skydive-cli 0.5.0-beta.2 → 0.5.0-beta.21

package/dist/js/{client-Dd5sMXPv.mjs → client-DbqRBquD.mjs}

@@ -1,11 +1,15 @@
 #!/usr/bin/env node
-import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
+import { a as mintPortalDeviceToken, c as unifyLegacyCliGrants, i as grantPortalAccess, n as fetchPortalDevices, r as findThisDevice } from "./api-DG5W6iwx.mjs";
 import os from "node:os";
 import { z } from "zod";
-import { execFile, spawn } from "node:child_process";
-import { WebSocket } from "ws";
+import * as childProcess from "node:child_process";
+import { spawn } from "node:child_process";
+import net from "node:net";
+import { WebSocket, createWebSocketStream } from "ws";
 
 //#region ../portal-daemon/src/machine.ts
+const SCUTIL_TIMEOUT_MS = 2e3;
+const SCUTIL_ATTEMPTS = 3;
 /**
 * Identity this machine registers under on the portal.
 *
@@ -14,38 +18,74 @@ import { WebSocket } from "ws";
 * row, so a grant applies to the machine no matter which surface the user
 * shared from. The name must therefore match what the desktop app registers —
 * on macOS that is `scutil --get LocalHostName` (the Rust client's own
-* derivation, stabler than the network-assigned hostname), with the plain
-* hostname as the fallback for other platforms or a failed read.
+* derivation, stabler than the network-assigned hostname).
+*
+* The machine name is a durable IDENTITY, not a fresh network reading: every
+* grant hangs off the device row keyed by this name, so if it changes the
+* device flips to a brand-new row with ZERO grants and every agent re-prompts
+* across every open CLI. `os.hostname()` is NOT durable — macOS rewrites it
+* from DHCP/DNS per network — so it must never be allowed to silently replace
+* a name we already registered under. Resolution order:
+*
+*   1. `scutil --get LocalHostName` (retried) — the stable, correct source.
+*   2. `previous` — the name we last successfully registered under, persisted
+*      by the daemon. Preferred over the volatile hostname so a transient
+*      `scutil` failure keeps our existing identity (and grants) intact.
+*   3. `os.hostname()` — last resort for a machine that has NEVER resolved a
+*      name (first run, non-macOS, scutil permanently unavailable).
 *
 * Historically the CLI suffixed `-cli` to keep a device distinct from the
 * desktop's; `unifyLegacyCliGrants` migrates grants off those rows.
 */
-async function resolveMachineIdentity() {
-	const fallback = fallbackHost();
-	if (process.platform !== "darwin") return {
-		machineName: fallback,
-		friendlyName: fallback
+async function resolveMachineIdentity(previous) {
+	const persisted = previous?.trim() || null;
+	if (process.platform !== "darwin") {
+		const machineName = persisted ?? fallbackHost();
+		return {
+			machineName,
+			friendlyName: machineName,
+			machineNameSource: persisted ? "persisted" : "hostname-fallback"
+		};
+	}
+	const local = await scutilRead("LocalHostName");
+	if (local) return {
+		machineName: local,
+		friendlyName: await scutilRead("ComputerName") ?? local,
+		machineNameSource: "scutil"
+	};
+	if (persisted) return {
+		machineName: persisted,
+		friendlyName: persisted,
+		machineNameSource: "persisted"
 	};
-	const local = await scutilRead("LocalHostName") ?? fallback;
+	const fallback = fallbackHost();
 	return {
-		machineName: local,
-		friendlyName: await scutilRead("ComputerName") ?? local
+		machineName: fallback,
+		friendlyName: fallback,
+		machineNameSource: "hostname-fallback"
 	};
 }
 function fallbackHost() {
 	return (os.hostname() || "machine").trim().replace(/\.local$/i, "") || "machine";
 }
 function scutilRead(key) {
-	return new Promise((resolve) => {
-		execFile("/usr/sbin/scutil", ["--get", key], { timeout: 2e3 }, (error, stdout) => {
-			if (error) {
-				resolve(null);
-				return;
-			}
-			const value = stdout.trim();
-			resolve(value.length > 0 ? value : null);
+	return attempt(0);
+	function attempt(n) {
+		return new Promise((resolve) => {
+			childProcess.execFile("/usr/sbin/scutil", ["--get", key], { timeout: SCUTIL_TIMEOUT_MS }, (error, stdout) => {
+				if (error) {
+					if (n + 1 < SCUTIL_ATTEMPTS) {
+						resolve(attempt(n + 1));
+						return;
+					}
+					resolve(null);
+					return;
+				}
+				const value = stdout.trim();
+				resolve(value.length > 0 ? value : null);
+			});
 		});
-	});
+	}
 }
 const INHERITED_ENV = [
 	"HOME",
@@ -134,6 +174,18 @@ const ctrlMessageSchema = z.discriminatedUnion("t", [
 		conversationId: z.string().nullable().optional()
 	}),
 	z.object({ t: z.literal("stdin_eof") }),
+	z.object({
+		t: z.literal("reverse_listen"),
+		listenPort: z.number().int().positive(),
+		targetPort: z.number().int().positive(),
+		dialOrigin: z.string().min(1),
+		token: z.string().min(1)
+	}),
+	z.object({ t: z.literal("reverse_listening") }),
+	z.object({
+		t: z.literal("reverse_token"),
+		token: z.string().min(1)
+	}),
 	z.object({ t: z.literal("pause") }),
 	z.object({ t: z.literal("resume") }),
 	z.object({ t: z.literal("cancel") }),
@@ -169,6 +221,62 @@ function decodeFrame(frame) {
 	};
 }
 
