@phnx-labs/agents-cli 1.22.54 → 1.22.55

package/dist/lib/daemon/daemon.js

@@ -17,23 +17,19 @@ import { listJobs as listAllJobs } from '../scheduling/routines.js';
 import { syncAllProjectRoutines } from '../routines-project.js';
 import { JobScheduler } from '../scheduler.js';
 // MonitorEngine is now owned by MonitorEngineService (daemon/monitor-engine-service.ts).
-import { executeJobDetached, monitorRunningJobs, listLiveRoutineChildren } from './runner.js';
+import { executeJobDetached, listLiveRoutineChildren } from './runner.js';
 import { detectOverdueJobs, notifyOverdue } from '../overdue.js';
 import { runCatchup } from '../catchup.js';
 import { notifyRoutineStart, notifyRoutineFinish, notifyRoutineStartFailed } from '../routine-notify.js';
 import { notifyOwnerRoutineFinish, notifyOwnerRoutineStartFailed } from '../routine-notify-owner.js';
 import { BrowserService } from '../browser/service.js';
 import { getSocketPath as getBrowserIpcSocketPath } from '../browser/ipc.js';
-import { startHostedWebhookReceivers } from '../daemon-webhooks.js';
 import { secretsBrokerSocketPath, brokerPidAlive } from '../secrets/agent.js';
 import { redactSecrets } from '../redact.js';
 import { getAgentsBinPath, getCliLaunch, BUN_VIRTUAL_ROOT } from '../cli-entry.js';
 import { localBinDir } from '../platform/posixpath.js';
-import { isSchedulerEnabled, assertSchedulerEnabled, isDaemonEnabled, resolveBrowserTaskIdleMs } from '../device-config.js';
-import { reapTerminalRoutineProcesses } from '../routine-process-cleanup.js';
+import { isSchedulerEnabled, assertSchedulerEnabled, isDaemonEnabled } from '../device-config.js';
 import { recordSubsystemOk, recordSubsystemError, recordSubsystemErrorReason, readSubsystemHealth, SUBSYSTEM_DAEMON_START } from '../daemon-health.js';
-import { runActiveSessionsWarmTick } from '../daemon-ticks.js';
-import { watchActiveSessionsReaderPresence } from '../session/session-cache.js';
 import { ServiceSupervisor } from './supervisor.js';
 import { SessionIndexService } from './session-index-service.js';
 import { SecretsBrokerService } from './secrets-broker-service.js';
@@ -46,6 +42,11 @@ import { SelfHealService } from './self-heal-service.js';
 import { KeychainReapService } from './keychain-reap-service.js';
 import { AuthSyncService } from './auth-sync-service.js';
 import { StateDirCheckService } from './state-dir-check-service.js';
+import { SessionStateService } from './session-state-service.js';
+import { WebhookReceiverService } from './webhook-receiver-service.js';
+import { HeartbeatService } from './heartbeat-service.js';
+import { TmuxReapService } from './tmux-reap-service.js';
+import { BrowserTaskReapService } from './browser-task-reap-service.js';
 import { emit, emitRoutineEnd } from '../feed/events.js';
 import { readDaemonServicesConfig, drainDaemonServiceRestartQueue } from '../daemon-services.js';
 /**
@@ -112,7 +113,6 @@ export function daemonSystemdUnitName() {
     const suffix = isolatedHomeSuffix();
     return suffix ? `agents-daemon-sandbox-${suffix}.service` : SYSTEMD_UNIT;
 }
-const MONITOR_TICK_MS = 60_000;
 /**
  * How often to re-scan for missed fires. Deliberately slower than the monitor
  * tick: detection walks a week of cron occurrences per routine
@@ -136,17 +136,10 @@ const CATCHUP_TICK_MS = 5 * 60_000;
  *   from wedges every keychain-backed secret on the box, so it runs minutely.
  */
 // BROKER_SELF_HEAL_TICK_MS moved to secrets-broker-service.ts (RUSH-3193 P2).
-// RUSH-2501: reap tmux sessions whose panes are all dead every 5 minutes.
-const DEAD_PANE_REAP_TICK_MS = 5 * 60_000;
-// RUSH-2622: close abandoned browser-task tabs every 5 minutes.
-const BROWSER_TASK_REAP_TICK_MS = 5 * 60_000;
-// Keep the active-session cache/journal fresh for sessions watch + Factory.
-// Matches DEFAULT_ACTIVE_CACHE_MAX_AGE_MS (15s) so long-lived watchers never
-// outlive the publisher (RUSH-2484 — CLI-owned continuous publish).
-const ACTIVE_SESSIONS_WARM_TICK_MS = 15_000;
 // Session-index warm interval/deadline live in session-index-service.ts now
 // (RUSH-3193 — migrated onto ServiceSupervisor).
 const WEDGE_THRESHOLD_TICKS = 3;
+const DAEMON_HEARTBEAT_TICK_MS = 60_000;
 /**
  * Crash-loop prevention (RUSH-2418). Three layers, because none of them alone
  * bounds a daemon that dies during startup:
@@ -348,7 +341,7 @@ export function removeHeartbeat() {
  */
 function isHeartbeatFresh(hb) {
     const elapsed = Date.now() - Date.parse(hb.lastTick);
-    return elapsed <= WEDGE_THRESHOLD_TICKS * MONITOR_TICK_MS;
+    return elapsed <= WEDGE_THRESHOLD_TICKS * DAEMON_HEARTBEAT_TICK_MS;
 }
 export function isDaemonWedged() {
     const pid = readDaemonPid();
@@ -725,87 +718,6 @@ export function warnEphemeralDaemonRoot(resolveBin = getAgentsBinPath) {
 // registered after `handleShutdown` is declared — see its registration site
