very-happy-cli 0.2.182 → 0.2.184

package/dist/{run-BBNrcCfI.cjs → run-gVwkplx0.cjs}

@@ -1,27 +1,27 @@
 'use strict';
 
-var mirrorProtocol = require('./mirrorProtocol-DkWOcZh9.cjs');
+var mirrorProtocol = require('./mirrorProtocol-D4CR5I5W.cjs');
 var fsMkdir = require('./fsMkdir-0K3yENml.cjs');
-var piRunnerArgs = require('./piRunnerArgs-vxCHKnSA.cjs');
+var piRunnerArgs = require('./piRunnerArgs-Dgjmj8KL.cjs');
 var fs = require('fs/promises');
 var os$1 = require('os');
 var tmp = require('tmp');
 var axios = require('axios');
 var node_fs = require('node:fs');
 var path = require('node:path');
-var configuration = require('./configuration-B-CugKJ3.cjs');
-var api = require('./api-CZWcG7uh.cjs');
-var spawnAgents = require('./spawnAgents-CG211IW7.cjs');
-var logger = require('./logger-DK1ytCz6.cjs');
-var index$2 = require('./index-CZC7egJA.cjs');
-var auth = require('./auth-Lw_utSMV.cjs');
+var configuration = require('./configuration-C9Sx-Foo.cjs');
+var api = require('./api-rw5xkzxo.cjs');
+var spawnAgents = require('./spawnAgents-D15n6tAj.cjs');
+var logger = require('./logger-CrtT0opS.cjs');
+var index$2 = require('./index-NhmqjrGv.cjs');
+var auth = require('./auth-gGryJImw.cjs');
 var child_process = require('child_process');
-var _package = require('./package-BfeqAzyJ.cjs');
-var doctor = require('./doctor-DMvlzmnE.cjs');
-var spawnHappyCLI = require('./spawnHappyCLI-D47kX6jg.cjs');
-var persistence = require('./persistence-BdpwWXKh.cjs');
-var controlClient = require('./controlClient-D0kGwKYx.cjs');
-var sessionOps = require('./sessionOps-Dx7wARjI.cjs');
+var _package = require('./package-DczR1k0c.cjs');
+var doctor = require('./doctor-DRdV3thy.cjs');
+var spawnHappyCLI = require('./spawnHappyCLI-8NcKgkuy.cjs');
+var persistence = require('./persistence-IYH6bAXY.cjs');
+var controlClient = require('./controlClient-BLO1_pPx.cjs');
+var sessionOps = require('./sessionOps-hRqzcMXB.cjs');
 var fastify = require('fastify');
 var z = require('zod');
 var fastifyTypeProviderZod = require('fastify-type-provider-zod');
@@ -29,66 +29,65 @@ var authRelay = require('./authRelay-Dy1qU9td.cjs');
 var node_crypto = require('node:crypto');
 var previewPath = require('./previewPath-B0rBdhy1.cjs');
 var backgroundTaskActivity = require('./backgroundTaskActivity-CBvUdj39.cjs');
-var rateLimitWindows = require('./rateLimitWindows-DJxnNw-X.cjs');
-var peerTools = require('./peerTools-BVp1z0T_.cjs');
+var rateLimitWindows = require('./rateLimitWindows-CeogT1b6.cjs');
+var peerTools = require('./peerTools-Cufh4Qp_.cjs');
 var os = require('node:os');
-var remoteSessionClient = require('./remoteSessionClient-CtV9mDko.cjs');
-var bootstrap = require('./bootstrap-DsXp74wv.cjs');
-var index$1 = require('./index-B_aNaW9w.cjs');
+var remoteSessionClient = require('./remoteSessionClient-CuAkp19e.cjs');
+var bootstrap = require('./bootstrap-BPz1iX77.cjs');
+var index$1 = require('./index-BsoUsrKS.cjs');
 var require$$0 = require('fs');
 var require$$1 = require('path');
 var node_child_process = require('node:child_process');
 var projectPath = require('./projectPath-C3ioB4Bu.cjs');
 var doctorReadiness = require('./doctorReadiness-Dl6yRQCy.cjs');
-var machineMetadata = require('./machineMetadata-IJc6_iyx.cjs');
+var machineMetadata = require('./machineMetadata-D1hlm_oF.cjs');
 var fileStore = require('./fileStore-7qhnbs6N.cjs');
 var pi = require('./pi-DlsrPCTa.cjs');
 var require$$3 = require('crypto');
 var detectCLI = require('./detectCLI-BuYR_Qxe.cjs');
-var handleResumeCommand = require('./handleResumeCommand-Dp2Y-p6V.cjs');
+var handleResumeCommand = require('./handleResumeCommand-z7wY7QVM.cjs');
 var webPanels = require('./webPanels-FCgFKvVe.cjs');
