@ouro.bot/cli 0.1.0-alpha.726 → 0.1.0-alpha.728

package/dist/heart/daemon/mcp-canary.js

@@ -33,7 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_CANARY_TIMEOUT_MS = void 0;
+exports.SETUP_CANARY_TIMEOUT_MS = exports.DEFAULT_CANARY_TIMEOUT_MS = void 0;
+exports.classifyMcpBoundary = classifyMcpBoundary;
+exports.sanitizeMcpCanaryText = sanitizeMcpCanaryText;
+exports.sanitizeMcpCanaryArgs = sanitizeMcpCanaryArgs;
 exports.buildMcpBridgeRepairGuidance = buildMcpBridgeRepairGuidance;
 exports.formatMcpBridgeRepairDetails = formatMcpBridgeRepairDetails;
 exports.buildMcpDoctorNextSteps = buildMcpDoctorNextSteps;
@@ -47,7 +50,40 @@ const child_process_1 = require("child_process");
 const path = __importStar(require("path"));
 const runtime_1 = require("../../nerves/runtime");
 exports.DEFAULT_CANARY_TIMEOUT_MS = 60_000;
+exports.SETUP_CANARY_TIMEOUT_MS = 10_000;
 const MCP_PROTOCOL_VERSION = "2024-11-05";
+function classifyMcpBoundary(input) {
+    if (!input.bridgeHealthy)
+        return "ouro-bridge-failed";
+    return input.hostStallObserved ? "host-stall-unexplained" : "ouro-bridge-healthy-at-capture";
+}
+function sanitizeMcpCanaryText(text) {
+    return text
+        .replace(/(https?:\/\/[^\s?]+)\?[^\s]*/g, "$1?[redacted]")
+        .replace(/"(?:password|token|secret|api[_-]?key)"\s*:\s*"[^"]*"/gi, '"credential":"[redacted]"')
+        .replace(/\bBearer\s+[^\s]+/gi, "Bearer [redacted]")
+        .replace(/--(?:password|token|secret|api[_-]?key)(\s+|=)[^\s]+/gi, "--credential$1[redacted]")
+        .replace(/\b(?:password|token|secret|api[_-]?key)=([^\s]+)/gi, "credential=[redacted]")
+        .trim();
+}
+function sanitizeMcpCanaryArgs(args) {
+    const sanitized = [];
+    let redactNext = false;
+    for (const arg of args) {
+        if (redactNext) {
+            sanitized.push("[redacted]");
+            redactNext = false;
+            continue;
+        }
+        if (/^--(?:password|token|secret|api[_-]?key)$/i.test(arg)) {
+            sanitized.push("--credential");
+            redactNext = true;
+            continue;
+        }
+        sanitized.push(sanitizeMcpCanaryText(arg));
+    }
+    return sanitized;
+}
 function defaultCommandArgs(agent, socketPath) {
     const entryPath = path.join(__dirname, "ouro-bot-entry.js");
     return [
@@ -58,18 +94,32 @@ function defaultCommandArgs(agent, socketPath) {
         ...(socketPath ? ["--socket", socketPath] : []),
     ];
 }
-function responseText(response) {
-    const result = response.result;
-    if (!result || typeof result !== "object" || Array.isArray(result))
-        return JSON.stringify(response);
-    const content = result.content;
-    if (!Array.isArray(content))
-        return JSON.stringify(response);
-    const first = content[0];
-    if (!first || typeof first !== "object" || Array.isArray(first))
-        return JSON.stringify(response);
-    const text = first.text;
-    return typeof text === "string" ? text : JSON.stringify(response);
+function isRecord(value) {
+    return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function requireInitializeResult(response) {
+    if (!isRecord(response.result)) {
+        throw new Error("MCP canary received invalid initialize result");
+    }
+}
+function requireStatusText(response) {
+    if (!isRecord(response.result)) {
+        throw new Error("MCP canary received invalid status result");
+    }
+    if (response.result.isError === true) {
+        const errorContent = response.result.content;
+        const errorFirst = Array.isArray(errorContent) ? errorContent[0] : undefined;
+        const errorText = isRecord(errorFirst) && typeof errorFirst.text === "string"
+            ? errorFirst.text
+            : "MCP status tool returned an error";
+        throw new Error(errorText);
+    }
+    const content = response.result.content;
+    const first = Array.isArray(content) ? content[0] : undefined;
+    if (!isRecord(first) || typeof first.text !== "string") {
+        throw new Error("MCP canary received invalid status result");
+    }
+    return first.text;
 }
 function parseFields(line) {
     const parsed = {};
@@ -214,7 +264,23 @@ function validateMcpStatus(parsed, requiredSenses, options = {}) {
