@phnx-labs/agents-cli 1.22.117 → 1.22.119

package/dist/lib/daemon/daemon.js

@@ -23,12 +23,11 @@ import { detectOverdueJobs, notifyOverdue } from '../overdue.js';
 import { runCatchup } from '../catchup.js';
 import { notifyRoutineStart, notifyRoutineFinish, notifyRoutineStartFailed } from '../routine-notify.js';
 import { notifyOwnerRoutineFinish, notifyOwnerRoutineStartFailed } from '../routine-notify-owner.js';
-import { getSocketPath as getBrowserIpcSocketPath } from '../browser/ipc.js';
 import { redactSecrets } from '../redact.js';
 import { getAgentsBinPath, getCliLaunch, BUN_VIRTUAL_ROOT } from '../cli-entry.js';
 import { localBinDir } from '../platform/posixpath.js';
 import { isSchedulerEnabled, assertSchedulerEnabled, isDaemonEnabled } from '../device-config.js';
-import { recordSubsystemOk, recordSubsystemError, recordSubsystemErrorReason, readSubsystemHealth, SUBSYSTEM_DAEMON_START } from '../daemon-health.js';
+import { recordSubsystemOk, recordSubsystemError, recordSubsystemErrorReason, readSubsystemHealth, readRecentDaemonRestarts, SUBSYSTEM_DAEMON_START } from '../daemon-health.js';
 import { ServiceSupervisor } from './supervisor.js';
 import { emit, emitAsync, emitRoutineEnd } from '../feed/events.js';
 import { readDaemonServicesConfig, drainDaemonServiceRestartQueue } from '../daemon-services.js';
@@ -40,8 +39,8 @@ import { sleepSync } from '../fs-atomic.js';
  * survive across processes goes through `daemon-health.ts` instead (which
  * `ServiceSupervisor` already writes on every tick). This getter exists so a
  * FUTURE same-process consumer (e.g. a `daemon services` live-status IPC
- * handler) can read the supervisor's richer state (`parked`, not just
- * ok/error) without needing its own reference to `runDaemon()`'s locals.
+ * handler) can read the supervisor's live state (`running`/`stopped`, plus the
+ * failure streak) without needing its own reference to `runDaemon()`'s locals.
  */
 let activeServiceSupervisor = null;
 /** Health for every service currently registered on the live supervisor, or `null` if the daemon isn't running in this process. */
@@ -127,31 +126,33 @@ export function daemonSystemdUnitName() {
 const WEDGE_THRESHOLD_TICKS = 3;
 const DAEMON_HEARTBEAT_TICK_MS = 60_000;
 /**
- * Crash-loop prevention (RUSH-2418). Three layers, because none of them alone
- * bounds a daemon that dies during startup:
+ * Crash-loop pacing and auto-start bounding (RUSH-2418, PHNX-4116). Two layers,
+ * because a daemon that dies during startup must be paced but must NEVER be
+ * abandoned:
  *
- * 1. **The OS supervisor paces the respawn.** `KeepAlive` with no
- *    `ThrottleInterval` lets launchd relaunch on its ~10s default, so a daemon
- *    that dies while booting is restarted six times a minute forever — the exact
- *    failure the menu-bar helper hit (`menubar/install-menubar.ts`: 38 orphaned
- *    `agents doctor` children, load average 490). systemd's `Restart=always`
- *    with no `StartLimit*` is the same uncapped loop.
- * 2. **`StartLimitBurst` gives systemd a real cap** — after this many starts
- *    inside the interval the unit is put in `failed` and stops respawning, so a
- *    genuinely broken install stops burning the box and `systemctl --user status`
- *    names it. launchd has no burst equivalent; the throttle is its whole answer.
- * 3. **The application-level circuit breaker** below stops *auto*-starts from
- *    re-entering the loop from the other direction — a foreground command that
- *    calls `ensureDaemonStarted()` on every invocation.
+ * 1. **The OS supervisor paces AND always retries the respawn.** launchd's
+ *    `KeepAlive` with `ThrottleInterval=30` (and systemd's `Restart=always`
+ *    `RestartSec=30`) relaunch a dead daemon every ~30s. Crucially systemd's
+ *    `StartLimitIntervalSec=0` REMOVES the burst cap (PHNX-4116): a repeatedly
+ *    deadline-breaching daemon is restarted every ~30s indefinitely rather than
+ *    parked in `failed` and left dark until a human runs `systemctl restart`.