-var index = require('./index-oh8XEozJ.cjs');
+var index = require('./index-Ub-5xbcU.cjs');
 var promises = require('node:fs/promises');
 var cliUpdate = require('./cliUpdate-DsKXPFYp.cjs');
-var client = require('./client-DK8CzUry.cjs');
-var client$1 = require('./client-CDuW4MS9.cjs');
-var module$1 = require('node:module');
+var client = require('./client-C49zFRkX.cjs');
+var client$1 = require('./client-BFDji81N.cjs');
+var daemonSupervisor = require('./daemonSupervisor-57JYYzMf.cjs');
 var path$1 = require('./path-B7zW-WwE.cjs');
 var editPaths = require('./editPaths-Bqp4OFPw.cjs');
-var startFileWatcher = require('./startFileWatcher-gKQTstR6.cjs');
-var sync = require('./sync-BxMdnZzz.cjs');
+var startFileWatcher = require('./startFileWatcher-CjgKvec9.cjs');
+var sync = require('./sync-DKSZOi6w.cjs');
 var types = require('./types-CRS-srZK.cjs');
 var tmuxSocket = require('./tmuxSocket-D-Xt6Vn-.cjs');
-var sessionLock = require('./sessionLock-Dc0fadGG.cjs');
+var sessionLock = require('./sessionLock-DNGDn9oj.cjs');
 var doctor$1 = require('./doctor-u46qYYKX.cjs');
-var resources = require('./resources-BPyN59Iv.cjs');
+var resources = require('./resources-CqwHPhdK.cjs');
 var node_util = require('node:util');
-var template = require('./template-BaHAmH2K.cjs');
-var daemonSupervisor = require('./daemonSupervisor-B-SPSqhs.cjs');
+var template = require('./template-BLJxflCH.cjs');
 var loginShellEnv = require('./loginShellEnv-BkuYtExZ.cjs');
-require('./acpSessionResume-Dxo8222T.cjs');
-require('./lidState-DcPvwniz.cjs');
+require('./acpSessionResume-DZ65DBeE.cjs');
+require('./lidState-C4YgPn6y.cjs');
 require('node:events');
 require('socket.io-client');
-require('./pushNotifications-CyQVDThC.cjs');
+require('./pushNotifications-BgQ_QTgS.cjs');
 require('./contentLogMetadata-ZSFk_NjQ.cjs');
 require('./limits-C-a7gr04.cjs');
-require('./time-DNLeIRgR.cjs');
-require('./registerCommonHandlers-DbNoM39q.cjs');
+require('./time-D-8GFCE7.cjs');
+require('./registerCommonHandlers-CRqKXwQt.cjs');
 require('util');
 require('cross-spawn');
 require('@paralleldrive/cuid2');
 require('chalk');
+require('node:module');
 require('tweetnacl');
-require('./browser-CZlA9AkO.cjs');
+require('./browser-D9D-1eqa.cjs');
 require('open');
 require('./ids-B6ZC0HGt.cjs');
 require('url');
-require('./localHappyAgentAuth-SD6GM97y.cjs');
+require('./localHappyAgentAuth-BzCuIkzi.cjs');
 require('./processTreeSnapshot-mDbnuojn.cjs');
 require('ps-list');
 
-var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 function _interopNamespaceDefault(e) {
     var n = Object.create(null);
     if (e) {
@@ -594,6 +593,7 @@ function startDaemonControlServer({
   stopSession,
   spawnSession,
   resumeSession,
+  restartSession,
   requestShutdown,
   onHappySessionWebhook,
   onSessionStateEvent,
@@ -890,6 +890,34 @@ function startDaemonControlServer({
           return { success: false, error: result.errorMessage };
       }
     });
+    typed.post("/restart-session", {
+      schema: {
+        body: z.z.object({ sessionId: z.z.string().min(1).max(200) }),
+        response: {
+          200: z.z.object({ success: z.z.boolean(), sessionId: z.z.string().optional(), error: z.z.string().optional() }),
+          500: z.z.object({ success: z.z.boolean(), error: z.z.string().optional() }),
+          503: z.z.object({ success: z.z.boolean(), error: z.z.string().optional() })
+        }
+      }
+    }, async (request, reply) => {
+      const { sessionId } = request.body;
+      if (!restartSession) {
+        reply.code(503);
+        return { success: false, error: "daemon is still starting up" };
+      }
