@ouro.bot/cli 0.1.0-alpha.53 → 0.1.0-alpha.530

package/dist/heart/daemon/safe-mode.js

@@ -0,0 +1,161 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SAFE_MODE_OVERRIDE_FILENAME = void 0;
+exports.detectSafeMode = detectSafeMode;
+exports.pruneOldCrashes = pruneOldCrashes;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const runtime_1 = require("../../nerves/runtime");
+exports.SAFE_MODE_OVERRIDE_FILENAME = "safe-mode-override.json";
+/** 3+ crashes within this window triggers safe mode */
+const CRASH_WINDOW_MS = 5 * 60 * 1000; // 5 minutes
+const CRASH_THRESHOLD = 3;
+/**
+ * Reads crash history from the tombstone file and determines if safe mode should be active.
+ * Returns active if 3+ crashes occurred within 5 minutes.
+ *
+ * Safe mode is bypassed when:
+ * - devMode is true
+ * - A safe-mode override file exists (written by `ouro up --force`)
+ */
+function detectSafeMode(tombstonePath, options) {
+    const inactive = { active: false, reason: "", enteredAt: "" };
+    // Dev mode: never enter safe mode
+    if (options?.devMode) {
+        return inactive;
+    }
+    // Check for override file (--force)
+    const overridePath = path.join(path.dirname(tombstonePath), exports.SAFE_MODE_OVERRIDE_FILENAME);
+    try {
+        if (fs.existsSync(overridePath)) {
+            return inactive;
+        }
+    }
+    catch {
+        // Best-effort check
+    }
+    // Read tombstone
+    let parsed;
+    try {
+        const raw = fs.readFileSync(tombstonePath, "utf-8");
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return inactive;
+    }
+    // Extract recentCrashes
+    if (!Array.isArray(parsed.recentCrashes)) {
+        return inactive;
+    }
+    const nowMs = options?.now ? options.now() : Date.now();
+    const windowStart = nowMs - CRASH_WINDOW_MS;
+    // Filter to valid string timestamps within the crash window
+    const recentInWindow = parsed.recentCrashes.filter((entry) => {
+        if (typeof entry !== "string")
+            return false;
+        const ts = new Date(entry).getTime();
+        if (isNaN(ts))
+            return false;
+        return ts >= windowStart;
+    });
+    if (recentInWindow.length < CRASH_THRESHOLD) {
+        return inactive;
+    }
+    const result = {
+        active: true,
+        reason: `crash loop detected: ${recentInWindow.length} crashes in last 5 minutes`,
+        enteredAt: new Date(nowMs).toISOString(),
+    };
+    (0, runtime_1.emitNervesEvent)({
+        level: "error",
+        component: "daemon",
+        event: "daemon.safe_mode_entered",
+        message: result.reason,
+        meta: {
+            crashCount: recentInWindow.length,
+            windowMs: CRASH_WINDOW_MS,
+            tombstonePath,
+        },
+    });
+    return result;
+}
+/**
+ * Prunes crash entries older than 5 minutes from the tombstone's recentCrashes.
+ * Also removes the safe-mode override file if present.
+ * Called after successful startup (uptime > stability threshold).
