@phnx-labs/agents-cli 1.22.66 → 1.22.69

package/dist/lib/daemon/runner.js

@@ -33,6 +33,7 @@ import { reconcileTask as reconcileHostTask } from '../hosts/reconcile.js';
 import { backgroundSpawnOptions, killTree } from '../platform/process.js';
 import lockfile from 'proper-lockfile';
 import { ensureLockTarget } from '../fs-atomic.js';
+import { logAndContinueOnLockCompromised } from '../lock-compromise.js';
 import { walkForFiles } from '../fs-walk.js';
 import { getBinaryPath, isVersionInstalled, resolveVersion, getVersionHomePath } from '../installations/versions.js';
 import { resolveClaudeSetupToken } from '../claude-account-token.js';
@@ -153,6 +154,7 @@ async function withRoutineLock(config, launch) {
             minTimeout: 100,
             maxTimeout: 100,
         },
+        onCompromised: logAndContinueOnLockCompromised('routines launch'),
     });
     try {
         return await launch();

package/dist/lib/daemon/service.d.ts

@@ -41,7 +41,14 @@ export interface DaemonService {
 /** A service the supervisor ticks on a fixed interval, under a hard per-tick deadline. */
 export interface PeriodicService extends DaemonService {
     readonly intervalMs: number;
-    /** Hard cap per tick. An over-budget tick parks the service; its in-flight guard remains held until the real promise settles. */
+    /**
+     * Hard cap per tick. An over-budget tick is ABANDONED: the supervisor aborts
+     * the tick's {@link AbortSignal}, parks the service, and schedules a backoff
+     * restart immediately — it does NOT wait for the real promise to settle
+     * (PHNX-3608). A tick that awaits `signal` (or forwards it to its I/O) can
+     * observe the deadline and unwind; one that ignores it is left to drain in the
+     * background while the service is already being restarted.
+     */
     readonly deadlineMs: number;
     /**
      * Delay before the FIRST tick after `start()`, in ms. Every later tick
@@ -52,7 +59,13 @@ export interface PeriodicService extends DaemonService {
      * firing at daemon startup.
      */
     readonly startupDelayMs?: number;
-    tick(ctx: DaemonContext): Promise<void>;
+    /**
+     * Run one tick. `signal` aborts when the supervisor's {@link deadlineMs}
+     * elapses (or the service is being stopped), so a well-behaved tick threads it
+     * into its awaits — `fetch(url, { signal })`, an ssh/exec spawn, a
+     * cancellable sleep — to bound its own I/O instead of leaking a runaway await.
+     */
+    tick(ctx: DaemonContext, signal: AbortSignal): Promise<void>;
 }
 export declare function isPeriodicService(service: DaemonService): service is PeriodicService;
 /**
@@ -93,10 +106,15 @@ export declare abstract class BasePeriodicService implements PeriodicService {
     private healthRecord;
     protected abstract onStart(ctx: DaemonContext): Promise<void>;
     protected abstract onStop(): Promise<void>;
-    protected abstract onTick(ctx: DaemonContext): Promise<void>;
+    /**
+     * Run one tick. `signal` aborts at the supervisor's deadline (or on stop);
+     * thread it into the tick's own awaits to bound its I/O. A subclass that does
+     * no cancellable work may implement `onTick(ctx)` and ignore the second arg.
+     */
+    protected abstract onTick(ctx: DaemonContext, signal: AbortSignal): Promise<void>;
     start(ctx: DaemonContext): Promise<void>;
     stop(): Promise<void>;
     restart(): Promise<void>;
-    tick(ctx: DaemonContext): Promise<void>;
+    tick(ctx: DaemonContext, signal: AbortSignal): Promise<void>;
     health(): ServiceHealth;
 }

package/dist/lib/daemon/service.js

@@ -81,9 +81,9 @@ export class BasePeriodicService {
         await this.stop();
         await this.start(ctx);
     }
-    async tick(ctx) {
+    async tick(ctx, signal) {
         try {
-            await this.onTick(ctx);
+            await this.onTick(ctx, signal);
             this.healthRecord = { ...this.healthRecord, lastRunMs: Date.now(), consecutiveFailures: 0, lastError: undefined };
         }
         catch (err) {

