@ouro.bot/cli 0.1.0-alpha.59 → 0.1.0-alpha.591

package/dist/heart/daemon/log-tailer.js

@@ -38,6 +38,7 @@ exports.readLastLines = readLastLines;
 exports.formatLogLine = formatLogLine;
 exports.tailLogs = tailLogs;
 const path = __importStar(require("path"));
+const zlib = __importStar(require("zlib"));
 const nerves_1 = require("../../nerves");
 const runtime_1 = require("../../nerves/runtime");
 const identity_1 = require("../identity");
@@ -47,6 +48,39 @@ const LEVEL_COLORS = {
     warn: "\x1b[33m",
     error: "\x1b[31m",
 };
+/**
+ * Parse a log filename into a (streamBase, generationRank) tuple.
+ *
+ * - `daemon.ndjson`          → { streamBase: "daemon", rank: 0 }   (active, newest)
+ * - `daemon.1.ndjson.gz`     → { streamBase: "daemon", rank: 1 }
+ * - `daemon.5.ndjson.gz`     → { streamBase: "daemon", rank: 5 }   (oldest)
+ * - Anything else            → null (not a log file).
+ *
+ * Higher rank = older. Used to sort so the oldest generation is read first
+ * and the active stream is read last, producing chronological output.
+ */
+function parseLogFilename(name) {
+    if (name.endsWith(".ndjson.gz")) {
+        // e.g. daemon.1.ndjson.gz → base "daemon.1", strip ".gz" then ".ndjson" then ".<n>"
+        const withoutGz = name.slice(0, -".gz".length); // daemon.1.ndjson
+        const withoutNdjson = withoutGz.slice(0, -".ndjson".length); // daemon.1
+        const genMatch = withoutNdjson.match(/^(.+)\.(\d+)$/);
+        if (!genMatch)
+            return null;
+        return { streamBase: genMatch[1], rank: parseInt(genMatch[2], 10) };
+    }
+    if (name.endsWith(".ndjson")) {
+        const withoutNdjson = name.slice(0, -".ndjson".length);
+        // Active file: daemon.ndjson → base "daemon", rank 0
+        // Legacy numeric gen: daemon.1.ndjson → base "daemon", rank 1 (treat same as gzipped)
+        const legacyMatch = withoutNdjson.match(/^(.+)\.(\d+)$/);
+        if (legacyMatch) {
+            return { streamBase: legacyMatch[1], rank: parseInt(legacyMatch[2], 10) };
+        }
+        return { streamBase: withoutNdjson, rank: 0 };
+    }
+    return null;
+}
 function discoverLogFiles(options) {
     /* v8 ignore start -- integration: default DI stubs for real OS @preserve */
     const existsSync = options.existsSync ?? (() => false);
@@ -55,22 +89,51 @@ function discoverLogFiles(options) {
     const logDir = options.homeDir
         ? path.join(options.homeDir, "AgentBundles", `${options.agentName ?? "slugger"}.ouro`, "state", "daemon", "logs")
         : (0, identity_1.getAgentDaemonLogsDir)(options.agentName);
-    const files = [];
+    const entries = [];
     if (existsSync(logDir)) {
         for (const name of readdirSync(logDir)) {
-            if (!name.endsWith(".ndjson"))
+            const parsed = parseLogFilename(name);
+            if (!parsed)
                 continue;
             if (options.agentFilter && !name.includes(options.agentFilter))
                 continue;
-            files.push(path.join(logDir, name));
+            entries.push({ name, parsed });
         }
     }
-    return files.sort();
+    // Sort chronologically: for each stream, oldest generation first, active last.
+    // Across streams, sort alphabetically by streamBase so output is stable.
+    entries.sort((a, b) => {
+        if (a.parsed.streamBase !== b.parsed.streamBase) {
+            return a.parsed.streamBase < b.parsed.streamBase ? -1 : 1;
+        }
+        // Same stream: higher rank = older = read first.
+        return b.parsed.rank - a.parsed.rank;
+    });
+    return entries.map((e) => path.join(logDir, e.name));
+}
+/**
+ * Read a log file as a string, transparently handling gzipped rotations.
