@phnx-labs/agents-cli 1.22.119 → 1.22.121

package/dist/lib/daemon/attention-notify-service.js

@@ -35,36 +35,22 @@ import { notifyDesktop } from '../menubar/notify-desktop.js';
 import { BasePeriodicService } from './service.js';
 const ATTENTION_NOTIFY_TICK_MS = 5_000;
 const ATTENTION_NOTIFY_DEADLINE_MS = 10_000;
-/** Feed retention: a notified-ledger sidecar older than this is pruned. */
 const LEDGER_RETENTION_MS = 14 * 24 * 60 * 60 * 1000;
-/** Prune the ledger at most this often — the dir is tiny, but a dir walk every 5s is waste. */
 const LEDGER_PRUNE_EVERY_MS = 60 * 60 * 1000;
-/** UNUserNotificationCenter caps action buttons; the argv contract is ≤ 6 choices. */
 const MAX_CHOICES = 6;
-/** Body cap — a banner truncates anyway, and a wall of text is noise. */
 const BODY_MAX = 200;
-/** Which attention kinds produce a banner, and the category + title verb each carries. */
 const BANNER_KINDS = {
     permission: { category: 'permission', label: 'Command approval' },
     question: { category: 'question', label: 'Question' },
     plan_review: { category: 'plan_review', label: 'Plan review' },
     stall: { category: 'failure', label: 'Failed' },
     failure: { category: 'failure', label: 'Failed' },
-    // A request record the CLI could not confirm is still pending: the `failure`
-    // category is the companion's one button set with no approval action — just
-    // Open terminal — which is exactly the honest offer here.
     unverified: { category: 'failure', label: 'Could not verify request' },
 };
 function shorten(text, max = BODY_MAX) {
     const flat = text.replace(/\s+/g, ' ').trim();
     return flat.length > max ? `${flat.slice(0, max - 1)}…` : flat;
 }
-/**
- * The banner for one attention item, or `undefined` when its kind does not
- * notify (`done` comes from the run process; `declared`/`review` are surfaced in
- * the feed, not as a native banner). Pure — the service and its test both build
- * through here, so what ships is what is asserted.
- */
 export function buildAttentionNotification(item, session) {
     const spec = BANNER_KINDS[item.kind];
     if (!spec)
@@ -85,8 +71,6 @@ export function buildAttentionNotification(item, session) {
     const subtitle = [item.host, item.project].filter(Boolean).join(' · ');
     if (subtitle)
         n.subtitle = subtitle;
-    // A stall/failure has no answerable option list — it offers one button that
-    // opens the session's terminal. Everything else carries the reconciled choices.
     const choices = spec.category === 'failure'
         ? [{ id: 'open-terminal', label: 'Open terminal' }]
         : (item.choices ?? []).slice(0, MAX_CHOICES).map((c) => ({ id: c.id, label: c.label }));
@@ -113,10 +97,8 @@ export class AttentionNotifyService extends BasePeriodicService {
         this.now = opts.now ?? Date.now;
     }
     async onStart(_ctx) {
-        // No handles to open — each tick re-reads sessions and the ledger.
     }
     async onStop() {
-        // Nothing to release — the supervisor's timer teardown is the only cleanup.
     }
     async onTick(ctx) {
         const sessions = await this.getSessions();
@@ -124,8 +106,6 @@ export class AttentionNotifyService extends BasePeriodicService {
         for (const session of sessions) {
             if (!session.sessionId)
                 continue;
-            // ActiveSession.host names the terminal app; the reconciler's host is the
-            // device scope, so the attention key is fleet-routable (mirrors watch.ts).
             const projected = { ...session, host };
             const blockId = blockIdForSession(session.sessionId);
             const item = reconcileAttention({
@@ -147,12 +127,10 @@ export class AttentionNotifyService extends BasePeriodicService {
         }
         await this.pruneLedger();
     }
-    /** Filesystem-safe sidecar name for an attention key (`host/session/generation`). */
     ledgerPath(key) {
         return path.join(this.ledgerDir, encodeURIComponent(key));
     }
     async hasNotified(key) {
-        // fs/promises has no existsSync; a stat that rejects with ENOENT is the miss.
         try {
             await fs.promises.stat(this.ledgerPath(key));
             return true;
@@ -175,7 +153,7 @@ export class AttentionNotifyService extends BasePeriodicService {
             names = await fs.promises.readdir(this.ledgerDir);
         }
         catch {
-            return; // No ledger dir yet — nothing to prune.
+            return;
         }
         for (const name of names) {
             const filePath = path.join(this.ledgerDir, name);
@@ -185,7 +163,6 @@ export class AttentionNotifyService extends BasePeriodicService {
                     await fs.promises.rm(filePath, { force: true });
             }
             catch {
-                // A file that vanished mid-walk is already gone; skip it.
             }
         }
     }

