@phnx-labs/agents-cli 1.22.106 → 1.22.109

package/dist/lib/agent-spec/agents.js

@@ -1692,34 +1692,41 @@ async function antigravityKeychainSignedIn() {
     }
     return cachedAgyKeychainSignedIn;
 }
+/** The XDG base dirs OpenCode reads, and the env var that overrides each. */
+const OPENCODE_XDG_DIRS = {
+    data: { env: 'XDG_DATA_HOME', fallback: ['.local', 'share'] },
+    state: { env: 'XDG_STATE_HOME', fallback: ['.local', 'state'] },
+};
 /**
- * OpenCode (sst/opencode) stores provider credentials in a single JSON file at
- * `$XDG_DATA_HOME/opencode/auth.json`, defaulting to
- * `~/.local/share/opencode/auth.json` on EVERY platform — its `xdg-basedir`
- * dependency does not special-case macOS, so there is no
- * `~/Library/Application Support` variant. The path is account-global (not
- * per-version), matching how `session/discover.ts` already resolves
- * `~/.local/share/opencode/opencode.db`.
+ * Resolve one of OpenCode's (sst/opencode) XDG-rooted files.
+ *
+ * OpenCode keeps provider credentials under `$XDG_DATA_HOME/opencode/` and TUI
+ * state under `$XDG_STATE_HOME/opencode/`, defaulting to `~/.local/share` and
+ * `~/.local/state` on EVERY platform — its `xdg-basedir` dependency does not
+ * special-case macOS, so there is no `~/Library/Application Support` variant.
+ * Both roots are account-global (not per-version), matching how
+ * `session/discover.ts` already resolves `~/.local/share/opencode/opencode.db`.
  *
  * Resolution order, first existing wins:
- *   1. `<base>/.local/share/opencode/auth.json` — the passed per-version home.
- *      This is primarily a test hook (suites write a hermetic auth file under a
- *      temp home) but also covers any relocated install.
- *   2. `$XDG_DATA_HOME/opencode/auth.json` — an explicit XDG override, exactly
+ *   1. `<base>/<fallback>/opencode/<file>` — the passed per-version home. This is
+ *      primarily a test hook (suites write a hermetic file under a temp home)
+ *      but also covers any relocated install.
+ *   2. `$XDG_<KIND>_HOME/opencode/<file>` — an explicit XDG override, exactly
  *      what OpenCode itself honours.
- *   3. `<realHome>/.local/share/opencode/auth.json` — the active default, under
+ *   3. `<realHome>/<fallback>/opencode/<file>` — the active default, under
  *      `AGENTS_REAL_HOME` or `os.homedir()`, so every installed version reflects
- *      the one account-global login (same fallback shape as
+ *      the one account-global state (same fallback shape as
  *      resolveAccountCredentialPath).
  * Returns the first existing path, or null. Never throws.
  */
-function resolveOpenCodeAuthPath(base) {
-    const candidates = [path.join(base, '.local', 'share', 'opencode', 'auth.json')];
-    const xdgData = process.env.XDG_DATA_HOME;
-    if (xdgData)
-        candidates.push(path.join(xdgData, 'opencode', 'auth.json'));
+export function resolveOpenCodeXdgPath(base, kind, file) {
+    const { env, fallback } = OPENCODE_XDG_DIRS[kind];
+    const candidates = [path.join(base, ...fallback, 'opencode', file)];
+    const override = process.env[env];
+    if (override)
+        candidates.push(path.join(override, 'opencode', file));
     const realHome = process.env.AGENTS_REAL_HOME || os.homedir();
-    candidates.push(path.join(realHome, '.local', 'share', 'opencode', 'auth.json'));
+    candidates.push(path.join(realHome, ...fallback, 'opencode', file));
     for (const candidate of candidates) {
         try {
             if (fs.existsSync(candidate))
@@ -1729,6 +1736,9 @@ function resolveOpenCodeAuthPath(base) {
     }
     return null;
 }
+function resolveOpenCodeAuthPath(base) {
+    return resolveOpenCodeXdgPath(base, 'data', 'auth.json');
+}
 /**
  * Validate one OpenCode auth.json entry against its discriminated union
  * (`type: 'oauth' | 'api' | 'wellknown'`) and confirm the credential actually
@@ -1751,25 +1761,58 @@ function isValidOpenCodeCredential(value) {
     }
 }
 /**
- * OpenCode's account identity: the sorted, "+"-joined list of provider ids
- * that hold a valid credential in `auth.json` (e.g. `"anthropic+muse-spark"`).