+ *
+ * For `.ndjson.gz` files we read the raw bytes via `fs.readFileSync` (ignoring
+ * any caller-supplied DI `readFileSync`, since that stub returns a `string`
+ * and would corrupt gzip bytes) and then `zlib.gunzipSync` to recover the
+ * original text. For plain `.ndjson` files we defer to the DI stub so tests
+ * can keep mocking fs.
+ */
+function readNdjsonFileContents(filePath, readFileSync) {
+    if (filePath.endsWith(".gz")) {
+        // Binary path: tests can mock readFileSync to return a Buffer (typed as
+        // string) via `as unknown as string` — we accept both Buffer and Uint8Array.
+        const raw = readFileSync(filePath);
+        const buf = typeof raw === "string" ? Buffer.from(raw, "binary") : Buffer.from(raw);
+        return zlib.gunzipSync(buf).toString("utf-8");
+    }
+    return readFileSync(filePath, "utf-8");
 }
 function readLastLines(filePath, count, readFileSync) {
     let content;
     try {
-        content = readFileSync(filePath, "utf-8");
+        content = readNdjsonFileContents(filePath, readFileSync);
     }
     catch {
         return [];
@@ -100,12 +163,17 @@ function tailLogs(options = {}) {
     const files = discoverLogFiles(options);
     (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.log_tailer_started", message: "log tailer started", meta: { fileCount: files.length, follow: !!options.follow } });
     const fileSizes = new Map();
-    // Read initial lines
+    // Read initial lines from each discovered file (oldest gz → newest gz → active).
+    // Gzipped files are historical and never tailed in follow mode.
     for (const file of files) {
         const lines = readLastLines(file, lineCount, readFileSync);
         for (const line of lines) {
             writer(`${formatLogLine(line)}\n`);
         }
+        if (file.endsWith(".gz")) {
+            // Historical rotation — skip size tracking, never followed.
+            continue;
+        }
         try {
             const content = readFileSync(file, "utf-8");
             fileSizes.set(file, content.length);
@@ -114,9 +182,10 @@ function tailLogs(options = {}) {
             fileSizes.set(file, 0);
         }
     }
-    // Follow mode
+    // Follow mode: only the active (non-gzipped) stream is watched.
     if (options.follow && watchFile && unwatchFile) {
-        for (const file of files) {
+        const activeFiles = files.filter((f) => !f.endsWith(".gz"));
+        for (const file of activeFiles) {
             watchFile(file, () => {
                 let content;
                 try {
@@ -138,7 +207,7 @@ function tailLogs(options = {}) {
             });
         }
         return () => {
-            for (const file of files) {
+            for (const file of activeFiles) {
                 unwatchFile(file);
             }
         };

package/dist/heart/daemon/logs-prune.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pruneDaemonLogs = pruneDaemonLogs;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const crypto_1 = require("crypto");
+const nerves_1 = require("../../nerves");
+const runtime_1 = require("../../nerves/runtime");
+const identity_1 = require("../identity");
+function isActiveLogStream(name) {
+    if (name.endsWith(".ndjson")) {
+        return !/\.\d+\.ndjson$/.test(name);
+    }
+    if (name.endsWith(".log")) {
+        return !/\.\d+\.log$/.test(name);
+    }
+    return false;
+}
+function pruneDaemonLogs(options = {}) {
+    /* v8 ignore next -- defensive: tests always pass logsDir to avoid prod paths @preserve */
+    const logsDir = options.logsDir ?? (0, identity_1.getAgentDaemonLogsDir)(options.agentName);
+    const maxSizeBytes = options.maxSizeBytes ?? nerves_1.DEFAULT_MAX_LOG_SIZE_BYTES;
+    const maxGenerations = options.maxGenerations ?? nerves_1.DEFAULT_MAX_GENERATIONS;
+    const traceId = (0, crypto_1.randomUUID)();
+    (0, runtime_1.emitNervesEvent)({
+        component: "nerves",
+        event: "nerves.logs_prune_start",
+        trace_id: traceId,
+        message: "pruning daemon logs",
+        meta: { logsDir, maxSizeBytes, maxGenerations },
+    });
+    let completed = false;
+    try {
+        if (!(0, fs_1.existsSync)(logsDir)) {
+            completed = true;
+            (0, runtime_1.emitNervesEvent)({
+                component: "nerves",
+                event: "nerves.logs_prune_end",
+                trace_id: traceId,
+                message: "daemon logs dir does not exist",
+                meta: { logsDir, filesCompacted: 0, bytesFreed: 0 },
+            });
+            return { filesCompacted: 0, bytesFreed: 0 };
+        }
+        let filesCompacted = 0;
+        let bytesFreed = 0;
+        // Enumerate and rotate each active structured stream plus legacy launchd
+        // .log streams. We explicitly skip .gz and other files — only the active
+        // stream can be a rotation candidate. Legacy generation files are handled
+        // inside rotateIfNeeded's generation-shift step, so we skip them here to
+        // avoid double-rotating.
