groove-dev 0.27.213 → 0.27.214

package/node_modules/@groove-dev/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/cli",
-  "version": "0.27.213",
+  "version": "0.27.214",
   "description": "GROOVE CLI — manage AI coding agents from your terminal",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/node_modules/@groove-dev/daemon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/daemon",
-  "version": "0.27.213",
+  "version": "0.27.214",
   "description": "GROOVE daemon — agent orchestration engine",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/node_modules/@groove-dev/daemon/src/tunnel-manager.js

@@ -26,6 +26,10 @@ const CONFIRM_TIMEOUT = 15000;
 // At most one automatic rebuild per tunnel per window; beyond that it stays
 // disconnected rather than thrashing against a host that keeps dying.
 const REBUILD_COOLDOWN_MS = 10 * 60 * 1000;
+// Restarting a crashed REMOTE daemon is cheaper and safer than a rebuild, so
+// its cooldown is shorter — but still bounded: a daemon that dies right after
+// every start has a real problem more starts won't fix.
+const REMOTE_START_COOLDOWN_MS = 2 * 60 * 1000;
 
 const INJECTION_CHARS = /[;|&`$(){}[\]<>!#\n\r\\]/;
 
@@ -60,6 +64,10 @@ export class TunnelManager {
   constructor(daemon) {
     this.daemon = daemon;
     this.remotesPath = resolve(daemon.grooveDir, 'remotes.json');
+    // Live tunnel state, persisted separately from the configs so a daemon
+    // restart can re-adopt still-running ssh processes instead of forgetting
+    // them (the configs file is user data; this is runtime state).
+    this.activePath = resolve(daemon.grooveDir, 'tunnels-active.json');
     this.saved = new Map();
     this.active = new Map();
     this._healthInterval = null;
@@ -88,8 +96,9 @@ export class TunnelManager {
   }
 
   async init() {
+    await this._readopt();
     for (const [id, config] of this.saved) {
-      if (config.autoConnect) {
+      if (config.autoConnect && !this.active.has(id)) {
         try {
           await this.connect(id);
         } catch (err) {
@@ -99,6 +108,71 @@ export class TunnelManager {
     }
   }
 
+  // Re-adopt tunnels whose detached ssh processes survived a daemon restart.
+  // Without this, every daemon/app restart orphaned the ssh (or shutdown killed
+  // it) and the new daemon started amnesiac — remote windows died mid-session
+  // and the user had to reconnect everything by hand.
+  async _readopt() {
+    let entries = [];
+    try {
+      if (existsSync(this.activePath)) entries = JSON.parse(readFileSync(this.activePath, 'utf8'));
+    } catch { /* corrupt — treat as none */ }
+    if (!Array.isArray(entries) || entries.length === 0) return;
+
+    let adopted = 0;
+    for (const e of entries) {
+      if (!e?.id || !e.pid || !e.localPort || !this.saved.has(e.id)) continue;
+      // Only re-adopt what is provably OUR ssh still doing THIS job: the pid
+      // must be alive, be an ssh process forwarding this port, and the port
+      // must serve HTTP.
+      let alive = false;
+      try { process.kill(e.pid, 0); alive = true; } catch { /* gone */ }
+      if (alive) alive = this._looksLikeOurSsh(e.pid, e.localPort);
+      if (alive && await this._tunnelResponds(e.localPort)) {
+        this.active.set(e.id, {
+          pid: e.pid,
+          localPort: e.localPort,
+          startedAt: e.startedAt || new Date().toISOString(),
+          lastPing: Date.now(),
+          latencyMs: null,
+          healthy: true,
+          failCount: 0,
+        });
+        adopted++;
+        const name = this.saved.get(e.id)?.name || e.id;
+        console.log(`[Groove:Tunnel] Re-adopted live tunnel to ${name} on port ${e.localPort}`);
+        this.daemon.broadcast({ type: 'tunnel.connected', data: { id: e.id, name, localPort: e.localPort, host: this.saved.get(e.id)?.host, url: `http://localhost:${e.localPort}?instance=${encodeURIComponent(name)}` } });
+      } else if (alive) {
+        // ssh survives but doesn't serve — a corpse from before the restart.
+        try { process.kill(e.pid, 'SIGTERM'); } catch { /* gone */ }
+      }
+    }
+    if (adopted > 0 && !this._healthInterval) {
+      this._healthInterval = setInterval(() => this._healthCheckAll(), HEALTH_INTERVAL);
+    }
+    this._saveActive();
+  }
+
+  // Identity check for re-adoption: is this pid an ssh forwarding this port?
+  // Guards against pid recycling handing us an unrelated process.
+  _looksLikeOurSsh(pid, localPort) {
+    try {
+      const cmd = execFileSync('ps', ['-p', String(pid), '-o', 'command='], {
+        encoding: 'utf8', timeout: 3000,
+      }).trim();
+      return cmd.includes('ssh') && cmd.includes(String(localPort));
+    } catch { return false; }
+  }
+
+  _saveActive() {
+    try {
+      const entries = [...this.active.entries()].map(([id, c]) => ({
+        id, pid: c.pid, localPort: c.localPort, startedAt: c.startedAt,
+      }));
+      writeFileSync(this.activePath, JSON.stringify(entries, null, 2), { mode: 0o600 });
+    } catch { /* best effort */ }
+  }
+
   getSaved() {
     return Array.from(this.saved.values()).map(s => ({
       ...this._sanitize(s),
@@ -406,6 +480,7 @@ export class TunnelManager {
       healthy: true,
       failCount: 0,
     });
+    this._saveActive();
 
