@phnx-labs/agents-cli 1.22.53 → 1.22.55

package/dist/lib/browser/remote-control.js

@@ -2,11 +2,13 @@
  * Consent gate for driving THIS machine's browser from another fleet machine.
  *
  * `browser --device <device>` routes a browser command to `<device>` over SSH (the
- * fleet passthrough) and runs `agents browser ...` there. Every such remote
- * invocation carries the {@link FLEET_REMOTE_ENV} marker, set once at the fleet
- * dispatch site (`maybeRunOnHost`). A machine only accepts being driven when its
- * owner has opted in via `agents browser remote-control on` (the device-scope
- * `browser.remote-control` config key, never synced).
+ * fleet passthrough) and runs `agents browser ...` there. `agents ssh <device>
+ * agents browser …` is the same remote drive through the ssh wrapper. Every such
+ * remote invocation carries the {@link FLEET_REMOTE_ENV} marker, set at the fleet
+ * dispatch site (`maybeRunOnHost` / `streamAgentsOnHost`) and on the ssh wrapper
+ * (`buildSshInvocation` via `markFleetRemote`). A machine only accepts being driven
+ * when its owner has opted in via `agents browser remote-control on` (the
+ * device-scope `browser.remote-control` config key, never synced).
  *
  * Local invocations (no marker) are never gated — this only governs cross-machine
  * drives. Read-only queries are not gated.
@@ -22,9 +24,9 @@
  * as a fast-fail CLI-side check so a refused `start` never auto-creates a profile.
  */
 import { getConfigValue } from '../device-config.js';
-/** Env marker set on every remote `agents` invocation by `buildRemoteAgentsInvocation`. */
+/** Env marker set on every remote `agents` invocation by `buildRemoteAgentsInvocation` and `markFleetRemote`. */
 export const FLEET_REMOTE_ENV = 'AGENTS_FLEET_REMOTE';
-/** True when this process was dispatched to this machine by a fleet `--device` run. */
+/** True when this process was dispatched to this machine by a fleet `--device` or `agents ssh … agents browser` run. */
 export function isFleetRemoteInvocation(env = process.env) {
     return env[FLEET_REMOTE_ENV] === '1';
 }

