@phnx-labs/agents-cli 1.22.66 → 1.22.69

package/CHANGELOG.md

@@ -1,5 +1,61 @@
 # Changelog
 
+## 1.22.69
+
+- **`agents monitors` no longer fires an action on a poll FAILURE (PHNX-3510).** An `[on-change]` monitor treated a failing poll — a `gh pr list … | jq` that intermittently printed `GraphQL: API rate limit already exceeded …` — as a value change: the empty→error→empty flap read as two changes and dispatched a full agent run each time on a premise that was false (~10 sessions burned re-verifying two already-merged PRs). A command/poll source now flags a snapshot that exited non-zero, or whose output matches a transport/auth/rate-limit error shape (caught even on exit 0, since a pipe to jq swallows the failing half's exit code), as an *observation failure*: the engine skips it, leaves watched-state untouched, does not fire, and records it as a failed check so a sustained streak escalates to the owner as a drought. `agents monitors test` labels a failed poll and reports `Would fire: no`. Note: a non-zero exit is now an observation failure rather than a watchable value — a monitor that wants to watch a command's success/failure should emit a stable token (`… && echo UP || echo DOWN`, always exit 0) so the state it cares about diffs as a value; sustained failures still reach the owner via the drought escalation. Source: `cli/src/lib/monitors/sources/failure.ts`, `cli/src/lib/monitors/sources/command.ts`, `cli/src/lib/monitors/engine.ts`, `cli/docs/automation.md`.
+
+- **`agents fleet worktrees` surfaces the worktree-sweep's held set as buckets, not a silent count (PHNX-3520).** The nightly `worktree-sweep` (PHNX-3503, in `phnx-labs/.agents`) reclaims merged agent worktrees and correctly HOLDS anything dirty, unmerged, or undeterminable — but it only ever emitted a `held=<n>` count, so the held set became a permanent, growing residue nothing resolved. Measured 2026-08-30 it is consistently LARGER than the reclaimed set (~800 worktrees fleet-wide), and one bucket inside it is real stranded work: a worktree whose branch carries commits on no remote (the PHNX-2951 / PHNX-2732 class — an agent finished, its commits never reached a remote, nothing surfaced them). The new read-only command classifies every held worktree into its three buckets — **`unmerged-commits`** (the one that matters), **`uncommitted-changes`**, and **`undeterminable`** (`status-unreadable` / `merge-state-unknown`, failing closed exactly as the sweep does) — and reports each with device/repo/worktree/branch/reason/age/size. `--json` is the structured form for machine callers; `--fleet` fans out over every online device and aggregates; `--bucket <name>` filters. The safe recovery action for the stranded bucket is `--push`: it PUBLISHES each `unmerged-commits` branch that is on no remote (re-reading the merge state immediately before pushing and refusing anything already on origin), making the work visible — it never removes a worktree or a branch. The destructive reclaim stays in the sweep; this is the surfacing half the sweep can consume. Source: `cli/src/lib/worktree/held.ts`, `cli/src/commands/ssh.ts`, `cli/src/lib/worktree/held.test.ts`.
+
+- **`agents run` starts ~0.6s faster on a box with many secrets bundles (PHNX-3585).** The AGI EXT "New Claude" boot runs `agents run claude --interactive`, and the whole wrapper cost is spent BEFORE the harness prints anything. Profiling that pre-exec window (new `AGENTS_PROFILE_BOOT=1` per-stage tracer, `cli/src/lib/boot-profile.ts`) showed the dominant stage was `--strategy balanced` account rotation: `readAccountRegistry` → `listBundles` decrypted EVERY file-store bundle's metadata to find the account bundles, and each decrypt runs a fresh scrypt KDF (~12ms) because every `.enc` file carries its own salt — ~690ms of pure KDF on a box with ~40 bundles, on every launch. Bundle metadata is non-secret by contract (it holds `keychain:`/`env:`/literal refs, never the secret bytes, and is already stored no-ACL so `secrets list` enumerates without Touch ID), so the file store now caches the decrypted metadata JSON keyed by each `.enc` file's `(mtime,size)` plus a passphrase fingerprint. Any bundle write (new mtime/size) or passphrase change (new fingerprint; rotation re-writes every file) misses and re-derives — no staleness, self-healing on any miss — and secret VALUE items never enter the cache. Measured on a worker box: `agents run claude` pre-exec `resolve-version` dropped from ~690ms to ~31ms (warm), total pre-exec ~1040ms → ~370ms. A committed `cli/scripts/bench-boot.sh` keeps it measured. Source: `cli/src/lib/secrets/filestore.ts`.
+
+- **Grok's cheap scan now fills `firstUserMessage` from a bounded `chat_history.jsonl` prefix read (PHNX-3621).** The summary-only path never parsed the log. The prefix reader skips Grok `<user_info>` / `synthetic_reason` scaffolding, prefers the first `prompt_index` user turn, and unwraps `<user_query>`. Existing Grok rows backfill through `CONTENT_INDEX_VERSION` v4. Source: `cli/src/lib/session/discover.ts`.
+
+- **Worker homes provisioned before seed-on-attach self-heal their account identity at resolve time (PHNX-3660).** `resolveClaudeSetupToken` required the version home's `.claude.json` to carry `oauthAccount.emailAddress`; homes whose `.oauth_token` was written by a pre-fix `accounts attach` had none, so exec-env injection and per-account usage reads were silently inert for them (they authenticated only via the shim's `.oauth_token` fallback). The resolver now recovers the email by matching the home's `.oauth_token` value against the `auth` bundle (re-encode-guarded slug decode, so a lossy or unmatched token can never invent a mapping), writes it back with `seedClaudeWorkerHomeIdentity` so the home converges after one read, and still fails closed — writing nothing — when the token matches no bundle key. Ambient no-home resolves never rewrite the operator's real `~/.claude.json`. Source: `cli/src/lib/claude-account-token.ts`.
+
+- **Resume `/continue` no longer launches the exhausted origin login when the pick is a provider account (PHNX-3674).** After native-first rotation (PHNX-3626), a usage-limited origin whose transcript is not in the origin home (trash/backup/reinstall, or local fallback from an unreachable peer) fell through to `/continue` on the provider-inclusive pool without carrying `RecoveryAccount`, so exec authenticated as the rate-limited native login. That continue target now injects the healthy provider the same way native rotation does. Source: `cli/src/lib/session/recovery.ts`, `cli/src/commands/exec.ts`.
+
+- **Private share OG covers are no longer cacheable by shared proxies (PHNX-3676).** Token-gated `visibility=private` pages already served HTML as `Cache-Control: private, no-store`, but the generated `/user/slug.png` cover used `public, max-age=31536000, immutable` after the token gate. RFC 9111 lets a shared cache reuse a `public` Authorization response for later unauthenticated requests keyed on the unauthenticated URL, so a Bearer fetch of the cover could leak the preview. `managedCoverHeaders` now treats `private` like `me`/`org` (`private, no-store` + `X-Robots-Tag: noindex`). Source: `cli/src/lib/share/worker-template.ts`.