+//#endregion
+//#region ../portal-daemon/src/reverse-listener.ts
+/**
+* The desktop half of an agent-initiated expose tunnel (`platform portal
+* expose`): listen on the local loopback and pipe each accepted TCP
+* connection to the agent sandbox's daemon (`/portal/tcp`) through the
+* agent-webserver edge Worker — the same per-connection dial-and-pipe as the
+* user-initiated `skydive portal forward`, just started from a directive
+* instead of a terminal. Tunnel bytes never touch the directive stream that
+* created this listener; it only anchors the lifetime and carries the token.
+*
+* `target()` is read per connection so a token refresh (or any future
+* retarget) applies to the next dial without touching established pipes.
+*/
+var ReverseListener = class {
+	server = null;
+	conns = /* @__PURE__ */ new Set();
+	constructor(opts) {
+		this.opts = opts;
+	}
+	start() {
+		const server = net.createServer((sock) => {
+			this.conns.add(sock);
+			sock.once("close", () => this.conns.delete(sock));
+			sock.pause();
+			const { dialOrigin, targetPort, token } = this.opts.target();
+			const ws = new WebSocket(`${dialOrigin.replace(/^http/, "ws")}/portal/tcp?port=${targetPort}`, { headers: { authorization: `Bearer ${token}` } });
+			ws.on("open", () => {
+				const stream = createWebSocketStream(ws);
+				stream.on("error", () => sock.destroy());
+				sock.on("error", () => stream.destroy());
+				sock.pipe(stream).pipe(sock);
+				sock.resume();
+			});
+			ws.on("error", (err) => {
+				this.opts.log(`expose: tunnel connect failed: ${err.message}`);
+				sock.destroy();
+			});
+			ws.on("unexpected-response", (_req, res) => {
+				this.opts.log(`expose: tunnel rejected (HTTP ${res.statusCode ?? "?"})`);
+				res.destroy();
+				sock.destroy();
+			});
+		});
+		server.once("error", (err) => this.opts.onListening(err));
+		server.listen(this.opts.listenPort, "127.0.0.1", () => this.opts.onListening(null));
+		this.server = server;
+	}
+	stop() {
+		this.server?.close();
+		this.server = null;
+		for (const sock of this.conns) sock.destroy();
+		this.conns.clear();
+	}
+};
+
 //#endregion
 //#region ../portal-daemon/src/exec.ts
 /**
@@ -181,6 +289,7 @@ function decodeFrame(frame) {
 */
 var JobManager = class {
 	jobs = /* @__PURE__ */ new Map();
+	reverse = /* @__PURE__ */ new Map();
 	constructor(opts) {
 		this.opts = opts;
 	}
@@ -200,12 +309,35 @@ var JobManager = class {
 			job.child.kill("SIGKILL");
 		}
 		this.jobs.clear();
+		for (const rev of this.reverse.values()) {
+			rev.settled = true;
+			rev.listener.stop();
+		}
+		this.reverse.clear();
 	}
 	handleCtrl(id, msg) {
 		switch (msg.t) {
 			case "open":
 				this.startJob(id, msg.argv, msg.env, msg.conversationId ?? null);
 				return;
+			case "reverse_listen":
+				this.startReverse(id, {
+					listenPort: msg.listenPort,
+					target: {
+						dialOrigin: msg.dialOrigin,
+						targetPort: msg.targetPort,
+						token: msg.token
+					}
+				});
+				return;
+			case "reverse_token": {
+				const rev = this.reverse.get(id);
+				if (rev) rev.target = {
+					...rev.target,
+					token: msg.token
+				};
+				return;
+			}
 			case "stdin_eof":
 				this.jobs.get(id)?.child.stdin.end();
 				return;
@@ -217,12 +349,51 @@ var JobManager = class {
 				return;
 			case "cancel":
 				this.jobs.get(id)?.child.kill("SIGKILL");
+				this.stopReverse(id);
 				return;
 			case "close":
-			case "error": return;
+			case "error":
+			case "reverse_listening": return;
 			default: return msg;
 		}
 	}
+	startReverse(id, { listenPort, target }) {
+		const rev = {
+			settled: false,
+			target,
+			seq: 0,
+			listener: new ReverseListener({
+				listenPort,
+				target: () => rev.target,
+				log: (msg) => {
+					if (rev.settled) return;
+					this.opts.send(encodeData(id, STREAM.stderr, rev.seq, Buffer.from(msg)));
+					rev.seq = rev.seq + 1 >>> 0;
+				},
+				onListening: (err) => {
+					if (err) {
+						rev.settled = true;
+						this.reverse.delete(id);
+						this.opts.send(encodeCtrl(id, {
+							t: "error",
+							message: `reverse listen failed: ${err.message}`
+						}));
+						return;
+					}
+					this.opts.send(encodeCtrl(id, { t: "reverse_listening" }));
+				}
+			})
+		};
+		this.reverse.set(id, rev);
+		rev.listener.start();
+	}
+	stopReverse(id) {
+		const rev = this.reverse.get(id);
+		if (!rev) return;
+		rev.settled = true;
+		this.reverse.delete(id);
+		rev.listener.stop();
+	}
 	setPaused(id, paused) {
 		const job = this.jobs.get(id);
 		if (!job) return;
@@ -296,111 +467,6 @@ var JobManager = class {
 	}
 };
 
