pi-freeflow 1.44.0 → 1.45.0

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## 1.45.0
+
+### Minor Changes
+
+- Synchronize the free model catalog with live upstreams and resolve cross-platform runtime, stream lifecycle, and process management issues across Windows and Linux (Node 22/24/26, Bun, Pi, and OMP).
+  
+  - **Catalog Sync (30 Models Total)**:
+    - Add 3 live verified OpenCode Zen models: `crouton-alpha-free` (1M context, 270K output), `iceman-free` (262K context, 131K output), and `inkling-2-small-free` (1M context, 131K output, multimodal).
+    - Add `liquid/lfm-3-1.7b:free` on KiloCode Gateway.
+    - Retire 6 discontinued KiloCode models confirmed 404 upstream (`poolside/laguna-s-2.1:free`, `poolside/laguna-xs-2.1:free`, `liquid/lfm-2.5-2.6b:free`, `reflection/beam-free`, `recursive/flint-v1.0:free`, `xingchen-agi/xing4.0-29b-a4b:free`) and dead-list them to prevent revival from stale caches.
+    - Update model aliases with clean mappings (`crouton`, `iceman`, `inkling-2-small`, `lfm-3`).
+  
+  - **Cross-Platform & Stream Lifecycle Fixes**:
+    - Add a `destroy` hook to the Zen sidecar stream and terminate orphaned child processes on stream cancellation, client disconnect, or stall timeouts.
+    - Support Windows `.cmd`/`.bat` runtime shims in child process spawns with `shell: true` and argument quoting, avoiding `EINVAL` under Node 22+.
+    - Fix `isDaemonMain()` to resolve symlinks and compare paths case-insensitively on Windows so symlinked daemon launches and lowercase drive paths start normally.
+    - Ensure client leases detach cleanly on `session_shutdown` and process exit across Node 22/24/26 and Bun.
+    - Filter `lsof` with `-sTCP:LISTEN` on Linux so active client sessions sharing port 28180 are never killed.
+    - Prioritize live registry versions and disk caches over installed 1.x binaries during User-Agent generation to fix version-drift auto-repair.
+    - Prevent tool argument corruption in `stream-cloak.ts` when function names repeat across stream deltas.
+    - Fix the hedged relay race so transient errors on one leg do not prematurely cancel healthy in-flight responses.
+    - Add single-flight deduplication and lockfile serialization to Cline token refreshes to prevent concurrent subagent requests from invalidating single-use refresh tokens.
+
+## 1.44.1
+
+### Patch Changes
+
+- Split oversized source modules into focused files with no behavior change. The proxy, command registry, stream pipeline, fingerprint, tool translation, Cline pool, and config internals now live in single-responsibility modules behind the same import paths, so updates and reviews land in smaller files while every command, lane, and gate behaves exactly as before.
+
 ## 1.44.0
 
 ### Minor Changes

package/README.md

@@ -19,7 +19,7 @@ Thin by design: a model list, a relay proxy, and a log. The host (`pi-ai`) handl
 | **32 free models** | 8 from OpenCode Zen, 15 from KiloCode Gateway, 1 from Cline, 8 from OVHcloud AI Endpoints, context windows up to 1M. Full list below. | **$0** |
 | **Relay pool** | Route requests through your own relays: a self-hosted egress pool (many egress IPs on one small host) or Cloudflare Workers / Deno Deploy / Vercel Edge workers. Traffic spreads across the pool, or stays on one sticky relay. A relay that rate-limits, times out, or drops the connection cools down while healthy ones take its traffic. | **$0** beyond your host or platforms' free tiers |
 | **Automatic fallback** | When every relay is cooling down, requests go direct to upstream instead of failing. | **$0** |
-| **Short model names** | Most models have a slash-free, colon-free alias, plus an optional `:effort` suffix for thinking depth. You type `freeflow/<name>`; the Cline model has no alias and must be typed in full. | **$0** |
+| **Short model names** | Most models have a slash-free, colon-free alias, plus an optional `:effort` suffix for thinking depth. You type `freeflow/<name>` (including `cline-super-vl` for Cline). | **$0** |
 | **Shared local proxy** | One daemon on `127.0.0.1:28180` serves every session on the machine, so parallel subagents reuse it instead of opening their own connections. Loopback-only and token-gated: hosts send the token automatically, external tools read `~/.pi/agent/token`. | **$0** |
 | **Logs you can read** | `~/.pi/agent/pi-freeflow.log`, rotated at 10MB. Tail it with `/freeflow logs`. | **$0** |
 | **Tool-call diagnostics** | `~/.pi/agent/toolcall-audit.jsonl`, rotated at 5MB. One line per streamed turn that declared tools (and per non-streamed Chat Completions turn) — the calls it made, argument size and validity, finish reason, classified failure — plus one line per abandoned upstream attempt. Names, sizes and reasons only. | **$0** |
@@ -134,13 +134,13 @@ For `api/relay.js`, use the canonical worker source (see below); `vercel.json` s
 
