@aitne/daemon 0.1.10 → 0.1.11

package/dist/adapters/adapter-watchdog.d.ts

@@ -0,0 +1,70 @@
+import type { AdapterConnectionState } from "./types.js";
+/** Probe cadence. */
+export declare const ADAPTER_WATCHDOG_INTERVAL_MS: number;
+/**
+ * Consecutive "down" observations before forcing a restart. Two ticks
+ * (~10 min at the default cadence) gives every library's own reconnect
+ * machinery (discord.js gateway resume, @slack/socket-mode backoff,
+ * telegraf poll retry) ample time to self-heal a transient blip — the
+ * watchdog only steps in for the gave-up / wedged cases.
+ */
+export declare const ADAPTER_WATCHDOG_DOWN_TICKS_BEFORE_RESTART = 2;
+export interface WatchedAdapter {
+    platform: string;
+    /**
+     * Live transport probe. Closures typically read the mutable
+     * `AdapterState` slot so a reload that swaps the instance is picked up
+     * automatically. Return "unknown" when there is nothing to assess
+     * (adapter not configured / not started) — the watchdog takes no action
+     * and resets the down counter.
+     */
+    getConnectionState: () => AdapterConnectionState;
+    /**
+     * Full stop→start cycle (bootstrap's `reload*Adapter(true)`). Expected
+     * to manage MessageHub status transitions itself. Errors are caught and
+     * logged; the down counter is preserved so the next tick retries.
+     */
+    restart: () => Promise<void>;
+    /**
+     * Invoked on observed state transitions (down ↔ ok) so the caller can
+     * surface them (e.g. `messageHub.setPlatformRuntimeStatus`). Optional.
+     */
+    onStateChange?: (state: AdapterConnectionState) => void;
+}
+export interface AdapterWatchdogOptions {
+    intervalMs?: number;
+    downTicksBeforeRestart?: number;
+}
+/**
+ * Daemon-level liveness watchdog for the messaging adapters.
+ *
+ * Every adapter relies on library-internal reconnection that can end in a
+ * permanently dead transport while the daemon still reports "connected":
+ * a Slack reconnect chain killed by an unrecoverable start error, a
+ * discord.js session invalidation, a telegraf poll loop exited on a
+ * non-retryable error — all typically after machine sleep kills the TCP
+ * sockets. The pre-watchdog behavior was a silent, indefinite outage that
+ * only a daemon restart cleared.
+ *
+ * The watchdog polls each adapter's `getConnectionState()` and, after
+ * {@link ADAPTER_WATCHDOG_DOWN_TICKS_BEFORE_RESTART} consecutive "down"
+ * observations, forces a full adapter restart through the bootstrap
+ * reloader. Restarts are serialized per adapter (no overlapping cycles)
+ * and a failed restart retries on the following tick.
+ */
+export declare class AdapterWatchdog {
+    private readonly intervalMs;
+    private readonly downTicksBeforeRestart;
+    private readonly watched;
+    private readonly downCounts;
+    private readonly lastObserved;
+    private readonly restartInFlight;
+    private timer;
+    constructor(options?: AdapterWatchdogOptions);
+    register(adapter: WatchedAdapter): void;
+    start(): void;
+    stop(): void;
+    /** One probe pass over all watched adapters. Exposed for tests. */
+    tick(): Promise<void>;
+    private probe;
+}

