@phnx-labs/agents-cli 1.22.84 → 1.22.86

package/dist/lib/daemon/account-state-daemon-service.js

@@ -19,14 +19,29 @@
  * (`AbortSignal.timeout` at the leaf), and the supervisor abandons + restarts a
  * hung tick regardless.
  */
+import * as fsp from 'node:fs/promises';
+import * as path from 'node:path';
 import { BasePeriodicService } from './service.js';
-import { runUsageRefreshTick, runFleetCacheWarmTick } from '../daemon-ticks.js';
+import { runUsageRefreshTick, refreshLocalFleetAuthState } from '../daemon-ticks.js';
+import { getDaemonDir } from '../state.js';
+import { getCliLaunch } from '../cli-entry.js';
+import { execFileBounded } from '../exec-bounded.js';
+import { fleetSharedStatePath, FLEET_SHARED_STATE_VERSION } from '../fleet-shared-state.js';
+import { withFileLockAsync } from '../fs-atomic.js';
+import { machineId } from '../machine-id.js';
+import { getConfigValueAsync, isHeadedDeviceRole } from '../device-config.js';
+import { harnessWorkerIsPerDevice } from '../harness-auth-capabilities.js';
 /** Usage cache refresh cadence. */
 export const USAGE_STATE_TICK_MS = 60_000;
 /** Fleet-auth refresh cadence — deliberately slower (rate-limited endpoint). */
 export const AUTH_STATE_TICK_MS = 3 * 60_000;
 /** A hung refresh is abandoned at this deadline; a real sweep is far under it. */
 const REFRESH_DEADLINE_MS = 2 * 60_000;
+const NOTIFY_DEADLINE_MS = 30_000;
+const ACCOUNT_TRANSITIONS_FILE = 'account-auth-transitions.json';
+// Resolve the current CLI once at daemon startup. getCliLaunch performs sync
+// filesystem probes, so it must never run inside a service tick.
+const FEED_POST_LAUNCH = getCliLaunch([]);
 /**
  * A promise that rejects when `signal` aborts (immediately if already aborted),
  * so a tick can `Promise.race` its work against the supervisor's deadline and
@@ -74,16 +89,197 @@ export class AccountAuthService extends BasePeriodicService {
     intervalMs = AUTH_STATE_TICK_MS;
     deadlineMs = REFRESH_DEADLINE_MS;
     refresh;
-    constructor(refresh = runFleetCacheWarmTick) {
+    stateFile;
+    notify;
+    constructor(refresh = async (signal) => (await refreshLocalFleetAuthState({ signal })).authRows, options = {}) {
         super();
         this.refresh = refresh;
+        this.stateFile = options.stateFile ?? path.join(getDaemonDir(), ACCOUNT_TRANSITIONS_FILE);
+        this.notify = options.notify ?? postImportantAccountTransition;
     }
     async onStart() { }
     async onStop() { }
     async onTick(_ctx, signal) {
-        await Promise.race([
+        const rows = await Promise.race([
             this.refresh(signal),
             abortRejection(signal, 'auth refresh aborted at deadline'),
         ]);
+        if (rows) {
+            await publishAccountDaemonStateRows(rows);
+            await processAccountAuthTransitions(rows, {
+                stateFile: this.stateFile,
+                notify: this.notify,
+            });
+        }
+    }
+}
+export async function publishAccountDaemonStateRows(rows, userAgentsDir) {
+    const device = machineId();
+    const file = fleetSharedStatePath(device, userAgentsDir);
+    await fsp.mkdir(path.dirname(file), { recursive: true });
+    const handle = await fsp.open(file, 'a', 0o600);
+    await handle.close();
+    const role = (await getConfigValueAsync('role', { device })).value;
+    const headed = isHeadedDeviceRole(role);
+    const accountRows = [...collapseAccountRows(rows).values()].map((row) => ({
+        // The registered account id is the only stable identity: two accounts may
+        // share one email (different orgs), so the display label is never a key.
+        // Unregistered legacy homes have no registry id and fall back to the label.
