@phnx-labs/agents-cli 1.22.119 → 1.22.121

package/dist/lib/daemon/self-update-service.js

@@ -1,38 +1,3 @@
-/**
- * Daemon self-update service (PHNX-3695, "Fix 2").
- *
- * The daemon (`agents __daemon-run`) is a long-running background process that
- * historically opted OUT of the CLI's interactive auto-update: `bootstrap.ts`
- * force-sets `AGENTS_CLI_DISABLE_AUTO_UPDATE=1` for `__daemon-run`, so a
- * running daemon never picked up new agents-cli code until a human ran
- * `agents daemon restart`. R5 in the root CLAUDE.md ("An installed CLI and its
- * installed helpers auto-update from the public channel") is binding for the
- * interactive CLI path (`self-update.ts` / `agents upgrade`) but was silently
- * NOT held for the one process that runs unattended for days. This service
- * closes that gap for the daemon specifically, reusing the exact same
- * verified-install primitives `agents upgrade` already uses — it does not
- * fork or reimplement them.
- *
- * Model: verify-then-exit, not swap-in-place. A daemon cannot safely hot-swap
- * its own loaded JS mid-process (in-flight ticks, open sockets, a live
- * ServiceSupervisor). Instead this tick installs + BYTE-VERIFIES the new
- * package on disk, and only once that succeeds does it `process.exit(0)` —
- * the OS supervisor (launchd `KeepAlive` / systemd `Restart=always`, see
- * `daemon/AGENTS.md`'s crash-recovery model) relaunches the daemon, which
- * then boots the new code. Clients do not need to be told anything: a socket
- * client re-probes and reconnects when the daemon relaunches, and the
- * scheduler's atomic `(routine, scheduledFor)` claim (see
- * `docs/specifications.md` §Scheduling & execution singularity) means a routine
- * mid-fire at the moment of exit is deduped safely across the restart rather
- * than double-fired.
- *
- * Fail-closed is the whole point: every step below that can fail — the
- * registry check, the install, the post-install verify — leaves the OLD
- * daemon running untouched and logs a WARN/ERROR for the next tick to retry.
- * The daemon must never exit into code it has not proven is the real,
- * verified, requested version; an unverified exit would let the OS supervisor
- * relaunch-loop on a broken install.
- */
 import { BasePeriodicService } from './service.js';
 import { getCliVersion, getCliVersionFresh } from '../version.js';
 import { isDevVersionStamp } from '../startup/dev-build.js';
@@ -42,33 +7,13 @@ import { NPM_PACKAGE_NAME, deriveGlobalPrefix, detectPackageManager, downloadVer
 import { tryAutoPullSystemRepo } from '../git.js';
 import { getSystemAgentsDir } from '../state.js';
 import { runUmbrellaSync } from '../sync-umbrella.js';
+import { upgradeOutdatedClis } from '../cli-resources.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import { fileURLToPath } from 'url';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
-/** Runs roughly every 75 minutes — self-update is not urgent (unlike self-heal's 6h drift repair, it changes running code, so it stays well under a day but still infrequent). */
 const SELF_UPDATE_TICK_MS = 75 * 60_000;
-/**
- * Hard cap per tick: a real download + npm/bun install + verify can
- * legitimately take minutes on a slow link. 15 minutes matches the task's
- * stated budget and is short relative to the ~75min cadence. Exported so an
- * on-demand self-update trigger ({@link triggerSelfUpdateInBackground}) can bound
- * its own `AbortController` on the SAME budget the periodic tick runs under —
- * one deadline, not two independently-tuned numbers that could drift apart.
- * (Its former transport, the `request-self-update` verb on the daemon's browser
- * IPC socket, left with the standalone `browser` CLI in PHNX-4101; the mechanism
- * stays for a future on-demand caller.)
- */
 const SELF_UPDATE_DEADLINE_MS = 15 * 60_000;
-/**
- * First tick fires 5 minutes after daemon boot — deliberately longer than
- * self-heal's 30s stagger (`self-heal-service.ts`): self-heal repairs local
- * drift and is cheap/safe to run immediately, while self-update can replace
- * the running package and exit the process, which should never be the very
- * first thing a freshly-started daemon does (give the box a moment to finish
- * settling — shims, PATH, other services' startup ticks — before considering
- * a restart). Every later tick still fires on the normal cadence.
- */
 const SELF_UPDATE_STARTUP_DELAY_MS = 5 * 60_000;
 async function fetchLatestNpmMetadata(signal) {
     const response = await fetch(`https://registry.npmjs.org/${NPM_PACKAGE_NAME}/latest`, { signal });
@@ -83,30 +28,7 @@ async function fetchLatestNpmMetadata(signal) {
     }
     return { version: data.version, integrity: data.dist.integrity, tarball: data.dist.tarball };
 }
-/**
- * Install + byte-verify `metadata` into `packageRoot`'s install, exactly the
- * sequence `bootstrap.ts`'s `installResolvedPackage` runs for `agents
- * upgrade` (download+integrity-verify -> sweep stale staging -> package-
