@ouro.bot/cli 0.1.0-alpha.7 → 0.1.0-alpha.700

package/dist/heart/daemon/sense-manager.js

@@ -0,0 +1,929 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DaemonSenseManager = void 0;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const runtime_1 = require("../../nerves/runtime");
+const identity_1 = require("../identity");
+const runtime_credentials_1 = require("../runtime-credentials");
+const provider_credentials_1 = require("../provider-credentials");
+const sense_truth_1 = require("../sense-truth");
+const machine_identity_1 = require("../machine-identity");
+const process_manager_1 = require("./process-manager");
+const config_1 = require("../../a2a/config");
+const DEFAULT_TEAMS_PORT = 3978;
+const DEFAULT_BLUEBUBBLES_PORT = 18790;
+const DEFAULT_BLUEBUBBLES_WEBHOOK_PATH = "/bluebubbles-webhook";
+const BLUEBUBBLES_RUNTIME_FRESHNESS_WINDOW_MS = 90_000;
+const SENSE_CONFIG_RETRY_DELAYS_MS = [1_000, 2_000, 5_000, 10_000, 30_000, 60_000];
+const WORKBENCH_RUNTIME_INJECTION_DETAIL = "runtime-injected by Workbench app; no agent.json entry required";
+const WORKBENCH_STALE_BUNDLE_DETAIL = "stale agent.json Workbench entry; run 'ouro connect workbench' to clean it and use runtime injection";
+function defaultSenses() {
+    return {
+        cli: { ...identity_1.DEFAULT_AGENT_SENSES.cli },
+        teams: { ...identity_1.DEFAULT_AGENT_SENSES.teams },
+        bluebubbles: { ...identity_1.DEFAULT_AGENT_SENSES.bluebubbles },
+        mail: { ...identity_1.DEFAULT_AGENT_SENSES.mail },
+        voice: { ...identity_1.DEFAULT_AGENT_SENSES.voice },
+        a2a: { ...identity_1.DEFAULT_AGENT_SENSES.a2a },
+        workbench: { ...identity_1.DEFAULT_AGENT_SENSES.workbench },
+    };
+}
+function readAgentSenses(agentJsonPath) {
+    const defaults = defaultSenses();
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(agentJsonPath, "utf-8"));
+    }
+    catch (error) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "channels",
+            event: "channel.daemon_sense_agent_config_fallback",
+            message: "using default senses because agent config could not be read",
+            meta: {
+                path: agentJsonPath,
+                reason: error instanceof Error ? error.message : String(error),
+            },
+        });
+        return { senses: defaults, workbenchHasStaleBundleEntry: false };
+    }
+    const rawSenses = parsed.senses;
+    if (!rawSenses || typeof rawSenses !== "object" || Array.isArray(rawSenses)) {
+        const rawMcpServers = parsed.mcpServers;
+        const workbenchHasStaleBundleEntry = !!rawMcpServers
+            && typeof rawMcpServers === "object"
+            && !Array.isArray(rawMcpServers)
+            && Object.prototype.hasOwnProperty.call(rawMcpServers, "ouro_workbench");
+        if (workbenchHasStaleBundleEntry)
+            defaults.workbench = { enabled: true };
+        return { senses: defaults, workbenchHasStaleBundleEntry };
+    }
+    const workbenchSensePresent = Object.prototype.hasOwnProperty.call(rawSenses, "workbench");
+    const rawMcpServers = parsed.mcpServers;
+    const workbenchMcpPresent = !!rawMcpServers
+        && typeof rawMcpServers === "object"
+        && !Array.isArray(rawMcpServers)
+        && Object.prototype.hasOwnProperty.call(rawMcpServers, "ouro_workbench");
+    const workbenchHasStaleBundleEntry = workbenchSensePresent || workbenchMcpPresent;
+    for (const sense of ["cli", "teams", "bluebubbles", "mail", "voice", "a2a", "workbench"]) {
+        const rawSense = rawSenses[sense];
+        if (!rawSense || typeof rawSense !== "object" || Array.isArray(rawSense)) {
+            continue;
+        }
+        const enabled = rawSense.enabled;
+        if (typeof enabled === "boolean") {
+            defaults[sense] = { enabled };
+        }
+    }
+    if (workbenchHasStaleBundleEntry) {
+        defaults.workbench = { enabled: true };
+    }
+    return { senses: defaults, workbenchHasStaleBundleEntry };
+}
+function textField(record, key) {
+    const value = record?.[key];
+    return typeof value === "string" ? value.trim() : "";
+}
+function booleanField(record, key) {
+    return record?.[key] === true;
+}
+function numberField(record, key, fallback) {
+    const value = record?.[key];
+    return typeof value === "number" && Number.isFinite(value) ? value : fallback;
+}
+function a2aMachineRuntimeConfig(agent) {
+    const runtimeConfig = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent);
+    const payload = runtimeConfig.ok ? runtimeConfig.config : {};
+    const a2a = payload.a2a;
+    return a2a && typeof a2a === "object" && !Array.isArray(a2a) ? a2a : undefined;
+}
+function managedA2AArgs(agent) {
+    const a2a = a2aMachineRuntimeConfig(agent);
+    const args = ["--port", String(numberField(a2a, "port", (0, config_1.defaultA2APort)(agent)))];
+    const host = textField(a2a, "host");
+    const endpointPath = (0, config_1.normalizeA2APath)(textField(a2a, "path") || config_1.A2A_DEFAULT_PATH);
+    const publicUrl = textField(a2a, "publicUrl");
+    if (host)
+        args.push("--host", host);
+    args.push("--path", endpointPath);
+    if (publicUrl)
+        args.push("--base-url", publicUrl);
+    return args;
+}
+function compactRuntimeConfigError(agent, error) {
+    const compact = error.replace(/\s+/g, " ").trim();
+    if (/credential vault is locked|vault locked|vault is locked/i.test(compact)) {
+        return `vault locked; run 'ouro vault unlock --agent ${agent}' if you have the saved secret, or 'ouro vault replace --agent ${agent}' if none was saved`;
+    }
+    return compact || "unavailable";
+}
+function runtimeConfigUnavailableDetail(agent, runtimeConfig) {
+    if (runtimeConfig.ok)
+        return "";
