skydive-cli 0.6.0-beta.7 → 0.6.0-beta.70

package/dist/js/{client-Btq6bMzX.mjs → client-CAX6sE_Y.mjs}

@@ -91,7 +91,7 @@ function parseFrame(expectedType, frameBytes) {
 		const parsed = jsonLen ? JSON.parse(textDecoder.decode(frameBytes.subarray(jsonStart, jsonEnd))) : {};
 		if (typeof parsed !== "object" || parsed === null) return null;
 		json = parsed;
-	} catch {
+	} catch (_error) {
 		return null;
 	}
 	return {
@@ -113,6 +113,8 @@ const FRAME = {
 	RESIZE: 17
 };
 const MAX_INPUT_BYTES = 1 * 1024 * 1024;
+/** Upper bound for an exec's `timeoutMs`; larger asks are clamped to this. */
+const MAX_EXEC_TIMEOUT_MS = 1440 * 60 * 1e3;
 /** Query params for the upgrade URL, from a spec. Inverse of {@link parseStreamSpec}. */
 function streamSpecToQuery(spec) {
 	if (spec.mode === "pty") return {
@@ -124,7 +126,8 @@ function streamSpecToQuery(spec) {
 	if (spec.mode === "exec") return {
 		agentId: spec.agentId,
 		mode: "exec",
-		command: spec.command
+		command: spec.command,
+		...spec.timeoutMs !== void 0 ? { timeoutMs: String(spec.timeoutMs) } : {}
 	};
 	return {
 		agentId: spec.agentId,
@@ -223,8 +226,23 @@ var SandboxStream = class SandboxStream {
 			}
 		});
 		let failure = null;
+		ws.on("unexpected-response", (_request, response) => {
+			const chunks = [];
+			let bytes = 0;
+			response.on("data", (chunk) => {
+				if (bytes >= MAX_HANDSHAKE_BODY_BYTES) return;
+				const remaining = MAX_HANDSHAKE_BODY_BYTES - bytes;
+				const kept = Buffer.from(chunk).subarray(0, remaining);
+				chunks.push(kept);
+				bytes += kept.length;
+			});
+			response.on("end", () => {
+				failure = formatHandshakeRejection(response.statusCode, response.statusMessage, Buffer.concat(chunks).toString("utf8"));
+				ws.terminate();
+			});
+		});
 		ws.on("error", (err) => {
-			failure = err.message;
+			failure ??= err.message;
 		});
 		ws.on("close", () => {
 			this.closed = true;
@@ -258,13 +276,20 @@ var SandboxStream = class SandboxStream {
 		} : {
 			mode: "exec",
 			agentId: opts.agentId,
-			command: opts.command
+			command: opts.command,
+			...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
 		};
 		const url = new URL(`${wsBase(opts.appUrl)}${SANDBOX_STREAM_PATH}`);
 		for (const [key, value] of Object.entries(streamSpecToQuery(spec))) url.searchParams.set(key, value);
 		return new SandboxStream(new WebSocket(url.toString(), { headers: { authorization: `Bearer ${opts.sessionToken}` } }), opts.onEvent);
 	}
 };
+const MAX_HANDSHAKE_BODY_BYTES = 512;
+function formatHandshakeRejection(statusCode, statusMessage, body) {
+	const status = [statusCode, statusMessage].filter(Boolean).join(" ");
+	const reason = Array.from(body, (char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127 ? " " : char).join("").replace(/\s+/g, " ").trim();
+	return reason ? `${status}: ${reason}` : status || "WebSocket upgrade rejected";
+}
 function toBuffer(data) {
 	if (Buffer.isBuffer(data)) return data;
 	if (Array.isArray(data)) return Buffer.concat(data);
@@ -272,4 +297,4 @@ function toBuffer(data) {
 }
 
