@phnx-labs/agents-cli 1.22.47 → 1.22.49

package/dist/lib/daemon/daemon.js

@@ -16,25 +16,51 @@ import { isAlive, killTree, backgroundSpawnOptions, waitForExit } from '../platf
 import { listJobs as listAllJobs } from '../scheduling/routines.js';
 import { syncAllProjectRoutines } from '../routines-project.js';
 import { JobScheduler } from '../scheduler.js';
-import { MonitorEngine } from '../monitors/engine.js';
+// MonitorEngine is now owned by MonitorEngineService (daemon/monitor-engine-service.ts).
 import { executeJobDetached, monitorRunningJobs, listLiveRoutineChildren } from './runner.js';
 import { detectOverdueJobs, notifyOverdue } from '../overdue.js';
 import { runCatchup } from '../catchup.js';
 import { notifyRoutineStart, notifyRoutineFinish, notifyRoutineStartFailed } from '../routine-notify.js';
 import { notifyOwnerRoutineFinish, notifyOwnerRoutineStartFailed } from '../routine-notify-owner.js';
 import { BrowserService } from '../browser/service.js';
-import { BrowserIPCServer, getSocketPath as getBrowserIpcSocketPath } from '../browser/ipc.js';
+import { getSocketPath as getBrowserIpcSocketPath } from '../browser/ipc.js';
 import { startHostedWebhookReceivers } from '../daemon-webhooks.js';
 import { secretsBrokerSocketPath, brokerPidAlive } from '../secrets/agent.js';
 import { redactSecrets } from '../redact.js';
 import { getAgentsBinPath, getCliLaunch, BUN_VIRTUAL_ROOT } from '../cli-entry.js';
-import { isSchedulerEnabled, assertSchedulerEnabled, isDaemonEnabled, getConfigValue, resolveBrowserTaskIdleMs } from '../device-config.js';
+import { isSchedulerEnabled, assertSchedulerEnabled, isDaemonEnabled, resolveBrowserTaskIdleMs } from '../device-config.js';
 import { reapTerminalRoutineProcesses } from '../routine-process-cleanup.js';
-import { recordSubsystemOk, recordSubsystemError, recordSubsystemErrorReason, readSubsystemHealth, SUBSYSTEM_SECRETS_BROKER, SUBSYSTEM_BROWSER_IPC, SUBSYSTEM_DAEMON_START } from '../daemon-health.js';
-import { startAccountStateService } from '../account-state-service.js';
-import { runActiveSessionsWarmTick, runFleetCacheWarmTick, runSessionIndexWarmTick, runUsageRefreshTick } from '../daemon-ticks.js';
+import { recordSubsystemOk, recordSubsystemError, recordSubsystemErrorReason, readSubsystemHealth, SUBSYSTEM_DAEMON_START } from '../daemon-health.js';
+import { runActiveSessionsWarmTick } from '../daemon-ticks.js';
+import { watchActiveSessionsReaderPresence } from '../session/session-cache.js';
+import { ServiceSupervisor } from './supervisor.js';
+import { SessionIndexService } from './session-index-service.js';
+import { SecretsBrokerService } from './secrets-broker-service.js';
+import { MonitorEngineService } from './monitor-engine-service.js';
+import { AccountStateDaemonService } from './account-state-daemon-service.js';
+import { BrowserIPCService } from './browser-ipc-service.js';
+import { WatchdogService } from './watchdog-service.js';
+import { DeviceProbeService } from './device-probe-service.js';
+import { SelfHealService } from './self-heal-service.js';
+import { KeychainReapService } from './keychain-reap-service.js';
+import { StateDirCheckService } from './state-dir-check-service.js';
 import { emit, emitRoutineEnd } from '../feed/events.js';
-import { readDaemonServicesConfig } from '../daemon-services.js';
+import { readDaemonServicesConfig, drainDaemonServiceRestartQueue } from '../daemon-services.js';
+/**
+ * The live `ServiceSupervisor` for the current `runDaemon()` invocation, or
+ * `null` before boot / after shutdown. In-process only — a separate `agents
+ * daemon status` process cannot see this; per-service health that must
+ * survive across processes goes through `daemon-health.ts` instead (which
+ * `ServiceSupervisor` already writes on every tick). This getter exists so a
+ * FUTURE same-process consumer (e.g. a `daemon services` live-status IPC
+ * handler) can read the supervisor's richer state (`parked`, not just
+ * ok/error) without needing its own reference to `runDaemon()`'s locals.
+ */
+let activeServiceSupervisor = null;
+/** Health for every service currently registered on the live supervisor, or `null` if the daemon isn't running in this process. */
+export function getServiceSupervisorHealth() {
+    return activeServiceSupervisor?.health() ?? null;
+}
 const PID_FILE = 'daemon.pid';
 const LIFETIME_FILE = 'daemon.lifetime';
 const LOCK_FILE = 'daemon.lock';
@@ -96,42 +122,28 @@ const CATCHUP_TICK_MS = 5 * 60_000;
 /**
  * Cadences for the in-process background ticks, named here beside the other
  * tick constants rather than left as inline literals at their `setInterval`
- * (RUSH-2423). Each is a deliberate trade, not a round number:
+ * (RUSH-2423). Self-heal, keychain-reap, state-dir-check, watchdog, and
+ * device-probe cadences moved to their own `*-service.ts` files (RUSH-3193
+ * P3, alongside session-index/account-state/etc.) — see those files for the
+ * per-service trade-offs (self-heal's 6h/cheap-to-be-late repair cadence,
+ * keychain-reap's 5min `ps`-shell cost bound, state-dir-check's env override
+ * for tests, watchdog/device-probe's shared 3min in-process housekeeping
+ * cadence, NOT a routine — RUSH-2495).