+ *    The owner requirement is that a wedged daemon always recovers on its own —
+ *    "just work like systemd/launchd". A supervised deadline breach is precisely
+ *    what forces the exit (see `ServiceSupervisor.exitForRestart`), so the exit
+ *    is the recovery, not a failure to give up on.
+ * 2. **The application-level circuit breaker** below still stops *auto*-starts
+ *    from re-entering the loop from the other direction — a foreground command
+ *    that calls `ensureDaemonStarted()` on every invocation. This bounds the
+ *    IMPLICIT starts a busy operator would otherwise trigger; the OS-level
+ *    unit-restart above is deliberately unbounded.
  */
 const DAEMON_THROTTLE_SECONDS = 30;
-const DAEMON_START_LIMIT_INTERVAL_SECONDS = 300;
-const DAEMON_START_LIMIT_BURST = 5;
 /**
  * How many consecutive failed daemon starts disable the *implicit* auto-start
- * (`ensureDaemonStarted`). Matches `DAEMON_START_LIMIT_BURST` so the two layers
- * give up together rather than one silently masking the other. `agents daemon
- * start` is the deliberate override and is never gated by this.
+ * (`ensureDaemonStarted`). This bounds foreground-command auto-starts only; the
+ * OS-level unit restart is deliberately unbounded (`StartLimitIntervalSec=0`) so
+ * a wedged daemon always recovers (PHNX-4116). `agents daemon start` is the
+ * deliberate override and is never gated by this.
  */
 export const DAEMON_AUTOSTART_FAILURE_LIMIT = 5;
 export function schedulerGateTransition(running, enabled) {
@@ -338,28 +339,19 @@ export function removeHeartbeat() {
     catch { /* already removed */ }
 }
 /**
- * A heartbeat is "fresh" when its last tick falls inside the wedge window — the
- * same threshold isDaemonWedged() uses to decide a still-present daemon has gone
- * unresponsive. A fresh heartbeat whose pid is alive is proof of a live, ticking
- * daemon even when the pid file has been lost.
+ * A heartbeat is "fresh" when its last tick falls inside the freshness window. A
+ * fresh heartbeat whose pid is alive is proof of a live, ticking daemon even
+ * when the pid file has been lost, which is why `resolveLiveDaemonPid` trusts it.
+ *
+ * There is no separate "wedged" verdict any more (PHNX-4116): a daemon whose
+ * event loop stalls no longer sits `wedged` waiting for a human — a supervised
+ * service that breaches its deadline exits the process, and systemd/launchd
+ * restart it. So the daemon is simply `running` or `stopped`.
  */
 function isHeartbeatFresh(hb) {
     const elapsed = Date.now() - Date.parse(hb.lastTick);
     return elapsed <= WEDGE_THRESHOLD_TICKS * DAEMON_HEARTBEAT_TICK_MS;
 }
-export function isDaemonWedged() {
-    const pid = readDaemonPid();
-    if (!pid)
-        return false;
-    if (!isLiveDaemon(pid))
-        return false;
-    const hb = readHeartbeat();
-    if (!hb)
-        return false;
-    if (hb.pid !== pid)
-        return false;
-    return !isHeartbeatFresh(hb);
-}
 /** How long stopDaemon waits for a SIGTERMed daemon to exit before escalating. */
 const STOP_GRACE_MS = 5000;
 /** How long it waits after the hard tree-kill before giving up. */
@@ -488,10 +480,11 @@ export function claimDaemonInstance() {
         const existing = resolveLiveDaemonPid(true);
         if (existing !== null && existing !== process.pid) {
             // Evict, and WAIT for the incumbent to be provably dead — its graceful
-            // handleShutdown releasing the browser IPC binding — before we write our
-            // pid and (later, in runDaemon) bind our own. Binding before the release
-            // recreates the two-owners-on-one-socket orphan documented at stopDaemon
-            // below, so the pid file is not written until the prior owner is gone.
+            // handleShutdown releasing its socket bindings (feed-stream hub, monitor)
+            // — before we write our pid and (later, in runDaemon) bind our own.
