@phnx-labs/agents-cli 1.22.69 → 1.22.71

package/dist/lib/cloud/rush.js

@@ -10,6 +10,7 @@ import * as os from 'os';
 import * as crypto from 'crypto';
 import * as yaml from 'yaml';
 import { resolveDispatchRepos, normalizeProviderStatus, MAX_IMAGES_PER_DISPATCH } from './types.js';
+import { isRushSessionExpired } from '../rush-session.js';
 import { parseSSE } from './stream.js';
 import { listInstalledVersions, getVersionHomePath } from '../installations/versions.js';
 import { getAccountInfo } from '../agents.js';
@@ -19,8 +20,9 @@ const USER_YAML = path.join(os.homedir(), '.rush', 'user.yaml');
 /**
  * Returns true when ~/.rush/user.yaml exists, carries an access_token, and
  * the token has not passed its expires_at timestamp (Unix seconds). A missing
- * expires_at is treated as non-expired so tokens written without an expiry
- * still work. Pass yamlPath to override the default path in tests.
+ * expires_at, or `expires_at: 0` (a non-expiring Phoenix `pid_` bearer), is
+ * treated as non-expired (see isRushSessionExpired, PHNX-3645). Pass yamlPath
+ * to override the default path in tests.
  */
 export function isRushSessionValid(yamlPath = USER_YAML) {
     try {
@@ -30,8 +32,7 @@ export function isRushSessionValid(yamlPath = USER_YAML) {
         const data = yaml.parse(raw);
         if (!data?.session?.access_token)
             return false;
-        const expiresAt = data.session.expires_at;
-        if (typeof expiresAt === 'number' && expiresAt <= Date.now() / 1000)
+        if (isRushSessionExpired(data.session.expires_at))
             return false;
         return true;
     }
@@ -39,19 +40,24 @@ export function isRushSessionValid(yamlPath = USER_YAML) {
         return false;
     }
 }
-/** Read the Rush session access token from ~/.rush/user.yaml. */
-function readToken() {
-    if (!fs.existsSync(USER_YAML)) {
+/**
+ * Read the Rush session access token from ~/.rush/user.yaml. Exported (with an
+ * overridable yamlPath, like isRushSessionValid) so the freshness behavior —
+ * including the `expires_at: 0` non-expiring case (PHNX-3645) — is directly
+ * testable; the class methods call it with the default path.
+ */
+export function readToken(yamlPath = USER_YAML) {
+    if (!fs.existsSync(yamlPath)) {
         throw new Error('Not logged in to Rush. Run `rush login` first.');
     }
-    const raw = fs.readFileSync(USER_YAML, 'utf-8');
+    const raw = fs.readFileSync(yamlPath, 'utf-8');
     const data = yaml.parse(raw);
     const token = data?.session?.access_token;
     if (!token) {
         throw new Error('No session token in ~/.rush/user.yaml. Run `rush login` first.');
     }
     const expiresAt = data.session?.expires_at;
-    if (typeof expiresAt === 'number' && expiresAt <= Date.now() / 1000) {
+    if (isRushSessionExpired(expiresAt)) {
         const expiredAt = new Date(expiresAt * 1000).toISOString();
         throw new Error(`Rush session expired at ${expiredAt}. Run \`rush login\` to refresh.`);
     }

package/dist/lib/daemon/auth-sync-service.js

@@ -23,7 +23,7 @@ export class AuthSyncService extends BasePeriodicService {
     }
     async onTick(ctx) {
         const { publishReservedAuthVerdict, syncReservedAuthBundle } = await import('../secrets/reserved-sync.js');
-        const published = publishReservedAuthVerdict();
+        const published = await publishReservedAuthVerdict();
         if (published.error)
             ctx.log('WARN', `auth-sync: verdict: ${published.error}`);
         const { syncFleetSharedStateRepo } = await import('../fleet-shared-repo-sync.js');

package/dist/lib/daemon/browser-task-reap-service.js

@@ -15,7 +15,7 @@ export class BrowserTaskReapService extends BasePeriodicService {
     async onStart(_ctx) { }
     async onStop() { }
     async onTick(ctx) {
-        const result = await this.browserService.reapAbandoned({ idleMs: resolveBrowserTaskIdleMs() });
+        const result = await this.browserService.reapAbandoned({ idleMs: await resolveBrowserTaskIdleMs() });
         if (result.closed.length > 0) {
             ctx.log('INFO', `Browser-task reaper: closed ${result.closed.length} task(s)`);
             for (const closed of result.closed) {

