@phnx-labs/agents-cli 1.22.65 → 1.22.68

package/dist/lib/daemon/account-state-daemon-service.d.ts

@@ -1,16 +1,56 @@
 /**
- * Account-state service lifecycle as a `DaemonService` (RUSH-3193 P2).
+ * Account-state services as supervised `PeriodicService`s (PHNX-3608).
  *
- * Wraps `startAccountStateService()` under the `ServiceSupervisor` contract
- * so the supervisor owns start/stop and reports health through the uniform
- * path. The account-state service owns its own internal intervals for usage
- * and auth refreshes; the supervisor just starts and stops it.
+ * The daemon owns usage and authentication health as first-party device state.
+ * This used to run its OWN two `setInterval` loops behind a `usageRunning` /
+ * `authRunning` latch with NO deadline (`account-state-service.ts`, now removed):
+ * a `runUsageRefreshTick` that hung on an unbounded provider await latched
+ * `usageRunning = true` forever, so the usage cache froze for the daemon's whole
+ * life while the service still looked healthy — the "12h usage-dark" root cause.
+ *
+ * Now usage and auth are TWO independent supervised services, each with its own
+ * timer, per-tick deadline, AbortSignal, and — crucially — its own circuit
+ * breaker (`AccountUsageService` = `account-state`, `AccountAuthService` =
+ * `account-auth`). Keeping them separate means a run of usage-refresh failures
+ * parks ONLY usage and never starves the slower auth refresh (they hit different
+ * endpoints), matching the old design's independent loops. Each threads its
+ * deadline AbortSignal into its refresh so the tick unwinds at the deadline
+ * instead of blocking; the provider fetch is itself already bounded
+ * (`AbortSignal.timeout` at the leaf), and the supervisor abandons + restarts a
+ * hung tick regardless.
  */
-import { BaseDaemonService, type DaemonContext } from './service.js';
+import { BasePeriodicService, type DaemonContext } from './service.js';
 import type { DaemonServiceId } from '../daemon-services.js';
-export declare class AccountStateDaemonService extends BaseDaemonService {
+/** Usage cache refresh cadence. */
+export declare const USAGE_STATE_TICK_MS = 60000;
+/** Fleet-auth refresh cadence — deliberately slower (rate-limited endpoint). */
+export declare const AUTH_STATE_TICK_MS: number;
+/**
+ * Refresh the usage cache the `agents run` router reads. Independent circuit
+ * breaker from auth — a persistently-failing usage endpoint parks only this.
+ */
+export declare class AccountUsageService extends BasePeriodicService {
+    readonly id: DaemonServiceId;
+    readonly intervalMs = 60000;
+    readonly deadlineMs: number;
+    private readonly refresh;
+    constructor(refresh?: (signal: AbortSignal) => Promise<void>);
+    protected onStart(): Promise<void>;
+    protected onStop(): Promise<void>;
+    protected onTick(_ctx: DaemonContext, signal: AbortSignal): Promise<void>;
+}
+/**
+ * Publish this host's fleet-status row and refresh auth health. Independent
+ * circuit breaker from usage, and on a slower cadence (the auth verdict rides a
+ * rate-limited endpoint).
+ */
+export declare class AccountAuthService extends BasePeriodicService {
     readonly id: DaemonServiceId;
-    private service;
-    protected onStart(ctx: DaemonContext): Promise<void>;
+    readonly intervalMs: number;
+    readonly deadlineMs: number;
+    private readonly refresh;
+    constructor(refresh?: (signal: AbortSignal) => Promise<void>);
+    protected onStart(): Promise<void>;
     protected onStop(): Promise<void>;
+    protected onTick(_ctx: DaemonContext, signal: AbortSignal): Promise<void>;
 }