- * `auth.json` carries no email/identity claim (see `isValidOpenCodeCredential`),
- * so this join is the closest thing to "which account is this" available — the
- * same value `agents view`/`agents doctor` show for OpenCode's signed-in state.
+ * The human identity an OpenCode `type: 'oauth'` credential carries in its
+ * access token, when that token is a JWT. Provider-agnostic by shape: the
+ * OpenAI-issued token OpenCode stores under its `openai` provider carries the
+ * same namespaced claims Codex's own `auth.json` does (`…/profile.email`,
+ * `…/auth.chatgpt_plan_type`), so the extraction is shared with `case 'codex'`
+ * rather than reinvented. A plain `email` claim is accepted too, for providers
+ * that issue an ordinary OIDC token.
+ *
+ * Only claims are read — the token itself is never returned or logged. A
+ * non-JWT credential (Anthropic's `sk-ant-oat…` opaque token, any `type: 'api'`
+ * key) simply yields nothing.
+ */
+function openCodeOauthIdentity(cred) {
+    const access = cred?.access;
+    if (typeof access !== 'string' || access.length === 0)
+        return { email: null, plan: null };
+    const claims = decodeJwtPayload(access);
+    if (!claims)
+        return { email: null, plan: null };
+    const profile = claims['https://api.openai.com/profile'] || {};
+    const auth = claims['https://api.openai.com/auth'] || {};
+    const rawEmail = profile.email ?? claims.email;
+    const email = typeof rawEmail === 'string' && rawEmail.includes('@') ? rawEmail : null;
+    const rawPlan = auth.chatgpt_plan_type;
+    const plan = typeof rawPlan === 'string' && rawPlan
+        ? rawPlan.charAt(0).toUpperCase() + rawPlan.slice(1)
+        : null;
+    return { email, plan };
+}
+/**
+ * OpenCode's account identity, read from `auth.json`.
+ *
+ * The provider join (`"meta+openai+opencode-go"`) is the stable key: OpenCode is
+ * a multi-provider harness, so "which providers are configured" is what actually
+ * identifies an install, and `session/discover.ts` indexes sessions by it.
+ * Providers that sign in over OAuth additionally hand OpenCode a token with real
+ * identity claims, so the email and plan are surfaced alongside it instead of
+ * leaving `agents view` showing a bare `id:` key for a login that knows exactly
+ * whose it is. Providers are walked in sorted order so a multi-OAuth install
+ * resolves to the same email on every machine.
  *
  * This is the ONLY correct source for an OpenCode "account". OpenCode's SQLite
  * `opencode.db` also carries `account`/`account_state`/`control_account` tables,
  * but on a real, actively-used install (yosemite-s1, 1.16.0, 35 applied
  * migrations) all three are permanently empty — no migration ever populates
  * them, and no session has ever written a row. Reading from them instead of
- * `auth.json` always yields `undefined`, credential or not; `session/discover.ts`
- * uses this function rather than duplicating a sqlite lookup against those
- * dead tables.
+ * `auth.json` always yields `undefined`, credential or not.
  *
  * Sync (`fs.readFileSync`), no network. Returns undefined when `auth.json` is
  * missing, unreadable, or carries no valid credential.
