@cello-protocol/daemon 0.0.196 → 0.0.198

package/dist/start-agent.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Bringing an agent online, and reporting honestly whether it can actually be REACHED.
+ *
+ * "Online" and "reachable" are two different facts and the whole value of this path is refusing to
+ * collapse them. An agent marked online whose standing receiver never came up looks identical to a
+ * healthy one at every surface — so a second `cello_start_agent`, which is what an operator runs
+ * when the first seemed not to work, reports the receiver's REAL state rather than a bare ok.
+ */
+import type { AgentInfo, Logger } from "./types.js";
+import type { SessionNodeManager } from "./session-node-manager.js";
+import type { SignalingManager } from "@cello-protocol/transport";
+import type { KeyProvider } from "@cello-protocol/crypto";
+import type { NotificationDispatcher } from "./notification-dispatcher.js";
+/** What starting an agent can answer. The readiness half is why this is a union and not a boolean. */
+export type StartAgentResult = {
+    ok: true;
+    standing_receiver: "ready";
+} | {
+    ok: true;
+    standing_receiver: "starting";
+    standing_receiver_cause: string | undefined;
+    guidance: string;
+} | {
+    ok: false;
+    reason: string;
+    guidance: string;
+};
+export interface StartAgentDeps {
+    logger: Logger;
+    sessionNodeManager: SessionNodeManager;
+    /** Live containers — a copy would report a stale online set forever. */
+    agents: ReadonlyArray<AgentInfo>;
+    onlineAgents: Set<string>;
+    explicitlyOfflineAgents: Set<string>;
+    keyProviders: Map<string, KeyProvider>;
+    /**
+     * ⚠️ A GETTER. The dispatcher is constructed ~575 lines BELOW this call and is only ever used when
+     * an agent is actually started, which is always later. It is a `const`, so by value this would be
+     * a temporal-dead-zone crash at boot rather than a silent absence — loud, but still wrong.
+     */
+    getNotificationDispatcher: () => NotificationDispatcher;
+    /** ⚠️ NOT a getter — for an agent with no manager this CONSTRUCTS one and dials. */
+    getAgentSignaling: (agentName: string, kp: KeyProvider, pubkeyHex: string) => {
+        signaling: SignalingManager;
+    };
+    autoRecoverForAgent: (agentName: string, trigger?: string) => Promise<void>;
+    flushAwaitingContent: (filterAgentName?: string) => Promise<void>;
+}
+export declare function createStartAgent(deps: StartAgentDeps): {
+    startAgentInternal: (name: string) => {
+        ok: true;
+        standing_receiver: "ready";
+    } | {
+        ok: true;
+        standing_receiver: "starting";
+        standing_receiver_cause: string | undefined;
+        guidance: string;
+    } | {
+        ok: false;
+        reason: string;
+        guidance: string;
+    };
+};
+//# sourceMappingURL=start-agent.d.ts.map

package/dist/start-agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"start-agent.d.ts","sourceRoot":"","sources":["../src/start-agent.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAG3E,sGAAsG;AACtG,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,iBAAiB,EAAE,OAAO,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,iBAAiB,EAAE,UAAU,CAAC;IAAC,uBAAuB,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC1G;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,wEAAwE;IACxE,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACjC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,uBAAuB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACvC;;;;OAIG;IACH,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;IACxD,oFAAoF;IACpF,iBAAiB,EAAE,CACjB,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,KAClD;QAAE,SAAS,EAAE,gBAAgB,CAAA;KAAE,CAAC;IACrC,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,oBAAoB,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc;+BAkBjB,MAAM,KACpC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,iBAAiB,EAAE,OAAO,CAAA;KAAE,GACxC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,iBAAiB,EAAE,UAAU,CAAC;QAAC,uBAAuB,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAC1G;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;EAyHpD"}

package/dist/start-agent.js

@@ -0,0 +1,136 @@
+import { extractErrorMessage } from "./error-message.js";
+export function createStartAgent(deps) {
+    const { logger, sessionNodeManager, agents, onlineAgents, explicitlyOfflineAgents, keyProviders, getNotificationDispatcher, getAgentSignaling, autoRecoverForAgent, flushAwaitingContent, } = deps;
+    // ─── MCP-001: cello_start_agent handler ───
+    // M8C-AUTOSTART-1 (A2): the shared start path. Extracted from cello_start_agent so cello_use_agent
+    // can AUTO-START an offline agent through the exact same code (idempotent, same signaling +
+    // standing-receiver setup, same agent_state_changed event) — never a divergent shim-side retry.