     };
 }
 async function runMcpStatusCanary(options) {
+    const startedAt = Date.now();
     const timeoutMs = options.timeoutMs ?? exports.DEFAULT_CANARY_TIMEOUT_MS;
+    const deadlineAt = startedAt + timeoutMs;
+    const evidence = {
+        capturedAt: new Date(startedAt).toISOString(),
+        durationMs: 0,
+        childPid: null,
+        phase: "spawn",
+        exitCode: null,
+        exitSignal: null,
+        stderr: "",
+    };
+    const decorate = (result, bridgeHealthy = false) => ({
+        ...result,
+        classification: classifyMcpBoundary({ bridgeHealthy, hostStallObserved: options.hostStallObserved === true }),
+        evidence,
+    });
     /* v8 ignore next -- default spawn is exercised by live canaries, while unit tests inject a fake child @preserve */
     const spawnImpl = options.spawnImpl ?? child_process_1.spawn;
     const command = options.command ?? process.execPath;
@@ -227,17 +293,38 @@ async function runMcpStatusCanary(options) {
         meta: {
             agent: options.agent,
             command,
-            commandArgs,
+            commandArgs: sanitizeMcpCanaryArgs(commandArgs),
             timeoutMs,
             requiredSenses,
             ignoreOverviewHealth: options.ignoreOverviewHealth === true,
             ignoreSenseHealth: options.ignoreSenseHealth === true,
         },
     });
-    const child = spawnImpl(command, commandArgs, { stdio: ["pipe", "pipe", "pipe"] });
+    let child;
+    try {
+        child = spawnImpl(command, commandArgs, { stdio: ["pipe", "pipe", "pipe"] });
+        evidence.childPid = child.pid ?? null;
+    }
+    catch (error) {
+        const reason = sanitizeMcpCanaryText(error instanceof Error ? error.message : String(error));
+        evidence.durationMs = Date.now() - startedAt;
+        (0, runtime_1.emitNervesEvent)({
+            component: "daemon",
+            event: "daemon.mcp_canary_error",
+            level: "error",
+            message: "MCP status canary failed to spawn",
+            meta: { agent: options.agent, reason },
+        });
+        return decorate({ ok: false, summary: `mcp canary failed: ${reason}`, details: [reason] });
+    }
     let buffer = "";
     let stderr = "";
     const pending = new Map();
+    let resolveExit;
+    const exitObserved = new Promise((resolve) => { resolveExit = resolve; });
+    function safeStderr() {
+        return sanitizeMcpCanaryText(stderr);
+    }
     function cleanup() {
         for (const [, request] of pending) {
             clearTimeout(request.timer);
@@ -268,14 +355,19 @@ async function runMcpStatusCanary(options) {
             buffer = buffer.slice(idx + 1);
             if (!line)
                 continue;
-            let response;
+            let parsedResponse;
             try {
-                response = JSON.parse(line);
+                parsedResponse = JSON.parse(line);
             }
             catch {
                 failAll(new Error(`MCP canary received malformed JSON: ${line}`));
                 return;
             }
+            if (!isRecord(parsedResponse)) {
+                failAll(new Error("MCP canary received malformed JSON-RPC response"));
+                return;
+            }
+            const response = parsedResponse;
             const id = typeof response.id === "number" ? response.id : null;
             if (id === null)
                 continue;
@@ -284,14 +376,27 @@ async function runMcpStatusCanary(options) {
                 continue;
             pending.delete(id);
             clearTimeout(request.timer);
+            const hasResult = Object.prototype.hasOwnProperty.call(response, "result");
+            const hasError = Object.prototype.hasOwnProperty.call(response, "error");
+            if (response.jsonrpc !== "2.0" || (!hasResult && !hasError)) {
+                request.reject(new Error("MCP canary received malformed JSON-RPC response"));
+                continue;
+            }
+            if (hasError) {
+                request.reject(new Error(`MCP canary received JSON-RPC error: ${JSON.stringify(response.error)}`));
+                continue;
+            }
             request.resolve(response);