 //#endregion
-export { encodeFsRequest as a, decodeFsResponse as i, SANDBOX_STREAM_PATH as n, streamSpecToQuery as r, SandboxStream as t };
+export { decodeFsResponse as a, FS_MAX_BLOB_BYTES as i, SANDBOX_STREAM_PATH as n, encodeFsRequest as o, streamSpecToQuery as r, SandboxStream as t };

package/dist/js/client-DIxEJCps.mjs

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { n as PortalClient, r as RATE_LIMIT_STAND_DOWN_MS, t as AUTH_STAND_DOWN_MS } from "./client-DUSVWrV6.mjs";
+import "./api-BFQ4PQDA.mjs";
+
+export { PortalClient };

package/dist/js/{client-DykZYZyR.mjs → client-DUSVWrV6.mjs}

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { t as HttpError } from "./http-error-BF2NZZE3.mjs";
 import { a as mintPortalDeviceToken, c as unifyLegacyCliGrants, i as grantPortalAccess, l as startTlsForward, n as fetchPortalDevices, r as findThisDevice } from "./api-BFQ4PQDA.mjs";
 import os from "node:os";
 import { z } from "zod";
@@ -160,7 +161,7 @@ function errorMessage(err) {
 * the commit time of the built tree is one monotonic clock they share.
 */
 function portalDaemonBuild() {
-	return "1787870817";
+	return "1791582876";
 }
 /**
 * Whether a client carrying `mine` should replace a running daemon carrying
@@ -186,6 +187,8 @@ function parseStamp(stamp) {
 
 //#endregion
 //#region ../portal-protocol/src/index.ts
+const CLOSE_SUPERSEDED = 4001;
+const CLOSE_FLAP_COOLDOWN = 4002;
 const MAX_WS_FRAME_BYTES = 16 * 1024 * 1024;
 const T_DATA = 1;
 const T_CTRL = 2;
@@ -577,14 +580,41 @@ var JobManager = class {
 