+    // Permissive by design (D12): an agent that exists goes online regardless of directory
+    // registration state (online-without-registration is an established contract). Returns a
+    // structured failure so callers can surface agent_start_failed with a real reason + guidance.
+    /**
+     * `standing_receiver` is part of the SUCCESS shape, not an optional extra — `DOD-M15-START-AGENT-
+     * UNAWAITED-1`. A bare `{ ok: true }` claimed the agent was started and reachable when only the
+     * first half was known, and the union makes the two states impossible to conflate at a call site.
+     */
+    function startAgentInternal(name) {
+        const agent = agents.find((a) => a.name === name);
+        if (!agent || agent.state === "load_failed") {
+            return { ok: false, reason: "agent_not_found", guidance: `Agent '${name}' does not exist. Run 'cello login' to register agents, or check agent names with cello_agents.` };
+        }
+        if (onlineAgents.has(name)) {
+            // Idempotent — already online, no event.
+            //
+            // It still reports REAL readiness rather than a bare ok. "Already online" says this daemon
+            // marked the agent online at some earlier moment; it says nothing about whether the receiver
+            // that ensure was firing ever came up. An operator who calls start twice — which is exactly
+            // what someone does when the first one seemed not to work — would otherwise get the most
+            // reassuring answer in the run on the attempt where something is actually wrong.
+            const readyNow = sessionNodeManager.getStandingReceiverInfo(name) !== null;
+            if (readyNow)
+                return { ok: true, standing_receiver: "ready" };
+            const cause = sessionNodeManager.standingReceiverAbsenceReason(name);
+            return {
+                ok: true,
+                standing_receiver: "starting",
+                standing_receiver_cause: cause,
+                guidance: `'${name}' was already online, and its standing receiver is not up (${cause}). Outbound ` +
+                    `sends and cello_initiate_session ensure it on demand. An inbound session arriving before ` +
+                    `it is ready is refused with 'standing_receiver_unavailable' — this daemon, not the ` +
+                    `counterparty. If it stays this way, stop the agent and start it again.`,
+            };
+        }
+        onlineAgents.add(name);
+        // Pressing start clears the deliberate-offline mark — that is what makes the switch reversible.
+        explicitlyOfflineAgents.delete(name);
+        // CELLO-M7-CONN-001 (DOD-CONN-2, code-review HIGH): the "online" transition establishes THIS
+        // agent's OWN directory signaling connection (the documented getAgentSignaling "online" trigger),
+        // so the directory has a stream to push inbound session_assignment / seal_interrupted_request to.
+        // Without this, a started receiver agent sitting in cello_await_session (notably after a daemon
+        // restart, where login does NOT auto-start agents) would have no stream and never receive inbound —
+        // a regression of the pre-CONN-001 keystone, which connected the primary at startup. Lazy +
+        // idempotent (getAgentSignaling reuses an existing manager); the test path returns the shared one.
+        const startKp = keyProviders.get(name);
+        if (startKp && agent.pubkey) {
+            getAgentSignaling(name, startKp, agent.pubkey);
+            logger.info("agent.directory.connection.initiated", { agentName: name, agentPubkey: agent.pubkey });
+        }
+        // DOD-LOOP-1: each online agent gets its OWN standing receiver, so two agents on one daemon
+        // (loopback) never contend for a single one. Fire-and-forget (initiate/accept also ensure on
+        // demand); never let it throw out of the handler. Once the SR is up, re-park any of THIS
+        // agent's un-acked awaiting content (the crash backstop — its node was unavailable at the
+        // pre-IPC startup flush because no agent was online yet).