- * manager install -> verify installed version -> refresh alias shims).
- * `bootstrap.ts` cannot be imported here — it runs side-effecting top-level
- * code (argv parsing, command registration) on import, which the daemon must
- * never trigger — so this is the same primitives from `self-update.ts`
- * composed directly, not a fork of the upgrade logic.
- *
- * `signal` is threaded into EVERY step's own `signal` option
- * (`downloadVerifiedTarball` / `installPackageIntoPrefix` /
- * `installPackageWithBun`, all in `self-update.ts`) rather than raced against
- * from the outside: those primitives kill the underlying fetch/child process
- * on abort and their promise rejects only once that real cancellation has
- * happened. A wrapper that merely stopped AWAITING an unkillable operation
- * (the prior approach here) left an orphaned `npm install -g`/`bun add -g`
- * writing into the shared global prefix — which the very next tick's fresh
- * install (started as soon as the supervisor's backoff fires, seconds later)
- * would then race into the same directory. Real cancellation is what makes
- * `attemptSelfUpdateAndExit`'s `inFlightAttempt` dedupe (below) an actual
- * guarantee instead of a guard whose lifetime is shorter than the operation
- * it's guarding (found in review, PHNX-3695).
- */
+// Exit is allowed only after tarball, installed version, shims, and global bin links are verified.
 export async function installAndVerifyDefault(metadata, packageRoot, signal) {
     const tarball = await downloadVerifiedTarball(metadata.tarball, metadata.integrity, 60_000, signal);
     try {
@@ -123,19 +45,10 @@ export async function installAndVerifyDefault(metadata, packageRoot, signal) {
             await fs.promises.rm(path.dirname(tarball), { recursive: true, force: true });
         }
         catch {
-            /* leave it for the OS temp sweep */
         }
     }
     await verifyInstalledVersion(packageRoot, metadata.version);
     await refreshAliasShims(packageRoot, signal);
-    // PHNX-2768: mirror `bootstrap.ts`'s `installResolvedPackage` — an
-    // `--ignore-scripts` install (both package-manager paths above) can leave
-    // the package.json at the new version but the global bin links
-    // (agents/ag/browser/computer) GONE. Without this, a self-update tick could
-    // exit `updated: true` while every operator-typed `agents` command on that
-    // box now reads "command not found," with no signal anywhere pointing at
-    // why. Same fail-loud contract as the interactive path: a link that cannot
-    // be made to resolve fails the whole attempt rather than reporting success.
     if (detectPackageManager(packageRoot) !== 'bun' && process.platform !== 'win32') {
         const prefix = deriveGlobalPrefix(packageRoot);
         const repairs = await ensureGlobalBinLinks(packageRoot, prefix);
@@ -171,9 +84,6 @@ function defaultSelfUpdateDeps() {
             }
         },
         syncLocal: async () => {
-            // Reconcile-only (no fetch — the .system pull above already fetched);
-            // best-effort, same as the system-repo pull: a declined resource here
-            // is not a self-update failure.
             await runUmbrellaSync({
                 flags: { local: true },
                 log: () => { },
@@ -183,28 +93,8 @@ function defaultSelfUpdateDeps() {
         },
     };
 }
-/**
- * Dedupes concurrent callers onto ONE in-flight attempt. The periodic tick
- * and an on-demand `request-self-update` IPC call (possibly several, if more
- * than one version-skewed client reconnects at once) can overlap in the same
- * process — without this, two concurrent `installAndVerify` calls race on the
- * same package-manager install directory. Keyed process-wide (not per-deps)
- * since production always shares one `defaultSelfUpdateDeps()` install target;
- * tests inject distinct `deps` per case and don't run concurrently with each
- * other, so this never cross-contaminates test outcomes.
- */
+// Periodic and on-demand triggers share the actual in-flight install, not merely its caller's wait.
 let inFlightAttempt = null;
-/**
- * Core self-update decision + action, shared by the periodic tick
- * ({@link SelfUpdateService.onTick}) and the on-demand trigger
- * ({@link triggerSelfUpdateInBackground}) — one implementation, so a
- * version-skew "update now" caller runs exactly the same fail-closed logic as the
- * scheduled sweep. Returns rather than throws so callers decide their own exit
- * timing (the periodic service exits immediately; an on-demand caller that must
- * respond to a client BEFORE exiting delays via {@link scheduleSelfUpdateExit}).
- * Concurrent callers share one in-flight attempt rather than racing separate
- * installs.
- */
 export async function attemptSelfUpdateAndExit(ctx, signal, deps = defaultSelfUpdateDeps()) {
     if (inFlightAttempt)
         return inFlightAttempt;
@@ -219,24 +109,12 @@ export async function attemptSelfUpdateAndExit(ctx, signal, deps = defaultSelfUp
     }
 }