+        for (const name of (0, fs_1.readdirSync)(logsDir)) {
+            if (!isActiveLogStream(name))
+                continue;
+            const filePath = (0, path_1.join)(logsDir, name);
+            let sizeBefore;
+            try {
+                sizeBefore = (0, fs_1.statSync)(filePath).size;
+                /* v8 ignore start -- defensive: file disappears between readdir and stat @preserve */
+            }
+            catch {
+                continue;
+            }
+            /* v8 ignore stop */
+            if (sizeBefore < maxSizeBytes)
+                continue;
+            // rotateIfNeeded returns true because we pre-checked sizeBefore >=
+            // maxSizeBytes above. The false branch of `if (rotated)` is defensive
+            // and unreachable under normal flow; we skip it from coverage so a
+            // future refactor that weakens the pre-check still reports correct
+            // counts without needing a contrived test.
+            const rotated = (0, nerves_1.rotateIfNeeded)(filePath, {
+                maxSizeBytes,
+                maxGenerations,
+                compress: true,
+            });
+            /* v8 ignore next 3 -- defensive: pre-check guarantees rotated=true @preserve */
+            if (!rotated) {
+                continue;
+            }
+            filesCompacted += 1;
+            bytesFreed += sizeBefore;
+        }
+        completed = true;
+        (0, runtime_1.emitNervesEvent)({
+            component: "nerves",
+            event: "nerves.logs_prune_end",
+            trace_id: traceId,
+            message: "daemon logs pruned",
+            meta: { logsDir, filesCompacted, bytesFreed },
+        });
+        return { filesCompacted, bytesFreed };
+    }
+    catch (err) {
+        /* v8 ignore next -- defensive: completed=true only reached after try returns @preserve */
+        if (!completed) {
+            /* v8 ignore next -- defensive: rotation always throws real Errors @preserve */
+            const reason = err instanceof Error ? err.message : String(err);
+            (0, runtime_1.emitNervesEvent)({
+                component: "nerves",
+                event: "nerves.logs_prune_error",
+                trace_id: traceId,
+                level: "error",
+                message: "daemon logs prune failed",
+                meta: { logsDir, error: reason },
+            });
+        }
+        throw err;
+    }
+}

package/dist/heart/daemon/mcp-canary.js

@@ -0,0 +1,297 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseMcpStatusText = parseMcpStatusText;
+exports.runMcpStatusCanary = runMcpStatusCanary;
+exports.formatMcpStatusCanaryResult = formatMcpStatusCanaryResult;
+exports.createMcpStatusCanaryProbe = createMcpStatusCanaryProbe;
+const child_process_1 = require("child_process");
+const path = __importStar(require("path"));
+const runtime_1 = require("../../nerves/runtime");
+const DEFAULT_CANARY_TIMEOUT_MS = 10_000;
+const MCP_PROTOCOL_VERSION = "2024-11-05";
+function defaultCommandArgs(agent, socketPath) {
+    const entryPath = path.join(__dirname, "ouro-bot-entry.js");
+    return [
+        entryPath,
+        "mcp-serve",
+        "--agent",
+        agent,
+        ...(socketPath ? ["--socket", socketPath] : []),
+    ];
+}
+function responseText(response) {
+    const result = response.result;
+    if (!result || typeof result !== "object" || Array.isArray(result))
+        return JSON.stringify(response);
+    const content = result.content;
+    if (!Array.isArray(content))
+        return JSON.stringify(response);
+    const first = content[0];
+    if (!first || typeof first !== "object" || Array.isArray(first))
+        return JSON.stringify(response);
+    const text = first.text;
+    return typeof text === "string" ? text : JSON.stringify(response);
+}
+function parseFields(line) {
+    const parsed = {};
+    for (const segment of line.split("\t")) {
+        const idx = segment.indexOf("=");
+        if (idx <= 0)