+
+- **`agents sessions inject` can nudge a live remote tmux session that has no session id, and no longer crashes on `--pane --device` (PHNX-3688).** Two bugs are fixed. (1) A live session whose `agents sessions --active` id column shows `-` — only a tmux label like `ag-claude-214edaae:0.0` is known — was untargetable: `inject <shortid>` failed `No active session matches`. The lookup now matches the `ag-<agent>-<shortid>` tmux name's suffix (and the full name / pane id), the only selector such a row exposes, and the discovered row carries its `tmuxName` so the match has something to key on. (2) `inject _ "text" --pane %122 --device <box>` crashed with `TypeError: host.startsWith is not a function`: under `optsWithGlobals()` the parent `sessions` command's variadic `-D, --device <target...>` shadows this subcommand's scalar `--device`, so a single `--device box` arrived as `['box']` and the array flowed straight into `sshExec`. It is now coerced to one host (and fails loud on more than one, since inject delivers to exactly one terminal). A bare session id combined with `--device` now resolves ON that device — its tmux panes live there, not on the box you typed the command from — by re-running the inject over SSH, the tool-native form of the old `agents ssh <box> "agents sessions inject <id> …"` workaround. Source: `cli/src/commands/sessions-inject.ts`, `cli/src/lib/session/active.ts`.
+
+- **`agents` releases no longer wedge waiting for a human to mint an attestation (PHNX-3696).** RUSH-2666 made an exact-tree attestation for the *release commit* mandatory but shipped no producer for it, so every `release.sh --apply` since 2026-08-15 stopped at `missing exact attestation key` and required an operator to hand-run `release-attestation-produce.sh` and copy the tarball into the store. `attest-main.yml` already attests every push to `main`; the release commit differs from that base only by the version bump, the folded changelog, and the regenerated command index — exactly the set `release-attestation.sh derive` allowlists — so `release.sh` now derives the record itself (`derive_release_attestation`, inheriting the green base's suite via `--inherit-suite-from`, no suite re-run). Soundness is unchanged: `derive` still fails closed if the tree diff touches anything outside that allowlist, so a code change can never inherit a stale pass, and the derive is best-effort — any failure falls through to the previous poll-then-`require`, which still fails loud (the call site guards it with `|| true`, which is load-bearing under `set -euo pipefail`: a bare call returning non-zero would abort the release before that fallback ran). The regression survived review because `release.test.ts` asserted against `release.sh` as *text*; the new coverage executes the real `derive_release_attestation` body against a real git repo and store. Source: `cli/scripts/release.sh`, `cli/scripts/release.test.ts`, `cli/AGENTS.md`.
+
+- **Owner phone pings are short and tappable — but only where a sink can render a link (PHNX-3698).** Every owner-bound message goes through one composer (`composeBroadcastMessage`), and the shared `{message}` now surfaces its links per-sink instead of dumping naked URLs after the footer. A **Slack `channel:` sink** gets mrkdwn labeled links `<url|label>`: the `Sent from claude/6fc1db18 on zion` crumb becomes `<https://prix.dev/console/sessions/<full-id>|claude/6fc1db18>` (an 8-char crumb is first upgraded to the full indexed id, since a truncated id would 404), and every `TEAM-N` key the title or body *names* — not just the session's own `ticketId`, so a ping that only mentions `PHNX-3689` in prose is still tappable — becomes `<https://linear.app/<workspace>/issue/<KEY>|<KEY>>` in place. **iMessage, the owner-scoped rush message, `command:` sinks, and every other channel stay plain** — they cannot render a labeled link and a dumped naked URL reads as noise, so the message is the human sentence with no URLs (keys and crumb as text); there is never a trailing URL line on any sink. `agents notify` and `agents send --to owner` route through that same composer on the owner-scoped (plain) path instead of shipping the raw body dump; a non-owner `agents send` is still delivered verbatim. An important/`--blocked` post (and an owner send) fires a best-effort, opt-in background `agents traces sync` so the linked console page exists when a Slack crumb is tapped (gated exactly like the run-exit arm; `AGENTS_NO_TRACE_SYNC=1` opts out). The Linear-key detector is canonical in one place shared with transcript ticket detection (`session/linear.ts`). Source: `cli/src/lib/feed-broadcast.ts`, `cli/src/lib/owner-message.ts`, `cli/src/lib/session/linear.ts`, `cli/src/lib/session/db.ts`, `cli/src/lib/run-trace-sync.ts`, `cli/src/commands/send.ts`, `cli/src/commands/feed.ts`.
+
+- **An ordinary CLI release no longer signs or notarizes anything on macOS, and the macOS attestation producer works again (PHNX-3699, PHNX-3631).** `release-attestation-produce.sh` gated its sign+notarize block on `uname == Darwin` alone, with no `--with-helpers` condition — so a CLI-only attestation produced on a Mac codesigned the CLI binary and rebuilt + signed both helper `.app`s, none of which ship in the tarball (RUSH-3026 removed the binary, RUSH-3100 the bundles). That violates the R3 requirement ("no signing, no notarization on the ordinary path") and, because `agents secrets exec apple.com` cannot unlock a Touch-ID-gated bundle headlessly, it *killed* the release outright — hit live cutting 1.22.69 right after PHNX-3696 made `release.sh` produce this attestation itself. The block is now gated on `--with-helpers`, so cutting a helper release still signs and an ordinary CLI release does not. Shipped alongside the **PHNX-3631** fix in the same path: `ATTEST_TMP` used `mktemp ".../agents-cli-attest.XXXXXX.json"`, but BSD/macOS `mktemp` only substitutes trailing X's and treats a template with a suffix after them as a literal filename — so the first call created that exact file and every later call died with `mkstemp failed … File exists`. Now `agents-cli-attest.json.XXXXXX`, which GNU accepts identically; the same pattern in `remote-sign-mac.sh` is fixed too. Together these take `release-attestation-produce.test.ts` on macOS from 22-of-29 failing to 31/31 passing. Source: `cli/scripts/release-attestation-produce.sh`, `cli/scripts/remote-sign-mac.sh`.
+
+- **`agents projects view <path>` auto-detects the cwd's project; `projects for-cwd` is gone (PHNX-3704).** `agents projects view [nameOrPath]` now accepts a DIRECTORY as well as a project name. A path-shaped argument — `.`, `..`, a `~`-prefixed value, a `/`-containing value, or an explicit `--path [dir]` (bare `--path` = cwd) — auto-detects the project that contains that directory via the existing path-based `projectNameForCwd` (def-root containment, longest wins); a bare token stays a project name. `view <path> --json` prints `{name, linear:{name,projectId}, root}` in ONE call, so a consumer gets the project name AND its Linear binding without a second `projects list` round-trip. Fail-open: an all-null shape when nothing contains the path, exit 0, never throws. The `projects for-cwd` subcommand and its `formatForCwdOutput` helper are deleted — `view <path> --json` subsumes them. Source: `cli/src/commands/projects.ts`.
