Installed LaunchAgent does not recover server or menubar crashes

[VirtualPaul]

Summary

The installed LaunchAgent does not automatically recover either component after a crash. The Python server is backgrounded outside launchd supervision, and the menubar LaunchAgent has RunAtLoad but no KeepAlive policy.

Tested with the package built from main at fb265549480ff0d3ad8b14b28007370539b70cf3.

Reproduction

1. Install the package and wait for GET http://127.0.0.1:8722/health to report ready.
2. Send TERM to the exact Python PID listening on port 8722.
3. Wait 12 seconds: no listener returns; the menubar process remains.
4. Relaunch manually with launchctl kickstart -k gui/$UID/com.token-meter.menubar.
5. Send TERM to the exact menubar PID.
6. Wait 12 seconds: the menubar does not return, and the server listener also disappears.

Manual launchctl kickstart restores the service, confirming the installation itself is still usable.

Root cause

• packaging/payload/bin/start-token-meter:79-93 backgrounds Python with nohup.
• The same script then execs the menubar binary at line 97.
• packaging/scripts/postinstall:74-101 generates one LaunchAgent with RunAtLoad but no KeepAlive.

Suggested fix

Prefer two explicit LaunchAgents:

1. A server job that runs Python in the foreground and uses KeepAlive/SuccessfulExit=false plus ThrottleInterval.
2. A menubar job that runs the Swift app in the foreground and restarts independently.
3. Make both jobs log separately and ensure uninstall removes both labels.
4. If a single job is retained, use a real foreground supervisor that monitors/reaps/restarts both children; do not detach Python with nohup.
5. Avoid restart storms on deterministic configuration failures.

Regression tests

• Kill only the server and assert a new PID is healthy within 10 seconds while exactly one listener exists.
• Kill only the menubar and assert it restarts without replacing a healthy server.
• Repeat each crash several times and assert there are no duplicate processes or orphaned listeners.
• Verify logout/login and uninstall behavior for both jobs.

[bhavsarpratik]

Resolved and revalidated on current main at f0c75e4.

The installer now owns two independent per-user LaunchAgents:

• com.token-meter.server
• com.token-meter.menubar

Both use KeepAlive with throttling. Crash-recovery validation against the installed runtime confirmed:

• terminating the server creates a new server process without restarting the menu bar;
• terminating the menu bar creates a new menu-bar process without restarting the server; and
• the dashboard returns to ok=true, state_ready=true, and inventory_ready=true with one listener on port 8722.

Contract coverage also verifies both labels, both KeepAlive entries, independent uninstall ownership, and foreground-launch behavior. This addresses the reported lack of independent crash recovery.