@phnx-labs/agents-cli 1.22.117 → 1.22.118

package/dist/lib/claude-statusline.js

@@ -9,6 +9,7 @@ import { mergeClaudeUsageCacheWindows } from './accounting/usage.js';
 import { loadReminders, pickReminderForSession } from './reminders.js';
 import { readMeta } from './state.js';
 import { machineId } from './machine-id.js';
+import { recordRunAuthOutcome } from './auth-health.js';
 export const CLAUDE_STATUSLINE_COMMAND = 'agents __claude-statusline';
 const DELEGATE_FILE = path.join('.agents', 'claude-statusline-delegate');
 // The private subcommand this feature runs. It is only ever invoked internally,
@@ -64,7 +65,7 @@ function windowFromNative(key, value) {
         windowMinutes: key === 'session' ? 300 : 10_080,
     };
 }
-export function ingestClaudeStatusLineUsage(payload, identity) {
+export function ingestClaudeStatusLineUsage(payload, identity, versionHome) {
     if (!identity?.usageKey || !payload.rate_limits)
         return false;
     const windows = [
@@ -80,8 +81,19 @@ export function ingestClaudeStatusLineUsage(payload, identity) {
         windows,
         freshness: { source: 'statusline', poller: machineId() },
     });
+    // A status-line payload with rate_limits IS a real inference response — the
+    // token authenticated moments ago. Record that as the per-account auth FACT
+    // (`last used ok`), keyed to the account this box actually ran (PHNX-4116).
+    recordRunAuthOutcome({
+        agent: 'claude',
+        accountId: resolveNativeAccount(identity)?.id ?? null,
+        home: versionHome ?? null,
+        outcome: { ok: true },
+    });
+    // Keep this box's own state file current so the next placement probe or
+    // usage-sync fan-out carries this reading; the file is local, no transport.
     void import('./accounting/usage-sync.js')
-        .then((mod) => mod.pushUsageSnapshotNow())
+        .then((mod) => mod.publishUsageSnapshotToSharedStore())
         .catch(() => { });
     return true;
 }
@@ -211,7 +223,7 @@ export async function runClaudeStatusLine() {
     const versionHome = versionHomeFromEnv(process.env);
     const identity = readClaudeIdentity(claudeHomeFromEnv(process.env));
     if (versionHome)
-        ingestClaudeStatusLineUsage(payload, identity);
+        ingestClaudeStatusLineUsage(payload, identity, versionHome);
     process.stdout.write(renderClaudeStatusLine(payload, undefined, versionHome ? renderDelegate(raw, versionHome) : '', resolveReminderPart(payload.session_id), formatAccountPart(identity, resolveNativeAccount(identity))));
     return 0;
 }

package/dist/lib/commands.js

@@ -571,7 +571,7 @@ function commandContentMatches(agentId, commandName, sourcePath) {
  * Get the project-scoped commands directory for an agent.
  * Claude: .claude/commands/
  * Codex: .codex/prompts/
- * Gemini: .gemini/commands/
+ * Cursor: .cursor/commands/
  */
 function getProjectCommandsDirs(agentId, cwd = process.cwd()) {
     const agent = AGENTS[agentId];

package/dist/lib/crabbox/lease.js

@@ -145,7 +145,7 @@ export function buildBootstrapScript(opts) {
     // Runs regardless of --keep-box (it's in the box body, not teardown), so a kept
     // box still loses the token after the run — minimizing the credential window.
     const shredPaths = credentialRuntimes.flatMap((id) => {
-        const paths = { claude: ['.claude.json', CLAUDE_TOKEN_REMOTE], codex: ['.codex/auth.json'], gemini: ['.gemini/google_accounts.json'], grok: ['.grok/auth.json'] }[id];
+        const paths = { claude: ['.claude.json', CLAUDE_TOKEN_REMOTE], codex: ['.codex/auth.json'], grok: ['.grok/auth.json'] }[id];
         return paths ?? [];
     });
     if (opts.dispatchProfile)

