shennian 0.3.85 → 0.3.86

package/dist/src/index.js

@@ -1,3 +1,587 @@
-import{Command as ie}from"commander";import I from"chalk";import ae from"node:os";import _ from"node:fs";import{loadConfig as d,saveConfig as ce,getConfigPath as me,getShennianDir as le,resolveShennianPath as J,normalizeAutoUpgradePolicy as de}from"./config/index.js";import{CliRelayClient as pe}from"./relay/client.js";import{collectKnownLogSecrets as K,installCliLogRedaction as ge,sanitizeCliLogValue as ue}from"./log-redaction.js";import{registerPairCommand as he,runSmartStart as fe}from"./commands/pair.js";import{clearDaemonPidIfOwner as j,createDaemonInstanceId as Se,clearDaemonLauncher as W,findRunningDaemonProcessIds as ve,isRemoteAccessDisabled as Y,prepareRemoteAccessPause as Ie,stopPreparedRemoteAccessService as we,isIsolatedDaemonE2eInstance as ye,registerDaemonCommand as Re,writeDaemonPid as q,writeDaemonLauncher as Q}from"./commands/daemon.js";import{registerRuntimeCommand as Ce}from"./commands/runtime.js";import{registerManagerCommand as ke}from"./commands/manager.js";import{registerUpgradeCommand as Ee}from"./commands/upgrade.js";import{registerToolsCommand as De}from"./commands/tools.js";import{registerIntegrationCommand as Te}from"./commands/integration.js";import{registerRoomCommand as Ae}from"./commands/room.js";import{SessionManager as be}from"./session/manager.js";import{SERVERS as M,regionToUrl as Oe,urlToRegion as Ue}from"./region.js";import{getCurrentVersion as X,handleStartupCrashCheck as Ne}from"./upgrade/engine.js";import{AutoUpgradeScheduler as Pe}from"./upgrade/scheduler.js";import{detectAgents as $e}from"./agents/detect.js";import{augmentProcessPath as Z}from"./env-path.js";Z();const ee=X();import{getCachedAgentInfos as _e,resolveAgentInfos as Me}from"./agents/model-registry.js";import{initCliLogReporter as xe,reportLog as w}from"./log-reporter.js";import{isNativeFusionEnabled as Le}from"./native-fusion/config.js";import{NativeSessionFusionService as Ve}from"./native-fusion/service.js";import{startDaemonLogRetention as Be}from"./daemon-log.js";import{startDaemonIpcServer as Ge}from"./daemon-ipc/server.js";import{resolveManagedRoomIpcPaths as He}from"./daemon-ipc/paths.js";import{RoomSessionRegistry as Fe}from"./room/session-registry.js";import{HttpRoomBindingClient as ze}from"./room/room-binding-client.js";import{TrustedManagedRoomBinder as Je}from"./room/managed-room-binding.js";import{RoomHostSessionObservationStore as Ke}from"./room/host-session-observations.js";import{RoomMirrorSyncService as je}from"./room/mirror-sync-service.js";import{RoomActivationService as We}from"./room/activation-service.js";import{RoomActivationAudit as Ye}from"./room/activation-audit.js";import{RoomAttachmentCache as qe}from"./room/attachment-cache.js";import{RoomAttachmentUploader as Qe}from"./room/attachment-upload.js";import{ManagedRoomContextAuthority as Xe}from"./room/managed-context.js";import{createManagedRoomExecutor as Ze}from"./room/managed-room-ipc.js";import{SESSION_SYNC_PROTOCOL_VERSION as eo,SESSION_SYNC_ADVERTISED_CAPABILITIES as oo}from"@shennian/wire";import{getDaemonInstallationId as no}from"./session/store.js";import{synchronizeMachinePersonalAuthority as to}from"./personal-sync/machine-authority.js";import{CLI_SESSION_SYNC_DATA_EPOCH as ro,ensurePersonalDataEpoch as so}from"./personal-sync/epoch.js";import{DeletionSyncRetryWaitError as io,DeletionSyncTerminalError as ao}from"./session/deletion-sync-state.js";const oe=le(),co=J("daemon.pid");function mo(){try{const o=_.readFileSync(co,"utf-8").trim();if(o.startsWith("{")){const a=JSON.parse(o),m=Number(a.pid);return Number.isInteger(m)&&m>0?m:null}const t=parseInt(o,10);return Number.isInteger(t)&&t>0?t:null}catch{return null}}function lo(o){return o.replace(/^https:\/\//,"wss://").replace(/^http:\/\//,"ws://")}function x(){process.stdout.write(`${JSON.stringify({ok:!1,error:"integration_command_retired",message:"Room MCP and Hooks were retired. Use the Shennian Skill and CLI.",nextAction:{type:"open_install_guide",url:"https://shennian.net/install.md"}})}
