@agentchatme/agent-core 0.0.131 → 0.0.1312

package/dist/daemon-entry.d.ts

@@ -47,8 +47,12 @@ declare class AgentWsClient extends EventEmitter {
     private attempt;
     private reconnectTimer;
     private livenessTimer;
+    private ackRetryTimer;
     private stopped;
     private ackMode;
+    private inboundPaused;
+    private readonly pendingAcks;
+    private readonly acksInFlight;
     constructor(url: string, apiKey: string);
     /** True only while the socket is live and ready. The heartbeat writer keys
      *  off this, so a reconnecting/terminal daemon lets its heartbeat go stale
@@ -56,6 +60,14 @@ declare class AgentWsClient extends EventEmitter {
     get connected(): boolean;
     start(): void;
     stop(): void;
+    /**
+     * Apply TCP backpressure while the model-turn queue is saturated. `ws`
+     * delegates this to the underlying socket; no delivered frame is discarded.
+     * A server heartbeat may close a very long pause, which is safe because all
+     * unacked messages re-drain after reconnect.
+     */
+    pauseInbound(): void;
+    resumeInbound(): void;
     getState(): State;
     /**
      * Confirm a message as handled: `{"type":"ack","message_id":"msg_..."}`.
@@ -65,6 +77,8 @@ declare class AgentWsClient extends EventEmitter {
      * real-time push — which carries no delivery_id — be acked at all.
      */
     ack(messageId: string): void;
+    private flushAcks;
+    private scheduleAckRetry;
     private open;
     private scheduleReconnect;
     private armLiveness;
@@ -94,6 +108,8 @@ declare class ReplyCoord {
 }
 
 interface TurnContext {
+    /** Trusted server message id that caused this autonomous turn. */
+    messageId?: string | undefined;
     /** The AgentChat conversation the message belongs to. */
     conversationId: string;
     /** @handle of the sender. */
@@ -127,6 +143,13 @@ interface TurnResult {
 }
 interface RuntimeAdapter {
     readonly name: string;
+    /**
+     * Reset conversation continuity when the authenticated AgentChat identity
+     * changes. `identityNamespace` contains no credential material; callers use
+     * the authenticated API base + handle. Adapters that persist host sessions
+     * must include it in their session key, not merely clear an in-memory map.
+     */
+    reset?(identityNamespace: string): void;
     /** Verify the runtime is usable (binary present, logged in). */
     preflight(): Promise<{
         ok: boolean;
@@ -186,6 +209,10 @@ interface ResolveDaemonOpts {
  */
 declare function resolveDaemonConfig(opts: ResolveDaemonOpts): Promise<DaemonConfig>;
 
+interface DaemonFailure {
+    kind: 'socket-auth' | 'runtime';
+    reason: string;
+}
 declare class Daemon {
     private readonly cfg;
     private readonly adapter;
@@ -195,7 +222,9 @@ declare class Daemon {
     private readonly ws;
     private readonly coord;
     private readonly seen;
-    private readonly convChains;
+    private readonly convQueues;
+    private readonly convWorkers;
+    private pending;
     private inFlight;
     private readonly waiters;
     private stopping;
@@ -203,13 +232,19 @@ declare class Daemon {
     constructor(cfg: DaemonConfig, adapter: RuntimeAdapter, ws?: AgentWsClient, // injectable for tests; defaults to a real socket