package/dist/lib/daemon/daemon.js

@@ -40,6 +40,7 @@ import { BrowserIPCService } from './browser-ipc-service.js';
 import { WatchdogService } from './watchdog-service.js';
 import { DeviceProbeService } from './device-probe-service.js';
 import { SelfHealService } from './self-heal-service.js';
+import { SelfUpdateService } from './self-update-service.js';
 import { KeychainReapService } from './keychain-reap-service.js';
 import { AuthSyncService } from './auth-sync-service.js';
 import { UsageSyncService } from './usage-sync-service.js';
@@ -49,7 +50,7 @@ import { WebhookReceiverService } from './webhook-receiver-service.js';
 import { HeartbeatService } from './heartbeat-service.js';
 import { TmuxReapService } from './tmux-reap-service.js';
 import { BrowserTaskReapService } from './browser-task-reap-service.js';
-import { emit, emitRoutineEnd } from '../feed/events.js';
+import { emit, emitAsync, emitRoutineEnd } from '../feed/events.js';
 import { readDaemonServicesConfig, drainDaemonServiceRestartQueue } from '../daemon-services.js';
 import { sleepSync } from '../fs-atomic.js';
 /**
@@ -749,11 +750,16 @@ export function log(level, message) {
             : lvl === 'START' || /starting|started/i.test(message) ? 'daemon.start'
                 : lvl === 'STOP' || /stopping|stopped|shutting down/i.test(message) ? 'daemon.stop'
                     : 'daemon.info';
-        emit(event, {
+        // Fire-and-forget the event mirror: `log()` is a synchronous primitive on
+        // every daemon tick's `ctx.log`, and the mirror's event-log lock would
+        // otherwise block the shared event loop for up to 30s under contention
+        // (PHNX-3695). The daemon-log append above is the primary, synchronous sink;
+        // the mirror is best-effort, so a fire-and-forget async write is correct.
+        void emitAsync(event, {
             module: 'daemon',
             detail: redactSecrets(message).slice(0, 500),
             status: lvl,
-        });
+        }).catch(() => { });
     }
     catch { /* never crash the daemon on event-log failure */ }
 }
@@ -1073,6 +1079,10 @@ export async function runDaemon() {
         supervisor.register(new SelfHealService());
     else
         log('INFO', 'Self-heal service disabled');
+    if (isEnabled('self-update'))
+        supervisor.register(new SelfUpdateService());
+    else
+        log('INFO', 'Self-update service disabled');
     if (isEnabled('keychain-reap'))
         supervisor.register(new KeychainReapService());
     else
@@ -2249,7 +2259,15 @@ function stopDaemonLocked() {
     // any service-manager teardown or direct signal and repairs only under lock.
     const pid = resolveLiveDaemonPid(true);
     const browserSock = process.platform === 'win32' ? null : getBrowserIpcSocketPath();
-    const browserSockOwner = pid !== null && browserSock ? readPathIdentity(browserSock) : null;
+    // Capture the socket's inode INDEPENDENTLY of whether a live pid resolved
+    // (PHNX-3618). A daemon that died between the CLI liveness precheck and this
+    // locked read leaves resolveLiveDaemonPid() returning null while its ungraceful
+    // exit left the binding on disk — capturing only when `pid !== null` meant that
+    // genuinely stale socket could never be reclaimed and was reported "ownership
+    // could not be verified". The inode is the successor guard: a fresh daemon that
+    // rebinds during the stop gets a new inode, so a later identity match still
+    // proves this exact binding is the one we captured, never a successor's.
+    const browserSockOwner = browserSock ? readPathIdentity(browserSock) : null;
     if (platform === 'darwin') {
         const plistPath = getLaunchdPlistPath();
         if (fs.existsSync(plistPath)) {
@@ -2380,8 +2398,19 @@ function stopDaemonLocked() {
     // ungracefully (killTree) and left a stale binding — the owner is provably
     // dead, so reclaim it and report.
     if (process.platform !== 'win32') {
+        // A binding is provably stale — and reclaimable — when the inode on disk is
+        // still the exact one captured under this lock AND no daemon (the signalled
+        // target OR any successor for this state dir) survives to own it. Keying the
+        // "a daemon still owns it" test on the whole survivor set rather than only the
+        // captured target is what lets a daemon that died BEFORE this stop (pid ===
+        // null, PHNX-3618) still have its stale socket reclaimed, while a live
+        // successor — which either rebound the inode or shows up as a survivor — is
+        // never touched (PHNX-3607's never-delete-a-successor invariant).
+        const aDaemonSurvives = survivors.length > 0 || unverifiedSurvivors.length > 0;
         if (browserSock && fs.existsSync(browserSock)) {
-            if (browserSockOwner && pathIdentityMatches(browserSock, browserSockOwner) && !targetStillOwnsResources) {
+            const ownsCapturedBinding = browserSockOwner !== null
+                && pathIdentityMatches(browserSock, browserSockOwner);
+            if (ownsCapturedBinding && !aDaemonSurvives) {
                 try {
                     fs.unlinkSync(browserSock);
                 }
@@ -2393,13 +2422,14 @@ function stopDaemonLocked() {
                 else
                     released.push('browser IPC socket (reclaimed)');
             }
+            else if (aDaemonSurvives) {
+                surviving.push('browser IPC socket still owned by a surviving daemon');
+            }
             else {
-                // The path was absent when the target was captured, there was no proven
-                // daemon target, or a successor replaced the inode. In every case this
-                // invocation does not own the current binding and must leave it alone.
-                surviving.push(targetStillOwnsResources
-                    ? 'browser IPC socket still owned by a surviving daemon'
-                    : 'browser IPC socket ownership could not be verified');
+                // The path was absent when this transaction captured the target (a
+                // successor bound it afterward) or a successor replaced the inode. Either
+                // way this invocation does not own the current binding and must leave it.
+                surviving.push('browser IPC socket ownership could not be verified');
             }
         }
         else {

