fix(claude): keep the daemon responsive during conversation rewind

The SDK parses and copies the complete transcript while forking a Claude
conversation. Running that work in the daemon's event loop blocks all
connected clients, even though only one conversation is being rewound.

Run the fork in a worker, stream transcript records, and append in bounded
chunks. Preserve the SDK's fork content, transcript location, and error
fields. Share the existing compiler worker loader and verify that the
installed daemon closure contains and starts the rewind worker.

Retain Dominic Anaeto's implementation and regressions from #8444, rebased
onto main to include the correction for the moved worktrees documentation
page in the website test.

Fixes #8209

Co-authored-by: Dominic Anaeto <dominic.anaeto@gmail.com>

.github/workflows/desktop-release.yml

@@ -135,6 +135,32 @@ jobs:
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      # Backport electron-builder#10172 to the pinned build tool only.
+      # Remove this step when app-builder-lib is upgraded to a release containing it.
+      - name: Repair temporary keychain password in signing tool
+        shell: bash
+        run: |
+          node <<'KEYCHAIN_FIX'
+          const fs = require('node:fs');
+          const path = require('node:path');
+          const manifestPath = require.resolve('app-builder-lib/package.json');
+          if (JSON.parse(fs.readFileSync(manifestPath, 'utf8')).version !== '26.8.1') {
+            throw new Error('Reassess/remove the signing backport for the new app-builder-lib version');
+          }
+          const sourcePath = path.join(path.dirname(manifestPath), 'out/codeSign/macCodeSign.js');
+          let source = fs.readFileSync(sourcePath, 'utf8');
+          const replacements = [
+            ['importCerts(keychainFile, certPaths, cscPasswords)', 'importCerts(keychainFile, certPaths, cscPasswords, keychainPassword)'],
+            ['importCerts(keychainFile, paths, keyPasswords)', 'importCerts(keychainFile, paths, keyPasswords, keychainPassword)'],
+            ['["set-key-partition-list", "-S", "apple-tool:,apple:", "-s", "-k", password, keychainFile]', '["set-key-partition-list", "-S", "apple-tool:,apple:", "-s", "-k", keychainPassword, keychainFile]'],
+          ];
+          for (const [before, after] of replacements) {
+            if (source.split(before).length !== 2) throw new Error('Unexpected signing tool source; refusing to patch');
+            source = source.replace(before, after);
+          }
+          fs.writeFileSync(sourcePath, source);
+          KEYCHAIN_FIX
+
       - name: Set desktop package version from tag
         shell: bash
         run: |

docs/android.md

@@ -174,7 +174,7 @@ REACT_NATIVE_PACKAGER_HOSTNAME=localhost \
 
 This is the Android counterpart of the iOS local-simulator flow in [development.md](development.md): on iOS the simulator shares the Mac's loopback so `localhost:<port>` works directly; on Android you need `10.0.2.2` or `adb reverse`.
 
-## Inverted timeline scrolling
+## Inverted timeline selection
 
 Android focus and selection visibility requests must not reposition inverted timelines. The
 `modules/paseo-scroll` package keeps React Native's scroll manager interface and returns zero for
@@ -183,16 +183,6 @@ Native's Android list uses `scale: -1`, which decomposes into a 180-degree rotat
 `scaleY`; checking the scale property alone misses it. Dragging and explicit scroll
 commands still work; non-inverted scroll views keep Android's default behavior.
 
-Nested panels also keep their edge overshoot and unconsumed flings inside the panel instead of
-moving the inverted timeline in the opposite direction. Nested-scroll registration and scrolling
-inside the panel are preserved. Run the native selection and nested-scroll regressions after prebuild:
-
-```bash
-cd packages/app/android
-./gradlew :paseo-scroll:connectedDebugAndroidTest \
-  --no-daemon --max-workers=2 -Dorg.gradle.parallel=false
-```
-
 Register this package before React Native's core package through its Expo config plugin. Normal
 Android builds use the prebuilt `react-android` library, so patching Java under `node_modules` does
 not change the shipped scroll view. Keep this behavior in the app's compiled native module.

docs/connected-hosts.md

@@ -74,10 +74,7 @@ registrations remain inspectable; a changed destination requires explicit identi
 
 Both daemons advertise `connectedHosts`; the shared link additionally requires `hostMultiplexing`.
 A completes capability and pinned-identity checks on each physical recovery before admitting channels. There is no local fallback. An older daemon continues to serve existing local
-operations; requesting this feature gives update guidance. The registry retries an older destination
-with capped backoff, so it comes online once updated. Self, duplicate, changed-identity, and
-authentication failures stay in `error` until an update changes the connection, `enabled`, or
-`replaceIdentity`, or A restarts.
+operations; requesting this feature gives update guidance.
 
 Disposing a routed API releases its observations and session. It does not remove the saved host or
 affect sibling API scopes. Disposing the origin cascades to its derived scopes. Observations restore

nix/desktop-package.nix

@@ -127,7 +127,7 @@ buildNpmPackage {
         # The Nix output is not a distributable DMG, so leave it unsigned and
         # disable the hardened runtime that requires a matching signature.
         CSC_IDENTITY_AUTO_DISCOVERY=false \
-          npm exec --offline -- electron-builder \
+          ../../node_modules/.bin/electron-builder \
             --config electron-builder.yml \
             --dir \
             --mac \

nix/npm-deps.hash

@@ -1 +1 @@
-sha256-KN/AVZV/o0TleLLpmggSrdJqjFDJ/NJYVHiC54xb4jQ=
+sha256-CeT2PtYIAFwvBC9LIku8VkTl0pvKxYzSCn0QW2ManfU=

packages/app/modules/paseo-scroll/android/src/androidTest/AndroidManifest.xml

@@ -1,5 +0,0 @@
-<manifest xmlns:android="http://schemas.android.com/apk/res/android">
-  <application>
-    <activity android:name="sh.paseo.scroll.NestedScrollActivity" android:theme="@android:style/Theme.Material.Light.NoActionBar" android:exported="false" />
-  </application>
-</manifest>

packages/app/modules/paseo-scroll/android/src/androidTest/java/sh/paseo/scroll/NestedScrollTest.kt

@@ -1,134 +0,0 @@
-package sh.paseo.scroll
-
-import android.app.Activity
-import android.content.Intent
-import android.os.SystemClock
-import android.view.View
-import android.view.ViewGroup
-import android.widget.FrameLayout
-import androidx.test.ext.junit.runners.AndroidJUnit4
-import androidx.test.platform.app.InstrumentationRegistry
-import com.facebook.react.bridge.JavaOnlyArray
-import com.facebook.react.bridge.JavaOnlyMap
-import com.facebook.react.soloader.OpenSourceMergedSoMapping
-import com.facebook.react.uimanager.DisplayMetricsHolder
-import com.facebook.react.uimanager.ReactStylesDiffMap
-import com.facebook.react.uimanager.ThemedReactContext
-import com.facebook.react.views.scroll.ReactScrollView
-import com.facebook.react.views.scroll.ReactScrollViewManager
-import com.facebook.soloader.SoLoader
-import org.junit.Assert.*
-import org.junit.Test
-import org.junit.runner.RunWith
-
-class NestedScrollActivity : Activity()
-
-@RunWith(AndroidJUnit4::class)
-class NestedScrollTest {
-  @Test fun invertedTimelineDoesNotConsumePanelOvershoot() = withNestedScroll(inverted = true) { parent, child ->
-    val before = parent.scrollY
-    assertTrue(child.startNestedScroll(View.SCROLL_AXIS_VERTICAL))
-    child.scrollTo(0, 600)
-    assertEquals(600, child.scrollY)
-    assertTrue(child.dispatchNestedScroll(0, 0, 0, 100, null))
-    assertEquals("Panel overshoot must not move the inverted timeline", before, parent.scrollY)
-    child.scrollTo(0, 0)
-    assertTrue(child.dispatchNestedScroll(0, 0, 0, -100, null))
-    assertEquals("Overshoot at either edge must stay inside the panel", before, parent.scrollY)
-    child.stopNestedScroll()
-  }
-
-  @Test fun ordinaryParentStillConsumesPanelOvershoot() = withNestedScroll(inverted = false) { parent, child ->
-    val before = parent.scrollY
-    assertTrue(child.startNestedScroll(View.SCROLL_AXIS_VERTICAL))
-    child.scrollTo(0, 600)
-    assertEquals(600, child.scrollY)
-    assertTrue(child.dispatchNestedScroll(0, 0, 0, 100, null))
-    assertEquals(before + 100, parent.scrollY)
-    child.stopNestedScroll()
-  }
-
-  @Test fun panelCanStillScrollInsideInvertedTimeline() = withNestedScroll(inverted = true) { parent, child ->
-    val before = parent.scrollY
-    assertTrue(child.startNestedScroll(View.SCROLL_AXIS_VERTICAL))
-    child.scrollTo(0, 100)
-    assertTrue(child.dispatchNestedScroll(0, 100, 0, 0, null))
-    assertEquals(100, child.scrollY)
-    assertEquals(before, parent.scrollY)
-    child.stopNestedScroll()
-    parent.scrollTo(0, before + 100)
-    assertEquals(before + 100, parent.scrollY)
-  }
-
-  @Test fun invertedTimelineAbsorbsUnconsumedPanelFling() = checkFling(inverted = true)
-
-  @Test fun ordinaryParentStillAcceptsUnconsumedPanelFling() = checkFling(inverted = false)
-
-  private fun checkFling(inverted: Boolean) = withNestedScroll(
-    inverted = inverted,
-    afterFrames = { parent ->
-      if (inverted) assertEquals("Panel fling must not move the inverted timeline", 400, parent.scrollY)
-      else assertTrue("Control fling must move an ordinary parent", parent.scrollY > 400)
-    }
-  ) { parent, child ->
-    parent.scrollTo(0, 400)
-    assertTrue(child.startNestedScroll(View.SCROLL_AXIS_VERTICAL))
-    child.scrollTo(0, 600)
-    assertEquals(600, child.scrollY)
-    assertTrue(child.dispatchNestedFling(0f, 1500f, false))
-    child.stopNestedScroll()
-  }
-
-  private fun withNestedScroll(
-    inverted: Boolean,
-    afterFrames: ((ReactScrollView) -> Unit)? = null,
-    check: (ReactScrollView, ReactScrollView) -> Unit
-  ) {
-    val instrumentation = InstrumentationRegistry.getInstrumentation()
-    val activity = instrumentation.startActivitySync(
-      Intent(instrumentation.context, NestedScrollActivity::class.java).addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
-    )
-    lateinit var parent: ReactScrollView
-    try {
-      instrumentation.runOnMainSync {
-        val appContext = instrumentation.targetContext
-        DisplayMetricsHolder.initDisplayMetricsIfNotInitialized(appContext)
-        SoLoader.init(appContext, OpenSourceMergedSoMapping)
-        val reactContext = ScrollTestContext(appContext)
-        val context = ThemedReactContext(reactContext, appContext)
-        val manager = PaseoScrollPackage().createViewManager(reactContext, ReactScrollViewManager.REACT_CLASS) as ReactScrollViewManager
-        parent = manager.createViewInstance(context)
-        val child = manager.createViewInstance(context).apply { isNestedScrollingEnabled = true }
-        val panelContent = View(context)
-        child.addView(panelContent, FrameLayout.LayoutParams(300, 800))
-        val content = FrameLayout(context)
-        content.addView(child, FrameLayout.LayoutParams(300, 200).apply { topMargin = 500 })
-        parent.addView(content, FrameLayout.LayoutParams(300, 2000))
-        panelContent.measure(exact(300), exact(800))
-        panelContent.layout(0, 0, 300, 800)
-        child.measure(exact(300), exact(200))
-        child.layout(0, 500, 300, 700)
-        content.measure(exact(300), exact(2000))
-        content.layout(0, 0, 300, 2000)
-        parent.measure(exact(300), exact(400))
-        parent.layout(0, 0, 300, 400)
-        // The same transform React Native applies to an inverted FlatList on Android.
-        manager.updateProperties(parent, ReactStylesDiffMap(JavaOnlyMap.of(
-          "transform", JavaOnlyArray.of(JavaOnlyMap.of("scale", if (inverted) -1.0 else 1.0))
-        )))
-        activity.setContentView(parent, ViewGroup.LayoutParams(300, 400))
-        parent.scrollTo(0, 400)
-        check(parent, child)
-      }
-      if (afterFrames != null) {
-        // Let the framework's real fling animation advance, with an ordinary-parent control.
-        SystemClock.sleep(500)
-        instrumentation.runOnMainSync { afterFrames(parent) }
-      }
-    } finally {
-      instrumentation.runOnMainSync { activity.finish() }
-    }
-  }
-
-  private fun exact(size: Int) = View.MeasureSpec.makeMeasureSpec(size, View.MeasureSpec.EXACTLY)
-}

