tokmon 0.28.0 → 0.28.2

package/dist/{chunk-E2YXYU73.js → chunk-HP5UZCXP.js}

@@ -26,6 +26,7 @@ var DEFAULTS = {
   defaultFocus: "all",
   ascii: "auto",
   allowNetworkAccess: false,
+  allowedHosts: [],
   resetDisplay: "relative",
   knownProviders: []
 };
@@ -147,6 +148,27 @@ function sameJson(a, b) {
     return false;
   }
 }
+function normalizeAllowedHost(value) {
+  if (typeof value !== "string") return null;
+  const candidate = value.trim();
+  if (!candidate) return null;
+  try {
+    const url = new URL(`http://${candidate}`);
+    if (url.username || url.password || url.port || url.pathname !== "/" || url.search || url.hash) return null;
+    const hostname = url.hostname.toLowerCase().replace(/\.$/, "");
+    if (!hostname || hostname.length > 253 || hostname.includes("*")) return null;
+    const labels = hostname.split(".");
+    if (labels.some((label) => !label || label.length > 63 || !/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(label))) return null;
+    return hostname;
+  } catch {
+    return null;
+  }
+}
+function normalizeAllowedHosts(value) {
+  if (!Array.isArray(value)) return [];
+  const hosts = value.map(normalizeAllowedHost).filter((host) => host !== null);
+  return [...new Set(hosts)];
+}
 function repairConfig(input) {
   const reasons = [];
   const parsed = isRecord(input) ? input : {};
@@ -192,6 +214,10 @@ function repairConfig(input) {
   if (parsed.knownProviders !== void 0 && !Array.isArray(parsed.knownProviders)) {
     reasons.push("knownProviders was not an array");
   }
+  const allowedHosts = normalizeAllowedHosts(parsed.allowedHosts);
+  if (parsed.allowedHosts !== void 0 && !sameJson(parsed.allowedHosts, allowedHosts)) {
+    reasons.push("allowedHosts contained invalid or duplicate hostnames");
+  }
   const activeAccountId = typeof parsed.activeAccountId === "string" && (accountIds.has(parsed.activeAccountId) || PROVIDER_IDS.includes(parsed.activeAccountId)) ? parsed.activeAccountId : null;
   if (parsed.activeAccountId !== void 0 && parsed.activeAccountId !== null && activeAccountId === null) {
     reasons.push("activeAccountId did not match a known account/provider");
@@ -217,6 +243,7 @@ function repairConfig(input) {
     defaultFocus: parsed.defaultFocus === "last" ? "last" : "all",
     ascii: parsed.ascii === "on" ? "on" : parsed.ascii === "off" ? "off" : "auto",
     allowNetworkAccess: parsed.allowNetworkAccess === true,
+    allowedHosts,
     resetDisplay: parsed.resetDisplay === "absolute" ? "absolute" : "relative",
     knownProviders
   };
@@ -389,6 +416,8 @@ export {
   getTrackedAccountRows,
   clampNum,
   isValidTimezone,
+  normalizeAllowedHost,
+  normalizeAllowedHosts,
   repairConfig,
   normalizeConfig,
   slugify,

package/dist/{chunk-QM5E5RJZ.js → chunk-J3JW3RFP.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   cacheDir
-} from "./chunk-E2YXYU73.js";
+} from "./chunk-HP5UZCXP.js";
 
