `pnpm --filter @parasor/server build` to produce dist/, " +
+            "set PARASOR_PTY_AUTOSTART=0 and start the daemon manually, " +
+            "or rebuild @parasor/server.");
+    }
+    let child = null;
+    try {
+        child = spawnFn(process.execPath, nodeArgs, {
+            detached: true,
+            stdio: "ignore",
+            env: opts.env ?? process.env,
+        });
+        // detached spawn() can emit `error` asynchronously
+        // for ENOENT / EACCES / exec format. Without a listener it becomes
+        // an unhandled error event in the parent. We swallow here because
+        // the probe loop below is the authoritative readiness signal -- a
+        // dead child surfaces as a startup-timeout error instead of a
+        // parent crash.
+        child.once("error", () => {
+            /* swallow -- startup-timeout path reports the failure */
+        });
+        child.unref();
+    }
+    catch (err) {
+        throw new DaemonSpawnError(`failed to spawn parasor-pty-host (entry=${resolvedEntry}): ${err.message}`, err);
+    }
+    const deadline = Date.now() + timeoutMs;
+    const pollMs = 100;
+    while (Date.now() < deadline) {
+        if (await probe(opts.paths.socketPath))
+            return;
+        await sleep(pollMs);
+    }
+    // timeout means our spawned child either never
+    // bound the socket or is hung mid-startup. Sending SIGTERM to the
+    // child's pid (only one we have -- pgid is unknown to the parent)
+    // prevents an orphan daemon process from sitting around eating fds.
+    // Best-effort: child may have exited normally just before we hit
+    // the deadline (race), or may not yet have setsid'd; either way the
+    // signal is harmless.
+    if (child && typeof child.pid === "number") {
+        try {
+            process.kill(child.pid, "SIGTERM");
+        }
+        catch {
+            /* already gone */
+        }
+    }
+    throw new DaemonSpawnError(`parasor-pty-host did not become ready within ${timeoutMs}ms (socket=${opts.paths.socketPath}). ` +
+        `Check ${opts.paths.logFile} for daemon-side errors.`);
+}
+/**
+ * Non-blocking connect probe -- the same shape as
+ * `bootstrap.ts#isSocketActive` but with a tighter timeout suitable
+ * for tight polling. Returns true on `connect`, false on every error.
+ */
+function probeSocket(path) {
+    return new Promise((resolve) => {
+        const sock = net.connect(path);
+        const cleanup = (ok) => {
+            sock.removeAllListeners();
+            try {
+                sock.destroy();
+            }
+            catch {
+                /* ignore */
+            }
+            resolve(ok);
+        };
+        sock.once("connect", () => cleanup(true));
+        sock.once("error", () => cleanup(false));
+        sock.setTimeout(250, () => cleanup(false));
+    });
+}
+/**
+ * Resolve the bundled daemon entry script path. Production points at
+ * `dist/pty/host-daemon/entry.js`. The dev/test runtime (`tsx --watch`)
+ * skips the build step entirely; spawnDaemon() handles that by falling
+ * back to `entry.ts` with a `--import tsx` node-arg prefix when the .js
+ * file is missing.  */
+function defaultEntryScriptPath() {
+    const here = dirname(fileURLToPath(import.meta.url));
+    return resolve(here, "entry.js");
+}
+//# sourceMappingURL=spawn-daemon.js.map