  *
- * - **Self-heal** repairs slow rot (a stale non-default version, an invalid
- *   plugin manifest), so it is cheap to be late and expensive to run often —
- *   hence 6h, plus one staggered kickoff shortly after start so shims and PATH
- *   settle without making launch itself busy.
  * - **Broker self-heal** is a bare `agentPing`, and the failure it recovers
  *   from wedges every keychain-backed secret on the box, so it runs minutely.
- * - **Keychain reap** shells `ps` once per pass; 5 min bounds that cost while
- *   still clearing orphans well inside a human's attention span.
- * - **State-dir self-check** is two `fs` reads. Its env override exists for
- *   tests, which cannot wait a minute to observe the self-terminate guard.
  */
-const SELF_HEAL_TICK_MS = 6 * 60 * 60_000;
-const SELF_HEAL_KICKOFF_MS = 30_000;
-const BROKER_SELF_HEAL_TICK_MS = 60_000;
-const KEYCHAIN_REAP_TICK_MS = 5 * 60_000;
+// BROKER_SELF_HEAL_TICK_MS moved to secrets-broker-service.ts (RUSH-3193 P2).
 // RUSH-2501: reap tmux sessions whose panes are all dead every 5 minutes.
 const DEAD_PANE_REAP_TICK_MS = 5 * 60_000;
 // RUSH-2622: close abandoned browser-task tabs every 5 minutes.
 const BROWSER_TASK_REAP_TICK_MS = 5 * 60_000;
-const STATE_DIR_CHECK_TICK_MS = 60_000;
-// Watchdog nudges this host's own stalled sessions; device-probe refreshes
-// registered devices' reachability and surfaces newly appeared tailnet nodes.
-// Both are daemon-owned housekeeping timers, NOT routines (RUSH-2495) — plain
-// in-process intervals the daemon holds directly, same cadence the old timers ran.
-const WATCHDOG_TICK_MS = 3 * 60_000;
-const DEVICE_PROBE_TICK_MS = 3 * 60_000;
 // Keep the active-session cache/journal fresh for sessions watch + Factory.
 // Matches DEFAULT_ACTIVE_CACHE_MAX_AGE_MS (15s) so long-lived watchers never
 // outlive the publisher (RUSH-2484 — CLI-owned continuous publish).
 const ACTIVE_SESSIONS_WARM_TICK_MS = 15_000;
-// Incrementally scan this host's transcript dirs into the local index so a
-// locally-started session is indexed within seconds, not on the next unrelated
-// `agents sessions*` call (RUSH-2682 — indexing was lazy, nothing scheduled it).
-const SESSION_INDEX_WARM_TICK_MS = 20_000;
+// Session-index warm interval/deadline live in session-index-service.ts now
+// (RUSH-3193 — migrated onto ServiceSupervisor).
 const WEDGE_THRESHOLD_TICKS = 3;
 /**
  * Crash-loop prevention (RUSH-2418). Three layers, because none of them alone
@@ -704,75 +716,17 @@ export function warnEphemeralDaemonRoot(resolveBin = getAgentsBinPath) {
 // named in stack traces, readable without scrolling through runDaemon's
 // 500-line body, and not recreated on every function invocation.
 //
-// Two functions (runBrokerSelfHeal, runStateDirSelfCheck) remain inline:
-//   • runBrokerSelfHeal closes over `hostedBroker` — a mutable runDaemon-
-//     local var also used by handleShutdown; lifting it requires both vars to
-//     be module-level, which is wider scope than this ticket.
-//   • runStateDirSelfCheck closes over `lifetimePath` and `lifetimeToken` —
-//     per-boot constants that cannot be pre-computed at module load time.
+// self-heal and keychain-reap moved to SelfHealService / KeychainReapService
+// on the ServiceSupervisor (RUSH-3193 P3) — the supervisor's own per-tick
+// deadline + inFlight guard replaces their local `healing`/`reapingKeychain`
+// flags. state-dir-check moved to StateDirCheckService (RUSH-3193 P3),
+// registered after `handleShutdown` is declared — see its registration site
+// below. runBrokerSelfHeal was moved into SecretsBrokerService (RUSH-3193 P2).
 // ---------------------------------------------------------------------------
 // In-flight guards: each flag prevents a slow tick from being re-entered
 // by the next timer fire before the previous one finishes.
-let healing = false;
-let reapingKeychain = false;
 let reapingDeadPanes = false;
 let reapingBrowserTasks = false;
-/**
- * Resource self-heal: fill missing resources, repair invalid manifests, and
- * fast-forward pristine stale plugins. Conservative 'safe' mode: never
- * overwrites hand-edited content. Runs ~every 6h plus once ~30s after startup.
- *
- * Does not run when the daemon's state directory no longer exists — that is the
- * self-terminate guard's signal to shut down; background maintenance must not
- * recreate the tree while it is mid-exit.
- */
-async function runHealCheck() {
-    if (healing)
-        return;
-    if (!fs.existsSync(getDaemonDir()))
-        return;
-    healing = true;
-    try {
-        const { runSelfHeal, selfHealChangedAnything, selfHealNeedsAttention, summarizeSelfHeal } = await import('../self-heal/registry.js');
-        if (!fs.existsSync(getDaemonDir()))
-            return;
-        const report = await runSelfHeal({ mode: 'safe' });
-        if (selfHealChangedAnything(report) || selfHealNeedsAttention(report)) {
-            log('INFO', `self-heal: ${summarizeSelfHeal(report)}`);
-        }
-    }
-    catch (err) {
-        log('ERROR', `self-heal check failed: ${err.message}`);
-    }
-    finally {
-        healing = false;
-    }
-}
-/**
- * Keychain orphan reaper: kill stuck keychain helper and `agents` processes
- * whose keychain call never returned. Runs every 5 min. Single-executor: only
- * the daemon runs this, so no cross-device race.