         }
     });
     child.on("error", (error) => failAll(error));
     child.on("close", (code, signal) => {
+        evidence.exitCode = code;
+        evidence.exitSignal = signal;
+        resolveExit();
         if (pending.size === 0)
             return;
-        failAll(new Error(`MCP canary process closed before response code=${code} signal=${signal ?? "none"} stderr=${stderr.trim()}`));
+        failAll(new Error(`MCP canary process closed before response code=${code} signal=${signal ?? "none"} stderr=${safeStderr()}`));
     });
     let nextId = 1;
     function request(method, params) {
@@ -300,36 +405,43 @@ async function runMcpStatusCanary(options) {
                 reject(new Error("MCP canary stdin is not writable"));
                 return;
             }
+            const remainingMs = deadlineAt - Date.now();
+            if (remainingMs <= 0) {
+                reject(new Error(`MCP canary timed out waiting for ${method}; stderr=${safeStderr()}`));
+                return;
+            }
             const id = nextId++;
             const timer = setTimeout(() => {
                 pending.delete(id);
-                reject(new Error(`MCP canary timed out waiting for ${method}; stderr=${stderr.trim()}`));
-            }, timeoutMs);
+                reject(new Error(`MCP canary timed out waiting for ${method}; stderr=${safeStderr()}`));
+            }, remainingMs);
             pending.set(id, { resolve, reject, timer });
             child.stdin.write(JSON.stringify({ jsonrpc: "2.0", id, method, params }) + "\n");
         });
     }
     try {
-        await request("initialize", {
+        evidence.phase = "initialize";
+        const initializeResponse = await request("initialize", {
             protocolVersion: MCP_PROTOCOL_VERSION,
             capabilities: {},
             clientInfo: { name: "ouro-mcp-canary", version: "1.0" },
         });
+        requireInitializeResult(initializeResponse);
         child.stdin?.write(JSON.stringify({ jsonrpc: "2.0", method: "initialized" }) + "\n");
+        evidence.phase = "status";
         const statusResponse = await request("tools/call", {
             name: "status",
             arguments: {},
         });
-        const result = statusResponse.result;
-        if (result && typeof result === "object" && !Array.isArray(result) && result.isError === true) {
-            throw new Error(responseText(statusResponse));
-        }
-        const parsed = parseMcpStatusText(responseText(statusResponse));
+        const statusText = requireStatusText(statusResponse);
+        const bridgeHealthy = true;
+        const parsed = parseMcpStatusText(sanitizeMcpCanaryText(statusText));
         const canary = validateMcpStatus(parsed, requiredSenses, {
             agent: options.agent,
             ignoreOverviewHealth: options.ignoreOverviewHealth,
             ignoreSenseHealth: options.ignoreSenseHealth,
         });
+        evidence.phase = "complete";
         (0, runtime_1.emitNervesEvent)({
             component: "daemon",
             event: canary.ok ? "daemon.mcp_canary_end" : "daemon.mcp_canary_error",
@@ -337,10 +449,10 @@ async function runMcpStatusCanary(options) {
             message: canary.summary,
             meta: { agent: options.agent, ok: canary.ok },
         });
-        return canary;
+        return decorate(canary, bridgeHealthy);
     }
     catch (error) {
-        const reason = error instanceof Error ? error.message : String(error);
+        const reason = sanitizeMcpCanaryText(error instanceof Error ? error.message : String(error));
         (0, runtime_1.emitNervesEvent)({
             component: "daemon",
             event: "daemon.mcp_canary_error",
@@ -348,16 +460,30 @@ async function runMcpStatusCanary(options) {
             message: "MCP status canary failed",
             meta: { agent: options.agent, reason },
         });
-        return { ok: false, summary: `mcp canary failed: ${reason}`, details: [reason] };
+        return decorate({ ok: false, summary: `mcp canary failed: ${reason}`, details: [reason] });
     }
     finally {
         child.stdin?.end();
         cleanup();
+        let exitTimer;
