seshmux 0.1.3 → 0.1.5

package/.next/standalone/seshmux-server.js

@@ -4710,11 +4710,146 @@ var init_search2 = __esm({
   }
 });
 
+// server/lib/update.ts
+function compareVersions(a, b) {
+  const pa = a.split(".").map((n) => parseInt(n, 10) || 0);
+  const pb = b.split(".").map((n) => parseInt(n, 10) || 0);
+  const len = Math.max(pa.length, pb.length);
+  for (let i = 0; i < len; i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return d < 0 ? -1 : 1;
+  }
+  return 0;
+}
+function isDaemonStale(daemonVersion, serverVersion) {
+  if (!daemonVersion || !serverVersion) return false;
+  return compareVersions(serverVersion, daemonVersion) > 0;
+}
+function detectInstallMethod(opts) {
+  const p = opts.argvRealPath;
+  if (p.includes("/_npx/") || p.includes("\\_npx\\")) return "npx";
+  const prefix = realpath2(opts.globalPrefix);
+  if (prefix && realpath2(p).startsWith(prefix)) return "global";
+  return "local";
+}
+function realpath2(p) {
+  if (!p) return "";
+  try {
+    return (0, import_node_fs9.realpathSync)(p);
+  } catch {
+    return p;
+  }
+}
+function resolveArgvRealPath() {
+  const raw = process.argv[1] ?? "";
+  try {
+    return (0, import_node_fs9.realpathSync)(raw);
+  } catch {
+    return raw;
+  }
+}
+function defaultExec(cmd, args) {
+  return new Promise((resolve, reject) => {
+    (0, import_node_child_process7.execFile)(cmd, args, { timeout: 12e4, maxBuffer: 8 * 1024 * 1024 }, (err, stdout, stderr) => {
+      if (err) reject(Object.assign(err, { stdout, stderr }));
+      else resolve({ stdout, stderr });
+    });
+  });
+}
+async function defaultGlobalPrefix(exec) {
+  try {
+    const { stdout } = await exec("npm", ["prefix", "-g"]);
+    return stdout.trim();
+  } catch {
+    return "";
+  }
+}
+async function checkUpdate(deps = {}) {
+  const current = deps.current ?? process.env.SESHMUX_VERSION ?? process.env.npm_package_version ?? "0.0.0";
+  const fetchFn = deps.fetchFn ?? defaultFetch;
+  const exec = deps.exec ?? defaultExec;
+  const argvRealPath = deps.argvRealPath ?? resolveArgvRealPath();
+  const globalPrefix = deps.globalPrefix ?? await defaultGlobalPrefix(exec);
+  const installMethod = detectInstallMethod({ argvRealPath, globalPrefix });
+  let latest = current;
+  if (cache && Date.now() - cache.ts < CACHE_TTL_MS) {
+    latest = cache.latest;
+  } else {
+    latest = await fetchLatest(fetchFn, current);
+    cache = { ts: Date.now(), latest };
+  }
+  return {
+    current,
+    latest,
+    updateAvailable: compareVersions(latest, current) > 0,
+    installMethod
+  };
+}
+async function fetchLatest(fetchFn, current) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+  try {
+    const res = await fetchFn(REGISTRY_URL, { signal: controller.signal });
+    if (!res.ok) return current;
+    const body = await res.json();
+    return typeof body.version === "string" ? body.version : current;
+  } catch {
+    return current;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function applyUpdate(deps) {
+  if (deps.installMethod === "npx") {
+    throw new Error("cannot self-update an npx invocation \u2014 run `npx seshmux@latest` next time");
+  }
+  const exec = deps.exec ?? defaultExec;
+  const previous = deps.current;