+
+- **`agents artifacts share` is private by default when signed in, and storage + visibility now live in one shared module.** A publish with no `--visibility` flag is now `me` (owner-only, Phoenix-gated) instead of `public` — signed in, your share is private unless you opt into `--visibility org` (everyone at your email domain, no org to create) or `--visibility public` (the gallery). A BYO (signed-out) publish still defaults to `public`, since the Worker refuses `me`/`org` without a Phoenix owner. The managed-vs-BYO selection policy and the visibility model are now the single `cli/src/lib/storage/` module (`selectStorageBackendKind` + `publishVisibility`/`defaultVisibilityForBackend`), consumed by both `agents artifacts share` (`lib/share/backend.ts`) and `agents traces sync` (`lib/traces/backend.ts`) instead of each re-deriving it — the seam the `sessions` backup surface reuses next. Failed share calls (publish/list/revisions/delete) now surface the Worker's own error — a 400/413/429 shows its `{"error":"…"}` reason and a 429's `Retry-After` — via one bounded extractor (`lib/share/http-error.ts`) that never dumps an arbitrary body. Source: `cli/src/lib/storage/`, `cli/src/lib/share/{backend,publish,delete,http-error}.ts`, `cli/src/commands/share.ts`.
+
+- **`agents view grok` shows the last-known usage % again instead of a numberless "run grok once to refresh usage".** Two bugs compounded. (1) `getGrokUsageInfo` read `unified.jsonl` from the home it was given, but `agents view` fetches usage per INSTALLED VERSION, passing each version's isolated home (`~/.agents/.history/versions/grok/<ver>`) — whose `.grok/logs/unified.jsonl` never exists, because Grok writes its billing log only to the user's shared real home `~/.grok`. So every version fell back to the refresh hint while the real reading (e.g. week 42%) sat unread in the shared home. Grok usage now resolves the requested home's log first and falls back to the shared `~/.grok` log where Grok actually writes (a per-version log, if one ever appears, still wins). The shared last line is attributed only to the identity that owns `~/.grok` (matching `auth.json`, or the real home itself) — other version-scoped Grok accounts stay as no-recent-usage rather than inheriting that meter. (2) The usage cache serializer persisted only fresh `windows`, dropping the `staleWindows` Grok's collector pre-partitions an ended-period reading onto — so the daemon-refreshed cache the plain `agents view grok` reads rendered the plan alone (no bar), even right after a `--refresh` had shown "W: 42% · stale". The serializer now persists the union of fresh and stale windows; `deserializeClaudeUsageSnapshot` re-runs the freshness gate on read, so the round-trip is preserved for every collector (Claude, which returns raw windows, is unchanged). Source: `cli/src/lib/accounting/usage.ts`.
+
+## 1.22.68
+
+Fix OpenCode session history to index and backfill the genuine first user request.
+
+- **`agents sessions resume` is native-first with same-harness account rotation, and records the origin version so it stops falling back (PHNX-3626).** Resume continues the SAME session with the harness's own native resume (`claude --resume <id>`, codex/grok/opencode native) on its recorded `agent@version` + device, rather than spinning up a fresh `/continue` transcript replay. When the origin account is rate/usage/session-limited, recovery rotates to a healthy INJECTABLE provider account of the same harness and stays native in the origin home (`--strategy balanced`, the same weighted-by-headroom picker dispatch uses); `/continue` replay is now the last-resort fallback only when no native path or no healthy same-harness account exists. The origin version is recorded forward at launch — `buildExecEnv` exports `AGENTS_RUN_VERSION`, the SessionStart hook joins it to the harness's real session id in the durable sidecar (like the launch mode), and the scan joins it at row build (`meta.version ?? actorRec.version`) and write-once COALESCEs it into the index — so a codex session whose transcript carried no derivable version (its relocated `.codex-homes/<version>/` home, which the scanner now also reads) no longer degrades to `/continue` for a missing recorded origin. Resume prefers the recorded device and falls back to a clearly-labelled local `/continue` replay from the synced mirror when that device is genuinely unreachable. Source: `cli/src/lib/session/recovery.ts`, `cli/src/lib/exec.ts`, `cli/src/commands/resume.ts`, `cli/src/lib/session/actor-sidecar.ts`, `cli/src/lib/session/db.ts`, `cli/src/lib/session/discover.ts`, `cli/src/lib/accounting/account-pool-collect.ts`, `packages/session-tracker/src/hook.sh`.
+
+- **`agents artifacts share --private/--unlisted` had no read authentication — private shares were world-readable by URL (PHNX-3654).** The share Worker's GET served any object with `cache-control: public` after only existence + expiry checks, so `--private`/`--unlisted` were obscurity, not authentication, and a private share could get a title-derived guessable slug. Two fixes ship together. **(A)** An `unlisted`/`--private` publish now prints a loud stderr warning that unlisted is NOT authenticated and points at the real controls, and forces a **64-bit random slug tail** (regardless of `--label`/title) so the capability URL can't be guessed. **(B)** A new **`--protected`** flag (= `--visibility private`) is token-gated read auth: the CLI mints a random viewer token, the Worker stores only its **SHA-256 hash** (`viewer-token-hash`) and serves the object — its page, generated OG cover, and revision list — only to a request whose `?k=<token>` or `Authorization: Bearer` matches under a constant-time compare, returning `404` (never `401`, no existence leak) otherwise. The key rides only in the emitted `https://<host>/<user>/<slug>?k=<token>` URL; the namespace owner reads their own private page without it, and it works for BYO endpoints too. `private` is publish-only — the in-place `share visibility` / PATCH route rejects it with a `400`. Source: `cli/src/lib/share/publish.ts`, `cli/src/lib/share/worker-template.ts`, `cli/src/commands/share.ts`, `cli/docs/share.md`.
+
+## 1.22.67
+
+- **Keep the shared daemon client-safe (PHNX-3605).** Browser version reconciliation no longer restarts the process; browser and routines lifecycle commands now enable, disable, and reload only their own services while sibling work keeps running. Source: `src/lib/browser/ipc.ts`, `src/commands/browser.ts`, `src/commands/routines.ts`.
+
+- **Daemon stop/start races can no longer erase a successor or signal a reused PID (PHNX-3607).** `stopDaemon()` now holds the same `daemon.lock` as start/claim through signal, wait, postcondition, and cleanup; it trusts a recorded PID only when the live process command ends in `__daemon-run`, and compare-deletes the PID/socket identity it captured instead of unlinking a successor's replacement. The stray-daemon reaper now waits for SIGTERM death, escalates to `killTree` when needed, waits again, and retains the registry marker if a duplicate somehow survives. Source: `cli/src/lib/daemon/daemon.ts`, `cli/src/lib/browser/ipc.ts`.
