@ouro.bot/cli 0.1.0-alpha.733 → 0.1.0-alpha.734

package/dist/heart/daemon/sanctuary-scheduler-liveness.js

@@ -0,0 +1,227 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readSanctuaryHealthCursor = readSanctuaryHealthCursor;
+exports.durableExclusiveJson = durableExclusiveJson;
+exports.consumeSanctuarySchedulerFire = consumeSanctuarySchedulerFire;
+exports.publishSanctuarySchedulerReceipt = publishSanctuarySchedulerReceipt;
+exports.sanctuarySchedulerLivenessReceiptMac = sanctuarySchedulerLivenessReceiptMac;
+exports.verifySanctuarySchedulerLivenessReceiptMac = verifySanctuarySchedulerLivenessReceiptMac;
+exports.recordSanctuarySchedulerLivenessReceipt = recordSanctuarySchedulerLivenessReceipt;
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const runtime_1 = require("../../nerves/runtime");
+const SHA256 = /^[0-9a-f]{64}$/u;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
+const CRONTAB_PATH = "/home/ouro/.ouro-cli/scheduler/sanctuary.crontab";
+const COMMAND = "/usr/local/bin/node /opt/ouro/dist/heart/daemon/ouro-entry.js poke sanctuary --habit sanctuary-health --trigger cron";
+function readSanctuaryHealthCursor(agentRoot) {
+    const state = JSON.parse(fs.readFileSync(path.join(agentRoot, "state", "health", "sanctuary-health.json"), "utf8"));
+    if (!Array.isArray(state.sweepReceipts) || !Array.isArray(state.deliveredReceipts))
+        throw new Error("Sanctuary health cursor state is invalid");
+    return { sweepCount: state.sweepReceipts.length, deliveryCount: state.deliveredReceipts.length };
+}
+function fsyncDirectory(directory, deps) {
+    const descriptor = deps.openSync(directory, fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW);
+    try {
+        deps.fsyncSync(descriptor);
+    }
+    finally {
+        deps.closeSync(descriptor);
+    }
+}
+function ensureDurableDirectory(directory, deps) {
+    try {
+        deps.mkdirSync(directory, { mode: 0o700 });
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "EEXIST") {
+            fsyncDirectory(directory, deps);
+            fsyncDirectory(path.dirname(directory), deps);
+            return;
+        }
+        if (code !== "ENOENT")
+            throw error;
+        const parent = path.dirname(directory);
+        if (parent === directory)
+            throw error;
+        ensureDurableDirectory(parent, deps);
+        try {
+            deps.mkdirSync(directory, { mode: 0o700 });
+        }
+        catch (retryError) {
+            if (retryError.code !== "EEXIST")
+                throw retryError;
+        }
+    }
+    fsyncDirectory(directory, deps);
+    fsyncDirectory(path.dirname(directory), deps);
+}
+function durableExclusiveJson(filePath, value, deps = fs) {
+    const directory = path.dirname(filePath);
+    ensureDurableDirectory(directory, deps);
+    const temporary = `${filePath}.tmp-${process.pid}-${(0, node_crypto_1.randomUUID)()}`;
+    let handle = null;
+    try {
+        handle = deps.openSync(temporary, fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY | fs.constants.O_NOFOLLOW, 0o600);
+        deps.writeFileSync(handle, `${JSON.stringify(value)}\n`, "utf8");
+        deps.fsyncSync(handle);
+        deps.closeSync(handle);
+        handle = null;
+        deps.linkSync(temporary, filePath);
+        fsyncDirectory(directory, deps);
+    }
+    finally {
+        if (handle !== null)
+            deps.closeSync(handle);
+        try {
+            deps.unlinkSync(temporary);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        finally {
+            fsyncDirectory(directory, deps);
+        }
+    }
+}
+function consumeSanctuarySchedulerFire(agentRoot, origin) {
+    if (!UUID.test(origin.schedulerRunId) || origin.occurrenceId !== `cron:${origin.slot}`)
+        throw new Error("Sanctuary scheduler fire claim is invalid");
+    const claimId = (0, node_crypto_1.createHash)("sha256").update(`sanctuary\0sanctuary-health\0${origin.slot}\0${origin.occurrenceId}`).digest("hex");