+      logger.logger.debug(`[CONTROL SERVER] Restart session request: ${sessionId}`);
+      const result = await restartSession(sessionId, { keepPublishedPermissionMode: true });
+      switch (result.type) {
+        case "success":
+          return { success: true, sessionId: result.sessionId };
+        case "requestToApproveDirectoryCreation":
+          reply.code(500);
+          return { success: false, error: `Cannot restart: working directory ${result.directory} needs to be created first` };
+        case "error":
+          reply.code(500);
+          return { success: false, error: result.errorMessage };
+      }
+    });
     typed.post("/terminal-hook", {
       schema: {
         body: z.z.any(),
@@ -5115,196 +5143,6 @@ async function waitForSessionLive(sessionId, live, timeoutMs = AUTOMATION_WAKE_T
   return true;
 }
 
-const CLAUDE_KEYCHAIN_SERVICE_PREFIX = "Claude Code";
-function keychainIdentity(env = process.env, deps = {}) {
-  const home = deps.home ?? os.homedir();
-  const secureDir = env.CLAUDE_SECURESTORAGE_CONFIG_DIR?.trim();
-  const configDirEnv = env.CLAUDE_CONFIG_DIR?.trim();
-  const configDir = secureDir || configDirEnv || path.join(home, ".claude");
-  const hasCustomDir = Boolean(secureDir || configDirEnv);
-  const dirSuffix = hasCustomDir ? "-" + node_crypto.createHash("sha256").update(configDir.normalize("NFC")).digest("hex").slice(0, 8) : "";
-  const oauthSuffix = env.CLAUDE_CODE_OAUTH_CLIENT_ID?.trim() ? "-custom-oauth" : "";
-  const rawAccount = env.USER || safeUsername(deps.username);
-  const account = /^[a-zA-Z0-9._-]+$/.test(rawAccount) ? rawAccount : "claude-code-user";
-  return {
-    service: `${CLAUDE_KEYCHAIN_SERVICE_PREFIX}${oauthSuffix}-credentials${dirSuffix}`,
-    account,
-    configDir,
-    credentialsPath: path.join(configDir, ".credentials.json")
-  };
-}
-function safeUsername(provider) {
-  try {
-    return provider ? provider() : os.userInfo().username;
-  } catch {
-    return "";
-  }
-}
-
-const CLAUDE_AUTH_PROBE_VERSION = 1;
-const LOCAL_CREDENTIAL_SOURCE = "Claude local credentials";
-function classifyAuthStatus(run, credentialSource) {
-  const localSource = credentialSource === void 0 || credentialSource === LOCAL_CREDENTIAL_SOURCE;
-  if (run.spawnError) {
-    return { status: "error", diagnosis: "probe-crash", detail: `could not run claude auth status: ${run.spawnError}` };
-  }
-  if (run.timedOut) {
-    return { status: "error", diagnosis: "probe-timeout", detail: "claude auth status did not answer within the timeout" };
-  }
-  const parsed = parseJsonObject(run.stdout);
-  if (!parsed) {
-    if (!localSource) return { status: "unknown", authMethod: credentialSource, detail: `auth status unparseable under ${credentialSource}` };
-    return { status: "error", diagnosis: "probe-crash", detail: `claude auth status returned no JSON (exit ${run.exitCode ?? "null"})` };
-  }
-  const authMethod = typeof parsed.authMethod === "string" ? parsed.authMethod : void 0;
-  const subscriptionType = typeof parsed.subscriptionType === "string" ? parsed.subscriptionType : void 0;
-  if (parsed.loggedIn === true) {
-    return { status: "ok", authMethod: localSource ? authMethod : credentialSource, subscriptionType };
-  }
-  if (!localSource) {
-    return { status: "unknown", authMethod: credentialSource, detail: `Claude Code reports loggedIn=false under ${credentialSource}; not a local-credential failure` };
-  }
-  return { status: "not-logged-in", authMethod, subscriptionType, detail: "Claude Code in the daemon context reports it is not logged in" };
-}
-function parseJsonObject(text) {
-  const trimmed = text.trim();
-  if (!trimmed) return null;
-  const start = trimmed.indexOf("{");