 // src/web/lockfile.ts
 import { closeSync, fchmodSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
@@ -23,7 +23,7 @@ function isLoopbackUrl(value) {
 }
 function validLock(value) {
   const lock = value;
-  return !!lock && typeof lock.pid === "number" && Number.isInteger(lock.pid) && lock.pid > 0 && typeof lock.port === "number" && Number.isInteger(lock.port) && lock.port >= 0 && lock.port <= 65535 && typeof lock.url === "string" && (lock.state === "starting" || isLoopbackUrl(lock.url)) && typeof lock.wsToken === "string" && lock.wsToken.length >= 32 && typeof lock.version === "string" && typeof lock.startedAt === "number" && typeof lock.ownerId === "string" && lock.ownerId.length >= 32 && (lock.state === "starting" || lock.state === "ready");
+  return !!lock && typeof lock.pid === "number" && Number.isInteger(lock.pid) && lock.pid > 0 && typeof lock.port === "number" && Number.isInteger(lock.port) && lock.port >= 0 && lock.port <= 65535 && typeof lock.url === "string" && (lock.state === "starting" || isLoopbackUrl(lock.url)) && typeof lock.wsToken === "string" && lock.wsToken.length >= 32 && typeof lock.version === "string" && typeof lock.protocolVersion === "number" && Number.isSafeInteger(lock.protocolVersion) && lock.protocolVersion >= 1 && Array.isArray(lock.capabilities) && lock.capabilities.every((capability) => typeof capability === "string") && (lock.ownerKind === "cli" || lock.ownerKind === "desktop") && typeof lock.startedAt === "number" && typeof lock.ownerId === "string" && lock.ownerId.length >= 32 && (lock.state === "starting" || lock.state === "ready");
 }
 function readLock(opts = {}) {
   try {
@@ -161,7 +161,10 @@ function isAlive(pid) {
     return err.code === "EPERM";
   }
 }
-async function probeHealth(url, token, version, timeoutMs = 500) {
+function sameCapabilities(actual, expected) {
+  return Array.isArray(actual) && actual.length === expected.length && actual.every((capability, index) => capability === expected[index]);
+}
+async function probeHealth(url, token, expected = {}, timeoutMs = 500) {
   if (!isLoopbackUrl(url) || !token) return false;
   try {
     const res = await fetch(`${url.replace(/\/+$/, "")}/healthz`, {
@@ -170,14 +173,14 @@ async function probeHealth(url, token, version, timeoutMs = 500) {
     });
     if (!res.ok) return false;
     const body = await res.json();
-    return body.ok === true && body.owner === true && (version === void 0 || body.version === version);
+    return body.ok === true && body.owner === true && (expected.version === void 0 || body.version === expected.version) && (expected.protocolVersion === void 0 || body.protocolVersion === expected.protocolVersion) && (expected.capabilities === void 0 || sameCapabilities(body.capabilities, expected.capabilities)) && (expected.ownerKind === void 0 || body.ownerKind === expected.ownerKind);
   } catch {
     return false;
   }
 }
-async function verifyLock(lock, version, timeoutMs) {
-  if (!lock || lock.state !== "ready" || lock.version !== version || !isAlive(lock.pid)) return null;
-  return await probeHealth(lock.url, lock.wsToken, version, timeoutMs) ? lock : null;
+async function verifyLock(lock, protocolVersion, timeoutMs) {
+  if (!lock || lock.state !== "ready" || lock.protocolVersion !== protocolVersion || !isAlive(lock.pid)) return null;
+  return await probeHealth(lock.url, lock.wsToken, lock, timeoutMs) ? lock : null;
 }
 
 export {

package/dist/{chunk-IWKSA64G.js → chunk-LCAHTRGP.js}

@@ -5,7 +5,7 @@ import {
   envDir,
   expandHome,
   isValidTimezone
-} from "./chunk-E2YXYU73.js";
+} from "./chunk-HP5UZCXP.js";
 
 // src/async.ts
 var DEFAULT_TIMEOUT_MS = 3e4;
@@ -739,242 +739,6 @@ function coalesceTables(list) {
   return mergeTables(list);
 }
 
