@ouro.bot/cli 0.1.0-alpha.28 → 0.1.0-alpha.280

package/dist/heart/daemon/daemon.js

@@ -34,18 +34,243 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OuroDaemon = void 0;
+exports.parseOrphanPidsFromPs = parseOrphanPidsFromPs;
+exports.filterPidfilePidsToActualOrphans = filterPidfilePidsToActualOrphans;
+exports.killOrphanProcesses = killOrphanProcesses;
+exports.writePidfile = writePidfile;
+exports.handleAgentSenseTurn = handleAgentSenseTurn;
 const fs = __importStar(require("fs"));
 const net = __importStar(require("net"));
+const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const identity_1 = require("../identity");
+const agent_discovery_1 = require("./agent-discovery");
 const runtime_1 = require("../../nerves/runtime");
 const runtime_metadata_1 = require("./runtime-metadata");
-const update_hooks_1 = require("./update-hooks");
+const runtime_mode_1 = require("./runtime-mode");
+const update_hooks_1 = require("../versioning/update-hooks");
 const bundle_meta_1 = require("./hooks/bundle-meta");
+const agent_config_v2_1 = require("./hooks/agent-config-v2");
 const bundle_manifest_1 = require("../../mind/bundle-manifest");
-const update_checker_1 = require("./update-checker");
-const staged_restart_1 = require("./staged-restart");
+const update_checker_1 = require("../versioning/update-checker");
+const staged_restart_1 = require("../versioning/staged-restart");
+const ouro_version_manager_1 = require("../versioning/ouro-version-manager");
 const child_process_1 = require("child_process");
+const pending_1 = require("../../mind/pending");
+const agent_service_1 = require("./agent-service");
+const channel_1 = require("../../mind/friends/channel");
+const mcp_manager_1 = require("../../repertoire/mcp-manager");
+const outlook_http_1 = require("../outlook/outlook-http");
+const outlook_types_1 = require("../outlook/outlook-types");
+const outlook_read_1 = require("../outlook/outlook-read");
+const outlook_view_1 = require("../outlook/outlook-view");
+const PIDFILE_PATH = path.join(os.homedir(), ".ouro-cli", "daemon.pids");
+/**
+ * Defense-in-depth: detect if we're running under vitest. The pidfile lives
+ * at a hardcoded path under the user's real ~/.ouro-cli/ — there's no DI
+ * seam to redirect it. So when a test creates a real OuroDaemon and calls
+ * start(), the daemon's killOrphanProcesses() reads the REAL pidfile,
+ * ps-verifies the PIDs, and SIGTERMs the production daemon. We saw this
+ * cause an outage on 2026-04-08 (alpha.265 daemon killed 93s after startup
+ * by a vitest test that called daemon.start()).
+ *
+ * Both killOrphanProcesses() and writePidfile() short-circuit under vitest
+ * to make the production pidfile sacred. Tests that need to verify these
+ * functions' behavior should use the extracted pure helpers
+ * (parseOrphanPidsFromPs, filterPidfilePidsToActualOrphans).
+ */
+function isVitestProcess() {
+    /* v8 ignore next -- defensive: process and process.argv always exist in node @preserve */
+    if (typeof process === "undefined" || !Array.isArray(process.argv))
+        return false;
+    return process.argv.some((arg) => typeof arg === "string" && arg.includes("vitest"));
+}
+/**
+ * Scan `ps -eo pid,ppid,command` output for daemon-owned entry points whose
+ * parent has died (PPID reparented to init/PID 1). Returns the list of PIDs
+ * that are safe to SIGTERM — true orphans, not children of live sibling
+ * daemons running from worktrees, test suites, or other users of the harness.
+ *
+ * Exported so unit tests can exercise the filter without shelling out.
+ */
+function parseOrphanPidsFromPs(psOutput, selfPid) {
+    const orphans = [];
+    for (const line of psOutput.split("\n")) {
+        // Explicitly exclude MCP server processes — they share a harness entry
+        // point but are not daemon children and must never be killed.
+        if (line.includes("mcp-serve") || line.includes("mcp serve"))
+            continue;
+        // Match only daemon-owned JS entry points.
+        if (!line.includes("agent-entry.js")
+            && !line.includes("daemon-entry.js")
+            && !line.includes("bluebubbles/entry.js")
+            && !line.includes("teams-entry.js"))
+            continue;
+        // Parse `<pid> <ppid> <command...>`. ps pads these with leading spaces.
+        // Regex guarantees both groups are \d+ so parseInt can't produce NaN.
+        const match = line.trim().match(/^(\d+)\s+(\d+)\s/);
+        if (!match)
+            continue;
+        const pid = parseInt(match[1], 10);
+        const ppid = parseInt(match[2], 10);
+        if (pid === selfPid)
+            continue;
+        // CRITICAL: only kill processes whose parent is init (PID 1). A live
+        // PPID means the process belongs to another daemon instance (parallel
+        // test run, sibling worktree, another user of /tmp/ouroboros-daemon.sock).
