@ouro.bot/cli 0.1.0-alpha.519 → 0.1.0-alpha.520

package/dist/heart/daemon/process-manager.js

@@ -53,6 +53,7 @@ class DaemonProcessManager {
     clearTimeoutFn;
     cooldownRecoveryMs;
     maxCooldownRetries;
+    startupStaleAfterMs;
     existsSyncFn;
     configCheckFn;
     statusWriterFn;
@@ -98,6 +99,29 @@ class DaemonProcessManager {
             });
         }
     }
+    currentTimeMs() {
+        const value = this.now();
+        return Number.isFinite(value) ? value : Date.now();
+    }
+    isStartAttemptCurrent(state, attemptId) {
+        return state.startAttemptId === attemptId;
+    }
+    markConfigCheckFailed(state, errorReason, fixHint) {
+        const agent = state.config.name;
+        state.snapshot.status = "crashed";
+        state.snapshot.errorReason = errorReason;
+        state.snapshot.fixHint = fixHint;
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "daemon",
+            event: "daemon.agent_config_invalid",
+            message: errorReason,
+            meta: { agent, fix: fixHint },
+        });
+        this.writeStatus(agent, `[daemon] ${agent}: ${errorReason}\n` +
+            (fixHint ? `  Fix: ${fixHint}\n` : ""));
+        this.notifySnapshotChange(state.snapshot);
+    }
     constructor(options) {
         this.maxRestartsPerHour = options.maxRestartsPerHour ?? 10;
         this.stabilityThresholdMs = options.stabilityThresholdMs ?? 60_000;
@@ -105,6 +129,7 @@ class DaemonProcessManager {
         this.maxBackoffMs = options.maxBackoffMs ?? 60_000;
         this.cooldownRecoveryMs = options.cooldownRecoveryMs ?? 5 * 60 * 1_000;
         this.maxCooldownRetries = options.maxCooldownRetries ?? 3;
+        this.startupStaleAfterMs = options.startupStaleAfterMs ?? 45_000;
         this.spawnFn = options.spawn ?? ((command, args, spawnOptions) => (0, child_process_1.spawn)(command, args, spawnOptions));
         this.now = options.now ?? (() => Date.now());
         this.setTimeoutFn = options.setTimeoutFn ?? ((cb, delay) => setTimeout(cb, delay));
@@ -119,6 +144,9 @@ class DaemonProcessManager {
             this.agents.set(agent.name, {
                 config: agent,
                 process: null,
+                startInFlight: false,
+                startAttemptedAtMs: null,
+                startAttemptId: 0,
                 restartTimer: null,
                 crashTimestamps: [],
                 stopRequested: false,
@@ -149,107 +177,193 @@ class DaemonProcessManager {
             }
         }
     }
+    triggerAutoStartAgents() {
+        for (const state of this.agents.values()) {
+            if (!state.config.autoStart)
+                continue;
+            void this.startAgent(state.config.name).catch((error) => {
+                const errorReason = error instanceof Error ? error.message : String(error);
+                this.markConfigCheckFailed(state, `agent startup threw before the worker could run: ${errorReason}`, "Run 'ouro doctor' for diagnostics, then retry 'ouro up'.");
+            });
+        }
+    }
     async startAgent(agent) {
         const state = this.requireAgent(agent);
-        if (state.process)
+        if (state.process || state.startInFlight)
             return;
-        this.clearRestartTimer(state);
-        state.stopRequested = false;
-        state.snapshot.status = "starting";
-        if (this.configCheckFn) {
-            const result = await this.configCheckFn(agent);
-            if (result.skip) {
-                state.snapshot.status = "stopped";
+        const attemptId = state.startAttemptId + 1;
+        state.startAttemptId = attemptId;
+        state.startInFlight = true;
+        state.startAttemptedAtMs = this.currentTimeMs();
+        try {
+            this.clearRestartTimer(state);
+            state.stopRequested = false;
+            state.snapshot.status = "starting";
+            if (this.configCheckFn) {
+                let result;
+                try {
+                    result = await this.configCheckFn(agent);
+                }
+                catch (error) {
+                    const errorReason = error instanceof Error ? error.message : String(error);
+                    this.markConfigCheckFailed(state, `agent config validation threw: ${errorReason}`, "Run 'ouro doctor' for diagnostics, then retry 'ouro up'.");