 async function runSelfUpdateAttempt(ctx, signal, deps) {
-    // One decline source for the periodic tick and the on-demand IPC path
-    // (`selfUpdateSyncDeclineReason`): dev build; shadowed install — except when
-    // the install on disk is already newer than the running code, because a
-    // relaunch installs nothing and a second `agents` on the box is irrelevant to
-    // it (otherwise a shadowed worker never leaves the release it booted on).
     const syncDecline = selfUpdateSyncDeclineReason(deps);
     if (syncDecline)
         return { updated: false, reason: syncDecline };
-    // Another agents process (an operator's `agents` command auto-updating, an
-    // `agents upgrade`, the installer) may already have replaced the install
-    // under this daemon. The code on disk is then newer than the code in memory
-    // and there is nothing to download — that path verified its install before
-    // it returned. Exit for the OS-supervisor relaunch, once the install has
-    // settled: npm's reify is atomic but bun's is not, so a version bump alone
-    // could be bun mid-extraction (`installLooksSettled`). Waiting one tick is
-    // cheap; relaunching into a half-written tree is a supervisor crash-loop.
     const current = deps.currentVersion();
     const installed = deps.installedVersion();
+    // Bun writes incrementally, so a newer on-disk version is trusted only after the install settles.
     if (installedIsNewerThanRunning(installed, current)) {
         if (!deps.installedIsSettled()) {
             ctx.log('INFO', `self-update: the install on disk is ${installed} (this daemon is running ${current}) but it is still settling; relaunch deferred to the next tick`);
@@ -267,11 +145,7 @@ async function runSelfUpdateAttempt(ctx, signal, deps) {
         ctx.log('ERROR', `self-update: install/verify of ${metadata.version} failed, staying on ${current}: ${message}`);
         return { updated: false, reason: 'install or verify failed' };
     }
-    // Best-effort from here: the CLI package itself is already installed and
-    // byte-verified, so a failure pulling the companion .system repo or
-    // reconciling resources must not undo a good CLI upgrade or block the exit
-    // that lets the OS supervisor relaunch onto it — it is logged and left for
-    // the NEXT tick (which runs on the new code) to retry.
+    // Post-install repo and local reconciliation is best-effort after install verification succeeds.
     try {
         await deps.syncSystemRepo();
     }
@@ -289,53 +163,15 @@ async function runSelfUpdateAttempt(ctx, signal, deps) {
     ctx.log('INFO', `self-update: verified ${current} -> ${metadata.version}; exiting for OS-supervisor relaunch`);
     return { updated: true };
 }
-/** How long `scheduleSelfUpdateExit` waits before `process.exit(0)` — long enough for an IPC handler's `socket.write` to flush to the OS. */
+// Give an on-demand caller's IPC response time to flush before the supervised process exits.
 const SELF_UPDATE_EXIT_DELAY_MS = 250;
 let exitScheduled = false;
-/**
- * Schedule the process exit for a verified self-update, exactly once, no
- * matter how many callers observe `outcome.updated` on the shared
- * `inFlightAttempt` promise. The periodic tick and an on-demand caller can both
- * be awaiting that SAME promise — if the tick's continuation ran an immediate
- * `process.exit(0)` while an on-demand caller's continuation had not yet flushed
- * its response to a client, the tick's exit could win the race and the client
- * would see a closed socket before any response (found in review, PHNX-3695).
- * Routing every caller through this one guarded, always-delayed scheduling point
- * means the delay protects EVERY caller's in-flight response.
- */
 export function scheduleSelfUpdateExit() {
     if (exitScheduled)
         return;
     exitScheduled = true;
     setTimeout(() => process.exit(0), SELF_UPDATE_EXIT_DELAY_MS);
 }
-/**
- * Fire an on-demand self-update in the BACKGROUND and return its (bounded)
- * promise WITHOUT the caller having to await it — the reusable primitive for a
- * "update now" trigger that must respond to a client before the daemon exits.
- * Awaiting the full check→download→install→verify inline would park the caller
- * for tens of seconds (worst case ~15 min), the client-stall PHNX-3605 was
- * written to prevent; instead a trigger responds "triggered" immediately and
- * lets this run in the background — the daemon does install→verify→exit(0) on its
- * own, the OS supervisor relaunches it, and the client reconnects.
- *
- * (Its one former production caller was the `request-self-update` verb on the
- * daemon's browser IPC socket, removed with the standalone `browser` CLI in
- * PHNX-4101. The primitive stays — tested and reusable — for a future on-demand
- * trigger; the periodic tick does not use it, exiting inline instead.)
- *
- * The work still shares the module-level {@link attemptSelfUpdateAndExit}