package/dist/lib/daemon/heartbeat-service.js

@@ -1,5 +1,5 @@
 /** Daemon heartbeat and routine-process reconciliation under supervision. */
-import { monitorRunningJobs } from './runner.js';
+import { reapExitedRunningJobs } from './runner.js';
 import { reapTerminalRoutineProcesses } from '../routine-process-cleanup.js';
 import { BasePeriodicService } from './service.js';
 const HEARTBEAT_TICK_MS = 60_000;
@@ -17,8 +17,8 @@ export class HeartbeatService extends BasePeriodicService {
     async onStop() { }
     async onTick(ctx) {
         this.publishHeartbeat();
-        monitorRunningJobs();
-        const reaped = reapTerminalRoutineProcesses();
+        await reapExitedRunningJobs();
+        const reaped = await reapTerminalRoutineProcesses();
         if (reaped.length > 0) {
             ctx.log('WARN', `Reaped ${reaped.length} terminal routine process group(s): ${reaped.join(', ')}`);
         }

package/dist/lib/daemon/keychain-reap-service.js

@@ -22,7 +22,7 @@ export class KeychainReapService extends BasePeriodicService {
     }
     async onTick(ctx) {
         const { reapOrphanedKeychainProcesses } = await import('../secrets/reaper.js');
-        const result = reapOrphanedKeychainProcesses();
+        const result = await reapOrphanedKeychainProcesses();
         if (result.reaped > 0) {
             ctx.log('WARN', `Reaped ${result.reaped} keychain orphan/stuck process(es)`);
             for (const d of result.details)

package/dist/lib/daemon/runner.d.ts

@@ -251,6 +251,23 @@ export declare function listLiveRoutineChildren(): number[];
  *   remote `.exit` is reconciled (`finalizeHostRun`).
  */
 export declare function isRunGenuinelyInFlight(meta: RunMeta): boolean;
-/** Scan all runs marked "running" and finalize any whose process has exited. */
+/**
+ * Scan all runs marked "running" and finalize any whose process has exited.
+ *
+ * SYNCHRONOUS — for OFF-loop callers only (the `agents routines list/status`
+ * builders and CLI best-effort orphan reaps), which run in short-lived CLI
+ * processes where a bounded synchronous `ps`/scan cannot starve a served event
+ * loop. The daemon's own heartbeat tick MUST use {@link reapExitedRunningJobs}
+ * instead — a sync scan there would freeze the shared event loop (PHNX-3695).
+ */
 export declare function monitorRunningJobs(): void;
+/**
+ * Async, non-blocking twin of {@link monitorRunningJobs} for the daemon's
+ * heartbeat tick (PHNX-3695). Identical reconciliation via
+ * {@link reconcileRunningRecord}, but the directory walk uses `fs/promises` and
+ * the pid-identity probe uses the deadline-bounded {@link isPidOursAsync}, so
+ * the every-tick scan never freezes the shared event loop — the freeze that
+ * left the browser IPC `version` probe unanswered.
+ */
+export declare function reapExitedRunningJobs(): Promise<void>;
 export {};