packages/app/modules/paseo-scroll/android/src/androidTest/java/sh/paseo/scroll/ScrollSelectionTest.kt

@@ -8,6 +8,7 @@ import android.widget.FrameLayout
 import android.widget.TextView
 import androidx.test.ext.junit.runners.AndroidJUnit4
 import androidx.test.platform.app.InstrumentationRegistry
+import com.facebook.react.bridge.BridgeReactContext
 import com.facebook.react.bridge.JavaOnlyArray
 import com.facebook.react.bridge.JavaOnlyMap
 import com.facebook.react.soloader.OpenSourceMergedSoMapping
@@ -69,7 +70,7 @@ class ScrollSelectionTest {
       val appContext = instrumentation.targetContext
       DisplayMetricsHolder.initDisplayMetricsIfNotInitialized(appContext)
       SoLoader.init(appContext, OpenSourceMergedSoMapping)
-      val reactContext = ScrollTestContext(appContext)
+      val reactContext = BridgeReactContext(appContext)
       val context = ThemedReactContext(reactContext, appContext)
       val manager = PaseoScrollPackage().createViewManager(reactContext, ReactScrollViewManager.REACT_CLASS) as ReactScrollViewManager
       val scroll = manager.createViewInstance(context)

packages/app/modules/paseo-scroll/android/src/androidTest/java/sh/paseo/scroll/ScrollTestContext.java

@@ -1,19 +0,0 @@
-package sh.paseo.scroll;
-
-import android.content.Context;
-import com.facebook.react.bridge.BridgeReactContext;
-import com.facebook.react.uimanager.events.BlackHoleEventDispatcher;
-import com.facebook.react.uimanager.events.EventDispatcher;
-import com.facebook.react.uimanager.events.EventDispatcherProvider;
-
-/** Native-only tests use RN's dispatcher for a context without a JS instance. */
-final class ScrollTestContext extends BridgeReactContext implements EventDispatcherProvider {
-  ScrollTestContext(Context context) {
-    super(context);
-  }
-
-  @Override
-  public EventDispatcher getEventDispatcher() {
-    return BlackHoleEventDispatcher.INSTANCE;
-  }
-}

packages/app/modules/paseo-scroll/android/src/main/java/sh/paseo/scroll/PaseoScrollPackage.kt

@@ -2,7 +2,6 @@ package sh.paseo.scroll
 
 import android.graphics.Matrix
 import android.graphics.Rect
-import android.view.View
 import com.facebook.react.ReactPackage
 import com.facebook.react.ViewManagerOnDemandReactPackage
 import com.facebook.react.bridge.NativeModule
@@ -31,30 +30,13 @@ private class PaseoScrollViewManager : ReactScrollViewManager() {
 private class PaseoScrollView(context: ThemedReactContext) : ReactScrollView(context) {
   private val transformValues = FloatArray(9)
 
-  private val isInverted: Boolean
-    get() {
-      // RN's Android scale: -1 becomes a 180-degree rotation with positive scaleY.
-      matrix.getValues(transformValues)
-      return transformValues[Matrix.MSCALE_Y] < 0
-    }
-
   // Both RN focus handling and Android selection visibility requests use this calculation.
   // Its coordinates ignore inversion. Keep focus/selection bookkeeping, but leave timeline
   // movement to user gestures and explicit scroll commands.
   override fun computeScrollDeltaToGetChildRectOnScreen(rect: Rect): Int {
-    if (isInverted) return 0
+    // RN's Android scale: -1 becomes a 180-degree rotation with positive scaleY.
+    matrix.getValues(transformValues)
+    if (transformValues[Matrix.MSCALE_Y] < 0) return 0
     return super.computeScrollDeltaToGetChildRectOnScreen(rect)
   }
-
-  // A nested panel's remaining delta uses its own visual direction. Consuming it in
-  // an inverted timeline moves the timeline the opposite way when the panel hits an edge.
-  override fun onNestedScroll(target: View, dxConsumed: Int, dyConsumed: Int, dxUnconsumed: Int, dyUnconsumed: Int) {
-    if (isInverted) return
-    super.onNestedScroll(target, dxConsumed, dyConsumed, dxUnconsumed, dyUnconsumed)
-  }
-
-  override fun onNestedFling(target: View, velocityX: Float, velocityY: Float, consumed: Boolean): Boolean {
-    if (isInverted && !consumed) return true
-    return super.onNestedFling(target, velocityX, velocityY, consumed)
-  }
 }

packages/app/src/terminal/runtime/terminal-emulator-runtime.browser.test.ts

@@ -717,13 +717,11 @@ describe("terminal emulator runtime in a real browser", () => {
     { name: "DA1-zero", bytes: "\x1b[0c" },
     { name: "DA2", bytes: "\x1b[>c" },
     { name: "DA3", bytes: "\x1b[=c" },
-    { name: "XTVERSION", bytes: "\x1b[>q" },
     { name: "DSR-5", bytes: "\x1b[5n" },
     { name: "DSR-6", bytes: "\x1b[6n" },
     { name: "DSR-?6", bytes: "\x1b[?6n" },
     { name: "DECRQM", bytes: "\x1b[1$p" },
     { name: "DECRQM-?", bytes: "\x1b[?1$p" },
-    { name: "DECRQSS", bytes: "\x1bP$qm\x1b\\" },
     { name: "OSC-10-foreground-color", bytes: "\x1b]10;?\x07" },
     { name: "OSC-11-background-color", bytes: "\x1b]11;?\x07" },
     { name: "OSC-12-cursor-color", bytes: "\x1b]12;?\x07" },

packages/app/src/terminal/runtime/terminal-emulator-runtime.ts

@@ -647,7 +647,6 @@ export class TerminalEmulatorRuntime {
       terminal.parser.registerCsiHandler({ final: "c" }, () => true);
       terminal.parser.registerCsiHandler({ prefix: ">", final: "c" }, () => true);
       terminal.parser.registerCsiHandler({ prefix: "=", final: "c" }, () => true);
-      terminal.parser.registerCsiHandler({ prefix: ">", final: "q" }, () => true);
       terminal.parser.registerCsiHandler({ final: "n" }, () => true);
       terminal.parser.registerCsiHandler({ prefix: "?", final: "n" }, () => true);
       terminal.parser.registerCsiHandler({ final: "R" }, () => true);
@@ -656,7 +655,6 @@ export class TerminalEmulatorRuntime {
         { prefix: "?", intermediates: "$", final: "p" },
         () => true,
       );
-      terminal.parser.registerDcsHandler({ intermediates: "$", final: "q" }, () => true);
       for (const code of [10, 11, 12]) {
         terminal.parser.registerOscHandler(code, (data) => data.trim() === "?");
       }