+ */
+function pruneOldCrashes(tombstonePath, options) {
+    // Remove override file
+    const overridePath = path.join(path.dirname(tombstonePath), exports.SAFE_MODE_OVERRIDE_FILENAME);
+    try {
+        if (fs.existsSync(overridePath)) {
+            fs.unlinkSync(overridePath);
+        }
+    }
+    catch {
+        // Best-effort
+    }
+    // Read existing tombstone
+    let parsed;
+    try {
+        const raw = fs.readFileSync(tombstonePath, "utf-8");
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return;
+    }
+    if (!Array.isArray(parsed.recentCrashes)) {
+        return;
+    }
+    const nowMs = options?.now ? options.now() : Date.now();
+    const windowStart = nowMs - CRASH_WINDOW_MS;
+    // Keep only entries within the window
+    const pruned = parsed.recentCrashes.filter((entry) => {
+        if (typeof entry !== "string")
+            return false;
+        const ts = new Date(entry).getTime();
+        if (isNaN(ts))
+            return false;
+        return ts >= windowStart;
+    });
+    parsed.recentCrashes = pruned;
+    try {
+        fs.writeFileSync(tombstonePath, JSON.stringify(parsed, null, 2) + "\n", "utf-8");
+    }
+    catch {
+        // Best-effort
+    }
+}

package/dist/heart/daemon/sense-manager.js

@@ -38,18 +38,23 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const runtime_1 = require("../../nerves/runtime");
-const bluebubbles_runtime_state_1 = require("../../senses/bluebubbles-runtime-state");
 const identity_1 = require("../identity");
+const runtime_credentials_1 = require("../runtime-credentials");
+const provider_credentials_1 = require("../provider-credentials");
 const sense_truth_1 = require("../sense-truth");
+const machine_identity_1 = require("../machine-identity");
 const process_manager_1 = require("./process-manager");
+const http_health_probe_1 = require("./http-health-probe");
 const DEFAULT_TEAMS_PORT = 3978;
 const DEFAULT_BLUEBUBBLES_PORT = 18790;
 const DEFAULT_BLUEBUBBLES_WEBHOOK_PATH = "/bluebubbles-webhook";
+const BLUEBUBBLES_RUNTIME_FRESHNESS_WINDOW_MS = 90_000;
 function defaultSenses() {
     return {
         cli: { ...identity_1.DEFAULT_AGENT_SENSES.cli },
         teams: { ...identity_1.DEFAULT_AGENT_SENSES.teams },
         bluebubbles: { ...identity_1.DEFAULT_AGENT_SENSES.bluebubbles },
+        mail: { ...identity_1.DEFAULT_AGENT_SENSES.mail },
     };
 }
 function readAgentSenses(agentJsonPath) {
@@ -75,7 +80,7 @@ function readAgentSenses(agentJsonPath) {
     if (!rawSenses || typeof rawSenses !== "object" || Array.isArray(rawSenses)) {
         return defaults;
     }
-    for (const sense of ["cli", "teams", "bluebubbles"]) {
+    for (const sense of ["cli", "teams", "bluebubbles", "mail"]) {
         const rawSense = rawSenses[sense];
         if (!rawSense || typeof rawSense !== "object" || Array.isArray(rawSense)) {
             continue;
@@ -87,22 +92,6 @@ function readAgentSenses(agentJsonPath) {
     }
     return defaults;
 }
-function readSecretsPayload(secretsPath) {
-    try {
-        const raw = fs.readFileSync(secretsPath, "utf-8");
-        const parsed = JSON.parse(raw);
-        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-            return { payload: {}, error: "invalid secrets.json object" };
-        }
-        return { payload: parsed, error: null };
-    }
-    catch (error) {
-        return {
-            payload: {},
-            error: error instanceof Error ? error.message : String(error),
-        };
-    }
-}
 function textField(record, key) {
     const value = record?.[key];
     return typeof value === "string" ? value.trim() : "";
@@ -111,17 +100,36 @@ function numberField(record, key, fallback) {
     const value = record?.[key];
     return typeof value === "number" && Number.isFinite(value) ? value : fallback;
 }
-function senseFactsFromSecrets(agent, senses, secretsPath) {
+function compactRuntimeConfigError(agent, error) {
+    const compact = error.replace(/\s+/g, " ").trim();
+    if (/credential vault is locked|vault locked|vault is locked/i.test(compact)) {
+        return `vault locked; run 'ouro vault unlock --agent ${agent}' if you have the saved secret, or 'ouro vault replace --agent ${agent}' if none was saved`;
+    }
+    return compact || "unavailable";
+}
+function runtimeConfigUnavailableDetail(agent, runtimeConfig) {
+    if (runtimeConfig.ok)
+        return "";
+    const itemName = /^vault:[^:]+:(.+)$/.exec(runtimeConfig.itemPath)?.[1] ?? "runtime/config";