package/dist/lib/daemon/runner.js

@@ -15,6 +15,7 @@
  */
 import { spawn, execFileSync } from 'child_process';
 import * as fs from 'fs';
+import * as fsp from 'fs/promises';
 import * as path from 'path';
 import * as os from 'os';
 import { getCliLaunch, getAgentsBinDir } from '../cli-entry.js';
@@ -23,14 +24,15 @@ import { getRunsDir, getUserAgentsDir, readMeta, getDaemonDir } from '../state.j
 import { shortCodexHome } from '../codex-home.js';
 import { prepareJobHome, buildSpawnEnv, getJobHomePath, assertSandboxForwardsHostGhAuth, linkVersionAuth } from '../sandbox.js';
 import { resolveModel, buildReasoningFlags } from '../models.js';
-import { createTimer, redactPrompt, emitRoutineEnd } from '../feed/events.js';
+import { createTimer, redactPrompt, emitRoutineEnd, emitRoutineEndAsync } from '../feed/events.js';
 import { resolveHarnessAdapter } from '../harness/index.js';
 import { applyAddDirs } from '../add-dir.js';
 import { normalizeMode, resolveHeadlessMode, buildExecEnv, detectRateLimit, detectAuthFailure, isAuthFailureFromLog, authFailureReason, AGENT_COMMANDS, } from '../exec.js';
 import { resolveActor } from '../actor.js';
 import { loadTask as loadHostTask } from '../hosts/tasks.js';
-import { reconcileTask as reconcileHostTask } from '../hosts/reconcile.js';
-import { backgroundSpawnOptions, killTree } from '../platform/process.js';
+import { reconcileTask as reconcileHostTask, reconcileTaskAsync as reconcileHostTaskAsync } from '../hosts/reconcile.js';
+import { backgroundSpawnOptions, isAlive, killTree } from '../platform/process.js';
+import { execFileBounded } from '../exec-bounded.js';
 import lockfile from 'proper-lockfile';
 import { ensureLockTarget } from '../fs-atomic.js';
 import { logAndContinueOnLockCompromised } from '../lock-compromise.js';
@@ -922,8 +924,12 @@ export async function resolveRoutineLaunch(config, cwd = process.cwd(), deps = {
     if (config.account && !explicitCredential) {
         // A native routine account is named by its durable name; the version matcher
         // keys on the identity (email/accountKey), so translate before resolving,
-        // and refuse a login that belongs to a different harness.
-        const unified = findUnifiedAccount(config.account, meta);
+        // and refuse a login that belongs to a different harness. Scope the lookup to
+        // the routine's own harness: `identityLabel` defaults to the login's email, so
+        // `account: <email>` matches every harness that identity is signed into, and
+        // un-scoped this resolved whichever row the store ordered first — then rejected
+        // it on the very next line.
+        const unified = findUnifiedAccount(config.account, meta, undefined, agent);
         if (unified?.kind === 'native' && unified.agent !== agent) {
             throw new Error(`Routine '${config.name}' account '${config.account}' is a ${unified.agent} login and cannot authenticate ${agent}.`);
         }
@@ -2224,6 +2230,40 @@ const MAX_WALL_CLOCK_MS = 24 * 60 * 60 * 1000;
  * compares against the process's actual start time via `ps`. Returns true
  * when the PID is alive AND plausibly ours.
  */
+/** Bound the identity `ps` — a hung `ps` must never freeze its caller for long (matches routine-process-cleanup's probe). */
+const PS_IDENTITY_TIMEOUT_MS = 5_000;
+/**
+ * Pure: does a `ps -o etime=` value place the process's birth within 30s of when
+ * we recorded spawning it? An empty/unknown reading conservatively reads as ours
+ * — never reap a run on a doubtful identity probe.
+ */
+function etimeIndicatesOurs(etime, spawnedAt) {
+    if (!etime)
+        return true;
+    const parts = etime.replace(/-/g, ':').split(':').reverse();
+    let uptimeSec = 0;
+    if (parts[0])
+        uptimeSec += parseInt(parts[0], 10);
+    if (parts[1])
+        uptimeSec += parseInt(parts[1], 10) * 60;
+    if (parts[2])
+        uptimeSec += parseInt(parts[2], 10) * 3600;
+    if (parts[3])
+        uptimeSec += parseInt(parts[3], 10) * 86400;
+    const processStartMs = Date.now() - uptimeSec * 1000;
+    return Math.abs(processStartMs - spawnedAt) < 30_000;
+}
+/**
+ * Synchronous identity check for callers OTHER than the periodic heartbeat tick:
+ * the `agents routines list/status` builders and stop-time enumeration (both in