+    const claimPath = path.join(agentRoot, "state", "scheduler", "sanctuary-fire-claims", `${claimId}.json`);
+    try {
+        durableExclusiveJson(claimPath, { schemaVersion: "sanctuary-scheduler-fire-claim-v1", ...origin });
+    }
+    catch (error) {
+        if (error.code === "EEXIST") {
+            (0, runtime_1.emitNervesEvent)({ level: "warn", component: "daemon", event: "daemon.sanctuary_scheduler_fire_rejected", message: "Rejected replayed Sanctuary scheduler fire", meta: { occurrenceId: origin.occurrenceId, schedulerRunId: origin.schedulerRunId } });
+            throw new Error("Sanctuary scheduler fire replay rejected");
+        }
+        throw error;
+    }
+    (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_scheduler_fire_consumed", message: "Consumed Sanctuary scheduler fire before execution", meta: { occurrenceId: origin.occurrenceId, schedulerRunId: origin.schedulerRunId } });
+}
+function publishSanctuarySchedulerReceipt(filePath, value, deps = fs) {
+    try {
+        durableExclusiveJson(filePath, value, deps);
+    }
+    catch (error) {
+        if (error.code === "EEXIST")
+            throw new Error("Sanctuary scheduler liveness receipt already exists");
+        throw error;
+    }
+}
+function unsignedReceipt(value) {
+    return Object.fromEntries(Object.entries(value).filter(([key]) => key !== "receiptMac"));
+}
+function sanctuarySchedulerLivenessReceiptMac(identityKey, value) {
+    return (0, node_crypto_1.createHmac)("sha256", identityKey).update(`sanctuary-scheduler-liveness-receipt-v2\0${JSON.stringify(unsignedReceipt(value))}`).digest("hex");
+}
+function verifySanctuarySchedulerLivenessReceiptMac(identityKey, value) {
+    const observed = value.receiptMac;
+    if (typeof observed !== "string" || !SHA256.test(observed))
+        return false;
+    return (0, node_crypto_1.timingSafeEqual)(Buffer.from(observed, "hex"), Buffer.from(sanctuarySchedulerLivenessReceiptMac(identityKey, value), "hex"));
+}
+function validateSupervisor(snapshot) {
+    const manifest = snapshot.manifest;
+    if (snapshot.schemaVersion !== "supercronic-supervisor-snapshot-v1" || snapshot.daemonPid !== process.pid
+        || snapshot.childCount !== 1 || snapshot.healthy !== true || !Number.isSafeInteger(snapshot.childPid) || snapshot.childPid <= 1
+        || snapshot.binaryPath !== "/usr/local/bin/supercronic" || snapshot.crontabPath !== CRONTAB_PATH
+        || JSON.stringify(snapshot.args) !== JSON.stringify(["-split-logs", "-inotify", CRONTAB_PATH])
+        || snapshot.namespace !== "habit:sanctuary" || manifest.length !== 1
+        || manifest[0]?.id !== "sanctuary:sanctuary-health" || manifest[0].agent !== "sanctuary"
+        || manifest[0].taskId !== "sanctuary-health" || manifest[0].schedule !== "*/15 * * * *"
+        || manifest[0].taskPath !== "/home/ouro/AgentBundles/sanctuary.ouro/habits/sanctuary-health.md"
+        || manifest[0].command !== COMMAND || !snapshot.renderedCrontab.includes(`# ouro:habit:sanctuary:sanctuary:sanctuary-health\n*/15 * * * * ${COMMAND}\n`)) {
+        throw new Error("Sanctuary scheduler supervisor attestation is invalid");
+    }
+}
+function recordSanctuarySchedulerLivenessReceipt(input) {
+    if (input.trigger !== "cron")
+        throw new Error("Sanctuary scheduler liveness requires cron provenance");
+    if (input.scenario.label !== "unit-16f-cron-fingerprint" || !SHA256.test(input.scenario.scenarioHandleDigest))
+        throw new Error("Sanctuary scheduler liveness scenario is invalid");
+    if (input.occurrenceId.length === 0 || !UUID.test(input.runnerId))
+        throw new Error("Sanctuary scheduler liveness runner provenance is invalid");
+    if (!/^[A-Za-z0-9_-]{43}$/u.test(input.identityKey) || input.schedulerOrigin.parentPid !== input.supervisor.childPid
