fix(coding-agent): harden daemon startup and recovery ownership

[sethkarten]

Linear: ENG-5827

Summary

• Treat a connected daemon without hello as unresponsive, give it the full startup window, and revalidate stale observations before shutdown.
• Fence the supervisor after socket lock loss and fail closed at every proper-lockfile call site in packages/coding-agent.
• Preserve verified-live and identity-unavailable workers after recovery probe timeouts. Keep them in recovering and retry asynchronously.
• Start the catalog and persist interrupted operations before orphan cleanup. Use a lightweight catalog entrypoint with a 30 second cold-start timeout.

No daemon wire shape changes are included. Windows named-pipe behavior is unchanged.

Prior-art audit

This implements only behavior still missing from the closed, unmerged PRs:

• fix(daemon): do not let a compromised lockfile take the supervisor down #1550: lock compromise handling was absent from current main.
• fix(coding-agent): preserve live workers during recovery #675: process identity and deferred-recovery helpers exist on main, but probe timeouts could still replace a verified-live worker.
• fix(coding-agent): preserve sessions during daemon startup #911: unresponsive classification, stale revalidation, the dedicated catalog entrypoint, the cold-start timeout, and catalog-before-cleanup ordering were absent.

I also checked #1523, #1756, #1895, #1897, #1900, #1909, #1926, #1123, and #1236. Only #1756 is merged. Sebastian's stack does not implement the startup, catalog, or lock-loss fixes here. #1897 adds PID-reuse protection and roster recovery state in the same supervisor functions, so it will need a deliberate conflict resolution, but it does not preserve live workers after probe timeouts or gate destructive cleanup on catalog durability. #1895, #1900, and #1909 do not duplicate these behaviors.

Invariants

• A proper-lockfile compromise callback records state and never throws through the refresh callback.
• A supervisor that loses its socket lease stops serving and relinquishes ownership.
• Cleanup under a compromised lease never unlinks a successor socket.
• A connected daemon without hello is never classified as stale.
• A stale observation is revalidated before any shutdown request.
• A live worker with matching identity is not killed or relaunched after hello, subscribe, or list timeouts.
• Catalog startup and interruption persistence complete before orphan cleanup.

Validation

• npm run check: passed.
• Affected coding-agent tests: 330 passed across 13 files.
• test/daemon-supervisor-process.test.ts: 10 passed, 8 skipped.
• Two independent code reviews found no blocking issues.

The process suite was run with inherited PRIME_AGENT_INTERNAL_DAEMON_* variables removed because this development shell is itself a daemon worker.

---

Note

High Risk
Changes core daemon lifecycle, distributed locking, and worker recovery paths where mistaken kills or socket unlink could interrupt active sessions; behavior is intentionally more conservative but affects every CLI daemon attach.

Overview
Hardens daemon startup, lock ownership, and live-worker recovery so the CLI and supervisor fail closed instead of replacing or killing processes they cannot safely own.

CLI startup now treats a connected socket with no daemon_hello as unresponsive (not stale), waits through the startup window, and errors with force-shutdown guidance rather than shutting down a possibly-busy daemon. Stale replacement re-checks the connected daemon’s hello before issuing shutdown and can reuse a peer that finishes starting mid-check.

proper-lockfile compromise is wired through daemon socket leases, supervisor/coordinator registry guards, session leases, auth, settings, and cron jobs: compromised locks abort mutations, skip unsafe socket unlink, and (for the supervisor) fence the server and relinquish ownership.

Worker recovery introduces typed probe/auth errors, keeps verified-live or identity-unknown workers in recovering with deferred probes (capped at ~10 rounds), and only SIGKILLs a live process for the identity-verified pre-roster adoption path. Destructive cleanup no longer kills resident workers from recoverUncertainWorkerOperations; catalog start and interruption persistence run before orphan reaping.

Catalog spawns a dedicated entrypoint (Node/Bun), 30s cold-start timeout, and fails fast if the child exits during startup.

^{Reviewed by Cursor Bugbot for commit 4659595. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Harden daemon startup and socket lease compromise recovery

• Adds compromise tracking to DaemonSocketPathLease and all subsystem locks (auth, settings, cron, session-lease, update-coordinator) so operations fail fast instead of proceeding or releasing a lock a successor may already own
• CLI's probeDaemonVersion now returns unresponsive for connected-but-silent daemons instead of stale; ensureDaemonRunning waits through the startup window before surfacing an error, and shutdownStaleDaemonIfNotBusy returns precise dispositions (current/stopped/busy)
• Worker recovery uses new DaemonWorkerProbeTimeoutError and DaemonWorkerAuthenticationError types, bounds deferred probe rounds to MAX_DEFERRED_RECOVERY_ROUNDS (10), and avoids destructive cleanup or orphan reaping when process identity is uncertain
• On socket lease compromise, DaemonSupervisor fences all client connections via fenceSupervisorSocket and begins async cleanup; mutating commands re-validate serving state after an idle-eviction fence
• Daemon catalog startup timeout raised from 5s to 30s (DAEMON_CATALOG_START_TIMEOUT_MS), and the spawner resolves .ts entrypoints via tsx or compiled .js depending on run mode
• Risk: recoverUncertainWorkerOperations signature changed (boolean pre-cleanup param removed); in-tree callers and tests in daemon-agent-roster.test.ts and daemon-supervisor-monitor.test.ts are updated. DaemonVersionProbe type now requires hello for stale and adds unresponsive — any out-of-tree callers of probeDaemonVersion need to handle the new union member.

^{Macroscope summarized 4659595.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 59e09c1. Configure here.}