package/dist/lib/crabbox/runtimes.js

@@ -22,13 +22,12 @@ import { listInstalledVersions, getVersionHomePath } from '../installations/vers
 export const LEASE_RUNTIMES = [
     { id: 'claude', label: 'Claude Code', localCandidates: ['.claude/.claude.json', '.claude.json'], remote: '.claude.json' },
     { id: 'codex', label: 'Codex CLI', localCandidates: ['.codex/auth.json'], remote: '.codex/auth.json' },
-    { id: 'gemini', label: 'Gemini CLI', localCandidates: ['.gemini/google_accounts.json'], remote: '.gemini/google_accounts.json' },
     { id: 'grok', label: 'Grok CLI', localCandidates: ['.grok/auth.json'], remote: '.grok/auth.json' },
 ];
 /**
  * Every runtime whose login this module can serialize (`LEASE_RUNTIMES`) is a
  * native, rotating OAuth / session credential (Claude OAuth token, codex/grok
- * `auth.json`, gemini `google_accounts.json`). The fleet-auth contract forbids
+ * `auth.json`). The fleet-auth contract forbids
  * copying any of them between devices — including to an ephemeral leased box —
  * because a shared refresh token rotates server-side on the next refresh and
  * invalidates every other copy (`docs/specifications.md` SING-1b,
@@ -142,7 +141,6 @@ const PROFILE_AUTH_ENV_KEYS_BY_RUNTIME = {
         'ANTHROPIC_FOUNDRY_API_KEY',
     ],
     codex: ['OPENAI_API_KEY'],
-    gemini: ['GEMINI_API_KEY', 'GOOGLE_API_KEY'],
     grok: ['XAI_API_KEY', 'GROK_API_KEY'],
 };
 /** True when a profile already carries auth for its host runtime via env. */

package/dist/lib/daemon/account-state-daemon-service.js

@@ -175,6 +175,7 @@ function verdictRank(verdict) {
         case 'rate_limited': return 5;
         case 'live': return 4;
         case 'unverified': return 3;
+        case 'no_evidence': return 3;
         case 'error': return 2;
         case 'unconfigured': return 1;
     }

package/dist/lib/daemon/auth-sync-service.d.ts

@@ -3,25 +3,28 @@
  *
  * This tick owns only the NON-git duties of auth sync: it materializes worker
  * slots from durable keys already on the box, then (on the elected headed
- * publisher) provisions peers whose LAST-DELIVERED verdict says `missing` by
- * pushing the credential over SSH. The secret never enters Git.
+ * publisher) provisions peers missing a reserved key by pushing the credential
+ * over SSH. The secret never enters Git.
  *
- * It no longer runs its own `syncFleetSharedStateRepo` (PHNX-4051). The verdict
- * this tick's decisions read is published and delivered by the single git
- * committer, the usage-sync tick — folding both publishes into one caller is
- * what stops the two ticks (30 s apart) from contending for the one shared-repo
- * lock and starving the usage snapshot workers depend on. This tick keeps its
- * own deadline and circuit breaker, so a hung peer SSH push parks only auth-sync
- * and never the usage delivery. The pushes read the peer verdicts the last
- * usage-sync exchange wrote into the local checkout; they are idempotent
- * (push only when a peer is missing a key), so acting on at-most-one-tick-old
- * data converges exactly as the in-tick exchange did. To keep "at-most-one-tick-
- * old" true, the pushes are gated on the exchange's freshness marker
- * (`readLastSuccessfulExchangeMs`): when the last usage-sync exchange is missing
- * or older than one usage-sync tick interval (`USAGE_SYNC_TICK_MS`, the
- * producer's cadence — not this service's own `AUTH_SYNC_TICK_MS`), this tick
- * skips the pushes and WARNs instead of acting on peer state that may no longer
- * hold.
+ * It runs no transport of its own (PHNX-4051): the per-account readiness
+ * verdicts it reads are published and delivered by the usage-sync tick's SSH
+ * exchange, which stores each peer's reply at `devices/<peer>/daemon-state.json`
+ * stamped `receivedAt`. This tick keeps its own deadline and circuit breaker, so
+ * a hung peer SSH push parks only auth-sync and never the usage delivery.
+ *
+ * The pushes read each peer's OWN reply file (PHNX-4116 PR 5): a peer reporting
+ * a `missing` verdict for an account is pushed that account's key; a peer that
+ * has never sent a reply (no file), or whose reply carries no `accounts.rows`
+ * field (an older CLI — fail closed), is skipped this tick and logged at INFO.
+ * Presence is also gated on a delivered-fingerprint match, so a re-mint
+ * (`accounts login` bumps `workerCredential.mintedAt` while the old token still
+ * authenticates) re-pushes the rotated key within a tick instead of reading
+ * `present` forever. The push is idempotent, so a stale reply is harmless — a
+ * stale "has key" is fine, a stale "missing key" costs one redundant push —
+ * which is why the per-peer `receivedAt` replaced the old global freshness gate
+ * (`readLastSuccessfulExchangeMs`) that skipped EVERY push when the newest
+ * exchange across the fleet went stale. The reply file is first-hand and
+ * timestamped, so acting on it needs no such fleet-wide gate.
  */
 import { BasePeriodicService, type DaemonContext } from './service.js';
 import type { DaemonServiceId } from '../daemon-services.js';