-// src/rpc/contract.ts
-import { Schema } from "effect";
-import * as Rpc from "effect/unstable/rpc/Rpc";
-import * as RpcGroup from "effect/unstable/rpc/RpcGroup";
-var TOKMON_WS_PATH = "/ws";
-var TOKMON_PROTOCOL_VERSION = 2;
-var TOKMON_CAPABILITIES = ["config-cas", "config-revision"];
-var TOKMON_WS_METHODS = {
-  getConfig: "tokmon.getConfig",
-  setConfig: "tokmon.setConfig",
-  refresh: "tokmon.refresh",
-  browseFs: "tokmon.browseFs",
-  snapshot: "tokmon.snapshot",
-  config: "tokmon.config"
-};
-var RefreshScopeSchema = Schema.Literals([
-  "all",
-  "summary",
-  "table",
-  "billing",
-  "peak"
-]);
-var ProviderIdSchema = Schema.Literals(PROVIDER_IDS);
-var NonNegativeIntegerSchema = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0));
-var PositiveFiniteSchema = Schema.Finite.check(Schema.isGreaterThanOrEqualTo(1));
-var AccountSchema = Schema.Struct({
-  id: Schema.String,
-  providerId: ProviderIdSchema,
-  name: Schema.String,
-  homeDir: Schema.String,
-  color: Schema.optionalKey(Schema.String)
-});
-var ConfigSchema = Schema.Struct({
-  revision: NonNegativeIntegerSchema,
-  interval: PositiveFiniteSchema,
-  billingInterval: PositiveFiniteSchema,
-  clearScreen: Schema.Boolean,
-  privacyMode: Schema.Boolean,
-  privacyToggleKey: Schema.String,
-  timezone: Schema.NullOr(Schema.String),
-  accounts: Schema.Array(AccountSchema),
-  activeAccountId: Schema.NullOr(Schema.String),
-  disabledProviders: Schema.Array(ProviderIdSchema),
-  onboarded: Schema.Boolean,
-  dashboardLayout: Schema.Literals(["grid", "single"]),
-  defaultFocus: Schema.Literals(["all", "last"]),
-  ascii: Schema.Literals(["auto", "on", "off"]),
-  allowNetworkAccess: Schema.Boolean,
-  resetDisplay: Schema.Literals(["relative", "absolute"]),
-  knownProviders: Schema.Array(ProviderIdSchema)
-});
-var ProtocolInfoSchema = Schema.Struct({
-  version: Schema.Literal(TOKMON_PROTOCOL_VERSION),
-  // Capabilities are additive within a protocol version. Older clients must
-  // preserve forward compatibility when a newer daemon advertises one they do
-  // not understand yet.
-  capabilities: Schema.Array(Schema.String)
-});
-var ConfigStateSchema = Schema.Struct({
-  protocol: ProtocolInfoSchema,
-  config: ConfigSchema
-});
-var ConfigUpdateRequestSchema = Schema.Struct({
-  expectedRevision: NonNegativeIntegerSchema,
-  config: ConfigSchema
-});
-var ConfigUpdateConflictSchema = Schema.Struct({
-  kind: Schema.Literal("conflict"),
-  state: ConfigStateSchema
-});
-var ConfigPersistenceFailureSchema = Schema.Struct({
-  kind: Schema.Literal("persistence"),
-  message: Schema.String
-});
-var FsEntrySchema = Schema.Struct({
-  name: Schema.String,
-  path: Schema.String,
-  dir: Schema.Boolean
-});
-var FsListingSchema = Schema.Struct({
-  path: Schema.String,
-  parent: Schema.NullOr(Schema.String),
-  entries: Schema.Array(FsEntrySchema)
-});
-var UsageSummarySchema = Schema.Struct({
-  cost: Schema.Finite,
-  tokens: Schema.Finite,
-  input: Schema.Finite,
-  cacheRead: Schema.Finite,
-  cacheSavings: Schema.Finite
-});
-var ModelDetailSchema = Schema.Struct({
-  name: Schema.String,
-  input: Schema.Finite,
-  output: Schema.Finite,
-  cacheCreate: Schema.Finite,