 // below. runBrokerSelfHeal was moved into SecretsBrokerService (RUSH-3193 P2).
 // ---------------------------------------------------------------------------
-// In-flight guards: each flag prevents a slow tick from being re-entered
-// by the next timer fire before the previous one finishes.
-let reapingDeadPanes = false;
-let reapingBrowserTasks = false;
-/**
- * RUSH-2501: kill tmux sessions on the helper socket whose panes are ALL dead.
- * RUSH-2521: and terminate the helper processes (MCP servers, harness background
- * daemons) whose owning agent has exited — killing the pane only SIGHUPs its
- * foreground process group, so anything that left that group outlives it.
- *
- * Runs every DEAD_PANE_REAP_TICK_MS (5 min). The daemon is the single executor
- * so no UI surface can race it.
- */
-async function runDeadPaneReap() {
-    if (reapingDeadPanes)
-        return;
-    reapingDeadPanes = true;
-    try {
-        const { reapDeadTmuxPanes } = await import('../tmux/session.js');
-        const { getDefaultSocketPath } = await import('../tmux/paths.js');
-        const result = await reapDeadTmuxPanes(getDefaultSocketPath());
-        for (const w of result.warnings)
-            log('WARN', `Dead-pane reaper: ${w}`);
-        if (result.processes > 0) {
-            log('INFO', `Dead-pane reaper: terminated ${result.processes} orphaned helper process(es)`);
-            for (const d of result.processDetails)
-                log('INFO', `  ${d}`);
-        }
-        if (result.reaped > 0) {
-            log('INFO', `Dead-pane reaper: reaped ${result.reaped} session(s)`);
-            for (const d of result.details)
-                log('INFO', `  killed ${d}`);
-        }
-    }
-    catch (err) {
-        log('ERROR', `Dead-pane reaper failed: ${err.message}`);
-    }
-    finally {
-        reapingDeadPanes = false;
-    }
-}
-/**
- * RUSH-2622: close abandoned browser-task tabs — a task whose owning agent
- * session has exited, or one idle past `browser.task-idle-minutes` (default 30,
- * 0 disables idle reaping only). Same policy `agents browser prune` triggers on
- * demand; this is the periodic side, and the daemon is the single executor so
- * no UI surface can race it. `service` is the daemon's own long-lived
- * BrowserService — the browser IPC server it started earlier in `runDaemon()`.
- *
- * Runs every BROWSER_TASK_REAP_TICK_MS (5 min).
- */
-async function runBrowserTaskReap(service) {
-    if (reapingBrowserTasks)
-        return;
-    reapingBrowserTasks = true;
-    try {
-        const result = await service.reapAbandoned({ idleMs: resolveBrowserTaskIdleMs() });
-        if (result.closed.length > 0) {
-            log('INFO', `Browser-task reaper: closed ${result.closed.length} task(s)`);
-            for (const c of result.closed)
-                log('INFO', `  ${c.task} (${c.reason}, profile ${c.profile})`);
-        }
-    }
-    catch (err) {
-        log('ERROR', `Browser-task reaper failed: ${err.message}`);
-    }
-    finally {
-        reapingBrowserTasks = false;
-    }
-}
-/**
- * One monitor tick: write heartbeat + drain the running-job monitor + reap
- * stale terminal routine process groups. Runs on MONITOR_TICK_MS.
- */
-function runMonitorTick() {
-    writeHeartbeat();
-    monitorRunningJobs();
-    const reaped = reapTerminalRoutineProcesses();
-    if (reaped.length > 0)
-        log('WARN', `Reaped ${reaped.length} terminal routine process group(s): ${reaped.join(', ')}`);
-}
 export async function runDaemon() {
     // Single-instance guard (last-wins, SING-11): a direct `agents __daemon-run`
     // (manual, or a service-manager restart racing a live predecessor) EVICTS the
@@ -891,6 +803,11 @@ export async function runDaemon() {
     // broker starts socket-first (#416) and `agents secrets` resolves within
     // ms of daemon start, exactly as before.
     const supervisor = new ServiceSupervisor();
+    if (isEnabled('session-state')) {
+        supervisor.register(new SessionStateService(() => supervisor.runNow('session-state')));
+    }
+    else
+        log('INFO', 'Live session-state service disabled');
     if (isEnabled('secrets-broker'))
         supervisor.register(new SecretsBrokerService());
     else
@@ -904,12 +821,13 @@ export async function runDaemon() {
         supervisor.register(new AccountStateDaemonService());
     else
         log('INFO', 'Account-state service disabled');
-    // BrowserIPCService owns the orphan reap (previously daemon.ts:1303-1318)
-    // and the BrowserIPCServer lifecycle. BrowserService is also constructed here
-    // so daemon.ts can access it for the browser-task-reap interval (task #3).
-    const browserSvcForReap = isEnabled('browser-ipc') ? new BrowserService() : null;
-    if (browserSvcForReap)
-        supervisor.register(new BrowserIPCService(browserSvcForReap));
+    // BrowserIPCService and BrowserTaskReapService share one long-lived
