groove-dev 0.27.212 → 0.27.214

package/daemon-bridge.js

@@ -0,0 +1,87 @@
+// FSL-1.1-Apache-2.0 — see LICENSE
+import { existsSync, readdirSync } from 'fs';
+import { createRequire } from 'module';
+import { dirname, join } from 'path';
+import { pathToFileURL } from 'url';
+
+const port = 31415;
+const projectDir = process.argv[2] || process.cwd();
+
+function preflightCheck(daemonPath) {
+  if (!existsSync(daemonPath)) {
+    throw new Error(
+      `Daemon entry point not found at ${daemonPath}. ` +
+      'The app may not have been packaged correctly — try reinstalling Groove.'
+    );
+  }
+
+  const daemonDir = dirname(daemonPath);
+  const require = createRequire(daemonPath);
+  const critical = ['express', 'ws'];
+  const missing = critical.filter(dep => {
+    try { require.resolve(dep); return false; } catch { return true; }
+  });
+
+  if (missing.length) {
+    const diag = [`Missing deps: ${missing.join(', ')}`, `GROOVE_DAEMON_PATH: ${daemonPath}`];
+    let walkDir = daemonDir;
+    for (let i = 0; i < 5 && walkDir !== dirname(walkDir); i++) {
+      try {
+        const entries = readdirSync(walkDir);
+        diag.push(`${walkDir}/: [${entries.join(', ')}]`);
+      } catch { diag.push(`${walkDir}/: (unreadable)`); }
+      walkDir = dirname(walkDir);
+    }
+    throw new Error(
+      `Daemon is missing dependencies. ` +
+      `Diagnostics:\n${diag.join('\n')}\n` +
+      'The app bundle may be incomplete — try reinstalling Groove.'
+    );
+  }
+}
+
+async function main() {
+  let Daemon;
+  const daemonPath = process.env.GROOVE_DAEMON_PATH;
+
+  if (daemonPath) {
+    preflightCheck(daemonPath);
+    const mod = await import(pathToFileURL(daemonPath).href);
+    Daemon = mod.Daemon;
+  } else {
+    const mod = await import('@groove-dev/daemon');
+    Daemon = mod.Daemon;
+  }
+
+  const daemon = new Daemon({ port, projectDir });
+  await daemon.start();
+
+  process.send({ type: 'ready', port: daemon.port });
+
+  process.on('message', (msg) => {
+    if (msg.type === 'auth-token') {
+      (async () => {
+        try { await daemon.setAuthToken(msg.token); } catch (err) {
+          process.stderr.write(`[daemon-bridge] setAuthToken failed: ${err.message}\n`);
+        }
+      })();
+    }
+  });
+
+  process.on('SIGTERM', async () => {
+    await daemon.stop();
+    process.exit(0);
+  });
+
+  process.on('SIGINT', async () => {
+    await daemon.stop();
+    process.exit(0);
+  });
+}
+
+main().catch((err) => {
+  if (process.send) {
+    process.send({ type: 'error', message: err.message });
+  }
+  process.exit(1);
+});

package/node_modules/@groove-dev/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/cli",
-  "version": "0.27.212",
+  "version": "0.27.214",
   "description": "GROOVE CLI — manage AI coding agents from your terminal",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/node_modules/@groove-dev/daemon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/daemon",
-  "version": "0.27.212",
+  "version": "0.27.214",
   "description": "GROOVE daemon — agent orchestration engine",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/node_modules/@groove-dev/daemon/src/tunnel-manager.js

@@ -20,6 +20,16 @@ const MAX_PORT_ATTEMPTS = 10;
 const HEALTH_INTERVAL = 30000;
 const HEALTH_TIMEOUT = 5000;
 const MAX_FAIL_COUNT = 3;
+// Long-timeout probe used to CONFIRM death before killing a tunnel — a busy
+// remote daemon can sit on /api/health well past the 5s routine probe.
+const CONFIRM_TIMEOUT = 15000;
+// At most one automatic rebuild per tunnel per window; beyond that it stays
+// disconnected rather than thrashing against a host that keeps dying.
+const REBUILD_COOLDOWN_MS = 10 * 60 * 1000;
+// Restarting a crashed REMOTE daemon is cheaper and safer than a rebuild, so
+// its cooldown is shorter — but still bounded: a daemon that dies right after
+// every start has a real problem more starts won't fix.
+const REMOTE_START_COOLDOWN_MS = 2 * 60 * 1000;
 
 const INJECTION_CHARS = /[;|&`$(){}[\]<>!#\n\r\\]/;
 
@@ -54,6 +64,10 @@ export class TunnelManager {
   constructor(daemon) {
     this.daemon = daemon;
     this.remotesPath = resolve(daemon.grooveDir, 'remotes.json');
+    // Live tunnel state, persisted separately from the configs so a daemon
+    // restart can re-adopt still-running ssh processes instead of forgetting
+    // them (the configs file is user data; this is runtime state).
+    this.activePath = resolve(daemon.grooveDir, 'tunnels-active.json');
     this.saved = new Map();
     this.active = new Map();
     this._healthInterval = null;
@@ -82,8 +96,9 @@ export class TunnelManager {
   }
 
   async init() {
+    await this._readopt();
     for (const [id, config] of this.saved) {
-      if (config.autoConnect) {
+      if (config.autoConnect && !this.active.has(id)) {
         try {
           await this.connect(id);
         } catch (err) {
@@ -93,6 +108,71 @@ export class TunnelManager {
     }
   }
 