 //#endregion
 //#region ../portal-daemon/src/client.ts
+const INITIAL_BACKOFF_MS = 500;
+const MAX_BACKOFF_MS = 1e4;
+const AUTH_STAND_DOWN_MS = 5 * 6e4;
+const AUTH_STAND_DOWN_MESSAGE = "portal sign-in expired — reopen Skydive Desktop (or run `skydive portal open`) to reconnect";
+/**
+* True when the error means the server could not authenticate us: a token-mint
+* failure (HttpError 401) or a WS upgrade rejected at the auth layer. `ws`
+* reports a rejected upgrade as `Unexpected server response: <status>` with no
+* structured status property, so the status is read from the message. A 429 is
+* deliberately NOT an auth failure — see isRateLimited.
+*/
+function isAuthFailure(err) {
+	if (err instanceof HttpError) return err.status === 401;
+	return /Unexpected server response: 401\b/.test(errorMessage(err));
+}
+const RATE_LIMIT_STAND_DOWN_MS = 12e4;
+const RATE_LIMIT_STAND_DOWN_MESSAGE = "portal connection rate limited — retrying in 2 minutes";
+function isRateLimited(err) {
+	if (err instanceof HttpError) return err.status === 429;
+	return /Unexpected server response: 429\b/.test(errorMessage(err));
+}
 const DEFAULT_HEARTBEAT = {
 	intervalMs: 15e3,
 	maxMissed: 2,
 	wakeTickMs: 2e3,
 	wakeGapThresholdMs: 1e4,
 	netWatchTickMs: 2e3,
-	initialBackoffMs: 500,
-	maxBackoffMs: 1e4
+	initialBackoffMs: INITIAL_BACKOFF_MS,
+	maxBackoffMs: MAX_BACKOFF_MS,
+	supersededBackoffFloorMs: 5e3,
+	flapWindowMs: 6e4,
+	flapMaxStandDowns: 3,
+	flapBackoffMs: 6e4,
+	authStandDownMs: AUTH_STAND_DOWN_MS,
+	rateLimitStandDownMs: RATE_LIMIT_STAND_DOWN_MS
 };
 /**
 * A cheap fingerprint of the machine's network identity: every non-internal
@@ -664,11 +694,14 @@ var PortalClient = class {
 	machineName = "";
 	friendlyName = "";
 	legacyGrantsChecked = false;
+	authRejected = false;
+	rateLimited = false;
 	wakeWatch = null;
 	lastTick = Date.now();
 	netWatch = null;
 	netFingerprint = networkFingerprint();
 	backoffKick = null;
+	inStandDownSleep = false;
 	dialReason = null;
 	disconnectedAt = null;
 	handingOff = false;
@@ -739,6 +772,7 @@ var PortalClient = class {
 			this.ws.terminate();
 			return;
 		}
+		if (this.inStandDownSleep) return;
 		this.kickBackoff();
 	}
 	kickBackoff() {
@@ -777,6 +811,8 @@ var PortalClient = class {
 		if (this.enabled || this.disposed) return;
 		this.enabled = true;
 		this.error = null;
+		this.authRejected = false;
+		this.rateLimited = false;
 		this.connectLoop();
 	}
 	disable() {
@@ -914,29 +950,68 @@ var PortalClient = class {
 			this.opts.onMachineName(identity.machineName, identity.machineNameSource);
 		}
 		let backoff = this.heartbeatConfig.initialBackoffMs;
+		let standDowns = [];
 		while (this.enabled && !this.disposed && !this.handingOff) {
 			this.setStatus("connecting");
+			let sleepFloor = 0;
 			try {
 				const token = await this.wsToken();
-				if (await this.runConnection(token)) backoff = this.heartbeatConfig.initialBackoffMs;
-				else backoff = Math.min(backoff * 2, this.heartbeatConfig.maxBackoffMs);
+				const { healthy, standDown } = await this.runConnection(token);
+				if (standDown) {
+					this.setStatus("stand-down");
+					const now = Date.now();
+					standDowns.push(now);
+					standDowns = standDowns.filter((at) => now - at <= this.heartbeatConfig.flapWindowMs);
+					if (standDowns.length >= this.heartbeatConfig.flapMaxStandDowns) {
+						backoff = this.heartbeatConfig.flapBackoffMs;