package/dist/lib/daemon/auth-sync-service.js

@@ -3,28 +3,30 @@
  *
  * This tick owns only the NON-git duties of auth sync: it materializes worker
  * slots from durable keys already on the box, then (on the elected headed
- * publisher) provisions peers whose LAST-DELIVERED verdict says `missing` by
- * pushing the credential over SSH. The secret never enters Git.
+ * publisher) provisions peers missing a reserved key by pushing the credential
+ * over SSH. The secret never enters Git.
  *
- * It no longer runs its own `syncFleetSharedStateRepo` (PHNX-4051). The verdict
- * this tick's decisions read is published and delivered by the single git
- * committer, the usage-sync tick — folding both publishes into one caller is
- * what stops the two ticks (30 s apart) from contending for the one shared-repo
- * lock and starving the usage snapshot workers depend on. This tick keeps its
- * own deadline and circuit breaker, so a hung peer SSH push parks only auth-sync
- * and never the usage delivery. The pushes read the peer verdicts the last
- * usage-sync exchange wrote into the local checkout; they are idempotent
- * (push only when a peer is missing a key), so acting on at-most-one-tick-old
- * data converges exactly as the in-tick exchange did. To keep "at-most-one-tick-
- * old" true, the pushes are gated on the exchange's freshness marker
- * (`readLastSuccessfulExchangeMs`): when the last usage-sync exchange is missing
- * or older than one usage-sync tick interval (`USAGE_SYNC_TICK_MS`, the
- * producer's cadence — not this service's own `AUTH_SYNC_TICK_MS`), this tick
- * skips the pushes and WARNs instead of acting on peer state that may no longer
- * hold.
+ * It runs no transport of its own (PHNX-4051): the per-account readiness
+ * verdicts it reads are published and delivered by the usage-sync tick's SSH
+ * exchange, which stores each peer's reply at `devices/<peer>/daemon-state.json`
+ * stamped `receivedAt`. This tick keeps its own deadline and circuit breaker, so
+ * a hung peer SSH push parks only auth-sync and never the usage delivery.
+ *
+ * The pushes read each peer's OWN reply file (PHNX-4116 PR 5): a peer reporting
+ * a `missing` verdict for an account is pushed that account's key; a peer that
+ * has never sent a reply (no file), or whose reply carries no `accounts.rows`
+ * field (an older CLI — fail closed), is skipped this tick and logged at INFO.
+ * Presence is also gated on a delivered-fingerprint match, so a re-mint
+ * (`accounts login` bumps `workerCredential.mintedAt` while the old token still
+ * authenticates) re-pushes the rotated key within a tick instead of reading
+ * `present` forever. The push is idempotent, so a stale reply is harmless — a
+ * stale "has key" is fine, a stale "missing key" costs one redundant push —
+ * which is why the per-peer `receivedAt` replaced the old global freshness gate
+ * (`readLastSuccessfulExchangeMs`) that skipped EVERY push when the newest
+ * exchange across the fleet went stale. The reply file is first-hand and
+ * timestamped, so acting on it needs no such fleet-wide gate.
  */
 import { BasePeriodicService } from './service.js';
-import { USAGE_SYNC_TICK_MS } from './usage-sync-service.js';
 export const AUTH_SYNC_TICK_MS = 15 * 60_000;
 const AUTH_SYNC_DEADLINE_MS = 2 * 60_000;
 export const AUTH_SYNC_KICKOFF_MS = 60_000;
@@ -40,7 +42,7 @@ export class AuthSyncService extends BasePeriodicService {
         // Nothing to release — the supervisor's timer teardown is the only cleanup.
     }
     async onTick(ctx) {
-        const { reconcileLocalWorkerSlots, syncReservedAuthBundle, syncReservedStores, } = await import('../secrets-policy.js');
+        const { reconcileLocalWorkerSlots, syncReservedAuthBundle, syncReservedStores, SKIP_REASON_NO_PEER_REPLY, SKIP_REASON_NO_ACCOUNT_ROWS, } = await import('../secrets-policy.js');
         // Worker-side slot materialization FIRST (PHNX-3940 T6): for each registered
         // account whose durable key is already on this box, create the HOME-shaped