package/dist/lib/daemon/account-state-daemon-service.js

@@ -1,26 +1,89 @@
 /**
- * Account-state service lifecycle as a `DaemonService` (RUSH-3193 P2).
+ * Account-state services as supervised `PeriodicService`s (PHNX-3608).
  *
- * Wraps `startAccountStateService()` under the `ServiceSupervisor` contract
- * so the supervisor owns start/stop and reports health through the uniform
- * path. The account-state service owns its own internal intervals for usage
- * and auth refreshes; the supervisor just starts and stops it.
+ * The daemon owns usage and authentication health as first-party device state.
+ * This used to run its OWN two `setInterval` loops behind a `usageRunning` /
+ * `authRunning` latch with NO deadline (`account-state-service.ts`, now removed):
+ * a `runUsageRefreshTick` that hung on an unbounded provider await latched
+ * `usageRunning = true` forever, so the usage cache froze for the daemon's whole
+ * life while the service still looked healthy — the "12h usage-dark" root cause.
+ *
+ * Now usage and auth are TWO independent supervised services, each with its own
+ * timer, per-tick deadline, AbortSignal, and — crucially — its own circuit
+ * breaker (`AccountUsageService` = `account-state`, `AccountAuthService` =
+ * `account-auth`). Keeping them separate means a run of usage-refresh failures
+ * parks ONLY usage and never starves the slower auth refresh (they hit different
+ * endpoints), matching the old design's independent loops. Each threads its
+ * deadline AbortSignal into its refresh so the tick unwinds at the deadline
+ * instead of blocking; the provider fetch is itself already bounded
+ * (`AbortSignal.timeout` at the leaf), and the supervisor abandons + restarts a
+ * hung tick regardless.
  */
-import { BaseDaemonService } from './service.js';
-import { startAccountStateService } from '../account-state-service.js';
+import { BasePeriodicService } from './service.js';
 import { runUsageRefreshTick, runFleetCacheWarmTick } from '../daemon-ticks.js';
-export class AccountStateDaemonService extends BaseDaemonService {
+/** Usage cache refresh cadence. */
+export const USAGE_STATE_TICK_MS = 60_000;
+/** Fleet-auth refresh cadence — deliberately slower (rate-limited endpoint). */
+export const AUTH_STATE_TICK_MS = 3 * 60_000;
+/** A hung refresh is abandoned at this deadline; a real sweep is far under it. */
+const REFRESH_DEADLINE_MS = 2 * 60_000;
+/**
+ * A promise that rejects when `signal` aborts (immediately if already aborted),
+ * so a tick can `Promise.race` its work against the supervisor's deadline and
+ * unwind instead of blocking on an await that may never settle. The signal is
+ * per-tick, so the once-listener is dropped with it — no cross-tick leak.
+ */
+function abortRejection(signal, label) {
+    return new Promise((_, reject) => {
+        if (signal.aborted) {
+            reject(new Error(label));
+            return;
+        }
+        signal.addEventListener('abort', () => reject(new Error(label)), { once: true });
+    });
+}
+/**
+ * Refresh the usage cache the `agents run` router reads. Independent circuit
+ * breaker from auth — a persistently-failing usage endpoint parks only this.
+ */
+export class AccountUsageService extends BasePeriodicService {
     id = 'account-state';
-    service = null;
-    async onStart(ctx) {
-        this.service = startAccountStateService({
-            refreshUsage: runUsageRefreshTick,
-            refreshAuth: runFleetCacheWarmTick,
-            onError: (area, error) => ctx.log('WARN', `${area} state refresh failed: ${error.message}`),
-        });
+    intervalMs = USAGE_STATE_TICK_MS;
+    deadlineMs = REFRESH_DEADLINE_MS;
+    refresh;
+    constructor(refresh = runUsageRefreshTick) {
+        super();
+        this.refresh = refresh;
+    }
+    async onStart() { }
+    async onStop() { }
+    async onTick(_ctx, signal) {
+        await Promise.race([
+            this.refresh(signal),
+            abortRejection(signal, 'usage refresh aborted at deadline'),
+        ]);
+    }
+}
+/**
+ * Publish this host's fleet-status row and refresh auth health. Independent
+ * circuit breaker from usage, and on a slower cadence (the auth verdict rides a
+ * rate-limited endpoint).
+ */
+export class AccountAuthService extends BasePeriodicService {
+    id = 'account-auth';
+    intervalMs = AUTH_STATE_TICK_MS;
+    deadlineMs = REFRESH_DEADLINE_MS;
+    refresh;
+    constructor(refresh = runFleetCacheWarmTick) {
+        super();
+        this.refresh = refresh;
     }
-    async onStop() {
-        this.service?.stop();
-        this.service = null;
+    async onStart() { }
+    async onStop() { }
+    async onTick(_ctx, signal) {
+        await Promise.race([
+            this.refresh(signal),
+            abortRejection(signal, 'auth refresh aborted at deadline'),
+        ]);
     }
 }