     // Verify daemon is reachable through tunnel, start if needed
     let remoteAlive = false;
@@ -496,6 +571,7 @@ export class TunnelManager {
     if (localPort) await this._waitForPortFree(localPort, 3000);
 
     this.active.delete(id);
+    this._saveActive();
 
     const config = this.saved.get(id);
     this.daemon.audit.log('tunnel.disconnect', { id, name: config?.name });
@@ -972,6 +1048,12 @@ export class TunnelManager {
             conn.failCount = 0;
             conn.healthy = true;
             conn._wedgedStreak = 0;
+          } else if (verdict === 'remote-down') {
+            // The tunnel is carrying traffic correctly — the far daemon is what
+            // died (typically mid-upgrade). Rebuild would be useless; start it.
+            conn.healthy = false;
+            this.daemon.broadcast({ type: 'tunnel.unhealthy', data: { id } });
+            await this._startRemoteDaemon(id, conn);
           } else {
             conn.healthy = false;
             this.daemon.broadcast({ type: 'tunnel.unhealthy', data: { id } });
@@ -995,19 +1077,71 @@ export class TunnelManager {
   }
 
   // Escalating evidence that a tunnel is actually dead, not merely slow:
-  //   'alive'     — answered a long-timeout HTTP probe; leave it alone
-  //   'proc-dead' — the ssh client process is gone
-  //   'port-dead' — nothing is listening on the local port
-  //   'wedged'    — port accepts TCP but HTTP never answers (dead forward)
+  //   'alive'       — answered a long-timeout HTTP probe; leave it alone
+  //   'proc-dead'   — the ssh client process is gone
+  //   'port-dead'   — nothing is listening on the local port
+  //   'remote-down' — the tunnel forwards fine but the REMOTE end refuses:
+  //                   the probe fails fast with a connection error, not a
+  //                   timeout. Killing the tunnel won't fix that — the remote
+  //                   daemon needs starting (e.g. it died during an upgrade).
+  //   'wedged'      — port accepts TCP but HTTP hangs to timeout (dead forward)
   async _confirmDead(conn) {
-    if (await this._tunnelResponds(conn.localPort, this.confirmTimeout ?? CONFIRM_TIMEOUT)) return 'alive';
+    const started = Date.now();
+    let probeErr = null;
+    try {
+      const res = await fetch(`http://localhost:${conn.localPort}/api/health`, {
+        signal: AbortSignal.timeout(this.confirmTimeout ?? CONFIRM_TIMEOUT),
+      });
+      if (res.ok) return 'alive';
+    } catch (err) { probeErr = err; }
+
     if (conn.pid) {
       try { process.kill(conn.pid, 0); } catch { return 'proc-dead'; }
     }
     if (!(await this._isPortInUse(conn.localPort))) return 'port-dead';
+
+    // ssh is alive and its port listens. A hang (timeout) means the forward is
+    // dead; a FAST connection-level error means ssh relayed the remote side's
+    // refusal — the tunnel works, the far daemon doesn't.
+    const failedFast = Date.now() - started < 2000;
+    const timedOut = probeErr && (probeErr.name === 'TimeoutError' || probeErr.name === 'AbortError');
+    if (failedFast && !timedOut) return 'remote-down';
     return 'wedged';
   }
 