+    // BrowserService when both are enabled. Either service can run independently.
+    const browserService = isEnabled('browser-ipc') || isEnabled('browser-task-reap')
+        ? new BrowserService()
+        : null;
+    if (isEnabled('browser-ipc') && browserService)
+        supervisor.register(new BrowserIPCService(browserService));
     else
         log('INFO', 'Browser IPC service disabled');
     if (isEnabled('session-index'))
@@ -940,6 +858,24 @@ export async function runDaemon() {
         supervisor.register(new AuthSyncService());
     else
         log('INFO', 'Auth-sync service disabled');
+    if (isEnabled('webhook-receiver'))
+        supervisor.register(new WebhookReceiverService());
+    else
+        log('INFO', 'Webhook receiver service disabled');
+    if (isEnabled('daemon-heartbeat'))
+        supervisor.register(new HeartbeatService(() => writeHeartbeat()));
+    else
+        log('INFO', 'Daemon heartbeat service disabled');
+    if (isEnabled('tmux-reap'))
+        supervisor.register(new TmuxReapService());
+    else
+        log('INFO', 'Tmux reap service disabled');
+    if (isEnabled('browser-task-reap') && browserService) {
+        supervisor.register(new BrowserTaskReapService(browserService));
+    }
+    else {
+        log('INFO', 'Browser-task reap service disabled');
+    }
     await supervisor.startAll({ log });
     activeServiceSupervisor = supervisor;
     // scheduler.enabled=false in this machine's device doc means NO routines fire
@@ -1076,36 +1012,9 @@ export async function runDaemon() {
     }
     if (schedulerEnabledAtBoot)
         bootScheduler();
-    // Active-sessions publish-own: continuous journal writer for `sessions watch`.
-    // Fire once immediately so a cold daemon does not leave watchers on
-    // "awaiting publisher" for a full tick (RUSH-2484). This boot-time fire alone
-    // no-ops on a genuinely cold boot (no reader has connected yet) — the
-    // presence watch below is what actually closes the gap for a watcher that
-    // connects later, whether at cold boot or after the reader-idle window.
-    let activeSessionsWarmInFlight = false;
-    const runActiveSessionsWarm = async () => {
-        if (activeSessionsWarmInFlight)
-            return;
-        activeSessionsWarmInFlight = true;
-        try {
-            await runActiveSessionsWarmTick();
-        }
-        catch (err) {
-            log('WARN', `active-sessions warm failed: ${err.message}`);
-        }
-        finally {
-            activeSessionsWarmInFlight = false;
-        }
-    };
-    void runActiveSessionsWarm();
-    const activeSessionsWarmInterval = setInterval(() => { void runActiveSessionsWarm(); }, ACTIVE_SESSIONS_WARM_TICK_MS);
-    // Out-of-band trigger (RUSH-2484): a reader connecting only writes a presence
-    // timestamp (noteActiveSessionsJournalReader in watch.ts) with no path back to
-    // this timer, so on its own the interval above leaves a fresh connection
-    // waiting up to ACTIVE_SESSIONS_WARM_TICK_MS for its first rows. This watches
-    // for the idle->recent edge and gathers immediately instead of waiting for the
-    // next scheduled tick — a genuinely idle box with no reader still never gathers.
-    const stopActiveSessionsReaderWatch = watchActiveSessionsReaderPresence(() => { void runActiveSessionsWarm(); });
+    // Live-session metadata publishing is owned by SessionStateService. Its
+    // presence watcher requests an immediate supervised tick when a reader
+    // connects; callers consume the journal instead of duplicating the gather.
     // Session-index warm (RUSH-2682) is registered on the supervisor above
     // (RUSH-3193 P2) alongside the socket services.
     // Watchdog and device-probe are now managed by WatchdogService /
@@ -1191,23 +1100,8 @@ export async function runDaemon() {
     // Started after the broker (above) so it resolves each receiver's signing
     // secret headlessly — no AGENTS_SECRETS_PASSPHRASE, no nohup. Binds nothing
     // unless daemon/webhooks.yaml declares a receiver, so an unconfigured box no-ops.
-    let webhookReceivers = null;
-    if (isEnabled('webhook-receiver')) {
-        try {
-            webhookReceivers = await startHostedWebhookReceivers({ log });
-            log('INFO', webhookReceivers.count > 0
-                ? `Webhook receiver hosting ${webhookReceivers.count} receiver(s)`
-                : 'Webhook receiver service enabled; no receivers declared in daemon/webhooks.yaml');
-        }
-        catch (err) {
-            log('WARN', `Webhook receiver host skipped: ${err.message}`);
-        }
-    }
-    else {
-        log('INFO', 'Webhook receiver service disabled');
-    }
-    runMonitorTick();
-    const monitorInterval = setInterval(runMonitorTick, MONITOR_TICK_MS);
+    // Signed webhook ingress is owned by WebhookReceiverService, including