+    if (runtimeConfig.reason === "missing")
+        return `missing vault ${itemName} (${agent})`;
+    return `vault ${itemName} unavailable (${compactRuntimeConfigError(agent, runtimeConfig.error)})`;
+}
+function senseFactsFromRuntimeConfig(agent, senses, runtimeConfig, machineRuntimeConfig = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent)) {
     const base = {
         cli: { configured: true, detail: "local interactive terminal" },
         teams: { configured: false, detail: "not enabled in agent.json" },
         bluebubbles: { configured: false, detail: "not enabled in agent.json" },
+        mail: { configured: false, detail: "not enabled in agent.json" },
     };
-    const { payload, error } = readSecretsPayload(secretsPath);
+    const payload = runtimeConfig.ok ? runtimeConfig.config : {};
+    const unavailableDetail = runtimeConfigUnavailableDetail(agent, runtimeConfig);
     const teams = payload.teams;
     const teamsChannel = payload.teamsChannel;
-    const bluebubbles = payload.bluebubbles;
-    const bluebubblesChannel = payload.bluebubblesChannel;
+    const machinePayload = machineRuntimeConfig.ok ? machineRuntimeConfig.config : {};
+    const bluebubbles = machinePayload.bluebubbles;
+    const bluebubblesChannel = machinePayload.bluebubblesChannel;
+    const mailroom = payload.mailroom;
     if (senses.teams.enabled) {
         const missing = [];
         if (!textField(teams, "clientId"))
@@ -137,9 +145,9 @@ function senseFactsFromSecrets(agent, senses, secretsPath) {
             }
             : {
                 configured: false,
-                detail: error && !fs.existsSync(secretsPath)
-                    ? `missing secrets.json (${agent})`
-                    : `missing ${missing.join("/")}`,
+                detail: runtimeConfig.ok
+                    ? `missing ${missing.join("/")}`
+                    : unavailableDetail,
             };
     }
     if (senses.bluebubbles.enabled) {
@@ -155,19 +163,52 @@ function senseFactsFromSecrets(agent, senses, secretsPath) {
             }
             : {
                 configured: false,
-                detail: error && !fs.existsSync(secretsPath)
-                    ? `missing secrets.json (${agent})`
-                    : `missing ${missing.join("/")}`,
+                optional: !machineRuntimeConfig.ok && machineRuntimeConfig.reason === "missing",
+                detail: !machineRuntimeConfig.ok && machineRuntimeConfig.reason === "missing"
+                    ? "not attached on this machine"
+                    : machineRuntimeConfig.ok
+                        ? `missing ${missing.join("/")}`
+                        : runtimeConfigUnavailableDetail(agent, machineRuntimeConfig),
+            };
+    }
+    if (senses.mail.enabled) {
+        const privateKeys = mailroom?.privateKeys;
+        const hasPrivateKeys = !!privateKeys && typeof privateKeys === "object" && !Array.isArray(privateKeys) && Object.values(privateKeys).some((value) => typeof value === "string" && value.trim().length > 0);
+        const mailboxAddress = textField(mailroom, "mailboxAddress");
+        const missing = [];
+        if (!mailboxAddress)
+            missing.push("mailroom.mailboxAddress");
+        if (!hasPrivateKeys)
+            missing.push("mailroom.privateKeys");
+        base.mail = missing.length === 0
+            ? { configured: true, detail: mailboxAddress }
+            : {
+                configured: false,
+                detail: runtimeConfig.ok
+                    ? `missing ${missing.join("/")}`
+                    : unavailableDetail,
             };
     }
     return base;
 }
+function senseRepairHint(agent, sense) {
+    if (sense === "teams") {
+        return `Run 'ouro vault config set --agent ${agent} --key teams.clientId', teams.clientSecret, and teams.tenantId; then run 'ouro up' again.`;
+    }
+    if (sense === "mail") {
+        return `Agent-runnable: provision Mailroom access with 'ouro connect mail --agent ${agent}', then restart with 'ouro up'.`;
+    }
+    return `Run 'ouro connect bluebubbles --agent ${agent}' to attach BlueBubbles on this machine; then run 'ouro up' again.`;
+}
+function currentMachineId() {
+    return (0, machine_identity_1.loadOrCreateMachineIdentity)({ homeDir: os.homedir() }).machineId;
+}
 function parseSenseSnapshotName(name) {
     const parts = name.split(":");
     if (parts.length !== 2)
         return null;
     const [agent, sense] = parts;
