@phnx-labs/agents-cli 1.22.34 → 1.22.37

package/dist/lib/config-transfer.js

@@ -2,10 +2,9 @@
  * Primitives for moving an agent config directory across the agents-cli boundary.
  *
  * Both helpers were part of {@link ./uninstall.ts} and are unchanged — teardown was
- * simply the first caller. `agents export` needs the same two operations (relocate a
- * directory that may sit on another volume; copy one without dragging `~/.agents`
- * symlinks along), so they live here rather than being duplicated or imported out of
- * a module named for teardown.
+ * simply the first caller. Other config-transfer paths need the same operations, so
+ * they live here rather than being duplicated or imported out of a module named for
+ * teardown.
  */
 import * as fs from 'fs';
 import * as path from 'path';

package/dist/lib/crabbox/cli.d.ts

@@ -5,7 +5,7 @@
  * checkout, and runs commands on them. We use it as the transport for
  * `agents run --lease`: warm a box → run the agent on it via `crabbox run` →
  * stop it. crabbox owns the SSH connection, so agents-cli never needs a direct
- * ssh target (unlike the `agents hosts` model).
+ * ssh target (unlike the host-dispatch model).
  *
  * crabbox talks to its cloud provider's API for list/status/warmup/stop, which
  * needs a provider token (e.g. HCLOUD_TOKEN) in the environment. We inject it
@@ -242,7 +242,7 @@ export declare function reapSafeOrphans(boxes: CrabboxBox[], nowSecs: number): C
 /**
  * List reap-safe orphans and (unless `dryRun`) stop them. Returns the candidates
  * considered and the slugs actually stopped. Best-effort per box — a stop failure
- * is skipped, never thrown. Backs `agents lease gc` and the 403 auto-reap opt-in.
+ * is skipped, never thrown. Backs `agents devices lease gc` and the 403 auto-reap opt-in.
  */
 export declare function reapOrphans(opts?: CrabboxOptions & {
     nowSecs?: number;

package/dist/lib/crabbox/cli.js

@@ -5,7 +5,7 @@
  * checkout, and runs commands on them. We use it as the transport for
  * `agents run --lease`: warm a box → run the agent on it via `crabbox run` →
  * stop it. crabbox owns the SSH connection, so agents-cli never needs a direct
- * ssh target (unlike the `agents hosts` model).
+ * ssh target (unlike the host-dispatch model).
  *
  * crabbox talks to its cloud provider's API for list/status/warmup/stop, which
  * needs a provider token (e.g. HCLOUD_TOKEN) in the environment. We inject it
@@ -394,7 +394,7 @@ export async function crabboxWarmup(opts = {}) {
                 if (orphans.length) {
                     hint =
                         ` ${orphans.length} expired, idle box(es) are holding the quota — free them with ` +
-                            `\`agents lease gc\` (or \`crabbox stop ${orphans[0].slug}\`).`;
+                            `\`agents devices lease gc\` (or \`crabbox stop ${orphans[0].slug}\`).`;
                 }
             }
             catch {
@@ -586,7 +586,7 @@ export function reapSafeOrphans(boxes, nowSecs) {
 /**
  * List reap-safe orphans and (unless `dryRun`) stop them. Returns the candidates
  * considered and the slugs actually stopped. Best-effort per box — a stop failure
- * is skipped, never thrown. Backs `agents lease gc` and the 403 auto-reap opt-in.
+ * is skipped, never thrown. Backs `agents devices lease gc` and the 403 auto-reap opt-in.
  */
 export function reapOrphans(opts = {}) {
     const nowSecs = opts.nowSecs ?? Math.floor(Date.now() / 1000);