+
+- **Daemon supervisor hardening: abandon hung ticks, thread an AbortSignal, and bring account-state/catch-up under the supervisor (PHNX-3608).** A supervised tick that awaited something that never settled used to park the service but hold its in-flight guard forever, so the backoff restart, `agents daemon services restart`, and SIGHUP reload were all blocked — a service could freeze for the daemon's life while still looking healthy (the 12h usage-dark class). On a deadline breach the supervisor now ABANDONS the tick: it aborts the tick's new `AbortSignal`, releases the in-flight guard immediately, and schedules the backoff restart right away, draining the runaway promise separately. `PeriodicService.tick(ctx, signal)` receives that signal so a service can bound its own I/O. `start()`/`stop()`/`restart()` are now bounded by a lifecycle deadline so a wedged bind/close can't stall daemon startup or shutdown. The account-state usage/auth refresh — previously its own un-deadlined `setInterval` behind a `usageRunning` latch (the exact hang that froze usage) — is now TWO supervised `PeriodicService`s (`account-state` usage + `account-auth`) with a real deadline + abort and INDEPENDENT circuit breakers, so a run of usage-refresh failures parks only usage and never starves the slower auth refresh; the deadline signal is threaded through to each provider fetch. Catch-up recovery moved off its bare `setInterval` onto a supervised `catchup` service. Disabling the `monitors` service now routes through `supervisor.stop`, and a stopped monitor engine dispatches nothing on tick — so a disabled monitors service actually stops firing instead of being ticked with its last-loaded set. Source: `cli/src/lib/daemon/supervisor.ts`, `cli/src/lib/daemon/service.ts`, `cli/src/lib/daemon/account-state-daemon-service.ts`, `cli/src/lib/daemon/catchup-service.ts`, `cli/src/lib/daemon/monitor-engine-service.ts`, `cli/src/lib/monitors/engine.ts`, `cli/src/lib/daemon/daemon.ts`, `cli/src/lib/daemon-services.ts`, `cli/src/lib/daemon-ticks.ts`, `cli/src/lib/usage-refresh.ts`, `cli/src/lib/accounting/usage.ts`, `cli/src/lib/auth-health.ts`.
+
+- **A cold `agents browser navigate` on a worker now follows the fleet browser hub instead of failing locally (PHNX-3610).** A bare `agents browser start` already forwards to the hub (`config.defaultBrowserDevice`), but a page verb with no bound task — `agents browser navigate|screenshot|click|…` run without a preceding `start` — did not: `resolveTaskRoute`'s no-task branch returned the local box, so the verb ran on the worker and failed with "no default browser on this machine." Agents on other devices could only drive the hub's logged-in browser if they knew to `start` first. The no-task branch now follows `defaultBrowserHub()` (passed in as `resolveTaskRoute`'s `hub` option so the leaf stays pure), and the task-routing hook forwards a taskless drive verb to the hub. So the hub creates the caller's OWN task, the dispatch now **forwards the caller's session/launch identity** (`AGENT_SESSION_ID`/`AGENT_LAUNCH_ID`, the same surface-parity mechanism `run --device` uses) — without it a forwarded verb resolved BLANK identity on the hub and its no-identity task bucket could collide with an unrelated agent's or a human's browser. A cold CLOSE verb (`done`/`stop`) is deliberately **not** forwarded when taskless — with no task it would target a context this session never opened — so it can never blindly stop a hub task. Behavior-only, no new flags; the existing `isSelfHost`/`isFleetRemoteInvocation` guards mean the hub never forwards to itself and a re-exec never loops. Source: `cli/src/lib/browser/task-index.ts`, `cli/src/lib/browser/caller-identity.ts`, `cli/src/commands/browser.ts`.
+
+- **The canonical session watch now carries the genuine request and recoverable history (PHNX-3621).** Transcript indexing stores `firstUserMessage` separately from the one-line topic, skips harness-injected plugin/developer scaffolding, preserves long multi-line requests, and backfills existing rows through the versioned content index. `agents feed watch --json` also folds in a bounded set of durable Previous rows on reset, marks ended live rows as Previous, and emits `agent.remove` before their replacement so presentation clients can render and resume history without parsing transcripts or issuing a second session fetch. Source: `cli/src/lib/session/prompt.ts`, `cli/src/lib/session/discover.ts`, `cli/src/lib/session/db.ts`, `cli/src/lib/session/active.ts`, `cli/src/lib/session/remote/watch.ts`, `cli/src/lib/feed/watch.ts`.
+
+- **Auto-sync traces when a local run exits (PHNX-3628).** Trace upload was manual-only — the sole caller of `syncTraces()` was `agents traces sync`, so the Prix console went stale between hand-runs. A local, headless `agents run` now spawns a detached `agents traces sync` on exit (mirroring `run-notify`; the incremental ledger means it pushes essentially just the finished session). It fires only when you have already opted into the traces store (signed in AND synced at least once); opt out per-run with `--no-trace-sync` or `AGENTS_NO_TRACE_SYNC=1`. Local runs only. Source: `src/lib/run-trace-sync.ts`, `src/lib/traces/sync.ts`, `src/commands/exec.ts`.
+
+- **The shared daemon now contains lock-refresh and reload failures instead of crashing, and concurrent health writers preserve the restart-backoff streak (PHNX-3606).** Every direct `proper-lockfile` lease used by device/team registries, routine launch claims, and usage refresh coordination overrides the library's timer-level compromise throw with an observable log-and-continue barrier. The daemon's `SIGHUP` reload callback is guarded independently of service supervision, and `health.json` updates now serialize the complete read-modify-write under a file lock and publish through atomic rename, so parallel processes cannot erase each other's failure counts or expose partial JSON. Source: `cli/src/lib/lock-compromise.ts`, `cli/src/lib/daemon/daemon.ts`, `cli/src/lib/daemon-health.ts`.
+
+- **Daemon usage/auth sync no longer blocks the event loop or opens a per-tick SSH mesh (PHNX-3609).** Headed devices publish one identity-keyed usage snapshot into their conflict-free tracked `~/.agents/devices/<device>/daemon-state.json`; each daemon automatically commits only its owned file and exchanges the user repo under one cross-process lock and a 45-second hard process-tree deadline, so workers receive and merge snapshots newest-wins without a human `agents repo sync user`. `auth-sync` uses the same file for non-secret `ready`/`missing`/`invalid` verdicts, elects one ready publisher, and opens device-to-device SSH only to provision a peer known to be missing the reserved bundle. That exceptional secret transfer is fully async and every import/read-back operation has a 20-second deadline; timeout disables SSH multiplexing, sends `SIGTERM`, then `SIGKILL`s an uncooperative client after a short grace so both the local promise and direct remote connection are bounded. OAuth/setup-token values never enter the Git store. Source: `cli/src/lib/fleet-shared-state.ts`, `cli/src/lib/fleet-shared-repo-sync.ts`, `cli/src/lib/accounting/usage-sync.ts`, `cli/src/lib/secrets/reserved-sync.ts`, `cli/src/lib/secrets/push.ts`, `cli/src/lib/ssh-exec.ts`.