+        const remainingExitWaitMs = Math.min(100, Math.max(0, deadlineAt - Date.now()));
+        await Promise.race([
+            exitObserved,
+            new Promise((resolve) => { exitTimer = setTimeout(resolve, remainingExitWaitMs); }),
+        ]);
+        clearTimeout(exitTimer);
+        evidence.stderr = safeStderr();
+        evidence.durationMs = Date.now() - startedAt;
     }
 }
 function formatMcpStatusCanaryResult(result) {
     return [
         result.ok ? "mcp canary: ok" : "mcp canary: failed",
+        ...(result.classification ? [`classification: ${result.classification}`] : []),
+        ...(result.evidence ? [
+            `captured=${result.evidence.capturedAt} durationMs=${result.evidence.durationMs} childPid=${result.evidence.childPid ?? "none"} phase=${result.evidence.phase} exitCode=${result.evidence.exitCode ?? "none"} exitSignal=${result.evidence.exitSignal ?? "none"}`,
+            ...(result.evidence.stderr ? [`stderr=${result.evidence.stderr}`] : []),
+        ] : []),
         result.summary,
         ...result.details.map((line) => `  ${line}`),
     ].join("\n");
@@ -368,6 +494,11 @@ function formatMcpStatusDoctorResult(result, agent) {
         && !line.startsWith("verify command="));
     const lines = [
         result.ok ? "mcp doctor: ok" : "mcp doctor: failed",
+        ...(result.classification ? [`classification: ${result.classification}`] : []),
+        ...(result.evidence ? [
+            `captured=${result.evidence.capturedAt} durationMs=${result.evidence.durationMs} childPid=${result.evidence.childPid ?? "none"} phase=${result.evidence.phase} exitCode=${result.evidence.exitCode ?? "none"} exitSignal=${result.evidence.exitSignal ?? "none"}`,
+            ...(result.evidence.stderr ? [`stderr=${result.evidence.stderr}`] : []),
+        ] : []),
         result.summary,
         ...rawDetails.map((line) => `  ${line}`),
     ];

package/dist/heart/daemon/process-manager.js

@@ -56,6 +56,9 @@ exports.RESPAWN_GUARD_WINDOW_MS = 10 * 60_000;
 const MAX_PENDING_IPC_MESSAGES = 20;
 class DaemonProcessManager {
     agents = new Map();
+    /** `stopAll()` is terminal for a manager instance. Once set, it fences
+     *  detached restart/start continuations until the owning daemon exits. */
+    shutdownRequested = false;
     maxRestartsPerHour;
     stabilityThresholdMs;
     initialBackoffMs;
@@ -67,6 +70,7 @@ class DaemonProcessManager {
     cooldownRecoveryMs;
     maxCooldownRetries;
     startupStaleAfterMs;
+    stopTimeoutMs;
     existsSyncFn;
     configCheckFn;
     statusWriterFn;
@@ -143,6 +147,7 @@ class DaemonProcessManager {
         this.cooldownRecoveryMs = options.cooldownRecoveryMs ?? 5 * 60 * 1_000;
         this.maxCooldownRetries = options.maxCooldownRetries ?? 3;
         this.startupStaleAfterMs = options.startupStaleAfterMs ?? 45_000;
+        this.stopTimeoutMs = options.stopTimeoutMs ?? 4_000;
         this.spawnFn = options.spawn ?? ((command, args, spawnOptions) => (0, child_process_1.spawn)(command, args, spawnOptions));
         this.now = options.now ?? (() => Date.now());
         this.setTimeoutFn = options.setTimeoutFn ?? ((cb, delay) => setTimeout(cb, delay));
@@ -169,6 +174,7 @@ class DaemonProcessManager {
                 cooldownTimer: null,
                 cooldownRetryCount: 0,
                 fastCrashCount: 0,
+                stopFailureActive: false,
                 snapshot: {
                     name: agent.name,
                     channel: agent.channel,
@@ -206,6 +212,8 @@ class DaemonProcessManager {
     }
     async startAgent(agent, options = {}) {
         const state = this.requireAgent(agent);
+        if (this.shutdownRequested)
+            return;
         if (state.process || state.startInFlight)
             return;
         const attemptId = state.startAttemptId + 1;
@@ -426,25 +434,87 @@ class DaemonProcessManager {
             return;
         }
         const child = state.process;
-        state.process = null;
-        state.snapshot.status = "stopped";
-        state.snapshot.pid = null;
-        try {
-            child.kill("SIGTERM");
-        }
-        catch {
-            (0, runtime_1.emitNervesEvent)({
-                level: "warn",