+ * short-lived CLI processes), plus the scheduler's fire-time slot-claim
+ * (`activeRoutineRun`) and status projection (`isRunGenuinelyInFlight`). Those
+ * last two DO run in-process on the daemon's event loop, but are event-driven
+ * (they fire when a job is dispatched, not on a fixed cadence) and the `ps` here
+ * is now bounded to {@link PS_IDENTITY_TIMEOUT_MS} — they are not the
+ * unconditional every-tick scan PHNX-3695 targets. The heartbeat tick's own scan
+ * uses the non-blocking {@link isPidOursAsync} instead.
+ */
 function isPidOurs(pid, spawnedAt) {
     try {
         process.kill(pid, 0);
@@ -2236,42 +2276,75 @@ function isPidOurs(pid, spawnedAt) {
     if (process.platform === 'win32')
         return true;
     try {
-        const etime = execFileSync('ps', ['-p', String(pid), '-o', 'etime='], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
-        if (!etime)
-            return true;
-        const parts = etime.replace(/-/g, ':').split(':').reverse();
-        let uptimeSec = 0;
-        if (parts[0])
-            uptimeSec += parseInt(parts[0], 10);
-        if (parts[1])
-            uptimeSec += parseInt(parts[1], 10) * 60;
-        if (parts[2])
-            uptimeSec += parseInt(parts[2], 10) * 3600;
-        if (parts[3])
-            uptimeSec += parseInt(parts[3], 10) * 86400;
-        const processStartMs = Date.now() - uptimeSec * 1000;
-        return Math.abs(processStartMs - spawnedAt) < 30_000;
+        const etime = execFileSync('ps', ['-p', String(pid), '-o', 'etime='], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'], timeout: PS_IDENTITY_TIMEOUT_MS }).trim();
+        return etimeIndicatesOurs(etime, spawnedAt);
     }
     catch {
         return true;
     }
 }
+/**
+ * Async, deadline-bounded twin of {@link isPidOurs} for the daemon's heartbeat
+ * tick (`reapExitedRunningJobs`) — the `ps` probe runs on the shared event loop,
+ * so it MUST NOT block it (PHNX-3695). Same semantics: dead pid → not ours;
+ * no recorded `spawnedAt` or Windows → assume ours; a failed/empty probe reads
+ * as ours (conservative — never reap on a doubtful probe).
+ */
+async function isPidOursAsync(pid, spawnedAt) {
+    if (!isAlive(pid))
+        return false;
+    if (spawnedAt === undefined)
+        return true;
+    if (process.platform === 'win32')
+        return true;
+    const res = await execFileBounded('ps', ['-p', String(pid), '-o', 'etime='], { timeoutMs: PS_IDENTITY_TIMEOUT_MS });
+    if (res.code !== 0)
+        return true; // probe failed → keep the run, same as the sync catch
+    return etimeIndicatesOurs(res.stdout.trim(), spawnedAt);
+}
 /**
  * Finalize one `host:`-placed run by healing its host-task sidecar against the
  * remote `.exit` (lib/hosts/reconcile.ts). Mutates + persists the meta only
  * when the sidecar reached a terminal state.
  */
+/** Apply a healed host-task's terminal state to the local run record. Shared by the sync and async host reconcilers. */
+function applyHealedHostRun(meta, healed, 
+// The routine-end emit acquires the event-log file lock. On the daemon
+// heartbeat tick (finalizeHostRunAsync) that MUST be the async, non-blocking
+// variant, or the synchronous `withFileLock` (lockSync + Atomics.wait, up to
+// 30s under contention) freezes the whole event loop — the exact wedge PHNX-3695
+// targets, on a path guard-no-sync-io does not scan (PHNX-3727). The sync CLI
+// path (finalizeHostRun) keeps the default synchronous emit.
+emit = emitRoutineEnd) {
+    if (healed.status !== 'completed' && healed.status !== 'failed')
+        return;
+    finalizeRunMeta(meta, healed.status, healed.exitCode ?? (healed.status === 'completed' ? 0 : 1), { completedAt: healed.finishedAt ?? undefined });
+    writeRunMeta(meta);
+    emit(meta);
+}
 function finalizeHostRun(meta) {
     try {
         const task = loadHostTask(meta.hostTaskId);
         if (!task)
             return;
-        const healed = reconcileHostTask(task);
-        if (healed.status !== 'completed' && healed.status !== 'failed')
+        applyHealedHostRun(meta, reconcileHostTask(task));
+    }
+    catch { /* unreachable host or unreadable sidecar — retry next sweep */ }
+}
+/**
+ * Async twin of {@link finalizeHostRun} for the daemon heartbeat tick