package/dist/lib/daemon/supervisor.d.ts

@@ -12,14 +12,23 @@
  *  - A tick that hangs on an unbounded await (SSH, keychain) used to latch its
  *    local in-flight guard `true` forever, silently freezing that one service
  *    for the daemon's life (observed ~51h). Here, every tick races a
- *    `deadlineMs` timeout; when the deadline wins, that service is parked and
- *    its in-flight guard stays held until the real promise settles. This keeps
- *    a timed-out tick from overlapping another tick or lifecycle transition.
+ *    `deadlineMs` timeout; when the deadline wins, the service is ABANDONED
+ *    (PHNX-3608): its `AbortSignal` is aborted so a cooperating tick can unwind
+ *    its own I/O, the in-flight guard is released immediately, and the backoff
+ *    restart is scheduled right away — it is NOT gated on the runaway promise
+ *    settling. An earlier revision kept the guard held until the real promise
+ *    settled, which meant a tick that never settles parked the service forever
+ *    and blocked backoff restart, `daemon services restart`, and SIGHUP reload —
+ *    the exact 12h-usage-dark class this exists to prevent. The orphaned promise
+ *    is drained separately in the background; `finishTick` is version-guarded so
+ *    its late settlement can never disturb the fresh tick the restart started.
  *
  * Repeated failures (thrown or timed-out) open a circuit breaker: the service
  * is parked (its timer stopped) and retried on exponential backoff via its own
  * `restart()`, while every sibling service keeps ticking on its own timer,
- * unaffected.
+ * unaffected. `start()`/`stop()`/`restart()` are themselves bounded by
+ * {@link ServiceSupervisorOptions.lifecycleDeadlineMs} so a wedged bind or close
+ * cannot stall daemon startup or shutdown.
  */
 import type { DaemonServiceId } from '../daemon-services.js';
 import type { DaemonContext, DaemonService, ServiceHealth } from './service.js';
@@ -30,6 +39,18 @@ export interface ServiceSupervisorOptions {
     backoffBaseMs?: number;
     /** Backoff ceiling. Default 5 minutes. */
     backoffMaxMs?: number;
+    /**
+     * Hard cap on a service's `start()`/`stop()`/`restart()` call (PHNX-3608). A
+     * wedged bind/close would otherwise stall `startAll()` (which awaits each
+     * `startOne` in turn) or `stopAll()` at shutdown. A start/restart that
+     * breaches it is treated as a failure (parked + backoff); a stop that breaches
+     * it is logged and the service is left marked stopped. Default 30s.
+     */
+    lifecycleDeadlineMs?: number;
+}
+export interface RegisterServiceOptions {
+    /** Register the lifecycle owner but leave it stopped until a live enable. */
+    enabled?: boolean;
 }
 export declare class ServiceSupervisor {
     private readonly registry;
@@ -37,7 +58,16 @@ export declare class ServiceSupervisor {
     private readonly parkAfterFailures;
     private readonly backoffBaseMs;
     private readonly backoffMaxMs;
+    private readonly lifecycleDeadlineMs;
     constructor(opts?: ServiceSupervisorOptions);
+    /**
+     * Race `op` against a deadline. On breach the returned promise rejects with a
+     * labelled error while the real `op` is left to settle in the background —
+     * used to bound the lifecycle calls (`start`/`stop`/`restart`) so a wedged one
+     * cannot stall startup or shutdown. `Promise.race` cannot cancel `op`; the
+     * caller decides what a breach means for that service.
+     */
+    private withDeadline;
     /**
      * Register a service. Must be called before `startAll()`.
      *
@@ -46,14 +76,20 @@ export declare class ServiceSupervisor {