+        accountId: row.accountId ?? row.account ?? row.version,
+        identityLabel: row.account,
+        harness: row.agent,
+        authMode: harnessWorkerIsPerDevice(row.agent)
+            ? 'per-device'
+            : headed ? 'native' : 'durable',
+        verdict: row.health.verdict === 'unconfigured'
+            ? 'missing'
+            : row.health.verdict === 'error' ? 'unverified' : row.health.verdict,
+        checkedAt: new Date(row.health.checkedAt).toISOString(),
+    }));
+    await withFileLockAsync(file, async () => {
+        const raw = await fsp.readFile(file, 'utf-8');
+        let current = {};
+        if (raw.trim()) {
+            const parsed = JSON.parse(raw);
+            if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+                throw new Error(`Cannot publish account state: ${file} is not an object.`);
+            }
+            current = parsed;
+            if (current.device !== device || current.version !== FLEET_SHARED_STATE_VERSION) {
+                throw new Error(`Cannot publish account state: ${file} has an unrecognized owner or version.`);
+            }
+        }
+        const next = {
+            ...current,
+            version: FLEET_SHARED_STATE_VERSION,
+            device,
+            accounts: { rows: accountRows },
+        };
+        const serialized = `${JSON.stringify(next, null, 2)}\n`;
+        if (serialized === raw)
+            return;
+        const temp = `${file}.${process.pid}.accounts.tmp`;
+        await fsp.writeFile(temp, serialized, { mode: 0o600 });
+        await fsp.rename(temp, file);
+    });
+}
+function transitionKey(row) {
+    // Stable identity first (registered account id); the display label is the
+    // fallback for unregistered legacy homes, never the key for a named account.
+    return `${row.agent}:${row.accountId ?? row.account ?? `version:${row.version}`}`;
+}
+function verdictRank(verdict) {
+    switch (verdict) {
+        case 'revoked': return 7;
+        case 'expired': return 6;
+        case 'rate_limited': return 5;
+        case 'live': return 4;
+        case 'unverified': return 3;
+        case 'error': return 2;
+        case 'unconfigured': return 1;
+    }
+}
+function collapseAccountRows(rows) {
+    const accounts = new Map();
+    for (const row of rows) {
+        const key = transitionKey(row);
+        const current = accounts.get(key);
+        if (!current || verdictRank(row.health.verdict) > verdictRank(current.health.verdict)) {
+            accounts.set(key, row);
+        }
+    }
+    return accounts;
+}
+async function readTransitionState(file) {
+    try {
+        const parsed = JSON.parse(await fsp.readFile(file, 'utf-8'));
+        if ((parsed.version === 1 || parsed.version === 2) && parsed.entries && typeof parsed.entries === 'object') {
+            // Version 1 files predate the outbox; they upgrade with an empty one.
+            return { version: 2, entries: parsed.entries, pending: parsed.pending ?? {} };
+        }
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT') {
+            throw new Error(`Cannot read account transition state at ${file}: ${error.message}`);
+        }
+    }
+    return { version: 2, entries: {}, pending: {} };
+}
+async function writeTransitionState(file, state) {
+    await fsp.mkdir(path.dirname(file), { recursive: true });
+    const temp = `${file}.${process.pid}.tmp`;
+    await fsp.writeFile(temp, `${JSON.stringify(state, null, 2)}\n`, { mode: 0o600 });
+    await fsp.rename(temp, file);
+}
+/**
+ * Detect live → expired/revoked transitions and deliver one owner-important
+ * feed post each, through a persisted outbox:
+ *
+ * 1. Newly-dead accounts are ENQUEUED into `pending` and the state is written
+ *    BEFORE any delivery is attempted — a crash or a failed sink can never
+ *    strand a transition in the already-recorded `entries` with no retry.
+ * 2. Every pending item (fresh and retried) is delivered; an item leaves
+ *    `pending` only after its notifier resolves, and the state is written
+ *    again. A crash in the narrow window between a successful post and that
+ *    second write re-sends once — at-least-once, never zero.
+ *
+ * Delivery failures keep their outbox entries AND throw after the state is
+ * durable, so the supervisor's circuit breaker still sees the unhealthy tick.