+    const itemName = /^vault:[^:]+:(.+)$/.exec(runtimeConfig.itemPath)?.[1] ?? "runtime/config";
+    if (runtimeConfig.reason === "missing")
+        return `missing vault ${itemName} (${agent})`;
+    return `vault ${itemName} unavailable (${compactRuntimeConfigError(agent, runtimeConfig.error)})`;
+}
+function senseFactsFromRuntimeConfig(agent, senses, runtimeConfig, machineRuntimeConfig = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent), workbenchHasStaleBundleEntry = false) {
+    const base = {
+        cli: { configured: true, detail: "local interactive terminal" },
+        teams: { configured: false, detail: "not enabled in agent.json" },
+        bluebubbles: { configured: false, detail: "not enabled in agent.json" },
+        mail: { configured: false, detail: "not enabled in agent.json" },
+        voice: { configured: false, detail: "not enabled in agent.json" },
+        a2a: { configured: false, detail: "not enabled in agent.json" },
+        workbench: { configured: false, detail: "not enabled in agent.json" },
+    };
+    const payload = runtimeConfig.ok ? runtimeConfig.config : {};
+    const unavailableDetail = runtimeConfigUnavailableDetail(agent, runtimeConfig);
+    const teams = payload.teams;
+    const teamsChannel = payload.teamsChannel;
+    const machinePayload = machineRuntimeConfig.ok ? machineRuntimeConfig.config : {};
+    const bluebubbles = machinePayload.bluebubbles;
+    const bluebubblesChannel = machinePayload.bluebubblesChannel;
+    const mailroom = payload.mailroom;
+    const integrations = payload.integrations;
+    const voice = machinePayload.voice;
+    const a2a = machinePayload.a2a;
+    if (senses.teams.enabled) {
+        const missing = [];
+        if (!textField(teams, "clientId"))
+            missing.push("teams.clientId");
+        if (!textField(teams, "clientSecret"))
+            missing.push("teams.clientSecret");
+        if (!textField(teams, "tenantId"))
+            missing.push("teams.tenantId");
+        base.teams = missing.length === 0
+            ? {
+                configured: true,
+                detail: `:${numberField(teamsChannel, "port", DEFAULT_TEAMS_PORT)}`,
+            }
+            : {
+                configured: false,
+                detail: runtimeConfig.ok
+                    ? `missing ${missing.join("/")}`
+                    : unavailableDetail,
+            };
+    }
+    if (senses.bluebubbles.enabled) {
+        const missing = [];
+        if (!textField(bluebubbles, "serverUrl"))
+            missing.push("bluebubbles.serverUrl");
+        if (!textField(bluebubbles, "password"))
+            missing.push("bluebubbles.password");
+        base.bluebubbles = missing.length === 0
+            ? {
+                configured: true,
+                detail: `:${numberField(bluebubblesChannel, "port", DEFAULT_BLUEBUBBLES_PORT)} ${textField(bluebubblesChannel, "webhookPath") || DEFAULT_BLUEBUBBLES_WEBHOOK_PATH}`,
+            }
+            : {
+                configured: false,
+                optional: !machineRuntimeConfig.ok && machineRuntimeConfig.reason === "missing",
+                detail: !machineRuntimeConfig.ok && machineRuntimeConfig.reason === "missing"
+                    ? "not attached on this machine"
+                    : machineRuntimeConfig.ok
+                        ? `missing ${missing.join("/")}`
+                        : runtimeConfigUnavailableDetail(agent, machineRuntimeConfig),
+            };
+    }
+    if (senses.mail.enabled) {
+        const privateKeys = mailroom?.privateKeys;
+        const hasPrivateKeys = !!privateKeys && typeof privateKeys === "object" && !Array.isArray(privateKeys) && Object.values(privateKeys).some((value) => typeof value === "string" && value.trim().length > 0);
+        const mailboxAddress = textField(mailroom, "mailboxAddress");
+        const missing = [];
+        if (!mailboxAddress)
+            missing.push("mailroom.mailboxAddress");
+        if (!hasPrivateKeys)
+            missing.push("mailroom.privateKeys");
+        base.mail = missing.length === 0
+            ? { configured: true, detail: mailboxAddress }
+            : {
+                configured: false,
+                detail: runtimeConfig.ok
+                    ? `missing ${missing.join("/")}`
+                    : unavailableDetail,
+            };
+    }
+    if (senses.voice.enabled) {
+        const portableVoice = payload.voice;
+        const conversationEngine = (textField(voice, "twilioConversationEngine")
+            || textField(voice, "conversationEngine")
+            || textField(portableVoice, "twilioConversationEngine")
+            || textField(portableVoice, "conversationEngine")
+            || "cascade").toLowerCase();
+        const twilioTransportMode = (textField(voice, "twilioTransportMode") || "record-play").toLowerCase();
+        const twilioPublicUrl = textField(voice, "twilioPublicUrl");
+        const hasOpenAIRealtimeKey = !!(textField(portableVoice, "openaiRealtimeApiKey")
+            || textField(integrations, "openaiApiKey")
+            || textField(integrations, "openaiEmbeddingsApiKey"));
+        const missing = [];
+        /* v8 ignore start -- voice setup missing-field matrix is enforced by the voice runtime resolver; sense-manager only renders human-readable readiness facts @preserve */
+        if (conversationEngine === "openai-realtime" || conversationEngine === "openai-sip") {
+            if (conversationEngine === "openai-realtime" && twilioTransportMode !== "media-stream") {
+                missing.push("voice.twilioTransportMode=media-stream");
+            }
+            if (!hasOpenAIRealtimeKey) {
+                missing.push("voice.openaiRealtimeApiKey");