+                    return;
+                }
+                if (!this.isStartAttemptCurrent(state, attemptId))
+                    return;
+                if (state.stopRequested) {
+                    state.snapshot.status = "stopped";
+                    state.snapshot.pid = null;
+                    this.notifySnapshotChange(state.snapshot);
+                    return;
+                }
+                if (result.skip) {
+                    state.snapshot.status = "stopped";
+                    state.snapshot.errorReason = null;
+                    state.snapshot.fixHint = null;
+                    (0, runtime_1.emitNervesEvent)({
+                        component: "daemon",
+                        event: "daemon.agent_config_skipped",
+                        message: result.error ?? "agent start skipped by config check",
+                        meta: { agent, fix: result.fix ?? null },
+                    });
+                    this.notifySnapshotChange(state.snapshot);
+                    return;
+                }
+                if (!result.ok) {
+                    this.markConfigCheckFailed(state, result.error ?? "agent config validation failed", result.fix ?? null);
+                    return;
+                }
+                /* v8 ignore next -- defensive duplicate stale-start guard before spawn preparation @preserve */
+                if (!this.isStartAttemptCurrent(state, attemptId))
+                    return;
+                // Config check passed — clear any prior error so the pulse stops
+                // reporting the broken state. This is the recovery path: the user
+                // fixed their secrets/config, the next startAgent attempt sees a
+                // valid config, and the pulse goes quiet.
                 state.snapshot.errorReason = null;
                 state.snapshot.fixHint = null;
-                (0, runtime_1.emitNervesEvent)({
-                    component: "daemon",
-                    event: "daemon.agent_config_skipped",
-                    message: result.error ?? "agent start skipped by config check",
-                    meta: { agent, fix: result.fix ?? null },
-                });
-                this.notifySnapshotChange(state.snapshot);
-                return;
             }
-            if (!result.ok) {
+            const runCwd = (0, identity_1.getRepoRoot)();
+            const entryScript = path.join((0, identity_1.getRepoRoot)(), "dist", state.config.entry);
+            if (this.existsSyncFn && !this.existsSyncFn(entryScript)) {
                 state.snapshot.status = "crashed";
-                // Surface the error and fix to the snapshot so sibling agents can
-                // read it via the pulse. Without this, the diagnosis stayed
-                // trapped in the nerves event and stderr — visible to humans
-                // running `ouro status` or grepping logs, but invisible to
-                // peer agents trying to coordinate around the broken state.
-                state.snapshot.errorReason = result.error ?? "agent config validation failed";
-                state.snapshot.fixHint = result.fix ?? null;
                 (0, runtime_1.emitNervesEvent)({
                     level: "error",
                     component: "daemon",
-                    event: "daemon.agent_config_invalid",
-                    message: result.error ?? "agent config validation failed",
-                    meta: { agent, fix: result.fix ?? null },
+                    event: "daemon.agent_entry_missing",
+                    message: "agent entry script does not exist — cannot spawn. Run 'ouro daemon install' from the correct location.",
+                    meta: { agent, entryScript },
                 });
-                this.writeStatus(agent, `[daemon] ${agent}: ${result.error}\n` +
-                    (result.fix ? `  Fix: ${result.fix}\n` : ""));
                 this.notifySnapshotChange(state.snapshot);
                 return;
             }
-            // Config check passed — clear any prior error so the pulse stops
-            // reporting the broken state. This is the recovery path: the user
-            // fixed their secrets/config, the next startAgent attempt sees a
-            // valid config, and the pulse goes quiet.
