pushary 1.8.0

package/dist/bin/pushary-daemon.js

@@ -0,0 +1,878 @@
+#!/usr/bin/env node
+import {
+  inspectConfiguredManagedProviders
+} from "../chunk-VQKRG3AC.js";
+import "../chunk-SIFVFP6T.js";
+import "../chunk-RHR6NARM.js";
+import {
+  HEARTBEAT_INTERVAL_MS,
+  sendHeartbeat
+} from "../chunk-DE4Y6TCC.js";
+import "../chunk-AXPCESYO.js";
+import {
+  detectProviderLiveCapabilities,
+  hasSpawnProvider,
+  resolveControlPolicy
+} from "../chunk-HQ6G3B5R.js";
+import {
+  SESSION_REAP_SILENCE_MS,
+  describeIdleWindow,
+  findLiveProcessBySpawnId,
+  listProcessProofs,
+  ownsLiveProcess,
+  silentSpawnedProofs
+} from "../chunk-ZSZSSJCV.js";
+import {
+  startRegisteredTranscripts
+} from "../chunk-JZTHGAPA.js";
+import "../chunk-SGZJ5LYH.js";
+import "../chunk-EYK3GSRH.js";
+import "../chunk-ZVSKMPBZ.js";
+import "../chunk-C2WCPBF7.js";
+import "../chunk-6J2JC2RT.js";
+import {
+  DAEMON_LEASE_RENEW_INTERVAL_MS,
+  acquireDaemonLease,
+  clearDaemonNeedsLogin,
+  daemonServiceManagerAvailable,
+  describeDaemonLoginBlock,
+  ensureDaemonRunning,
+  hasDaemonServiceDefinition,
+  manageDaemonService,
+  parseDaemonAction,
+  readDaemonNeedsLogin,
+  readDaemonStatus,
+  replaceDaemonService,
+  requestDaemonHandoff,
+  stopDaemonRunning,
+  writeDaemonNeedsLogin
+} from "../chunk-WE2J62NC.js";
+import "../chunk-3EVPNIBE.js";
+import "../chunk-OKXS7WDZ.js";
+import "../chunk-MPWXGONV.js";
+import "../chunk-SAXBC4AZ.js";
+import "../chunk-OLQRRFBX.js";
+import {
+  spawnClaude
+} from "../chunk-XHKBHWLX.js";
+import "../chunk-EPCXUP3P.js";
+import {
+  writeHuman
+} from "../chunk-QCGNGEGE.js";
+import {
+  exitOnHelpFlag
+} from "../chunk-HZVVNGEW.js";
+import "../chunk-GMXKITVA.js";
+import {
+  readControlMode
+} from "../chunk-P7WQEVWA.js";
+import {
+  getMachineId
+} from "../chunk-LXQ5FBBD.js";
+import "../chunk-7QLSKOSU.js";
+import {
+  EXIT
+} from "../chunk-KZERVKTD.js";
+import "../chunk-DB3ONZB4.js";
+import {
+  resolveBinary
+} from "../chunk-A2A2YTMG.js";
+import "../chunk-T7E75EKA.js";
+import {
+  getApiKey,
+  getBaseUrl
+} from "../chunk-GPEGOGRJ.js";
+import {
+  NPX_LATEST_COMMAND
+} from "../chunk-E4FJTUH4.js";
+import "../chunk-NQTHFF4W.js";
+
+// src/spawn-daemon.ts
+import { execFileSync, spawn } from "child_process";
+import { existsSync, statSync } from "fs";
+import { homedir } from "os";
+import { basename, dirname, join } from "path";
+
+// src/stop-requests.ts
+var STOP_CAPABILITY = "stop";
+var STOP_ACK_CAPABILITY = "stop-ack";
+var windowsTaskkillArgs = (pid) => ["/PID", String(pid), "/T", "/F"];
+var isStopRequest = (value) => {
+  if (!value || typeof value !== "object") return false;
+  const candidate = value;
+  return (candidate.id === void 0 || typeof candidate.id === "string" && candidate.id.length > 0 && candidate.id.length <= 64) && (candidate.spawnId === void 0 || typeof candidate.spawnId === "string" && candidate.spawnId.length > 0 && candidate.spawnId.length <= 64) && typeof candidate.sessionId === "string" && candidate.sessionId.length > 0 && typeof candidate.pid === "number" && Number.isInteger(candidate.pid) && candidate.pid > 1;
+};
+var parseStopRequests = (value) => Array.isArray(value) ? value.filter(isStopRequest) : [];
+var applyStop = (request, deps) => {
+  if (request.pid === deps.selfPid) return "skipped_self";
+  if (!deps.ownsProcess(request)) return "refused";
+  try {
+    deps.kill(request.pid, "SIGTERM");
+    return "stopped";
+  } catch (err) {
+    const code = err?.code;
+    return code === "ESRCH" ? "already_gone" : "refused";
+  }
+};
+var applyStopAndVerify = async (request, deps, attempts = 100, intervalMs = 100) => {
+  if (!deps.isAlive(request.pid)) return "already_gone";
+  if (!await deps.ownsProcess(request)) return "refused";