+ */
+export async function processAccountAuthTransitions(rows, options = {}) {
+    const file = options.stateFile ?? path.join(getDaemonDir(), ACCOUNT_TRANSITIONS_FILE);
+    const notify = options.notify ?? postImportantAccountTransition;
+    const previous = await readTransitionState(file);
+    const next = {
+        version: 2,
+        entries: { ...previous.entries },
+        pending: { ...previous.pending },
+    };
+    for (const [key, row] of collapseAccountRows(rows)) {
+        const before = previous.entries[key]?.verdict;
+        const after = row.health.verdict;
+        next.entries[key] = { verdict: after, checkedAt: row.health.checkedAt };
+        if (before === 'live' && (after === 'expired' || after === 'revoked') && !next.pending[key]) {
+            next.pending[key] = {
+                agent: row.agent,
+                account: row.account ?? row.version,
+                verdict: after,
+            };
+        }
+    }
+    // Durable BEFORE delivery: a pending entry survives a crash mid-notify.
+    await writeTransitionState(file, next);
+    const delivered = [];
+    const failures = [];
+    for (const [key, transition] of Object.entries(next.pending)) {
+        try {
+            await notify(transition);
+            delete next.pending[key];
+            delivered.push(transition);
+        }
+        catch (error) {
+            failures.push(`${transition.agent} account ${transition.account}: ${error.message}`);
+        }
+    }
+    await writeTransitionState(file, next);
+    if (failures.length > 0) {
+        throw new Error(`Account expiry notification failed (kept in the outbox for the next tick): ${failures.join('; ')}`);
+    }
+    return delivered;
+}
+async function postImportantAccountTransition(transition) {
+    const title = `${transition.agent} account ${transition.verdict}`;
+    const text = `${transition.agent} account ${transition.account} changed from live to ${transition.verdict}. Run agents accounts list ${transition.agent} for the exact fix.`;
+    const args = [...FEED_POST_LAUNCH.args,
+        'feed', 'post',
+        '--session', 'account-state-daemon',
+        '--title', title,
+        '--level', 'important',
+        text,
+    ];
+    const result = await execFileBounded(FEED_POST_LAUNCH.command, args, { timeoutMs: NOTIFY_DEADLINE_MS });
+    if (result.code !== 0) {
+        const detail = result.timedOut ? 'timed out' : (result.stderr.trim() || `exit ${result.code}`);
+        throw new Error(`Account expiry feed notification failed: ${detail}`);
     }
 }

package/dist/lib/daemon/auth-sync-service.js

@@ -22,7 +22,24 @@ export class AuthSyncService extends BasePeriodicService {
         // Nothing to release — the supervisor's timer teardown is the only cleanup.
     }
     async onTick(ctx) {
-        const { publishReservedAuthVerdict, syncReservedAuthBundle } = await import('../secrets/reserved-sync.js');
+        const { publishReservedAuthVerdict, reconcileLocalWorkerSlots, syncReservedAuthBundle, syncReservedStores, } = await import('../secrets-policy.js');
+        // Worker-side slot materialization FIRST (PHNX-3940 T6): for each registered
+        // account whose durable key is already on this box, create the HOME-shaped
+        // slot the picker and spawn read. It touches only local state — the registry
+        // copy and the file-backed store — so it never waits on the git exchange
+        // below. It used to sit after `if (!transport.success) return`, so a single
+        // `git rebase timed out` postponed every slot on the box by another tick.
+        // Self-gated on device role: a headed box returns immediately.
+        try {
+            const slots = reconcileLocalWorkerSlots();
+            if (slots.provisioned.length > 0)
+                ctx.log('INFO', `auth-sync: provisioned worker slot(s) for ${slots.provisioned.join(', ')}`);
+            for (const err of slots.errors)
+                ctx.log('WARN', `auth-sync: worker slot ${err.accountId}: ${err.message}`);
+        }
+        catch (err) {
+            ctx.log('WARN', `auth-sync: worker slot reconcile: ${err.message}`);
+        }
         const published = await publishReservedAuthVerdict();
         if (published.error)
             ctx.log('WARN', `auth-sync: verdict: ${published.error}`);
@@ -44,5 +61,19 @@ export class AuthSyncService extends BasePeriodicService {
         for (const err of result.errors) {
             ctx.log('WARN', `auth-sync: ${err.device}: ${err.message}`);
         }
+        // Generalized per-account, per-key, per-role reserved-store push (PHNX-3940
+        // T6). On the elected headed publisher this pushes every portable account's
+        // reserved `__<harness>__` store to the worker peers missing it. The push is
+        // the only transport — provisioning (above) writes only locally (invariant 1).