+            }
+            if (conversationEngine === "openai-sip") {
+                if (!textField(portableVoice, "openaiSipProjectId") && !textField(voice, "openaiSipProjectId")) {
+                    missing.push("voice.openaiSipProjectId");
+                }
+                const allowUnsignedWebhooks = booleanField(portableVoice, "openaiSipAllowUnsignedWebhooks")
+                    || booleanField(voice, "openaiSipAllowUnsignedWebhooks");
+                if (!allowUnsignedWebhooks && !textField(portableVoice, "openaiSipWebhookSecret") && !textField(voice, "openaiSipWebhookSecret")) {
+                    missing.push("voice.openaiSipWebhookSecret");
+                }
+            }
+        }
+        else {
+            if (!textField(integrations, "elevenLabsApiKey"))
+                missing.push("integrations.elevenLabsApiKey");
+            if (!textField(integrations, "elevenLabsVoiceId") && !textField(portableVoice, "elevenLabsVoiceId")) {
+                missing.push("integrations.elevenLabsVoiceId");
+            }
+            if (!textField(voice, "whisperCliPath"))
+                missing.push("voice.whisperCliPath");
+            if (!textField(voice, "whisperModelPath"))
+                missing.push("voice.whisperModelPath");
+        }
+        /* v8 ignore stop */
+        base.voice = missing.length === 0
+            ? {
+                configured: true,
+                /* v8 ignore start -- voice detail copy mirrors runtime resolver modes; resolver tests own the matrix @preserve */
+                detail: conversationEngine === "openai-sip"
+                    ? twilioPublicUrl
+                        ? "OpenAI Realtime SIP speech-to-speech; Twilio phone transport attached"
+                        : "OpenAI Realtime SIP speech-to-speech"
+                    : conversationEngine === "openai-realtime"
+                        ? twilioPublicUrl
+                            ? "OpenAI Realtime speech-to-speech; Twilio phone transport attached"
+                            : "OpenAI Realtime speech-to-speech"
+                        : twilioPublicUrl
+                            ? "local Whisper.cpp STT + ElevenLabs TTS; Twilio phone transport attached"
+                            : "local Whisper.cpp STT + ElevenLabs TTS",
+                /* v8 ignore stop */
+            }
+            : {
+                configured: false,
+                optional: !machineRuntimeConfig.ok && machineRuntimeConfig.reason === "missing",
+                detail: !machineRuntimeConfig.ok && machineRuntimeConfig.reason === "missing"
+                    ? "not attached on this machine"
+                    : runtimeConfig.ok && machineRuntimeConfig.ok
+                        ? `missing ${missing.join("/")}`
+                        : !runtimeConfig.ok
+                            ? unavailableDetail
+                            : runtimeConfigUnavailableDetail(agent, machineRuntimeConfig),
+            };
+    }
+    if (senses.a2a.enabled) {
+        const port = numberField(a2a, "port", (0, config_1.defaultA2APort)(agent));
+        const endpointPath = (0, config_1.normalizeA2APath)(textField(a2a, "path") || config_1.A2A_DEFAULT_PATH);
+        const publicUrl = textField(a2a, "publicUrl");
+        base.a2a = {
+            configured: true,
+            /* v8 ignore next -- listSenseRows tests cover the public URL; daemon defaults cover the local port in live startup smoke @preserve */
+            detail: publicUrl ? `${publicUrl}${endpointPath}` : `:${port} ${endpointPath}`,
+        };
+    }
+    if (workbenchHasStaleBundleEntry || senses.workbench.enabled) {
+        base.workbench = {
+            configured: false,
+            detail: WORKBENCH_STALE_BUNDLE_DETAIL,
+        };
+    }
+    return base;
+}
+function senseRepairHint(agent, sense) {
+    if (sense === "teams") {
+        return `Run 'ouro vault config set --agent ${agent} --key teams.clientId', teams.clientSecret, and teams.tenantId; then run 'ouro up' again.`;
+    }
+    if (sense === "mail") {
+        return `Agent-runnable: provision Mailroom access with 'ouro connect mail --agent ${agent}', then restart with 'ouro up'.`;
+    }
+    if (sense === "voice") {
+        return `Agent-runnable: run 'ouro connect voice --agent ${agent}' for config guidance; use voice.twilioConversationEngine=openai-sip with voice.openaiRealtimeApiKey, voice.openaiSipProjectId, and voice.openaiSipWebhookSecret for preferred SIP phone voice; use openai-realtime for Media Streams fallback, or save ElevenLabs and local Whisper.cpp settings for cascade fallback; then run 'ouro up' again.`;
+    }
+    /* v8 ignore next -- A2A currently has no credential-gated not-configured state; kept for future repair copy symmetry @preserve */
+    if (sense === "a2a") {
+        return `Agent-runnable: run 'ouro connect a2a --agent ${agent}', then restart with 'ouro up'.`;
+    }
+    /* v8 ignore next -- Workbench is deliberately not daemon-managed, so getSenseInventory never asks the daemon manager for a repair hint @preserve */
+    if (sense === "workbench") {
+        return `Agent-runnable: install Ouro Workbench.app, then launch the boss through Workbench or run 'ouro mcp-serve --agent ${agent} --workbench-mcp'; 'ouro connect workbench --agent ${agent}' only cleans stale bundle entries.`;
+    }
+    return `Run 'ouro connect bluebubbles --agent ${agent}' to attach BlueBubbles on this machine; then run 'ouro up' again.`;
+}
+function currentMachineId() {
+    return (0, machine_identity_1.loadOrCreateMachineIdentity)({ homeDir: os.homedir() }).machineId;
+}
+function parseSenseSnapshotName(name) {
+    const parts = name.split(":");
+    if (parts.length !== 2)