         // slot the picker and spawn read. It touches only local state — the registry
@@ -67,29 +69,12 @@ export class AuthSyncService extends BasePeriodicService {
         catch (err) {
             ctx.log('WARN', `auth-sync: worker slot reconcile: ${err.message}`);
         }
-        // The verdict this tick's pushes read is published by the usage-sync tick,
-        // the single git committer (PHNX-4051), and delivered into the local checkout
-        // by its exchange. The pushes below act on that last-delivered peer state, so
-        // they are only sound while that state is fresh. Gate them on the exchange's
-        // freshness: if the last successful usage-sync exchange is missing or older
-        // than one tick interval, the delivered peer verdicts may be stale — a peer
-        // that already received the key still reads `missing`, or a cleared `missing`
-        // still reads stale — so skip the pushes and WARN rather than pushing off it.
-        // The worker-slot reconcile above is NOT gated: it reads only local durable
-        // keys, never delivered peer verdicts.
-        const { readLastSuccessfulExchangeMs } = await import('../fleet-shared-repo-sync.js');
-        const lastExchangeMs = readLastSuccessfulExchangeMs();
-        const ageMs = lastExchangeMs === null ? null : Date.now() - lastExchangeMs;
-        // The threshold is the PRODUCER's cadence (USAGE_SYNC_TICK_MS), not this
-        // service's own AUTH_SYNC_TICK_MS: the delivered peer verdicts are refreshed
-        // once per usage-sync exchange, so "stale" is measured against that tick, not
-        // this one. The two constants are equal today, but sourcing it here keeps the
-        // gate tracking the usage-sync cadence if either is ever retuned alone.
-        if (ageMs === null || ageMs > USAGE_SYNC_TICK_MS) {
-            const age = ageMs === null ? 'never completed' : `last completed ${Math.round(ageMs / 1000)}s ago`;
-            ctx.log('WARN', `auth-sync: skipping credential push — usage-sync exchange ${age} (need one within ${Math.round(USAGE_SYNC_TICK_MS / 1000)}s); peer verdicts may be stale`);
-            return;
-        }
+        // The pushes read each peer's OWN daemon-state reply, first-hand and
+        // timestamped, so they run every tick with no fleet-wide freshness gate: a
+        // peer that has replied is planned off its verdict (any age — the push is
+        // idempotent), and a peer that has never replied is skipped and logged at
+        // INFO below. The worker-slot reconcile above reads only local durable keys,
+        // never peer verdicts, so it was never gated either.
         const result = await syncReservedAuthBundle();
         if (result.pushed.length > 0) {
             ctx.log('INFO', `auth-sync: pushed auth to ${result.pushed.join(', ')}`);
@@ -107,6 +92,15 @@ export class AuthSyncService extends BasePeriodicService {
                 ctx.log('INFO', `auth-sync: adopted ${stores.adopted.length} legacy reserved item(s) into their bundle: ${stores.adopted.map((a) => `${a.bundle} ${a.key}`).join(', ')}`);
             for (const p of stores.pushed)
                 ctx.log('INFO', `auth-sync: pushed ${p.bundle} (${p.keys.length} key(s)) to ${p.device}`);
+            // A peer with no reply yet — or a reply with no account rows (older CLI,
+            // fail-closed) — is informational, not a warning: a brand-new or never-
+            // dialed worker legitimately has none on an early tick, and the no-rows
+            // skip is transient during a rolling upgrade. One line per such peer per tick.
+            for (const s of stores.skipped) {
+                if (s.reason === SKIP_REASON_NO_PEER_REPLY || s.reason === SKIP_REASON_NO_ACCOUNT_ROWS) {
+                    ctx.log('INFO', `auth-sync: ${s.device}: ${s.reason}`);
+                }
+            }
             for (const err of stores.errors)
                 ctx.log('WARN', `auth-sync: reserved-store ${err.device}: ${err.message}`);
         }