package/dist/adapters/adapter-watchdog.js

@@ -0,0 +1,115 @@
+import { createLogger } from "../logging.js";
+const logger = createLogger("adapter-watchdog");
+/** Probe cadence. */
+export const ADAPTER_WATCHDOG_INTERVAL_MS = 5 * 60_000;
+/**
+ * Consecutive "down" observations before forcing a restart. Two ticks
+ * (~10 min at the default cadence) gives every library's own reconnect
+ * machinery (discord.js gateway resume, @slack/socket-mode backoff,
+ * telegraf poll retry) ample time to self-heal a transient blip — the
+ * watchdog only steps in for the gave-up / wedged cases.
+ */
+export const ADAPTER_WATCHDOG_DOWN_TICKS_BEFORE_RESTART = 2;
+/**
+ * Daemon-level liveness watchdog for the messaging adapters.
+ *
+ * Every adapter relies on library-internal reconnection that can end in a
+ * permanently dead transport while the daemon still reports "connected":
+ * a Slack reconnect chain killed by an unrecoverable start error, a
+ * discord.js session invalidation, a telegraf poll loop exited on a
+ * non-retryable error — all typically after machine sleep kills the TCP
+ * sockets. The pre-watchdog behavior was a silent, indefinite outage that
+ * only a daemon restart cleared.
+ *
+ * The watchdog polls each adapter's `getConnectionState()` and, after
+ * {@link ADAPTER_WATCHDOG_DOWN_TICKS_BEFORE_RESTART} consecutive "down"
+ * observations, forces a full adapter restart through the bootstrap
+ * reloader. Restarts are serialized per adapter (no overlapping cycles)
+ * and a failed restart retries on the following tick.
+ */
+export class AdapterWatchdog {
+    intervalMs;
+    downTicksBeforeRestart;
+    watched = [];
+    downCounts = new Map();
+    lastObserved = new Map();
+    restartInFlight = new Set();
+    timer = null;
+    constructor(options) {
+        this.intervalMs = options?.intervalMs ?? ADAPTER_WATCHDOG_INTERVAL_MS;
+        this.downTicksBeforeRestart =
+            options?.downTicksBeforeRestart
+                ?? ADAPTER_WATCHDOG_DOWN_TICKS_BEFORE_RESTART;
+    }
+    register(adapter) {
+        this.watched.push(adapter);
+    }
+    start() {
+        if (this.timer)
+            return;
+        this.timer = setInterval(() => void this.tick(), this.intervalMs);
+        this.timer.unref?.();
+        logger.info({
+            platforms: this.watched.map((w) => w.platform),
+            intervalMs: this.intervalMs,
+        }, "Adapter watchdog started");
+    }
+    stop() {
+        if (!this.timer)
+            return;
+        clearInterval(this.timer);
+        this.timer = null;
+    }
+    /** One probe pass over all watched adapters. Exposed for tests. */
+    async tick() {
+        for (const adapter of this.watched) {
+            await this.probe(adapter).catch((err) => {
+                logger.error({ err, platform: adapter.platform }, "Adapter watchdog probe threw");
+            });
+        }
+    }
+    async probe(adapter) {
+        if (this.restartInFlight.has(adapter.platform))
+            return;
+        let state;
+        try {
+            state = adapter.getConnectionState();
+        }
+        catch (err) {
+            logger.warn({ err, platform: adapter.platform }, "Adapter connection probe threw; treating as unknown");
+            state = "unknown";
+        }
+        const previous = this.lastObserved.get(adapter.platform);
+        if (previous !== state) {
+            this.lastObserved.set(adapter.platform, state);
+            if (state === "down" || previous === "down") {
+                logger.warn({ platform: adapter.platform, from: previous ?? "unobserved", to: state }, "Adapter connection state changed");
+                adapter.onStateChange?.(state);
+            }
+        }
+        if (state !== "down") {
+            this.downCounts.set(adapter.platform, 0);
+            return;
+        }
+        const downCount = (this.downCounts.get(adapter.platform) ?? 0) + 1;
+        this.downCounts.set(adapter.platform, downCount);
+        if (downCount < this.downTicksBeforeRestart) {
+            logger.warn({ platform: adapter.platform, downCount }, "Adapter connection down — waiting for library self-recovery before restart");
+            return;
+        }
+        logger.warn({ platform: adapter.platform, downCount }, "Adapter connection still down — forcing restart");
+        this.restartInFlight.add(adapter.platform);
+        try {
+            await adapter.restart();
+            this.downCounts.set(adapter.platform, 0);
+            logger.info({ platform: adapter.platform }, "Adapter watchdog restart completed");
+        }
+        catch (err) {
+            // Counter is left at/above the threshold so the next tick retries.
+            logger.error({ err, platform: adapter.platform }, "Adapter watchdog restart failed; will retry on next tick");
+        }
+        finally {
+            this.restartInFlight.delete(adapter.platform);
+        }
+    }
+}