+            // Binding before the release recreates the two-owners-on-one-socket orphan
+            // documented at stopDaemon below, so the pid file is not written until the
+            // prior owner is gone.
             if (!evictIncumbentDaemon(existing))
                 return false;
         }
@@ -504,10 +497,11 @@ export function claimDaemonInstance() {
 }
 /**
  * SIGTERM a live incumbent daemon and block until it is provably dead, so its
- * graceful handleShutdown has released the browser IPC binding BEFORE the
- * newcomer binds anything of its own (SING-11) — the daemon no longer hosts a
- * secrets broker socket to release (the standalone `secrets` CLI owns it now,
- * PHNX-3989 OWN-1). Escalates
+ * graceful handleShutdown has released its socket bindings (the feed-stream hub,
+ * the monitor socket) BEFORE the newcomer binds anything of its own (SING-11) —
+ * the daemon no longer hosts a secrets broker socket (the standalone `secrets`
+ * CLI owns it, PHNX-3989 OWN-1) nor a browser IPC socket (the standalone
+ * `browser` CLI owns it, PHNX-4101). Escalates
  * to killTree after the grace window. Passes the POSITIVE pid so the kill reaches
  * only the incumbent daemon — never its detached routine children, which run in
  * their own process groups and must survive takeover (SING-11a); the new daemon
@@ -878,15 +872,13 @@ export async function runDaemon() {
     assertTestDaemonHome();
     // Lifecycle readers and launchers do not run services. Load their code only
     // in the daemon process, before it claims or publishes lifecycle state.
-    const [{ BrowserService }, { SessionIndexService }, { SessionSummarizerService }, { SessionTitleService }, { MonitorEngineService }, { AccountUsageService, AccountAuthService }, { CatchupService }, { BrowserIPCService }, { WatchdogService }, { DeviceProbeService }, { SelfHealService }, { SelfUpdateService }, { HarnessUpdateService }, { AuthSyncService }, { UsageSyncService }, { StateDirCheckService }, { SessionStateService }, { FeedStreamService }, { AttentionNotifyService }, { WebhookReceiverService }, { HeartbeatService }, { TmuxReapService }, { BrowserTaskReapService },] = await Promise.all([
-        import('../browser/service.js'),
+    const [{ SessionIndexService }, { SessionSummarizerService }, { SessionTitleService }, { MonitorEngineService }, { AccountUsageService, AccountAuthService }, { CatchupService }, { WatchdogService }, { DeviceProbeService }, { SelfHealService }, { SelfUpdateService }, { HarnessUpdateService }, { AuthSyncService }, { UsageSyncService }, { StateDirCheckService }, { SessionStateService }, { FeedStreamService }, { AttentionNotifyService }, { WebhookReceiverService }, { HeartbeatService }, { TmuxReapService },] = await Promise.all([
         import('./session-index-service.js'),
         import('./session-summarizer-service.js'),
         import('./session-title-service.js'),
         import('./monitor-engine-service.js'),
         import('./account-state-daemon-service.js'),
         import('./catchup-service.js'),
-        import('./browser-ipc-service.js'),
         import('./watchdog-service.js'),
         import('./device-probe-service.js'),
         import('./self-heal-service.js'),
@@ -901,7 +893,6 @@ export async function runDaemon() {
         import('./webhook-receiver-service.js'),
         import('./heartbeat-service.js'),
         import('./tmux-reap-service.js'),
-        import('./browser-task-reap-service.js'),
     ]);
     // Install the shared-daemon reload signal boundary BEFORE publishing our PID
     // in claimDaemonInstance(). Browser/routines clients use that PID to decide a
@@ -1011,11 +1002,11 @@ export async function runDaemon() {
     catch (err) {
         log('ERROR', `Stray daemon reaper failed: ${err.message}`);
     }
-    // Socket services: monitor engine, account-state, and browser IPC are all
-    // managed by the ServiceSupervisor (RUSH-3193 P2). The secrets broker moved
-    // with the standalone `secrets` engine (PHNX-3989 OWN-1) — this daemon no
-    // longer hosts or takes over that broker; the standalone owns its own
-    // lifecycle exclusively.
+    // Socket services: monitor engine, account-state, and the feed-stream hub are
+    // all managed by the ServiceSupervisor (RUSH-3193 P2). The secrets broker moved
+    // with the standalone `secrets` engine (PHNX-3989 OWN-1) and the browser IPC
+    // service with the standalone `browser` CLI (PHNX-4101) — this daemon no longer
+    // hosts either; each standalone owns its own lifecycle exclusively.
     const supervisor = new ServiceSupervisor();
     if (isEnabled('session-state')) {
         supervisor.register(new SessionStateService(() => supervisor.runNow('session-state')));
@@ -1023,8 +1014,7 @@ export async function runDaemon() {
     else
         log('INFO', 'Live session-state service disabled');
     // The shared feed fan-out. Registered even when disabled at boot so a later
-    // `agents daemon services enable feed-stream` brings it up over SIGHUP, the
-    // same live-transition shape browser IPC uses.
