@ouro.bot/cli 0.1.0-alpha.34 → 0.1.0-alpha.340

package/dist/heart/daemon/doctor-types.js

@@ -0,0 +1,8 @@
+"use strict";
+/**
+ * Type definitions for the `ouro doctor` system health check.
+ *
+ * Describes the structure of health check results: individual checks,
+ * grouped categories, and the aggregated result.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/heart/daemon/doctor.js

@@ -0,0 +1,401 @@
+"use strict";
+/**
+ * System health check ("ouro doctor") — runs all diagnostic categories
+ * and aggregates results into a structured DoctorResult.
+ *
+ * Each category checker is isolated: if one throws, it produces a single
+ * "fail" check and the remaining categories still run.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkDaemon = checkDaemon;
+exports.checkAgents = checkAgents;
+exports.checkSenses = checkSenses;
+exports.checkHabits = checkHabits;
+exports.checkSecurity = checkSecurity;
+exports.checkDisk = checkDisk;
+exports.runDoctorChecks = runDoctorChecks;
+const runtime_1 = require("../../nerves/runtime");
+const bluebubbles_health_diagnostics_1 = require("./bluebubbles-health-diagnostics");
+const DEFAULT_BLUEBUBBLES_REQUEST_TIMEOUT_MS = 30_000;
+// ── Category checkers ──
+async function checkDaemon(deps) {
+    const checks = [];
+    const socketExists = deps.existsSync(deps.socketPath);
+    checks.push({
+        label: "daemon socket exists",
+        status: socketExists ? "pass" : "fail",
+        detail: socketExists ? deps.socketPath : `not found at ${deps.socketPath}`,
+    });
+    if (socketExists) {
+        const alive = await deps.checkSocketAlive(deps.socketPath);
+        checks.push({
+            label: "daemon is responsive",
+            status: alive ? "pass" : "fail",
+            detail: alive ? "socket responded" : "socket exists but daemon unresponsive",
+        });
+    }
+    else {
+        checks.push({
+            label: "daemon is responsive",
+            status: "fail",
+            detail: "skipped — socket missing",
+        });
+    }
+    return { name: "Daemon", checks };
+}
+/** Discover all *.ouro directories under bundlesRoot. */
+function discoverAgents(deps) {
+    if (!deps.existsSync(deps.bundlesRoot))
+        return [];
+    return deps.readdirSync(deps.bundlesRoot).filter((name) => name.endsWith(".ouro"));
+}
+function asRecord(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : null;
+}
+function textField(record, key) {
+    const value = record?.[key];
+    return typeof value === "string" ? value.trim() : "";
+}
+function numberField(record, key, fallback) {
+    const value = record?.[key];
+    return typeof value === "number" && Number.isFinite(value) ? value : fallback;
+}
+function readJsonObject(deps, filePath) {
+    try {
+        return asRecord(JSON.parse(deps.readFileSync(filePath)));
+    }
+    catch {
+        return null;
+    }
+}
+function checkAgents(deps) {
+    const checks = [];
+    if (!deps.existsSync(deps.bundlesRoot)) {
+        checks.push({ label: "bundles directory", status: "fail", detail: `${deps.bundlesRoot} not found` });
+        return { name: "Agents", checks };
+    }
+    const agents = discoverAgents(deps);
+    if (agents.length === 0) {
+        checks.push({ label: "agent bundles", status: "warn", detail: "no *.ouro bundles found" });
+        return { name: "Agents", checks };
+    }
+    for (const agentDir of agents) {
+        const agentPath = `${deps.bundlesRoot}/${agentDir}`;
+        const configPath = `${agentPath}/agent.json`;
+        if (!deps.existsSync(configPath)) {
+            checks.push({ label: `${agentDir}/agent.json`, status: "fail", detail: "missing" });
+            continue;
+        }
+        let config;
+        try {
+            config = JSON.parse(deps.readFileSync(configPath));
+        }
+        catch {
+            checks.push({ label: `${agentDir}/agent.json`, status: "fail", detail: "unparseable JSON" });
+            continue;
+        }
+        const missing = [];
+        if (!config.version)
+            missing.push("version");
+        if (!config.humanFacing || typeof config.humanFacing !== "object") {
+            missing.push("humanFacing");
+        }
+        else {
+            const hf = config.humanFacing;
+            if (!hf.provider)
+                missing.push("humanFacing.provider");
+            if (!hf.model)
+                missing.push("humanFacing.model");
+        }
+        if (!config.agentFacing || typeof config.agentFacing !== "object") {
+            missing.push("agentFacing");
+        }
+        else {
+            const af = config.agentFacing;