+  const version2 = /^\d+\.\d+\.\d+[A-Za-z0-9.\-+]*$/.test(deps.target ?? "") ? deps.target : null;
+  const spec = `seshmux@${version2 ?? "latest"}`;
+  try {
+    const { stdout, stderr } = await exec("npm", ["i", "-g", spec, "--prefer-online"]);
+    return { ok: true, log: [stdout, stderr].filter(Boolean).join("\n"), previous };
+  } catch (e) {
+    const err = e;
+    const log = [err.stdout, err.stderr, err.message].filter(Boolean).join("\n");
+    return { ok: false, log, previous };
+  }
+}
+var import_node_child_process7, import_node_fs9, REGISTRY_URL, FETCH_TIMEOUT_MS, CACHE_TTL_MS, defaultFetch, cache;
+var init_update = __esm({
+  "server/lib/update.ts"() {
+    "use strict";
+    import_node_child_process7 = require("node:child_process");
+    import_node_fs9 = require("node:fs");
+    REGISTRY_URL = "https://registry.npmjs.org/seshmux/latest";
+    FETCH_TIMEOUT_MS = 5e3;
+    CACHE_TTL_MS = 6 * 60 * 60 * 1e3;
+    defaultFetch = (url, init) => fetch(url, init);
+    cache = null;
+  }
+});
+
 // server/routes/env.ts
 var env_exports = {};
 __export(env_exports, {
   default: () => envRoutes
 });
+async function realDaemonInfo() {
+  let conn = null;
+  try {
+    conn = await dial();
+    const [{ version: version2 }, { ptys }] = await Promise.all([conn.hello(), conn.list()]);
+    return {
+      version: version2 || null,
+      plainPtys: ptys.filter((p) => p.alive !== false && !p.tmuxName).length
+    };
+  } catch {
+    return { version: null, plainPtys: 0 };
+  } finally {
+    conn?.close();
+  }
+}
 function commandPreview(commands) {
   return {
     fresh: commands.fresh("").join(" "),
@@ -4725,12 +4860,17 @@ function commandPreview(commands) {
 }
 async function envRoutes(f, deps = {}) {
   const bridgeStatus2 = deps.bridgeStatus ?? (() => bridgeStatus());
+  const daemonInfo = deps.daemonInfo ?? realDaemonInfo;
+  const serverVersion = deps.serverVersion ?? (() => process.env.SESHMUX_VERSION ?? "");
   f.get("/api/env", async () => {
-    const [env, bridge, providers] = await Promise.all([
+    const [env, bridge, providers, dInfo] = await Promise.all([
       detectEnv(),
       bridgeStatus2().catch(() => ({ claude: false, codex: false })),
-      getProviders()
+      getProviders(),
+      daemonInfo().catch(() => ({ version: null, plainPtys: 0 }))
     ]);
+    const dVersion = dInfo.version;
+    const sVersion = serverVersion();
     const commands = {};
     const teams = {};
     for (const p of providers) {
@@ -4744,7 +4884,16 @@ async function envRoutes(f, deps = {}) {
         codex: { registered: bridge.codex }
       },
       commands,
-      teams
+      teams,
+      // The daemon outlives server updates by design, so it can be older than us. The NEXT update
+      // upgrades it automatically — unless plain (non-tmux) PTYs are live, which a restart would
+      // kill. plainPtys is what lets the UI tell those two states apart.
+      daemon: {
+        version: dVersion,
+        serverVersion: sVersion || null,
+        stale: isDaemonStale(dVersion, sVersion),
+        plainPtys: dInfo.plainPtys
+      }
     };
   });
 }
@@ -4754,6 +4903,8 @@ var init_env = __esm({
     init_detect();
     init_registry();
     init_types();
+    init_daemon_client();
+    init_update();
   }
 });
 