      * supervisor uses `isPeriodicService()` to decide whether to schedule a timer
      * for each registered entry.
      */
-    register(service: DaemonService): void;
+    register(service: DaemonService, options?: RegisterServiceOptions): void;
+    /**
+     * Flip a tick's in-flight guard off and release every `awaitIdle()` waiter in
+     * the same synchronous step, so no waiter's continuation can run while
+     * `inFlight` is still true (PHNX-3608).
+     */
+    private clearInFlight;
     /** Start every registered service and begin ticking each on its own timer. */
     startAll(ctx: DaemonContext): Promise<void>;
     /** Stop every registered service and clear all timers. */
     stopAll(): Promise<void>;
     /** Force one service to restart right now, outside its normal backoff schedule. Drives `agents daemon services restart <id>` (RUSH-3193 P4). */
     restartOne(id: DaemonServiceId): Promise<void>;
-    /** Whether `id` is registered on this supervisor. A service disabled at daemon boot is never registered — see {@link start}. */
+    /** Whether `id` has a lifecycle owner on this supervisor, running or stopped. */
     isRegistered(id: DaemonServiceId): boolean;
     /** Every currently registered service id. */
     registeredIds(): DaemonServiceId[];
@@ -66,9 +102,9 @@ export declare class ServiceSupervisor {
     /**
      * Start one registered service live — drives `agents daemon services enable
      * <id>` (RUSH-3193 P4). Only affects a service already registered on this
-     * supervisor: one disabled at daemon boot was never constructed or
-     * registered, so enabling it live is not possible without a daemon restart
-     * (the CLI falls back to that advice — see `commands/daemon.ts`).
+     * supervisor. Callers that need live enable from a boot-disabled state must
+     * register the service with `{ enabled: false }`, which gives the supervisor
+     * ownership without running its startup side effects.
      */
     start(id: DaemonServiceId): Promise<void>;
     /** Stop one registered service live — drives `agents daemon services disable <id>` (RUSH-3193 P4). */
@@ -81,12 +117,16 @@ export declare class ServiceSupervisor {
     private stopOne;
     private scheduleTimer;
     /**
-     * Run one tick under a hard deadline. The deadline is enforced with
-     * `Promise.race`, not true cancellation — JS cannot abort an arbitrary
-     * in-flight await. A timeout parks the service immediately but deliberately
-     * keeps `inFlight` set until the REAL promise settles. Starting another tick
-     * or tearing resources down underneath the abandoned one would trade a
-     * visible parked service for duplicated side effects and lifecycle races.
+     * Run one tick under a hard deadline (PHNX-3608). The tick receives an
+     * `AbortSignal` that is aborted when the deadline elapses, so a cooperating
+     * tick can bound its own I/O and unwind. The deadline itself is still enforced
+     * with `Promise.race` — JS cannot forcibly cancel an arbitrary await — but on
+     * a breach the service is ABANDONED, not parked-and-held: the in-flight guard
+     * is released immediately and the backoff restart is scheduled right away
+     * (via `park()`), so a tick that never settles can no longer wedge backoff,
+     * `daemon services restart`, or SIGHUP reload. The runaway promise drains in
+     * the background; `finishTick` is version-guarded on `activeTick`, so its late
+     * settlement can never disturb the fresh tick a restart has since started.
      */
     private runTick;
     private park;

