@controlflow-ai/daemon 0.1.0

package/src/daemon.ts

@@ -0,0 +1,580 @@
+#!/usr/bin/env bun
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { parseArgs, boolFlag, flag, numberFlag } from './args.js';
+import { LockClient } from './client.js';
+import { DEFAULT_DAEMON_PORT, DEFAULT_HOST, agentHomePath, defaultDaemonToken, defaultServerUrl, defaultStatePath, ensureAgentHome, ensureParentDir, ensurePrivatePalCliBin } from './config.js';
+import { writeFailureMessage } from './failure-message.js';
+import { formatMessage } from './format.js';
+import { startLocalApi } from './local-api.js';
+import { loadOrCreateDaemonToken } from './token-file.js';
+import type { ComputerAgentAssignment, Message, MessageDelivery } from './types.js';
+import type { AgentRuntime } from './agent-runtime.js';
+import { knownRuntimeNames, resolveRuntimeDriver } from './runtime-registry.js';
+
+interface DaemonState {
+  daemonId: string;
+  lastSeenId: number;
+  agentUuid?: string;
+  agents?: Record<string, { agentUuid: string; lastSeenId?: number }>;
+  computerId?: string;
+  connectionId?: string;
+}
+
+interface ManagedAgent {
+  agent: string;
+  runtimeProvider: string;
+  agentUuid: string;
+  agentHome: string;
+  projectCwd: string;
+}
+
+function usage(): string {
+  return `pal daemon
+
+Usage:
+  npx @controlflow-ai/daemon --api-key sk_machine_... [--server ${defaultServerUrl()}] [--cwd .] [--interval 1500] [--dry-run]
+  npx @controlflow-ai/daemon --agent codex --computer-id host --computer-secret secret [--server ${defaultServerUrl()}] [--cwd .]
+
+The daemon connects one computer to the server, claims deliveries for assigned agents, and starts one agent run for each claimed delivery.
+Runs have no default timeout; use the web control page or API to kill/restart a run.
+`;
+}
+
+function defaultState(): DaemonState {
+  return { daemonId: crypto.randomUUID(), lastSeenId: 0 };
+}
+
+function readState(path: string): DaemonState {
+  if (!existsSync(path)) return defaultState();
+  try {
+    const state = JSON.parse(readFileSync(path, 'utf8')) as Partial<DaemonState>;
+    return {
+      daemonId: state.daemonId || crypto.randomUUID(),
+      lastSeenId: Number.isFinite(state.lastSeenId) ? Number(state.lastSeenId) : 0,
+      agentUuid: state.agentUuid,
+      agents: state.agents,
+      computerId: state.computerId,
+      connectionId: state.connectionId,
+    };
+  } catch {
+    return defaultState();
+  }
+}
+
+function ensureAgentUuid(state: DaemonState, agent: string): string {
+  state.agents ??= {};
+  state.agents[agent] ??= { agentUuid: Object.keys(state.agents).length === 0 && state.agentUuid ? state.agentUuid : crypto.randomUUID(), lastSeenId: 0 };
+  if (!state.agentUuid && Object.keys(state.agents).length === 1) {
+    state.agentUuid = state.agents[agent].agentUuid;
+  }
+  return state.agents[agent].agentUuid;
+}
+
+function writeState(path: string, state: DaemonState): void {
+  ensureParentDir(path);
+  writeFileSync(path, `${JSON.stringify(state, null, 2)}\n`);
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+async function resolveRuntime(agent: string, serverUrl: string, agentUuid: string): Promise<AgentRuntime> {
+  let configuredRuntime: string | null | undefined;
+  try {
+    const response = await fetch(`${serverUrl.replace(/\/$/, '')}/api/agents`);
+    if (response.ok) {
+      const payload = await response.json() as { data?: { agents: Array<{ agent_key: string; runtime: string | null }> } };
+      const configured = payload.data?.agents.find((a) => a.agent_key === agent);
