talon-agent 3.15.0 → 3.15.2

package/src/backend/remote-server/sessions.ts

@@ -17,7 +17,12 @@ import {
 import { log, logWarn } from "../../util/log.js";
 import type { RemoteAgentClient, RemotePermissionRule } from "./client.js";
 import type { RemoteServerState } from "./state.js";
-import { TALON_MCP_SERVER_NAME, getChatMcpServerName } from "./mcp.js";
+import {
+  TALON_MCP_SERVER_NAME,
+  TALON_PLUGIN_MCP_SERVER_NAME,
+  getChatMcpServerName,
+  safeMcpNamePart,
+} from "./mcp.js";
 
 /**
  * Build the per-session permission ruleset Talon installs on every fresh
@@ -33,14 +38,13 @@ import { TALON_MCP_SERVER_NAME, getChatMcpServerName } from "./mcp.js";
  *      "No active chat context". Or in the cross-chat case where chat B
  *      IS active, the model in chat A could leak content into chat B.
  *      Deny pattern blocks both. (Visibility is also blocked at the
- *      MCP-registration layer via `ensureChatMcpServer`; this rule is
- *      defense in depth.)
+ *      prompt layer by `buildToolOverrides`; this rule is defense in depth.)
  *
- *   2. Auto-allow built-in tools (`tool *`, `edit *`, `bash *`) so they
+ *   2. Auto-allow built-in tools (`tool *`, `edit *`, `bash *`) and
+ *      workspace paths outside the server process's launch directory so they
  *      don't sit in `permission.asked` waiting for a reply that never
- *      arrives — Talon's question watchdog only handles `question.*`
- *      events, not `permission.*`. Without the allow rule the model's
- *      first `read` call hangs the entire turn.
+ *      arrives. The permission watchdog is a fallback for new categories;
+ *      this rule resolves the known path case without a polling round trip.
  *
  * Rules are evaluated in order; first match wins. (See upstream's
  * `PermissionRule` type — `permission` is the rule category, `pattern`
@@ -48,6 +52,7 @@ import { TALON_MCP_SERVER_NAME, getChatMcpServerName } from "./mcp.js";
  */
 export function buildPermissionRuleset(chatId: string): RemotePermissionRule[] {
   const ourServerName = getChatMcpServerName(chatId);
+  const ourPluginPrefix = `${TALON_PLUGIN_MCP_SERVER_NAME}-${safeMcpNamePart(chatId, "chat")}-`;
   return [
     { permission: "tool", pattern: `${ourServerName}_*`, action: "allow" },
     {
@@ -55,9 +60,16 @@ export function buildPermissionRuleset(chatId: string): RemotePermissionRule[] {
       pattern: `${TALON_MCP_SERVER_NAME}-*`,
       action: "deny",
     },
+    { permission: "tool", pattern: `${ourPluginPrefix}*`, action: "allow" },
+    {
+      permission: "tool",
+      pattern: `${TALON_PLUGIN_MCP_SERVER_NAME}-*`,
+      action: "deny",
+    },
     { permission: "tool", pattern: "*", action: "allow" },
     { permission: "edit", pattern: "*", action: "allow" },
     { permission: "bash", pattern: "*", action: "allow" },
+    { permission: "external_directory", pattern: "*", action: "allow" },
   ];
 }
 
@@ -106,3 +118,51 @@ export async function ensureRemoteSession<TClient extends RemoteAgentClient>(
 