+  const outcome = applyStop(request, { ...deps, ownsProcess: () => true });
+  if (outcome !== "stopped") return outcome;
+  for (let attempt = 0; attempt < attempts; attempt++) {
+    await deps.sleep(intervalMs);
+    if (!deps.isAlive(request.pid)) return "stopped";
+  }
+  return "signal_sent";
+};
+
+// src/spawn-daemon.ts
+var DRAIN_PATH = "/api/agent/spawn/drain";
+var ACK_PATH = "/api/agent/spawn/ack";
+var SPAWN_PROTOCOL_VERSION = 2;
+var FAST_POLL_MS = 3e3;
+var SLOW_POLL_MS = 3e4;
+var FAST_DECAY_TICKS = 3;
+var MAX_ERROR_BACKOFF_MS = 12e4;
+var MAX_ERROR_STREAK = 6;
+var REQUEST_TIMEOUT_MS = 1e4;
+var STOP_PROTOCOL_VERSION = 2;
+var MAX_SPAWNS_PER_WINDOW = 5;
+var SPAWN_WINDOW_MS = 6e4;
+var VERSION_CHECK_INTERVAL_MS = 2e3;
+var CONTROL_PROBE_INTERVAL_MS = 6e4;
+var MAX_TRACKED_PROCESSES = 100;
+var MAX_COMPLETED_STOPS = 20;
+var SESSION_REAP_INTERVAL_MS = 6e4;
+var controlProbeDue = (lastProbeAt, at = Date.now()) => lastProbeAt === 0 || at - lastProbeAt >= CONTROL_PROBE_INTERVAL_MS;
+var parseControlProbe = (value) => {
+  if (typeof value !== "object" || value === null) return null;
+  const id = value.id;
+  return typeof id === "string" && id.length > 0 && id.length <= 128 ? id : null;
+};
+var daemonSignals = (platform = process.platform) => platform === "win32" ? ["SIGINT", "SIGTERM"] : ["SIGINT", "SIGTERM", "SIGHUP"];
+var parseSpawnClaim = (value) => {
+  if (typeof value !== "object" || value === null) return null;
+  const request = value;
+  if (typeof request.id !== "string" || typeof request.prompt !== "string") return null;
+  return {
+    id: request.id,
+    prompt: request.prompt,
+    ...typeof request.claimId === "string" ? { claimId: request.claimId } : {},
+    ...Number.isInteger(request.attemptCount) ? { attemptCount: request.attemptCount } : {},
+    ...typeof request.cwd === "string" ? { cwd: request.cwd } : {},
+    ...typeof request.agent === "string" ? { agent: request.agent } : {},
+    ...typeof request.model === "string" ? { model: request.model } : {},
+    ...typeof request.resumeSessionId === "string" ? { resumeSessionId: request.resumeSessionId } : {}
+  };
+};
+var stopAcknowledgement = (request, machineId, state) => request.id ? { stopId: request.id, machineId, state } : null;
+var spawnAcknowledgement = (request, machineId, outcome) => {
+  if (!request.claimId) return null;
+  return outcome.state === "started" ? {
+    spawnId: request.id,
+    claimId: request.claimId,
+    machineId,
+    state: "started",
+    pid: outcome.pid ?? null
+  } : {
+    spawnId: request.id,
+    claimId: request.claimId,
+    machineId,
+    state: "failed",
+    failure: {
+      code: "launch_failed",
+      message: outcome.message.slice(0, 240),
+      retryable: false
+    }
+  };
+};
+var launchSpawnClaim = async (request, runtime) => {
+  const existingPid = await runtime.findExistingPid(request.id);
+  if (existingPid !== null) {
+    await runtime.acknowledge(spawnAcknowledgement(request, runtime.machineId, { state: "started", pid: existingPid }));
+    return;
+  }
+  let pid;
+  try {
+    pid = await runtime.launch(request);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    runtime.reportLaunchError(message);
+    await runtime.acknowledge(spawnAcknowledgement(request, runtime.machineId, { state: "failed", message }));
+    return;
+  }
+  await runtime.acknowledge(spawnAcknowledgement(request, runtime.machineId, { state: "started", pid }));
+};
+var DrainError = class extends Error {
+  constructor(status) {
+    super(`drain ${status}`);
+    this.status = status;
+    this.name = "DrainError";
+  }
+};
+var isAuthFailure = (err) => {
+  if (typeof err !== "object" || err === null) return false;
+  const candidate = err;
+  if (candidate.name !== "DrainError") return false;