package/dist/lib/browser/service.js

@@ -21,6 +21,7 @@ import { emit } from '../feed/events.js';
 import { resolveActor } from '../actor.js';
 import { recordBrowserSession } from '../session/db.js';
 import { sshExecAsync } from '../ssh-exec.js';
+import { resolveFfmpeg } from './ffmpeg.js';
 /**
  * Canonical form for comparing a requested URL against what CDP reports for a
  * live target. `new URL('https://example.com').href` is `https://example.com/`,
@@ -1130,38 +1131,29 @@ export class BrowserService {
         await fs.promises.mkdir(recordingsDir, { recursive: true });
         const outputPath = path.join(recordingsDir, `${Date.now()}.webm`);
         // Resolve ffmpeg lazily so non-recording paths don't pay the import cost.
-        const { spawn } = await import('child_process');
-        // CDP `Page.startScreencast` delivers frames at a VARIABLE cadence (paints
-        // are event-driven, not clocked). Feeding those into a fixed `-framerate`
-        // input made ffmpeg assume every frame was 1/fps apart, so a page that
-        // painted slower/faster than `fps` played back at the wrong speed. Instead
-        // stamp each frame with its wall-clock arrival time
-        // (`-use_wallclock_as_timestamps 1`) and keep those timings on output
-        // (`-vsync vfr`), so playback duration matches the real capture.
-        const ffmpeg = spawn('ffmpeg', [
+        const [{ spawn }, ffmpegPath] = await Promise.all([
+            import('child_process'),
+            resolveFfmpeg(),
+        ]);
+        // The frame pump below clocks the latest CDP paint into stdin at exactly
+        // `fps`, including repeated frames while the page is static. Declare that
+        // cadence to image2pipe so frame count / fps is the real capture duration.
+        const ffmpeg = spawn(ffmpegPath, [
             '-loglevel', 'error',
             '-f', 'image2pipe',
-            '-use_wallclock_as_timestamps', '1',
+            '-framerate', String(fps),
             '-i', '-',
             '-c:v', 'libvpx-vp9',
             '-b:v', '1M',
             '-pix_fmt', 'yuv420p',
-            '-vsync', 'vfr',
             '-y',
             outputPath,
         ], { stdio: ['pipe', 'ignore', 'pipe'], windowsHide: true });
-        // Wait for the spawn to confirm (or fail) before we wire CDP frames into a
-        // dead pipe. ENOENT from a missing ffmpeg surfaces here as a real error
-        // instead of a silently empty .webm.
+        // Wait for the spawn to confirm before wiring CDP frames into a dead pipe.
         await new Promise((resolve, reject) => {
             const onError = (err) => {
                 ffmpeg.off('spawn', onSpawn);
-                if (err.code === 'ENOENT') {
-                    reject(new Error('ffmpeg not found on PATH — install via `brew install ffmpeg`'));
-                }
-                else {
-                    reject(err);
-                }
+                reject(err);
             };
             const onSpawn = () => {
                 ffmpeg.off('error', onError);
@@ -1181,13 +1173,33 @@ export class BrowserService {
         });
         const ffmpegStderr = () => stderrBuf;
         ffmpeg.on('error', () => { });
-        // 30 fps is CDP's screencast cap; everyNthFrame = round(30/fps).
-        const everyNthFrame = Math.max(1, Math.round(30 / fps));
-        await conn.cdp.send('Page.startScreencast', { format: 'jpeg', quality: 60, everyNthFrame }, sessionId);
-        const frameHandler = (params) => {
+        let frameCount = 0;
+        let latestFrame;
+        let stdinBlocked = false;
+        let stdinError;
+        ffmpeg.stdin?.on('drain', () => { stdinBlocked = false; });
+        ffmpeg.stdin?.on('error', (error) => { stdinError = error; });
+        const writeFrame = (frame) => {
+            const stdin = ffmpeg.stdin;
+            if (!stdin || stdin.destroyed || stdinError || stdinBlocked)
+                return false;
+            stdinBlocked = !stdin.write(frame);
+            frameCount += 1;
+            return true;
+        };
+        const frameIntervalMs = 1000 / fps;
+        let resolveFirstFrame;
+        const firstFrame = new Promise((resolve) => { resolveFirstFrame = resolve; });
+        const frameHandler = (params, eventSessionId) => {
+            if (eventSessionId !== sessionId)
+                return;
             const p = params;
             try {
-                ffmpeg.stdin?.write(Buffer.from(p.data, 'base64'));
+                latestFrame = Buffer.from(p.data, 'base64');
+                if (frameCount === 0) {
+                    if (writeFrame(latestFrame))
+                        resolveFirstFrame();
+                }
             }
             catch {
                 // ffmpeg exited; ignore writes
@@ -1195,7 +1207,77 @@ export class BrowserService {
             // Must ack every frame or CDP stops sending.
             conn.cdp.send('Page.screencastFrameAck', { sessionId: p.sessionId }, sessionId).catch(() => { });
         };
+        // CDP emits on paints, so a static page can legitimately produce only one
+        // event in 15 seconds. Retain the latest real frame and clock it into the