package/dist/lib/daemon-health.d.ts

@@ -1,6 +1,15 @@
 /** Stable subsystem identifiers shared by the daemon (writer) and `agents daemon` (reader). */
 export declare const SUBSYSTEM_SECRETS_BROKER = "secrets-broker";
 export declare const SUBSYSTEM_BROWSER_IPC = "browser-ipc";
+/**
+ * Daemon startup itself (RUSH-2418). Unlike the two above, this record is
+ * written from BOTH sides: the launching CLI records a start that produced no
+ * live daemon, and the daemon records its own successful claim. Its
+ * `consecutiveFailures` is what `ensureDaemonStarted` reads to open the
+ * auto-start circuit breaker, so a daemon dying on boot stops being relaunched
+ * by every foreground command that happens to want one.
+ */
+export declare const SUBSYSTEM_DAEMON_START = "daemon-start";
 /** One subsystem's health as of the last time it reported in. */
 export interface SubsystemHealth {
     /** Stable identifier, e.g. 'secrets-broker', 'browser-ipc'. */
@@ -18,6 +27,19 @@ export interface SubsystemHealth {
 export declare function recordSubsystemOk(subsystem: string, at?: string): void;
 /** Record a subsystem failure — bumps the consecutive-failure streak. */
 export declare function recordSubsystemError(subsystem: string, error: string, at?: string): void;
+/**
+ * Refine the reason on an already-counted failure, without bumping the streak.
+ *
+ * Exists because a start is counted BEFORE its outcome is known (RUSH-2418):
+ * the launcher marks the attempt, then replaces the provisional reason with the
+ * real one if it fails outright. Calling `recordSubsystemError` a second time
+ * would count one failed start as two.
+ *
+ * Describing a failure that was never counted would be a lie in the other
+ * direction — a `lastError` with `consecutiveFailures: 0` — so an unreported
+ * subsystem is left alone rather than given a blank record to decorate.
+ */
+export declare function recordSubsystemErrorReason(subsystem: string, error: string, at?: string): void;
 /** Read one subsystem's health record, or null if it has never reported in. */
 export declare function readSubsystemHealth(subsystem: string): SubsystemHealth | null;
 /** Read every subsystem's health record, sorted by subsystem name. */

package/dist/lib/daemon-health.js

@@ -11,9 +11,10 @@
  *
  * Scheduled routines get this for free once migrated onto `agents routines`
  * (their run history already carries success/failure — `agents routines
- * stats`). This module exists for the two subsystems that predate routines
- * and have no run history of their own: the secrets broker and the browser
- * IPC server.
+ * stats`). This module exists for the subsystems that predate routines and have
+ * no run history of their own: the secrets broker and the browser IPC server,
+ * plus the daemon's own startup (`SUBSYSTEM_DAEMON_START`, RUSH-2418) — which
+ * is the one record that also GATES behaviour rather than only reporting it.
  *
  * File-backed (one JSON object keyed by subsystem name) rather than in-memory
  * because `agents daemon status` runs as a SEPARATE process from the daemon —
@@ -26,6 +27,15 @@ const HEALTH_FILE = 'health.json';
 /** Stable subsystem identifiers shared by the daemon (writer) and `agents daemon` (reader). */
 export const SUBSYSTEM_SECRETS_BROKER = 'secrets-broker';
 export const SUBSYSTEM_BROWSER_IPC = 'browser-ipc';
+/**
+ * Daemon startup itself (RUSH-2418). Unlike the two above, this record is
+ * written from BOTH sides: the launching CLI records a start that produced no
+ * live daemon, and the daemon records its own successful claim. Its
+ * `consecutiveFailures` is what `ensureDaemonStarted` reads to open the
+ * auto-start circuit breaker, so a daemon dying on boot stops being relaunched
+ * by every foreground command that happens to want one.
+ */
+export const SUBSYSTEM_DAEMON_START = 'daemon-start';
 function getHealthPath() {
     return path.join(getDaemonDir(), HEALTH_FILE);
 }
@@ -74,6 +84,26 @@ export function recordSubsystemError(subsystem, error, at = new Date().toISOStri
     };
     writeAll(all);
 }
+/**
+ * Refine the reason on an already-counted failure, without bumping the streak.
+ *
+ * Exists because a start is counted BEFORE its outcome is known (RUSH-2418):
+ * the launcher marks the attempt, then replaces the provisional reason with the
+ * real one if it fails outright. Calling `recordSubsystemError` a second time
+ * would count one failed start as two.
+ *
+ * Describing a failure that was never counted would be a lie in the other
+ * direction — a `lastError` with `consecutiveFailures: 0` — so an unreported
+ * subsystem is left alone rather than given a blank record to decorate.
+ */
+export function recordSubsystemErrorReason(subsystem, error, at = new Date().toISOString()) {
+    const all = readAll();
+    const existing = all[subsystem];
+    if (!existing)
+        return;
+    all[subsystem] = { ...existing, lastError: error, lastErrorAt: at };
+    writeAll(all);
+}
 /** Read one subsystem's health record, or null if it has never reported in. */
 export function readSubsystemHealth(subsystem) {
     return readAll()[subsystem] ?? null;