 **Canonical worker source (all platforms)**
 
-The relay worker template is generated per deployment by `/freeflow deploy`, with one shared core adapted for Vercel, Cloudflare, and Deno. Every deploy embeds a random 32-byte secret, and the generated worker answers `401` to any request without a matching `x-relay-auth` header; the client sends that secret to each relay in the pool. Only a hand-pasted legacy worker built without a secret is open to anyone. Either way, a relay forwards only to an allowlist (`https://opencode.ai`, `https://api.kilo.ai`) with private-host and path checks.
+The relay worker template is generated per deployment by `/freeflow deploy`, with one shared core adapted for Vercel, Cloudflare, and Deno. Every deploy embeds a random 32-byte secret, and the generated worker answers `401` to any request without a matching `x-relay-auth` header; the client sends that secret to each relay in the pool. Only a hand-pasted legacy worker built without a secret is open to anyone. Either way, a relay forwards only to an allowlist (`https://opencode.ai`, `https://api.kilo.ai`, `https://oai.endpoints.kepler.ai.cloud.ovh.net`) with private-host and path checks.
 
 ```js
 // Minimal Cloudflare illustration. Prefer /freeflow deploy: the generated
 // worker is the hardened source for all three platforms.
 // This example omits the private-host guard, path validation, and auth.
-const ALLOWED_TARGETS = ["https://opencode.ai", "https://api.kilo.ai"];
+const ALLOWED_TARGETS = ["https://opencode.ai", "https://api.kilo.ai", "https://oai.endpoints.kepler.ai.cloud.ovh.net"];
 export default {
   async fetch(req) {
     const target = req.headers.get("x-relay-target");
@@ -215,7 +215,7 @@ The same command set works identically in OMP and Pi:
 
 ---
 
-### 32 models, one command
+### 30 models, one command
 
 ```bash
 /model → freeflow → pick
@@ -225,7 +225,7 @@ Every model specification is reconciled against [models.dev](https://models.dev/
 
 The host catalog carries text and image inputs only. Upstream video and audio support (MiMo: audio + video; GLM 5.3 Flash: video + PDF; Nemotron Super VL and Nano Omni: video) is therefore not selectable from the picker and is not declared in `input`.
 
-#### OpenCode Zen (8 models), Chat Completions API
+#### OpenCode Zen (11 models), Chat Completions API
 
 Good defaults for long coding sessions and agentic work.
 
@@ -239,8 +239,11 @@ Good defaults for long coding sessions and agentic work.
 | `beam-free` | Reflection AI | **1M** (1.048.576) | **131K** (131.072) | `low … max` | ❌ |
 | `deepseek-v4.1-flash-free` | DeepSeek | **1M** (1.048.576) | **393K** (393.216) | `low / high / max` | ✅ |
 | `flint-40b-free` | Recursive | **262K** (262.144) | **65K** (65.536) | `low … max` | ❌ |
+| `crouton-alpha-free` | Stealth (Thinking Machines) | **1M** (1.048.576) | **270K** (270.000) | `minimal … max` | ✅ |
+| `iceman-free` | Stealth | **262K** (262.144) | **131K** (131.072) | `low / high / max` | ❌ |
+| `inkling-2-small-free` | Thinking Machines | **1M** (1.048.576) | **131K** (131.072) | `minimal … max` | ✅ |
 
-#### KiloCode Gateway (15 models), OpenRouter compatible
+#### KiloCode Gateway (10 models), OpenRouter compatible
 
 Keyless access. Most rows have a short alias (shown with the full ID in parentheses); a row that shows only the full ID has no short form.
 
