tokmon 0.28.1 → 0.28.3

package/dist/{chunk-S33XIUAW.js → chunk-P57DVFNH.js}

@@ -1,28 +1,32 @@
 #!/usr/bin/env node
 import {
-  appVersion,
-  findWebRoot,
-  send,
-  sendJson,
-  serveStatic
-} from "./chunk-SMPY52EV.js";
+  resolveDaemonChannel
+} from "./chunk-UYPDMVW5.js";
 import {
   buildAccounts,
   colorHex,
+  deriveAccountIdentity,
+  deriveProviderHeadroom,
+  deriveQuotaViews,
   fetchPeak,
   namedHex
-} from "./chunk-FMP3P2WV.js";
+} from "./chunk-TN6V7XSL.js";
 import {
   PROVIDERS,
+  detectProviders,
+  resolveTimezone,
+  withTimeout
+} from "./chunk-CFKUZCMB.js";
+import {
+  ConfigPersistenceFailure,
+  ConfigUpdateConflictFailure,
+  RefreshFailure,
   TOKMON_CAPABILITIES,
   TOKMON_PROTOCOL_VERSION,
   TOKMON_WS_METHODS,
   TOKMON_WS_PATH,
-  TokmonRpcGroup,
-  detectProviders,
-  resolveTimezone,
-  withTimeout
-} from "./chunk-CVKCVHS7.js";
+  TokmonRpcGroup
+} from "./chunk-JZSZEHVD.js";
 import {
   cacheDir,
   expandHome,
@@ -30,7 +34,7 @@ import {
   normalizeConfig,
   saveConfig,
   snapshotCacheFile
-} from "./chunk-HP5UZCXP.js";
+} from "./chunk-HNWEJ6MS.js";
 
 // src/web/server.ts
 import { createServer } from "http";
@@ -66,9 +70,13 @@ async function fetchAccountBilling(account, tz) {
   return p.fetchBilling(account, tz);
 }
 function assembleSnapshot(opts) {
+  const providerOrdinals = /* @__PURE__ */ new Map();
   const accounts = opts.resolved.map((r) => {
     const u = opts.usage.get(r.account.id);
     const billing = opts.billing.get(r.account.id) ?? null;
+    const ordinal = (providerOrdinals.get(r.account.providerId) ?? 0) + 1;
+    providerOrdinals.set(r.account.providerId, ordinal);
+    const quotas = deriveQuotaViews(billing?.metrics ?? []);
     return {
       id: r.account.id,
       providerId: r.account.providerId,
@@ -79,7 +87,22 @@ function assembleSnapshot(opts) {
       hasBilling: r.hasBilling,
       email: billing?.email ?? null,
       displayName: billing?.displayName ?? null,
+      identity: deriveAccountIdentity({
+        name: r.account.name,
+        email: billing?.email,
+        displayName: billing?.displayName,
+        providerName: PROVIDERS[r.account.providerId].name,
+        ordinal,
+        privacyMode: opts.config.privacyMode
+      }),
+      quotas,
+      headroom: deriveProviderHeadroom([{
+        id: r.account.id,
+        lastActivityAt: u?.dashboard?.lastActivityAt ?? null,
+        quotas
+      }], opts.config.tray.activeTimeoutMin, Date.now(), opts.config.tray.displayMetric),
       plan: billing?.plan ?? null,
+      lastActivityAt: u?.dashboard?.lastActivityAt ?? null,
       dashboard: u?.dashboard ?? null,
       table: u?.table ?? null,
       billing,
@@ -91,6 +114,12 @@ function assembleSnapshot(opts) {
       tableUpdatedAt: opts.tableUpdatedAt?.get(r.account.id) ?? null
     };
   });
+  const accountsByProvider = /* @__PURE__ */ new Map();
+  for (const account of accounts) {
+    const group = accountsByProvider.get(account.providerId) ?? [];
+    group.push(account);
+    accountsByProvider.set(account.providerId, group);
+  }
   const seen = /* @__PURE__ */ new Set();
   const providers = [];
   for (const r of opts.resolved) {
@@ -99,7 +128,17 @@ function assembleSnapshot(opts) {
     providers.push({
       id: r.account.providerId,
       name: PROVIDERS[r.account.providerId].name,
-      color: namedHex(PROVIDERS[r.account.providerId].color)
+      color: namedHex(PROVIDERS[r.account.providerId].color),
+      headroom: deriveProviderHeadroom(
+        (accountsByProvider.get(r.account.providerId) ?? []).map((account) => ({
+          id: account.id,
+          lastActivityAt: account.lastActivityAt,
+          quotas: account.quotas ?? []
+        })),
