@phnx-labs/agents-cli 1.22.53 → 1.22.55

package/dist/lib/daemon/secrets-broker-service.js

@@ -8,18 +8,19 @@
  * over hosting whenever the daemon is NOT already hosting AND no healthy
  * standalone broker answers a ping.
  */
-import { BaseDaemonService } from './service.js';
+import { BasePeriodicService } from './service.js';
 /** Matches the constant previously in daemon.ts. */
 const BROKER_SELF_HEAL_TICK_MS = 60_000;
+const BROKER_SELF_HEAL_DEADLINE_MS = 30_000;
 /** Take over only when we are not already hosting AND no broker is reachable. */
 function shouldTakeOver(isHosting, brokerReachable) {
     return !isHosting && !brokerReachable;
 }
-export class SecretsBrokerService extends BaseDaemonService {
+export class SecretsBrokerService extends BasePeriodicService {
     id = 'secrets-broker';
+    intervalMs = BROKER_SELF_HEAL_TICK_MS;
+    deadlineMs = BROKER_SELF_HEAL_DEADLINE_MS;
     hostedBroker = null;
-    selfHealTimer;
-    selfHealInFlight = false;
     async onStart(ctx) {
         const { agentPing, startHostedBroker } = await import('../secrets/agent.js');
         if ((await agentPing()).reachable) {
@@ -30,37 +31,21 @@ export class SecretsBrokerService extends BaseDaemonService {
             if (this.hostedBroker)
                 ctx.log('INFO', 'Secrets broker hosted in daemon (socket-first)');
         }
-        // RUSH-1817: if the standalone the daemon deferred to at start later dies,
-        // take over hosting on the next self-heal probe.
-        const runSelfHeal = async () => {
-            if (this.selfHealInFlight)
-                return;
-            this.selfHealInFlight = true;
-            try {
-                const { agentPing: ping, startHostedBroker: startBroker } = await import('../secrets/agent.js');
-                const reachable = (await ping()).reachable;
-                if (!shouldTakeOver(this.hostedBroker != null, reachable))
-                    return;
-                this.hostedBroker = await startBroker();
-                if (this.hostedBroker) {
-                    ctx.log('WARN', 'Secrets broker was unreachable; daemon took over hosting (self-heal)');
-                }
-            }
-            catch (err) {
-                ctx.log('WARN', `Secrets broker self-heal skipped: ${err.message}`);
-            }
-            finally {
-                this.selfHealInFlight = false;
-            }
-        };
-        this.selfHealTimer = setInterval(() => { void runSelfHeal(); }, BROKER_SELF_HEAL_TICK_MS);
     }
     async onStop() {
-        if (this.selfHealTimer !== undefined) {
-            clearInterval(this.selfHealTimer);
-            this.selfHealTimer = undefined;
-        }
         this.hostedBroker?.close();
         this.hostedBroker = null;
     }
+    async onTick(ctx) {
+        // RUSH-1817: if the standalone the daemon deferred to at start later dies,
+        // take over hosting on the next supervisor-owned self-heal probe.
+        const { agentPing, startHostedBroker } = await import('../secrets/agent.js');
+        const reachable = (await agentPing()).reachable;
+        if (!shouldTakeOver(this.hostedBroker != null, reachable))
+            return;
+        this.hostedBroker = await startHostedBroker();
+        if (this.hostedBroker) {
+            ctx.log('WARN', 'Secrets broker was unreachable; daemon took over hosting (self-heal)');
+        }
+    }
 }