@@ -5016,10 +5167,11 @@ async function termRoutes(f, deps = {}) {
       try {
         conn = await (deps.dialFn ?? dial)();
         const { data } = await withTimeout(conn.history(req.params.ptyId, lines), 5e3, "history timed out");
-        return reply.send({ data });
+        return reply.send({ supported: true, data });
       } catch (e) {
         const msg = e.message || String(e);
-        return reply.code(msg.includes("unknown method") ? 501 : 500).send({ error: msg });
+        if (msg.includes("unknown method")) return reply.send({ supported: false, data: "" });
+        return reply.code(500).send({ error: msg });
       } finally {
         conn?.close();
       }
@@ -5602,7 +5754,7 @@ async function notifyRoutes(f) {
       return { ok: true, delivered: false, reason: "disabled" };
     }
     await new Promise((resolve) => {
-      const child = (0, import_node_child_process7.execFile)(
+      const child = (0, import_node_child_process8.execFile)(
         "osascript",
         [
           "-e",
@@ -5620,11 +5772,11 @@ async function notifyRoutes(f) {
     return { ok: true, delivered: true };
   });
 }
-var import_node_child_process7, import_promises18, import_node_path22, import_node_os10;
+var import_node_child_process8, import_promises18, import_node_path22, import_node_os10;
 var init_notify = __esm({
   "server/routes/notify.ts"() {
     "use strict";
-    import_node_child_process7 = require("node:child_process");
+    import_node_child_process8 = require("node:child_process");
     import_promises18 = require("node:fs/promises");
     import_node_path22 = __toESM(require("node:path"));
     import_node_os10 = __toESM(require("node:os"));
@@ -5656,122 +5808,6 @@ var init_approval = __esm({
   }
 });
 