+    // `agents daemon services enable feed-stream` brings it up over SIGHUP.
     supervisor.register(new FeedStreamService(), { enabled: isEnabled('feed-stream') });
     if (!isEnabled('feed-stream'))
         log('INFO', 'Shared feed stream service disabled');
@@ -1034,8 +1024,8 @@ export async function runDaemon() {
     else
         log('INFO', 'Monitor engine disabled');
     // Usage and auth refresh are two INDEPENDENT supervised services (PHNX-3608)
-    // so a run of usage-refresh failures parks only usage and never starves the
-    // slower auth refresh — each carries its own circuit breaker.
+    // so a run of usage-refresh throws is recorded against usage alone and never
+    // starves the slower auth refresh — each keeps ticking on its own interval.
     if (isEnabled('account-state'))
         supervisor.register(new AccountUsageService());
     else
@@ -1066,14 +1056,11 @@ export async function runDaemon() {
     else {
         log('INFO', 'Catch-up recovery service disabled');
     }
-    // BrowserIPCService and BrowserTaskReapService share one long-lived
-    // BrowserService. Browser IPC is registered even when disabled at boot so an
-    // explicit later `agents browser start` can enable it live over SIGHUP — the
-    // client owns a service transition, never a whole-daemon restart (PHNX-3605).
-    const browserService = new BrowserService();
-    supervisor.register(new BrowserIPCService(browserService), { enabled: isEnabled('browser-ipc') });
-    if (!isEnabled('browser-ipc'))
-        log('INFO', 'Browser IPC service disabled');
+    // The browser IPC service and its task reaper are the standalone `browser`
+    // CLI's now (@phnx-labs/browser-cli, PHNX-4101): it hosts its own IPC service
+    // and runs its own `prune` reaper. agents-cli no longer constructs a
+    // BrowserService, binds a browser socket, or reaps browser tasks — see
+    // `commands/browser.ts` and `docs/browser.md`.
     if (isEnabled('session-index'))
         supervisor.register(new SessionIndexService());
     else
@@ -1143,17 +1130,11 @@ export async function runDaemon() {
         supervisor.register(new TmuxReapService());
     else
         log('INFO', 'Tmux reap service disabled');
-    if (isEnabled('browser-task-reap')) {
-        supervisor.register(new BrowserTaskReapService(browserService));
-    }
-    else {
-        log('INFO', 'Browser-task reap service disabled');
-    }
     await supervisor.startAll({ log });
     activeServiceSupervisor = supervisor;
     // scheduler.enabled=false in this machine's device doc means NO routines fire
     // here — the scheduler and its catchup recovery simply never start, while the
-    // daemon keeps its other duties (browser IPC, session sync).
+    // daemon keeps its other duties (feed stream, session sync).
     // The refusal message is the same one the start surfaces
     // (`routines add` auto-start, manual `routines start`) raise. The gate is
     // re-evaluated on every SIGHUP reload (handleReload below) via
@@ -1353,14 +1334,14 @@ export async function runDaemon() {
         }
         catch (err) {
             // Ordinary pass errors are logged, not re-thrown: a transient catchup
-            // failure should not trip the circuit breaker. A HANG is still caught — the
-            // CatchupService deadline aborts the tick and the supervisor parks +
-            // restarts it regardless of this swallow (PHNX-3608).
+            // failure should not be counted as a service failure. A HANG is still
+            // caught — the CatchupService deadline aborts the tick and the supervisor
+            // exits the daemon for an OS restart regardless of this swallow (PHNX-4116).
             log('ERROR', `Catchup pass failed: ${err.message}`);
         }
     }
-    // Browser orphan reap and IPC server start are now managed by BrowserIPCService
-    // on the supervisor (RUSH-3193 P2). The orphan reap runs inside onStart().
+    // The browser IPC server and its orphan reap left this daemon with the
+    // standalone `browser` CLI (PHNX-4101) — it hosts its own IPC service now.