-  cacheRead: Schema.Finite,
-  cacheSavings: Schema.Finite,
-  cost: Schema.Finite,
-  count: Schema.Finite
-});
-var TableRowSchema = Schema.Struct({
-  label: Schema.String,
-  models: Schema.Array(Schema.String),
-  input: Schema.Finite,
-  output: Schema.Finite,
-  cacheCreate: Schema.Finite,
-  cacheRead: Schema.Finite,
-  cacheSavings: Schema.Finite,
-  total: Schema.Finite,
-  cost: Schema.Finite,
-  count: Schema.Finite,
-  breakdown: Schema.Array(ModelDetailSchema)
-});
-var DashboardDataSchema = Schema.Struct({
-  today: UsageSummarySchema,
-  week: UsageSummarySchema,
-  month: UsageSummarySchema,
-  burnRate: Schema.Finite,
-  series: Schema.Array(Schema.Finite)
-});
-var TableDataSchema = Schema.Struct({
-  daily: Schema.Array(TableRowSchema),
-  weekly: Schema.Array(TableRowSchema),
-  monthly: Schema.Array(TableRowSchema)
-});
-var MetricFormatSchema = Schema.Union([
-  Schema.Struct({ kind: Schema.Literal("percent") }),
-  Schema.Struct({ kind: Schema.Literal("dollars"), currency: Schema.optionalKey(Schema.String) }),
-  Schema.Struct({ kind: Schema.Literal("count"), suffix: Schema.optionalKey(Schema.String) })
-]);
-var MetricSchema = Schema.Struct({
-  label: Schema.String,
-  used: Schema.Finite,
-  limit: Schema.NullOr(Schema.Finite),
-  format: MetricFormatSchema,
-  resetsAt: Schema.optionalKey(Schema.NullOr(Schema.String)),
-  primary: Schema.optionalKey(Schema.Boolean)
-});
-var BillingResultSchema = Schema.Struct({
-  plan: Schema.NullOr(Schema.String),
-  metrics: Schema.Array(MetricSchema),
-  error: Schema.NullOr(Schema.String),
-  email: Schema.optionalKey(Schema.NullOr(Schema.String)),
-  displayName: Schema.optionalKey(Schema.NullOr(Schema.String)),
-  activity: Schema.optionalKey(Schema.NullOr(Schema.Struct({
-    series: Schema.Array(Schema.Finite),
-    summary: Schema.String
-  }))),
-  modelSpend: Schema.optionalKey(Schema.NullOr(Schema.Array(Schema.Struct({
-    name: Schema.String,
-    usd: Schema.Finite,
-    requests: Schema.Finite
-  })))),
-  asOfMs: Schema.optionalKey(Schema.Finite)
-});
-var WebAccountSchema = Schema.Struct({
-  id: Schema.String,
-  providerId: ProviderIdSchema,
-  name: Schema.String,
-  color: Schema.String,
-  homeDir: Schema.NullOr(Schema.String),
-  hasUsage: Schema.Boolean,
-  hasBilling: Schema.Boolean,
-  email: Schema.optionalKey(Schema.NullOr(Schema.String)),
-  displayName: Schema.optionalKey(Schema.NullOr(Schema.String)),
-  plan: Schema.optionalKey(Schema.NullOr(Schema.String)),
-  dashboard: Schema.NullOr(DashboardDataSchema),
-  table: Schema.NullOr(TableDataSchema),
-  billing: Schema.NullOr(BillingResultSchema),
-  summaryState: Schema.Literals(["pending", "ready", "error"]),
-  billingState: Schema.Literals(["pending", "ready", "error"]),
-  tableState: Schema.Literals(["pending", "ready", "error"]),
-  summaryUpdatedAt: Schema.optionalKey(Schema.NullOr(NonNegativeIntegerSchema)),
-  billingUpdatedAt: Schema.optionalKey(Schema.NullOr(NonNegativeIntegerSchema)),
-  tableUpdatedAt: Schema.optionalKey(Schema.NullOr(NonNegativeIntegerSchema))
-});
-var WebSnapshotSchema = Schema.Struct({
-  version: Schema.String,
-  generatedAt: NonNegativeIntegerSchema,