-// server/lib/update.ts
-function compareVersions(a, b) {
-  const pa = a.split(".").map((n) => parseInt(n, 10) || 0);
-  const pb = b.split(".").map((n) => parseInt(n, 10) || 0);
-  const len = Math.max(pa.length, pb.length);
-  for (let i = 0; i < len; i++) {
-    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
-    if (d !== 0) return d < 0 ? -1 : 1;
-  }
-  return 0;
-}
-function detectInstallMethod(opts) {
-  const p = opts.argvRealPath;
-  if (p.includes("/_npx/") || p.includes("\\_npx\\")) return "npx";
-  const prefix = realpath2(opts.globalPrefix);
-  if (prefix && realpath2(p).startsWith(prefix)) return "global";
-  return "local";
-}
-function realpath2(p) {
-  if (!p) return "";
-  try {
-    return (0, import_node_fs9.realpathSync)(p);
-  } catch {
-    return p;
-  }
-}
-function resolveArgvRealPath() {
-  const raw = process.argv[1] ?? "";
-  try {
-    return (0, import_node_fs9.realpathSync)(raw);
-  } catch {
-    return raw;
-  }
-}
-function defaultExec(cmd, args) {
-  return new Promise((resolve, reject) => {
-    (0, import_node_child_process8.execFile)(cmd, args, { timeout: 12e4, maxBuffer: 8 * 1024 * 1024 }, (err, stdout, stderr) => {
-      if (err) reject(Object.assign(err, { stdout, stderr }));
-      else resolve({ stdout, stderr });
-    });
-  });
-}
-async function defaultGlobalPrefix(exec) {
-  try {
-    const { stdout } = await exec("npm", ["prefix", "-g"]);
-    return stdout.trim();
-  } catch {
-    return "";
-  }
-}
-async function checkUpdate(deps = {}) {
-  const current = deps.current ?? process.env.SESHMUX_VERSION ?? process.env.npm_package_version ?? "0.0.0";
-  const fetchFn = deps.fetchFn ?? defaultFetch;
-  const exec = deps.exec ?? defaultExec;
-  const argvRealPath = deps.argvRealPath ?? resolveArgvRealPath();
-  const globalPrefix = deps.globalPrefix ?? await defaultGlobalPrefix(exec);
-  const installMethod = detectInstallMethod({ argvRealPath, globalPrefix });
-  let latest = current;
-  if (cache && Date.now() - cache.ts < CACHE_TTL_MS) {
-    latest = cache.latest;
-  } else {
-    latest = await fetchLatest(fetchFn, current);
-    cache = { ts: Date.now(), latest };
-  }
-  return {
-    current,
-    latest,
-    updateAvailable: compareVersions(latest, current) > 0,
-    installMethod
-  };
-}
-async function fetchLatest(fetchFn, current) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
-  try {
-    const res = await fetchFn(REGISTRY_URL, { signal: controller.signal });
-    if (!res.ok) return current;
-    const body = await res.json();
-    return typeof body.version === "string" ? body.version : current;
-  } catch {
-    return current;
-  } finally {
-    clearTimeout(timer);
-  }
-}
-async function applyUpdate(deps) {
-  if (deps.installMethod === "npx") {
-    throw new Error("cannot self-update an npx invocation \u2014 run `npx seshmux@latest` next time");
-  }
-  const exec = deps.exec ?? defaultExec;
-  const previous = deps.current;
-  const version2 = /^\d+\.\d+\.\d+[A-Za-z0-9.\-+]*$/.test(deps.target ?? "") ? deps.target : null;
-  const spec = `seshmux@${version2 ?? "latest"}`;
-  try {
-    const { stdout, stderr } = await exec("npm", ["i", "-g", spec, "--prefer-online"]);
-    return { ok: true, log: [stdout, stderr].filter(Boolean).join("\n"), previous };
-  } catch (e) {
-    const err = e;
-    const log = [err.stdout, err.stderr, err.message].filter(Boolean).join("\n");
-    return { ok: false, log, previous };
-  }
-}
-var import_node_child_process8, import_node_fs9, REGISTRY_URL, FETCH_TIMEOUT_MS, CACHE_TTL_MS, defaultFetch, cache;
-var init_update = __esm({
-  "server/lib/update.ts"() {
-    "use strict";
-    import_node_child_process8 = require("node:child_process");
-    import_node_fs9 = require("node:fs");
-    REGISTRY_URL = "https://registry.npmjs.org/seshmux/latest";
-    FETCH_TIMEOUT_MS = 5e3;
-    CACHE_TTL_MS = 6 * 60 * 60 * 1e3;
-    defaultFetch = (url, init) => fetch(url, init);
-    cache = null;
-  }
-});
-
 // server/routes/update.ts
 var update_exports = {};
 __export(update_exports, {