+            if (!af.provider)
+                missing.push("agentFacing.provider");
+            if (!af.model)
+                missing.push("agentFacing.model");
+        }
+        if (missing.length > 0) {
+            checks.push({ label: `${agentDir}/agent.json`, status: "warn", detail: `missing fields: ${missing.join(", ")}` });
+        }
+        else {
+            checks.push({ label: `${agentDir}/agent.json`, status: "pass", detail: "valid" });
+        }
+    }
+    return { name: "Agents", checks };
+}
+async function checkSenses(deps) {
+    const checks = [];
+    const agents = discoverAgents(deps);
+    for (const agentDir of agents) {
+        const agentName = agentDir.replace(/\.ouro$/, "");
+        const configPath = `${deps.bundlesRoot}/${agentDir}/agent.json`;
+        if (!deps.existsSync(configPath))
+            continue;
+        let config;
+        try {
+            config = JSON.parse(deps.readFileSync(configPath));
+        }
+        catch {
+            checks.push({ label: `${agentDir} senses`, status: "fail", detail: "agent.json unparseable" });
+            continue;
+        }
+        if (!config.senses || typeof config.senses !== "object") {
+            checks.push({ label: `${agentDir} senses`, status: "warn", detail: "no senses config block" });
+            continue;
+        }
+        const senses = config.senses;
+        const senseNames = ["cli", "teams", "bluebubbles"];
+        for (const sense of senseNames) {
+            if (!(sense in senses))
+                continue;
+            const entry = senses[sense];
+            if (!entry || typeof entry !== "object") {
+                checks.push({ label: `${agentDir} ${sense}`, status: "fail", detail: "malformed sense entry" });
+                continue;
+            }
+            const senseObj = entry;
+            if (typeof senseObj.enabled !== "boolean") {
+                checks.push({ label: `${agentDir} ${sense}`, status: "warn", detail: "missing enabled boolean" });
+            }
+            else {
+                checks.push({
+                    label: `${agentDir} ${sense}`,
+                    status: "pass",
+                    detail: senseObj.enabled ? "enabled" : "disabled",
+                });
+            }
+            if (sense === "bluebubbles" && senseObj.enabled === true) {
+                const secretsPath = `${deps.secretsRoot}/${agentName}/secrets.json`;
+                if (!deps.existsSync(secretsPath)) {
+                    checks.push({
+                        label: `${agentDir} bluebubbles config`,
+                        status: "fail",
+                        detail: "missing secrets.json",
+                    });
+                    continue;
+                }
+                const secrets = readJsonObject(deps, secretsPath);
+                if (!secrets) {
+                    checks.push({
+                        label: `${agentDir} bluebubbles config`,
+                        status: "fail",
+                        detail: "secrets.json unparseable",
+                    });
+                    continue;
+                }
+                const bluebubbles = asRecord(secrets.bluebubbles);
+                const bluebubblesChannel = asRecord(secrets.bluebubblesChannel);
+                const serverUrl = textField(bluebubbles, "serverUrl");
+                const password = textField(bluebubbles, "password");
+                const missing = [];
+                if (!serverUrl)
+                    missing.push("bluebubbles.serverUrl");
+                if (!password)
+                    missing.push("bluebubbles.password");
+                if (missing.length > 0) {
+                    checks.push({
+                        label: `${agentDir} bluebubbles config`,
+                        status: "fail",
+                        detail: `missing ${missing.join("/")}`,
+                    });
+                    continue;
+                }
+                checks.push({
+                    label: `${agentDir} bluebubbles config`,
+                    status: "pass",
+                    detail: serverUrl,
+                });
+                if (deps.fetchImpl) {
+                    const probe = await (0, bluebubbles_health_diagnostics_1.probeBlueBubblesHealth)({
+                        serverUrl,
+                        password,
+                        requestTimeoutMs: numberField(bluebubblesChannel, "requestTimeoutMs", DEFAULT_BLUEBUBBLES_REQUEST_TIMEOUT_MS),
+                        fetchImpl: deps.fetchImpl,
+                    });