  */
-export function resolveOpenCodeAccountId(base) {
+export function resolveOpenCodeIdentity(base) {
     const authPath = resolveOpenCodeAuthPath(base);
     if (!authPath)
         return undefined;
@@ -1777,16 +1820,34 @@ export function resolveOpenCodeAccountId(base) {
         const data = JSON.parse(fs.readFileSync(authPath, 'utf-8'));
         if (!data || typeof data !== 'object')
             return undefined;
-        const providers = Object.entries(data)
+        const valid = Object.entries(data)
             .filter(([, cred]) => isValidOpenCodeCredential(cred))
-            .map(([id]) => id)
-            .sort();
-        return providers.length ? providers.join('+') : undefined;
+            .sort(([a], [b]) => a.localeCompare(b));
+        if (valid.length === 0)
+            return undefined;
+        let email = null;
+        let plan = null;
+        for (const [, cred] of valid) {
+            const claimed = openCodeOauthIdentity(cred);
+            email ??= claimed.email;
+            plan ??= claimed.plan;
+            if (email && plan)
+                break;
+        }
+        return { providers: valid.map(([id]) => id).join('+'), email, plan };
     }
     catch {
         return undefined;
     }
 }
+/**
+ * The provider join alone — the value `session/discover.ts` indexes sessions by,
+ * kept as its own entry point so callers that only need the key do not have to
+ * know about the OAuth claim walk.
+ */
+export function resolveOpenCodeAccountId(base) {
+    return resolveOpenCodeIdentity(base)?.providers;
+}
 /**
  * Whether a Muse Code `~/.config/muse/auth.json` document holds any usable
  * access token. Live shape from `muse login` (device OAuth, Muse Code 0.1.0):
@@ -1972,6 +2033,11 @@ export async function getAccountInfo(agentId, home) {
         claude: path.join(base, '.claude.json'),
         codex: path.join(base, '.codex', 'auth.json'),
         gemini: path.join(base, '.gemini', 'google_accounts.json'),
+        // OpenCode keeps every session in ONE sqlite file rather than a directory of
+        // per-session transcripts, so the session-file walk resolveLastActive runs
+        // for other agents finds nothing. Its mtime fallback is the right read here:
+        // opencode.db is written on every turn, so it tracks real activity.
+        opencode: resolveOpenCodeXdgPath(base, 'data', 'opencode.db') ?? undefined,
     };
     const lastActive = resolveLastActive(agentId, base, configFiles[agentId]);
     try {
@@ -2238,20 +2304,27 @@ export async function getAccountInfo(agentId, home) {
             }
             case 'opencode': {
                 // OpenCode's auth.json is a record keyed by provider id ->
-                // { type: 'oauth'|'api'|'wellknown', ...secret fields }. There is no
-                // email/identity claim to surface, so — like antigravity/kimi — we
-                // report signed-in state plus the NON-SECRET provider metadata (which
-                // provider ids hold a valid credential) and never read the tokens/keys
-                // themselves. The user's complaint was the row read "not signed in"
-                // despite a live login; a valid provider entry now shows e.g.
-                // "id:muse-spark" so they can see exactly which provider is configured.
-                // resolveOpenCodeAccountId is the single source of truth for this join —
-                // session/discover.ts reuses it for the indexed `account` field.
-                const accountId = resolveOpenCodeAccountId(base);
-                if (!accountId)
+                // { type: 'oauth'|'api'|'wellknown', ...secret fields }. The provider
+                // join is the identity key (see resolveOpenCodeIdentity), and an OAuth
+                // provider's token additionally carries the real account email and plan
+                // — so the row shows who is signed in rather than only a bare `id:` key.
+                // Secrets are never read out; only JWT claims are.
+                const identity = resolveOpenCodeIdentity(base);
+                if (!identity)
                     return { ...empty, lastActive };
-                const accountKey = buildIdentityKey(agentId, [['providers', accountId]]);
-                return { ...empty, signedIn: true, accountId, accountKey, lastActive };
+                // Keyed on providers, not email: OpenCode bills through whichever
+                // provider credentials are configured, so two installs sharing one
+                // email but different provider sets are genuinely different accounts.
+                const accountKey = buildIdentityKey(agentId, [['providers', identity.providers]]);
+                return {
+                    ...empty,
+                    signedIn: true,
+                    accountId: identity.providers,
+                    accountKey,
+                    email: identity.email,
+                    plan: identity.plan,
+                    lastActive,
+                };
             }
             case 'muse': {
                 // Muse Code authenticates with META_API_KEY (env, highest priority) or

package/dist/lib/daemon/daemon.d.ts

@@ -11,6 +11,17 @@ import { getAgentsBinPath } from '../cli-entry.js';
 import type { ServiceHealth } from './service.js';
 /** Health for every service currently registered on the live supervisor, or `null` if the daemon isn't running in this process. */
 export declare function getServiceSupervisorHealth(): Record<string, ServiceHealth> | null;
+/**
+ * The service-manager identifiers of the REAL install's daemon — never
+ * namespaced. A caller under a redirected HOME (a test/e2e harness) uses these
+ * to recognize the box's production daemon as owned, where
+ * `daemonSystemdUnitName()`/`daemonServiceLabel()` would name only its own
+ * sandbox job (W4, PHNX-3736).