package/bin/seshmux.js

@@ -18,7 +18,104 @@ const http = require('node:http');
 const { randomBytes } = require('node:crypto');
 const path = require('node:path');
 const fs = require('node:fs');
-const { ensureDaemon } = require('../daemon/ensure');
+const { ensureDaemon, pidAlive, paths, configDir, daemonInfo, canSafelyRestartDaemon } = require('../daemon/ensure');
+
+// The daemon's pid, from the pidfile it writes in the config dir. null when it isn't running.
+function readDaemonPid() {
+  try {
+    const pid = Number(fs.readFileSync(paths(configDir()).pid, 'utf8').trim());
+    return Number.isInteger(pid) && pid > 0 && pidAlive(pid) ? pid : null;
+  } catch {
+    return null;
+  }
+}
+
+// Stop the running daemon (if any) and start a fresh one. The ONLY kill+respawn path —
+// shared by --restart-daemon (explicit, may end plain PTYs) and the post-update auto-upgrade
+// (which only calls this once canSafelyRestartDaemon() says every live PTY is tmux-backed).
+// Returns false if the old daemon refused to die (we never start a second one).
+async function restartDaemon() {
+  const before = readDaemonPid();
+  if (before) {
+    try {
+      process.kill(before, 'SIGTERM');
+    } catch {
+      /* already gone */
+    }
+    for (let i = 0; i < 40 && pidAlive(before); i++) await new Promise((r) => setTimeout(r, 100));
+    if (pidAlive(before)) {
+      console.error(`[seshmux] daemon ${before} did not stop; not starting a second one`);
+      return false;
+    }
+  }
+  const { spawned } = await ensureDaemon();
+  console.log(`[seshmux] daemon ${spawned ? 'restarted' : 'already up'} (pid ${readDaemonPid() ?? '?'})`);
+  return true;
+}
+
+// Numeric-segment version compare ("0.10.0" > "0.9.0"). Mirror of server/lib/update.ts's
+// compareVersions — this file is plain CJS and cannot import the TS module.
+function versionLess(a, b) {
+  const pa = a.split('.').map((n) => parseInt(n, 10) || 0);
+  const pb = b.split('.').map((n) => parseInt(n, 10) || 0);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] || 0) - (pb[i] || 0);
+    if (d !== 0) return d < 0;
+  }
+  return false;
+}
+
+// After a self-update the server is new but the daemon still runs the OLD code forever
+// (ensureDaemon reuses any daemon that answers hello). Upgrade it here — but ONLY when no live
+// session would die: tmux-tier PTYs rehydrate in the fresh daemon, plain-tier PTYs do not.
+// Unreachable daemon / unknown versions (dev) → do nothing.
+// Returns 'upgraded' | 'blocked' | 'noop'. quiet=true suppresses the blocked log (the retry
+// loop below would otherwise repeat it forever).
+async function autoUpgradeDaemon(ourVersion, quiet) {
+  const info = await daemonInfo(paths(configDir()).sock).catch(() => null);
+  if (!info || !info.version || !ourVersion || ourVersion === '0.0.0') return 'noop';
+  if (!versionLess(info.version, ourVersion)) return 'noop';
+
+  const { safe, plainCount } = canSafelyRestartDaemon(info.ptys);
+  if (!safe) {
+    if (!quiet) {
+      console.log(
+        `[seshmux] daemon stays on v${info.version} for now — ${plainCount} running session(s) are not tmux-backed ` +
+          'and a restart would end them. It will upgrade itself as soon as they finish.',
+      );
+    }
+    return 'blocked';
+  }
+  const tmuxCount = info.ptys.filter((p) => p.tmuxName && p.alive !== false).length;
+  console.log(
+    `[seshmux] upgrading daemon v${info.version} -> v${ourVersion}` +
+      (tmuxCount ? ` (${tmuxCount} tmux session(s) will re-attach)` : ''),
+  );
+  await restartDaemon();
+  return 'upgraded';
+}
+
+// A blocked upgrade must not stay blocked forever. Without tmux a PTY simply cannot outlive the
+// daemon that owns its master fd — that is the OS, not a bug we can fix — so the answer is NOT to
+// demand the user install tmux, it is to never need the restart at a bad moment. The daemon is
+// harmless while stale (protocol frozen at 1; newer RPCs degrade, they don't fail), so it can
+// simply WAIT for a safe moment: every live session ended, or all remaining ones are tmux-backed.
+// Then it upgrades itself, with nothing killed and nothing for the user to type.
+const UPGRADE_RETRY_MS = Number(process.env.SESHMUX_UPGRADE_RETRY_MS) || 60_000;
+function scheduleDaemonUpgrade(getVersion) {
+  let announced = false;
+  const tick = async () => {
+    const result = await autoUpgradeDaemon(getVersion(), announced).catch(() => 'noop');
+    if (result === 'blocked') {
+      announced = true; // say it once, then wait quietly
+      return;
+    }
+    clearInterval(timer); // upgraded, or nothing to do — stop checking
+  };
+  const timer = setInterval(tick, UPGRADE_RETRY_MS);
+  if (timer.unref) timer.unref(); // never hold the process open on this alone
+  tick();
+}
 
 // Absolute path to THIS cli entry, inherited by the server child. The MCP
 // bridge registration writes it into agent configs (`node <bin> mcp-bridge`) —
@@ -88,12 +185,17 @@ function parseArgs(argv) {
   // $PORT is honoured because server/index.ts already does — without this the CLI
   // silently ignored it and booted on 4700 anyway. --port still wins over the env.
   const envPort = Number(process.env.PORT);
-  const args = { port: Number.isInteger(envPort) && envPort > 0 ? envPort : 4700, noOpen: false };
+  const args = {
+    port: Number.isInteger(envPort) && envPort > 0 ? envPort : 4700,
+    noOpen: false,
+    restartDaemon: false,
+  };
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     if (a === '--port' || a === '-p') args.port = Number(argv[++i]);
     else if (a.startsWith('--port=')) args.port = Number(a.slice(7));
     else if (a === '--no-open') args.noOpen = true;
+    else if (a === '--restart-daemon') args.restartDaemon = true;
   }
   if (!Number.isInteger(args.port) || args.port <= 0) args.port = 4700;
   return args;
@@ -132,6 +234,99 @@ function runMcpBridge(root) {
   child.on('exit', (code) => process.exit(code ?? 0));
 }
 