-  if (start < 0) return null;
-  try {
-    const value = JSON.parse(trimmed.slice(start));
-    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
-  } catch {
-    return null;
-  }
-}
-function resolveSdkClaudeBinary(platform = process.platform, arch = process.arch, resolver = (s) => module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('run-BBNrcCfI.cjs', document.baseURI).href))).resolve(s)) {
-  const platformArch = `${platform}-${arch}`;
-  const candidates = [
-    `@anthropic-ai/claude-agent-sdk-${platformArch}/claude`,
-    `@anthropic-ai/claude-agent-sdk-${platformArch}/claude.exe`
-  ];
-  for (const candidate of candidates) {
-    try {
-      return resolver(candidate);
-    } catch {
-    }
-  }
-  return null;
-}
-function interpretSecurityRead(result) {
-  if (result.error === "ENOENT") return { kind: "unsupported" };
-  if (result.error === "timeout") return { kind: "error", detail: "security timed out" };
-  if (result.exitCode === 44) return { kind: "absent" };
-  if (result.exitCode === 36) return { kind: "unreadable" };
-  if (result.exitCode !== 0) return { kind: "error", detail: `security exited ${result.exitCode ?? "null"}` };
-  const raw = result.stdout.trim();
-  if (!raw) return { kind: "absent" };
-  const parsed = parseJsonObject(raw);
-  const oauth = parsed && typeof parsed.claudeAiOauth === "object" && parsed.claudeAiOauth ? parsed.claudeAiOauth : null;
-  if (!oauth) return { kind: "present", accessToken: "", refreshToken: "", raw };
-  return {
-    kind: "present",
-    accessToken: typeof oauth.accessToken === "string" ? oauth.accessToken : "",
-    refreshToken: typeof oauth.refreshToken === "string" ? oauth.refreshToken : "",
-    raw
-  };
-}
-function interpretCredentialsFile(text) {
-  if (text === null) return { exists: false, hasTokens: false, refreshToken: "" };
-  const parsed = parseJsonObject(text);
-  const oauth = parsed && typeof parsed.claudeAiOauth === "object" && parsed.claudeAiOauth ? parsed.claudeAiOauth : null;
-  const access = oauth && typeof oauth.accessToken === "string" ? oauth.accessToken : "";
-  const refresh = oauth && typeof oauth.refreshToken === "string" ? oauth.refreshToken : "";
-  return { exists: true, hasTokens: access.length > 0 && refresh.length > 0, refreshToken: refresh };
-}
-function tokenTail(token) {
-  return token ? node_crypto.createHash("sha256").update(token).digest("hex").slice(-6) : "";
-}
-const CREDENTIALS_REJECTED_DETAIL = "Credentials exist but Claude Code rejects them in the daemon context \u2014 the refresh token has most likely been rotated away by another store or another machine using the same credentials. Log in again with `claude` on this machine.";
-function diagnoseStores(input) {
-  const { status, keychain, file } = input;
-  if (keychain.kind === "present") {
-    const empty = keychain.accessToken.length === 0 && keychain.refreshToken.length === 0;
-    if (empty && file.hasTokens && status === "not-logged-in") {
-      return {
-        diagnosis: "keychain-empty-item",
-        repairable: "delete-empty-keychain-item",
-        keychainRaw: keychain.raw,
-        detail: "The login keychain holds a Claude Code credentials item with empty tokens; Claude Code prefers it over the valid ~/.claude/.credentials.json and reports not logged in."
-      };
-    }
-    if (!empty && file.hasTokens && tokenTail(keychain.refreshToken) !== tokenTail(file.refreshToken)) {
-      return {
-        diagnosis: "store-divergence",
-        detail: "Keychain and ~/.claude/.credentials.json hold different refresh tokens; one of them will stop working at its next refresh. Treat the daemon-context login as canonical, or pin credentialStore=file."