+ */
+export declare function productionDaemonServiceNames(): {
+    systemdUnit: string;
+    launchdLabel: string;
+};
 /**
  * RUSH-2639 (residual): launchd/systemd route `unload`/`load`/`list` by the
  * service identifier ALONE, never by the plist/unit file's path. Baking the
@@ -96,7 +107,7 @@ export declare function singleShot(fn: () => Promise<void>): () => Promise<void>
  */
 export declare function getDaemonLogPath(): string;
 /** Read the stored daemon PID from disk. Returns null if not present or invalid. */
-export declare function readDaemonPid(): number | null;
+export declare function readDaemonPid(daemonDir?: string): number | null;
 /** Write the daemon PID to the pid file. */
 export declare function writeDaemonPid(pid: number): void;
 /** Remove the daemon PID file. */
@@ -286,6 +297,28 @@ export declare function generateLaunchdPlist(agentsBin?: string): string;
  */
 export declare function generateSystemdUnit(agentsBin?: string): string;
 export { getAgentsBinPath };
+/**
+ * Ask the service manager for the daemon's live PID. Used as a fallback when
+ * the daemon hasn't yet written its pid file but launchd/systemd already report
+ * it running — so a start never has to surface a null PID for a daemon that is
+ * in fact up. Returns null when the service isn't running or the query fails.
+ *
+ * `names` defaults to THIS process's (possibly sandbox-namespaced) job; a
+ * caller under a redirected HOME passes `productionDaemonServiceNames()` to
+ * ask after the real install's unit instead. Read-only either way.
+ */
+export declare function readServiceManagerPid(platform?: NodeJS.Platform, names?: {
+    systemdUnit: string;
+    launchdLabel: string;
+}): number | null;
+/**
+ * Thrown when a daemon LAUNCH is attempted under a redirected HOME without the
+ * explicit test opt-in (W4, PHNX-3736). `bootstrap.ts` prints the message
+ * without a stack — this is user-actionable, not an engineering bug.
+ */
+export declare class RedirectedHomeDaemonError extends Error {
+    name: string;
+}
 /** Start the daemon via launchd, systemd, or as a detached process. */
 export declare function startDaemon(agentsBin?: string): {
     pid: number | null;

package/dist/lib/daemon/daemon.js

@@ -77,6 +77,16 @@ const LOG_MAX_SIZE = 5 * 1024 * 1024; // 5 MB
 const LOG_ROTATE_COUNT = 3;
 const PLIST_NAME = 'com.phnx-labs.agents-daemon';
 const SYSTEMD_UNIT = 'agents-daemon.service';
+/**
+ * The service-manager identifiers of the REAL install's daemon — never
+ * namespaced. A caller under a redirected HOME (a test/e2e harness) uses these
+ * to recognize the box's production daemon as owned, where
+ * `daemonSystemdUnitName()`/`daemonServiceLabel()` would name only its own
+ * sandbox job (W4, PHNX-3736).
+ */
+export function productionDaemonServiceNames() {
+    return { systemdUnit: SYSTEMD_UNIT, launchdLabel: PLIST_NAME };
+}
 /**
  * RUSH-2639 (residual): launchd/systemd route `unload`/`load`/`list` by the
  * service identifier ALONE, never by the plist/unit file's path. Baking the
@@ -286,8 +296,8 @@ function getSystemdUnitPath() {
     return path.join(os.homedir(), '.config', 'systemd', 'user', daemonSystemdUnitName());
 }
 /** Read the stored daemon PID from disk. Returns null if not present or invalid. */
-export function readDaemonPid() {
-    const pidPath = getPidPath();
+export function readDaemonPid(daemonDir) {
+    const pidPath = daemonDir ? path.join(daemonDir, PID_FILE) : getPidPath();
     if (!fs.existsSync(pidPath))
         return null;
     try {
@@ -1655,19 +1665,27 @@ export { getAgentsBinPath };
  * the daemon hasn't yet written its pid file but launchd/systemd already report
  * it running — so a start never has to surface a null PID for a daemon that is
  * in fact up. Returns null when the service isn't running or the query fails.