+						this.setStatus("error", "another portal connection for this machine keeps taking over — if Skydive Desktop or `skydive portal open` is running twice, quit the duplicate; an unstable network can also cause this briefly");
+					} else backoff = Math.max(Math.min(backoff * 2, this.heartbeatConfig.maxBackoffMs), this.heartbeatConfig.supersededBackoffFloorMs);
+					sleepFloor = backoff / 2;
+				} else if (healthy) backoff = this.heartbeatConfig.initialBackoffMs;
+				else if (this.authRejected) {
+					this.setStatus("error", AUTH_STAND_DOWN_MESSAGE);
+					this.authRejected = false;
+					backoff = this.heartbeatConfig.authStandDownMs;
+					sleepFloor = backoff;
+				} else if (this.rateLimited) {
+					this.setStatus("error", RATE_LIMIT_STAND_DOWN_MESSAGE);
+					this.rateLimited = false;
+					backoff = this.heartbeatConfig.rateLimitStandDownMs;
+					sleepFloor = backoff;
+				} else backoff = Math.min(backoff * 2, this.heartbeatConfig.maxBackoffMs);
 			} catch (err) {
 				if (!this.enabled || this.disposed || this.handingOff) break;
-				this.setStatus("error", errorMessage(err));
-				backoff = Math.min(backoff * 2, this.heartbeatConfig.maxBackoffMs);
+				if (isAuthFailure(err)) {
+					this.setStatus("error", AUTH_STAND_DOWN_MESSAGE);
+					backoff = this.heartbeatConfig.authStandDownMs;
+					sleepFloor = backoff;
+				} else if (isRateLimited(err)) {
+					this.setStatus("error", RATE_LIMIT_STAND_DOWN_MESSAGE);
+					backoff = this.heartbeatConfig.rateLimitStandDownMs;
+					sleepFloor = backoff;
+				} else {
+					this.setStatus("error", errorMessage(err));
+					backoff = Math.min(backoff * 2, this.heartbeatConfig.maxBackoffMs);
+				}
 			}
 			if (!this.enabled || this.disposed || this.handingOff) break;
-			await this.backoffSleep(Math.random() * backoff);
+			this.inStandDownSleep = sleepFloor > 0;
+			await this.backoffSleep(sleepFloor + Math.random() * Math.max(backoff - sleepFloor, 0));
+			this.inStandDownSleep = false;
 		}
 	}
 	runConnection(token) {
 		return new Promise((resolve) => {
 			let settled = false;
 			let healthy = false;
+			let standDown = false;
 			const settle = () => {
 				if (settled) return;
 				settled = true;
-				resolve(healthy);
+				resolve({
+					healthy,
+					standDown
+				});
 			};
 			const ws = new WebSocket(portalWsUrl(this.opts.appUrl, this.machineName, this.friendlyName, {
 				build: portalDaemonBuild(),
@@ -974,6 +1049,8 @@ var PortalClient = class {
 			};
 			ws.on("open", () => {
 				missed = 0;
+				this.authRejected = false;
+				this.rateLimited = false;
 				this.dialReason = null;
 				this.disconnectedAt = null;
 				this.setStatus("connected");
@@ -987,8 +1064,18 @@ var PortalClient = class {
 			});
 			ws.on("error", (err) => {
 				this.error = errorMessage(err);
+				if (isAuthFailure(err)) {
+					this.authRejected = true;
+					this.dialReason ??= "portal credentials rejected; standing down";
+				}
+				if (isRateLimited(err)) {
+					this.rateLimited = true;
+					this.dialReason ??= "portal connection rate limited; standing down";
+				}
 			});
-			ws.on("close", (code) => {
+			ws.on("close", (code, reason) => {
+				standDown = code === CLOSE_SUPERSEDED || code === CLOSE_FLAP_COOLDOWN || code === 1e3 && reason.toString() === "superseded";
+				if (standDown) this.dialReason ??= `superseded (code ${code})`;
 				this.dialReason ??= `connection closed (code ${code})`;
 				this.disconnectedAt ??= Date.now();
 				clearInterval(heartbeat);
@@ -1048,4 +1135,4 @@ function sleep(ms) {
 }
 
