daemon: NewHandler returns error instead of panicking (l3)

Replace Handler with NewHandler(statsDir) (http.Handler, error) when the
auth store cannot be opened, matching Run's error wrapping. Tests use a
small helper; add coverage for open failure on a read-only stats dir.

Made-with: Cursor

1 files changed, 10 insertions, 8 deletions

diff --git a/internal/daemon/daemon.go b/internal/daemon/daemon.go
index 22d9f1a..b913c43 100644
--- a/internal/daemon/daemon.go
+++ b/internal/daemon/daemon.go
@@ -30,6 +30,16 @@ type Config struct {
 	LogOutput io.Writer
 }
 
+// NewHandler returns HTTP handlers for daemon routes using the default auth DB
+// under statsDir. It returns an error if the auth store cannot be opened.
+func NewHandler(statsDir string) (http.Handler, error) {
+	store, err := openAuthStore(context.Background(), statsDir, "")
+	if err != nil {
+		return nil, fmt.Errorf("auth db: %w", err)
+	}
+	return routes(statsDir, "", store), nil
+}
+
 func routes(statsDir, authDB string, store *authkeys.Store) http.Handler {
 	mux := http.NewServeMux()
 	mux.HandleFunc("/health", health)
@@ -40,14 +50,6 @@ func routes(statsDir, authDB string, store *authkeys.Store) http.Handler {
 	return mux
 }
 
-func Handler(statsDir string) http.Handler {
-	store, err := openAuthStore(context.Background(), statsDir, "")
-	if err != nil {
-		panic(err)
-	}
-	return routes(statsDir, "", store)
-}
-
 func logWriter(cfg Config) io.Writer {
 	if cfg.LogOutput != nil {
 		return cfg.LogOutput