@mycadet/assistant 0.13.0-dev.202611141959.760a53b → 0.13.0-dev.202611142107.f5e00a2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mycadet/assistant",
-  "version": "0.13.0-dev.202611141959.760a53b",
+  "version": "0.13.0-dev.202611142107.f5e00a2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vargasjr-dev/mycadet-temp.git"

package/src/__tests__/credential-execution-api-key-propagation.test.ts

@@ -12,7 +12,7 @@
  * ## What this file tests (and what it does NOT)
  *
  * This file exercises **production code** exclusively:
- * - `createCesClient` from `credential-execution/client.ts`
+ * - `createCesRpcClient` from `@mycadet/ces-client/rpc-client`
  * - Zod schemas from `@mycadet/service-contracts/credential-rpc` (HandshakeRequestSchema,
  *   CesRpcSchemas, CesRpcMethod)
  *
@@ -30,6 +30,7 @@ import { describe, expect, test } from "bun:test";
 
 import type { CesTransport } from "@mycadet/ces-client/rpc-client";
 import type { CesRpcClient } from "@mycadet/ces-client/rpc-client";
+import { createCesRpcClient } from "@mycadet/ces-client/rpc-client";
 import {
   CES_PROTOCOL_VERSION,
   CesRpcMethod,
@@ -37,8 +38,6 @@ import {
   HandshakeRequestSchema,
 } from "@mycadet/service-contracts/credential-rpc";
 
-import { createCesClient } from "../credential-execution/client.js";
-
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -172,7 +171,7 @@ describe("update_managed_credential RPC contract", () => {
 describe("CesClient.updateAssistantApiKey()", () => {
   test("sends update_managed_credential RPC with the correct payload", async () => {
     const transport = createMockTransport();
-    const client = createCesClient(transport, {
+    const client = createCesRpcClient(transport, {
       handshakeTimeoutMs: 1_000,
       requestTimeoutMs: 1_000,
     });
@@ -210,7 +209,7 @@ describe("CesClient.updateAssistantApiKey()", () => {
 
   test("propagation flow: handshake without key then update", async () => {
     const transport = createMockTransport();
-    const client = createCesClient(transport, {
+    const client = createCesRpcClient(transport, {
       handshakeTimeoutMs: 1_000,
       requestTimeoutMs: 1_000,
     });
@@ -254,7 +253,7 @@ describe("CesClient.updateAssistantApiKey()", () => {
 
   test("throws if called before handshake", async () => {
     const transport = createMockTransport();
-    const client = createCesClient(transport);
+    const client = createCesRpcClient(transport);
 
     try {
       await client.updateAssistantApiKey("key");

package/src/__tests__/credential-execution-client.test.ts

@@ -24,10 +24,10 @@ import type { CesTransport } from "@mycadet/ces-client/rpc-client";
 import { CesClientError } from "@mycadet/ces-client/rpc-client";
 import { CesHandshakeError } from "@mycadet/ces-client/rpc-client";
 import { CesTransportError } from "@mycadet/ces-client/rpc-client";
+import { createCesRpcClient } from "@mycadet/ces-client/rpc-client";
 import { resolveIpcEndpoint } from "@mycadet/ipc-server-utils";
 import { CES_PROTOCOL_VERSION } from "@mycadet/service-contracts/credential-rpc";
 
-import { createCesClient } from "../credential-execution/client.js";
 import {
   discoverCes,
   discoverCesWithRetry,
@@ -207,7 +207,7 @@ describe("discoverCesWithRetry", () => {
 describe("CES client", () => {
   test("handshake sends correct protocol version", async () => {
     const transport = createMockTransport();
-    const client = createCesClient(transport, {
+    const client = createCesRpcClient(transport, {
       handshakeTimeoutMs: 1_000,
     });
 
@@ -240,7 +240,7 @@ describe("CES client", () => {
 
   test("handshake times out when CES does not respond", async () => {
     const transport = createMockTransport();
-    const client = createCesClient(transport, {
+    const client = createCesRpcClient(transport, {
       handshakeTimeoutMs: 100, // Very short timeout for test
     });
 