package/dist/lib/daemon/supervisor.js

@@ -12,30 +12,62 @@
  *  - A tick that hangs on an unbounded await (SSH, keychain) used to latch its
  *    local in-flight guard `true` forever, silently freezing that one service
  *    for the daemon's life (observed ~51h). Here, every tick races a
- *    `deadlineMs` timeout; when the deadline wins, that service is parked and
- *    its in-flight guard stays held until the real promise settles. This keeps
- *    a timed-out tick from overlapping another tick or lifecycle transition.
+ *    `deadlineMs` timeout; when the deadline wins, the service is ABANDONED
+ *    (PHNX-3608): its `AbortSignal` is aborted so a cooperating tick can unwind
+ *    its own I/O, the in-flight guard is released immediately, and the backoff
+ *    restart is scheduled right away — it is NOT gated on the runaway promise
+ *    settling. An earlier revision kept the guard held until the real promise
+ *    settled, which meant a tick that never settles parked the service forever
+ *    and blocked backoff restart, `daemon services restart`, and SIGHUP reload —
+ *    the exact 12h-usage-dark class this exists to prevent. The orphaned promise
+ *    is drained separately in the background; `finishTick` is version-guarded so
+ *    its late settlement can never disturb the fresh tick the restart started.
  *
  * Repeated failures (thrown or timed-out) open a circuit breaker: the service
  * is parked (its timer stopped) and retried on exponential backoff via its own
  * `restart()`, while every sibling service keeps ticking on its own timer,
- * unaffected.
+ * unaffected. `start()`/`stop()`/`restart()` are themselves bounded by
+ * {@link ServiceSupervisorOptions.lifecycleDeadlineMs} so a wedged bind or close
+ * cannot stall daemon startup or shutdown.
  */
 import { recordSubsystemOk, recordSubsystemError, recordSubsystemState } from '../daemon-health.js';
 import { isPeriodicService } from './service.js';
 const DEFAULT_PARK_AFTER_FAILURES = 3;
 const DEFAULT_BACKOFF_BASE_MS = 5_000;
 const DEFAULT_BACKOFF_MAX_MS = 5 * 60_000;
+const DEFAULT_LIFECYCLE_DEADLINE_MS = 30_000;
 export class ServiceSupervisor {
     registry = new Map();
     ctx = null;
     parkAfterFailures;
     backoffBaseMs;
     backoffMaxMs;
+    lifecycleDeadlineMs;
     constructor(opts = {}) {
         this.parkAfterFailures = opts.parkAfterFailures ?? DEFAULT_PARK_AFTER_FAILURES;
         this.backoffBaseMs = opts.backoffBaseMs ?? DEFAULT_BACKOFF_BASE_MS;
         this.backoffMaxMs = opts.backoffMaxMs ?? DEFAULT_BACKOFF_MAX_MS;
+        this.lifecycleDeadlineMs = opts.lifecycleDeadlineMs ?? DEFAULT_LIFECYCLE_DEADLINE_MS;
+    }
+    /**
+     * Race `op` against a deadline. On breach the returned promise rejects with a
+     * labelled error while the real `op` is left to settle in the background —
+     * used to bound the lifecycle calls (`start`/`stop`/`restart`) so a wedged one
+     * cannot stall startup or shutdown. `Promise.race` cannot cancel `op`; the
+     * caller decides what a breach means for that service.
+     */
+    async withDeadline(op, ms, label) {
+        let timer;
+        const deadline = new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new Error(`${label} exceeded deadline of ${ms}ms`)), ms);
+        });
+        try {
+            return await Promise.race([op(), deadline]);
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
     }
     /**
      * Register a service. Must be called before `startAll()`.
@@ -45,24 +77,40 @@ export class ServiceSupervisor {
      * supervisor uses `isPeriodicService()` to decide whether to schedule a timer
      * for each registered entry.
      */
-    register(service) {
+    register(service, options = {}) {
         if (this.registry.has(service.id))
             throw new Error(`service '${service.id}' is already registered`);
         this.registry.set(service.id, {
             service,
-            state: 'idle',
+            state: options.enabled === false ? 'stopped' : 'idle',
             lastRunMs: 0,
             consecutiveFailures: 0,
             restartAttempts: 0,
             inFlight: false,
             everStarted: false,
+            idleWaiters: [],
         });
     }
+    /**
+     * Flip a tick's in-flight guard off and release every `awaitIdle()` waiter in
+     * the same synchronous step, so no waiter's continuation can run while
+     * `inFlight` is still true (PHNX-3608).
+     */
+    clearInFlight(entry) {
+        entry.inFlight = false;
+        const waiters = entry.idleWaiters;
+        entry.idleWaiters = [];
+        for (const resolve of waiters)
+            resolve();
+    }
     /** Start every registered service and begin ticking each on its own timer. */
     async startAll(ctx) {