+                    checks.push({
+                        label: `${agentDir} bluebubbles upstream`,
+                        status: probe.ok ? "pass" : "fail",
+                        detail: probe.detail,
+                    });
+                }
+            }
+        }
+    }
+    if (checks.length === 0) {
+        checks.push({ label: "senses", status: "warn", detail: "no agents with senses config found" });
+    }
+    return { name: "Senses", checks };
+}
+function checkHabits(deps) {
+    const checks = [];
+    const agents = discoverAgents(deps);
+    for (const agentDir of agents) {
+        const agentName = agentDir.replace(/\.ouro$/, "");
+        const habitsDir = `${deps.bundlesRoot}/${agentDir}/habits`;
+        if (!deps.existsSync(habitsDir)) {
+            checks.push({ label: `${agentDir} habits dir`, status: "warn", detail: "no habits directory" });
+            continue;
+        }
+        checks.push({ label: `${agentDir} habits dir`, status: "pass", detail: habitsDir });
+        // Check for launchd plists on macOS
+        const launchAgentsDir = `${deps.homedir}/Library/LaunchAgents`;
+        if (deps.existsSync(launchAgentsDir)) {
+            const plists = deps.readdirSync(launchAgentsDir).filter((f) => f.startsWith(`bot.ouro.${agentName}.`) && f.endsWith(".plist"));
+            if (plists.length > 0) {
+                checks.push({ label: `${agentDir} launchd plists`, status: "pass", detail: `${plists.length} plist(s)` });
+            }
+            else {
+                checks.push({ label: `${agentDir} launchd plists`, status: "fail", detail: "no matching plists in LaunchAgents" });
+            }
+        }
+    }
+    if (checks.length === 0) {
+        checks.push({ label: "habits", status: "warn", detail: "no agents found" });
+    }
+    return { name: "Habits", checks };
+}
+function checkSecurity(deps) {
+    const checks = [];
+    const agents = discoverAgents(deps);
+    for (const agentDir of agents) {
+        const agentName = agentDir.replace(/\.ouro$/, "");
+        const secretsPath = `${deps.secretsRoot}/${agentName}/secrets.json`;
+        if (!deps.existsSync(secretsPath)) {
+            checks.push({ label: `${agentDir} secrets.json`, status: "fail", detail: "missing" });
+            continue;
+        }
+        // Check file permissions
+        const stat = deps.statSync(secretsPath);
+        const worldReadable = (stat.mode & 0o004) !== 0;
+        if (worldReadable) {
+            checks.push({ label: `${agentDir} secrets.json perms`, status: "warn", detail: "world-readable — consider chmod 600" });
+        }
+        else {
+            checks.push({ label: `${agentDir} secrets.json perms`, status: "pass", detail: "not world-readable" });
+        }
+        // Check agent.json for leaked credential keys
+        const configPath = `${deps.bundlesRoot}/${agentDir}/agent.json`;
+        if (deps.existsSync(configPath)) {
+            try {
+                const raw = deps.readFileSync(configPath);
+                const sensitiveKeys = ["apiKey", "token", "secret", "password"];
+                const found = sensitiveKeys.filter((key) => raw.includes(`"${key}"`));
+                if (found.length > 0) {
+                    checks.push({ label: `${agentDir} credential leak`, status: "warn", detail: `agent.json contains keys: ${found.join(", ")}` });
+                }
+                else {
+                    checks.push({ label: `${agentDir} credential leak`, status: "pass", detail: "no credential keys in agent.json" });
+                }
+            }
+            catch {
+                checks.push({ label: `${agentDir} credential leak`, status: "fail", detail: "could not read agent.json" });
+            }
+        }
+    }
+    if (checks.length === 0) {
+        checks.push({ label: "security", status: "warn", detail: "no agents found" });
+    }
+    return { name: "Security", checks };
+}
+function checkDisk(deps) {
+    const checks = [];
+    // Check daemon logs directory
+    const logsDir = `${deps.homedir}/.ouro-cli/logs`;
+    if (!deps.existsSync(logsDir)) {
+        checks.push({ label: "daemon logs dir", status: "warn", detail: `${logsDir} not found` });
+    }
+    else {
+        let totalSize = 0;
+        try {
+            const files = deps.readdirSync(logsDir);
+            for (const file of files) {
+                try {
+                    const stat = deps.statSync(`${logsDir}/${file}`);
+                    totalSize += stat.size;
+                }
+                catch {
+                    // skip unreadable files