-`),process.exitCode=1}function po(o){const t=[`trigger=${o.trigger??"unknown"}`,`phase=${o.phase}`,`code=${o.code??"unknown"}`,`attempt=${o.reconnectAttempt}`];return o.reason&&t.push(`reason=${o.reason}`),o.error&&t.push(`error=${o.error}`),t.join(" ")}async function ne(o,t=5e3){const a=Date.now();for(;Date.now()-a<t;){try{process.kill(o,0)}catch{return!0}await new Promise(m=>setTimeout(m,100))}try{return process.kill(o,0),!1}catch{return!0}}const r=new ie;r.name("shennian").description("Shennian \u2014 AI Agent Control Plane").version(ee),r.enablePositionalOptions(),Te(r),Ae(r),r.option("--api <url>","Server URL override").option("--name <name>","Machine name",ae.hostname()).action(async o=>{const t=d(),a=o.api??process.env.SHENNIAN_DESKTOP_SERVER_URL??t.serverUrl??void 0;await fe(a,o.name)}),r.command("run-service",{hidden:!0}).description("(internal) Connect to relay server, called by the background service").option("--api <url>","Server URL override").action(async o=>{const t=J("env.json");try{const e=JSON.parse(_.readFileSync(t,"utf-8"));for(const[s,n]of Object.entries(e))process.env[s]||(process.env[s]=n);Z()}catch{}ge(K(process.env,d()));const a=Be();Y()&&(console.log(`[${new Date().toISOString()}] remote access disabled, service start skipped`),clearInterval(a),process.exit(0));const m=!!(process.env.INVOCATION_ID||process.env.JOURNAL_STREAM||process.env.SHENNIAN_DESKTOP_SERVER_URL),L=async(e,s)=>{console.log(`[${new Date().toISOString()}] ${s} (PID ${e})`),process.kill(e,"SIGTERM"),await ne(e)||(process.kill(e,"SIGKILL"),await ne(e,2e3))};try{const e=mo();if(e&&e!==process.pid)try{process.kill(e,0),m?await L(e,"managed start taking over from existing daemon"):(console.log(`[${new Date().toISOString()}] daemon already running (PID ${e}), skipping duplicate start`),process.exit(0))}catch{}}catch{}const b=ye(process.env,oe)?[]:ve(process.pid);if(b.length>0)if(m)for(const e of b)try{await L(e,"managed start taking over from orphan daemon")}catch{}else console.log(`[${new Date().toISOString()}] daemon already running (PID ${b[0]}), skipping duplicate start`),process.exit(0);const p=Se();q(process.pid,p,{version:ee}),Q(process.pid,void 0,p),process.on("exit",()=>{j(process.pid,p),W(p)}),await Ne()&&(console.log(`[${new Date().toISOString()}] Rolled back to previous version, restarting...`),process.exit(0));try{so()}catch(e){console.error(`[personal-sync] data epoch initialization failed: ${e instanceof Error?e.message:String(e)}`),process.exitCode=1;return}const c=d(),u=o.api??process.env.SHENNIAN_DESKTOP_SERVER_URL??c.serverUrl??M.cn.url,g=X(),O=$e(),S=O.map(e=>e.type),U=_e(O),y=new Fe,R=new Ke,N=new Xe(y),h=new ze(u),re=new qe({actionClient:h}),se=new Qe({actionClient:h});let P=null;const V=Ze({authority:N,actionClient:h,attachmentCache:re,attachmentUploader:se,observations:R,getMachineCredentials:()=>({machineToken:d().machineToken})}),C=await Ge({paths:He(),handlers:{"managed-room.execute":e=>V(e)}});let B=!1;const k=()=>{B||(B=!0,C.close().finally(()=>process.exit(0)))};if(process.once("SIGINT",k),process.once("SIGTERM",k),!c.machineToken){console.error('Shennian CLI is not paired. Run "shennian pair --browser" or "shennian pair --token" first.'),await C.close(),process.exitCode=1;return}process.removeListener("SIGINT",k),process.removeListener("SIGTERM",k);const G=`${lo(u)}/relay/machine`,$=c.machineToken;if(!$)return;try{await to({serverUrl:u,machineToken:$,machineId:c.machineId})}catch(e){console.error(`[personal-sync] machine authority verification failed: ${e instanceof Error?e.message:String(e)}`),await C.close(),process.exitCode=1;return}c.machineId&&xe(u,c.machineId),console.log(`[${new Date().toISOString()}] Connecting to ${G}... (v${g}) agents: ${S.join(",")}`),w({level:"info",wsEvent:"daemon.start",metadata:{version:g,agents:S}});let E=null,D=null,T=0;const H=de(c.autoUpgrade),l=new pe({serverUrl:G,machineToken:$,cliVersion:g,agentList:S,autoUpgradePolicy:H,sessionSyncProtocolVersion:eo,sessionSyncCapabilities:oo,daemonInstallationId:no(),dataEpoch:ro,onConnected:()=>{console.log(`[${new Date().toISOString()}] \u2713 Connected`),w({level:"info",wsEvent:"daemon.connected"}),U.some(n=>n.models.length>0)&&l.sendEvent({type:"event",event:"machine.agents",payload:{agentList:S,agents:U}}),Me(O,{serverUrl:c.serverUrl??u,authToken:c.machineToken??c.accessToken}).then(n=>{JSON.stringify(n)!==JSON.stringify(U)&&l.sendEvent({type:"event",event:"machine.agents",payload:{agentList:S,agents:n}})}).catch(()=>{}),import("./upgrade/engine.js").then(({readUpgradeAttempt:n,clearUpgradeAttempt:i})=>{const v=n();i(),v&&(console.log(`[${new Date().toISOString()}] [upgrade] Reporting success: ${v.from} \u2192 ${v.to}`),l.sendEvent({type:"event",event:"upgrade",payload:{state:"success",machineId:"self",from:v.from,to:v.to}}))}).catch(()=>{}),A.start(),D?.start();const e=++T,s=async()=>{try{await f.synchronizeSessionDeletions(),e===T&&l.getState()==="connected"&&E?.handleConnected()}catch(n){if(console.error("[session.deletions] startup catch-up failed",n),e===T&&l.getState()==="connected"){if(n instanceof ao)return;const i=n instanceof io?Math.max(1e3,n.retryAfterMs):5e3;setTimeout(()=>{s()},i).unref?.