         this.ctx = ctx;
-        for (const id of this.registry.keys())
+        for (const [id, entry] of this.registry) {
+            if (entry.state === 'stopped')
+                continue;
             await this.startOne(id);
+        }
     }
     /** Stop every registered service and clear all timers. */
     async stopAll() {
@@ -98,7 +146,7 @@ export class ServiceSupervisor {
         recordSubsystemState(id, 'parked');
         await this.attemptRestart(id);
     }
-    /** Whether `id` is registered on this supervisor. A service disabled at daemon boot is never registered — see {@link start}. */
+    /** Whether `id` has a lifecycle owner on this supervisor, running or stopped. */
     isRegistered(id) {
         return this.registry.has(id);
     }
@@ -115,17 +163,23 @@ export class ServiceSupervisor {
         const entry = this.registry.get(id);
         if (!entry)
             throw new Error(`service '${id}' is not registered`);
-        const activeTick = entry.activeTick;
-        if (!activeTick)
+        // Resolve from clearInFlight (which also flips `inFlight` false) rather than
+        // from the tick promise directly: awaiting the tick promise resumed this
+        // caller on a shorter microtask chain than the tick's own finally→finishTick,
+        // so a queued `.then(stop)` could run before `inFlight` was cleared and
+        // `stop()` would throw "cannot stop while a tick is still in flight"
+        // (PHNX-3608 — the SIGHUP live-disable regression). Waiting on the guard
+        // itself makes the ordering deterministic.
+        if (!entry.inFlight)
             return;
-        await activeTick.catch(() => undefined);
+        await new Promise((resolve) => { entry.idleWaiters.push(resolve); });
     }
     /**
      * Start one registered service live — drives `agents daemon services enable
      * <id>` (RUSH-3193 P4). Only affects a service already registered on this
-     * supervisor: one disabled at daemon boot was never constructed or
-     * registered, so enabling it live is not possible without a daemon restart
-     * (the CLI falls back to that advice — see `commands/daemon.ts`).
+     * supervisor. Callers that need live enable from a boot-disabled state must
+     * register the service with `{ enabled: false }`, which gives the supervisor
+     * ownership without running its startup side effects.
      */
     async start(id) {
         const entry = this.registry.get(id);
@@ -172,9 +226,12 @@ export class ServiceSupervisor {
         if (!entry || !ctx)
             return;
         try {
-            await entry.service.start(ctx);
+            await this.withDeadline(() => entry.service.start(ctx), this.lifecycleDeadlineMs, `service '${id}' start`);
         }
         catch (err) {
+            // A thrown OR wedged start() parks the service and retries on backoff,
+            // rather than propagating out of startAll() and stalling the boot of
+            // every service after it (PHNX-3608).
             this.recordFailure(entry, id, err);
             this.park(id);
             return;
@@ -226,15 +283,26 @@ export class ServiceSupervisor {
         }
         entry.state = 'stopped';
         recordSubsystemState(id, 'stopped');
+        // Signal any in-flight tick to unwind — a cooperating tick threads this into
+        // its I/O and returns promptly at shutdown instead of blocking on it.
+        entry.activeController?.abort();
         // Whole-daemon shutdown must not hang forever on an unresolved tick, but it
         // also must not tear down resources the tick may still be using. Stop its
         // timers and mark it stopped; process exit owns final cleanup in this case.
-        if (entry.inFlight && force)
+        if (entry.inFlight && force) {
+            // Release any awaitIdle waiter — the service is stopping, so no one should
+            // keep waiting on a tick that will now be abandoned at process exit.
+            const waiters = entry.idleWaiters;
+            entry.idleWaiters = [];
+            for (const resolve of waiters)
+                resolve();
             return;
+        }
         if (!entry.everStarted)
             return; // start() never succeeded — nothing to stop.
         try {
-            await entry.service.stop();
+            // A wedged stop() must not stall stopAll() at shutdown (PHNX-3608).
+            await this.withDeadline(() => entry.service.stop(), this.lifecycleDeadlineMs, `service '${id}' stop`);
         }
         catch (err) {
             this.ctx?.log('WARN', `service '${id}' stop failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -247,12 +315,16 @@ export class ServiceSupervisor {
         entry.timer = setInterval(() => { void this.runTick(id); }, entry.service.intervalMs);