packages/client/src/node/index.ts

@@ -204,16 +204,15 @@ export function createHostTransportFactory(
 }
 export function createHostClient(
   connection: string,
-  config: Omit<DaemonClientConfig, "url"> & HostTransportOptions,
+  config: Omit<DaemonClientConfig, "url" | "transportFactory"> & HostTransportOptions,
   budget?: HostTransportBudget,
 ): DaemonClient {
   const target = parseHostTarget(connection);
-  const { webSocketAgent, transportFactory, ...clientConfig } = config;
+  const { webSocketAgent, ...clientConfig } = config;
   return new DaemonClient({
     ...clientConfig,
     url: "ws://host-connector/ws",
     ...(target.password ? { password: target.password } : {}),
-    transportFactory:
-      transportFactory ?? createHostTransportFactory(connection, budget, { webSocketAgent }),
+    transportFactory: createHostTransportFactory(connection, budget, { webSocketAgent }),
   });
 }

packages/desktop/package.json

@@ -41,7 +41,7 @@
     "@types/node": "24.6.0",
     "@types/ws": "^8.5.14",
     "electron": "44.2.0",
-    "electron-builder": "26.18.0",
+    "electron-builder": "26.8.1",
     "typescript": "5.9.3",
     "unzip-crx-3": "^0.2.0",
     "vitest": "^4.1.6",

packages/server/src/server/agent/providers/claude/rewind-session-store.ts

@@ -0,0 +1,63 @@
+import { createReadStream } from "node:fs";
+import { appendFile } from "node:fs/promises";
+import path from "node:path";
+import { createInterface } from "node:readline";
+import type { SessionStore, SessionStoreEntry } from "@anthropic-ai/claude-agent-sdk";
+
+const APPEND_CHUNK_LENGTH = 1 << 20;
+
+export function projectFolderSessionStore(projectFolder: string): SessionStore {
+  const transcriptPath = (sessionId: string) => path.join(projectFolder, `${sessionId}.jsonl`);
+  return {
+    async load({ sessionId }) {
+      const input = createReadStream(transcriptPath(sessionId), { encoding: "utf8" });
+      const lines = createInterface({ input, crlfDelay: Infinity });
+      const entries: SessionStoreEntry[] = [];
+      try {
+        for await (const line of lines) {
+          const entry = parseTranscriptEntry(line);
+          if (entry) entries.push(entry);
+        }
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
+        throw error;
+      } finally {
+        lines.close();
+        input.destroy();
+      }
+      return entries;
+    },
+    async append({ sessionId }, entries) {
+      let chunk = "";
+      for (const entry of entries) {
+        chunk += `${JSON.stringify(entry)}\n`;
+        if (chunk.length >= APPEND_CHUNK_LENGTH) {
+          await appendFile(transcriptPath(sessionId), chunk, "utf8");
+          chunk = "";
+        }
+      }
+      await appendFile(transcriptPath(sessionId), chunk, "utf8");
+    },
+  };
+}
+
+function parseTranscriptEntry(line: string): SessionStoreEntry | null {
+  if (!line.trim()) return null;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(line);
+  } catch {
+    // Skip a line that is not JSON, as the SDK's own transcript reader does.
+    return null;
+  }
+  return isSessionStoreEntry(parsed) ? parsed : null;
+}
+
+function isSessionStoreEntry(value: unknown): value is SessionStoreEntry {
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    !Array.isArray(value) &&
+    typeof (value as { type?: unknown }).type === "string"
+  );
+}

packages/server/src/server/agent/providers/claude/rewind-worker.ts

@@ -0,0 +1,43 @@
+import path from "node:path";
+import { parentPort, workerData } from "node:worker_threads";
+import { forkSession } from "@anthropic-ai/claude-agent-sdk";
+import { projectFolderSessionStore } from "./rewind-session-store.js";
+
+export interface ClaudeForkRequest {
+  sessionId: string;
+  upToMessageId: string;
+  transcriptPath: string;
+}
+
+export type ClaudeForkReply =
+  | { kind: "forked"; sessionId: string }
+  | {
+      kind: "failed";
+      message: string;
+      stack: string | undefined;
+      properties: Record<string, unknown>;
+    };
+
+const port = parentPort!;
+const request: ClaudeForkRequest = workerData;
+try {
+  // On its own, the SDK looks for the session under the daemon's CLAUDE_CONFIG_DIR, while a
+  // provider can point Claude Code at another one. Forking through a store rooted at the
+  // transcript's folder reads the session where Claude Code wrote it and writes the fork beside it.
+  const fork = await forkSession(request.sessionId, {
+    upToMessageId: request.upToMessageId,
+    sessionStore: projectFolderSessionStore(path.dirname(request.transcriptPath)),
+  });
+  port.postMessage({ kind: "forked", sessionId: fork.sessionId } satisfies ClaudeForkReply);
+} catch (cause) {
+  const error = cause instanceof Error ? cause : new Error(String(cause));
+  const failure = { kind: "failed", message: error.message, stack: error.stack } as const;
+  try {
+    port.postMessage({ ...failure, properties: { ...error } } satisfies ClaudeForkReply);
+  } catch (cloneError) {
+    if (!(cloneError instanceof DOMException) || cloneError.name !== "DataCloneError") {
+      throw cloneError;
+    }
+    port.postMessage({ ...failure, properties: {} } satisfies ClaudeForkReply);
+  }
+}

packages/server/src/server/agent/providers/claude/rewind.test.ts

@@ -1,4 +1,5 @@
 import { randomUUID } from "node:crypto";
+import { subscribe, unsubscribe } from "node:diagnostics_channel";
 import {
   mkdirSync,
   mkdtempSync,
@@ -10,9 +11,11 @@ import {
 } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
+import { Worker } from "node:worker_threads";
 import { afterEach, describe, expect, test } from "vitest";
-import type { Query } from "@anthropic-ai/claude-agent-sdk";
+import { forkSession, type Query } from "@anthropic-ai/claude-agent-sdk";
 
+import { measureMainThreadWork } from "../../../../test-utils/main-thread-work.js";
 import {
   findSteeredMessageParent,
   revertClaudeConversation,
@@ -20,6 +23,7 @@ import {
   revertClaudeFiles,
   realClaudeRewindSdk,
 } from "./rewind.js";
+import { projectFolderSessionStore } from "./rewind-session-store.js";
 import { FakeClaudeSdk } from "./test-rewind-claude-sdk.js";
 
 describe("Claude rewind", () => {
@@ -278,8 +282,196 @@ describe("Claude rewind against the Claude SDK", () => {
       "tool output",
     ]);
   });
+
+  test("writes the fork beside the original and leaves the original untouched", async () => {
+    tempRoot = mkdtempSync(path.join(tmpdir(), "claude-rewind-fork-"));
+    const projectDir = path.join(tempRoot, "projects", "-repo");
+    mkdirSync(projectDir, { recursive: true });
+    const sessionId = randomUUID();
+    const firstUser = randomUUID();
+    const firstReply = randomUUID();
+    const secondUser = randomUUID();
+    const transcriptPath = path.join(projectDir, `${sessionId}.jsonl`);
+    writeTranscript(transcriptPath, sessionId, [
+      { type: "user", uuid: firstUser, parentUuid: null, text: "first" },
+      { type: "assistant", uuid: firstReply, parentUuid: firstUser, text: "first reply" },
+      { type: "user", uuid: secondUser, parentUuid: firstReply, text: "second" },
+      { type: "assistant", uuid: randomUUID(), parentUuid: secondUser, text: "second reply" },
+    ]);
+    const original = readFileSync(transcriptPath, "utf8");
+
+    const fork = await realClaudeRewindSdk.forkSession(sessionId, {
+      upToMessageId: secondUser,
+      transcriptPath,
+    });
+
+    const forkPath = path.join(projectDir, `${fork.sessionId}.jsonl`);
+    expect(readdirSync(projectDir).sort()).toEqual(
+      [`${sessionId}.jsonl`, `${fork.sessionId}.jsonl`].sort(),
+    );
+    expect(readMessageTexts(forkPath)).toEqual(["first", "first reply", "second"]);
+    const forkSessionIds = readFileSync(forkPath, "utf8")
+      .trim()
+      .split("\n")
+      .map((line) => (JSON.parse(line) as { sessionId: string }).sessionId);
+    expect(forkSessionIds).toEqual([
+      fork.sessionId,
+      fork.sessionId,
+      fork.sessionId,
+      fork.sessionId,
+    ]);
+    expect(readFileSync(transcriptPath, "utf8")).toBe(original);
+  });
+
+  test("rejects with the SDK's own error when the transcript is missing", async () => {
+    tempRoot = mkdtempSync(path.join(tmpdir(), "claude-rewind-missing-"));
+    const sessionId = randomUUID();
+
+    await expect(
+      realClaudeRewindSdk.forkSession(sessionId, {
+        upToMessageId: randomUUID(),
+        transcriptPath: path.join(tempRoot, `${sessionId}.jsonl`),
+      }),
+    ).rejects.toThrow(new Error(`Session ${sessionId} not found`));
+  });
+
+  test("rejects with the name and message of the error the SDK raises", async () => {
+    tempRoot = mkdtempSync(path.join(tmpdir(), "claude-rewind-invalid-"));
+    const sessionId = randomUUID();
+    const sdkError = await forkSession(sessionId, { upToMessageId: "not-a-uuid" }).then(
+      () => null,
+      (error: Error) => error,
+    );
+    expect(sdkError).toBeInstanceOf(Error);
+
+    await expect(
+      realClaudeRewindSdk.forkSession(sessionId, {
+        upToMessageId: "not-a-uuid",
+        transcriptPath: path.join(tempRoot, `${sessionId}.jsonl`),
+      }),
+    ).rejects.toMatchObject({ name: sdkError?.name, message: sdkError?.message });
+  });
+
+  test("keeps a filesystem error's code when the fork fails in the worker", async () => {
+    tempRoot = mkdtempSync(path.join(tmpdir(), "claude-rewind-eisdir-"));
+    const sessionId = randomUUID();
+    const transcriptPath = path.join(tempRoot, `${sessionId}.jsonl`);
+    mkdirSync(transcriptPath);
+
+    await expect(
+      realClaudeRewindSdk.forkSession(sessionId, { upToMessageId: randomUUID(), transcriptPath }),
+    ).rejects.toMatchObject({ name: "Error", code: "EISDIR" });
+  });
+
+  test("forks one conversation at a time", async () => {
+    tempRoot = mkdtempSync(path.join(tmpdir(), "claude-rewind-queue-"));
+    const projectDir = path.join(tempRoot, "projects", "-repo");
+    mkdirSync(projectDir, { recursive: true });
+    const forks = [randomUUID(), randomUUID()].map((sessionId) => {
+      const user = randomUUID();
+      const transcriptPath = path.join(projectDir, `${sessionId}.jsonl`);
+      writeTranscript(transcriptPath, sessionId, [
+        { type: "user", uuid: user, parentUuid: null, text: "first" },
+        { type: "assistant", uuid: randomUUID(), parentUuid: user, text: "first reply" },
+      ]);
+      return { sessionId, upToMessageId: user, transcriptPath };
+    });
+    const events: string[] = [];
+    let started = 0;
+    function recordWorker(message: unknown): void {
+      if (typeof message !== "object" || message === null || !("worker" in message)) return;
+      if (!(message.worker instanceof Worker)) return;
+      const fork = ++started;
+      events.push(`start ${fork}`);
+      message.worker.once("message", () => events.push(`reply ${fork}`));
+    }
+
+    subscribe("worker_threads", recordWorker);
+    try {
+      await Promise.all(
+        forks.map(({ sessionId, upToMessageId, transcriptPath }) =>
+          realClaudeRewindSdk.forkSession(sessionId, { upToMessageId, transcriptPath }),
+        ),
+      );
+    } finally {
+      unsubscribe("worker_threads", recordWorker);
+    }
+
+    expect(events).toEqual(["start 1", "reply 1", "start 2", "reply 2"]);
+  });
+
+  test("forks a long transcript without blocking the daemon's event loop", async () => {
+    tempRoot = mkdtempSync(path.join(tmpdir(), "claude-rewind-long-"));
+    const projectDir = path.join(tempRoot, "projects", "-repo");
+    mkdirSync(projectDir, { recursive: true });
+    const sessionId = randomUUID();
+    const transcriptPath = path.join(projectDir, `${sessionId}.jsonl`);
+    const turns = 43_000;
+    const lastUser = writeLongTranscript(transcriptPath, sessionId, turns);
+
+    const { result: fork, blockingMs } = await measureMainThreadWork(
+      "claude fork main-thread work",
+      () => realClaudeRewindSdk.forkSession(sessionId, { upToMessageId: lastUser, transcriptPath }),
+    );
+
+    expect(blockingMs).toBeLessThan(50);
+    const forkLines = readFileSync(path.join(projectDir, `${fork.sessionId}.jsonl`), "utf8")
+      .trim()
+      .split("\n");
+    expect(forkLines).toHaveLength(turns * 2);
+    expect(JSON.parse(forkLines[turns * 2 - 2]!).forkedFrom).toEqual({
+      sessionId,
+      messageUuid: lastUser,
+    });
+  });
 });
 