+  return candidate.status === 401 || candidate.status === 403;
+};
+var normalizeLaunchAgent = (requestedAgent) => {
+  if (requestedAgent === void 0 || requestedAgent === "claude") return "claude";
+  if (requestedAgent === "codex" || requestedAgent === "gemini") return requestedAgent;
+  return null;
+};
+var providerLaunchError = (requestedAgent, binaries, configuredProviders) => {
+  const agent = normalizeLaunchAgent(requestedAgent);
+  if (!agent) return `Unsupported agent provider: ${requestedAgent}`;
+  if (configuredProviders && !configuredProviders.includes(agent)) {
+    return `${agent === "claude" ? "Claude Code" : agent === "codex" ? "Codex" : "Gemini"} is not configured for Pushary on this machine`;
+  }
+  if (binaries[agent]) return null;
+  return agent === "claude" ? "Claude Code is not installed on this machine" : `${agent === "codex" ? "Codex" : "Gemini"} CLI is not installed on this machine`;
+};
+var resolveSpawnDirectory = (requested, options = {}) => {
+  const fallbackDir = options.fallbackDir ?? process.cwd();
+  const value = requested?.trim();
+  if (!value) return { ok: true, cwd: fallbackDir };
+  const homeDir = options.homeDir ?? homedir();
+  const cwd = value === "~" ? homeDir : value.startsWith("~/") || value.startsWith("~\\") ? join(homeDir, value.slice(2)) : value;
+  if (!(options.exists ?? existsSync)(cwd)) {
+    return { ok: false, message: `Directory does not exist: ${value}` };
+  }
+  try {
+    if (!(options.isDirectory ?? ((path) => statSync(path).isDirectory()))(cwd)) {
+      return { ok: false, message: `Not a directory: ${value}` };
+    }
+  } catch {
+    return { ok: false, message: `Not a directory: ${value}` };
+  }
+  return { ok: true, cwd };
+};
+var isFlagShapedPrompt = (prompt) => prompt.trimStart().startsWith("-");
+var buildSpawnLaunch = (req, opts) => {
+  if (isFlagShapedPrompt(req.prompt)) return null;
+  const agent = normalizeLaunchAgent(req.agent);
+  if (!agent) return null;
+  const model = typeof req.model === "string" && req.model.length > 0 ? ["--model", req.model] : [];
+  if (agent === "claude") {
+    const claudeArgs = ["claude", "--remote", ...model, "-p", req.prompt];
+    return opts.spawnDirect ? { direct: true, command: opts.execPath, args: [opts.siblingEntry, ...claudeArgs], agent } : { direct: false, command: opts.pusharyBin, args: claudeArgs, agent };
+  }
+  if (agent === "codex") {
+    return {
+      direct: true,
+      command: opts.execPath,
+      args: [opts.codexBridgeEntry],
+      agent
+    };
+  }
+  return {
+    direct: true,
+    command: opts.execPath,
+    args: [opts.geminiBridgeEntry],
+    agent
+  };
+};
+var spawnRateAllows = (timestamps, now, maxPerWindow = MAX_SPAWNS_PER_WINDOW, windowMs = SPAWN_WINDOW_MS) => {
+  while (timestamps.length > 0 && now - timestamps[0] > windowMs) timestamps.shift();
+  return timestamps.length < maxPerWindow;
+};
+var stderr = (msg) => {
+  process.stderr.write(msg);
+};
+var log = (message) => {
+  writeHuman(`${(/* @__PURE__ */ new Date()).toISOString()} ${message}
+`);
+};
+var errMsg = (err) => err instanceof Error ? err.message : String(err);
+var trackFailureStreak = (name, sinks) => {
+  let failing = false;
+  let lastDetail = "";
+  return {
+    fail(detail) {
+      sinks.recordError(`${name}: ${detail}`);
+      if (!failing || detail !== lastDetail) sinks.log(`${name} failing: ${detail}`);
+      failing = true;
+      lastDetail = detail;
+    },
+    recover() {
+      if (failing) sinks.log(`${name} recovered`);
+      failing = false;
+      lastDetail = "";
+    }
+  };
+};
+var runSpawnDaemon = async () => {
+  let apiKey;
+  try {
+    apiKey = getApiKey();
+  } catch {
+    stderr(`[pushary] daemon needs an API key. Run \`${NPX_LATEST_COMMAND} setup\`.