+ * (PHNX-3695). A `host:`-placed run's remote `.exit` is read over ssh; on the
+ * tick that read MUST be async (`reconcileHostTaskAsync` → `sshExecAsync`) or a
+ * single 6s ssh timeout freezes the whole event loop — the exact bug class this
+ * effort targets, worse than the local `ps` probe.
+ */
+async function finalizeHostRunAsync(meta) {
+    try {
+        const task = loadHostTask(meta.hostTaskId);
+        if (!task)
             return;
-        finalizeRunMeta(meta, healed.status, healed.exitCode ?? (healed.status === 'completed' ? 0 : 1), { completedAt: healed.finishedAt ?? undefined });
-        writeRunMeta(meta);
-        emitRoutineEnd(meta);
+        // Tick path: emit through the async, non-blocking file lock (PHNX-3727).
+        applyHealedHostRun(meta, await reconcileHostTaskAsync(task), (m) => { void emitRoutineEndAsync(m); });
     }
     catch { /* unreachable host or unreadable sidecar — retry next sweep */ }
 }
@@ -2345,7 +2418,91 @@ export function isRunGenuinelyInFlight(meta) {
         return false;
     return isPidOurs(meta.pid, meta.spawnedAt);
 }
-/** Scan all runs marked "running" and finalize any whose process has exited. */
+/**
+ * Reconcile ONE `running` record once its process identity is known (`ours` =
+ * the recorded pid is still genuinely the child we spawned). Shared verbatim by
+ * the synchronous {@link monitorRunningJobs} (off-loop callers) and the async
+ * {@link reapExitedRunningJobs} (daemon heartbeat tick) so there is one copy of
+ * the finalize/timeout/report logic — only the surrounding directory/`ps` IO
+ * differs by sync-vs-async flavor. Caller has already confirmed `meta.status`
+ * is `running`. The finalize/report/archive helpers stay synchronous: they run
+ * ONLY when a run actually transitions (times out or its process exited), a
+ * conditional/rare event, not the every-tick scan the loop-starvation fix
+ * (PHNX-3695) targets. The one exception is the `routine.end` EVENT emit, whose
+ * file lock CAN block for up to 30s under contention even on that rare path — so
+ * the emitter is injected: the off-loop sync caller passes `emitRoutineEnd`
+ * (synchronous, so a short-lived CLI process flushes it before exit), the daemon
+ * tick passes a fire-and-forget `emitRoutineEndAsync` (the long-lived daemon
+ * flushes it, and the shared event loop is never blocked on the lock).
+ */
+function reconcileRunningRecord(meta, jobRunsPath, runDirName, ours, emitEnd) {
+    // Host-placed runs (meta.hostTaskId) are handled by the caller, sync or async
+    // — their remote `.exit` read is ssh I/O that must stay off the daemon tick's
+    // event loop (finalizeHostRunAsync). Records reaching here are local-pid runs.
+    const runDirPath = path.join(jobRunsPath, runDirName);
+    const stdoutPath = path.join(runDirPath, 'stdout.log');
+    // Command-mode records carry no agent; there is no stream-json report to
+    // parse or extract. Reap them on pid liveness alone.
+    const isCommandRun = Boolean(meta.command) || !meta.agent;
+    // Age-out runs FIRST, before the null-pid guard below, so a wedged record
+    // still marked `running` past its deadline is always finalized — a
+    // provisional launcher claim whose daemon crashed before spawning a child
+    // (pid null), or an old record whose recorded pid was reused, would
+    // otherwise linger as `running` forever (RUSH-2640). Only kill a process
+    // group that is genuinely still ours; terminating a reused pid would kill
+    // an unrelated process, and a null pid has nothing to kill.
+    const wallClockMs = Date.now() - Date.parse(meta.startedAt);
+    const timeoutMs = meta.timeoutMs ?? MAX_WALL_CLOCK_MS;
+    if (Number.isFinite(wallClockMs) && wallClockMs > timeoutMs) {
+        if (meta.pid && ours)
+            terminateRoutineTree(meta.pid);
+        finalizeRunMeta(meta, 'timeout', null, { errorMessage: 'exceeded configured timeout' });
+        writeRunMeta(meta);
+        emitEnd(meta);
+        if (!isCommandRun) {
+            extractAndSaveReport(stdoutPath, meta.agent, runDirPath);
+            archiveRoutineTranscripts(meta, runDirPath);
+        }
+        return;
+    }
+    if (!meta.pid)
+        return;
+    if (!ours) {
+        if (isCommandRun) {