-    if (sense !== "teams" && sense !== "bluebubbles")
+    if (sense !== "teams" && sense !== "bluebubbles" && sense !== "mail")
         return null;
     return { agent, sense };
 }
@@ -176,47 +217,198 @@ function runtimeInfoFor(status) {
         return { runtime: "running" };
     return { runtime: "error" };
 }
+function managedSenseEntry(sense) {
+    if (sense === "teams")
+        return "senses/teams-entry.js";
+    if (sense === "bluebubbles")
+        return "senses/bluebubbles/entry.js";
+    return "senses/mail-entry.js";
+}
+function runtimeCredentialBootstrapFor(agent, sense) {
+    const runtime = (0, runtime_credentials_1.readRuntimeCredentialConfig)(agent);
+    const machineId = sense === "bluebubbles" ? currentMachineId() : undefined;
+    const machine = sense === "bluebubbles" ? (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent) : null;
+    const providerPool = (0, provider_credentials_1.readProviderCredentialPool)(agent);
+    const providerCredentialRecords = providerPool.ok
+        ? Object.values(providerPool.pool.providers).filter((record) => !!record)
+        : [];
+    const bootstrap = {
+        agentName: agent,
+        runtimeConfig: runtime.ok ? runtime.config : undefined,
+        machineRuntimeConfig: machine?.ok ? machine.config : undefined,
+        machineId,
+        providerCredentialRecords: providerCredentialRecords.length > 0 ? providerCredentialRecords : undefined,
+    };
+    if (!bootstrap.runtimeConfig && !bootstrap.machineRuntimeConfig && !bootstrap.providerCredentialRecords)
+        return null;
+    return bootstrap;
+}
+function blueBubblesRuntimeStateIsFresh(lastCheckedAt, now = Date.now()) {
+    if (!lastCheckedAt) {
+        return false;
+    }
+    const checkedAt = Date.parse(lastCheckedAt);
+    if (!Number.isFinite(checkedAt)) {
+        return false;
+    }
+    return checkedAt >= now - BLUEBUBBLES_RUNTIME_FRESHNESS_WINDOW_MS;
+}
+function readBlueBubblesRuntimeJson(runtimePath) {
+    try {
+        const raw = fs.readFileSync(runtimePath, "utf-8");
+        const parsed = JSON.parse(raw);
+        /* v8 ignore start -- branches: ternary fallbacks for missing/malformed BB runtime fields @preserve */
+        return {
+            upstreamStatus: parsed.upstreamStatus === "ok" || parsed.upstreamStatus === "error"
+                ? parsed.upstreamStatus
+                : "unknown",
+            detail: typeof parsed.detail === "string" && parsed.detail.trim()
+                ? parsed.detail
+                : "startup health probe pending",
+            lastCheckedAt: typeof parsed.lastCheckedAt === "string" ? parsed.lastCheckedAt : undefined,
+            proofMethod: typeof parsed.proofMethod === "string" && parsed.proofMethod.trim()
+                ? parsed.proofMethod
+                : undefined,
+            pendingRecoveryCount: typeof parsed.pendingRecoveryCount === "number" && Number.isFinite(parsed.pendingRecoveryCount)
+                ? parsed.pendingRecoveryCount
+                : 0,
+            failedRecoveryCount: typeof parsed.failedRecoveryCount === "number" && Number.isFinite(parsed.failedRecoveryCount)
+                ? parsed.failedRecoveryCount
+                : 0,
+            oldestPendingRecoveryAt: typeof parsed.oldestPendingRecoveryAt === "string" ? parsed.oldestPendingRecoveryAt : undefined,
+            oldestPendingRecoveryAgeMs: typeof parsed.oldestPendingRecoveryAgeMs === "number" && Number.isFinite(parsed.oldestPendingRecoveryAgeMs)
+                ? parsed.oldestPendingRecoveryAgeMs
+                : undefined,
+        };
+        /* v8 ignore stop */
+        /* v8 ignore start -- defensive: catch for missing/corrupt BB runtime state file @preserve */
+    }
+    catch {
+        return { upstreamStatus: "unknown", detail: "startup health probe pending", pendingRecoveryCount: 0, failedRecoveryCount: 0 };
+    }
+    /* v8 ignore stop */
+}
 function readBlueBubblesRuntimeFacts(agent, bundlesRoot, snapshot) {
     const agentRoot = path.join(bundlesRoot, `${agent}.ouro`);
     const runtimePath = path.join(agentRoot, "state", "senses", "bluebubbles", "runtime.json");
-    if (snapshot?.runtime !== "running" || !fs.existsSync(runtimePath)) {
+    if (!fs.existsSync(runtimePath)) {
         return { runtime: snapshot?.runtime };
     }
-    const state = (0, bluebubbles_runtime_state_1.readBlueBubblesRuntimeState)(agent, agentRoot);
+    const state = readBlueBubblesRuntimeJson(runtimePath);