+`);
+    return 1;
+  }
+  const loginBlock = readDaemonNeedsLogin();
+  if (loginBlock.kind === "blocked") {
+    stderr(`[pushary] daemon not starting: ${describeDaemonLoginBlock(loginBlock.record)}
+`);
+    return 0;
+  }
+  if (loginBlock.kind === "stale") clearDaemonNeedsLogin();
+  const machineId = getMachineId();
+  const baseUrl = getBaseUrl();
+  const pusharyBin = resolveBinary("pushary") ?? "pushary";
+  const configuredProviders = inspectConfiguredManagedProviders();
+  const providerCapabilities = detectProviderLiveCapabilities(configuredProviders);
+  const siblingEntry = process.argv[1] ? join(dirname(process.argv[1]), "pushary.js") : "";
+  const codexBridgeEntry = process.argv[1] ? join(dirname(process.argv[1]), "pushary-codex-bridge.js") : "pushary-codex-bridge";
+  const geminiBridgeEntry = process.argv[1] ? join(dirname(process.argv[1]), "pushary-gemini-bridge.js") : "pushary-gemini-bridge";
+  const spawnDirect = siblingEntry.length > 0 && existsSync(siblingEntry);
+  const existing = readDaemonStatus();
+  let handoff;
+  try {
+    handoff = await requestDaemonHandoff(existing);
+  } catch (err) {
+    stderr(`[pushary] daemon could not request a handoff: ${err instanceof Error ? err.message : String(err)}
+`);
+    return 1;
+  }
+  if (existing.pid !== null && handoff.pid === existing.pid && handoff.processAlive === true) {
+    stderr("[pushary] daemon could not replace the existing process; run `pushary doctor` for details\n");
+    return 1;
+  }
+  const lifecycle = acquireDaemonLease({ machineId });
+  if (lifecycle.kind === "already-running") {
+    writeHuman(`[pushary] daemon already online as pid ${lifecycle.status.pid ?? "unknown"}
+`);
+    return 0;
+  }
+  if (lifecycle.kind === "unavailable") {
+    stderr(`[pushary] daemon could not acquire its local lease: ${lifecycle.detail}
+`);
+    return 1;
+  }
+  const daemonLease = lifecycle.lease;
+  const sinks = { log, recordError: (message) => daemonLease.recordError(message) };
+  const drainHealth = trackFailureStreak("drain", sinks);
+  const heartbeatHealth = trackFailureStreak("heartbeat", sinks);
+  let stopped = false;
+  let idleTicks = 0;
+  let errorStreak = 0;
+  let lastControlProbeAt = 0;
+  const spawnTimestamps = [];
+  const launchedProcesses = /* @__PURE__ */ new Map();
+  const completedStops = /* @__PURE__ */ new Map();
+  let timer;
+  let inflight;
+  let finish = () => {
+  };
+  let heartbeat;
+  let versionWatch;
+  let leaseRenewal;
+  let sessionReaper;
+  let reaping = false;
+  let rateCapped = false;
+  const launch = (req) => {
+    if (launchedProcesses.size >= MAX_TRACKED_PROCESSES) {
+      return Promise.reject(new Error("This daemon is already tracking 100 active sessions"));
+    }
+    const directory = resolveSpawnDirectory(req.cwd);
+    if (!directory.ok) return Promise.reject(new Error(directory.message));
+    const agent = normalizeLaunchAgent(req.agent);
+    if (!agent) return Promise.reject(new Error(`Unsupported agent provider: ${req.agent}`));
+    const providerBin = resolveBinary(agent);
+    const unavailable = providerLaunchError(req.agent, {
+      claude: agent === "claude" ? providerBin ?? null : null,
+      codex: agent === "codex" ? providerBin ?? null : null,
+      gemini: agent === "gemini" ? providerBin ?? null : null
+    }, configuredProviders);
+    if (unavailable) return Promise.reject(new Error(unavailable));
+    spawnTimestamps.push(Date.now());
+    const cwd = directory.cwd;
+    const env = {
+      ...process.env,
+      PUSHARY_SPAWN_ID: req.id,
+      PUSHARY_SPAWN_CLAIM_ID: req.claimId,
+      ...req.agent === "codex" || req.agent === "gemini" ? {
+        PUSHARY_BRIDGE_CWD: cwd,
+        PUSHARY_BRIDGE_PROMPT: req.prompt || void 0,
+        PUSHARY_BRIDGE_MODEL: req.model || void 0,
+        PUSHARY_BRIDGE_RESUME_SESSION_ID: req.resumeSessionId || void 0
+      } : {},
+      ...req.agent === "codex" ? {
+        PUSHARY_CODEX_COMMAND: providerBin ?? "codex"
+      } : {},
+      ...req.agent === "gemini" ? {
+        PUSHARY_GEMINI_COMMAND: providerBin ?? "gemini"
+      } : {}
+    };
+    const plan = buildSpawnLaunch(req, {
+      spawnDirect,
+      execPath: process.execPath,
+      siblingEntry,
+      pusharyBin,
+      codexBridgeEntry,
+      geminiBridgeEntry
+    });
+    if (!plan) {
+      return Promise.reject(new Error("The prompt looks like a command-line flag"));
+    }
+    return new Promise((resolve, reject) => {
+      try {
+        const child = plan.direct ? spawn(plan.command, plan.args, { cwd, detached: true, stdio: "ignore", env }) : spawnClaude(plan.command, plan.args, { cwd, detached: true, stdio: "ignore", env });
+        let started = false;
+        child.once("error", (err) => {
+          if (!started) reject(err);
+          else {
+            log(`spawn ${req.id}: launched session reported an error: ${err.message}`);
+            daemonLease.recordError(`spawn ${req.id}: ${err.message}`);