@@ -258,7 +258,7 @@ describe("CES client", () => {
 
   test("handshake reports rejection from CES", async () => {
     const transport = createMockTransport();
-    const client = createCesClient(transport, {
+    const client = createCesRpcClient(transport, {
       handshakeTimeoutMs: 1_000,
     });
 
@@ -285,7 +285,7 @@ describe("CES client", () => {
 
   test("call() throws before handshake", async () => {
     const transport = createMockTransport();
-    const client = createCesClient(transport);
+    const client = createCesRpcClient(transport);
 
     try {
       await client.call("list_credentials", {});
@@ -300,7 +300,7 @@ describe("CES client", () => {
 
   test("call() throws when transport is dead", async () => {
     const transport = createMockTransport();
-    const client = createCesClient(transport, {
+    const client = createCesRpcClient(transport, {
       handshakeTimeoutMs: 1_000,
     });
 
@@ -332,7 +332,7 @@ describe("CES client", () => {
 
   test("close() cancels pending requests", async () => {
     const transport = createMockTransport();
-    const client = createCesClient(transport, {
+    const client = createCesRpcClient(transport, {
       handshakeTimeoutMs: 1_000,
       requestTimeoutMs: 10_000,
     });

package/src/credential-execution/ces-runtime.ts

@@ -2,12 +2,10 @@ import type { CesRpcClient as CesClient } from "@mycadet/ces-client/rpc-client";
 import type { CesRpcHandshakeOptions as CesClientHandshakeOptions } from "@mycadet/ces-client/rpc-client";
 
 import { getCloudAssistantId } from "../config/env.js";
-import type { AssistantConfig } from "../config/schema.js";
 import { resolveCloudProxyContext } from "../providers/cloud-proxy/context.js";
 import { cesRecordBackend } from "../security/ces-rpc-record-backend.js";
 import { getLogger } from "../util/logger.js";
-import { openCesRpcSession } from "./ces-connect.js";
-import type { CesSessionClient } from "./client.js";
+import { type CesSessionClient, createCesClient } from "./client.js";
 
 const log = getLogger("ces-runtime");
 
@@ -16,15 +14,16 @@ const log = getLogger("ces-runtime");
  * Service) connection. `initializeCesClient()` connects and handshakes at
  * daemon startup; `getCesClient()` exposes the live client to routes;
  * `stopCes()` tears it down at shutdown.
+ *
+ * Reconnection is owned by the session itself: a dead transport triggers the
+ * client's in-session reconnect loop (same handshake, bounded backoff), so
+ * the `clientRef` reference stays stable across CES restarts.
  */
 
 let clientPromise: Promise<CesClient | undefined> | undefined;
-let initAbortController: AbortController | undefined;
 let clientRef: CesSessionClient | undefined;
 /** Monotonically increasing counter to detect stale client updates. */
 let clientGeneration = 0;
-/** Boot-session reconnect, set by initializeCesClient and used by the proactive loop. */
-let reconnectBootSession: (() => Promise<CesClient | undefined>) | undefined;
 
 /**
  * Initialize the assistant's CES RPC client: discover the socket, connect,
@@ -34,32 +33,10 @@ let reconnectBootSession: (() => Promise<CesClient | undefined>) | undefined;
  * reads route through the record backend's own lazily opened session, and
  * `clientRef` is updated once the handshake resolves.
  */
-export async function initializeCesClient(
-  _config: AssistantConfig,
-): Promise<void> {
-  const abortController = new AbortController();
-  initAbortController = abortController;
-  let handshake: CesClientHandshakeOptions = {};
+export async function initializeCesClient(): Promise<void> {
   const generation = ++clientGeneration;
 