     // Webhook receivers: signed webhook receiver(s) + their funnel (RUSH-2548).
     // Resolves each receiver's signing secret headlessly through the standalone
     // `secrets` CLI (an agentOnly secrets-client read) — no AGENTS_SECRETS_PASSPHRASE,
@@ -1379,15 +1360,13 @@ export async function runDaemon() {
     // RUSH-2501: reap tmux sessions whose panes are all dead. Daemon-only
     // (single executor). Dead managed panes and their orphan helpers are
     // reaped by TmuxReapService.
-    // RUSH-2622: close abandoned browser-task tabs on the same 5-min cadence,
-    // reusing the daemon's long-lived BrowserService when browser IPC is enabled.
-    // Abandoned browser tasks are reaped by BrowserTaskReapService, sharing the
-    // same BrowserService instance as BrowserIPCService.
+    // Abandoned browser-task reaping (RUSH-2622) left this daemon with the
+    // standalone `browser` CLI (PHNX-4101) — its own `prune` reaper owns it now.
     // RUSH-2367 / RUSH-3193 P3: state-dir-check (self-terminate guard) is
     // registered on the supervisor further below, once `handleShutdown` exists
     // — see the registration site after its declaration for why.
-    // RUSH-2418: startup is over — the scheduler, browser IPC, broker decision,
-    // monitor engine and every background tick are up. Only NOW does this daemon
+    // RUSH-2418: startup is over — the scheduler, feed stream, monitor engine and
+    // every background tick are up. Only NOW does this daemon
     // clear the auto-start failure streak `ensureDaemonStarted` reads. Clearing it
     // at claim time instead would reset the breaker for a process that dies while
     // initializing a subsystem, which is exactly the crash loop it exists to stop.
@@ -1670,14 +1649,14 @@ export function generateSystemdUnit(agentsBin = getAgentsBinPath()) {
     return `[Unit]
 Description=Agents Daemon - Scheduled Job Runner
 After=network.target
-StartLimitIntervalSec=${DAEMON_START_LIMIT_INTERVAL_SECONDS}
-StartLimitBurst=${DAEMON_START_LIMIT_BURST}
+StartLimitIntervalSec=0
 
 [Service]
 Type=simple
 ExecStart=${execStart}
 Restart=always
 RestartSec=${DAEMON_THROTTLE_SECONDS}
+KillMode=process
 Environment=PATH=${daemonPathValue(agentsBin, ['/usr/local/bin', '/usr/bin', '/bin'])}
 Environment=HOME=${home}
 Environment=AGENTS_REAL_HOME=${realHome}
@@ -1989,7 +1968,7 @@ function startDaemonLocked(agentsBin, releaseLock) {
  * console-owning wrapper (cmd.exe / the npm shim). When that wrapper exits it
  * closes its console, and the detached daemon sharing that console receives a
  * console-close event that trips its shutdown handler — the daemon comes up,
- * binds the browser IPC socket, then tears itself down ~36ms later (#556).
+ * binds its sockets, then tears itself down ~36ms later (#556).
  * Going through `process.execPath` means a real PE/binary is spawned with
  * `detached: true` and no console, so nothing signals the daemon after launch.
  *
@@ -2279,13 +2258,11 @@ export function findSurvivingStateDirDaemons(exclude) {
  * from launchd/systemd if applicable.
  *
  * The SIGTERM → grace → killTree sequence is unchanged; what it adds is
- * verification. After the daemon is gone it checks that the browser IPC
- * binding actually released — a stale socket present on disk but with no live
- * owner is the orphan that keeps clients hanging on it — and that no
- * `__daemon-run` for THIS state dir survives. A killTree escalation exits
- * without running the daemon's graceful handleShutdown, so that socket can be
- * left stale; this reclaims it (the owner is provably dead) and reports it. It
- * never reports success on an unverified stop.
+ * verification: after the daemon is gone it checks that no `__daemon-run` for
+ * THIS state dir survives and reclaims the state files a killTree escalation
+ * (which skips the graceful handleShutdown) can leave stale. The browser IPC
+ * socket is no longer among them — it left with the standalone `browser` CLI
+ * (PHNX-4101). It never reports success on an unverified stop.