+describe("Claude project folder session store", () => {
+  let root: string | null = null;
+
+  afterEach(() => {
+    if (root) rmSync(root, { recursive: true, force: true });
+    root = null;
+  });
+
+  test("appends entries after existing ones, byte for byte, and loads them back", async () => {
+    root = mkdtempSync(path.join(tmpdir(), "claude-rewind-store-"));
+    const store = projectFolderSessionStore(root);
+    const key = { projectKey: "-repo", sessionId: randomUUID() };
+    const transcriptPath = path.join(root, `${key.sessionId}.jsonl`);
+    const existing = { type: "user", uuid: randomUUID(), message: { content: "already there" } };
+    writeFileSync(transcriptPath, `${JSON.stringify(existing)}\n`);
+    const entries = Array.from({ length: 4_000 }, (_, index) => ({
+      type: "assistant",
+      uuid: randomUUID(),
+      message: { content: `reply ${index} ✓ ${"x".repeat(1_000)}` },
+    }));
+
+    await store.append(key, entries);
+
+    expect(readFileSync(transcriptPath, "utf8")).toBe(
+      [existing, ...entries].map((entry) => `${JSON.stringify(entry)}\n`).join(""),
+    );
+    expect(await store.load(key)).toEqual([existing, ...entries]);
+  });
+});
+
+function writeLongTranscript(transcriptPath: string, sessionId: string, turns: number): string {
+  const toolOutput = 'line 1: "quoted" output\twith\\escapes\n'.repeat(4);
+  const lines: TranscriptLine[] = [];
+  let parentUuid: string | null = null;
+  let lastUser = "";
+  for (let turn = 0; turn < turns; turn++) {
+    lastUser = randomUUID();
+    const reply = randomUUID();
+    lines.push({ type: "user", uuid: lastUser, parentUuid, text: `question ${turn}` });
+    lines.push({ type: "assistant", uuid: reply, parentUuid: lastUser, text: toolOutput });
+    parentUuid = reply;
+  }
+  writeTranscript(transcriptPath, sessionId, lines);
+  return lastUser;
+}
+
 test.runIf(process.platform === "linux")(
   "releases the transcript descriptor after an early steer match",
   async () => {

packages/server/src/server/agent/providers/claude/rewind.ts

@@ -1,13 +1,10 @@
 import { createReadStream } from "node:fs";
-import { appendFile, readFile } from "node:fs/promises";
-import path from "node:path";
 import { createInterface } from "node:readline";
-import {
-  forkSession as claudeForkSession,
-  type Query,
-  type SessionStore,
-  type SessionStoreEntry,
-} from "@anthropic-ai/claude-agent-sdk";
+import { Worker } from "node:worker_threads";
+import type { Query } from "@anthropic-ai/claude-agent-sdk";
+import pLimit from "p-limit";
+import { resolveWorkerEntrypoint } from "../../../../utils/worker-entrypoint.js";
+import type { ClaudeForkReply, ClaudeForkRequest } from "./rewind-worker.js";
 
 export interface ClaudeRewindSdk {
   forkSession(
@@ -16,60 +13,42 @@ export interface ClaudeRewindSdk {
   ): Promise<{ sessionId: string }>;
 }
 
-// On its own, the SDK looks for the session under the daemon's CLAUDE_CONFIG_DIR, while a
-// provider can point Claude Code at another one. Forking through a store rooted at the
-// transcript's folder reads the session where Claude Code wrote it and writes the fork beside it.
+const source = import.meta.url.endsWith(".ts");
+const workerUrl = new URL(source ? "./rewind-worker.ts" : "./rewind-worker.js", import.meta.url);
+const rewindWorker = resolveWorkerEntrypoint(workerUrl);
+const forks = pLimit(1);
+
 export const realClaudeRewindSdk: ClaudeRewindSdk = {
   forkSession: (sessionId, options) =>
-    claudeForkSession(sessionId, {
-      upToMessageId: options.upToMessageId,
-      sessionStore: projectFolderSessionStore(path.dirname(options.transcriptPath)),
-    }),
+    forks(() =>
+      forkInWorker({
+        sessionId,
+        upToMessageId: options.upToMessageId,
+        transcriptPath: options.transcriptPath,
+      }),
+    ),
 };
 
-function projectFolderSessionStore(projectFolder: string): SessionStore {
-  const transcriptPath = (sessionId: string) => path.join(projectFolder, `${sessionId}.jsonl`);
-  return {
-    async load({ sessionId }) {
-      let text: string;
-      try {
-        text = await readFile(transcriptPath(sessionId), "utf8");
-      } catch (error) {
-        if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
-        throw error;
+function forkInWorker(request: ClaudeForkRequest): Promise<{ sessionId: string }> {
+  return new Promise((resolve, reject) => {
+    const worker = new Worker(rewindWorker.entrypoint, {
+      eval: rewindWorker.eval,
+      execArgv: [],
+      workerData: request,
+    });
+    worker.once("message", (reply: ClaudeForkReply) => {
+      void worker.terminate();
+      if (reply.kind === "forked") {
+        resolve({ sessionId: reply.sessionId });
+        return;
       }
-      return parseTranscriptEntries(text);
-    },
-    async append({ sessionId }, entries) {
-      const lines = entries.map((entry) => `${JSON.stringify(entry)}\n`).join("");
-      await appendFile(transcriptPath(sessionId), lines, "utf8");
-    },
-  };
-}
-
-function parseTranscriptEntries(text: string): SessionStoreEntry[] {
-  const entries: SessionStoreEntry[] = [];
-  for (const line of text.split("\n")) {
-    if (!line.trim()) continue;
-    let parsed: unknown;
-    try {
-      parsed = JSON.parse(line);
-    } catch {
-      // Skip a line that is not JSON, as the SDK's own transcript reader does.
-      continue;
-    }
-    if (isSessionStoreEntry(parsed)) entries.push(parsed);
-  }
-  return entries;
-}
-
-function isSessionStoreEntry(value: unknown): value is SessionStoreEntry {
-  return (
-    typeof value === "object" &&
-    value !== null &&
-    !Array.isArray(value) &&
-    typeof (value as { type?: unknown }).type === "string"
-  );
+      const error = new Error(reply.message);
+      error.stack = reply.stack;
+      reject(Object.assign(error, reply.properties));
+    });
+    worker.once("error", reject);
+    worker.once("exit", (code) => reject(new Error(`Claude rewind worker exited (code ${code})`)));
+  });
 }
 
 /**

packages/server/src/server/connected-hosts/hosts.e2e.test.ts

@@ -784,211 +784,6 @@ test("old capabilities fail before execution and authentication errors recover t
   expect((await online(paseo)).hosts[0]!.serverId).toBe(b.daemon.getServerId());
 });
 