     /** Called when the socket gives up for good (auth refused). The supervisor
      *  above decides what happens next — this class does not end the process. */
-    onTerminal?: ((reason: string) => void) | undefined);
+    onTerminal?: ((failure: DaemonFailure) => void) | undefined);
     start(): Promise<void>;
     stop(): void;
     private onInbound;
-    /** Serialize turns within a conversation; the global semaphore caps total. */
-    private enqueue;
+    /** Queue one already-tracked row and ensure exactly one worker for its conversation. */
+    private enqueueExisting;
+    /** Process each message independently, in arrival order within a conversation. */
+    private drainConversation;
     private handle;
+    private markHandled;
+    private markNoLongerPending;
+    /** Bound reconnect-dedup memory without ever evicting unfinished work. */
+    private pruneSeen;
     private acquireSlot;
     private releaseSlot;
 }

package/dist/daemon-entry.js

@@ -1,5 +1,7 @@
 import {
+  CODING_AGENTS_CLIENT_HEADERS,
   acquireLeaderLock,
+  atomicWriteFile,
   beat,
   credentialsPath,
   external_exports,
@@ -7,7 +9,7 @@ import {
   idle,
   log,
   resolveIdentity
-} from "./chunk-XLRPNQ7G.js";
+} from "./chunk-AGDJ4A6R.js";
 
 // src/daemon/ws-client.ts
 import { WebSocket } from "ws";
@@ -49,6 +51,7 @@ function contextOf(row) {
 // src/daemon/ws-client.ts
 var BASE_BACKOFF_MS = 1e3;
 var MAX_BACKOFF_MS = 6e4;
+var ACK_RETRY_MS = 1e3;
 var LIVENESS_MS = 1e5;
 var AgentWsClient = class extends EventEmitter {
   constructor(url, apiKey) {
@@ -63,8 +66,12 @@ var AgentWsClient = class extends EventEmitter {
   attempt = 0;
   reconnectTimer = null;
   livenessTimer = null;
+  ackRetryTimer = null;
   stopped = false;
   ackMode = false;
+  inboundPaused = false;
+  pendingAcks = /* @__PURE__ */ new Set();
+  acksInFlight = /* @__PURE__ */ new Set();
   /** True only while the socket is live and ready. The heartbeat writer keys
    *  off this, so a reconnecting/terminal daemon lets its heartbeat go stale
    *  and the next session detects that always-on is actually down. */
@@ -79,6 +86,7 @@ var AgentWsClient = class extends EventEmitter {
     this.stopped = true;
     this.state = "closed";
     this.clearTimers();
+    this.acksInFlight.clear();
     if (this.ws) {
       try {
         this.ws.close(1e3, "daemon shutdown");
@@ -87,6 +95,29 @@ var AgentWsClient = class extends EventEmitter {
       this.ws = null;
     }
   }
+  /**
+   * Apply TCP backpressure while the model-turn queue is saturated. `ws`
+   * delegates this to the underlying socket; no delivered frame is discarded.
+   * A server heartbeat may close a very long pause, which is safe because all
+   * unacked messages re-drain after reconnect.
+   */
+  pauseInbound() {
+    if (this.inboundPaused) return;
+    this.inboundPaused = true;
+    try {
+      this.ws?.pause();
+    } catch {
+    }
+  }
+  resumeInbound() {
+    if (!this.inboundPaused) return;
+    this.inboundPaused = false;
+    try {
+      this.ws?.resume();
+      if (this.state === "ready") this.armLiveness();
+    } catch {
+    }
+  }
   getState() {
     return this.state;
   }
@@ -98,19 +129,48 @@ var AgentWsClient = class extends EventEmitter {
    * real-time push — which carries no delivery_id — be acked at all.