 //#endregion
-export { resolveMachineIdentity as a, isRecord as i, isNewerBuild as n, portalDaemonBuild as r, PortalClient as t };
+export { portalDaemonBuild as a, isNewerBuild as i, PortalClient as n, isRecord as o, RATE_LIMIT_STAND_DOWN_MS as r, resolveMachineIdentity as s, AUTH_STAND_DOWN_MS as t };

package/dist/js/{daemon-BNXG3RB6.mjs → daemon-Bd1bhqtt.mjs}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
-import { i as isRecord, n as isNewerBuild, r as portalDaemonBuild, t as PortalClient } from "./client-DykZYZyR.mjs";
+import { a as portalDaemonBuild, i as isNewerBuild, n as PortalClient, o as isRecord } from "./client-DUSVWrV6.mjs";
 import { t as defaultTlsCertSource } from "./tls-cert-Rua2oV7n.mjs";
 import os from "node:os";
 import path from "node:path";
+import { access, appendFile, mkdir, readFile, stat, unlink, writeFile } from "node:fs/promises";
 import { z } from "zod";
 import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { connect, createServer } from "node:net";
-import { access, appendFile, mkdir, readFile, stat, unlink, writeFile } from "node:fs/promises";
 
 //#region ../portal-daemon/src/local-protocol.ts
 /**
@@ -66,6 +66,18 @@ function canonicalPortalAppUrl(appUrl) {
 	if (host === "skydive.com" || host === "www.skydive.com" || host === "api.skydive.com") return "https://api.skydive.com";
 	return trimmed;
 }
+/** Prefix every Windows named pipe lives under (the pipe filesystem root). */
+const WINDOWS_PIPE_PREFIX = "\\\\.\\pipe\\";
+/**
+* Whether a daemon control-socket path is a Windows named pipe rather than a
+* Unix-domain-socket FILE. Pipes have no on-disk file: they cannot be
+* `stat`ed, `unlink`ed, or purged by a tmp cleaner, and the OS frees the name
+* the moment the owning server closes — so every file-based lifecycle step
+* (stale-file cleanup, the socket-ownership watch) must be skipped for them.
+*/
+function isNamedPipePath(socketPath) {
+	return socketPath.startsWith(WINDOWS_PIPE_PREFIX);
+}
 /**
 * Per-user, per-app daemon socket + state paths. Scoped by OS user and a hash
 * of the CANONICAL appUrl so two logins or two deployments (prod vs a PR
@@ -73,17 +85,42 @@ function canonicalPortalAppUrl(appUrl) {
 * every alias of one deployment (see {@link canonicalPortalAppUrl}) shares
 * one. Kept under the OS temp dir because Unix socket paths are
 * length-limited (~104 bytes on macOS).
+*
+* On Windows a `node:net` server cannot listen on a filesystem path at all —
+* binding the tmp-dir path fails with EACCES and the daemon dies silently
+* (ANY-7285's Windows facet) — so the socket is a named pipe under
+* `\\.\pipe\`, keyed by the same (user, appUrl-hash) pair. State and log
+* files stay under the temp dir on every platform.
+*
+* Darwin `sockaddr_un.sun_path` is 104 bytes including NUL (103 usable).
+* `os.tmpdir()` on macOS is `$TMPDIR` (`/var/folders/<id>/T`, often ~50
+* chars). Adding `skydive-portal-<user>-<hash>/daemon.sock` overruns that
+* cap: bind() fails, the sidecar handshake still reports the long path, and
+* connect() returns ENOENT (or Go's "path must be shorter than SUN_LEN").
+* Stay in `os.tmpdir()` (do not relocate to `/tmp`) and shorten the leaf
+* when the composed path would blow the cap. Windows named pipes have no
+* sun_path, so they keep the long leaf.
 */
-function daemonPaths(appUrl) {
-	const user = safeSegment(os.userInfo().username || "user");
-	const app = createHash("sha256").update(canonicalPortalAppUrl(appUrl)).digest("hex").slice(0, 12);
-	const dir = path.join(os.tmpdir(), `skydive-portal-${user}-${app}`);
-	return {
+const SUN_PATH_MAX = 103;
+function daemonPaths(appUrl, platform = process.platform) {
+	const parent = os.tmpdir();
+	const key = `skydive-portal-${safeSegment(os.userInfo().username || "user")}-${createHash("sha256").update(canonicalPortalAppUrl(appUrl)).digest("hex").slice(0, 12)}`;
+	const dir = path.join(parent, key);
+	const paths = {
 		dir,
-		socketPath: path.join(dir, "daemon.sock"),
+		socketPath: platform === "win32" ? `${WINDOWS_PIPE_PREFIX}${key}` : path.join(dir, "daemon.sock"),
 		statePath: path.join(dir, "state.json"),
 		logPath: path.join(dir, "daemon.log")
 	};
+	if (platform === "win32" || Buffer.byteLength(paths.socketPath) <= SUN_PATH_MAX) return paths;