     }
     /**
-     * Run one tick under a hard deadline. The deadline is enforced with
-     * `Promise.race`, not true cancellation — JS cannot abort an arbitrary
-     * in-flight await. A timeout parks the service immediately but deliberately
-     * keeps `inFlight` set until the REAL promise settles. Starting another tick
-     * or tearing resources down underneath the abandoned one would trade a
-     * visible parked service for duplicated side effects and lifecycle races.
+     * Run one tick under a hard deadline (PHNX-3608). The tick receives an
+     * `AbortSignal` that is aborted when the deadline elapses, so a cooperating
+     * tick can bound its own I/O and unwind. The deadline itself is still enforced
+     * with `Promise.race` — JS cannot forcibly cancel an arbitrary await — but on
+     * a breach the service is ABANDONED, not parked-and-held: the in-flight guard
+     * is released immediately and the backoff restart is scheduled right away
+     * (via `park()`), so a tick that never settles can no longer wedge backoff,
+     * `daemon services restart`, or SIGHUP reload. The runaway promise drains in
+     * the background; `finishTick` is version-guarded on `activeTick`, so its late
+     * settlement can never disturb the fresh tick a restart has since started.
      */
     async runTick(id) {
         const entry = this.registry.get(id);
@@ -265,9 +337,11 @@ export class ServiceSupervisor {
             return;
         const periodicService = entry.service;
         entry.inFlight = true;
+        const controller = new AbortController();
+        entry.activeController = controller;
         let deadlineTimer;
         let timedOut = false;
-        const tickPromise = periodicService.tick(ctx);
+        const tickPromise = periodicService.tick(ctx, controller.signal);
         entry.activeTick = tickPromise;
         try {
             const deadline = new Promise((_, reject) => {
@@ -291,9 +365,22 @@ export class ServiceSupervisor {
             if (deadlineTimer)
                 clearTimeout(deadlineTimer);
             if (timedOut) {
-                // Promise.race cannot cancel arbitrary work. Keep the service parked and
-                // in-flight until the REAL tick settles; only then may backoff restart it.
-                void tickPromise.then(() => this.finishTick(id, tickPromise), () => this.finishTick(id, tickPromise));
+                // Abandon the runaway tick: abort its signal so a cooperating tick can
+                // unwind, then release the in-flight guard NOW so the backoff restart
+                // park() scheduled is not blocked on a promise that may never settle.
+                // The real promise is drained separately and its result discarded — the
+                // version-guarded finishTick keeps that late settlement from touching a
+                // restart's fresh tick.
+                controller.abort();
+                entry.activeTick = undefined;
+                entry.activeController = undefined;
+                this.clearInFlight(entry);
+                // Re-read the entry so its `state` is the full union, not the `'running'`
+                // narrowing from this function's entry-guard — park() set it to 'parked'.
+                const current = this.registry.get(id);
+                if (current && current.state === 'parked' && !current.restartTimer)
+                    this.scheduleRestart(id);
+                void tickPromise.then(() => undefined, () => undefined);
             }
             else {
                 this.finishTick(id, tickPromise);
@@ -328,7 +415,9 @@ export class ServiceSupervisor {
         if (!entry || !ctx || entry.state === 'stopped')
             return;
         try {
-            await entry.service.restart();
+            // A wedged restart() must not silently stall the circuit breaker — bound
+            // it and treat a breach as another failed restart, retried on backoff.
+            await this.withDeadline(() => entry.service.restart(), this.lifecycleDeadlineMs, `service '${id}' restart`);
             entry.everStarted = true; // restart() is stop()+start() on the service — a successful one means it is running again and owes a stop() at shutdown.
             entry.state = 'running';
             recordSubsystemState(id, 'running');
@@ -364,7 +453,8 @@ export class ServiceSupervisor {
         if (!entry || entry.activeTick !== tickPromise)
             return;
         entry.activeTick = undefined;
-        entry.inFlight = false;
+        entry.activeController = undefined;
+        this.clearInFlight(entry);
         if (entry.state === 'parked' && !entry.restartTimer)
             this.scheduleRestart(id);
     }