-            state.snapshot.errorReason = null;
-            state.snapshot.fixHint = null;
-        }
-        const runCwd = (0, identity_1.getRepoRoot)();
-        const entryScript = path.join((0, identity_1.getRepoRoot)(), "dist", state.config.entry);
-        if (this.existsSyncFn && !this.existsSyncFn(entryScript)) {
-            state.snapshot.status = "crashed";
+            /* v8 ignore next -- defensive duplicate stale-start guard immediately before spawn @preserve */
+            if (!this.isStartAttemptCurrent(state, attemptId))
+                return;
+            if (state.stopRequested) {
+                state.snapshot.status = "stopped";
+                state.snapshot.pid = null;
+                this.notifySnapshotChange(state.snapshot);
+                return;
+            }
+            const args = [entryScript, "--agent", state.config.agentArg ?? agent, ...(state.config.args ?? [])];
+            const child = this.spawnFn("node", args, {
+                cwd: runCwd,
+                env: state.config.env ? { ...process.env, ...state.config.env } : process.env,
+                stdio: ["ignore", "ignore", "ignore", "ipc"],
+            });
+            /* v8 ignore next 7 -- defensive: spawn should always return a ChildProcess @preserve */
+            if (!child) {
+                state.snapshot.status = "crashed";
+                (0, runtime_1.emitNervesEvent)({ level: "error", component: "daemon", event: "daemon.agent_spawn_failed", message: "spawn returned null", meta: { agent } });
+                return;
+            }
+            if (!this.isStartAttemptCurrent(state, attemptId)) {
+                try {
+                    child.kill("SIGTERM");
+                }
+                catch {
+                    (0, runtime_1.emitNervesEvent)({
+                        level: "warn",
+                        component: "daemon",
+                        event: "daemon.agent_stop_error",
+                        message: "failed to stop stale managed agent startup",
+                        meta: { agent },
+                    });
+                }
+                return;
+            }
+            state.process = child;
+            state.snapshot.status = "running";
+            state.snapshot.pid = child.pid ?? null;
+            state.snapshot.startedAt = new Date(this.currentTimeMs()).toISOString();
+            const bootstrap = state.config.getRuntimeCredentialBootstrap?.() ?? null;
+            if (bootstrap) {
+                const message = {
+                    type: "ouro.runtimeCredentialBootstrap",
+                    agentName: bootstrap.agentName,
+                };
+                if (bootstrap.runtimeConfig)
+                    message.runtimeConfig = bootstrap.runtimeConfig;
+                if (bootstrap.machineRuntimeConfig)
+                    message.machineRuntimeConfig = bootstrap.machineRuntimeConfig;
+                if (bootstrap.machineId)
+                    message.machineId = bootstrap.machineId;
+                if (bootstrap.providerCredentialRecords)
+                    message.providerCredentialRecords = bootstrap.providerCredentialRecords;
+                try {
+                    child.send?.(message);
+                    (0, runtime_1.emitNervesEvent)({
+                        component: "daemon",
+                        event: "daemon.agent_runtime_credentials_bootstrap_sent",
+                        message: "sent runtime credential bootstrap to managed agent process",
+                        meta: {
+                            agent,
+                            runtimeConfig: !!bootstrap.runtimeConfig,
+                            machineRuntimeConfig: !!bootstrap.machineRuntimeConfig,
+                            providerCredentialRecords: bootstrap.providerCredentialRecords?.length ?? 0,
+                        },
+                    });
+                }
+                catch (error) {
+                    (0, runtime_1.emitNervesEvent)({
+                        level: "warn",
+                        component: "daemon",
+                        event: "daemon.agent_ipc_send_error",
+                        message: "failed to send runtime credential bootstrap to managed agent process",
+                        meta: { agent, error: error instanceof Error ? error.message : String(error) },
+                    });
+                }
+            }
             (0, runtime_1.emitNervesEvent)({
-                level: "error",
                 component: "daemon",
-                event: "daemon.agent_entry_missing",
-                message: "agent entry script does not exist — cannot spawn. Run 'ouro daemon install' from the correct location.",
-                meta: { agent, entryScript },
+                event: "daemon.agent_started",
+                message: "daemon started managed agent process",