package/dist/lib/daemon/daemon.d.ts

@@ -51,9 +51,10 @@ export declare function daemonServiceLabel(): string;
 export declare function daemonSystemdUnitName(): string;
 /**
  * How many consecutive failed daemon starts disable the *implicit* auto-start
- * (`ensureDaemonStarted`). Matches `DAEMON_START_LIMIT_BURST` so the two layers
- * give up together rather than one silently masking the other. `agents daemon
- * start` is the deliberate override and is never gated by this.
+ * (`ensureDaemonStarted`). This bounds foreground-command auto-starts only; the
+ * OS-level unit restart is deliberately unbounded (`StartLimitIntervalSec=0`) so
+ * a wedged daemon always recovers (PHNX-4116). `agents daemon start` is the
+ * deliberate override and is never gated by this.
  */
 export declare const DAEMON_AUTOSTART_FAILURE_LIMIT = 5;
 /**
@@ -111,7 +112,6 @@ interface DaemonHeartbeat {
 export declare function writeHeartbeat(pid?: number): void;
 export declare function readHeartbeat(): DaemonHeartbeat | null;
 export declare function removeHeartbeat(): void;
-export declare function isDaemonWedged(): boolean;
 /**
  * Check whether a daemon is alive — via the pid file, or a fresh heartbeat when
  * the pid file has been lost (see resolveLiveDaemonPid). The observation itself
@@ -349,7 +349,7 @@ export declare function ensureDaemonStarted(): {
  * console-owning wrapper (cmd.exe / the npm shim). When that wrapper exits it
  * closes its console, and the detached daemon sharing that console receives a
  * console-close event that trips its shutdown handler — the daemon comes up,
- * binds the browser IPC socket, then tears itself down ~36ms later (#556).
+ * binds its sockets, then tears itself down ~36ms later (#556).
  * Going through `process.execPath` means a real PE/binary is spawned with
  * `detached: true` and no console, so nothing signals the daemon after launch.
  *
@@ -452,24 +452,35 @@ export declare function findSurvivingStateDirDaemons(exclude: Set<number>): numb
  * from launchd/systemd if applicable.
  *
  * The SIGTERM → grace → killTree sequence is unchanged; what it adds is
- * verification. After the daemon is gone it checks that the browser IPC
- * binding actually released — a stale socket present on disk but with no live
- * owner is the orphan that keeps clients hanging on it — and that no
- * `__daemon-run` for THIS state dir survives. A killTree escalation exits
- * without running the daemon's graceful handleShutdown, so that socket can be
- * left stale; this reclaims it (the owner is provably dead) and reports it. It
- * never reports success on an unverified stop.
+ * verification: after the daemon is gone it checks that no `__daemon-run` for
+ * THIS state dir survives and reclaims the state files a killTree escalation
+ * (which skips the graceful handleShutdown) can leave stale. The browser IPC
+ * socket is no longer among them — it left with the standalone `browser` CLI
+ * (PHNX-4101). It never reports success on an unverified stop.
  */
 export declare function stopDaemon(): DaemonStopResult;
-/** Get current daemon status including running state, PID, and enabled job count. */
+/**
+ * Get current daemon status including running state, PID, enabled job count, and
+ * the supervised-restart history `agents daemon status` renders (PHNX-4116).
+ *
+ * There is no `wedged` state: a stalled daemon exits for a supervised
+ * systemd/launchd restart rather than sitting unresponsive, so the daemon is
+ * simply `running` or `stopped`, and its recent restarts are reported instead.
+ */
 export declare function getDaemonStatus(): {
-    state: 'running' | 'wedged' | 'stopped';
+    state: 'running' | 'stopped';
     running: boolean;
     pid: number | null;
     jobCount: number;
     logPath: string;
     binaryPath: string | null;
     heartbeat: DaemonHeartbeat | null;
+    /** Supervised restarts in the last 24h (a service breaching its deadline exits the daemon for an OS restart). */
+    restarts24h: number;
+    /** The most recent supervised-restart cause, or null if none in the last 24h. */
+    lastRestartCause: string | null;
+    /** ISO timestamp of the most recent supervised restart in the last 24h, or null. */
+    lastRestartAt: string | null;
 };
 /** Read the daemon log, optionally limited to the last N lines. */
 export declare function readDaemonLog(lines?: number): string;