package/dist/lib/daemon/usage-sync-service.d.ts

@@ -1,12 +1,10 @@
 /**
  * Fleet usage-snapshot sync as a `PeriodicService` (PHNX-3392 usage-sync).
  *
- * On a headed box (personal/desktop) each tick pushes the local identity-keyed
- * Claude usage rows to worker peers that cannot read usage themselves. On a
- * worker whose cache is empty or stale, the same tick pulls those rows from the
- * primary headed device. Both drivers gate on the self role, so this service is
- * safe to register everywhere. Single-executor per destination: each daemon only
- * writes the DESTINATION's own cache, and the merge is newest-wins + idempotent.
+ * A headed box publishes its local identity-keyed Claude usage rows into its
+ * owned file in the fleet-synced user repo. The tick then runs one serialized,
+ * timeout-bounded git exchange; a worker reads the delivered peer snapshots
+ * and merges newest-wins. No tick opens a device-to-device SSH mesh.
  */
 import { BasePeriodicService, type DaemonContext } from './service.js';
 import type { DaemonServiceId } from '../daemon-services.js';

package/dist/lib/daemon/usage-sync-service.js

@@ -1,12 +1,10 @@
 /**
  * Fleet usage-snapshot sync as a `PeriodicService` (PHNX-3392 usage-sync).
  *
- * On a headed box (personal/desktop) each tick pushes the local identity-keyed
- * Claude usage rows to worker peers that cannot read usage themselves. On a
- * worker whose cache is empty or stale, the same tick pulls those rows from the
- * primary headed device. Both drivers gate on the self role, so this service is
- * safe to register everywhere. Single-executor per destination: each daemon only
- * writes the DESTINATION's own cache, and the merge is newest-wins + idempotent.
+ * A headed box publishes its local identity-keyed Claude usage rows into its
+ * owned file in the fleet-synced user repo. The tick then runs one serialized,
+ * timeout-bounded git exchange; a worker reads the delivered peer snapshots
+ * and merges newest-wins. No tick opens a device-to-device SSH mesh.
  */
 import { BasePeriodicService } from './service.js';
 const USAGE_SYNC_TICK_MS = 15 * 60_000;
@@ -24,19 +22,25 @@ export class UsageSyncService extends BasePeriodicService {
         // Nothing to release — the supervisor's timer teardown is the only cleanup.
     }
     async onTick(ctx) {
-        const { pullUsageFromPrimary, syncFleetUsageSnapshots } = await import('../accounting/usage-sync.js');
-        const pushResult = syncFleetUsageSnapshots();
-        if (pushResult.pushed.length > 0) {
-            ctx.log('INFO', `usage-sync: pushed usage to ${pushResult.pushed.join(', ')}`);
+        const { consumeUsageSnapshotsFromSharedStore, publishUsageSnapshotToSharedStore } = await import('../accounting/usage-sync.js');
+        const published = publishUsageSnapshotToSharedStore();
+        if (published.changed)
+            ctx.log('INFO', `usage-sync: published usage snapshot to ${published.path}`);
+        if (published.error)
+            ctx.log('WARN', `usage-sync: publish: ${published.error}`);
+        const { syncFleetSharedStateRepo } = await import('../fleet-shared-repo-sync.js');
+        const transport = await syncFleetSharedStateRepo();
+        if (transport.skipped)
+            ctx.log('WARN', `usage-sync: ${transport.skipped}`);
+        if (transport.error)
+            ctx.log('WARN', `usage-sync: shared-store transport: ${transport.error}`);
+        if (!transport.success)
+            return;
+        const consumed = consumeUsageSnapshotsFromSharedStore();
+        if (consumed.merged > 0) {
+            ctx.log('INFO', `usage-sync: merged ${consumed.merged} row(s) from ${consumed.sources.join(', ')}`);
         }
-        for (const err of pushResult.errors) {
+        for (const err of consumed.errors)
             ctx.log('WARN', `usage-sync: ${err.device}: ${err.message}`);
-        }
-        const pullResult = pullUsageFromPrimary();
-        if (pullResult.pulledFrom) {
-            ctx.log('INFO', `usage-sync: pulled usage from ${pullResult.pulledFrom}; merged ${pullResult.merged} row(s)`);
-        }
-        if (pullResult.error)
-            ctx.log('WARN', `usage-sync: pull: ${pullResult.error}`);
     }
 }