package/dist/adapters/discord.d.ts

@@ -1,4 +1,4 @@
-import type { MessageAdapter, OnMessageCallback, OutboundAttachmentRef } from "./types.js";
+import type { AdapterConnectionState, MessageAdapter, OnMessageCallback, OutboundAttachmentRef } from "./types.js";
 import type { AttachmentStore } from "../services/attachments/store.js";
 export interface DiscordBotInfo {
     id: string;
@@ -48,6 +48,14 @@ export declare class DiscordAdapter implements MessageAdapter {
     private readonly onOwnerDetected;
     private botUserId;
     private botInfo;
+    /**
+     * Set when the gateway emits `Events.Invalidated` — discord.js stops
+     * reconnecting entirely on an invalidated session, so without external
+     * intervention the adapter is permanently deaf. Cleared on `start()`.
+     */
+    private sessionInvalidated;
+    /** True once `client.login()` has resolved; cleared in `stop()`. */
+    private startCompleted;
     private pairingChallenge;
     private readonly attachmentStore;
     constructor(opts: DiscordAdapterOptions);
@@ -64,6 +72,14 @@ export declare class DiscordAdapter implements MessageAdapter {
     static fetchBotInfo(botToken: string): Promise<DiscordBotInfo>;
     start(): Promise<void>;
     stop(): Promise<void>;
+    /**
+     * Live gateway liveness for the adapter watchdog. discord.js resumes /
+     * reconnects on its own for transient closes, so a momentary not-ready
+     * state is normal — the watchdog only acts on consecutive "down"
+     * observations. An invalidated session is reported "down" immediately
+     * because the client never recovers from it without a fresh login.
+     */
+    getConnectionState(): AdapterConnectionState;
     resolveUserChannel(): Promise<string | null>;
     sendMessage(params: {
         channel: string;

package/dist/adapters/discord.js

@@ -34,6 +34,14 @@ export class DiscordAdapter {
     onOwnerDetected;
     botUserId = null;
     botInfo = null;
+    /**
+     * Set when the gateway emits `Events.Invalidated` — discord.js stops
+     * reconnecting entirely on an invalidated session, so without external
+     * intervention the adapter is permanently deaf. Cleared on `start()`.
+     */
+    sessionInvalidated = false;
+    /** True once `client.login()` has resolved; cleared in `stop()`. */
+    startCompleted = false;
     pairingChallenge = null;
     attachmentStore;
     constructor(opts) {
@@ -113,6 +121,7 @@ export class DiscordAdapter {
         // Remove all listeners first to prevent duplicates on re-start
         this.client.removeAllListeners(Events.Error);
         this.client.removeAllListeners(Events.Warn);
+        this.client.removeAllListeners(Events.Invalidated);
         rawClient.removeAllListeners("raw");
         this.client.on(Events.Error, (err) => {
             logger.error({ error: err.message }, "Discord client error");
@@ -120,6 +129,14 @@ export class DiscordAdapter {
         this.client.on(Events.Warn, (info) => {
             logger.warn({ info }, "Discord client warn");
         });
+        // Session invalidation is terminal for discord.js — the client stops
+        // reconnecting. Record it so getConnectionState reports "down" and the
+        // adapter watchdog performs a full stop→start cycle.
+        this.client.on(Events.Invalidated, () => {
+            this.sessionInvalidated = true;
+            logger.error("Discord gateway session invalidated — client will not reconnect on its own");
+        });
+        this.sessionInvalidated = false;
         // We deliberately do NOT subscribe to Events.MessageCreate.
         //
         // discord.js 14.26.2 has a bug where MessageCreateAction silently
@@ -154,12 +171,28 @@ export class DiscordAdapter {
                 avatarUrl: this.client.user.avatarURL() ?? null,
             };
         }
+        this.startCompleted = true;
         logger.info({ botUser: this.client.user?.tag }, "Discord adapter connected");
     }
     async stop() {
+        this.startCompleted = false;
         this.client.destroy();
         logger.info("Discord adapter disconnected");
     }
+    /**
+     * Live gateway liveness for the adapter watchdog. discord.js resumes /
+     * reconnects on its own for transient closes, so a momentary not-ready
+     * state is normal — the watchdog only acts on consecutive "down"
+     * observations. An invalidated session is reported "down" immediately
+     * because the client never recovers from it without a fresh login.
+     */
+    getConnectionState() {
+        if (!this.startCompleted)
+            return "unknown";
+        if (this.sessionInvalidated)
+            return "down";
+        return this.client.isReady() ? "ok" : "down";
+    }
     async resolveUserChannel() {
         if (!this.mutableOwnerId)
             return null;