+        try {
+            const stores = await syncReservedStores();
+            for (const p of stores.pushed)
+                ctx.log('INFO', `auth-sync: pushed ${p.bundle} (${p.keys.length} key(s)) to ${p.device}`);
+            for (const err of stores.errors)
+                ctx.log('WARN', `auth-sync: reserved-store ${err.device}: ${err.message}`);
+        }
+        catch (err) {
+            ctx.log('WARN', `auth-sync: reserved-store sync: ${err.message}`);
+        }
     }
 }

package/dist/lib/daemon/daemon.d.ts

@@ -53,15 +53,6 @@ export declare function daemonSystemdUnitName(): string;
  * start` is the deliberate override and is never gated by this.
  */
 export declare const DAEMON_AUTOSTART_FAILURE_LIMIT = 5;
-/**
- * RUSH-1817: decide whether the daemon should (re)take over hosting the secrets
- * broker. The startup host decision is one-shot; this drives the periodic
- * self-heal re-check. Take over ONLY when the daemon is not already hosting AND
- * no healthy broker answers a ping — i.e. a standalone the daemon deferred to at
- * start has since died or crash-looped. Never take over while our in-process
- * broker is hosting, and never clobber a reachable (healthy) broker.
- */
-export declare function shouldTakeOverBroker(isHosting: boolean, brokerReachable: boolean): boolean;
 /**
  * What a gate re-evaluation must do with the routines scheduler. The daemon
  * re-evaluates `scheduler.enabled` on every SIGHUP reload so flipping the key
@@ -436,13 +427,12 @@ export declare function findSurvivingStateDirDaemons(exclude: Set<number>): numb
  * from launchd/systemd if applicable.
  *
  * The SIGTERM → grace → killTree sequence is unchanged; what it adds is
- * verification. After the daemon is gone it checks that the secrets broker socket
- * and browser IPC binding actually released — a stale socket present on disk but
- * with no live owner is the orphan that keeps clients holding unlocked bundles
- * hanging (`daemon.ts` broker-hosting; the two-brokers-on-one-socket bug) — and
- * that no `__daemon-run` for THIS state dir survives. A killTree escalation exits
- * without running the daemon's graceful handleShutdown, so those sockets can be
- * left stale; this reclaims each (the owner is provably dead) and reports it. It
+ * verification. After the daemon is gone it checks that the browser IPC
+ * binding actually released — a stale socket present on disk but with no live
+ * owner is the orphan that keeps clients hanging on it — and that no
+ * `__daemon-run` for THIS state dir survives. A killTree escalation exits
+ * without running the daemon's graceful handleShutdown, so that socket can be
+ * left stale; this reclaims it (the owner is provably dead) and reports it. It
  * never reports success on an unverified stop.
  */
 export declare function stopDaemon(): DaemonStopResult;

package/dist/lib/daemon/daemon.js

@@ -24,7 +24,6 @@ import { notifyRoutineStart, notifyRoutineFinish, notifyRoutineStartFailed } fro
 import { notifyOwnerRoutineFinish, notifyOwnerRoutineStartFailed } from '../routine-notify-owner.js';
 import { BrowserService } from '../browser/service.js';
 import { getSocketPath as getBrowserIpcSocketPath } from '../browser/ipc.js';
-import { secretsBrokerSocketPath, brokerPidAlive } from '../secrets/agent.js';
 import { redactSecrets } from '../redact.js';
 import { getAgentsBinPath, getCliLaunch, BUN_VIRTUAL_ROOT } from '../cli-entry.js';
 import { localBinDir } from '../platform/posixpath.js';
@@ -33,7 +32,6 @@ import { recordSubsystemOk, recordSubsystemError, recordSubsystemErrorReason, re
 import { ServiceSupervisor } from './supervisor.js';
 import { SessionIndexService } from './session-index-service.js';
 import { SessionSummarizerService } from './session-summarizer-service.js';
-import { SecretsBrokerService } from './secrets-broker-service.js';
 import { MonitorEngineService } from './monitor-engine-service.js';
 import { AccountUsageService, AccountAuthService } from './account-state-daemon-service.js';
 import { CatchupService } from './catchup-service.js';
@@ -43,7 +41,6 @@ import { DeviceProbeService } from './device-probe-service.js';
 import { SelfHealService } from './self-heal-service.js';
 import { SelfUpdateService } from './self-update-service.js';
 import { HarnessUpdateService } from './harness-update-service.js';
-import { KeychainReapService } from './keychain-reap-service.js';
 import { AuthSyncService } from './auth-sync-service.js';
 import { UsageSyncService } from './usage-sync-service.js';
 import { StateDirCheckService } from './state-dir-check-service.js';
@@ -125,18 +122,15 @@ export function daemonSystemdUnitName() {
 /**
  * Cadences for the in-process background ticks, named here beside the other
  * tick constants rather than left as inline literals at their `setInterval`
- * (RUSH-2423). Self-heal, keychain-reap, state-dir-check, watchdog, and
- * device-probe cadences moved to their own `*-service.ts` files (RUSH-3193
- * P3, alongside session-index/account-state/etc.) — see those files for the
- * per-service trade-offs (self-heal's 6h/cheap-to-be-late repair cadence,
- * keychain-reap's 5min `ps`-shell cost bound, state-dir-check's env override
- * for tests, watchdog/device-probe's shared 3min in-process housekeeping
- * cadence, NOT a routine — RUSH-2495).