+
 ## 1.22.66
 
 - **Fleet usage/auth sync now reaches FQDN-only-pinned workers (PHNX-3505).** The

package/README.md

@@ -416,11 +416,11 @@ agents sessions resume 019fd0c8-b3e9-77a2-a1a4-444698c4d897  # original harness/
 agents run auto --resume 019fd0c8-b3e9-77a2-a1a4-444698c4d897  # adapt if its account is unavailable
 ```
 
-`agents sessions resume` reopens several sessions in whatever terminal you're in -- auto-detected across iTerm, Ghostty, tmux, and the VSCodium agent-terminal, or forced with `--iterm` / `--ghostty` / `--tmux` / `--vscodium`. `agents sessions resume <id>` resumes one session without requiring you to name its harness: exact IDs take a local SQLite fast path, then resolve fleet-wide and recover on the source device. If the origin version is installed, signed in, healthy, and still owns the indexed transcript, its isolated home performs native resume. Claude launches that native resume from the original project directory recorded before the first turn, so its `projects/<cwd-key>` lookup reaches the conversation even when the session later changed directories. Otherwise a healthy version of the **same harness** starts with `/continue <id>`, which reads the indexed transcript even when the old version home is retained under version trash or the same version number was reinstalled into a new home. It never native-resumes from a different isolated home. Back them with **tmux** and the runs turn durable: detach, close your editor, reboot the GUI -- the session is still alive to `agents tmux attach`. The whole `agents tmux` subsystem (persistent multiplexer sessions that survive editor restarts and can be shared with other tools) sits underneath.
+`agents sessions resume` reopens several sessions in whatever terminal you're in -- auto-detected across iTerm, Ghostty, tmux, and the VSCodium agent-terminal, or forced with `--iterm` / `--ghostty` / `--tmux` / `--vscodium`. `agents sessions resume <id>` resumes one session without requiring you to name its harness: exact IDs take a local SQLite fast path, then resolve fleet-wide and recover on the source device. If the origin version is installed, signed in, healthy, and still owns the indexed transcript, its isolated home performs native resume. Claude launches that native resume from the original project directory recorded before the first turn, so its `projects/<cwd-key>` lookup reaches the conversation even when the session later changed directories. When that origin login is usage-limited but the home still owns the transcript, resume stays native and rotates to a healthy injectable provider account of the **same harness**. `/continue <id>` is the last-resort fallback — a signed-out, revoked, trashed, backup-only, or same-number-reinstalled origin, or a limited origin whose transcript is no longer in that home — and still authenticates as a healthy same-harness account (injecting a provider credential when that is the pick, so it never launches the exhausted native login). It never native-resumes from a different isolated home. Back them with **tmux** and the runs turn durable: detach, close your editor, reboot the GUI -- the session is still alive to `agents tmux attach`. The whole `agents tmux` subsystem (persistent multiplexer sessions that survive editor restarts and can be shared with other tools) sits underneath.
 
 ### Send an agent to the background — and bring it back
 
-Running 30 agents and drowning in terminal tabs? `agents sessions detach <id>` stops a session's interactive process and keeps it working **headless** in the background -- it drives its task to done unattended, no tab, lower cost. `agents sessions resume <id>` brings it back through the same origin-device recovery decision: native resume in the exact healthy origin home, or same-harness `/continue` when that home is unavailable, with the full indexed history (including whatever it did while backgrounded).
+Running 30 agents and drowning in terminal tabs? `agents sessions detach <id>` stops a session's interactive process and keeps it working **headless** in the background -- it drives its task to done unattended, no tab, lower cost. `agents sessions resume <id>` brings it back through the same origin-device recovery decision: native resume in the exact origin home (healthy login, or a rotated injectable account on a usage limit), or same-harness `/continue` as last resort when that home is unavailable, with the full indexed history (including whatever it did while backgrounded).
 
 ```
 agents sessions detach a1b2c3d4     # go headless in the background, keep working
@@ -658,6 +658,9 @@ agents fleet status                     # online/offline rollup + NEEDS ATTENTIO
 agents fleet status --verbose           # full per-device auth/CLI/sync/version grid
 agents fleet status --live              # force a live resource probe (alias of --refresh)
 agents fleet status --json --strict     # scriptable fleet health gate
+agents fleet worktrees                  # held agent worktrees by bucket: stranded (unmerged) · dirty · undeterminable
+agents fleet worktrees --fleet          # aggregate the held set across every online device
+agents fleet worktrees --push           # publish stranded on-no-remote branches (recovers work; never deletes)
 agents devices harnesses                # per device: agent@version · account · signed · quota · ready
 agents devices accounts                 # same, one row per account (which harnesses share it)
 agents devices harnesses --agents claude,codex --json   # scoped, machine-readable
@@ -1252,6 +1255,8 @@ agents daemon services                      # health of the two hosted services
 agents daemon services list                 # every toggleable service and its current on/off state
 agents daemon services enable secrets-broker
 agents daemon services disable browser-ipc  # stop hosting browser IPC without stopping the daemon
+agents browser stop --service               # browser-scoped alias; next browser action requiring IPC re-enables it
+agents routines stop                        # disable/reload only the scheduler service
 agents daemon logs -f --level warn --since 1h
 agents daemon doctor                        # one-shot health check; non-zero exit on problems
 ```
@@ -1261,8 +1266,11 @@ watchdog, device probe, self-heal, keychain reap, account-state refresh,
 state-dir checks) is an independent toggle in `~/.agents/daemon/services.yaml`.
 `agents daemon services list` shows every service; `enable|disable <id>` flips
 one. Missing keys default to enabled, so upgrades are no-ops. Most services take
-effect on the next daemon start; scheduler and monitor engine also re-evaluate
-on `SIGHUP reload`.
+effect on the next daemon start; browser IPC is registered even when boot-disabled
+so browser commands can enable it live, while scheduler and monitor engine also
+re-evaluate on `SIGHUP reload`. Only `agents daemon start|stop|restart` owns the
+whole process lifecycle. Browser and routines clients change their own service
+state without evicting sibling work.