-  tz: Schema.String,
-  intervalMs: PositiveFiniteSchema,
-  billingIntervalMs: Schema.optionalKey(PositiveFiniteSchema),
-  providers: Schema.Array(Schema.Struct({
-    id: ProviderIdSchema,
-    name: Schema.String,
-    color: Schema.String
-  })),
-  accounts: Schema.Array(WebAccountSchema),
-  seeded: Schema.Boolean,
-  peak: Schema.NullOr(Schema.Struct({
-    state: Schema.Literals(["peak", "off-peak", "weekend"]),
-    label: Schema.String,
-    // The upstream clock is only normalized to a finite number; do not make
-    // the wire contract narrower than the producer's declared type.
-    minutesUntilChange: Schema.NullOr(Schema.Finite),
-    changesAt: Schema.optionalKey(Schema.NullOr(Schema.String))
-  }))
-});
-var EmptyPayloadSchema = Schema.Struct({});
-var GetConfigRpc = Rpc.make(TOKMON_WS_METHODS.getConfig, {
-  payload: EmptyPayloadSchema,
-  success: ConfigStateSchema
-});
-var SetConfigRpc = Rpc.make(TOKMON_WS_METHODS.setConfig, {
-  payload: ConfigUpdateRequestSchema,
-  success: ConfigStateSchema,
-  error: Schema.Union([ConfigUpdateConflictSchema, ConfigPersistenceFailureSchema])
-});
-var RefreshRpc = Rpc.make(TOKMON_WS_METHODS.refresh, {
-  payload: Schema.Struct({ scope: RefreshScopeSchema }),
-  success: Schema.Void
-});
-var BrowseFsRpc = Rpc.make(TOKMON_WS_METHODS.browseFs, {
-  payload: Schema.Struct({ path: Schema.String }),
-  success: FsListingSchema
-});
-var SnapshotRpc = Rpc.make(TOKMON_WS_METHODS.snapshot, {
-  payload: EmptyPayloadSchema,
-  success: WebSnapshotSchema,
-  stream: true
-});
-var ConfigRpc = Rpc.make(TOKMON_WS_METHODS.config, {
-  payload: EmptyPayloadSchema,
-  success: ConfigStateSchema,
-  stream: true
-});
-var TokmonRpcGroup = RpcGroup.make(
-  GetConfigRpc,
-  SetConfigRpc,
-  RefreshRpc,
-  BrowseFsRpc,
-  SnapshotRpc,
-  ConfigRpc
-);
-
 // src/shared/format.ts
 var MONTHS = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
 function formatCurrency(value, opts = {}) {
@@ -1726,13 +1490,14 @@ function timestampSecond(value) {
   const ts = timestampMs(value);
   return ts === null ? null : new Date(ts).toISOString().slice(0, 19);
 }
-async function hasThreadSpawn(path) {
+async function hasForkedHistory(path) {
   let handle = null;
   try {
     handle = await openFile(path, "r");
     const buffer = Buffer.alloc(16 * 1024);
     const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
-    return buffer.subarray(0, bytesRead).includes("thread_spawn");
+    const prefix = buffer.subarray(0, bytesRead).toString("utf8");
+    return prefix.includes("thread_spawn") && /"forked_from_id"\s*:\s*"[^"]+"/.test(prefix);
   } catch {
     return false;
   } finally {
@@ -1740,32 +1505,11 @@ async function hasThreadSpawn(path) {
     });
   }
 }
-async function detectReplaySecond(path) {
-  if (!await hasThreadSpawn(path)) return null;
-  let first = null;
-  const input = createReadStream2(path);
-  input.on("error", () => {
-  });
-  const rl = createInterface2({ input, crlfDelay: Infinity });
-  try {
-    for await (const rawLine of rl) {
-      if (!rawLine.includes("token_count")) continue;
-      try {
-        const line = rawLine.charCodeAt(0) === 65279 ? rawLine.slice(1) : rawLine;