package/dist/adapters/notification-manager.d.ts

@@ -5,6 +5,7 @@ import type { INotificationManager, ReplyActivityHandle } from "../core/dispatch
 import type { MessageReplyTarget } from "../core/dispatcher-types.js";
 import type { SignalDetector } from "../core/signal-detector.js";
 import type { MessageHub } from "./message-hub.js";
+import type { OutboundAttachmentRef } from "./types.js";
 export interface NotificationManagerOptions {
     /**
      * Maximum number of times `deliverReply` will attempt the originating
@@ -27,6 +28,24 @@ export interface NotificationManagerOptions {
      * `setTimeout(...).unref()` so the timer never blocks daemon shutdown.
      */
     sleep?: (ms: number) => Promise<void>;
+    /**
+     * BACKGROUND_TASK_RUNNER_DESIGN.md §2.3 / §13 Decision 4 (Phase 4,
+     * opt-in) — router that hands a proactive autonomous forward to the
+     * task-delivery gate + activity-branch machinery so the REAL DM agent
+     * weaves it into the live conversation. Only invoked when the owner is
+     * active AND `config.autonomousForwardNaturalDelivery` is on; returns
+     * `true` when it enqueued the weave (this `deliverProactive` then
+     * returns without the verbatim send), `false` to fall through to the
+     * verbatim path. Wired from the event bus in bootstrap; absent in tests.
+     * The IDLE path is never rerouted — it keeps the richer verbatim
+     * delivery (multi-destination fan-out, notification_log telemetry,
+     * batching cooldown) unchanged.
+     */
+    routeAutonomousForwardNaturally?: (input: {
+        content: string;
+        event: import("@aitne/shared").Event;
+        originSessionId?: number;
+    }) => Promise<boolean>;
 }
 type DestinationMode = "default" | "configured_only";
 export declare class NotificationManager implements INotificationManager {
@@ -61,6 +80,7 @@ export declare class NotificationManager implements INotificationManager {
     private readonly replyRetryAttempts;
     private readonly replyRetryBackoffBaseMs;
     private readonly sleep;
+    private readonly routeAutonomousForwardNaturally?;
     constructor(messageHub: MessageHub, db: Database.Database, config: AgentConfig, options?: NotificationManagerOptions);
     /** Set the SignalDetector for implicit feedback tracking. */
     setSignalDetector(detector: SignalDetector): void;
@@ -84,6 +104,7 @@ export declare class NotificationManager implements INotificationManager {
         destinationMode?: DestinationMode;
         originSessionId?: number;
         replyTo?: MessageReplyTarget;
+        attachments?: readonly OutboundAttachmentRef[];
     }): Promise<void>;
     /**
      * Direct reply to a MessageEvent — bypasses quiet-hours, rate-limits,
@@ -188,7 +209,12 @@ export declare class NotificationManager implements INotificationManager {
      *  cache invalidates naturally on every call (config can hot-reload
      *  via PATCH /api/config). */
     private quietHoursWindow;
-    /** Check if hourly or daily notification limits have been reached */
+    /**
+     * Check if hourly or daily notification limits have been reached.
+     * Counting lives in the shared `core/notification-rate-limit.ts` helper
+     * so this gate and the `/api/notify` route gate
+     * (QUIET_HOURS_HARDENING_PLAN.md Phase 1) cannot drift.
+     */
     private isRateLimited;
     /**
      * Per-type gate. True when this event type has hit