()}}};s()},onDisconnected:e=>{T+=1,D?.stop(),console.log(`[${new Date().toISOString()}] \u26A0 Disconnected, reconnecting... ${po(e)}`),w({level:"warn",wsEvent:"daemon.disconnected",metadata:{code:e.code,reason:e.reason,error:e.error,phase:e.phase,trigger:e.trigger,reconnectAttempt:e.reconnectAttempt}})},onReq:e=>{console.log(`[${new Date().toISOString()}] [req] ${e.method}`),w({level:"info",type:"ws",wsEvent:e.method,wsDirection:"in",traceId:e.traceId}),f.handleReq(e)}});E=Le()?new Ve(l):null,D=new je({registry:y,observations:R,actionClient:h,getMachineCredentials:()=>({machineToken:d().machineToken}),onMessages:async(e,s,n,i)=>{await P?.processMessages(e,s,n,i)}});const A=new Pe({currentVersion:g,machineId:c.machineId??"unknown-machine",serverUrl:c.serverUrl??u,getIdleState:()=>f.getUpgradeIdleState(),startUpgrade:async e=>{const{handleUpgradeStart:s}=await import("./commands/upgrade.js");await s(l,"auto-upgrade",e,{currentVersion:g})}});A.setPolicy(H);const f=new be(l,E,g,A,new Je({registry:y,observations:R,bindingClient:h,getMachineCredentials:()=>{const e=d();return{machineId:e.machineId,machineToken:e.machineToken}},hostProcessIdentity:()=>`daemon:${p}`}),{prepare:()=>Ie(),isDisabled:()=>Y(),shutdownAfterResponse:()=>{setTimeout(()=>{we(),process.kill(process.pid,"SIGTERM")},100).unref?.()}},e=>N.revokeToken(e),V);P=new We({registry:y,observations:R,enqueueConversationBatch:e=>f.enqueueManagedRoomBatch(e),loadContext:async e=>{const s=d().machineToken?.trim(),n=e.binding;if(!s||!n)throw new Error("managed_room_context_unavailable");const i=await h.status({machineToken:s,roomId:n.roomId,bindingId:n.bindingId});return{roomName:i.room.name,memberCount:i.room.memberCount,members:i.room.members,agentsByIdentityId:i.agent?{[i.agentIdentityId]:i.agent}:{},agentSystemPromptsByIdentityId:i.agent?{[i.agentIdentityId]:i.agent.systemPrompt??""}:{}}},issueManagedRoomContext:(e,s)=>{const n=d().machineToken;if(!n)throw new Error("machine_not_authorized");return N.issue({registryKey:e,machineCredential:n,activationCauseMessageId:s})},audit:new Ye}),f.setManagedRoomTurnPreparer(e=>P.prepareConversationTurn(e)),_.mkdirSync(oe,{recursive:!0}),q(process.pid,p,{version:g}),Q(process.pid,void 0,p),l.connect(),process.stdin.resume();let F=!1;const z=async()=>{if(!F){F=!0,console.log(I.gray(`
-Disconnecting...`)),w({level:"info",wsEvent:"daemon.stop"}),clearInterval(a);try{await f.cleanup(),A.stop(),E?.stop(),D?.stop(),l.disconnect(),await C.close(),j(process.pid,p),W(p)}finally{process.exit(0)}}};process.on("SIGINT",()=>{z()}),process.on("SIGTERM",()=>{z()})}),r.command("workbuddy-session-hook",{hidden:!0}).description("(retired) WorkBuddy Room Hook").allowUnknownOption(!0).action(()=>x()),r.command("room-session-hook",{hidden:!0}).description("(internal) Authorize the official Room tool for one trusted Agent Session").argument("<runtime>","Trusted runtime adapter").allowUnknownOption(!0).action(()=>x()),r.command("room-tool-server",{hidden:!0}).description("(internal) Run the official Shennian Room MCP tool").allowUnknownOption(!0).action(()=>x());const te=r.command("config").description("View or modify configuration");te.command("show",{isDefault:!0}).description("Show current configuration").action(()=>{console.log(`Config file: ${me()}`);const o=d(),t=ue(o,K(process.env,o));if(o.serverUrl){const a=Ue(o.serverUrl);console.log(`Region: ${a} (${M[a].label})`)}console.log(JSON.stringify(t,null,2))}),te.command("set").description("Update a config value").argument("<key>",'Config key (e.g. "server")').argument("<value>",'Config value (e.g. "cn" or "global")').action((o,t)=>{const a=d();if(o==="server"){t!=="cn"&&t!=="global"&&(console.error(I.red('\u2717 Value must be "cn" or "global"')),process.exit(1));const m=t;a.serverUrl=Oe(m),ce(a),console.log(I.green(`\u2713 Server set to ${M[m].label}`)),console.log(I.yellow("  Restart the background service for this to take effect: shennian stop && shennian start"));return}console.error(I.red(`\u2717 Unknown config key: ${o}. Supported: server`)),process.exit(1)}),he(r),Re(r),Ce(r),ke(r),Ee(r),De(r),r.parse();
+// @arch docs/architecture/cli/daemon.md
+// @test src/__tests__/agents-e2e.ts
+// @test src/__tests__/daemon-autostart.test.ts
+import { Command } from 'commander';
+import chalk from 'chalk';
+import os from 'node:os';
+import fs from 'node:fs';
+import { loadConfig, saveConfig, getConfigPath, getShennianDir, resolveShennianPath, normalizeAutoUpgradePolicy, } from './config/index.js';
+import { CliRelayClient } from './relay/client.js';
+import { collectKnownLogSecrets, installCliLogRedaction, sanitizeCliLogValue, } from './log-redaction.js';
+import { registerPairCommand, runSmartStart } from './commands/pair.js';
+import { clearDaemonPidIfOwner, createDaemonInstanceId, clearDaemonLauncher, findRunningDaemonProcessIds, isRemoteAccessDisabled, prepareRemoteAccessPause, stopPreparedRemoteAccessService, isIsolatedDaemonE2eInstance, registerDaemonCommand, writeDaemonPid, writeDaemonLauncher, } from './commands/daemon.js';