+          }
+        });
+        child.once("spawn", () => {
+          started = true;
+          if (typeof child.pid === "number") {
+            launchedProcesses.set(child.pid, req.id);
+            child.once("close", () => launchedProcesses.delete(child.pid));
+          }
+          child.unref();
+          log(`spawn ${req.id}: launched a phone-requested ${plan.agent} session in ${basename(cwd)} (pid ${child.pid ?? "unknown"})`);
+          resolve(typeof child.pid === "number" ? child.pid : null);
+        });
+      } catch (err) {
+        reject(err);
+      }
+    });
+  };
+  const kill = process.platform === "win32" ? (pid) => {
+    execFileSync("taskkill", windowsTaskkillArgs(pid), { stdio: "ignore" });
+  } : process.kill.bind(process);
+  const stopDeps = {
+    kill,
+    ownsProcess: (request) => {
+      const launched = request.spawnId ? launchedProcesses.get(request.pid) === request.spawnId : !request.id && launchedProcesses.has(request.pid);
+      return launched || ownsLiveProcess(request);
+    },
+    selfPid: process.pid,
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    isAlive: (pid) => {
+      try {
+        process.kill(pid, 0);
+        return true;
+      } catch (err) {
+        return err.code === "EPERM";
+      }
+    }
+  };
+  const reapSilentSessions = async () => {
+    if (stopped || reaping) return;
+    reaping = true;
+    try {
+      const now = Date.now();
+      const silent = silentSpawnedProofs(listProcessProofs({ reapDead: true }), now, SESSION_REAP_SILENCE_MS);
+      for (const proof of silent) {
+        if (stopped) return;
+        const outcome = await applyStopAndVerify(
+          { sessionId: proof.sessionId, pid: proof.pid, spawnId: proof.spawnId },
+          stopDeps
+        );
+        log(`session ${proof.sessionId} (pid ${proof.pid}) was silent for ${describeIdleWindow(now - proof.lastSeenAt)}: ${outcome}`);
+      }
+    } finally {
+      reaping = false;
+    }
+  };
+  const runStop = async (stop) => {
+    const outcome = stop.id ? completedStops.get(stop.id) ?? await apply() : await apply();
+    if (stop.id && !completedStops.has(stop.id)) {
+      if (completedStops.size === MAX_COMPLETED_STOPS) {
+        const oldest = completedStops.keys().next().value;
+        if (oldest) completedStops.delete(oldest);
+      }
+      completedStops.set(stop.id, outcome);
+    }
+    const said = {
+      stopped: `stopped session ${stop.sessionId}`,
+      already_gone: `session ${stop.sessionId} had already exited`,
+      signal_sent: `sent the stop signal to session ${stop.sessionId}; shutdown is still finishing`,
+      refused: `could not stop session ${stop.sessionId}, the system refused the signal`,
+      skipped_self: `refused to stop session ${stop.sessionId}: that pid is this daemon`
+    };
+    log(said[outcome]);
+    const acknowledgement = stopAcknowledgement(stop, machineId, outcome);
+    if (acknowledgement) {
+      for (let attempt = 0; attempt < 3 && !stopped; attempt++) {
+        const response = await fetch(`${baseUrl}/api/agent/stop/ack`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
+          body: JSON.stringify(acknowledgement),
+          signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+        }).catch(() => null);
+        if (response?.ok) {
+          completedStops.delete(acknowledgement.stopId);
+          break;
+        }
+        if (attempt < 2) await new Promise((resolve) => setTimeout(resolve, 200 * (attempt + 1)));
+      }
+    }
+    async function apply() {
+      return applyStopAndVerify(stop, stopDeps);
+    }
+  };
+  const acknowledgeControlProbe = async (probeId) => {
+    const response = await fetch(`${baseUrl}${DRAIN_PATH}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
+      body: JSON.stringify({ machineId, controlProbeAck: probeId }),
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    }).catch(() => null);
+    return response?.ok === true;
+  };
+  const drain = async (signal) => {
+    const controlProbe = controlProbeDue(lastControlProbeAt);
+    if (controlProbe) lastControlProbeAt = Date.now();
+    const res = await fetch(`${baseUrl}${DRAIN_PATH}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
+      body: JSON.stringify({
+        machineId,
+        spawnProtocol: SPAWN_PROTOCOL_VERSION,
+        stopProtocol: STOP_PROTOCOL_VERSION,
+        controlProbe
+      }),
+      signal
+    });
+    if (!res.ok) throw new DrainError(res.status);
+    const data = await res.json();
+    const response = typeof data === "object" && data !== null ? data : {};
+    await Promise.all(parseStopRequests(response.stops).map(runStop));
+    const controlProbeId = parseControlProbe(response.controlProbe);
+    return {
+      request: parseSpawnClaim(response.spawn),
+      controlProbeId,
+      // Released servers ignore the request field and omit the response field.
