daemon-debug — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited daemon-debug (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when diagnosing why processes aren't starting, proxies are missing, ports are occupied, or the autostart flow isn't working.
Work through these in order. Each step either finds the problem or rules out a category.
# Is the daemon running?
agnt daemon status
# What processes does the daemon know about?
printf 'PROC LIST\n;;\n' | socat - UNIX-CONNECT:/tmp/devtool-mcp-$(id -u).sock
# What proxies exist?
printf 'PROXY LIST\n;;\n' | socat - UNIX-CONNECT:/tmp/devtool-mcp-$(id -u).sockDecode base64 JSON responses. Check:
urls populated?# Read the project config
cat /path/to/project/.agnt.kdlFor each proxy with script set:
scripts {}?url-matchers? Do they match actual output format?fallback-port? (safety net if URL detection fails)URL detection is the #1 failure point for script-linked proxies.
Common URL matcher mismatches:
| Dev server | Actual output | Correct matcher |
|---|---|---|
| dotnet | Now listening on: http://localhost:6111 | "Now listening on: {url}" |
| Vite | Local: http://localhost:5173/ | "Local:\\s+{url}" |
| Next.js | - Local: http://localhost:3000 | "Local:\\s+{url}" |
| Flask | Running on http://127.0.0.1:5000 | "Running on {url}" |
How to test: Check process output for the URL line, then verify the matcher pattern (with {url} removed) matches as a regex substring.
# Linux: what's listening on expected ports?
ss -tlnp | grep -E ':(6111|6112|3000|5173)\b'
# Compare against daemon's tracked processes
# If port is occupied by a PID the daemon doesn't own → rogue processIf URL was detected but proxy wasn't created:
proxyEvents channel full? (Check daemon debug log for "channel full" warnings)handleURLDetected find the matching proxy config? (Check for "Proxy X matches script Y" in debug log)The session log (the startup output the developer sees) should show:
[starting] / [started] for each script[proxy_starting] / [proxy_started] for each proxy[dependency_ready] or [dependency_wait] for dependenciesMissing entries indicate the step was silently skipped.
Symptoms: Process running, no proxy in PROXY LIST Causes:
.agnt.kdlfallback-port configured → add it as safety netSymptoms: Process shows as "failed" but port is in use by unmanaged PID Causes:
Fix: proc {action: "restart", process_id: "..."} kills rogue and restarts
Symptoms: Process killed during long compilation Root cause: Stall detection misidentified compilation output as stall Fix: Error output IS activity — AlertScanner classifications must reset stall timer
Symptoms: Status bar shows indicators for scripts that were removed from .agnt.kdl Root cause: Script registry entries survived session disconnect How it happens:
CleanupSessionResources must remove ALL registry entries for the projectRegister returns stale entries via LoadOrStoreDiagnosis:
# Check script registry vs config
printf 'SCRIPT LIST\n;;\n' | socat - UNIX-CONNECT:/tmp/devtool-mcp-$(id -u).sock
# Compare count against scripts in .agnt.kdlFix: The registry is ephemeral — rebuilt from .agnt.kdl each session. CleanupSessionResources removes entries when the last session disconnects. If stale entries appear, check that cleanup is running (look for "cleared script registry" in debug log).
Symptoms: Session log shows autostart running twice for same project Causes:
Impact: Second cycle may fail if ports already bound by first cycle's processes
When debugging on WSL:
runtime.GOOS is "linux" — use platform.IsWSL() insteadss (Linux) and netstat.exe (Windows)platform.ShouldUseWindowsShell(path) to determine which side owns the process~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.