+// Is a binary on PATH? Shell-free.
+function have(bin) {
+  return new Promise((resolve) => {
+    execFile('which', [bin], (err, stdout) => resolve(!err && !!String(stdout).trim()));
+  });
+}
+
+// The package manager we can offer to install tmux with, or null when there is nothing to offer.
+async function tmuxInstaller() {
+  if (process.platform === 'darwin' && (await have('brew'))) return { cmd: 'brew', args: ['install', 'tmux'] };
+  if (await have('apt-get')) return { cmd: 'sudo', args: ['apt-get', 'install', '-y', 'tmux'] };
+  if (await have('dnf')) return { cmd: 'sudo', args: ['dnf', 'install', '-y', 'tmux'] };
+  return null;
+}
+
+// Resolves 'yes' | 'no' | 'none'. 'none' = the user never actually answered (stdin hit EOF, or
+// the terminal went away): rl.question's callback then NEVER fires, which would hang startup
+// forever. Booting the app matters more than this prompt, so no answer means "skip it, ask again
+// next time" — never a silent decline the user did not make.
+function askYesNo(question) {
+  return new Promise((resolve) => {
+    const rl = require('node:readline').createInterface({ input: process.stdin, output: process.stdout });
+    let done = false;
+    const finish = (v) => {
+      if (done) return;
+      done = true;
+      rl.close();
+      resolve(v);
+    };
+    rl.on('close', () => finish('none')); // EOF / ^D / stdin closed
+    rl.question(question, (answer) => finish(/^n/i.test(String(answer).trim()) ? 'no' : 'yes'));
+  });
+}
+
+// Without tmux, a session's PTY is owned by the daemon and dies with it — a crash or a daemon
+// restart ends the user's running agent. session-start.ts picks the tmux tier ONLY when tmux is
+// on PATH, so a tmux-less machine silently gets the fragile tier and nobody says a word. A real
+// user lost every session this way. Offer to fix it, once, and never nag again.
+//
+// NOT an npm postinstall: that needs a package manager we can't assume, is skipped entirely under
+// `npm ci --ignore-scripts` (standard in CI), would run in Docker images where tmux is pointless,
+// and shelling out to a system installer from an install hook is exactly what supply-chain
+// scanners flag. A first-run prompt asks the person who is actually there.
+async function offerTmux() {
+  if (await have('tmux')) return;
+  const ackFile = path.join(configDir(), 'tmux-declined');
+  if (fs.existsSync(ackFile)) return;
+
+  const durability =
+    '[seshmux] tmux is not installed.\n' +
+    '  Your agent sessions will end if seshmux restarts or crashes.\n' +
+    '  With tmux, they survive restarts, updates, and crashes.';
+
+  // Non-interactive (piped, CI, launched by a GUI): state it, never block on a prompt nobody
+  // can answer, and do not record a decline the user never made.
+  if (!process.stdin.isTTY) {
+    console.log(`${durability}\n  Install tmux to make sessions durable.`);
+    return;
+  }
+
+  const installer = await tmuxInstaller();
+  if (!installer) {
+    console.log(`${durability}\n  Install tmux with your package manager to make sessions durable.`);
+    return;
+  }
+
+  console.log(durability);
+  const answer = await askYesNo(`\n  Install tmux now with ${installer.cmd}? [Y/n] `);
+  if (answer === 'none') return; // no answer given — boot anyway, ask again next launch
+  if (answer === 'no') {
+    try {
+      fs.mkdirSync(path.dirname(ackFile), { recursive: true });
+      fs.writeFileSync(ackFile, 'declined\n');
+    } catch {
+      /* best effort — worst case we ask again next launch */
+    }
+    console.log('[seshmux] continuing without tmux (sessions are not crash-safe). Not asking again.');
+    return;
+  }
+
+  console.log(`[seshmux] ${installer.cmd} ${installer.args.join(' ')}…`);
+  await new Promise((resolve) => {
+    const child = spawn(installer.cmd, installer.args, { stdio: 'inherit' });
+    child.on('exit', resolve);
+    child.on('error', resolve);
+  });
+  console.log(
+    (await have('tmux'))
+      ? '[seshmux] tmux installed — new sessions will survive restarts and crashes.'
+      : '[seshmux] tmux install did not complete; continuing without it.',
+  );
+}
+
 async function main() {
   // Subcommand dispatch (before arg parsing / server flow).
   const argv = process.argv.slice(2);
@@ -143,6 +338,25 @@ async function main() {
 