package/dist/lib/daemon-services.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Daemon service catalog + persistent toggle config.
+ *
+ * Defines the services the daemon hosts, loads their on/off state from
+ * ~/.agents/daemon/services.yaml, and exposes lightweight helpers so both the
+ * daemon and service clients (e.g. secrets) can check whether a service is
+ * enabled without pulling in the whole daemon lifecycle.
+ */
+/** Every service the daemon can host. IDs are kebab-case and stable. */
+export type DaemonServiceId = 'secrets-broker' | 'scheduler' | 'monitors' | 'browser-ipc' | 'self-heal' | 'keychain-reap' | 'account-state' | 'watchdog' | 'device-probe' | 'state-dir-check';
+/** Human-readable metadata for each service. */
+export interface DaemonServiceDef {
+    id: DaemonServiceId;
+    title: string;
+    description: string;
+}
+export declare const DAEMON_SERVICES: DaemonServiceDef[];
+/** Stable order of service IDs. */
+export declare const DAEMON_SERVICE_IDS: DaemonServiceId[];
+/** Persistent service toggles. */
+export interface DaemonServicesConfig {
+    services: Record<DaemonServiceId, boolean>;
+}
+/** Path to ~/.agents/daemon/services.yaml. */
+export declare function getDaemonServicesConfigPath(): string;
+/**
+ * Read the services config from disk. Missing or malformed files return the
+ * default (all services enabled). Never throws.
+ */
+export declare function readDaemonServicesConfig(): DaemonServicesConfig;
+/**
+ * Write the services config to disk, creating the daemon config dir if needed.
+ * Preserves unknown keys/ordering in the existing file when possible.
+ */
+export declare function writeDaemonServicesConfig(cfg: DaemonServicesConfig): void;
+/**
+ * Check whether a single service is enabled. Returns true (enabled) when the
+ * config file is missing or the ID is unknown, so disabling must be explicit.
+ */
+export declare function isDaemonServiceEnabled(id: DaemonServiceId): boolean;
+/**
+ * Toggle one service and persist. Returns the new config.
+ */
+export declare function setDaemonServiceEnabled(id: DaemonServiceId, enabled: boolean): DaemonServicesConfig;
+/**
+ * List every known service with its current enabled state and metadata.
+ */
+export declare function listDaemonServiceStates(): Array<DaemonServiceDef & {
+    enabled: boolean;
+}>;