+ *
+ * `names` defaults to THIS process's (possibly sandbox-namespaced) job; a
+ * caller under a redirected HOME passes `productionDaemonServiceNames()` to
+ * ask after the real install's unit instead. Read-only either way.
  */
-function readServiceManagerPid(platform = os.platform()) {
-    const reg = serviceManagerRegistrationAllowed();
-    if (!reg.allowed)
+export function readServiceManagerPid(platform = os.platform(), names) {
+    const resolved = names ?? { systemdUnit: daemonSystemdUnitName(), launchdLabel: daemonServiceLabel() };
+    // The registration gate exists because a sandboxed process must not REGISTER
+    // or tear down jobs in the real per-user service manager. Asking after an
+    // explicitly named job is read-only — in particular the production unit from
+    // a redirected-HOME caller (W4) — and mutates nothing, so it is let through.
+    if (names === undefined && !serviceManagerRegistrationAllowed().allowed)
         return null;
     try {
         if (platform === 'linux') {
-            const out = execFileSync('systemctl', ['--user', 'show', '-p', 'MainPID', '--value', daemonSystemdUnitName()], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+            const out = execFileSync('systemctl', ['--user', 'show', '-p', 'MainPID', '--value', resolved.systemdUnit], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
             const pid = parseInt(out, 10);
             return !isNaN(pid) && pid > 0 ? pid : null;
         }
         if (platform === 'darwin') {
-            const out = execFileSync('launchctl', ['list', daemonServiceLabel()], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
+            const out = execFileSync('launchctl', ['list', resolved.launchdLabel], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
             const m = out.match(/"PID"\s*=\s*(\d+)/);
             if (m) {
                 const pid = parseInt(m[1], 10);
@@ -1678,12 +1696,47 @@ function readServiceManagerPid(platform = os.platform()) {
     catch { /* not running / manager unavailable */ }
     return null;
 }
+/**
+ * Thrown when a daemon LAUNCH is attempted under a redirected HOME without the
+ * explicit test opt-in (W4, PHNX-3736). `bootstrap.ts` prints the message
+ * without a stack — this is user-actionable, not an engineering bug.
+ */
+export class RedirectedHomeDaemonError extends Error {
+    name = 'RedirectedHomeDaemonError';
+}
+/**
+ * W4 (PHNX-3736): never LAUNCH a daemon under a redirected (sandbox/test) HOME
+ * without an explicit opt-in. A daemon started there keeps its own pid file
+ * under the temp home, so the real install's pid-file takeover can never see
+ * it — the leaked `HOME=/tmp/pin-e2e-<pid>` daemon that ran 4+ days on
+ * yosemite-s1 was launched exactly this way by a headless e2e session that
+ * never cleaned up. RUSH-3021 closed this for `ensureDaemonStarted`'s
+ * AUTO-start path but left the explicit `startDaemon()` open, which is the
+ * path the e2e harness took.
+ *
+ * Placed after the `already-running` early-return: reporting a live daemon (so
+ * `daemon stop` can still kill a leaked one) must stay possible under any
+ * HOME. `AGENTS_ALLOW_TEST_DAEMON=1` is the deliberate test/e2e seam — a
+ * harness that sets it owns stopping what it starts.
+ */
+function assertDaemonLaunchHomeAllowed() {
+    const suffix = isolatedHomeSuffix();
+    if (!suffix)
+        return;
+    if (process.env.AGENTS_ALLOW_TEST_DAEMON === '1')
+        return;
+    throw new RedirectedHomeDaemonError(`refusing to start the daemon under a redirected HOME (sandbox-${suffix}): ` +
+        `a daemon launched here keeps its own pid file under ${process.env.HOME}, invisible to the real ` +
+        `install's pid-file takeover, and outlives whatever launched it (PHNX-3736). ` +
+        `For a deliberate test/e2e launch set AGENTS_ALLOW_TEST_DAEMON=1 — and stop the daemon when done.`);
+}
 /** Start the daemon via launchd, systemd, or as a detached process. */
 export function startDaemon(agentsBin) {
     if (isDaemonRunning()) {
         const pid = readDaemonPid();
         return { pid, method: 'already-running' };
     }
+    assertDaemonLaunchHomeAllowed();
     const releaseLock = acquireStartLock();
     if (!releaseLock) {
         // Another process is already starting the daemon
@@ -1769,8 +1822,9 @@ export function ensureDaemonStarted() {
     // recursive teardown rm (ENOTEMPTY). Placed after the already-running branch
     // — reporting a live daemon stays allowed, same as the circuit breaker.
