@ouro.bot/cli 0.1.0-alpha.91 → 0.1.0-alpha.911

package/dist/heart/daemon/sense-manager.js

@@ -38,19 +38,32 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const runtime_1 = require("../../nerves/runtime");
-const bluebubbles_runtime_state_1 = require("../../senses/bluebubbles-runtime-state");
 const identity_1 = require("../identity");
+const runtime_credentials_1 = require("../runtime-credentials");
+const provider_credentials_1 = require("../provider-credentials");
 const sense_truth_1 = require("../sense-truth");
+const machine_identity_1 = require("../machine-identity");
+const shepherd_config_1 = require("../shepherd-config");
 const process_manager_1 = require("./process-manager");
+const config_1 = require("../../a2a/config");
 const DEFAULT_TEAMS_PORT = 3978;
 const DEFAULT_BLUEBUBBLES_PORT = 18790;
 const DEFAULT_BLUEBUBBLES_WEBHOOK_PATH = "/bluebubbles-webhook";
 const BLUEBUBBLES_RUNTIME_FRESHNESS_WINDOW_MS = 90_000;
+const SENSE_CONFIG_RETRY_DELAYS_MS = [1_000, 2_000, 5_000, 10_000, 30_000, 60_000];
+const WORKBENCH_RUNTIME_INJECTION_DETAIL = "runtime-injected by Workbench app; no agent.json entry required";
+const WORKBENCH_STALE_BUNDLE_DETAIL = "stale agent.json Workbench entry; run 'ouro connect workbench' to clean it and use runtime injection";
 function defaultSenses() {
     return {
         cli: { ...identity_1.DEFAULT_AGENT_SENSES.cli },
         teams: { ...identity_1.DEFAULT_AGENT_SENSES.teams },
         bluebubbles: { ...identity_1.DEFAULT_AGENT_SENSES.bluebubbles },
+        mail: { ...identity_1.DEFAULT_AGENT_SENSES.mail },
+        voice: { ...identity_1.DEFAULT_AGENT_SENSES.voice },
+        a2a: { ...identity_1.DEFAULT_AGENT_SENSES.a2a },
+        telegram: { ...identity_1.DEFAULT_AGENT_SENSES.telegram },
+        workbench: { ...identity_1.DEFAULT_AGENT_SENSES.workbench },
+        shepherd: { ...identity_1.DEFAULT_AGENT_SENSES.shepherd },
     };
 }
 function readAgentSenses(agentJsonPath) {
@@ -70,13 +83,27 @@ function readAgentSenses(agentJsonPath) {
                 reason: error instanceof Error ? error.message : String(error),
             },
         });
-        return defaults;
+        return { senses: defaults, workbenchHasStaleBundleEntry: false };
     }
     const rawSenses = parsed.senses;
     if (!rawSenses || typeof rawSenses !== "object" || Array.isArray(rawSenses)) {
-        return defaults;
+        const rawMcpServers = parsed.mcpServers;
+        const workbenchHasStaleBundleEntry = !!rawMcpServers
+            && typeof rawMcpServers === "object"
+            && !Array.isArray(rawMcpServers)
+            && Object.prototype.hasOwnProperty.call(rawMcpServers, "ouro_workbench");
+        if (workbenchHasStaleBundleEntry)
+            defaults.workbench = { enabled: true };
+        return { senses: defaults, workbenchHasStaleBundleEntry };
     }
-    for (const sense of ["cli", "teams", "bluebubbles"]) {
+    const workbenchSensePresent = Object.prototype.hasOwnProperty.call(rawSenses, "workbench");
+    const rawMcpServers = parsed.mcpServers;
+    const workbenchMcpPresent = !!rawMcpServers
+        && typeof rawMcpServers === "object"
+        && !Array.isArray(rawMcpServers)
+        && Object.prototype.hasOwnProperty.call(rawMcpServers, "ouro_workbench");
+    const workbenchHasStaleBundleEntry = workbenchSensePresent || workbenchMcpPresent;
+    for (const sense of ["cli", "teams", "bluebubbles", "mail", "voice", "a2a", "telegram", "workbench", "shepherd"]) {
         const rawSense = rawSenses[sense];
         if (!rawSense || typeof rawSense !== "object" || Array.isArray(rawSense)) {
             continue;
@@ -86,43 +113,96 @@ function readAgentSenses(agentJsonPath) {
             defaults[sense] = { enabled };
         }
     }
-    return defaults;
-}
-function readSecretsPayload(secretsPath) {
-    try {
-        const raw = fs.readFileSync(secretsPath, "utf-8");
-        const parsed = JSON.parse(raw);
-        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-            return { payload: {}, error: "invalid secrets.json object" };
-        }
