@phnx-labs/agents-cli 1.22.66 → 1.22.69

package/dist/lib/claude-account-token.js

@@ -79,11 +79,100 @@ export function resolveClaudeSetupToken(home) {
     // Require a known account (email) up front: without it we cannot key a
     // per-account token, and we must NOT fall back to a bare shared key that
     // would misapply one account's setup-token to another.
-    const email = readClaudeAccountEmail(home);
+    const email = readClaudeAccountEmail(home)
+        // Self-heal (PHNX-3660): a home provisioned before seed-on-attach carries an
+        // `.oauth_token` but no identity. Recover the email from the bundle and
+        // write it back, so the home converges instead of needing a re-attach.
+        // Explicit-home only: with no home the probe targets the operator's real
+        // ~/.claude.json, which a library read must never rewrite.
+        ?? (home ? discoverClaudeAccountEmailFromOauthToken(home) : null);
     if (!email)
         return null;
     return resolveClaudeSetupTokenForEmail(email, home ?? os.homedir());
 }
+/** Negative/positive discovery cache, keyed by home + .oauth_token fingerprint (SHOULD-2). */
+const discoveryCache = new Map();
+/**
+ * Recover a home's account email from its `.claude/.oauth_token` by matching
+ * the token VALUE against the `auth` bundle (the slug encodes the email, and
+ * the re-encode check makes the decode lossless or fail). On a match the
+ * identity is written back via {@link seedClaudeWorkerHomeIdentity}, so this
+ * runs at most once per home. Returns null — and writes nothing — when the
+ * file is missing, malformed, or matches no bundle key: a token that no longer
+ * exists in the bundle must not resurrect an account mapping. A no-match
+ * result is cached against the token file's fingerprint so a rotated-out home
+ * does not re-decrypt the bundle on every probe.
+ */
+function discoverClaudeAccountEmailFromOauthToken(home) {
+    try {
+        const tokenPath = path.join(home, '.claude', '.oauth_token');
+        const fingerprint = credentialFingerprint(tokenPath);
+        if (fingerprint === 'missing')
+            return null;
+        const cached = discoveryCache.get(home);
+        if (cached && cached.fingerprint === fingerprint)
+            return cached.email;
+        const email = discoverEmailUncached(home, tokenPath);
+        discoveryCache.set(home, { fingerprint, email });
+        return email;
+    }
+    catch (err) {
+        if (err instanceof ReservedBundleWrongBackendError)
+            throw err;
+        return null;
+    }
+}
+function discoverEmailUncached(home, tokenPath) {
+    let token;
+    try {
+        token = fs.readFileSync(tokenPath, 'utf-8').trim();
+    }
+    catch {
+        return null;
+    }
+    if (!isValidClaudeSetupToken(token))
+        return null;
+    if (!bundleExists(AUTH_BUNDLE))
+        return null;
+    if (bundleBackend(AUTH_BUNDLE) !== 'file') {
+        throw new ReservedBundleWrongBackendError(AUTH_BUNDLE, bundleBackend(AUTH_BUNDLE));
+    }