+        // encoder at --fps; new paints replace it, while quiet time still advances
+        // the WebM timeline instead of collapsing to a one-frame, 0.04s artifact.
+        const framePump = setInterval(() => {
+            if (!latestFrame)
+                return;
+            try {
+                writeFrame(latestFrame);
+            }
+            catch {
+                // ffmpeg exited; recordStop reports its exit code and stderr.
+            }
+        }, frameIntervalMs);
+        // Register BEFORE startScreencast. Chrome may emit its first frame before
+        // the command response; missing that frame also misses its ack and stalls
+        // the entire stream with ffmpeg's stdin still empty (PHNX-2600).
         conn.cdp.on('Page.screencastFrame', frameHandler);
+        try {
+            await conn.cdp.send('Page.enable', {}, sessionId);
+            await conn.cdp.send('Page.startScreencast', {
+                format: 'jpeg',
+                quality: 60,
+                // Chrome's frames are paint-driven, not a 30fps clock. Asking for
+                // every third paint can suppress the only stored frame on a static
+                // page, so receive every paint and enforce --fps when writing stdin.
+                everyNthFrame: 1,
+                maxFramesInFlight: 1,
+                // A static/low-paint page may produce no new compositor frame after
+                // startScreencast. Ask Chrome to send its stored last frame so the
+                // first ack can bootstrap the stream instead of leaving ffmpeg stdin
+                // empty forever (confirmed live against Chrome 151 / PHNX-2600).
+                sendLastFrame: true,
+            }, sessionId);
+            await new Promise((resolve, reject) => {
+                const timer = setTimeout(() => reject(new Error('Chrome produced no screencast frame within 5s; recording was not started.')), 5000);
+                firstFrame.then(() => {
+                    clearTimeout(timer);
+                    resolve();
+                });
+            });
+        }
+        catch (error) {
+            conn.cdp.off('Page.screencastFrame', frameHandler);
+            clearInterval(framePump);
+            try {
+                await conn.cdp.send('Page.stopScreencast', {}, sessionId);
+            }
+            catch { /* session may be gone */ }
+            try {
+                ffmpeg.stdin?.end();
+            }
+            catch { /* process may already be gone */ }
+            await new Promise((resolve) => {
+                if (ffmpeg.exitCode !== null)
+                    return resolve();
+                const timer = setTimeout(() => {
+                    try {
+                        ffmpeg.kill('SIGKILL');
+                    }
+                    catch { /* already gone */ }
+                    resolve();
+                }, 1000);
+                ffmpeg.once('exit', () => {
+                    clearTimeout(timer);
+                    resolve();
+                });
+            });
+            await fs.promises.rm(outputPath, { force: true });
+            throw error;
+        }
         const durationMs = durationSec * 1000;
         const maxBytes = maxMb * 1024 * 1024;
         const state = {
@@ -1206,9 +1288,12 @@ export class BrowserService {
             maxBytes,
             ffmpeg,
             ffmpegStderr,
+            encoderError: () => stdinError,
+            get frameCount() { return frameCount; },
             sessionId,
             conn,
             frameHandler,
+            framePump,
             durationTimer: setTimeout(() => {
                 this.recordStop(taskId, 'duration-cap').catch(() => { });
             }, durationMs),
@@ -1242,6 +1327,7 @@ export class BrowserService {
         rec.stopReason = reason;
         clearTimeout(rec.durationTimer);
         clearInterval(rec.sizeCheckInterval);
+        clearInterval(rec.framePump);
         rec.conn.cdp.off('Page.screencastFrame', rec.frameHandler);
         try {
             await rec.conn.cdp.send('Page.stopScreencast', {}, rec.sessionId);
@@ -1291,6 +1377,13 @@ export class BrowserService {
                 `${rec.outputPath}; the file is likely corrupt or empty.` +
                 (err ? ` ffmpeg: ${err.slice(-800)}` : ''));
         }
+        const encoderError = rec.encoderError?.();
+        if (encoderError) {
+            throw new Error(`ffmpeg stopped accepting recording frames at ${rec.outputPath}: ${encoderError.message}`);
+        }
+        if (rec.frameCount === 0) {
+            throw new Error(`Chrome delivered no frames for the recording at ${rec.outputPath}; the output is empty.`);
+        }
         let bytes = 0;
         try {
             const st = await fs.promises.stat(rec.outputPath);
@@ -1995,6 +2088,7 @@ export class BrowserService {
                 rec.conn.cdp.off('Page.screencastFrame', rec.frameHandler);
             }
             catch { /* socket may be gone */ }
+            clearInterval(rec.framePump);
             try {
                 rec.ffmpeg.stdin?.end();
             }

