@ouro.bot/cli 0.1.0-alpha.55 → 0.1.0-alpha.551

package/dist/heart/daemon/process-manager.js

@@ -51,24 +51,108 @@ class DaemonProcessManager {
     now;
     setTimeoutFn;
     clearTimeoutFn;
+    cooldownRecoveryMs;
+    maxCooldownRetries;
+    startupStaleAfterMs;
     existsSyncFn;
+    configCheckFn;
+    statusWriterFn;
+    onSnapshotChangeFn;
+    /**
+     * Notify the snapshot-change observer (if registered). Swallows any
+     * errors from the observer so process lifecycle code never fails
+     * because the observer threw.
+     */
+    notifySnapshotChange(snapshot) {
+        if (!this.onSnapshotChangeFn)
+            return;
+        try {
+            this.onSnapshotChangeFn(snapshot);
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "daemon",
+                event: "daemon.snapshot_change_observer_error",
+                message: "snapshot-change observer threw",
+                meta: {
+                    agent: snapshot.name,
+                    error: error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error),
+                },
+            });
+        }
+    }
+    writeStatus(agent, text) {
+        try {
+            this.statusWriterFn(text);
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "daemon",
+                event: "daemon.status_writer_error",
+                message: "daemon status writer threw",
+                meta: {
+                    agent,
+                    error: error instanceof Error ? error.message : String(error),
+                },
+            });
+        }
+    }
+    currentTimeMs() {
+        const value = this.now();
+        return Number.isFinite(value) ? value : Date.now();
+    }
+    isStartAttemptCurrent(state, attemptId) {
+        return state.startAttemptId === attemptId;
+    }
+    markConfigCheckFailed(state, errorReason, fixHint) {
+        const agent = state.config.name;
+        state.snapshot.status = "crashed";
+        state.snapshot.errorReason = errorReason;
+        state.snapshot.fixHint = fixHint;
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "daemon",
+            event: "daemon.agent_config_invalid",
+            message: errorReason,
+            meta: { agent, fix: fixHint },
+        });
+        this.writeStatus(agent, `[daemon] ${agent}: ${errorReason}\n` +
+            (fixHint ? `  Fix: ${fixHint}\n` : ""));
+        this.notifySnapshotChange(state.snapshot);
+    }
     constructor(options) {
         this.maxRestartsPerHour = options.maxRestartsPerHour ?? 10;
         this.stabilityThresholdMs = options.stabilityThresholdMs ?? 60_000;
         this.initialBackoffMs = options.initialBackoffMs ?? 1_000;
         this.maxBackoffMs = options.maxBackoffMs ?? 60_000;
+        this.cooldownRecoveryMs = options.cooldownRecoveryMs ?? 5 * 60 * 1_000;
+        this.maxCooldownRetries = options.maxCooldownRetries ?? 3;
+        this.startupStaleAfterMs = options.startupStaleAfterMs ?? 45_000;
         this.spawnFn = options.spawn ?? ((command, args, spawnOptions) => (0, child_process_1.spawn)(command, args, spawnOptions));
         this.now = options.now ?? (() => Date.now());
         this.setTimeoutFn = options.setTimeoutFn ?? ((cb, delay) => setTimeout(cb, delay));
         this.clearTimeoutFn = options.clearTimeoutFn ?? ((timer) => clearTimeout(timer));
         this.existsSyncFn = options.existsSync ?? null;
+        this.configCheckFn = options.configCheck ?? null;
+        this.statusWriterFn = options.statusWriter ?? ((text) => {
+            process.stderr.write(text);
+        });
+        this.onSnapshotChangeFn = options.onSnapshotChange ?? null;
         for (const agent of options.agents) {
             this.agents.set(agent.name, {
                 config: agent,
                 process: null,
+                startInFlight: false,
+                startAttemptedAtMs: null,
+                startAttemptId: 0,
                 restartTimer: null,
                 crashTimestamps: [],
                 stopRequested: false,
+                cooldownTimer: null,
+                cooldownRetryCount: 0,
+                fastCrashCount: 0,
                 snapshot: {
                     name: agent.name,