package/dist/lib/daemon/service.d.ts

@@ -1,7 +1,7 @@
 /**
  * DaemonService contract (RUSH-3193 P1).
  *
- * Today the daemon's ~13 background services are bare `setInterval` closures
+ * Historically the daemon's background services were bare `setInterval` closures
  * inside one long `runDaemon()` (daemon.ts), sharing one event loop with no
  * per-service error boundary or deadline. A throw escaping a tick's local
  * try/catch hits the process-wide handler and kills every service; a tick that
@@ -41,7 +41,7 @@ export interface DaemonService {
 /** A service the supervisor ticks on a fixed interval, under a hard per-tick deadline. */
 export interface PeriodicService extends DaemonService {
     readonly intervalMs: number;
-    /** Hard cap per tick. An over-budget tick is abandoned (never awaited past this) so its in-flight guard always releases. */
+    /** Hard cap per tick. An over-budget tick parks the service; its in-flight guard remains held until the real promise settles. */
     readonly deadlineMs: number;
     /**
      * Delay before the FIRST tick after `start()`, in ms. Every later tick

package/dist/lib/daemon/service.js

@@ -1,7 +1,7 @@
 /**
  * DaemonService contract (RUSH-3193 P1).
  *
- * Today the daemon's ~13 background services are bare `setInterval` closures
+ * Historically the daemon's background services were bare `setInterval` closures
  * inside one long `runDaemon()` (daemon.ts), sharing one event loop with no
  * per-service error boundary or deadline. A throw escaping a tick's local
  * try/catch hits the process-wide handler and kills every service; a tick that

package/dist/lib/daemon/session-state-service.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Live-session metadata publisher as a supervised periodic service.
+ *
+ * This is the single daemon-owned writer behind `sessions watch`: consumers
+ * announce reader presence, and the service publishes an incremental journal
+ * snapshot immediately on the idle->active edge and every 15 seconds while a
+ * reader remains. Callers consume the row; they do not run their own gather.
+ */
+import type { DaemonServiceId } from '../daemon-services.js';
+import { BasePeriodicService, type DaemonContext } from './service.js';
+export declare class SessionStateService extends BasePeriodicService {
+    private readonly wake;
+    readonly id: DaemonServiceId;
+    readonly intervalMs = 15000;
+    readonly deadlineMs = 30000;
+    private stopReaderWatch;
+    constructor(wake: () => void);
+    protected onStart(_ctx: DaemonContext): Promise<void>;
+    protected onStop(): Promise<void>;
+    protected onTick(_ctx: DaemonContext): Promise<void>;
+}

package/dist/lib/daemon/session-state-service.js

@@ -0,0 +1,34 @@
+/**
+ * Live-session metadata publisher as a supervised periodic service.
+ *
+ * This is the single daemon-owned writer behind `sessions watch`: consumers
+ * announce reader presence, and the service publishes an incremental journal
+ * snapshot immediately on the idle->active edge and every 15 seconds while a
+ * reader remains. Callers consume the row; they do not run their own gather.
+ */
+import { runActiveSessionsWarmTick } from '../daemon-ticks.js';
+import { watchActiveSessionsReaderPresence } from '../session/session-cache.js';
+import { BasePeriodicService } from './service.js';
+const SESSION_STATE_TICK_MS = 15_000;
+const SESSION_STATE_DEADLINE_MS = 30_000;
+export class SessionStateService extends BasePeriodicService {
+    wake;
+    id = 'session-state';
+    intervalMs = SESSION_STATE_TICK_MS;
+    deadlineMs = SESSION_STATE_DEADLINE_MS;
+    stopReaderWatch = null;
+    constructor(wake) {
+        super();
+        this.wake = wake;
+    }
+    async onStart(_ctx) {
+        this.stopReaderWatch = watchActiveSessionsReaderPresence(this.wake);
+    }
+    async onStop() {
+        this.stopReaderWatch?.();
+        this.stopReaderWatch = null;
+    }
+    async onTick(_ctx) {
+        await runActiveSessionsWarmTick();
+    }
+}