   const args = parseArgs(argv);
 
+  // --restart-daemon: the manual escape hatch for upgrading the daemon (the update flow does it
+  // automatically, but ONLY when no plain PTY would die — see autoUpgradeDaemon). ensureDaemon()
+  // treats any daemon that answers hello as 'ok' and reuses it (daemon/ensure.js classify()),
+  // which is what keeps your sessions alive across server updates — restarting seshmux does NOT
+  // replace the daemon. This does.
+  //
+  // Destructive on purpose: tmux-tier sessions rehydrate from `tmux ls` and survive, PLAIN-tier
+  // PTYs die with the daemon. The automatic path refuses to run in that case; this flag is the
+  // explicit "do it anyway, I accept losing them".
+  if (args.restartDaemon) {
+    const before = readDaemonPid();
+    if (before) {
+      console.log(`[seshmux] stopping daemon ${before} — tmux-backed sessions survive; any non-tmux PTYs will end`);
+    } else {
+      console.log('[seshmux] no daemon running');
+    }
+    if (!(await restartDaemon())) process.exit(1);
+  }
+
   // If a healthy seshmux already runs on the requested port range, just open the
   // browser to it — no duplicate server, no port fight.
   const reuse = await resolvePort(args.port);
@@ -153,6 +367,11 @@ async function main() {
     return;
   }
 
+  // Ask about tmux BEFORE the daemon starts, so a yes takes effect for the very first session
+  // (session-start.ts picks the tmux tier only if tmux is on PATH at spawn time). Only reached
+  // when we are actually starting seshmux — never when we just hand off to a running instance.
+  await offerTmux().catch(() => {}); // never block startup on this
+
   // Ensure a responsive daemon BEFORE the server comes up. Spawns detached +
   // unref'd if needed; recovers a stale socket. Non-fatal if it can't start —
   // the app degrades to browse-only (no live terminals) rather than refusing.
@@ -226,6 +445,11 @@ async function main() {
   let child = spawnServer();
   if (!args.noOpen) setTimeout(() => openBrowser(url), 1500);
 
+  // Also on plain startup, not just after an update: a previous run may have deferred the upgrade
+  // (sessions were running), or the user updated and quit before it could finish. Without this, a
+  // daemon that was stale once could stay stale forever.
+  scheduleDaemonUpgrade(currentVersion);
+
   // NOTE: shutdown kills the SERVER child only — never the daemon. The daemon is
   // detached and holds live PTYs across this process's death (update-safety).
   let shuttingDown = false;
@@ -245,7 +469,7 @@ async function main() {
   // and printed by the server before it exits.
   const RESTART_CODE = 75;
   let restartTimes = [];
-  const onExit = (code) => {
+  const onExit = async (code) => {
     if (shuttingDown) return;
     if (code === RESTART_CODE) {
       const now = Date.now();
@@ -258,7 +482,11 @@ async function main() {
         );
         process.exit(1);
       }
-      console.log('[seshmux] server restarting for update (session-safe; daemon untouched)…');
+      console.log('[seshmux] server restarting for update (session-safe)…');
+      // One-click means one click: the new package is on disk now, so upgrade the daemon too —
+      // but only if every live PTY is tmux-backed (it re-attaches). If a plain session would die,
+      // this defers and the retry loop finishes the job the moment that session ends.
+      scheduleDaemonUpgrade(currentVersion);
       child = spawnServer();
       child.on('exit', onExit);
       return;