+  // The tunnel is healthy; the daemon on the far side is what's down. Start it
+  // over ssh rather than pointlessly rebuilding the tunnel. Rate-limited: if
+  // the remote daemon won't stay up, repeated starts won't save it.
+  async _startRemoteDaemon(id, conn) {
+    this._remoteStartAt = this._remoteStartAt || new Map();
+    const last = this._remoteStartAt.get(id) || 0;
+    if (Date.now() - last < REMOTE_START_COOLDOWN_MS) return;
+    this._remoteStartAt.set(id, Date.now());
+
+    console.log(`[Groove:Tunnel] ${id}: tunnel is fine but the remote daemon is down — starting it`);
+    this.daemon.audit.log('tunnel.remote-daemon-start', { id });
+    this.daemon.broadcast({ type: 'tunnel.status', data: { id, step: 'starting' } });
+    try {
+      await this.autoStart(id);
+      // Confirm it came up; a success resets the failure counters immediately
+      // instead of waiting out another health cycle.
+      for (let i = 0; i < 10; i++) {
+        await new Promise((r) => setTimeout(r, 2000));
+        if (await this._tunnelResponds(conn.localPort)) {
+          conn.failCount = 0;
+          conn.healthy = true;
+          conn._wedgedStreak = 0;
+          console.log(`[Groove:Tunnel] ${id}: remote daemon is back`);
+          this.daemon.broadcast({ type: 'tunnel.health', data: { id, latencyMs: conn.latencyMs, healthy: true } });
+          return;
+        }
+      }
+      console.warn(`[Groove:Tunnel] ${id}: remote daemon did not come back after start`);
+    } catch (err) {
+      console.warn(`[Groove:Tunnel] ${id}: could not start remote daemon: ${err.message}`);
+    }
+  }
+
   // Tear down a confirmed-dead tunnel and immediately rebuild it on the SAME
   // local port. The remote GUI window points at that port and its WebSocket
   // retries every 2s, so a same-port rebuild heals an open window without the
@@ -1075,25 +1209,17 @@ export class TunnelManager {
     throw new Error(`No available local port found (tried ${DEFAULT_LOCAL_PORT}-${DEFAULT_LOCAL_PORT + MAX_PORT_ATTEMPTS - 1})`);
   }
 
+  // Deliberately does NOT kill the ssh processes. They are spawned detached and
+  // are the user's live sessions: killing them on every daemon restart (app
+  // upgrade, promote, crash) is what nuked remote windows mid-session. State is
+  // persisted; the next daemon re-adopts whatever is still alive and serving.
+  // Explicit disconnect()/delete() remain the paths that actually kill a tunnel.
   shutdown() {
     if (this._healthInterval) {
       clearInterval(this._healthInterval);
       this._healthInterval = null;
     }
-    for (const [id] of this.active) {
-      try {
-        const conn = this.active.get(id);
-        if (conn?.pid) {
-          const cmd = execFileSync('ps', ['-p', String(conn.pid), '-o', 'command='], {
-            encoding: 'utf8',
-            timeout: 3000,
-          }).trim();
-          if (cmd.includes('ssh')) {
-            process.kill(conn.pid, 'SIGTERM');
-          }
-        }
-      } catch { /* ignore */ }
-    }
+    this._saveActive();
     this.active.clear();
   }
 }

package/node_modules/@groove-dev/daemon/test/tunnel-manager.test.js

@@ -10,7 +10,7 @@
 
 import { describe, it, beforeEach, afterEach } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, rmSync } from 'fs';
+import { mkdtempSync, rmSync, readFileSync, existsSync } from 'fs';
 import { tmpdir } from 'os';
 import { resolve } from 'path';
 import { createServer } from 'net';
@@ -240,6 +240,104 @@ describe('TunnelManager — wake-from-sleep recovery', () => {
     } finally { live.close(); }
   });
 