                     channel: agent.channel,
@@ -78,6 +162,10 @@ class DaemonProcessManager {
                     startedAt: null,
                     lastCrashAt: null,
                     backoffMs: this.initialBackoffMs,
+                    lastExitCode: null,
+                    lastSignal: null,
+                    errorReason: null,
+                    fixHint: null,
                 },
             });
         }
@@ -89,53 +177,203 @@ class DaemonProcessManager {
             }
         }
     }
+    triggerAutoStartAgents() {
+        for (const state of this.agents.values()) {
+            if (!state.config.autoStart)
+                continue;
+            void this.startAgent(state.config.name).catch((error) => {
+                const errorReason = error instanceof Error ? error.message : String(error);
+                this.markConfigCheckFailed(state, `agent startup threw before the worker could run: ${errorReason}`, "Run 'ouro doctor' for diagnostics, then retry 'ouro up'.");
+            });
+        }
+    }
     async startAgent(agent) {
         const state = this.requireAgent(agent);
-        if (state.process)
+        if (state.process || state.startInFlight)
             return;
-        this.clearRestartTimer(state);
-        state.stopRequested = false;
-        state.snapshot.status = "starting";
-        const runCwd = (0, identity_1.getRepoRoot)();
-        const entryScript = path.join((0, identity_1.getRepoRoot)(), "dist", state.config.entry);
-        if (this.existsSyncFn && !this.existsSyncFn(entryScript)) {
-            state.snapshot.status = "crashed";
+        const attemptId = state.startAttemptId + 1;
+        state.startAttemptId = attemptId;
+        state.startInFlight = true;
+        state.startAttemptedAtMs = this.currentTimeMs();
+        try {
+            this.clearRestartTimer(state);
+            state.stopRequested = false;
+            state.snapshot.status = "starting";
+            if (this.configCheckFn) {
+                let result;
+                try {
+                    result = await this.configCheckFn(agent);
+                }
+                catch (error) {
+                    const errorReason = error instanceof Error ? error.message : String(error);
+                    this.markConfigCheckFailed(state, `agent config validation threw: ${errorReason}`, "Run 'ouro doctor' for diagnostics, then retry 'ouro up'.");
+                    return;
+                }
+                if (!this.isStartAttemptCurrent(state, attemptId))
+                    return;
+                if (state.stopRequested) {
+                    state.snapshot.status = "stopped";
+                    state.snapshot.pid = null;
+                    this.notifySnapshotChange(state.snapshot);
+                    return;
+                }
+                if (result.skip) {
+                    state.snapshot.status = "stopped";
+                    state.snapshot.errorReason = null;
+                    state.snapshot.fixHint = null;
+                    (0, runtime_1.emitNervesEvent)({
+                        component: "daemon",
+                        event: "daemon.agent_config_skipped",
+                        message: result.error ?? "agent start skipped by config check",
+                        meta: { agent, fix: result.fix ?? null },
+                    });
+                    this.notifySnapshotChange(state.snapshot);
+                    return;
+                }
+                if (!result.ok) {
+                    this.markConfigCheckFailed(state, result.error ?? "agent config validation failed", result.fix ?? null);
+                    return;
+                }
+                /* v8 ignore next -- defensive duplicate stale-start guard before spawn preparation @preserve */
+                if (!this.isStartAttemptCurrent(state, attemptId))
+                    return;
+                // Config check passed — clear any prior error so the pulse stops
+                // reporting the broken state. This is the recovery path: the user
+                // fixed their secrets/config, the next startAgent attempt sees a
+                // valid config, and the pulse goes quiet.