 
 There is no `agents daemon jobs` -- scheduled work is always `agents routines`
 (see `agents routines stats` for per-routine failure detail). `disable` is a
@@ -1317,6 +1325,7 @@ Sources: a command's stdout (`--watch` / `--poll`), an HTTP endpoint (`--poll-ht
 # Signed in? Just publish — no Cloudflare setup.
 agents auth login
 agents artifacts share plan.html --visibility unlisted      # → https://share.agents-cli.sh/<handle>/<slug>-<id>
+agents artifacts share secret.html --protected              # → https://share.agents-cli.sh/<handle>/<slug>-<id>?k=<token>
 
 # Or provision your own Cloudflare R2 (~$0).
 agents artifacts setup                                      # once: provision bucket + Worker on your CF
@@ -1326,7 +1335,7 @@ agents artifacts share plan.html --label "Q3 fleet plan" --meta kind=plan   # hu
 agents artifacts share plan.html --json                     # URL object for plan-render hooks
 agents artifacts share list --agent claude                  # public gallery, filterable
 agents artifacts share list --meta kind=plan                # exact, repeatable metadata filters
-agents artifacts share list --all                           # include hidden unlisted/me/org pages
+agents artifacts share list --all                           # include hidden unlisted/private/me/org pages
 agents artifacts share list --scope me                      # just the owner-only pages
 agents artifacts share edit fleet --label "Final fleet plan" --meta status=final
 agents artifacts share revisions fleet                      # prior versions kept under a slug
@@ -1348,7 +1357,10 @@ Worker lazily renders and caches the branded 1200×630 Open Graph card at `<slug
 so publishing from Linux does not require a local Chromium; BYO endpoints keep the
 local screenshot fallback. `--visibility unlisted` (hidden aliases
 `--unlisted` / `--private`) is a capability URL: GET still works, the gallery hides it,
-and the Worker sends `X-Robots-Tag: noindex`. `--visibility me` is visible only to
+and the Worker sends `X-Robots-Tag: noindex`. `--protected` (`--visibility private`)
+is token-gated: the published URL carries a secret `?k=` key (`Authorization: Bearer`
+is accepted too) and GET returns 404 without it — treat the whole link as a secret.
+`--visibility me` is visible only to
 you (the signed-in owner); `--visibility org` is visible to anyone at your email
 **domain** — derived from your own address, so it needs a **workspace** Google
 account and is refused on a public-inbox domain (`gmail.com`, `outlook.com`,
@@ -1368,8 +1380,9 @@ single **Phoenix ID** (Google-only device-code OAuth, `agents auth login`) — s
 a Cloudflare API token from your `cloudflare.com` secrets bundle (or `--token`), creates
 an R2 bucket, uploads a tiny Worker, and enables the free `*.workers.dev` subdomain (or
 maps `--domain share.example.com` when the token owns the zone). Writes are bearer-gated
-**through** the Worker (Phoenix bearer or static `WRITE_TOKEN`); reads are **public**, so
-a link outlives the agent. R2 has zero egress + a 10 GB free tier, so BYO is still
+**through** the Worker (Phoenix bearer or static `WRITE_TOKEN`); public and unlisted
+reads are **public** so a link outlives the agent, while `--protected` token-gates
+reads on BYO too. R2 has zero egress + a 10 GB free tier, so BYO is still
 effectively free.
 
 **Fleet mode:** provision one endpoint, then every fleet / cloud / ephemeral agent

package/dist/bootstrap.js

@@ -19,6 +19,7 @@ import * as path from 'path';
 import { fileURLToPath } from 'url';
 import { detectDevBuild } from './lib/startup/dev-build.js';
 import { configureRootCommand } from './lib/startup/root-command.js';
+import { bootMark } from './lib/boot-profile.js';
 // `ora`, `@inquirer/prompts`, `./commands/utils.js`, and the agents/versions/shims
 // modules are imported dynamically at their use sites: they are needed only on
 // interactive / update / shim-repair paths, never for fast commands like
@@ -1029,6 +1030,7 @@ if (helpAllRequested) {
 // immediately: skip the update check (PATH scan + cache read) and the detached
 // background sync (spawns a child process) that every other invocation runs.
 if (!isDocumentationRequest) {
+    bootMark('bootstrap:evaluated');
     // Run update check before parsing so the upgrade notice/prompt precedes output.
     await checkForUpdates();
     // Fire-and-forget the background sync. System repo gets a real fast-forward
@@ -1157,21 +1159,22 @@ if (passedArgs.length === 0) {
 }
 try {
     await maybeBootstrapShimIntegration(requestedCommand, isDocumentationRequest, verboseStartup);
+    bootMark('bootstrap:pre-parse');
     await program.parseAsync();
 }
 catch (err) {
     if (err instanceof Error && err.name === 'ExitPromptError') {
         process.exit(130);
     }
-    // Browser-daemon-not-running and CDP-not-reachable surface as typed errors
+    // Browser-service-not-running and CDP-not-reachable surface as typed errors
     // from src/lib/browser/. Don't dump a Node stacktrace for these — they are
     // user-actionable, not engineering bugs. See issues #41 and #43.
     if (err instanceof Error) {
-        const isBrowserDaemonNotRunning = err.name === 'BrowserDaemonNotRunningError';
+        const isBrowserServiceNotRunning = err.name === 'BrowserServiceNotRunningError';
         const isBrowserCdpUnreachable = err.name === 'BrowserCdpConnectionError';
         const isBrowserIpcDown = err.message.startsWith('IPC error:') &&
             (err.message.includes('ECONNREFUSED') || err.message.includes('ENOENT'));
-        if (isBrowserDaemonNotRunning || isBrowserCdpUnreachable || isBrowserIpcDown) {
+        if (isBrowserServiceNotRunning || isBrowserCdpUnreachable || isBrowserIpcDown) {
             console.error(err.message);
             process.exit(1);
         }

package/dist/commands/browser.js

@@ -1,3 +1,4 @@
+import { Option } from 'commander';
 import chalk from 'chalk';
 import { spawnSync } from 'node:child_process';
 import * as fs from 'fs';
@@ -14,8 +15,9 @@ import { DEFAULT_VIEWPORT, parseWindowSize, parseWindowPosition } from '../lib/b
 import { runBrowserSessionsCommand } from './browser-sessions-picker.js';
 import { discoverBrowserWsUrl, verifyBrowserIdentity } from '../lib/browser/cdp.js';
 import { parseTargetFilter } from '../lib/browser/service.js';
-import { BrowserDaemonNotRunningError, formatBrowserDaemonNotRunningError, sendIPCRequest as sendRawIPCRequest, resetBrowserDaemon, } from '../lib/browser/ipc.js';
-import { bindTask, getTaskBinding, honorScreenshotOutput, REJECT_DEVICE_MESSAGE, resolveTaskRoute, unbindTask, unbindTasksForProfile, updateTaskBinding, } from '../lib/browser/task-index.js';
+import { BrowserServiceNotRunningError, formatBrowserServiceNotRunningError, sendIPCRequest as sendRawIPCRequest, stopBrowserService, } from '../lib/browser/ipc.js';
+import { bindTask, getTaskBinding, honorScreenshotOutput, isTerminalBrowserVerb, REJECT_DEVICE_MESSAGE, resolveTaskRoute, unbindTask, unbindTasksForProfile, updateTaskBinding, } from '../lib/browser/task-index.js';
+import { callerIdentityEnv, resolveCallerIdentity } from '../lib/browser/caller-identity.js';
 import { isSelfHost } from '../lib/devices/self-host.js';
 import { resolveHost } from '../lib/hosts/registry.js';
 import { sshTargetFor } from '../lib/hosts/types.js';
@@ -132,12 +134,17 @@ async function dispatchBrowserToDevice(device, forwardedArgs, mode) {
     }
     const target = sshTargetFor(host);
     const remoteOs = resolveRemoteOsSync(host.name);
-    const env = withActorEnv({ AGENTS_FLEET_REMOTE: '1' });
+    // Forward the caller's identity so the HUB resolves the same session/launch id
+    // the worker would stamp locally. Without it the forwarded verb lands blank on
+    // the hub and its no-identity task bucket collides with unrelated tasks — the
+    // surface-parity gap the run --device path already closes (caller-identity.ts).