+    const { env } = readAndResolveBundleEnv(AUTH_BUNDLE, { caller: 'usage', agentOnly: true });
+    for (const [key, value] of Object.entries(env)) {
+        if (value.trim() !== token)
+            continue;
+        const email = emailFromTokenKey(key);
+        if (!email)
+            continue;
+        seedClaudeWorkerHomeIdentity(home, email);
+        return email;
+    }
+    return null;
+}
+/**
+ * Decode the email a `CLAUDE_CODE_OAUTH_TOKEN_<slug>` key encodes — or null
+ * when the decode is ambiguous. The mapping collapses every non-alphanumeric
+ * to `_`, so a `_` surviving in the decoded address cannot be told apart from
+ * a folded `.`/`+`/etc. (`FIRST_DOT_LAST_AT_GMAIL_DOT_COM` decodes to
+ * `first_dot_last@gmail.com`, which round-trips — wrongly — under the bare
+ * re-encode check; review BLOCKER 1). Only a fully unambiguous decode — local
+ * and domain pure `[a-z0-9]`, dots in the domain only — is trusted.
+ */
+function emailFromTokenKey(key) {
+    const prefix = 'CLAUDE_CODE_OAUTH_TOKEN_';
+    if (!key.startsWith(prefix))
+        return null;
+    const slug = key.slice(prefix.length);
+    const [local, domain, ...rest] = slug.split('_AT_');
+    if (!local || !domain || rest.length > 0)
+        return null;
+    const email = `${local}@${domain.replace(/_DOT_/g, '.')}`.toLowerCase();
+    if (!/^[a-z0-9]+@[a-z0-9.]+$/.test(email))
+        return null;
+    if (claudeAccountTokenKey(email) !== key)
+        return null;
+    return email;
+}
 /**
  * Resolve a long-lived setup-token for an EXPLICIT account email, independent of
  * any version home's `.claude.json`. This is what lets `agents accounts attach`
@@ -167,14 +256,29 @@ export function seedClaudeWorkerHomeIdentity(versionHome, email) {
         try {
             doc = JSON.parse(fs.readFileSync(p, 'utf-8'));
         }
-        catch {
-            // Missing or unreadable at this location — write a fresh minimal document.
+        catch (err) {
+            // Missing file → write a fresh minimal document. A file that EXISTS but
+            // does not parse is being concurrently rewritten by Claude Code itself —
+            // skip it rather than overwrite a live config with the minimal doc.
+            if (err.code !== 'ENOENT')
+                continue;
         }
         const existing = (doc.oauthAccount && typeof doc.oauthAccount === 'object'
             ? doc.oauthAccount
             : {});
         doc.oauthAccount = { ...existing, emailAddress: trimmed };
         fs.mkdirSync(path.dirname(p), { recursive: true });
-        fs.writeFileSync(p, JSON.stringify(doc));
+        // Temp-write + rename: a reader mid-write never sees a truncated doc.
+        const tmp = `${p}.agents-${process.pid}.tmp`;
+        try {
+            fs.writeFileSync(tmp, JSON.stringify(doc));
+            fs.renameSync(tmp, p);
+        }
+        catch {
+            try {
+                fs.rmSync(tmp, { force: true });
+            }
+            catch { /* best effort */ }
+        }
     }
 }