+import { registerRuntimeCommand } from './commands/runtime.js';
+import { registerManagerCommand } from './commands/manager.js';
+import { registerUpgradeCommand } from './commands/upgrade.js';
+import { registerToolsCommand } from './commands/tools.js';
+import { registerIntegrationCommand } from './commands/integration.js';
+import { registerRoomCommand } from './commands/room.js';
+import { SessionManager } from './session/manager.js';
+import { SERVERS, regionToUrl, urlToRegion } from './region.js';
+import { getCurrentVersion, handleStartupCrashCheck } from './upgrade/engine.js';
+import { AutoUpgradeScheduler } from './upgrade/scheduler.js';
+import { detectAgents } from './agents/detect.js';
+import { augmentProcessPath } from './env-path.js';
+augmentProcessPath();
+const cliVersion = getCurrentVersion();
+import { getCachedAgentInfos, resolveAgentInfos } from './agents/model-registry.js';
+import { initCliLogReporter, reportLog } from './log-reporter.js';
+import { isNativeFusionEnabled } from './native-fusion/config.js';
+import { NativeSessionFusionService } from './native-fusion/service.js';
+import { startDaemonLogRetention } from './daemon-log.js';
+import { startDaemonIpcServer } from './daemon-ipc/server.js';
+import { resolveManagedRoomIpcPaths } from './daemon-ipc/paths.js';
+import { RoomSessionRegistry } from './room/session-registry.js';
+import { HttpRoomBindingClient } from './room/room-binding-client.js';
+import { TrustedManagedRoomBinder } from './room/managed-room-binding.js';
+import { RoomHostSessionObservationStore } from './room/host-session-observations.js';
+import { RoomMirrorSyncService } from './room/mirror-sync-service.js';
+import { RoomActivationService } from './room/activation-service.js';
+import { RoomActivationAudit } from './room/activation-audit.js';
+import { RoomAttachmentCache } from './room/attachment-cache.js';
+import { RoomAttachmentUploader } from './room/attachment-upload.js';
+import { ManagedRoomContextAuthority } from './room/managed-context.js';
+import { createManagedRoomExecutor } from './room/managed-room-ipc.js';
+import { SESSION_SYNC_PROTOCOL_VERSION, SESSION_SYNC_ADVERTISED_CAPABILITIES } from '@shennian/wire';
+import { getDaemonInstallationId } from './session/store.js';
+import { synchronizeMachinePersonalAuthority } from './personal-sync/machine-authority.js';
+import { CLI_SESSION_SYNC_DATA_EPOCH, ensurePersonalDataEpoch } from './personal-sync/epoch.js';
+import { DeletionSyncRetryWaitError, DeletionSyncTerminalError, } from './session/deletion-sync-state.js';
+const SHENNIAN_DIR = getShennianDir();
+const PID_FILE = resolveShennianPath('daemon.pid');
+function readDaemonPidFile() {
+    try {
+        const raw = fs.readFileSync(PID_FILE, 'utf-8').trim();
+        if (raw.startsWith('{')) {
+            const parsed = JSON.parse(raw);
+            const pid = Number(parsed.pid);
+            return Number.isInteger(pid) && pid > 0 ? pid : null;
+        }
+        const pid = parseInt(raw, 10);
+        return Number.isInteger(pid) && pid > 0 ? pid : null;
+    }
+    catch {
+        return null;
+    }
+}
+function httpToWs(url) {
+    return url.replace(/^https:\/\//, 'wss://').replace(/^http:\/\//, 'ws://');
+}
+function writeRetiredIntegrationError() {
+    process.stdout.write(`${JSON.stringify({
+        ok: false,
+        error: 'integration_command_retired',
+        message: 'Room MCP and Hooks were retired. Use the Shennian Skill and CLI.',
+        nextAction: { type: 'open_install_guide', url: 'https://shennian.net/install.md' },
+    })}\n`);
+    process.exitCode = 1;
+}
+function formatDisconnectInfo(info) {
+    const parts = [
+        `trigger=${info.trigger ?? 'unknown'}`,
+        `phase=${info.phase}`,
+        `code=${info.code ?? 'unknown'}`,
+        `attempt=${info.reconnectAttempt}`,
+    ];
+    if (info.reason)
+        parts.push(`reason=${info.reason}`);
+    if (info.error)
+        parts.push(`error=${info.error}`);
+    return parts.join(' ');
+}
+async function waitForPidExit(pid, timeoutMs = 5000) {
+    const startedAt = Date.now();
+    while (Date.now() - startedAt < timeoutMs) {
+        try {
+            process.kill(pid, 0);
+        }
+        catch {
+            return true;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 100));
+    }
+    try {
+        process.kill(pid, 0);
+        return false;
+    }
+    catch {
+        return true;
+    }
+}
+const program = new Command();
+program.name('shennian').description('Shennian — AI Agent Control Plane').version(cliVersion);
+// Keep options written after a subcommand scoped to that subcommand. In particular,
+// `room create --name` must not be consumed by the legacy root machine-name option.