+    const identityEnv = callerIdentityEnv(resolveCallerIdentity());
+    const env = withActorEnv({ ...identityEnv, AGENTS_FLEET_REMOTE: '1' });
     const remoteCmd = buildRemoteAgentsInvocation(forwardedArgs, undefined, remoteOs, env);
     if (mode === 'stream') {
         const code = streamAgentsOnHost(host, forwardedArgs, {
             interactive: !!process.stdout.isTTY && !process.argv.includes('--no-tty'),
-            extraEnv: { AGENTS_FLEET_REMOTE: '1' },
+            extraEnv: { ...identityEnv, AGENTS_FLEET_REMOTE: '1' },
             remoteOs,
             target,
         });
@@ -304,7 +311,7 @@ export function registerBrowserCommand(program) {
       agents browser navigate https://example.com
       agents browser screenshot
 
-      # Keep one process and daemon socket warm for repeated actions
+      # Keep one process and browser-service socket warm for repeated actions
       agents browser stream --task "$AGENTS_BROWSER_TASK"
 
       # Bind a device at start; later verbs resolve it from the task
@@ -324,9 +331,9 @@ export function registerBrowserCommand(program) {
       # Close tabs the daemon's own reaper would have caught on its next 5-min tick
       agents browser prune --dry-run
 
-      # Recover a wedged daemon ("Timeout waiting for browser daemon socket"):
-      # stop it and clear a stale socket, then start clean
-      agents browser stop --daemon
+      # Recover browser IPC without interrupting routines, usage, or secrets:
+      # stop only the browser service, then start it clean
+      agents browser stop --service
       agents browser start
     `,
         notes: `
@@ -1261,13 +1268,25 @@ function registerTaskCommands(browser) {
             task: taskFlag ?? process.env.AGENTS_BROWSER_TASK,
             sessionId: callerSessionId(),
             launchId: callerLaunchId(),
+            hub: defaultBrowserHub(),
         });
         if (route.kind !== 'proceed') {
             console.error(route.message);
             process.exit(1);
         }
         inferredTaskName = route.task;
-        if (isSelfHost(route.device) || !route.task)
+        // A cold page verb (no bound task) whose route is the fleet hub still
+        // forwards: `route.task` is undefined but `route.device` is a peer, so the
+        // `--task` push below is skipped and the hub's daemon creates the caller's
+        // OWN task (keyed to the identity `dispatchBrowserToDevice` now forwards).
+        // Only a self-host route runs locally.
+        if (isSelfHost(route.device))
+            return;
+        // ...but a cold CLOSE verb (done/stop) must NOT forward: with no task it
+        // would target a browsing context this session never opened. It stays local
+        // (its historic no-task behaviour) unless an explicit --task/local binding
+        // routes it — a taskless `done` must never blindly stop a hub task.
+        if (!route.task && isTerminalBrowserVerb(top))
             return;
         const forwarded = browserForwardedArgv();
         if (route.task && !forwarded.includes('--task')) {
@@ -1364,7 +1383,7 @@ function registerTaskCommands(browser) {
     });
     setHelpSections(stream, {
         examples: `
-      # Batch two warm actions through one process and one daemon connection
+      # Batch two warm actions through one process and one browser-service connection
       printf '%s\\n' \\
         '{"action":"screenshot","path":"/tmp/page.jpg"}' \\
         '{"action":"click","atX":320,"atY":540}' \\
@@ -1688,24 +1707,29 @@ function registerTaskCommands(browser) {
     });
     browser
         .command('stop')
-        .description('Stop a browser task and close its tabs; with --profile, detach the whole profile (close browser + drop cached connection); with --daemon, stop the browser daemon and clear a wedged socket')
+        .description('Stop a browser task and close its tabs; with --profile, detach the whole profile; with --service, stop only browser IPC while the shared daemon stays up')
         .option(TASK_OPTION_FLAG, TASK_OPTION_DESC)
         .option(DEVICE_ON_PAGE_VERB_FLAG, DEVICE_ON_PAGE_VERB_DESC)
         .option('-p, --profile <name>', 'Detach the whole profile (incl. composite "name@endpoint") instead of stopping a single task')
-        .option('--daemon', 'Stop the browser daemon entirely and clear a stale/wedged socket so the next start comes up clean (recovery for "Timeout waiting for browser daemon socket")')
+        .option('--service', 'Stop only the browser-ipc service and clear a stale/wedged socket; the shared daemon and its other services stay up')
+        .addOption(new Option('--daemon').hideHelp())
         .action(async (opts) => {
-        if (opts.daemon) {
+        if (opts.service || opts.daemon) {
             if (opts.profile || opts.task) {
-                console.error('--daemon stops the whole browser daemon; do not combine it with --profile or --task.');
+                console.error('--service stops browser IPC; do not combine it with --profile or --task.');
                 process.exit(1);
             }
+            if (opts.daemon) {
+                console.error('`--daemon` now means the browser service only; use `--service`. The shared daemon will not be stopped.');
+            }
             try {
-                const result = await resetBrowserDaemon();
+                const result = await stopBrowserService();
                 const parts = [];
-                parts.push(result.wasRunning ? 'Stopped browser daemon' : 'Browser daemon was not running');
+                parts.push(result.wasRunning ? 'Stopped browser service' : 'Browser service was not running');
                 if (result.socketCleared)
                     parts.push('cleared stale socket');
-                console.log(`${parts.join('; ')}. It restarts on the next browser command.`);
+                parts.push(result.daemonRunning ? 'shared daemon is still running' : 'shared daemon was already stopped');
+                console.log(`${parts.join('; ')}. Browser IPC starts again on the next browser action that requires it.`);
             }
             catch (err) {
                 console.error(err instanceof Error ? err.message : String(err));
@@ -2121,7 +2145,7 @@ function registerTaskCommands(browser) {
     }
     browser
         .command('status')
-        .description('Show running browser tasks')
+        .description('Show browser service state and running browser tasks')
         .option('-p, --profile <name>', 'Filter by profile')
         .option('--json', 'Output machine-readable JSON')
         .action(async (opts) => {
@@ -2133,10 +2157,10 @@ function registerTaskCommands(browser) {
             }, { autoStartDaemon: false });
         }
         catch (err) {
-            if (err instanceof BrowserDaemonNotRunningError) {
-                const message = formatBrowserDaemonNotRunningError();
+            if (err instanceof BrowserServiceNotRunningError) {