package/dist/lib/daemon/account-state-daemon-service.d.ts

@@ -1,16 +1,56 @@
 /**
- * Account-state service lifecycle as a `DaemonService` (RUSH-3193 P2).
+ * Account-state services as supervised `PeriodicService`s (PHNX-3608).
  *
- * Wraps `startAccountStateService()` under the `ServiceSupervisor` contract
- * so the supervisor owns start/stop and reports health through the uniform
- * path. The account-state service owns its own internal intervals for usage
- * and auth refreshes; the supervisor just starts and stops it.
+ * The daemon owns usage and authentication health as first-party device state.
+ * This used to run its OWN two `setInterval` loops behind a `usageRunning` /
+ * `authRunning` latch with NO deadline (`account-state-service.ts`, now removed):
+ * a `runUsageRefreshTick` that hung on an unbounded provider await latched
+ * `usageRunning = true` forever, so the usage cache froze for the daemon's whole
+ * life while the service still looked healthy — the "12h usage-dark" root cause.
+ *
+ * Now usage and auth are TWO independent supervised services, each with its own
+ * timer, per-tick deadline, AbortSignal, and — crucially — its own circuit
+ * breaker (`AccountUsageService` = `account-state`, `AccountAuthService` =
+ * `account-auth`). Keeping them separate means a run of usage-refresh failures
+ * parks ONLY usage and never starves the slower auth refresh (they hit different
+ * endpoints), matching the old design's independent loops. Each threads its
+ * deadline AbortSignal into its refresh so the tick unwinds at the deadline
+ * instead of blocking; the provider fetch is itself already bounded
+ * (`AbortSignal.timeout` at the leaf), and the supervisor abandons + restarts a
+ * hung tick regardless.
  */
-import { BaseDaemonService, type DaemonContext } from './service.js';
+import { BasePeriodicService, type DaemonContext } from './service.js';
 import type { DaemonServiceId } from '../daemon-services.js';
-export declare class AccountStateDaemonService extends BaseDaemonService {
+/** Usage cache refresh cadence. */
+export declare const USAGE_STATE_TICK_MS = 60000;
+/** Fleet-auth refresh cadence — deliberately slower (rate-limited endpoint). */
+export declare const AUTH_STATE_TICK_MS: number;
+/**
+ * Refresh the usage cache the `agents run` router reads. Independent circuit
+ * breaker from auth — a persistently-failing usage endpoint parks only this.
+ */
+export declare class AccountUsageService extends BasePeriodicService {
+    readonly id: DaemonServiceId;
+    readonly intervalMs = 60000;
+    readonly deadlineMs: number;
+    private readonly refresh;
+    constructor(refresh?: (signal: AbortSignal) => Promise<void>);
+    protected onStart(): Promise<void>;
+    protected onStop(): Promise<void>;
+    protected onTick(_ctx: DaemonContext, signal: AbortSignal): Promise<void>;
+}
+/**
+ * Publish this host's fleet-status row and refresh auth health. Independent
+ * circuit breaker from usage, and on a slower cadence (the auth verdict rides a
+ * rate-limited endpoint).
+ */
+export declare class AccountAuthService extends BasePeriodicService {
     readonly id: DaemonServiceId;
-    private service;
-    protected onStart(ctx: DaemonContext): Promise<void>;
+    readonly intervalMs: number;
+    readonly deadlineMs: number;
+    private readonly refresh;
+    constructor(refresh?: (signal: AbortSignal) => Promise<void>);
+    protected onStart(): Promise<void>;
     protected onStop(): Promise<void>;
+    protected onTick(_ctx: DaemonContext, signal: AbortSignal): Promise<void>;
 }