+      configuredRuntime = configured?.runtime;
+    }
+  } catch (error) {
+    throw new Error(`Could not resolve runtime for agent '${agent}' from ${serverUrl}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+
+  if (!configuredRuntime) {
+    throw new Error(`Agent '${agent}' has no runtime configured. Configure it via POST /api/agents or PATCH /api/agents/<key>. Supported runtimes: ${knownRuntimeNames().join(', ')}.`);
+  }
+  return resolveRuntimeDriver(configuredRuntime, agentUuid);
+}
+
+async function executeRun(client: LockClient, delivery: MessageDelivery, message: Message, options: {
+  agent: string;
+  daemonId: string;
+  serverUrl: string;
+  agentHome: string;
+  projectCwd: string;
+  extraArgs: string[];
+  localDaemonUrl?: string;
+  localDaemonToken?: string;
+  privateCliBinDir?: string;
+  dryRun: boolean;
+  attempt: number;
+  agentUuid: string;
+  computerId?: string | null;
+  connectionId?: string | null;
+  runtimeProvider: string;
+  isConnectionRevoked?: () => boolean;
+  abortSignal?: AbortSignal;
+}): Promise<'done' | 'restart'> {
+  if (!delivery.claim_token) throw new Error(`delivery ${delivery.id} is not claimed`);
+
+  const runtime = await resolveRuntime(options.agent, options.serverUrl, options.agentUuid);
+  const logPrefix = `[${runtime.name}]`;
+
+  console.log(`${logPrefix} session getOrCreate chat=${message.chat_id} agent=${options.agent} daemon=${options.daemonId} agentHome=${options.agentHome} projectCwd=${options.projectCwd}`);
+  const session = await client.getOrCreateSession({
+    chat_id: message.chat_id,
+    agent: options.agent,
+    daemon_id: options.daemonId,
+    connection_id: options.connectionId,
+    computer_id: options.computerId,
+    runtime_provider: options.runtimeProvider,
+    cwd: options.agentHome,
+    last_message_id: message.id,
+  });
+  console.log(`${logPrefix} session=${session.id} last_message_id=${session.last_message_id} runtime_session_id=${session.runtime_session_id ?? '-'}`);
+
+  console.log(`${logPrefix} startRun message=${message.id} agent=${options.agent} attempt=${options.attempt} session=${session.id} delivery=${delivery.id}`);
+  const run = await client.startRun({
+    message_id: message.id,
+    agent: options.agent,
+    cwd: options.agentHome,
+    attempt: options.attempt,
+    pid: null,
+    session_id: session.id,
+    trigger_message_id: message.id,
+    daemon_id: options.daemonId,
+    connection_id: options.connectionId,
+    computer_id: options.computerId,
+    runtime_provider: options.runtimeProvider,
+    delivery_id: delivery.id,
+  });
+  console.log(`${logPrefix} run=${run.id} status=${run.status}`);
+
+  const { runAgentRuntime } = await import('./agent-runtime.js');
+  const roomParticipants = await client.listRoomMembers(message.chat_id)
+    .then((result) => result.participants)
+    .catch((error) => {
+      console.warn(`${logPrefix} room participant snapshot unavailable: ${error instanceof Error ? error.message : String(error)}`);
+      return [];
+    });
+  const recentMessages = await client.getMessages(new URLSearchParams({
+    chat_id: message.chat_id,
+    after: String(Math.max(0, message.id - 50)),
+    limit: '50',
+  })).catch((error) => {
+    console.warn(`${logPrefix} recent room history unavailable: ${error instanceof Error ? error.message : String(error)}`);
+    return [];
+  });
+
+  try {
+    console.log(`${logPrefix} spawn agent=${options.agent} chat=${message.chat_name} message=${message.id} dryRun=${options.dryRun}`);
+    const result = await runAgentRuntime(runtime, {
+      agent: options.agent,