+        return null;
+    const [agent, sense] = parts;
+    if (sense !== "teams" && sense !== "bluebubbles" && sense !== "mail" && sense !== "voice" && sense !== "a2a")
+        return null;
+    return { agent, sense };
+}
+function runtimeInfoFor(status) {
+    if (status === "running")
+        return { runtime: "running" };
+    return { runtime: "error" };
+}
+function managedSenseEntry(sense) {
+    if (sense === "teams")
+        return "senses/teams-entry.js";
+    if (sense === "bluebubbles")
+        return "senses/bluebubbles/entry.js";
+    if (sense === "voice")
+        return "senses/voice-entry.js";
+    if (sense === "a2a")
+        return "senses/a2a-entry.js";
+    return "senses/mail-entry.js";
+}
+function runtimeCredentialBootstrapFor(agent, sense) {
+    const runtime = (0, runtime_credentials_1.readRuntimeCredentialConfig)(agent);
+    const machineId = sense === "bluebubbles" || sense === "voice" || sense === "a2a" ? currentMachineId() : undefined;
+    const machine = sense === "bluebubbles" || sense === "voice" || sense === "a2a" ? (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent) : null;
+    const providerPool = (0, provider_credentials_1.readProviderCredentialPool)(agent);
+    const providerCredentialRecords = providerPool.ok
+        ? Object.values(providerPool.pool.providers).filter((record) => !!record)
+        : [];
+    const bootstrap = {
+        agentName: agent,
+        runtimeConfig: runtime.ok ? runtime.config : undefined,
+        machineRuntimeConfig: machine?.ok ? machine.config : undefined,
+        machineId,
+        providerCredentialRecords: providerCredentialRecords.length > 0 ? providerCredentialRecords : undefined,
+    };
+    if (!bootstrap.runtimeConfig && !bootstrap.machineRuntimeConfig && !bootstrap.providerCredentialRecords)
+        return null;
+    return bootstrap;
+}
+function blueBubblesRuntimeStateIsFresh(lastCheckedAt, now = Date.now()) {
+    if (!lastCheckedAt) {
+        return false;
+    }
+    const checkedAt = Date.parse(lastCheckedAt);
+    if (!Number.isFinite(checkedAt)) {
+        return false;
+    }
+    return checkedAt >= now - BLUEBUBBLES_RUNTIME_FRESHNESS_WINDOW_MS;
+}
+function readBlueBubblesRuntimeJson(runtimePath) {
+    try {
+        const raw = fs.readFileSync(runtimePath, "utf-8");
+        const parsed = JSON.parse(raw);
+        /* v8 ignore start -- branches: ternary fallbacks for missing/malformed BB runtime fields @preserve */
+        return {
+            upstreamStatus: parsed.upstreamStatus === "ok" || parsed.upstreamStatus === "error"
+                ? parsed.upstreamStatus
+                : "unknown",
+            detail: typeof parsed.detail === "string" && parsed.detail.trim()
+                ? parsed.detail
+                : "startup health probe pending",
+            lastCheckedAt: typeof parsed.lastCheckedAt === "string" ? parsed.lastCheckedAt : undefined,
+            proofMethod: typeof parsed.proofMethod === "string" && parsed.proofMethod.trim()
+                ? parsed.proofMethod
+                : undefined,
+            pendingRecoveryCount: typeof parsed.pendingRecoveryCount === "number" && Number.isFinite(parsed.pendingRecoveryCount)
+                ? parsed.pendingRecoveryCount
+                : 0,
+            failedRecoveryCount: typeof parsed.failedRecoveryCount === "number" && Number.isFinite(parsed.failedRecoveryCount)
+                ? parsed.failedRecoveryCount
+                : 0,
+            oldestPendingRecoveryAt: typeof parsed.oldestPendingRecoveryAt === "string" ? parsed.oldestPendingRecoveryAt : undefined,
+            oldestPendingRecoveryAgeMs: typeof parsed.oldestPendingRecoveryAgeMs === "number" && Number.isFinite(parsed.oldestPendingRecoveryAgeMs)
+                ? parsed.oldestPendingRecoveryAgeMs
+                : undefined,
+            activeTurnCount: typeof parsed.activeTurnCount === "number" && Number.isFinite(parsed.activeTurnCount)
+                ? parsed.activeTurnCount
+                : undefined,
+            stalledTurnCount: typeof parsed.stalledTurnCount === "number" && Number.isFinite(parsed.stalledTurnCount)
+                ? parsed.stalledTurnCount
+                : undefined,
+            oldestActiveTurnStartedAt: typeof parsed.oldestActiveTurnStartedAt === "string" ? parsed.oldestActiveTurnStartedAt : undefined,
+            oldestActiveTurnAgeMs: typeof parsed.oldestActiveTurnAgeMs === "number" && Number.isFinite(parsed.oldestActiveTurnAgeMs)
+                ? parsed.oldestActiveTurnAgeMs
+                : undefined,
+        };
+        /* v8 ignore stop */
+        /* v8 ignore start -- defensive: catch for missing/corrupt BB runtime state file @preserve */
+    }
+    catch {
+        return { upstreamStatus: "unknown", detail: "startup health probe pending", pendingRecoveryCount: 0, failedRecoveryCount: 0 };
+    }
+    /* v8 ignore stop */
+}
+function readBlueBubblesRuntimeFacts(agent, bundlesRoot, snapshot) {
+    const agentRoot = path.join(bundlesRoot, `${agent}.ouro`);
+    const runtimePath = path.join(agentRoot, "state", "senses", "bluebubbles", "runtime.json");
+    if (!fs.existsSync(runtimePath)) {
+        return { runtime: snapshot?.runtime };
+    }
+    const state = readBlueBubblesRuntimeJson(runtimePath);
+    const checkedAtMs = state.lastCheckedAt ? Date.parse(state.lastCheckedAt) : Number.NaN;
+    const proofFacts = {
+        proofMethod: state.proofMethod ?? "bluebubbles.checkHealth",
+        lastProofAt: state.lastCheckedAt,
+        proofAgeMs: Number.isFinite(checkedAtMs) ? Math.max(0, Date.now() - checkedAtMs) : undefined,
+        pendingRecoveryCount: state.pendingRecoveryCount,
+        failedRecoveryCount: state.failedRecoveryCount,