package/dist/lib/daemon/auth-sync-service.d.ts

@@ -1,10 +1,10 @@
 /**
  * Reserved `auth` bundle fleet sync as a `PeriodicService` (PHNX-2371).
  *
- * Each daemon that has a local file-backed `auth` bundle pushes it to pinned
- * fleet devices that do not yet have it. The destination auto-provisions its
- * own machine-local key; no passphrase is forwarded. Single-executor per
- * destination: this process only writes the remote's own store.
+ * Each daemon publishes a safe readiness verdict to the fleet-shared user repo,
+ * then runs the same serialized, timeout-bounded git exchange as usage sync.
+ * One deterministic ready device asynchronously provisions peers whose delivered
+ * verdict says `missing`; the secret never enters Git.
  */
 import { BasePeriodicService, type DaemonContext } from './service.js';
 import type { DaemonServiceId } from '../daemon-services.js';

package/dist/lib/daemon/auth-sync-service.js

@@ -1,10 +1,10 @@
 /**
  * Reserved `auth` bundle fleet sync as a `PeriodicService` (PHNX-2371).
  *
- * Each daemon that has a local file-backed `auth` bundle pushes it to pinned
- * fleet devices that do not yet have it. The destination auto-provisions its
- * own machine-local key; no passphrase is forwarded. Single-executor per
- * destination: this process only writes the remote's own store.
+ * Each daemon publishes a safe readiness verdict to the fleet-shared user repo,
+ * then runs the same serialized, timeout-bounded git exchange as usage sync.
+ * One deterministic ready device asynchronously provisions peers whose delivered
+ * verdict says `missing`; the secret never enters Git.
  */
 import { BasePeriodicService } from './service.js';
 const AUTH_SYNC_TICK_MS = 15 * 60_000;
@@ -22,8 +22,19 @@ export class AuthSyncService extends BasePeriodicService {
         // Nothing to release — the supervisor's timer teardown is the only cleanup.
     }
     async onTick(ctx) {
-        const { syncReservedAuthBundle } = await import('../secrets/reserved-sync.js');
-        const result = syncReservedAuthBundle();
+        const { publishReservedAuthVerdict, syncReservedAuthBundle } = await import('../secrets/reserved-sync.js');
+        const published = publishReservedAuthVerdict();
+        if (published.error)
+            ctx.log('WARN', `auth-sync: verdict: ${published.error}`);
+        const { syncFleetSharedStateRepo } = await import('../fleet-shared-repo-sync.js');
+        const transport = await syncFleetSharedStateRepo();
+        if (transport.skipped)
+            ctx.log('WARN', `auth-sync: ${transport.skipped}`);
+        if (transport.error)
+            ctx.log('WARN', `auth-sync: shared-store transport: ${transport.error}`);
+        if (!transport.success)
+            return;
+        const result = await syncReservedAuthBundle();
         if (result.pushed.length > 0) {
             ctx.log('INFO', `auth-sync: pushed auth to ${result.pushed.join(', ')}`);
         }