+program.enablePositionalOptions();
+registerIntegrationCommand(program);
+registerRoomCommand(program);
+program
+    .option('--api <url>', 'Server URL override')
+    .option('--name <name>', 'Machine name', os.hostname())
+    .action(async (opts) => {
+    const config = loadConfig();
+    const serverUrl = opts.api ?? process.env.SHENNIAN_DESKTOP_SERVER_URL ?? config.serverUrl ?? undefined;
+    await runSmartStart(serverUrl, opts.name);
+});
+// run-service: internal command used by the background service process
+program
+    .command('run-service', { hidden: true })
+    .description('(internal) Connect to relay server, called by the background service')
+    .option('--api <url>', 'Server URL override')
+    .action(async (opts) => {
+    const envFile = resolveShennianPath('env.json');
+    try {
+        const saved = JSON.parse(fs.readFileSync(envFile, 'utf-8'));
+        for (const [k, v] of Object.entries(saved)) {
+            if (!process.env[k])
+                process.env[k] = v;
+        }
+        augmentProcessPath();
+    }
+    catch {
+        // env.json may not exist yet
+    }
+    installCliLogRedaction(collectKnownLogSecrets(process.env, loadConfig()));
+    const logRetentionTimer = startDaemonLogRetention();
+    if (isRemoteAccessDisabled()) {
+        console.log(`[${new Date().toISOString()}] remote access disabled, service start skipped`);
+        clearInterval(logRetentionTimer);
+        process.exit(0);
+    }
+    // Single-instance guard. Service-manager starts are authoritative and may
+    // need to take over from an older detached process after app/daemon upgrades.
+    const serviceManagedStart = Boolean(process.env.INVOCATION_ID ||
+        process.env.JOURNAL_STREAM ||
+        process.env.SHENNIAN_DESKTOP_SERVER_URL);
+    const stopExistingDaemon = async (oldPid, reason) => {
+        console.log(`[${new Date().toISOString()}] ${reason} (PID ${oldPid})`);
+        process.kill(oldPid, 'SIGTERM');
+        const stopped = await waitForPidExit(oldPid);
+        if (!stopped) {
+            process.kill(oldPid, 'SIGKILL');
+            await waitForPidExit(oldPid, 2000);
+        }
+    };
+    try {
+        const oldPid = readDaemonPidFile();
+        if (oldPid && oldPid !== process.pid) {
+            try {
+                process.kill(oldPid, 0);
+                if (serviceManagedStart) {
+                    await stopExistingDaemon(oldPid, 'managed start taking over from existing daemon');
+                }
+                else {
+                    console.log(`[${new Date().toISOString()}] daemon already running (PID ${oldPid}), skipping duplicate start`);
+                    process.exit(0);
+                }
+            }
+            catch {
+                // Stale pid; continue booting and overwrite it below.
+            }
+        }
+    }
+    catch {
+        /* noop */
+    }
+    const orphanPids = isIsolatedDaemonE2eInstance(process.env, SHENNIAN_DIR)
+        ? []
+        : findRunningDaemonProcessIds(process.pid);
+    if (orphanPids.length > 0) {
+        if (serviceManagedStart) {
+            for (const orphanPid of orphanPids) {
+                try {
+                    await stopExistingDaemon(orphanPid, 'managed start taking over from orphan daemon');
+                }
+                catch {
+                    // Keep booting; the normal pid-file guard below still protects the managed daemon.
+                }
+            }
+        }
+        else {
+            console.log(`[${new Date().toISOString()}] daemon already running (PID ${orphanPids[0]}), skipping duplicate start`);
+            process.exit(0);
+        }
+    }
+    const daemonInstanceId = createDaemonInstanceId();
+    writeDaemonPid(process.pid, daemonInstanceId, { version: cliVersion });
+    writeDaemonLauncher(process.pid, undefined, daemonInstanceId);
+    process.on('exit', () => {
+        clearDaemonPidIfOwner(process.pid, daemonInstanceId);
+        clearDaemonLauncher(daemonInstanceId);
+    });
+    // Crash detection: if we're recovering from a failed upgrade, rollback and exit
+    const didRollback = await handleStartupCrashCheck();
+    if (didRollback) {
+        console.log(`[${new Date().toISOString()}] Rolled back to previous version, restarting...`);
+        process.exit(0);
+    }
+    // No personal producer may open its store until the machine generation is
+    // fully migrated and its crash-safe marker is committed.