+        oldestPendingRecoveryAt: state.oldestPendingRecoveryAt,
+        oldestPendingRecoveryAgeMs: state.oldestPendingRecoveryAgeMs,
+        activeTurnCount: state.activeTurnCount,
+        stalledTurnCount: state.stalledTurnCount,
+        oldestActiveTurnStartedAt: state.oldestActiveTurnStartedAt,
+        oldestActiveTurnAgeMs: state.oldestActiveTurnAgeMs,
+    };
+    if (!blueBubblesRuntimeStateIsFresh(state.lastCheckedAt)) {
+        return {
+            runtime: snapshot?.runtime,
+            lastFailure: state.lastCheckedAt ? "BlueBubbles proof is stale" : undefined,
+            failureLayer: state.lastCheckedAt ? "proof_freshness" : undefined,
+        };
+    }
+    if (snapshot?.runtime !== "running") {
+        return {
+            runtime: "error",
+            detail: "BlueBubbles listener is not running",
+            ...proofFacts,
+            lastFailure: "listener process is not running",
+            failureLayer: "listener",
+            recoveryAction: "daemon health monitor will restart the BlueBubbles listener when its probe fails",
+        };
+    }
+    if (state.upstreamStatus === "error") {
+        return {
+            runtime: "error",
+            detail: state.detail,
+            ...proofFacts,
+            lastFailure: state.detail,
+            failureLayer: "upstream",
+            recoveryAction: "verify BlueBubbles server/app auth and local machine attachment, then retry the listener",
+        };
+    }
+    if (state.pendingRecoveryCount > 0) {
+        return {
+            runtime: "error",
+            detail: state.detail,
+            ...proofFacts,
+            lastFailure: state.detail,
+            failureLayer: "recovery_queue",
+            recoveryAction: "queued recovery will retry; inspect BlueBubbles inbound/recovery sidecar logs if age keeps growing",
+        };
+    }
+    if ((state.stalledTurnCount ?? 0) > 0) {
+        return {
+            runtime: "error",
+            detail: state.detail,
+            ...proofFacts,
+            lastFailure: state.detail,
+            failureLayer: "live_turn_stall",
+            recoveryAction: "live iMessage turn timeout/watchdog will release the lane and recovery will retry captured messages",
+        };
+    }
+    if (state.upstreamStatus === "ok") {
+        return {
+            runtime: "running",
+            ...proofFacts,
+            ...(state.failedRecoveryCount > 0 ? { detail: state.detail } : {}),
+            ...(state.failedRecoveryCount > 0 ? {
+                lastFailure: state.detail,
+                failureLayer: "recovery_quarantine",
+                recoveryAction: "inspect quarantined BlueBubbles recovery failures; live transport remains reachable",
+            } : {}),
+        };
+    }
+    return { runtime: snapshot?.runtime, ...proofFacts };
+}
+class DaemonSenseManager {
+    processManager;
+    contexts;
+    pendingConfigRefreshes = new Set();
+    configRefreshRetryTimers = new Map();
+    configRefreshRetryAttempts = new Map();
+    bundlesRoot;
+    constructor(options) {
+        const bundlesRoot = options.bundlesRoot ?? path.join(os.homedir(), "AgentBundles");
+        this.bundlesRoot = bundlesRoot;
+        this.contexts = new Map(options.agents.map((agent) => {
+            const { senses, workbenchHasStaleBundleEntry } = readAgentSenses(path.join(bundlesRoot, `${agent}.ouro`, "agent.json"));
+            const facts = senseFactsFromRuntimeConfig(agent, senses, (0, runtime_credentials_1.readRuntimeCredentialConfig)(agent), (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent), workbenchHasStaleBundleEntry);
+            return [agent, { senses, workbenchHasStaleBundleEntry, facts }];
+        }));
+        const managedSenseAgents = [...this.contexts.entries()].flatMap(([agent, context]) => {
+            return ["teams", "bluebubbles", "mail", "voice", "a2a"]
+                .filter((sense) => context.senses[sense].enabled)
+                .map((sense) => ({
+                name: `${agent}:${sense}`,
+                agentArg: agent,
+                entry: managedSenseEntry(sense),
+                channel: sense,
+                autoStart: true,
+                ...(sense === "a2a" ? { args: managedA2AArgs(agent), getArgs: () => managedA2AArgs(agent) } : {}),
+                getRuntimeCredentialBootstrap: () => runtimeCredentialBootstrapFor(agent, sense),
+            }));
+        });
+        this.processManager = options.processManager ?? new process_manager_1.DaemonProcessManager({
+            agents: managedSenseAgents,
+            configCheck: async (name) => {
+                const parsed = parseSenseSnapshotName(name);
+                if (!parsed)
+                    return { ok: true };
+                const context = this.contexts.get(parsed.agent);
+                if (!context)
+                    return { ok: true };
+                context.facts = senseFactsFromRuntimeConfig(parsed.agent, context.senses, (0, runtime_credentials_1.readRuntimeCredentialConfig)(parsed.agent), (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(parsed.agent), context.workbenchHasStaleBundleEntry);
+                const fact = context.facts[parsed.sense];
+                if (fact.configured)
+                    return { ok: true };
+                this.scheduleSenseConfigRefresh(name, parsed);
+                if (fact.optional) {
+                    return {
+                        ok: false,
+                        skip: true,
+                        error: `${parsed.sense} is enabled for ${parsed.agent} but not attached on this machine`,
+                    };
+                }
+                return {
+                    ok: false,