+    // per-service failure isolation, measured health, and shutdown cleanup.
     // Resource self-heal is now managed by SelfHealService on the supervisor
     // (RUSH-3193 P3), registered above alongside the socket services. The
     // supervisor's immediate first tick on start replaces the old
@@ -1218,16 +1112,11 @@ export async function runDaemon() {
     // supervisor (RUSH-3193 P3), registered above alongside the socket services.
     // RUSH-2501: reap tmux sessions whose panes are all dead. Runs on the same
     // 5-min cadence as the keychain reaper. Daemon-only (single executor).
-    void runDeadPaneReap(); // kick-off on startup so the backlog clears immediately
-    const deadPaneReapInterval = setInterval(() => { void runDeadPaneReap(); }, DEAD_PANE_REAP_TICK_MS);
+    // Dead managed panes and their orphan helpers are reaped by TmuxReapService.
     // RUSH-2622: close abandoned browser-task tabs on the same 5-min cadence,
-    // reusing the daemon's own long-lived BrowserService. `browserSvcForReap` is
-    // the BrowserService created for BrowserIPCService above; null when disabled.
-    let browserTaskReapInterval;
-    if (browserSvcForReap) {
-        void runBrowserTaskReap(browserSvcForReap); // kick-off on startup
-        browserTaskReapInterval = setInterval(() => { void runBrowserTaskReap(browserSvcForReap); }, BROWSER_TASK_REAP_TICK_MS);
-    }
+    // reusing the daemon's long-lived BrowserService when browser IPC is enabled.
+    // Abandoned browser tasks are reaped by BrowserTaskReapService, sharing the
+    // same BrowserService instance as BrowserIPCService.
     // RUSH-2367 / RUSH-3193 P3: state-dir-check (self-terminate guard) is
     // registered on the supervisor further below, once `handleShutdown` exists
     // — see the registration site after its declaration for why.
@@ -1265,7 +1154,11 @@ export async function runDaemon() {
                 // never registered, so it falls through to the same "restart to
                 // apply" advice as before.
                 if (supervisor.isRegistered(id)) {
-                    const action = now ? supervisor.start(id) : supervisor.stop(id);
+                    // A periodic service may be inside a real tick when SIGHUP arrives.
+                    // Queue the desired transition behind that exact promise: deadlines
+                    // detect a wedge but cannot cancel arbitrary work, and polling here
+                    // would create another lifecycle timer outside the supervisor.
+                    const action = supervisor.awaitIdle(id).then(() => now ? supervisor.start(id) : supervisor.stop(id));
                     void action
                         .then(() => log('INFO', `Service '${id}' ${now ? 'started' : 'stopped'} live (SIGHUP reload)`))
                         .catch((err) => log('WARN', `Service '${id}' live ${now ? 'start' : 'stop'} failed: ${err.message}`));
@@ -1280,7 +1173,7 @@ export async function runDaemon() {
         // Drain queued `agents daemon services restart <id>` requests (RUSH-3193 P4).
         for (const id of drainDaemonServiceRestartQueue()) {
             if (supervisor.isRegistered(id)) {
-                void supervisor.restartOne(id)
+                void supervisor.awaitIdle(id).then(() => supervisor.restartOne(id))
                     .then(() => log('INFO', `Service '${id}' restarted live (SIGHUP reload)`))
                     .catch((err) => log('WARN', `Service '${id}' live restart failed: ${err.message}`));
             }
@@ -1351,20 +1244,12 @@ export async function runDaemon() {
     // rather than one that every step added later has to re-earn.
     const handleShutdown = singleShot(async () => {
         log('INFO', 'Daemon shutting down');
-        clearInterval(activeSessionsWarmInterval);
-        stopActiveSessionsReaderWatch();
-        // supervisor.stopAll() stops every registered service: secrets-broker
-        // (closes hostedBroker + self-heal timer), monitor engine, account-state,
-        // browser IPC, session-index, watchdog, device-probe, self-heal,
-        // keychain-reap, and (once registered just below) state-dir-check.
+        // supervisor.stopAll() stops every registered service, including socket
+        // hosts, session publishers/indexers, monitor/account work, and every
+        // maintenance timer; state-dir-check joins the registry just below.
         await supervisor.stopAll();
         activeServiceSupervisor = null;
         stopScheduler();
-        await webhookReceivers?.close();
-        clearInterval(monitorInterval);
-        clearInterval(deadPaneReapInterval);
-        if (browserTaskReapInterval)
-            clearInterval(browserTaskReapInterval);
         try {
             if (fs.readFileSync(lifetimePath, 'utf-8') === lifetimeToken)
                 fs.unlinkSync(lifetimePath);