+    const checkedAtMs = state.lastCheckedAt ? Date.parse(state.lastCheckedAt) : Number.NaN;
+    const proofFacts = {
+        proofMethod: state.proofMethod ?? "bluebubbles.checkHealth",
+        lastProofAt: state.lastCheckedAt,
+        proofAgeMs: Number.isFinite(checkedAtMs) ? Math.max(0, Date.now() - checkedAtMs) : undefined,
+        pendingRecoveryCount: state.pendingRecoveryCount,
+        failedRecoveryCount: state.failedRecoveryCount,
+        oldestPendingRecoveryAt: state.oldestPendingRecoveryAt,
+        oldestPendingRecoveryAgeMs: state.oldestPendingRecoveryAgeMs,
+    };
+    if (!blueBubblesRuntimeStateIsFresh(state.lastCheckedAt)) {
+        return {
+            runtime: snapshot?.runtime,
+            lastFailure: state.lastCheckedAt ? "BlueBubbles proof is stale" : undefined,
+            failureLayer: state.lastCheckedAt ? "proof_freshness" : undefined,
+        };
+    }
+    if (snapshot?.runtime !== "running") {
+        return {
+            runtime: "error",
+            detail: "BlueBubbles listener is not running",
+            ...proofFacts,
+            lastFailure: "listener process is not running",
+            failureLayer: "listener",
+            recoveryAction: "daemon health monitor will restart the BlueBubbles listener when its probe fails",
+        };
+    }
     if (state.upstreamStatus === "error") {
         return {
             runtime: "error",
             detail: state.detail,
+            ...proofFacts,
+            lastFailure: state.detail,
+            failureLayer: "upstream",
+            recoveryAction: "verify BlueBubbles server/app auth and local machine attachment, then retry the listener",
+        };
+    }
+    if (state.pendingRecoveryCount > 0) {
+        return {
+            runtime: "error",
+            detail: state.detail,
+            ...proofFacts,
+            lastFailure: state.detail,
+            failureLayer: "recovery_queue",
+            recoveryAction: "queued recovery will retry; inspect BlueBubbles inbound/recovery sidecar logs if age keeps growing",
+        };
+    }
+    if (state.upstreamStatus === "ok") {
+        return {
+            runtime: "running",
+            ...proofFacts,
+            ...(state.failedRecoveryCount > 0 ? { detail: state.detail } : {}),
+            ...(state.failedRecoveryCount > 0 ? {
+                lastFailure: state.detail,
+                failureLayer: "recovery_quarantine",
+                recoveryAction: "inspect quarantined BlueBubbles recovery failures; live transport remains reachable",
+            } : {}),
         };
     }
-    return { runtime: snapshot.runtime };
+    return { runtime: snapshot?.runtime, ...proofFacts };
 }
 class DaemonSenseManager {
     processManager;
     contexts;
+    pendingConfigRefreshes = new Set();
     bundlesRoot;
     constructor(options) {
         const bundlesRoot = options.bundlesRoot ?? path.join(os.homedir(), "AgentBundles");
-        const secretsRoot = options.secretsRoot ?? path.join(os.homedir(), ".agentsecrets");
         this.bundlesRoot = bundlesRoot;
         this.contexts = new Map(options.agents.map((agent) => {
             const senses = readAgentSenses(path.join(bundlesRoot, `${agent}.ouro`, "agent.json"));
-            const facts = senseFactsFromSecrets(agent, senses, path.join(secretsRoot, agent, "secrets.json"));
+            const facts = senseFactsFromRuntimeConfig(agent, senses, (0, runtime_credentials_1.readRuntimeCredentialConfig)(agent), (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent));
             return [agent, { senses, facts }];
         }));
         const managedSenseAgents = [...this.contexts.entries()].flatMap(([agent, context]) => {
-            return ["teams", "bluebubbles"]
-                .filter((sense) => context.senses[sense].enabled && context.facts[sense].configured)
+            return ["teams", "bluebubbles", "mail"]
+                .filter((sense) => context.senses[sense].enabled)
                 .map((sense) => ({
                 name: `${agent}:${sense}`,
                 agentArg: agent,
-                entry: sense === "teams" ? "senses/teams-entry.js" : "senses/bluebubbles-entry.js",
+                entry: managedSenseEntry(sense),
                 channel: sense,
                 autoStart: true,
+                getRuntimeCredentialBootstrap: () => runtimeCredentialBootstrapFor(agent, sense),
             }));
         });
         this.processManager = options.processManager ?? new process_manager_1.DaemonProcessManager({