-  reconnectBootSession = async (): Promise<CesClient | undefined> => {
-    // Reset the dead session's transport, then open a fresh one — the
-    // replacement re-registers its own transport-close hook.
-    await clientRef?.stop().catch(() => {});
-    const client = await openCesRpcSession({
-      handshake,
-      onTransportClose: () => startProactiveReconnectLoop(),
-    });
-    if (client) {
-      log.info("CES reconnection handshake accepted");
-      clientGeneration++;
-      clientRef = client;
-    }
-    return client;
-  };
-
-  // Reconnect ownership is claimed above, before the identity read.
-  // Snapshotting the API key inside this promise (not before it) avoids a
+  // Snapshot the API key inside this promise (not before it) to avoid a
   // second resolveCloudProxyContext() after the handshake, which would read
   // the key through CES while reconnecting.
   clientPromise = (async (): Promise<CesClient | undefined> => {
@@ -69,21 +46,14 @@ export async function initializeCesClient(
       // after hatch and stored in the credential store. CES can't read
       // the env var, so we pass it via the handshake.
       const proxyCtx = await resolveCloudProxyContext();
-      if (abortController.signal.aborted) {
-        return undefined;
-      }
       const assistantId = getCloudAssistantId();
-      handshake = {
+      const handshake: CesClientHandshakeOptions = {
         ...(proxyCtx.assistantApiKey
           ? { assistantApiKey: proxyCtx.assistantApiKey }
           : {}),
         ...(assistantId ? { assistantId } : {}),
       };
-      const client = await openCesRpcSession({
-        signal: abortController.signal,
-        handshake,
-        onTransportClose: () => startProactiveReconnectLoop(),
-      });
+      const client = await createCesClient({ handshake });
       if (client && clientGeneration === generation) {
         clientRef = client;
         log.info(
@@ -114,20 +84,11 @@ export function getCesClient(): CesClient | undefined {
 
 /** Tear down the CES connection during daemon shutdown. */
 export async function stopCes(): Promise<void> {
-  // Suppress the proactive reconnect loop — forceStop() closes the
-  // transport, which would otherwise trigger onTransportClose and start
-  // a reconnect loop racing against this shutdown.
-  shuttingDown = true;
   // Drop the record backend's own session too.
   await cesRecordBackend.close().catch(() => {});
-  // Abort any in-flight CES initialization so it fails fast instead of
-  // blocking shutdown for up to ~15s (socket connect + handshake timeouts).
-  if (initAbortController) {
-    initAbortController.abort();
-    initAbortController = undefined;
-  }
   // Force-stop the live session's transport — forceStop() works even if
-  // start() hasn't finished (unlike stop() which is a no-op when !running).
+  // start() hasn't finished (unlike stop() which is a no-op when not
+  // connected), and it disables the session's own reconnection loop.
   if (clientRef) {
     await clientRef.forceStop().catch(() => {});
     // Cancel in-flight handshake/RPC timers by closing the client directly.
@@ -142,96 +103,4 @@ export async function stopCes(): Promise<void> {
     await clientPromise.catch(() => undefined);
     clientPromise = undefined;
   }
-  reconnectBootSession = undefined;
-  proactiveReconnectInFlight = false;
-}
-
-// ---------------------------------------------------------------------------
-// Proactive reconnect loop
-// ---------------------------------------------------------------------------
-
-/**
- * Backoff schedule for proactive reconnection attempts (milliseconds).
- * The first attempt fires immediately (0ms); subsequent attempts use
- * exponential backoff capped at 30s.
- */
-const RECONNECT_BACKOFF_MS = [0, 2_000, 5_000, 10_000, 20_000, 30_000];
-
-/** Maximum reconnection attempts before giving up and relying on the lazy path. */
-const MAX_RECONNECT_ATTEMPTS = RECONNECT_BACKOFF_MS.length;
-
-/**
- * Track the active reconnect loop so a new transport-close event (e.g. from
- * a failed reconnect's own transport dying) doesn't start a second loop.
- */
-let proactiveReconnectInFlight = false;
-/** Set to true during stopCes() so the proactive reconnect loop doesn't fire
- * when forceStop() intentionally closes the transport. */
-let shuttingDown = false;
-
-/**
- * Start a retry-with-backoff loop that proactively re-establishes the boot
- * CES session after the transport dies. Each attempt calls the boot-session
- * reconnect (which re-handshakes with the assistant API key and updates
- * `clientRef`). The record backend reconnects its own session independently,
- * cooldown-gated, on the next credential/record operation.
- */
-function startProactiveReconnectLoop(): void {
-  if (shuttingDown) {
-    log.debug("CES shutting down — not starting proactive reconnect loop");
-    return;
-  }
-  if (proactiveReconnectInFlight) {
-    log.debug("Proactive reconnect loop already running — skipping");
-    return;
-  }
-  proactiveReconnectInFlight = true;
-
-  void (async () => {
-    log.warn("CES transport died — starting proactive reconnect loop");
-
-    for (let attempt = 0; attempt < MAX_RECONNECT_ATTEMPTS; attempt++) {
-      const delay = RECONNECT_BACKOFF_MS[attempt];
-      if (delay > 0) {
-        await sleep(delay);
-      }
-
-      // Stop if the daemon is shutting down.
-      if (shuttingDown) {
-        log.info("Proactive reconnect loop stopped — shutdown in progress");
-        break;
-      }
-
-      try {
-        const client = await reconnectBootSession?.();
-        if (client) {
-          log.info(
-            { attempt: attempt + 1 },
-            "Proactive CES reconnection succeeded",
-          );
-          break;
-        }
-        log.warn(
-          { attempt: attempt + 1, max: MAX_RECONNECT_ATTEMPTS },
-          "Proactive CES reconnection attempt did not succeed",
-        );
-      } catch (err) {
-        log.warn(
-          {
-            attempt: attempt + 1,
-            max: MAX_RECONNECT_ATTEMPTS,
-            error: err instanceof Error ? err.message : String(err),
-          },
-          "Proactive CES reconnection attempt threw",
-        );
-      }
-    }
-
-    proactiveReconnectInFlight = false;
-    log.info("Proactive reconnect loop finished");
-  })();
-}
-
-function sleep(ms: number): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, ms));
 }