    */
   ack(messageId) {
+    this.pendingAcks.add(messageId);
+    this.flushAcks();
+  }
+  flushAcks() {
     if (this.state !== "ready" || !this.ws) return;
-    try {
-      this.ws.send(JSON.stringify({ type: "ack", message_id: messageId }));
-    } catch (err) {
-      log.debug(`ack send failed for ${messageId} (will re-drain): ${String(err)}`);
+    for (const messageId of this.pendingAcks) {
+      if (this.acksInFlight.has(messageId)) continue;
+      this.acksInFlight.add(messageId);
+      try {
+        this.ws.send(
+          JSON.stringify({ type: "ack", message_id: messageId }),
+          (err) => {
+            this.acksInFlight.delete(messageId);
+            if (!err) this.pendingAcks.delete(messageId);
+            else {
+              log.debug(`ack send failed for ${messageId} (will retry): ${String(err)}`);
+              this.scheduleAckRetry();
+            }
+          }
+        );
+      } catch (err) {
+        this.acksInFlight.delete(messageId);
+        log.debug(`ack send failed for ${messageId} (will retry): ${String(err)}`);
+        this.scheduleAckRetry();
+      }
     }
   }
+  scheduleAckRetry() {
+    if (this.stopped || this.ackRetryTimer) return;
+    this.ackRetryTimer = setTimeout(() => {
+      this.ackRetryTimer = null;
+      this.flushAcks();
+    }, ACK_RETRY_MS);
+    this.ackRetryTimer.unref();
+  }
   open() {
     if (this.stopped) return;
     this.state = this.attempt === 0 ? "connecting" : "reconnecting";
     log.info(`ws ${this.state} (attempt ${this.attempt + 1}) \u2192 ${this.url}`);
     const ws = new WebSocket(this.url, {
       headers: {
+        ...CODING_AGENTS_CLIENT_HEADERS,
         authorization: `Bearer ${this.apiKey}`,
         // Opt into the delivery-ack protocol: the server then leaves each
         // delivery 'stored' until we ack it (by message id) instead of
@@ -124,8 +184,10 @@ var AgentWsClient = class extends EventEmitter {
       this.attempt = 0;
       this.state = "ready";
       this.armLiveness();
+      if (this.inboundPaused) ws.pause();
       log.info("ws ready \u2014 draining + listening");
       this.emit("ready");
+      this.flushAcks();
     });
     ws.on("message", (data) => {
       this.armLiveness();
@@ -150,6 +212,7 @@ var AgentWsClient = class extends EventEmitter {
     });
     ws.on("ping", () => this.armLiveness());
     ws.on("unexpected-response", (_req, res) => {
+      if (this.stopped) return;
       if (res.statusCode === 401 || res.statusCode === 403) {
         this.state = "terminal";
         this.clearTimers();
@@ -165,18 +228,23 @@ var AgentWsClient = class extends EventEmitter {
     });
     ws.on("close", (code) => {
       if (this.state === "terminal" || this.stopped) return;
+      this.acksInFlight.clear();
       log.warn(`ws closed (${code}) \u2014 scheduling reconnect`);
       this.scheduleReconnect();
     });
   }
   scheduleReconnect() {
     if (this.stopped || this.state === "terminal") return;
+    if (this.reconnectTimer) return;
     this.state = "reconnecting";
     this.clearTimers();
     const backoff = Math.min(BASE_BACKOFF_MS * 2 ** this.attempt, MAX_BACKOFF_MS);
     const jitter = backoff * (0.5 + Math.random() * 0.5);
     this.attempt++;
-    this.reconnectTimer = setTimeout(() => this.open(), jitter);
+    this.reconnectTimer = setTimeout(() => {
+      this.reconnectTimer = null;
+      this.open();
+    }, jitter);
   }
   armLiveness() {
     if (this.livenessTimer) clearTimeout(this.livenessTimer);
@@ -198,6 +266,10 @@ var AgentWsClient = class extends EventEmitter {
       clearTimeout(this.livenessTimer);
       this.livenessTimer = null;
     }
+    if (this.ackRetryTimer) {