-        return { payload: parsed, error: null };
-    }
-    catch (error) {
-        return {
-            payload: {},
-            error: error instanceof Error ? error.message : String(error),
-        };
+    if (workbenchHasStaleBundleEntry) {
+        defaults.workbench = { enabled: true };
     }
+    return { senses: defaults, workbenchHasStaleBundleEntry };
 }
 function textField(record, key) {
     const value = record?.[key];
     return typeof value === "string" ? value.trim() : "";
 }
+function booleanField(record, key) {
+    return record?.[key] === true;
+}
 function numberField(record, key, fallback) {
     const value = record?.[key];
     return typeof value === "number" && Number.isFinite(value) ? value : fallback;
 }
-function senseFactsFromSecrets(agent, senses, secretsPath) {
+function a2aMachineRuntimeConfig(agent) {
+    const runtimeConfig = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent);
+    const payload = runtimeConfig.ok ? runtimeConfig.config : {};
+    const a2a = payload.a2a;
+    return a2a && typeof a2a === "object" && !Array.isArray(a2a) ? a2a : undefined;
+}
+function managedA2AArgs(agent) {
+    const a2a = a2aMachineRuntimeConfig(agent);
+    const args = ["--port", String(numberField(a2a, "port", (0, config_1.defaultA2APort)(agent)))];
+    const host = textField(a2a, "host");
+    const endpointPath = (0, config_1.normalizeA2APath)(textField(a2a, "path") || config_1.A2A_DEFAULT_PATH);
+    const publicUrl = textField(a2a, "publicUrl");
+    if (host)
+        args.push("--host", host);
+    args.push("--path", endpointPath);
+    if (publicUrl)
+        args.push("--base-url", publicUrl);
+    return args;
+}
+function compactRuntimeConfigError(agent, error) {
+    const compact = error.replace(/\s+/g, " ").trim();
+    if (/credential vault is locked|vault locked|vault is locked/i.test(compact)) {
+        return `vault locked; run 'ouro vault unlock --agent ${agent}' if you have the saved secret, or 'ouro vault replace --agent ${agent}' if none was saved`;
+    }
+    return compact || "unavailable";
+}
+function runtimeConfigUnavailableDetail(agent, runtimeConfig) {
+    if (runtimeConfig.ok)
+        return "";
+    const itemName = /^vault:[^:]+:(.+)$/.exec(runtimeConfig.itemPath)?.[1] ?? "runtime/config";
+    if (runtimeConfig.reason === "missing")
+        return `missing vault ${itemName} (${agent})`;
+    return `vault ${itemName} unavailable (${compactRuntimeConfigError(agent, runtimeConfig.error)})`;
+}
+function needsMachineRuntimeConfig(agent, sense) {
+    return sense === "bluebubbles" || sense === "voice" || sense === "a2a" || sense === "shepherd" || (agent === "sanctuary" && sense === "telegram");
+}
+function senseFactsFromRuntimeConfig(agent, senses, runtimeConfig, machineRuntimeConfig = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent), workbenchHasStaleBundleEntry = false) {
     const base = {
         cli: { configured: true, detail: "local interactive terminal" },
         teams: { configured: false, detail: "not enabled in agent.json" },
         bluebubbles: { configured: false, detail: "not enabled in agent.json" },
+        mail: { configured: false, detail: "not enabled in agent.json" },
+        voice: { configured: false, detail: "not enabled in agent.json" },
+        a2a: { configured: false, detail: "not enabled in agent.json" },
+        telegram: { configured: false, detail: "not enabled in agent.json" },
+        workbench: { configured: false, detail: "not enabled in agent.json" },
+        shepherd: { configured: false, detail: "not enabled in agent.json" },
     };
-    const { payload, error } = readSecretsPayload(secretsPath);
+    const payload = runtimeConfig.ok ? runtimeConfig.config : {};
+    const unavailableDetail = runtimeConfigUnavailableDetail(agent, runtimeConfig);
     const teams = payload.teams;
     const teamsChannel = payload.teamsChannel;
-    const bluebubbles = payload.bluebubbles;
-    const bluebubblesChannel = payload.bluebubblesChannel;
+    const machinePayload = machineRuntimeConfig.ok ? machineRuntimeConfig.config : {};