package/dist/lib/daemon/account-state-daemon-service.js

@@ -1,26 +1,89 @@
 /**
- * Account-state service lifecycle as a `DaemonService` (RUSH-3193 P2).
+ * Account-state services as supervised `PeriodicService`s (PHNX-3608).
  *
- * Wraps `startAccountStateService()` under the `ServiceSupervisor` contract
- * so the supervisor owns start/stop and reports health through the uniform
- * path. The account-state service owns its own internal intervals for usage
- * and auth refreshes; the supervisor just starts and stops it.
+ * The daemon owns usage and authentication health as first-party device state.
+ * This used to run its OWN two `setInterval` loops behind a `usageRunning` /
+ * `authRunning` latch with NO deadline (`account-state-service.ts`, now removed):
+ * a `runUsageRefreshTick` that hung on an unbounded provider await latched
+ * `usageRunning = true` forever, so the usage cache froze for the daemon's whole
+ * life while the service still looked healthy — the "12h usage-dark" root cause.
+ *
+ * Now usage and auth are TWO independent supervised services, each with its own
+ * timer, per-tick deadline, AbortSignal, and — crucially — its own circuit
+ * breaker (`AccountUsageService` = `account-state`, `AccountAuthService` =
+ * `account-auth`). Keeping them separate means a run of usage-refresh failures
+ * parks ONLY usage and never starves the slower auth refresh (they hit different
+ * endpoints), matching the old design's independent loops. Each threads its
+ * deadline AbortSignal into its refresh so the tick unwinds at the deadline
+ * instead of blocking; the provider fetch is itself already bounded
+ * (`AbortSignal.timeout` at the leaf), and the supervisor abandons + restarts a
+ * hung tick regardless.
  */
-import { BaseDaemonService } from './service.js';
-import { startAccountStateService } from '../account-state-service.js';
+import { BasePeriodicService } from './service.js';
 import { runUsageRefreshTick, runFleetCacheWarmTick } from '../daemon-ticks.js';
-export class AccountStateDaemonService extends BaseDaemonService {
+/** Usage cache refresh cadence. */
+export const USAGE_STATE_TICK_MS = 60_000;
+/** Fleet-auth refresh cadence — deliberately slower (rate-limited endpoint). */
+export const AUTH_STATE_TICK_MS = 3 * 60_000;
+/** A hung refresh is abandoned at this deadline; a real sweep is far under it. */
+const REFRESH_DEADLINE_MS = 2 * 60_000;
+/**
+ * A promise that rejects when `signal` aborts (immediately if already aborted),
+ * so a tick can `Promise.race` its work against the supervisor's deadline and
+ * unwind instead of blocking on an await that may never settle. The signal is
+ * per-tick, so the once-listener is dropped with it — no cross-tick leak.
+ */
+function abortRejection(signal, label) {
+    return new Promise((_, reject) => {
+        if (signal.aborted) {
+            reject(new Error(label));
+            return;
+        }
+        signal.addEventListener('abort', () => reject(new Error(label)), { once: true });
+    });
+}
+/**
+ * Refresh the usage cache the `agents run` router reads. Independent circuit
+ * breaker from auth — a persistently-failing usage endpoint parks only this.
+ */
+export class AccountUsageService extends BasePeriodicService {
     id = 'account-state';
-    service = null;
-    async onStart(ctx) {
-        this.service = startAccountStateService({
-            refreshUsage: runUsageRefreshTick,
-            refreshAuth: runFleetCacheWarmTick,
-            onError: (area, error) => ctx.log('WARN', `${area} state refresh failed: ${error.message}`),
-        });
+    intervalMs = USAGE_STATE_TICK_MS;
+    deadlineMs = REFRESH_DEADLINE_MS;
+    refresh;
+    constructor(refresh = runUsageRefreshTick) {
+        super();
+        this.refresh = refresh;
+    }
+    async onStart() { }
+    async onStop() { }
+    async onTick(_ctx, signal) {
+        await Promise.race([
+            this.refresh(signal),
+            abortRejection(signal, 'usage refresh aborted at deadline'),
+        ]);
+    }
+}
+/**
+ * Publish this host's fleet-status row and refresh auth health. Independent
+ * circuit breaker from usage, and on a slower cadence (the auth verdict rides a
+ * rate-limited endpoint).
+ */
+export class AccountAuthService extends BasePeriodicService {
+    id = 'account-auth';
+    intervalMs = AUTH_STATE_TICK_MS;
+    deadlineMs = REFRESH_DEADLINE_MS;
+    refresh;
+    constructor(refresh = runFleetCacheWarmTick) {
+        super();
+        this.refresh = refresh;
     }
-    async onStop() {
-        this.service?.stop();
-        this.service = null;
+    async onStart() { }
+    async onStop() { }
+    async onTick(_ctx, signal) {
+        await Promise.race([
+            this.refresh(signal),
+            abortRejection(signal, 'auth refresh aborted at deadline'),
+        ]);
     }
 }

package/dist/lib/daemon/auth-sync-service.d.ts

@@ -1,10 +1,10 @@
 /**
  * Reserved `auth` bundle fleet sync as a `PeriodicService` (PHNX-2371).
  *
- * Each daemon that has a local file-backed `auth` bundle pushes it to pinned
- * fleet devices that do not yet have it. The destination auto-provisions its
- * own machine-local key; no passphrase is forwarded. Single-executor per
- * destination: this process only writes the remote's own store.
+ * Each daemon publishes a safe readiness verdict to the fleet-shared user repo,
+ * then runs the same serialized, timeout-bounded git exchange as usage sync.
+ * One deterministic ready device asynchronously provisions peers whose delivered
+ * verdict says `missing`; the secret never enters Git.
  */
 import { BasePeriodicService, type DaemonContext } from './service.js';
 import type { DaemonServiceId } from '../daemon-services.js';