+      // Their successful authenticated drain remains the strongest proof they expose.
+      legacyControlProof: controlProbe && !Object.hasOwn(response, "controlProbe")
+    };
+  };
+  const acknowledge = async (body) => {
+    if (!body) return;
+    let lastError;
+    for (let attempt = 0; attempt < 3 && !stopped; attempt++) {
+      const controller = new AbortController();
+      inflight = controller;
+      const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+      try {
+        const response = await fetch(`${baseUrl}${ACK_PATH}`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
+          body: JSON.stringify(body),
+          signal: controller.signal
+        });
+        if (response.ok) return;
+        const error = new Error(`spawn ${body.spawnId} acknowledgement failed (${response.status})`);
+        if (response.status < 500) {
+          lastError = error;
+          break;
+        }
+        lastError = error;
+      } catch (err) {
+        lastError = new Error(`spawn ${body.spawnId} acknowledgement failed: ${errMsg(err)}`);
+      } finally {
+        clearTimeout(timeout);
+        if (inflight === controller) inflight = void 0;
+      }
+    }
+    throw lastError ?? new Error(`spawn ${body.spawnId} acknowledgement stopped`);
+  };
+  const launchClaim = (request) => launchSpawnClaim(request, {
+    machineId,
+    findExistingPid: async (spawnId) => {
+      for (const [pid, launchedSpawnId] of launchedProcesses) {
+        if (launchedSpawnId === spawnId) return pid;
+      }
+      return findLiveProcessBySpawnId(spawnId);
+    },
+    launch,
+    acknowledge,
+    reportLaunchError: (message) => {
+      log(`spawn ${request.id}: could not launch session: ${message}`);
+      daemonLease.recordError(`spawn ${request.id}: ${message}`);
+    }
+  });
+  const nextDelay = () => {
+    if (errorStreak > 0) return Math.min(SLOW_POLL_MS * 2 ** (errorStreak - 1), MAX_ERROR_BACKOFF_MS);
+    return idleTicks >= FAST_DECAY_TICKS ? SLOW_POLL_MS : FAST_POLL_MS;
+  };
+  const jitter = (ms) => Math.max(1, Math.round(ms * (0.85 + Math.random() * 0.3)));
+  const tick = async () => {
+    if (stopped) return;
+    if (!daemonLease.isOwner()) {
+      finish();
+      return;
+    }
+    if (!spawnRateAllows(spawnTimestamps, Date.now())) {
+      if (!rateCapped) log(`spawn rate cap reached (${MAX_SPAWNS_PER_WINDOW} in ${SPAWN_WINDOW_MS / 1e3}s); leaving the queue until the window frees`);
+      rateCapped = true;
+      timer = setTimeout(tick, jitter(nextDelay()));
+      return;
+    }
+    rateCapped = false;
+    const controller = new AbortController();
+    inflight = controller;
+    const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    try {
+      const drained = await drain(controller.signal);
+      if (!daemonLease.isOwner()) {
+        finish();
+        return;
+      }
+      errorStreak = 0;
+      drainHealth.recover();
+      if (drained.request) {
+        idleTicks = 0;
+        await launchClaim(drained.request);
+      } else {
+        idleTicks++;
+      }
+      const controlProved = drained.legacyControlProof || drained.controlProbeId !== null && await acknowledgeControlProbe(drained.controlProbeId);
+      if (controlProved) {
+        daemonLease.recordSuccessfulControl();
+      }
+    } catch (err) {
+      if (isAuthFailure(err)) {
+        const status = err.status;
+        writeDaemonNeedsLogin(status === 401 ? "key_rejected" : "plan_inactive");
+        log(
+          status === 401 ? "daemon stopping: this machine's key was rejected. Run `pushary login` to sign in again." : "daemon stopping: this workspace has no active plan, so the queue is closed. Pick one at pushary.com/dashboard/settings?tab=billing"
+        );
+        finish();
+        return;
+      }
+      errorStreak = Math.min(errorStreak + 1, MAX_ERROR_STREAK);
+      drainHealth.fail(errMsg(err));
+    } finally {
+      clearTimeout(timeout);
+      inflight = void 0;
+    }
+    if (!stopped) timer = setTimeout(tick, jitter(nextDelay()));
+  };
+  const stopTranscripts = startRegisteredTranscripts(apiKey, machineId);
+  const teardown = () => {
+    stopTranscripts();
+    if (stopped) return;
+    stopped = true;
+    if (timer) clearTimeout(timer);