-async function updatableDestination() {
-  let features: { connectedHosts: boolean; hostMultiplexing: boolean } | undefined;
-  let holding = false;
-  const held: (() => void)[] = [];
-  let connections = 0;
-  const http = createServer();
-  const ws = new WebSocketServer({ server: http });
-  ws.on("connection", (socket) => {
-    connections++;
-    socket.on("message", (data) => {
-      const frame = JSON.parse(data.toString());
-      if (frame.type === "ping") socket.send(JSON.stringify({ type: "pong" }));
-      if (frame.type !== "hello") return;
-      const reply = () =>
-        socket.send(
-          JSON.stringify({
-            type: "session",
-            message: {
-              type: "status",
-              payload: {
-                status: "server_info",
-                serverId: "srv_updated",
-                hostname: "updated",
-                version: "0.12.0",
-                ...(features ? { features } : {}),
-              },
-            },
-          }),
-        );
-      if (holding) held.push(reply);
-      else reply();
-    });
-  });
-  http.listen(0, "127.0.0.1");
-  await once(http, "listening");
-  cleanup.push(async () => {
-    for (const socket of ws.clients) socket.terminate();
-    await new Promise<void>((resolve) => ws.close(() => resolve()));
-    await new Promise<void>((resolve) => http.close(() => resolve()));
-  });
-  const address = http.address();
-  if (!address || typeof address === "string") throw new Error("Missing destination port");
-  return {
-    port: address.port,
-    connections: () => connections,
-    hold: () => {
-      holding = true;
-    },
-    update: () => {
-      features = { connectedHosts: true, hostMultiplexing: true };
-      holding = false;
-      for (const reply of held.splice(0)) reply();
-    },
-  };
-}
-async function capabilityRetry(paseo: ReturnType<typeof createPaseoApi>): Promise<number> {
-  let retryAt = "";
-  await expect
-    .poll(
-      async () => {
-        const row = (await paseo.hosts.list()).hosts[0];
-        retryAt = row?.nextRetryAt ?? "";
-        return row;
-      },
-      { timeout: 5000 },
-    )
-    .toMatchObject({
-      status: "offline",
-      nextRetryAt: expect.any(String),
-      error: { code: "unsupported_capability" },
-    });
-  return Date.parse(retryAt);
-}
-
-test("a destination updated past unsupported_capability keeps its guidance while retrying and comes online, while duplicate_host stays terminal", async () => {
-  const destination = await updatableDestination();
-  const a = await daemon();
-  const { paseo } = await api(a);
-  const host = await paseo.hosts.add({ connection: `127.0.0.1:${destination.port}` });
-  await capabilityRetry(paseo);
-  destination.hold();
-  await expect
-    .poll(async () => (await paseo.hosts.list()).hosts[0], { timeout: 5000 })
-    .toMatchObject({ status: "connecting", error: { code: "unsupported_capability" } });
-  await expect(paseo.hosts.client("srv_updated")).rejects.toMatchObject({
-    code: "unsupported_capability",
-  });
-  destination.update();
-  expect((await online(paseo)).hosts[0]).toMatchObject({
-    registrationId: host.registrationId,
-    serverId: "srv_updated",
-    nextRetryAt: null,
-    error: null,
-  });
-  await paseo.hosts.add({ connection: `ws://127.0.0.1:${destination.port}/ws` });
-  await expect
-    .poll(async () => (await paseo.hosts.list()).hosts[1], { timeout: 5000 })
-    .toMatchObject({ status: "error", nextRetryAt: null, error: { code: "duplicate_host" } });
-});
-
-test("disabling or removing a host cancels its pending capability retry", async () => {
-  const destination = await updatableDestination();
-  const a = await daemon();
-  const { paseo } = await api(a);
-  const host = await paseo.hosts.add({ connection: `127.0.0.1:${destination.port}` });
-  let retryAt = await capabilityRetry(paseo);
-  let connections = destination.connections();
-  await paseo.hosts.update(host.registrationId, { enabled: false });
-  await new Promise((resolve) => setTimeout(resolve, retryAt - Date.now() + 500));
-  expect(destination.connections()).toBe(connections);
-  await paseo.hosts.update(host.registrationId, { enabled: true });
-  retryAt = await capabilityRetry(paseo);
-  connections = destination.connections();
-  await paseo.hosts.remove(host.registrationId);
-  await new Promise((resolve) => setTimeout(resolve, retryAt - Date.now() + 500));
-  expect(destination.connections()).toBe(connections);
-});
-
-import {
-  createDaemonChannel,
-  exportPublicKey,
-  generateKeyPair,
-  openDaemonSecureChannel,
-  type Transport,
-} from "@getpaseo/relay/e2ee";
-test("a capability retry over a relay keeps the protected endpoint security it negotiated", async () => {
-  const keys = generateKeyPair();
-  const legacyReceived: unknown[] = [];
-  let connections = 0;
-  let retryClosed = false;
-  const http = createServer();
-  const ws = new WebSocketServer({ server: http });
-  ws.on("connection", (socket) => {
-    connections++;
-    const wire: Transport = {
-      send: (data) => socket.send(data),
-      close: (code, reason) => socket.close(code, reason),
-      onmessage: null,
-      onclose: null,
-      onerror: null,
-    };
-    socket.on("message", (data, isBinary) => {
-      const bytes = Buffer.from(data as Buffer);
-      wire.onmessage?.({
-        data: isBinary
-          ? bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength)
-          : bytes.toString(),
-        isBinary,
-      });
-    });
-    socket.on("close", (code, reason) => wire.onclose?.(code, reason.toString()));
-    if (connections > 1) {
-      socket.on("close", () => {
-        retryClosed = true;
-      });
-      void createDaemonChannel(wire, keys, {
-        onmessage: (data) => legacyReceived.push(data),
-      }).catch(() => {});
-      return;
-    }
-    const channel = openDaemonSecureChannel(wire, {
-      daemonKeyPair: keys,
-      events: {
-        onmessage: (data) => {
-          if (typeof data !== "string" || JSON.parse(data).type !== "hello") return;
-          void channel.then((secure) =>
-            secure.send(
-              JSON.stringify({
-                type: "session",
-                message: {
-                  type: "status",
-                  payload: {
-                    status: "server_info",
-                    serverId: "srv_relayed",
-                    hostname: "relayed",
-                    version: "0.12.0",
-                  },
-                },
-              }),
-            ),
-          );
-        },
-      },
-    });
-    void channel.catch(() => {});
-  });
-  http.listen(0, "127.0.0.1");
-  await once(http, "listening");
-  cleanup.push(async () => {
-    for (const socket of ws.clients) socket.terminate();
-    await new Promise<void>((resolve) => ws.close(() => resolve()));
-    await new Promise<void>((resolve) => http.close(() => resolve()));
-  });
-  const address = http.address();
-  if (!address || typeof address === "string") throw new Error("Missing relay port");
-  const a = await daemon();
-  const { paseo } = await api(a);
-  await paseo.hosts.add({
-    connection: `relay://127.0.0.1:${address.port}/srv_relayed?key=${encodeURIComponent(exportPublicKey(keys.publicKey))}`,
-  });
-  await capabilityRetry(paseo);
-  await expect.poll(() => retryClosed, { timeout: 15000 }).toBe(true);
-  expect(legacyReceived).toEqual([]);
-});
-
 test("an unreachable saved target becomes online after its daemon starts without being added again", async () => {
   const reservation = createServer();
   reservation.listen(0, "127.0.0.1");