- */
-async function runKeychainReap() {
-    if (reapingKeychain)
-        return;
-    reapingKeychain = true;
-    try {
-        const { reapOrphanedKeychainProcesses } = await import('../secrets/reaper.js');
-        const result = reapOrphanedKeychainProcesses();
-        if (result.reaped > 0) {
-            log('WARN', `Reaped ${result.reaped} keychain orphan/stuck process(es)`);
-            for (const d of result.details)
-                log('WARN', `  ${d}`);
-        }
-    }
-    catch (err) {
-        log('ERROR', `Keychain reaper failed: ${err.message}`);
-    }
-    finally {
-        reapingKeychain = false;
-    }
-}
 /**
  * RUSH-2501: kill tmux sessions on the helper socket whose panes are ALL dead.
  * RUSH-2521: and terminate the helper processes (MCP servers, harness background
@@ -813,7 +767,7 @@ async function runDeadPaneReap() {
 /**
  * RUSH-2622: close abandoned browser-task tabs — a task whose owning agent
  * session has exited, or one idle past `browser.task-idle-minutes` (default 30,
- * 0 disables idle reaping only). Same policy `agents browser gc` triggers on
+ * 0 disables idle reaping only). Same policy `agents browser prune` triggers on
  * demand; this is the periodic side, and the daemon is the single executor so
  * no UI surface can race it. `service` is the daemon's own long-lived
  * BrowserService — the browser IPC server it started earlier in `runDaemon()`.
@@ -929,36 +883,59 @@ export async function runDaemon() {
     catch (err) {
         log('ERROR', `Stray daemon reaper failed: ${err.message}`);
     }
-    // #416: host the secrets broker socket-first — before the scheduler and the
-    // heavy browser services — so `agents secrets` resolves within
-    // ms of daemon start. Only host when no broker is already reachable, so we
-    // never orphan a live standalone broker's clients (that broker stays the
-    // server until it idle-exits or the daemon restarts). Best-effort: a failure
-    // here must not stop the daemon. Retiring the standalone launchd service is
-    // the follow-on (#416 step 2 / #417).
-    let hostedBroker = null;
-    if (isEnabled('secrets-broker')) {
-        try {
-            const { agentPing, startHostedBroker } = await import('../secrets/agent.js');
-            if ((await agentPing()).reachable) {
-                log('INFO', 'Secrets broker already running (standalone); daemon not hosting it');
-            }
-            else {
-                hostedBroker = await startHostedBroker();
-                if (hostedBroker)
-                    log('INFO', 'Secrets broker hosted in daemon (socket-first)');
-            }
-            recordSubsystemOk(SUBSYSTEM_SECRETS_BROKER);
-        }
-        catch (err) {
-            const message = err.message;
-            log('WARN', `Secrets broker host skipped: ${message}`);
-            recordSubsystemError(SUBSYSTEM_SECRETS_BROKER, message);
-        }
-    }
-    else {
+    // Socket services: secrets broker, monitor engine, account-state, and
+    // browser IPC are all managed by the ServiceSupervisor (RUSH-3193 P2).
+    // The supervisor is created here — before the scheduler — so the secrets
+    // broker starts socket-first (#416) and `agents secrets` resolves within
+    // ms of daemon start, exactly as before.
+    const supervisor = new ServiceSupervisor();
+    if (isEnabled('secrets-broker'))
+        supervisor.register(new SecretsBrokerService());
+    else
         log('INFO', 'Secrets broker service disabled; daemon not hosting it');
-    }
+    const monitorEngineSvc = new MonitorEngineService();
+    if (isEnabled('monitors'))
+        supervisor.register(monitorEngineSvc);
+    else
+        log('INFO', 'Monitor engine disabled');
+    if (isEnabled('account-state'))
+        supervisor.register(new AccountStateDaemonService());
+    else
+        log('INFO', 'Account-state service disabled');
+    // BrowserIPCService owns the orphan reap (previously daemon.ts:1303-1318)
+    // and the BrowserIPCServer lifecycle. BrowserService is also constructed here
+    // so daemon.ts can access it for the browser-task-reap interval (task #3).
+    const browserSvcForReap = isEnabled('browser-ipc') ? new BrowserService() : null;
+    if (browserSvcForReap)
+        supervisor.register(new BrowserIPCService(browserSvcForReap));
+    else
+        log('INFO', 'Browser IPC service disabled');
+    if (isEnabled('session-index'))
+        supervisor.register(new SessionIndexService());
+    else
+        log('INFO', 'Session-index warm service disabled');
+    // Watchdog, device-probe, self-heal, and keychain-reap are all periodic
+    // services managed by the ServiceSupervisor (RUSH-3193 P3). Each is gated
+    // the same way as the socket services above; state-dir-check is registered
+    // separately, later, after `handleShutdown` exists (see below).