package/dist/lib/daemon/supervisor.d.ts

@@ -12,9 +12,9 @@
  *  - A tick that hangs on an unbounded await (SSH, keychain) used to latch its
  *    local in-flight guard `true` forever, silently freezing that one service
  *    for the daemon's life (observed ~51h). Here, every tick races a
- *    `deadlineMs` timeout; when the deadline wins, the guard is released in
- *    `finally` regardless of whether the real tick promise ever settles, so
- *    the NEXT scheduled tick can still run.
+ *    `deadlineMs` timeout; when the deadline wins, that service is parked and
+ *    its in-flight guard stays held until the real promise settles. This keeps
+ *    a timed-out tick from overlapping another tick or lifecycle transition.
  *
  * Repeated failures (thrown or timed-out) open a circuit breaker: the service
  * is parked (its timer stopped) and retried on exponential backoff via its own
@@ -24,7 +24,7 @@
 import type { DaemonServiceId } from '../daemon-services.js';
 import type { DaemonContext, DaemonService, ServiceHealth } from './service.js';
 export interface ServiceSupervisorOptions {
-    /** Consecutive tick failures (throw or deadline breach) before a service is parked. Default 3. */
+    /** Consecutive thrown tick failures before a service is parked. Deadline breaches park immediately. Default 3. */
     parkAfterFailures?: number;
     /** First restart backoff delay, doubled on each further failed restart attempt. Default 5s. */
     backoffBaseMs?: number;
@@ -57,6 +57,12 @@ export declare class ServiceSupervisor {
     isRegistered(id: DaemonServiceId): boolean;
     /** Every currently registered service id. */
     registeredIds(): DaemonServiceId[];
+    /**
+     * Resolve when the service's current tick has really settled. Daemon control
+     * edges use this to queue a requested live transition without polling or
+     * treating a deadline race as cancellation.
+     */
+    awaitIdle(id: DaemonServiceId): Promise<void>;
     /**
      * Start one registered service live — drives `agents daemon services enable
      * <id>` (RUSH-3193 P4). Only affects a service already registered on this
@@ -67,6 +73,8 @@ export declare class ServiceSupervisor {
     start(id: DaemonServiceId): Promise<void>;
     /** Stop one registered service live — drives `agents daemon services disable <id>` (RUSH-3193 P4). */
     stop(id: DaemonServiceId): Promise<void>;
+    /** Request an immediate supervised tick, used by event edges that cannot wait for the regular cadence. */
+    runNow(id: DaemonServiceId): void;
     /** Health for every registered service, keyed by service id. */
     health(): Record<string, ServiceHealth>;
     private startOne;
@@ -75,13 +83,15 @@ export declare class ServiceSupervisor {
     /**
      * Run one tick under a hard deadline. The deadline is enforced with
      * `Promise.race`, not true cancellation — JS cannot abort an arbitrary
-     * in-flight await. What matters for the freeze this replaces is that
-     * `inFlight` is released in `finally` as soon as the race settles, so an
-     * abandoned tick can never block the next scheduled one again.
+     * in-flight await. A timeout parks the service immediately but deliberately
+     * keeps `inFlight` set until the REAL promise settles. Starting another tick
+     * or tearing resources down underneath the abandoned one would trade a
+     * visible parked service for duplicated side effects and lifecycle races.
      */
     private runTick;
     private park;
     private scheduleRestart;
     private attemptRestart;
     private recordFailure;
+    private finishTick;
 }