+      clearTimeout(this.ackRetryTimer);
+      this.ackRetryTimer = null;
+    }
   }
 };
 
@@ -212,6 +284,7 @@ var ReplyCoord = class {
     const res = await fetch(url, {
       method,
       headers: {
+        ...CODING_AGENTS_CLIENT_HEADERS,
         authorization: `Bearer ${this.cfg.apiKey}`,
         ...body !== void 0 ? { "content-type": "application/json" } : {}
       },
@@ -263,8 +336,8 @@ function describeSender(ctx) {
 }
 
 // src/daemon/run.ts
-import * as path2 from "path";
-import * as fs from "fs";
+import * as path3 from "path";
+import * as fs2 from "fs";
 
 // src/daemon/config.ts
 import * as path from "path";
@@ -298,12 +371,49 @@ async function resolveDaemonConfig(opts) {
 }
 
 // src/daemon/loop.ts
-import * as os from "os";
+import * as crypto from "crypto";
+import * as fs from "fs";
+import * as path2 from "path";
+var MAX_TIMER_MS = 2147483647;
+function positiveBoundedEnv(name, fallback) {
+  const parsed = Number(process.env[name]);
+  return Number.isFinite(parsed) && parsed > 0 ? Math.min(parsed, MAX_TIMER_MS) : fallback;
+}
 var MAX_CONCURRENT_TURNS = 3;
-var MAX_ATTEMPTS = 3;
 var HEARTBEAT_MS = 3e4;
+var SEEN_TTL_MS = 24 * 60 * 6e4;
+var MAX_COMPLETED_SEEN = 1e4;
+var PAUSE_AT_PENDING = Math.max(
+  1,
+  Math.floor(positiveBoundedEnv("AGENTCHATD_MAX_PENDING", 2e3))
+);
+var RESUME_AT_PENDING = Math.max(1, Math.floor(PAUSE_AT_PENDING / 2));
+var RETRY_BASE_MS = positiveBoundedEnv("AGENTCHATD_RETRY_MS", 1e3);
+var RETRY_MAX_MS = Math.max(
+  RETRY_BASE_MS,
+  positiveBoundedEnv("AGENTCHATD_RETRY_MAX_MS", 5 * 6e4)
+);
 var YIELD_MS = Number(process.env["AGENTCHATD_YIELD_MS"] ?? 1e4);
 var delay = (ms) => new Promise((r) => setTimeout(r, ms));
+function retryDelay(attempt) {
+  return Math.min(RETRY_BASE_MS * 2 ** Math.min(20, Math.max(0, attempt - 1)), RETRY_MAX_MS);
+}
+function installationId(home) {
+  const file = path2.join(home, "daemon.installation-id");
+  try {
+    const existing = fs.readFileSync(file, "utf-8").trim();
+    if (/^[0-9a-f-]{36}$/i.test(existing)) return existing;
+  } catch {
+  }
+  const id = crypto.randomUUID();
+  try {
+    atomicWriteFile(file, `${id}
+`, 384);
+  } catch (err) {
+    log.warn(`could not persist daemon installation id: ${String(err)}`);
+  }
+  return id;
+}
 var Daemon = class {
   constructor(cfg, adapter, ws, onTerminal) {
     this.cfg = cfg;
@@ -312,7 +422,7 @@ var Daemon = class {
     this.coord = new ReplyCoord({
       apiKey: cfg.apiKey,
       apiBase: cfg.apiBase,
-      holder: `daemon:${os.hostname()}`
+      holder: `daemon:${installationId(cfg.home)}`
     });
     this.ws = ws ?? new AgentWsClient(cfg.wsUrl, cfg.apiKey);
     this.ws.on("inbound", (row) => this.onInbound(row));
@@ -320,7 +430,7 @@ var Daemon = class {
     this.ws.on("terminal", (reason) => {
       log.error(`daemon terminal: ${reason}`);
       this.stop();
-      this.onTerminal?.(reason);
+      this.onTerminal?.({ kind: "socket-auth", reason });
     });
   }
   cfg;
@@ -329,8 +439,9 @@ var Daemon = class {
   ws;
   coord;
   seen = /* @__PURE__ */ new Map();
-  // message id → attempts
-  convChains = /* @__PURE__ */ new Map();
+  convQueues = /* @__PURE__ */ new Map();
+  convWorkers = /* @__PURE__ */ new Set();
+  pending = 0;
   inFlight = 0;
   waiters = [];
   stopping = false;
@@ -354,23 +465,53 @@ var Daemon = class {
   }
   onInbound(row) {
     if (senderOf(row) === this.cfg.handle) return;
-    if (this.seen.has(row.id)) return;
-    this.seen.set(row.id, 0);
-    this.enqueue(row);
-  }
-  /** Serialize turns within a conversation; the global semaphore caps total. */
-  enqueue(row) {
-    const prev = this.convChains.get(row.conversation_id) ?? Promise.resolve();