+            continue;
+        parsed[segment.slice(0, idx)] = segment.slice(idx + 1);
+    }
+    return parsed;
+}
+function parseMcpStatusText(text) {
+    const daemon = {};
+    const senses = {};
+    for (const line of text.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        if (trimmed.startsWith("daemon=")) {
+            Object.assign(daemon, parseFields(trimmed));
+            continue;
+        }
+        if (!trimmed.startsWith("sense="))
+            continue;
+        const fields = parseFields(trimmed);
+        const sense = fields.sense;
+        if (!sense)
+            continue;
+        const [name, status = "unknown"] = sense.split(":");
+        senses[name] = { ...fields, name, status };
+    }
+    return { daemon, senses, raw: text };
+}
+function validateMcpStatus(parsed, requiredSenses, options = {}) {
+    const failures = [];
+    if (parsed.daemon.daemon !== "running") {
+        failures.push(`daemon=${parsed.daemon.daemon ?? "missing"}`);
+    }
+    if (!options.ignoreOverviewHealth && parsed.daemon.health !== "ok") {
+        failures.push(`health=${parsed.daemon.health ?? "missing"}`);
+    }
+    if (parsed.daemon.daemonVersion &&
+        parsed.daemon.mcpVersion &&
+        parsed.daemon.daemonVersion !== parsed.daemon.mcpVersion) {
+        failures.push(`version mismatch daemon=${parsed.daemon.daemonVersion} mcp=${parsed.daemon.mcpVersion}`);
+    }
+    for (const [sense, row] of Object.entries(parsed.senses)) {
+        if (row.status === "disabled")
+            continue;
+        if (row.status === "running" || row.status === "interactive")
+            continue;
+        failures.push(`sense=${sense}:${row.status}`);
+    }
+    for (const sense of requiredSenses) {
+        const row = parsed.senses[sense];
+        if (!row) {
+            failures.push(`required sense missing: ${sense}`);
+            continue;
+        }
+        if (row.status !== "running" && row.status !== "interactive") {
+            failures.push(`required sense unhealthy: ${sense}:${row.status}`);
+        }
+    }
+    const senseSummary = Object.values(parsed.senses)
+        .map((row) => `${row.name}:${row.status}`)
+        .join(",");
+    const summary = failures.length === 0
+        ? `mcp canary ok: daemon=${parsed.daemon.daemon} health=${parsed.daemon.health}${options.ignoreOverviewHealth ? " (overview ignored)" : ""} senses=${senseSummary}`
+        : `mcp canary failed: ${failures.join("; ")}`;
+    return {
+        ok: failures.length === 0,
+        summary,
+        details: failures.length === 0 ? [parsed.raw] : [...failures, parsed.raw],
+        parsed,
+    };
+}
+async function runMcpStatusCanary(options) {
+    const timeoutMs = options.timeoutMs ?? DEFAULT_CANARY_TIMEOUT_MS;
+    /* v8 ignore next -- default spawn is exercised by live canaries, while unit tests inject a fake child @preserve */
+    const spawnImpl = options.spawnImpl ?? child_process_1.spawn;
+    const command = options.command ?? process.execPath;
+    const commandArgs = options.commandArgs ?? defaultCommandArgs(options.agent, options.socketPath);
+    const requiredSenses = options.requiredSenses ?? [];
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.mcp_canary_start",
+        message: "starting MCP status canary",
+        meta: {
+            agent: options.agent,
+            command,
+            commandArgs,
+            timeoutMs,
+            requiredSenses,
+            ignoreOverviewHealth: options.ignoreOverviewHealth === true,
+        },
+    });
+    const child = spawnImpl(command, commandArgs, { stdio: ["pipe", "pipe", "pipe"] });
+    let buffer = "";
+    let stderr = "";
+    const pending = new Map();
+    function cleanup() {
+        for (const [, request] of pending) {
+            clearTimeout(request.timer);
+        }
+        pending.clear();
+        if (!child.killed)
+            child.kill();
+    }
+    function failAll(error) {
+        for (const [, request] of pending) {