-                component: "daemon",
-                event: "daemon.agent_stop_error",
-                message: "failed to send SIGTERM to managed agent",
-                meta: { agent },
-            });
-        }
-        this.notifySnapshotChange(state.snapshot);
+        const childPid = child.pid ?? null;
+        const childPidLabel = childPid === null ? "unknown" : String(childPid);
+        await new Promise((resolve, reject) => {
+            let settled = false;
+            let timeout = null;
+            const finish = (error) => {
+                /* v8 ignore next -- defensive idempotence if an injected timer fires after cancellation @preserve */
+                if (settled)
+                    return;
+                settled = true;
+                child.removeListener("exit", onExit);
+                if (timeout !== null)
+                    this.clearTimeoutFn(timeout);
+                if (error)
+                    reject(error);
+                else
+                    resolve();
+            };
+            const onExit = () => finish();
+            child.once("exit", onExit);
+            let signalAccepted = false;
+            try {
+                signalAccepted = child.kill("SIGTERM");
+            }
+            catch {
+                const errorReason = "failed to send SIGTERM to managed agent; worker remains tracked";
+                state.stopFailureActive = true;
+                state.snapshot.errorReason = errorReason;
+                state.snapshot.fixHint = `Inspect managed worker PID ${childPidLabel} before retrying the stop or restart.`;
+                (0, runtime_1.emitNervesEvent)({
+                    level: "error",
+                    component: "daemon",
+                    event: "daemon.agent_stop_error",
+                    message: errorReason,
+                    meta: { agent, pid: childPid },
+                });
+                this.notifySnapshotChange(state.snapshot);
+                finish(new Error(errorReason));
+                return;
+            }
+            if (!signalAccepted) {
+                const errorReason = "managed agent rejected SIGTERM; worker remains tracked";
+                state.stopFailureActive = true;
+                state.snapshot.errorReason = errorReason;
+                state.snapshot.fixHint = `Inspect managed worker PID ${childPidLabel} before retrying the stop or restart.`;
+                (0, runtime_1.emitNervesEvent)({
+                    level: "error",
+                    component: "daemon",
+                    event: "daemon.agent_stop_error",
+                    message: errorReason,
+                    meta: { agent, pid: childPid },
+                });
+                this.notifySnapshotChange(state.snapshot);
+                finish(new Error(errorReason));
+                return;
+            }
+            if (settled)
+                return;
+            timeout = this.setTimeoutFn(() => {
+                if (settled)
+                    return;
+                const errorReason = `managed agent did not exit within ${this.stopTimeoutMs}ms; replacement was not started`;
+                state.stopFailureActive = true;
+                state.snapshot.errorReason = errorReason;
+                state.snapshot.fixHint = `Inspect managed worker PID ${childPidLabel}; retry only after that worker has exited.`;
+                (0, runtime_1.emitNervesEvent)({
+                    level: "error",
+                    component: "daemon",
+                    event: "daemon.agent_stop_timeout",
+                    message: errorReason,
+                    meta: { agent, pid: childPid, timeoutMs: this.stopTimeoutMs },
+                });
+                this.notifySnapshotChange(state.snapshot);
+                finish(new Error(errorReason));
+            }, this.stopTimeoutMs);
+        });
     }
     async restartAgent(agent, options = {}) {
         const state = this.requireAgent(agent);
+        if (this.shutdownRequested)
+            return;
         // Respawn-loop guard: prune timestamps outside the window, then check
         // whether we've already restarted this agent too many times in it.