package/dist/lib/daemon/auth-sync-service.d.ts

@@ -1,31 +1,3 @@
-/**
- * Reserved `auth` bundle fleet sync as a `PeriodicService` (PHNX-2371).
- *
- * This tick owns only the NON-git duties of auth sync: it materializes worker
- * slots from durable keys already on the box, then (on the elected headed
- * publisher) provisions peers missing a reserved key by pushing the credential
- * over SSH. The secret never enters Git.
- *
- * It runs no transport of its own (PHNX-4051): the per-account readiness
- * verdicts it reads are published and delivered by the usage-sync tick's SSH
- * exchange, which stores each peer's reply at `devices/<peer>/daemon-state.json`
- * stamped `receivedAt`. This tick keeps its own deadline and circuit breaker, so
- * a hung peer SSH push parks only auth-sync and never the usage delivery.
- *
- * The pushes read each peer's OWN reply file (PHNX-4116 PR 5): a peer reporting
- * a `missing` verdict for an account is pushed that account's key; a peer that
- * has never sent a reply (no file), or whose reply carries no `accounts.rows`
- * field (an older CLI — fail closed), is skipped this tick and logged at INFO.
- * Presence is also gated on a delivered-fingerprint match, so a re-mint
- * (`accounts login` bumps `workerCredential.mintedAt` while the old token still
- * authenticates) re-pushes the rotated key within a tick instead of reading
- * `present` forever. The push is idempotent, so a stale reply is harmless — a
- * stale "has key" is fine, a stale "missing key" costs one redundant push —
- * which is why the per-peer `receivedAt` replaced the old global freshness gate
- * (`readLastSuccessfulExchangeMs`) that skipped EVERY push when the newest
- * exchange across the fleet went stale. The reply file is first-hand and
- * timestamped, so acting on it needs no such fleet-wide gate.
- */
 import { BasePeriodicService, type DaemonContext } from './service.js';
 import type { DaemonServiceId } from '../daemon-services.js';
 export declare const AUTH_SYNC_TICK_MS: number;