+            clearTimeout(request.timer);
+            request.reject(error);
+        }
+        pending.clear();
+    }
+    child.stderr?.setEncoding("utf8");
+    child.stderr?.on("data", (chunk) => {
+        stderr += chunk.toString();
+    });
+    child.stdout?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk) => {
+        buffer += chunk.toString();
+        for (;;) {
+            const idx = buffer.indexOf("\n");
+            if (idx === -1)
+                break;
+            const line = buffer.slice(0, idx).trim();
+            buffer = buffer.slice(idx + 1);
+            if (!line)
+                continue;
+            let response;
+            try {
+                response = JSON.parse(line);
+            }
+            catch {
+                failAll(new Error(`MCP canary received malformed JSON: ${line}`));
+                return;
+            }
+            const id = typeof response.id === "number" ? response.id : null;
+            if (id === null)
+                continue;
+            const request = pending.get(id);
+            if (!request)
+                continue;
+            pending.delete(id);
+            clearTimeout(request.timer);
+            request.resolve(response);
+        }
+    });
+    child.on("error", (error) => failAll(error));
+    child.on("close", (code, signal) => {
+        if (pending.size === 0)
+            return;
+        failAll(new Error(`MCP canary process closed before response code=${code} signal=${signal ?? "none"} stderr=${stderr.trim()}`));
+    });
+    let nextId = 1;
+    function request(method, params) {
+        return new Promise((resolve, reject) => {
+            if (!child.stdin?.writable) {
+                reject(new Error("MCP canary stdin is not writable"));
+                return;
+            }
+            const id = nextId++;
+            const timer = setTimeout(() => {
+                pending.delete(id);
+                reject(new Error(`MCP canary timed out waiting for ${method}; stderr=${stderr.trim()}`));
+            }, timeoutMs);
+            pending.set(id, { resolve, reject, timer });
+            child.stdin.write(JSON.stringify({ jsonrpc: "2.0", id, method, params }) + "\n");
+        });
+    }
+    try {
+        await request("initialize", {
+            protocolVersion: MCP_PROTOCOL_VERSION,
+            capabilities: {},
+            clientInfo: { name: "ouro-mcp-canary", version: "1.0" },
+        });
+        child.stdin?.write(JSON.stringify({ jsonrpc: "2.0", method: "initialized" }) + "\n");
+        const statusResponse = await request("tools/call", {
+            name: "status",
+            arguments: {},
+        });
+        const result = statusResponse.result;
+        if (result && typeof result === "object" && !Array.isArray(result) && result.isError === true) {
+            throw new Error(responseText(statusResponse));
+        }
+        const parsed = parseMcpStatusText(responseText(statusResponse));
+        const canary = validateMcpStatus(parsed, requiredSenses, {
+            ignoreOverviewHealth: options.ignoreOverviewHealth,
+        });
+        (0, runtime_1.emitNervesEvent)({
+            component: "daemon",
+            event: canary.ok ? "daemon.mcp_canary_end" : "daemon.mcp_canary_error",
+            level: canary.ok ? "info" : "error",
+            message: canary.summary,
+            meta: { agent: options.agent, ok: canary.ok },
+        });
+        return canary;
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        (0, runtime_1.emitNervesEvent)({
+            component: "daemon",
+            event: "daemon.mcp_canary_error",
+            level: "error",
+            message: "MCP status canary failed",
+            meta: { agent: options.agent, reason },
+        });
+        return { ok: false, summary: `mcp canary failed: ${reason}`, details: [reason] };
+    }
+    finally {
+        child.stdin?.end();
+        cleanup();
+    }
+}
+function formatMcpStatusCanaryResult(result) {
+    return [