+        // The standing-receiver ensure + sender re-park; a rejection here is a standing-receiver failure.
+        void sessionNodeManager.ensureStandingReceiverForAgent(name)
+            .then(() => flushAwaitingContent(name))
+            .catch((err) => {
+            logger.warn("session.standing_receiver.ensure.failed", {
+                agentName: name,
+                reason: extractErrorMessage(err),
+                // `DOD-M15-START-AGENT-UNAWAITED-1`. The operator has ALREADY been told `ok: true` — this
+                // handler answered before this promise settled — so nothing corrects that answer if this
+                // is permanent. Say what it costs them here, because this line is the only account.
+                impact: "cello_start_agent already answered ok for this agent, and its standing receiver did not " +
+                    "come up. The agent is online to the directory and CANNOT accept an inbound session: a " +
+                    "counterparty dialling it is refused standing_receiver_unavailable. Initiate and accept " +
+                    "each re-ensure on demand, so this may still recover on the next attempt; if it does not, " +
+                    "stop and restart the agent.",
+            });
+        })
+            // DOD-MSG-4 (auto-recover-on-reconnect): RECEIVER drains its parked mailbox from every relay it
+            // has sessions on (symmetric to the sender re-park). Its own stage so a failure is labelled
+            // correctly (review #4), not as a standing-receiver error. autoRecoverForAgent catches per-relay
+            // errors internally, so this .catch is a backstop only.
+            .then(() => autoRecoverForAgent(name, "agent_start"))
+            .catch((err) => {
+            logger.warn("content.recover.auto.failed", { agentName: name, stage: "agent_start", error: extractErrorMessage(err) });
+        });
+        /**
+         * `DOD-M15-START-AGENT-UNAWAITED-1` — SAY WHETHER THE AGENT CAN ACTUALLY HEAR YET.
+         *
+         * The ensure above is fire-and-forget and that is deliberate: initiate and accept both ensure on
+         * demand, and awaiting it here would turn a transient network failure into a failed start. **The
+         * defect was never the timing — it was the CLAIM.** `{ ok: true }` with nothing else reads as
+         * "your agent is running and reachable", and a session landing in the window before the receiver
+         * exists is refused `standing_receiver_unavailable` — a precondition on OUR side, surfacing to
+         * the operator as though the counterparty or the directory were at fault.
+         *
+         * ⚠️ **This field is only worth having because it can genuinely say `ready`.** Computed one line
+         * after firing an async ensure, a naive readiness flag would be `starting` on every call — a
+         * field that can never take its other value, which is the same defect as a log line reporting a
+         * verdict its producer cannot have. It escapes that because `ensureStandingReceiverForAgent` is
+         * IDEMPOTENT: an agent that already holds a receiver (a repeat start, or one whose receiver
+         * survived) has one at this instant and reports `ready` truthfully.
+         *
+         * `cause` is read from the same four-way answer the refusal path uses, so the response and the
+         * eventual error agree instead of describing the same state in two vocabularies.
+         */
+        const receiverReady = sessionNodeManager.getStandingReceiverInfo(name) !== null;
+        const startingCause = receiverReady ? undefined : sessionNodeManager.standingReceiverAbsenceReason(name);
+        logger.info("agent.online", {
+            agentName: name,
+            agentPubkey: agent.pubkey ?? "",
+            standingReceiver: receiverReady ? "ready" : "starting",
+            ...(startingCause !== undefined ? { standingReceiverCause: startingCause } : {}),
+        });
+        // MCP-002: Broadcast agent_state_changed to ALL connections
+        getNotificationDispatcher().dispatchAgentStateChanged(name, "online", "started");
+        if (receiverReady)
+            return { ok: true, standing_receiver: "ready" };
+        return {
+            ok: true,
+            standing_receiver: "starting",
+            standing_receiver_cause: startingCause,
+            // Invariant: an agent-facing response carries an affordance. Naming the refusal text is the
+            // load-bearing half — an operator who hits it in the next second can otherwise only conclude
+            // the other side is broken.