+    if (heartbeat) clearInterval(heartbeat);
+    if (versionWatch) clearInterval(versionWatch);
+    if (leaseRenewal) clearInterval(leaseRenewal);
+    if (sessionReaper) clearInterval(sessionReaper);
+    inflight?.abort();
+    try {
+      daemonLease.release();
+    } catch (err) {
+      log(`daemon could not release its local lease: ${errMsg(err)}`);
+    }
+  };
+  const beat = async () => {
+    if (stopped) return;
+    if (!daemonLease.isOwner()) {
+      finish();
+      return;
+    }
+    const result = await sendHeartbeat(apiKey, {
+      repoKey: basename(process.cwd()),
+      capabilities: [
+        ...hasSpawnProvider(providerCapabilities) ? ["spawn"] : [],
+        STOP_CAPABILITY,
+        STOP_ACK_CAPABILITY,
+        ...providerCapabilities
+      ]
+    });
+    if (result.kind === "ok") {
+      daemonLease.recordSuccessfulHeartbeat();
+      heartbeatHealth.recover();
+    }
+    if (result.kind === "failed") heartbeatHealth.fail(result.detail);
+    if (result.kind === "unauthorized" && !stopped) {
+      writeDaemonNeedsLogin("key_rejected");
+      log("daemon stopping: this machine's key was rejected. Run `pushary login` to sign in again.");
+      finish();
+    }
+  };
+  void beat();
+  heartbeat = setInterval(() => void beat(), HEARTBEAT_INTERVAL_MS);
+  leaseRenewal = setInterval(() => daemonLease.renew(), DAEMON_LEASE_RENEW_INTERVAL_MS);
+  versionWatch = setInterval(() => {
+    if (daemonLease.shouldYield()) finish();
+  }, VERSION_CHECK_INTERVAL_MS);
+  sessionReaper = setInterval(() => void reapSilentSessions(), SESSION_REAP_INTERVAL_MS);
+  log(hasSpawnProvider(providerCapabilities) ? `daemon online (pid ${process.pid}): this machine (${machineId}) can now be sent a new session from your phone. Ctrl-C to stop.` : `daemon online (pid ${process.pid}): no supported Claude, Codex, or Gemini CLI was found, so phone-start is unavailable. Ctrl-C to stop.`);
+  timer = setTimeout(tick, 0);
+  const signals = daemonSignals();
+  await new Promise((resolve) => {
+    const onSignal = () => finish();
+    for (const signal of signals) process.on(signal, onSignal);
+    finish = () => {
+      teardown();
+      for (const signal of signals) process.off(signal, onSignal);
+      resolve();
+    };
+  });
+  return 0;
+};
+
+// src/daemon-sessions.ts
+import { execFileSync as execFileSync2 } from "child_process";
+var readResidentSetKb = (pid) => {
+  if (process.platform === "win32") return null;
+  try {
+    const output = execFileSync2("ps", ["-o", "rss=", "-p", String(pid)], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const kb = Number.parseInt(output.trim(), 10);
+    return Number.isFinite(kb) ? kb : null;
+  } catch {
+    return null;
+  }
+};
+var formatAge = (ms) => {
+  const totalSeconds = Math.max(0, Math.floor(ms / 1e3));
+  const hours = Math.floor(totalSeconds / 3600);
+  const minutes = Math.floor(totalSeconds % 3600 / 60);
+  if (hours > 0) return `${hours}h${String(minutes).padStart(2, "0")}m`;
+  if (minutes > 0) return `${minutes}m`;
+  return `${totalSeconds}s`;
+};
+var formatMemory = (kb) => kb === null ? "n/a" : kb >= 1024 ? `${Math.round(kb / 1024)} MB` : `${kb} KB`;
+var describeSessionProof = (entry, now, rssKb) => [
+  entry.sessionId,
+  `pid ${entry.pid}`,
+  entry.alive ? "alive" : "dead, reaped",
+  `age ${formatAge(now - entry.startedAt)}`,
+  `seen ${formatAge(now - entry.lastSeenAt)} ago`,
+  `rss ${formatMemory(rssKb)}`,
+  ...entry.spawnId ? [`spawn ${entry.spawnId}`] : []
+].join("  ");
+var describeSessionProofs = (entries, now, residentSet) => {
+  const live = entries.filter((entry) => entry.alive).length;
+  const reaped = entries.length - live;
+  if (entries.length === 0) return ["Sessions: none"];
+  const header = `Sessions: ${live} live${reaped > 0 ? `, ${reaped} dead proof${reaped === 1 ? "" : "s"} reaped` : ""}`;
+  return [
+    header,
+    ...entries.map((entry) => `  ${describeSessionProof(entry, now, entry.alive ? residentSet(entry.pid) : null)}`)
+  ];
+};
+
+// bin/pushary-daemon.ts
+exitOnHelpFlag("daemon");
+var serviceFailure = (result) => result.kind === "ok" ? null : result.detail;
+var applyService = (action) => serviceFailure(manageDaemonService(action));
+var waitForManagedDaemon = async () => {