package/dist/adapters/notification-manager.js

@@ -1,8 +1,11 @@
-import { isMessageEvent, getAgentDayBoundsUtc } from "@aitne/shared";
+import { isMessageEvent } from "@aitne/shared";
 import { randomUUID } from "node:crypto";
 import { isInQuietHoursAt, nextQuietHoursEndMs as computeNextQuietHoursEndMs, } from "../core/quiet-hours.js";
+import { evaluateNotificationRateLimit } from "../core/notification-rate-limit.js";
+import { SAFETY_CATEGORIES } from "../core/notification-gate.js";
 import { MessageDeliveryError } from "./message-hub.js";
 import { recordProactiveForwardDeliveries } from "../core/channel-timeline.js";
+import { classifyOwnerDmActivity } from "../core/context-builder-conversation.js";
 import { createLogger } from "../logging.js";
 const logger = createLogger("notification-manager");
 /**
@@ -26,13 +29,6 @@ function logDeliveryFailure(err, msg) {
 const NOOP_REPLY_ACTIVITY = {
     stop: async () => { },
 };
-/** Safety categories bypass quiet hours and user preferences */
-const SAFETY_CATEGORIES = [
-    "security",
-    "deadline",
-    "error",
-    "critical",
-];
 /**
  * Default bounded-retry shape for `deliverReply`. Sized so the operator's
  * worst-case wait for an acknowledged DM is small (~600 ms across two
@@ -96,6 +92,7 @@ export class NotificationManager {
     replyRetryAttempts;
     replyRetryBackoffBaseMs;
     sleep;
+    routeAutonomousForwardNaturally;
     constructor(messageHub, db, config, options = {}) {
         this.messageHub = messageHub;
         this.db = db;
@@ -108,6 +105,7 @@ export class NotificationManager {
         this.replyRetryAttempts = Math.max(1, options.replyRetryAttempts ?? DEFAULT_REPLY_RETRY_ATTEMPTS);
         this.replyRetryBackoffBaseMs = Math.max(0, options.replyRetryBackoffBaseMs ?? DEFAULT_REPLY_RETRY_BACKOFF_BASE_MS);
         this.sleep = options.sleep ?? defaultSleep;
+        this.routeAutonomousForwardNaturally = options.routeAutonomousForwardNaturally;
     }
     /** Set the SignalDetector for implicit feedback tracking. */
     setSignalDetector(detector) {
@@ -150,7 +148,7 @@ export class NotificationManager {
         // a `failed` notification row, and we fall through to the proactive
         // path so the reply still reaches the operator.
         if (options?.replyTo) {
-            const delivered = await this.deliverDirect(message, event, priority, options.replyTo);
+            const delivered = await this.deliverDirect(message, event, priority, options.replyTo, options.attachments);
             if (delivered)
                 return;
             logger.info({
@@ -254,11 +252,17 @@ export class NotificationManager {
      * (`send`'s explicit-replyTo path) to drive the §3.4-bis fallback to
      * the proactive destinations.
      */
-    async deliverDirect(message, event, priority, target) {
+    async deliverDirect(message, event, priority, target, attachments) {
         const dispatchId = randomUUID();
         const summary = truncateSummary(message);
         try {
-            const delivery = await this.messageHub.sendToPlatform(target.platform, target.channel, message, target.threadId ?? undefined);
+            // Keep the no-attachment call shape identical to the historical
+            // 4-arg form so existing adapters/tests that assert the exact send
+            // signature are unaffected; only widen to 5 args when media is
+            // present (the task-delivery idle screenshot path).
+            const delivery = attachments && attachments.length > 0
+                ? await this.messageHub.sendToPlatform(target.platform, target.channel, message, target.threadId ?? undefined, [...attachments])
+                : await this.messageHub.sendToPlatform(target.platform, target.channel, message, target.threadId ?? undefined);
             this.logNotificationRows({
                 dispatchId,
                 event,
@@ -299,6 +303,33 @@ export class NotificationManager {
         const isSafety = this.isSafetyCategory(category, priority);
         const dispatchId = randomUUID();
         const summary = truncateSummary(message);
+        // BACKGROUND_TASK_RUNNER_DESIGN.md §2.3 / §13 Decision 4 (Phase 4,
+        // opt-in) — when the owner is ACTIVE mid-conversation, hand a
+        // non-safety, non-batched proactive forward to the delivery machinery
+        // so the real DM agent weaves it into the live thread instead of this
+        // verbatim dump. The IDLE path is deliberately left on the richer
+        // verbatim delivery below (multi-destination fan-out + telemetry +
+        // batching), so this only changes the active case. The router enqueues
+        // the weave and returns true; a false (no owner-DM channel / disabled)
+        // falls through to the unchanged verbatim path.
+        if (!isSafety
+            && !fromBatch
+            && this.config.autonomousForwardNaturalDelivery
+            && this.routeAutonomousForwardNaturally
+            && classifyOwnerDmActivity({ db: this.db, config: this.config }) === "active") {
+            try {
+                const routed = await this.routeAutonomousForwardNaturally({
+                    content: message,
+                    event,
+                    ...(originSessionId !== undefined ? { originSessionId } : {}),
+                });
+                if (routed)
+                    return;
+            }
+            catch (err) {
+                logger.warn({ err, eventType: event.type }, "autonomous-forward natural delivery routing threw; falling back to verbatim proactive send");
+            }
+        }
         if (!isSafety && this.isQuietHours()) {
             this.logNotificationRows({
                 dispatchId,
@@ -613,35 +644,19 @@ export class NotificationManager {
             timezone: this.config.timezone || undefined,
         };
     }
-    /** Check if hourly or daily notification limits have been reached */
+    /**
+     * Check if hourly or daily notification limits have been reached.
+     * Counting lives in the shared `core/notification-rate-limit.ts` helper
+     * so this gate and the `/api/notify` route gate
+     * (QUIET_HOURS_HARDENING_PLAN.md Phase 1) cannot drift.
+     */
     isRateLimited() {
-        // Hourly check
-        const hourlyCount = this.db
-            .prepare(`SELECT COUNT(DISTINCT CASE
-             WHEN dispatch_id != '' THEN dispatch_id
-             ELSE CAST(id AS TEXT)
-           END) as cnt
-         FROM notification_log
-         WHERE status = 'delivered'
-           AND COALESCE(notification_type, '') != 'message.received'
-           AND created_at > datetime('now', '-1 hour')`)
-            .get();
-        if (hourlyCount.cnt >= this.config.maxNotificationsPerHour) {
-            return true;
-        }
-        // Daily check (timezone-aware agent day)
-        const bounds = getAgentDayBoundsUtc(this.config.timezone, this.config.dayBoundaryHour);
-        const dailyCount = this.db
-            .prepare(`SELECT COUNT(DISTINCT CASE
-             WHEN dispatch_id != '' THEN dispatch_id
-             ELSE CAST(id AS TEXT)
-           END) as cnt
-         FROM notification_log
-         WHERE status = 'delivered'
-           AND COALESCE(notification_type, '') != 'message.received'
-           AND created_at >= ? AND created_at < ?`)
-            .get(bounds.start, bounds.end);
-        return dailyCount.cnt >= this.config.maxNotificationsPerDay;
+        return evaluateNotificationRateLimit(this.db, {
+            maxNotificationsPerHour: this.config.maxNotificationsPerHour,
+            maxNotificationsPerDay: this.config.maxNotificationsPerDay,
+            timezone: this.config.timezone,
+            dayBoundaryHour: this.config.dayBoundaryHour,
+        }).limited;
     }
     /**
      * Per-type gate. True when this event type has hit