+            guidance: `'${name}' is online and its standing receiver is still being built. Outbound sends and ` +
+                `cello_initiate_session ensure it on demand, so ordinary use is fine. A session arriving in ` +
+                `the next moment can be refused with 'standing_receiver_unavailable' — that is this daemon ` +
+                `not being ready yet, NOT the counterparty being unreachable. It clears on its own; ` +
+                `cello_status reports the receiver once it is up.`,
+        };
+    }
+    return { startAgentInternal };
+}
+//# sourceMappingURL=start-agent.js.map

package/dist/start-agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"start-agent.js","sourceRoot":"","sources":["../src/start-agent.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AA8BzD,MAAM,UAAU,gBAAgB,CAAC,IAAoB;IACnD,MAAM,EACJ,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,YAAY,EAAE,uBAAuB,EAAE,YAAY,EACvF,yBAAyB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,oBAAoB,GACxF,GAAG,IAAI,CAAC;IAET,6CAA6C;IAC7C,mGAAmG;IACnG,4FAA4F;IAC5F,gGAAgG;IAChG,uFAAuF;IACvF,yFAAyF;IACzF,8FAA8F;IAC9F;;;;OAIG;IACH,SAAS,kBAAkB,CAAC,IAAY;QAItC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;YAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,IAAI,iGAAiG,EAAE,CAAC;QAC7K,CAAC;QACD,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,yCAAyC;YACzC,EAAE;YACF,2FAA2F;YAC3F,6FAA6F;YAC7F,4FAA4F;YAC5F,yFAAyF;YACzF,iFAAiF;YACjF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;YAC3E,IAAI,QAAQ;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,kBAAkB,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC;YACrE,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,iBAAiB,EAAE,UAAU;gBAC7B,uBAAuB,EAAE,KAAK;gBAC9B,QAAQ,EACN,IAAI,IAAI,8DAA8D,KAAK,cAAc;oBACzF,2FAA2F;oBAC3F,qFAAqF;oBACrF,wEAAwE;aAC3E,CAAC;QACJ,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,gGAAgG;QAChG,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,6FAA6F;QAC7F,kGAAkG;QAClG,kGAAkG;QAClG,gGAAgG;QAChG,oGAAoG;QACpG,4FAA4F;QAC5F,mGAAmG;QACnG,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YAC5B,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,4FAA4F;QAC5F,6FAA6F;QAC7F,yFAAyF;QACzF,0FAA0F;QAC1F,0DAA0D;QAC1D,kGAAkG;QAClG,KAAK,kBAAkB,CAAC,8BAA8B,CAAC,IAAI,CAAC;aACzD,IAAI,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;aACtC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;gBACrD,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;gBAChC,0FAA0F;gBAC1F,yFAAyF;gBACzF,oFAAoF;gBACpF,MAAM,EACJ,0FAA0F;oBAC1F,wFAAwF;oBACxF,yFAAyF;oBACzF,2FAA2F;oBAC3F,6BAA6B;aAChC,CAAC,CAAC;QACL,CAAC,CAAC;YACF,gGAAgG;YAChG,4FAA4F;YAC5F,iGAAiG;YACjG,wDAAwD;aACvD,IAAI,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;aACpD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzH,CAAC,CAAC,CAAC;QACL;;;;;;;;;;;;;;;;;;;WAmBG;QACH,MAAM,aAAa,GAAG,kBAAkB,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;QAChF,MAAM,aAAa,GAAG,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC;QACzG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE;YAC1B,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;YAC/B,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU;YACtD,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjF,CAAC,CAAC;QACH,4DAA4D;QAC5D,yBAAyB,EAAE,CAAC,yBAAyB,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QACjF,IAAI,aAAa;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAgB,EAAE,CAAC;QAC5E,OAAO;YACL,EAAE,EAAE,IAAI;YACR,iBAAiB,EAAE,UAAmB;YACtC,uBAAuB,EAAE,aAAa;YACtC,4FAA4F;YAC5F,6FAA6F;YAC7F,4BAA4B;YAC5B,QAAQ,EACN,IAAI,IAAI,iFAAiF;gBACzF,6FAA6F;gBAC7F,4FAA4F;gBAC5F,qFAAqF;gBACrF,kDAAkD;SACrD,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAChC,CAAC"}

package/dist/status-handler.d.ts

@@ -0,0 +1,46 @@
+/**
+ * `cello_status` — what ONE CONNECTION can see of this daemon, from its own perspective.