             agents: managedSenseAgents,
+            configCheck: async (name) => {
+                const parsed = parseSenseSnapshotName(name);
+                if (!parsed)
+                    return { ok: true };
+                const context = this.contexts.get(parsed.agent);
+                if (!context)
+                    return { ok: true };
+                context.facts = senseFactsFromRuntimeConfig(parsed.agent, context.senses, (0, runtime_credentials_1.readRuntimeCredentialConfig)(parsed.agent), (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(parsed.agent));
+                const fact = context.facts[parsed.sense];
+                if (fact.configured)
+                    return { ok: true };
+                this.scheduleSenseConfigRefresh(name, parsed);
+                if (fact.optional) {
+                    return {
+                        ok: false,
+                        skip: true,
+                        error: `${parsed.sense} is enabled for ${parsed.agent} but not attached on this machine`,
+                    };
+                }
+                return {
+                    ok: false,
+                    skip: true,
+                    error: `${parsed.sense} is enabled for ${parsed.agent} but runtime credentials are not ready: ${fact.detail}`,
+                    fix: senseRepairHint(parsed.agent, parsed.sense),
+                };
+            },
         });
         (0, runtime_1.emitNervesEvent)({
             component: "channels",
@@ -228,12 +420,106 @@ class DaemonSenseManager {
             },
         });
     }
+    scheduleSenseConfigRefresh(name, parsed) {
+        if (this.pendingConfigRefreshes.has(name))
+            return;
+        this.pendingConfigRefreshes.add(name);
+        void this.refreshSenseConfigAndRetry(name, parsed);
+    }
+    async refreshSenseConfigAndRetry(name, parsed) {
+        try {
+            const refreshed = await (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(parsed.agent, { preserveCachedOnFailure: true });
+            const machineRefreshed = parsed.sense === "bluebubbles"
+                ? await (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(parsed.agent, currentMachineId(), { preserveCachedOnFailure: true })
+                : (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(parsed.agent);
+            const context = this.contexts.get(parsed.agent);
+            /* v8 ignore next -- defensive: config refreshes are only scheduled for known agent contexts @preserve */
+            if (!context)
+                return;
+            context.facts = senseFactsFromRuntimeConfig(parsed.agent, context.senses, refreshed, machineRefreshed);
+            if (!context.facts[parsed.sense].configured)
+                return;
+            setTimeout(() => {
+                void this.processManager.startAgent?.(name).catch((error) => {
+                    (0, runtime_1.emitNervesEvent)({
+                        level: "error",
+                        component: "channels",
+                        event: "channel.daemon_sense_autostart_error",
+                        message: "sense autostart failed",
+                        /* v8 ignore next -- defensive: process manager rejects with Error instances in normal use @preserve */
+                        meta: { error: error instanceof Error ? error.message : String(error) },
+                    });
+                });
+            }, 0);
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "error",
+                component: "channels",
+                event: "channel.daemon_sense_autostart_error",
+                message: "sense config refresh failed",
+                /* v8 ignore next -- defensive: runtime credential refresh rejects with Error instances in normal use @preserve */
+                meta: { error: error instanceof Error ? error.message : String(error) },
+            });
+        }
+        finally {
+            this.pendingConfigRefreshes.delete(name);
+        }
+    }
     async startAutoStartSenses() {
         await this.processManager.startAutoStartAgents();
     }
+    triggerAutoStartSenses() {
+        if (this.processManager.triggerAutoStartAgents) {
+            this.processManager.triggerAutoStartAgents();
+            return;
+        }
+        void this.processManager.startAutoStartAgents().catch((error) => {
+            (0, runtime_1.emitNervesEvent)({
+                level: "error",
+                component: "channels",