- * `inFlightAttempt` guard, so a concurrent trigger (or the periodic tick) can't
- * race a second install into the same prefix. It is bounded by
- * {@link SELF_UPDATE_DEADLINE_MS} via an `AbortController` nobody awaits (the
- * timer is `unref`'d so it never keeps the daemon alive on its own and never
- * dangles in a test). Fail-closed is preserved end to end:
- * `runSelfUpdateAttempt` already turns an install/verify failure into a
- * not-updated outcome that leaves the running daemon untouched. The caller
- * schedules the one decoupled {@link scheduleSelfUpdateExit} off the returned
- * promise once `updated` is true, so the exit still fires after the caller's
- * response has flushed.
- */
 export function triggerSelfUpdateInBackground(ctx, deps = defaultSelfUpdateDeps()) {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), SELF_UPDATE_DEADLINE_MS);
@@ -343,24 +179,9 @@ export function triggerSelfUpdateInBackground(ctx, deps = defaultSelfUpdateDeps(
         timeout.unref();
     return attemptSelfUpdateAndExit(ctx, controller.signal, deps).finally(() => clearTimeout(timeout));
 }
-/**
- * The subset of self-update decline checks that are INSTANT and network-free —
- * a dev build, or a shadowed install. The on-demand IPC handler
- * (`request-self-update`) runs these SYNCHRONOUSLY so a version-skewed browser
- * client gets the PHNX-3605 "nothing changed, not evicting" advisory
- * immediately, instead of a "triggered" it would never act on. The remaining
- * checks (registry probe, already-current, install/verify) stay inside the
- * backgrounded {@link attemptSelfUpdateAndExit} so the handler never blocks on
- * the network or the install. This is the single source of the two instant
- * decline reasons — {@link runSelfUpdateAttempt} calls it too, so the on-demand
- * decline text can never drift from the periodic tick's. Returns the decline
- * reason, or `null` to proceed to the (backgrounded) install path.
- */
 export function selfUpdateSyncDeclineReason(deps = defaultSelfUpdateDeps()) {
     if (deps.isDevBuild())
         return DEV_BUILD_DECLINE;
-    // A stale install is never declined by a shadow: the relaunch installs nothing.
-    // (Whether that install has SETTLED is the attempt's call, not a decline.)
     if (deps.detectShadow() && !installedIsNewerThanRunning(deps.installedVersion(), deps.currentVersion())) {
         return SHADOW_DECLINE;
     }
@@ -368,13 +189,11 @@ export function selfUpdateSyncDeclineReason(deps = defaultSelfUpdateDeps()) {
 }
 const DEV_BUILD_DECLINE = 'dev build — self-update is a no-op';
 const SHADOW_DECLINE = 'another agents binary shadows this install — self-update is a no-op';
-/** True when the package on disk is a strictly newer release than the one this process booted with. */
 function installedIsNewerThanRunning(installed, running) {
     if (installed === 'unknown' || running === 'unknown')
         return false;
     return compareVersions(installed, running) > 0;
 }
-/** The shadow decline is logged once per daemon process — a silent permanent no-op is how eight workers sat on stale code unnoticed (2026-09-07). */
 let shadowDeclineLogged = false;
 export class SelfUpdateService extends BasePeriodicService {
     id = 'self-update';
@@ -382,12 +201,11 @@ export class SelfUpdateService extends BasePeriodicService {
     deadlineMs = SELF_UPDATE_DEADLINE_MS;
     startupDelayMs = SELF_UPDATE_STARTUP_DELAY_MS;
     async onStart(_ctx) {
-        // No connections/handles to open — each tick checks the registry fresh.
     }
     async onStop() {
-        // Nothing to release — the supervisor's timer teardown is the only cleanup needed.
     }
     async onTick(ctx, signal) {
+        const deadlineAt = Date.now() + this.deadlineMs;
         const outcome = await attemptSelfUpdateAndExit(ctx, signal);
         if (outcome.updated) {
             scheduleSelfUpdateExit();
@@ -398,5 +216,24 @@ export class SelfUpdateService extends BasePeriodicService {
             ctx.log('WARN', `self-update: ${outcome.reason}; this daemon will only move to a new release after another agents ` +
                 'process upgrades the install (`agents doctor` lists the shadow copy)');
         }
+        await upgradeHostClis(ctx, signal, deadlineAt);
+    }
+}
+export async function upgradeHostClis(ctx, signal, deadlineAt, cwd) {
+    let results;
+    try {
+        results = await upgradeOutdatedClis({ signal, deadlineAt, cwd });
+    }
+    catch (err) {
+        ctx.log('WARN', `host-cli upgrade: could not read CLI manifests: ${err.message}`);
+        return;
+    }
+    for (const r of results) {
+        if (r.status === 'upgraded')
+            ctx.log('INFO', `host-cli upgrade: ${r.name} ${r.from} -> ${r.to}`);
+        else if (r.status === 'failed')
+            ctx.log('WARN', `host-cli upgrade: ${r.name} failed, left as is: ${r.reason}`);
+        else if (r.status === 'skipped' && r.reason.startsWith('outdated'))
+            ctx.log('WARN', `host-cli upgrade: ${r.name} ${r.reason}`);
     }
 }