+ *
+ * The widest read in the daemon and one of the narrowest dependency lists: nine values, every one a
+ * reader, nothing written. It reports the agents this connection may act as, its directory
+ * signaling, where the consortium manifest came from, unresolved directory nodes, interrupted
+ * sessions and live ones.
+ *
+ * ⚠️ `unresolvedNodesForStatus` DID NOT COME WITH IT, and that is deliberate. The daemon-wide
+ * `getStatus()` — what `cello status` at a terminal renders — calls the same helper, and it is the
+ * surface that was silent on 2026-07-31 while every session failed. A helper with two consumers
+ * moves only when both move; here it is injected instead.
+ */
+import { type ManifestOrigin } from "./manifest-validity.js";
+import type { IpcHandler } from "./ipc-server.js";
+import type { AgentInfo, ActiveSessionInfo, DirectorySignalingState, InterruptedSessionInfo } from "./types.js";
+import type { IDirectoryChallengeVerifier } from "@cello-protocol/transport";
+import type { ConsortiumManifest } from "@cello-protocol/protocol-types";
+export interface StatusHandlerDeps {
+    handlers: Map<string, IpcHandler>;
+    /** Every agent this CONNECTION may act as — not every agent the daemon holds. */
+    getAgentsForConnection: (connectionId: string) => AgentInfo[];
+    directorySignalingStatus: () => DirectorySignalingState;
+    /** Where the verified manifest came from, for a reader deciding how much the rest is worth. */
+    manifestOrigin: ManifestOrigin;
+    manifestProvider: {
+        getCurrentManifest: () => Pick<ConsortiumManifest, "not_before" | "expires"> | null;
+    } | undefined;
+    /** The configured directory URL, or undefined when nothing was configured. */
+    directoryHttpUrl: string | undefined;
+    /**
+     * The directory challenge verifier, or undefined when this daemon holds none. TYPED, not
+     * `unknown`: the posture line an operator reads is derived from `!== undefined`, so a dep loose
+     * enough to accept `null` or the wrong variable would report `directory_authentication: enforced`
+     * on a daemon that enforces nothing — the failure `DOD-M15-DIRAUTH-1` exists to prevent.
+     */
+    challengeVerifier: IDirectoryChallengeVerifier | undefined;
+    /** Emits ONLY when something is wrong or nothing has looked recently enough to say. */
+    unresolvedNodesForStatus: () => {
+        directory_endpoints_unresolved: unknown;
+    } | undefined;
+    buildInterruptedSessions: () => InterruptedSessionInfo[];
+    buildActiveSessions: () => ActiveSessionInfo[];
+}
+export declare function registerStatusHandler(deps: StatusHandlerDeps): void;
+//# sourceMappingURL=status-handler.d.ts.map

package/dist/status-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-handler.d.ts","sourceRoot":"","sources":["../src/status-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAsD,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAGjH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAChH,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAEzE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,iFAAiF;IACjF,sBAAsB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;IAC9D,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;IACxD,+FAA+F;IAC/F,cAAc,EAAE,cAAc,CAAC;IAC/B,gBAAgB,EAAE;QAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC,kBAAkB,EAAE,YAAY,GAAG,SAAS,CAAC,GAAG,IAAI,CAAA;KAAE,GAAG,SAAS,CAAC;IACtH,8EAA8E;IAC9E,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC;;;;;OAKG;IACH,iBAAiB,EAAE,2BAA2B,GAAG,SAAS,CAAC;IAC3D,uFAAuF;IACvF,wBAAwB,EAAE,MAAM;QAAE,8BAA8B,EAAE,OAAO,CAAA;KAAE,GAAG,SAAS,CAAC;IACxF,wBAAwB,EAAE,MAAM,sBAAsB,EAAE,CAAC;IACzD,mBAAmB,EAAE,MAAM,iBAAiB,EAAE,CAAC;CAChD;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CA+CnE"}

package/dist/status-handler.js

@@ -0,0 +1,58 @@
+/**
+ * `cello_status` — what ONE CONNECTION can see of this daemon, from its own perspective.
