teamshare-bridge 0.22.1 → 0.22.3

package/dist/bridge/service.js

@@ -1,10 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.runDaemon = exports.CRASH_BACKOFF_MS = exports.AUTOSTART_TASK_NAME = exports.LAUNCH_LOG_PATH = exports.LOG_PATH = void 0;
+exports.runDaemon = exports.SINGLETON_SWEEP_EVERY_TICKS = exports.CRASH_BACKOFF_MS = exports.pidInfo = exports.listOurDaemonPids = exports.isOurDaemonProcess = exports.AUTOSTART_TASK_NAME = exports.LAUNCH_LOG_PATH = exports.LOG_PATH = void 0;
 exports.runningPid = runningPid;
 exports.isPortAnswering = isPortAnswering;
-exports.listOurDaemonPids = listOurDaemonPids;
 exports.stopAllDaemons = stopAllDaemons;
+exports.describeRunningDaemon = describeRunningDaemon;
 exports.verifyRunningPid = verifyRunningPid;
 exports.startDaemon = startDaemon;
 exports.crashBackoffMs = crashBackoffMs;
@@ -79,13 +79,7 @@ function runningPid() {
 }
 /** True when a TeamShare daemon answers /ping with ok:true on `port` (sync probe). */
 function probeHealthy(port) {
-    const res = (0, node_child_process_1.spawnSync)(process.execPath, [
-        '-e',
-        `fetch('http://127.0.0.1:${port}/ping',{signal:AbortSignal.timeout(2000)})` +
-            '.then(async r=>{try{const b=await r.json();process.exit(b&&b.ok===true?0:1)}catch{process.exit(1)}})' +
-            '.catch(()=>process.exit(1))',
-    ], { stdio: 'ignore', timeout: 5000, windowsHide: true });
-    return res.status === 0;
+    return (0, daemon_instance_1.probePortAnswering)(port);
 }
 /**
  * True when a TeamShare daemon answers /ping on `port` (for honest status).
@@ -101,6 +95,10 @@ function probeHealthy(port) {
  * fallback port), so a healthy daemon is never mistaken for a zombie - and
  * because it is exclusive, "some daemon is healthy" and "the daemon I asked
  * about is healthy" cannot disagree.
+ *
+ * It is NOT, however, proof that no SECOND daemon is running: that question is
+ * answered by process enumeration in `startDaemon`/`stopDaemon`, which is the
+ * only place that can see a daemon whose lock was lost.
  */
 function daemonHealthy() {
     return (0, daemon_instance_1.resolveDaemonInstanceSync)() !== null;
@@ -109,70 +107,26 @@ function daemonHealthy() {
 function isPortAnswering(port) {
     return probeHealthy(port);
 }
-function pidInfo(pid) {
-    try {
-        if (process.platform === 'win32') {
-            const res = (0, node_child_process_1.spawnSync)('powershell.exe', [
-                '-NoProfile',
-                '-NonInteractive',
-                '-Command',
-                '$n=(Get-Process -Id ' +
-                    pid +
-                    ' -ErrorAction SilentlyContinue).ProcessName; ' +
-                    '$c=(Get-CimInstance Win32_Process -Filter "ProcessId=' +
-                    pid +
-                    '" -ErrorAction SilentlyContinue).CommandLine; ' +
-                    '"$n`t$c"',
-            ], { stdio: 'pipe', encoding: 'utf8', timeout: 5_000, windowsHide: true });
-            const out = (res.stdout ?? '').trim();
-            if (!out)
-                return null;
-            const tab = out.indexOf('\t');
-            const name = (tab >= 0 ? out.slice(0, tab) : out).trim();
-            const cmdline = tab >= 0 ? out.slice(tab + 1).trim() : '';
-            return { name: name || null, cmdline: cmdline || null };
-        }
-        const res = (0, node_child_process_1.spawnSync)('ps', ['-p', String(pid), '-o', 'args='], {
-            stdio: 'pipe',
-            encoding: 'utf8',
-            timeout: 5_000,
-        });
-        const out = (res.stdout ?? '').trim();
-        if (!out || out === 'args=')
-            return null;
-        return { name: null, cmdline: out };
-    }
-    catch {
-        return null;
-    }
-}
 /**
- * True only when the pid is verifiably a TeamShare daemon process.
- * `node …/index.js daemon` (or a teamshare path containing `daemon`).