packages/server/src/server/connected-hosts/index.ts

@@ -7,12 +7,10 @@ import { z } from "zod";
 import {
   createHostClient,
   createHostChannelTransport,
-  createHostTransportFactory,
   parseHostTarget,
   HostTransportBudget,
 } from "@getpaseo/client/node";
 import type { DaemonClient } from "@getpaseo/client/internal/daemon-client";
-import type { DaemonTransportFactory } from "@getpaseo/client/internal/daemon-client-transport-types";
 import {
   HostSummarySchema,
   HostAddSchema,
@@ -237,30 +235,23 @@ export class ConnectedHosts {
       if (route.registrationId === id)
         route.close(code, "Host access was disabled, replaced or removed");
   }
-  private start(
-    row: Saved,
-    resume?: { failures: number; transports: DaemonTransportFactory },
-  ): void {
+  private start(row: Saved): void {
     if (!row.enabled || this.closed) return;
-    const transports =
-      resume?.transports ??
-      createHostTransportFactory(row.connection, this.budget, {
-        webSocketAgent: webSocketProxyAgent,
-      });
     let stopped = false;
-    let attempts = resume?.failures ?? 0;
-    let retry: ReturnType<typeof setTimeout> | undefined;
-    const client = createHostClient(row.connection, {
-      clientId: `host-link-${this.self.serverId}-${row.registrationId}`,
-      connectTimeoutMs: 10000,
-      transportFactory: transports,
-    });
+    const client = createHostClient(
+      row.connection,
+      {
+        clientId: `host-link-${this.self.serverId}-${row.registrationId}`,
+        connectTimeoutMs: 10000,
+        webSocketAgent: webSocketProxyAgent,
+      },
+      this.budget,
+    );
     const live: Live = {
       client,
       accepted: false,
       stop: () => {
         stopped = true;
-        clearTimeout(retry);
         void client.close();
       },
     };
@@ -294,7 +285,7 @@ export class ConnectedHosts {
         if (info.features?.connectedHosts !== true || info.features?.hostMultiplexing !== true)
           throw new HostError(
             "unsupported_capability",
-            "Update the destination daemon to use connected hosts; retrying automatically.",
+            "Update the destination daemon to use connected hosts.",
           );
         // Pin and persist under the same writer as management to prevent discovery races.
         await this.mutate(async () => {
@@ -313,22 +304,16 @@ export class ConnectedHosts {
           if (stopped || client.getLastServerInfoMessage() !== info || !client.isConnected) return;
           Object.assign(row, next);
           live.accepted = true;
-          attempts = 0;
           this.changed();
         });
       } catch (error) {
         if (stopped) return;
+        row.status = "error";
         row.error = connectionFailure(error, client.authFailureReason !== null) ?? {
           code: "host_offline",
           message: "Host connection failed",
         };
-        if (terminalFailures.has(row.error.code)) {
-          row.status = "error";
-          row.nextRetryAt = null;
-        } else {
-          stopped = true;
-          retry = this.scheduleAcceptanceRetry(row, attempts, transports);
-        }
+        row.nextRetryAt = null;
         this.changed();
         await client.close();
       }
@@ -344,17 +329,18 @@ export class ConnectedHosts {
         if (route.registrationId === row.registrationId) route.close();
       row.status = state.status === "connecting" ? "connecting" : "offline";
       row.nextRetryAt = state.status === "disconnected" ? (state.nextRetryAt ?? null) : null;
-      if (state.status === "disconnected")
-        row.error = connectionFailure(
-          Object.assign(new Error("Check the SSH configuration and daemon credentials"), {
-            code: state.failureCode,
-          }),
-          client.authFailureReason !== null,
-        ) ?? {
-          code: "host_offline",
-          message: "Cannot reach host. Check the connection; retrying automatically.",
-        };
-      else if (row.error?.code !== "unsupported_capability") row.error = null;
+      row.error =
+        state.status === "disconnected"
+          ? (connectionFailure(
+              Object.assign(new Error("Check the SSH configuration and daemon credentials"), {
+                code: state.failureCode,
+              }),
+              client.authFailureReason !== null,
+            ) ?? {
+              code: "host_offline",
+              message: "Cannot reach host. Check the connection; retrying automatically.",
+            })
+          : null;
       if (row.error?.code === "authentication_failed") {
         row.status = "error";
         row.nextRetryAt = null;
@@ -365,18 +351,6 @@ export class ConnectedHosts {
     });
     void client.connect().catch(() => {});
   }
-  private scheduleAcceptanceRetry(
-    row: Saved,
-    failures: number,
-    transports: DaemonTransportFactory,
-  ): ReturnType<typeof setTimeout> {
-    const delay = acceptanceRetryDelayMs(failures);
-    row.status = "offline";
-    row.nextRetryAt = new Date(Date.now() + delay).toISOString();
-    const retry = setTimeout(() => this.start(row, { failures: failures + 1, transports }), delay);
-    retry.unref();
-    return retry;
-  }
   async openRoute(input: {
     serverId: string;
     scopeId: string;
@@ -557,20 +531,6 @@ export class ConnectedHosts {
   }
 }
 
-const ACCEPTANCE_RETRY_BASE_MS = 1500;
-const ACCEPTANCE_RETRY_MAX_MS = 30_000;
-
-function acceptanceRetryDelayMs(failures: number): number {
-  return Math.min(ACCEPTANCE_RETRY_BASE_MS * 2 ** failures, ACCEPTANCE_RETRY_MAX_MS);
-}
-
-const terminalFailures = new Set([
-  "server_id_mismatch",
-  "self_host",
-  "duplicate_host",
-  "authentication_failed",
-]);
-
 function connectionFailure(error: unknown, authenticationFailed: boolean): HostSummary["error"] {
   if (error instanceof HostError) return { code: error.code, message: error.message };
   if (error instanceof Error && "code" in error && error.code === "authentication_failed")

packages/server/src/server/daemon-e2e/checkout-diff-content.e2e.test.ts

@@ -88,9 +88,13 @@ test.each(["uncommitted", "base", "commit"] as const)(
   60_000,
 );
 
-test.each(["single", "batch", "rename"] as const)(
-  "%s diff includes hunks from a repository subdirectory before and after commit",
-  async (shape) => {
+test.each(
+  (["uncommitted", "base"] as const).flatMap((mode) =>
+    (["single", "batch", "rename"] as const).map((shape) => ({ mode, shape })),
+  ),
+)(
+  "$mode $shape diff includes hunks from a repository subdirectory",
+  async ({ mode, shape }) => {
     const ctx = await createDaemonTestContext();
     const cwd = mkdtempSync(join(tmpdir(), "checkout-diff-subdirectory-"));
 
@@ -108,7 +112,9 @@ test.each(["single", "batch", "rename"] as const)(
       }
       git(cwd, "add", ".");
       git(cwd, "-c", "commit.gpgsign=false", "commit", "-m", "initial");
-      git(cwd, "checkout", "-b", "feature");
+      if (mode === "base") {
+        git(cwd, "checkout", "-b", "feature");
+      }
       const filename = shape === "rename" ? "renamed.txt" : "normal.txt";
       if (shape === "rename") {
         git(cwd, "mv", "sub/normal.txt", `sub/${filename}`);
@@ -117,38 +123,36 @@ test.each(["single", "batch", "rename"] as const)(
       if (shape === "batch") {
         writeFileSync(join(cwd, "sibling.txt"), "new sibling\n");
       }
-      async function expectSubdirectoryDiff(mode: "uncommitted" | "base") {
-        const compare = { mode, baseRef: "main" };
-        const rootDiff = await ctx.client.getCheckoutDiff(cwd, compare);
-        const subdirectoryDiff = await ctx.client.getCheckoutDiff(subdirectory, compare);
-        const subscription = ctx.client.observeCheckoutDiff(subdirectory, compare);
-        const liveDiff = await subscription.ready;
-        await subscription.release();
-
-        expect(rootDiff.error).toBeNull();
-        expect(subdirectoryDiff.error).toBeNull();
-        expect(liveDiff.error).toBeNull();
-        expect(liveDiff.files).toEqual(rootDiff.files);
-        expect(rootDiff.files).toHaveLength(shape === "batch" ? 2 : 1);
-        const file = rootDiff.files.find((candidate) => candidate.path === `sub/${filename}`);
-        expect(file).toMatchObject({
-          additions: 1,
-          deletions: 1,
-          ...(shape === "rename" ? { oldPath: "sub/normal.txt" } : {}),
-        });
-        expect(file?.hunks.flatMap((hunk) => hunk.lines)).toEqual(
-          expect.arrayContaining([
-            expect.objectContaining({ type: "remove", content: "before" }),
-            expect.objectContaining({ type: "add", content: "after" }),
-          ]),
-        );
-        expect(subdirectoryDiff.files).toEqual(rootDiff.files);
+      if (mode === "base") {
+        git(cwd, "add", ".");
+        git(cwd, "-c", "commit.gpgsign=false", "commit", "-m", "edit");
       }
 
-      await expectSubdirectoryDiff("uncommitted");
-      git(cwd, "add", ".");
-      git(cwd, "-c", "commit.gpgsign=false", "commit", "-m", "edit");
-      await expectSubdirectoryDiff("base");
+      const compare = { mode, baseRef: "main" };
+      const rootDiff = await ctx.client.getCheckoutDiff(cwd, compare);
+      const subdirectoryDiff = await ctx.client.getCheckoutDiff(subdirectory, compare);
+      const subscription = ctx.client.observeCheckoutDiff(subdirectory, compare);
+      const liveDiff = await subscription.ready;
+      await subscription.release();
+
+      expect(rootDiff.error).toBeNull();
+      expect(subdirectoryDiff.error).toBeNull();
+      expect(liveDiff.error).toBeNull();
+      expect(liveDiff.files).toEqual(rootDiff.files);
+      expect(rootDiff.files).toHaveLength(shape === "batch" ? 2 : 1);
+      const file = rootDiff.files.find((candidate) => candidate.path === `sub/${filename}`);
+      expect(file).toMatchObject({
+        additions: 1,
+        deletions: 1,
+        ...(shape === "rename" ? { oldPath: "sub/normal.txt" } : {}),
+      });
+      expect(file?.hunks.flatMap((hunk) => hunk.lines)).toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({ type: "remove", content: "before" }),
+          expect.objectContaining({ type: "add", content: "after" }),
+        ]),
+      );
+      expect(subdirectoryDiff.files).toEqual(rootDiff.files);
     } finally {
       await ctx.cleanup();
       rmSync(cwd, { recursive: true, force: true });

packages/server/src/server/plugins/compiler.ts

@@ -1,8 +1,7 @@
-import { createRequire } from "node:module";
-import { pathToFileURL } from "node:url";
 import { Worker } from "node:worker_threads";
 import pLimit from "p-limit";
 import { ZodError } from "zod";
+import { resolveWorkerEntrypoint } from "../../utils/worker-entrypoint.js";
 import type * as build from "./compiler-build.js";
 import type { PluginManifest } from "./manifest.js";
 import type { CompilerReply } from "./compiler-worker.js";
@@ -37,9 +36,7 @@ const workerUrl = new URL(
 );
 // Resolve the development loader once at module initialization, never during a
 // compile request. Packaged workers execute ordinary JavaScript without tsx.
-const workerEntrypoint = source
-  ? `import(${JSON.stringify(pathToFileURL(createRequire(import.meta.url).resolve("tsx/esm/api")).href)}).then(({ register }) => { register(); return import(${JSON.stringify(workerUrl.href)}); });`
-  : workerUrl;
+const compilerWorker = resolveWorkerEntrypoint(workerUrl);
 
 // Reuse the isolate during a build batch (notably daemon bootstrap), then release
 // TypeScript's heap when idle. Only this owner admits work or stops the worker.
@@ -74,7 +71,10 @@ class PluginCompiler {
   }
 
   private startWorker(): Worker {
-    const worker = new Worker(workerEntrypoint, { eval: source, execArgv: [] });
+    const worker = new Worker(compilerWorker.entrypoint, {
+      eval: compilerWorker.eval,
+      execArgv: [],
+    });
     this.worker = worker;
     // Keep error/exit ownership while idle too. The next caller gets a fresh
     // isolate after a crash; author build commands are never retried.