package/dist/lib/daemon/heartbeat-service.d.ts

@@ -0,0 +1,13 @@
+/** Daemon heartbeat and routine-process reconciliation under supervision. */
+import type { DaemonServiceId } from '../daemon-services.js';
+import { BasePeriodicService, type DaemonContext } from './service.js';
+export declare class HeartbeatService extends BasePeriodicService {
+    private readonly publishHeartbeat;
+    readonly id: DaemonServiceId;
+    readonly intervalMs = 60000;
+    readonly deadlineMs = 30000;
+    constructor(publishHeartbeat: () => void);
+    protected onStart(_ctx: DaemonContext): Promise<void>;
+    protected onStop(): Promise<void>;
+    protected onTick(ctx: DaemonContext): Promise<void>;
+}

package/dist/lib/daemon/heartbeat-service.js

@@ -0,0 +1,26 @@
+/** Daemon heartbeat and routine-process reconciliation under supervision. */
+import { monitorRunningJobs } from './runner.js';
+import { reapTerminalRoutineProcesses } from '../routine-process-cleanup.js';
+import { BasePeriodicService } from './service.js';
+const HEARTBEAT_TICK_MS = 60_000;
+const HEARTBEAT_DEADLINE_MS = 30_000;
+export class HeartbeatService extends BasePeriodicService {
+    publishHeartbeat;
+    id = 'daemon-heartbeat';
+    intervalMs = HEARTBEAT_TICK_MS;
+    deadlineMs = HEARTBEAT_DEADLINE_MS;
+    constructor(publishHeartbeat) {
+        super();
+        this.publishHeartbeat = publishHeartbeat;
+    }
+    async onStart(_ctx) { }
+    async onStop() { }
+    async onTick(ctx) {
+        this.publishHeartbeat();
+        monitorRunningJobs();
+        const reaped = reapTerminalRoutineProcesses();
+        if (reaped.length > 0) {
+            ctx.log('WARN', `Reaped ${reaped.length} terminal routine process group(s): ${reaped.join(', ')}`);
+        }
+    }
+}