+        || input.schedulerOrigin.scenarioHandleDigest !== input.scenario.scenarioHandleDigest || input.occurrenceId !== input.schedulerOrigin.occurrenceId
+        || input.occurrenceId !== `cron:${input.schedulerOrigin.slot}`
+        || !UUID.test(input.schedulerOrigin.schedulerRunId)
+        || input.schedulerOrigin.slot.length === 0 || !SHA256.test(input.schedulerOrigin.proofMac))
+        throw new Error("Sanctuary scheduler liveness authenticated origin is invalid");
+    if (input.providerInvocationCount !== 0 || input.privateTurnCount !== 0)
+        throw new Error("Sanctuary scheduler liveness performed paid work");
+    validateSupervisor(input.supervisor);
+    const statePath = path.join(input.agentRoot, "state", "health", "sanctuary-health.json");
+    const state = JSON.parse(fs.readFileSync(statePath, "utf8"));
+    if (!Array.isArray(state.sweepReceipts) || !Array.isArray(state.deliveredReceipts))
+        throw new Error("Sanctuary scheduler liveness state is invalid");
+    const after = { sweepCount: state.sweepReceipts.length, deliveryCount: state.deliveredReceipts.length };
+    const matching = state.sweepReceipts.slice(input.before.sweepCount).filter((row) => row.scenarioHandleDigest === input.scenario.scenarioHandleDigest);
+    const sweep = matching[0];
+    if (after.sweepCount - input.before.sweepCount !== 1 || matching.length !== 1 || !sweep
+        || after.deliveryCount - input.before.deliveryCount !== 0 || sweep.opened !== 0 || sweep.recovered !== 0 || sweep.digestDue !== false || sweep.deliveryId !== undefined) {
+        throw new Error("Sanctuary scheduler liveness requires exactly one unchanged sweep");
+    }
+    const unsigned = {
+        schemaVersion: "sanctuary-scheduler-liveness-receipt-v1",
+        label: "unit-16f-cron-fingerprint",
+        scenarioHandleDigest: input.scenario.scenarioHandleDigest,
+        trigger: "cron",
+        occurrenceId: input.occurrenceId,
+        runnerId: input.runnerId,
+        recordedAt: (input.now ?? (() => new Date()))().toISOString(),
+        before: input.before,
+        after,
+        sweepDelta: 1,
+        deliveryDelta: 0,
+        providerInvocationCount: 0,
+        privateTurnCount: 0,
+        sweep: { recordDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(sweep)).digest("hex"), opened: 0, recovered: 0, digestDue: false, deliveryId: null },
+        supervisor: input.supervisor,
+        schedulerOrigin: input.schedulerOrigin,
+        nonReplay: true,
+    };
+    const receipt = { ...unsigned, receiptMac: sanctuarySchedulerLivenessReceiptMac(input.identityKey, unsigned) };
+    const receiptPath = path.join(input.agentRoot, "state", "acceptance", "scheduler-liveness-receipts", `${input.scenario.scenarioHandleDigest}.json`);
+    publishSanctuarySchedulerReceipt(receiptPath, receipt);
+    (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_scheduler_liveness", message: "Scheduler-origin Sanctuary health sweep attested", meta: { scenarioHandleDigest: input.scenario.scenarioHandleDigest, occurrenceId: input.occurrenceId, runnerId: input.runnerId } });
+    return receipt;
+}

package/dist/heart/daemon/sanctuary-scheduler-origin.js

@@ -0,0 +1,126 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultSanctuarySchedulerOriginDeps = defaultSanctuarySchedulerOriginDeps;
+exports.createSanctuarySchedulerFireCommand = createSanctuarySchedulerFireCommand;
+exports.verifySanctuarySchedulerFireCommand = verifySanctuarySchedulerFireCommand;
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const identity_1 = require("../identity");
+const runtime_1 = require("../../nerves/runtime");
+const telegram_1 = require("../../senses/telegram");
+const sanctuary_acceptance_marker_1 = require("./sanctuary-acceptance-marker");
+const CRONTAB_PATH = "/home/ouro/.ouro-cli/scheduler/sanctuary.crontab";
+const SUPERCRONIC = "/usr/local/bin/supercronic";