package/dist/lib/daemon/auth-sync-service.js

@@ -1,31 +1,3 @@
-/**
- * Reserved `auth` bundle fleet sync as a `PeriodicService` (PHNX-2371).
- *
- * This tick owns only the NON-git duties of auth sync: it materializes worker
- * slots from durable keys already on the box, then (on the elected headed
- * publisher) provisions peers missing a reserved key by pushing the credential
- * over SSH. The secret never enters Git.
- *
- * It runs no transport of its own (PHNX-4051): the per-account readiness
- * verdicts it reads are published and delivered by the usage-sync tick's SSH
- * exchange, which stores each peer's reply at `devices/<peer>/daemon-state.json`
- * stamped `receivedAt`. This tick keeps its own deadline and circuit breaker, so
- * a hung peer SSH push parks only auth-sync and never the usage delivery.
- *
- * The pushes read each peer's OWN reply file (PHNX-4116 PR 5): a peer reporting
- * a `missing` verdict for an account is pushed that account's key; a peer that
- * has never sent a reply (no file), or whose reply carries no `accounts.rows`
- * field (an older CLI — fail closed), is skipped this tick and logged at INFO.
- * Presence is also gated on a delivered-fingerprint match, so a re-mint
- * (`accounts login` bumps `workerCredential.mintedAt` while the old token still
- * authenticates) re-pushes the rotated key within a tick instead of reading
- * `present` forever. The push is idempotent, so a stale reply is harmless — a
- * stale "has key" is fine, a stale "missing key" costs one redundant push —
- * which is why the per-peer `receivedAt` replaced the old global freshness gate
- * (`readLastSuccessfulExchangeMs`) that skipped EVERY push when the newest
- * exchange across the fleet went stale. The reply file is first-hand and
- * timestamped, so acting on it needs no such fleet-wide gate.
- */
 import { BasePeriodicService } from './service.js';
 export const AUTH_SYNC_TICK_MS = 15 * 60_000;
 const AUTH_SYNC_DEADLINE_MS = 2 * 60_000;
@@ -36,31 +8,17 @@ export class AuthSyncService extends BasePeriodicService {
     deadlineMs = AUTH_SYNC_DEADLINE_MS;
     startupDelayMs = AUTH_SYNC_KICKOFF_MS;
     async onStart(_ctx) {
-        // No connections to open — each tick re-reads the local bundle + registry.
     }
     async onStop() {
-        // Nothing to release — the supervisor's timer teardown is the only cleanup.
     }
     async onTick(ctx) {
         const { reconcileLocalWorkerSlots, syncReservedAuthBundle, syncReservedStores, SKIP_REASON_NO_PEER_REPLY, SKIP_REASON_NO_ACCOUNT_ROWS, } = await import('../secrets-policy.js');
-        // Worker-side slot materialization FIRST (PHNX-3940 T6): for each registered
-        // account whose durable key is already on this box, create the HOME-shaped
-        // slot the picker and spawn read. It touches only local state — the registry
-        // copy and the file-backed store — so it never waits on any git exchange. It
-        // used to sit after this tick's own `if (!transport.success) return`, so a
-        // single `git rebase timed out` postponed every slot on the box by another
-        // tick; that exchange has since moved to the usage-sync tick (PHNX-4051).
-        // Self-gated on device role: a headed box returns immediately.
         try {
             const slots = reconcileLocalWorkerSlots();
             if (slots.provisioned.length > 0)
                 ctx.log('INFO', `auth-sync: provisioned worker slot(s) for ${slots.provisioned.join(', ')}`);
             for (const err of slots.errors)
                 ctx.log('WARN', `auth-sync: worker slot ${err.accountId}: ${err.message}`);
-            // A row skipped for a key this box cannot read is the one silent outcome
-            // an operator needs to see: it is what "0 slots after the daemon restart"
-            // looked like on yosemite-m0 (2026-09-07), where the durable key was in
-            // the bundle but the `secrets` on the daemon's PATH could not decrypt it.
             const waiting = slots.skipped.filter((s) => s.reason === 'durable key not synced yet');
             if (waiting.length > 0) {
                 ctx.log('WARN', `auth-sync: ${waiting.length} registered account(s) have no readable durable key on this box yet; slot not provisioned (${waiting.map((s) => s.accountId).join(', ')})`);
@@ -69,12 +27,6 @@ export class AuthSyncService extends BasePeriodicService {
         catch (err) {
             ctx.log('WARN', `auth-sync: worker slot reconcile: ${err.message}`);
         }
-        // The pushes read each peer's OWN daemon-state reply, first-hand and
-        // timestamped, so they run every tick with no fleet-wide freshness gate: a
-        // peer that has replied is planned off its verdict (any age — the push is
-        // idempotent), and a peer that has never replied is skipped and logged at
-        // INFO below. The worker-slot reconcile above reads only local durable keys,
-        // never peer verdicts, so it was never gated either.
         const result = await syncReservedAuthBundle();
         if (result.pushed.length > 0) {
             ctx.log('INFO', `auth-sync: pushed auth to ${result.pushed.join(', ')}`);
@@ -82,20 +34,12 @@ export class AuthSyncService extends BasePeriodicService {
         for (const err of result.errors) {
             ctx.log('WARN', `auth-sync: ${err.device}: ${err.message}`);
         }
-        // Generalized per-account, per-key, per-role reserved-store push (PHNX-3940
-        // T6). On the elected headed publisher this pushes every portable account's
-        // reserved `__<harness>__` store to the worker peers missing it. The push is
-        // the only transport — provisioning (above) writes only locally (invariant 1).
         try {
             const stores = await syncReservedStores();
             if (stores.adopted.length > 0)
                 ctx.log('INFO', `auth-sync: adopted ${stores.adopted.length} legacy reserved item(s) into their bundle: ${stores.adopted.map((a) => `${a.bundle} ${a.key}`).join(', ')}`);
             for (const p of stores.pushed)
                 ctx.log('INFO', `auth-sync: pushed ${p.bundle} (${p.keys.length} key(s)) to ${p.device}`);
-            // A peer with no reply yet — or a reply with no account rows (older CLI,
-            // fail-closed) — is informational, not a warning: a brand-new or never-
-            // dialed worker legitimately has none on an early tick, and the no-rows
-            // skip is transient during a rolling upgrade. One line per such peer per tick.
             for (const s of stores.skipped) {
                 if (s.reason === SKIP_REASON_NO_PEER_REPLY || s.reason === SKIP_REASON_NO_ACCOUNT_ROWS) {
                     ctx.log('INFO', `auth-sync: ${s.device}: ${s.reason}`);