+    if (isEnabled('watchdog'))
+        supervisor.register(new WatchdogService());
+    else
+        log('INFO', 'Watchdog service disabled');
+    if (isEnabled('device-probe'))
+        supervisor.register(new DeviceProbeService());
+    else
+        log('INFO', 'Device-probe service disabled');
+    if (isEnabled('self-heal'))
+        supervisor.register(new SelfHealService());
+    else
+        log('INFO', 'Self-heal service disabled');
+    if (isEnabled('keychain-reap'))
+        supervisor.register(new KeychainReapService());
+    else
+        log('INFO', 'Keychain-reap service disabled');
+    await supervisor.startAll({ log });
+    activeServiceSupervisor = supervisor;
     // scheduler.enabled=false in this machine's device doc means NO routines fire
     // here — the scheduler and its catchup recovery simply never start, while the
     // daemon keeps its other duties (secrets broker, browser IPC, session sync).
@@ -1093,21 +1070,12 @@ export async function runDaemon() {
     }
     if (schedulerEnabledAtBoot)
         bootScheduler();
-    // Usage and authentication are first-party device state, so the daemon owns
-    // their timers directly rather than scheduling them as built-in routines.
-    // Explicit CLI refreshes converge on the same cross-process refresh leases.
-    const accountStateService = isEnabled('account-state')
-        ? startAccountStateService({
-            refreshUsage: runUsageRefreshTick,
-            refreshAuth: runFleetCacheWarmTick,
-            onError: (area, error) => log('WARN', `${area} state refresh failed: ${error.message}`),
-        })
-        : null;
-    if (!accountStateService)
-        log('INFO', 'Account-state service disabled');
     // Active-sessions publish-own: continuous journal writer for `sessions watch`.
     // Fire once immediately so a cold daemon does not leave watchers on
-    // "awaiting publisher" for a full tick (RUSH-2484).
+    // "awaiting publisher" for a full tick (RUSH-2484). This boot-time fire alone
+    // no-ops on a genuinely cold boot (no reader has connected yet) — the
+    // presence watch below is what actually closes the gap for a watcher that
+    // connects later, whether at cold boot or after the reader-idle window.
     let activeSessionsWarmInFlight = false;
     const runActiveSessionsWarm = async () => {
         if (activeSessionsWarmInFlight)
@@ -1125,135 +1093,23 @@ export async function runDaemon() {
     };
     void runActiveSessionsWarm();
     const activeSessionsWarmInterval = setInterval(() => { void runActiveSessionsWarm(); }, ACTIVE_SESSIONS_WARM_TICK_MS);
-    // Session-index warm (RUSH-2682): keep THIS host's transcript index current so
-    // a locally-started session is discoverable within seconds. Incremental +
-    // single-flight (the DB scan claim), overlap-guarded so a slow scan never
-    // stacks on the next tick.
-    let sessionIndexWarmInFlight = false;
-    const runSessionIndexWarm = async () => {
-        if (sessionIndexWarmInFlight)
-            return;
-        sessionIndexWarmInFlight = true;
-        try {
-            const { indexed, claimed } = await runSessionIndexWarmTick();
-            // Log only when the tick did something. A silent tick is what let it
-            // report 0 forever unnoticed (RUSH-2691); a line on every idle 20s tick
-            // would drown the log, so the steady state (claimed, nothing changed)
-            // stays quiet and both interesting outcomes are visible.
-            if (!claimed)
-                log('INFO', 'session-index warm: skipped, another process holds the scan claim');
-            else if (indexed > 0)
-                log('INFO', `session-index warm: indexed ${indexed} transcript(s)`);
-        }
-        catch (err) {
-            log('WARN', `session-index warm failed: ${err.message}`);
-        }
-        finally {
-            sessionIndexWarmInFlight = false;
-        }
-    };
-    void runSessionIndexWarm();
-    const sessionIndexWarmInterval = setInterval(() => { void runSessionIndexWarm(); }, SESSION_INDEX_WARM_TICK_MS);
-    // Watchdog: nudge this host's own stalled agent sessions. Gated on the
-    // `watchdog.enabled` device-config flag (`agents watchdog enable`), so the
-    // timer always fires but only does work when the user opted in. Overlap-safe
-    // via the in-flight guard (a slow pass never overlaps the next tick).
-    let watchdogInterval;
-    if (isEnabled('watchdog')) {
-        let watchdogInFlight = false;
-        const runWatchdogTick = async () => {
-            if (watchdogInFlight)
-                return;
-            watchdogInFlight = true;
-            try {
-                if (getConfigValue('watchdog.enabled').value !== true)
-                    return;
-                const { runWatchdogPass } = await import('../watchdog/service.js');
-                const result = await runWatchdogPass({ nudge: true });
-                log('INFO', `watchdog: ${result.counts.total} live, ${result.counts.stalled} stalled, ${result.counts.nudged} nudged`);
-                emit('watchdog.action', {
-                    module: 'watchdog',
-                    total: result.counts.total,
-                    stalled: result.counts.stalled,
-                    nudged: result.counts.nudged,
-                });
-            }
-            catch (err) {
-                log('WARN', `watchdog tick failed: ${err.message}`);
-            }
-            finally {
-                watchdogInFlight = false;
-            }
-        };
-        watchdogInterval = setInterval(() => { void runWatchdogTick(); }, WATCHDOG_TICK_MS);
-    }
-    else {
-        log('INFO', 'Watchdog service disabled');
-    }
-    // Device probe: refresh registered devices' reachability and detect newly
-    // appeared tailnet nodes, dropping a sentinel per pending device so the
-    // menu-bar helper can surface "NEW DEVICES → Register / Ignore". Refresh mode
-    // never auto-registers a newcomer; a machine without tailscale is a clean
-    // no-op. `reconcilePendingSentinels` re-subtracts the ignore-list AND the
-    // registered roster, so a dismissed or already-known device is never
-    // re-surfaced (RUSH-2495 + registry-empty pollution). On soft-fail (no
-    // tailscale) we still prune registered/ignored sentinels so a hermetic test
-    // leak cannot leave fleet boxes in NEW DEVICES forever.