+	const short = createHash("sha256").update(`${os.userInfo().username || "user"}\0${canonicalPortalAppUrl(appUrl)}`).digest("hex").slice(0, 12);
+	const shortDir = path.join(parent, `skydive-p-${short}`);
+	return {
+		dir: shortDir,
+		socketPath: path.join(shortDir, "d.sock"),
+		statePath: path.join(shortDir, "state.json"),
+		logPath: path.join(shortDir, "daemon.log")
+	};
 }
 function safeSegment(value) {
 	return value.replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 24) || "user";
@@ -344,6 +381,16 @@ const IDLE_SHUTDOWN_MS = 3e4;
 */
 const SOCKET_WATCH_TICK_MS = 3e4;
 /**
+* Grace window after a server stand-down: the check fires the instant the
+* close lands, but the WINNER's socket bind may still be in flight — a check
+* run at t=0 can see our own still-good socket, conclude we are the owner, and
+* redial into the supersede war the stand-down exists to end. On a
+* stand-down-triggered check, wait this out once and re-stat before
+* concluding ownership. The periodic watch tick runs grace-free (nothing just
+* displaced us there).
+*/
+const STAND_DOWN_GRACE_MS = 1500;
+/**
 * Upper bound an incumbent daemon waits, during a graceful handoff, for the
 * successor to dial out and claim presence before giving up and releasing the
 * slot itself. Comfortably above a normal successor boot + WS dial (a few
@@ -370,12 +417,14 @@ var PortalDaemon = class {
 	socketId = null;
 	socketCheckRunning = false;
 	socketWatchTickMs;
+	standDownGraceMs;
 	exit;
 	constructor(appUrl, options) {
 		this.appUrl = canonicalPortalAppUrl(appUrl);
 		this.paths = daemonPaths(this.appUrl);
 		this.fallbackCwd = process.env.HOME ?? process.cwd();
 		this.socketWatchTickMs = options?.socketWatchTickMs ?? SOCKET_WATCH_TICK_MS;
+		this.standDownGraceMs = options?.standDownGraceMs ?? STAND_DOWN_GRACE_MS;
 		this.exit = options?.exit ?? (() => process.exit(0));
 	}
 	/** Start listening. Rejects if the socket is already held by another daemon. */
@@ -392,8 +441,10 @@ var PortalDaemon = class {
 				resolve();
 			});
 		});
-		await this.recordSocketIdentity();
-		this.startSocketWatch();
+		if (!isNamedPipePath(this.paths.socketPath)) {
+			await this.recordSocketIdentity();
+			this.startSocketWatch();
+		}
 	}
 	/**
 	* Remember which socket FILE we bound (dev+ino), so the watch can tell "our
@@ -421,24 +472,42 @@ var PortalDaemon = class {
 	*/
 	startSocketWatch() {
 		this.socketWatch = setInterval(() => {
-			if (this.socketCheckRunning) return;
-			this.socketCheckRunning = true;
-			this.checkSocketOwnership().catch((error) => this.logError("socket ownership check failed", error)).finally(() => {
-				this.socketCheckRunning = false;
-			});
+			this.runOwnershipCheck();
 		}, this.socketWatchTickMs);
 		this.socketWatch.unref();
 	}
+	/** One socket-ownership pass, shared by the watch timer (grace-free) and the
+	* client's 'stand-down' state (with grace — see STAND_DOWN_GRACE_MS).
+	*/
+	runOwnershipCheck(graceMs = 0) {
+		if (this.socketCheckRunning) return;
+		this.socketCheckRunning = true;
+		this.checkSocketOwnership(graceMs).catch((error) => this.logError("socket ownership check failed", error)).finally(() => {
+			this.socketCheckRunning = false;
+		});
+	}
 	stopSocketWatch() {
 		if (this.socketWatch) {
 			clearInterval(this.socketWatch);
 			this.socketWatch = null;
 		}
 	}
-	async checkSocketOwnership() {
+	async checkSocketOwnership(graceMs = 0) {
 		if (!this.server || this.handingOff) return;
 		const current = await stat(this.paths.socketPath).catch(() => null);
-		if (current && this.socketId && current.dev === this.socketId.dev && current.ino === this.socketId.ino) return;
+		if (current && this.socketId && current.dev === this.socketId.dev && current.ino === this.socketId.ino) {
+			if (graceMs > 0) {
+				await new Promise((r) => setTimeout(r, graceMs));
+				const recheck = await stat(this.paths.socketPath).catch(() => null);
+				const socketId = this.socketId;
+				if (recheck && socketId && !(recheck.dev === socketId.dev && recheck.ino === socketId.ino)) {
+					this.logInfo("control socket taken over during stand-down grace; standing down");
+					this.standDown();
+					return;
+				}
+			}
+			return;
+		}
 		if (current) {
 			this.logInfo("control socket path is owned by another daemon; standing down");