  */
 export function stopDaemon() {
     const releaseLock = acquireLifecycleLock();
@@ -2341,16 +2318,6 @@ function stopDaemonLocked() {
     // excluded. resolveLiveDaemonPid(true) rejects a reused/non-daemon pid before
     // any service-manager teardown or direct signal and repairs only under lock.
     const pid = resolveLiveDaemonPid(true);
-    const browserSock = process.platform === 'win32' ? null : getBrowserIpcSocketPath();
-    // Capture the socket's inode INDEPENDENTLY of whether a live pid resolved
-    // (PHNX-3618). A daemon that died between the CLI liveness precheck and this
-    // locked read leaves resolveLiveDaemonPid() returning null while its ungraceful
-    // exit left the binding on disk — capturing only when `pid !== null` meant that
-    // genuinely stale socket could never be reclaimed and was reported "ownership
-    // could not be verified". The inode is the successor guard: a fresh daemon that
-    // rebinds during the stop gets a new inode, so a later identity match still
-    // proves this exact binding is the one we captured, never a successor's.
-    const browserSockOwner = browserSock ? readPathIdentity(browserSock) : null;
     if (platform === 'darwin') {
         const plistPath = getLaunchdPlistPath();
         if (fs.existsSync(plistPath)) {
@@ -2476,49 +2443,9 @@ function stopDaemonLocked() {
     else if (pid === null && currentPid !== null) {
         surviving.push(`daemon pid registration changed to ${currentPid} during stop`);
     }
-    // Browser IPC binding: on POSIX the listening socket is a filesystem object.
-    // A graceful handleShutdown unlinks it; if it survives, the daemon exited
-    // ungracefully (killTree) and left a stale binding — the owner is provably
-    // dead, so reclaim it and report.
-    if (process.platform !== 'win32') {
-        // A binding is provably stale — and reclaimable — when the inode on disk is
-        // still the exact one captured under this lock AND no daemon (the signalled
-        // target OR any successor for this state dir) survives to own it. Keying the
-        // "a daemon still owns it" test on the whole survivor set rather than only the
-        // captured target is what lets a daemon that died BEFORE this stop (pid ===
-        // null, PHNX-3618) still have its stale socket reclaimed, while a live
-        // successor — which either rebound the inode or shows up as a survivor — is
-        // never touched (PHNX-3607's never-delete-a-successor invariant).
-        const aDaemonSurvives = survivors.length > 0 || unverifiedSurvivors.length > 0;
-        if (browserSock && fs.existsSync(browserSock)) {
-            const ownsCapturedBinding = browserSockOwner !== null
-                && pathIdentityMatches(browserSock, browserSockOwner);
-            if (ownsCapturedBinding && !aDaemonSurvives) {
-                try {
-                    fs.unlinkSync(browserSock);
-                }
-                catch { /* failed to reclaim the captured binding */ }
-                if (pathIdentityMatches(browserSock, browserSockOwner))
-                    surviving.push('browser IPC socket not released');
-                else if (fs.existsSync(browserSock))
-                    surviving.push('browser IPC socket ownership changed during stop');
-                else
-                    released.push('browser IPC socket (reclaimed)');
-            }
-            else if (aDaemonSurvives) {
-                surviving.push('browser IPC socket still owned by a surviving daemon');
-            }
-            else {
-                // The path was absent when this transaction captured the target (a
-                // successor bound it afterward) or a successor replaced the inode. Either
-                // way this invocation does not own the current binding and must leave it.
-                surviving.push('browser IPC socket ownership could not be verified');
-            }
-        }
-        else {
-            released.push('browser IPC socket');
-        }
-    }
+    // The browser IPC socket is the standalone `browser` CLI's now (PHNX-4101):
+    // the daemon no longer binds it, so there is nothing to reclaim here. browser-cli
+    // owns its own socket lifecycle under `~/.agents/.cache/helpers/browser/`.
     // ── The state files a killed daemon cannot clean up itself (RUSH-2421) ─────
     // handleShutdown removes the lifetime marker, the heartbeat and this pid's
     // instance-registry entry — but it only runs on the GRACEFUL path. Every
@@ -2556,10 +2483,16 @@ function stopDaemonLocked() {
         detachedChildren,
     };
 }
-/** Get current daemon status including running state, PID, and enabled job count. */
+/**
+ * Get current daemon status including running state, PID, enabled job count, and
+ * the supervised-restart history `agents daemon status` renders (PHNX-4116).
+ *
+ * There is no `wedged` state: a stalled daemon exits for a supervised
+ * systemd/launchd restart rather than sitting unresponsive, so the daemon is
+ * simply `running` or `stopped`, and its recent restarts are reported instead.