- *
- * - **Broker self-heal** is a bare `agentPing`, and the failure it recovers
- *   from wedges every keychain-backed secret on the box, so it runs minutely.
+ * (RUSH-2423). Self-heal, state-dir-check, watchdog, and device-probe
+ * cadences moved to their own `*-service.ts` files (RUSH-3193 P3, alongside
+ * session-index/account-state/etc.) — see those files for the per-service
+ * trade-offs (self-heal's 6h/cheap-to-be-late repair cadence, state-dir-check's
+ * env override for tests, watchdog/device-probe's shared 3min in-process
+ * housekeeping cadence, NOT a routine — RUSH-2495). The secrets broker and its
+ * self-heal/reap ticks moved out of this daemon entirely with the standalone
+ * `secrets` engine (PHNX-3989 OWN-1) — this daemon no longer hosts that broker.
  */
-// BROKER_SELF_HEAL_TICK_MS moved to secrets-broker-service.ts (RUSH-3193 P2).
 // Session-index warm interval/deadline live in session-index-service.ts now
 // (RUSH-3193 — migrated onto ServiceSupervisor).
 const WEDGE_THRESHOLD_TICKS = 3;
@@ -169,17 +163,6 @@ const DAEMON_START_LIMIT_BURST = 5;
  * start` is the deliberate override and is never gated by this.
  */
 export const DAEMON_AUTOSTART_FAILURE_LIMIT = 5;
-/**
- * RUSH-1817: decide whether the daemon should (re)take over hosting the secrets
- * broker. The startup host decision is one-shot; this drives the periodic
- * self-heal re-check. Take over ONLY when the daemon is not already hosting AND
- * no healthy broker answers a ping — i.e. a standalone the daemon deferred to at
- * start has since died or crash-looped. Never take over while our in-process
- * broker is hosting, and never clobber a reachable (healthy) broker.
- */
-export function shouldTakeOverBroker(isHosting, brokerReachable) {
-    return !isHosting && !brokerReachable;
-}
 export function schedulerGateTransition(running, enabled) {
     if (running)
         return enabled ? 'reload' : 'stop';
@@ -504,11 +487,10 @@ export function claimDaemonInstance() {
         const existing = resolveLiveDaemonPid(true);
         if (existing !== null && existing !== process.pid) {
             // Evict, and WAIT for the incumbent to be provably dead — its graceful
-            // handleShutdown releasing the browser IPC binding and the secrets broker
-            // socket — before we write our pid and (later, in runDaemon) bind our own.
-            // Binding before the release recreates the two-brokers-on-one-socket orphan
-            // documented at stopDaemon below, so the pid file is not written until the
-            // prior owner is gone.
+            // handleShutdown releasing the browser IPC binding — before we write our
+            // pid and (later, in runDaemon) bind our own. Binding before the release
+            // recreates the two-owners-on-one-socket orphan documented at stopDaemon
+            // below, so the pid file is not written until the prior owner is gone.