+const SUPERCRONIC_CMDLINE = `${SUPERCRONIC}\0-split-logs\0-inotify\0${CRONTAB_PATH}\0`;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
+const SHA256 = /^[0-9a-f]{64}$/u;
+const SLOT_MS = 15 * 60 * 1_000;
+function processIdentity(stat) {
+    const close = stat.lastIndexOf(")");
+    if (close < 1)
+        throw new Error("scheduler process identity is invalid");
+    const fields = stat.slice(close + 2).trim().split(/\s+/u);
+    const parentPid = Number(fields[1]);
+    const startTime = fields[19];
+    if (!Number.isSafeInteger(parentPid) || parentPid < 0 || !startTime || !/^[0-9]+$/u.test(startTime))
+        throw new Error("scheduler process identity is invalid");
+    return { parentPid, startTime };
+}
+function slotFor(now) {
+    return new Date(Math.floor(now.getTime() / SLOT_MS) * SLOT_MS).toISOString();
+}
+function unsigned(command) {
+    return Object.fromEntries(Object.entries(command).filter(([key]) => key !== "proofMac"));
+}
+function mac(key, command) {
+    return (0, node_crypto_1.createHmac)("sha256", key).update(JSON.stringify(unsigned(command))).digest("hex");
+}
+function safeEqual(left, right) {
+    if (!SHA256.test(left) || !SHA256.test(right))
+        return false;
+    return (0, node_crypto_1.timingSafeEqual)(Buffer.from(left, "hex"), Buffer.from(right, "hex"));
+}
+function defaultSanctuarySchedulerOriginDeps(agentRoot = (0, identity_1.getAgentRoot)("sanctuary"), markerReader = () => (0, sanctuary_acceptance_marker_1.readSanctuaryAcceptanceMarker)("sanctuary")) {
+    return {
+        platform: process.platform, pid: process.pid, ppid: process.ppid, now: () => new Date(),
+        readFile: (target) => fs.readFileSync(target, "utf8"), readLink: (target) => fs.readlinkSync(target),
+        identityKey: () => (0, telegram_1.readOrCreateTelegramIdentityKey)(agentRoot), marker: markerReader, randomId: () => (0, node_crypto_1.randomUUID)(),
+    };
+}
+function createSanctuarySchedulerFireCommand(command, deps = defaultSanctuarySchedulerOriginDeps()) {
+    if (command.agent !== "sanctuary" || command.habitName !== "sanctuary-health" || command.trigger !== "cron" || deps.platform !== "linux")
+        return null;
+    try {
+        if (deps.readLink(`/proc/${deps.ppid}/exe`) !== SUPERCRONIC || deps.readFile(`/proc/${deps.ppid}/cmdline`) !== SUPERCRONIC_CMDLINE)
+            return null;
+        const invocation = processIdentity(deps.readFile(`/proc/${deps.pid}/stat`));
+        const parent = processIdentity(deps.readFile(`/proc/${deps.ppid}/stat`));
+        const marker = deps.marker();
+        if (invocation.parentPid !== deps.ppid)
+            return null;
+        const slot = slotFor(deps.now());
+        const value = {
+            kind: "habit.scheduler-fire", agent: "sanctuary", habitName: "sanctuary-health", trigger: "cron",
+            slot, occurrenceId: `cron:${slot}`, schedulerRunId: deps.randomId(), invocationPid: deps.pid, parentPid: deps.ppid,
+            parentStartTime: parent.startTime, invocationStartTime: invocation.startTime,
+            scenarioHandleDigest: marker?.label === "unit-16f-cron-fingerprint" ? marker.scenarioHandleDigest : null,
+        };
+        return { ...value, proofMac: mac(deps.identityKey(), value) };
+    }
+    catch {
+        return null;
+    }
+}
+function verifySanctuarySchedulerFireCommand(command, deps) {
+    if (!command || command.kind !== "habit.scheduler-fire" || command.agent !== "sanctuary" || command.habitName !== "sanctuary-health" || command.trigger !== "cron"
+        || !UUID.test(command.schedulerRunId) || (command.scenarioHandleDigest !== null && !SHA256.test(command.scenarioHandleDigest)) || command.scenarioHandleDigest !== deps.scenarioHandleDigest
+        || command.slot !== slotFor(deps.now()) || command.occurrenceId !== `cron:${command.slot}`)
+        throw new Error("scheduler fire slot or binding is invalid");