+ *
+ * The widest read in the daemon and one of the narrowest dependency lists: nine values, every one a
+ * reader, nothing written. It reports the agents this connection may act as, its directory
+ * signaling, where the consortium manifest came from, unresolved directory nodes, interrupted
+ * sessions and live ones.
+ *
+ * ⚠️ `unresolvedNodesForStatus` DID NOT COME WITH IT, and that is deliberate. The daemon-wide
+ * `getStatus()` — what `cello status` at a terminal renders — calls the same helper, and it is the
+ * surface that was silent on 2026-07-31 while every session failed. A helper with two consumers
+ * moves only when both move; here it is injected instead.
+ */
+import { classifyManifestValidity, describeManifestValidity } from "./manifest-validity.js";
+import { describeDirectoryAuth } from "./directory-auth-posture.js";
+import { resolveDirectoryUrl } from "./directory-bootstrap.js";
+export function registerStatusHandler(deps) {
+    const { handlers, getAgentsForConnection, directorySignalingStatus, manifestOrigin, manifestProvider, directoryHttpUrl, challengeVerifier, unresolvedNodesForStatus, buildInterruptedSessions, buildActiveSessions, } = deps;
+    handlers.set("cello_status", async (_params, connectionId) => {
+        return {
+            daemon: "running",
+            directory_signaling: directorySignalingStatus(),
+            // CAN I ACTUALLY REACH THE DIRECTORY — not just "is my socket up?".
+            //
+            // These are different facts and they diverged for an hour on 2026-07-31. libp2p signaling
+            // dials multiaddrs from the bundled manifest, so it stayed connected and every agent reported
+            // online, while a cached NXDOMAIN meant nothing that needed the HTTP endpoint resolved. The
+            // roster came back empty, so every threshold ceremony failed — surfacing to the operator as
+            // counterparty_offline, then directory_below_threshold, then ceremony_exhausted. Three errors,
+            // none of them naming DNS, while the reason sat in the log 26 times per node.
+            //
+            // Omitted entirely when nothing is failing, so a healthy status stays quiet.
+            ...(unresolvedNodesForStatus() ?? {}),
+            // DOD-M15-MANIFEST-EXPIRY-LIVE-1: contributes NOTHING while the manifest is comfortably in
+            // window. A field present on every status read for the years a manifest is valid is furniture,
+            // not a warning, and it teaches the reader to skip the block that matters.
+            ...(describeManifestValidity(classifyManifestValidity(manifestProvider?.getCurrentManifest() ?? null, Date.now()), manifestOrigin) ?? {}),
+            // DOD-M15-DIRAUTH-1: the posture is STATED, in both directions. Unlike every other field in
+            // this milestone the healthy case is reported too — the defect is precisely that "enforced"
+            // and "skipped" differ only by the absence of a log line, so an operator must be able to
+            // confirm it is on, not merely fail to find evidence that it is off.
+            ...describeDirectoryAuth({
+                verifierPresent: challengeVerifier !== undefined,
+                directoryUrl: directoryHttpUrl ?? resolveDirectoryUrl(process.env),
+                // Review F5: with neither set, `resolveDirectoryUrl` re-picks a RANDOM bundled endpoint on
+                // every call, so there is no configured URL to quote or to blame.