-    const next = prev.then(() => this.handle(row)).catch((err) => {
-      log.warn(`unhandled in conv ${row.conversation_id}: ${String(err)}`);
-    });
-    this.convChains.set(row.conversation_id, next);
-    void next.then(() => {
-      if (this.convChains.get(row.conversation_id) === next) this.convChains.delete(row.conversation_id);
-    });
+    this.pruneSeen();
+    const prior = this.seen.get(row.id);
+    if (prior) {
+      prior.updatedAt = Date.now();
+      if (prior.status === "handled") this.ws.ack(row.id);
+      return;
+    }
+    this.seen.set(row.id, { row, status: "queued", attempts: 0, updatedAt: Date.now() });
+    this.pending += 1;
+    if (this.pending >= PAUSE_AT_PENDING) this.ws.pauseInbound();
+    this.enqueueExisting(row);
+  }
+  /** Queue one already-tracked row and ensure exactly one worker for its conversation. */
+  enqueueExisting(row) {
+    const queue = this.convQueues.get(row.conversation_id) ?? [];
+    queue.push(row);
+    this.convQueues.set(row.conversation_id, queue);
+    if (this.convWorkers.has(row.conversation_id)) return;
+    this.convWorkers.add(row.conversation_id);
+    void this.drainConversation(row.conversation_id);
+  }
+  /** Process each message independently, in arrival order within a conversation. */
+  async drainConversation(conversationId) {
+    try {
+      while (!this.stopping) {
+        const queue = this.convQueues.get(conversationId);
+        if (!queue || queue.length === 0) break;
+        const row = queue.shift();
+        if (!row) break;
+        await this.handle(row);
+      }
+    } catch (err) {
+      log.warn(`unhandled in conv ${conversationId}: ${String(err)}`);
+    } finally {
+      this.convWorkers.delete(conversationId);
+      const queue = this.convQueues.get(conversationId);
+      if (!queue || queue.length === 0) this.convQueues.delete(conversationId);
+      else if (!this.stopping) {
+        this.convWorkers.add(conversationId);
+        void this.drainConversation(conversationId);
+      }
+    }
   }
   async handle(row) {
     if (this.stopping) return;
+    const initial = this.seen.get(row.id);
+    if (!initial || initial.status !== "queued") return;
     if (await this.coord.isSessionActive()) {
       log.info(`msg ${row.id}: live session active \u2014 yielding for ${YIELD_MS}ms`);
       await delay(YIELD_MS);
@@ -378,37 +519,90 @@ var Daemon = class {
     }
     if (!await this.coord.claim(row.id)) {
       log.info(`msg ${row.id}: claimed by the live session \u2014 standing down`);
+      this.seen.delete(row.id);
+      this.markNoLongerPending();
       return;
     }
-    await this.acquireSlot();
-    try {
-      const attempts = (this.seen.get(row.id) ?? 0) + 1;
-      this.seen.set(row.id, attempts);
-      log.info(`turn for msg ${row.id} from @${senderOf(row)} (attempt ${attempts})`);
-      const ctx = contextOf(row);
-      const result = await this.adapter.runTurn({
-        conversationId: row.conversation_id,
-        sender: senderOf(row),
-        text: typeof row.content?.["text"] === "string" ? row.content["text"] : "",
-        createdAt: typeof row.created_at === "string" ? row.created_at : void 0,
-        type: typeof row.type === "string" ? row.type : void 0,
-        senderDisplayName: ctx.senderDisplayName,
-        senderKind: ctx.senderKind,
-        groupName: ctx.groupName,
-        mentioned: ctx.mentions.includes(this.cfg.handle.toLowerCase())
-      });
+    while (!this.stopping) {
+      const state = this.seen.get(row.id);
+      if (!state || state.status === "handled") return;
+      state.status = "running";
+      state.attempts += 1;
+      state.updatedAt = Date.now();