+    try {
+        ensurePersonalDataEpoch();
+    }
+    catch (error) {
+        console.error(`[personal-sync] data epoch initialization failed: ${error instanceof Error ? error.message : String(error)}`);
+        process.exitCode = 1;
+        return;
+    }
+    const config = loadConfig();
+    const serverUrl = opts.api ?? process.env.SHENNIAN_DESKTOP_SERVER_URL ?? config.serverUrl ?? SERVERS.cn.url;
+    const currentCliVersion = getCurrentVersion();
+    const detectedAgents = detectAgents();
+    const agentList = detectedAgents.map((a) => a.type);
+    const cachedAgentInfos = getCachedAgentInfos(detectedAgents);
+    const roomSessionRegistry = new RoomSessionRegistry();
+    const roomHostSessionObservations = new RoomHostSessionObservationStore();
+    const managedRoomContexts = new ManagedRoomContextAuthority(roomSessionRegistry);
+    const roomBindingClient = new HttpRoomBindingClient(serverUrl);
+    const roomAttachmentCache = new RoomAttachmentCache({ actionClient: roomBindingClient });
+    const roomAttachmentUploader = new RoomAttachmentUploader({ actionClient: roomBindingClient });
+    let roomActivationService = null;
+    const managedRoomExecutor = createManagedRoomExecutor({
+        authority: managedRoomContexts,
+        actionClient: roomBindingClient,
+        attachmentCache: roomAttachmentCache,
+        attachmentUploader: roomAttachmentUploader,
+        observations: roomHostSessionObservations,
+        getMachineCredentials: () => ({ machineToken: loadConfig().machineToken }),
+    });
+    const daemonIpc = await startDaemonIpcServer({
+        paths: resolveManagedRoomIpcPaths(),
+        handlers: {
+            'managed-room.execute': (params) => managedRoomExecutor(params),
+        },
+    });
+    let stoppingBeforeRelay = false;
+    const stopBeforeRelay = () => {
+        if (stoppingBeforeRelay)
+            return;
+        stoppingBeforeRelay = true;
+        void daemonIpc.close().finally(() => process.exit(0));
+    };
+    process.once('SIGINT', stopBeforeRelay);
+    process.once('SIGTERM', stopBeforeRelay);
+    if (!config.machineToken) {
+        console.error('Shennian CLI is not paired. Run "shennian pair --browser" or "shennian pair --token" first.');
+        await daemonIpc.close();
+        process.exitCode = 1;
+        return;
+    }
+    process.removeListener('SIGINT', stopBeforeRelay);
+    process.removeListener('SIGTERM', stopBeforeRelay);
+    const wsBase = httpToWs(serverUrl);
+    const wsUrl = `${wsBase}/relay/machine`;
+    const machineToken = config.machineToken;
+    if (!machineToken)
+        return;
+    try {
+        await synchronizeMachinePersonalAuthority({
+            serverUrl,
+            machineToken,
+            machineId: config.machineId,
+        });
+    }
+    catch (error) {
+        console.error(`[personal-sync] machine authority verification failed: ${error instanceof Error ? error.message : String(error)}`);
+        await daemonIpc.close();
+        process.exitCode = 1;
+        return;
+    }
+    if (config.machineId) {
+        initCliLogReporter(serverUrl, config.machineId);
+    }
+    console.log(`[${new Date().toISOString()}] Connecting to ${wsUrl}... (v${currentCliVersion}) agents: ${agentList.join(',')}`);
+    reportLog({
+        level: 'info',
+        wsEvent: 'daemon.start',
+        metadata: { version: currentCliVersion, agents: agentList },
+    });
+    let nativeFusion = null;
+    let roomMirrorSync = null;
+    let deletionCatchupGeneration = 0;
+    const autoUpgradePolicy = normalizeAutoUpgradePolicy(config.autoUpgrade);
+    const client = new CliRelayClient({
+        serverUrl: wsUrl,
+        machineToken,
+        cliVersion: currentCliVersion,
+        agentList,
+        autoUpgradePolicy,
+        sessionSyncProtocolVersion: SESSION_SYNC_PROTOCOL_VERSION,
+        sessionSyncCapabilities: SESSION_SYNC_ADVERTISED_CAPABILITIES,
+        daemonInstallationId: getDaemonInstallationId(),
+        dataEpoch: CLI_SESSION_SYNC_DATA_EPOCH,
+        onConnected: () => {
+            console.log(`[${new Date().toISOString()}] ✓ Connected`);
+            reportLog({ level: 'info', wsEvent: 'daemon.connected' });
+            if (cachedAgentInfos.some((agent) => agent.models.length > 0)) {
+                client.sendEvent({
+                    type: 'event',
+                    event: 'machine.agents',
+                    payload: {
+                        agentList,
+                        agents: cachedAgentInfos,
+                    },
+                });
+            }
+            void resolveAgentInfos(detectedAgents, {
+                serverUrl: config.serverUrl ?? serverUrl,
+                authToken: config.machineToken ?? config.accessToken,
+            })
+                .then((agents) => {
+                if (JSON.stringify(agents) === JSON.stringify(cachedAgentInfos))
+                    return;
+                client.sendEvent({
+                    type: 'event',
+                    event: 'machine.agents',
+                    payload: {
+                        agentList,
+                        agents,
+                    },
+                });
+            })
+                .catch(() => { });
+            import('./upgrade/engine.js')
+                .then(({ readUpgradeAttempt, clearUpgradeAttempt }) => {