         const now = this.now();
@@ -528,8 +598,14 @@ class DaemonProcessManager {
         await this.startAgent(agent, options);
     }
     async stopAll() {
-        for (const state of this.agents.values()) {
-            await this.stopAgent(state.config.name);
+        this.shutdownRequested = true;
+        const states = [...this.agents.values()];
+        const results = await Promise.allSettled(states.map((state) => this.stopAgent(state.config.name)));
+        const failures = results.flatMap((result, index) => result.status === "rejected"
+            ? [{ agent: states[index].config.name, reason: result.reason }]
+            : []);
+        if (failures.length > 0) {
+            throw new AggregateError(failures.map((failure) => failure.reason), `failed to stop ${failures.length} managed worker(s): ${failures.map((failure) => failure.agent).join(", ")}`);
         }
     }
     resetAgentFailureState(agent) {
@@ -582,6 +658,7 @@ class DaemonProcessManager {
         return [...this.agents.values()].map((state) => state.snapshot);
     }
     onExit(state, child, code, signal) {
+        /* v8 ignore next -- defensive: replacement cannot start before this child's one-shot exit listener drains @preserve */
         if (state.process !== child)
             return;
         state.process = null;
@@ -590,6 +667,11 @@ class DaemonProcessManager {
         state.snapshot.pid = null;
         state.snapshot.lastExitCode = code;
         state.snapshot.lastSignal = signal;
+        if (state.stopFailureActive) {
+            state.stopFailureActive = false;
+            state.snapshot.errorReason = null;
+            state.snapshot.fixHint = null;
+        }
         const crashed = !state.stopRequested && code !== 0;
         const now = this.currentTimeMs();
         const startedAt = state.snapshot.startedAt ? Date.parse(state.snapshot.startedAt) : now;

package/dist/heart/daemon/socket-client.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_DAEMON_COMMAND_TIMEOUT_MS = exports.DEFAULT_DAEMON_SOCKET_PATH = void 0;
+exports.DEFAULT_DAEMON_STATUS_TIMEOUT_MS = exports.DEFAULT_DAEMON_COMMAND_TIMEOUT_MS = exports.DEFAULT_DAEMON_SOCKET_PATH = void 0;
 exports.__bypassVitestGuardForTests = __bypassVitestGuardForTests;
 exports.sendDaemonCommand = sendDaemonCommand;
 exports.checkDaemonSocketAlive = checkDaemonSocketAlive;
@@ -44,6 +44,7 @@ const net = __importStar(require("net"));
 const runtime_1 = require("../../nerves/runtime");
 exports.DEFAULT_DAEMON_SOCKET_PATH = "/tmp/ouroboros-daemon.sock";
 exports.DEFAULT_DAEMON_COMMAND_TIMEOUT_MS = 10 * 60 * 1000;
+exports.DEFAULT_DAEMON_STATUS_TIMEOUT_MS = 5_000;
 /**
  * Defense-in-depth: detect if we're running under vitest. Tests that forget
  * to `vi.mock("../../heart/daemon/socket-client")` would otherwise leak real
@@ -130,11 +131,16 @@ function sendDaemonCommand(socketPath, command, options = {}) {
         let raw = "";
         let settled = false;
         const timeoutMs = options.timeoutMs ?? exports.DEFAULT_DAEMON_COMMAND_TIMEOUT_MS;
+        let deadlineTimer;
+        const clearDeadline = () => {
+            clearTimeout(deadlineTimer);
+        };
         const resolveOnce = (response) => {
             /* v8 ignore next -- duplicate settlement guard; callers also guard event handlers before reaching this helper @preserve */
             if (settled)
                 return;
             settled = true;
+            clearDeadline();
             resolve(response);
         };
         const rejectOnce = (error) => {
@@ -142,27 +148,30 @@ function sendDaemonCommand(socketPath, command, options = {}) {
             if (settled)
                 return;
             settled = true;
+            clearDeadline();
             reject(error);
         };
-        if ("setTimeout" in client && typeof client.setTimeout === "function") {
-            client.setTimeout(timeoutMs, () => {
-                const error = new Error(`Daemon command ${command.kind} timed out after ${timeoutMs}ms waiting for a response.`);
-                (0, runtime_1.emitNervesEvent)({
-                    level: "error",