package/dist/lib/daemon/supervisor.js

@@ -12,9 +12,9 @@
  *  - A tick that hangs on an unbounded await (SSH, keychain) used to latch its
  *    local in-flight guard `true` forever, silently freezing that one service
  *    for the daemon's life (observed ~51h). Here, every tick races a
- *    `deadlineMs` timeout; when the deadline wins, the guard is released in
- *    `finally` regardless of whether the real tick promise ever settles, so
- *    the NEXT scheduled tick can still run.
+ *    `deadlineMs` timeout; when the deadline wins, that service is parked and
+ *    its in-flight guard stays held until the real promise settles. This keeps
+ *    a timed-out tick from overlapping another tick or lifecycle transition.
  *
  * Repeated failures (thrown or timed-out) open a circuit breaker: the service
  * is parked (its timer stopped) and retried on exponential backoff via its own
@@ -67,17 +67,35 @@ export class ServiceSupervisor {
     /** Stop every registered service and clear all timers. */
     async stopAll() {
         for (const id of this.registry.keys())
-            await this.stopOne(id);
+            await this.stopOne(id, true);
     }
     /** Force one service to restart right now, outside its normal backoff schedule. Drives `agents daemon services restart <id>` (RUSH-3193 P4). */
     async restartOne(id) {
         const entry = this.registry.get(id);
         if (!entry)
             throw new Error(`service '${id}' is not registered`);
+        if (entry.inFlight) {
+            throw new Error(`service '${id}' cannot restart while a tick is still in flight`);
+        }
+        // A live periodic service already owns an interval. attemptRestart() installs
+        // a fresh one after restart, so leaving the existing handles alive would
+        // multiply the tick rate on every operator-requested restart.
+        if (entry.timer) {
+            clearInterval(entry.timer);
+            entry.timer = undefined;
+        }
+        if (entry.startupTimer) {
+            clearTimeout(entry.startupTimer);
+            entry.startupTimer = undefined;
+        }
         if (entry.restartTimer) {
             clearTimeout(entry.restartTimer);
             entry.restartTimer = undefined;
         }
+        // Block a timer callback already queued in this event-loop turn while the
+        // service tears down and starts again.
+        entry.state = 'parked';
+        recordSubsystemState(id, 'parked');
         await this.attemptRestart(id);
     }
     /** Whether `id` is registered on this supervisor. A service disabled at daemon boot is never registered — see {@link start}. */
@@ -88,6 +106,20 @@ export class ServiceSupervisor {
     registeredIds() {
         return Array.from(this.registry.keys());
     }
+    /**
+     * Resolve when the service's current tick has really settled. Daemon control
+     * edges use this to queue a requested live transition without polling or
+     * treating a deadline race as cancellation.
+     */
+    async awaitIdle(id) {
+        const entry = this.registry.get(id);
+        if (!entry)
+            throw new Error(`service '${id}' is not registered`);
+        const activeTick = entry.activeTick;
+        if (!activeTick)
+            return;
+        await activeTick.catch(() => undefined);
+    }
     /**
      * Start one registered service live — drives `agents daemon services enable
      * <id>` (RUSH-3193 P4). Only affects a service already registered on this
@@ -101,6 +133,9 @@ export class ServiceSupervisor {
             throw new Error(`service '${id}' is not registered`);
         if (entry.state === 'running')
             return;
+        if (entry.inFlight) {
+            throw new Error(`service '${id}' cannot start while a tick is still in flight`);
+        }
         await this.startOne(id);
     }
     /** Stop one registered service live — drives `agents daemon services disable <id>` (RUSH-3193 P4). */
@@ -110,7 +145,13 @@ export class ServiceSupervisor {
             throw new Error(`service '${id}' is not registered`);
         if (entry.state === 'stopped')
             return;
-        await this.stopOne(id);
+        await this.stopOne(id, false);
+    }
+    /** Request an immediate supervised tick, used by event edges that cannot wait for the regular cadence. */
+    runNow(id) {
+        if (!this.registry.has(id))
+            throw new Error(`service '${id}' is not registered`);
+        void this.runTick(id);
     }
     /** Health for every registered service, keyed by service id. */
     health() {
@@ -164,10 +205,13 @@ export class ServiceSupervisor {
             recordSubsystemOk(id);
         }
     }