@@ -251,16 +254,11 @@ Keyless access. Most rows have a short alias (shown with the full ID in parenthe
 | `nemotron-3-ultra-550b` (`nvidia/...:free`) | NVIDIA | **1M** (1.000.000) | **182K** (182.520) | `minimal…xhigh`\* | ❌ |
 | `nemotron-3.5-lightning` (`nvidia/nemotron-3.5-lightning:free`) | NVIDIA | **1M** (1.000.000) | **235K** (235.929) | `minimal…xhigh`\* | ❌ |
 | `north-mini-code` (`cohere/...:free`) | Cohere | **256K** (256.000) | **64K** (64.000) | `minimal…xhigh`\* | ❌ |
-| `laguna-s-2.1:free` (`poolside/...:free`) | Poolside | **1M** (1.048.576) | **131K** (131.072) | `minimal…xhigh`\* | ❌ |
-| `laguna-xs-2.1:free` (`poolside/...:free`) | Poolside | **262K** (262.144) | **32K** (32.768) | `minimal…xhigh`\* | ❌ |
-| `lfm-2.5` (`liquid/lfm-2.5-2.6b:free`) | Liquid AI | **128K** (128.000) | **32K** (32.768) | `minimal…xhigh`\* | ❌ |
+| `lfm-3` (`liquid/lfm-3-1.7b:free`) | Liquid AI | **262K** (262.144) | **8K** (8.192) | `minimal…xhigh`\* | ❌ |
 | `kilo-auto` (`kilo-auto/free`) | Kilo Gateway Auto | **256K** (256.000) | **10K** (10.000) | `minimal…xhigh`\* | ❌ |
 | `openrouter` (`openrouter/free`) | OpenRouter Free | **200K** (200.000) | **65K** (65.536) | `minimal…xhigh`\* | ✅ |
 | `glyph-cluster` (`stealth/glyph-cluster`) | Stealth preview (lab undisclosed) | **256K** (256.000) | **256K** (256.000) | `minimal…xhigh`\* | ❌ |
-| `nvidia/nemotron-3.5-super-vl:free` | NVIDIA | **1M** (1.000.000) | **131K** (131.072) | `minimal…xhigh`\* | ✅ |
-| `beam-kilo` (`reflection/beam-free`) | Reflection AI | **1M** (1.048.576) | **131K** (131.072) | `low…max`\* | ❌ |
-| `flint-kilo` (`recursive/flint-v1.0:free`) | Recursive | **262K** (262.144) | **65K** (65.536) | `minimal…xhigh`\* | ❌ |
-| `xing4.0` (`xingchen-agi/xing4.0-29b-a4b:free`) | XingChen | **262K** (262.144) | **235K** (235.929) | `minimal…xhigh`\* | ❌ |
+| `nemotron-3.5-super-vl-kilo` (`nvidia/nemotron-3.5-super-vl:free`) | NVIDIA | **1M** (1.000.000) | **131K** (131.072) | `minimal…xhigh`\* | ✅ |
 
 \* Levels are forwarded as-is through the OpenRouter-style nested `reasoning` parameter; effort mapping is decided by each model. MiMo collapses `minimal→low` and `xhigh→high` upstream, so its selector shows 5 labels but only 3 distinct effort values.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-freeflow",
   "type": "module",
-  "version": "1.44.0",
+  "version": "1.45.0",
   "description": "Thin provider for OMP/Pi — model list + dumb relay proxy + log; host pi-ai owns thinking/normalization",
   "main": "extensions/index.ts",
   "types": "src/index.ts",