package/src/credential-execution/client.test.ts

@@ -0,0 +1,22 @@
+/**
+ * Tests for the shared CES RPC session factory used by assistant boot and
+ * child-process credential resolution.
+ */
+import { describe, expect, test } from "bun:test";
+
+import { createCesClient } from "./client.js";
+
+describe("createCesClient", () => {
+  test("returns undefined when discovery fails without polling", async () => {
+    const start = Date.now();
+    const client = await createCesClient({
+      discover: async () => ({
+        mode: "unavailable",
+        reason: "missing test socket",
+      }),
+    });
+
+    expect(client).toBeUndefined();
+    expect(Date.now() - start).toBeLessThan(1_000);
+  });
+});

package/src/credential-execution/client.ts

@@ -1,61 +1,228 @@
 /**
  * CES RPC client — assistant-local entry point.
  *
- * Re-exports the shared `@mycadet/ces-client/rpc-client` types and factory
- * so that all assistant-internal consumers (`secure-keys.ts`, `lifecycle.ts`,
- * `server.ts`, etc.) import from this module without a direct package
- * dependency. The process-manager and transport wiring in the assistant
- * remain in the assistant codebase; only the protocol/envelope logic is
- * delegated to the shared package.
+ * The session fully owns its transport lifecycle: the process manager,
+ * socket discovery, handshake, and reconnection all live here. Consumers
+ * call `createCesClient()` and get back a stable client reference whose
+ * transport self-heals — when the socket dies the session reconnects with
+ * the same handshake (exponential backoff, capped) without the caller
+ * seeing a new object. `client.stop()` / `client.forceStop()` tear the
+ * session down and disable reconnection.
+ *
+ * Only the protocol/envelope logic is delegated to the shared
+ * `@mycadet/ces-client` package; the process-manager wiring stays in the
+ * assistant codebase.
  */
 
 import {
+  CesClientError,
   type CesRpcClient,
   type CesRpcClientConfig,
-  type CesTransport,
+  type CesRpcHandshakeOptions,
   createCesRpcClient,
 } from "@mycadet/ces-client/rpc-client";
 
 import { getLogger } from "../util/logger.js";
+import {
+  CesUnavailableError,
+  createCesProcessManager,
+} from "./process-manager.js";
 
 const log = getLogger("ces-rpc-client");
 