+                state.snapshot.errorReason = null;
+                state.snapshot.fixHint = null;
+            }
+            const runCwd = (0, identity_1.getRepoRoot)();
+            const entryScript = path.join((0, identity_1.getRepoRoot)(), "dist", state.config.entry);
+            if (this.existsSyncFn && !this.existsSyncFn(entryScript)) {
+                state.snapshot.status = "crashed";
+                (0, runtime_1.emitNervesEvent)({
+                    level: "error",
+                    component: "daemon",
+                    event: "daemon.agent_entry_missing",
+                    message: "agent entry script does not exist — cannot spawn. Run 'ouro daemon install' from the correct location.",
+                    meta: { agent, entryScript },
+                });
+                this.notifySnapshotChange(state.snapshot);
+                return;
+            }
+            /* v8 ignore next -- defensive duplicate stale-start guard immediately before spawn @preserve */
+            if (!this.isStartAttemptCurrent(state, attemptId))
+                return;
+            if (state.stopRequested) {
+                state.snapshot.status = "stopped";
+                state.snapshot.pid = null;
+                this.notifySnapshotChange(state.snapshot);
+                return;
+            }
+            const args = [entryScript, "--agent", state.config.agentArg ?? agent, ...(state.config.args ?? [])];
+            const child = this.spawnFn("node", args, {
+                cwd: runCwd,
+                env: state.config.env ? { ...process.env, ...state.config.env } : process.env,
+                stdio: ["ignore", "ignore", "ignore", "ipc"],
+            });
+            /* v8 ignore next 7 -- defensive: spawn should always return a ChildProcess @preserve */
+            if (!child) {
+                state.snapshot.status = "crashed";
+                (0, runtime_1.emitNervesEvent)({ level: "error", component: "daemon", event: "daemon.agent_spawn_failed", message: "spawn returned null", meta: { agent } });
+                return;
+            }
+            if (!this.isStartAttemptCurrent(state, attemptId)) {
+                try {
+                    child.kill("SIGTERM");
+                }
+                catch {
+                    (0, runtime_1.emitNervesEvent)({
+                        level: "warn",
+                        component: "daemon",
+                        event: "daemon.agent_stop_error",
+                        message: "failed to stop stale managed agent startup",
+                        meta: { agent },
+                    });
+                }
+                return;
+            }
+            state.process = child;
+            state.snapshot.status = "running";
+            state.snapshot.pid = child.pid ?? null;
+            state.snapshot.startedAt = new Date(this.currentTimeMs()).toISOString();
+            const bootstrap = state.config.getRuntimeCredentialBootstrap?.() ?? null;
+            if (bootstrap) {
+                const message = {
+                    type: "ouro.runtimeCredentialBootstrap",
+                    agentName: bootstrap.agentName,
+                };
+                if (bootstrap.runtimeConfig)
+                    message.runtimeConfig = bootstrap.runtimeConfig;
+                if (bootstrap.machineRuntimeConfig)
+                    message.machineRuntimeConfig = bootstrap.machineRuntimeConfig;
+                if (bootstrap.machineId)
+                    message.machineId = bootstrap.machineId;
+                if (bootstrap.providerCredentialRecords)
+                    message.providerCredentialRecords = bootstrap.providerCredentialRecords;
+                try {
+                    child.send?.(message);
+                    (0, runtime_1.emitNervesEvent)({
+                        component: "daemon",
+                        event: "daemon.agent_runtime_credentials_bootstrap_sent",
+                        message: "sent runtime credential bootstrap to managed agent process",
+                        meta: {
+                            agent,
+                            runtimeConfig: !!bootstrap.runtimeConfig,
+                            machineRuntimeConfig: !!bootstrap.machineRuntimeConfig,