+  // Re-adopt tunnels whose detached ssh processes survived a daemon restart.
+  // Without this, every daemon/app restart orphaned the ssh (or shutdown killed
+  // it) and the new daemon started amnesiac — remote windows died mid-session
+  // and the user had to reconnect everything by hand.
+  async _readopt() {
+    let entries = [];
+    try {
+      if (existsSync(this.activePath)) entries = JSON.parse(readFileSync(this.activePath, 'utf8'));
+    } catch { /* corrupt — treat as none */ }
+    if (!Array.isArray(entries) || entries.length === 0) return;
+
+    let adopted = 0;
+    for (const e of entries) {
+      if (!e?.id || !e.pid || !e.localPort || !this.saved.has(e.id)) continue;
+      // Only re-adopt what is provably OUR ssh still doing THIS job: the pid
+      // must be alive, be an ssh process forwarding this port, and the port
+      // must serve HTTP.
+      let alive = false;
+      try { process.kill(e.pid, 0); alive = true; } catch { /* gone */ }
+      if (alive) alive = this._looksLikeOurSsh(e.pid, e.localPort);
+      if (alive && await this._tunnelResponds(e.localPort)) {
+        this.active.set(e.id, {
+          pid: e.pid,
+          localPort: e.localPort,
+          startedAt: e.startedAt || new Date().toISOString(),
+          lastPing: Date.now(),
+          latencyMs: null,
+          healthy: true,
+          failCount: 0,
+        });
+        adopted++;
+        const name = this.saved.get(e.id)?.name || e.id;
+        console.log(`[Groove:Tunnel] Re-adopted live tunnel to ${name} on port ${e.localPort}`);
+        this.daemon.broadcast({ type: 'tunnel.connected', data: { id: e.id, name, localPort: e.localPort, host: this.saved.get(e.id)?.host, url: `http://localhost:${e.localPort}?instance=${encodeURIComponent(name)}` } });
+      } else if (alive) {
+        // ssh survives but doesn't serve — a corpse from before the restart.
+        try { process.kill(e.pid, 'SIGTERM'); } catch { /* gone */ }
+      }
+    }
+    if (adopted > 0 && !this._healthInterval) {
+      this._healthInterval = setInterval(() => this._healthCheckAll(), HEALTH_INTERVAL);
+    }
+    this._saveActive();
+  }
+
+  // Identity check for re-adoption: is this pid an ssh forwarding this port?
+  // Guards against pid recycling handing us an unrelated process.
+  _looksLikeOurSsh(pid, localPort) {
+    try {
+      const cmd = execFileSync('ps', ['-p', String(pid), '-o', 'command='], {
+        encoding: 'utf8', timeout: 3000,
+      }).trim();
+      return cmd.includes('ssh') && cmd.includes(String(localPort));
+    } catch { return false; }
+  }
+
+  _saveActive() {
+    try {
+      const entries = [...this.active.entries()].map(([id, c]) => ({
+        id, pid: c.pid, localPort: c.localPort, startedAt: c.startedAt,
+      }));
+      writeFileSync(this.activePath, JSON.stringify(entries, null, 2), { mode: 0o600 });
+    } catch { /* best effort */ }
+  }
+
   getSaved() {
     return Array.from(this.saved.values()).map(s => ({
       ...this._sanitize(s),
@@ -295,6 +375,8 @@ export class TunnelManager {
         return { localPort: existing.localPort, pid: existing.pid, name: config.name };
       }
       console.log(`[Groove:Tunnel] ${config.name}: existing tunnel is not responding — rebuilding`);
+      // Reuse the dead tunnel's port so any GUI window pointed at it heals.
+      opts = { ...opts, preferredPort: opts.preferredPort || existing.localPort };
       await this.disconnect(id);
     }
 
@@ -328,7 +410,14 @@ export class TunnelManager {
     // Establish SSH tunnel
     this.daemon.broadcast({ type: 'tunnel.status', data: { id, step: 'connecting' } });
 
-    const localPort = await this._findAvailablePort();
+    // A rebuild wants its old port back: the remote GUI window is pointed at it
+    // and will self-heal over WebSocket retry only if the port stays the same.
+    let localPort;
+    if (opts.preferredPort && !(await this._isPortInUse(opts.preferredPort))) {
+      localPort = opts.preferredPort;
+    } else {
+      localPort = await this._findAvailablePort();
+    }
     const target = `${config.user}@${config.host}`;
     const keyArgs = config.sshKeyPath ? ['-i', config.sshKeyPath] : [];
 
@@ -391,6 +480,7 @@ export class TunnelManager {
       healthy: true,
       failCount: 0,
     });
+    this._saveActive();
 
     // Verify daemon is reachable through tunnel, start if needed
     let remoteAlive = false;
@@ -445,7 +535,7 @@ export class TunnelManager {
   // Does the tunnel actually serve a request, as opposed to merely holding an
   // open listening socket? A wedged forward passes a TCP connect test but never
   // answers, so only an HTTP round-trip proves it.
-  async _tunnelResponds(localPort, timeoutMs = HEALTH_TIMEOUT) {
+  async _tunnelResponds(localPort, timeoutMs = this.healthTimeout ?? HEALTH_TIMEOUT) {
     try {
       const res = await fetch(`http://localhost:${localPort}/api/health`, {
         signal: AbortSignal.timeout(timeoutMs),
@@ -481,6 +571,7 @@ export class TunnelManager {
     if (localPort) await this._waitForPortFree(localPort, 3000);
 
     this.active.delete(id);
+    this._saveActive();
 
     const config = this.saved.get(id);
     this.daemon.audit.log('tunnel.disconnect', { id, name: config?.name });
@@ -915,22 +1006,26 @@ export class TunnelManager {
 
   async _healthCheckPass() {
     // Timers don't fire while the machine is asleep, so an interval that should
-    // have run every HEALTH_INTERVAL arriving far later means we just woke up.
-    // Every tunnel is suspect at that point: verify them now rather than waiting
-    // for MAX_FAIL_COUNT normal cycles to notice.
+    // have run every HEALTH_INTERVAL arriving far later means we PROBABLY just
+    // woke up — but not certainly: this daemon also blocks its event loop for
+    // long stretches (execFileSync ssh calls in test/upgrade paths), which
+    // produces the same gap on a machine that never slept. So a gap only makes
+    // tunnels *suspect* — it fast-tracks them to the confirmation ladder below.
+    // It must never lower the bar for killing one (that misdiagnosis dropped a
+    // healthy DGX tunnel twice in ten minutes).
     const now = Date.now();
     const gap = now - (this._lastHealthCheck || now);
     this._lastHealthCheck = now;
-    const wokeFromSleep = gap > HEALTH_INTERVAL * 3;
-    if (wokeFromSleep && this.active.size > 0) {
-      console.log(`[Groove:Tunnel] Detected a ${Math.round(gap / 1000)}s gap (system sleep) — verifying tunnels`);
+    const suspectAll = gap > HEALTH_INTERVAL * 3;
+    if (suspectAll && this.active.size > 0) {
+      console.log(`[Groove:Tunnel] ${Math.round(gap / 1000)}s timer gap (sleep or blocked loop) — verifying tunnels`);
     }
 