package/dist/lib/daemon/auth-sync-service.js

@@ -1,10 +1,10 @@
 /**
  * Reserved `auth` bundle fleet sync as a `PeriodicService` (PHNX-2371).
  *
- * Each daemon that has a local file-backed `auth` bundle pushes it to pinned
- * fleet devices that do not yet have it. The destination auto-provisions its
- * own machine-local key; no passphrase is forwarded. Single-executor per
- * destination: this process only writes the remote's own store.
+ * Each daemon publishes a safe readiness verdict to the fleet-shared user repo,
+ * then runs the same serialized, timeout-bounded git exchange as usage sync.
+ * One deterministic ready device asynchronously provisions peers whose delivered
+ * verdict says `missing`; the secret never enters Git.
  */
 import { BasePeriodicService } from './service.js';
 const AUTH_SYNC_TICK_MS = 15 * 60_000;
@@ -22,8 +22,19 @@ export class AuthSyncService extends BasePeriodicService {
         // Nothing to release — the supervisor's timer teardown is the only cleanup.
     }
     async onTick(ctx) {
-        const { syncReservedAuthBundle } = await import('../secrets/reserved-sync.js');
-        const result = syncReservedAuthBundle();
+        const { publishReservedAuthVerdict, syncReservedAuthBundle } = await import('../secrets/reserved-sync.js');
+        const published = publishReservedAuthVerdict();
+        if (published.error)
+            ctx.log('WARN', `auth-sync: verdict: ${published.error}`);
+        const { syncFleetSharedStateRepo } = await import('../fleet-shared-repo-sync.js');
+        const transport = await syncFleetSharedStateRepo();
+        if (transport.skipped)
+            ctx.log('WARN', `auth-sync: ${transport.skipped}`);
+        if (transport.error)
+            ctx.log('WARN', `auth-sync: shared-store transport: ${transport.error}`);
+        if (!transport.success)
+            return;
+        const result = await syncReservedAuthBundle();
         if (result.pushed.length > 0) {
             ctx.log('INFO', `auth-sync: pushed auth to ${result.pushed.join(', ')}`);
         }

package/dist/lib/daemon/catchup-service.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Catch-up recovery as a supervised `PeriodicService` (PHNX-3608).
+ *
+ * A catch-up pass detects routines whose scheduled fire this device missed (the
+ * laptop slept, the daemon was wedged, an OS suspend the process survived) and
+ * runs them late. It used to run on a bare `setInterval` booted/stopped inside
+ * `runDaemon()` alongside the scheduler, with only a local `catchingUp` overlap
+ * flag and NO deadline — a pass that hung on an off-box (host/cloud) dispatch
+ * could latch that flag and silently stop recovering missed fires for the
+ * daemon's life, the same "abstraction too weak" class the supervisor exists for.
+ *
+ * Under the supervisor it gets a per-tick deadline, an AbortSignal, and the
+ * circuit breaker: a hung pass is abandoned and restarted on backoff instead of
+ * latching. The scheduler itself (croner-driven `JobScheduler`) stays outside the
+ * supervisor — it is not a tick loop — so this service self-gates on whether the
+ * scheduler is currently booted and no-ops cheaply when the scheduler gate is off.
+ */
+import { BasePeriodicService, type DaemonContext } from './service.js';
+import type { DaemonServiceId } from '../daemon-services.js';
+/**
+ * How often to re-run catch-up. A startup pass alone misses a fire lost while the
+ * daemon stayed up but its event loop was wedged, or one lost across an OS
+ * suspend the process survived — five minutes bounds the cost while still
+ * recovering from a wedge or an OS suspend the process survived.
+ */
+export declare const CATCHUP_TICK_MS: number;
+export interface CatchupServiceDeps {
+    /**
+     * Whether the routine scheduler is currently booted. When false (the
+     * `scheduler.enabled` gate is off), the pass no-ops — there is nothing to
+     * catch up on a device where no routines fire.
+     */
+    isSchedulerBooted: () => boolean;
+    /** Run one catch-up pass. Receives the tick's AbortSignal so it can bound its dispatches. */
+    runPass: (signal: AbortSignal) => Promise<void>;
+}
+export declare class CatchupService extends BasePeriodicService {
+    private readonly deps;
+    readonly id: DaemonServiceId;
+    readonly intervalMs: number;
+    /**
+     * A pass awaits `executeJobDetached` per overdue job and an off-box dispatch
+     * can block for a while, so the bound is generous — but finite, which the old
+     * un-deadlined loop was not. A pass exceeding it is hung, not slow.
+     */
+    readonly deadlineMs: number;
+    constructor(deps: CatchupServiceDeps);
+    protected onStart(): Promise<void>;
+    protected onStop(): Promise<void>;
+    protected onTick(_ctx: DaemonContext, signal: AbortSignal): Promise<void>;
+}