-        const obj = JSON.parse(line);
-        if ((obj?.payload?.type ?? obj?.type) !== "token_count") continue;
-        const info = obj?.payload?.info;
-        if (!normalizeUsage(info?.last_token_usage) && !normalizeUsage(info?.total_token_usage)) continue;
-        const second = timestampSecond(obj.timestamp ?? obj?.payload?.timestamp);
-        if (!second) continue;
-        if (!first) first = second;
-        else return first === second ? second : null;
-      } catch {
-      }
-    }
-  } catch {
-  }
-  return null;
+function isLiveTaskStart(obj) {
+  if ((obj?.payload?.type ?? obj?.type) !== "task_started") return false;
+  const eventSecond = timestampSecond(obj?.timestamp ?? obj?.payload?.timestamp);
+  const startedSecond = timestampSecond(obj?.payload?.started_at);
+  return eventSecond !== null && eventSecond === startedSecond;
 }
 function findUsage(obj) {
   return normalizeUsage(obj?.usage) ?? normalizeUsage(obj?.payload?.usage) ?? normalizeUsage(obj?.payload?.info?.usage) ?? normalizeUsage(obj?.result?.usage) ?? normalizeUsage(obj?.response?.usage) ?? normalizeUsage(obj?.token_usage) ?? normalizeUsage(obj);
@@ -1778,19 +1522,22 @@ async function parseFile2(path) {
   let model = "gpt-5";
   let prevTotal = null;
   let prevSig = null;
-  const replaySecond = await detectReplaySecond(path);
-  let skipReplay = replaySecond !== null;
+  let skipReplay = await hasForkedHistory(path);
   const input = createReadStream2(path);
   input.on("error", () => {
   });
   const rl = createInterface2({ input, crlfDelay: Infinity });
   try {
     for await (const rawLine of rl) {
-      if (!rawLine.includes("token_count") && !rawLine.includes("turn_context") && !rawLine.includes('"usage"') && !rawLine.includes("input_tokens") && !rawLine.includes("prompt_tokens")) continue;
+      if (!rawLine.includes("token_count") && !rawLine.includes("task_started") && !rawLine.includes("turn_context") && !rawLine.includes('"usage"') && !rawLine.includes("input_tokens") && !rawLine.includes("prompt_tokens")) continue;
       try {
         const line = rawLine.charCodeAt(0) === 65279 ? rawLine.slice(1) : rawLine;
         const obj = JSON.parse(line);
         const payloadType = obj?.payload?.type ?? obj?.type;
+        if (skipReplay) {
+          if (isLiveTaskStart(obj)) skipReplay = false;
+          continue;
+        }
         if (payloadType === "turn_context") {
           const m2 = extractModel(obj);
           if (typeof m2 === "string" && m2.trim()) model = m2;
@@ -1826,14 +1573,6 @@ async function parseFile2(path) {
         const total = normalizeUsage(info?.total_token_usage);
         const last = normalizeUsage(info?.last_token_usage);
         const tsValue = obj.timestamp ?? obj?.payload?.timestamp;
-        if (skipReplay && replaySecond) {
-          const second = timestampSecond(tsValue);
-          if (second === replaySecond) {
-            if (total) prevTotal = total;
-            continue;
-          }
-          if (second) skipReplay = false;
-        }
         const sig = eventSig(last, total);
         if (sig === prevSig) continue;
         prevSig = sig;
@@ -4621,11 +4360,6 @@ async function detectProviders() {
 }
 