+                const attempt = readUpgradeAttempt();
+                clearUpgradeAttempt();
+                if (attempt) {
+                    console.log(`[${new Date().toISOString()}] [upgrade] Reporting success: ${attempt.from} → ${attempt.to}`);
+                    client.sendEvent({
+                        type: 'event',
+                        event: 'upgrade',
+                        payload: {
+                            state: 'success',
+                            machineId: 'self',
+                            from: attempt.from,
+                            to: attempt.to,
+                        },
+                    });
+                }
+            })
+                .catch(() => { });
+            upgradeScheduler.start();
+            roomMirrorSync?.start();
+            const catchupGeneration = ++deletionCatchupGeneration;
+            const catchUpBeforeDiscovery = async () => {
+                try {
+                    await sessionManager.synchronizeSessionDeletions();
+                    if (catchupGeneration === deletionCatchupGeneration &&
+                        client.getState() === 'connected') {
+                        nativeFusion?.handleConnected();
+                    }
+                }
+                catch (error) {
+                    // Discovery and dirty-index publication deliberately stay stopped:
+                    // scanning before deletion catch-up can resurrect local history.
+                    console.error('[session.deletions] startup catch-up failed', error);
+                    if (catchupGeneration === deletionCatchupGeneration &&
+                        client.getState() === 'connected') {
+                        if (error instanceof DeletionSyncTerminalError)
+                            return;
+                        const delay = error instanceof DeletionSyncRetryWaitError
+                            ? Math.max(1_000, error.retryAfterMs)
+                            : 5_000;
+                        setTimeout(() => void catchUpBeforeDiscovery(), delay).unref?.();
+                    }
+                }
+            };
+            void catchUpBeforeDiscovery();
+        },
+        onDisconnected: (info) => {
+            deletionCatchupGeneration += 1;
+            roomMirrorSync?.stop();
+            console.log(`[${new Date().toISOString()}] ⚠ Disconnected, reconnecting... ${formatDisconnectInfo(info)}`);
+            reportLog({
+                level: 'warn',
+                wsEvent: 'daemon.disconnected',
+                metadata: {
+                    code: info.code,
+                    reason: info.reason,
+                    error: info.error,
+                    phase: info.phase,
+                    trigger: info.trigger,
+                    reconnectAttempt: info.reconnectAttempt,
+                },
+            });
+        },
+        onReq: (req) => {
+            console.log(`[${new Date().toISOString()}] [req] ${req.method}`);
+            reportLog({
+                level: 'info',
+                type: 'ws',
+                wsEvent: req.method,
+                wsDirection: 'in',
+                traceId: req.traceId,
+            });
+            void sessionManager.handleReq(req);
+        },
+    });
+    nativeFusion = isNativeFusionEnabled() ? new NativeSessionFusionService(client) : null;
+    roomMirrorSync = new RoomMirrorSyncService({
+        registry: roomSessionRegistry,
+        observations: roomHostSessionObservations,
+        actionClient: roomBindingClient,
+        getMachineCredentials: () => ({ machineToken: loadConfig().machineToken }),
+        onMessages: async (roomId, messages, registrations, context) => {
+            await roomActivationService?.processMessages(roomId, messages, registrations, context);
+        },
+    });
+    const upgradeScheduler = new AutoUpgradeScheduler({
+        currentVersion: currentCliVersion,
+        machineId: config.machineId ?? 'unknown-machine',
+        serverUrl: config.serverUrl ?? serverUrl,
+        getIdleState: () => sessionManager.getUpgradeIdleState(),
+        startUpgrade: async (targetVersion) => {
+            const { handleUpgradeStart } = await import('./commands/upgrade.js');
+            await handleUpgradeStart(client, 'auto-upgrade', targetVersion, {
+                currentVersion: currentCliVersion,
+            });
+        },
+    });
+    upgradeScheduler.setPolicy(autoUpgradePolicy);
+    const sessionManager = new SessionManager(client, nativeFusion, currentCliVersion, upgradeScheduler, new TrustedManagedRoomBinder({
+        registry: roomSessionRegistry,
+        observations: roomHostSessionObservations,
+        bindingClient: roomBindingClient,
+        getMachineCredentials: () => {
+            const current = loadConfig();
+            return { machineId: current.machineId, machineToken: current.machineToken };
+        },
+        hostProcessIdentity: () => `daemon:${daemonInstanceId}`,
+    }), {
+        prepare: () => prepareRemoteAccessPause(),
+        isDisabled: () => isRemoteAccessDisabled(),
+        shutdownAfterResponse: () => {
+            setTimeout(() => {
+                stopPreparedRemoteAccessService();
+                process.kill(process.pid, 'SIGTERM');
+            }, 100).unref?.();
+        },
+    }, (token) => managedRoomContexts.revokeToken(token), managedRoomExecutor);