+/**
+ * Backoff schedule for a session's proactive reconnection attempts
+ * (milliseconds). The first attempt fires immediately (0ms); subsequent
+ * attempts use exponential backoff capped at 30s.
+ */
+const RECONNECT_BACKOFF_MS = [0, 2_000, 5_000, 10_000, 20_000, 30_000];
+
+/** Maximum reconnection attempts before the session gives up and relies on
+ * callers lazily opening a fresh one. */
+const MAX_RECONNECT_ATTEMPTS = RECONNECT_BACKOFF_MS.length;
+
 /**
  * The transport lifecycle of one CES RPC session. The lifecycle rides on the
  * client itself (`client.stop()` / `client.forceStop()`) — there is no
  * separate session object to keep alive alongside it.
  */
 export interface CesClientLifecycle {
-  /** Disconnect this session's transport. Idempotent. */
+  /** Disconnect this session's transport. Idempotent. Disables reconnection. */
   stop(): Promise<void>;
-  /** Shutdown path: disconnects even while `start()` is still in flight. */
+  /** Shutdown path: disconnects even while a connect is still in flight. */
   forceStop(): Promise<void>;
 }
 
-/** A CES RPC client that owns its transport lifecycle. */
+/** A CES RPC client that owns its transport lifecycle and reconnection. */
 export interface CesSessionClient extends CesRpcClient, CesClientLifecycle {}
 