package/dist/lib/daemon/service.d.ts

@@ -1,89 +1,28 @@
-/**
- * DaemonService contract (RUSH-3193 P1).
- *
- * Historically the daemon's background services were bare `setInterval` closures
- * inside one long `runDaemon()` (daemon.ts), sharing one event loop with no
- * per-service error boundary or deadline. A throw escaping a tick's local
- * try/catch hits the process-wide handler and kills every service; a tick that
- * hangs on an unbounded await latches its in-flight guard `true` forever and
- * silently freezes that service for the daemon's life.
- *
- * This module defines the service shape a `ServiceSupervisor` (supervisor.ts)
- * drives instead: one contract per service, owned timer, per-tick deadline,
- * and a health record the supervisor can report without the service having to
- * know it is being supervised.
- */
 import type { DaemonServiceId } from '../daemon-services.js';
-/**
- * Lifecycle state a supervised service can be in. There is no `parked` state:
- * a throw keeps the service `running` (it retries on the next tick) and a
- * deadline breach exits the whole daemon for a supervised OS restart (PHNX-4116).
- */
 export type ServiceState = 'idle' | 'running' | 'stopped';
-/** A service's most recently observed health, as reported by the supervisor. */
 export interface ServiceHealth {
     state: ServiceState;
-    /** `Date.now()` of the last tick that completed without throwing or timing out. */
     lastRunMs: number;
     lastError?: string;
-    /** Consecutive failed/timed-out ticks since the last success. */
     consecutiveFailures: number;
 }
-/** Shared context every service receives at start/tick time. */
 export interface DaemonContext {
     log: (level: string, message: string) => void;
 }
-/** Base contract every supervised daemon service implements. */
 export interface DaemonService {
     readonly id: DaemonServiceId;
     start(ctx: DaemonContext): Promise<void>;
     stop(): Promise<void>;
-    /** `stop()` then `start()` — used by the supervisor's circuit-breaker (and, in future, an on-demand `daemon services restart <id>` command — not wired up yet). */
     restart(): Promise<void>;
     health(): ServiceHealth;
 }
-/** A service the supervisor ticks on a fixed interval, under a hard per-tick deadline. */
 export interface PeriodicService extends DaemonService {
     readonly intervalMs: number;
-    /**
-     * Hard cap per tick. An over-budget tick is a HANG that cannot be retried
-     * in-process (its promise may never settle), so the supervisor aborts the
-     * tick's {@link AbortSignal} and EXITS the daemon (code 70) for a supervised
-     * systemd/launchd restart (PHNX-4116) — there is no park or in-process backoff.
-     * A tick that awaits `signal` (or forwards it to its I/O) can observe the
-     * deadline and unwind cleanly before the process exits.
-     */
     readonly deadlineMs: number;
-    /**
-     * Delay before the FIRST tick after `start()`, in ms. Every later tick
-     * still fires on the normal `intervalMs` cadence — this only staggers the
-     * boot-time tick. Default (omitted) is 0, the supervisor's baseline
-     * immediate-first-tick behavior. Set this when a service's first-boot work
-     * needs something else (shims, PATH) to settle before it runs, rather than
-     * firing at daemon startup.
-     */
     readonly startupDelayMs?: number;
-    /**
-     * Run one tick. `signal` aborts when the supervisor's {@link deadlineMs}
-     * elapses (or the service is being stopped), so a well-behaved tick threads it
-     * into its awaits — `fetch(url, { signal })`, an ssh/exec spawn, a
-     * cancellable sleep — to bound its own I/O instead of leaking a runaway await.
-     */
     tick(ctx: DaemonContext, signal: AbortSignal): Promise<void>;
 }
 export declare function isPeriodicService(service: DaemonService): service is PeriodicService;
-/**
- * Convenience base for a lifecycle-only (non-periodic) daemon service.
- *
- * Concrete subclasses implement `onStart` and `onStop`; the base owns the
- * `ServiceHealth` record and the `restart()` default (`stop` + `start`).
- * Unlike `BasePeriodicService` there is no tick — the supervisor just calls
- * `start()` once at boot, keeps the service marked `running`, and calls