+            // Command routines normally record their own terminal status via
+            // child.on('exit') (so this record would already be non-'running' and
+            // skipped above). Reaching here means the daemon restarted mid-run and
+            // missed the exit event — recover the true code from the exit-code file
+            // the child wrote; its absence means the child was killed/crashed.
+            const ec = readCommandExitCode(runDirPath);
+            finalizeRunMeta(meta, ec === 0 ? 'completed' : 'failed', ec);
+        }
+        else {
+            const inferred = inferFinalStatusFromLog(stdoutPath, meta.agent);
+            if (inferred) {
+                finalizeRunMeta(meta, inferred.status, inferred.exitCode);
+            }
+            else {
+                finalizeRunMeta(meta, 'failed', null, { errorMessage: 'process exited before final status could be inferred' });
+            }
+        }
+        writeRunMeta(meta);
+        emitEnd(meta);
+        if (!isCommandRun) {
+            extractAndSaveReport(stdoutPath, meta.agent, runDirPath);
+            archiveRoutineTranscripts(meta, runDirPath);
+        }
+    }
+}
+/**
+ * Scan all runs marked "running" and finalize any whose process has exited.
+ *
+ * SYNCHRONOUS — for OFF-loop callers only (the `agents routines list/status`
+ * builders and CLI best-effort orphan reaps), which run in short-lived CLI
+ * processes where a bounded synchronous `ps`/scan cannot starve a served event
+ * loop. The daemon's own heartbeat tick MUST use {@link reapExitedRunningJobs}
+ * instead — a sync scan there would freeze the shared event loop (PHNX-3695).
+ */
 export function monitorRunningJobs() {
     const runsDir = getRunsDir();
     if (!fs.existsSync(runsDir))
@@ -2374,67 +2531,67 @@ export function monitorRunningJobs() {
                 const meta = JSON.parse(fs.readFileSync(metaPath, 'utf-8'));
                 if (meta.status !== 'running')
                     continue;
-                // `host:`-placed run — no local pid to watch. Reconcile against the
-                // remote `.exit` (completion is confirmed, never guessed: an
-                // unreachable host leaves the run `running` for the next sweep).
+                // `host:`-placed run — no local pid; reconcile against the remote `.exit`.
                 if (meta.hostTaskId) {
                     finalizeHostRun(meta);
                     continue;
                 }
-                const runDirPath = path.join(jobRunsPath, runDirEntry.name);
-                const stdoutPath = path.join(runDirPath, 'stdout.log');
-                // Command-mode records carry no agent; there is no stream-json report to
-                // parse or extract. Reap them on pid liveness alone.
-                const isCommandRun = Boolean(meta.command) || !meta.agent;
-                // Age-out runs FIRST, before the null-pid guard below, so a wedged record
-                // still marked `running` past its deadline is always finalized — a
-                // provisional launcher claim whose daemon crashed before spawning a child
-                // (pid null), or an old record whose recorded pid was reused, would
-                // otherwise linger as `running` forever (RUSH-2640). Only kill a process
-                // group that is genuinely still ours; terminating a reused pid would kill
-                // an unrelated process, and a null pid has nothing to kill.
-                const wallClockMs = Date.now() - Date.parse(meta.startedAt);
-                const timeoutMs = meta.timeoutMs ?? MAX_WALL_CLOCK_MS;
-                if (Number.isFinite(wallClockMs) && wallClockMs > timeoutMs) {
-                    if (meta.pid && isPidOurs(meta.pid, meta.spawnedAt))
-                        terminateRoutineTree(meta.pid);
-                    finalizeRunMeta(meta, 'timeout', null, { errorMessage: 'exceeded configured timeout' });
-                    writeRunMeta(meta);
-                    emitRoutineEnd(meta);
-                    if (!isCommandRun) {
-                        extractAndSaveReport(stdoutPath, meta.agent, runDirPath);
-                        archiveRoutineTranscripts(meta, runDirPath);
-                    }
+                const ours = meta.pid ? isPidOurs(meta.pid, meta.spawnedAt) : false;