     for (const [id, conn] of this.active) {
       try {
         const start = Date.now();
         const res = await fetch(`http://localhost:${conn.localPort}/api/health`, {
-          signal: AbortSignal.timeout(HEALTH_TIMEOUT),
+          signal: AbortSignal.timeout(this.healthTimeout ?? HEALTH_TIMEOUT),
         });
         if (res.ok) {
           conn.latencyMs = Date.now() - start;
@@ -942,22 +1037,35 @@ export class TunnelManager {
         }
       } catch {
         conn.failCount = (conn.failCount || 0) + 1;
-        // After a sleep gap, one failure is enough — the tunnel was almost
-        // certainly cut with the network.
-        const limit = wokeFromSleep ? 1 : MAX_FAIL_COUNT;
-        if (conn.failCount >= limit) {
-          conn.healthy = false;
-          this.daemon.broadcast({ type: 'tunnel.unhealthy', data: { id } });
-
-          // Reap it. Previously a dead tunnel was only FLAGGED, so it stayed in
-          // `active` indefinitely and every later connect() handed back its dead
-          // port — the reason reconnecting never helped and only a full restart
-          // did. Removing it means the next connect() builds a real tunnel.
-          if (conn.failCount >= limit + 1) {
-            console.log(`[Groove:Tunnel] Reaping dead tunnel ${id} after ${conn.failCount} failed checks`);
-            this.daemon.broadcast({ type: 'tunnel.status', data: { id, step: 'reaping' } });
-            await this.disconnect(id);
-            continue;
+        // A failed 5s probe is WEAK evidence: it can't distinguish a dead
+        // tunnel from a remote daemon that's briefly busy or our own blocked
+        // event loop. Never kill on it. Once failures accumulate (or a timer
+        // gap makes everything suspect), run the confirmation ladder, which
+        // can — a healthy verdict there resets the count.
+        if (conn.failCount >= MAX_FAIL_COUNT || suspectAll) {
+          const verdict = await this._confirmDead(conn);
+          if (verdict === 'alive') {
+            conn.failCount = 0;
+            conn.healthy = true;
+            conn._wedgedStreak = 0;
+          } else if (verdict === 'remote-down') {
+            // The tunnel is carrying traffic correctly — the far daemon is what
+            // died (typically mid-upgrade). Rebuild would be useless; start it.
+            conn.healthy = false;
+            this.daemon.broadcast({ type: 'tunnel.unhealthy', data: { id } });
+            await this._startRemoteDaemon(id, conn);
+          } else {
+            conn.healthy = false;
+            this.daemon.broadcast({ type: 'tunnel.unhealthy', data: { id } });
+            // 'wedged' (port accepts, HTTP silent even at long timeout) is the
+            // one verdict with a false-positive path — a remote event loop
+            // blocked 15s+ — so demand it twice in a row. proc-dead/port-dead
+            // are unambiguous: the ssh client is gone or nothing is listening.
+            conn._wedgedStreak = verdict === 'wedged' ? (conn._wedgedStreak || 0) + 1 : 0;
+            if (verdict !== 'wedged' || conn._wedgedStreak >= 2) {
+              await this._reapAndRebuild(id, conn, verdict);
+              continue;
+            }
           }
         }
       }
@@ -968,6 +1076,103 @@ export class TunnelManager {
     }
   }
 
+  // Escalating evidence that a tunnel is actually dead, not merely slow:
+  //   'alive'       — answered a long-timeout HTTP probe; leave it alone
+  //   'proc-dead'   — the ssh client process is gone
+  //   'port-dead'   — nothing is listening on the local port
+  //   'remote-down' — the tunnel forwards fine but the REMOTE end refuses:
+  //                   the probe fails fast with a connection error, not a
+  //                   timeout. Killing the tunnel won't fix that — the remote
+  //                   daemon needs starting (e.g. it died during an upgrade).
+  //   'wedged'      — port accepts TCP but HTTP hangs to timeout (dead forward)
+  async _confirmDead(conn) {
+    const started = Date.now();
+    let probeErr = null;
+    try {
+      const res = await fetch(`http://localhost:${conn.localPort}/api/health`, {
+        signal: AbortSignal.timeout(this.confirmTimeout ?? CONFIRM_TIMEOUT),
+      });
+      if (res.ok) return 'alive';
+    } catch (err) { probeErr = err; }
+
+    if (conn.pid) {
+      try { process.kill(conn.pid, 0); } catch { return 'proc-dead'; }
+    }
+    if (!(await this._isPortInUse(conn.localPort))) return 'port-dead';
+
+    // ssh is alive and its port listens. A hang (timeout) means the forward is
+    // dead; a FAST connection-level error means ssh relayed the remote side's
+    // refusal — the tunnel works, the far daemon doesn't.
+    const failedFast = Date.now() - started < 2000;
+    const timedOut = probeErr && (probeErr.name === 'TimeoutError' || probeErr.name === 'AbortError');
+    if (failedFast && !timedOut) return 'remote-down';
+    return 'wedged';
+  }
+
+  // The tunnel is healthy; the daemon on the far side is what's down. Start it
+  // over ssh rather than pointlessly rebuilding the tunnel. Rate-limited: if
+  // the remote daemon won't stay up, repeated starts won't save it.
+  async _startRemoteDaemon(id, conn) {
+    this._remoteStartAt = this._remoteStartAt || new Map();
+    const last = this._remoteStartAt.get(id) || 0;
+    if (Date.now() - last < REMOTE_START_COOLDOWN_MS) return;
+    this._remoteStartAt.set(id, Date.now());
+
+    console.log(`[Groove:Tunnel] ${id}: tunnel is fine but the remote daemon is down — starting it`);
+    this.daemon.audit.log('tunnel.remote-daemon-start', { id });
+    this.daemon.broadcast({ type: 'tunnel.status', data: { id, step: 'starting' } });
+    try {
+      await this.autoStart(id);
+      // Confirm it came up; a success resets the failure counters immediately
+      // instead of waiting out another health cycle.
+      for (let i = 0; i < 10; i++) {
+        await new Promise((r) => setTimeout(r, 2000));
+        if (await this._tunnelResponds(conn.localPort)) {
+          conn.failCount = 0;
+          conn.healthy = true;
+          conn._wedgedStreak = 0;
+          console.log(`[Groove:Tunnel] ${id}: remote daemon is back`);
+          this.daemon.broadcast({ type: 'tunnel.health', data: { id, latencyMs: conn.latencyMs, healthy: true } });
+          return;
+        }
+      }
+      console.warn(`[Groove:Tunnel] ${id}: remote daemon did not come back after start`);
+    } catch (err) {
+      console.warn(`[Groove:Tunnel] ${id}: could not start remote daemon: ${err.message}`);
+    }
+  }
+
+  // Tear down a confirmed-dead tunnel and immediately rebuild it on the SAME
+  // local port. The remote GUI window points at that port and its WebSocket
+  // retries every 2s, so a same-port rebuild heals an open window without the
+  // user noticing. Only if the rebuild fails does this surface as a disconnect.
+  // Rate-limited so a genuinely dead host degrades to disconnected instead of
+  // thrashing reconnect attempts forever.
+  async _reapAndRebuild(id, conn, reason) {
+    const { localPort } = conn;
+    console.log(`[Groove:Tunnel] Tunnel ${id} confirmed dead (${reason}) — rebuilding`);
+    this.daemon.audit.log('tunnel.reap', { id, reason, failCount: conn.failCount });
+    await this.disconnect(id);
+
+    const lastRebuild = this._rebuildAt?.get(id) || 0;
+    if (Date.now() - lastRebuild < REBUILD_COOLDOWN_MS) {
+      console.log(`[Groove:Tunnel] ${id} already auto-rebuilt recently — leaving disconnected`);
+      return;
+    }
+    this._rebuildAt = this._rebuildAt || new Map();
+    this._rebuildAt.set(id, Date.now());
+
+    try {
+      this.daemon.broadcast({ type: 'tunnel.status', data: { id, step: 'reconnecting' } });
+      await this.connect(id, { preferredPort: localPort });
+      console.log(`[Groove:Tunnel] ${id} rebuilt on port ${localPort}`);
+    } catch (err) {
+      console.warn(`[Groove:Tunnel] Auto-rebuild of ${id} failed: ${err.message}`);
+      // disconnect() above already broadcast tunnel.disconnected — the GUI is
+      // consistent; the user can reconnect manually when the host is back.
+    }
+  }
+
   // Signal 0 only tests for existence — no signal is delivered.
   async _waitForExit(pid, timeoutMs) {
     const deadline = Date.now() + timeoutMs;
@@ -1004,25 +1209,17 @@ export class TunnelManager {
     throw new Error(`No available local port found (tried ${DEFAULT_LOCAL_PORT}-${DEFAULT_LOCAL_PORT + MAX_PORT_ATTEMPTS - 1})`);
   }
 