+        // Killing those will crash unrelated harnesses — we saw this in B6
+        // when a vitest worker's daemon killed slugger's production children.
+        if (ppid !== 1)
+            continue;
+        orphans.push(pid);
+    }
+    return orphans;
+}
+/**
+ * Given a list of PIDs from the pidfile, return only those that are actual
+ * orphans (PPID reparented to init/PID 1). Protects against a polluted
+ * pidfile killing a PID that the OS has reassigned to an unrelated process.
+ *
+ * Implementation: shells out to `ps -p <csv> -o pid,ppid` for a batch lookup.
+ * Returns the empty list if ps fails — safer to skip cleanup than to
+ * wildcard-kill on a bad read.
+ *
+ * Exported for direct unit coverage.
+ */
+function filterPidfilePidsToActualOrphans(candidatePids, psRunner = runPsCheck) {
+    if (candidatePids.length === 0)
+        return [];
+    const psOutput = psRunner(candidatePids);
+    if (psOutput === null)
+        return [];
+    const survivingOrphans = [];
+    // `ps -p x,y,z -o pid,ppid` emits a header line then one row per found PID.
+    // PIDs not found (already exited) are silently omitted — which is the
+    // correct behavior for us: we only want to kill live orphans.
+    for (const line of psOutput.split("\n")) {
+        const match = line.trim().match(/^(\d+)\s+(\d+)$/);
+        if (!match)
+            continue;
+        const pid = parseInt(match[1], 10);
+        const ppid = parseInt(match[2], 10);
+        if (ppid !== 1)
+            continue;
+        if (!candidatePids.includes(pid))
+            continue;
+        survivingOrphans.push(pid);
+    }
+    return survivingOrphans;
+}
+/* v8 ignore start -- shells out to ps; covered by filterPidfilePidsToActualOrphans unit tests via injected runner @preserve */
+function runPsCheck(pids) {
+    try {
+        const csv = pids.join(",");
+        return (0, child_process_1.execSync)(`ps -p ${csv} -o pid=,ppid=`, { encoding: "utf-8", timeout: 5000 });
+    }
+    catch {
+        // ps returns non-zero when none of the requested PIDs exist. Treat as
+        // "no survivors" rather than an error.
+        return "";
+    }
+}
+/* v8 ignore stop */
+/**
+ * Kill all ouro processes from the previous daemon instance using the pidfile.
+ * On startup, reads PIDs from ~/.ouro-cli/daemon.pids, kills them all, then
+ * deletes the file. The new daemon writes its own PIDs after spawning.
+ *
+ * Safety: pidfile contents are verified before being killed — each PID must
+ * be an actual orphan (PPID reparented to init/PID 1) via
+ * `filterPidfilePidsToActualOrphans`. Otherwise a polluted pidfile (written
+ * by a test, or a crashed daemon whose PIDs have since been reused by the
+ * OS) could SIGTERM unrelated processes.
+ *
+ * Falls back to ps-based scanning scoped to true orphans (PPID=1) if the
+ * pidfile doesn't exist (first run, previous daemon crashed before writing,
+ * manual cleanup). The scope is narrow on purpose — see parseOrphanPidsFromPs.
+ */
+/* v8 ignore start -- process lifecycle: uses kill/ps, tested via deployment @preserve */
+function killOrphanProcesses() {
+    if (isVitestProcess()) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "daemon",
+            event: "daemon.orphan_cleanup_test_blocked",
+            message: "blocked killOrphanProcesses from touching real pidfile under vitest",
+            meta: { pidfilePath: PIDFILE_PATH },
+        });
+        return;
+    }
+    try {
+        let pidsToKill = [];
+        // Primary: read pidfile from previous daemon
+        try {
+            const raw = fs.readFileSync(PIDFILE_PATH, "utf-8");
+            const candidates = raw.split("\n")
+                .map((s) => parseInt(s.trim(), 10))
+                .filter((n) => !isNaN(n) && n !== process.pid);
+            // Verify each candidate is an actual live orphan before killing. See
+            // docstring above for why this matters.
+            pidsToKill = filterPidfilePidsToActualOrphans(candidates);
+            fs.unlinkSync(PIDFILE_PATH);
+        }
+        catch {
+            // No pidfile — fall back to ps scan (scoped to orphans with PPID=1).