+      serverUrl: options.serverUrl,
+      message,
+      cwd: options.agentHome,
+      agentHome: options.agentHome,
+      projectCwd: options.projectCwd,
+      extraArgs: options.extraArgs,
+      localDaemonUrl: options.localDaemonUrl,
+      localDaemonToken: options.localDaemonToken,
+      privateCliBinDir: options.privateCliBinDir,
+      palCliCommand: 'pal',
+      runtimeSessionId: session.runtime_session_id,
+      roomParticipants,
+      recentMessages,
+      dryRun: options.dryRun,
+      signal: options.abortSignal,
+      onStart: async (pid) => {
+        console.log(`${logPrefix} run=${run.id} pid=${pid}`);
+        await client.updateRunPid(run.id, pid);
+      },
+      getAction: async () => {
+        if (options.isConnectionRevoked?.()) return 'kill';
+        const latest = await client.getRun(run.id);
+        if (latest.action) {
+          console.log(`${logPrefix} run=${run.id} action=${latest.action}`);
+        }
+        return latest.action;
+      },
+    });
+
+    if (result.runtimeSessionId && result.runtimeSessionId !== session.runtime_session_id) {
+      console.log(`${logPrefix} session=${session.id} runtime_session_id=${result.runtimeSessionId}`);
+      await client.updateSessionRuntimeSessionId(session.id, { runtime_session_id: result.runtimeSessionId });
+    }
+
+    console.log(`${logPrefix} run=${run.id} exitCode=${result.exitCode} stoppedByAction=${result.stoppedByAction ?? '-'} outputLen=${result.output.length}`);
+    if (options.isConnectionRevoked?.()) {
+      console.log(`${logPrefix} run=${run.id} stopped after connection revocation; skipping revoked server writes`);
+      return 'done';
+    }
+
+    if (options.dryRun && result.output.trim()) {
+      console.log(`${logPrefix} dry-run sending output back to chat`);
+      await client.sendMessage({
+        chat: message.chat_name,
+        parent_id: message.parent_id ?? message.id,
+        sender: options.agent,
+        content: result.output.trim(),
+        type: 'system',
+      });
+    }
+
+    if (result.stoppedByAction === 'restart') {
+      console.log(`${logPrefix} run=${run.id} finishing with restart`);
+      await client.finishRun(run.id, { status: 'restarted', exit_code: result.exitCode, output: result.output });
+      return 'restart';
+    }
+
+    if (result.stoppedByAction === 'kill') {
+      console.log(`${logPrefix} run=${run.id} finishing with killed`);
+      await client.finishRun(run.id, { status: 'killed', exit_code: result.exitCode, output: result.output });
+      await client.ackDelivery(delivery.id, { daemon_id: options.daemonId, connection_id: options.connectionId, claim_token: delivery.claim_token, run_id: run.id });
+      return 'done';
+    }
+
+    if (result.exitCode === 0) {
+      console.log(`${logPrefix} run=${run.id} finishing with completed`);
+      await client.finishRun(run.id, { status: 'completed', exit_code: result.exitCode, output: result.output });
+      await client.ackDelivery(delivery.id, { daemon_id: options.daemonId, connection_id: options.connectionId, claim_token: delivery.claim_token, run_id: run.id });
+      return 'done';
+    }
+
+    const output = `${runtime.name} run failed with exit ${result.exitCode}\n${result.output}`.trim();
+    console.log(`${logPrefix} run=${run.id} finishing with failed: ${output.slice(0, 200)}`);
+    await client.finishRun(run.id, { status: 'failed', exit_code: result.exitCode, output });
+    await client.failDelivery(delivery.id, { daemon_id: options.daemonId, connection_id: options.connectionId, claim_token: delivery.claim_token, run_id: run.id, error: output });