+  it('remote-down (fast refusal through a live tunnel) starts the daemon, not a rebuild', async () => {
+    // ssh alive + port listens + connections REFUSED at the far end: ssh relays
+    // the refusal as an immediate close, so the probe fails fast rather than
+    // hanging. The tunnel is fine; only the remote daemon needs starting.
+    const refusing = createServer((sock) => sock.destroy());
+    await new Promise((r) => refusing.listen(0, '127.0.0.1', r));
+    const port = refusing.address().port;
+    try {
+      mgr.saved.set('dgx', { id: 'dgx', name: 'Axom Spark', host: 'edgexpert.local', user: 'axom', port: 22 });
+      mgr.active.set('dgx', {
+        pid: process.pid, localPort: port, healthy: true, failCount: 99,
+        startedAt: new Date().toISOString(),
+      });
+
+      const started = [];
+      mgr.autoStart = async (id) => { started.push(id); };
+      mgr.connect = async () => { throw new Error('rebuild must not be attempted'); };
+
+      await mgr._healthCheckAll();
+
+      assert.deepEqual(started, ['dgx'], 'the remote daemon was started over ssh');
+      assert.equal(mgr.active.has('dgx'), true, 'the healthy tunnel was NOT torn down');
+    } finally { refusing.close(); }
+  });
+
+  it('re-adopts a surviving tunnel after a daemon restart instead of forgetting it', async () => {
+    const live = await startHealthyListener();
+    try {
+      mgr.saved.set('s19', { id: 's19', name: 'S19 Agency', host: '3.22.211.238', user: 'ubuntu', port: 22 });
+      mgr._save(); // the new daemon loads configs from disk
+      mgr.active.set('s19', {
+        pid: process.pid, localPort: live.port,
+        startedAt: new Date().toISOString(), healthy: true, failCount: 0,
+      });
+      mgr._saveActive();
+      mgr.shutdown(); // daemon going down — must NOT kill the tunnel
+
+      // "New daemon" after restart. The stand-in pid is node, not ssh, so the
+      // identity gate is stubbed — everything else runs for real.
+      const daemon2 = makeDaemon(grooveDir);
+      const mgr2 = new TunnelManager(daemon2);
+      mgr2.healthTimeout = 400;
+      mgr2._looksLikeOurSsh = (pid, port) => pid === process.pid && port === live.port;
+
+      await mgr2._readopt();
+
+      assert.equal(mgr2.active.has('s19'), true, 'the surviving tunnel was re-adopted');
+      assert.equal(mgr2.active.get('s19').localPort, live.port, 'on its original port');
+      assert.ok(
+        daemon2.broadcasts.some((b) => b.type === 'tunnel.connected'),
+        'the GUI is told the tunnel is (still) connected',
+      );
+      mgr2.shutdown();
+    } finally { live.close(); }
+  });
+
+  it('does not re-adopt a dead or hijacked pid', async () => {
+    const live = await startHealthyListener();
+    try {
+      mgr.saved.set('s19', { id: 's19', name: 'S19 Agency', host: '3.22.211.238', user: 'ubuntu', port: 22 });
+      mgr._save();
+      mgr.active.set('s19', {
+        pid: 999999, localPort: live.port, // no such process
+        startedAt: new Date().toISOString(), healthy: true, failCount: 0,
+      });
+      mgr._saveActive();
+      mgr.shutdown();
+
+      const daemon2 = makeDaemon(grooveDir);
+      const mgr2 = new TunnelManager(daemon2);
+      mgr2.healthTimeout = 400;
+      await mgr2._readopt();
+
+      assert.equal(mgr2.active.has('s19'), false, 'a dead pid is not adopted');
+      mgr2.shutdown();
+    } finally { live.close(); }
+  });
+
+  it('shutdown persists state and does not kill the tunnel process', async () => {
+    const live = await startHealthyListener();
+    try {
+      mgr.saved.set('s19', { id: 's19', name: 'S19', host: 'x', user: 'u', port: 22 });
+      mgr.active.set('s19', {
+        pid: process.pid, localPort: live.port,
+        startedAt: new Date().toISOString(), healthy: true, failCount: 0,
+      });
+      mgr.shutdown();
+
+      // Our stand-in "tunnel process" (this test runner) must still be alive —
+      // shutdown killing it would have killed the test.
+      assert.doesNotThrow(() => process.kill(process.pid, 0));
+      const persisted = JSON.parse(readFileSync(resolve(grooveDir, 'tunnels-active.json'), 'utf8'));
+      assert.equal(persisted.length, 1);
+      assert.equal(persisted[0].id, 's19');
+      assert.equal(persisted[0].localPort, live.port);
+    } finally { live.close(); }
+  });
+
   it('_waitForPortFree reports a released port', async () => {
     const live = await startHealthyListener();
     assert.equal(await mgr._waitForPortFree(live.port, 600), false, 'still held while listening');