+                event: "channel.daemon_sense_autostart_error",
+                message: "sense autostart failed",
+                meta: { error: error instanceof Error ? error.message : String(error) },
+            });
+        });
+    }
     async stopAll() {
         await this.processManager.stopAll();
     }
+    /* v8 ignore start -- pid collection for orphan cleanup pidfile @preserve */
+    listManagedPids() {
+        return this.processManager.listAgentSnapshots()
+            .map((s) => s.pid)
+            .filter((pid) => pid !== null && pid !== undefined);
+    }
+    /* v8 ignore stop */
+    listHealthProbes() {
+        const probes = [];
+        for (const [agent, context] of this.contexts.entries()) {
+            const runtimeConfig = (0, runtime_credentials_1.readRuntimeCredentialConfig)(agent);
+            const machineRuntimeConfig = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent);
+            context.facts = senseFactsFromRuntimeConfig(agent, context.senses, runtimeConfig, machineRuntimeConfig);
+            if (!context.senses.bluebubbles.enabled || !context.facts.bluebubbles.configured || !machineRuntimeConfig.ok) {
+                continue;
+            }
+            const machinePayload = machineRuntimeConfig.config;
+            const bluebubblesChannel = machinePayload.bluebubblesChannel;
+            const port = numberField(bluebubblesChannel, "port", DEFAULT_BLUEBUBBLES_PORT);
+            probes.push({
+                ...(0, http_health_probe_1.createHttpHealthProbe)(`bluebubbles:${agent}`, port),
+                managedName: `${agent}:bluebubbles`,
+            });
+        }
+        return probes;
+    }
+    async restartSense(managedName) {
+        if (this.processManager.restartAgent) {
+            await this.processManager.restartAgent(managedName);
+            return;
+        }
+        await this.processManager.startAgent?.(managedName);
+    }
     listSenseRows() {
         const runtime = new Map();
         for (const snapshot of this.processManager.listAgentSnapshots()) {
@@ -245,6 +531,7 @@ class DaemonSenseManager {
             runtime.set(parsed.agent, current);
         }
         const rows = [...this.contexts.entries()].flatMap(([agent, context]) => {
+            context.facts = senseFactsFromRuntimeConfig(agent, context.senses, (0, runtime_credentials_1.readRuntimeCredentialConfig)(agent), (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent));
             const blueBubblesRuntimeFacts = readBlueBubblesRuntimeFacts(agent, this.bundlesRoot, runtime.get(agent)?.bluebubbles);
             const runtimeInfo = {
                 cli: { configured: true },
@@ -254,8 +541,13 @@ class DaemonSenseManager {
                 },
                 bluebubbles: {
                     configured: context.facts.bluebubbles.configured,
+                    optional: context.facts.bluebubbles.optional,
                     ...blueBubblesRuntimeFacts,
                 },
+                mail: {
+                    configured: context.facts.mail.configured,
+                    ...(runtime.get(agent)?.mail ?? {}),
+                },
             };
             const inventory = (0, sense_truth_1.getSenseInventory)({ senses: context.senses }, runtimeInfo);
             return inventory.map((entry) => ({
@@ -270,6 +562,18 @@ class DaemonSenseManager {
                             ?? context.facts[entry.sense].detail
                         : context.facts[entry.sense].detail
                     : "not enabled in agent.json",
+                ...(entry.sense === "bluebubbles" ? {
+                    proofMethod: blueBubblesRuntimeFacts.proofMethod,
+                    lastProofAt: blueBubblesRuntimeFacts.lastProofAt,
+                    proofAgeMs: blueBubblesRuntimeFacts.proofAgeMs,
+                    lastFailure: blueBubblesRuntimeFacts.lastFailure,
+                    failureLayer: blueBubblesRuntimeFacts.failureLayer,
+                    recoveryAction: blueBubblesRuntimeFacts.recoveryAction,
+                    pendingRecoveryCount: blueBubblesRuntimeFacts.pendingRecoveryCount,
+                    failedRecoveryCount: blueBubblesRuntimeFacts.failedRecoveryCount,
+                    oldestPendingRecoveryAt: blueBubblesRuntimeFacts.oldestPendingRecoveryAt,
+                    oldestPendingRecoveryAgeMs: blueBubblesRuntimeFacts.oldestPendingRecoveryAgeMs,
+                } : {}),
             }));
         });
         (0, runtime_1.emitNervesEvent)({