             if (!evictIncumbentDaemon(existing))
                 return false;
         }
@@ -521,8 +503,10 @@ export function claimDaemonInstance() {
 }
 /**
  * SIGTERM a live incumbent daemon and block until it is provably dead, so its
- * graceful handleShutdown has released the browser IPC binding and the secrets
- * broker socket BEFORE the newcomer binds anything of its own (SING-11). Escalates
+ * graceful handleShutdown has released the browser IPC binding BEFORE the
+ * newcomer binds anything of its own (SING-11) — the daemon no longer hosts a
+ * secrets broker socket to release (the standalone `secrets` CLI owns it now,
+ * PHNX-3989 OWN-1). Escalates
  * to killTree after the grace window. Passes the POSITIVE pid so the kill reaches
  * only the incumbent daemon — never its detached routine children, which run in
  * their own process groups and must survive takeover (SING-11a); the new daemon
@@ -878,12 +862,12 @@ export function assertTestDaemonHome(daemonDir = getDaemonDir(), testHome = proc
 // named in stack traces, readable without scrolling through runDaemon's
 // 500-line body, and not recreated on every function invocation.
 //
-// self-heal and keychain-reap moved to SelfHealService / KeychainReapService
-// on the ServiceSupervisor (RUSH-3193 P3) — the supervisor's own per-tick
-// deadline + inFlight guard replaces their local `healing`/`reapingKeychain`
-// flags. state-dir-check moved to StateDirCheckService (RUSH-3193 P3),
-// registered after `handleShutdown` is declared — see its registration site
-// below. runBrokerSelfHeal was moved into SecretsBrokerService (RUSH-3193 P2).
+// self-heal moved to SelfHealService on the ServiceSupervisor (RUSH-3193 P3)
+// — the supervisor's own per-tick deadline + inFlight guard replaces its local
+// `healing` flag. state-dir-check moved to StateDirCheckService (RUSH-3193
+// P3), registered after `handleShutdown` is declared — see its registration
+// site below. The secrets broker (self-heal, reap, and hosting) moved out of
+// this daemon entirely with the standalone `secrets` engine (PHNX-3989 OWN-1).
 // ---------------------------------------------------------------------------
 export async function runDaemon() {
     // PHNX-2545 test-home tripwire — FIRST, before this daemon claims an instance,
@@ -999,21 +983,17 @@ export async function runDaemon() {
     catch (err) {
         log('ERROR', `Stray daemon reaper failed: ${err.message}`);
     }
-    // Socket services: secrets broker, monitor engine, account-state, and
-    // browser IPC are all managed by the ServiceSupervisor (RUSH-3193 P2).
-    // The supervisor is created here — before the scheduler — so the secrets
-    // broker starts socket-first (#416) and `agents secrets` resolves within
-    // ms of daemon start, exactly as before.
+    // Socket services: monitor engine, account-state, and browser IPC are all
+    // managed by the ServiceSupervisor (RUSH-3193 P2). The secrets broker moved
+    // with the standalone `secrets` engine (PHNX-3989 OWN-1) — this daemon no
+    // longer hosts or takes over that broker; the standalone owns its own
+    // lifecycle exclusively.
     const supervisor = new ServiceSupervisor();
     if (isEnabled('session-state')) {
         supervisor.register(new SessionStateService(() => supervisor.runNow('session-state')));
     }
     else
         log('INFO', 'Live session-state service disabled');
-    if (isEnabled('secrets-broker'))
-        supervisor.register(new SecretsBrokerService());
-    else
-        log('INFO', 'Secrets broker service disabled; daemon not hosting it');
     const monitorEngineSvc = new MonitorEngineService();
     if (isEnabled('monitors'))
         supervisor.register(monitorEngineSvc);
@@ -1071,10 +1051,10 @@ export async function runDaemon() {
         supervisor.register(new SessionSummarizerService());
     else
         log('INFO', 'Session summarizer service disabled');
-    // Watchdog, device-probe, self-heal, and keychain-reap are all periodic
-    // services managed by the ServiceSupervisor (RUSH-3193 P3). Each is gated
-    // the same way as the socket services above; state-dir-check is registered
-    // separately, later, after `handleShutdown` exists (see below).