+                            providerCredentialRecords: bootstrap.providerCredentialRecords?.length ?? 0,
+                        },
+                    });
+                }
+                catch (error) {
+                    (0, runtime_1.emitNervesEvent)({
+                        level: "warn",
+                        component: "daemon",
+                        event: "daemon.agent_ipc_send_error",
+                        message: "failed to send runtime credential bootstrap to managed agent process",
+                        meta: { agent, error: error instanceof Error ? error.message : String(error) },
+                    });
+                }
+            }
             (0, runtime_1.emitNervesEvent)({
-                level: "error",
                 component: "daemon",
-                event: "daemon.agent_entry_missing",
-                message: "agent entry script does not exist — cannot spawn. Run 'ouro daemon install' from the correct location.",
-                meta: { agent, entryScript },
+                event: "daemon.agent_started",
+                message: "daemon started managed agent process",
+                meta: { agent, pid: child.pid ?? null, cwd: runCwd },
+            });
+            this.notifySnapshotChange(state.snapshot);
+            /* v8 ignore start — child process error handler; requires real spawn to trigger */
+            child.on("error", (err) => {
+                (0, runtime_1.emitNervesEvent)({
+                    level: "warn",
+                    component: "daemon",
+                    event: "daemon.agent_process_error",
+                    message: "managed agent process emitted error",
+                    meta: { agent, error: err.message },
+                });
+            });
+            /* v8 ignore stop */
+            child.once("exit", (code, signal) => {
+                this.onExit(state, code, signal);
             });
-            return;
         }
-        const args = [entryScript, "--agent", state.config.agentArg ?? agent, ...(state.config.args ?? [])];
-        const child = this.spawnFn("node", args, {
-            cwd: runCwd,
-            env: state.config.env ? { ...process.env, ...state.config.env } : process.env,
-            stdio: ["ignore", "ignore", "ignore", "ipc"],
-        });
-        state.process = child;
-        state.snapshot.status = "running";
-        state.snapshot.pid = child.pid ?? null;
-        state.snapshot.startedAt = new Date(this.now()).toISOString();
-        (0, runtime_1.emitNervesEvent)({
-            component: "daemon",
-            event: "daemon.agent_started",
-            message: "daemon started managed agent process",
-            meta: { agent, pid: child.pid ?? null, cwd: runCwd },
-        });
-        child.once("exit", (code, signal) => {
-            this.onExit(state, code, signal);
-        });
+        finally {
+            if (this.isStartAttemptCurrent(state, attemptId)) {
+                state.startInFlight = false;
+                state.startAttemptedAtMs = null;
+            }
+        }
     }
     async stopAgent(agent) {
         const state = this.requireAgent(agent);
         this.clearRestartTimer(state);
+        this.clearCooldownTimer(state);
         state.stopRequested = true;
         if (!state.process) {
             state.snapshot.status = "stopped";
             state.snapshot.pid = null;
+            this.notifySnapshotChange(state.snapshot);
             return;
         }
         const child = state.process;
@@ -154,8 +392,34 @@ class DaemonProcessManager {
                 meta: { agent },
             });
         }
+        this.notifySnapshotChange(state.snapshot);
     }
     async restartAgent(agent) {
+        const state = this.requireAgent(agent);
+        if (state.startInFlight && !state.process) {
+            const startedAt = state.startAttemptedAtMs;
+            /* v8 ignore next -- defensive: startInFlight always records a start timestamp @preserve */
+            const elapsedMs = startedAt === null ? 0 : this.currentTimeMs() - startedAt;
+            if (elapsedMs < this.startupStaleAfterMs) {
+                (0, runtime_1.emitNervesEvent)({