package/node_modules/@groove-dev/gui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/gui",
-  "version": "0.27.213",
+  "version": "0.27.214",
   "description": "GROOVE GUI — visual agent control plane",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "groove-dev",
-  "version": "0.27.213",
+  "version": "0.27.214",
   "description": "Open-source agent orchestration layer — the AI company OS. Local model agent engine (GGUF/Ollama/llama-server), HuggingFace model browser, MCP integrations (Slack, Gmail, Stripe, 15+), agent scheduling (cron), business roles (CMO, CFO, EA). GUI dashboard, multi-agent coordination, zero cold-start, infinite sessions. Works with Claude Code, Codex, Gemini CLI, Ollama, any local model.",
   "license": "FSL-1.1-Apache-2.0",
   "author": "Groove Dev <hello@groovedev.ai> (https://groovedev.ai)",

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/cli",
-  "version": "0.27.213",
+  "version": "0.27.214",
   "description": "GROOVE CLI — manage AI coding agents from your terminal",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/packages/daemon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/daemon",
-  "version": "0.27.213",
+  "version": "0.27.214",
   "description": "GROOVE daemon — agent orchestration engine",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/packages/daemon/src/tunnel-manager.js

@@ -26,6 +26,10 @@ const CONFIRM_TIMEOUT = 15000;
 // At most one automatic rebuild per tunnel per window; beyond that it stays
 // disconnected rather than thrashing against a host that keeps dying.
 const REBUILD_COOLDOWN_MS = 10 * 60 * 1000;
+// Restarting a crashed REMOTE daemon is cheaper and safer than a rebuild, so
+// its cooldown is shorter — but still bounded: a daemon that dies right after
+// every start has a real problem more starts won't fix.
+const REMOTE_START_COOLDOWN_MS = 2 * 60 * 1000;
 
 const INJECTION_CHARS = /[;|&`$(){}[\]<>!#\n\r\\]/;
 
@@ -60,6 +64,10 @@ export class TunnelManager {
   constructor(daemon) {
     this.daemon = daemon;
     this.remotesPath = resolve(daemon.grooveDir, 'remotes.json');
+    // Live tunnel state, persisted separately from the configs so a daemon
+    // restart can re-adopt still-running ssh processes instead of forgetting
+    // them (the configs file is user data; this is runtime state).
+    this.activePath = resolve(daemon.grooveDir, 'tunnels-active.json');
     this.saved = new Map();
     this.active = new Map();
     this._healthInterval = null;
@@ -88,8 +96,9 @@ export class TunnelManager {
   }
 
   async init() {
+    await this._readopt();
     for (const [id, config] of this.saved) {
-      if (config.autoConnect) {
+      if (config.autoConnect && !this.active.has(id)) {
         try {
           await this.connect(id);
         } catch (err) {
@@ -99,6 +108,71 @@ export class TunnelManager {
     }
   }
 