-    async stopOne(id) {
+    async stopOne(id, force) {
         const entry = this.registry.get(id);
         if (!entry)
             return;
+        if (entry.inFlight && !force) {
+            throw new Error(`service '${id}' cannot stop while a tick is still in flight`);
+        }
         if (entry.timer) {
             clearInterval(entry.timer);
             entry.timer = undefined;
@@ -182,6 +226,11 @@ export class ServiceSupervisor {
         }
         entry.state = 'stopped';
         recordSubsystemState(id, 'stopped');
+        // Whole-daemon shutdown must not hang forever on an unresolved tick, but it
+        // also must not tear down resources the tick may still be using. Stop its
+        // timers and mark it stopped; process exit owns final cleanup in this case.
+        if (entry.inFlight && force)
+            return;
         if (!entry.everStarted)
             return; // start() never succeeded — nothing to stop.
         try {
@@ -200,9 +249,10 @@ export class ServiceSupervisor {
     /**
      * Run one tick under a hard deadline. The deadline is enforced with
      * `Promise.race`, not true cancellation — JS cannot abort an arbitrary
-     * in-flight await. What matters for the freeze this replaces is that
-     * `inFlight` is released in `finally` as soon as the race settles, so an
-     * abandoned tick can never block the next scheduled one again.
+     * in-flight await. A timeout parks the service immediately but deliberately
+     * keeps `inFlight` set until the REAL promise settles. Starting another tick
+     * or tearing resources down underneath the abandoned one would trade a
+     * visible parked service for duplicated side effects and lifecycle races.
      */
     async runTick(id) {
         const entry = this.registry.get(id);
@@ -216,11 +266,17 @@ export class ServiceSupervisor {
         const periodicService = entry.service;
         entry.inFlight = true;
         let deadlineTimer;
+        let timedOut = false;
+        const tickPromise = periodicService.tick(ctx);
+        entry.activeTick = tickPromise;
         try {
             const deadline = new Promise((_, reject) => {
-                deadlineTimer = setTimeout(() => reject(new Error(`tick exceeded deadline of ${periodicService.deadlineMs}ms`)), periodicService.deadlineMs);
+                deadlineTimer = setTimeout(() => {
+                    timedOut = true;
+                    reject(new Error(`tick exceeded deadline of ${periodicService.deadlineMs}ms`));
+                }, periodicService.deadlineMs);
             });
-            await Promise.race([periodicService.tick(ctx), deadline]);
+            await Promise.race([tickPromise, deadline]);
             entry.consecutiveFailures = 0;
             entry.lastError = undefined;
             entry.lastRunMs = Date.now();
@@ -228,13 +284,20 @@ export class ServiceSupervisor {
         }
         catch (err) {
             this.recordFailure(entry, id, err);
-            if (entry.consecutiveFailures >= this.parkAfterFailures)
+            if (timedOut || entry.consecutiveFailures >= this.parkAfterFailures)
                 this.park(id);
         }
         finally {
             if (deadlineTimer)
                 clearTimeout(deadlineTimer);
-            entry.inFlight = false;
+            if (timedOut) {
+                // Promise.race cannot cancel arbitrary work. Keep the service parked and
+                // in-flight until the REAL tick settles; only then may backoff restart it.
+                void tickPromise.then(() => this.finishTick(id, tickPromise), () => this.finishTick(id, tickPromise));
+            }
+            else {
+                this.finishTick(id, tickPromise);
+            }
         }
     }
     park(id) {
@@ -248,7 +311,8 @@ export class ServiceSupervisor {
             entry.timer = undefined;
         }
         this.ctx?.log('WARN', `service '${id}' parked after ${entry.consecutiveFailures} consecutive failure(s)`);
-        this.scheduleRestart(id);
+        if (!entry.inFlight)
+            this.scheduleRestart(id);
     }
     scheduleRestart(id) {
         const entry = this.registry.get(id);
@@ -295,4 +359,13 @@ export class ServiceSupervisor {
         recordSubsystemError(id, message);
         this.ctx?.log('WARN', `service '${id}' failed: ${message}`);
     }
+    finishTick(id, tickPromise) {
+        const entry = this.registry.get(id);
+        if (!entry || entry.activeTick !== tickPromise)
+            return;
+        entry.activeTick = undefined;
+        entry.inFlight = false;
+        if (entry.state === 'parked' && !entry.restartTimer)
+            this.scheduleRestart(id);
+    }
 }