+                }
+            }
+        }
+        catch {
+            // readdirSync failure handled below
+        }
+        const sizeMB = totalSize / (1024 * 1024);
+        if (sizeMB > 500) {
+            checks.push({ label: "daemon log size", status: "fail", detail: `${sizeMB.toFixed(1)}MB — exceeds 500MB limit` });
+        }
+        else if (sizeMB > 100) {
+            checks.push({ label: "daemon log size", status: "warn", detail: `${sizeMB.toFixed(1)}MB — consider pruning with \`ouro logs prune\`` });
+        }
+        else {
+            checks.push({ label: "daemon log size", status: "pass", detail: `${sizeMB.toFixed(1)}MB` });
+        }
+    }
+    // Check AgentBundles root
+    if (deps.existsSync(deps.bundlesRoot)) {
+        checks.push({ label: "bundles root", status: "pass", detail: deps.bundlesRoot });
+    }
+    else {
+        checks.push({ label: "bundles root", status: "warn", detail: `${deps.bundlesRoot} not found` });
+    }
+    return { name: "Disk", checks };
+}
+// ── Orchestrator ──
+function computeSummary(categories) {
+    let passed = 0;
+    let warnings = 0;
+    let failed = 0;
+    for (const cat of categories) {
+        for (const check of cat.checks) {
+            /* v8 ignore next 3 -- all three branches tested; v8 misreports compound if/else-if chain @preserve */
+            if (check.status === "pass")
+                passed++;
+            else if (check.status === "warn")
+                warnings++;
+            else
+                failed++;
+        }
+    }
+    return { passed, warnings, failed };
+}
+const CATEGORY_CHECKERS = [
+    { name: "Daemon", fn: checkDaemon },
+    { name: "Agents", fn: checkAgents },
+    { name: "Senses", fn: checkSenses },
+    { name: "Habits", fn: checkHabits },
+    { name: "Security", fn: checkSecurity },
+    { name: "Disk", fn: checkDisk },
+];
+async function runDoctorChecks(deps) {
+    const categories = [];
+    for (const checker of CATEGORY_CHECKERS) {
+        try {
+            const category = await Promise.resolve(checker.fn(deps));
+            categories.push(category);
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "daemon",
+                event: "daemon.doctor_check_error",
+                message: `doctor check ${checker.name} failed`,
+                meta: { category: checker.name, error: error instanceof Error ? error.message : String(error) },
+            });
+            categories.push({
+                name: checker.name,
+                checks: [{
+                        label: checker.name.toLowerCase(),
+                        status: "fail",
+                        detail: `check crashed: ${error instanceof Error ? error.message : String(error)}`,
+                    }],
+            });
+        }
+    }
+    return { categories, summary: computeSummary(categories) };
+}

package/dist/heart/daemon/health-monitor.js

@@ -7,22 +7,74 @@ class HealthMonitor {
     scheduler;
     alertSink;
     diskUsagePercent;
+    onCriticalAgent;
+    senseProbes;
+    intervalHandle = null;
     constructor(options) {
         this.processManager = options.processManager;
         this.scheduler = options.scheduler;
         this.alertSink = options.alertSink ?? (() => undefined);
         this.diskUsagePercent = options.diskUsagePercent ?? (() => 0);
+        this.onCriticalAgent = options.onCriticalAgent ?? (() => undefined);
+        this.senseProbes = options.senseProbes ?? [];
+    }
+    startPeriodicChecks(intervalMs) {
+        if (this.intervalHandle !== null)
+            return;
+        (0, runtime_1.emitNervesEvent)({
+            level: "info",
+            component: "daemon",
+            event: "daemon.health_check_scheduled",
+            message: "periodic health checks started",
+            meta: { intervalMs },
+        });
+        this.intervalHandle = setInterval(() => {
+            void this.runChecks();
+        }, intervalMs);
+    }
+    stopPeriodicChecks() {
+        if (this.intervalHandle === null)
+            return;
+        clearInterval(this.intervalHandle);
+        this.intervalHandle = null;
     }
     async runChecks() {
         const results = [];
         const snapshots = this.processManager.listAgentSnapshots();
         const unhealthy = snapshots.filter((snapshot) => snapshot.status !== "running");
         if (unhealthy.length > 0) {
+            const unhealthySummary = unhealthy.map((item) => {
+                const detail = [
+                    item.errorReason ?? null,
+                    item.fixHint ? `fix: ${item.fixHint}` : null,