+export interface CesSessionClientOptions {
+  /** Handshake material reused verbatim across reconnections. */
+  handshake?: CesRpcHandshakeOptions;
+  /** Socket discovery override. Tests inject a stub. */
+  discover?: Parameters<typeof createCesProcessManager>[0]["discover"];
+  /** RPC/handshake timeouts forwarded to the shared client. */
+  config?: CesRpcClientConfig;
+}
+
 /**
- * Construct a CES RPC client wired to the assistant logger so handshake-ready
- * and close transitions are visible in the daemon logs.
+ * Open a CES RPC session: discover the socket, connect, handshake, and own
+ * the transport from then on — a dead transport triggers an in-session
+ * reconnection (same handshake, bounded backoff) instead of surfacing a
+ * close callback to the caller.
+ *
+ * Returns undefined when CES is missing or the handshake is rejected. The
+ * transport is stopped on those paths so a later call can open a fresh
+ * session. Shutdown goes through `client.forceStop()`, which also stops any
+ * in-session reconnect loop.
  */
-export function createCesClient(
-  transport: CesTransport,
-  config?: CesRpcClientConfig,
-): CesRpcClient;
-export function createCesClient(
-  transport: CesTransport,
-  config: CesRpcClientConfig | undefined,
-  lifecycle: CesClientLifecycle,
-): CesSessionClient;
-export function createCesClient(
-  transport: CesTransport,
-  config?: CesRpcClientConfig,
-  lifecycle?: CesClientLifecycle,
-): CesRpcClient | CesSessionClient {
-  const client = createCesRpcClient(transport, { logger: log, ...config });
-  if (lifecycle) {
-    return Object.assign(client, lifecycle) as CesSessionClient;
+export async function createCesClient(
+  options: CesSessionClientOptions = {},
+): Promise<CesSessionClient | undefined> {
+  const pm = createCesProcessManager({ discover: options.discover });
+  const handshake = options.handshake;
+
+  let inner: CesRpcClient | undefined;
+  let stopping = false;
+  let reconnecting = false;
+
+  const stopInternal = async (force: boolean): Promise<void> => {
+    stopping = true;
+    inner?.close();
+    inner = undefined;
+    await (force ? pm.forceStop() : pm.stop()).catch(() => {});
+  };
+
+  /** Connect + handshake one transport. Returns the ready inner client. */
+  const connectOnce = async (): Promise<CesRpcClient> => {
+    const transport = await pm.start();
+    const rpc = createCesRpcClient(transport, {
+      logger: log,
+      ...options.config,
+    });
+    const { accepted, reason } = await rpc.handshake(handshake);
+    if (!accepted) {
+      rpc.close();
+      throw new Error(
+        reason ? `CES handshake rejected: ${reason}` : "CES handshake rejected",
+      );
+    }
+    return rpc;
+  };
+
+  /**
+   * Reconnect with bounded backoff after the transport dies. The live inner
+   * client is swapped in place, so consumers holding the session reference
+   * keep calling the same object.
+   */
+  const scheduleReconnect = (): void => {
+    if (stopping) {
+      return;
+    }
+    if (reconnecting) {
+      return;
+    }
+    reconnecting = true;
+
+    void (async () => {
+      log.warn("CES transport died — starting in-session reconnect loop");
+
+      for (let attempt = 0; attempt < MAX_RECONNECT_ATTEMPTS; attempt++) {
+        const delay = RECONNECT_BACKOFF_MS[attempt];
+        if (delay > 0) {
+          await sleep(delay);
+        }
+        if (stopping) {
+          reconnecting = false;
+          log.info("CES reconnect loop stopped — session is closing");
+          return;
+        }
+        try {
+          // The transport died but the pm still counts as running; reset it
+          // so start() opens a fresh socket.
+          await pm.stop().catch(() => {});
+          inner = await connectOnce();
+          reconnecting = false;
+          log.info(
+            { attempt: attempt + 1 },
+            "CES session reconnected and handshake accepted",
+          );
+          return;
+        } catch (err) {
+          log.warn(
+            {
+              attempt: attempt + 1,
+              max: MAX_RECONNECT_ATTEMPTS,
+              error: err instanceof Error ? err.message : String(err),
+            },
+            "CES session reconnection attempt did not succeed",
+          );
+        }
+      }
+
+      reconnecting = false;
+      log.info("CES reconnect loop finished — later ops reopen lazily");
+    })();
+  };
+
+  pm.onTransportClose(() => scheduleReconnect());
+
+  // Stable delegating surface: consumers keep one reference while the inner
+  // client is swapped underneath it across reconnections.
+  const session: CesSessionClient = {
+    handshake(sessionOptions) {
+      return inner
+        ? inner.handshake(sessionOptions)
+        : Promise.resolve({ accepted: false, reason: "CES session is closed" });
+    },
+    call(method, request) {
+      if (!inner) {
+        return Promise.reject(new CesClientError("CES session is closed"));
+      }
+      return inner.call(method, request);
+    },
+    updateAssistantApiKey(assistantApiKey, assistantId) {
+      if (!inner) {
+        return Promise.resolve({ updated: false });
+      }
+      return inner.updateAssistantApiKey(assistantApiKey, assistantId);
+    },
+    isReady() {
+      return inner?.isReady() ?? false;
+    },
+    close() {
+      stopping = true;
+      inner?.close();
+      inner = undefined;
+    },
+    stop() {
+      return stopInternal(false);
+    },
+    forceStop() {
+      return stopInternal(true);
+    },
+  };
+
+  try {
+    inner = await connectOnce();
+    return session;
+  } catch (err) {
+    if (err instanceof CesUnavailableError) {
+      log.info({ reason: err.message }, "CES is not available");
+    } else {
+      log.warn(
+        { error: err instanceof Error ? err.message : String(err) },
+        "Failed to open CES RPC session",
+      );
+    }
+    stopping = true;
+    inner?.close();
+    inner = undefined;
+    await pm.stop().catch(() => {});
+    return undefined;
   }
-  return client;
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
 }

package/src/daemon/lifecycle.ts

@@ -547,11 +547,7 @@ export async function runDaemon(): Promise<void> {
   applyModuleLogLevels(config.logFile?.levels);
 