packages/server/src/server/plugins/index.posix.test.ts

@@ -20,7 +20,6 @@ import { DaemonConfigStore } from "../daemon-config-store.js";
 import { PluginService } from "./index.js";
 import { BuiltinPluginLoader } from "./builtin/index.js";
 import { ManagedPluginSources } from "./managed-source.js";
-import type { PluginProviderMetadata } from "./plugin-process-protocol.js";
 import {
   startNpmRegistry,
   npmPluginPackages,
@@ -180,55 +179,6 @@ function createPluginSelectivePausedRuntime(pausedPluginId: string) {
   return { runtime, started, releaseStart, starts };
 }
 
-function createGatedRuntime(providers: Record<string, readonly PluginProviderMetadata[]> = {}) {
-  const gates = new Map<string, PromiseWithResolvers<void>>();
-  const gate = (pluginId: string) => {
-    const existing = gates.get(pluginId);
-    if (existing) return existing;
-    const created = Promise.withResolvers<void>();
-    gates.set(pluginId, created);
-    return created;
-  };
-  const begun: string[] = [];
-  const running = new Set<string>();
-  const runtime: TestPluginRuntime = {
-    ...emptyUsageRuntime,
-    catalog: () => [...running].map((id) => ({ id, clientBundle: "bundle" })),
-    invoke: async () => undefined,
-    getLogs: () => [],
-    clearLogs: () => undefined,
-    getProviderRegistrations: (pluginId) =>
-      running.has(pluginId) ? (providers[pluginId] ?? []) : [],
-    startPlugin: async (pluginId) => {
-      begun.push(pluginId);
-      await gate(pluginId).promise;
-      running.add(pluginId);
-    },
-    stopPluginById: async (pluginId) => running.delete(pluginId),
-    stopAll: async () => {
-      running.clear();
-    },
-    subscribe: () => () => undefined,
-    bindPaseoSessionHost: () => undefined,
-  };
-  return {
-    runtime,
-    begun,
-    finish: (pluginId: string) => gate(pluginId).resolve(),
-    fail: (pluginId: string, error: Error) => gate(pluginId).reject(error),
-  };
-}
-
-function nextNotification(service: PluginService, pluginId: string): Promise<void> {
-  return new Promise((resolve) => {
-    const unsubscribe = service.subscribe((notified) => {
-      if (notified !== pluginId) return;
-      unsubscribe();
-      resolve();
-    });
-  });
-}
-
 describe("PluginService", () => {
   it.each([
     { shadow: false, runtime: "subprocess" },
@@ -422,127 +372,15 @@ describe("PluginService", () => {
       "startup-first": { source: "directory", path: first },
       "startup-second": { source: "directory", path: second },
     });
-    const notifications: { pluginId: string; running: boolean }[] = [];
-    service.subscribe((pluginId) =>
-      notifications.push({ pluginId, running: catalogIds(service).includes(pluginId) }),
-    );
+    const snapshots: string[][] = [];
+    service.subscribe(() => snapshots.push(catalogIds(service)));
 
     await service.start();
 
-    expect(notifications).toEqual([
-      { pluginId: "startup-first", running: true },
-      { pluginId: "startup-second", running: true },
-    ]);
-    expect(catalogIds(service)).toEqual(["startup-first", "startup-second"]);
+    expect(snapshots).toEqual([["startup-first"], ["startup-first", "startup-second"]]);
     await service.stopAllPlugins();
   }, 20_000);
 
-  it("starts configured plugins concurrently and publishes them in config order", async () => {
-    const home = await mkdtemp(path.join(tmpdir(), "paseo-plugin-home-"));
-    roots.push(home);
-    const gated = createGatedRuntime();
-    const service = createService(
-      home,
-      {
-        alpha: { source: "directory", path: "/plugins/alpha" },
-        beta: { source: "directory", path: "/plugins/beta" },
-        gamma: { source: "directory", path: "/plugins/gamma" },
-      },
-      { runtime: gated.runtime },
-    );
-    const notified: string[] = [];
-    service.subscribe((pluginId) => notified.push(pluginId));
-    let started = false;
-    const starting = (async () => {
-      await service.start();
-      started = true;
-    })();
-
-    await expect.poll(() => gated.begun).toEqual(["alpha", "beta", "gamma"]);
-
-    gated.finish("gamma");
-    const alphaPublished = nextNotification(service, "alpha");
-    gated.finish("alpha");
-    await alphaPublished;
-    expect(notified).toEqual(["alpha"]);
-    expect(started).toBe(false);
-
-    gated.finish("beta");
-    await starting;
-    expect(notified).toEqual(["alpha", "beta", "gamma"]);
-    expect(catalogIds(service)).toEqual(["alpha", "beta", "gamma"]);
-    await service.stopAllPlugins();
-  });
-
-  it("starts the other configured plugins when one fails while they are still starting", async () => {
-    const home = await mkdtemp(path.join(tmpdir(), "paseo-plugin-home-"));
-    roots.push(home);
-    const gated = createGatedRuntime();
-    const service = createService(
-      home,
-      {
-        broken: { source: "directory", path: "/plugins/broken" },
-        healthy: { source: "directory", path: "/plugins/healthy" },
-      },
-      { runtime: gated.runtime },
-    );
-    const notified: string[] = [];
-    service.subscribe((pluginId) => notified.push(pluginId));
-    const starting = service.start();
-
-    await expect.poll(() => gated.begun).toEqual(["broken", "healthy"]);
-    const brokenPublished = nextNotification(service, "broken");
-    gated.fail("broken", new Error("startup exploded"));
-    await brokenPublished;
-    gated.finish("healthy");
-    await starting;
-
-    expect(notified).toEqual(["broken", "healthy"]);
-    expect(catalogIds(service)).toEqual(["healthy"]);
-    expect(await service.listPlugins()).toMatchObject([
-      { id: "broken", status: "failed", error: "startup exploded" },
-      { id: "healthy", status: "running" },
-    ]);
-    await service.stopAllPlugins();
-  });
-
-  it("keeps a provider ID with the plugin listed first when both start at once", async () => {
-    const home = await mkdtemp(path.join(tmpdir(), "paseo-plugin-home-"));
-    roots.push(home);
-    const gated = createGatedRuntime({
-      first: [{ id: "shared-agent", label: "First agent" }],
-      second: [{ id: "shared-agent", label: "Second agent" }],
-    });
-    const service = createService(
-      home,
-      {
-        first: { source: "directory", path: "/plugins/first" },
-        second: { source: "directory", path: "/plugins/second" },
-      },
-      { runtime: gated.runtime },
-    );
-    const starting = service.start();
-
-    await expect.poll(() => gated.begun).toEqual(["first", "second"]);
-    gated.finish("second");
-    gated.finish("first");
-    await starting;
-
-    expect(service.getProviderRegistrations()).toMatchObject([
-      { id: "shared-agent", label: "First agent" },
-    ]);
-    expect(catalogIds(service)).toEqual(["first"]);
-    expect(await service.listPlugins()).toMatchObject([
-      { id: "first", status: "running" },
-      {
-        id: "second",
-        status: "failed",
-        error: 'Plugin second cannot register provider ID "shared-agent" twice',
-      },
-    ]);
-    await service.stopAllPlugins();
-  });
-
   it("uses an explicit config key, exposes reload failure, and retries from disk", async () => {
     const home = await mkdtemp(path.join(tmpdir(), "paseo-plugin-home-"));
     roots.push(home);

packages/server/src/server/plugins/index.ts

@@ -230,18 +230,11 @@ export class PluginService {
       }
     });
     if (config.pluginsEnabled === true) {
-      let earlierPublished: Promise<unknown> = Promise.resolve();
-      await Promise.all(
-        Object.entries(config.plugins ?? {})
-          .filter(([, source]) => source.enabled !== false)
-          .map(async ([pluginId]) => {
-            const publishTurn = earlierPublished;
-            const starting = this.startConfigured(pluginId, publishTurn);
-            earlierPublished = Promise.all([publishTurn, starting]);
-            await starting;
-            this.notify(pluginId);
-          }),
-      );
+      for (const [pluginId, source] of Object.entries(config.plugins ?? {})) {
+        if (source.enabled === false) continue;
+        await this.startConfigured(pluginId);
+        this.notify(pluginId);
+      }
     }
     this.configStore.onFieldChange("pluginsEnabled", (value) => {
       this.handleGlobalSwitch(value === true);
@@ -567,12 +560,12 @@ export class PluginService {
     }).catch((error) => this.logger.error({ err: error }, "Failed to enable plugins"));
   }
 
-  private async startConfigured(pluginId: string, publishTurn?: Promise<unknown>): Promise<void> {
+  private async startConfigured(pluginId: string): Promise<void> {
     const source = this.configStore.get().plugins?.[pluginId];
     if (!source || source.enabled === false || !this.canPublish(pluginId)) return;
     this.errors.delete(pluginId);
     try {
-      await this.startPlugin(pluginId, source.path, publishTurn);
+      await this.startPlugin(pluginId, source.path);
     } catch (error) {
       if (this.canPublish(pluginId)) this.recordFailure(pluginId, error);
     }
@@ -601,13 +594,8 @@ export class PluginService {
     );
   }
 