package/dist/adapters/slack-adapter.d.ts

@@ -1,4 +1,4 @@
-import type { MessageAdapter, OnMessageCallback, OutboundAttachmentRef } from "./types.js";
+import type { AdapterConnectionState, MessageAdapter, OnMessageCallback, OutboundAttachmentRef } from "./types.js";
 import type { AttachmentStore } from "../services/attachments/store.js";
 export interface SlackBotInfo {
     botUserId: string | null;
@@ -56,6 +56,12 @@ export declare class SlackAdapter implements MessageAdapter {
     private readonly onMessage;
     private readonly onOwnerDetected;
     private app;
+    /**
+     * True once `app.start()` has resolved (cleared in `stop()`). Gates the
+     * watchdog probe: before the first successful start there is no socket
+     * to assess, and reporting "down" then would trigger pointless restarts.
+     */
+    private startCompleted;
     private botUserId;
     private botInfo;
     private pairingChallenge;
@@ -75,6 +81,25 @@ export declare class SlackAdapter implements MessageAdapter {
     static fetchBotInfo(botToken: string): Promise<SlackBotInfo>;
     start(): Promise<void>;
     stop(): Promise<void>;
+    /**
+     * Live Socket Mode liveness for the adapter watchdog.
+     *
+     * Bolt's `App` keeps its `SocketModeReceiver` private, but the receiver's
+     * `client` (a `@slack/socket-mode` `SocketModeClient`) and the client's
+     * `websocket` (a `SlackWebSocket` with a public `isActive()`) are public
+     * fields — only the first hop needs a cast. `@slack/socket-mode` v2
+     * reconnects on `close` with an UNBOUNDED linear backoff, but a reconnect
+     * chain can still die permanently (`UnrecoverableSocketModeStartError`,
+     * or an exception escaping the recursive retry), and after machine sleep
+     * the ping-pong watchdog may take minutes to notice a dead socket. The
+     * adapter watchdog uses this probe to force a full stop→start cycle when
+     * the socket stays dead.
+     *
+     * Returns "unknown" (watchdog: no action) when the receiver shape is not
+     * what we expect — a Bolt upgrade must degrade to "no watchdog" rather
+     * than to restart loops.
+     */
+    getConnectionState(): AdapterConnectionState;
     resolveUserChannel(): Promise<string | null>;
     sendMessage(params: {
         channel: string;