-      };
-    }
-    return {};
-  }
-  if ((keychain.kind === "absent" || keychain.kind === "unreadable" || keychain.kind === "unsupported") && !file.hasTokens) {
-    return { diagnosis: "no-credentials", detail: "No Claude Code credentials found for this daemon context; log in with `claude` on this machine." };
-  }
-  if (keychain.kind === "unreadable" && file.hasTokens && status === "not-logged-in") {
-    return { diagnosis: "credentials-rejected", detail: CREDENTIALS_REJECTED_DETAIL };
-  }
-  if (keychain.kind === "error") {
-    return { detail: `keychain check failed: ${keychain.detail}` };
-  }
-  return {};
-}
-function securityReadArgs(identity) {
-  return ["find-generic-password", "-s", identity.service, "-a", identity.account, "-w"];
-}
-function securityDeleteArgs(identity) {
-  return ["delete-generic-password", "-s", identity.service, "-a", identity.account];
-}
-const HAPPY_DAEMON_LAUNCHD_LABEL = "com.mereith.happy-daemon";
-function classifyLineage(input) {
-  if (input.platform !== "darwin") return "other";
-  const label = input.label ?? HAPPY_DAEMON_LAUNCHD_LABEL;
-  if (input.env.XPC_SERVICE_NAME !== label) return "other";
-  if (input.launchdJobPid !== null && input.ancestorPids.includes(input.launchdJobPid)) return "launchd";
-  return "inherited-env";
-}
-function parseLaunchctlPid(printOutput) {
-  const match = /^\s*pid\s*=\s*(\d+)/m.exec(printOutput);
-  return match ? Number(match[1]) : null;
-}
-function keychainOffShimDir(happyLibDir) {
-  return path.join(happyLibDir, "scripts", "shims", "keychain-off");
-}
-function withKeychainOffPath(path$1, shimDir) {
-  const parts = (path$1 ?? "").split(path.delimiter).filter((p) => p && p !== shimDir);
-  return [shimDir, ...parts].join(path.delimiter);
-}
-function buildClaudeAuthState(input) {
-  const { classification, diagnosis } = input;
-  const detail = (diagnosis?.detail ?? classification.detail)?.slice(0, 200);
-  const state = {
-    probeVersion: CLAUDE_AUTH_PROBE_VERSION,
-    daemonPid: input.daemonPid,
-    status: classification.status,
-    context: { platform: input.platform, lineage: input.lineage, credentialStore: input.credentialStore },
-    checkedAt: input.now ?? Date.now()
-  };
-  if (classification.authMethod) state.authMethod = classification.authMethod;
-  if (classification.subscriptionType) state.subscriptionType = classification.subscriptionType;
-  const diag = diagnosis?.diagnosis ?? classification.diagnosis;
-  if (diag) state.diagnosis = diag;
-  if (detail) state.detail = detail;
-  if (diagnosis?.repairable) state.repairable = diagnosis.repairable;
-  return state;
-}
-function claudeAuthStateChanged(prev, next) {
-  if (!prev) return true;
-  const strip = ({ checkedAt: _c, ...rest }) => JSON.stringify(rest);
-  return strip(prev) !== strip(next);
-}
-function keychainIdentityFor(env) {
-  return keychainIdentity(env);
-}
-
 const CLAUDE_AUTH_PROBE_INTERVAL_MS = 10 * 60 * 1e3;
 const CLAUDE_AUTH_REFRESH_INTERVAL_MS = 30 * 60 * 1e3;
 const PROBE_TIMEOUT_MS = 8e3;
@@ -5315,6 +5153,7 @@ class ClaudeAuthService {
     this.opts = opts;
     this.env = opts.env ?? process.env;
     this.platform = opts.platform ?? process.platform;
+    this.lineage = opts.lineage ?? null;
   }
   timer = null;
   signalTimer = null;
@@ -5355,7 +5194,7 @@ class ClaudeAuthService {
     if (this.opts.getCredentialStore() !== "file") return {};
     const shim = this.resolveShimDir();
     if (!shim) return {};
-    return { PATH: withKeychainOffPath(this.env.PATH, shim) };
+    return { PATH: daemonSupervisor.withKeychainOffPath(this.env.PATH, shim) };
   }
   effectiveCredentialStore() {
     if (this.opts.getCredentialStore() !== "file") return "auto";
@@ -5379,8 +5218,8 @@ class ClaudeAuthService {
     const state = await this.probe("repair-precheck", true);
     const seen = this.lastDiagnosis;
     if (state.diagnosis !== "keychain-empty-item" || !seen?.keychainRaw) return { error: "precondition-failed", claudeAuth: state };
-    const identity = keychainIdentityFor(this.env);
-    const again = interpretSecurityRead(await this.security(securityReadArgs(identity)));
+    const identity = daemonSupervisor.keychainIdentityFor(this.env);