package/dist/lib/daemon/monitor-engine-service.d.ts

@@ -2,21 +2,25 @@
  * MonitorEngine lifecycle as a `DaemonService` (RUSH-3193 P2).
  *
  * Wraps the `MonitorEngine` (event-triggered watchers) under the
- * `ServiceSupervisor` contract. This is a lifecycle-only service — the engine
- * runs its own internal event loop; the supervisor just calls `start()` at
- * boot and `stop()` at shutdown.
+ * `ServiceSupervisor` contract. The engine can own a timer when embedded by a
+ * foreground caller, but the daemon starts it in external-scheduler mode so
+ * every evaluation cycle receives the supervisor's deadline, health, and
+ * circuit-breaker semantics.
  *
  * `getEngine()` exposes the underlying `MonitorEngine` so `daemon.ts`'s
  * SIGHUP handler can call `engine.reload()` when needed.
  */
-import { BaseDaemonService, type DaemonContext } from './service.js';
+import { BasePeriodicService, type DaemonContext } from './service.js';
 import type { DaemonServiceId } from '../daemon-services.js';
 import { MonitorEngine } from '../monitors/engine.js';
-export declare class MonitorEngineService extends BaseDaemonService {
+export declare class MonitorEngineService extends BasePeriodicService {
     readonly id: DaemonServiceId;
+    readonly intervalMs = 5000;
+    readonly deadlineMs: number;
     private engine;
     /** Returns the live engine after `start()`, or `null` before/after. */
     getEngine(): MonitorEngine | null;
     protected onStart(ctx: DaemonContext): Promise<void>;
     protected onStop(): Promise<void>;
+    protected onTick(_ctx: DaemonContext): Promise<void>;
 }

package/dist/lib/daemon/monitor-engine-service.js

@@ -2,17 +2,20 @@
  * MonitorEngine lifecycle as a `DaemonService` (RUSH-3193 P2).
  *
  * Wraps the `MonitorEngine` (event-triggered watchers) under the
- * `ServiceSupervisor` contract. This is a lifecycle-only service — the engine
- * runs its own internal event loop; the supervisor just calls `start()` at
- * boot and `stop()` at shutdown.
+ * `ServiceSupervisor` contract. The engine can own a timer when embedded by a
+ * foreground caller, but the daemon starts it in external-scheduler mode so
+ * every evaluation cycle receives the supervisor's deadline, health, and
+ * circuit-breaker semantics.
  *
  * `getEngine()` exposes the underlying `MonitorEngine` so `daemon.ts`'s
  * SIGHUP handler can call `engine.reload()` when needed.
  */
-import { BaseDaemonService } from './service.js';
-import { MonitorEngine } from '../monitors/engine.js';
-export class MonitorEngineService extends BaseDaemonService {
+import { BasePeriodicService } from './service.js';
+import { MONITOR_ENGINE_TICK_MS, MonitorEngine } from '../monitors/engine.js';
+export class MonitorEngineService extends BasePeriodicService {
     id = 'monitors';
+    intervalMs = MONITOR_ENGINE_TICK_MS;
+    deadlineMs = 2 * 60_000;
     engine = null;
     /** Returns the live engine after `start()`, or `null` before/after. */
     getEngine() {
@@ -20,10 +23,15 @@ export class MonitorEngineService extends BaseDaemonService {
     }
     async onStart(ctx) {
         this.engine = new MonitorEngine((level, message) => ctx.log(level, message));
-        this.engine.start();
+        this.engine.start({ externalScheduler: true });
     }
     async onStop() {
         this.engine?.stop();
         this.engine = null;
     }
+    async onTick(_ctx) {
+        if (!this.engine)
+            throw new Error('monitor engine tick requested before start');
+        await this.engine.tick();
+    }
 }