+  // Deliberately does NOT kill the ssh processes. They are spawned detached and
+  // are the user's live sessions: killing them on every daemon restart (app
+  // upgrade, promote, crash) is what nuked remote windows mid-session. State is
+  // persisted; the next daemon re-adopts whatever is still alive and serving.
+  // Explicit disconnect()/delete() remain the paths that actually kill a tunnel.
   shutdown() {
     if (this._healthInterval) {
       clearInterval(this._healthInterval);
       this._healthInterval = null;
     }
-    for (const [id] of this.active) {
-      try {
-        const conn = this.active.get(id);
-        if (conn?.pid) {
-          const cmd = execFileSync('ps', ['-p', String(conn.pid), '-o', 'command='], {
-            encoding: 'utf8',
-            timeout: 3000,
-          }).trim();
-          if (cmd.includes('ssh')) {
-            process.kill(conn.pid, 'SIGTERM');
-          }
-        }
-      } catch { /* ignore */ }
-    }
+    this._saveActive();
     this.active.clear();
   }
 }

package/node_modules/@groove-dev/daemon/test/tunnel-manager.test.js

@@ -10,7 +10,7 @@
 
 import { describe, it, beforeEach, afterEach } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, rmSync } from 'fs';
+import { mkdtempSync, rmSync, readFileSync, existsSync } from 'fs';
 import { tmpdir } from 'os';
 import { resolve } from 'path';
 import { createServer } from 'net';
@@ -66,6 +66,10 @@ describe('TunnelManager — wake-from-sleep recovery', () => {
     grooveDir = mkdtempSync(resolve(tmpdir(), 'groove-tunnel-'));
     daemon = makeDaemon(grooveDir);
     mgr = new TunnelManager(daemon);
+    // Shrink probe timeouts (production: 5s routine / 15s confirm) so the
+    // wedged-listener tests don't burn real minutes waiting them out.
+    mgr.healthTimeout = 400;
+    mgr.confirmTimeout = 1200;
   });
 
   afterEach(() => {
@@ -84,7 +88,7 @@ describe('TunnelManager — wake-from-sleep recovery', () => {
   it('_tunnelResponds rejects a tunnel that accepts but never answers', async () => {
     const wedged = await startWedgedListener();
     try {
-      assert.equal(await mgr._tunnelResponds(wedged.port, 1500), false);
+      assert.equal(await mgr._tunnelResponds(wedged.port, 800), false);
     } finally { wedged.close(); }
   });
 
@@ -132,19 +136,25 @@ describe('TunnelManager — wake-from-sleep recovery', () => {
     } finally { live.close(); }
   });
 
-  it('the health pass reaps a dead tunnel so the next connect starts clean', async () => {
+  it('the health pass reaps a proc-dead tunnel and tries to rebuild it', async () => {
     const wedged = await startWedgedListener();
     try {
       mgr.saved.set('s19', { id: 's19', name: 'S19 Agency', host: 'example.invalid', user: 'ops', port: 22 });
       mgr.active.set('s19', {
-        pid: 999999, localPort: wedged.port, healthy: true,
+        pid: 999999, // no such process → verdict 'proc-dead', reap on first confirm
+        localPort: wedged.port, healthy: true,
         failCount: 99, // already past the failure limit
         startedAt: new Date().toISOString(),
       });
 
+      const rebuilds = [];
+      mgr.connect = async (id, opts) => { rebuilds.push({ id, opts }); throw new Error('host unreachable'); };
+
       await mgr._healthCheckAll();
 
       assert.equal(mgr.active.has('s19'), false, 'dead tunnel removed from active');
+      assert.equal(rebuilds.length, 1, 'an automatic rebuild was attempted');
+      assert.equal(rebuilds[0].opts.preferredPort, wedged.port, 'rebuild asks for the same port');
       assert.ok(
         daemon.broadcasts.some((b) => b.type === 'tunnel.unhealthy'),
         'the GUI is told the tunnel went unhealthy',
@@ -152,24 +162,182 @@ describe('TunnelManager — wake-from-sleep recovery', () => {
     } finally { wedged.close(); }
   });
 
-  it('treats a long timer gap as a sleep and drops the failure tolerance', async () => {
+  it('a slow-but-alive tunnel is never reaped — the long confirm probe clears it', async () => {
+    // Answers /api/health slower than the routine probe allows but inside the
+    // confirmation window. This is a busy DGX, not a dead tunnel.
+    const sockets = [];
+    const slow = createServer((sock) => {
+      sockets.push(sock);
+      sock.on('data', () => setTimeout(() => {
+        const body = '{"ok":true}';
+        try {
+          sock.end('HTTP/1.1 200 OK\r\nContent-Type: application/json\r\n'
+            + `Content-Length: ${body.length}\r\nConnection: close\r\n\r\n${body}`);
+        } catch { /* closed */ }
+      }, 700));
+    });
+    await new Promise((r) => slow.listen(0, '127.0.0.1', r));
+    const port = slow.address().port;
+    try {
+      mgr.saved.set('dgx', { id: 'dgx', name: 'Axom Spark', host: 'edgexpert.local', user: 'rok', port: 22 });
+      mgr.active.set('dgx', {
+        pid: process.pid, // definitely alive
+        localPort: port, healthy: true, failCount: 99,
+        startedAt: new Date().toISOString(),
+      });
+
+      mgr.connect = async () => { throw new Error('rebuild must not be attempted'); };
+      await mgr._healthCheckAll();
+
+      const conn = mgr.active.get('dgx');
+      assert.ok(conn, 'the tunnel survived');
+      assert.equal(conn.healthy, true, 'confirmed alive by the long probe');
+      assert.equal(conn.failCount, 0, 'failure count reset');
+    } finally {
+      for (const s of sockets) s.destroy();
+      slow.close();
+    }
+  });
+
+  it('a wedged tunnel needs two consecutive confirmations before it is reaped', { timeout: 30000 }, async () => {
     const wedged = await startWedgedListener();
     try {
       mgr.saved.set('s19', { id: 's19', name: 'S19 Agency', host: 'example.invalid', user: 'ops', port: 22 });
       mgr.active.set('s19', {
-        pid: 999999, localPort: wedged.port, healthy: true, failCount: 0,
+        pid: process.pid, // ssh "alive" → verdict is 'wedged', not 'proc-dead'
+        localPort: wedged.port, healthy: true, failCount: 99,
         startedAt: new Date().toISOString(),
       });
+      mgr.connect = async () => { throw new Error('unreachable'); };
 
