fix(daemon): keep a detached daemon out of the launching terminal's session

Detaching left the daemon running, but closing the terminal that
originally launched it killed the daemon anyway — so `fresh -a` came back
with `Connection refused`, and a second client attached from another
terminal was torn down along with it. The docs promise the opposite:
"Terminal closes, but the Fresh daemon keeps running in the background."

`spawn_server_detached` spawned the server as an ordinary child, so it
inherited the client's session and process group: the terminal going away
SIGHUP'd it, and a signal to that process group reached it. Windows
already passed `DETACHED_PROCESS | CREATE_NEW_PROCESS_GROUP`; the Unix
side had no equivalent, and the `daemonize()` helper that would have
provided one is not called from any path.

Call `setsid()` from `pre_exec` so the spawned daemon leads its own
session with no controlling terminal. `setsid` rather than `daemonize`
because the daemon has to keep the inherited working directory — it serves
that project — and `daemonize` chdirs to `/`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FjzTLqa27FEwYb7E2djB3B

Author: claude

crates/fresh-editor/src/server/daemon/unix.rs

@@ -63,7 +63,21 @@ pub fn daemonize() -> io::Result<()> {
 /// spawned daemon boots into an SSH authority instead of the default
 /// `Authority::local()` (see `EditorServerConfig.startup_authority`).
 /// Returns the PID of the spawned server (intermediate, not final daemon PID).
+///
+/// The child calls `setsid()` before exec so the daemon leads its own session
+/// with no controlling terminal — the Unix counterpart of the Windows
+/// `DETACHED_PROCESS | CREATE_NEW_PROCESS_GROUP`. Without it the daemon stayed
+/// in the launching terminal's session and process group: closing that terminal
+/// SIGHUP'd the daemon even though the user had already detached, and killing
+/// the terminal's process group took the daemon down with it — along with any
+/// client attached from another terminal.
+///
+/// `setsid()` rather than [`daemonize`] because the daemon must keep the
+/// inherited working directory (it serves that project); `daemonize` chdirs
+/// to `/`.
 pub fn spawn_server_detached(session_name: Option<&str>, ssh_url: Option<&str>) -> io::Result<u32> {
+    use std::os::unix::process::CommandExt;
+
     let exe = std::env::current_exe()?;
 
     let mut args = vec!["--server".to_string()];
@@ -79,12 +93,27 @@ pub fn spawn_server_detached(session_name: Option<&str>, ssh_url: Option<&str>)
     }
 
     // Use Command to spawn, which properly handles the process
-    let child = std::process::Command::new(&exe)
-        .args(&args)
+    let mut cmd = std::process::Command::new(&exe);
+    cmd.args(&args)
         .stdin(std::process::Stdio::null())
         .stdout(std::process::Stdio::null())
-        .stderr(std::process::Stdio::null())
-        .spawn()?;
+        .stderr(std::process::Stdio::null());
+
+    // SAFETY: runs in the forked child between fork and exec, where only
+    // async-signal-safe calls are allowed. `setsid` is one such call, and it
+    // touches no allocator or lock this process holds. It fails with EPERM only
+    // when the caller is already a session leader — harmless here, since that
+    // means the child is already free of a controlling terminal, so the error is
+    // deliberately not propagated (returning would abort an otherwise usable
+    // daemon).
+    unsafe {
+        cmd.pre_exec(|| {
+            libc::setsid();
+            Ok(())
+        });
+    }
+
+    let child = cmd.spawn()?;
 
