@phnx-labs/agents-cli 1.22.117 → 1.22.119

package/dist/lib/daemon/auth-sync-service.js

@@ -3,28 +3,30 @@
  *
  * This tick owns only the NON-git duties of auth sync: it materializes worker
  * slots from durable keys already on the box, then (on the elected headed
- * publisher) provisions peers whose LAST-DELIVERED verdict says `missing` by
- * pushing the credential over SSH. The secret never enters Git.
+ * publisher) provisions peers missing a reserved key by pushing the credential
+ * over SSH. The secret never enters Git.
  *
- * It no longer runs its own `syncFleetSharedStateRepo` (PHNX-4051). The verdict
- * this tick's decisions read is published and delivered by the single git
- * committer, the usage-sync tick — folding both publishes into one caller is
- * what stops the two ticks (30 s apart) from contending for the one shared-repo
- * lock and starving the usage snapshot workers depend on. This tick keeps its
- * own deadline and circuit breaker, so a hung peer SSH push parks only auth-sync
- * and never the usage delivery. The pushes read the peer verdicts the last
- * usage-sync exchange wrote into the local checkout; they are idempotent
- * (push only when a peer is missing a key), so acting on at-most-one-tick-old
- * data converges exactly as the in-tick exchange did. To keep "at-most-one-tick-
- * old" true, the pushes are gated on the exchange's freshness marker
- * (`readLastSuccessfulExchangeMs`): when the last usage-sync exchange is missing
- * or older than one usage-sync tick interval (`USAGE_SYNC_TICK_MS`, the
- * producer's cadence — not this service's own `AUTH_SYNC_TICK_MS`), this tick
- * skips the pushes and WARNs instead of acting on peer state that may no longer
- * hold.
+ * It runs no transport of its own (PHNX-4051): the per-account readiness
+ * verdicts it reads are published and delivered by the usage-sync tick's SSH
+ * exchange, which stores each peer's reply at `devices/<peer>/daemon-state.json`
+ * stamped `receivedAt`. This tick keeps its own deadline and circuit breaker, so
+ * a hung peer SSH push parks only auth-sync and never the usage delivery.
+ *
+ * The pushes read each peer's OWN reply file (PHNX-4116 PR 5): a peer reporting
+ * a `missing` verdict for an account is pushed that account's key; a peer that
+ * has never sent a reply (no file), or whose reply carries no `accounts.rows`
+ * field (an older CLI — fail closed), is skipped this tick and logged at INFO.
+ * Presence is also gated on a delivered-fingerprint match, so a re-mint
+ * (`accounts login` bumps `workerCredential.mintedAt` while the old token still
+ * authenticates) re-pushes the rotated key within a tick instead of reading
+ * `present` forever. The push is idempotent, so a stale reply is harmless — a
+ * stale "has key" is fine, a stale "missing key" costs one redundant push —
+ * which is why the per-peer `receivedAt` replaced the old global freshness gate
+ * (`readLastSuccessfulExchangeMs`) that skipped EVERY push when the newest
+ * exchange across the fleet went stale. The reply file is first-hand and
+ * timestamped, so acting on it needs no such fleet-wide gate.
  */
 import { BasePeriodicService } from './service.js';
-import { USAGE_SYNC_TICK_MS } from './usage-sync-service.js';
 export const AUTH_SYNC_TICK_MS = 15 * 60_000;
 const AUTH_SYNC_DEADLINE_MS = 2 * 60_000;
 export const AUTH_SYNC_KICKOFF_MS = 60_000;
@@ -40,7 +42,7 @@ export class AuthSyncService extends BasePeriodicService {
         // Nothing to release — the supervisor's timer teardown is the only cleanup.