     // AGENTS_SERVICE_MANAGER_ALLOW_REDIRECTED_HOME=1 is the test seam for suites
-    // that exercise daemon startup deliberately; `agents daemon start` remains
-    // the operator override.
+    // that exercise daemon startup deliberately. The explicit `agents daemon
+    // start` path is gated separately by startDaemon's own redirected-HOME
+    // refusal (AGENTS_ALLOW_TEST_DAEMON=1, W4/PHNX-3736).
     if (!serviceManagerRegistrationAllowed().allowed)
         return null;
     // RUSH-2418: the auto-start circuit breaker. A daemon that dies during

package/dist/lib/daemon/leaked-daemons.d.ts

@@ -0,0 +1,60 @@
+/**
+ * The daemon state dir for an ARBITRARY home — the same layout state.ts's
+ * DAEMON_DIR chain produces (`<home>/.agents/.cache/helpers/daemon`). A caller
+ * under a redirected HOME (a test/e2e harness) uses this to find the REAL
+ * install's daemon records. Kept here rather than exported from state.ts: any
+ * edit to state.ts selects its entire static-import closure into the required
+ * impact gate (186 files, 295s against the 240s budget, measured on this
+ * change's first CI run), so the helper cannot live there without a
+ * budget-policy change. If state.ts's layout ever moves, this must move with
+ * it — the two are the same address.
+ */
+export declare function getDaemonDirForHome(home: string): string;
+/** One live `__daemon-run` process from the box-wide `ps` scan. */
+export interface DaemonRunProcess {
+    pid: number;
+    /** Owning uid from `ps`, or null when unavailable. */
+    uid: number | null;
+    /** Whitespace-tokenized argv (`ps` renders it unquoted). */
+    tokens: string[];
+}
+/**
+ * Every live `__daemon-run` process on this box, regardless of which install
+ * launched it or which state dir it serves. POSIX-only (uses `ps`); a no-op on
+ * Windows.
+ *
+ * `getDaemonLaunch` always spawns `<node> <entry> __daemon-run` with nothing
+ * after it — the ONLY argv `__daemon-run` ever appears in for a real daemon.
+ * A substring/regex test anywhere in the full command line is not enough: an
+ * `agents run claude "<prompt>"` invocation whose prompt happens to quote the
+ * literal text `__daemon-run` (this ticket's own brief does) matches that test
+ * too, and was observed producing false "duplicate daemon" rows. Requiring it
+ * to be the LAST whitespace-delimited token is the actual invariant.
+ *
+ * This raw box-wide scan is deliberately NOT the duplicate-detection scope
+ * (RUSH-2368): a `__daemon-run` under a different HOME serves a different
+ * `getDaemonDir()` and is not a duplicate of THIS device's daemon, however
+ * `ps` sees it — a leaked vitest fixture under its own `/tmp` HOME matched
+ * this scan and was reported as a stray to `kill`. Callers attach their own
+ * scope: `agents daemon status` gates on the instance registry,
+ * {@link findLeakedDaemons} on the owner records above.
+ */
+export declare function listDaemonRunProcesses(): DaemonRunProcess[];
+/** A `__daemon-run` process no owner record names. */
+export interface LeakedDaemon {
+    pid: number;
+    /** The HOME the process runs under, or null when it cannot be read. */
+    home: string | null;
+    /** The process's start time as `ps lstart` renders it, or null when unavailable. */
+    startedAt: string | null;
+    /** The launch entry (the argv token before `__daemon-run`), best-effort. */
+    entry: string | null;
+}
+/**
+ * Every `__daemon-run` process running as THIS uid that no owner record names:
+ * neither the service manager's unit main PID nor the recorded
+ * `<daemonDir>/daemon.pid`. Each result carries the process's HOME and start
+ * time so the report can show them. An empty list means no leak — including
+ * the common stopped-daemon case, where there is simply nothing running.