+  // Re-adopt tunnels whose detached ssh processes survived a daemon restart.
+  // Without this, every daemon/app restart orphaned the ssh (or shutdown killed
+  // it) and the new daemon started amnesiac — remote windows died mid-session
+  // and the user had to reconnect everything by hand.
+  async _readopt() {
+    let entries = [];
+    try {
+      if (existsSync(this.activePath)) entries = JSON.parse(readFileSync(this.activePath, 'utf8'));
+    } catch { /* corrupt — treat as none */ }
+    if (!Array.isArray(entries) || entries.length === 0) return;
+
+    let adopted = 0;
+    for (const e of entries) {
+      if (!e?.id || !e.pid || !e.localPort || !this.saved.has(e.id)) continue;
+      // Only re-adopt what is provably OUR ssh still doing THIS job: the pid
+      // must be alive, be an ssh process forwarding this port, and the port
+      // must serve HTTP.
+      let alive = false;
+      try { process.kill(e.pid, 0); alive = true; } catch { /* gone */ }
+      if (alive) alive = this._looksLikeOurSsh(e.pid, e.localPort);
+      if (alive && await this._tunnelResponds(e.localPort)) {
+        this.active.set(e.id, {
+          pid: e.pid,
+          localPort: e.localPort,
+          startedAt: e.startedAt || new Date().toISOString(),
+          lastPing: Date.now(),
+          latencyMs: null,
+          healthy: true,
+          failCount: 0,
+        });
+        adopted++;
+        const name = this.saved.get(e.id)?.name || e.id;
+        console.log(`[Groove:Tunnel] Re-adopted live tunnel to ${name} on port ${e.localPort}`);
+        this.daemon.broadcast({ type: 'tunnel.connected', data: { id: e.id, name, localPort: e.localPort, host: this.saved.get(e.id)?.host, url: `http://localhost:${e.localPort}?instance=${encodeURIComponent(name)}` } });
+      } else if (alive) {
+        // ssh survives but doesn't serve — a corpse from before the restart.
+        try { process.kill(e.pid, 'SIGTERM'); } catch { /* gone */ }
+      }
+    }
+    if (adopted > 0 && !this._healthInterval) {
+      this._healthInterval = setInterval(() => this._healthCheckAll(), HEALTH_INTERVAL);
+    }
+    this._saveActive();
+  }
+
+  // Identity check for re-adoption: is this pid an ssh forwarding this port?
+  // Guards against pid recycling handing us an unrelated process.
+  _looksLikeOurSsh(pid, localPort) {
+    try {
+      const cmd = execFileSync('ps', ['-p', String(pid), '-o', 'command='], {
+        encoding: 'utf8', timeout: 3000,
+      }).trim();
+      return cmd.includes('ssh') && cmd.includes(String(localPort));
+    } catch { return false; }
+  }
+
+  _saveActive() {
+    try {
+      const entries = [...this.active.entries()].map(([id, c]) => ({
+        id, pid: c.pid, localPort: c.localPort, startedAt: c.startedAt,
+      }));
+      writeFileSync(this.activePath, JSON.stringify(entries, null, 2), { mode: 0o600 });
+    } catch { /* best effort */ }
+  }
+
   getSaved() {
     return Array.from(this.saved.values()).map(s => ({
       ...this._sanitize(s),
@@ -406,6 +480,7 @@ export class TunnelManager {
       healthy: true,
       failCount: 0,
     });
+    this._saveActive();
 
     // Verify daemon is reachable through tunnel, start if needed
     let remoteAlive = false;
@@ -496,6 +571,7 @@ export class TunnelManager {
     if (localPort) await this._waitForPortFree(localPort, 3000);
 
     this.active.delete(id);
+    this._saveActive();
 
     const config = this.saved.get(id);
     this.daemon.audit.log('tunnel.disconnect', { id, name: config?.name });
@@ -972,6 +1048,12 @@ export class TunnelManager {
             conn.failCount = 0;
             conn.healthy = true;
             conn._wedgedStreak = 0;
+          } else if (verdict === 'remote-down') {
+            // The tunnel is carrying traffic correctly — the far daemon is what
+            // died (typically mid-upgrade). Rebuild would be useless; start it.
+            conn.healthy = false;
+            this.daemon.broadcast({ type: 'tunnel.unhealthy', data: { id } });
+            await this._startRemoteDaemon(id, conn);
           } else {
             conn.healthy = false;
             this.daemon.broadcast({ type: 'tunnel.unhealthy', data: { id } });
@@ -995,19 +1077,71 @@ export class TunnelManager {
   }
 
   // Escalating evidence that a tunnel is actually dead, not merely slow:
-  //   'alive'     — answered a long-timeout HTTP probe; leave it alone
-  //   'proc-dead' — the ssh client process is gone
-  //   'port-dead' — nothing is listening on the local port
-  //   'wedged'    — port accepts TCP but HTTP never answers (dead forward)
+  //   'alive'       — answered a long-timeout HTTP probe; leave it alone
+  //   'proc-dead'   — the ssh client process is gone
+  //   'port-dead'   — nothing is listening on the local port
+  //   'remote-down' — the tunnel forwards fine but the REMOTE end refuses:
+  //                   the probe fails fast with a connection error, not a
+  //                   timeout. Killing the tunnel won't fix that — the remote
+  //                   daemon needs starting (e.g. it died during an upgrade).
+  //   'wedged'      — port accepts TCP but HTTP hangs to timeout (dead forward)
   async _confirmDead(conn) {
-    if (await this._tunnelResponds(conn.localPort, this.confirmTimeout ?? CONFIRM_TIMEOUT)) return 'alive';
+    const started = Date.now();
+    let probeErr = null;
+    try {
+      const res = await fetch(`http://localhost:${conn.localPort}/api/health`, {
+        signal: AbortSignal.timeout(this.confirmTimeout ?? CONFIRM_TIMEOUT),
+      });
+      if (res.ok) return 'alive';
+    } catch (err) { probeErr = err; }
+
     if (conn.pid) {
       try { process.kill(conn.pid, 0); } catch { return 'proc-dead'; }
     }
     if (!(await this._isPortInUse(conn.localPort))) return 'port-dead';
+
+    // ssh is alive and its port listens. A hang (timeout) means the forward is
+    // dead; a FAST connection-level error means ssh relayed the remote side's
+    // refusal — the tunnel works, the far daemon doesn't.
+    const failedFast = Date.now() - started < 2000;
+    const timedOut = probeErr && (probeErr.name === 'TimeoutError' || probeErr.name === 'AbortError');
+    if (failedFast && !timedOut) return 'remote-down';
     return 'wedged';
   }
 