+        }
+        if (pidsToKill.length === 0) {
+            try {
+                const result = (0, child_process_1.execSync)("ps -eo pid,ppid,command", { encoding: "utf-8", timeout: 5000 });
+                pidsToKill = parseOrphanPidsFromPs(result, process.pid);
+            }
+            catch { /* ps failed — best effort */ }
+        }
+        if (pidsToKill.length > 0) {
+            for (const pid of pidsToKill) {
+                try {
+                    process.kill(pid, "SIGTERM");
+                }
+                catch { /* already exited */ }
+            }
+            (0, runtime_1.emitNervesEvent)({
+                component: "daemon",
+                event: "daemon.orphan_cleanup",
+                message: `killed ${pidsToKill.length} orphaned ouro processes`,
+                meta: { pids: pidsToKill },
+            });
+        }
+    }
+    catch (error) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "daemon",
+            event: "daemon.orphan_cleanup_error",
+            message: "failed to clean up orphaned ouro processes",
+            meta: { error: error instanceof Error ? error.message : String(error) },
+        });
+    }
+}
+/**
+ * Write all managed PIDs (daemon + children) to the pidfile.
+ * Called after all agents and senses are spawned.
+ */
+function writePidfile(extraPids = []) {
+    if (isVitestProcess()) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "daemon",
+            event: "daemon.write_pidfile_test_blocked",
+            message: "blocked writePidfile from clobbering real pidfile under vitest",
+            meta: { pidfilePath: PIDFILE_PATH, attemptedPids: extraPids.length },
+        });
+        return;
+    }
+    try {
+        const pids = [process.pid, ...extraPids].filter(Boolean);
+        fs.mkdirSync(path.dirname(PIDFILE_PATH), { recursive: true });
+        fs.writeFileSync(PIDFILE_PATH, pids.join("\n") + "\n", "utf-8");
+    }
+    catch { /* best effort */ }
+}
 function buildWorkerRows(snapshots) {
     return snapshots.map((snapshot) => ({
         agent: snapshot.name,
@@ -54,6 +279,8 @@ function buildWorkerRows(snapshots) {
         pid: snapshot.pid,
         restartCount: snapshot.restartCount,
         startedAt: snapshot.startedAt,
+        lastExitCode: snapshot.lastExitCode ?? null,
+        lastSignal: snapshot.lastSignal ?? null,
     }));
 }
 function formatStatusSummary(payload) {
@@ -86,6 +313,35 @@ function parseIncomingCommand(raw) {
     }
     return parsed;
 }
+/**
+ * Handle agent.senseTurn command: runs a full agent turn via the daemon process.
+ * Dynamic import lazy-loads shared-turn. Hot-reload works because ouro dev
+ * restarts the daemon process (fresh module cache).
+ */
+async function handleAgentSenseTurn(command) {
+    try {
+        const { setAgentName } = await Promise.resolve().then(() => __importStar(require("../identity")));
+        setAgentName(command.agent);
+        const { runSenseTurn } = await Promise.resolve().then(() => __importStar(require("../../senses/shared-turn")));
+        const result = await runSenseTurn({
+            agentName: command.agent,
+            channel: command.channel,
+            sessionKey: command.sessionKey,
+            friendId: command.friendId,
+            userMessage: command.message,
+        });
+        return {
+            ok: true,
+            message: result.response,
+            data: { ponderDeferred: result.ponderDeferred },
+        };
+    }
+    catch (error) {
+        /* v8 ignore next -- branch: String(error) fallback only for non-Error throws @preserve */
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        return { ok: false, error: `sense turn failed: ${errorMessage}` };
+    }
+}
 class OuroDaemon {
     socketPath;
     processManager;
@@ -94,7 +350,9 @@ class OuroDaemon {
     router;
     senseManager;
     bundlesRoot;
+    mode;
     server = null;
+    outlookServer = null;
     constructor(options) {
         this.socketPath = options.socketPath;
         this.processManager = options.processManager;
@@ -103,6 +361,32 @@ class OuroDaemon {
         this.router = options.router;
         this.senseManager = options.senseManager ?? null;
         this.bundlesRoot = options.bundlesRoot ?? (0, identity_1.getAgentBundlesRoot)();
+        this.mode = options.mode ?? "production";
+    }
+    buildStatusPayload() {
+        const snapshots = this.processManager.listAgentSnapshots();
+        const workers = buildWorkerRows(snapshots);
+        const senses = this.senseManager?.listSenseRows() ?? [];
+        const repoRoot = (0, identity_1.getRepoRoot)();
+        const sync = (0, agent_discovery_1.listBundleSyncRows)({ bundlesRoot: this.bundlesRoot });
+        const agents = (0, agent_discovery_1.listAllBundleAgents)({ bundlesRoot: this.bundlesRoot });
+        return {
+            overview: {
+                daemon: "running",
+                health: workers.every((worker) => worker.status === "running") ? "ok" : "warn",
+                socketPath: this.socketPath,
+                outlookUrl: this.outlookServer?.origin ?? "http://127.0.0.1:0",
+                ...(0, runtime_metadata_1.getRuntimeMetadata)(),
+                workerCount: workers.length,
+                senseCount: senses.length,
+                entryPath: path.join(repoRoot, "dist", "heart", "daemon", "daemon-entry.js"),
+                mode: (0, runtime_mode_1.detectRuntimeMode)(repoRoot),
+            },
+            workers,
+            senses,
+            sync,
+            agents,
+        };
     }
     async start() {
         if (this.server)
@@ -113,61 +397,211 @@ class OuroDaemon {
             message: "starting daemon server",
             meta: { socketPath: this.socketPath },
         });
+        try {
+            await this.startInner();
+        }
+        catch (err) {
+            // Emit a paired terminating event (`_error`) so the nerves audit's
+            // start_end_pairing rule is satisfied when startup throws mid-sequence
+            // and `stop()` (which emits `server_end`) is never called.
