fix(server): quitting stops an agent-device daemon left by an earlier server#33587

Approvability

Verdict: Approved at 6071c9a

Macroscope's review found this PR approvable — Shutdown now cleans up agent-device daemons left by earlier server processes using an already-installed CLI. Cleanup remains scoped to the configured local state directory and bounded by the existing timeout.

Notes:

• All code in this push has already been reviewed. Approvability was decided on eligibility alone.

No code changes detected at e0f5828. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[GPT-6.1 Sol][Codex] on behalf of shivam.

Handoff from https://github.com/pingdotgg/t3code/pull/33566. I reproduced a related shutdown failure on the real macOS desktop on shiv and Linux desktop on corex. These results compare base ad9e87111fd9b2f10ec320b4de0a6ad3a092278a with my concurrent hub/daemon shutdown fix at 801f686fa67825157305b2c99af492fe5e4157c8. They do not verify this PR's head.

Both platforms used Electron 44.10.1, agent-device 0.21.31 and expo-device-hub 0.19.1, isolated state and mock keychain. Helpers were enabled through the real Devices settings using background CUA. macOS used an unsigned packaged arm64 T3 Code Beta 0.1.7 on macOS 27.0.1. Linux used Ubuntu 26.04 x64.

• Ordinary graceful Quit stopped the app, hub and daemon on both base and candidate on both devices.
• Deliberately SIGSTOPping the verified app-owned hub before Quit reproduced the leak on base on both devices. Hub scope closure waited ahead of daemon cleanup, while desktop ended the backend after its five-second grace.
• On macOS, native Quit was invoked through AXPress on its menu item. Base daemon PID 70959 remained under PPID 1 using the packaged T3 executable, and returned HTTP 200 after the app/backend exited. With concurrent shutdown, daemon PID 76506 exited 119 ms after Quit while the hub was still stopped. The hub/backend exited around five seconds later.
• Linux used SIGTERM through DesktopLifecycle's app.quit/before-quit path. Base daemon PID 4101264 survived; candidate stopped all three processes.

macOS recordings: base with stalled hub, candidate with stalled hub, ordinary base, ordinary candidate. Window recording ends when Quit removes its capture target; native action output and process observations established the final state. Linux Devices capture. The process observations and recording limitations are recorded in #33566's body.

The Deferred-based stalled-hub regression failed on base and all 20 LocalDeviceHost tests passed on my candidate. Boat check:changed and CI passed at that head. Two independent reviews found no remaining issues with that scoped fix. All test processes and temporary builds were cleaned up.

Your previous-server ownership fix addresses a separate gap I also noticed in the source: agentToolRef stays null until this instance calls ensureAgentReady. I did not runtime-test that orphan-recovery case. The reporter's original build and cause of the nine-day daemon lifetime remain unknown. Earlier shutdown work, daemon stop exceeding the five-second grace, and active device sessions were not covered by my fix or evidence. A deliberately paused hub could still leave stale hub.json after backend termination.

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Baseline: 5be6bc9 · PR result: e0f5828 · Source CI: success

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

Explain Change →

No actionable comments were generated in the recent review.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

External image Recent review info

External image Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: fix/issue-33552
• File: .coderabbit.config.ts
• Commit: 6071c9a
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Team
• Run ID: 7d56a5e0-1eaa-4ea3-862d-f5bcb9e2c539

External image Commits

Reviewing files that changed from the base of the PR and between 269f131b11e087f30b47034f6d51c952606e0a42 and 6071c9a467375c04e3bd8471abeef332226c0329.

External image Files selected for processing: 1

• apps/server/src/device/LocalDeviceHost.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 1 remain after this review.

Evidence

Ran independently bundled real servers on Linux x86_64, Node 26.12.1, agent-device 0.21.31, with fresh databases and identical RPC-driven settings. Both recordings use a 1280×760 terminal and the same white theme. No tests or mocks were used as evidence.

1. Enable local device support and agent access; initialize agent tools through the real device RPC path. Record daemon PID/start time and verify HTTP health.
2. SIGKILL the exact server; confirm the daemon survives.
3. Restart with the same state without device operations, quit gracefully with SIGTERM, then inspect the same daemon.
4. Repeat with a new daemon; after restarting, disable agent access through device.configure, the operation used by Devices settings, and inspect the same daemon.

Driver and synthetic seeding · Recording script · Reproduction instructions

AI-assisted; verified with the tests and tools listed above.

Not shown:

• Desktop shell quit, visual Settings controls, and MCP device-tool invocation were not exercised; evidence uses the real built server, authenticated device RPC, and graceful SIGTERM.
• Older recorded agent-device versions, missing-version fallback, dead or malformed daemon records, and missing installed tools were not exercised; both runs used a live daemon and the current installed pin.
• macOS and Windows behavior was not exercised; this environment is Linux.
• The first restart's supplementary raw server log was overwritten by the second restart's identically named log. The uninterrupted recordings and runtime transcripts retain both complete scenarios.