package/src/catalog.ts

@@ -195,6 +195,25 @@ export const DEAD_MODEL_IDS = new Set<string>([
  // sibling Kilo id nvidia/nemotron-3-ultra-550b-a55b:free is a separate
  // serving route and is unaffected.
  "nemotron-3-ultra-free",
+ // poolside/laguna-s-2.1:free and poolside/laguna-xs-2.1:free: discontinued
+ // upstream on KiloCode (2026-11-09) — removed from live /api/gateway/models,
+ // answers HTTP 404 "The requested model does not exist" across all egresses.
+ "poolside/laguna-s-2.1:free",
+ "poolside/laguna-xs-2.1:free",
+ // liquid/lfm-2.5-2.6b:free: replaced upstream on KiloCode by liquid/lfm-3-1.7b:free
+ // (2026-11-09) — answers HTTP 404 "The requested model is currently unavailable".
+ "liquid/lfm-2.5-2.6b:free",
+ // reflection/beam-free: discontinued upstream on KiloCode (2026-11-09) —
+ // answers HTTP 404 "The requested model does not exist". The Zen beam-free
+ // twin is a separate serving route and remains active.
+ "reflection/beam-free",
+ // recursive/flint-v1.0:free: discontinued upstream on KiloCode (2026-11-09) —
+ // answers HTTP 404 "The requested model is currently unavailable". The Zen
+ // flint-40b-free twin is a separate serving route and remains active.
+ "recursive/flint-v1.0:free",
+ // xingchen-agi/xing4.0-29b-a4b:free: discontinued upstream on KiloCode (2026-11-09) —
+ // answers HTTP 404 "The requested model is currently unavailable".
+ "xingchen-agi/xing4.0-29b-a4b:free",
 ]);
 /**
  * Free-tier allowlist for anything entering the picker via network or stale disk.
@@ -336,25 +355,30 @@ export function enrichModelDef(raw: RawModelItem, source: Upstream): RegisteredM
  // Declared fields win over wire aliases: a listing that already names
  // contextWindow/maxTokens/reasoning keeps its values; the snake_case
  // upstream aliases and the id heuristics only fill gaps.
- let contextWindow =
-  typeof raw.contextWindow === "number" ? raw.contextWindow
-  : typeof raw.context_length === "number" ? raw.context_length : 262_144;
+ const validPosNum = (n: unknown): n is number =>
+  typeof n === "number" && Number.isFinite(n) && n > 0;
+ const declaredContext =
+  validPosNum(raw.contextWindow) ? raw.contextWindow
+  : validPosNum(raw.context_length) ? raw.context_length : undefined;
+ let contextWindow = declaredContext ?? 262_144;
  if (
-  idLower.includes("1m") ||
-  idLower.includes("ultra") ||
-  idLower.includes("lightning") ||
-  idLower.includes("mimo-v2.5") ||
-  idLower.includes("muse-spark")
+  declaredContext === undefined && (
+   idLower.includes("1m") ||
+   idLower.includes("ultra") ||
+   idLower.includes("lightning") ||
+   idLower.includes("mimo-v2.5") ||
+   idLower.includes("muse-spark")
+  )
  ) {
   contextWindow = 1_048_576;
  }
 
- let maxTokens =
-  typeof raw.maxTokens === "number" ? raw.maxTokens
-  : typeof raw.max_output_tokens === "number"
-   ? raw.max_output_tokens
-   : 65_536;
- if (idLower.includes("ultra") || idLower.includes("lightning")) {
+ const declaredMaxTokens =
+  validPosNum(raw.maxTokens) ? raw.maxTokens
+  : validPosNum(raw.max_output_tokens) ? raw.max_output_tokens
+  : validPosNum(raw.max_tokens) ? raw.max_tokens : undefined;
+ let maxTokens = declaredMaxTokens ?? 65_536;
+ if (declaredMaxTokens === undefined && (idLower.includes("ultra") || idLower.includes("lightning"))) {
   maxTokens = 131_072;
  }
 