- * `stop()` at shutdown.
- *
- * `lastRunMs` is set to the time `start()` completed, so `supervisor.health()`
- * carries a meaningful "last known healthy" timestamp even with no periodic ticks.
- */
 export declare abstract class BaseDaemonService implements DaemonService {
     abstract readonly id: DaemonServiceId;
     protected ctx: DaemonContext | null;
@@ -95,13 +34,6 @@ export declare abstract class BaseDaemonService implements DaemonService {
     restart(): Promise<void>;
     health(): ServiceHealth;
 }
-/**
- * Convenience base for a periodic service: owns the `ServiceHealth` record so
- * concrete services only implement the three lifecycle hooks. `restart()`
- * defaults to `stop()` then `start()` against the last context passed to
- * `start()`, which is what every current-generation service needs — a
- * concrete service overrides it only if it must reuse state across a restart.
- */
 export declare abstract class BasePeriodicService implements PeriodicService {
     abstract readonly id: DaemonServiceId;
     abstract readonly intervalMs: number;
@@ -110,11 +42,6 @@ export declare abstract class BasePeriodicService implements PeriodicService {
     private healthRecord;
     protected abstract onStart(ctx: DaemonContext): Promise<void>;
     protected abstract onStop(): Promise<void>;
-    /**
-     * Run one tick. `signal` aborts at the supervisor's deadline (or on stop);
-     * thread it into the tick's own awaits to bound its I/O. A subclass that does
-     * no cancellable work may implement `onTick(ctx)` and ignore the second arg.
-     */
     protected abstract onTick(ctx: DaemonContext, signal: AbortSignal): Promise<void>;
     start(ctx: DaemonContext): Promise<void>;
     stop(): Promise<void>;

package/dist/lib/daemon/service.js

@@ -1,18 +1,3 @@
-/**
- * DaemonService contract (RUSH-3193 P1).
- *
- * Historically the daemon's background services were bare `setInterval` closures
- * inside one long `runDaemon()` (daemon.ts), sharing one event loop with no
- * per-service error boundary or deadline. A throw escaping a tick's local
- * try/catch hits the process-wide handler and kills every service; a tick that
- * hangs on an unbounded await latches its in-flight guard `true` forever and
- * silently freezes that service for the daemon's life.
- *
- * This module defines the service shape a `ServiceSupervisor` (supervisor.ts)
- * drives instead: one contract per service, owned timer, per-tick deadline,
- * and a health record the supervisor can report without the service having to
- * know it is being supervised.
- */
 export function isPeriodicService(service) {
     const candidate = service;
     return typeof candidate.tick === 'function' && typeof candidate.intervalMs === 'number' && typeof candidate.deadlineMs === 'number';
@@ -20,18 +5,6 @@ export function isPeriodicService(service) {
 function blankHealth() {
     return { state: 'idle', lastRunMs: 0, consecutiveFailures: 0 };
 }
-/**
- * Convenience base for a lifecycle-only (non-periodic) daemon service.
- *
- * Concrete subclasses implement `onStart` and `onStop`; the base owns the
- * `ServiceHealth` record and the `restart()` default (`stop` + `start`).
- * Unlike `BasePeriodicService` there is no tick — the supervisor just calls
- * `start()` once at boot, keeps the service marked `running`, and calls
- * `stop()` at shutdown.
- *
- * `lastRunMs` is set to the time `start()` completed, so `supervisor.health()`
- * carries a meaningful "last known healthy" timestamp even with no periodic ticks.
- */
 export class BaseDaemonService {
     ctx = null;
     healthRecord = blankHealth();
@@ -55,13 +28,6 @@ export class BaseDaemonService {
         return { ...this.healthRecord };
     }
 }
-/**
- * Convenience base for a periodic service: owns the `ServiceHealth` record so
- * concrete services only implement the three lifecycle hooks. `restart()`
- * defaults to `stop()` then `start()` against the last context passed to
- * `start()`, which is what every current-generation service needs — a
- * concrete service overrides it only if it must reuse state across a restart.
- */
 export class BasePeriodicService {
     ctx = null;
     healthRecord = blankHealth();