 export {
-  TOKMON_WS_PATH,
-  TOKMON_PROTOCOL_VERSION,
-  TOKMON_CAPABILITIES,
-  TOKMON_WS_METHODS,
-  TokmonRpcGroup,
   withTimeout,
   systemTimezone,
   resolveTimezone,

package/dist/{chunk-AMD4PXDG.js → chunk-LKYOWBD4.js}

@@ -5,10 +5,10 @@ import {
   readLock,
   reclaimDeadLock,
   verifyLock
-} from "./chunk-QM5E5RJZ.js";
+} from "./chunk-J3JW3RFP.js";
 import {
-  appVersion
-} from "./chunk-SMPY52EV.js";
+  TOKMON_PROTOCOL_VERSION
+} from "./chunk-WUK3MQUB.js";
 
 // src/client/daemon-handle.ts
 import { spawn } from "child_process";
@@ -37,7 +37,7 @@ function runtimeExecArgv(entry, override) {
 function parseHandshake(line) {
   try {
     const value = JSON.parse(line);
-    return value?.ready === 1 && typeof value.url === "string" && typeof value.wsToken === "string" && typeof value.version === "string" ? value : null;
+    return value?.ready === 1 && typeof value.url === "string" && typeof value.wsToken === "string" && typeof value.version === "string" && typeof value.protocolVersion === "number" && Array.isArray(value.capabilities) && value.capabilities.every((capability) => typeof capability === "string") && (value.ownerKind === "cli" || value.ownerKind === "desktop") ? value : null;
   } catch {
     return null;
   }
@@ -46,18 +46,18 @@ function connected(url) {
   return { kind: "spawned", baseUrl: url, stop: () => {
   } };
 }
-async function attach(opts, version) {
-  const lock = await verifyLock(readLock(opts), version);
+async function attach(opts, protocolVersion) {
+  const lock = await verifyLock(readLock(opts), protocolVersion);
   return lock ? connected(lock.url) : null;
 }
 var delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-async function retireIncompatibleDaemon(opts, version, timeoutMs) {
+async function retireIncompatibleDaemon(opts, protocolVersion, timeoutMs) {
   const lock = readLock(opts);
-  if (!lock || lock.state !== "ready" || lock.version === version || lock.pid === process.pid || !isAlive(lock.pid)) return;
+  if (!lock || lock.state !== "ready" || lock.protocolVersion === protocolVersion || lock.ownerKind === "desktop" || lock.pid === process.pid || !isAlive(lock.pid)) return;
   const authenticated = await probeHealth(
     lock.url,
     lock.wsToken,
-    lock.version,
+    lock,
     Math.min(1e3, timeoutMs)
   );
   if (!authenticated) return;
@@ -79,12 +79,12 @@ async function retireIncompatibleDaemon(opts, version, timeoutMs) {
   }
 }
 async function attachOrSpawn(opts = {}) {
-  const version = appVersion();
+  const protocolVersion = TOKMON_PROTOCOL_VERSION;
   const timeoutMs = opts.timeoutMs ?? HANDSHAKE_TIMEOUT_MS;
-  const existing = await attach(opts, version);
+  const existing = await attach(opts, protocolVersion);
   if (existing) return existing;
-  await retireIncompatibleDaemon(opts, version, timeoutMs);
-  const upgraded = await attach(opts, version);
+  await retireIncompatibleDaemon(opts, protocolVersion, timeoutMs);
+  const upgraded = await attach(opts, protocolVersion);
   if (upgraded) return upgraded;
   const entry = opts.entry ?? process.argv[1];
   if (!entry) return degraded();
@@ -117,7 +117,7 @@ async function attachOrSpawn(opts = {}) {
       resolve(handle);
     };
     const tryAttach = (final = false) => {
-      void attach(opts, version).then((found) => {
+      void attach(opts, protocolVersion).then((found) => {
         if (found) {
           finish(found);
           return;
@@ -143,7 +143,7 @@ async function attachOrSpawn(opts = {}) {
         const line = stdout.slice(0, newline).trim();
         stdout = stdout.slice(newline + 1);
         const handshake = parseHandshake(line);
-        if (!handshake || handshake.version !== version) continue;
+        if (!handshake || handshake.protocolVersion !== protocolVersion) continue;
         tryAttach();
         return;
       }

package/dist/{chunk-QOA6KOJQ.js → chunk-M7XMV36F.js}

@@ -3,7 +3,7 @@ import {
   TOKMON_WS_METHODS,
   TOKMON_WS_PATH,
   TokmonRpcGroup
-} from "./chunk-IWKSA64G.js";
+} from "./chunk-WUK3MQUB.js";
 
 // src/client/daemon-rpc-client.ts
 import { Cause, Context, Duration, Effect, Exit, Fiber, Layer, ManagedRuntime, Schedule, Stream } from "effect";