-    let deviceProbeInterval;
-    if (isEnabled('device-probe')) {
-        let deviceProbeInFlight = false;
-        const runDeviceProbeTick = async () => {
-            if (deviceProbeInFlight)
-                return;
-            deviceProbeInFlight = true;
-            try {
-                const { runDeviceSync } = await import('../devices/sync.js');
-                const { reconcilePendingSentinels, pruneDismissedPendingSentinels, } = await import('../devices/pending.js');
-                const dev = await runDeviceSync({ soft: true, mode: 'refresh' });
-                if (!dev.ok) {
-                    await pruneDismissedPendingSentinels();
-                    if (dev.reason)
-                        log('WARN', `device probe soft-fail: ${dev.reason}`);
-                    return;
-                }
-                await reconcilePendingSentinels(dev.pending);
-                if (dev.pending.length) {
-                    log('INFO', `devices: ${dev.pending.length} new pending (${dev.pending.map((p) => p.name).join(', ')})`);
-                }
-            }
-            catch (err) {
-                log('WARN', `device probe tick failed: ${err.message}`);
-            }
-            finally {
-                deviceProbeInFlight = false;
-            }
-        };
-        // Fire once on start so a leftover pollution set is cleared without waiting
-        // for the first interval tick (the 3-minute lag is how the menubar sat on
-        // 20 phantom NEW DEVICES after a hermetic leak).
-        void runDeviceProbeTick();
-        deviceProbeInterval = setInterval(() => { void runDeviceProbeTick(); }, DEVICE_PROBE_TICK_MS);
-    }
-    else {
-        log('INFO', 'Device-probe service disabled');
-    }
-    // Monitor engine: event-triggered watchers, beside the cron scheduler. Same
-    // daemon, same dispatch seam — a monitor is a routine whose trigger is a
-    // watched source instead of a clock. Reloads on SIGHUP alongside the scheduler.
-    const monitorEngine = isEnabled('monitors')
-        ? new MonitorEngine((level, message) => log(level, message))
-        : null;
-    if (monitorEngine) {
-        try {
-            monitorEngine.start();
-        }
-        catch (err) {
-            log('ERROR', `Monitor engine failed to start: ${err.message}`);
-        }
-    }
-    else {
-        log('INFO', 'Monitor engine disabled');
-    }
+    // Out-of-band trigger (RUSH-2484): a reader connecting only writes a presence
+    // timestamp (noteActiveSessionsJournalReader in watch.ts) with no path back to
+    // this timer, so on its own the interval above leaves a fresh connection
+    // waiting up to ACTIVE_SESSIONS_WARM_TICK_MS for its first rows. This watches
+    // for the idle->recent edge and gathers immediately instead of waiting for the
+    // next scheduled tick — a genuinely idle box with no reader still never gathers.
+    const stopActiveSessionsReaderWatch = watchActiveSessionsReaderPresence(() => { void runActiveSessionsWarm(); });
+    // Session-index warm (RUSH-2682) is registered on the supervisor above
+    // (RUSH-3193 P2) alongside the socket services.
+    // Watchdog and device-probe are now managed by WatchdogService /
+    // DeviceProbeService on the supervisor (RUSH-3193 P3), registered above
+    // alongside the socket services. The supervisor fires an immediate first
+    // tick on start, which replaces device-probe's old `void
+    // runDeviceProbeTick()` kick-off (the 3-minute lag that used to leave the
+    // menubar showing 20 phantom NEW DEVICES after a hermetic leak).
+    // Monitor engine is now managed by MonitorEngineService on the supervisor
+    // (RUSH-3193 P2). Access it via monitorEngineSvc.getEngine() in handleReload.
     // Backlog recovery: any enabled recurring job whose most-recent expected fire
     // is older than its most-recent recorded run was missed — the laptop slept,
     // the machine was off, or the daemon crashed through the fire. croner only
@@ -1263,7 +1119,7 @@ export async function runDaemon() {
     // `catchup: false`, RUN late. Runs on a timer as well as at startup: a startup
     // pass alone misses a fire lost while the daemon stayed up but its event loop
     // was wedged, or one lost across an OS suspend that the process survived.
-    // Overlap guard, same shape as runHealCheck (above). A pass
+    // Overlap guard, same shape as SelfHealService's supervisor-owned inFlight guard. A pass
     // awaits executeJobDetached per job and an off-box (host/cloud) dispatch can
     // block for a while, so a slow pass could still be working when the next tick
     // fires. Both passes would then see a job the first has not yet reached as
@@ -1323,42 +1179,9 @@ export async function runDaemon() {
             catchingUp = false;
         }
     }
-    // Before the BrowserService comes up, reap browser + tunnel processes
-    // spawned by previous daemons that are no longer alive. Without this,
-    // a daemon hard-crash (SIGKILL, OOM) would leak every browser and SSH
-    // tunnel it had open — and the next session would either hijack those
-    // (cdp:// profile silently driven via stale ssh tunnel) or fail to
-    // bind because the ports are still claimed.