- * false = foreign process (PID reuse) — NEVER kill it, just clear the pid file.
- * null = unqueryable/gone — treated as not-ours for killing purposes.
+ * Best-effort identity of a pid: image name + command line. null = process
+ * gone or unqueryable - never treat as "ours to kill".
+ *
+ * Re-exported from `daemon-instance`, which owns process identity for the whole
+ * daemon lifecycle: `listOurDaemonPids` and the boot guard must agree with
+ * `stopDaemon` about what "our daemon" means, and two copies of that test is
+ * how they drift apart.
  */
-function isOurDaemonProcess(pid) {
-    const info = pidInfo(pid);
-    if (!info)
-        return null;
-    // Name first: a recycled pid held by a foreign process (GameInputSvc,
-    // services, …) is NEVER ours, even when its command line is unqueryable.
-    if (info.name && !/^node(?:\.exe)?$/i.test(info.name))
-        return false;
-    if (info.cmdline) {
-        return /(index\.js|teamshare)/i.test(info.cmdline) && /\bdaemon\b/i.test(info.cmdline);
-    }
-    // node-ish but cmdline denied — caller falls back to runtime.json.
-    return null;
-}
+var daemon_instance_2 = require("./daemon-instance");
+Object.defineProperty(exports, "isOurDaemonProcess", { enumerable: true, get: function () { return daemon_instance_2.isOurDaemonProcess; } });
+Object.defineProperty(exports, "listOurDaemonPids", { enumerable: true, get: function () { return daemon_instance_2.listOurDaemonPids; } });
+Object.defineProperty(exports, "pidInfo", { enumerable: true, get: function () { return daemon_instance_2.pidInfo; } });
 /**
  * Identity decision before killing a pid from the pid file:
  * ours (cmdline match, or runtime.json agrees while cmdline is unqueryable)
  * → kill allowed; anything else → clear the stale file, kill nothing.
  */
 function pidIsOurDaemon(pid) {
-    const identity = isOurDaemonProcess(pid);
+    const identity = (0, daemon_instance_1.isOurDaemonProcess)(pid);
     if (identity === true)
         return true;
     if (identity === false)
@@ -201,192 +155,136 @@ function clearForeignPidFile(pid) {
         /* best-effort */
     }
 }
-/**
- * Every pid on this machine that is VERIFIABLY a TeamShare daemon (2026-10).
- *
- * `daemon.lock` is NOT good enough on its own, and that is the whole reason this
- * exists. During the incident that motivated it, `daemon.lock` held pid 24148
- * (already dead) while THREE real daemons ran on three different ports. Anything
- * that trusts the lock alone — `stopDaemon`, and therefore the auto-upgrade —
- * concludes "daemon is not running", skips the stop, and runs `npm i -g` over a
- * directory that live processes still have open. On Windows that aborts the
- * install with EBUSY on a mapped native DLL and leaves the install HALF-WRITTEN:
- * `socket.io-client/build/cjs/index.js` never gets created, and every subsequent
- * daemon boot dies at require.
- *
- * A pid is returned only when its command line matches `isOurDaemonProcess`, so a
- * recycled pid held by an unrelated program is never returned and can never be
- * killed. The supervisor is excluded by the same test (its argv says `supervisor`,
- * not `daemon`) — an upgrade stops daemons, never the watchdog that restarts them.
- *
- * Unqueryable processes (access denied) are simply absent from the list; callers
- * treat "cannot enumerate" as "cannot confirm", which is the safe direction.
- */
-function listOurDaemonPids() {
-    const out = (() => {
-        if (process.platform === 'win32') {
-            const res = (0, node_child_process_1.spawnSync)('powershell.exe', [
-                '-NoProfile',
-                '-NonInteractive',
-                '-Command',
-                'Get-CimInstance Win32_Process -Filter "Name=\'node.exe\'" | ' +
-                    'ForEach-Object { "$($_.ProcessId)`t$($_.CommandLine)" }',
-            ], { stdio: 'pipe', encoding: 'utf8', timeout: 10_000, windowsHide: true });
-            return res.stdout ?? '';
-        }
-        const res = (0, node_child_process_1.spawnSync)('ps', ['-eo', 'pid=,args='], {
-            stdio: 'pipe',
-            encoding: 'utf8',
-            timeout: 10_000,
-        });
-        return res.stdout ?? '';
-    })();
-    const pids = [];
-    for (const line of out.split(/\r?\n/)) {
-        const tab = line.indexOf('\t');
-        const pid = Number(tab >= 0 ? line.slice(0, tab) : line.slice(0, line.indexOf(' ')).trim());
-        if (!Number.isInteger(pid) || pid <= 0)
-            continue;
-        // Re-use the single-process identity test so "verified" means exactly the same
-        // thing here as it does everywhere else a pid is about to be killed.