+    const again = daemonSupervisor.interpretSecurityRead(await this.security(daemonSupervisor.securityReadArgs(identity)));
     if (again.kind !== "present" || again.raw !== seen.keychainRaw || again.accessToken || again.refreshToken) {
       return { error: "precondition-failed", claudeAuth: state };
     }
@@ -5391,7 +5230,7 @@ class ClaudeAuthService {
     } catch (error) {
       return { error: `backup-failed: ${String(error)}`, claudeAuth: state };
     }
-    const del = await this.security(securityDeleteArgs(identity));
+    const del = await this.security(daemonSupervisor.securityDeleteArgs(identity));
     if (del.exitCode !== 0) return { error: `delete-failed: security exited ${del.exitCode ?? "null"}`, claudeAuth: state };
     logger.logger.debug("[CLAUDE AUTH] deleted empty-token keychain item after backup");
     const after = await this.probe("repair-done", true);
@@ -5399,7 +5238,7 @@ class ClaudeAuthService {
   }
   // ── internals ────────────────────────────────────────────────────────
   resolveShimDir() {
-    const dir = keychainOffShimDir(this.opts.happyLibDir);
+    const dir = daemonSupervisor.keychainOffShimDir(this.opts.happyLibDir);
     const bin = path.join(dir, "security");
     try {
       if (!node_fs.statSync(bin).isFile()) return null;
@@ -5419,20 +5258,20 @@ class ClaudeAuthService {
       diagnosis = await this.diagnose(classification.status);
       this.lastDiagnosis = diagnosis;
     } else if (classification.status === "not-logged-in") {
-      const file = interpretCredentialsFile(this.readCredentialsFile());
+      const file = daemonSupervisor.interpretCredentialsFile(this.readCredentialsFile());
       if (!file.hasTokens) {
         diagnosis = {
           diagnosis: "no-credentials",
           detail: store === "file" ? "credentialStore=file and ~/.claude/.credentials.json has no tokens; log in with `claude` from a terminal on this machine." : "No Claude Code credentials found for this daemon context; log in with `claude` on this machine."
         };
       } else {
-        diagnosis = { diagnosis: "credentials-rejected", detail: CREDENTIALS_REJECTED_DETAIL };
+        diagnosis = { diagnosis: "credentials-rejected", detail: daemonSupervisor.CREDENTIALS_REJECTED_DETAIL };
       }
     }
     if (storeRequested === "file" && store === "auto") {
-      diagnosis = { ...diagnosis ?? {}, detail: `credentialStore=file requested but the keychain-off shim is missing under ${keychainOffShimDir(this.opts.happyLibDir)}; running in auto mode.` };
+      diagnosis = { ...diagnosis ?? {}, detail: `credentialStore=file requested but the keychain-off shim is missing under ${daemonSupervisor.keychainOffShimDir(this.opts.happyLibDir)}; running in auto mode.` };
     }
-    const state = buildClaudeAuthState({
+    const state = daemonSupervisor.buildClaudeAuthState({
       daemonPid: process.pid,
       platform: this.platform,
       lineage: await this.resolveLineage(),
@@ -5441,7 +5280,7 @@ class ClaudeAuthService {
       diagnosis,
       now: this.opts.now?.() ?? Date.now()
     });
-    const changed = claudeAuthStateChanged(this.last, state);
+    const changed = daemonSupervisor.claudeAuthStateChanged(this.last, state);
     const stale = state.checkedAt - this.lastPublishedAt >= CLAUDE_AUTH_REFRESH_INTERVAL_MS;
     if (changed) {
       logger.logger.debug(`[CLAUDE AUTH] ${reason}: status=${state.status} diagnosis=${state.diagnosis ?? "-"} lineage=${state.context.lineage} store=${state.context.credentialStore}`);
@@ -5459,7 +5298,7 @@ class ClaudeAuthService {
     return state;
   }
   async runAuthStatus() {
-    const binary = resolveSdkClaudeBinary(this.platform, process.arch);
+    const binary = daemonSupervisor.resolveSdkClaudeBinary(this.platform, process.arch);
     if (!binary) {
       return { status: "claude-missing", diagnosis: "sdk-binary-missing", detail: "The Claude Code binary bundled with the Agent SDK is missing; remote sessions cannot start." };
     }
@@ -5504,16 +5343,16 @@ class ClaudeAuthService {
         done({ stdout, exitCode: code, timedOut: false });
       });
     });
-    return classifyAuthStatus(run, this.opts.credentialSource);
+    return daemonSupervisor.classifyAuthStatus(run, this.opts.credentialSource);
   }
   async diagnose(status) {