package/src/client-recovery.ts

@@ -0,0 +1,238 @@
+/**
+ * Watchdog recovery, backoff, and circuit-breaker logic for pi-freeflow daemon.
+ *
+ * Implements exponential backoff, stuck-busy heuristics, and automatic
+ * circuit-breaker halting when repeated recovery attempts fail.
+ */
+
+import {
+ BREAKER_FAILURES,
+ BREAKER_HALT_MS,
+ BREAKER_WINDOW_MS,
+ BUSY_BYPASS_CONTINUOUS_MS,
+ BUSY_BYPASS_QUIET_MS,
+ PKG_VERSION,
+ RECOVERY_BACKOFF_BASE_MS,
+ RECOVERY_BACKOFF_CAP_MS,
+} from "./config.ts";
+import type { DaemonHealthSnapshot } from "./health.ts";
+import { logInfo, logWarn } from "./logger.ts";
+import { compareVersions } from "./update-core.ts";
+
+/** First tick (Date.now()) the daemon has looked continuously busy; 0 = idle. */
+let busySince = 0;
+/** Consecutive recovery attempts (backoff exponent n). Reset on healthy watchdog tick. */
+let backoffAttempt = 0;
+/** Timestamps of recent recovery failures (breaker window). */
+let recoveryFailures: number[] = [];
+/** Watchdog respawns halted until this time (breaker open). */
+let breakerOpenUntil = 0;
+
+/**
+ * Respawn backoff: min(2s * 2^n, 60s) + jitter. n is the consecutive-failure
+ * count; pass jitterMs = 0 in tests for a deterministic base.
+ */
+export function computeRecoveryBackoffMs(attempt: number, jitterMs = Math.random() * 500): number {
+ const n = Math.max(0, Math.floor(attempt));
+ const base = Math.min(RECOVERY_BACKOFF_BASE_MS * 2 ** n, RECOVERY_BACKOFF_CAP_MS);
+ return base + Math.max(0, jitterMs);
+}
+
+/**
+ * Stuck-busy check (pure, testable): a busy daemon may only be replaced after
+ * 5min of continuous busy AND zero forwarded stream bytes for 60s+. Anything
+ * else must be left untouched mid-request.
+ */
+export function isStuckBusy(busySinceMs: number, lastBytesAt: number, now = Date.now()): boolean {
+ if (!busySinceMs) return false;
+ if (now - busySinceMs < BUSY_BYPASS_CONTINUOUS_MS) return false;
+ if (lastBytesAt && now - lastBytesAt < BUSY_BYPASS_QUIET_MS) return false;
+ return true;
+}
+
+/** Track the busy/idle edge from a health snapshot; returns the updated busySince. */
+export function trackBusyEdge(activeRequests: number, lastBytesAt: number, now = Date.now()): number {
+ if (activeRequests > 0) {
+  if (!busySince) busySince = now;
+ } else {
+  busySince = 0;
+ }
+ return busySince;
+}
+
+export function getBusySince(): number {
+ return busySince;
+}
+
+export function resetBusySince(): void {
+ busySince = 0;
+}
+
+/** True while the breaker halt is in effect (respawns paused, fallback serves). */
+export function isBreakerHalted(now = Date.now()): boolean {
+ return now < breakerOpenUntil;
+}
+
+/** Record a recovery failure; opens the breaker after 5 straight failures in 5min. */
+export function recordRecoveryFailure(now = Date.now()): boolean {
+ recoveryFailures.push(now);
+ recoveryFailures = recoveryFailures.filter((t) => now - t <= BREAKER_WINDOW_MS);
+ backoffAttempt += 1;
+ if (recoveryFailures.length >= BREAKER_FAILURES) {
+  breakerOpenUntil = now + BREAKER_HALT_MS;
+  logWarn("recovery breaker open — 5 straight failures in 5min, halting respawn for 10min (in-process fallback meanwhile)");
+  return true;
+ }
+ return false;
+}
+
+/** Record a healthy watchdog tick: clears the straight-failure run and backoff. */
+export function recordRecoverySuccess(): void {
+ recoveryFailures = [];
+ backoffAttempt = 0;
+ breakerOpenUntil = 0;
+}
+
+/** Test seam: snapshot of the recovery counters. */
+export function _getRecoveryStateForTest(): {
+ backoffAttempt: number;
+ failures: number[];
+ breakerOpenUntil: number;
+ busySince: number;
+} {
+ return { backoffAttempt, failures: [...recoveryFailures], breakerOpenUntil, busySince };
+}
+
+/** Test seam: reset recovery counters without touching timers. */
+export function _resetRecoveryForTest(): void {
+ backoffAttempt = 0;
+ recoveryFailures = [];
+ breakerOpenUntil = 0;
+ busySince = 0;
+}
+
+/** Recovery-decision shape; canonical definition lives in health.ts. */
+export type HealthForRecovery = DaemonHealthSnapshot;
+
+/**
+ * Older-version guard: only a daemon strictly older than this build is worth
+ * recovering. shouldReplaceDaemon deliberately leaves a NEWER daemon running,
+ * so recovering from one could never succeed (watchdog → recover → refused →
+ * reattach → watchdog, until the breaker parks into the in-process fallback).
+ * Null/undefined version (pre-version daemon) is not older on its own.