+    await writeFailureMessage(client, message, options.agent, output);
+    return 'done';
+  } catch (error) {
+    const output = error instanceof Error ? error.message : String(error);
+    console.error(`${logPrefix} run=${run.id} exception: ${output}`);
+    if (options.isConnectionRevoked?.()) {
+      console.log(`${logPrefix} run=${run.id} exception after connection revocation; skipping revoked server writes`);
+      return 'done';
+    }
+    await client.finishRun(run.id, { status: 'failed', output });
+    await client.failDelivery(delivery.id, { daemon_id: options.daemonId, connection_id: options.connectionId, claim_token: delivery.claim_token, run_id: run.id, error: output });
+    await writeFailureMessage(client, message, options.agent, output);
+    return 'done';
+  }
+}
+
+async function handleDelivery(client: LockClient, delivery: MessageDelivery, options: {
+  agent: string;
+  daemonId: string;
+  serverUrl: string;
+  agentHome: string;
+  projectCwd: string;
+  extraArgs: string[];
+  localDaemonUrl?: string;
+  localDaemonToken?: string;
+  privateCliBinDir?: string;
+  dryRun: boolean;
+  agentUuid: string;
+  computerId?: string | null;
+  connectionId?: string | null;
+  runtimeProvider: string;
+  isConnectionRevoked?: () => boolean;
+  abortSignal?: AbortSignal;
+}): Promise<void> {
+  console.log(`[daemon] handleDelivery delivery=${delivery.id} message=${delivery.message_id} attempts=${delivery.attempts}`);
+  const message = await client.getMessage(delivery.message_id);
+  console.log(`[daemon] claimed delivery ${delivery.id} for ${formatMessage(message)}`);
+
+  let attempt = Math.max(delivery.attempts, 1);
+  while (true) {
+    console.log(`[daemon] executeRun delivery=${delivery.id} attempt=${attempt}`);
+    const outcome = await executeRun(client, delivery, message, { ...options, attempt });
+    console.log(`[daemon] executeRun delivery=${delivery.id} outcome=${outcome}`);
+    if (outcome !== 'restart') return;
+    attempt += 1;
+    console.log(`[daemon] restarting message ${message.id} for ${options.agent}, attempt ${attempt}`);
+  }
+}
+
+async function discoverDeliveries(client: LockClient, state: DaemonState, agent: string): Promise<void> {
+  console.log(`[daemon] discoverDeliveries agent=${agent} after=${state.lastSeenId}`);
+  const messages = await client.getInbox(agent, state.lastSeenId, 20);
+  console.log(`[daemon] discoverDeliveries found ${messages.length} messages`);
+  for (const message of messages) {
+    console.log(`[daemon] createDelivery message=${message.id} agent=${agent}`);
+    await client.createDelivery({ message_id: message.id, agent });
+    state.lastSeenId = Math.max(state.lastSeenId, message.id);
+  }
+}
+
+async function processPendingDeliveries(client: LockClient, options: {
+  agent: string;
+  daemonId: string;
+  serverUrl: string;
+  agentHome: string;
+  projectCwd: string;
+  extraArgs: string[];
+  localDaemonUrl?: string;
+  localDaemonToken?: string;
+  privateCliBinDir?: string;
+  dryRun: boolean;
+  agentUuid: string;
+  computerId?: string | null;
+  connectionId?: string | null;
+  runtimeProvider: string;
+  isConnectionRevoked?: () => boolean;
+  abortSignal?: AbortSignal;
+}): Promise<void> {
+  console.log(`[daemon] processPendingDeliveries agent=${options.agent} daemon=${options.daemonId}`);
+  const deliveries = await client.listDeliveries(options.agent, 'pending', 20);
+  console.log(`[daemon] processPendingDeliveries found ${deliveries.length} pending deliveries`);