+        opts.config.tray.activeTimeoutMin,
+        Date.now(),
+        opts.config.tray.displayMetric
+      )
     });
   }
   return {
@@ -118,22 +157,139 @@ function tzFor(config) {
   return resolveTimezone(config.timezone);
 }
 
+// src/web/static.ts
+import { createReadStream, existsSync, readFileSync } from "fs";
+import { stat } from "fs/promises";
+import { fileURLToPath } from "url";
+import { extname, join, normalize, sep } from "path";
+var MIME = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".ico": "image/x-icon",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ttf": "font/ttf",
+  ".otf": "font/otf",
+  ".map": "application/json; charset=utf-8",
+  ".webmanifest": "application/manifest+json"
+};
+function findWebRoot() {
+  const candidates = ["./web/", "../web/", "../dist/web/", "../../dist/web/"];
+  for (const rel of candidates) {
+    try {
+      const dir = fileURLToPath(new URL(rel, import.meta.url));
+      if (existsSync(join(dir, "index.html"))) return dir.replace(/[\\/]+$/, "");
+    } catch {
+    }
+  }
+  return null;
+}
+function resolveStaticPath(webRoot, urlPath) {
+  let clean;
+  try {
+    clean = decodeURIComponent(urlPath.split("?")[0]);
+  } catch {
+    return null;
+  }
+  const rel = normalize(clean).replace(/^(\.\.[/\\])+/, "").replace(/^[/\\]+/, "");
+  const full = join(webRoot, rel);
+  if (full !== webRoot && !full.startsWith(webRoot + sep)) return null;
+  return full;
+}
+function send(res, status, type, body) {
+  res.writeHead(status, {
+    "Content-Type": type,
+    "Cache-Control": "no-store",
+    "Referrer-Policy": "no-referrer",
+    "X-Content-Type-Options": "nosniff"
+  });
+  res.end(body);
+}
+function sendJson(res, status, data) {
+  send(res, status, "application/json; charset=utf-8", JSON.stringify(data));
+}
+function serveStatic(webRoot, urlPath, res) {
+  const path = urlPath.split("?")[0];
+  const filePath = resolveStaticPath(webRoot, path === "/" ? "/index.html" : path);
+  if (!filePath) {
+    send(res, 403, "text/plain", "forbidden");
+    return;
+  }
+  void stat(filePath).then((st) => {
+    if (st.isFile()) {
+      const type = MIME[extname(filePath).toLowerCase()] || "application/octet-stream";
+      const immutable = filePath.includes(`${sep}assets${sep}`);
+      res.writeHead(200, {
+        "Content-Type": type,
+        "Cache-Control": immutable ? "public, max-age=31536000, immutable" : "no-cache",
+        "Referrer-Policy": "no-referrer",
+        "X-Content-Type-Options": "nosniff"
+      });
+      createReadStream(filePath).pipe(res);
+    } else {
+      throw new Error("not a file");
+    }
+  }).catch(() => {
+    if (extname(path)) {
+      send(res, 404, "text/plain", "not found");
+      return;
+    }
+    const indexPath = join(webRoot, "index.html");
+    if (!existsSync(indexPath)) {
+      send(res, 404, "text/plain", "not found");
+      return;
+    }
+    res.writeHead(200, {
+      "Content-Type": MIME[".html"],
+      "Cache-Control": "no-cache",
+      "Referrer-Policy": "no-referrer",
+      "X-Content-Type-Options": "nosniff"
+    });
+    createReadStream(indexPath).on("error", () => {
+      try {
+        res.destroy();
+      } catch {
+      }
+    }).pipe(res);
+  });
+}
+function appVersion() {
+  for (const rel of ["../package.json", "../../package.json"]) {
+    try {
+      const p = fileURLToPath(new URL(rel, import.meta.url));
+      const pkg = JSON.parse(readFileSync(p, "utf-8"));
+      if (typeof pkg.version === "string") return pkg.version;
+    } catch {
+    }
+  }
+  return "";
+}
+
 // src/web/vite-dev.ts
-import { existsSync } from "fs";
-import { fileURLToPath, pathToFileURL } from "url";
+import { existsSync as existsSync2 } from "fs";