-      // Last check was 10 minutes ago — the machine was asleep.
-      mgr._lastHealthCheck = Date.now() - 10 * 60 * 1000;
       await mgr._healthCheckAll();
+      assert.equal(mgr.active.has('s19'), true, 'first wedged verdict only flags it');
+      assert.equal(mgr.active.get('s19').healthy, false);
 
-      const conn = mgr.active.get('s19');
-      assert.equal(conn?.healthy, false, 'one failure after a sleep gap is enough');
+      mgr.active.get('s19').failCount = 99; // still failing next tick
+      await mgr._healthCheckAll();
+      assert.equal(mgr.active.has('s19'), false, 'second wedged verdict reaps it');
     } finally { wedged.close(); }
   });
 
+  it('a timer gap fast-tracks confirmation but cannot kill a live tunnel', async () => {
+    const live = await startHealthyListener();
+    try {
+      mgr.saved.set('dgx', { id: 'dgx', name: 'Axom Spark', host: 'edgexpert.local', user: 'rok', port: 22 });
+      mgr.active.set('dgx', {
+        pid: process.pid, localPort: live.port, healthy: true, failCount: 0,
+        startedAt: new Date().toISOString(),
+      });
+
+      // 10-minute gap: sleep — or just a blocked event loop on a busy daemon.
+      mgr._lastHealthCheck = Date.now() - 10 * 60 * 1000;
+      mgr.connect = async () => { throw new Error('rebuild must not be attempted'); };
+      await mgr._healthCheckAll();
+
+      const conn = mgr.active.get('dgx');
+      assert.ok(conn, 'live tunnel survived the suspicious gap');
+      assert.equal(conn.healthy, true);
+    } finally { live.close(); }
+  });
+
+  it('remote-down (fast refusal through a live tunnel) starts the daemon, not a rebuild', async () => {
+    // ssh alive + port listens + connections REFUSED at the far end: ssh relays
+    // the refusal as an immediate close, so the probe fails fast rather than
+    // hanging. The tunnel is fine; only the remote daemon needs starting.
+    const refusing = createServer((sock) => sock.destroy());
+    await new Promise((r) => refusing.listen(0, '127.0.0.1', r));
+    const port = refusing.address().port;
+    try {
+      mgr.saved.set('dgx', { id: 'dgx', name: 'Axom Spark', host: 'edgexpert.local', user: 'axom', port: 22 });
+      mgr.active.set('dgx', {
+        pid: process.pid, localPort: port, healthy: true, failCount: 99,
+        startedAt: new Date().toISOString(),
+      });
+
+      const started = [];
+      mgr.autoStart = async (id) => { started.push(id); };
+      mgr.connect = async () => { throw new Error('rebuild must not be attempted'); };
+
+      await mgr._healthCheckAll();
+
+      assert.deepEqual(started, ['dgx'], 'the remote daemon was started over ssh');
+      assert.equal(mgr.active.has('dgx'), true, 'the healthy tunnel was NOT torn down');
+    } finally { refusing.close(); }
+  });
+
+  it('re-adopts a surviving tunnel after a daemon restart instead of forgetting it', async () => {
+    const live = await startHealthyListener();
+    try {
+      mgr.saved.set('s19', { id: 's19', name: 'S19 Agency', host: '3.22.211.238', user: 'ubuntu', port: 22 });
+      mgr._save(); // the new daemon loads configs from disk
+      mgr.active.set('s19', {
+        pid: process.pid, localPort: live.port,
+        startedAt: new Date().toISOString(), healthy: true, failCount: 0,
+      });
+      mgr._saveActive();
+      mgr.shutdown(); // daemon going down — must NOT kill the tunnel
+
+      // "New daemon" after restart. The stand-in pid is node, not ssh, so the
+      // identity gate is stubbed — everything else runs for real.
+      const daemon2 = makeDaemon(grooveDir);
+      const mgr2 = new TunnelManager(daemon2);
+      mgr2.healthTimeout = 400;
+      mgr2._looksLikeOurSsh = (pid, port) => pid === process.pid && port === live.port;
+
+      await mgr2._readopt();
+
+      assert.equal(mgr2.active.has('s19'), true, 'the surviving tunnel was re-adopted');
+      assert.equal(mgr2.active.get('s19').localPort, live.port, 'on its original port');
+      assert.ok(
+        daemon2.broadcasts.some((b) => b.type === 'tunnel.connected'),
+        'the GUI is told the tunnel is (still) connected',
+      );
+      mgr2.shutdown();
+    } finally { live.close(); }
+  });
+
+  it('does not re-adopt a dead or hijacked pid', async () => {
+    const live = await startHealthyListener();
+    try {
+      mgr.saved.set('s19', { id: 's19', name: 'S19 Agency', host: '3.22.211.238', user: 'ubuntu', port: 22 });
+      mgr._save();
+      mgr.active.set('s19', {
+        pid: 999999, localPort: live.port, // no such process
+        startedAt: new Date().toISOString(), healthy: true, failCount: 0,
+      });
+      mgr._saveActive();
+      mgr.shutdown();
+
+      const daemon2 = makeDaemon(grooveDir);
+      const mgr2 = new TunnelManager(daemon2);
+      mgr2.healthTimeout = 400;
+      await mgr2._readopt();
+
+      assert.equal(mgr2.active.has('s19'), false, 'a dead pid is not adopted');
+      mgr2.shutdown();
+    } finally { live.close(); }
+  });
+
+  it('shutdown persists state and does not kill the tunnel process', async () => {
+    const live = await startHealthyListener();
+    try {
+      mgr.saved.set('s19', { id: 's19', name: 'S19', host: 'x', user: 'u', port: 22 });
+      mgr.active.set('s19', {
+        pid: process.pid, localPort: live.port,
+        startedAt: new Date().toISOString(), healthy: true, failCount: 0,
+      });
+      mgr.shutdown();
+
+      // Our stand-in "tunnel process" (this test runner) must still be alive —
+      // shutdown killing it would have killed the test.
+      assert.doesNotThrow(() => process.kill(process.pid, 0));
+      const persisted = JSON.parse(readFileSync(resolve(grooveDir, 'tunnels-active.json'), 'utf8'));
+      assert.equal(persisted.length, 1);
+      assert.equal(persisted[0].id, 's19');
+      assert.equal(persisted[0].localPort, live.port);
+    } finally { live.close(); }
+  });
+
   it('_waitForPortFree reports a released port', async () => {
     const live = await startHealthyListener();
     assert.equal(await mgr._waitForPortFree(live.port, 600), false, 'still held while listening');

package/node_modules/@groove-dev/gui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/gui",
-  "version": "0.27.212",
+  "version": "0.27.214",
   "description": "GROOVE GUI — visual agent control plane",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "groove-dev",
-  "version": "0.27.212",
+  "version": "0.27.214",
   "description": "Open-source agent orchestration layer — the AI company OS. Local model agent engine (GGUF/Ollama/llama-server), HuggingFace model browser, MCP integrations (Slack, Gmail, Stripe, 15+), agent scheduling (cron), business roles (CMO, CFO, EA). GUI dashboard, multi-agent coordination, zero cold-start, infinite sessions. Works with Claude Code, Codex, Gemini CLI, Ollama, any local model.",
   "license": "FSL-1.1-Apache-2.0",
   "author": "Groove Dev <hello@groovedev.ai> (https://groovedev.ai)",