-    try {
-        const { reapOrphanedProcesses } = await import('../browser/runtime-state.js');
-        const result = reapOrphanedProcesses();
-        if (result.reaped > 0) {
-            log('INFO', `Reaped ${result.reaped} orphan process(es) from prior daemon(s)`);
-            for (const d of result.details)
-                log('INFO', `  ${d}`);
-        }
-    }
-    catch (err) {
-        log('ERROR', `Orphan reaper failed: ${err.message}`);
-    }
-    const browserService = isEnabled('browser-ipc') ? new BrowserService() : null;
-    const browserIPC = browserService ? new BrowserIPCServer(browserService) : null;
-    if (browserIPC) {
-        try {
-            await browserIPC.start();
-            log('INFO', 'Browser IPC server started');
-            recordSubsystemOk(SUBSYSTEM_BROWSER_IPC);
-        }
-        catch (err) {
-            const message = err.message;
-            log('ERROR', `Browser IPC failed to start: ${message}`);
-            recordSubsystemError(SUBSYSTEM_BROWSER_IPC, message);
-        }
-    }
-    else {
-        log('INFO', 'Browser IPC service disabled');
-    }
-    // 5th hosted service: signed webhook receiver(s) + their funnel (RUSH-2548).
+    // Browser orphan reap and IPC server start are now managed by BrowserIPCService
+    // on the supervisor (RUSH-3193 P2). The orphan reap runs inside onStart().
+    // Webhook receivers: signed webhook receiver(s) + their funnel (RUSH-2548).
     // Started after the broker (above) so it resolves each receiver's signing
     // secret headlessly — no AGENTS_SECRETS_PASSPHRASE, no nohup. Binds nothing
     // unless daemon/webhooks.yaml declares a receiver, so an unconfigured box no-ops.
@@ -1379,122 +1202,29 @@ export async function runDaemon() {
     }
     runMonitorTick();
     const monitorInterval = setInterval(runMonitorTick, MONITOR_TICK_MS);
-    // Resource safety check: see runHealCheck above. Runs ~every 6h plus once
-    // ~30s after startup so shims/PATH settle shortly after the daemon starts.
-    let healInterval;
-    let healKickoff;
-    if (isEnabled('self-heal')) {
-        healInterval = setInterval(() => { void runHealCheck(); }, SELF_HEAL_TICK_MS);
-        healKickoff = setTimeout(() => { void runHealCheck(); }, SELF_HEAL_KICKOFF_MS);
-    }
-    else {
-        log('INFO', 'Self-heal service disabled');
-    }
-    // RUSH-1817: the startup host decision above is one-shot. If a standalone
-    // broker answered agentPing() at daemon start, the daemon declined to host —
-    // but should that standalone later die or crash-loop, nothing takes over and
-    // every `agents secrets unlock|export|start` fails until a manual restart
-    // (this wedged all keychain-backed secrets on zion and blocked a release).
-    // Re-probe on a cadence: whenever the daemon is NOT itself hosting AND no
-    // healthy broker answers a ping, take over hosting. startHostedBroker binds
-    // the socket only when it is free, so a take-over never races a live broker.
-    // Inline (not module-level): closes over `hostedBroker`, a mutable runDaemon-
-    // local var also closed over by handleShutdown. Lifting it would require
-    // hostedBroker to be module-level state too — wider than this refactor's scope.
-    let brokerSelfHealInterval;
-    if (isEnabled('secrets-broker')) {
-        let selfHealingBroker = false;
-        const runBrokerSelfHeal = async () => {
-            if (selfHealingBroker)
-                return;
-            selfHealingBroker = true;
-            try {
-                const { agentPing, startHostedBroker } = await import('../secrets/agent.js');
-                const reachable = (await agentPing()).reachable;
-                if (!shouldTakeOverBroker(hostedBroker != null, reachable))
-                    return;
-                hostedBroker = await startHostedBroker();
-                if (hostedBroker) {
-                    log('WARN', 'Secrets broker was unreachable; daemon took over hosting (self-heal)');
-                }
-            }
-            catch (err) {
-                log('WARN', `Secrets broker self-heal skipped: ${err.message}`);
-            }
-            finally {
-                selfHealingBroker = false;
-            }
-        };
-        brokerSelfHealInterval = setInterval(() => { void runBrokerSelfHeal(); }, BROKER_SELF_HEAL_TICK_MS);
-    }
-    // RUSH-2232: reap orphaned keychain helpers and `agents` processes stuck on a
-    // keychain call. Runs as a 5-min interval in the daemon (the single executor)
-    // so no UI surface can race it. See runKeychainReap above.
-    let keychainReapInterval;
-    if (isEnabled('keychain-reap')) {
-        keychainReapInterval = setInterval(() => { void runKeychainReap(); }, KEYCHAIN_REAP_TICK_MS);
-    }
-    else {
-        log('INFO', 'Keychain-reap service disabled');
-    }
+    // Resource self-heal is now managed by SelfHealService on the supervisor
+    // (RUSH-3193 P3), registered above alongside the socket services. The
+    // supervisor's immediate first tick on start replaces the old
+    // SELF_HEAL_KICKOFF_MS (30s) delayed kickoff timer — see self-heal-service.ts.
+    // Broker self-heal (RUSH-1817) is now encapsulated in SecretsBrokerService
+    // (RUSH-3193 P2). The interval fires inside onStart() and is stopped in onStop().
+    // RUSH-2232: keychain-reap is now managed by KeychainReapService on the
+    // supervisor (RUSH-3193 P3), registered above alongside the socket services.