+        result.ok ? "mcp canary: ok" : "mcp canary: failed",
+        result.summary,
+        ...result.details.map((line) => `  ${line}`),
+    ].join("\n");
+}
+function createMcpStatusCanaryProbe(options) {
+    return {
+        name: `mcp-canary:${options.agent}`,
+        check: async () => {
+            const result = await runMcpStatusCanary(options);
+            return { ok: result.ok, detail: result.summary };
+        },
+    };
+}

package/dist/heart/daemon/os-cron-deps.js

@@ -0,0 +1,135 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRealOsCronDeps = createRealOsCronDeps;
+exports.createRealCrontabDeps = createRealCrontabDeps;
+exports.resolveOuroBinaryPath = resolveOuroBinaryPath;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const runtime_1 = require("../../nerves/runtime");
+function createRealOsCronDeps() {
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.os_cron_deps_created",
+        message: "created real OS cron deps",
+        meta: { platform: process.platform },
+    });
+    return {
+        exec: (cmd) => {
+            try {
+                (0, child_process_1.execSync)(cmd, { stdio: "ignore" });
+            }
+            catch {
+                /* best effort */
+            }
+        },
+        writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"),
+        removeFile: (p) => {
+            try {
+                fs.unlinkSync(p);
+            }
+            catch {
+                /* best effort — file may already be gone */
+            }
+        },
+        existsFile: (p) => fs.existsSync(p),
+        listDir: (dir) => {
+            try {
+                return fs.readdirSync(dir);
+            }
+            catch {
+                return [];
+            }
+        },
+        mkdirp: (dir) => fs.mkdirSync(dir, { recursive: true }),
+        homeDir: os.homedir(),
+        envPath: process.env.PATH ?? "",
+    };
+}
+function createRealCrontabDeps() {
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.crontab_deps_created",
+        message: "created real crontab deps",
+        meta: {},
+    });
+    /* v8 ignore start -- crontab exec closures: calling these in tests would modify the real system crontab @preserve */
+    return {
+        execOutput: (cmd) => (0, child_process_1.execSync)(cmd, { encoding: "utf-8" }),
+        execWrite: (cmd, stdin) => {
+            (0, child_process_1.execSync)(cmd, { input: stdin, stdio: ["pipe", "ignore", "ignore"] });
+        },
+    };
+    /* v8 ignore stop */
+}
+/* v8 ignore start -- ouro path resolution: probes process.argv, filesystem layout, and PATH; branches depend on install method and runtime environment @preserve */
+function resolveOuroBinaryPath() {
+    // Try to resolve from process.argv[1] — the script being run
+    const scriptPath = process.argv[1];
+    if (scriptPath) {
+        // If running via node dist/heart/daemon/daemon-entry.js, resolve the ouro wrapper
+        // The ouro binary is typically at the package root's bin
+        const distDir = path.resolve(path.dirname(scriptPath));
+        const packageBin = path.resolve(distDir, "..", "..", "..", "node_modules", ".bin", "ouro");
+        if (fs.existsSync(packageBin)) {
+            return packageBin;
+        }
+        // Try the repo-local scripts/ouro.sh
+        const repoOuro = path.resolve(distDir, "..", "..", "..", "scripts", "ouro.sh");
+        if (fs.existsSync(repoOuro)) {
+            return repoOuro;
+        }
+    }
+    // Try which ouro
+    try {
+        const result = (0, child_process_1.execSync)("which ouro", { encoding: "utf-8" }).trim();
+        if (result.length > 0)
+            return result;
+    }
+    catch {
+        /* not on PATH */
+    }
+    // Fallback: use "ouro" and rely on PATH
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.ouro_path_fallback",
+        message: "could not resolve full ouro binary path, falling back to 'ouro'",
+        meta: {},
+    });
+    return "ouro";
+}
+/* v8 ignore stop */