package/dist/lib/daemon/runner.d.ts

@@ -233,6 +233,21 @@ export declare function inferFinalStatusFromLog(stdoutPath: string, agent: Agent
  * `host:`-placed runs have no local pid and are excluded.
  */
 export declare function listLiveRoutineChildren(): number[];
+/**
+ * Whether a run record marked `running` is genuinely in flight right now. A
+ * `running` status alone is not enough: `writeActiveClaim` stamps a provisional
+ * claim as `running` with `pid: null` BEFORE the child spawns, and
+ * `monitorRunningJobs()` does not reap a null-pid record (it has no process to
+ * probe, and ages it out only past the configured timeout — up to a week). So a
+ * daemon crash in that spawn window leaves a `running` record for a run that is
+ * not running (RUSH-2640). A caller answering "is one running now?" MUST gate on
+ * this, mirroring `listLiveRoutineChildren`'s local-liveness test:
+ * - a local child is in flight only while its pid is still ours (alive, same
+ *   birth time — a dead-and-reused pid does not count);
+ * - a `host:`-placed run has no local pid by design and is in flight until its
+ *   remote `.exit` is reconciled (`finalizeHostRun`).
+ */
+export declare function isRunGenuinelyInFlight(meta: RunMeta): boolean;
 /** Scan all runs marked "running" and finalize any whose process has exited. */
 export declare function monitorRunningJobs(): void;
 export {};

package/dist/lib/daemon/runner.js

@@ -2263,6 +2263,29 @@ export function listLiveRoutineChildren() {
     }
     return pids;
 }
+/**
+ * Whether a run record marked `running` is genuinely in flight right now. A
+ * `running` status alone is not enough: `writeActiveClaim` stamps a provisional
+ * claim as `running` with `pid: null` BEFORE the child spawns, and
+ * `monitorRunningJobs()` does not reap a null-pid record (it has no process to
+ * probe, and ages it out only past the configured timeout — up to a week). So a
+ * daemon crash in that spawn window leaves a `running` record for a run that is
+ * not running (RUSH-2640). A caller answering "is one running now?" MUST gate on
+ * this, mirroring `listLiveRoutineChildren`'s local-liveness test:
+ * - a local child is in flight only while its pid is still ours (alive, same
+ *   birth time — a dead-and-reused pid does not count);
+ * - a `host:`-placed run has no local pid by design and is in flight until its
+ *   remote `.exit` is reconciled (`finalizeHostRun`).
+ */
+export function isRunGenuinelyInFlight(meta) {
+    if (meta.status !== 'running')
+        return false;
+    if (meta.hostTaskId)
+        return true;
+    if (!meta.pid)
+        return false;
+    return isPidOurs(meta.pid, meta.spawnedAt);
+}
 /** Scan all runs marked "running" and finalize any whose process has exited. */
 export function monitorRunningJobs() {
     const runsDir = getRunsDir();

package/dist/lib/daemon/secrets-broker-service.d.ts

@@ -8,13 +8,14 @@
  * over hosting whenever the daemon is NOT already hosting AND no healthy
  * standalone broker answers a ping.
  */
-import { BaseDaemonService, type DaemonContext } from './service.js';
+import { BasePeriodicService, type DaemonContext } from './service.js';
 import type { DaemonServiceId } from '../daemon-services.js';
-export declare class SecretsBrokerService extends BaseDaemonService {
+export declare class SecretsBrokerService extends BasePeriodicService {
     readonly id: DaemonServiceId;
+    readonly intervalMs = 60000;
+    readonly deadlineMs = 30000;
     private hostedBroker;
-    private selfHealTimer;
-    private selfHealInFlight;
     protected onStart(ctx: DaemonContext): Promise<void>;
     protected onStop(): Promise<void>;
+    protected onTick(ctx: DaemonContext): Promise<void>;
 }