-//#endregion
-//#region ../portal-daemon/src/api.ts
-/**
-* The portal's session-authed REST surface, shared by `PortalClient` (the
-* TUI/`portal open` connection) and the `skydive portal` management
-* commands, so the endpoint contracts and response schemas live in exactly
-* one place.
-*/
-const deviceSchema = z.object({
-	id: z.string(),
-	machineName: z.string(),
-	friendlyName: z.string(),
-	connected: z.boolean(),
-	lastSeen: z.string().nullable(),
-	grantedAgentIds: z.array(z.string())
-});
-const devicesResponseSchema = z.object({
-	devices: z.array(deviceSchema),
-	agents: z.array(z.object({
-		id: z.string(),
-		name: z.string()
-	}))
-});
-const deviceTokenSchema = z.object({ token: z.string().min(1) });
-async function portalFetch(auth, path, init) {
-	const res = await fetch(`${auth.appUrl}${path}`, {
-		method: init.method,
-		headers: {
-			authorization: `Bearer ${auth.sessionToken}`,
-			accept: "application/json",
-			...init.body ? { "content-type": "application/json" } : {}
-		},
-		...init.body ? { body: init.body } : {}
-	});
-	if (!res.ok) {
-		const body = await res.text().catch(() => "");
-		throw new HttpError(res.status, body);
-	}
-	return res.json();
-}
-async function fetchPortalDevices(auth) {
-	const json = await portalFetch(auth, "/api/v1/portal/devices", { method: "GET" });
-	return devicesResponseSchema.parse(json);
-}
-const registerResponseSchema = z.object({ device: z.object({ id: z.string() }) });
-/**
-* Register this machine's device row without connecting. Connecting registers
-* as a side effect; this covers granting an agent on a machine that has never
-* shared yet (the grant references the device row).
-*/
-async function registerPortalDevice(auth, { machineName, friendlyName }) {
-	const json = await portalFetch(auth, "/api/v1/portal/devices", {
-		method: "POST",
-		body: JSON.stringify({
-			machineName,
-			friendlyName
-		})
-	});
-	return registerResponseSchema.parse(json).device;
-}
-/** Short-lived token the machine presents when dialing the portal WebSocket. */
-async function mintPortalDeviceToken(auth) {
-	const json = await portalFetch(auth, "/api/v1/portal/device-token", { method: "POST" });
-	return deviceTokenSchema.parse(json).token;
-}
-async function grantPortalAccess(auth, { deviceId, agentId }) {
-	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants`, {
-		method: "POST",
-		body: JSON.stringify({ agentId })
-	});
-}
-async function revokePortalAccess(auth, { deviceId, agentId }) {
-	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants/${encodeURIComponent(agentId)}`, { method: "DELETE" });
-}
-/**
-* The device row for a given machine identity. Matching is by `machineName`
-* equality — the stable handle the machine registers under, not the display
-* label.
-*/
-function findThisDevice(devices, machineName) {
-	return devices.find((device) => device.machineName === machineName) ?? null;
-}
-/**
-* One-time grant migration onto the merged device. Earlier CLI builds
-* registered a separate `<machineName>-cli` device, so a user's existing
-* approvals hang off that row; the merged device would start with zero grants
-* and every already-authorized agent would ask again. Copy any grant the
-* merged device is missing (the grant endpoint upserts, so re-runs are
-* no-ops). The legacy row is left in place — an old CLI build may still
-* connect under it. Returns how many grants were copied.
-*/
-async function unifyLegacyCliGrants(auth, machineName) {
-	const { devices } = await fetchPortalDevices(auth);
-	const merged = findThisDevice(devices, machineName);
-	const legacy = findThisDevice(devices, `${machineName}-cli`);
-	if (!merged || !legacy) return 0;
-	const have = new Set(merged.grantedAgentIds);
-	const missing = legacy.grantedAgentIds.filter((id) => !have.has(id));
-	for (const agentId of missing) await grantPortalAccess(auth, {
-		deviceId: merged.id,
-		agentId
-	});
-	return missing.length;
-}
-
 //#endregion
 //#region ../portal-daemon/src/client.ts
 const INITIAL_BACKOFF_MS = 500;
@@ -469,13 +535,19 @@ var PortalClient = class {
 		this.ws?.close();
 		this.ws = null;
 	}
-	/** Grant one agent access to this machine (default-deny; user-initiated). */
-	async grantAgent(agentId) {
+	/**
+	* Grant one agent access to this machine (default-deny; user-initiated).
+	* `conversationId` is the conversation whose run asked (null when the grant
+	* is not answering an in-chat request) — the server uses it to wake the
+	* waiting agent.
+	*/
+	async grantAgent(agentId, conversationId) {
 		const auth = this.sessionAuth();
 		if (!auth) throw new Error("granting needs a signed-in CLI session on this machine (the desktop connection alone cannot manage grants)");
 		await grantPortalAccess(auth, {
 			deviceId: await this.ensureDeviceId(),
-			agentId
+			agentId,
+			conversationId
 		});
 		this.granted.add(agentId);
 		this.emit();
@@ -517,9 +589,10 @@ var PortalClient = class {
 	}
 	async connectLoop() {
 		if (!this.machineName) {
-			const identity = await resolveMachineIdentity();
+			const identity = await resolveMachineIdentity(this.opts.persistedMachineName);
 			this.machineName = identity.machineName;
 			this.friendlyName = identity.friendlyName;
+			this.opts.onMachineName(identity.machineName, identity.machineNameSource);
 		}
 		let backoff = INITIAL_BACKOFF_MS;
 		while (this.enabled && !this.disposed) {
@@ -617,4 +690,4 @@ function sleep(ms) {
 }
 