+                meta: { agent, pid: child.pid ?? null, cwd: runCwd },
             });
             this.notifySnapshotChange(state.snapshot);
-            return;
+            /* v8 ignore start — child process error handler; requires real spawn to trigger */
+            child.on("error", (err) => {
+                (0, runtime_1.emitNervesEvent)({
+                    level: "warn",
+                    component: "daemon",
+                    event: "daemon.agent_process_error",
+                    message: "managed agent process emitted error",
+                    meta: { agent, error: err.message },
+                });
+            });
+            /* v8 ignore stop */
+            child.once("exit", (code, signal) => {
+                this.onExit(state, code, signal);
+            });
         }
-        const args = [entryScript, "--agent", state.config.agentArg ?? agent, ...(state.config.args ?? [])];
-        const child = this.spawnFn("node", args, {
-            cwd: runCwd,
-            env: state.config.env ? { ...process.env, ...state.config.env } : process.env,
-            stdio: ["ignore", "ignore", "ignore", "ipc"],
-        });
-        /* v8 ignore next 7 -- defensive: spawn should always return a ChildProcess @preserve */
-        if (!child) {
-            state.snapshot.status = "crashed";
-            (0, runtime_1.emitNervesEvent)({ level: "error", component: "daemon", event: "daemon.agent_spawn_failed", message: "spawn returned null", meta: { agent } });
-            return;
+        finally {
+            if (this.isStartAttemptCurrent(state, attemptId)) {
+                state.startInFlight = false;
+                state.startAttemptedAtMs = null;
+            }
         }
-        state.process = child;
-        state.snapshot.status = "running";
-        state.snapshot.pid = child.pid ?? null;
-        state.snapshot.startedAt = new Date(this.now()).toISOString();
-        (0, runtime_1.emitNervesEvent)({
-            component: "daemon",
-            event: "daemon.agent_started",
-            message: "daemon started managed agent process",
-            meta: { agent, pid: child.pid ?? null, cwd: runCwd },
-        });
-        this.notifySnapshotChange(state.snapshot);
-        /* v8 ignore start — child process error handler; requires real spawn to trigger */
-        child.on("error", (err) => {
-            (0, runtime_1.emitNervesEvent)({
-                level: "warn",
-                component: "daemon",
-                event: "daemon.agent_process_error",
-                message: "managed agent process emitted error",
-                meta: { agent, error: err.message },
-            });
-        });
-        /* v8 ignore stop */
-        child.once("exit", (code, signal) => {
-            this.onExit(state, code, signal);
-        });
     }
     async stopAgent(agent) {
         const state = this.requireAgent(agent);
@@ -281,6 +395,31 @@ class DaemonProcessManager {
         this.notifySnapshotChange(state.snapshot);
     }
     async restartAgent(agent) {
+        const state = this.requireAgent(agent);
+        if (state.startInFlight && !state.process) {
+            const startedAt = state.startAttemptedAtMs;
+            /* v8 ignore next -- defensive: startInFlight always records a start timestamp @preserve */
+            const elapsedMs = startedAt === null ? 0 : this.currentTimeMs() - startedAt;
+            if (elapsedMs < this.startupStaleAfterMs) {
+                (0, runtime_1.emitNervesEvent)({
+                    component: "daemon",
+                    event: "daemon.agent_restart_deferred",
+                    message: "managed agent restart skipped while startup is already in flight",
+                    meta: { agent, elapsedMs, startupStaleAfterMs: this.startupStaleAfterMs },
+                });
+                return;
+            }
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "daemon",
+                event: "daemon.agent_startup_stale_recovered",
+                message: "managed agent startup was stale; clearing the pending attempt before restart",
+                meta: { agent, elapsedMs, startupStaleAfterMs: this.startupStaleAfterMs },
+            });
+            state.startAttemptId += 1;
+            state.startInFlight = false;
+            state.startAttemptedAtMs = null;
+        }
         await this.stopAgent(agent);
         await this.startAgent(agent);
     }
@@ -316,11 +455,13 @@ class DaemonProcessManager {
         if (!state.process)
             return;
         state.process = null;
+        state.startInFlight = false;
+        state.startAttemptedAtMs = null;
         state.snapshot.pid = null;
         state.snapshot.lastExitCode = code;
         state.snapshot.lastSignal = signal;
         const crashed = !state.stopRequested && code !== 0;