+      const attempt = state.attempts;
+      await this.acquireSlot();
+      if (this.stopping) {
+        this.releaseSlot();
+        return;
+      }
+      let result;
+      try {
+        log.info(
+          `turn for msg ${row.id} in ${row.conversation_id} from @${senderOf(row)} (attempt ${attempt})`
+        );
+        const ctx = contextOf(row);
+        result = await this.adapter.runTurn({
+          messageId: row.id,
+          conversationId: row.conversation_id,
+          sender: senderOf(row),
+          text: typeof row.content?.["text"] === "string" ? row.content["text"] : "",
+          createdAt: typeof row.created_at === "string" ? row.created_at : void 0,
+          type: typeof row.type === "string" ? row.type : void 0,
+          senderDisplayName: ctx.senderDisplayName,
+          senderKind: ctx.senderKind,
+          groupName: ctx.groupName,
+          mentioned: ctx.mentions.includes(this.cfg.handle.toLowerCase())
+        });
+      } catch (err) {
+        result = { ok: false, detail: `adapter threw: ${String(err)}` };
+      } finally {
+        this.releaseSlot();
+      }
       if (result.ok) {
-        this.ws.ack(row.id);
-      } else if (result.fatal) {
-        log.error(`fatal turn error: ${result.detail} \u2014 not acking (will re-drain)`);
-      } else if (attempts >= MAX_ATTEMPTS) {
-        log.warn(`msg ${row.id} failed ${attempts}\xD7 (${result.detail}); acking to drop (poison guard)`);
-        this.ws.ack(row.id);
-      } else {
-        log.warn(`turn failed for ${row.id}: ${result.detail}; leaving unacked for re-drain`);
+        this.markHandled(row.id);
+        return;
       }
-    } finally {
-      this.releaseSlot();
+      if (result.fatal) {
+        log.error(`fatal turn error: ${result.detail} \u2014 stopping runtime so preflight can recover`);
+        this.stop();
+        this.onTerminal?.({ kind: "runtime", reason: result.detail ?? "runtime failed" });
+        return;
+      }
+      const retryMs = retryDelay(attempt);
+      state.status = "retry-wait";
+      state.updatedAt = Date.now();
+      log.warn(
+        `turn failed for msg ${row.id}: ${result.detail}; retrying in ${retryMs}ms without acknowledging it`
+      );
+      await delay(retryMs);
+    }
+  }
+  markHandled(messageId) {
+    const state = this.seen.get(messageId);
+    if (!state || state.status === "handled") return;
+    state.status = "handled";
+    state.updatedAt = Date.now();
+    this.markNoLongerPending();
+    this.ws.ack(messageId);
+  }
+  markNoLongerPending() {
+    this.pending = Math.max(0, this.pending - 1);
+    if (this.pending <= RESUME_AT_PENDING) this.ws.resumeInbound();
+  }
+  /** Bound reconnect-dedup memory without ever evicting unfinished work. */
+  pruneSeen() {
+    const cutoff = Date.now() - SEEN_TTL_MS;
+    const completed = [];
+    for (const entry of this.seen.entries()) {
+      const [id, state] = entry;
+      if (state.status !== "handled") continue;
+      if (state.updatedAt < cutoff) this.seen.delete(id);
+      else completed.push(entry);
+    }
+    if (completed.length <= MAX_COMPLETED_SEEN) return;
+    completed.sort((a, b) => a[1].updatedAt - b[1].updatedAt);
+    for (const [id] of completed.slice(0, completed.length - MAX_COMPLETED_SEEN)) {
+      this.seen.delete(id);
     }
   }
   // ─── global concurrency semaphore ─────────────────────────────────────────
@@ -433,19 +627,44 @@ var Daemon = class {
 var POLL_MS = 5e3;
 var TICK_MS = 250;
 var MAX_BACKOFF_MS2 = 5 * 6e4;
+var MAX_LOG_BYTES = 5 * 1024 * 1024;
+var KEEP_LOG_BYTES = 1024 * 1024;
 var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 function fingerprint(home) {