+                    skip: true,
+                    error: `${parsed.sense} is enabled for ${parsed.agent} but runtime credentials are not ready: ${fact.detail}`,
+                    fix: senseRepairHint(parsed.agent, parsed.sense),
+                };
+            },
+        });
+        (0, runtime_1.emitNervesEvent)({
+            component: "channels",
+            event: "channel.daemon_sense_manager_init",
+            message: "initialized daemon sense manager",
+            meta: {
+                agents: options.agents,
+                managedSenseProcesses: managedSenseAgents.map((entry) => entry.name),
+            },
+        });
+    }
+    scheduleSenseConfigRefresh(name, parsed, delayMs = 0) {
+        if (this.pendingConfigRefreshes.has(name) || this.configRefreshRetryTimers.has(name))
+            return;
+        if (delayMs > 0) {
+            const timer = setTimeout(() => {
+                this.configRefreshRetryTimers.delete(name);
+                this.pendingConfigRefreshes.add(name);
+                void this.refreshSenseConfigAndRetry(name, parsed);
+            }, delayMs);
+            this.configRefreshRetryTimers.set(name, timer);
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "channels",
+                event: "channel.daemon_sense_config_retry_scheduled",
+                message: "scheduled managed sense config retry",
+                meta: {
+                    agent: parsed.agent,
+                    sense: parsed.sense,
+                    managedName: name,
+                    delayMs,
+                    attempt: this.configRefreshRetryAttempts.get(name),
+                },
+            });
+            return;
+        }
+        this.pendingConfigRefreshes.add(name);
+        void this.refreshSenseConfigAndRetry(name, parsed);
+    }
+    nextConfigRetryDelayMs(name) {
+        const attempt = (this.configRefreshRetryAttempts.get(name) ?? 0) + 1;
+        this.configRefreshRetryAttempts.set(name, attempt);
+        return SENSE_CONFIG_RETRY_DELAYS_MS[Math.min(attempt - 1, SENSE_CONFIG_RETRY_DELAYS_MS.length - 1)];
+    }
+    clearConfigRetryState(name) {
+        clearTimeout(this.configRefreshRetryTimers.get(name));
+        this.configRefreshRetryTimers.delete(name);
+        this.configRefreshRetryAttempts.delete(name);
+    }
+    shouldRetryConfigRefresh(sense, runtimeConfig, machineRuntimeConfig) {
+        if (!runtimeConfig.ok && runtimeConfig.reason === "unavailable")
+            return true;
+        if ((sense === "bluebubbles" || sense === "voice" || sense === "a2a") &&
+            !machineRuntimeConfig.ok &&
+            machineRuntimeConfig.reason === "unavailable")
+            return true;
+        return false;
+    }
+    async refreshSenseConfigAndRetry(name, parsed) {
+        let retryAfterMs = null;
+        try {
+            const refreshed = await (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(parsed.agent, { preserveCachedOnFailure: true });
+            const machineRefreshed = parsed.sense === "bluebubbles" || parsed.sense === "voice" || parsed.sense === "a2a"
+                ? await (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(parsed.agent, currentMachineId(), { preserveCachedOnFailure: true })
+                : (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(parsed.agent);
+            const context = this.contexts.get(parsed.agent);
+            /* v8 ignore next -- defensive: config refreshes are only scheduled for known agent contexts @preserve */
+            if (!context)
+                return;
+            context.facts = senseFactsFromRuntimeConfig(parsed.agent, context.senses, refreshed, machineRefreshed, context.workbenchHasStaleBundleEntry);
+            if (!context.facts[parsed.sense].configured) {
+                if (this.shouldRetryConfigRefresh(parsed.sense, refreshed, machineRefreshed)) {
+                    retryAfterMs = this.nextConfigRetryDelayMs(name);
+                }
+                else {
+                    this.clearConfigRetryState(name);
+                }
+                return;
+            }
+            this.clearConfigRetryState(name);
+            setTimeout(() => {
+                void this.processManager.startAgent?.(name).catch((error) => {
+                    (0, runtime_1.emitNervesEvent)({
+                        level: "error",
+                        component: "channels",
+                        event: "channel.daemon_sense_autostart_error",
+                        message: "sense autostart failed",
+                        /* v8 ignore next -- defensive: process manager rejects with Error instances in normal use @preserve */
+                        meta: { error: error instanceof Error ? error.message : String(error) },
+                    });
+                });
+            }, 0);
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "error",
+                component: "channels",
+                event: "channel.daemon_sense_autostart_error",
+                message: "sense config refresh failed",
+                /* v8 ignore next -- defensive: runtime credential refresh rejects with Error instances in normal use @preserve */
+                meta: { error: error instanceof Error ? error.message : String(error) },
+            });
+        }
+        finally {
+            this.pendingConfigRefreshes.delete(name);
+            if (retryAfterMs !== null) {
+                this.scheduleSenseConfigRefresh(name, parsed, retryAfterMs);
+            }
+        }
+    }
+    async refreshEnabledSenseConfigs() {
+        const refreshes = [...this.contexts.entries()].map(async ([agent, context]) => {
+            const enabledManagedSenses = ["teams", "bluebubbles", "mail", "voice", "a2a"]