 //#endregion
-export { registerPortalDevice as a, resolveMachineIdentity as c, grantPortalAccess as i, fetchPortalDevices as n, revokePortalAccess as o, findThisDevice as r, isRecord as s, PortalClient as t };
+export { isRecord as n, resolveMachineIdentity as r, PortalClient as t };

package/dist/js/client-hH2PJL8y.mjs

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { t as PortalClient } from "./client-DbqRBquD.mjs";
+import "./api-DG5W6iwx.mjs";
+
+export { PortalClient };

package/dist/js/{daemon-DDBIumf1.mjs → daemon-C6tZH1dO.mjs}

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
-import "./client-Dd5sMXPv.mjs";
-import { a as runPortalDaemon, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-Bq93vOIk.mjs";
+import "./client-DbqRBquD.mjs";
+import { a as runPortalDaemon, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-Dj9tGT12.mjs";
+import "./api-DG5W6iwx.mjs";
 
 export { runPortalDaemon };

package/dist/js/{daemon-Bq93vOIk.mjs → daemon-Dj9tGT12.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { s as isRecord, t as PortalClient } from "./client-Dd5sMXPv.mjs";
+import { n as isRecord, t as PortalClient } from "./client-DbqRBquD.mjs";
 import os from "node:os";
 import path from "node:path";
 import { z } from "zod";
@@ -8,6 +8,43 @@ import { createHash } from "node:crypto";
 import { connect, createServer } from "node:net";
 import { access, appendFile, mkdir, readFile, unlink, writeFile } from "node:fs/promises";
 