package/dist/adapters/slack-adapter.js

@@ -34,6 +34,12 @@ export class SlackAdapter {
     onMessage;
     onOwnerDetected;
     app = null;
+    /**
+     * True once `app.start()` has resolved (cleared in `stop()`). Gates the
+     * watchdog probe: before the first successful start there is no socket
+     * to assess, and reporting "down" then would trigger pointless restarts.
+     */
+    startCompleted = false;
     botUserId = null;
     botInfo = null;
     pairingChallenge = null;
@@ -147,15 +153,50 @@ export class SlackAdapter {
             await this.handleMessage(message);
         });
         await this.app.start();
+        this.startCompleted = true;
         logger.info({ botUserId: this.botUserId }, "Slack adapter connected (Socket Mode)");
     }
     async stop() {
+        this.startCompleted = false;
         if (this.app) {
             await this.app.stop();
             this.app = null;
         }
         logger.info("Slack adapter disconnected");
     }
+    /**
+     * Live Socket Mode liveness for the adapter watchdog.
+     *
+     * Bolt's `App` keeps its `SocketModeReceiver` private, but the receiver's
+     * `client` (a `@slack/socket-mode` `SocketModeClient`) and the client's
+     * `websocket` (a `SlackWebSocket` with a public `isActive()`) are public
+     * fields — only the first hop needs a cast. `@slack/socket-mode` v2
+     * reconnects on `close` with an UNBOUNDED linear backoff, but a reconnect
+     * chain can still die permanently (`UnrecoverableSocketModeStartError`,
+     * or an exception escaping the recursive retry), and after machine sleep
+     * the ping-pong watchdog may take minutes to notice a dead socket. The
+     * adapter watchdog uses this probe to force a full stop→start cycle when
+     * the socket stays dead.
+     *
+     * Returns "unknown" (watchdog: no action) when the receiver shape is not
+     * what we expect — a Bolt upgrade must degrade to "no watchdog" rather
+     * than to restart loops.
+     */
+    getConnectionState() {
+        if (!this.app || !this.startCompleted)
+            return "unknown";
+        const receiver = this.app.receiver;
+        const websocket = receiver?.client?.websocket;
+        if (!websocket || typeof websocket.isActive !== "function") {
+            return "unknown";
+        }
+        try {
+            return websocket.isActive() ? "ok" : "down";
+        }
+        catch {
+            return "unknown";
+        }
+    }
     async resolveUserChannel() {
         if (!this.app || !this.mutableOwnerId)
             return null;

package/dist/adapters/telegram-adapter.d.ts

@@ -1,4 +1,4 @@
-import type { MessageAdapter, OnMessageCallback, OutboundAttachmentRef } from "./types.js";
+import type { AdapterConnectionState, MessageAdapter, OnMessageCallback, OutboundAttachmentRef } from "./types.js";
 import type { AttachmentStore } from "../services/attachments/store.js";
 export interface TelegramBotInfo {
     id: number;
@@ -59,6 +59,15 @@ export declare class TelegramAdapter implements MessageAdapter {
     private readonly attachmentStore;
     private bot;
     private botInfo;
+    /**
+     * Non-null when the long-poll loop has died. telegraf's `launch()`
+     * promise stays pending while polling runs and settles when the loop
+     * exits: it self-retries network errors / 429 / 5xx internally, but any
+     * other failure (401 invalid token, 409 conflicting consumer, an
+     * unexpected throw) kills the loop for good. Without observing that
+     * settlement the daemon would sit "connected" while receiving nothing.
+     */
+    private pollingDeadError;
     /** Active pairing challenge (null when pairing isn't in progress). */
     private pairingChallenge;
     /** Buffers for Telegram media albums (media_group_id → accumulated items). */
@@ -84,6 +93,14 @@ export declare class TelegramAdapter implements MessageAdapter {
     start(): Promise<void>;
     stop(): Promise<void>;
     resolveUserChannel(): Promise<string | null>;
+    /**
+     * Live long-poll liveness for the adapter watchdog. "ok" means the
+     * polling loop is still running (telegraf retries transient network /
+     * 429 / 5xx failures internally, so an offline laptop stays "ok" and
+     * recovers on its own); "down" means the loop has exited and only a
+     * full stop→start cycle brings messages back.
+     */
+    getConnectionState(): AdapterConnectionState;
     sendMessage(params: {
         channel: string;
         text: string;