+                ].filter((part) => part !== null).join("; ");
+                return detail.length > 0 ? `${item.name} (${detail})` : item.name;
+            }).join(", ");
             results.push({
                 name: "agent-processes",
                 status: "critical",
-                message: `non-running agents: ${unhealthy.map((item) => item.name).join(", ")}`,
+                message: `non-running agents: ${unhealthySummary}`,
             });
+            for (const agent of unhealthy) {
+                try {
+                    (0, runtime_1.emitNervesEvent)({
+                        level: "warn",
+                        component: "daemon",
+                        event: "daemon.health_check_recovery_attempted",
+                        message: "triggering recovery restart for non-running agent",
+                        meta: {
+                            agentName: agent.name,
+                            agentStatus: agent.status,
+                            errorReason: agent.errorReason ?? null,
+                            fixHint: agent.fixHint ?? null,
+                        },
+                    });
+                    this.onCriticalAgent(agent.name);
+                }
+                catch {
+                    // Recovery is best-effort -- callback errors must not crash runChecks
+                }
+            }
         }
         else {
             results.push({ name: "agent-processes", status: "ok", message: "all managed agents running" });
@@ -61,6 +113,32 @@ class HealthMonitor {
                 message: `disk usage healthy (${diskPercent}%)`,
             });
         }
+        for (const probe of this.senseProbes) {
+            try {
+                const outcome = await probe.check();
+                if (outcome.ok) {
+                    results.push({
+                        name: `sense-probe:${probe.name}`,
+                        status: "ok",
+                        message: `${probe.name} healthy`,
+                    });
+                }
+                else {
+                    results.push({
+                        name: `sense-probe:${probe.name}`,
+                        status: "critical",
+                        message: `${probe.name} failed: ${outcome.detail ?? "unknown"}`,
+                    });
+                }
+            }
+            catch (error) {
+                results.push({
+                    name: `sense-probe:${probe.name}`,
+                    status: "critical",
+                    message: `${probe.name} error: ${error instanceof Error ? error.message : String(error)}`,
+                });
+            }
+        }
         for (const result of results) {
             (0, runtime_1.emitNervesEvent)({
                 level: result.status === "critical" ? "error" : result.status === "warn" ? "warn" : "info",

package/dist/heart/daemon/hooks/agent-config-v2.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.agentConfigV2Hook = agentConfigV2Hook;
+const runtime_1 = require("../../../nerves/runtime");
+const migrate_config_1 = require("../../migrate-config");
+async function agentConfigV2Hook(ctx) {
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.agent_config_v2_hook_start",
+        message: "running agent-config-v2 update hook",
+        meta: { agentRoot: ctx.agentRoot, currentVersion: ctx.currentVersion },
+    });
+    try {
+        (0, migrate_config_1.migrateAgentConfigV1ToV2)(ctx.agentRoot);
+    }
+    catch (err) {
+        const errorMessage = err instanceof Error ? err.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(err);
+        (0, runtime_1.emitNervesEvent)({
+            component: "daemon",
+            event: "daemon.agent_config_v2_hook_error",
+            message: "agent-config-v2 hook migration failed",
+            meta: { agentRoot: ctx.agentRoot, error: errorMessage },
+        });
+        return { ok: false, error: errorMessage };
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.agent_config_v2_hook_end",
+        message: "agent-config-v2 hook completed",
+        meta: { agentRoot: ctx.agentRoot },
+    });
+    return { ok: true };
+}

package/dist/heart/daemon/hooks/bundle-meta.js

@@ -37,6 +37,115 @@ exports.bundleMetaHook = bundleMetaHook;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const runtime_1 = require("../../../nerves/runtime");
+/**
+ * Migrate bundle from schema 1 to schema 2:
+ * - Move state/{episodes,obligations,cares,intentions}/* to arc/{name}/*
+ * - Move psyche/memory/* to diary/
+ * Idempotent: skips missing sources; on collision, newer mtime wins.