+                urlExplicitlyConfigured: directoryHttpUrl !== undefined || process.env["CELLO_DIRECTORY_URL"] !== undefined,
+            }),
+            agents: getAgentsForConnection(connectionId),
+            // M-1 PULL: live MCP clients must see interrupted sessions too, exactly as
+            // the daemon-wide getStatus() surfaces them.
+            interrupted_sessions: buildInterruptedSessions(),
+            // M8B F16: per-session liveness on the MCP surface too.
+            active_sessions: buildActiveSessions(),
+        };
+    });
+}
+//# sourceMappingURL=status-handler.js.map

package/dist/status-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-handler.js","sourceRoot":"","sources":["../src/status-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAuB,MAAM,wBAAwB,CAAC;AACjH,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AA6B/D,MAAM,UAAU,qBAAqB,CAAC,IAAuB;IAC3D,MAAM,EACJ,QAAQ,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,cAAc,EAAE,gBAAgB,EAC5F,gBAAgB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,mBAAmB,GAC7G,GAAG,IAAI,CAAC;IAET,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE;QAC3D,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,mBAAmB,EAAE,wBAAwB,EAAE;YAC/C,oEAAoE;YACpE,EAAE;YACF,0FAA0F;YAC1F,8FAA8F;YAC9F,4FAA4F;YAC5F,4FAA4F;YAC5F,+FAA+F;YAC/F,8EAA8E;YAC9E,EAAE;YACF,6EAA6E;YAC7E,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC;YACrC,2FAA2F;YAC3F,+FAA+F;YAC/F,2EAA2E;YAC3E,GAAG,CAAC,wBAAwB,CAC1B,wBAAwB,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,IAAI,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,EACpF,cAAc,CACf,IAAI,EAAE,CAAC;YACR,4FAA4F;YAC5F,4FAA4F;YAC5F,yFAAyF;YACzF,qEAAqE;YACrE,GAAG,qBAAqB,CAAC;gBACvB,eAAe,EAAE,iBAAiB,KAAK,SAAS;gBAChD,YAAY,EAAE,gBAAgB,IAAI,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC;gBAClE,2FAA2F;gBAC3F,kEAAkE;gBAClE,uBAAuB,EAAE,gBAAgB,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,KAAK,SAAS;aAC5G,CAAC;YACF,MAAM,EAAE,sBAAsB,CAAC,YAAY,CAAC;YAC5C,2EAA2E;YAC3E,6CAA6C;YAC7C,oBAAoB,EAAE,wBAAwB,EAAE;YAChD,wDAAwD;YACxD,eAAe,EAAE,mBAAmB,EAAE;SACvC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/test-handlers.d.ts

@@ -0,0 +1,62 @@
+/**
+ * The verbs that exist for TESTS, and nothing else.
+ *
+ * Two groups with different guards, and the difference is why this file has a header. The seven
+ * `__test_*` verbs sit inside `CELLO_ENV === "test"` and cannot be reached in production. The six
+ * above them — `queue_failed_send`, `debug_inject_park_fault`, `enqueue_awaiting_content`,
+ * `mark_content_acked`, `check_nonce`, `drain_session` — are NOT gated, and FOUR of them write state.
+ * `check_nonce` is the one to notice: it does not merely read, it `checkAndAdd`s, which INSERTs into
+ * `session_seen_nonces` and survives a restart — so pre-registering a nonce makes the real message
+ * carrying it arrive and be discarded as a duplicate, logged at debug and nowhere else. Their only
+ * callers are tests (measured: nothing in the CLI, nothing in the MCP shim), so a production daemon
+ * answers six verbs nobody outside a test has a use for.
+ *
+ * ⚠️ THE ASYMMETRY IS RECORDED, NOT FIXED HERE. Gating them changes behaviour and this is a movement
+ * order; the guard structure moved exactly as it was. It is written into the order's *Newly
+ * discovered* so it can be ranked — rather than inherited by the next reader, who would see the file
+ * name and assume the whole thing is unreachable in production.