   // Open the assistant's CES RPC client (handshake + reconnect wiring).
-  // Blocks up to a 20s timeout so credential reads route through CES before
-  // provider init; non-fatal, falls back to the direct credential store on
-  // failure. CES serves a multi-connection IPC socket, so child
-  // processes can open the same `openCesRpcSession` path independently.
-  await initializeCesClient(config);
+  await initializeCesClient();
 
   // Bring up the plugin layer: install the runtime bridge, register the
   // first-party defaults, load user plugins, and run every plugin's

package/src/security/ces-rpc-record-backend.ts

@@ -14,8 +14,8 @@ import { CesRpcClient as CesClient } from "@mycadet/ces-client/rpc-client";
 import type { CredentialRecord } from "@mycadet/service-contracts/credential-rpc";
 import { CesRpcMethod } from "@mycadet/service-contracts/credential-rpc";
 
-import { openCesRpcSession } from "../credential-execution/ces-connect.js";
 import type { CesSessionClient } from "../credential-execution/client.js";
+import { createCesClient } from "../credential-execution/client.js";
 import { CesUnavailableError } from "../credential-execution/process-manager.js";
 import { getLogger } from "../util/logger.js";
 
@@ -24,10 +24,19 @@ const log = getLogger("ces-rpc-record-backend");
 /** Minimum interval between CES connection attempts after a failure. */
 const LAZY_SESSION_COOLDOWN_MS = 3_000;
 
+/** How long ensureClient waits on a self-healing session before giving up. */
+const RECONNECT_WAIT_MS = 15_000;
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
 class CesRpcRecordBackend {
   /**
-   * The live IPC client, opened by this backend's first record operation and
-   * reopened on the next operation whenever the transport dies.
+   * The live IPC session, opened by this backend's first record operation.
+   * The session owns its transport and reconnection: after a CES restart the
+   * same reference becomes ready again, so this backend never re-opens or
+   * swaps clients itself.
    */
   private client: CesSessionClient | undefined;
 
@@ -48,21 +57,33 @@ class CesRpcRecordBackend {
    * surface that rather than degrading, so a lost write is never mistaken
    * for a successful one. Failed attempts are not re-attempted within the
    * cooldown window: every operation would otherwise re-pay the discovery
-   * polling while CES is down.
+   * polling while CES is down. A held session whose transport died is NOT
+   * dropped here — the session reconnects itself; we just wait for it.
    */
   async ensureClient(): Promise<CesClient> {
     if (this.client?.isReady()) {
       return this.client;
     }
-    // Stale client from a dead transport — drop it and re-open below.
-    this.client = undefined;
+    if (this.client && !this.client.isReady()) {
+      // The session is self-healing (in-session reconnect loop) — wait for
+      // it to come back rather than opening a competing session.
+      for (let waited = 0; waited < RECONNECT_WAIT_MS; waited += 250) {
+        await sleep(250);
+        if (this.client.isReady()) {
+          return this.client;
+        }
+      }
+      throw new CesUnavailableError(
+        "CES is unreachable (session reconnect did not become ready)",
+      );
+    }
     if (Date.now() - this.lastFailedAttemptAt < LAZY_SESSION_COOLDOWN_MS) {
       throw new CesUnavailableError(
         "CES is unreachable (recent connection attempt failed)",
       );
     }
     if (!this.sessionAttempt) {
-      this.sessionAttempt = openCesRpcSession()
+      this.sessionAttempt = createCesClient()
         .then((client) => {
           if (!client) {
             throw new CesUnavailableError(