+            (0, runtime_1.emitNervesEvent)({
+                level: "error",
+                component: "daemon",
+                event: "daemon.server_error",
+                message: "daemon start failed",
+                meta: {
+                    error: err instanceof Error ? err.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(err),
+                },
+            });
+            throw err;
+        }
+    }
+    async startInner() {
         // Register update hooks and apply pending updates before starting agents
         (0, update_hooks_1.registerUpdateHook)(bundle_meta_1.bundleMetaHook);
+        (0, update_hooks_1.registerUpdateHook)(agent_config_v2_1.agentConfigV2Hook);
         const currentVersion = (0, bundle_manifest_1.getPackageVersion)();
         await (0, update_hooks_1.applyPendingUpdates)(this.bundlesRoot, currentVersion);
         // Start periodic update checker (polls npm registry every 30 minutes)
+        // Skip in dev mode — dev builds should not auto-update from npm
         const bundlesRoot = this.bundlesRoot;
-        const daemon = this;
-        (0, update_checker_1.startUpdateChecker)({
-            currentVersion,
-            deps: {
-                distTag: "alpha",
-                fetchRegistryJson: /* v8 ignore next -- integration: real HTTP fetch @preserve */ async () => {
-                    const res = await fetch("https://registry.npmjs.org/@ouro.bot/cli");
-                    return res.json();
-                },
-            },
-            onUpdate: /* v8 ignore start -- integration: real npm install + process spawn @preserve */ async (result) => {
-                if (!result.latestVersion)
-                    return;
-                await (0, staged_restart_1.performStagedRestart)(result.latestVersion, {
-                    execSync: (cmd) => (0, child_process_1.execSync)(cmd, { stdio: "inherit" }),
-                    spawnSync: child_process_1.spawnSync,
-                    resolveNewCodePath: (_version) => {
-                        try {
-                            const resolved = (0, child_process_1.execSync)(`node -e "console.log(require.resolve('@ouro.bot/cli/package.json'))"`, { encoding: "utf-8" }).trim();
-                            return resolved ? path.dirname(resolved) : null;
-                        }
-                        catch {
-                            return null;
-                        }
+        const daemonSocketPath = this.socketPath;
+        if (this.mode === "dev") {
+            (0, runtime_1.emitNervesEvent)({
+                component: "daemon",
+                event: "daemon.update_checker_skip",
+                message: "skipping update checker in dev mode",
+                meta: { reason: "dev mode" },
+            });
+        }
+        else {
+            const daemon = this;
+            (0, update_checker_1.startUpdateChecker)({
+                currentVersion,
+                deps: {
+                    distTag: "alpha",
+                    fetchRegistryJson: /* v8 ignore next -- integration: real HTTP fetch @preserve */ async () => {
+                        const res = await fetch("https://registry.npmjs.org/@ouro.bot/cli");
+                        return res.json();
                     },
-                    gracefulShutdown: () => daemon.stop(),
-                    nodePath: process.execPath,
-                    bundlesRoot,
-                });
-            },
-            /* v8 ignore stop */
-        });
+                },
+                onUpdate: /* v8 ignore start -- integration: real npm install + process spawn @preserve */ async (result) => {
+                    if (!result.latestVersion)
+                        return;
+                    // Install via the version manager (NOT `npm install -g`). The
+                    // global install path doesn't end up on the daemon process's
+                    // NODE_PATH, so the previous `require.resolve('@ouro.bot/cli')`
+                    // -based path lookup always returned null and the staged restart
+                    // never actually completed. Verified live on 2026-04-08:
+                    // alpha.268 daemon detected alpha.270 was available, ran the
+                    // staged restart, and bailed at `staged_restart_path_failed` —
+                    // meaning the daemon could never auto-update itself and required
+                    // manual `ouro up` to pick up new versions.
+                    //
+                    // Switch to the version-managed layout the CLI itself uses:
+                    // installVersion(version) puts files at
+                    //   ~/.ouro-cli/versions/{version}/node_modules/@ouro.bot/cli
+                    // which is a known path we can compute deterministically.