+  const result = await ensureDaemonRunning({ spawnDaemon: () => {
+  } });
+  return "detail" in result ? result.detail : null;
+};
+var main = async () => {
+  const action = parseDaemonAction(process.argv.slice(2));
+  if (!action) {
+    process.stderr.write("Unknown daemon action. Use install, start, stop, restart, status, uninstall, or foreground.\n");
+    return EXIT.USAGE;
+  }
+  if (action === "foreground") return await runSpawnDaemon();
+  if (action === "status") {
+    const status = readDaemonStatus();
+    process.stdout.write(`Pushary daemon: ${status.kind}${status.pid ? ` (pid ${status.pid})` : ""}
+`);
+    if (status.lastError) process.stdout.write(`Last error: ${status.lastError.message} at ${status.lastError.at}
+`);
+    const sessions = describeSessionProofs(listProcessProofs({ reapDead: true }), Date.now(), readResidentSetKb);
+    process.stdout.write(`${sessions.join("\n")}
+`);
+    return status.kind === "running" ? EXIT.OK : EXIT.UNREACHABLE;
+  }
+  if (action === "install" || action === "start" || action === "restart") {
+    if (!getApiKey()) {
+      process.stderr.write("[pushary] daemon service has no readable API key; re-run setup.\n");
+      return EXIT.FAILED;
+    }
+    const status = readDaemonStatus();
+    const controlPolicy = resolveControlPolicy({
+      mode: readControlMode() ?? (action === "install" ? "on" : null),
+      providerAvailable: hasSpawnProvider(detectProviderLiveCapabilities(inspectConfiguredManagedProviders())),
+      managerAvailable: daemonServiceManagerAvailable(),
+      servicePresent: status.kind !== "absent" || hasDaemonServiceDefinition()
+    });
+    if (controlPolicy !== "enabled") {
+      process.stderr.write(`[pushary] daemon service is ${controlPolicy}; run setup with --control on to configure phone-start safely.
+`);
+      return EXIT.FAILED;
+    }
+  }
+  if (action === "install") {
+    const installed = await replaceDaemonService();
+    if (installed.kind !== "ok") {
+      process.stderr.write(`[pushary] daemon service install failed: ${installed.detail}
+`);
+      return EXIT.FAILED;
+    }
+    const unhealthy = await waitForManagedDaemon();
+    if (unhealthy) {
+      process.stderr.write(`[pushary] daemon service installed but unavailable: ${unhealthy}
+`);
+      return EXIT.UNREACHABLE;
+    }
+    process.stdout.write("[pushary] daemon service installed and online\n");
+    return EXIT.OK;
+  }
+  if (action === "start") {
+    const failed2 = applyService("start");
+    if (failed2) {
+      process.stderr.write(`[pushary] daemon service could not start: ${failed2}
+`);
+      return EXIT.FAILED;
+    }
+    const unhealthy = await waitForManagedDaemon();
+    if (unhealthy) {
+      process.stderr.write(`[pushary] daemon service did not become healthy: ${unhealthy}
+`);
+      return EXIT.UNREACHABLE;
+    }
+    process.stdout.write("[pushary] daemon service online\n");
+    return EXIT.OK;
+  }
+  const serviceAction = action === "uninstall" ? "uninstall" : "stop";
+  const failed = applyService(serviceAction);
+  const stopped = await stopDaemonRunning();
+  if (failed || stopped.kind === "unavailable") {
+    const detail = [failed, stopped.kind === "unavailable" ? stopped.detail : null].filter(Boolean).join("; ");
+    process.stderr.write(`[pushary] daemon could not stop: ${detail}
+`);
+    return EXIT.FAILED;
+  }
+  if (action === "restart") {
+    const startFailed = applyService("start");
+    if (startFailed) {
+      process.stderr.write(`[pushary] daemon service could not restart: ${startFailed}
+`);
+      return EXIT.FAILED;
+    }
+    const unhealthy = await waitForManagedDaemon();
+    if (unhealthy) {
+      process.stderr.write(`[pushary] daemon service did not become healthy: ${unhealthy}
+`);
+      return EXIT.UNREACHABLE;
+    }
+    process.stdout.write("[pushary] daemon service restarted\n");
+    return EXIT.OK;
+  }
+  process.stdout.write(action === "uninstall" ? "[pushary] daemon service removed\n" : "[pushary] daemon stopped\n");
+  return EXIT.OK;
+};
+main().then((code) => process.exit(code)).catch((err) => {
+  process.stderr.write(`[pushary] daemon error: ${err instanceof Error ? err.message : String(err)}
+`);
+  process.exit(EXIT.FAILED);
+});