package/dist/lib/daemon/session-index-service.d.ts

@@ -1,15 +1,3 @@
-/**
- * Session-index warm service (RUSH-2682), migrated onto `ServiceSupervisor`
- * (RUSH-3193 P1) as the proof-of-concept periodic service.
- *
- * Incrementally scans this host's transcript dirs into the local index so a
- * locally-started session is discoverable within seconds, not on the next
- * unrelated `agents sessions*` call. Single-flight via the DB scan claim in
- * `scanSessionsIncremental` — a concurrent foreground scan is a skip, not a
- * failure. Previously a bare `setInterval` in `runDaemon()`
- * (daemon.ts:1118-1137); the supervisor now owns its timer, error boundary,
- * and deadline instead.
- */
 import { BasePeriodicService, type DaemonContext } from './service.js';
 import type { DaemonServiceId } from '../daemon-services.js';
 export declare class SessionIndexService extends BasePeriodicService {

package/dist/lib/daemon/session-index-service.js

@@ -1,44 +1,21 @@
-/**
- * Session-index warm service (RUSH-2682), migrated onto `ServiceSupervisor`
- * (RUSH-3193 P1) as the proof-of-concept periodic service.
- *
- * Incrementally scans this host's transcript dirs into the local index so a
- * locally-started session is discoverable within seconds, not on the next
- * unrelated `agents sessions*` call. Single-flight via the DB scan claim in
- * `scanSessionsIncremental` — a concurrent foreground scan is a skip, not a
- * failure. Previously a bare `setInterval` in `runDaemon()`
- * (daemon.ts:1118-1137); the supervisor now owns its timer, error boundary,
- * and deadline instead.
- */
 import { BasePeriodicService } from './service.js';
 import { runDeferredToolIndex, runSessionIndexWarmTick } from '../daemon-ticks.js';
-/** Matches the historical inline interval (daemon.ts SESSION_INDEX_WARM_TICK_MS). */
 const SESSION_INDEX_WARM_TICK_MS = 20_000;
-/** Hard cap per tick — well above a healthy incremental scan, short enough that a hang never freezes the service for long. */
 const SESSION_INDEX_WARM_DEADLINE_MS = 60_000;
 export class SessionIndexService extends BasePeriodicService {
     id = 'session-index';
     intervalMs = SESSION_INDEX_WARM_TICK_MS;
     deadlineMs = SESSION_INDEX_WARM_DEADLINE_MS;
     async onStart(_ctx) {
-        // No connections/handles to open — the scan claim itself is per-tick state.
     }
     async onStop() {
-        // Nothing to release — the supervisor's timer teardown is the only cleanup needed.
     }
     async onTick(ctx) {
         const { indexed, claimed } = await runSessionIndexWarmTick();
-        // Log only when the tick did something. A silent tick is what let it
-        // report 0 forever unnoticed (RUSH-2691); a line on every idle 20s tick
-        // would drown the log, so the steady state (claimed, nothing changed)
-        // stays quiet and both interesting outcomes are visible.
         if (!claimed)
             ctx.log('INFO', 'session-index warm: skipped, another process holds the scan claim');
         else if (indexed > 0)
             ctx.log('INFO', `session-index warm: indexed ${indexed} transcript(s)`);
-        // Deferred tool-index pass (PHNX-3411): fill tool_scan_ledger rows for
-        // harnesses whose scanner produces no events. Runs only when the warm tick
-        // claimed the scan lock (i.e. we are the active indexer this tick).
         if (claimed) {
             const { indexed: toolIndexed } = await runDeferredToolIndex();
             if (toolIndexed > 0)