package/dist/lib/claude-account-token.d.ts

@@ -1,3 +1,13 @@
+/**
+ * Reserved FILE-BASED secrets bundle holding long-lived, non-rotating Claude
+ * setup-tokens. Usage/probe reads authenticate with these instead of Claude
+ * Code's ACL-bound login item, so they never pop Touch ID. Keyed strictly
+ * per-account (`CLAUDE_CODE_OAUTH_TOKEN_<slug>` from the account email) — never a
+ * bare key, so one account's token can't be misapplied to another in a
+ * multi-account fleet.
+ */
+/** Alias of the secrets-layer reserved name so mint/seed shares one source of truth. */
+export declare const AUTH_BUNDLE = "auth";
 /** True only for a clean, single-line `sk-ant-oat01-…` token — see {@link SETUP_TOKEN_RE}. */
 export declare function isValidClaudeSetupToken(value: string): boolean;
 /** The per-account key an email maps to inside the `auth` bundle. */

package/dist/lib/claude-account-token.js

@@ -1,7 +1,7 @@
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
-import { bundleBackend, bundleExists, readAndResolveBundleEnv } from './secrets/bundles.js';
+import { AUTH_BUNDLE_NAME, ReservedBundleWrongBackendError, bundleBackend, bundleExists, readAndResolveBundleEnv, } from './secrets/bundles.js';
 import { fileStoreItemPath } from './secrets/filestore.js';
 import { secretsKeychainItem } from './secrets/index.js';
 /**
@@ -12,7 +12,8 @@ import { secretsKeychainItem } from './secrets/index.js';
  * bare key, so one account's token can't be misapplied to another in a
  * multi-account fleet.
  */
-const AUTH_BUNDLE = 'auth';
+/** Alias of the secrets-layer reserved name so mint/seed shares one source of truth. */
+export const AUTH_BUNDLE = AUTH_BUNDLE_NAME;
 /**
  * A well-formed Claude OAuth setup-token: the `sk-ant-oat01-` prefix followed by
  * token-safe characters only, on a single line. `claude setup-token` mints exactly
@@ -82,8 +83,15 @@ export function resolveClaudeSetupToken(home) {
         const email = readClaudeAccountEmail(home);
         if (!email)
             return null;
-        if (!bundleExists(AUTH_BUNDLE) || bundleBackend(AUTH_BUNDLE) !== 'file')
+        if (!bundleExists(AUTH_BUNDLE))
             return null;
+        const backend = bundleBackend(AUTH_BUNDLE);
+        if (backend !== 'file') {
+            // SEC-GAP-3: a keychain/vault-backed `auth` used to return null here, so
+            // usage/probe fell through to the interactive login (Touch ID) with no
+            // hint that the seeded setup-token was being ignored.
+            throw new ReservedBundleWrongBackendError(AUTH_BUNDLE, backend);
+        }
         const cacheKey = home ?? os.homedir();
         const item = secretsKeychainItem(AUTH_BUNDLE, claudeAccountTokenKey(email));
         const credentialPath = fileStoreItemPath(item);
@@ -110,7 +118,9 @@ export function resolveClaudeSetupToken(home) {
         // than return a token whose current file fingerprint was never observed.
         return null;
     }
-    catch {
+    catch (err) {
+        if (err instanceof ReservedBundleWrongBackendError)
+            throw err;
         return null;
     }
 }

package/dist/lib/config-drift.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Config drift: has THIS box drained its device-scoped state into its own
+ * `devices/<host>/agents.yaml`, or is it still carrying per-box state in the
+ * shared top-level `agents.yaml`?
+ *
+ * PHNX-3315 P1 heals a frozen top-level header and drains the central `browser:`
+ * tombstone; P2 folds `fleet.discovery` / `fleet.ignored`, the `hosts:` registry,
+ * and device-scoped native `accounts:` out of central and into the device doc.
+ * Each fold-and-delete migration is idempotent and runs on config access / daemon
+ * boot / install — so a converged box shows NO drift. A box that has NOT run the
+ * fold yet (stale checkout, never re-synced) still holds those blocks centrally,
+ * and until now that was INVISIBLE: `agents sync status` only reported per-agent
+ * "N missing", so an un-drained box was discovered the hard way — as a mystery
+ * `agents repo pull` conflict when two boxes rewrote the same shared map.
+ *
+ * This detector is READ-ONLY and must NOT trigger the migration (that would drain
+ * the very leak it is trying to surface): it reads the raw top-level user file
+ * directly, never `readMeta()` (system-merged) and never the migration hook.
+ */
+export interface ConfigDrift {
+    /** Top-level `agents.yaml` header != the current META_HEADER (the P1 case). */
+    staleHeader: boolean;
+    /**
+     * Labels of central blocks that should have folded into this box's device doc
+     * but still linger — the P1 `browser` tombstone and the P2 `fleet` / `hosts` /
+     * `accounts` device-scoped writers. Empty on a drained box.
+     */
+    centralLeaks: string[];
+}
+/**
+ * Inspect this box's on-disk state for config drift. Pure read — no migration, no
+ * writes. Mirrors the gather step of {@link migrateDeviceConfigStores} (plus the
+ * browser tombstone) so a leak here is exactly what a fold would drain.
+ */
+export declare function detectConfigDrift(): ConfigDrift;
+/** True when either drift class is present. */
+export declare function hasConfigDrift(d: ConfigDrift): boolean;