-    const identity = keychainIdentityFor(this.env);
-    const keychain = interpretSecurityRead(await this.security(securityReadArgs(identity)));
-    const file = interpretCredentialsFile(this.readCredentialsFile(identity.credentialsPath));
-    return diagnoseStores({ status, keychain, file });
+    const identity = daemonSupervisor.keychainIdentityFor(this.env);
+    const keychain = daemonSupervisor.interpretSecurityRead(await this.security(daemonSupervisor.securityReadArgs(identity)));
+    const file = daemonSupervisor.interpretCredentialsFile(this.readCredentialsFile(identity.credentialsPath));
+    return daemonSupervisor.diagnoseStores({ status, keychain, file });
   }
   readCredentialsFile(path) {
-    const target = path ?? keychainIdentityFor(this.env).credentialsPath;
+    const target = path ?? daemonSupervisor.keychainIdentityFor(this.env).credentialsPath;
     try {
       return node_fs.existsSync(target) ? node_fs.readFileSync(target, "utf8") : null;
     } catch {
@@ -5538,9 +5377,9 @@ class ClaudeAuthService {
       return this.lineage;
     }
     const uid = typeof process.getuid === "function" ? process.getuid() : null;
-    const launchdJobPid = uid === null ? null : parseLaunchctlPid(await this.exec("launchctl", ["print", `gui/${uid}/${HAPPY_DAEMON_LAUNCHD_LABEL}`]));
+    const launchdJobPid = uid === null ? null : daemonSupervisor.parseLaunchctlPid(await this.exec("launchctl", ["print", `gui/${uid}/${daemonSupervisor.HAPPY_DAEMON_LAUNCHD_LABEL}`]));
     const ancestors = await this.ancestorPids();
-    this.lineage = classifyLineage({ platform: this.platform, env: this.env, launchdJobPid, ancestorPids: ancestors });
+    this.lineage = daemonSupervisor.classifyLineage({ platform: this.platform, env: this.env, launchdJobPid, ancestorPids: ancestors });
     return this.lineage;
   }
   async ancestorPids() {
@@ -6378,6 +6217,10 @@ async function removeTeamWorktree(resource) {
   if (ownBranch) await git(repository, ["branch", "-D", branch]);
 }
 
+function refusalCode(error) {
+  const code = axios.isAxiosError(error) ? error.response?.data?.error : void 0;
+  return typeof code === "string" && /^[a-z_]{1,64}$/.test(code) ? ` (${code})` : "";
+}
 function persistedSpawnMatches(operationId) {
   return Object.entries(persistence.readPersistedSessions()).filter(([, entry]) => entry.metadata?.teamOperationId === operationId);
 }
@@ -6412,6 +6255,7 @@ function createTeamWorker(deps) {
       writeReceipt$1(home, receipt);
     }
     if (receipt.phase === "completed") return;
+    let sessionStopped = false;
     try {
       if (op.type === "spawn") {
         if (machineMetadata.ownerRetryPending(op, receipt) && (receipt.phase === "prepared" || receipt.phase === "spawning" && persistedSpawnMatches(op.id).length === 0)) {
@@ -6508,10 +6352,11 @@ function createTeamWorker(deps) {
           return;
         }
         const bot = team.bots.find((candidate) => candidate.id === op.botId);
-        if (!bot || bot.generation !== op.generation || bot.sessionId !== op.sessionId) throw new Error("Worker binding changed; preserve resources for reconciliation");
+        if (!bot || op.sessionId && bot.transferredTo?.sessionId === op.sessionId) throw new Error("Worker binding changed; preserve resources for reconciliation");
         if (op.sessionId) {
           await deps.stopAndWait(op.sessionId);
           await sessionOps.archiveSession(op.sessionId);
+          sessionStopped = true;
         }
         if (team.archivedAt !== void 0) {
           await complete(op, receipt);
@@ -6534,7 +6379,7 @@ function createTeamWorker(deps) {
         } catch {
         }
       }
-      await action(op.teamId, `failure-${op.id}-${receipt.phase}-${node_crypto.createHash("sha256").update(detail).digest("hex").slice(0, 12)}`, { type: "fail-operation", operationId: op.id, machineId: deps.machineId, claimId: receipt.claimId, error: detail.slice(0, 1e3), unknown }).catch(() => {
+      await action(op.teamId, `failure-${op.id}-${receipt.phase}-${node_crypto.createHash("sha256").update(detail).digest("hex").slice(0, 12)}${sessionStopped ? "-stopped" : ""}`, { type: "fail-operation", operationId: op.id, machineId: deps.machineId, claimId: receipt.claimId, error: detail.slice(0, 1e3), unknown, ...sessionStopped ? { sessionStopped: true } : {} }).catch(() => {