+                const message = formatBrowserServiceNotRunningError();
                 if (opts.json) {
-                    console.log(JSON.stringify({ ok: false, error: message }));
+                    console.log(JSON.stringify({ ok: false, service: { id: 'browser-ipc', state: 'stopped' }, error: message }));
                 }
                 else {
                     console.error(message);
@@ -2158,6 +2182,7 @@ function registerTaskCommands(browser) {
             console.log(JSON.stringify(response.profiles ?? [], null, 2));
             return;
         }
+        console.log(chalk.gray('Browser service: running (shared daemon unchanged)'));
         // Build flat list of tasks with profile context
         const allTasks = [];
         for (const profile of response.profiles || []) {

package/dist/commands/daemon-test-harness.d.ts

@@ -28,7 +28,7 @@ export declare function makeHome(): string;
 export declare function run(home: string, args: string[]): ReturnType<typeof spawnSync>;
 /**
  * Spawn a real, long-lived process whose command line ends in `__daemon-run`
- * (so `isDaemonRunProcess`'s `ps` check accepts it — see
+ * (so `isLiveDaemon`'s process-command check accepts it — see
  * `lib/daemon.test.ts`'s "reaps a live __daemon-run registrant" test, same
  * technique) and register it in `home`'s OWN instance registry, exactly the
  * marker `registerDaemonInstance` would write. A real live process, not a

package/dist/commands/daemon-test-harness.js

@@ -54,7 +54,7 @@ export function run(home, args) {
 }
 /**
  * Spawn a real, long-lived process whose command line ends in `__daemon-run`
- * (so `isDaemonRunProcess`'s `ps` check accepts it — see
+ * (so `isLiveDaemon`'s process-command check accepts it — see
  * `lib/daemon.test.ts`'s "reaps a live __daemon-run registrant" test, same
  * technique) and register it in `home`'s OWN instance registry, exactly the
  * marker `registerDaemonInstance` would write. A real live process, not a
@@ -67,7 +67,7 @@ export async function spawnFakeRegisteredDaemon(home) {
         stdio: 'ignore',
     });
     // Give the exec a moment to land before `ps` (read by the status command's
-    // isDaemonRunProcess check) is asked to see its real argv — mirrors
+    // isLiveDaemon check) is asked to see its real argv — mirrors
     // lib/daemon.test.ts's identical fake-daemon technique.
     await new Promise((r) => setTimeout(r, 150));
     const instancesDir = path.join(home, '.agents', '.cache', 'helpers', 'daemon', 'instances');

package/dist/commands/daemon.js

@@ -297,9 +297,9 @@ async function probeSecretsBroker() {
 }
 async function probeBrowserIPC() {
     const record = readSubsystemHealth(SUBSYSTEM_BROWSER_IPC);
-    const { isDaemonReachable, getSocketPath } = await import('../lib/browser/ipc.js');
+    const { isBrowserServiceReachable, getSocketPath } = await import('../lib/browser/ipc.js');
     const { listAllProfileSnapshots } = await import('../lib/browser/runtime-state.js');
-    const bound = await isDaemonReachable();
+    const bound = await isBrowserServiceReachable();
     const sessionCount = listAllProfileSnapshots().filter((s) => s.pidAlive && s.daemonAlive).length;
     return { bound, socketPath: getSocketPath(), sessionCount, record };
 }
@@ -892,14 +892,13 @@ export function registerDaemonCommand(program) {
       'systemctl start' on a disabled unit.
 
       'agents daemon services enable|disable|restart <id>' applies live (no
-      daemon restart) for the 10 supervisor-managed services: secrets-broker,
-      browser-ipc, account-state, session-index, monitors (off only — turning
-      monitors back on still needs a restart), watchdog, device-probe,
-      self-heal, keychain-reap, and state-dir-check. The other 2 services
-      (scheduler, webhook-receiver) are still bare interval/socket setups with
-      no live start/stop hook, so a toggle there — and 'enable' on any service
-      that was disabled at daemon boot — still needs 'agents daemon restart'.
-      'agents daemon services' names which case you're in per row.
+      daemon restart) for supervisor-managed services that were registered at
+      boot. browser-ipc is also registered while disabled, specifically so a
+      browser client can enable it live. The inline scheduler re-evaluates its
+      toggle on every reload as well. A boot-disabled service other than
+      browser-ipc, the monitor on-transition, and webhook-receiver still need an
+      operator 'agents daemon restart'. 'agents daemon services' names which
+      case you're in per row.
     `,
     });
     cmd.command('status')
@@ -1020,12 +1019,13 @@ export function registerDaemonCommand(program) {
       agents daemon services restart secrets-broker
     `,
         notes: `
-      A service disabled at daemon boot was never registered on the
-      supervisor, so 'enable' on it — and any toggle/restart on the 2
-      services the supervisor doesn't manage yet (scheduler,
-      webhook-receiver) — falls back to 'restart the daemon to apply'. Each
-      row in the plain-text view names which case it is; 'supervised:
-      true/false' does the same in --json.
+      A service disabled at daemon boot is normally not registered on the
+      supervisor, so enabling it needs an operator restart. browser-ipc is the
+      exception: it is registered stopped and can be enabled live. The inline
+      scheduler also applies enable/disable on reload; webhook-receiver and the
+      monitor on-transition still require 'agents daemon restart'. Each row in
+      the plain-text view names which case it is; 'supervised: true/false' does
+      the same in --json.
     `,
     });
     servicesCmd
@@ -1057,12 +1057,11 @@ export function registerDaemonCommand(program) {
      * Apply an enable/disable toggle live (RUSH-3193 P4): persist it, then signal
      * the running daemon to reload — its handler diffs the toggle and drives
      * `supervisor.start/stop(id)` for a supervised service, so no restart is
-     * needed for the 10 supervisor-managed services (secrets-broker,
-     * browser-ipc, account-state, session-index, monitors' off-transition,
-     * watchdog, device-probe, self-heal, keychain-reap, state-dir-check). The 2
-     * remaining `setInterval`/socket-driven services (scheduler,
-     * webhook-receiver) and monitors' on-transition still need a restart — the
-     * daemon's own reload log says so.
+     * needed for supervisor-managed services registered at boot. browser-ipc is
+     * registered even when disabled so it can be enabled live; the inline
+     * scheduler also re-evaluates its toggle on reload. webhook-receiver,
+     * monitors' on-transition, and other boot-disabled services still need a
+     * deliberate operator restart — the daemon's own reload log says so.
      */
     function applyServiceToggleLive(service) {
         if (!isDaemonRunning())