+                    // Then activateVersion(version) flips the CurrentVersion symlink
+                    // so the next `ouro up` from the user sees the same version
+                    // the daemon is running.
+                    const cliHome = (0, ouro_version_manager_1.getOuroCliHome)();
+                    await (0, staged_restart_1.performStagedRestart)(result.latestVersion, {
+                        execSync: (cmd) => (0, child_process_1.execSync)(cmd, { stdio: "inherit" }),
+                        spawnSync: child_process_1.spawnSync,
+                        installNewVersion: (version) => {
+                            (0, ouro_version_manager_1.installVersion)(version, {});
+                            (0, ouro_version_manager_1.activateVersion)(version, {});
+                        },
+                        resolveNewCodePath: (version) => {
+                            const versionPath = path.join(cliHome, "versions", version, "node_modules", "@ouro.bot", "cli");
+                            return fs.existsSync(versionPath) ? versionPath : null;
+                        },
+                        gracefulShutdown: () => daemon.stop(),
+                        spawnNewDaemon: (entryPath, sock) => {
+                            const outFd = fs.openSync(os.devNull, "w");
+                            const errFd = fs.openSync(os.devNull, "w");
+                            const child = (0, child_process_1.spawn)(process.execPath, [entryPath, "--socket", sock], {
+                                detached: true,
+                                stdio: ["ignore", outFd, errFd],
+                            });
+                            child.unref();
+                            return { pid: child.pid ?? null };
+                        },
+                        nodePath: process.execPath,
+                        bundlesRoot,
+                        socketPath: daemonSocketPath,
+                    });
+                },
+                /* v8 ignore stop */
+            });
+        }
+        // MCP connections are lazily initialized per-agent during senseTurn
+        // (daemon manages multiple agents; agent identity must be set before loading MCP config)
+        /* v8 ignore start -- orphan cleanup + pidfile: calls process management functions @preserve */
+        killOrphanProcesses();
+        /* v8 ignore stop */
         await this.processManager.startAutoStartAgents();
         await this.senseManager?.startAutoStartSenses();
+        // Write all managed PIDs to disk so the next daemon can clean up
+        /* v8 ignore start -- pidfile write: collects PIDs from process managers @preserve */
+        const agentPids = this.processManager.listAgentSnapshots().map((s) => s.pid).filter((p) => p !== null);
+        const sensePids = this.senseManager?.listManagedPids?.() ?? [];
+        writePidfile([...agentPids, ...sensePids]);
+        /* v8 ignore stop */
         this.scheduler.start?.();
         await this.scheduler.reconcile?.();
         await this.drainPendingBundleMessages();
+        await this.drainPendingSenseMessages();
+        /* v8 ignore start — Outlook server startup, tested via outlook-http.test.ts */
+        if (!this.outlookServer) {
+            try {
+                this.outlookServer = await (0, outlook_http_1.startOutlookHttpServer)({
+                    host: "127.0.0.1",
+                    port: outlook_types_1.OUTLOOK_DEFAULT_PORT,
+                    bundlesRoot: this.bundlesRoot,
+                    readMachineState: () => (0, outlook_read_1.readOutlookMachineState)({ bundlesRoot: this.bundlesRoot }),
+                    readMachineView: ({ machine }) => {
+                        const overview = this.buildStatusPayload().overview;
+                        return (0, outlook_view_1.buildOutlookMachineView)({
+                            machine,
+                            daemon: {
+                                status: overview.daemon,
+                                health: overview.health,
+                                mode: overview.mode,
+                                socketPath: overview.socketPath,
+                                outlookUrl: overview.outlookUrl,
+                                entryPath: overview.entryPath,
+                                workerCount: overview.workerCount,
+                                senseCount: overview.senseCount,
+                            },
+                        });
+                    },
+                    readAgentState: (agentName) => (0, outlook_read_1.readOutlookAgentState)(agentName, { bundlesRoot: this.bundlesRoot }),
+                    readAgentView: (agentName) => {
+                        const agent = (0, outlook_read_1.readOutlookAgentState)(agentName, { bundlesRoot: this.bundlesRoot });
+                        return (0, outlook_view_1.buildOutlookAgentView)({
+                            agent,
+                            viewer: { kind: "human" },
+                        });
+                    },
+                });
+            }
+            catch (error) {
+                (0, runtime_1.emitNervesEvent)({
+                    level: "warn",
+                    component: "daemon",
+                    event: "daemon.outlook_start_failed",
+                    message: `Outlook server failed to start: ${String(error)}`,
+                    meta: { port: outlook_types_1.OUTLOOK_DEFAULT_PORT },
+                });
+            }
+        }
+        /* v8 ignore stop */
         if (fs.existsSync(this.socketPath)) {
             fs.unlinkSync(this.socketPath);
         }
-        this.server = net.createServer((connection) => {
+        // allowHalfOpen: true lets the server keep its writable side open after
+        // the client sends FIN. Without this, when a client calls `client.end()`
+        // after writing a command, node closes the server's writable side
+        // automatically — so a long-running response (like an agent.senseTurn
+        // LLM turn that takes 5+ seconds) never reaches the client. The
+        // socket-client fix in #303/#334 also removed client.end() on the
+        // sending side, but this option is defense in depth: even if a future
+        // caller half-closes, the server still writes its response correctly.