package/dist/lib/daemon/tmux-reap-service.d.ts

@@ -0,0 +1,11 @@
+/** Dead managed tmux session and orphan-helper cleanup under supervision. */
+import type { DaemonServiceId } from '../daemon-services.js';
+import { BasePeriodicService, type DaemonContext } from './service.js';
+export declare class TmuxReapService extends BasePeriodicService {
+    readonly id: DaemonServiceId;
+    readonly intervalMs: number;
+    readonly deadlineMs: number;
+    protected onStart(_ctx: DaemonContext): Promise<void>;
+    protected onStop(): Promise<void>;
+    protected onTick(ctx: DaemonContext): Promise<void>;
+}

package/dist/lib/daemon/tmux-reap-service.js

@@ -0,0 +1,28 @@
+/** Dead managed tmux session and orphan-helper cleanup under supervision. */
+import { getDefaultSocketPath } from '../tmux/paths.js';
+import { reapDeadTmuxPanes } from '../tmux/session.js';
+import { BasePeriodicService } from './service.js';
+const TMUX_REAP_TICK_MS = 5 * 60_000;
+const TMUX_REAP_DEADLINE_MS = 2 * 60_000;
+export class TmuxReapService extends BasePeriodicService {
+    id = 'tmux-reap';
+    intervalMs = TMUX_REAP_TICK_MS;
+    deadlineMs = TMUX_REAP_DEADLINE_MS;
+    async onStart(_ctx) { }
+    async onStop() { }
+    async onTick(ctx) {
+        const result = await reapDeadTmuxPanes(getDefaultSocketPath());
+        for (const warning of result.warnings)
+            ctx.log('WARN', `Dead-pane reaper: ${warning}`);
+        if (result.processes > 0) {
+            ctx.log('INFO', `Dead-pane reaper: terminated ${result.processes} orphaned helper process(es)`);
+            for (const detail of result.processDetails)
+                ctx.log('INFO', `  ${detail}`);
+        }
+        if (result.reaped > 0) {
+            ctx.log('INFO', `Dead-pane reaper: reaped ${result.reaped} session(s)`);
+            for (const detail of result.details)
+                ctx.log('INFO', `  killed ${detail}`);
+        }
+    }
+}

package/dist/lib/daemon/webhook-receiver-service.d.ts

@@ -0,0 +1,9 @@
+/** Signed webhook receiver lifecycle under the daemon service supervisor. */
+import type { DaemonServiceId } from '../daemon-services.js';
+import { BaseDaemonService, type DaemonContext } from './service.js';
+export declare class WebhookReceiverService extends BaseDaemonService {
+    readonly id: DaemonServiceId;
+    private receivers;
+    protected onStart(ctx: DaemonContext): Promise<void>;
+    protected onStop(): Promise<void>;
+}

package/dist/lib/daemon/webhook-receiver-service.js

@@ -0,0 +1,17 @@
+/** Signed webhook receiver lifecycle under the daemon service supervisor. */
+import { startHostedWebhookReceivers } from '../daemon-webhooks.js';
+import { BaseDaemonService } from './service.js';
+export class WebhookReceiverService extends BaseDaemonService {
+    id = 'webhook-receiver';
+    receivers = null;
+    async onStart(ctx) {
+        this.receivers = await startHostedWebhookReceivers({ log: ctx.log });
+        ctx.log('INFO', this.receivers.count > 0
+            ? `Webhook receiver hosting ${this.receivers.count} receiver(s)`
+            : 'Webhook receiver service enabled; no receivers declared in daemon/webhooks.yaml');
+    }
+    async onStop() {
+        await this.receivers?.close();
+        this.receivers = null;
+    }
+}