+ */
+function migrateToSchema2(agentRoot) {
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.bundle_migration_start",
+        message: "migrating bundle to schema 2",
+        meta: { agentRoot },
+    });
+    // Migrate arc entities
+    for (const name of ["episodes", "obligations", "cares", "intentions"]) {
+        const src = path.join(agentRoot, "state", name);
+        const dest = path.join(agentRoot, "arc", name);
+        migrateDirectory(src, dest);
+    }
+    // Migrate diary
+    const memorySrc = path.join(agentRoot, "psyche", "memory");
+    const diaryDest = path.join(agentRoot, "diary");
+    migrateDirectory(memorySrc, diaryDest);
+    // Update bundle .gitignore
+    updateBundleGitignore(agentRoot);
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.bundle_migration_end",
+        message: "bundle migration to schema 2 complete",
+        meta: { agentRoot },
+    });
+}
+/**
+ * Ensure bundle .gitignore has state/ ignored and does NOT ignore arc/, diary/, journal/.
+ */
+function updateBundleGitignore(agentRoot) {
+    const gitignorePath = path.join(agentRoot, ".gitignore");
+    let lines = [];
+    try {
+        if (fs.existsSync(gitignorePath)) {
+            lines = fs.readFileSync(gitignorePath, "utf-8").split("\n");
+        }
+    }
+    catch {
+        // If we can't read, start fresh
+    }
+    // Remove arc/, diary/, journal/ from ignore (they should be tracked)
+    const toRemove = new Set(["arc/", "diary/", "journal/"]);
+    lines = lines.filter((line) => !toRemove.has(line.trim()));
+    // Ensure state/ is in the ignore list
+    const hasState = lines.some((line) => line.trim() === "state/");
+    if (!hasState) {
+        lines.push("state/");
+    }
+    // Write back, trimming trailing empty lines and ensuring trailing newline
+    const content = lines.join("\n").replace(/\n+$/, "") + "\n";
+    try {
+        fs.writeFileSync(gitignorePath, content, "utf-8");
+    }
+    catch {
+        // Non-blocking: if we can't write .gitignore, migration still succeeds
+    }
+}
+/**
+ * Recursively copy files from src to dest.
+ * Creates destination directories as needed. Skips if source doesn't exist.
+ * When both source and destination exist, compares mtimes: newer file wins.
+ * Logs a warning either way when a collision is detected.
+ */
+function migrateDirectory(src, dest) {
+    if (!fs.existsSync(src))
+        return;
+    fs.mkdirSync(dest, { recursive: true });
+    const entries = fs.readdirSync(src, { withFileTypes: true });
+    for (const entry of entries) {
+        const srcPath = path.join(src, entry.name);
+        const destPath = path.join(dest, entry.name);
+        if (entry.isDirectory()) {
+            migrateDirectory(srcPath, destPath);
+        }
+        else if (!fs.existsSync(destPath)) {
+            fs.copyFileSync(srcPath, destPath);
+        }
+        else {
+            // Collision: both source and destination exist — compare mtimes
+            const srcMtime = fs.statSync(srcPath).mtimeMs;
+            const destMtime = fs.statSync(destPath).mtimeMs;
+            if (srcMtime > destMtime) {
+                fs.copyFileSync(srcPath, destPath);
+                (0, runtime_1.emitNervesEvent)({
+                    level: "warn",
+                    component: "daemon",
+                    event: "daemon.bundle_migration_collision",
+                    message: `migration collision: source newer, overwriting destination`,
+                    meta: { srcPath, destPath, srcMtime, destMtime },
+                });
+            }
+            else {
+                (0, runtime_1.emitNervesEvent)({
+                    level: "warn",
+                    component: "daemon",
+                    event: "daemon.bundle_migration_collision",
+                    message: `migration collision: destination newer or equal, keeping destination`,
+                    meta: { srcPath, destPath, srcMtime, destMtime },
+                });
+            }
+        }
+    }
+}
 async function bundleMetaHook(ctx) {
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
@@ -56,9 +165,14 @@ async function bundleMetaHook(ctx) {
         // Malformed JSON -- treat as missing, will overwrite with fresh
         existing = undefined;
     }
+    // Run schema-2 migration if needed
+    const currentSchema = existing?.bundleSchemaVersion ?? 1;
+    if (currentSchema < 2) {
+        migrateToSchema2(ctx.agentRoot);
+    }
     const updated = {
         runtimeVersion: ctx.currentVersion,
-        bundleSchemaVersion: existing?.bundleSchemaVersion ?? 1,
+        bundleSchemaVersion: currentSchema < 2 ? 2 : currentSchema,
         lastUpdated: new Date().toISOString(),
     };
     // Save old runtimeVersion as previousRuntimeVersion (if there was one)