package/dist/lib/config-drift.js

@@ -0,0 +1,72 @@
+/**
+ * Config drift: has THIS box drained its device-scoped state into its own
+ * `devices/<host>/agents.yaml`, or is it still carrying per-box state in the
+ * shared top-level `agents.yaml`?
+ *
+ * PHNX-3315 P1 heals a frozen top-level header and drains the central `browser:`
+ * tombstone; P2 folds `fleet.discovery` / `fleet.ignored`, the `hosts:` registry,
+ * and device-scoped native `accounts:` out of central and into the device doc.
+ * Each fold-and-delete migration is idempotent and runs on config access / daemon
+ * boot / install — so a converged box shows NO drift. A box that has NOT run the
+ * fold yet (stale checkout, never re-synced) still holds those blocks centrally,
+ * and until now that was INVISIBLE: `agents sync status` only reported per-agent
+ * "N missing", so an un-drained box was discovered the hard way — as a mystery
+ * `agents repo pull` conflict when two boxes rewrote the same shared map.
+ *
+ * This detector is READ-ONLY and must NOT trigger the migration (that would drain
+ * the very leak it is trying to surface): it reads the raw top-level user file
+ * directly, never `readMeta()` (system-merged) and never the migration hook.
+ */
+import { hasStaleMetaHeader, readTopLevelUserMeta } from './state.js';
+function isMap(v) {
+    return !!v && typeof v === 'object' && !Array.isArray(v);
+}
+/**
+ * Inspect this box's on-disk state for config drift. Pure read — no migration, no
+ * writes. Mirrors the gather step of {@link migrateDeviceConfigStores} (plus the
+ * browser tombstone) so a leak here is exactly what a fold would drain.
+ */
+export function detectConfigDrift() {
+    const staleHeader = hasStaleMetaHeader();
+    const raw = readTopLevelUserMeta();
+    const centralLeaks = [];
+    if (raw) {
+        // P1: the leftover central `browser:` tombstone (should fold into deviceBrowser).
+        if (isMap(raw.browser) && Object.keys(raw.browser).length > 0) {
+            centralLeaks.push('browser');
+        }
+        // P2: fleet.discovery / fleet.ignored, and the short-lived per-device config
+        // store under fleet.devices.<name>.config — all fold into the device doc.
+        const fleet = isMap(raw.fleet) ? raw.fleet : undefined;
+        if (fleet) {
+            if (isMap(fleet.discovery) && Object.keys(fleet.discovery).length > 0) {
+                centralLeaks.push('fleet.discovery');
+            }
+            if (Array.isArray(fleet.ignored) && fleet.ignored.length > 0) {
+                centralLeaks.push('fleet.ignored');
+            }
+            if (isMap(fleet.devices)) {
+                const anyDeviceConfig = Object.values(fleet.devices).some((ov) => isMap(ov) && isMap(ov.config) && Object.keys(ov.config).length > 0);
+                if (anyDeviceConfig)
+                    centralLeaks.push('fleet.devices.*.config');
+            }
+        }
+        // P2: the central `hosts:` registry (should fold into deviceHosts).
+        if (isMap(raw.hosts) && Object.keys(raw.hosts).length > 0) {
+            centralLeaks.push('hosts');
+        }
+        // P2: central native accounts marked scope:'device' — identity PII that
+        // belongs in the device doc, off the git-tracked shared file. Fleet-shared /
+        // version-scoped identities stay central and are NOT a leak.
+        const accounts = isMap(raw.accounts) ? raw.accounts : undefined;
+        const native = accounts && isMap(accounts.native) ? accounts.native : undefined;
+        if (native && Object.values(native).some((a) => isMap(a) && a.scope === 'device')) {
+            centralLeaks.push('accounts (device-scoped)');
+        }
+    }
+    return { staleHeader, centralLeaks };
+}
+/** True when either drift class is present. */
+export function hasConfigDrift(d) {
+    return d.staleHeader || d.centralLeaks.length > 0;
+}

package/dist/lib/daemon/auth-sync-service.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Reserved `auth` bundle fleet sync as a `PeriodicService` (PHNX-2371).
+ *
+ * Each daemon that has a local file-backed `auth` bundle pushes it to pinned
+ * fleet devices that do not yet have it. The destination auto-provisions its
+ * own machine-local key; no passphrase is forwarded. Single-executor per
+ * destination: this process only writes the remote's own store.
+ */
+import { BasePeriodicService, type DaemonContext } from './service.js';
+import type { DaemonServiceId } from '../daemon-services.js';
+export declare class AuthSyncService extends BasePeriodicService {
+    readonly id: DaemonServiceId;
+    readonly intervalMs: number;
+    readonly deadlineMs: number;
+    readonly startupDelayMs = 60000;
+    protected onStart(_ctx: DaemonContext): Promise<void>;
+    protected onStop(): Promise<void>;
+    protected onTick(ctx: DaemonContext): Promise<void>;
+}