     // RUSH-2501: reap tmux sessions whose panes are all dead. Runs on the same
     // 5-min cadence as the keychain reaper. Daemon-only (single executor).
     void runDeadPaneReap(); // kick-off on startup so the backlog clears immediately
     const deadPaneReapInterval = setInterval(() => { void runDeadPaneReap(); }, DEAD_PANE_REAP_TICK_MS);
     // RUSH-2622: close abandoned browser-task tabs on the same 5-min cadence,
-    // reusing the daemon's own long-lived BrowserService instead of a second
-    // one. Only when browser IPC is actually up — there is no service to reap
-    // through otherwise.
+    // reusing the daemon's own long-lived BrowserService. `browserSvcForReap` is
+    // the BrowserService created for BrowserIPCService above; null when disabled.
     let browserTaskReapInterval;
-    if (browserService) {
-        void runBrowserTaskReap(browserService); // kick-off on startup
-        browserTaskReapInterval = setInterval(() => { void runBrowserTaskReap(browserService); }, BROWSER_TASK_REAP_TICK_MS);
-    }
-    // RUSH-2367: self-terminate if this daemon's own state dir has been removed
-    // out from under it — the shape of a leaked test-fixture daemon whose /tmp
-    // HOME was deleted by its test's own cleanup while the process itself
-    // somehow survived (lost the SIGTERM/SIGKILL race, or outlived a killed
-    // test runner before its `finally` ever ran). Nothing else can reach a
-    // daemon in that state: no `agents daemon` command targets it, since a
-    // different HOME resolves a different ensureDaemonDir() and therefore a
-    // different instance registry — without this it runs forever. Reads
-    // the lifetime marker directly, never the local ensureDaemonDir() wrapper,
-    // which recreates the directory as a side effect and would defeat the check.
-    // Heartbeat/status paths may recreate the directory and pid file after a
-    // deletion; they never recreate this per-lifetime token.
-    // Inline (not module-level): closes over `lifetimePath` and `lifetimeToken`,
-    // per-boot constants computed once at runDaemon() start that cannot be
-    // pre-computed at module load time.
-    let stateDirCheckInterval;
-    if (isEnabled('state-dir-check')) {
-        let checkingStateDir = false;
-        const runStateDirSelfCheck = () => {
-            if (checkingStateDir)
-                return;
-            checkingStateDir = true;
-            try {
-                let markerMatches = false;
-                try {
-                    markerMatches = fs.readFileSync(lifetimePath, 'utf-8') === lifetimeToken;
-                }
-                catch {
-                    // A missing state dir or marker is the condition this guard detects.
-                }
-                if (!markerMatches) {
-                    log('WARN', `Daemon state dir ${getDaemonDir()} no longer exists; exiting (self-terminate guard)`);
-                    void handleShutdown();
-                }
-            }
-            finally {
-                checkingStateDir = false;
-            }
-        };
-        const stateDirCheckMs = Number(process.env.AGENTS_DAEMON_STATE_DIR_CHECK_MS) || STATE_DIR_CHECK_TICK_MS;
-        stateDirCheckInterval = setInterval(runStateDirSelfCheck, stateDirCheckMs);
-    }
-    else {
-        log('INFO', 'State-dir self-check disabled');
+    if (browserSvcForReap) {
+        void runBrowserTaskReap(browserSvcForReap); // kick-off on startup
+        browserTaskReapInterval = setInterval(() => { void runBrowserTaskReap(browserSvcForReap); }, BROWSER_TASK_REAP_TICK_MS);
     }
+    // RUSH-2367 / RUSH-3193 P3: state-dir-check (self-terminate guard) is
+    // registered on the supervisor further below, once `handleShutdown` exists
+    // — see the registration site after its declaration for why.
     // RUSH-2418: startup is over — the scheduler, browser IPC, broker decision,
     // monitor engine and every background tick are up. Only NOW does this daemon
     // clear the auto-start failure streak `ensureDaemonStarted` reads. Clearing it
@@ -1512,16 +1242,46 @@ export async function runDaemon() {
             const was = servicesConfig.services[id] !== false;
             const now = reloadedEnabled(id);
             if (was !== now) {
-                // scheduler and monitors are re-evaluated live later in this handler,
-                // so don't tell the user they need a restart for those.
+                // scheduler and monitors' off-transition are re-evaluated live later in
+                // this handler, so don't tell the user they need a restart for those.
                 if (id === 'scheduler' || (id === 'monitors' && !now)) {
                     continue;
                 }
-                log('INFO', `Service '${id}' toggled ${now ? 'on' : 'off'} — restart daemon to apply`);
+                if (id === 'monitors') {
+                    // monitors' on-transition still needs a restart — starting the
+                    // engine live is not wired up (see the liveMonitorEngine block below).
+                    log('INFO', `Service '${id}' toggled on — restart daemon to apply`);
+                    continue;
+                }
+                // RUSH-3193 P4: a service the supervisor already owns (it was enabled
+                // at daemon boot, so it was registered) takes the toggle live via
+                // supervisor.start/stop — no restart needed. One disabled at boot was
+                // never registered, so it falls through to the same "restart to
+                // apply" advice as before.
+                if (supervisor.isRegistered(id)) {
+                    const action = now ? supervisor.start(id) : supervisor.stop(id);
+                    void action
+                        .then(() => log('INFO', `Service '${id}' ${now ? 'started' : 'stopped'} live (SIGHUP reload)`))
+                        .catch((err) => log('WARN', `Service '${id}' live ${now ? 'start' : 'stop'} failed: ${err.message}`));
+                }
+                else {
+                    log('INFO', `Service '${id}' toggled ${now ? 'on' : 'off'} — restart daemon to apply`);
+                }
             }
         }
         // Remember the reloaded state so subsequent reloads log transitions truthfully.
         servicesConfig = reloadedConfig;
+        // Drain queued `agents daemon services restart <id>` requests (RUSH-3193 P4).