+                .filter((sense) => context.senses[sense].enabled);
+            /* v8 ignore next -- periodic refresh work only exists when a managed background sense is enabled @preserve */
+            if (enabledManagedSenses.length === 0)
+                return;
+            /* v8 ignore start -- periodic freshness refresh uses the same runtime readers covered by startup integration tests @preserve */
+            const runtimeConfig = await (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(agent, { preserveCachedOnFailure: true });
+            const needsMachineConfig = enabledManagedSenses.some((sense) => sense === "bluebubbles" || sense === "voice" || sense === "a2a");
+            const machineRuntimeConfig = needsMachineConfig
+                ? await (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(agent, currentMachineId(), { preserveCachedOnFailure: true })
+                : (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent);
+            /* v8 ignore stop */
+            context.facts = senseFactsFromRuntimeConfig(agent, context.senses, runtimeConfig, machineRuntimeConfig, context.workbenchHasStaleBundleEntry);
+        });
+        await Promise.all(refreshes);
+    }
+    async startAutoStartSenses() {
+        await this.refreshEnabledSenseConfigs();
+        await this.processManager.startAutoStartAgents();
+    }
+    triggerAutoStartSenses() {
+        void this.refreshEnabledSenseConfigs()
+            .catch((error) => {
+            (0, runtime_1.emitNervesEvent)({
+                level: "error",
+                component: "channels",
+                event: "channel.daemon_sense_autostart_error",
+                message: "sense config refresh failed",
+                meta: { error: error instanceof Error ? error.message : /* v8 ignore next -- defensive non-Error refresh rejection @preserve */ String(error) },
+            });
+        })
+            .then(() => {
+            if (this.processManager.triggerAutoStartAgents) {
+                this.processManager.triggerAutoStartAgents();
+                return;
+            }
+            void this.processManager.startAutoStartAgents().catch((error) => {
+                (0, runtime_1.emitNervesEvent)({
+                    level: "error",
+                    component: "channels",
+                    event: "channel.daemon_sense_autostart_error",
+                    message: "sense autostart failed",
+                    meta: { error: error instanceof Error ? error.message : String(error) },
+                });
+            });
+        });
+    }
+    async stopAll() {
+        for (const timer of this.configRefreshRetryTimers.values()) {
+            clearTimeout(timer);
+        }
+        this.configRefreshRetryTimers.clear();
+        this.configRefreshRetryAttempts.clear();
+        await this.processManager.stopAll();
+    }
+    /* v8 ignore start -- pid collection for orphan cleanup pidfile @preserve */
+    listManagedPids() {
+        return this.processManager.listAgentSnapshots()
+            .map((s) => s.pid)
+            .filter((pid) => pid !== null && pid !== undefined);
+    }
+    /* v8 ignore stop */
+    listHealthProbes() {
+        const probes = [];
+        for (const [agent, context] of this.contexts.entries()) {
+            const runtimeConfig = (0, runtime_credentials_1.readRuntimeCredentialConfig)(agent);
+            const machineRuntimeConfig = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent);
+            context.facts = senseFactsFromRuntimeConfig(agent, context.senses, runtimeConfig, machineRuntimeConfig, context.workbenchHasStaleBundleEntry);
+            if (!context.senses.bluebubbles.enabled || !context.facts.bluebubbles.configured || !machineRuntimeConfig.ok) {
+                continue;
+            }
+            // DELIBERATELY no HTTP health probe for BlueBubbles.
+            //
+            // We used to register `createHttpHealthProbe(...)` here, which GETs the
+            // sense's /health endpoint every ~60s with a 5s timeout. On 2026-05-11
+            // that caused a death spiral:
+            //   1. Sense gets busy with real work (e.g. VLM image describe → 20+s)
+            //   2. /health probe times out at 5s
+            //   3. Daemon declares the sense "critical" → SIGTERMs it mid-work
+            //   4. Sense respawns, recovery loop replays the same inbound message
+            //      into the agent's BB session (visible side-effect — an affected
+            //      agent saw the same user text injected 76 times)
+            //   5. New sense hits the same VLM call, gets killed at 5s, repeat
+            //
+            // The probe was redundant supervision: dead processes are already
+            // recaptured by `processManager`'s child-process exit handler. The
+            // probe specifically caught "alive but hung" cases — but the cost
+            // (killing genuinely-busy processes and replaying messages) far
+            // outweighed the benefit. For "alive but hung" detection we now
+            // rely on the agent's own awareness: BB sense's runtime.json carries
+            // pendingRecoveryCount + lastRecoveredAt, surfaced in the agent
+            // prompt. If recovery has been wedged for too long, the agent can
+            // call `restart_runtime` itself (see alpha.598 / PR #723).
+            //
+            // The respawn-loop guard in processManager is the backstop: even if
+            // something else triggers a tight respawn cycle for any reason, the
+            // guard fires and refuses further restarts after N attempts in M
+            // minutes, so we can never re-enter the 2026-05-11 spiral.