+import { fileURLToPath as fileURLToPath2, pathToFileURL } from "url";
 import { createRequire } from "module";
-import { join } from "path";
+import { join as join2 } from "path";
 function isDevMode() {
   const forced = process.env.TOKMON_WEB_MODE;
   if (forced === "dev") return true;
   if (forced === "prod") return false;
+  if (process.env.NODE_TEST_CONTEXT) return false;
   return import.meta.url.includes("/src/");
 }
 function findWebSource() {
   for (const rel of ["../../web/", "../web/", "./web/"]) {
     try {
-      const dir = fileURLToPath(new URL(rel, import.meta.url));
-      if (existsSync(join(dir, "vite.config.ts")) && existsSync(join(dir, "index.html"))) {
+      const dir = fileURLToPath2(new URL(rel, import.meta.url));
+      if (existsSync2(join2(dir, "vite.config.ts")) && existsSync2(join2(dir, "index.html"))) {
         return dir.replace(/[\\/]+$/, "");
       }
     } catch {
@@ -148,12 +304,12 @@ async function createViteDevServer(httpServer, log) {
     return null;
   }
   try {
-    const req = createRequire(pathToFileURL(join(root, "package.json")).href);
+    const req = createRequire(pathToFileURL(join2(root, "package.json")).href);
     const vitePath = req.resolve("vite");
     const vite = await import(pathToFileURL(vitePath).href);
     const dev = await vite.createServer({
       root,
-      configFile: join(root, "vite.config.ts"),
+      configFile: join2(root, "vite.config.ts"),
       server: { middlewareMode: true, hmr: { server: httpServer } },
       appType: "spa",
       clearScreen: false,
@@ -177,7 +333,7 @@ code{color:#e6b450}</style></head><body>
 </body></html>`;
 
 // src/web/data-engine.ts
-import { readFileSync, writeFileSync, mkdirSync, renameSync } from "fs";
+import { readFileSync as readFileSync2, writeFileSync, mkdirSync, renameSync } from "fs";
 
 // src/web/refresh-queue.ts
 function deferred() {
@@ -331,15 +487,20 @@ function createDataEngine(opts) {
     billingUpdatedAt,
     tableUpdatedAt,
     seeded,
-    peak
+    peak,
+    config: currentConfig
   });
   const hydrateFromCache = () => {
     try {
-      const cached = JSON.parse(readFileSync(snapshotCacheFile(), "utf-8"));
+      const cached = JSON.parse(readFileSync2(snapshotCacheFile(), "utf-8"));
       if (!cached || !Array.isArray(cached.accounts)) return;
       for (const a of cached.accounts) {
         if (a.dashboard || a.table) {
-          usage.set(a.id, { dashboard: a.dashboard, table: a.table });
+          const dashboard = a.dashboard ? {
+            ...a.dashboard,
+            lastActivityAt: typeof a.dashboard.lastActivityAt === "number" && Number.isSafeInteger(a.dashboard.lastActivityAt) && a.dashboard.lastActivityAt >= 0 ? a.dashboard.lastActivityAt : null
+          } : null;
+          usage.set(a.id, { dashboard, table: a.table });
           if (a.dashboard) {
             summaryState.set(a.id, "ready");
             if (typeof a.summaryUpdatedAt === "number") summaryUpdatedAt.set(a.id, a.summaryUpdatedAt);
@@ -578,6 +739,7 @@ function createDataEngine(opts) {
     broadcastConfig(config) {
       if (stopped) return;
       currentConfig = config;
+      rebuild();
       for (const onConfig of configSubscribers) {
         try {
           onConfig(config);
@@ -665,23 +827,51 @@ async function resolveEngineConfig(config) {
     billingIntervalMs: billingIntervalFor(config)
   };
 }
+function configAffectsEngine(previous, next) {
+  return previous.interval !== next.interval || previous.billingInterval !== next.billingInterval || previous.timezone !== next.timezone || JSON.stringify(previous.accounts) !== JSON.stringify(next.accounts) || JSON.stringify(previous.disabledProviders) !== JSON.stringify(next.disabledProviders) || JSON.stringify(previous.accountDetection) !== JSON.stringify(next.accountDetection);