package/dist/lib/daemon-services.js

@@ -0,0 +1,147 @@
+/**
+ * Daemon service catalog + persistent toggle config.
+ *
+ * Defines the services the daemon hosts, loads their on/off state from
+ * ~/.agents/daemon/services.yaml, and exposes lightweight helpers so both the
+ * daemon and service clients (e.g. secrets) can check whether a service is
+ * enabled without pulling in the whole daemon lifecycle.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import * as yaml from 'yaml';
+import { getDaemonConfigDir } from './state.js';
+import { atomicWriteFileSync } from './fs-atomic.js';
+export const DAEMON_SERVICES = [
+    {
+        id: 'secrets-broker',
+        title: 'Secrets broker',
+        description: 'Hosts the keychain-backed secrets broker socket so unlocked bundles stay warm across agent runs.',
+    },
+    {
+        id: 'scheduler',
+        title: 'Routine scheduler',
+        description: 'Fires cron-scheduled routines and catches up missed fires.',
+    },
+    {
+        id: 'monitors',
+        title: 'Monitor engine',
+        description: 'Watches event sources and triggers monitor-driven routines.',
+    },
+    {
+        id: 'browser-ipc',
+        title: 'Browser IPC',
+        description: 'Keeps a supervised browser automation IPC socket available for sessions.',
+    },
+    {
+        id: 'self-heal',
+        title: 'Self-heal registry',
+        description: 'Repairs shims, PATH, shadowing, and resource drift on a schedule.',
+    },
+    {
+        id: 'keychain-reap',
+        title: 'Keychain reap',
+        description: 'Reaps orphaned keychain helpers and stuck agents processes.',
+    },
+    {
+        id: 'account-state',
+        title: 'Account state',
+        description: 'Refreshes account quota/usage and publishes the local fleet-status row.',
+    },
+    {
+        id: 'watchdog',
+        title: 'Watchdog',
+        description: 'Nudges stalled agent sessions on this host when opted in via watchdog.enabled.',
+    },
+    {
+        id: 'device-probe',
+        title: 'Device probe',
+        description: 'Discovers Tailscale devices and surfaces pending ones for registration.',
+    },
+    {
+        id: 'state-dir-check',
+        title: 'State-dir self-check',
+        description: 'Self-terminates the daemon if its state directory is removed.',
+    },
+];
+/** Stable order of service IDs. */
+export const DAEMON_SERVICE_IDS = DAEMON_SERVICES.map((s) => s.id);
+function defaultServicesConfig() {
+    const services = {};
+    for (const id of DAEMON_SERVICE_IDS)
+        services[id] = true;
+    return { services };
+}
+/** Path to ~/.agents/daemon/services.yaml. */
+export function getDaemonServicesConfigPath() {
+    return path.join(getDaemonConfigDir(), 'services.yaml');
+}
+/**
+ * Read the services config from disk. Missing or malformed files return the
+ * default (all services enabled). Never throws.
+ */
+export function readDaemonServicesConfig() {
+    const cfg = defaultServicesConfig();
+    try {
+        const raw = fs.readFileSync(getDaemonServicesConfigPath(), 'utf-8');
+        const parsed = yaml.parse(raw);
+        if (parsed && typeof parsed === 'object' && parsed.services && typeof parsed.services === 'object') {
+            for (const id of DAEMON_SERVICE_IDS) {
+                const value = parsed.services[id];
+                if (typeof value === 'boolean')
+                    cfg.services[id] = value;
+            }
+        }
+    }
+    catch {
+        // Missing or corrupt -> defaults.
+    }
+    return cfg;
+}
+/**
+ * Write the services config to disk, creating the daemon config dir if needed.
+ * Preserves unknown keys/ordering in the existing file when possible.
+ */
+export function writeDaemonServicesConfig(cfg) {
+    const dir = getDaemonConfigDir();
+    fs.mkdirSync(dir, { recursive: true });
+    const filePath = getDaemonServicesConfigPath();
+    // Preserve any extra top-level fields the user may have added.
+    let preserved = {};
+    try {
+        const raw = fs.readFileSync(filePath, 'utf-8');
+        const parsed = yaml.parse(raw);
+        if (parsed && typeof parsed === 'object')
+            preserved = parsed;
+    }
+    catch {
+        // ignore
+    }
+    const services = {};
+    for (const id of DAEMON_SERVICE_IDS)
+        services[id] = cfg.services[id] ?? true;
+    const out = yaml.stringify({ ...preserved, services }, { sortMapEntries: false });
+    atomicWriteFileSync(filePath, out, 'utf-8');
+}
+/**
+ * Check whether a single service is enabled. Returns true (enabled) when the
+ * config file is missing or the ID is unknown, so disabling must be explicit.
+ */
+export function isDaemonServiceEnabled(id) {
+    return readDaemonServicesConfig().services[id] !== false;
+}
+/**
+ * Toggle one service and persist. Returns the new config.
+ */
+export function setDaemonServiceEnabled(id, enabled) {
+    const cfg = readDaemonServicesConfig();
+    cfg.services[id] = enabled;
+    writeDaemonServicesConfig(cfg);
+    return cfg;
+}
+/**
+ * List every known service with its current enabled state and metadata.
+ */
+export function listDaemonServiceStates() {
+    const cfg = readDaemonServicesConfig();
+    return DAEMON_SERVICES.map((s) => ({ ...s, enabled: cfg.services[s.id] !== false }));
+}