package/dist/lib/daemon/secrets-broker-service.js

@@ -8,18 +8,19 @@
  * over hosting whenever the daemon is NOT already hosting AND no healthy
  * standalone broker answers a ping.
  */
-import { BaseDaemonService } from './service.js';
+import { BasePeriodicService } from './service.js';
 /** Matches the constant previously in daemon.ts. */
 const BROKER_SELF_HEAL_TICK_MS = 60_000;
+const BROKER_SELF_HEAL_DEADLINE_MS = 30_000;
 /** Take over only when we are not already hosting AND no broker is reachable. */
 function shouldTakeOver(isHosting, brokerReachable) {
     return !isHosting && !brokerReachable;
 }
-export class SecretsBrokerService extends BaseDaemonService {
+export class SecretsBrokerService extends BasePeriodicService {
     id = 'secrets-broker';
+    intervalMs = BROKER_SELF_HEAL_TICK_MS;
+    deadlineMs = BROKER_SELF_HEAL_DEADLINE_MS;
     hostedBroker = null;
-    selfHealTimer;
-    selfHealInFlight = false;
     async onStart(ctx) {
         const { agentPing, startHostedBroker } = await import('../secrets/agent.js');
         if ((await agentPing()).reachable) {
@@ -30,37 +31,21 @@ export class SecretsBrokerService extends BaseDaemonService {
             if (this.hostedBroker)
                 ctx.log('INFO', 'Secrets broker hosted in daemon (socket-first)');
         }
-        // RUSH-1817: if the standalone the daemon deferred to at start later dies,
-        // take over hosting on the next self-heal probe.
-        const runSelfHeal = async () => {
-            if (this.selfHealInFlight)
-                return;
-            this.selfHealInFlight = true;
-            try {
-                const { agentPing: ping, startHostedBroker: startBroker } = await import('../secrets/agent.js');
-                const reachable = (await ping()).reachable;
-                if (!shouldTakeOver(this.hostedBroker != null, reachable))
-                    return;
-                this.hostedBroker = await startBroker();
-                if (this.hostedBroker) {
-                    ctx.log('WARN', 'Secrets broker was unreachable; daemon took over hosting (self-heal)');
-                }
-            }
-            catch (err) {
-                ctx.log('WARN', `Secrets broker self-heal skipped: ${err.message}`);
-            }
-            finally {
-                this.selfHealInFlight = false;
-            }
-        };
-        this.selfHealTimer = setInterval(() => { void runSelfHeal(); }, BROKER_SELF_HEAL_TICK_MS);
     }
     async onStop() {
-        if (this.selfHealTimer !== undefined) {
-            clearInterval(this.selfHealTimer);
-            this.selfHealTimer = undefined;
-        }
         this.hostedBroker?.close();
         this.hostedBroker = null;
     }
+    async onTick(ctx) {
+        // RUSH-1817: if the standalone the daemon deferred to at start later dies,
+        // take over hosting on the next supervisor-owned self-heal probe.
+        const { agentPing, startHostedBroker } = await import('../secrets/agent.js');
+        const reachable = (await agentPing()).reachable;
+        if (!shouldTakeOver(this.hostedBroker != null, reachable))
+            return;
+        this.hostedBroker = await startHostedBroker();
+        if (this.hostedBroker) {
+            ctx.log('WARN', 'Secrets broker was unreachable; daemon took over hosting (self-heal)');
+        }
+    }
 }

package/dist/lib/daemon/service.d.ts

@@ -1,7 +1,7 @@
 /**
  * DaemonService contract (RUSH-3193 P1).
  *
- * Today the daemon's ~13 background services are bare `setInterval` closures
+ * Historically the daemon's background services were bare `setInterval` closures
  * inside one long `runDaemon()` (daemon.ts), sharing one event loop with no
  * per-service error boundary or deadline. A throw escaping a tick's local
  * try/catch hits the process-wide handler and kills every service; a tick that
@@ -41,7 +41,7 @@ export interface DaemonService {
 /** A service the supervisor ticks on a fixed interval, under a hard per-tick deadline. */
 export interface PeriodicService extends DaemonService {
     readonly intervalMs: number;
-    /** Hard cap per tick. An over-budget tick is abandoned (never awaited past this) so its in-flight guard always releases. */
+    /** Hard cap per tick. An over-budget tick parks the service; its in-flight guard remains held until the real promise settles. */
     readonly deadlineMs: number;
     /**
      * Delay before the FIRST tick after `start()`, in ms. Every later tick

package/dist/lib/daemon/service.js

@@ -1,7 +1,7 @@
 /**
  * DaemonService contract (RUSH-3193 P1).
  *
- * Today the daemon's ~13 background services are bare `setInterval` closures
+ * Historically the daemon's background services were bare `setInterval` closures
  * inside one long `runDaemon()` (daemon.ts), sharing one event loop with no
  * per-service error boundary or deadline. A throw escaping a tick's local
  * try/catch hits the process-wide handler and kills every service; a tick that