+}
 var updateQueues = /* @__PURE__ */ new WeakMap();
+function hasOwn(value, key) {
+  return Object.prototype.hasOwnProperty.call(value, key);
+}
+function mergeCapabilityFields(incomingConfig, current) {
+  const incoming = incomingConfig;
+  const incomingTray = incoming.tray;
+  const incomingDesktop = incoming.desktop;
+  return {
+    ...incoming,
+    appearance: hasOwn(incoming, "appearance") ? incoming.appearance : current.appearance,
+    accountDetection: hasOwn(incoming, "accountDetection") ? incoming.accountDetection : current.accountDetection,
+    tray: hasOwn(incoming, "tray") && incomingTray ? {
+      ...current.tray,
+      ...incomingTray,
+      pinnedProviders: hasOwn(incomingTray, "pinnedProviders") ? incomingTray.pinnedProviders : current.tray.pinnedProviders
+    } : current.tray,
+    desktop: hasOwn(incoming, "desktop") && incomingDesktop ? {
+      ...current.desktop,
+      ...incomingDesktop,
+      expandedProviders: hasOwn(incomingDesktop, "expandedProviders") ? incomingDesktop.expandedProviders : current.desktop.expandedProviders,
+      graphRangeDays: hasOwn(incomingDesktop, "graphRangeDays") ? incomingDesktop.graphRangeDays : current.desktop.graphRangeDays
+    } : current.desktop
+  };
+}
 async function applyConfigUpdateUnlocked(engine, state, input) {
   if (input.expectedRevision !== state.config.revision) {
     throw new ConfigConflictError(toConfigState(state.config));
   }
   const normalized = normalizeConfig({
-    ...input.config,
+    ...mergeCapabilityFields(input.config, state.config),
     revision: state.config.revision + 1
   });
-  const engineConfig = await resolveEngineConfig(normalized);
+  const reconfigureEngine = configAffectsEngine(state.config, normalized);
+  const engineConfig = reconfigureEngine ? await resolveEngineConfig(normalized) : null;
   try {
     await saveConfig(normalized);
   } catch (error) {
     throw new ConfigPersistenceError(error);
   }
   state.config = normalized;
-  engine.setConfig(engineConfig);
+  if (engineConfig) engine.setConfig(engineConfig);
   engine.broadcastConfig(normalized);
   return toConfigState(normalized);
 }
@@ -703,11 +893,11 @@ import { Effect, Exit, Layer, Queue, Scope, Stream } from "effect";
 import { RpcSerialization, RpcServer } from "effect/unstable/rpc";
 
 // src/web/fs.ts
-import { readdir, stat, realpath } from "fs/promises";
+import { readdir, stat as stat2, realpath } from "fs/promises";
 import { homedir } from "os";
-import { join as join2, resolve as resolvePath, isAbsolute, sep } from "path";
+import { join as join3, resolve as resolvePath, isAbsolute, sep as sep2 } from "path";
 function isContained(root, target) {
-  return target === root || target.startsWith(root + sep);
+  return target === root || target.startsWith(root + sep2);
 }
 function parentFor(root, abs) {
   const parentResolved = resolvePath(abs, "..");
@@ -727,7 +917,7 @@ async function listHomeDirectory(rawPath) {
   const abs = isContained(root, real) ? real : root;
   let st;
   try {
-    st = await stat(abs);
+    st = await stat2(abs);
   } catch {
     return { path: abs, parent: parentFor(root, abs), entries: [] };
   }
@@ -742,7 +932,7 @@ async function listHomeDirectory(rawPath) {
   for (const d of dirents) {
     if (d.name.startsWith(".")) continue;
     let dir = d.isDirectory();
-    const full = join2(abs, d.name);
+    const full = join3(abs, d.name);
     if (d.isSymbolicLink()) {
       let real2;
       try {
@@ -752,7 +942,7 @@ async function listHomeDirectory(rawPath) {
       }
       if (!isContained(root, real2)) continue;
       try {
-        dir = (await stat(full)).isDirectory();