+//#region ../portal-daemon/src/build-stamp.ts
+/**
+* This build's stamp: the unix commit time (seconds) of the source it was
+* compiled from. Empty string when unstamped (a dev source run without the
+* env override).
+*
+* Why a commit time and not a package version: the daemon ships inside two
+* independently-versioned installers (the skydive CLI and the desktop app),
+* so their semvers are not comparable — but both build from this repo, so
+* the commit time of the built tree is one monotonic clock they share.
+*/
+function portalDaemonBuild() {
+	return "1786659341";
+}
+/**
+* Whether a client carrying `mine` should replace a running daemon carrying
+* `theirs` (newest build wins):
+*
+*  - an unstamped client never takes over — it can't prove it's newer;
+*  - a stamped client replaces an unstamped daemon — every stamped build
+*    postdates stamping, so the unstamped daemon is older by construction;
+*  - otherwise strictly greater wins; equal keeps the incumbent, so two
+*    identical builds never bounce the daemon between them.
+*/
+function isNewerBuild(mine, theirs) {
+	const mineAt = parseStamp(mine);
+	if (mineAt === null) return false;
+	const theirsAt = parseStamp(theirs);
+	if (theirsAt === null) return true;
+	return mineAt > theirsAt;
+}
+function parseStamp(stamp) {
+	if (!/^[0-9]+$/.test(stamp)) return null;
+	return Number(stamp);
+}
+
+//#endregion
 //#region ../portal-daemon/src/local-protocol.ts
 /**
 * Local IPC between the portal DAEMON and the `skydive` CLI processes attached
@@ -138,10 +175,18 @@ const clientCwdSchema = z.object({
 	t: z.literal("cwd"),
 	cwd: z.string().min(1)
 });
-/** `grant` — authorize one agent to reach this machine (user-initiated). */
+/**
+* `grant` — authorize one agent to reach this machine (user-initiated).
+* `conversationId` names the conversation whose run asked for access (the
+* in-chat approval card); the grant carries it upstream so the server wakes
+* the waiting agent. Defaults to null on parse so hellos from CLI builds that
+* predate the field keep granting against a newer daemon — they just skip the
+* wake, same as before the field existed.
+*/
 const clientGrantSchema = z.object({
 	t: z.literal("grant"),
-	agentId: z.string().min(1)
+	agentId: z.string().min(1),
+	conversationId: z.string().nullish().default(null)
 });
 /**
 * `decline` — the user answered no to an agent's request for this machine
@@ -220,6 +265,7 @@ const daemonStatusResultSchema = z.object({
 	v: z.number(),
 	pid: z.number(),
 	appUrl: z.string(),
+	build: z.string().default(""),
 	portal: z.object({
 		status: z.enum([
 			"off",
@@ -319,6 +365,7 @@ var PortalDaemon = class {
 	conns = /* @__PURE__ */ new Set();
 	cwds = /* @__PURE__ */ new Map();
 	declined = /* @__PURE__ */ new Set();
+	persistedMachineName = null;
 	fallbackCwd;
 	idleTimer = null;
 	sessionToken = null;
@@ -417,7 +464,7 @@ var PortalDaemon = class {
 			case "grant":
 				this.declined.delete(msg.agentId);
 				this.ensureClient();
-				this.client?.grantAgent(msg.agentId).catch((error) => {
+				this.client?.grantAgent(msg.agentId, msg.conversationId).catch((error) => {
 					this.logError("grantAgent failed", error);
 				});
 				return;
@@ -453,12 +500,28 @@ var PortalDaemon = class {
 				deviceToken: this.deviceToken
 			}),
 			resolveCwd: (conversationId) => this.resolveCwd(conversationId),
+			persistedMachineName: this.persistedMachineName,
+			onMachineName: (name, source) => this.onMachineName(name, source),
 			onState: (state) => {
 				this.lastState = state;
 				this.broadcastState();
 			}
 		});
 	}
+	/**
+	* The identity resolved on connect. Persist the name so a later scutil
+	* failure reuses it instead of adopting the volatile hostname, and log the