-        const now = this.now();
+        const now = this.currentTimeMs();
         const startedAt = state.snapshot.startedAt ? Date.parse(state.snapshot.startedAt) : now;
         const runDuration = Math.max(0, now - startedAt);
         (0, runtime_1.emitNervesEvent)({

package/dist/heart/daemon/sense-manager.js

@@ -40,6 +40,7 @@ const path = __importStar(require("path"));
 const runtime_1 = require("../../nerves/runtime");
 const identity_1 = require("../identity");
 const runtime_credentials_1 = require("../runtime-credentials");
+const provider_credentials_1 = require("../provider-credentials");
 const sense_truth_1 = require("../sense-truth");
 const machine_identity_1 = require("../machine-identity");
 const process_manager_1 = require("./process-manager");
@@ -223,6 +224,25 @@ function managedSenseEntry(sense) {
         return "senses/bluebubbles/entry.js";
     return "senses/mail-entry.js";
 }
+function runtimeCredentialBootstrapFor(agent, sense) {
+    const runtime = (0, runtime_credentials_1.readRuntimeCredentialConfig)(agent);
+    const machineId = sense === "bluebubbles" ? currentMachineId() : undefined;
+    const machine = sense === "bluebubbles" ? (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent) : null;
+    const providerPool = (0, provider_credentials_1.readProviderCredentialPool)(agent);
+    const providerCredentialRecords = providerPool.ok
+        ? Object.values(providerPool.pool.providers).filter((record) => !!record)
+        : [];
+    const bootstrap = {
+        agentName: agent,
+        runtimeConfig: runtime.ok ? runtime.config : undefined,
+        machineRuntimeConfig: machine?.ok ? machine.config : undefined,
+        machineId,
+        providerCredentialRecords: providerCredentialRecords.length > 0 ? providerCredentialRecords : undefined,
+    };
+    if (!bootstrap.runtimeConfig && !bootstrap.machineRuntimeConfig && !bootstrap.providerCredentialRecords)
+        return null;
+    return bootstrap;
+}
 function blueBubblesRuntimeStateIsFresh(lastCheckedAt, now = Date.now()) {
     if (!lastCheckedAt) {
         return false;
@@ -279,6 +299,7 @@ function readBlueBubblesRuntimeFacts(agent, bundlesRoot, snapshot) {
 class DaemonSenseManager {
     processManager;
     contexts;
+    pendingConfigRefreshes = new Set();
     bundlesRoot;
     constructor(options) {
         const bundlesRoot = options.bundlesRoot ?? path.join(os.homedir(), "AgentBundles");
@@ -297,6 +318,7 @@ class DaemonSenseManager {
                 entry: managedSenseEntry(sense),
                 channel: sense,
                 autoStart: true,
+                getRuntimeCredentialBootstrap: () => runtimeCredentialBootstrapFor(agent, sense),
             }));
         });
         this.processManager = options.processManager ?? new process_manager_1.DaemonProcessManager({
@@ -308,14 +330,11 @@ class DaemonSenseManager {
                 const context = this.contexts.get(parsed.agent);
                 if (!context)
                     return { ok: true };
-                const refreshed = await (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(parsed.agent, { preserveCachedOnFailure: true });
-                const machineRefreshed = parsed.sense === "bluebubbles"
-                    ? await (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(parsed.agent, currentMachineId(), { preserveCachedOnFailure: true })
-                    : (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(parsed.agent);
-                context.facts = senseFactsFromRuntimeConfig(parsed.agent, context.senses, refreshed, machineRefreshed);
+                context.facts = senseFactsFromRuntimeConfig(parsed.agent, context.senses, (0, runtime_credentials_1.readRuntimeCredentialConfig)(parsed.agent), (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(parsed.agent));
                 const fact = context.facts[parsed.sense];
                 if (fact.configured)
                     return { ok: true };
+                this.scheduleSenseConfigRefresh(name, parsed);
                 if (fact.optional) {
                     return {
                         ok: false,
@@ -325,6 +344,7 @@ class DaemonSenseManager {
                 }
                 return {
                     ok: false,
+                    skip: true,
                     error: `${parsed.sense} is enabled for ${parsed.agent} but runtime credentials are not ready: ${fact.detail}`,
                     fix: senseRepairHint(parsed.agent, parsed.sense),
                 };
@@ -340,9 +360,70 @@ class DaemonSenseManager {
             },
         });
     }
+    scheduleSenseConfigRefresh(name, parsed) {
+        if (this.pendingConfigRefreshes.has(name))
+            return;
+        this.pendingConfigRefreshes.add(name);
+        void this.refreshSenseConfigAndRetry(name, parsed);
+    }