+  // The tunnel is healthy; the daemon on the far side is what's down. Start it
+  // over ssh rather than pointlessly rebuilding the tunnel. Rate-limited: if
+  // the remote daemon won't stay up, repeated starts won't save it.
+  async _startRemoteDaemon(id, conn) {
+    this._remoteStartAt = this._remoteStartAt || new Map();
+    const last = this._remoteStartAt.get(id) || 0;
+    if (Date.now() - last < REMOTE_START_COOLDOWN_MS) return;
+    this._remoteStartAt.set(id, Date.now());
+
+    console.log(`[Groove:Tunnel] ${id}: tunnel is fine but the remote daemon is down — starting it`);
+    this.daemon.audit.log('tunnel.remote-daemon-start', { id });
+    this.daemon.broadcast({ type: 'tunnel.status', data: { id, step: 'starting' } });
+    try {
+      await this.autoStart(id);
+      // Confirm it came up; a success resets the failure counters immediately
+      // instead of waiting out another health cycle.
+      for (let i = 0; i < 10; i++) {
+        await new Promise((r) => setTimeout(r, 2000));
+        if (await this._tunnelResponds(conn.localPort)) {
+          conn.failCount = 0;
+          conn.healthy = true;
+          conn._wedgedStreak = 0;
+          console.log(`[Groove:Tunnel] ${id}: remote daemon is back`);
+          this.daemon.broadcast({ type: 'tunnel.health', data: { id, latencyMs: conn.latencyMs, healthy: true } });
+          return;
+        }
+      }
+      console.warn(`[Groove:Tunnel] ${id}: remote daemon did not come back after start`);
+    } catch (err) {
+      console.warn(`[Groove:Tunnel] ${id}: could not start remote daemon: ${err.message}`);
+    }
+  }
+
   // Tear down a confirmed-dead tunnel and immediately rebuild it on the SAME
   // local port. The remote GUI window points at that port and its WebSocket
   // retries every 2s, so a same-port rebuild heals an open window without the
@@ -1075,25 +1209,17 @@ export class TunnelManager {
     throw new Error(`No available local port found (tried ${DEFAULT_LOCAL_PORT}-${DEFAULT_LOCAL_PORT + MAX_PORT_ATTEMPTS - 1})`);
   }
 
+  // Deliberately does NOT kill the ssh processes. They are spawned detached and
+  // are the user's live sessions: killing them on every daemon restart (app
+  // upgrade, promote, crash) is what nuked remote windows mid-session. State is
+  // persisted; the next daemon re-adopts whatever is still alive and serving.
+  // Explicit disconnect()/delete() remain the paths that actually kill a tunnel.
   shutdown() {
     if (this._healthInterval) {
       clearInterval(this._healthInterval);
       this._healthInterval = null;
     }
-    for (const [id] of this.active) {
-      try {
-        const conn = this.active.get(id);
-        if (conn?.pid) {
-          const cmd = execFileSync('ps', ['-p', String(conn.pid), '-o', 'command='], {
-            encoding: 'utf8',
-            timeout: 3000,
-          }).trim();
-          if (cmd.includes('ssh')) {
-            process.kill(conn.pid, 'SIGTERM');
-          }
-        }
-      } catch { /* ignore */ }
-    }
+    this._saveActive();
     this.active.clear();
   }
 }

package/packages/gui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/gui",
-  "version": "0.27.213",
+  "version": "0.27.214",
   "description": "GROOVE GUI — visual agent control plane",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",