+        this.server = net.createServer({ allowHalfOpen: true }, (connection) => {
             let raw = "";
             let responded = false;
+            /* v8 ignore start — connection error handler requires real socket error @preserve */
+            connection.on("error", (err) => {
+                (0, runtime_1.emitNervesEvent)({
+                    level: "warn",
+                    component: "daemon",
+                    event: "daemon.connection_error",
+                    message: "socket connection error",
+                    meta: { error: err.message, code: err.code ?? null },
+                });
+            });
+            /* v8 ignore stop */
             const flushResponse = async () => {
                 if (responded)
                     return;
                 responded = true;
                 const response = await this.handleRawPayload(raw);
-                connection.end(response);
+                try {
+                    connection.end(response);
+                    /* v8 ignore start — EPIPE catch requires real socket disconnect @preserve */
+                }
+                catch (err) {
+                    (0, runtime_1.emitNervesEvent)({
+                        level: "warn",
+                        component: "daemon",
+                        event: "daemon.connection_end_error",
+                        message: "failed to send response to client (EPIPE)",
+                        meta: { error: err instanceof Error ? err.message : String(err) },
+                    });
+                }
+                /* v8 ignore stop */
             };
             connection.on("data", (chunk) => {
                 raw += chunk.toString("utf-8");
@@ -180,7 +614,22 @@ class OuroDaemon {
         const server = this.server;
         await new Promise((resolve, reject) => {
             server.once("error", reject);
-            server.listen(this.socketPath, () => resolve());
+            server.listen(this.socketPath, () => {
+                // Replace the one-time error listener with a persistent one after successful listen
+                server.removeAllListeners("error");
+                /* v8 ignore start — server error after listen requires real socket race condition @preserve */
+                server.on("error", (err) => {
+                    (0, runtime_1.emitNervesEvent)({
+                        level: "error",
+                        component: "daemon",
+                        event: "daemon.server_error",
+                        message: "daemon server error after listen",
+                        meta: { error: err.message, code: err.code ?? null },
+                    });
+                });
+                /* v8 ignore stop */
+                resolve();
+            });
         });
     }
     async drainPendingBundleMessages() {
@@ -231,23 +680,147 @@ class OuroDaemon {
             fs.writeFileSync(pendingPath, next, "utf-8");
         }
     }
+    /** Drains per-sense pending dirs for always-on senses across all agents. */
+    static ALWAYS_ON_SENSES = new Set((0, channel_1.getAlwaysOnSenseNames)());
+    async drainPendingSenseMessages() {
+        if (!fs.existsSync(this.bundlesRoot))
+            return;
+        let bundleDirs;
+        try {
+            bundleDirs = fs.readdirSync(this.bundlesRoot, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const bundleDir of bundleDirs) {
+            if (!bundleDir.isDirectory() || !bundleDir.name.endsWith(".ouro"))
+                continue;
+            const agentName = bundleDir.name.replace(/\.ouro$/, "");
+            const pendingRoot = path.join(this.bundlesRoot, bundleDir.name, "state", "pending");
+            if (!fs.existsSync(pendingRoot))
+                continue;
+            let friendDirs;
+            try {
+                friendDirs = fs.readdirSync(pendingRoot, { withFileTypes: true });
+            }
+            catch {
+                continue;
+            }
+            for (const friendDir of friendDirs) {
+                if (!friendDir.isDirectory())
+                    continue;
+                const friendPath = path.join(pendingRoot, friendDir.name);
+                let channelDirs;
+                try {
+                    channelDirs = fs.readdirSync(friendPath, { withFileTypes: true });
+                }
+                catch {
+                    continue;
+                }
+                for (const channelDir of channelDirs) {
+                    if (!channelDir.isDirectory())
+                        continue;
+                    if (!OuroDaemon.ALWAYS_ON_SENSES.has(channelDir.name))
+                        continue;
+                    const channelPath = path.join(friendPath, channelDir.name);
+                    let keyDirs;
+                    try {
+                        keyDirs = fs.readdirSync(channelPath, { withFileTypes: true });
+                    }
+                    catch {
+                        continue;
+                    }
+                    for (const keyDir of keyDirs) {
+                        if (!keyDir.isDirectory())
+                            continue;
+                        const leafDir = path.join(channelPath, keyDir.name);
+                        const messages = (0, pending_1.drainPending)(leafDir);
+                        for (const msg of messages) {
+                            try {
+                                await this.router.send({
+                                    from: msg.from,
+                                    to: agentName,
+                                    content: msg.content,
+                                    priority: "normal",
+                                });
+                            }
+                            catch {
+                                // Best-effort delivery — log and continue
+                            }
+                        }
+                        if (messages.length > 0) {
+                            (0, runtime_1.emitNervesEvent)({
+                                component: "daemon",
+                                event: "daemon.startup_sense_drain",
+                                message: "drained pending sense messages on startup",
+                                meta: {
+                                    agent: agentName,
+                                    channel: channelDir.name,
+                                    friendId: friendDir.name,
+                                    key: keyDir.name,
+                                    count: messages.length,
+                                },
+                            });
+                        }
+                    }
+                }
+            }
+        }
+    }
     async stop() {
+        // Must be named `_end` (not `_stop`) to satisfy the nerves audit's
+        // start/end pairing rule — see src/nerves/coverage/audit-rules.ts.