 			this.standDown();
@@ -490,6 +559,10 @@ var PortalDaemon = class {
 		this.exit();
 	}
 	async clearStaleSocket() {
+		if (isNamedPipePath(this.paths.socketPath)) {
+			if (await isDaemonListening(this.paths.socketPath)) throw new Error("daemon already running");
+			return;
+		}
 		if (!await pathExists(this.paths.socketPath)) return;
 		if (await new Promise((resolve) => {
 			const probe = connect(this.paths.socketPath);
@@ -605,13 +678,23 @@ var PortalDaemon = class {
 			tlsCertSource: defaultTlsCertSource(process.env, (msg) => this.logInfo(msg)),
 			persistedMachineName: this.persistedMachineName,
 			onMachineName: (name, source) => this.onMachineName(name, source),
-			onState: (state) => {
-				this.lastState = state;
-				this.broadcastState();
-			}
+			onState: (state) => this.handleClientState(state)
 		});
 	}
 	/**
+	* Client state transition. A server stand-down ('stand-down' status — the
+	* superseded/flap-cooldown close, distinguishable from an ordinary close
+	* through the status) runs the ownership check NOW with grace, so a
+	* duplicate that already lost the control socket yields within one server
+	* round trip instead of waiting for the next watch tick and fighting
+	* (supersede war).
+	*/
+	handleClientState(state) {
+		if (state.status === "stand-down") this.runOwnershipCheck(this.standDownGraceMs);
+		this.lastState = state;
+		this.broadcastState();
+	}
+	/**
 	* The identity resolved on connect. Persist the name so a later scutil
 	* failure reuses it instead of adopting the volatile hostname, and log the
 	* source — a `hostname-fallback` after we'd previously registered under
@@ -693,7 +776,7 @@ var PortalDaemon = class {
 			appUrl: this.appUrl,
 			build: portalDaemonBuild(),
 			portal: {
-				status: portal?.status ?? "off",
+				status: portal?.status === "stand-down" ? "connecting" : portal?.status ?? "off",
 				machineName: portal?.machineName ?? "",
 				friendlyName: portal?.friendlyName ?? "",
 				error: portal?.error ?? null,
@@ -786,13 +869,19 @@ var PortalDaemon = class {
 * drains attached clients, who reconnect within ~500ms) and spawn from this
 * binary. Both spawners apply the same rule, so a host converges on the
 * newest installed build with at most one bounce.
+*
+* Returns whether a daemon is actually listening when it's done. A spawned
+* daemon that never binds (its process died on startup — e.g. the Windows
+* EACCES bind failure this used to swallow) resolves `false` so callers can
+* SAY so, instead of silently handing the caller a socket nobody serves and
+* leaving the reconnect loop to spin forever with no visible error.
 */
 async function ensureDaemonRunning(appUrl) {
 	const { socketPath } = daemonPaths(appUrl);
 	if (await isDaemonListening(socketPath)) {
 		const status = await queryDaemonStatus(appUrl);
-		if (!status || !isNewerBuild(portalDaemonBuild(), status.build)) return;
-		if (await stopDaemonForHandoff(appUrl) === "failed") return;
+		if (!status || !isNewerBuild(portalDaemonBuild(), status.build)) return true;
+		if (await stopDaemonForHandoff(appUrl) === "failed") return true;
 	}
 	const entry = process.argv[1];
 	const args = entry ? [
@@ -806,9 +895,10 @@ async function ensureDaemonRunning(appUrl) {
 		env: process.env
 	}).unref();
 	for (let i = 0; i < 50; i += 1) {
-		if (await isDaemonListening(socketPath)) return;
+		if (await isDaemonListening(socketPath)) return true;
 		await sleep(100);
 	}
+	return false;
 }
 /**
 * Entry the CLI calls when launched with PORTAL_DAEMON_FLAG: become the daemon.
@@ -829,7 +919,7 @@ function startPortalDaemon(appUrl) {
 	return new PortalDaemon(appUrl, null).listen();
 }
 async function isDaemonListening(socketPath) {
-	if (!await pathExists(socketPath)) return false;
+	if (!isNamedPipePath(socketPath) && !await pathExists(socketPath)) return false;
 	return new Promise((resolve) => {
 		const probe = connect(socketPath);
 		probe.on("connect", () => {
@@ -956,7 +1046,7 @@ async function stopDaemon(appUrl) {
 function stateMessage(state, declined) {
 	return {
 		t: "state",
-		status: state.status,
+		status: state.status === "stand-down" ? "connecting" : state.status,
 		machineName: state.machineName,
 		friendlyName: state.friendlyName,
 		error: state.error,