+                    component: "daemon",
+                    event: "daemon.agent_restart_deferred",
+                    message: "managed agent restart skipped while startup is already in flight",
+                    meta: { agent, elapsedMs, startupStaleAfterMs: this.startupStaleAfterMs },
+                });
+                return;
+            }
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "daemon",
+                event: "daemon.agent_startup_stale_recovered",
+                message: "managed agent startup was stale; clearing the pending attempt before restart",
+                meta: { agent, elapsedMs, startupStaleAfterMs: this.startupStaleAfterMs },
+            });
+            state.startAttemptId += 1;
+            state.startInFlight = false;
+            state.startAttemptedAtMs = null;
+        }
         await this.stopAgent(agent);
         await this.startAgent(agent);
     }
@@ -191,9 +455,13 @@ class DaemonProcessManager {
         if (!state.process)
             return;
         state.process = null;
+        state.startInFlight = false;
+        state.startAttemptedAtMs = null;
         state.snapshot.pid = null;
+        state.snapshot.lastExitCode = code;
+        state.snapshot.lastSignal = signal;
         const crashed = !state.stopRequested && code !== 0;
-        const now = this.now();
+        const now = this.currentTimeMs();
         const startedAt = state.snapshot.startedAt ? Date.parse(state.snapshot.startedAt) : now;
         const runDuration = Math.max(0, now - startedAt);
         (0, runtime_1.emitNervesEvent)({
@@ -208,13 +476,45 @@ class DaemonProcessManager {
             if (runDuration >= this.stabilityThresholdMs) {
                 state.snapshot.backoffMs = this.initialBackoffMs;
             }
+            this.notifySnapshotChange(state.snapshot);
             return;
         }
         state.snapshot.lastCrashAt = new Date(now).toISOString();
+        // Fast-crash detection: if the agent dies within 5 seconds of starting, it's likely
+        // a configuration issue (missing credentials, bad provider, etc.) not a transient failure.
+        // After 3 consecutive fast crashes, stop retrying and mark as config-failed.
+        const FAST_CRASH_THRESHOLD_MS = 5000;
+        const FAST_CRASH_MAX = 3;
+        if (runDuration < FAST_CRASH_THRESHOLD_MS) {
+            state.fastCrashCount = state.fastCrashCount + 1;
+            if (state.fastCrashCount >= FAST_CRASH_MAX) {
+                state.snapshot.status = "crashed";
+                // Capture the fast-crash diagnosis on the snapshot so it surfaces
+                // via the pulse. The error message is prescriptive: it tells the
+                // user (and their sibling agents) exactly what to do.
+                state.snapshot.errorReason = `agent crashed ${FAST_CRASH_MAX} times within ${FAST_CRASH_THRESHOLD_MS}ms of startup — likely a configuration issue (missing credentials, bad provider).`;
+                state.snapshot.fixHint = `Fix the config and run \`ouro up\` to restart, or check daemon logs for the underlying error.`;
+                (0, runtime_1.emitNervesEvent)({
+                    level: "error",
+                    component: "daemon",
+                    event: "daemon.agent_config_failure",
+                    message: `agent crashed ${FAST_CRASH_MAX} times within ${FAST_CRASH_THRESHOLD_MS}ms of startup — likely a configuration issue (missing credentials, bad provider). Not retrying. Fix the config and run \`ouro up\` to restart.`,
+                    meta: { agent: state.config.name, fastCrashCount: state.fastCrashCount, avgRunDurationMs: runDuration },
+                });
+                this.notifySnapshotChange(state.snapshot);
+                return; // Don't schedule cooldown recovery — this needs human/agent intervention
+            }
+        }
+        else {
+            // Reset fast-crash counter on a stable run
+            state.fastCrashCount = 0;
+        }
         state.crashTimestamps = state.crashTimestamps.filter((crashTs) => crashTs >= startOfHour(now));
         state.crashTimestamps.push(now);
         if (state.crashTimestamps.length > this.maxRestartsPerHour) {