+  for (const delivery of deliveries) {
+    try {
+      console.log(`[daemon] claimDelivery delivery=${delivery.id}`);
+      const claimed = await client.claimDelivery(delivery.id, { daemon_id: options.daemonId, connection_id: options.connectionId, computer_id: options.computerId });
+      console.log(`[daemon] claimDelivery success delivery=${claimed.id} token=${claimed.claim_token}`);
+      await handleDelivery(client, claimed, options);
+    } catch (error) {
+      console.warn(`[daemon] claimDelivery failed delivery=${delivery.id}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+}
+
+async function buildManagedAgent(input: {
+  assignment: Pick<ComputerAgentAssignment, 'agent' | 'runtime' | 'cwd'>;
+  state: DaemonState;
+  serverUrl: string;
+  defaultCwd: string;
+}): Promise<ManagedAgent> {
+  const agentUuid = ensureAgentUuid(input.state, input.assignment.agent);
+  const runtime = await resolveRuntime(input.assignment.agent, input.serverUrl, agentUuid);
+  const agentHome = agentHomePath(agentUuid);
+  ensureAgentHome(agentHome, input.assignment.agent, runtime.name);
+  return {
+    agent: input.assignment.agent,
+    runtimeProvider: runtime.name,
+    agentUuid,
+    agentHome,
+    projectCwd: input.assignment.cwd || input.defaultCwd,
+  };
+}
+
+function daemonAgentPayload(managedAgents: Map<string, ManagedAgent>): Array<{ agent: string; cwd: string; capabilities: Record<string, unknown> }> {
+  return Array.from(managedAgents.values()).map((managed) => ({
+    agent: managed.agent,
+    cwd: managed.agentHome,
+    capabilities: { runtime: managed.runtimeProvider, agentHome: managed.agentHome, projectCwd: managed.projectCwd },
+  }));
+}
+
+async function reconcileManagedAgents(input: {
+  assignments: ComputerAgentAssignment[];
+  explicitAgents: Set<string>;
+  managedAgents: Map<string, ManagedAgent>;
+  state: DaemonState;
+  client: LockClient;
+  daemonId: string;
+  computerId: string;
+  serverUrl: string;
+  defaultCwd: string;
+}): Promise<void> {
+  const desiredAssignedAgents = new Set(input.assignments.map((assignment) => assignment.agent));
+
+  for (const assignment of input.assignments) {
+    if (!assignment.runtime) {
+      console.warn(`[daemon] assigned agent ${assignment.agent} has no runtime configured; skipping`);
+      continue;
+    }
+    const existing = input.managedAgents.get(assignment.agent);
+    const projectCwd = assignment.cwd || input.defaultCwd;
+    if (existing && existing.runtimeProvider === assignment.runtime && existing.projectCwd === projectCwd) continue;
+    const managed = await buildManagedAgent({ assignment, state: input.state, serverUrl: input.serverUrl, defaultCwd: input.defaultCwd });
+    input.managedAgents.set(assignment.agent, managed);
+    console.log(`[daemon] agent active agent=${managed.agent} runtime=${managed.runtimeProvider} projectCwd=${managed.projectCwd}`);
+  }
+
+  for (const agent of Array.from(input.managedAgents.keys())) {
+    if (input.explicitAgents.has(agent)) continue;
+    if (desiredAssignedAgents.has(agent)) continue;
+    input.managedAgents.delete(agent);
+    console.log(`[daemon] agent removed agent=${agent}`);
+  }
+
+  await input.client.registerDaemon({
+    id: input.daemonId,
+    name: input.computerId,
+    server_url: input.serverUrl,
+    agents: daemonAgentPayload(input.managedAgents),
+  });
+}
+
+async function main(): Promise<void> {
+  const rawArgs = parseArgs();
+  // When launched as `bun run src/daemon.ts --agent foo`, the first arg is a flag,
+  // not a subcommand. Shift it back into flags/values.