+    if (!safeEqual(command.proofMac, mac(deps.identityKey, command)))
+        throw new Error("scheduler fire authentication failed");
+    const invocation = processIdentity(deps.readFile(`/proc/${command.invocationPid}/stat`));
+    const parent = processIdentity(deps.readFile(`/proc/${command.parentPid}/stat`));
+    if (command.parentPid !== deps.childPid || invocation.parentPid !== command.parentPid || invocation.startTime !== command.invocationStartTime
+        || parent.startTime !== command.parentStartTime || deps.readLink(`/proc/${command.parentPid}/exe`) !== SUPERCRONIC
+        || deps.readFile(`/proc/${command.parentPid}/cmdline`) !== SUPERCRONIC_CMDLINE)
+        throw new Error("scheduler fire ancestry is invalid");
+    (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_scheduler_origin_authenticated", message: "Sanctuary scheduler origin authenticated", meta: { schedulerRunId: command.schedulerRunId, slot: command.slot } });
+    return {
+        slot: command.slot, schedulerRunId: command.schedulerRunId, invocationPid: command.invocationPid, parentPid: command.parentPid,
+        parentStartTime: command.parentStartTime, invocationStartTime: command.invocationStartTime, proofMac: command.proofMac,
+        scenarioHandleDigest: command.scenarioHandleDigest, occurrenceId: command.occurrenceId,
+    };
+}

package/dist/heart/daemon/sense-manager.js

@@ -60,6 +60,7 @@ function defaultSenses() {
         mail: { ...identity_1.DEFAULT_AGENT_SENSES.mail },
         voice: { ...identity_1.DEFAULT_AGENT_SENSES.voice },
         a2a: { ...identity_1.DEFAULT_AGENT_SENSES.a2a },
+        telegram: { ...identity_1.DEFAULT_AGENT_SENSES.telegram },
         workbench: { ...identity_1.DEFAULT_AGENT_SENSES.workbench },
     };
 }
@@ -100,7 +101,7 @@ function readAgentSenses(agentJsonPath) {
         && !Array.isArray(rawMcpServers)
         && Object.prototype.hasOwnProperty.call(rawMcpServers, "ouro_workbench");
     const workbenchHasStaleBundleEntry = workbenchSensePresent || workbenchMcpPresent;
-    for (const sense of ["cli", "teams", "bluebubbles", "mail", "voice", "a2a", "workbench"]) {
+    for (const sense of ["cli", "teams", "bluebubbles", "mail", "voice", "a2a", "telegram", "workbench"]) {
         const rawSense = rawSenses[sense];
         if (!rawSense || typeof rawSense !== "object" || Array.isArray(rawSense)) {
             continue;
@@ -168,6 +169,7 @@ function senseFactsFromRuntimeConfig(agent, senses, runtimeConfig, machineRuntim
         mail: { configured: false, detail: "not enabled in agent.json" },
         voice: { configured: false, detail: "not enabled in agent.json" },
         a2a: { configured: false, detail: "not enabled in agent.json" },
+        telegram: { configured: false, detail: "not enabled in agent.json" },
         workbench: { configured: false, detail: "not enabled in agent.json" },
     };
     const payload = runtimeConfig.ok ? runtimeConfig.config : {};
@@ -181,6 +183,13 @@ function senseFactsFromRuntimeConfig(agent, senses, runtimeConfig, machineRuntim
     const integrations = payload.integrations;
     const voice = machinePayload.voice;
     const a2a = machinePayload.a2a;
+    if (senses.telegram.enabled) {
+        const missing = ["telegramBotToken", "telegramAuthorizedUserId", "telegramAuthorizedChatId"]
+            .filter((field) => !textField(payload, field));
+        base.telegram = missing.length === 0
+            ? { configured: true, detail: "private long poll" }
+            : { configured: false, detail: `missing runtime/config: ${missing.join(", ")}` };
+    }
     if (senses.teams.enabled) {
         const missing = [];
         if (!textField(teams, "clientId"))
@@ -345,6 +354,9 @@ function senseRepairHint(agent, sense) {
     if (sense === "a2a") {
         return `Agent-runnable: run 'ouro connect a2a --agent ${agent}', then restart with 'ouro up'.`;
     }
+    if (sense === "telegram") {