   const id = resolveIdentity(home);
   return id === null ? null : `${id.apiKey}:${id.handle ?? ""}`;
 }
+function boundDaemonLog(home) {
+  const file = path3.join(home, "daemon.log");
+  try {
+    const size = fs2.statSync(file).size;
+    if (size <= MAX_LOG_BYTES) return;
+    const fd = fs2.openSync(file, "r");
+    try {
+      const keep = Buffer.alloc(Math.min(KEEP_LOG_BYTES, size));
+      fs2.readSync(fd, keep, 0, keep.length, size - keep.length);
+      fs2.writeFileSync(
+        file,
+        `[agentchat:info] older daemon log output truncated at ${(/* @__PURE__ */ new Date()).toISOString()}
+${keep.toString("utf-8")}`
+      );
+    } finally {
+      fs2.closeSync(fd);
+    }
+  } catch {
+  }
+}
 async function runDaemon(opts) {
-  const home = path2.resolve(opts.home);
-  const workdir = opts.workdir ?? path2.join(home, "daemon-workdir");
+  const home = path3.resolve(opts.home);
+  const workdir = opts.workdir ?? path3.join(home, "daemon-workdir");
+  boundDaemonLog(home);
   if (process.env["AGENTCHAT_LOG_LEVEL"] === void 0) process.env["AGENTCHAT_LOG_LEVEL"] = "info";
   const lock = acquireLeaderLock(home);
   if (lock === null) return 1;
   let live = null;
   let liveFingerprint = null;
+  let observedFingerprint = null;
+  let adapterFingerprint = null;
   let refused = null;
   let failures = 0;
   let lastFailure = null;
@@ -471,10 +690,17 @@ async function runDaemon(opts) {
   process.on("SIGTERM", () => shutdown("SIGTERM"));
   let nudged = false;
   try {
-    fs.mkdirSync(home, { recursive: true });
-    const watcher = fs.watch(home, (_event, filename) => {
+    fs2.mkdirSync(home, { recursive: true });
+    const watcher = fs2.watch(home, (_event, filename) => {
       if (filename === null || String(filename).startsWith("credentials")) nudged = true;
     });
+    watcher.on("error", (err) => {
+      log.warn(`credential watcher unavailable; polling instead: ${String(err)}`);
+      try {
+        watcher.close();
+      } catch {
+      }
+    });
     watcher.unref();
   } catch {
   }
@@ -483,19 +709,33 @@ async function runDaemon(opts) {
   for (; ; ) {
     if (shuttingDown) break;
     const fp = fingerprint(home);
+    const identityChanged = fp !== observedFingerprint;
+    if (identityChanged) {
+      disconnect(fp === null ? "signed out" : "identity changed");
+      observedFingerprint = fp;
+      failures = 0;
+      lastFailure = null;
+      if (fp !== refused) refused = null;
+    }
     if (fp === null) {
-      disconnect("signed out");
       if (refused !== null) refused = null;
     } else if (fp !== liveFingerprint) {
-      disconnect("identity changed");
-      failures = 0;
       if (fp === refused) {
       } else {
         try {
           const cfg = await resolveDaemonConfig({ home, workdir });
-          const candidate = new Daemon(cfg, opts.adapter, void 0, (reason) => {
-            log.warn(`credential refused (${reason}) \u2014 idling until it changes`);
-            refused = fp;
+          if (adapterFingerprint !== fp) {
+            opts.adapter.reset?.(`${cfg.apiBase}:${cfg.handle}`);
+            adapterFingerprint = fp;
+          }
+          const candidate = new Daemon(cfg, opts.adapter, void 0, (failure) => {
+            if (failure.kind === "socket-auth") {
+              log.warn(`credential refused (${failure.reason}) \u2014 idling until it changes`);
+              refused = fp;
+            } else {
+              log.warn(`runtime became unhealthy (${failure.reason}) \u2014 re-running preflight`);
+              failures += 1;
+            }
             live = null;
             liveFingerprint = null;
             idle(home);