+        // This is the counterpart to `daemon.server_start` emitted at line 480.
         (0, runtime_1.emitNervesEvent)({
             component: "daemon",
-            event: "daemon.server_stop",
+            event: "daemon.server_end",
             message: "stopping daemon server",
             meta: { socketPath: this.socketPath },
         });
         (0, update_checker_1.stopUpdateChecker)();
+        (0, mcp_manager_1.shutdownSharedMcpManager)();
         this.scheduler.stop?.();
         await this.processManager.stopAll();
         await this.senseManager?.stopAll();
         if (this.server) {
-            await new Promise((resolve) => {
-                this.server?.close(() => resolve());
-            });
+            // DO NOT `await` server.close() here. server.close() resolves only
+            // after every open connection has closed. When stop() is invoked
+            // from the daemon.stop command handler, the calling client's
+            // connection is STILL open — its flushResponse() is currently
+            // awaiting THIS function. Awaiting close() creates a deadlock:
+            //
+            //   client → flushResponse → handleRawPayload → daemon.stop case
+            //   → stop() → await server.close() (waits for client's connection)
+            //   → client's connection waits for flushResponse to call
+            //     connection.end() → DEADLOCK
+            //
+            // Both processes sit in kevent forever. Verified live on
+            // 2026-04-08: alpha.268 daemon hung at `daemon.server_end` log
+            // line for 5+ minutes after a client sent daemon.stop, while the
+            // client (alpha.270 ouro up) hung waiting for the response.
+            //
+            // This regressed when #303/#334/#339 stopped half-closing the
+            // client socket and switched the server to allowHalfOpen: true.
+            // Previously, the client called .end() after writing its command,
+            // which (with allowHalfOpen: false) caused node to auto-tear-down
+            // the server's writable side — incidentally unblocking
+            // server.close() before the response was sent. The half-close
+            // breakage masked this deadlock; the fix exposed it.
+            //
+            // Solution: fire close() and let it complete asynchronously. Once
+            // stop() returns, the daemon.stop case returns its response,
+            // flushResponse() calls connection.end(response), the connection
+            // closes, and server.close()'s pending callback fires. The event
+            // loop drains and the daemon exits cleanly.
+            this.server.close();
             this.server = null;
         }
+        /* v8 ignore start -- outlookServer stop: only reachable when the outlook HTTP server successfully bound to port 6876 during start(). Coverage fluctuates locally because a running production daemon holds the port and tests get EADDRINUSE, leaving outlookServer null. In CI the port is free and this block runs. Not worth fighting port contention to cover two trivial lines. @preserve */
+        if (this.outlookServer) {
+            await this.outlookServer.stop();
+            this.outlookServer = null;
+        }
+        /* v8 ignore stop */
         if (fs.existsSync(this.socketPath)) {
             fs.unlinkSync(this.socketPath);
         }
@@ -272,6 +845,27 @@ class OuroDaemon {
             message: "handling daemon command",
             meta: { kind: command.kind },
         });
+        try {
+            return await this.handleCommandInner(command);
+            /* v8 ignore start — command error catch tested in daemon-command-error.test; instanceof branches defensive @preserve */
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "error",
+                component: "daemon",
+                event: "daemon.command_error",
+                message: "unexpected error handling daemon command",
+                meta: {
+                    kind: command.kind,
+                    error: error instanceof Error ? error.message : String(error),
+                    stack: error instanceof Error ? error.stack ?? null : null,
+                },
+            });
+            throw error;
+        }
+        /* v8 ignore stop */
+    }
+    async handleCommandInner(command) {
         switch (command.kind) {
             case "daemon.start":
                 await this.start();
@@ -280,21 +874,7 @@ class OuroDaemon {
                 await this.stop();
                 return { ok: true, message: "daemon stopped" };
             case "daemon.status": {
-                const snapshots = this.processManager.listAgentSnapshots();
-                const workers = buildWorkerRows(snapshots);
-                const senses = this.senseManager?.listSenseRows() ?? [];
-                const data = {
-                    overview: {
-                        daemon: "running",
-                        health: workers.every((worker) => worker.status === "running") ? "ok" : "warn",
-                        socketPath: this.socketPath,
-                        ...(0, runtime_metadata_1.getRuntimeMetadata)(),