package/dist/lib/daemon/catchup-service.js

@@ -0,0 +1,51 @@
+/**
+ * Catch-up recovery as a supervised `PeriodicService` (PHNX-3608).
+ *
+ * A catch-up pass detects routines whose scheduled fire this device missed (the
+ * laptop slept, the daemon was wedged, an OS suspend the process survived) and
+ * runs them late. It used to run on a bare `setInterval` booted/stopped inside
+ * `runDaemon()` alongside the scheduler, with only a local `catchingUp` overlap
+ * flag and NO deadline — a pass that hung on an off-box (host/cloud) dispatch
+ * could latch that flag and silently stop recovering missed fires for the
+ * daemon's life, the same "abstraction too weak" class the supervisor exists for.
+ *
+ * Under the supervisor it gets a per-tick deadline, an AbortSignal, and the
+ * circuit breaker: a hung pass is abandoned and restarted on backoff instead of
+ * latching. The scheduler itself (croner-driven `JobScheduler`) stays outside the
+ * supervisor — it is not a tick loop — so this service self-gates on whether the
+ * scheduler is currently booted and no-ops cheaply when the scheduler gate is off.
+ */
+import { BasePeriodicService } from './service.js';
+/**
+ * How often to re-run catch-up. A startup pass alone misses a fire lost while the
+ * daemon stayed up but its event loop was wedged, or one lost across an OS
+ * suspend the process survived — five minutes bounds the cost while still
+ * recovering from a wedge or an OS suspend the process survived.
+ */
+export const CATCHUP_TICK_MS = 5 * 60_000;
+export class CatchupService extends BasePeriodicService {
+    deps;
+    id = 'catchup';
+    intervalMs = CATCHUP_TICK_MS;
+    /**
+     * A pass awaits `executeJobDetached` per overdue job and an off-box dispatch
+     * can block for a while, so the bound is generous — but finite, which the old
+     * un-deadlined loop was not. A pass exceeding it is hung, not slow.
+     */
+    deadlineMs = 4 * 60_000;
+    constructor(deps) {
+        super();
+        this.deps = deps;
+    }
+    async onStart() {
+        // No owned resources — the supervisor owns the timer.
+    }
+    async onStop() {
+        // No owned resources.
+    }
+    async onTick(_ctx, signal) {
+        if (!this.deps.isSchedulerBooted())
+            return;
+        await this.deps.runPass(signal);
+    }
+}