+ */
 export function getDaemonStatus() {
     const running = isDaemonRunning();
-    const wedged = running && isDaemonWedged();
     const pid = readDaemonPid();
     let jobCount = 0;
     try {
@@ -2571,14 +2504,19 @@ export function getDaemonStatus() {
         binaryPath = getAgentsBinPath();
     }
     catch { /* resolution failed */ }
+    const recentRestarts = readRecentDaemonRestarts(Date.now() - 24 * 60 * 60 * 1000);
+    const lastRestart = recentRestarts.length > 0 ? recentRestarts[recentRestarts.length - 1] : null;
     return {
-        state: wedged ? 'wedged' : running ? 'running' : 'stopped',
+        state: running ? 'running' : 'stopped',
         running,
         pid,
         jobCount,
         logPath: getDaemonLogPath(),
         binaryPath,
         heartbeat: readHeartbeat(),
+        restarts24h: recentRestarts.length,
+        lastRestartCause: lastRestart ? `${lastRestart.subsystem}: ${lastRestart.cause}` : null,
+        lastRestartAt: lastRestart ? lastRestart.at : null,
     };
 }
 /** Read the daemon log, optionally limited to the last N lines. */

package/dist/lib/daemon/runner.d.ts

@@ -87,8 +87,8 @@ export declare function routineSpawnCwd(config: Pick<JobConfig, 'name' | 'projec
  *     modeFlags.plan so claudeAdapter.routineModeArgs can splice
  *     plan → acceptEdits / auto / skip.
  *
- * Returns undefined when `agent` is outside ROUTINE_AGENT_IDS (gemini, grok,
- * and every other harness the daemon does not fire locally).
+ * Returns undefined when `agent` is outside ROUTINE_AGENT_IDS (grok and every
+ * other harness the daemon does not fire locally).
  */
 export declare function bakeRoutineArgv(agent: string): string[] | undefined;
 /** Build the full CLI argv for executing a job, applying mode, model, and permission flags. */

package/dist/lib/daemon/runner.js

@@ -43,7 +43,25 @@ import { getConfiguredRunStrategy, resolveRunVersion, resolveAccountCandidate, r
 import { isHeadedDeviceRole, selfConfiguredDeviceRole } from '../device-config.js';
 import { isSelfUpdatingAgent, ROUTINE_AGENT_IDS, isAgentHardDeprecated, hardDeprecationError } from '../agents.js';
 import { isCustomHarnessName, readProfile } from '../profiles.js';
-import { findAccount, findUnifiedAccount, resolveAccountSelection, resolveCredentialAccount } from '../account-registry.js';
+import { findAccount, findUnifiedAccount, listNativeAccounts, resolveAccountSelection, resolveCredentialAccount } from '../account-registry.js';
+import { recordRunAuthOutcome } from '../auth-health.js';
+/**
+ * Record a routine run's auth outcome as a per-account FACT (PHNX-4116). A worker
+ * runs entirely through routines and never probes, so an auth failure here — or a
+ * clean success that clears a stale failure — is the honest evidence `agents view`
+ * renders as `last used ok` / `last auth failure`. Best-effort: resolves the slot
+ * from the routine's account name so the fact lands on the right row, and never
+ * throws (a run it cannot attribute is simply not recorded).
+ */
+function recordRoutineAuthOutcome(agent, accountName, version, outcome) {
+    try {
+        const accountId = accountName
+            ? listNativeAccounts(readMeta()).find((a) => a.agent === agent && a.name === accountName)?.id ?? null
+            : null;
+        recordRunAuthOutcome({ agent, accountId, version: version ?? null, account: accountName, outcome });
+    }
+    catch { /* best-effort */ }
+}
 export class RoutineAlreadyRunningError extends Error {
     constructor(jobName, runId) {
         super(`Routine '${jobName}' already has a running execution (${runId})`);
@@ -465,7 +483,6 @@ const ROUTINE_TRANSCRIPT_SPECS = {
     claude: [{ root: ['.claude', 'projects'], ext: '.jsonl' }],
     codex: [{ root: ['.codex', 'sessions'], ext: '.jsonl' }],
     cursor: [{ root: ['.cursor', 'projects'], ext: '.jsonl' }],
-    gemini: [{ root: ['.gemini', 'tmp'], ext: '.json' }],
     antigravity: [{ root: ['.gemini', 'antigravity-cli', 'conversations'], ext: '.db' }],
     droid: [{ root: ['.factory', 'sessions'], ext: '.jsonl' }],
     // Kimi splits a session across two files (session/discover.ts:4382-4384):
@@ -506,8 +523,8 @@ export function routineSpawnCwd(config) {
  *     modeFlags.plan so claudeAdapter.routineModeArgs can splice
  *     plan → acceptEdits / auto / skip.