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/cli",
-  "version": "0.27.212",
+  "version": "0.27.214",
   "description": "GROOVE CLI — manage AI coding agents from your terminal",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/packages/daemon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/daemon",
-  "version": "0.27.212",
+  "version": "0.27.214",
   "description": "GROOVE daemon — agent orchestration engine",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/packages/daemon/src/tunnel-manager.js

@@ -20,6 +20,16 @@ const MAX_PORT_ATTEMPTS = 10;
 const HEALTH_INTERVAL = 30000;
 const HEALTH_TIMEOUT = 5000;
 const MAX_FAIL_COUNT = 3;
+// Long-timeout probe used to CONFIRM death before killing a tunnel — a busy
+// remote daemon can sit on /api/health well past the 5s routine probe.
+const CONFIRM_TIMEOUT = 15000;
+// At most one automatic rebuild per tunnel per window; beyond that it stays
+// disconnected rather than thrashing against a host that keeps dying.
+const REBUILD_COOLDOWN_MS = 10 * 60 * 1000;
+// Restarting a crashed REMOTE daemon is cheaper and safer than a rebuild, so
+// its cooldown is shorter — but still bounded: a daemon that dies right after
+// every start has a real problem more starts won't fix.
+const REMOTE_START_COOLDOWN_MS = 2 * 60 * 1000;
 
 const INJECTION_CHARS = /[;|&`$(){}[\]<>!#\n\r\\]/;
 
@@ -54,6 +64,10 @@ export class TunnelManager {
   constructor(daemon) {
     this.daemon = daemon;
     this.remotesPath = resolve(daemon.grooveDir, 'remotes.json');
+    // Live tunnel state, persisted separately from the configs so a daemon
+    // restart can re-adopt still-running ssh processes instead of forgetting
+    // them (the configs file is user data; this is runtime state).
+    this.activePath = resolve(daemon.grooveDir, 'tunnels-active.json');
     this.saved = new Map();
     this.active = new Map();
     this._healthInterval = null;
@@ -82,8 +96,9 @@ export class TunnelManager {
   }
 
   async init() {
+    await this._readopt();
     for (const [id, config] of this.saved) {
-      if (config.autoConnect) {
+      if (config.autoConnect && !this.active.has(id)) {
         try {
           await this.connect(id);
         } catch (err) {
@@ -93,6 +108,71 @@ export class TunnelManager {
     }
   }
 
+  // Re-adopt tunnels whose detached ssh processes survived a daemon restart.
+  // Without this, every daemon/app restart orphaned the ssh (or shutdown killed
+  // it) and the new daemon started amnesiac — remote windows died mid-session
+  // and the user had to reconnect everything by hand.
+  async _readopt() {
+    let entries = [];
+    try {
+      if (existsSync(this.activePath)) entries = JSON.parse(readFileSync(this.activePath, 'utf8'));
+    } catch { /* corrupt — treat as none */ }
+    if (!Array.isArray(entries) || entries.length === 0) return;
+
+    let adopted = 0;
+    for (const e of entries) {
+      if (!e?.id || !e.pid || !e.localPort || !this.saved.has(e.id)) continue;
+      // Only re-adopt what is provably OUR ssh still doing THIS job: the pid
+      // must be alive, be an ssh process forwarding this port, and the port
+      // must serve HTTP.
+      let alive = false;
+      try { process.kill(e.pid, 0); alive = true; } catch { /* gone */ }
+      if (alive) alive = this._looksLikeOurSsh(e.pid, e.localPort);
+      if (alive && await this._tunnelResponds(e.localPort)) {
+        this.active.set(e.id, {
+          pid: e.pid,
+          localPort: e.localPort,
+          startedAt: e.startedAt || new Date().toISOString(),
+          lastPing: Date.now(),
+          latencyMs: null,
+          healthy: true,
+          failCount: 0,
+        });
+        adopted++;
+        const name = this.saved.get(e.id)?.name || e.id;
+        console.log(`[Groove:Tunnel] Re-adopted live tunnel to ${name} on port ${e.localPort}`);
+        this.daemon.broadcast({ type: 'tunnel.connected', data: { id: e.id, name, localPort: e.localPort, host: this.saved.get(e.id)?.host, url: `http://localhost:${e.localPort}?instance=${encodeURIComponent(name)}` } });
+      } else if (alive) {
+        // ssh survives but doesn't serve — a corpse from before the restart.
+        try { process.kill(e.pid, 'SIGTERM'); } catch { /* gone */ }
+      }
+    }
+    if (adopted > 0 && !this._healthInterval) {
+      this._healthInterval = setInterval(() => this._healthCheckAll(), HEALTH_INTERVAL);
+    }
+    this._saveActive();
+  }
+
+  // Identity check for re-adoption: is this pid an ssh forwarding this port?
+  // Guards against pid recycling handing us an unrelated process.
+  _looksLikeOurSsh(pid, localPort) {
+    try {
+      const cmd = execFileSync('ps', ['-p', String(pid), '-o', 'command='], {
+        encoding: 'utf8', timeout: 3000,
+      }).trim();
+      return cmd.includes('ssh') && cmd.includes(String(localPort));
+    } catch { return false; }
+  }
+
+  _saveActive() {
+    try {
+      const entries = [...this.active.entries()].map(([id, c]) => ({
+        id, pid: c.pid, localPort: c.localPort, startedAt: c.startedAt,
+      }));
+      writeFileSync(this.activePath, JSON.stringify(entries, null, 2), { mode: 0o600 });
+    } catch { /* best effort */ }
+  }
+
   getSaved() {
     return Array.from(this.saved.values()).map(s => ({
       ...this._sanitize(s),
@@ -295,6 +375,8 @@ export class TunnelManager {
         return { localPort: existing.localPort, pid: existing.pid, name: config.name };
       }
       console.log(`[Groove:Tunnel] ${config.name}: existing tunnel is not responding — rebuilding`);
+      // Reuse the dead tunnel's port so any GUI window pointed at it heals.
+      opts = { ...opts, preferredPort: opts.preferredPort || existing.localPort };
       await this.disconnect(id);
     }
 