package/dist/lib/daemon/daemon.d.ts

@@ -120,8 +120,11 @@ export declare function removeHeartbeat(): void;
 export declare function isDaemonWedged(): boolean;
 /**
  * Check whether a daemon is alive — via the pid file, or a fresh heartbeat when
- * the pid file has been lost (see resolveLiveDaemonPid). Heals the pid file as a
- * side effect so a subsequent read is consistent.
+ * the pid file has been lost (see resolveLiveDaemonPid). The observation itself
+ * is read-only; when it finds desync it opportunistically acquires daemon.lock
+ * and repeats the observation there before repairing. A contended probe still
+ * returns the observed liveness without mutating another lifecycle operation's
+ * state.
  */
 export declare function isDaemonRunning(): boolean;
 /**
@@ -137,9 +140,9 @@ export declare function isDaemonRunning(): boolean;
  * pid file, this does NOT defer to it — it evicts the incumbent and becomes the
  * survivor, so a second install can never leave two daemons running. Returns true
  * and records our PID once the incumbent is provably dead (its resources
- * released). Returns false ONLY when another `__daemon-run` currently holds the
- * O_EXCL start lock — i.e. a concurrent claimer is mid-takeover and will be the
- * singleton — in which case the caller must exit without touching further state.
+ * released). Returns false when another `__daemon-run` currently holds the
+ * O_EXCL start lock, or when the incumbent cannot be safely identified/evicted,
+ * in which case the caller must exit without touching further state.
  * The read-evict-write is serialized behind the same start lock startDaemon()
  * uses, so two `_run` processes can't both claim in the window between the
  * liveness check and the write.
@@ -177,8 +180,11 @@ export declare function reapStrayDaemons(keepPid?: number): {
     reaped: number;
     details: string[];
 };
+export declare function isLiveDaemon(pid: number): boolean;
 /** Append a JSONL log entry to the daemon log file (owner-only permissions). */
 export declare function log(level: string, message: string): void;
+/** Keep synchronous signal-handler failures inside the daemon's crash barrier. */
+export declare function guardSignalHandler(handler: () => void, onError: (err: unknown) => void): () => void;
 /** Main daemon loop: load jobs, schedule crons, monitor runs, and handle signals. */
 /**
  * Anchor the daemon's working directory to a stable, always-present path.
@@ -390,7 +396,7 @@ export declare function startDetached(opts?: StartDetachedOptions): {
 export interface StopResidueArtifact {
     label: string;
     present: boolean;
-    /** The file names a pid that is alive and is NOT the daemon we stopped. */
+    /** The file names a live owner, including a stopped target that survived. */
     ownedByLiveOther: boolean;
     reclaim: () => void;
     stillPresent: () => boolean;
@@ -424,22 +430,6 @@ export interface DaemonStopResult {
     surviving: string[];
     detachedChildren: number[];
 }
-/**
- * Live `__daemon-run` processes still registered in THIS state dir's instance
- * registry, excluding `exclude`. State-dir-scoped by construction: the registry
- * lives inside this state dir, so a daemon serving a DIFFERENT state dir (a test
- * fixture with its own HOME, a separate install/home) registers elsewhere and is
- * invisible here — it is never a stop/takeover target. POSIX-only (the registry
- * and its `ps` liveness probe are); `[]` on Windows.
- *
- * Exported for `agents daemon status`/`doctor`/`services` (RUSH-2368): those
- * commands previously flagged every `__daemon-run` on the box (a raw `ps` scan)
- * as a "duplicate" of this daemon, which misreported test fixtures under their
- * own HOME — and therefore their own state dir and registry — as strays to
- * kill. This registry read is the same scope the reaper (`reapStrayDaemons`)
- * and the stop postcondition (`stopDaemon`) already use, so the display and the
- * reaper agree on what a duplicate is.
- */
 export declare function findSurvivingStateDirDaemons(exclude: Set<number>): number[];
 /**
  * Stop the daemon and ASSERT its postcondition (SING-12, RUSH-2355), unloading it