+ *
+ * ⚠️ TWO PRODUCTION REGISTRATIONS DID NOT COME WITH IT. `contentPark.registerHandlers(handlers)` and
+ * `registerInboundSessionHandlers(handlers)` sit between the two groups in the original file and are
+ * real surfaces. They stay in the composition root; only the test verbs on either side moved. That
+ * DOES change registration order — those two now run after all thirteen instead of between them —
+ * and it is inert: dispatch resolves against the live map on each request rather than snapshotting
+ * it, the IPC server is not created until every registration has run, and none of these verb names
+ * collides. Written down because "do not reorder registration" is a rule of this order, and the
+ * next reader deserves the measurement rather than the worry.
+ */
+import type { IpcHandler } from "./ipc-server.js";
+import type { SessionNodeManager } from "./session-node-manager.js";
+import type { Logger } from "./types.js";
+import type { RetryQueue } from "./retry-queue.js";
+import type { NonceDedupStore } from "./nonce-dedup.js";
+import { type AnyRefusalReason } from "./refusal-reasons.js";
+import type { InboundSessionEvent } from "./inbound-sessions.js";
+/** The per-connection agent selection, as these verbs need to read it. */
+export interface TestConnState {
+    currentAgent: string | null;
+}
+export interface TestHandlerDeps {
+    handlers: Map<string, IpcHandler>;
+    logger: Logger;
+    sessionNodeManager: SessionNodeManager;
+    retryQueue: RetryQueue;
+    nonceDedupStore: NonceDedupStore;
+    /** Opens a delivery window and hands back the release. */
+    deliveryOpens: {
+        begin: (openerPubkey: string, targetPubkey: string) => () => void;
+    };
+    /** Name → pubkey, empty string when this daemon holds no such agent. */
+    pubkeyOfAgent: (name: string) => string;
+    /** The one dispatch path that also reaches Telegram — tests drive it to assert both halves. */
+    dispatchSessionStateChangedWithTelegram: (agentName: string, sessionId: string, state: string, counterpartyPubkey: string | null) => void;
+    /** The inbound-session queue machinery these verbs seed, injected rather than reached for. */
+    enqueueInboundSession: (agentName: string, event: InboundSessionEvent) => void;
+    recordRefusal: (agentName: string, sessionIdHex: string, counterpartyPubkeyHex: string, reason: AnyRefusalReason) => void;
+    /** The queue itself — one verb backdates the entry it just enqueued, which needs the container. */
+    inboundSessionQueues: Map<string, InboundSessionEvent[]>;
+    /** Read this connection's agent selection. The READ, not the container. */
+    getConnState: (connectionId: string) => TestConnState | undefined;
+}
+export declare function registerTestHandlers(deps: TestHandlerDeps): void;
+//# sourceMappingURL=test-handlers.d.ts.map

package/dist/test-handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-handlers.d.ts","sourceRoot":"","sources":["../src/test-handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAqC,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAChG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAEjE,0EAA0E;AAC1E,MAAM,WAAW,aAAa;IAAG,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAAE;AAE/D,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,UAAU,EAAE,UAAU,CAAC;IACvB,eAAe,EAAE,eAAe,CAAC;IACjC,0DAA0D;IAC1D,aAAa,EAAE;QAAE,KAAK,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,MAAM,IAAI,CAAA;KAAE,CAAC;IACrF,wEAAwE;IACxE,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACxC,+FAA+F;IAC/F,uCAAuC,EAAE,CACvC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,kBAAkB,EAAE,MAAM,GAAG,IAAI,KAC9B,IAAI,CAAC;IACV,8FAA8F;IAC9F,qBAAqB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAC/E,aAAa,EAAE,CACb,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,qBAAqB,EAAE,MAAM,EAC7B,MAAM,EAAE,gBAAgB,KACrB,IAAI,CAAC;IACV,mGAAmG;IACnG,oBAAoB,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,2EAA2E;IAC3E,YAAY,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,aAAa,GAAG,SAAS,CAAC;CACnE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CAqQhE"}