   return newId;
 }
+
+/**
+ * The per-turn setup a warm-up front-loads. Both remote-server backends
+ * expose these under identical signatures; the shape lets the helper stay
+ * backend-agnostic without importing either SDK.
+ */
+export interface RemoteWarmDeps<TClient extends RemoteAgentClient> {
+  ensureServer(): Promise<TClient>;
+  ensureSession(client: TClient, chatId: string): Promise<string>;
+  ensureChatMcpServer(client: TClient, chatId: string): Promise<string>;
+  ensurePluginMcpServers(client: TClient, chatId: string): Promise<string[]>;
+}
+
+/**
+ * Pre-pay a chat's cold start: spawn the server if it isn't up, create (or
+ * resume) the session, and register the chat + plugin MCP servers.
+ *
+ * This is the remote-server analogue of the Claude backend's `warmSession`,
+ * and closes the last `sessions` capability gap between the two families.
+ * `performSessionReset` and the native frontend call it right after a reset,
+ * so the first turn on a fresh session doesn't serially pay session creation
+ * plus a full plugin-MCP registration sweep — the dominant cold-start cost
+ * here, since each plugin server is a separate connect.
+ *
+ * Best-effort by contract: `/reset` has already succeeded by the time this
+ * runs, and the same work is idempotent and repeated at the head of every
+ * turn. A failure must degrade to a slow first turn, never surface as a
+ * failed reset — so everything is caught and logged, not rethrown.
+ */
+export async function warmRemoteSession<TClient extends RemoteAgentClient>(
+  state: RemoteServerState<TClient>,
+  chatId: string,
+  deps: RemoteWarmDeps<TClient>,
+): Promise<void> {
+  try {
+    const client = await deps.ensureServer();
+    await deps.ensureSession(client, chatId);
+    await deps.ensureChatMcpServer(client, chatId);
+    await deps.ensurePluginMcpServers(client, chatId);
+    log("agent", `[${chatId}] Warmed ${state.label} session`);
+  } catch (err) {
+    logWarn(
+      "agent",
+      `[${chatId}] ${state.label} warm-up skipped (first turn pays cold start): ` +
+        `${err instanceof Error ? err.message : String(err)}`,
+    );
+  }
+}

package/src/backend/remote-server/sse-stream.ts

@@ -44,17 +44,24 @@ export async function subscribeSseStream(
   client: SseSubscribableClient,
   chatId: string,
 ): Promise<AsyncIterable<unknown> | undefined> {
-  let result: unknown;
-  try {
-    result = await client.global.event();
-  } catch (err) {
-    logWarn(
-      "agent",
-      `[${chatId}] SSE subscribe failed: ${err instanceof Error ? err.message : String(err)}`,
-    );
-    return undefined;
+  let lastError: unknown;
+  for (let attempt = 1; attempt <= 3; attempt++) {
+    try {
+      const stream = narrowSseResult(await client.global.event());
+      if (stream) return stream;
+      lastError = new Error("response did not contain an async event stream");
+    } catch (err) {
+      lastError = err;
+    }
+    if (attempt < 3) {
+      await new Promise((resolve) => setTimeout(resolve, 150 * attempt));
+    }
   }
-  return narrowSseResult(result);
+  logWarn(
+    "agent",
+    `[${chatId}] SSE subscribe failed after 3 attempts: ${lastError instanceof Error ? lastError.message : String(lastError)}`,
+  );
+  return undefined;
 }
 
 /**

package/src/backend/remote-server/state.ts

@@ -52,6 +52,10 @@ export interface RemoteServerState<TClient extends RemoteAgentClient> {
    * actual state, so we cache locally instead of trusting the server.
    */
   readonly registeredMcpServers: Set<string>;
+  /** Exact tool names exposed by each registered MCP server. */
+  readonly registeredMcpTools: Map<string, readonly string[]>;
+  /** Plugin-name → registered server-name mapping for each chat context. */
+  readonly pluginMcpServersByChat: Map<string, Map<string, string>>;
 }
 
 /** Inputs for {@link createRemoteServerState}. */
@@ -84,6 +88,8 @@ export function createRemoteServerState<TClient extends RemoteAgentClient>(
     serverHandle: null,
     modelProviderCache: new Map(),
     registeredMcpServers: new Set(),
+    registeredMcpTools: new Map(),
+    pluginMcpServersByChat: new Map(),
   };
 }
 