+        dir = (await stat2(full)).isDirectory();
       } catch {
         continue;
       }
@@ -847,27 +1037,45 @@ function configStream(engine) {
     yield* Scope.addFinalizer(scope, Effect.sync(unsubscribe));
   }), { bufferSize: 16, strategy: "sliding" });
 }
-function toConfigUpdateFailure(error) {
+function configUpdateFailureEffect(error) {
   if (error instanceof ConfigConflictError) {
-    return { kind: "conflict", state: error.state };
+    return Effect.fail(new ConfigUpdateConflictFailure({ kind: "conflict", state: error.state }));
   }
   if (error instanceof ConfigPersistenceError) {
-    return { kind: "persistence", message: error.message };
+    return Effect.fail(new ConfigPersistenceFailure({ kind: "persistence", message: error.message }));
   }
-  return { kind: "persistence", message: error instanceof Error ? error.message : "config update failed" };
+  return Effect.die(error);
+}
+function configUpdateEffect(engine, state, input) {
+  return Effect.tryPromise({
+    try: () => applyConfigUpdate(engine, state, input),
+    catch: (error) => error
+  }).pipe(Effect.matchEffect({
+    onFailure: configUpdateFailureEffect,
+    onSuccess: Effect.succeed
+  }));
+}
+function refreshFailureEffect(error) {
+  return error instanceof AggregateError ? Effect.fail(new RefreshFailure({ kind: "refresh", message: error.message })) : Effect.die(error);
+}
+function refreshEffect(engine, scope) {
+  return Effect.tryPromise({
+    try: () => engine.refresh(scope),
+    catch: (error) => error
+  }).pipe(Effect.matchEffect({
+    onFailure: refreshFailureEffect,
+    onSuccess: Effect.succeed
+  }));
 }
 async function mountWsRpc(server, deps) {
   const scope = await Effect.runPromise(Scope.make());
   const wss = new NodeWS.WebSocketServer({ noServer: true });
   const handlersLayer = TokmonRpcGroup.toLayer(
     TokmonRpcGroup.of({
-      [TOKMON_WS_METHODS.getConfig]: () => Effect.tryPromise(() => Promise.resolve(deps.state.config ?? loadConfig()).then(toConfigState)),
-      [TOKMON_WS_METHODS.setConfig]: (config) => Effect.tryPromise({
-        try: () => applyConfigUpdate(deps.engine, deps.state, config),
-        catch: toConfigUpdateFailure
-      }),
-      [TOKMON_WS_METHODS.refresh]: ({ scope: scope2 }) => Effect.promise(() => deps.engine.refresh(scope2)),
-      [TOKMON_WS_METHODS.browseFs]: ({ path }) => Effect.tryPromise(() => listHomeDirectory(path)),
+      [TOKMON_WS_METHODS.getConfig]: () => Effect.promise(() => Promise.resolve(deps.state.config ?? loadConfig()).then(toConfigState)),
+      [TOKMON_WS_METHODS.setConfig]: (config) => configUpdateEffect(deps.engine, deps.state, config),
+      [TOKMON_WS_METHODS.refresh]: ({ scope: scope2 }) => refreshEffect(deps.engine, scope2),
+      [TOKMON_WS_METHODS.browseFs]: ({ path }) => Effect.promise(() => listHomeDirectory(path)),
       [TOKMON_WS_METHODS.snapshot]: () => snapshotStream(deps.engine),
       [TOKMON_WS_METHODS.config]: () => configStream(deps.engine).pipe(Stream.map(toConfigState))
     })
@@ -957,7 +1165,7 @@ function guardSameOrigin(req, res) {
   }
   return true;
 }
-function createRouter(engine, state, vite, webRoot, wsToken, version) {
+function createRouter(engine, state, vite, webRoot, wsToken, version, protocolVersion, capabilities, ownerKind, channel) {
   return (req, res) => {
     const url = req.url || "/";
     const path = url.split("?")[0];
@@ -973,6 +1181,10 @@ function createRouter(engine, state, vite, webRoot, wsToken, version) {
         ok: true,
         ready: engine.snapshot() !== null,
         version,
+        protocolVersion,
+        capabilities,
+        ownerKind,
+        channel,
         // Discovery requires this proof; public health checks retain their useful 200 response.