+ */
+export function isOlderDaemonVersion(version: string | null | undefined): boolean {
+ return version != null && compareVersions(version, PKG_VERSION) < 0;
+}
+
+/**
+ * Watchdog decision matrix (pure, testable). Recover when the daemon is gone,
+ * serves an older version, or reports a degraded failed-SSE window. Missing
+ * sseDegraded (pre-window daemon) never triggers on its own.
+ */
+export function shouldRecoverOnHealth(health: HealthForRecovery): boolean {
+ if (health === null) return true;
+ if (isOlderDaemonVersion(health.version)) return true;
+ if (health.sseDegraded === true) return true;
+ return false;
+}
+
+export interface RecoveryDeps {
+ readonly isEnsuring: () => boolean;
+ readonly setEnsuring: (val: boolean) => void;
+ readonly ensureInProcessFallback: () => Promise<number>;
+ readonly stopHeartbeatInternal: () => void;
+ readonly resetHeartbeatPort: () => void;
+ readonly attachTo: (port: number) => Promise<void>;
+ readonly killStaleDaemon: (port: number, ver: string, what: string) => Promise<boolean>;
+ readonly ensureDaemon: () => Promise<number>;
+ readonly getDaemonHealth?: (port: number) => Promise<DaemonHealthSnapshot>;
+}
+
+export async function triggerRecovery(port: number, why: string, deps: RecoveryDeps): Promise<void> {
+ if (deps.isEnsuring()) return;
+ deps.setEnsuring(true);
+ try {
+  const now = Date.now();
+  if (isBreakerHalted(now)) {
+   logWarn(`recovery breaker halted — serving in-process fallback meanwhile (${why})`);
+   void deps.ensureInProcessFallback();
+   return;
+  }
+  const opened = recordRecoveryFailure(now);
+  if (opened) {
+   void deps.ensureInProcessFallback();
+   return;
+  }
+  const delay = computeRecoveryBackoffMs(backoffAttempt - 1);
+  logWarn(`watchdog recovery (${why}) — backing off ${Math.round(delay)}ms before respawn`);
+  deps.stopHeartbeatInternal();
+  deps.resetHeartbeatPort();
+  const { promise: backoffDone, resolve: resolveBackoff } = Promise.withResolvers<void>();
+  const backoffTimer = setTimeout(resolveBackoff, delay);
+  try { backoffTimer.unref(); } catch { }
+  await backoffDone;
+  try {
+   const health = deps.getDaemonHealth ? await deps.getDaemonHealth(port) : null;
+   if (health && (health.activeRequests ?? 0) > 0) {
+    trackBusyEdge(health.activeRequests ?? 0, health.lastBytesAt ?? 0, Date.now());
+    if (!isStuckBusy(busySince, health.lastBytesAt ?? 0, Date.now())) {
+     logInfo(`watchdog recovery deferred — daemon busy (${health.activeRequests} active, waiting for 5min-stuck + 60s-quiet)`);
+     await deps.attachTo(port);
+     return;
+    }
+   }
+   const ver = health?.version ?? PKG_VERSION;
+   await deps.killStaleDaemon(port, ver, "proxy daemon");
+  } catch (e) {
+   logWarn("watchdog pre-respawn probe failed", { error: String(e) });
+  }
+  // Release before delegating: ensureDaemon owns the flag from here (it
+  // early-returns while ensuring is true). The handoff is synchronous up
+  // to ensureDaemon's own ensuring=true, so no tick slips between.
+  deps.setEnsuring(false);
+  await deps.ensureDaemon();
+ } finally {
+  deps.setEnsuring(false);
+ }
+}
+
+/**
+ * 5s watchdog tick: polls /_health for version + failed-SSE rate and drives
+ * stopHeartbeat → busy-ruled kill → ensureDaemon when the daemon is stale or
+ * degraded. Healthy ticks reset backoff/breaker and track the busy edge.
+ */
+export async function watchdogCheck(port: number, deps: RecoveryDeps): Promise<void> {
+ if (deps.isEnsuring()) return;
+ if (isBreakerHalted()) return;
+ if (!deps.getDaemonHealth) return;
+ let health: DaemonHealthSnapshot;
+ try {
+  health = await deps.getDaemonHealth(port);
+ } catch {
+  return;
+ }
+ if (health === null) {
+  await new Promise<void>((r) => setTimeout(r, 200));
+  try {
+   health = await deps.getDaemonHealth(port);
+  } catch {
+   return;
+  }
+ }
+ if (health && (health.activeRequests ?? 0) > 0) {
+  trackBusyEdge(health.activeRequests ?? 0, health.lastBytesAt ?? 0);
+ } else {
+  trackBusyEdge(0, 0);
+ }
+ if (!shouldRecoverOnHealth(health)) {
+  recordRecoverySuccess();
+  return;
+ }
+ if (health && (health.activeRequests ?? 0) > 0 && !isStuckBusy(busySince, health.lastBytesAt ?? 0)) return;
+ void triggerRecovery(
+  port,
+  health === null ? "daemon gone" : isOlderDaemonVersion(health.version) ? `stale v${health.version}` : "failed-SSE degraded",
+  deps,
+ ).catch((e) => logWarn("watchdog recovery failed", { error: String(e) }));
+}