package/dist/js/{daemon-CQ6MTh6u.mjs → daemon-CHpPVmNL.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import "./client-DykZYZyR.mjs";
+import "./client-DUSVWrV6.mjs";
 import "./tls-cert-Rua2oV7n.mjs";
 import "./api-BFQ4PQDA.mjs";
-import { a as runPortalDaemon, c as stopDaemonForHandoff, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-BNXG3RB6.mjs";
+import { a as runPortalDaemon, c as stopDaemonForHandoff, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-Bd1bhqtt.mjs";
 
 export { runPortalDaemon };

package/dist/js/{daemon-client-C-m-YATb.mjs → daemon-client-C5262e5L.mjs}

@@ -1,14 +1,21 @@
 #!/usr/bin/env node
-import { d as daemonPaths, f as encodeLine, l as LOCAL_PROTOCOL_VERSION, m as parseDaemonMessage, n as ensureDaemonRunning, p as makeLineParser } from "./daemon-BNXG3RB6.mjs";
+import { d as daemonPaths, f as encodeLine, l as LOCAL_PROTOCOL_VERSION, m as parseDaemonMessage, n as ensureDaemonRunning, p as makeLineParser } from "./daemon-Bd1bhqtt.mjs";
 import { randomUUID } from "node:crypto";
 import { connect } from "node:net";
 
 //#region ../portal-daemon/src/daemon-client.ts
+/** Reconnect delay when an established daemon connection drops. */
+const RECONNECT_DELAY_MS = 500;
+/** Base delay between daemon SPAWN retries (doubles per consecutive failure). */
+const START_RETRY_BASE_MS = 2e3;
+/** Consecutive failed spawns before start() stops respawning. */
+const MAX_START_ATTEMPTS = 3;
 var PortalDaemonClient = class {
 	sessionId = randomUUID();
 	socket = null;
 	disposed = false;
 	reconnectTimer = null;
+	startFailures = 0;
 	lastBind = null;
 	fallbackCwd = null;
 	wantEnabled = false;
@@ -21,7 +28,21 @@ var PortalDaemonClient = class {
 	/** Spawn the daemon if needed and attach. Idempotent. */
 	async start() {
 		if (this.disposed) return;
-		await ensureDaemonRunning(this.opts.appUrl);
+		if (!await ensureDaemonRunning(this.opts.appUrl)) {
+			this.startFailures += 1;
+			const exhausted = this.startFailures >= MAX_START_ATTEMPTS;
+			this.opts.onState({
+				status: "error",
+				machineName: "",
+				friendlyName: "",
+				error: exhausted ? "portal daemon failed to start repeatedly; toggle sharing to retry" : "portal daemon failed to start (control socket never came up)",
+				grantedAgentIds: [],
+				declinedAgentIds: []
+			});
+			if (!exhausted) this.scheduleReconnect(START_RETRY_BASE_MS * 2 ** (this.startFailures - 1));
+			return;
+		}
+		this.startFailures = 0;
 		this.connect();
 	}
 	connect() {
@@ -74,12 +95,12 @@ var PortalDaemonClient = class {
 		socket.on("close", onClose);
 		socket.on("error", onClose);
 	}
-	scheduleReconnect() {
+	scheduleReconnect(delayMs = RECONNECT_DELAY_MS) {
 		if (this.disposed || this.reconnectTimer) return;
 		this.reconnectTimer = setTimeout(() => {
 			this.reconnectTimer = null;
 			this.start();
-		}, 500);
+		}, delayMs);
 		this.reconnectTimer.unref();
 	}
 	onMessage(msg) {
@@ -109,6 +130,10 @@ var PortalDaemonClient = class {
 	/** Turn machine sharing on (the daemon connects the portal). */
 	enable() {
 		this.wantEnabled = true;
+		if (this.startFailures >= MAX_START_ATTEMPTS) {
+			this.startFailures = 0;
+			this.start();
+		}
 		this.send({ t: "enable" });
 	}
 	/** Turn machine sharing off. */

package/dist/js/daemon-client-CXpHkS9v.mjs

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import "./client-DUSVWrV6.mjs";
+import "./tls-cert-Rua2oV7n.mjs";
+import "./api-BFQ4PQDA.mjs";
+import "./daemon-Bd1bhqtt.mjs";
+import { t as PortalDaemonClient } from "./daemon-client-C5262e5L.mjs";
+
+export { PortalDaemonClient };