     }
     async onTick(ctx) {
-        const { reconcileLocalWorkerSlots, syncReservedAuthBundle, syncReservedStores, } = await import('../secrets-policy.js');
+        const { reconcileLocalWorkerSlots, syncReservedAuthBundle, syncReservedStores, SKIP_REASON_NO_PEER_REPLY, SKIP_REASON_NO_ACCOUNT_ROWS, } = await import('../secrets-policy.js');
         // Worker-side slot materialization FIRST (PHNX-3940 T6): for each registered
         // account whose durable key is already on this box, create the HOME-shaped
         // slot the picker and spawn read. It touches only local state — the registry
@@ -67,29 +69,12 @@ export class AuthSyncService extends BasePeriodicService {
         catch (err) {
             ctx.log('WARN', `auth-sync: worker slot reconcile: ${err.message}`);
         }
-        // The verdict this tick's pushes read is published by the usage-sync tick,
-        // the single git committer (PHNX-4051), and delivered into the local checkout
-        // by its exchange. The pushes below act on that last-delivered peer state, so
-        // they are only sound while that state is fresh. Gate them on the exchange's
-        // freshness: if the last successful usage-sync exchange is missing or older
-        // than one tick interval, the delivered peer verdicts may be stale — a peer
-        // that already received the key still reads `missing`, or a cleared `missing`
-        // still reads stale — so skip the pushes and WARN rather than pushing off it.
-        // The worker-slot reconcile above is NOT gated: it reads only local durable
-        // keys, never delivered peer verdicts.
-        const { readLastSuccessfulExchangeMs } = await import('../fleet-shared-repo-sync.js');
-        const lastExchangeMs = readLastSuccessfulExchangeMs();
-        const ageMs = lastExchangeMs === null ? null : Date.now() - lastExchangeMs;
-        // The threshold is the PRODUCER's cadence (USAGE_SYNC_TICK_MS), not this
-        // service's own AUTH_SYNC_TICK_MS: the delivered peer verdicts are refreshed
-        // once per usage-sync exchange, so "stale" is measured against that tick, not
-        // this one. The two constants are equal today, but sourcing it here keeps the
-        // gate tracking the usage-sync cadence if either is ever retuned alone.
-        if (ageMs === null || ageMs > USAGE_SYNC_TICK_MS) {
-            const age = ageMs === null ? 'never completed' : `last completed ${Math.round(ageMs / 1000)}s ago`;
-            ctx.log('WARN', `auth-sync: skipping credential push — usage-sync exchange ${age} (need one within ${Math.round(USAGE_SYNC_TICK_MS / 1000)}s); peer verdicts may be stale`);
-            return;
-        }
+        // The pushes read each peer's OWN daemon-state reply, first-hand and
+        // timestamped, so they run every tick with no fleet-wide freshness gate: a
+        // peer that has replied is planned off its verdict (any age — the push is
+        // idempotent), and a peer that has never replied is skipped and logged at
+        // INFO below. The worker-slot reconcile above reads only local durable keys,
+        // never peer verdicts, so it was never gated either.
         const result = await syncReservedAuthBundle();
         if (result.pushed.length > 0) {
             ctx.log('INFO', `auth-sync: pushed auth to ${result.pushed.join(', ')}`);
@@ -107,6 +92,15 @@ export class AuthSyncService extends BasePeriodicService {
                 ctx.log('INFO', `auth-sync: adopted ${stores.adopted.length} legacy reserved item(s) into their bundle: ${stores.adopted.map((a) => `${a.bundle} ${a.key}`).join(', ')}`);
             for (const p of stores.pushed)
                 ctx.log('INFO', `auth-sync: pushed ${p.bundle} (${p.keys.length} key(s)) to ${p.device}`);
+            // A peer with no reply yet — or a reply with no account rows (older CLI,
+            // fail-closed) — is informational, not a warning: a brand-new or never-
+            // dialed worker legitimately has none on an early tick, and the no-rows
+            // skip is transient during a rolling upgrade. One line per such peer per tick.
+            for (const s of stores.skipped) {
+                if (s.reason === SKIP_REASON_NO_PEER_REPLY || s.reason === SKIP_REASON_NO_ACCOUNT_ROWS) {
+                    ctx.log('INFO', `auth-sync: ${s.device}: ${s.reason}`);
+                }
+            }
             for (const err of stores.errors)
                 ctx.log('WARN', `auth-sync: reserved-store ${err.device}: ${err.message}`);
         }

package/dist/lib/daemon/daemon.d.ts

@@ -51,9 +51,10 @@ export declare function daemonServiceLabel(): string;
 export declare function daemonSystemdUnitName(): string;
 /**
  * How many consecutive failed daemon starts disable the *implicit* auto-start
- * (`ensureDaemonStarted`). Matches `DAEMON_START_LIMIT_BURST` so the two layers
- * give up together rather than one silently masking the other. `agents daemon
- * start` is the deliberate override and is never gated by this.