-                    component: "daemon",
-                    event: "daemon.socket_command_timeout",
-                    message: "daemon socket command timed out",
-                    meta: {
-                        socketPath,
-                        kind: command.kind,
-                        timeoutMs,
-                        error: error.message,
-                    },
-                });
-                client.destroy();
-                rejectOnce(error);
+        deadlineTimer = setTimeout(() => {
+            /* v8 ignore next -- terminal socket events clear this timer; guard protects a queued timer callback race @preserve */
+            if (settled)
+                return;
+            const error = new Error(`Daemon command ${command.kind} timed out after ${timeoutMs}ms waiting for a response.`);
+            error.code = "ETIMEDOUT";
+            (0, runtime_1.emitNervesEvent)({
+                level: "error",
+                component: "daemon",
+                event: "daemon.socket_command_timeout",
+                message: "daemon socket command timed out",
+                meta: {
+                    socketPath,
+                    kind: command.kind,
+                    timeoutMs,
+                    error: error.message,
+                },
             });
-        }
+            client.destroy();
+            rejectOnce(error);
+        }, timeoutMs);
         client.on("connect", () => {
             // Write the command + newline delimiter. DO NOT call client.end()
             // afterwards — the server closes the connection once it has written

package/dist/heart/providers/anthropic.js

@@ -104,14 +104,13 @@ function parseToolCallInput(argumentsJson) {
     }
 }
 function toAnthropicMessages(messages) {
-    let system;
+    const systemParts = [];
     const converted = [];
     for (const msg of messages) {
         if (msg.role === "system") {
-            if (!system) {
-                const text = toAnthropicTextContent(msg.content);
-                system = text || undefined;
-            }
+            const text = toAnthropicTextContent(msg.content).trim();
+            if (text)
+                systemParts.push(text);
             continue;
         }
         if (msg.role === "user") {
@@ -173,7 +172,7 @@ function toAnthropicMessages(messages) {
             });
         }
     }
-    return { system, messages: converted };
+    return { system: systemParts.length > 0 ? systemParts.join("\n\n") : undefined, messages: converted };
 }
 function toAnthropicTools(tools) {
     return tools.map((tool) => ({
@@ -231,6 +230,11 @@ function isAnthropicAuthFailure(error) {
 }
 async function streamAnthropicMessages(client, model, request) {
     const { system, messages } = toAnthropicMessages(request.messages);
+    const additionalSystemParts = request.messages
+        .filter((message) => message.role === "system")
+        .slice(1)
+        .map((message) => toAnthropicTextContent(message.content).trim())
+        .filter((text) => text.length > 0);
     const anthropicTools = toAnthropicTools(request.activeTools);
     const modelCaps = (0, model_capabilities_1.getModelCapabilities)(model);
     const maxTokens = modelCaps.maxOutputTokens ?? 16384;
@@ -255,12 +259,13 @@ async function streamAnthropicMessages(client, model, request) {
             text: preambleText + "\n\n" + request.systemPrompt.stable,
             cache_control: { type: "ephemeral" },
         };
-        if (request.systemPrompt.volatile) {
-            params.system = [stableBlock, { type: "text", text: request.systemPrompt.volatile }];
-        }
-        else {
-            params.system = [stableBlock];
-        }
+        params.system = [
+            stableBlock,
+            ...(request.systemPrompt.volatile
+                ? [{ type: "text", text: request.systemPrompt.volatile }]
+                : []),
+            ...additionalSystemParts.map((text) => ({ type: "text", text })),
+        ];
     }
     else if (system) {
         // Fallback: no structured prompt, extract from messages (legacy path)