+    // Watchdog, device-probe, and self-heal are all periodic services managed
+    // by the ServiceSupervisor (RUSH-3193 P3). Each is gated the same way as
+    // the socket services above; state-dir-check is registered separately,
+    // later, after `handleShutdown` exists (see below).
     if (isEnabled('watchdog'))
         supervisor.register(new WatchdogService());
     else
@@ -1095,10 +1075,6 @@ export async function runDaemon() {
         supervisor.register(new HarnessUpdateService());
     else
         log('INFO', 'Harness-update service disabled');
-    if (isEnabled('keychain-reap'))
-        supervisor.register(new KeychainReapService());
-    else
-        log('INFO', 'Keychain-reap service disabled');
     if (isEnabled('auth-sync'))
         supervisor.register(new AuthSyncService());
     else
@@ -1129,7 +1105,7 @@ export async function runDaemon() {
     activeServiceSupervisor = supervisor;
     // scheduler.enabled=false in this machine's device doc means NO routines fire
     // here — the scheduler and its catchup recovery simply never start, while the
-    // daemon keeps its other duties (secrets broker, browser IPC, session sync).
+    // daemon keeps its other duties (browser IPC, session sync).
     // The refusal message is the same one the start surfaces
     // (`routines add` auto-start, manual `routines start`) raise. The gate is
     // re-evaluated on every SIGHUP reload (handleReload below) via
@@ -1338,22 +1314,23 @@ export async function runDaemon() {
     // Browser orphan reap and IPC server start are now managed by BrowserIPCService
     // on the supervisor (RUSH-3193 P2). The orphan reap runs inside onStart().
     // Webhook receivers: signed webhook receiver(s) + their funnel (RUSH-2548).
-    // Started after the broker (above) so it resolves each receiver's signing
-    // secret headlessly — no AGENTS_SECRETS_PASSPHRASE, no nohup. Binds nothing
-    // unless daemon/webhooks.yaml declares a receiver, so an unconfigured box no-ops.
+    // Resolves each receiver's signing secret headlessly through the standalone
+    // `secrets` CLI (an agentOnly secrets-client read) — no AGENTS_SECRETS_PASSPHRASE,
+    // no nohup. Binds nothing unless daemon/webhooks.yaml declares a receiver, so an
+    // unconfigured box no-ops.
     // Signed webhook ingress is owned by WebhookReceiverService, including
     // per-service failure isolation, measured health, and shutdown cleanup.
     // Resource self-heal is now managed by SelfHealService on the supervisor
     // (RUSH-3193 P3), registered above alongside the socket services. The
     // supervisor's immediate first tick on start replaces the old
     // SELF_HEAL_KICKOFF_MS (30s) delayed kickoff timer — see self-heal-service.ts.
-    // Broker self-heal (RUSH-1817) is now encapsulated in SecretsBrokerService
-    // (RUSH-3193 P2). The interval fires inside onStart() and is stopped in onStop().
-    // RUSH-2232: keychain-reap is now managed by KeychainReapService on the
-    // supervisor (RUSH-3193 P3), registered above alongside the socket services.
-    // RUSH-2501: reap tmux sessions whose panes are all dead. Runs on the same
-    // 5-min cadence as the keychain reaper. Daemon-only (single executor).
-    // Dead managed panes and their orphan helpers are reaped by TmuxReapService.
+    // The secrets broker's self-heal and keychain-reap ticks (formerly
+    // SecretsBrokerService / KeychainReapService, RUSH-1817 / RUSH-2232) moved
+    // out of this daemon entirely with the standalone `secrets` engine
+    // (PHNX-3989 OWN-1) — the standalone owns its own broker lifecycle.
+    // RUSH-2501: reap tmux sessions whose panes are all dead. Daemon-only
+    // (single executor). Dead managed panes and their orphan helpers are
+    // reaped by TmuxReapService.
     // RUSH-2622: close abandoned browser-task tabs on the same 5-min cadence,
     // reusing the daemon's long-lived BrowserService when browser IPC is enabled.
     // Abandoned browser tasks are reaped by BrowserTaskReapService, sharing the
@@ -1501,7 +1478,7 @@ export async function runDaemon() {
     });
     // State-dir self-check (RUSH-2367 self-terminate guard) is registered on
     // the supervisor here — AFTER `handleShutdown` above — rather than
-    // alongside watchdog/device-probe/self-heal/keychain-reap earlier. The
+    // alongside watchdog/device-probe/self-heal earlier. The
     // supervisor fires an immediate first tick on `register()`+`start()`; doing
     // that before `handleShutdown` exists would reference the const in its
     // temporal dead zone the moment a mismatch is ever detected. Registering it
@@ -1661,9 +1638,8 @@ Environment=AGENTS_REAL_HOME=${realHome}
 WantedBy=default.target`;
 }
 // Binary-resolution helpers (getAgentsBinPath / isNodeScriptEntry / getCliLaunch)
-// live in ./cli-entry.js — a leaf module the secrets broker also imports without
-// forming a cycle. Re-exported so existing `from './daemon.js'` importers of
-// getAgentsBinPath keep resolving.