package/dist/lib/daemon-ticks.d.ts

@@ -1,81 +1,50 @@
 /**
- * Daemon housekeeping ticks — one-shot bodies invoked by system routines.
+ * Daemon account-state tick bodies.
  *
- * RUSH-2353: these were ~15 hardcoded `setInterval` timers inside
- * `runDaemon()` (daemon.ts) — a parallel, inferior reimplementation of the
- * routines system (no declaration, no run history, no pause/disable, no
- * device pin). Each function here is one migrated tick's *body*, unchanged in
- * behavior, now invoked as a detached one-shot process by a system routine's
- * `command:` (via the `agents __daemon-tick <name>` entrypoint in index.ts)
- * instead of an in-process interval closure.
+ * These two bodies are the `refreshUsage` / `refreshAuth` implementations the
+ * daemon's `account-state-service.ts` timers call directly, in-process, on a
+ * plain `setInterval` (usage every 60s, auth every ~3 min). They are NOT
+ * routines and are never fired through the scheduler — the daemon owns usage and
+ * authentication health as first-party device state (RUSH-2451).
  *
- * Overlap protection that used to live in daemon.ts as a per-tick boolean
- * flag (`watchdogInFlight`, `probingDevices`, ...) is now provided by the
- * routine runner's launch claim (`withRoutineLaunchClaim` in runner.ts) — two
- * fires of the same routine name never run concurrently.
- *
- * Output goes to `console.log`/`console.error`: each tick runs as a spawned
- * child of `executeCommandJobDetached`, which redirects the child's stdout to
- * the run's `stdout.log` — so this doubles as the run's log, readable via
- * `agents routines runs <name>`.
- */
-/** ~every 3 min. Mirrors the old WATCHDOG_TICK_MS. */
-export declare function runWatchdogTick(): Promise<void>;
-/**
- * Device probe: refresh registered devices' reachability and detect newly
- * appeared tailnet nodes, dropping a sentinel per pending device so the
- * menu-bar helper can surface "NEW DEVICES -> Register / Ignore". Refresh
- * mode never auto-registers a newcomer. A machine without tailscale is a
- * clean no-op. ~every 3 min.
- */
-export declare function runDeviceProbeTick(): Promise<void>;
-/**
- * tmux hook reconcile: retrofit the guarded `pane-died` hook onto managed
- * `agents run` sessions a pre-fix binary left with the old unconditional
- * hook. Non-destructive: set-hook only, never a kill or detach. ~every 5 min.
- */
-export declare function runTmuxReconcileTick(): Promise<void>;
-/**
- * Launch-health self-heal: probe that each agent's DEFAULT version actually
- * LAUNCHES, and repair a gutted install. Never repoints the global default
- * (allowDefaultSwitch: false) — a background default switch would be a
- * silent logout. ~every 6h.
- */
-export declare function runLaunchHealthTick(): Promise<void>;
+ * `refreshLocalFleetAuthState` is also called by `agents fleet`/`ssh` surfaces
+ * that need a fresh local auth snapshot on demand; provider-level work is guarded
+ * by the cross-process refresh lease so an explicit CLI refresh and the daemon
+ * timer converge on the same published result.
+ */
+import type { FleetStatusRow } from './fleet-status.js';