         owner: tokenMatches(header2(req, "x-tokmon-token"), wsToken)
       });
@@ -1003,7 +1215,11 @@ function createRouter(engine, state, vite, webRoot, wsToken, version) {
 async function startWebServer(opts) {
   const state = { config: opts.config };
   const tz = tzFor(state.config);
-  const version = appVersion();
+  const version = opts.version ?? appVersion();
+  const protocolVersion = opts.protocolVersion ?? TOKMON_PROTOCOL_VERSION;
+  const capabilities = opts.capabilities ?? TOKMON_CAPABILITIES;
+  const ownerKind = opts.ownerKind ?? "cli";
+  const channel = resolveDaemonChannel(opts.channel);
   const summaryIntervalMs = summaryIntervalFor(state.config);
   const billingIntervalMs = billingIntervalFor(state.config);
   const wsToken = opts.wsToken ?? randomBytes(32).toString("base64url");
@@ -1017,10 +1233,21 @@ async function startWebServer(opts) {
   let closeWsRpc = null;
   try {
     if (isDevMode()) vite = await createViteDevServer(server, log);
-    const webRoot = vite ? null : findWebRoot();
+    const webRoot = vite ? null : opts.webRoot ?? findWebRoot();
     if (!vite && !webRoot) log("  \u26A0 no dashboard available \u2014 see the page for build/dev instructions");
     engine = createDataEngine({ version, config: state.config, tz, summaryIntervalMs, billingIntervalMs, resolved });
-    server.addListener("request", createRouter(engine, state, vite, webRoot, wsToken, version));
+    server.addListener("request", createRouter(
+      engine,
+      state,
+      vite,
+      webRoot,
+      wsToken,
+      version,
+      protocolVersion,
+      capabilities,
+      ownerKind,
+      channel
+    ));
     closeWsRpc = await mountWsRpc(server, { engine, state });
     const bindHost = state.config.allowNetworkAccess ? NETWORK_HOST : LOOPBACK_HOST;
     const port = await listenWithFallback(server, opts.port ?? DEFAULT_PORT, bindHost);
@@ -1116,5 +1343,6 @@ function listenWithFallback(server, startPort, host) {
 }
 
 export {
+  appVersion,
   startWebServer
 };

package/dist/{chunk-4HU4EI5T.js → chunk-P5JN5DDX.js}

@@ -1,20 +1,21 @@
 #!/usr/bin/env node
 import {
-  isAlive,
-  probeHealth,
   readLock,
-  reclaimDeadLock,
+  retireIncompatibleCliOwner,
   verifyLock
-} from "./chunk-XDA5RJST.js";
+} from "./chunk-USKOQIE3.js";
 import {
-  appVersion
-} from "./chunk-SMPY52EV.js";
+  daemonChannelFromWire,
+  resolveDaemonChannel
+} from "./chunk-UYPDMVW5.js";
+import {
+  TOKMON_PROTOCOL_VERSION
+} from "./chunk-JZSZEHVD.js";
 
 // src/client/daemon-handle.ts
 import { spawn } from "child_process";
 import { extname } from "path";
 var HANDSHAKE_TIMEOUT_MS = process.platform === "win32" ? 15e3 : 1e4;
-var UPGRADE_SHUTDOWN_TIMEOUT_MS = 5e3;
 function runtimeExecArgv(entry, override) {
   if (override) return override;
   const ext = extname(entry).toLowerCase();
@@ -37,7 +38,7 @@ function runtimeExecArgv(entry, override) {
 function parseHandshake(line) {
   try {
     const value = JSON.parse(line);
-    return value?.ready === 1 && typeof value.url === "string" && typeof value.wsToken === "string" && typeof value.version === "string" ? value : null;
+    return value?.ready === 1 && typeof value.url === "string" && typeof value.wsToken === "string" && typeof value.version === "string" && typeof value.protocolVersion === "number" && Array.isArray(value.capabilities) && value.capabilities.every((capability) => typeof capability === "string") && (value.ownerKind === "cli" || value.ownerKind === "desktop") && daemonChannelFromWire(value.channel) !== null ? { ...value, channel: daemonChannelFromWire(value.channel) } : null;