       });
       deps.log(`Teams operation ${op.id} ${unknown ? "needs reconciliation" : "will retry"}`);
     }
@@ -6614,8 +6459,8 @@ Use the teams tools to inspect current task state before acting. This message is
         if (closed) break;
         try {
           await execute(op);
-        } catch {
-          deps.log(`Teams operation ${op.id} remains pending`);
+        } catch (error) {
+          deps.log(`Teams operation ${op.id} remains pending${refusalCode(error)}`);
         }
       }
       await flushEvents(data.teams ?? []);
@@ -6953,7 +6798,9 @@ function createAutomationRunner(deps) {
   function persist(receipt) {
     writeReceipt(home, receipt, now());
   }
-  async function finish(item, report2) {
+  async function finish(item, input) {
+    const { report: report2, clipped } = template.clipAutomationReport(input);
+    if (clipped.length) deps.log(`Automation run ${item.runId} report clipped: ${clipped.map((c) => `${c.field} ${c.from}\u2192${c.to}`).join(", ")}`);
     try {
       await client.report(item.runId, report2);
     } catch (error) {
@@ -8390,7 +8237,7 @@ async function startDaemon() {
         }
         const model = sanitizeResumeModel(options?.model);
         if (model) args.push("--model", model);
-        const permissionMode = spawnAgents.sanitizeSpawnPermissionMode(options?.permissionMode);
+        const permissionMode = spawnAgents.sanitizeSpawnPermissionMode(options?.permissionMode ?? (options?.keepPublishedPermissionMode ? publishedRelaunchPermissionMode(metadata) : void 0));
         if (permissionMode) args.push("--permission-mode", permissionMode);
         restartCounts.set(happySessionId, recordRestartAttempt(prior));
         const teamEnv = await teamRelaunchEnvFor(happySessionId, metadata);
@@ -8549,6 +8396,8 @@ async function startDaemon() {
       spawnSession,
       resumeSession,
       // B-501: `very-happy send --resume`
+      restartSession,
+      // B-794: `very-happy session provider`
       requestShutdown: () => requestShutdown("happy-cli"),
       onHappySessionWebhook,
       onSessionStateEvent,
@@ -8593,8 +8442,10 @@ async function startDaemon() {
       }
     });
     const daemonClaudeCredentials = doctorReadiness.resolveClaudeCredentialReadiness();
-    const daemonSupervisor$1 = daemonSupervisor.detectDaemonSupervisor(process.env);
-    logger.logger.debug(`[DAEMON RUN] Supervisor: ${daemonSupervisor$1}`);
+    const launchdJob = process.platform === "darwin" ? await daemonSupervisor.probeLaunchdJob() : null;
+    const daemonSupervisor$1 = daemonSupervisor.detectDaemonSupervisor(process.env, process.platform, launchdJob);
+    const lineage = daemonSupervisor.daemonLineage(daemonSupervisor$1, process.env, process.platform, launchdJob);
+    logger.logger.debug(`[DAEMON RUN] Supervisor: ${daemonSupervisor$1} (lineage ${lineage}${launchdJob ? `, launchd job pid ${launchdJob.jobPid ?? "-"}` : ""})`);
     let fileState = {
       pid: process.pid,
       httpPort: controlPort,
@@ -8677,7 +8528,8 @@ async function startDaemon() {
         await persistence.writeSettings({ ...settings, claudeCredentialStore: store });
         claudeCredentialStoreSetting = store;
       },
-      publish: (state) => apiMachine.setClaudeAuthState(state)
+      publish: (state) => apiMachine.setClaudeAuthState(state),
+      lineage
     });
     claudeAuthServiceRef = claudeAuthService;
     apiMachine.setClaudeAuthHandlers({
@@ -8854,8 +8706,8 @@ async function startDaemon() {
               await controlClient.cleanupDaemonState();
               await persistence.releaseDaemonLock(daemonLockHandle);
               await stopCaffeinate();
-              if (daemonSupervisor$1 === "systemd") {
-                logger.logger.debug(`[DAEMON RUN] systemd-supervised: exiting ${HANDOVER_EXIT_CODE} for the unit to restart on the new bundle`);
+              if (daemonSupervisor$1 !== "none") {
+                logger.logger.debug(`[DAEMON RUN] ${daemonSupervisor$1}-supervised: exiting ${HANDOVER_EXIT_CODE} for the supervisor to restart on the new bundle`);
                 process.exit(HANDOVER_EXIT_CODE);
               }
               try {