@@ -328,7 +410,14 @@ export class TunnelManager {
     // Establish SSH tunnel
     this.daemon.broadcast({ type: 'tunnel.status', data: { id, step: 'connecting' } });
 
-    const localPort = await this._findAvailablePort();
+    // A rebuild wants its old port back: the remote GUI window is pointed at it
+    // and will self-heal over WebSocket retry only if the port stays the same.
+    let localPort;
+    if (opts.preferredPort && !(await this._isPortInUse(opts.preferredPort))) {
+      localPort = opts.preferredPort;
+    } else {
+      localPort = await this._findAvailablePort();
+    }
     const target = `${config.user}@${config.host}`;
     const keyArgs = config.sshKeyPath ? ['-i', config.sshKeyPath] : [];
 
@@ -391,6 +480,7 @@ export class TunnelManager {
       healthy: true,
       failCount: 0,
     });
+    this._saveActive();
 
     // Verify daemon is reachable through tunnel, start if needed
     let remoteAlive = false;
@@ -445,7 +535,7 @@ export class TunnelManager {
   // Does the tunnel actually serve a request, as opposed to merely holding an
   // open listening socket? A wedged forward passes a TCP connect test but never
   // answers, so only an HTTP round-trip proves it.
-  async _tunnelResponds(localPort, timeoutMs = HEALTH_TIMEOUT) {
+  async _tunnelResponds(localPort, timeoutMs = this.healthTimeout ?? HEALTH_TIMEOUT) {
     try {
       const res = await fetch(`http://localhost:${localPort}/api/health`, {
         signal: AbortSignal.timeout(timeoutMs),
@@ -481,6 +571,7 @@ export class TunnelManager {
     if (localPort) await this._waitForPortFree(localPort, 3000);
 
     this.active.delete(id);
+    this._saveActive();
 
     const config = this.saved.get(id);
     this.daemon.audit.log('tunnel.disconnect', { id, name: config?.name });
@@ -915,22 +1006,26 @@ export class TunnelManager {
 
   async _healthCheckPass() {
     // Timers don't fire while the machine is asleep, so an interval that should
-    // have run every HEALTH_INTERVAL arriving far later means we just woke up.
-    // Every tunnel is suspect at that point: verify them now rather than waiting
-    // for MAX_FAIL_COUNT normal cycles to notice.
+    // have run every HEALTH_INTERVAL arriving far later means we PROBABLY just
+    // woke up — but not certainly: this daemon also blocks its event loop for
+    // long stretches (execFileSync ssh calls in test/upgrade paths), which
+    // produces the same gap on a machine that never slept. So a gap only makes
+    // tunnels *suspect* — it fast-tracks them to the confirmation ladder below.
+    // It must never lower the bar for killing one (that misdiagnosis dropped a
+    // healthy DGX tunnel twice in ten minutes).
     const now = Date.now();
     const gap = now - (this._lastHealthCheck || now);
     this._lastHealthCheck = now;
-    const wokeFromSleep = gap > HEALTH_INTERVAL * 3;
-    if (wokeFromSleep && this.active.size > 0) {
-      console.log(`[Groove:Tunnel] Detected a ${Math.round(gap / 1000)}s gap (system sleep) — verifying tunnels`);
+    const suspectAll = gap > HEALTH_INTERVAL * 3;
+    if (suspectAll && this.active.size > 0) {
+      console.log(`[Groove:Tunnel] ${Math.round(gap / 1000)}s timer gap (sleep or blocked loop) — verifying tunnels`);
     }
 
     for (const [id, conn] of this.active) {
       try {
         const start = Date.now();
         const res = await fetch(`http://localhost:${conn.localPort}/api/health`, {
-          signal: AbortSignal.timeout(HEALTH_TIMEOUT),
+          signal: AbortSignal.timeout(this.healthTimeout ?? HEALTH_TIMEOUT),
         });
         if (res.ok) {
           conn.latencyMs = Date.now() - start;
@@ -942,22 +1037,35 @@ export class TunnelManager {
         }
       } catch {
         conn.failCount = (conn.failCount || 0) + 1;
-        // After a sleep gap, one failure is enough — the tunnel was almost
-        // certainly cut with the network.
-        const limit = wokeFromSleep ? 1 : MAX_FAIL_COUNT;
-        if (conn.failCount >= limit) {
-          conn.healthy = false;
-          this.daemon.broadcast({ type: 'tunnel.unhealthy', data: { id } });
-
-          // Reap it. Previously a dead tunnel was only FLAGGED, so it stayed in
-          // `active` indefinitely and every later connect() handed back its dead
-          // port — the reason reconnecting never helped and only a full restart
-          // did. Removing it means the next connect() builds a real tunnel.
-          if (conn.failCount >= limit + 1) {
-            console.log(`[Groove:Tunnel] Reaping dead tunnel ${id} after ${conn.failCount} failed checks`);
-            this.daemon.broadcast({ type: 'tunnel.status', data: { id, step: 'reaping' } });
-            await this.disconnect(id);
-            continue;
+        // A failed 5s probe is WEAK evidence: it can't distinguish a dead
+        // tunnel from a remote daemon that's briefly busy or our own blocked
+        // event loop. Never kill on it. Once failures accumulate (or a timer
+        // gap makes everything suspect), run the confirmation ladder, which
+        // can — a healthy verdict there resets the count.
+        if (conn.failCount >= MAX_FAIL_COUNT || suspectAll) {
+          const verdict = await this._confirmDead(conn);
+          if (verdict === 'alive') {
+            conn.failCount = 0;
+            conn.healthy = true;
+            conn._wedgedStreak = 0;
+          } else if (verdict === 'remote-down') {
+            // The tunnel is carrying traffic correctly — the far daemon is what
+            // died (typically mid-upgrade). Rebuild would be useless; start it.
+            conn.healthy = false;
+            this.daemon.broadcast({ type: 'tunnel.unhealthy', data: { id } });
+            await this._startRemoteDaemon(id, conn);
+          } else {
+            conn.healthy = false;
+            this.daemon.broadcast({ type: 'tunnel.unhealthy', data: { id } });
+            // 'wedged' (port accepts, HTTP silent even at long timeout) is the
+            // one verdict with a false-positive path — a remote event loop
+            // blocked 15s+ — so demand it twice in a row. proc-dead/port-dead
+            // are unambiguous: the ssh client is gone or nothing is listening.
+            conn._wedgedStreak = verdict === 'wedged' ? (conn._wedgedStreak || 0) + 1 : 0;
+            if (verdict !== 'wedged' || conn._wedgedStreak >= 2) {
+              await this._reapAndRebuild(id, conn, verdict);
+              continue;
+            }
           }
         }
       }
@@ -968,6 +1076,103 @@ export class TunnelManager {
     }
   }
 