package/dist/lib/daemon/catchup-service.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Catch-up recovery as a supervised `PeriodicService` (PHNX-3608).
+ *
+ * A catch-up pass detects routines whose scheduled fire this device missed (the
+ * laptop slept, the daemon was wedged, an OS suspend the process survived) and
+ * runs them late. It used to run on a bare `setInterval` booted/stopped inside
+ * `runDaemon()` alongside the scheduler, with only a local `catchingUp` overlap
+ * flag and NO deadline — a pass that hung on an off-box (host/cloud) dispatch
+ * could latch that flag and silently stop recovering missed fires for the
+ * daemon's life, the same "abstraction too weak" class the supervisor exists for.
+ *
+ * Under the supervisor it gets a per-tick deadline, an AbortSignal, and the
+ * circuit breaker: a hung pass is abandoned and restarted on backoff instead of
+ * latching. The scheduler itself (croner-driven `JobScheduler`) stays outside the
+ * supervisor — it is not a tick loop — so this service self-gates on whether the
+ * scheduler is currently booted and no-ops cheaply when the scheduler gate is off.
+ */
+import { BasePeriodicService, type DaemonContext } from './service.js';
+import type { DaemonServiceId } from '../daemon-services.js';
+/**
+ * How often to re-run catch-up. A startup pass alone misses a fire lost while the
+ * daemon stayed up but its event loop was wedged, or one lost across an OS
+ * suspend the process survived — five minutes bounds the cost while still
+ * recovering from a wedge or an OS suspend the process survived.
+ */
+export declare const CATCHUP_TICK_MS: number;
+export interface CatchupServiceDeps {
+    /**
+     * Whether the routine scheduler is currently booted. When false (the
+     * `scheduler.enabled` gate is off), the pass no-ops — there is nothing to
+     * catch up on a device where no routines fire.
+     */
+    isSchedulerBooted: () => boolean;
+    /** Run one catch-up pass. Receives the tick's AbortSignal so it can bound its dispatches. */
+    runPass: (signal: AbortSignal) => Promise<void>;
+}
+export declare class CatchupService extends BasePeriodicService {
+    private readonly deps;
+    readonly id: DaemonServiceId;
+    readonly intervalMs: number;
+    /**
+     * A pass awaits `executeJobDetached` per overdue job and an off-box dispatch
+     * can block for a while, so the bound is generous — but finite, which the old
+     * un-deadlined loop was not. A pass exceeding it is hung, not slow.
+     */
+    readonly deadlineMs: number;
+    constructor(deps: CatchupServiceDeps);
+    protected onStart(): Promise<void>;
+    protected onStop(): Promise<void>;
+    protected onTick(_ctx: DaemonContext, signal: AbortSignal): Promise<void>;
+}

package/dist/lib/daemon/catchup-service.js

@@ -0,0 +1,51 @@
+/**
+ * Catch-up recovery as a supervised `PeriodicService` (PHNX-3608).
+ *
+ * A catch-up pass detects routines whose scheduled fire this device missed (the
+ * laptop slept, the daemon was wedged, an OS suspend the process survived) and
+ * runs them late. It used to run on a bare `setInterval` booted/stopped inside
+ * `runDaemon()` alongside the scheduler, with only a local `catchingUp` overlap
+ * flag and NO deadline — a pass that hung on an off-box (host/cloud) dispatch
+ * could latch that flag and silently stop recovering missed fires for the
+ * daemon's life, the same "abstraction too weak" class the supervisor exists for.
+ *
+ * Under the supervisor it gets a per-tick deadline, an AbortSignal, and the
+ * circuit breaker: a hung pass is abandoned and restarted on backoff instead of
+ * latching. The scheduler itself (croner-driven `JobScheduler`) stays outside the
+ * supervisor — it is not a tick loop — so this service self-gates on whether the
+ * scheduler is currently booted and no-ops cheaply when the scheduler gate is off.
+ */
+import { BasePeriodicService } from './service.js';
+/**
+ * How often to re-run catch-up. A startup pass alone misses a fire lost while the
+ * daemon stayed up but its event loop was wedged, or one lost across an OS
+ * suspend the process survived — five minutes bounds the cost while still
+ * recovering from a wedge or an OS suspend the process survived.
+ */
+export const CATCHUP_TICK_MS = 5 * 60_000;
+export class CatchupService extends BasePeriodicService {
+    deps;
+    id = 'catchup';
+    intervalMs = CATCHUP_TICK_MS;
+    /**
+     * A pass awaits `executeJobDetached` per overdue job and an off-box dispatch
+     * can block for a while, so the bound is generous — but finite, which the old
+     * un-deadlined loop was not. A pass exceeding it is hung, not slow.
+     */
+    deadlineMs = 4 * 60_000;
+    constructor(deps) {
+        super();
+        this.deps = deps;
+    }
+    async onStart() {
+        // No owned resources — the supervisor owns the timer.
+    }
+    async onStop() {
+        // No owned resources.
+    }
+    async onTick(_ctx, signal) {
+        if (!this.deps.isSchedulerBooted())
+            return;
+        await this.deps.runPass(signal);
+    }
+}