+import type { AuthProbeRow } from './auth-health.js';
+export declare function isFreshFleetAuthSnapshot(value: {
+    row: FleetStatusRow;
+    authRows: AuthProbeRow[];
+}, minimumCapturedAt: number): boolean;
 /**
  * Fleet cache warm: publish THIS host's row for the caches `agents fleet
  * status` / `agents devices list` read (PUBLISH-OWN / READ-UNION, RUSH-2061).
- * ~every 3 min.
  */
+export declare function refreshLocalFleetAuthState(): Promise<{
+    row: FleetStatusRow;
+    authRows: import('./auth-health.js').AuthProbeRow[];
+}>;
 export declare function runFleetCacheWarmTick(): Promise<void>;
-/**
- * Session-status cache warm (RUSH-2062): publish THIS host's local active
- * sessions so menubar / Factory / watchdog / CLI share one warm snapshot.
- * Publish-own only (no cross-host SSH). ~every 3 min.
- */
-export declare function runSessionCacheWarmTick(): Promise<void>;
 /**
  * Usage refresh: keep the usage cache the `agents run` router reads
  * (RUSH-2061, readOnly hot path) fresh, WITHOUT the hot path ever fetching.
- * This host is the sole writer for its own local accounts. ~every 60s
- * (USAGE_REFRESH_TICK_MS in usage-refresh.ts — keep in sync).
+ * The configured primary host is the fleet's sole provider-facing writer;
+ * subscribers import its token-free derived cache.
  */
 export declare function runUsageRefreshTick(): Promise<void>;
 /**
- * Auto-dispatch: for any managed project that has opted in (autoDispatch:true
- * + maxAgents>0 in ~/.agents/factory/projects.json), pick up Linear tickets
- * delegated to an agent and still in Todo, and dispatch each through
- * agents-cli's own cloud-provider layer. OFF unless a project opts in; no
- * opted-in project or no LINEAR_API_KEY is a clean no-op. ~every 3 min.
+ * Active-sessions warm (RUSH-2062 / RUSH-2484): publish THIS host's live session
+ * rows so `agents sessions watch` (and the extension that tails it) receive
+ * journal deltas. Publish-own only — no cross-host SSH.
  *
- * Migrated to a routine (RUSH-2353) so it inherits the `devices:` allowlist —
- * pin with `agents routines devices auto-dispatch --set <one>` to fix the
- * shared-input double-fire problem this job had hardcoded (every daemon on
- * the fleet polled the same Linear queue with no coordination).
- */
-export declare function runAutoDispatchTick(): Promise<void>;
-/** Registry: routine-facing name -> tick body. Keys match the shipped routine YAML names. */
-export declare const DAEMON_TICKS: Record<string, () => Promise<void>>;
-export declare const DAEMON_TICK_ROUTINE_NAMES: readonly string[];
-/** Run one named tick, or throw for an unknown name (fails the routine run loud). */
-export declare function runDaemonTick(name: string): Promise<void>;
+ * Cadence matches {@link DEFAULT_ACTIVE_CACHE_MAX_AGE_MS} so one-shot readers and
+ * long-lived watchers share one writer. Without this tick the journal has no
+ * continuous producer and Factory freezes after the initial cache snapshot.
+ */
+export declare function runActiveSessionsWarmTick(opts?: {
+    gather?: () => Promise<import('./session/active.js').ActiveSession[]>;
+}): Promise<{
+    sessions: number;
+}>;