package/dist/lib/daemon/auth-sync-service.js

@@ -0,0 +1,34 @@
+/**
+ * Reserved `auth` bundle fleet sync as a `PeriodicService` (PHNX-2371).
+ *
+ * Each daemon that has a local file-backed `auth` bundle pushes it to pinned
+ * fleet devices that do not yet have it. The destination auto-provisions its
+ * own machine-local key; no passphrase is forwarded. Single-executor per
+ * destination: this process only writes the remote's own store.
+ */
+import { BasePeriodicService } from './service.js';
+const AUTH_SYNC_TICK_MS = 15 * 60_000;
+const AUTH_SYNC_DEADLINE_MS = 2 * 60_000;
+const AUTH_SYNC_KICKOFF_MS = 60_000;
+export class AuthSyncService extends BasePeriodicService {
+    id = 'auth-sync';
+    intervalMs = AUTH_SYNC_TICK_MS;
+    deadlineMs = AUTH_SYNC_DEADLINE_MS;
+    startupDelayMs = AUTH_SYNC_KICKOFF_MS;
+    async onStart(_ctx) {
+        // No connections to open — each tick re-reads the local bundle + registry.
+    }
+    async onStop() {
+        // Nothing to release — the supervisor's timer teardown is the only cleanup.
+    }
+    async onTick(ctx) {
+        const { syncReservedAuthBundle } = await import('../secrets/reserved-sync.js');
+        const result = syncReservedAuthBundle();
+        if (result.pushed.length > 0) {
+            ctx.log('INFO', `auth-sync: pushed auth to ${result.pushed.join(', ')}`);
+        }
+        for (const err of result.errors) {
+            ctx.log('WARN', `auth-sync: ${err.device}: ${err.message}`);
+        }
+    }
+}

package/dist/lib/daemon/browser-task-reap-service.d.ts

@@ -0,0 +1,14 @@
+/** Abandoned browser-task cleanup under supervision. */
+import { BrowserService } from '../browser/service.js';
+import type { DaemonServiceId } from '../daemon-services.js';
+import { BasePeriodicService, type DaemonContext } from './service.js';
+export declare class BrowserTaskReapService extends BasePeriodicService {
+    private readonly browserService;
+    readonly id: DaemonServiceId;
+    readonly intervalMs: number;
+    readonly deadlineMs: number;
+    constructor(browserService: BrowserService);
+    protected onStart(_ctx: DaemonContext): Promise<void>;
+    protected onStop(): Promise<void>;
+    protected onTick(ctx: DaemonContext): Promise<void>;
+}

package/dist/lib/daemon/browser-task-reap-service.js

@@ -0,0 +1,26 @@
+/** Abandoned browser-task cleanup under supervision. */
+import { resolveBrowserTaskIdleMs } from '../device-config.js';
+import { BasePeriodicService } from './service.js';
+const BROWSER_TASK_REAP_TICK_MS = 5 * 60_000;
+const BROWSER_TASK_REAP_DEADLINE_MS = 2 * 60_000;
+export class BrowserTaskReapService extends BasePeriodicService {
+    browserService;
+    id = 'browser-task-reap';
+    intervalMs = BROWSER_TASK_REAP_TICK_MS;
+    deadlineMs = BROWSER_TASK_REAP_DEADLINE_MS;
+    constructor(browserService) {
+        super();
+        this.browserService = browserService;
+    }
+    async onStart(_ctx) { }
+    async onStop() { }
+    async onTick(ctx) {
+        const result = await this.browserService.reapAbandoned({ idleMs: resolveBrowserTaskIdleMs() });
+        if (result.closed.length > 0) {
+            ctx.log('INFO', `Browser-task reaper: closed ${result.closed.length} task(s)`);
+            for (const closed of result.closed) {
+                ctx.log('INFO', `  ${closed.task} (${closed.reason}, profile ${closed.profile})`);
+            }
+        }
+    }
+}