  *
- * Returns undefined when `agent` is outside ROUTINE_AGENT_IDS (gemini, grok,
- * and every other harness the daemon does not fire locally).
+ * Returns undefined when `agent` is outside ROUTINE_AGENT_IDS (grok and every
+ * other harness the daemon does not fire locally).
  */
 export function bakeRoutineArgv(agent) {
     if (!ROUTINE_AGENT_IDS.includes(agent))
@@ -1577,6 +1594,7 @@ async function executeJobPlaced(config, deps, attempt) {
             // success (processFailed:false).
             if (isAuthFailureFromLog(attempt.logText, effectiveAgent, { processFailed: false })) {
                 const reason = authFailureReason(attempt.logText) ?? 'authentication_failed';
+                recordRoutineAuthOutcome(attemptAgent, config.account, attemptVersion, { ok: false, verdict: 'revoked', detail: reason });
                 finalizeRunMeta(meta, 'failed', attempt.exitCode ?? 1, { errorMessage: `auth_failed: ${reason}` });
                 writeRunMeta(meta);
                 timer.end({ status: 'failed', exitCode: meta.exitCode ?? undefined, runId, error: `auth_failed: ${reason}` });
@@ -1584,6 +1602,9 @@ async function executeJobPlaced(config, deps, attempt) {
                 archiveRoutineTranscripts(meta, runDir, overlayHome);
                 return { meta, reportPath: null };
             }
+            // A clean routine completion is real auth evidence — record it so a worker's
+            // token reads `last used ok` and a stale failure fact is cleared (PHNX-4116).
+            recordRoutineAuthOutcome(attemptAgent, config.account, attemptVersion, { ok: true });
             finalizeRunMeta(meta, 'completed', 0);
             writeRunMeta(meta);
             timer.end({ status: 'completed', exitCode: 0, runId });
@@ -1619,6 +1640,8 @@ async function executeJobPlaced(config, deps, attempt) {
         const failureErrorMessage = authReason
             ? `auth_failed: ${authReason}`
             : (attempt.error ?? undefined);
+        if (authFailed)
+            recordRoutineAuthOutcome(attemptAgent, config.account, attemptVersion, { ok: false, verdict: 'revoked', detail: authReason ?? undefined });
         finalizeRunMeta(meta, 'failed', attempt.exitCode ?? 1, failureErrorMessage ? { errorMessage: failureErrorMessage } : undefined);
         writeRunMeta(meta);
         timer.end({
@@ -2044,10 +2067,15 @@ async function executeJobDetachedClaimed(config, attempt, hooks) {
         // marker still catches an exit-0 auth failure on its own.
         if (isAuthFailureFromLog(logText, effectiveAgent, { processFailed: (code ?? 1) !== 0 })) {
             const reason = authFailureReason(logText) ?? 'authentication_failed';
+            recordRoutineAuthOutcome(effectiveAgent, config.account, meta.version, { ok: false, verdict: 'revoked', detail: reason });
             settle('failed', code ?? 1, `auth_failed: ${reason}`);
             return;
         }
         const inferred = inferFinalStatusFromLog(stdoutPath, effectiveAgent);
+        const finalStatus = inferred ? inferred.status : (code === 0 ? 'completed' : 'failed');
+        // A clean completion clears any stale auth-failure fact for this account.
+        if (finalStatus === 'completed')
+            recordRoutineAuthOutcome(effectiveAgent, config.account, meta.version, { ok: true });
         if (inferred) {
             settle(inferred.status, inferred.exitCode);
         }
@@ -2201,11 +2229,6 @@ export function extractReport(stdoutPath, agentType) {
                             : JSON.stringify(parsed.content);
                     }
                 }
-                if (agentType === 'gemini') {
-                    if (parsed.type === 'text' && parsed.text) {
-                        lastMessage = parsed.text;
-                    }
-                }
             }
             catch { /* malformed JSONL line */ }
         }