-        if (isOurDaemonProcess(pid) === true)
-            pids.push(pid);
-    }
-    return pids;
-}
-/** Terminate one verified daemon pid: SIGTERM, then force on Windows. */
-function killDaemonPid(pid, timeoutMs) {
-    try {
-        process.kill(pid);
-    }
-    catch {
-        /* already gone */
-    }
-    const deadline = Date.now() + timeoutMs;
-    while (pidAlive(pid) && Date.now() < deadline) {
-        /* brief wait for a clean exit */
-    }
-    if (!pidAlive(pid))
-        return true;
-    if (process.platform === 'win32') {
-        // Windows: a detached console node.exe has no window to close politely, so
-        // WM_CLOSE is not an option and /F is the only way.
-        (0, node_child_process_1.spawnSync)('taskkill', ['/pid', String(pid), '/f'], {
-            stdio: 'ignore',
-            windowsHide: true,
-        });
-    }
-    else {
-        try {
-            process.kill(pid, 'SIGKILL');
-        }
-        catch {
-            /* best-effort */
-        }
-    }
-    const hard = Date.now() + 3000;
-    while (pidAlive(pid) && Date.now() < hard) {
-        /* wait for the kill to land */
-    }
-    return !pidAlive(pid);
-}
 /**
  * Stop EVERY verified daemon on this machine, not just the one in the lock.
  *
- * Exists for the auto-upgrade, which must not write over a directory a live
- * process still has mapped (see `listOurDaemonPids`). Returns the pids it could
- * NOT kill, so the caller can ABORT rather than proceed — a half-installed bridge
- * is strictly worse than an out-of-date one.
+ * The auto-upgrade needs this (it must not write over a directory a live process
+ * still has mapped), and so does plain `stop`: a lock-only `stop` is what let
+ * three daemons survive a "daemon is not running" and then break the next
+ * `npm i -g` with EBUSY. Returns the pids it could NOT kill so callers can
+ * ABORT rather than proceed — a half-installed bridge is strictly worse than an
+ * out-of-date one.
  */
 function stopAllDaemons() {
     const stopped = [];
     const survivors = [];
-    for (const pid of listOurDaemonPids()) {
-        if (killDaemonPid(pid, 5000))
+    for (const pid of (0, daemon_instance_1.listOurDaemonPids)()) {
+        if ((0, daemon_instance_1.killDaemonPid)(pid, 5000))
             stopped.push(pid);
         else
             survivors.push(pid);
     }
-    // The lock/runtime files describe a daemon that no longer exists either way;
-    // leaving a stale one behind is what made the next `stopDaemon` a no-op.
-    try {
-        (0, node_fs_1.rmSync)(PID_PATH, { force: true });
-    }
-    catch {
-        /* already gone */
-    }
-    try {
-        (0, daemon_instance_1.clearDaemonLock)();
-    }
-    catch {
-        /* already gone */
+    // Only clear the files when the machine is genuinely free. Clearing them while
+    // a survivor is still running is precisely how a live daemon becomes invisible
+    // and the next start piles a second one on top of it.
+    if (survivors.length === 0) {
+        try {
+            (0, node_fs_1.rmSync)(PID_PATH, { force: true });
+        }
+        catch {
+            /* already gone */
+        }
+        try {
+            (0, daemon_instance_1.clearDaemonLock)();
+        }
+        catch {
+            /* already gone */
+        }
     }
     const message = survivors.length > 0
         ? `${stopped.length} stopped, ${survivors.length} could not be stopped (${survivors.join(', ')})`
         : `stopped ${stopped.length} daemon(s)`;
     return { stopped, survivors, message };
 }
+/**
+ * The honest answer to "is the daemon running?", for READ-ONLY commands.
+ *
+ * `verifyRunningPid` used to answer from `daemon.lock` alone, so a daemon whose
+ * lock had been taken over by a dead pid printed `stopped` while it was serving
+ * every wake on the machine. The lock is still consulted first (it is cheapest
+ * and normally right), but it is no longer the only witness:
+ *
+ *   lock -> runtime.json -> process enumeration.