-  private async startPlugin(
-    pluginId: string,
-    sourcePath: string,
-    publishTurn?: Promise<unknown>,
-  ): Promise<void> {
+  private async startPlugin(pluginId: string, sourcePath: string): Promise<void> {
     await this.runtime.startPlugin(pluginId, sourcePath, () => this.canPublish(pluginId));
-    await publishTurn;
     try {
       await this.publishProviderRegistrations(pluginId, sourcePath);
       this.publishUsageSources(pluginId);

packages/server/src/utils/test-fixtures/expand-tilde-worker.ts

@@ -0,0 +1,6 @@
+import { parentPort, workerData } from "node:worker_threads";
+import { expandTilde } from "../path.js";
+
+const port = parentPort!;
+const input: string = workerData;
+port.postMessage(expandTilde(input));

packages/server/src/utils/worker-entrypoint.test.ts

@@ -0,0 +1,34 @@
+import { once } from "node:events";
+import { Worker } from "node:worker_threads";
+import { describe, expect, test } from "vitest";
+
+import { expandTilde } from "./path.js";
+import { resolveWorkerEntrypoint } from "./worker-entrypoint.js";
+
+describe("worker entrypoint", () => {
+  test("starts a compiled worker from its own URL", () => {
+    const entry = resolveWorkerEntrypoint(
+      new URL("file:///app/dist/server/server/plugins/compiler-worker.js"),
+    );
+
+    expect({ ...entry, entrypoint: String(entry.entrypoint) }).toEqual({
+      entrypoint: "file:///app/dist/server/server/plugins/compiler-worker.js",
+      eval: false,
+    });
+  });
+
+  test("runs a TypeScript worker, with its .js imports, through tsx", async () => {
+    const entry = resolveWorkerEntrypoint(
+      new URL("./test-fixtures/expand-tilde-worker.ts", import.meta.url),
+    );
+    const worker = new Worker(entry.entrypoint, {
+      eval: entry.eval,
+      execArgv: [],
+      workerData: "~/project",
+    });
+
+    const [expanded] = await once(worker, "message");
+
+    expect(expanded).toBe(expandTilde("~/project"));
+  });
+});

packages/server/src/utils/worker-entrypoint.ts

@@ -0,0 +1,16 @@
+import { createRequire } from "node:module";
+import { pathToFileURL } from "node:url";
+
+export interface WorkerEntrypoint {
+  entrypoint: string | URL;
+  eval: boolean;
+}
+
+export function resolveWorkerEntrypoint(workerUrl: URL): WorkerEntrypoint {
+  if (!workerUrl.pathname.endsWith(".ts")) return { entrypoint: workerUrl, eval: false };
+  const tsxUrl = pathToFileURL(createRequire(import.meta.url).resolve("tsx/esm/api")).href;
+  return {
+    entrypoint: `import(${JSON.stringify(tsxUrl)}).then(({ register }) => { register(); return import(${JSON.stringify(workerUrl.href)}); });`,
+    eval: true,
+  };
+}

scripts/ci-workflow.test.mjs

@@ -680,46 +680,51 @@ test("macOS jobs use latest runners while preserving release architectures", ()
   assert.match(release, /runner: macos-26-intel\n\s+electron_arch: x64/);
 });
 
-test("Nix desktop packaging resolves the workspace-local builder", () => {
-  const source = readFileSync(new URL("nix/desktop-package.nix", repoRoot), "utf8");
-  const invocation = source.match(/^\s+([^\n]*electron-builder) \\\n/m)?.[1];
-  assert.ok(invocation, "Nix invokes the desktop packaging tool");
-  const directory = mkdtempSync(join(tmpdir(), "nix-builder-resolution-"));
+test("macOS signing repair keeps certificate and keychain passwords separate", () => {
+  const workflow = readFileSync(new URL(".github/workflows/desktop-release.yml", repoRoot), "utf8");
+  const match = workflow.match(/<<'KEYCHAIN_FIX'\n([\s\S]*?)\n          KEYCHAIN_FIX/);
+  assert.ok(match, "the release workflow repairs the pinned signing tool");
+  const script = match[1].replace(/^          /gm, "");
+  const original = [
+    "return await importCerts(keychainFile, certPaths, cscPasswords);",
+    "async function importCerts(keychainFile, paths, keyPasswords) {",
+    '["import", paths[i], "-P", password]',
+    '["set-key-partition-list", "-S", "apple-tool:,apple:", "-s", "-k", password, keychainFile]',
+    "}",
+  ].join("\n");
+  const directory = mkdtempSync(join(tmpdir(), "signing-repair-"));
   try {
-    const desktop = join(directory, "packages/desktop");
-    mkdirSync(join(desktop, "node_modules/.bin"), { recursive: true });
-    mkdirSync(join(desktop, "node_modules/electron-builder"));
-    writeFileSync(
-      join(desktop, "node_modules/electron-builder/package.json"),
-      JSON.stringify({
-        name: "electron-builder",
-        version: "1.0.0",
-        bin: { "electron-builder": "../.bin/electron-builder" },
-      }),
-    );
-    writeFileSync(
-      join(directory, "package.json"),
-      JSON.stringify({ private: true, workspaces: ["packages/desktop"] }),
-    );
-    writeFileSync(
-      join(desktop, "package.json"),
-      JSON.stringify({
-        name: "desktop-fixture",
-        private: true,
-        devDependencies: { "electron-builder": "1.0.0" },
-      }),
-    );
-    writeFileSync(
-      join(desktop, "node_modules/.bin/electron-builder"),
-      '#!/bin/sh\nprintf "workspace-builder\\n"\n',
-      { mode: 0o755 },
-    );
-    const result = spawnSync("sh", ["-c", `${invocation} --version`], {
-      cwd: desktop,
-      encoding: "utf8",
-    });
-    assert.equal(result.status, 0, result.stderr);
-    assert.equal(result.stdout.trim(), "workspace-builder");
+    const packageDirectory = join(directory, "node_modules/app-builder-lib");
+    mkdirSync(join(packageDirectory, "out/codeSign"), { recursive: true });
+    const manifest = join(packageDirectory, "package.json");
+    const sourcePath = join(packageDirectory, "out/codeSign/macCodeSign.js");
+    for (const [version, source, succeeds] of [
+      ["26.8.1", original, true],
+      ["26.8.1", original.replace("cscPasswords);", "differentArguments);"), false],
+      ["26.18.0", original, false],
+    ]) {
+      writeFileSync(manifest, JSON.stringify({ name: "app-builder-lib", version }));
+      writeFileSync(sourcePath, source);
+      const result = spawnSync(process.execPath, ["-e", script], {
+        cwd: directory,
+        encoding: "utf8",
+      });
+      const actual = readFileSync(sourcePath, "utf8");
+      if (succeeds) {
+        assert.equal(result.status, 0, result.stderr);
+        assert.ok(
+          actual.includes("importCerts(keychainFile, certPaths, cscPasswords, keychainPassword)"),
+        );
+        assert.ok(
+          actual.includes("importCerts(keychainFile, paths, keyPasswords, keychainPassword)"),
+        );
+        assert.ok(actual.includes('["import", paths[i], "-P", password]'));
+        assert.ok(actual.includes('"-k", keychainPassword, keychainFile]'));
+      } else {
+        assert.notEqual(result.status, 0);
+        assert.equal(actual, source, "unexpected tool inputs must fail without a partial write");
+      }
+    }
   } finally {
     rmSync(directory, { recursive: true, force: true });
   }

scripts/trace-daemon-dist.test.mjs

@@ -1,6 +1,7 @@
 import assert from "node:assert/strict";
 import { execFile } from "node:child_process";
-import { cp, mkdtemp, rm } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { cp, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import test from "node:test";
@@ -9,6 +10,12 @@ import { promisify } from "node:util";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const bridgeModule = "packages/server/dist/server/server/agent/providers/opencode/bridge.js";
+const claudeDist = "packages/server/dist/server/server/agent/providers/claude";
+const workerThreadEntrypoints = [
+  "packages/server/dist/server/server/plugins/compiler-worker.js",
+  `${claudeDist}/rewind-worker.js`,
+  `${claudeDist}/rewind-session-store.js`,
+];
 
 // Mirrors nix/package.nix's installPhase: copy every traced path into $out.
 async function installTracedDaemon(outRoot) {
@@ -17,12 +24,14 @@ async function installTracedDaemon(outRoot) {
     [path.join(repoRoot, "scripts/trace-daemon.mjs")],
     { cwd: repoRoot, maxBuffer: 64 * 1024 * 1024 },
   );
-  for (const file of stdout.split("\n").filter(Boolean)) {
+  const files = stdout.split("\n").filter(Boolean);
+  for (const file of files) {
     await cp(path.join(repoRoot, file), path.join(outRoot, file), {
       recursive: true,
       verbatimSymlinks: true,
     });
   }
+  return files;
 }
 
 test("traced daemon closure ships the OpenCode bridge plugin for every OpenCode version", async () => {
@@ -44,3 +53,32 @@ test("traced daemon closure ships the OpenCode bridge plugin for every OpenCode
     await rm(outRoot, { recursive: true, force: true });
   }
 });
+
+test("traced daemon closure ships the worker-thread entrypoints and what they load", async () => {
+  const outRoot = await mkdtemp(path.join(os.tmpdir(), "trace-daemon-dist-"));
+  try {
+    const files = await installTracedDaemon(outRoot);
+    for (const file of workerThreadEntrypoints) {
+      assert.ok(files.includes(file), `${file} is missing from the traced closure`);
+    }
+
+    const { realClaudeRewindSdk } = await import(
+      pathToFileURL(path.join(outRoot, claudeDist, "rewind.js")).href
+    );
+    const sessionId = randomUUID();
+    const user = randomUUID();
+    const transcriptPath = path.join(outRoot, `${sessionId}.jsonl`);
+    await writeFile(
+      transcriptPath,
+      `${JSON.stringify({ type: "user", uuid: user, parentUuid: null, sessionId, message: { role: "user", content: "first" } })}\n`,
+    );
+    const fork = await realClaudeRewindSdk.forkSession(sessionId, {
+      upToMessageId: user,
+      transcriptPath,
+    });
+    const forked = await readFile(path.join(outRoot, `${fork.sessionId}.jsonl`), "utf8");
+    assert.equal(JSON.parse(forked.split("\n")[0]).forkedFrom.messageUuid, user);
+  } finally {
+    await rm(outRoot, { recursive: true, force: true });
+  }
+});