package/src/backend/remote-server/turn-timeout.ts

@@ -0,0 +1,71 @@
+/** Bounded turn execution for OpenCode/Kilo's long-lived HTTP servers. */
+
+import { logWarn } from "../../util/log.js";
+
+const DEFAULT_REMOTE_TURN_TIMEOUT_MS = 10 * 60_000;
+
+export function remoteTurnTimeoutMs(): number {
+  const configured = Number(process.env.TALON_REMOTE_TURN_TIMEOUT_MS);
+  return Number.isFinite(configured) && configured > 0
+    ? configured
+    : DEFAULT_REMOTE_TURN_TIMEOUT_MS;
+}
+
+export class RemoteTurnTimeoutError extends Error {
+  constructor(label: string, timeoutMs: number) {
+    super(`${label} turn timed out after ${Math.round(timeoutMs / 1000)}s`);
+    // Core error classification treats TimeoutError as a retryable transport
+    // failure, so the normal fallback-model path remains available.
+    this.name = "TimeoutError";
+  }
+}
+
+export interface RemoteTurnAbortClient {
+  session: {
+    abort(args: { sessionID: string }): Promise<unknown>;
+  };
+}
+
+/**
+ * Race a prompt+SSE turn against a hard deadline. On expiry, abort upstream
+ * generation before rejecting so the provider stops spending tokens and the
+ * session can be safely reset by the shared retry path.
+ */
+export async function awaitRemoteTurn<T>(
+  turn: Promise<T>,
+  inputs: {
+    client: RemoteTurnAbortClient;
+    sessionId: string;
+    chatId: string;
+    label: string;
+    timeoutMs?: number;
+  },
+): Promise<T> {
+  const timeoutMs = inputs.timeoutMs ?? remoteTurnTimeoutMs();
+  let timer: ReturnType<typeof setTimeout> | null = null;
+  try {
+    return await Promise.race([
+      turn,
+      new Promise<never>((_, reject) => {
+        timer = setTimeout(() => {
+          logWarn(
+            "agent",
+            `[${inputs.chatId}] ${inputs.label} turn exceeded ${Math.round(timeoutMs / 1000)}s; aborting`,
+          );
+          inputs.client.session
+            .abort({ sessionID: inputs.sessionId })
+            .catch((err) =>
+              logWarn(
+                "agent",
+                `[${inputs.chatId}] ${inputs.label} timeout abort failed: ${err instanceof Error ? err.message : String(err)}`,
+              ),
+            );
+          reject(new RemoteTurnTimeoutError(inputs.label, timeoutMs));
+        }, timeoutMs);
+        timer.unref?.();
+      }),
+    ]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}

package/src/core/mcp-hub/index.ts

@@ -104,6 +104,28 @@ export function hubPluginServerNames(only?: string[]): string[] {
   return Object.keys(getPluginMcpServers("", "hub-enum", only));
 }
 
+/**
+ * Enumerate one plugin server's tools through the same hub-managed child that
+ * serves MCP requests. Remote agent servers do not include dynamically-added
+ * MCP tools in their `/experimental/tool/ids` response, so OpenCode/Kilo need
+ * this authoritative list to build per-chat visibility overrides.
+ */
+export async function listHubPluginToolNames(
+  serverName: string,
+  chatId: string,
+  bridgeUrl: string,
+): Promise<string[]> {
+  const key =
+    serverName === "brave-search"
+      ? "brave-search"
+      : `${serverName}\u0000${chatId}`;
+  const child = await acquireChild(key, () =>
+    pluginSpec(serverName, chatId, bridgeUrl),
+  );
+  child.touch();
+  return (await child.listTools()).map((tool) => tool.name);
+}
+
 // ── Server construction per session ─────────────────────────────────────────
 
 type HubTarget =

package/src/frontend/telegram/admin.ts

@@ -70,7 +70,9 @@ export async function handleAdminCommand(
         const model = formatModelLabel(
           getChatSettings(s.chatId).model ?? config.model,
         );
-        return `<b>${escapeHtml(title)}</b> <code>${s.chatId}</code>\n  ${s.info.turns} turns | ${age} | ${model}`;
+        // `model` is a catalog id (OpenRouter/Kilo ids are free-form), so
+        // it gets the same escaping the title already had.
+        return `<b>${escapeHtml(title)}</b> <code>${s.chatId}</code>\n  ${s.info.turns} turns | ${age} | ${escapeHtml(model)}`;
       });
       await ctx.reply(
         `<b>Active chats (${sessions.length})</b>\n\n` + lines.join("\n\n"),