   } catch {
     return null;
   }
@@ -46,52 +47,30 @@ function connected(url) {
   return { kind: "spawned", baseUrl: url, stop: () => {
   } };
 }
-async function attach(opts, version) {
-  const lock = await verifyLock(readLock(opts), version);
+async function attach(opts, protocolVersion) {
+  const lock = await verifyLock(readLock(opts), protocolVersion);
   return lock ? connected(lock.url) : null;
 }
-var delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-async function retireIncompatibleDaemon(opts, version, timeoutMs) {
-  const lock = readLock(opts);
-  if (!lock || lock.state !== "ready" || lock.version === version || lock.pid === process.pid || !isAlive(lock.pid)) return;
-  const authenticated = await probeHealth(
-    lock.url,
-    lock.wsToken,
-    lock.version,
-    Math.min(1e3, timeoutMs)
-  );
-  if (!authenticated) return;
-  try {
-    process.kill(lock.pid, "SIGTERM");
-  } catch {
-    if (!isAlive(lock.pid)) reclaimDeadLock(opts);
-    return;
-  }
-  const deadline = Date.now() + Math.min(timeoutMs, UPGRADE_SHUTDOWN_TIMEOUT_MS);
-  while (Date.now() < deadline) {
-    const current = readLock(opts);
-    if (!current || current.ownerId !== lock.ownerId) return;
-    if (!isAlive(lock.pid)) {
-      reclaimDeadLock(opts);
-      return;
-    }
-    await delay(50);
-  }
-}
 async function attachOrSpawn(opts = {}) {
-  const version = appVersion();
+  const protocolVersion = TOKMON_PROTOCOL_VERSION;
   const timeoutMs = opts.timeoutMs ?? HANDSHAKE_TIMEOUT_MS;
-  const existing = await attach(opts, version);
+  const baseEnv = opts.env ?? process.env;
+  const channel = resolveDaemonChannel(opts.channel, baseEnv);
+  const lockOpts = { cachePath: opts.cachePath, channel };
+  const existing = await attach(lockOpts, protocolVersion);
   if (existing) return existing;
-  await retireIncompatibleDaemon(opts, version, timeoutMs);
-  const upgraded = await attach(opts, version);
+  await retireIncompatibleCliOwner(lockOpts, protocolVersion, timeoutMs);
+  const upgraded = await attach(lockOpts, protocolVersion);
   if (upgraded) return upgraded;
   const entry = opts.entry ?? process.argv[1];
   if (!entry) return degraded();
   const execPath = opts.execPath ?? process.execPath;
   const args = ["__daemon", "--port", "0", "--no-open"];
-  const baseEnv = opts.env ?? process.env;
-  const env = opts.cachePath ? { ...baseEnv, TOKMON_DAEMON_CACHE_DIR: opts.cachePath } : baseEnv;
+  const env = {
+    ...baseEnv,
+    TOKMON_CHANNEL: channel,
+    ...opts.cachePath ? { TOKMON_DAEMON_CACHE_DIR: opts.cachePath } : {}
+  };
   return new Promise((resolve) => {
     let child;
     try {
@@ -117,7 +96,7 @@ async function attachOrSpawn(opts = {}) {
       resolve(handle);
     };
     const tryAttach = (final = false) => {
-      void attach(opts, version).then((found) => {
+      void attach(lockOpts, protocolVersion).then((found) => {
         if (found) {
           finish(found);
           return;
@@ -143,7 +122,7 @@ async function attachOrSpawn(opts = {}) {
         const line = stdout.slice(0, newline).trim();
         stdout = stdout.slice(newline + 1);
         const handshake = parseHandshake(line);
-        if (!handshake || handshake.version !== version) continue;
+        if (!handshake || handshake.protocolVersion !== protocolVersion || handshake.channel !== channel) continue;
         tryAttach();
         return;
       }