+        }
+        return probes;
+    }
+    async restartSense(managedName) {
+        if (this.processManager.restartAgent) {
+            await this.processManager.restartAgent(managedName);
+            return;
+        }
+        await this.processManager.startAgent?.(managedName);
+    }
+    async reviveSense(agent, sense) {
+        const parsed = parseSenseSnapshotName(`${agent}:${sense}`);
+        if (!parsed)
+            return null;
+        const context = this.contexts.get(parsed.agent);
+        if (!context || !context.senses[parsed.sense].enabled)
+            return null;
+        const managedName = `${parsed.agent}:${parsed.sense}`;
+        const runtimeConfig = await (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(parsed.agent, { preserveCachedOnFailure: true });
+        const needsMachineConfig = parsed.sense === "bluebubbles" || parsed.sense === "voice" || parsed.sense === "a2a";
+        const machineRuntimeConfig = needsMachineConfig
+            ? await (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(parsed.agent, currentMachineId(), { preserveCachedOnFailure: true })
+            : (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(parsed.agent);
+        context.facts = senseFactsFromRuntimeConfig(parsed.agent, context.senses, runtimeConfig, machineRuntimeConfig, context.workbenchHasStaleBundleEntry);
+        this.processManager.resetAgentFailureState?.(managedName);
+        await this.processManager.startAgent?.(managedName);
+        return this.listSenseRows().find((row) => row.agent === parsed.agent && row.sense === parsed.sense) ?? null;
+    }
+    listSenseRows() {
+        const runtime = new Map();
+        for (const snapshot of this.processManager.listAgentSnapshots()) {
+            const parsed = parseSenseSnapshotName(snapshot.name);
+            if (!parsed)
+                continue;
+            const current = runtime.get(parsed.agent) ?? {};
+            current[parsed.sense] = runtimeInfoFor(snapshot.status);
+            runtime.set(parsed.agent, current);
+        }
+        const rows = [...this.contexts.entries()].flatMap(([agent, context]) => {
+            context.facts = senseFactsFromRuntimeConfig(agent, context.senses, (0, runtime_credentials_1.readRuntimeCredentialConfig)(agent), (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent), context.workbenchHasStaleBundleEntry);
+            const blueBubblesRuntimeFacts = readBlueBubblesRuntimeFacts(agent, this.bundlesRoot, runtime.get(agent)?.bluebubbles);
+            const blueBubblesConfigured = context.facts.bluebubbles.configured;
+            const runtimeInfo = {
+                cli: { configured: true },
+                teams: {
+                    configured: context.facts.teams.configured,
+                    ...(runtime.get(agent)?.teams ?? {}),
+                },
+                bluebubbles: blueBubblesConfigured
+                    ? {
+                        configured: true,
+                        optional: context.facts.bluebubbles.optional,
+                        ...blueBubblesRuntimeFacts,
+                    }
+                    : {
+                        configured: false,
+                        optional: context.facts.bluebubbles.optional,
+                    },
+                mail: {
+                    configured: context.facts.mail.configured,
+                    ...(runtime.get(agent)?.mail ?? {}),
+                },
+                voice: {
+                    configured: context.facts.voice.configured,
+                    optional: context.facts.voice.optional,
+                    ...(runtime.get(agent)?.voice ?? {}),
+                },
+                a2a: {
+                    configured: context.facts.a2a.configured,
+                    ...(runtime.get(agent)?.a2a ?? {}),
+                },
+                workbench: {
+                    configured: context.facts.workbench.configured,
+                },
+            };
+            const inventory = (0, sense_truth_1.getSenseInventory)({ senses: context.senses }, runtimeInfo);
+            return inventory.map((entry) => ({
+                agent,
+                sense: entry.sense,
+                label: entry.label,
+                enabled: entry.enabled,
+                status: entry.status,
+                detail: entry.enabled
+                    ? entry.sense === "bluebubbles"
+                        ? blueBubblesConfigured
+                            ? blueBubblesRuntimeFacts.detail
+                                ?? context.facts[entry.sense].detail
+                            : context.facts[entry.sense].detail
+                        : context.facts[entry.sense].detail
+                    : entry.sense === "workbench"
+                        ? WORKBENCH_RUNTIME_INJECTION_DETAIL
+                        : "not enabled in agent.json",
+                ...(entry.sense === "bluebubbles" && blueBubblesConfigured ? {
+                    proofMethod: blueBubblesRuntimeFacts.proofMethod,
+                    lastProofAt: blueBubblesRuntimeFacts.lastProofAt,
+                    proofAgeMs: blueBubblesRuntimeFacts.proofAgeMs,
+                    lastFailure: blueBubblesRuntimeFacts.lastFailure,
+                    failureLayer: blueBubblesRuntimeFacts.failureLayer,
+                    recoveryAction: blueBubblesRuntimeFacts.recoveryAction,
+                    pendingRecoveryCount: blueBubblesRuntimeFacts.pendingRecoveryCount,
+                    failedRecoveryCount: blueBubblesRuntimeFacts.failedRecoveryCount,
+                    oldestPendingRecoveryAt: blueBubblesRuntimeFacts.oldestPendingRecoveryAt,
+                    oldestPendingRecoveryAgeMs: blueBubblesRuntimeFacts.oldestPendingRecoveryAgeMs,
+                    activeTurnCount: blueBubblesRuntimeFacts.activeTurnCount,
+                    stalledTurnCount: blueBubblesRuntimeFacts.stalledTurnCount,
+                    oldestActiveTurnStartedAt: blueBubblesRuntimeFacts.oldestActiveTurnStartedAt,
+                    oldestActiveTurnAgeMs: blueBubblesRuntimeFacts.oldestActiveTurnAgeMs,
+                } : {}),
+            }));
+        });
+        (0, runtime_1.emitNervesEvent)({
+            component: "channels",
+            event: "channel.daemon_sense_rows_built",
+            message: "built daemon sense status rows",
+            meta: {
+                rows: rows.map((row) => ({
+                    agent: row.agent,
+                    sense: row.sense,
+                    status: row.status,
+                })),
+            },
+        });
+        return rows;
+    }
+}
+exports.DaemonSenseManager = DaemonSenseManager;