package/src/frontend/telegram/callbacks/model.ts

@@ -44,6 +44,47 @@ import {
   editOrIgnoreSame,
   type CallbackDeps,
 } from "./shared.js";
+import { logWarn } from "../../../util/log.js";
+
+/**
+ * Run the backend-side half of a chat's session handoff.
+ *
+ * A backend switch already clears Talon's own stores (session row,
+ * history, pulse checkpoint), but those are only half the state.
+ * `performSessionReset` also drives the backend capability slots, and
+ * the switch path skipped them entirely:
+ *
+ *   - the OUTGOING backend keeps in-process per-chat state that no
+ *     amount of clearing Talon's stores touches. openai-agents holds a
+ *     `MemorySession` map keyed by chat id, so switching away and back
+ *     resurrected the old conversation the operator meant to drop.
+ *   - the INCOMING backend was never warmed, so the first turn after a
+ *     switch paid the full cold start — on OpenCode/Kilo that is session
+ *     creation plus a per-plugin MCP registration sweep.
+ *
+ * The warm is deliberately fire-and-forget: it can take seconds, and the
+ * callback still has a toast to answer and a menu to redraw. Telegram
+ * expires an unanswered callback query, so blocking here would trade a
+ * cold first turn for a visibly stuck button.
+ */
+function handOffBackendSession(
+  chatId: string,
+  previousBackend: ReturnType<typeof resolveBackendForChat>,
+  gateway: CallbackDeps["gateway"],
+): void {
+  previousBackend?.sessions?.resetChat?.(chatId);
+  const nextBackend = resolveBackendForChat(chatId, gateway);
+  // Same instance on a no-op switch — warming it again is harmless
+  // (every step is idempotent) but pointless, so skip it.
+  if (!nextBackend || nextBackend === previousBackend) return;
+  void Promise.resolve(nextBackend.sessions?.warmSession?.(chatId)).catch(
+    (err) =>
+      logWarn(
+        "bot",
+        `[${chatId}] warm after backend switch failed: ${err instanceof Error ? err.message : String(err)}`,
+      ),
+  );
+}
 
 export async function handleModelCallback(
   ctx: Context,
@@ -171,6 +212,10 @@ export async function handleModelCallback(
       });
       return;
     }
+    // Resolve the outgoing backend BEFORE rebinding — afterwards this
+    // chat already points at the new one and the old in-process state
+    // would be unreachable.
+    const previousBackend = resolveBackendForChat(cid, gateway);
     const result = await rebindChat(cid, action.backendId, config);
     if (!result.ok) {
       await answerCallbackQuerySafe(ctx, {
@@ -188,6 +233,7 @@ export async function handleModelCallback(
     resetSession(cid);
     clearHistory(cid);
     resetPulseCheckpoint(cid);
+    handOffBackendSession(cid, previousBackend, gateway);
     const label =
       available.find((b) => b.id === action.backendId)?.label ??
       action.backendId;
@@ -210,11 +256,13 @@ export async function handleModelCallback(
     // global chat-role backend. Per-backend model picks are
     // preserved (modelByBackend stays intact) so reverting and
     // switching back later still restores prior choices.
+    const previousBackend = resolveBackendForChat(cid, gateway);
     await releaseChat(cid);
     setChatBackend(cid, undefined);
     resetSession(cid);
     clearHistory(cid);
     resetPulseCheckpoint(cid);
+    handOffBackendSession(cid, previousBackend, gateway);
     // Resolve the now-default backend's model for the toast.
     const defaultBackend = resolveBackendForChat(cid, gateway);
     const defaultBackendId = getBackendIdForChat(cid);

package/src/frontend/telegram/commands/info.ts

@@ -132,11 +132,17 @@ export function registerInfoCommands(bot: Bot): void {
       return;
     }
     const lines = plugins.map((p) => {
-      const ver = p.plugin.version ? ` v${p.plugin.version}` : "";
-      const desc = p.plugin.description ? ` — ${p.plugin.description}` : "";
+      // Every field here is author-supplied manifest text, not just the
+      // name. A description like "R&D tools" or "<beta>" would otherwise
+      // reach Telegram as markup and 400 the whole listing, so `/plugins`
+      // would look dead rather than show one odd line.
+      const ver = p.plugin.version ? ` v${escapeHtml(p.plugin.version)}` : "";
+      const desc = p.plugin.description
+        ? ` — ${escapeHtml(p.plugin.description)}`
+        : "";
       const mcp = p.plugin.mcpServerPath ? " [MCP]" : "";
       const fe = p.plugin.frontends?.length
-        ? ` (${p.plugin.frontends.join(", ")})`
+        ? ` (${escapeHtml(p.plugin.frontends.join(", "))})`
         : "";
       return `• <b>${escapeHtml(p.plugin.name)}</b>${ver}${mcp}${fe}${desc}`;
     });