package/dist/lib/daemon/catchup-service.d.ts

@@ -1,48 +1,14 @@
-/**
- * Catch-up recovery as a supervised `PeriodicService` (PHNX-3608).
- *
- * A catch-up pass detects routines whose scheduled fire this device missed (the
- * laptop slept, the daemon was wedged, an OS suspend the process survived) and
- * runs them late. It used to run on a bare `setInterval` booted/stopped inside
- * `runDaemon()` alongside the scheduler, with only a local `catchingUp` overlap
- * flag and NO deadline — a pass that hung on an off-box (host/cloud) dispatch
- * could latch that flag and silently stop recovering missed fires for the
- * daemon's life, the same "abstraction too weak" class the supervisor exists for.
- *
- * Under the supervisor it gets a per-tick deadline, an AbortSignal, and the
- * circuit breaker: a hung pass is abandoned and restarted on backoff instead of
- * latching. The scheduler itself (croner-driven `JobScheduler`) stays outside the
- * supervisor — it is not a tick loop — so this service self-gates on whether the
- * scheduler is currently booted and no-ops cheaply when the scheduler gate is off.
- */
 import { BasePeriodicService, type DaemonContext } from './service.js';
 import type { DaemonServiceId } from '../daemon-services.js';
-/**
- * How often to re-run catch-up. A startup pass alone misses a fire lost while the
- * daemon stayed up but its event loop was wedged, or one lost across an OS
- * suspend the process survived — five minutes bounds the cost while still
- * recovering from a wedge or an OS suspend the process survived.
- */
 export declare const CATCHUP_TICK_MS: number;
 interface CatchupServiceDeps {
-    /**
-     * Whether the routine scheduler is currently booted. When false (the
-     * `scheduler.enabled` gate is off), the pass no-ops — there is nothing to
-     * catch up on a device where no routines fire.
-     */
     isSchedulerBooted: () => boolean;
-    /** Run one catch-up pass. Receives the tick's AbortSignal so it can bound its dispatches. */
     runPass: (signal: AbortSignal) => Promise<void>;
 }
 export declare class CatchupService extends BasePeriodicService {
     private readonly deps;
     readonly id: DaemonServiceId;
     readonly intervalMs: number;
-    /**
-     * A pass awaits `executeJobDetached` per overdue job and an off-box dispatch
-     * can block for a while, so the bound is generous — but finite, which the old
-     * un-deadlined loop was not. A pass exceeding it is hung, not slow.
-     */
     readonly deadlineMs: number;
     constructor(deps: CatchupServiceDeps);
     protected onStart(): Promise<void>;

package/dist/lib/daemon/catchup-service.js

@@ -1,47 +1,17 @@
-/**
- * Catch-up recovery as a supervised `PeriodicService` (PHNX-3608).
- *
- * A catch-up pass detects routines whose scheduled fire this device missed (the
- * laptop slept, the daemon was wedged, an OS suspend the process survived) and
- * runs them late. It used to run on a bare `setInterval` booted/stopped inside
- * `runDaemon()` alongside the scheduler, with only a local `catchingUp` overlap
- * flag and NO deadline — a pass that hung on an off-box (host/cloud) dispatch
- * could latch that flag and silently stop recovering missed fires for the
- * daemon's life, the same "abstraction too weak" class the supervisor exists for.
- *
- * Under the supervisor it gets a per-tick deadline, an AbortSignal, and the
- * circuit breaker: a hung pass is abandoned and restarted on backoff instead of
- * latching. The scheduler itself (croner-driven `JobScheduler`) stays outside the
- * supervisor — it is not a tick loop — so this service self-gates on whether the
- * scheduler is currently booted and no-ops cheaply when the scheduler gate is off.
- */
 import { BasePeriodicService } from './service.js';
-/**
- * How often to re-run catch-up. A startup pass alone misses a fire lost while the
- * daemon stayed up but its event loop was wedged, or one lost across an OS
- * suspend the process survived — five minutes bounds the cost while still
- * recovering from a wedge or an OS suspend the process survived.
- */
 export const CATCHUP_TICK_MS = 5 * 60_000;
 export class CatchupService extends BasePeriodicService {
     deps;
     id = 'catchup';
     intervalMs = CATCHUP_TICK_MS;
-    /**
-     * A pass awaits `executeJobDetached` per overdue job and an off-box dispatch
-     * can block for a while, so the bound is generous — but finite, which the old
-     * un-deadlined loop was not. A pass exceeding it is hung, not slow.
-     */
     deadlineMs = 4 * 60_000;
     constructor(deps) {
         super();
         this.deps = deps;
     }
     async onStart() {
-        // No owned resources — the supervisor owns the timer.
     }
     async onStop() {
-        // No owned resources.
     }
     async onTick(_ctx, signal) {
         if (!this.deps.isSchedulerBooted())