+ *
+ * Enumeration is last because it is the only one that costs a process query, and
+ * because a pid it finds with no port behind it is a weaker claim than a daemon
+ * that stamped its own lock.
+ */
+function describeRunningDaemon() {
+    const rawLock = (0, daemon_instance_1.readDaemonLockFile)();
+    const lock = (0, daemon_instance_1.readLiveDaemonLock)();
+    const live = (0, daemon_instance_1.listOurDaemonPids)();
+    const runtime = (0, bus_1.readRuntimeFile)();
+    const claimed = (pid) => typeof pid === 'number' && pid > 0 && (live.includes(pid) || pidIsOurDaemon(pid));
+    const stale = rawLock && (!lock || rawLock.pid !== lock.pid) ? rawLock.pid : null;
+    if (lock && pidIsOurDaemon(lock.pid)) {
+        return { pid: lock.pid, source: 'lock', staleLockPid: null, daemonCount: live.length };
+    }
+    if (claimed(runtime?.pid)) {
+        return { pid: runtime.pid, source: 'runtime', staleLockPid: stale, daemonCount: live.length };
+    }
+    if (live.length > 0) {
+        return { pid: live[0], source: 'process', staleLockPid: stale, daemonCount: live.length };
+    }
+    return { pid: null, source: 'none', staleLockPid: stale, daemonCount: 0 };
+}
 /**
  * Live daemon pid WITH an identity check, for an honest `status`: a recycled
  * pid (pid file survives a reboot, Windows hands the number to another
  * process) clears the stale file and reports stopped instead of "running".
  */
 function verifyRunningPid() {
-    const pid = runningPid();
-    if (pid === null)
-        return null;
-    if (!pidIsOurDaemon(pid)) {
-        clearForeignPidFile(pid);
-        return null;
-    }
-    return pid;
+    return describeRunningDaemon().pid;
 }
 /**
  * `start`: spawns the daemon detached (stdio -> ~/.teamshare/daemon.log) and
  * records the pid. `daemon` stays the foreground alias for debugging.
  *
- * IMP-9xx zombie takeover: a pid-file hit alone no longer refuses to start -
- * the instance must also answer /ping. Alive-but-wedged daemons (network
- * stack wedged, event loop stuck) are killed and replaced so `start` always
- * yields a WORKING daemon.
+ * ONE DAEMON, ALWAYS (2026-10). The old version asked the pid file one question
+ * — "is the pid in the file healthy?" — and that is not the question that keeps
+ * a machine clean. A daemon holding no lock (lock expired after 24h, cleared by
+ * a half-written install, unreadable) is invisible to it, so every 30s the
+ * watchdog answered "no daemon" and spawned another: three were alive at once,
+ * and `npm i -g` over their still-mapped native DLL failed with EBUSY and left
+ * the bridge unusable.
+ *
+ * So the question is now "which verified daemon processes exist, and does one of
+ * them answer?" (`reconcileSingleton`), and its three answers are the only
+ * outcomes:
+ *   - a healthy daemon is already there  -> adopt it and return it
+ *   - processes exist but nothing answers -> stop them all, spawn one
+ *   - nothing at all                      -> spawn one
  */
 function startDaemon(port) {
-    const existing = runningPid();
-    if (existing !== null) {
-        // The lock already records the BOUND port, so a fallback-bound daemon is
-        // recognised as healthy even when config.port is busy.
-        if (daemonHealthy()) {
-            return { started: false, pid: existing, message: `daemon already running (pid ${existing})` };
-        }
-        // Identity guard: only kill a pid we can VERIFY is our daemon — a
-        // recycled pid pointing at an innocent process must never be taskkill'd.
-        if (!pidIsOurDaemon(existing)) {
-            clearForeignPidFile(existing);
-            // Fall through: spawn a fresh daemon (the foreign pid does not own our probe port).
+    const recon = (0, daemon_instance_1.reconcileSingleton)();
+    if (recon.decision.action === 'keep' && recon.decision.keep !== null) {
+        return {
+            started: false,
+            pid: recon.decision.keep,
+            message: `daemon already running (pid ${recon.decision.keep})${recon.stopped.length > 0 ? ` - stopped ${recon.stopped.length} duplicate(s): ${recon.stopped.join(', ')}` : ''}`,
+        };
+    }
+    if (recon.decision.action === 'blocked') {
+        return { started: false, message: recon.message };
+    }
+    if (recon.stopped.length > 0 || recon.decision.action === 'replace') {
+        // Logged, not swallowed: a machine that had to be reconciled is exactly the
+        // machine whose next `npm i -g` needs looking at.