package/src/frontend/telegram/commands/settings.ts

@@ -112,10 +112,16 @@ export function registerSettingsCommands(
     if (be?.models?.resolveModelInfo) {
       const resolution = await be.models?.resolveModelInfo(arg);
       if (resolution.kind !== "exact") {
+        // Every backend's formatModelError returns plain text and
+        // interpolates the raw query, so escape at this boundary — the
+        // same fix as the model menu's status lines. `/model <name>`
+        // (which the OpenCode/Kilo hint literally tells you to type)
+        // otherwise reaches Telegram as an unsupported `<name>` tag and
+        // the whole reply 400s, leaving the command looking dead.
         const msg =
           be.models?.formatModelError?.(arg, resolution) ??
-          `No model matched "${escapeHtml(arg)}".`;
-        await ctx.reply(msg, { parse_mode: "HTML" });
+          `No model matched "${arg}".`;
+        await ctx.reply(escapeHtml(msg), { parse_mode: "HTML" });
         return;
       }
       if (!resolution.model.selectable) {

package/src/frontend/telegram/handlers/queue.ts

@@ -122,10 +122,16 @@ async function flushQueue(chatId: string): Promise<void> {
   // Clear hourglass reactions on queued messages now that we're processing
   for (const msgId of queuedReactionMsgIds) {
     bot.api.setMessageReaction(numericChatId, msgId, []).catch((err) => {
-      logWarn(
-        "bot",
-        `Failed to clear reaction on msg ${msgId}: ${err instanceof Error ? err.message : err}`,
-      );
+      const detail = err instanceof Error ? err.message : String(err);
+      // The id is recorded optimistically — the hourglass `setMessageReaction`
+      // above is fire-and-forget, so we queue the clear before knowing the set
+      // landed. When it didn't, clearing a reaction that was never there comes
+      // back as REACTION_EMPTY. The end state we wanted (no reaction) already
+      // holds, so that is a no-op, not a failure. Keeping the optimistic push
+      // matters: gating it on the set resolving would race the flush and strand
+      // a ⏳ on the message. Anything else is still worth surfacing.
+      if (detail.includes("REACTION_EMPTY")) return;
+      logWarn("bot", `Failed to clear reaction on msg ${msgId}: ${detail}`);
     });
   }
 

package/src/frontend/telegram/helpers/menu.ts

@@ -370,9 +370,12 @@ export function renderModelMenuText(state: ModelMenuState): string {
       `<i>Use the picker below to choose one — sending a message before picking will be refused.</i>`,
     );
   } else {
-    lines.push(`<b>Model:</b> <code>${state.activeDisplay}</code>`);
+    lines.push(`<b>Model:</b> <code>${escapeHtml(state.activeDisplay)}</code>`);
   }
-  for (const l of state.statusLines) lines.push(l);
+  // Display names and status lines are plain text from backend catalogs —
+  // a literal `<name>` in a hint (or a `<` in a model id) is otherwise
+  // parsed as an HTML tag and Telegram rejects the whole send with 400.
+  for (const l of state.statusLines) lines.push(escapeHtml(l));
   if (state.freeOnly && state.showFreeToggle) {
     lines.push("<i>Filtering to free-tier models when browsing.</i>");
   }

package/src/util/respawn.ts

@@ -3,8 +3,7 @@
  *
  * Spawns a fresh copy of the current process — same Node binary,
  * same `execArgv` (preserving the tsx loader so `.ts` entrypoints
- * still resolve), same script + user args, same cwd + env — then
- * triggers a graceful shutdown of the current process. The new
+ * still resolve), same script + user args, same cwd + env. The new
  * child is detached with stdio:"ignore" so it survives the parent's
  * exit; calling `unref()` lets the parent exit without waiting on
  * it.
@@ -16,59 +15,88 @@
  * debugger. Respawning from our own `process.argv` works regardless
  * of launch method.
  *
- * Shutdown is done by raising SIGTERM on ourselves rather than
- * `process.exit(0)` so the existing graceful-shutdown handler runs
- * (`await frontend.stop()`, flush sessions, remove PID file). The
- * brief overlap between the new child binding Telegram's long-poll
- * and the old one releasing it is benign — grammy retries on 409
- * Conflict and the new child takes over within a few seconds.
+ * Ordering matters. `respawnSelf()` only *arms* the handoff and
+ * raises SIGTERM; the successor is spawned by `spawnSuccessor()` at
+ * the tail of graceful shutdown, once the frontends have stopped.
+ * Spawning up-front (the previous behaviour) left the successor
+ * long-polling `getUpdates` while the outgoing process was still
+ * draining in-flight queries — up to DRAIN_TIMEOUT_MS of two live
+ * pollers. Telegram answers only one of them and re-delivers the
+ * unconfirmed updates to the other, so a restart mid-turn produced
+ * a 409 Conflict on the way out and duplicate replies on the way in.
+ * Releasing the poll before the successor binds it removes the
+ * overlap rather than relying on grammy's 409 retry to paper over it.
  */
 