+        return `Agent-runnable: store Telegram bot/user/chat coordinates with 'ouro connect telegram --agent ${agent}', then restart with 'ouro up'.`;
+    }
     /* v8 ignore next -- Workbench is deliberately not daemon-managed, so getSenseInventory never asks the daemon manager for a repair hint @preserve */
     if (sense === "workbench") {
         return `Agent-runnable: install Ouro Workbench.app, then launch the boss through Workbench or run 'ouro mcp-serve --agent ${agent} --workbench-mcp'; 'ouro connect workbench --agent ${agent}' only cleans stale bundle entries.`;
@@ -359,7 +371,7 @@ function parseSenseSnapshotName(name) {
     if (parts.length !== 2)
         return null;
     const [agent, sense] = parts;
-    if (sense !== "teams" && sense !== "bluebubbles" && sense !== "mail" && sense !== "voice" && sense !== "a2a")
+    if (sense !== "teams" && sense !== "bluebubbles" && sense !== "mail" && sense !== "voice" && sense !== "a2a" && sense !== "telegram")
         return null;
     return { agent, sense };
 }
@@ -377,12 +389,15 @@ function managedSenseEntry(sense) {
         return "senses/voice-entry.js";
     if (sense === "a2a")
         return "senses/a2a-entry.js";
+    if (sense === "telegram")
+        return "senses/telegram-entry.js";
     return "senses/mail-entry.js";
 }
 function runtimeCredentialBootstrapFor(agent, sense) {
     const runtime = (0, runtime_credentials_1.readRuntimeCredentialConfig)(agent);
-    const machineId = sense === "bluebubbles" || sense === "voice" || sense === "a2a" ? currentMachineId() : undefined;
-    const machine = sense === "bluebubbles" || sense === "voice" || sense === "a2a" ? (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent) : null;
+    const usesMachineConfig = sense === "bluebubbles" || sense === "voice" || sense === "a2a" || sense === "telegram";
+    const machineId = usesMachineConfig ? currentMachineId() : undefined;
+    const machine = usesMachineConfig ? (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent) : null;
     const providerPool = (0, provider_credentials_1.readProviderCredentialPool)(agent);
     const providerCredentialRecords = providerPool.ok
         ? Object.values(providerPool.pool.providers).filter((record) => !!record)
@@ -551,7 +566,7 @@ class DaemonSenseManager {
             return [agent, { senses, workbenchHasStaleBundleEntry, facts }];
         }));
         const managedSenseAgents = [...this.contexts.entries()].flatMap(([agent, context]) => {
-            return ["teams", "bluebubbles", "mail", "voice", "a2a"]
+            return ["teams", "bluebubbles", "mail", "voice", "a2a", "telegram"]
                 .filter((sense) => context.senses[sense].enabled)
                 .map((sense) => ({
                 name: `${agent}:${sense}`,
@@ -703,7 +718,7 @@ class DaemonSenseManager {
     }
     async refreshEnabledSenseConfigs() {
         const refreshes = [...this.contexts.entries()].map(async ([agent, context]) => {
-            const enabledManagedSenses = ["teams", "bluebubbles", "mail", "voice", "a2a"]
+            const enabledManagedSenses = ["teams", "bluebubbles", "mail", "voice", "a2a", "telegram"]
                 .filter((sense) => context.senses[sense].enabled);
             /* v8 ignore next -- periodic refresh work only exists when a managed background sense is enabled @preserve */
             if (enabledManagedSenses.length === 0)
@@ -872,6 +887,10 @@ class DaemonSenseManager {
                     configured: context.facts.a2a.configured,
                     ...(runtime.get(agent)?.a2a ?? {}),
                 },
+                telegram: {
+                    configured: context.facts.telegram.configured,
+                    ...(runtime.get(agent)?.telegram ?? {}),
+                },
                 workbench: {
                     configured: context.facts.workbench.configured,
                 },