+  // Escalating evidence that a tunnel is actually dead, not merely slow:
+  //   'alive'       — answered a long-timeout HTTP probe; leave it alone
+  //   'proc-dead'   — the ssh client process is gone
+  //   'port-dead'   — nothing is listening on the local port
+  //   'remote-down' — the tunnel forwards fine but the REMOTE end refuses:
+  //                   the probe fails fast with a connection error, not a
+  //                   timeout. Killing the tunnel won't fix that — the remote
+  //                   daemon needs starting (e.g. it died during an upgrade).
+  //   'wedged'      — port accepts TCP but HTTP hangs to timeout (dead forward)
+  async _confirmDead(conn) {
+    const started = Date.now();
+    let probeErr = null;
+    try {
+      const res = await fetch(`http://localhost:${conn.localPort}/api/health`, {
+        signal: AbortSignal.timeout(this.confirmTimeout ?? CONFIRM_TIMEOUT),
+      });
+      if (res.ok) return 'alive';
+    } catch (err) { probeErr = err; }
+
+    if (conn.pid) {
+      try { process.kill(conn.pid, 0); } catch { return 'proc-dead'; }
+    }
+    if (!(await this._isPortInUse(conn.localPort))) return 'port-dead';
+
+    // ssh is alive and its port listens. A hang (timeout) means the forward is
+    // dead; a FAST connection-level error means ssh relayed the remote side's
+    // refusal — the tunnel works, the far daemon doesn't.
+    const failedFast = Date.now() - started < 2000;
+    const timedOut = probeErr && (probeErr.name === 'TimeoutError' || probeErr.name === 'AbortError');
+    if (failedFast && !timedOut) return 'remote-down';
+    return 'wedged';
+  }
+
+  // The tunnel is healthy; the daemon on the far side is what's down. Start it
+  // over ssh rather than pointlessly rebuilding the tunnel. Rate-limited: if
+  // the remote daemon won't stay up, repeated starts won't save it.
+  async _startRemoteDaemon(id, conn) {
+    this._remoteStartAt = this._remoteStartAt || new Map();
+    const last = this._remoteStartAt.get(id) || 0;
+    if (Date.now() - last < REMOTE_START_COOLDOWN_MS) return;
+    this._remoteStartAt.set(id, Date.now());
+
+    console.log(`[Groove:Tunnel] ${id}: tunnel is fine but the remote daemon is down — starting it`);
+    this.daemon.audit.log('tunnel.remote-daemon-start', { id });
+    this.daemon.broadcast({ type: 'tunnel.status', data: { id, step: 'starting' } });
+    try {
+      await this.autoStart(id);
+      // Confirm it came up; a success resets the failure counters immediately
+      // instead of waiting out another health cycle.
+      for (let i = 0; i < 10; i++) {
+        await new Promise((r) => setTimeout(r, 2000));
+        if (await this._tunnelResponds(conn.localPort)) {
+          conn.failCount = 0;
+          conn.healthy = true;
+          conn._wedgedStreak = 0;
+          console.log(`[Groove:Tunnel] ${id}: remote daemon is back`);
+          this.daemon.broadcast({ type: 'tunnel.health', data: { id, latencyMs: conn.latencyMs, healthy: true } });
+          return;
+        }
+      }
+      console.warn(`[Groove:Tunnel] ${id}: remote daemon did not come back after start`);
+    } catch (err) {
+      console.warn(`[Groove:Tunnel] ${id}: could not start remote daemon: ${err.message}`);
+    }
+  }
+
+  // Tear down a confirmed-dead tunnel and immediately rebuild it on the SAME
+  // local port. The remote GUI window points at that port and its WebSocket
+  // retries every 2s, so a same-port rebuild heals an open window without the
+  // user noticing. Only if the rebuild fails does this surface as a disconnect.
+  // Rate-limited so a genuinely dead host degrades to disconnected instead of
+  // thrashing reconnect attempts forever.
+  async _reapAndRebuild(id, conn, reason) {
+    const { localPort } = conn;
+    console.log(`[Groove:Tunnel] Tunnel ${id} confirmed dead (${reason}) — rebuilding`);
+    this.daemon.audit.log('tunnel.reap', { id, reason, failCount: conn.failCount });
+    await this.disconnect(id);
+
+    const lastRebuild = this._rebuildAt?.get(id) || 0;
+    if (Date.now() - lastRebuild < REBUILD_COOLDOWN_MS) {
+      console.log(`[Groove:Tunnel] ${id} already auto-rebuilt recently — leaving disconnected`);
+      return;
+    }
+    this._rebuildAt = this._rebuildAt || new Map();
+    this._rebuildAt.set(id, Date.now());
+
+    try {
+      this.daemon.broadcast({ type: 'tunnel.status', data: { id, step: 'reconnecting' } });
+      await this.connect(id, { preferredPort: localPort });
+      console.log(`[Groove:Tunnel] ${id} rebuilt on port ${localPort}`);
+    } catch (err) {
+      console.warn(`[Groove:Tunnel] Auto-rebuild of ${id} failed: ${err.message}`);
+      // disconnect() above already broadcast tunnel.disconnected — the GUI is
+      // consistent; the user can reconnect manually when the host is back.
+    }
+  }
+
   // Signal 0 only tests for existence — no signal is delivered.
   async _waitForExit(pid, timeoutMs) {
     const deadline = Date.now() + timeoutMs;
@@ -1004,25 +1209,17 @@ export class TunnelManager {
     throw new Error(`No available local port found (tried ${DEFAULT_LOCAL_PORT}-${DEFAULT_LOCAL_PORT + MAX_PORT_ATTEMPTS - 1})`);
   }
 
+  // Deliberately does NOT kill the ssh processes. They are spawned detached and
+  // are the user's live sessions: killing them on every daemon restart (app
+  // upgrade, promote, crash) is what nuked remote windows mid-session. State is
+  // persisted; the next daemon re-adopts whatever is still alive and serving.
+  // Explicit disconnect()/delete() remain the paths that actually kill a tunnel.
   shutdown() {
     if (this._healthInterval) {
       clearInterval(this._healthInterval);
       this._healthInterval = null;
     }
-    for (const [id] of this.active) {
-      try {
-        const conn = this.active.get(id);
-        if (conn?.pid) {
-          const cmd = execFileSync('ps', ['-p', String(conn.pid), '-o', 'command='], {
-            encoding: 'utf8',
-            timeout: 3000,
-          }).trim();
-          if (cmd.includes('ssh')) {
-            process.kill(conn.pid, 'SIGTERM');
-          }
-        }
-      } catch { /* ignore */ }
-    }
+    this._saveActive();
     this.active.clear();
   }
 }

package/packages/gui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/gui",
-  "version": "0.27.212",
+  "version": "0.27.214",
   "description": "GROOVE GUI — visual agent control plane",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",