+        try {
+            (0, node_fs_1.appendFileSync)(exports.LOG_PATH, `[${new Date().toISOString()}] [service] singleton reconcile: ${recon.message}\n`, 'utf8');
         }
-        else {
-            // Wedged zombie - replace it.
-            try {
-                process.kill(existing);
-            }
-            catch {
-                /* already gone */
-            }
-            const deadline = Date.now() + 3000;
-            while (pidAlive(existing) && Date.now() < deadline) {
-                /* brief wait */
-            }
-            if (pidAlive(existing)) {
-                (0, node_child_process_1.spawnSync)('taskkill', ['/pid', String(existing), '/f'], { stdio: 'ignore', windowsHide: true });
-            }
-            try {
-                (0, node_fs_1.rmSync)(PID_PATH);
-            }
-            catch {
-                /* best-effort */
-            }
+        catch {
+            /* best-effort */
         }
     }
+    if (recon.survivors.length > 0) {
+        return {
+            started: false,
+            message: `refusing to start: ${recon.survivors.length} TeamShare daemon process(es) ` +
+                `(${recon.survivors.join(', ')}) could not be stopped. Installing/starting over a ` +
+                `live tree is what produces an unusable bridge - retry once they are gone.`,
+        };
+    }
     const args = [(0, node_path_1.join)(__dirname, 'index.js'), 'daemon'];
     if (port)
         args.push('--port', String(port));
@@ -500,6 +398,15 @@ const CRASH_LOOP_THRESHOLD = 3;
  * bridge back within one cycle instead of needing a reboot.
  */
 exports.CRASH_BACKOFF_MS = [0, 30_000, 60_000, 120_000, 300_000];
+/**
+ * Healthy watchdog ticks between duplicate sweeps (~5 min at the 30s cadence).
+ *
+ * Exported for the unit test. Enumerating processes is not free (one PowerShell
+ * call), so it must not run every tick — but it must run periodically, because
+ * "one healthy lock" and "one daemon" are different facts and only the second
+ * one is the invariant.
+ */
+exports.SINGLETON_SWEEP_EVERY_TICKS = 10;
 /** The wait before attempt `streak + 1`, clamped to the table. */
 function crashBackoffMs(streak) {
     if (streak <= 0)
@@ -515,6 +422,8 @@ function runSupervisor(intervalMs = 30_000) {
     let lastAttemptAt = 0;
     /** One diagnostic per crash-loop episode, not one per attempt. */
     let crashLoopReported = false;
+    /** Healthy ticks since the last duplicate sweep. */
+    let ticksSinceSweep = 0;
     const appendWatchdogLog = (line) => {
         try {
             (0, node_fs_1.appendFileSync)(exports.LOG_PATH, `[${new Date().toISOString()}] [watchdog] ${line}\n`, 'utf8');
@@ -555,6 +464,32 @@ function runSupervisor(intervalMs = 30_000) {
         }
         process.exit(1);
     });
+    /**
+     * A healthy lock does NOT mean the machine holds one daemon — only that one of
+     * them owns the lock. This is the sweep that makes "exactly one" true over
+     * time instead of only at the moment someone runs `start`.
+     *
+     * Cost matters: it runs on the 30s tick, so the steady state is ONE process
+     * enumeration every `SWEEP_EVERY_HEALTHY_TICKS` ticks (~5 min), and the
+     * expensive part (port probes + kills) only runs when a duplicate is actually
+     * found. Without it, a lockless second daemon — the exact state this machine
+     * sat in for hours — survives every tick, because a healthy lock makes the
+     * watchdog return early.
+     */
+    const sweepDuplicates = () => {
+        try {
+            const live = (0, daemon_instance_1.listOurDaemonPids)();
+            if (live.length <= 1)
+                return;
+            const recon = (0, daemon_instance_1.reconcileSingleton)();
+            appendWatchdogLog(recon.stopped.length > 0 || recon.decision.action !== 'keep'
+                ? `singleton sweep: ${recon.message}`
+                : `singleton sweep found ${live.length} daemons but kept ${recon.decision.keep} - ${recon.message}`);
+        }
+        catch {
+            /* never die */
+        }
+    };
     const tick = () => {
         try {
             // A silent auto-upgrade helper owns the machine while it runs
@@ -571,8 +506,17 @@ function runSupervisor(intervalMs = 30_000) {
                     crashStreak = 0;
                     crashLoopReported = false;
                 }
+                // Periodic duplicate sweep: a healthy lock says nothing about a SECOND,
+                // lockless daemon, and this machine ran three for hours because every
+                // tick returned early on that healthy lock.