+        for (const id of drainDaemonServiceRestartQueue()) {
+            if (supervisor.isRegistered(id)) {
+                void supervisor.restartOne(id)
+                    .then(() => log('INFO', `Service '${id}' restarted live (SIGHUP reload)`))
+                    .catch((err) => log('WARN', `Service '${id}' live restart failed: ${err.message}`));
+            }
+            else {
+                log('WARN', `Restart requested for '${id}' but it is not supervisor-managed on this daemon — restart the daemon instead`);
+            }
+        }
         // Refresh user-layer copies of opted-in project routines BEFORE the
         // scheduler reloads, so YAML edits under `<project>/.agents/routines/`
         // take effect on the next fire without a manual `routines sync`.
@@ -1557,17 +1317,18 @@ export async function runDaemon() {
         }
         // Monitor engine can be stopped on reload if disabled; starting it requires
         // a restart, so we only handle the off transition here.
-        if (monitorEngine) {
+        const liveMonitorEngine = monitorEngineSvc.getEngine();
+        if (liveMonitorEngine) {
             if (!reloadedEnabled('monitors')) {
                 log('WARN', 'monitors service is now disabled — stopping monitor engine; restart daemon to re-enable');
                 try {
-                    monitorEngine.stop();
+                    liveMonitorEngine.stop();
                 }
                 catch { /* best-effort */ }
             }
             else {
                 try {
-                    monitorEngine.reload();
+                    liveMonitorEngine.reload();
                 }
                 catch (err) {
                     log('ERROR', `Monitor engine reload failed: ${err.message}`);
@@ -1576,39 +1337,28 @@ export async function runDaemon() {
         }
     };
     // Structurally single-shot (RUSH-2423). Shutdown is reachable from SIGTERM,
-    // SIGINT, and the state-dir self-check's independent `void handleShutdown()`,
-    // and two of those can arrive together — a service manager that SIGTERMs a
-    // daemon whose state dir was just removed. It was only INCIDENTALLY safe
-    // before (every step inside happens to be idempotent); the guard makes
-    // single-shot a property of the function rather than one that every step
-    // added later has to re-earn.
+    // SIGINT, and StateDirCheckService's independent `onMissing` callback (which
+    // calls this same handler), and two of those can arrive together — a
+    // service manager that SIGTERMs a daemon whose state dir was just removed.
+    // It was only INCIDENTALLY safe before (every step inside happens to be
+    // idempotent); the guard makes single-shot a property of the function
+    // rather than one that every step added later has to re-earn.
     const handleShutdown = singleShot(async () => {
         log('INFO', 'Daemon shutting down');
-        accountStateService?.stop();
         clearInterval(activeSessionsWarmInterval);
-        clearInterval(sessionIndexWarmInterval);
-        if (watchdogInterval)
-            clearInterval(watchdogInterval);
-        if (deviceProbeInterval)
-            clearInterval(deviceProbeInterval);
+        stopActiveSessionsReaderWatch();
+        // supervisor.stopAll() stops every registered service: secrets-broker
+        // (closes hostedBroker + self-heal timer), monitor engine, account-state,
+        // browser IPC, session-index, watchdog, device-probe, self-heal,
+        // keychain-reap, and (once registered just below) state-dir-check.
+        await supervisor.stopAll();
+        activeServiceSupervisor = null;
         stopScheduler();
-        monitorEngine?.stop();
-        await browserIPC?.stop();
         await webhookReceivers?.close();
         clearInterval(monitorInterval);
-        if (healInterval)
-            clearInterval(healInterval);
-        if (healKickoff)
-            clearTimeout(healKickoff);
-        if (brokerSelfHealInterval)
-            clearInterval(brokerSelfHealInterval);
-        if (keychainReapInterval)
-            clearInterval(keychainReapInterval);
         clearInterval(deadPaneReapInterval);
         if (browserTaskReapInterval)
             clearInterval(browserTaskReapInterval);
-        if (stateDirCheckInterval)
-            clearInterval(stateDirCheckInterval);
         try {
             if (fs.readFileSync(lifetimePath, 'utf-8') === lifetimeToken)
                 fs.unlinkSync(lifetimePath);
@@ -1616,12 +1366,30 @@ export async function runDaemon() {
         catch {
             // Already removed with the state dir, or replaced by a newer owner.
         }
-        hostedBroker?.close();
         removeDaemonPid();
         removeHeartbeat();
         unregisterDaemonInstance();
         process.exit(0);
     });
+    // State-dir self-check (RUSH-2367 self-terminate guard) is registered on
+    // the supervisor here — AFTER `handleShutdown` above — rather than
+    // alongside watchdog/device-probe/self-heal/keychain-reap earlier. The
+    // supervisor fires an immediate first tick on `register()`+`start()`; doing
+    // that before `handleShutdown` exists would reference the const in its
+    // temporal dead zone the moment a mismatch is ever detected. Registering it
+    // here, once `handleShutdown` is a real function, removes that risk
+    // entirely rather than relying on the marker always matching on tick one.
+    if (isEnabled('state-dir-check')) {
+        supervisor.register(new StateDirCheckService({
+            lifetimePath,
+            lifetimeToken,
+            onMissing: () => { void handleShutdown(); },
+        }));
+        await supervisor.start('state-dir-check');
+    }
+    else {
+        log('INFO', 'State-dir self-check disabled');
+    }
     process.on('SIGHUP', handleReload);
     process.on('SIGTERM', () => handleShutdown());
     process.on('SIGINT', () => handleShutdown());