+  const args: typeof rawArgs = rawArgs.command.startsWith('--')
+    ? parseArgs(['daemon', rawArgs.command, ...rawArgs.values, ...Object.entries(rawArgs.flags).flatMap(([k, v]) => v === true ? [`--${k}`] : [`--${k}=${v}`])])
+    : rawArgs;
+  if (args.flags.help) {
+    console.log(usage());
+    return;
+  }
+
+  const explicitAgent = flag(args.flags, 'agent') ?? process.env.PAL_AGENT;
+  const serverUrl = flag(args.flags, 'server-url') ?? flag(args.flags, 'server') ?? defaultServerUrl();
+  const cwd = flag(args.flags, 'cwd') ?? process.cwd();
+  const interval = numberFlag(args.flags, 'interval', 1500)!;
+  const localHost = flag(args.flags, 'local-host') ?? DEFAULT_HOST;
+  const localPort = numberFlag(args.flags, 'local-port', DEFAULT_DAEMON_PORT)!;
+  const argvLocalToken = flag(args.flags, 'local-token');
+  if (argvLocalToken && process.env.NODE_ENV !== 'test') {
+    throw new Error('--local-token is only allowed when NODE_ENV=test; use LOCK_DAEMON_TOKEN or token file');
+  }
+  const localToken = argvLocalToken ?? defaultDaemonToken() ?? loadOrCreateDaemonToken();
+  const statePath = flag(args.flags, 'state') ?? defaultStatePath(explicitAgent ?? 'computer');
+  const once = boolFlag(args.flags, 'once');
+  const dryRun = boolFlag(args.flags, 'dry-run');
+  const extraArgsRaw = flag(args.flags, 'neeko-args') ?? flag(args.flags, 'agent-args') ?? '';
+  const extraArgs = extraArgsRaw ? extraArgsRaw.split(' ').filter(Boolean) : [];
+  const privateCliBinDir = ensurePrivatePalCliBin();
+  const bootstrapClient = new LockClient(serverUrl);
+  const state = readState(statePath);
+
+  const apiKey = flag(args.flags, 'api-key') ?? process.env.PAL_API_KEY;
+  const computerId = flag(args.flags, 'computer-id') ?? process.env.PAL_COMPUTER_ID;
+  const computerSecret = flag(args.flags, 'computer-secret') ?? process.env.PAL_COMPUTER_SECRET;
+  if (!apiKey?.trim() && !computerId?.trim()) throw new Error('--api-key, --computer-id, or PAL_COMPUTER_ID is required');
+  if (!apiKey?.trim() && !computerSecret?.trim()) throw new Error('--api-key, --computer-secret, or PAL_COMPUTER_SECRET is required');
+
+  const explicitAgents = new Set<string>();
+  const managedAgents = new Map<string, ManagedAgent>();
+  if (explicitAgent) {
+    explicitAgents.add(explicitAgent);
+    const managed = await buildManagedAgent({
+      assignment: { agent: explicitAgent, runtime: null, cwd },
+      state,
+      serverUrl,
+      defaultCwd: cwd,
+    });
+    managedAgents.set(explicitAgent, managed);
+  }
+
+  const connected = await bootstrapClient.connectComputer({
+    computer_id: computerId,
+    secret: computerSecret,
+    api_key: apiKey,
+    name: computerId,
+    server_url: serverUrl,
+    agents: daemonAgentPayload(managedAgents),
+  });
+  state.computerId = connected.computer.id;
+  state.connectionId = connected.connection.id;
+  state.daemonId = connected.connection.id;
+
+  const daemonAuth = { computer_id: connected.computer.id, connection_id: connected.connection.id, token: connected.token };
+  const client = new LockClient(serverUrl, daemonAuth);
+  await reconcileManagedAgents({
+    assignments: connected.agents ?? [],
+    explicitAgents,
+    managedAgents,
+    state,
+    client,
+    daemonId: connected.connection.id,
+    computerId: connected.computer.id,
+    serverUrl,
+    defaultCwd: cwd,
+  });
+  if (managedAgents.size === 0) {
+    console.log(`[daemon] no agents currently assigned to computer ${connected.computer.id}; waiting for assignments`);
+  }
+  writeState(statePath, state);