+    roomActivationService = new RoomActivationService({
+        registry: roomSessionRegistry,
+        observations: roomHostSessionObservations,
+        enqueueConversationBatch: (inputs) => sessionManager.enqueueManagedRoomBatch(inputs),
+        loadContext: async (registration) => {
+            const machineToken = loadConfig().machineToken?.trim();
+            const binding = registration.binding;
+            if (!machineToken || !binding)
+                throw new Error('managed_room_context_unavailable');
+            const remote = await roomBindingClient.status({
+                machineToken,
+                roomId: binding.roomId,
+                bindingId: binding.bindingId,
+            });
+            return {
+                roomName: remote.room.name,
+                memberCount: remote.room.memberCount,
+                members: remote.room.members,
+                agentsByIdentityId: remote.agent ? { [remote.agentIdentityId]: remote.agent } : {},
+                agentSystemPromptsByIdentityId: remote.agent
+                    ? { [remote.agentIdentityId]: remote.agent.systemPrompt ?? '' }
+                    : {},
+            };
+        },
+        issueManagedRoomContext: (registryKey, activationCauseMessageId) => {
+            const machineToken = loadConfig().machineToken;
+            if (!machineToken)
+                throw new Error('machine_not_authorized');
+            return managedRoomContexts.issue({
+                registryKey,
+                machineCredential: machineToken,
+                activationCauseMessageId,
+            });
+        },
+        audit: new RoomActivationAudit(),
+    });
+    sessionManager.setManagedRoomTurnPreparer((contexts) => roomActivationService.prepareConversationTurn(contexts));
+    fs.mkdirSync(SHENNIAN_DIR, { recursive: true });
+    writeDaemonPid(process.pid, daemonInstanceId, { version: currentCliVersion });
+    writeDaemonLauncher(process.pid, undefined, daemonInstanceId);
+    client.connect();
+    process.stdin.resume();
+    let shuttingDown = false;
+    const shutdown = async () => {
+        if (shuttingDown)
+            return;
+        shuttingDown = true;
+        console.log(chalk.gray('\nDisconnecting...'));
+        reportLog({ level: 'info', wsEvent: 'daemon.stop' });
+        clearInterval(logRetentionTimer);
+        try {
+            await sessionManager.cleanup();
+            upgradeScheduler.stop();
+            nativeFusion?.stop();
+            roomMirrorSync?.stop();
+            client.disconnect();
+            await daemonIpc.close();
+            clearDaemonPidIfOwner(process.pid, daemonInstanceId);
+            clearDaemonLauncher(daemonInstanceId);
+        }
+        finally {
+            process.exit(0);
+        }
+    };
+    process.on('SIGINT', () => void shutdown());
+    process.on('SIGTERM', () => void shutdown());
+});
+program
+    .command('workbuddy-session-hook', { hidden: true })
+    .description('(retired) WorkBuddy Room Hook')
+    .allowUnknownOption(true)
+    .action(() => writeRetiredIntegrationError());
+program
+    .command('room-session-hook', { hidden: true })
+    .description('(internal) Authorize the official Room tool for one trusted Agent Session')
+    .argument('<runtime>', 'Trusted runtime adapter')
+    .allowUnknownOption(true)
+    .action(() => writeRetiredIntegrationError());
+program
+    .command('room-tool-server', { hidden: true })
+    .description('(internal) Run the official Shennian Room MCP tool')
+    .allowUnknownOption(true)
+    .action(() => writeRetiredIntegrationError());
+// config: view and modify settings
+const configCmd = program.command('config').description('View or modify configuration');
+configCmd
+    .command('show', { isDefault: true })
+    .description('Show current configuration')
+    .action(() => {
+    console.log(`Config file: ${getConfigPath()}`);
+    const config = loadConfig();
+    const display = sanitizeCliLogValue(config, collectKnownLogSecrets(process.env, config));
+    if (config.serverUrl) {
+        const region = urlToRegion(config.serverUrl);
+        console.log(`Region: ${region} (${SERVERS[region].label})`);
+    }
+    console.log(JSON.stringify(display, null, 2));
+});
+configCmd
+    .command('set')
+    .description('Update a config value')
+    .argument('<key>', 'Config key (e.g. "server")')
+    .argument('<value>', 'Config value (e.g. "cn" or "global")')
+    .action((key, value) => {
+    const config = loadConfig();
+    if (key === 'server') {
+        if (value !== 'cn' && value !== 'global') {
+            console.error(chalk.red('✗ Value must be "cn" or "global"'));
+            process.exit(1);
+        }
+        const region = value;
+        config.serverUrl = regionToUrl(region);
+        saveConfig(config);
+        console.log(chalk.green(`✓ Server set to ${SERVERS[region].label}`));
+        console.log(chalk.yellow('  Restart the background service for this to take effect: shennian stop && shennian start'));
+        return;
+    }
+    console.error(chalk.red(`✗ Unknown config key: ${key}. Supported: server`));
+    process.exit(1);
+});
+registerPairCommand(program);
+registerDaemonCommand(program);
+registerRuntimeCommand(program);
+registerManagerCommand(program);
+registerUpgradeCommand(program);
+registerToolsCommand(program);
+program.parse();