+                // Sync emit: an off-loop CLI process must flush the event before it exits.
+                reconcileRunningRecord(meta, jobRunsPath, runDirEntry.name, ours, emitRoutineEnd);
+            }
+            catch { /* corrupt or unreadable meta.json */ }
+        }
+    }
+}
+/**
+ * Async, non-blocking twin of {@link monitorRunningJobs} for the daemon's
+ * heartbeat tick (PHNX-3695). Identical reconciliation via
+ * {@link reconcileRunningRecord}, but the directory walk uses `fs/promises` and
+ * the pid-identity probe uses the deadline-bounded {@link isPidOursAsync}, so
+ * the every-tick scan never freezes the shared event loop — the freeze that
+ * left the browser IPC `version` probe unanswered.
+ */
+export async function reapExitedRunningJobs() {
+    const runsDir = getRunsDir();
+    let jobDirs;
+    try {
+        jobDirs = await fsp.readdir(runsDir, { withFileTypes: true });
+    }
+    catch {
+        return; // runs dir absent — nothing to reap
+    }
+    for (const jobDir of jobDirs) {
+        if (!jobDir.isDirectory())
+            continue;
+        const jobRunsPath = path.join(runsDir, jobDir.name);
+        let runDirs;
+        try {
+            runDirs = await fsp.readdir(jobRunsPath, { withFileTypes: true });
+        }
+        catch {
+            // A retention/cleanup pass may remove a job directory after the root
+            // snapshot. The next sweep observes the remaining state.
+            continue;
+        }
+        for (const runDirEntry of runDirs) {
+            if (!runDirEntry.isDirectory())
+                continue;
+            try {
+                const raw = await fsp.readFile(path.join(jobRunsPath, runDirEntry.name, 'meta.json'), 'utf-8');
+                const meta = JSON.parse(raw);
+                if (meta.status !== 'running')
                     continue;
-                }
-                if (!meta.pid)
+                // `host:`-placed run — read its remote `.exit` over ssh ASYNC so a slow
+                // host never freezes the tick's event loop (PHNX-3695).
+                if (meta.hostTaskId) {
+                    await finalizeHostRunAsync(meta);
                     continue;
-                if (!isPidOurs(meta.pid, meta.spawnedAt)) {
-                    if (isCommandRun) {
-                        // Command routines normally record their own terminal status via
-                        // child.on('exit') (so this record would already be non-'running' and
-                        // skipped above). Reaching here means the daemon restarted mid-run and
-                        // missed the exit event — recover the true code from the exit-code file
-                        // the child wrote; its absence means the child was killed/crashed.
-                        const ec = readCommandExitCode(runDirPath);
-                        finalizeRunMeta(meta, ec === 0 ? 'completed' : 'failed', ec);
-                    }
-                    else {
-                        const inferred = inferFinalStatusFromLog(stdoutPath, meta.agent);
-                        if (inferred) {
-                            finalizeRunMeta(meta, inferred.status, inferred.exitCode);
-                        }
-                        else {
-                            finalizeRunMeta(meta, 'failed', null, { errorMessage: 'process exited before final status could be inferred' });
-                        }
-                    }
-                    writeRunMeta(meta);
-                    emitRoutineEnd(meta);
-                    if (!isCommandRun) {
-                        extractAndSaveReport(stdoutPath, meta.agent, runDirPath);
-                        archiveRoutineTranscripts(meta, runDirPath);
-                    }
                 }
+                const ours = meta.pid ? await isPidOursAsync(meta.pid, meta.spawnedAt) : false;
+                // Fire-and-forget async emit: the event-log lock must never block the
+                // daemon tick's shared event loop; the long-lived daemon still flushes it.
+                reconcileRunningRecord(meta, jobRunsPath, runDirEntry.name, ours, (m) => { void emitRoutineEndAsync(m); });
             }
             catch { /* corrupt or unreadable meta.json */ }
         }