package/src/credential-execution/ces-connect.test.ts

@@ -1,35 +0,0 @@
-/**
- * Tests for the shared CES RPC session helper used by assistant boot and
- * child-process credential resolution.
- */
-import { describe, expect, test } from "bun:test";
-
-import { openCesRpcSession } from "./ces-connect.js";
-
-describe("openCesRpcSession", () => {
-  test("returns undefined when discovery fails without polling", async () => {
-    const start = Date.now();
-    const client = await openCesRpcSession({
-      discover: async () => ({
-        mode: "unavailable",
-        reason: "missing test socket",
-      }),
-    });
-
-    expect(client).toBeUndefined();
-    expect(Date.now() - start).toBeLessThan(1_000);
-  });
-
-  test("returns undefined when the abort signal is already fired", async () => {
-    const abort = new AbortController();
-    abort.abort();
-    const client = await openCesRpcSession({
-      discover: async () => {
-        throw new Error("discover should not run after abort");
-      },
-      signal: abort.signal,
-    });
-
-    expect(client).toBeUndefined();
-  });
-});

package/src/credential-execution/ces-connect.ts

@@ -1,93 +0,0 @@
-/**
- * Open a CES RPC client over the shared IPC socket.
- *
- * Assistant boot and child-process credential reads use this helper. Both
- * are CES API clients: discover `ces.sock`, connect, handshake. Each opened
- * session owns its transport lifecycle through the returned client
- * (`client.stop()` / `client.forceStop()`); reconnect opens a fresh session.
- */
-
-import type { CesRpcHandshakeOptions } from "@mycadet/ces-client/rpc-client";
-
-import type { AssistantConfig } from "../config/schema.js";
-import { getLogger } from "../util/logger.js";
-import { type CesSessionClient, createCesClient } from "./client.js";
-import {
-  type CesProcessManagerConfig,
-  CesUnavailableError,
-  createCesProcessManager,
-} from "./process-manager.js";
-
-const log = getLogger("ces-connect");
-
-export interface OpenCesRpcSessionOptions {
-  handshake?: CesRpcHandshakeOptions;
-  signal?: AbortSignal;
-  assistantConfig?: AssistantConfig;
-  discover?: CesProcessManagerConfig["discover"];
-  /** Fired when the session's transport dies (the reconnect trigger). */
-  onTransportClose?: () => void;
-}
-
-/**
- * Discover the CES socket, connect, and complete the RPC handshake.
- *
- * Returns undefined when CES is missing, the handshake is rejected, the
- * abort signal fires, or the transport fails. The session's transport is
- * stopped on those paths so a later call can open a fresh session.
- */
-export async function openCesRpcSession(
-  options: OpenCesRpcSessionOptions = {},
-): Promise<CesSessionClient | undefined> {
-  const pm = createCesProcessManager({
-    assistantConfig: options.assistantConfig,
-    discover: options.discover,
-  });
-  if (options.onTransportClose) {
-    pm.onTransportClose(options.onTransportClose);
-  }
-
-  const fail = async (): Promise<undefined> => {
-    await pm.stop().catch(() => {});
-    return undefined;
-  };
-
-  if (options.signal?.aborted) {
-    return fail();
-  }
-
-  try {
-    const transport = await pm.start();
-    if (options.signal?.aborted) {
-      return fail();
-    }
-
-    const client = createCesClient(transport, undefined, {
-      stop: () => pm.stop(),
-      forceStop: () => pm.forceStop(),
-    });
-
-    const { accepted, reason } = await client.handshake(options.handshake);
-    if (options.signal?.aborted) {
-      client.close();
-      return fail();
-    }
-    if (!accepted) {
-      log.warn({ reason }, "CES handshake rejected");
-      client.close();
-      return fail();
-    }
-
-    return client;
-  } catch (err) {
-    if (err instanceof CesUnavailableError) {
-      log.info({ reason: err.message }, "CES is not available");
-    } else {
-      log.warn(
-        { error: err instanceof Error ? err.message : String(err) },
-        "Failed to open CES RPC session",
-      );
-    }
-    return fail();
-  }
-}