package/dist/lib/daemon-services.d.ts

@@ -7,7 +7,7 @@
  * enabled without pulling in the whole daemon lifecycle.
  */
 /** Every service the daemon can host. IDs are kebab-case and stable. */
-export type DaemonServiceId = 'secrets-broker' | 'scheduler' | 'monitors' | 'browser-ipc' | 'webhook-receiver' | 'self-heal' | 'keychain-reap' | 'account-state' | 'watchdog' | 'device-probe' | 'state-dir-check' | 'session-index';
+export type DaemonServiceId = 'secrets-broker' | 'scheduler' | 'monitors' | 'browser-ipc' | 'webhook-receiver' | 'self-heal' | 'keychain-reap' | 'account-state' | 'watchdog' | 'device-probe' | 'state-dir-check' | 'session-index' | 'auth-sync' | 'daemon-heartbeat' | 'tmux-reap' | 'browser-task-reap' | 'session-state';
 /** Human-readable metadata for each service. */
 export interface DaemonServiceDef {
     id: DaemonServiceId;

package/dist/lib/daemon-services.js

@@ -67,11 +67,36 @@ export const DAEMON_SERVICES = [
         title: 'State-dir self-check',
         description: 'Self-terminates the daemon if its state directory is removed.',
     },
+    {
+        id: 'daemon-heartbeat',
+        title: 'Daemon heartbeat',
+        description: 'Publishes daemon liveness and reconciles routine process state.',
+    },
+    {
+        id: 'tmux-reap',
+        title: 'Tmux reap',
+        description: 'Reaps dead managed tmux sessions and their orphaned helper processes.',
+    },
+    {
+        id: 'browser-task-reap',
+        title: 'Browser task reap',
+        description: 'Closes abandoned browser-task tabs whose owner exited or idle lease expired.',
+    },
+    {
+        id: 'session-state',
+        title: 'Live session state',
+        description: 'Publishes this host\'s active session metadata for sessions watch and fleet consumers.',
+    },
     {
         id: 'session-index',
         title: 'Session-index warm',
         description: 'Keeps this host\'s transcript index current so a locally-started session is discoverable within seconds.',
     },
+    {
+        id: 'auth-sync',
+        title: 'Auth bundle sync',
+        description: 'Pushes the reserved file-backed auth bundle (setup-tokens) to pinned fleet devices that do not yet have it.',
+    },
 ];
 /** Stable order of service IDs. */
 export const DAEMON_SERVICE_IDS = DAEMON_SERVICES.map((s) => s.id);

package/dist/lib/device-config.d.ts

@@ -223,9 +223,9 @@ export declare function isDaemonEnabled(): boolean;
 /**
  * Throw when the daemon is disabled on this machine, naming the setting and
  * the fix. Every AUTO-start surface (routines add/start/catchup/webhook,
- * `ensureDaemonStarted`) refuses with this before calling `startDaemon()`.
- * `agents daemon start` is the deliberate override and does NOT call this —
- * disable only blocks auto-start, mirroring `systemctl disable`.
+ * monitors add, `ensureDaemonStarted`) refuses with this before calling
+ * `startDaemon()`. `agents daemon start` is the deliberate override and does
+ * NOT call this — disable only blocks auto-start, mirroring `systemctl disable`.
  */
 export declare function assertDaemonEnabled(): void;
 /**