+	* source — a `hostname-fallback` after we'd previously registered under
+	* scutil is the tell that a flap just orphaned this machine's grants.
+	*/
+	onMachineName(name, source) {
+		if (source === "hostname-fallback" && this.persistedMachineName) this.logInfo(`portal identity WARNING: fell back to hostname "${name}" but had previously registered as "${this.persistedMachineName}" — grants may be orphaned`);
+		else this.logInfo(`portal identity: "${name}" (source=${source})`);
+		if (name && name !== this.persistedMachineName) {
+			this.persistedMachineName = name;
+			this.persistState();
+		}
+	}
 	/** The cwd an exec for `conversationId` runs in. */
 	resolveCwd(conversationId) {
 		if (conversationId) {
@@ -492,7 +555,14 @@ var PortalDaemon = class {
 	/** Append a line to the daemon log file (best-effort, for post-hoc debugging). */
 	logError(context, error) {
 		const message = error instanceof Error ? error.message : String(error);
-		const line = `${(/* @__PURE__ */ new Date()).toISOString()} ${context}: ${message}\n`;
+		this.logLine(`${context}: ${message}`);
+	}
+	/** Append an informational line to the daemon log file (best-effort). */
+	logInfo(message) {
+		this.logLine(message);
+	}
+	logLine(message) {
+		const line = `${(/* @__PURE__ */ new Date()).toISOString()} ${message}\n`;
 		appendFile(this.paths.logPath, line).catch((_error) => {});
 	}
 	/** Close the listener without exiting the process (tests own the process). */
@@ -516,6 +586,7 @@ var PortalDaemon = class {
 			v: LOCAL_PROTOCOL_VERSION,
 			pid: process.pid,
 			appUrl: this.appUrl,
+			build: portalDaemonBuild(),
 			portal: {
 				status: portal?.status ?? "off",
 				machineName: portal?.machineName ?? "",
@@ -551,6 +622,7 @@ var PortalDaemon = class {
 				if (Array.isArray(parsed.declined)) {
 					for (const id of parsed.declined) if (typeof id === "string") this.declined.add(id);
 				}
+				if (typeof parsed.machineName === "string" && parsed.machineName) this.persistedMachineName = parsed.machineName;
 			}
 		} catch (_error) {}
 	}
@@ -558,7 +630,8 @@ var PortalDaemon = class {
 		const state = {
 			version: LOCAL_PROTOCOL_VERSION,
 			cwds: Object.fromEntries(this.cwds),
-			declined: [...this.declined]
+			declined: [...this.declined],
+			machineName: this.persistedMachineName ?? void 0
 		};
 		writeFile(this.paths.statePath, JSON.stringify(state)).catch((error) => {
 			this.logError("persistState failed", error);
@@ -573,10 +646,23 @@ var PortalDaemon = class {
 * before dispatching a normal command — the same pattern the update-check
 * worker uses, so it survives bundling (import.meta.url points at the bundle,
 * not a standalone daemon module).
+*
+* Newest build wins: the daemon is embedded in two independently-updated
+* installers (the skydive CLI and the desktop app), and whoever spawned first
+* would otherwise hold the socket forever — a stale desktop daemon serving a
+* newer CLI indefinitely. So when a daemon is already listening, compare its
+* build stamp to ours: if ours is strictly newer, ask it to shut down (it
+* drains attached clients, who reconnect within ~500ms) and spawn from this
+* binary. Both spawners apply the same rule, so a host converges on the
+* newest installed build with at most one bounce.
 */
 async function ensureDaemonRunning(appUrl) {
 	const { socketPath } = daemonPaths(appUrl);
-	if (await isDaemonListening(socketPath)) return;
+	if (await isDaemonListening(socketPath)) {
+		const status = await queryDaemonStatus(appUrl);
+		if (!status || !isNewerBuild(portalDaemonBuild(), status.build)) return;
+		if (await stopDaemon(appUrl) === "failed") return;
+	}
 	const entry = process.argv[1];
 	const args = entry ? [
 		entry,