-                        workerCount: workers.length,
-                        senseCount: senses.length,
-                    },
-                    workers,
-                    senses,
-                };
+                const data = this.buildStatusPayload();
                 return {
                     ok: true,
                     summary: formatStatusSummary(data),
@@ -311,7 +891,7 @@ class OuroDaemon {
                     ok: true,
                     summary: "logs: use `ouro logs` to tail daemon and agent output",
                     message: "log streaming available via ouro logs",
-                    data: { logDir: "~/.agentstate/daemon/logs" },
+                    data: { logDir: "~/AgentBundles/<agent>.ouro/state/daemon/logs" },
                 };
             case "agent.start":
                 await this.processManager.startAgent(command.agent);
@@ -322,6 +902,35 @@ class OuroDaemon {
             case "agent.restart":
                 await this.processManager.restartAgent?.(command.agent);
                 return { ok: true, message: `restarted ${command.agent}` };
+            case "agent.ask":
+                return (0, agent_service_1.handleAgentAsk)(command);
+            case "agent.status":
+                return (0, agent_service_1.handleAgentStatus)(command);
+            case "agent.catchup":
+                return (0, agent_service_1.handleAgentCatchup)(command);
+            case "agent.delegate":
+                return (0, agent_service_1.handleAgentDelegate)(command);
+            case "agent.getContext":
+                return (0, agent_service_1.handleAgentGetContext)(command);
+            case "agent.searchMemory":
+                return (0, agent_service_1.handleAgentSearchMemory)(command);
+            case "agent.getTask":
+                return (0, agent_service_1.handleAgentGetTask)(command);
+            case "agent.checkScope":
+                return (0, agent_service_1.handleAgentCheckScope)(command);
+            case "agent.requestDecision":
+                return (0, agent_service_1.handleAgentRequestDecision)(command);
+            case "agent.checkGuidance":
+                return (0, agent_service_1.handleAgentCheckGuidance)(command);
+            case "agent.reportProgress":
+                return (0, agent_service_1.handleAgentReportProgress)(command);
+            case "agent.reportBlocker":
+                return (0, agent_service_1.handleAgentReportBlocker)(command);
+            case "agent.reportComplete":
+                return (0, agent_service_1.handleAgentReportComplete)(command);
+            case "agent.senseTurn":
+                return handleAgentSenseTurn(command);
+            /* v8 ignore stop */
             case "cron.list": {
                 const jobs = this.scheduler.listJobs();
                 const summary = jobs.length === 0
@@ -353,6 +962,13 @@ class OuroDaemon {
                     data: messages,
                 };
             }
+            case "inner.wake":
+                await this.processManager.startAgent(command.agent);
+                this.processManager.sendToAgent?.(command.agent, { type: "message" });
+                return {
+                    ok: true,
+                    message: `woke inner dialog for ${command.agent}`,
+                };
             case "chat.connect":
                 await this.processManager.startAgent(command.agent);
                 return {
@@ -375,6 +991,35 @@ class OuroDaemon {
                     data: receipt,
                 };
             }
+            case "habit.poke": {
+                this.processManager.sendToAgent?.(command.agent, { type: "habit", habitName: command.habitName });
+                return {
+                    ok: true,
+                    message: `poked habit ${command.habitName} for ${command.agent}`,
+                };
+            }
+            case "mcp.list": {
+                const mcpManager = await (0, mcp_manager_1.getSharedMcpManager)();
+                if (!mcpManager) {
+                    return { ok: true, data: [], message: "no MCP servers configured" };
+                }
+                return { ok: true, data: mcpManager.listAllTools() };
+            }
+            case "mcp.call": {
+                const mcpCallManager = await (0, mcp_manager_1.getSharedMcpManager)();
+                if (!mcpCallManager) {
+                    return { ok: false, error: "no MCP servers configured" };
+                }
+                try {
+                    const parsedArgs = command.args ? JSON.parse(command.args) : {};
+                    const result = await mcpCallManager.callTool(command.server, command.tool, parsedArgs);
+                    return { ok: true, data: result };
+                }
+                catch (error) {
+                    /* v8 ignore next -- defensive: callTool errors are always Error instances @preserve */
+                    return { ok: false, error: error instanceof Error ? error.message : String(error) };
+                }
+            }
             case "hatch.start":
                 return {
                     ok: true,