     Ok(child.id())
 }

crates/fresh-editor/tests/daemon_survives_launching_terminal.rs

@@ -0,0 +1,149 @@
+//! A detached daemon must outlive the terminal that launched it (issue #2808).
+//!
+//! Reported symptom: `fresh -a`, then `Detach` — the client exits and
+//! `fresh --cmd daemon list` still shows the daemon. Close the terminal that
+//! originally launched it and the daemon dies anyway, so `fresh -a` comes back
+//! with `Connection refused`; worse, a *second* client attached from another
+//! terminal is killed along with it. The docs promise the opposite: "Terminal
+//! closes, but the Fresh daemon keeps running in the background."
+//!
+//! Cause: `spawn_server_detached` spawned the server as a plain child, so it
+//! stayed in the launching terminal's session and process group. Windows already
+//! passed `DETACHED_PROCESS | CREATE_NEW_PROCESS_GROUP`; the Unix side had no
+//! equivalent, and the `daemonize()` helper that would have provided one was
+//! never called from any path.
+//!
+//! Asserted here at the process level, because that is where the bug lives: the
+//! daemon must lead its own session, and must survive a `SIGKILL` delivered to
+//! the launching client's entire process group. `SIGKILL` to a process group is
+//! delivered to every member before `killpg` returns, so "still alive
+//! afterwards" is a deterministic verdict rather than a race.
+#![cfg(unix)]
+
+use std::path::{Path, PathBuf};
+use std::time::Duration;
+
+fn pty_available() -> bool {
+    use portable_pty::{native_pty_system, PtySize};
+    native_pty_system()
+        .openpty(PtySize {
+            rows: 24,
+            cols: 80,
+            pixel_width: 0,
+            pixel_height: 0,
+        })
+        .is_ok()
+}
+
+fn session_id_of(pid: u32) -> Option<i32> {
+    let sid = unsafe { libc::getsid(pid as i32) };
+    if sid == -1 {
+        None
+    } else {
+        Some(sid)
+    }
+}
+
+fn process_alive(pid: u32) -> bool {
+    unsafe { libc::kill(pid as i32, 0) == 0 }
+}
+
+/// Block until `pid_file` names a live process, which is how the client itself
+/// waits for daemon readiness. Unbounded on purpose (see CONTRIBUTING: no
+/// in-test timeouts); `cargo nextest` bounds the whole test externally.
+fn wait_for_daemon_pid(pid_file: &Path) -> u32 {
+    loop {
+        if let Ok(text) = std::fs::read_to_string(pid_file) {
+            if let Ok(pid) = text.trim().parse::<u32>() {
+                if process_alive(pid) {
+                    return pid;
+                }
+            }
+        }
+        std::thread::sleep(Duration::from_millis(20));
+    }
+}
+
+#[test]
+fn detached_daemon_outlives_its_launching_process_group() {
+    if !pty_available() {
+        eprintln!("SKIP: no PTY available");
+        return;
+    }
+    use portable_pty::{native_pty_system, CommandBuilder, PtySize};
+
+    let sandbox = tempfile::tempdir().unwrap();
+    let mk = |n: &str| -> PathBuf {
+        let p = sandbox.path().join(n);
+        std::fs::create_dir_all(&p).unwrap();
+        p
+    };
+    // Isolate the daemon's sockets/pid files and all persistence into the
+    // sandbox so this test cannot see or disturb a real daemon.
+    let runtime_dir = mk("run");
+    let data_home = mk("data");
+    let home = mk("home");
+    let project = mk("project");
+    std::fs::write(project.join("file.txt"), "hello\n").unwrap();
+
+    // A daemon name unique to this test run, so the pid file path is known and
+    // cannot collide with anything else.
+    let session_name = format!("t{}", std::process::id());
+    let pid_file = runtime_dir
+        .join("fresh")
+        .join(format!("{session_name}.pid"));
+
+    // Launch the client on a PTY, exactly as a terminal would. The PTY child
+    // becomes its own session leader, standing in for "the launching terminal";
+    // the daemon it spawns must not join that session.
+    let pair = native_pty_system()
+        .openpty(PtySize {
+            rows: 30,
+            cols: 100,
+            pixel_width: 0,
+            pixel_height: 0,
+        })
+        .unwrap();
+    let mut cmd = CommandBuilder::new(env!("CARGO_BIN_EXE_fresh"));
+    cmd.args(["--no-upgrade-check", "-a", &session_name]);
+    cmd.cwd(&project);
+    cmd.env("XDG_RUNTIME_DIR", &runtime_dir);
+    cmd.env("XDG_DATA_HOME", &data_home);
+    cmd.env("HOME", &home);
+    cmd.env("TERM", "xterm-256color");
+    let mut client = pair.slave.spawn_command(cmd).unwrap();
+    drop(pair.slave);
+
+    let daemon_pid = wait_for_daemon_pid(&pid_file);
+    let client_pid = client.process_id().expect("client pid");
+
+    let client_sid = session_id_of(client_pid).expect("client session id");
+    let daemon_sid = session_id_of(daemon_pid).expect("daemon session id");
+
+    // The daemon leads its own session. Sharing the client's session is what let
+    // the terminal's teardown reach it.
+    assert_ne!(
+        daemon_sid, client_sid,
+        "daemon (pid {daemon_pid}) must not share the launching client's session \
+         (pid {client_pid}, sid {client_sid})"
+    );
+
+    // The user-visible promise: tearing the launching terminal down — its whole
+    // process group, the way a closing terminal does — leaves the daemon running.
+    let client_pgid = unsafe { libc::getpgid(client_pid as i32) };
+    assert!(client_pgid > 0, "could not read the client's process group");
+    assert_eq!(
+        unsafe { libc::killpg(client_pgid, libc::SIGKILL) },
+        0,
+        "failed to signal the launching process group"
+    );
+    let _ = client.wait();
+
+    assert!(
+        process_alive(daemon_pid),
+        "daemon (pid {daemon_pid}) died with the process group that launched it"
+    );
+
+    // Leave nothing behind: the sandbox only isolates files, not processes.
+    unsafe { libc::kill(daemon_pid as i32, libc::SIGKILL) };
+}