package/dist/lib/daemon/session-state-service.d.ts

@@ -1,11 +1,3 @@
-/**
- * Live-session metadata publisher as a supervised periodic service.
- *
- * This is the single daemon-owned writer behind `sessions watch`: consumers
- * announce reader presence, and the service publishes an incremental journal
- * snapshot immediately on the idle->active edge and every 15 seconds while a
- * reader remains. Callers consume the row; they do not run their own gather.
- */
 import type { DaemonServiceId } from '../daemon-services.js';
 import { BasePeriodicService, type DaemonContext } from './service.js';
 export declare class SessionStateService extends BasePeriodicService {

package/dist/lib/daemon/session-state-service.js

@@ -1,11 +1,3 @@
-/**
- * Live-session metadata publisher as a supervised periodic service.
- *
- * This is the single daemon-owned writer behind `sessions watch`: consumers
- * announce reader presence, and the service publishes an incremental journal
- * snapshot immediately on the idle->active edge and every 15 seconds while a
- * reader remains. Callers consume the row; they do not run their own gather.
- */
 import { runActiveSessionsWarmTick } from '../daemon-ticks.js';
 import { watchActiveSessionsReaderPresence } from '../session/session-cache.js';
 import { BasePeriodicService } from './service.js';

package/dist/lib/daemon/session-summarizer-service.d.ts

@@ -1,17 +1,3 @@
-/**
- * Session-summarizer service (PHNX-3939).
- *
- * The single daemon-owned executor that computes a per-session goal / progress
- * checkpoints / checklist and writes them to the transcript-keyed
- * `session_summaries` cache, from which the display/merge path serves them onto
- * the `sessions watch` stream. It NEVER runs on a request path.
- *
- * Off by default: `runSummarizerPass` no-ops unless `summarizer.enabled` and a
- * model endpoint (`summarizer.baseUrl` + `summarizer.model`) are configured, so a
- * daemon with the feature unconfigured makes zero model calls. Reader-gated and
- * bounded per tick like the other session services, so it costs nothing while no
- * one is watching.
- */
 import { BasePeriodicService, type DaemonContext } from './service.js';
 import type { DaemonServiceId } from '../daemon-services.js';
 export declare class SessionSummarizerService extends BasePeriodicService {

package/dist/lib/daemon/session-summarizer-service.js

@@ -1,37 +1,19 @@
-/**
- * Session-summarizer service (PHNX-3939).
- *
- * The single daemon-owned executor that computes a per-session goal / progress
- * checkpoints / checklist and writes them to the transcript-keyed
- * `session_summaries` cache, from which the display/merge path serves them onto
- * the `sessions watch` stream. It NEVER runs on a request path.
- *
- * Off by default: `runSummarizerPass` no-ops unless `summarizer.enabled` and a
- * model endpoint (`summarizer.baseUrl` + `summarizer.model`) are configured, so a
- * daemon with the feature unconfigured makes zero model calls. Reader-gated and
- * bounded per tick like the other session services, so it costs nothing while no
- * one is watching.
- */
 import { BasePeriodicService } from './service.js';
 import { runSummarizerPass } from '../summarizer/pass.js';
-/** Slower than the state tick — a summary is a coarse signal, not live status. */
 const SESSION_SUMMARIZER_TICK_MS = 20_000;
-/** Hard cap per tick; a local model call is bounded, this leaves generous headroom. */
 const SESSION_SUMMARIZER_DEADLINE_MS = 60_000;
 export class SessionSummarizerService extends BasePeriodicService {
     id = 'session-summarizer';
     intervalMs = SESSION_SUMMARIZER_TICK_MS;
     deadlineMs = SESSION_SUMMARIZER_DEADLINE_MS;
     async onStart(_ctx) {
-        // No handles to open — each tick reads config + the warm session cache fresh.
     }
     async onStop() {
-        // Nothing to release.
     }
     async onTick(ctx, signal) {
         const r = await runSummarizerPass({ signal });
         if (r.disabled)
-            return; // off / unconfigured — stay silent
+            return;
         if (r.computed > 0 || r.skipped > 0) {
             ctx.log('INFO', `session-summarizer: computed ${r.computed}, skipped ${r.skipped}, reused ${r.reused}`);
         }