+// live in ./cli-entry.js — a leaf module. Re-exported so existing
+// `from './daemon.js'` importers of getAgentsBinPath keep resolving.
 export { getAgentsBinPath };
 /**
  * Ask the service manager for the daemon's live PID. Used as a fallback when
@@ -2207,13 +2183,12 @@ export function findSurvivingStateDirDaemons(exclude) {
  * from launchd/systemd if applicable.
  *
  * The SIGTERM → grace → killTree sequence is unchanged; what it adds is
- * verification. After the daemon is gone it checks that the secrets broker socket
- * and browser IPC binding actually released — a stale socket present on disk but
- * with no live owner is the orphan that keeps clients holding unlocked bundles
- * hanging (`daemon.ts` broker-hosting; the two-brokers-on-one-socket bug) — and
- * that no `__daemon-run` for THIS state dir survives. A killTree escalation exits
- * without running the daemon's graceful handleShutdown, so those sockets can be
- * left stale; this reclaims each (the owner is provably dead) and reports it. It
+ * verification. After the daemon is gone it checks that the browser IPC
+ * binding actually released — a stale socket present on disk but with no live
+ * owner is the orphan that keeps clients hanging on it — and that no
+ * `__daemon-run` for THIS state dir survives. A killTree escalation exits
+ * without running the daemon's graceful handleShutdown, so that socket can be
+ * left stale; this reclaims it (the owner is provably dead) and reports it. It
  * never reports success on an unverified stop.
  */
 export function stopDaemon() {
@@ -2447,26 +2422,6 @@ function stopDaemonLocked() {
         else {
             released.push('browser IPC socket');
         }
-        // Secrets broker socket: released when it is gone, or still owned by a
-        // DIFFERENT live broker (a standalone service the daemon never hosted). A
-        // socket present with NO live owner is the orphan — reclaim it.
-        const brokerSock = secretsBrokerSocketPath();
-        if (!fs.existsSync(brokerSock)) {
-            released.push('secrets broker socket');
-        }
-        else if (brokerPidAlive()) {
-            released.push('secrets broker socket (standalone owner)');
-        }
-        else {
-            try {
-                fs.unlinkSync(brokerSock);
-            }
-            catch { /* raced with a fresh bind */ }
-            if (fs.existsSync(brokerSock))
-                surviving.push('secrets broker socket not released');
-            else
-                released.push('secrets broker socket (reclaimed)');
-        }
     }
     // ── The state files a killed daemon cannot clean up itself (RUSH-2421) ─────
     // handleShutdown removes the lifetime marker, the heartbeat and this pid's

package/dist/lib/daemon/daemon.test-fixture.d.ts

@@ -1,4 +1,3 @@
-import { type KeychainBackend } from '../secrets/index.js';
 /**
  * Shared fixture for the daemon.*.test.ts suite slices (RUSH-2819).
  *
@@ -9,15 +8,14 @@ import { type KeychainBackend } from '../secrets/index.js';
  * process-spawning / real-daemon integration tests across workers; the
  * helpers shared by more than one slice live here.
  */
-/** An in-memory KeychainBackend stand-in, so a test never touches the real OS keychain. */
-export declare function makeMemoryBackend(): {
-    backend: KeychainBackend;
-    store: Map<string, string>;
-};
 /**
- * Registers the keychain-backend swap + AGENTS_SECRETS_NO_AGENT hermeticity
- * beforeEach/afterEach every slice of the original daemon.test.ts ran under,
- * verbatim. Call once at the top level of each slice file.
+ * Isolates every slice against a fresh, empty standalone `secrets` store
+ * (PHNX-3989) — an in-process fake keychain can no longer serve reads, since
+ * the client always spawns the real standalone, and several slices here also
+ * spawn a REAL `__daemon-run` subprocess that must see the SAME isolated
+ * store (a fresh `SECRETS_HOME` covers both: `useFreshSecretsHome` sets it as
+ * a `process.env` var, which every spawned child inherits by default). Call
+ * once at the top level of each slice file.
  */
 export declare function installKeychainHermeticity(): void;
 export declare const REPO_ROOT: string;