+                ticksSinceSweep += 1;
+                if (ticksSinceSweep >= exports.SINGLETON_SWEEP_EVERY_TICKS) {
+                    ticksSinceSweep = 0;
+                    sweepDuplicates();
+                }
                 return;
             }
+            ticksSinceSweep = 0;
             // ── CRASH-LOOP DETECTION (2026-10) ───────────────────────────────────
             // A daemon that dies within seconds of starting is not a daemon to keep
             // respawning — it is a broken INSTALL. Observed: 262 restarts at an exact
@@ -628,53 +572,38 @@ function runSupervisor(intervalMs = 30_000) {
     tick();
     setInterval(tick, intervalMs);
 }
-/** `stop`: terminates the live daemon and clears the pid file. */
+/**
+ * `stop`: terminates EVERY verified daemon on this machine and clears the files.
+ *
+ * It used to signal exactly one pid — the one in `daemon.lock` — and report
+ * `daemon is not running` whenever that file was stale. That is precisely how
+ * three daemons survived a `stop` on this machine: the human ran it, saw
+ * "daemon is not running", and the three survivors kept their native DLLs
+ * mapped, so the next `npm i -g` aborted with EBUSY and left the install
+ * half-written (every later boot died on a missing
+ * `socket.io-client/build/cjs/index.js`).
+ *
+ * `stop` now asks the OS, not the file. `restart` inherits that, which is why a
+ * restart can no longer leave the old daemon behind to collide with the new one.
+ */
 function stopDaemon() {
-    const pid = runningPid();
-    if (pid === null) {
-        try {
-            (0, node_fs_1.rmSync)(PID_PATH);
-        }
-        catch {
-            /* already gone */
-        }
+    const claimed = runningPid();
+    if (claimed !== null && !pidIsOurDaemon(claimed)) {
+        // Identity guard: never signal a pid that is not verifiably our daemon. The
+        // stale file is cleared, and we still go on to enumerate - the real daemon
+        // may be a different, lockless pid.
+        clearForeignPidFile(claimed);
+    }
+    const result = stopAllDaemons();
+    if (result.stopped.length === 0 && result.survivors.length === 0) {
         return { stopped: false, message: 'daemon is not running' };
     }
-    // Identity guard: never signal a pid that is not verifiably our daemon.
-    if (!pidIsOurDaemon(pid)) {
-        clearForeignPidFile(pid);
-        return { stopped: false, message: `pid ${pid} is not a TeamShare daemon (PID reuse) - pid file cleared, nothing killed` };
-    }
-    try {
-        process.kill(pid);
-    }
-    catch {
-        /* best-effort */
-    }
-    const deadline = Date.now() + 5000;
-    while (pidAlive(pid) && Date.now() < deadline) {
-        /* wait briefly for the daemon to exit */
-    }
-    if (pidAlive(pid)) {
-        if (process.platform === 'win32') {
-            // Windows: force kill via taskkill.
-            (0, node_child_process_1.spawnSync)('taskkill', ['/pid', String(pid), '/f'], { stdio: 'ignore', windowsHide: true });
-        }
-        else {
-            // POSIX: SIGKILL if SIGTERM didn't work.
-            try {
-                process.kill(pid, 'SIGKILL');
-            }
-            catch { /* best-effort */ }
-        }
-    }
-    try {
-        (0, node_fs_1.rmSync)(PID_PATH);
-    }
-    catch {
-        /* already gone */
-    }
-    return { stopped: true, message: `daemon stopped (pid ${pid})` };
+    return {
+        stopped: result.survivors.length === 0,
+        message: result.survivors.length > 0
+            ? `${result.message} - the machine is NOT clean; do not run npm install -g teamshare-bridge until they are gone`
+            : `daemon stopped (${result.stopped.length} process(es): ${result.stopped.join(', ')})`,
+    };
 }
 /** `restart`: stop + start. */
 function restartDaemon(port) {