+ */
+export declare function findLeakedDaemons(): LeakedDaemon[];

package/dist/lib/daemon/leaked-daemons.js

@@ -0,0 +1,180 @@
+/**
+ * Leaked-daemon detection (W4, PHNX-3736).
+ *
+ * One daemon per device is the contract: the always-on process behind
+ * `agents __daemon-run` is either the service manager's unit main PID or the
+ * pid recorded in `<daemonDir>/daemon.pid`. Anything else running
+ * `__daemon-run` as this uid is a LEAK — a daemon nothing owns.
+ *
+ * The motivating incident ran 4+ days on yosemite-s1: a headless e2e session
+ * launched a daemon under `HOME=/tmp/pin-e2e-<pid>` and never stopped it. The
+ * pid-file takeover in `daemon.ts` could not see it because it keeps its own
+ * pid file under the temp home, and `agents daemon status`'s duplicate scope
+ * (`findSurvivingStateDirDaemons`, RUSH-2368) deliberately covers only this
+ * install's state dir — so the leak was invisible to every existing surface.
+ *
+ * Why flagging a different-HOME daemon here is not the RUSH-2368 harm: that
+ * incident taught that a `__daemon-run` under another HOME is not a DUPLICATE
+ * of this device's daemon and must never be told to `kill` from the duplicate
+ * path. This module does not accuse it of being a duplicate — it reports that
+ * NO owner record (unit main PID, recorded daemon.pid) names the pid at all,
+ * and shows the process's own HOME and start time so the operator can judge
+ * before acting. A different uid is never named: we cannot inspect its
+ * environment or signal it.
+ */
+import { execFileSync } from 'child_process';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { productionDaemonServiceNames, readDaemonPid, readServiceManagerPid } from './daemon.js';
+import { getDaemonDir } from '../state.js';
+/**
+ * The daemon state dir for an ARBITRARY home — the same layout state.ts's
+ * DAEMON_DIR chain produces (`<home>/.agents/.cache/helpers/daemon`). A caller
+ * under a redirected HOME (a test/e2e harness) uses this to find the REAL
+ * install's daemon records. Kept here rather than exported from state.ts: any
+ * edit to state.ts selects its entire static-import closure into the required
+ * impact gate (186 files, 295s against the 240s budget, measured on this
+ * change's first CI run), so the helper cannot live there without a
+ * budget-policy change. If state.ts's layout ever moves, this must move with
+ * it — the two are the same address.
+ */
+export function getDaemonDirForHome(home) {
+    return path.join(home, '.agents', '.cache', 'helpers', 'daemon');
+}
+/**
+ * Every live `__daemon-run` process on this box, regardless of which install
+ * launched it or which state dir it serves. POSIX-only (uses `ps`); a no-op on
+ * Windows.
+ *
+ * `getDaemonLaunch` always spawns `<node> <entry> __daemon-run` with nothing
+ * after it — the ONLY argv `__daemon-run` ever appears in for a real daemon.
+ * A substring/regex test anywhere in the full command line is not enough: an
+ * `agents run claude "<prompt>"` invocation whose prompt happens to quote the
+ * literal text `__daemon-run` (this ticket's own brief does) matches that test
+ * too, and was observed producing false "duplicate daemon" rows. Requiring it
+ * to be the LAST whitespace-delimited token is the actual invariant.
+ *
+ * This raw box-wide scan is deliberately NOT the duplicate-detection scope
+ * (RUSH-2368): a `__daemon-run` under a different HOME serves a different
+ * `getDaemonDir()` and is not a duplicate of THIS device's daemon, however
+ * `ps` sees it — a leaked vitest fixture under its own `/tmp` HOME matched
+ * this scan and was reported as a stray to `kill`. Callers attach their own
+ * scope: `agents daemon status` gates on the instance registry,
+ * {@link findLeakedDaemons} on the owner records above.