             state.snapshot.status = "crashed";
+            state.snapshot.errorReason = `agent exceeded restart limit (${this.maxRestartsPerHour}/hr) — entering cooldown`;
+            state.snapshot.fixHint = "investigate why the agent keeps crashing; cooldown will retry shortly";
             (0, runtime_1.emitNervesEvent)({
                 level: "error",
                 component: "daemon",
@@ -222,6 +522,8 @@ class DaemonProcessManager {
                 message: "managed agent exceeded restart limit and is marked crashed",
                 meta: { agent: state.config.name, maxRestartsPerHour: this.maxRestartsPerHour },
             });
+            this.notifySnapshotChange(state.snapshot);
+            this.scheduleCooldownRecovery(state);
             return;
         }
         state.snapshot.status = "starting";
@@ -232,6 +534,7 @@ class DaemonProcessManager {
         state.restartTimer = this.setTimeoutFn(() => {
             void this.startAgent(state.config.name);
         }, waitMs);
+        this.notifySnapshotChange(state.snapshot);
     }
     clearRestartTimer(state) {
         if (state.restartTimer === null)
@@ -239,6 +542,45 @@ class DaemonProcessManager {
         this.clearTimeoutFn(state.restartTimer);
         state.restartTimer = null;
     }
+    scheduleCooldownRecovery(state) {
+        if (state.cooldownRetryCount >= this.maxCooldownRetries) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "error",
+                component: "daemon",
+                event: "daemon.agent_permanent_failure",
+                message: "managed agent exhausted all cooldown retries — permanently stopped",
+                meta: { agent: state.config.name, cooldownRetryCount: state.cooldownRetryCount, maxCooldownRetries: this.maxCooldownRetries },
+            });
+            return;
+        }
+        this.clearCooldownTimer(state);
+        state.cooldownTimer = this.setTimeoutFn(() => {
+            state.cooldownRetryCount += 1;
+            state.crashTimestamps = [];
+            state.snapshot.backoffMs = this.initialBackoffMs;
+            state.snapshot.status = "starting";
+            state.snapshot.restartCount += 1;
+            (0, runtime_1.emitNervesEvent)({
+                component: "daemon",
+                event: "daemon.agent_cooldown_recovery",
+                message: "attempting cooldown recovery for managed agent",
+                meta: { agent: state.config.name, cooldownRetryCount: state.cooldownRetryCount },
+            });
+            void this.startAgent(state.config.name);
+        }, this.cooldownRecoveryMs);
+        (0, runtime_1.emitNervesEvent)({
+            component: "daemon",
+            event: "daemon.agent_cooldown_scheduled",
+            message: `scheduled cooldown recovery in ${this.cooldownRecoveryMs}ms`,
+            meta: { agent: state.config.name, cooldownRecoveryMs: this.cooldownRecoveryMs, cooldownRetryCount: state.cooldownRetryCount },
+        });
+    }
+    clearCooldownTimer(state) {
+        if (state.cooldownTimer === null)
+            return;
+        this.clearTimeoutFn(state.cooldownTimer);
+        state.cooldownTimer = null;
+    }
     requireAgent(agent) {
         const state = this.agents.get(agent);
         if (!state) {

package/dist/heart/daemon/provider-discovery.js

@@ -0,0 +1,137 @@
+"use strict";
+/**
+ * Shared provider discovery for repair.
+ *
+ * Runtime repair only trusts the agent vault. First-run conveniences may still
+ * inspect env vars before credentials are stored, but once an agent exists the
+ * vault is the source of truth.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scanEnvVarCredentials = scanEnvVarCredentials;
+exports.discoverInstalledAgentCredentials = discoverInstalledAgentCredentials;
+exports.describeDiscoveredCredentialSource = describeDiscoveredCredentialSource;
+exports.discoverWorkingProvider = discoverWorkingProvider;
+const identity_1 = require("../identity");
+const provider_credentials_1 = require("../provider-credentials");
+const runtime_1 = require("../../nerves/runtime");
+/**
+ * Scan environment variables for API keys during first-run bootstrap.
+ * This does not participate in runtime provider repair.