+ * (`ensureDaemonStarted`). This bounds foreground-command auto-starts only; the
+ * OS-level unit restart is deliberately unbounded (`StartLimitIntervalSec=0`) so
+ * a wedged daemon always recovers (PHNX-4116). `agents daemon start` is the
+ * deliberate override and is never gated by this.
  */
 export declare const DAEMON_AUTOSTART_FAILURE_LIMIT = 5;
 /**
@@ -111,7 +112,6 @@ interface DaemonHeartbeat {
 export declare function writeHeartbeat(pid?: number): void;
 export declare function readHeartbeat(): DaemonHeartbeat | null;
 export declare function removeHeartbeat(): void;
-export declare function isDaemonWedged(): boolean;
 /**
  * Check whether a daemon is alive — via the pid file, or a fresh heartbeat when
  * the pid file has been lost (see resolveLiveDaemonPid). The observation itself
@@ -349,7 +349,7 @@ export declare function ensureDaemonStarted(): {
  * console-owning wrapper (cmd.exe / the npm shim). When that wrapper exits it
  * closes its console, and the detached daemon sharing that console receives a
  * console-close event that trips its shutdown handler — the daemon comes up,
- * binds the browser IPC socket, then tears itself down ~36ms later (#556).
+ * binds its sockets, then tears itself down ~36ms later (#556).
  * Going through `process.execPath` means a real PE/binary is spawned with
  * `detached: true` and no console, so nothing signals the daemon after launch.
  *
@@ -452,24 +452,35 @@ export declare function findSurvivingStateDirDaemons(exclude: Set<number>): numb
  * from launchd/systemd if applicable.
  *
  * The SIGTERM → grace → killTree sequence is unchanged; what it adds is
- * verification. After the daemon is gone it checks that the browser IPC
- * binding actually released — a stale socket present on disk but with no live
- * owner is the orphan that keeps clients hanging on it — and that no
- * `__daemon-run` for THIS state dir survives. A killTree escalation exits
- * without running the daemon's graceful handleShutdown, so that socket can be
- * left stale; this reclaims it (the owner is provably dead) and reports it. It
- * never reports success on an unverified stop.
+ * verification: after the daemon is gone it checks that no `__daemon-run` for
+ * THIS state dir survives and reclaims the state files a killTree escalation
+ * (which skips the graceful handleShutdown) can leave stale. The browser IPC
+ * socket is no longer among them — it left with the standalone `browser` CLI
+ * (PHNX-4101). It never reports success on an unverified stop.
  */
 export declare function stopDaemon(): DaemonStopResult;
-/** Get current daemon status including running state, PID, and enabled job count. */
+/**
+ * Get current daemon status including running state, PID, enabled job count, and
+ * the supervised-restart history `agents daemon status` renders (PHNX-4116).
+ *
+ * There is no `wedged` state: a stalled daemon exits for a supervised
+ * systemd/launchd restart rather than sitting unresponsive, so the daemon is
+ * simply `running` or `stopped`, and its recent restarts are reported instead.
+ */
 export declare function getDaemonStatus(): {
-    state: 'running' | 'wedged' | 'stopped';
+    state: 'running' | 'stopped';
     running: boolean;
     pid: number | null;
     jobCount: number;
     logPath: string;
     binaryPath: string | null;
     heartbeat: DaemonHeartbeat | null;
+    /** Supervised restarts in the last 24h (a service breaching its deadline exits the daemon for an OS restart). */
+    restarts24h: number;
+    /** The most recent supervised-restart cause, or null if none in the last 24h. */
+    lastRestartCause: string | null;
+    /** ISO timestamp of the most recent supervised restart in the last 24h, or null. */
+    lastRestartAt: string | null;
 };
 /** Read the daemon log, optionally limited to the last N lines. */
 export declare function readDaemonLog(lines?: number): string;