package/dist/lib/daemon/daemon.d.ts

@@ -120,8 +120,11 @@ export declare function removeHeartbeat(): void;
 export declare function isDaemonWedged(): boolean;
 /**
  * Check whether a daemon is alive — via the pid file, or a fresh heartbeat when
- * the pid file has been lost (see resolveLiveDaemonPid). Heals the pid file as a
- * side effect so a subsequent read is consistent.
+ * the pid file has been lost (see resolveLiveDaemonPid). The observation itself
+ * is read-only; when it finds desync it opportunistically acquires daemon.lock
+ * and repeats the observation there before repairing. A contended probe still
+ * returns the observed liveness without mutating another lifecycle operation's
+ * state.
  */
 export declare function isDaemonRunning(): boolean;
 /**
@@ -137,9 +140,9 @@ export declare function isDaemonRunning(): boolean;
  * pid file, this does NOT defer to it — it evicts the incumbent and becomes the
  * survivor, so a second install can never leave two daemons running. Returns true
  * and records our PID once the incumbent is provably dead (its resources
- * released). Returns false ONLY when another `__daemon-run` currently holds the
- * O_EXCL start lock — i.e. a concurrent claimer is mid-takeover and will be the
- * singleton — in which case the caller must exit without touching further state.
+ * released). Returns false when another `__daemon-run` currently holds the
+ * O_EXCL start lock, or when the incumbent cannot be safely identified/evicted,
+ * in which case the caller must exit without touching further state.
  * The read-evict-write is serialized behind the same start lock startDaemon()
  * uses, so two `_run` processes can't both claim in the window between the
  * liveness check and the write.
@@ -177,8 +180,11 @@ export declare function reapStrayDaemons(keepPid?: number): {
     reaped: number;
     details: string[];
 };
+export declare function isLiveDaemon(pid: number): boolean;
 /** Append a JSONL log entry to the daemon log file (owner-only permissions). */
 export declare function log(level: string, message: string): void;
+/** Keep synchronous signal-handler failures inside the daemon's crash barrier. */
+export declare function guardSignalHandler(handler: () => void, onError: (err: unknown) => void): () => void;
 /** Main daemon loop: load jobs, schedule crons, monitor runs, and handle signals. */
 /**
  * Anchor the daemon's working directory to a stable, always-present path.
@@ -390,7 +396,7 @@ export declare function startDetached(opts?: StartDetachedOptions): {
 export interface StopResidueArtifact {
     label: string;
     present: boolean;
-    /** The file names a pid that is alive and is NOT the daemon we stopped. */
+    /** The file names a live owner, including a stopped target that survived. */
     ownedByLiveOther: boolean;
     reclaim: () => void;
     stillPresent: () => boolean;
@@ -424,22 +430,6 @@ export interface DaemonStopResult {
     surviving: string[];
     detachedChildren: number[];
 }
-/**
- * Live `__daemon-run` processes still registered in THIS state dir's instance
- * registry, excluding `exclude`. State-dir-scoped by construction: the registry
- * lives inside this state dir, so a daemon serving a DIFFERENT state dir (a test
- * fixture with its own HOME, a separate install/home) registers elsewhere and is
- * invisible here — it is never a stop/takeover target. POSIX-only (the registry
- * and its `ps` liveness probe are); `[]` on Windows.
- *
- * Exported for `agents daemon status`/`doctor`/`services` (RUSH-2368): those
- * commands previously flagged every `__daemon-run` on the box (a raw `ps` scan)
- * as a "duplicate" of this daemon, which misreported test fixtures under their
- * own HOME — and therefore their own state dir and registry — as strays to
- * kill. This registry read is the same scope the reaper (`reapStrayDaemons`)
- * and the stop postcondition (`stopDaemon`) already use, so the display and the
- * reaper agree on what a duplicate is.
- */
 export declare function findSurvivingStateDirDaemons(exclude: Set<number>): number[];
 /**
  * Stop the daemon and ASSERT its postcondition (SING-12, RUSH-2355), unloading it