+ */
+export function listDaemonRunProcesses() {
+    if (process.platform === 'win32')
+        return [];
+    let out;
+    try {
+        out = execFileSync('ps', ['-eo', 'pid=,uid=,args='], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
+    }
+    catch {
+        return [];
+    }
+    const found = [];
+    for (const line of out.split('\n')) {
+        const m = line.trim().match(/^(\d+)\s+(\d+)\s+(.*)$/);
+        if (!m)
+            continue;
+        const tokens = m[3].trim().split(/\s+/);
+        if (tokens.length === 0 || tokens[tokens.length - 1] !== '__daemon-run')
+            continue;
+        const pid = parseInt(m[1], 10);
+        if (isNaN(pid))
+            continue;
+        const uidParsed = parseInt(m[2], 10);
+        found.push({ pid, uid: isNaN(uidParsed) ? null : uidParsed, tokens });
+    }
+    return found;
+}
+/**
+ * The HOME of a live process, or null when unreadable. Linux reads
+ * `/proc/<pid>/environ`; macOS has no equivalent zero-dependency primitive, so
+ * it falls back to `ps -E`, which appends the environment to the command
+ * column. Both are best-effort: a null HOME must never turn into an accusation
+ * beyond "unknown".
+ */
+function processHome(pid) {
+    if (process.platform === 'linux') {
+        try {
+            const env = fs.readFileSync(`/proc/${pid}/environ`, 'utf-8');
+            for (const entry of env.split('\0')) {
+                if (entry.startsWith('HOME='))
+                    return entry.slice('HOME='.length) || null;
+            }
+            return null;
+        }
+        catch {
+            return null;
+        }
+    }
+    try {
+        const out = execFileSync('ps', ['-E', '-o', 'command=', '-p', String(pid)], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
+        const m = out.match(/(?:^|\s)HOME=(\S+)/);
+        return m ? m[1] : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The start time of a live process as `ps lstart` renders it, or null (best-effort, POSIX only). */
+function processStartTime(pid) {
+    if (process.platform === 'win32')
+        return null;
+    try {
+        const out = execFileSync('ps', ['-o', 'lstart=', '-p', String(pid)], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+        return out || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Every `__daemon-run` process running as THIS uid that no owner record names:
+ * neither the service manager's unit main PID nor the recorded
+ * `<daemonDir>/daemon.pid`. Each result carries the process's HOME and start
+ * time so the report can show them. An empty list means no leak — including
+ * the common stopped-daemon case, where there is simply nothing running.
+ */
+export function findLeakedDaemons() {
+    const owned = new Set();
+    const recorded = readDaemonPid();
+    if (recorded)
+        owned.add(recorded);
+    const unitPid = readServiceManagerPid();
+    if (unitPid)
+        owned.add(unitPid);
+    // A caller under a redirected HOME (a test/e2e harness) must still recognize
+    // the REAL install's daemon as owned: its records live under the account
+    // home (`os.userInfo().homedir` reads the passwd record, ignoring $HOME),
+    // not under this process's HOME. Flagging the box's healthy production
+    // daemon as a leak would be the RUSH-2368 harm through a new door.
+    const realDaemonDir = getDaemonDirForHome(os.userInfo().homedir);
+    if (realDaemonDir !== getDaemonDir()) {
+        const realRecorded = readDaemonPid(realDaemonDir);
+        if (realRecorded)
+            owned.add(realRecorded);
+        const realUnitPid = readServiceManagerPid(os.platform(), productionDaemonServiceNames());
+        if (realUnitPid)
+            owned.add(realUnitPid);
+    }
+    const myUid = typeof process.getuid === 'function' ? process.getuid() : null;
+    const leaked = [];
+    for (const p of listDaemonRunProcesses()) {
+        if (owned.has(p.pid))
+            continue;
+        // Another uid's daemon is never named: we cannot read its environment
+        // reliably and could not signal it if we tried.
+        if (myUid !== null && p.uid !== null && p.uid !== myUid)
+            continue;
+        leaked.push({
+            pid: p.pid,
+            home: processHome(p.pid),
+            startedAt: processStartTime(p.pid),
+            entry: p.tokens.length >= 2 ? p.tokens[p.tokens.length - 2] : null,
+        });
+    }
+    return leaked;
+}