+  let connectionRevoked = false;
+  const heartbeatMs = numberFlag(args.flags, 'heartbeat-interval', 5000)!;
+
+  const localServer = startLocalApi({ host: localHost, port: localPort, serverUrl, token: localToken, daemonAuth });
+
+  console.log(`pal daemon computer=${connected.computer.id} connection=${connected.connection.id} agents=${Array.from(managedAgents.values()).map((managed) => `${managed.agent}:${managed.runtimeProvider}`).join(',') || 'none'} server=${serverUrl}`);
+  console.log(`local api=http://${localServer.hostname}:${localServer.port} token=${localToken ? 'set' : 'missing'}`);
+  console.log(`state=${statePath} lastSeenId=${state.lastSeenId}`);
+  console.log(`private cli bin=${privateCliBinDir}`);
+
+  let running = true;
+  const runtimeAbortController = new AbortController();
+  process.on('SIGINT', () => { running = false; runtimeAbortController.abort(); });
+  process.on('SIGTERM', () => { running = false; runtimeAbortController.abort(); });
+  const heartbeatTimer = setInterval(() => {
+    void client.heartbeatComputer(connected.computer.id).catch((error) => {
+      connectionRevoked = true;
+      running = false;
+      runtimeAbortController.abort();
+      console.warn(`[daemon] heartbeat failed, stopping connection=${connected.connection.id}: ${error instanceof Error ? error.message : String(error)}`);
+    });
+  }, heartbeatMs);
+
+  while (running) {
+    console.log(`[daemon] tick process deliveries interval=${interval}ms once=${once}`);
+    try {
+      const heartbeat = await client.heartbeatComputer(connected.computer.id);
+      await reconcileManagedAgents({
+        assignments: heartbeat.agents ?? [],
+        explicitAgents,
+        managedAgents,
+        state,
+        client,
+        daemonId: connected.connection.id,
+        computerId: connected.computer.id,
+        serverUrl,
+        defaultCwd: cwd,
+      });
+      writeState(statePath, state);
+    } catch (error) {
+      connectionRevoked = true;
+      running = false;
+      runtimeAbortController.abort();
+      console.warn(`[daemon] heartbeat failed, stopping connection=${connected.connection.id}: ${error instanceof Error ? error.message : String(error)}`);
+      break;
+    }
+    if (managedAgents.size === 0) {
+      console.log(`[daemon] no assigned agents; idle`);
+    }
+    for (const managed of managedAgents.values()) {
+      if (process.env.PAL_DAEMON_DISCOVER_INBOX === '1') {
+        await discoverDeliveries(client, state, managed.agent);
+        writeState(statePath, state);
+      }
+      await processPendingDeliveries(client, {
+        agent: managed.agent,
+        daemonId: connected.connection.id,
+        serverUrl,
+        agentHome: managed.agentHome,
+        projectCwd: managed.projectCwd,
+        extraArgs,
+        dryRun,
+        agentUuid: managed.agentUuid,
+        computerId: connected.computer.id,
+        connectionId: connected.connection.id,
+        runtimeProvider: managed.runtimeProvider,
+        isConnectionRevoked: () => connectionRevoked,
+        abortSignal: runtimeAbortController.signal,
+        localDaemonUrl: `http://${localServer.hostname}:${localServer.port}`,
+        localDaemonToken: localToken,
+        privateCliBinDir,
+      });
+    }
+
+    if (once) {
+      console.log(`[daemon] --once set, exiting loop`);
+      break;
+    }
+    console.log(`[daemon] sleep ${interval}ms`);
+    await sleep(interval);
+  }
+
+  clearInterval(heartbeatTimer);
+  localServer.stop(true);
+}
+
+main().catch((error) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+});