package/dist/lib/device-config.js

@@ -145,7 +145,7 @@ export const CONFIG_KEYS = [
         defaultValue: true,
         description: 'Whether the daemon may run on this device at all (secrets broker, browser IPC, watchdog, and the ' +
             'routines scheduler). Disabling is the top-level kill switch: nothing auto-starts the daemon while it ' +
-            'is set, including `routines add`/`routines start`/`routines catchup`/webhook triggers. ' +
+            'is set, including `routines add`/`routines start`/`routines catchup`/`monitors add`/webhook triggers. ' +
             '`agents daemon start` still starts it explicitly.',
     },
     {
@@ -176,7 +176,7 @@ export const CONFIG_KEYS = [
         visibility: 'machine',
         type: 'bool',
         defaultValue: false,
-        description: "Whether other fleet machines may drive THIS device's browser over `browser --device <this-device>`. " +
+        description: "Whether other fleet machines may drive THIS device's browser over `browser --device <this-device>` or `agents ssh <this-device> …` (`agents browser` / `ag browser` / standalone `browser`). " +
             'Default off — a fleet-remote drive is refused until the owner runs `agents browser remote-control on`.',
     },
     {
@@ -813,9 +813,9 @@ export function isDaemonEnabled() {
 /**
  * Throw when the daemon is disabled on this machine, naming the setting and
  * the fix. Every AUTO-start surface (routines add/start/catchup/webhook,
- * `ensureDaemonStarted`) refuses with this before calling `startDaemon()`.
- * `agents daemon start` is the deliberate override and does NOT call this —
- * disable only blocks auto-start, mirroring `systemctl disable`.
+ * monitors add, `ensureDaemonStarted`) refuses with this before calling
+ * `startDaemon()`. `agents daemon start` is the deliberate override and does
+ * NOT call this — disable only blocks auto-start, mirroring `systemctl disable`.
  */
 export function assertDaemonEnabled() {
     if (isDaemonEnabled())

package/dist/lib/devices/connect.d.ts

@@ -37,6 +37,26 @@ export declare function fleetDialTarget(device: DeviceProfile): string;
  * login).
  */
 export declare function wrapRemoteCommand(device: DeviceProfile, cmd: string[]): string | undefined;
+/**
+ * True when `cmd` is a browser drive: `agents browser …`, `ag browser …`, or
+ * the standalone `browser` binary (`cli/package.json` `bin.browser` →
+ * `src/browser.ts`), including the quoted single-string form
+ * `agents ssh box 'browser …'`. The `--device` passthrough stamps
+ * {@link markFleetRemote} on this shape so the far-side consent gate can fire;
+ * `agents ssh` must too (PHNX-3065).
+ */
+export declare function isAgentsBrowserDrive(cmd: string[]): boolean;
+/**
+ * Prefix a remote command so the far side sees `AGENTS_FLEET_REMOTE=1` — the
+ * marker the browser consent gate reads. `wrapRemoteCommand` joins the argv
+ * with spaces (POSIX) or base64-encodes it for PowerShell, so a
+ * shell-appropriate leading token rides through both: `env VAR=1 …` on POSIX,
+ * `$env:VAR='1'; …` on PowerShell.
+ *
+ * Already-marked argv (the `--device` fan-out stamps this before
+ * {@link buildSshInvocation}) is left unchanged so the prefix is not doubled.
+ */
+export declare function markFleetRemote(cmd: string[], device: Pick<DeviceProfile, 'shell'>): string[];
 /**
  * Build the remote command that starts an INTERACTIVE LOGIN shell inside a
  * mirrored project directory, falling back to the remote home when that
@@ -97,6 +117,12 @@ export declare function deviceIdentityArgs(device: DeviceProfile): string[];
  * to the remote home), matching `agents run --device`. It is ignored when a `cmd`
  * is given: an explicit command keeps its current cwd (the remote home) and its
  * behavior unchanged (RUSH-2412).
+ *
+ * An `agents browser …` / `ag browser …` / standalone `browser …` command is
+ * prefixed with {@link markFleetRemote} so the far-side consent gate sees
+ * `AGENTS_FLEET_REMOTE=1` the same way `browser --device` does. The local `env`
+ * overlay here is for the ssh *client* (askpass); it cannot carry the marker —
+ * OpenSSH does not forward arbitrary env (PHNX-3065).
  */
 export declare function buildSshInvocation(device: DeviceProfile, cmd: string[], askpassShimPath: string, hostKey?: SshHostKeyOptions, opts?: {
     agentOnly?: boolean;