+ */
+function scanEnvVarCredentials(env) {
+    const results = [];
+    for (const [provider, desc] of Object.entries(identity_1.PROVIDER_CREDENTIALS)) {
+        const cred = {};
+        for (const [envVar, credKey] of Object.entries(desc.envVars)) {
+            const value = env[envVar];
+            if (value) {
+                cred[credKey] = value;
+            }
+        }
+        const hasRequired = desc.required.some((key) => !!cred[key]);
+        if (hasRequired) {
+            results.push({
+                provider,
+                agentName: "env",
+                credentials: cred,
+                providerConfig: { ...cred },
+            });
+        }
+    }
+    return results;
+}
+function stringifyProviderFields(fields) {
+    const result = {};
+    for (const [key, value] of Object.entries(fields)) {
+        result[key] = String(value);
+    }
+    return result;
+}
+function discoveredFromVaultRecord(record, agentName = "vault") {
+    return {
+        provider: record.provider,
+        agentName,
+        credentials: stringifyProviderFields(record.credentials),
+        providerConfig: stringifyProviderFields(record.config),
+    };
+}
+async function discoverInstalledAgentCredentials(agentNames) {
+    const discovered = [];
+    for (const agentName of agentNames) {
+        if (agentName === "SerpentGuide")
+            continue;
+        const poolResult = await (0, provider_credentials_1.refreshProviderCredentialPool)(agentName, { preserveCachedOnFailure: true });
+        if (!poolResult.ok)
+            continue;
+        for (const record of Object.values(poolResult.pool.providers)) {
+            if (!record)
+                continue;
+            discovered.push(discoveredFromVaultRecord(record, agentName));
+        }
+    }
+    return discovered;
+}
+function describeDiscoveredCredentialSource(credential, envVar) {
+    if (credential.agentName === "env") {
+        return envVar ? `from env: $${envVar}` : "from env";
+    }
+    return `from ${credential.agentName}'s vault`;
+}
+async function discoverWorkingProvider(deps) {
+    const poolResult = await (0, provider_credentials_1.refreshProviderCredentialPool)(deps.agentName);
+    if (!poolResult.ok) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "daemon",
+            event: "daemon.provider_discovery_none",
+            message: "provider discovery could not read agent vault",
+            meta: { agentName: deps.agentName, reason: poolResult.reason },
+        });
+        return null;
+    }
+    const candidates = Object.entries(poolResult.pool.providers)
+        .map(([, record]) => discoveredFromVaultRecord(record));
+    if (candidates.length === 0) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "info",
+            component: "daemon",
+            event: "daemon.provider_discovery_none",
+            message: "no provider credentials found in agent vault",
+            meta: { agentName: deps.agentName },
+        });
+        return null;
+    }
+    for (const candidate of candidates) {
+        const config = { ...candidate.providerConfig, ...candidate.credentials };
+        (0, runtime_1.emitNervesEvent)({
+            level: "info",
+            component: "daemon",
+            event: "daemon.provider_discovery_ping",
+            message: `pinging provider: ${candidate.provider}`,
+            meta: { agentName: deps.agentName, provider: candidate.provider, source: candidate.agentName },
+        });
+        const result = await deps.pingProvider(candidate.provider, config);
+        if (result.ok) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "info",
+                component: "daemon",
+                event: "daemon.provider_discovery_ok",
+                message: `provider discovery succeeded: ${candidate.provider}`,
+                meta: { agentName: deps.agentName, provider: candidate.provider, source: candidate.agentName },
+            });
+            return {
+                provider: candidate.provider,
+                credentials: candidate.credentials,
+                providerConfig: candidate.providerConfig,
+            };
+        }
+    }
+    (0, runtime_1.emitNervesEvent)({
+        level: "warn",
+        component: "daemon",
+        event: "daemon.provider_discovery_all_failed",
+        message: "all vault provider candidates failed ping",
+        meta: { agentName: deps.agentName, candidateCount: candidates.length },
+    });
+    return null;
+}