+    async refreshSenseConfigAndRetry(name, parsed) {
+        try {
+            const refreshed = await (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(parsed.agent, { preserveCachedOnFailure: true });
+            const machineRefreshed = parsed.sense === "bluebubbles"
+                ? await (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(parsed.agent, currentMachineId(), { preserveCachedOnFailure: true })
+                : (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(parsed.agent);
+            const context = this.contexts.get(parsed.agent);
+            /* v8 ignore next -- defensive: config refreshes are only scheduled for known agent contexts @preserve */
+            if (!context)
+                return;
+            context.facts = senseFactsFromRuntimeConfig(parsed.agent, context.senses, refreshed, machineRefreshed);
+            if (!context.facts[parsed.sense].configured)
+                return;
+            setTimeout(() => {
+                void this.processManager.startAgent?.(name).catch((error) => {
+                    (0, runtime_1.emitNervesEvent)({
+                        level: "error",
+                        component: "channels",
+                        event: "channel.daemon_sense_autostart_error",
+                        message: "sense autostart failed",
+                        /* v8 ignore next -- defensive: process manager rejects with Error instances in normal use @preserve */
+                        meta: { error: error instanceof Error ? error.message : String(error) },
+                    });
+                });
+            }, 0);
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "error",
+                component: "channels",
+                event: "channel.daemon_sense_autostart_error",
+                message: "sense config refresh failed",
+                /* v8 ignore next -- defensive: runtime credential refresh rejects with Error instances in normal use @preserve */
+                meta: { error: error instanceof Error ? error.message : String(error) },
+            });
+        }
+        finally {
+            this.pendingConfigRefreshes.delete(name);
+        }
+    }
     async startAutoStartSenses() {
         await this.processManager.startAutoStartAgents();
     }
+    triggerAutoStartSenses() {
+        if (this.processManager.triggerAutoStartAgents) {
+            this.processManager.triggerAutoStartAgents();
+            return;
+        }
+        void this.processManager.startAutoStartAgents().catch((error) => {
+            (0, runtime_1.emitNervesEvent)({
+                level: "error",
+                component: "channels",
+                event: "channel.daemon_sense_autostart_error",
+                message: "sense autostart failed",
+                meta: { error: error instanceof Error ? error.message : String(error) },
+            });
+        });
+    }
     async stopAll() {
         await this.processManager.stopAll();
     }

package/dist/heart/daemon/startup-tui.js

@@ -22,6 +22,7 @@ const terminal_ui_1 = require("./terminal-ui");
 const SPINNER_FRAMES = "⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏";
 const STABILITY_THRESHOLD_MS = 5_000;
 const POLL_INTERVAL_MS = 500;
+const STARTUP_POLL_TIMEOUT_MS = 180_000;
 // ── ANSI helpers ──
 const RESET = "\x1b[0m";
 const BOLD = "\x1b[1m";
@@ -133,6 +134,7 @@ function renderFinalSummary(result, isTTY) {
  */
 async function pollDaemonStartup(deps) {
     const startTime = deps.now();
+    const maxWaitMs = deps.maxWaitMs ?? STARTUP_POLL_TIMEOUT_MS;
     let prevLineCount = 0;
     const isTTY = deps.isTTY ?? true;
     const isAlive = deps.isProcessAlive ?? defaultIsProcessAlive;
@@ -182,8 +184,29 @@ async function pollDaemonStartup(deps) {
                     degraded: [{ agent: "daemon", errorReason: errorMsg, fixHint: "check daemon logs or run `ouro doctor`" }],
                 };
             }
-            // Show what the daemon is doing from its log
             const latestEvent = deps.readLatestDaemonEvent?.() ?? null;
+            if (elapsed >= maxWaitMs) {
+                const errorMsg = latestEvent
+                    ? `daemon did not answer within ${(maxWaitMs / 1000).toFixed(0)}s; latest event: ${latestEvent}`
+                    : `daemon did not answer within ${(maxWaitMs / 1000).toFixed(0)}s`;
+                const result = {
+                    stable: [],
+                    degraded: [{ agent: "daemon", errorReason: errorMsg, fixHint: "check daemon logs or run `ouro doctor`" }],
+                };
+                if (shouldRender) {
+                    const summary = renderFinalSummary(result, isTTY);
+                    deps.writeRaw(summary);
+                }
+                (0, runtime_1.emitNervesEvent)({
+                    level: "error",
+                    component: "daemon",