 import { spawn } from "node:child_process";
 import { log, logError } from "./log.js";
 
+let pendingReason: string | null = null;
+
 /**
- * Respawn the current process with identical argv + flags, then
- * raise SIGTERM on ourselves so the existing graceful-shutdown path
- * cleanly stops the frontend, flushes state, and exits.
+ * Arm a respawn and raise SIGTERM on ourselves so the existing
+ * graceful-shutdown path cleanly stops the frontends, flushes state,
+ * and hands off via `spawnSuccessor()`.
  *
  * `reason` is logged for operator visibility (e.g. "telegram
- * /restart"). The function returns immediately; the actual exit
- * happens asynchronously once the child has spawned (or failed).
+ * /restart"). The function returns immediately; the successor starts
+ * only after shutdown has released the Telegram long-poll.
  */
 export function respawnSelf(reason: string): void {
   log("shutdown", `Respawn requested (${reason})`);
+  pendingReason = reason;
+  // SIGTERM triggers the graceful-shutdown handler in src/app.ts,
+  // which stops the frontends, flushes state, spawns the successor,
+  // and calls process.exit(0). Don't exit here directly — that would
+  // skip the flush and leave the PID file dangling.
+  process.kill(process.pid, "SIGTERM");
+}
 
-  const child = spawn(
-    process.argv[0],
-    [...process.execArgv, ...process.argv.slice(1)],
-    {
-      cwd: process.cwd(),
-      detached: true,
-      stdio: "ignore",
-      env: { ...process.env },
-    },
-  );
+/** True when a `/restart` or `/update` armed a handoff. */
+export function respawnRequested(): boolean {
+  return pendingReason !== null;
+}
 
-  child.once("spawn", () => {
-    log("shutdown", `Respawn child started (pid ${child.pid}) — exiting self`);
-    child.unref();
-    // SIGTERM triggers the existing graceful-shutdown handler in
-    // src/index.ts, which stops the frontend, flushes state, and
-    // calls process.exit(0). Don't exit here directly — that would
-    // skip the flush and leave the PID file dangling.
-    process.kill(process.pid, "SIGTERM");
-  });
+/**
+ * Spawn the successor process. Called at the end of graceful
+ * shutdown, after the frontends have stopped — so the incoming
+ * process binds Telegram's long-poll only once this one has let go
+ * of it. No-op unless `respawnSelf()` armed a handoff.
+ *
+ * Never throws: a failed handoff must not prevent this process from
+ * exiting. An external supervisor (systemd, pm2, the user's
+ * terminal) can pick things up.
+ */
+export function spawnSuccessor(): void {
+  if (pendingReason === null) return;
+  const reason = pendingReason;
+  pendingReason = null;
 
-  child.once("error", (err) => {
+  try {
+    const child = spawn(
+      process.argv[0],
+      [...process.execArgv, ...process.argv.slice(1)],
+      {
+        cwd: process.cwd(),
+        detached: true,
+        stdio: "ignore",
+        env: { ...process.env },
+      },
+    );
+    child.once("error", (err) => {
+      logError(
+        "shutdown",
+        `Respawn failed; exiting without a successor — restart manually`,
+        err,
+      );
+    });
+    child.unref();
+    log("shutdown", `Respawn child started (pid ${child.pid}) — ${reason}`);
+  } catch (err) {
     logError(
       "shutdown",
       `Respawn failed; exiting without a successor — restart manually`,
       err,
     );
-    // The child never started, so we can't hand off. Still exit so
-    // any external supervisor (systemd, pm2, the user's terminal)
-    // can pick things up.
-    process.kill(process.pid, "SIGTERM");
-  });
+  }
 }