+                    event: "daemon.startup_poll_timeout",
+                    message: "daemon startup polling timed out before the daemon answered",
+                    meta: { socketPath: deps.socketPath, daemonPid: deps.daemonPid, elapsedMs: elapsed, maxWaitMs, lastEvent: latestEvent },
+                });
+                return result;
+            }
+            // Show what the daemon is doing from its log
             reportProgress([
                 "waiting for Ouro to answer",
                 latestEvent ? `- latest daemon event: ${latestEvent}` : "- background service is still starting",
@@ -223,10 +246,53 @@ async function pollDaemonStartup(deps) {
                 });
                 return result;
             }
+            if (elapsed >= maxWaitMs) {
+                const result = buildTimedOutStartupResult(payload, assessment, maxWaitMs);
+                if (shouldRender) {
+                    const summary = renderFinalSummary(result, isTTY);
+                    deps.writeRaw(summary);
+                }
+                (0, runtime_1.emitNervesEvent)({
+                    level: "error",
+                    component: "daemon",
+                    event: "daemon.startup_poll_timeout",
+                    message: "daemon startup polling timed out with unresolved workers",
+                    meta: {
+                        socketPath: deps.socketPath,
+                        daemonPid: deps.daemonPid,
+                        elapsedMs: elapsed,
+                        maxWaitMs,
+                        stableCount: result.stable.length,
+                        degradedCount: result.degraded.length,
+                    },
+                });
+                return result;
+            }
         }
         await deps.sleep(POLL_INTERVAL_MS);
     }
 }
+function buildTimedOutStartupResult(payload, assessment, maxWaitMs) {
+    const stable = [...assessment.stable];
+    const degraded = [...assessment.degraded];
+    const stableAgents = new Set(stable);
+    const degradedAgents = new Set();
+    for (const worker of degraded)
+        degradedAgents.add(worker.agent);
+    const seconds = (maxWaitMs / 1000).toFixed(0);
+    for (const worker of payload.workers) {
+        if (stableAgents.has(worker.agent) || degradedAgents.has(worker.agent))
+            continue;
+        degraded.push({
+            agent: worker.agent,
+            errorReason: `startup timed out after ${seconds}s while worker was ${worker.status}`,
+            fixHint: worker.errorReason
+                ? worker.fixHint ?? "check daemon logs"
+                : "run `ouro status` or `ouro doctor` for current worker details; the daemon is still answering",
+        });
+    }
+    return { stable, degraded };
+}
 function formatStartupWorkerLine(payload) {
     const base = `- ${payload.agent}/${payload.worker}: ${payload.status}`;
     if (payload.status === "crashed" && payload.errorReason) {

package/dist/heart/outlook/readers/mail.js

@@ -255,7 +255,7 @@ function statusFromReaderFailure(reason) {
     return reason;
 }
 async function readMailView(agentName) {
-    const resolved = (0, reader_1.resolveMailroomReader)(agentName);
+    const resolved = await (0, reader_1.resolveMailroomReaderWithRefresh)(agentName);
     if (!resolved.ok) {
         const status = statusFromReaderFailure(resolved.reason);
         emitMailRead(agentName, "list", status);
@@ -300,7 +300,7 @@ async function readMailView(agentName) {
     }
 }
 async function readMailMessageView(agentName, messageId) {
-    const resolved = (0, reader_1.resolveMailroomReader)(agentName);
+    const resolved = await (0, reader_1.resolveMailroomReaderWithRefresh)(agentName);
     if (!resolved.ok) {
         const status = statusFromReaderFailure(resolved.reason);
         emitMailRead(agentName, "message", status);

package/dist/heart/provider-credentials.js

@@ -347,7 +347,7 @@ async function readProviderCredentialRecord(agentName, provider, options = {}) {
     const cached = readCachedProviderCredentialRecord(agentName, provider);
     if (cached.ok || options.refreshIfMissing === false)
         return cached;
-    return resultForProvider(await refreshProviderCredentialPool(agentName), provider);
+    return resultForProvider(await refreshProviderCredentialPool(agentName, { providers: [provider] }), provider);
 }
 async function upsertProviderCredential(input) {
     const updatedAt = (input.now ?? new Date()).toISOString();
@@ -374,6 +374,7 @@ async function upsertProviderCredential(input) {
     });
     input.onProgress?.(`refreshing local provider snapshot from ${input.agentName}'s vault...`);
     const refreshResult = await refreshProviderCredentialPool(input.agentName, {
+        providers: [input.provider],
         onProgress: input.onProgress,
     });
     if (!refreshResult.ok) {