+    const bluebubbles = machinePayload.bluebubbles;
+    const bluebubblesChannel = machinePayload.bluebubblesChannel;
+    const mailroom = payload.mailroom;
+    const integrations = payload.integrations;
+    const voice = machinePayload.voice;
+    const a2a = machinePayload.a2a;
+    if (senses.telegram.enabled && agent === "sanctuary") {
+        const ready = runtimeConfig.ok && machineRuntimeConfig.ok
+            && !Object.hasOwn(payload, "telegramBotToken") && !Object.hasOwn(machinePayload, "telegramBotToken");
+        base.telegram = ready
+            ? { configured: true, detail: "root authority transport; gateway validated at process startup" }
+            : { configured: false, detail: "root authority migration requires available tokenless credential inventories" };
+    }
+    else if (senses.telegram.enabled) {
+        const missing = ["telegramBotToken", "telegramAuthorizedUserId", "telegramAuthorizedChatId"]
+            .filter((field) => !textField(payload, field));
+        base.telegram = missing.length === 0
+            ? { configured: true, detail: "private long poll" }
+            : { configured: false, detail: `missing runtime/config: ${missing.join(", ")}` };
+    }
     if (senses.teams.enabled) {
         const missing = [];
         if (!textField(teams, "clientId"))
@@ -138,9 +218,9 @@ function senseFactsFromSecrets(agent, senses, secretsPath) {
             }
             : {
                 configured: false,
-                detail: error && !fs.existsSync(secretsPath)
-                    ? `missing secrets.json (${agent})`
-                    : `missing ${missing.join("/")}`,
+                detail: runtimeConfig.ok
+                    ? `missing ${missing.join("/")}`
+                    : unavailableDetail,
             };
     }
     if (senses.bluebubbles.enabled) {
@@ -156,19 +236,164 @@ function senseFactsFromSecrets(agent, senses, secretsPath) {
             }
             : {
                 configured: false,
-                detail: error && !fs.existsSync(secretsPath)
-                    ? `missing secrets.json (${agent})`
-                    : `missing ${missing.join("/")}`,
+                optional: !machineRuntimeConfig.ok && machineRuntimeConfig.reason === "missing",
+                detail: !machineRuntimeConfig.ok && machineRuntimeConfig.reason === "missing"
+                    ? "not attached on this machine"
+                    : machineRuntimeConfig.ok
+                        ? `missing ${missing.join("/")}`
+                        : runtimeConfigUnavailableDetail(agent, machineRuntimeConfig),
+            };
+    }
+    if (senses.mail.enabled) {
+        const privateKeys = mailroom?.privateKeys;
+        const hasPrivateKeys = !!privateKeys && typeof privateKeys === "object" && !Array.isArray(privateKeys) && Object.values(privateKeys).some((value) => typeof value === "string" && value.trim().length > 0);
+        const mailboxAddress = textField(mailroom, "mailboxAddress");
+        const missing = [];
+        if (!mailboxAddress)
+            missing.push("mailroom.mailboxAddress");
+        if (!hasPrivateKeys)
+            missing.push("mailroom.privateKeys");
+        base.mail = missing.length === 0
+            ? { configured: true, detail: mailboxAddress }
+            : {
+                configured: false,
+                detail: runtimeConfig.ok
+                    ? `missing ${missing.join("/")}`
+                    : unavailableDetail,
             };
     }
+    if (senses.voice.enabled) {
+        const portableVoice = payload.voice;
+        const conversationEngine = (textField(voice, "twilioConversationEngine")
+            || textField(voice, "conversationEngine")
+            || textField(portableVoice, "twilioConversationEngine")
+            || textField(portableVoice, "conversationEngine")
+            || "cascade").toLowerCase();
+        const twilioTransportMode = (textField(voice, "twilioTransportMode") || "record-play").toLowerCase();
+        const twilioPublicUrl = textField(voice, "twilioPublicUrl");
+        const hasOpenAIRealtimeKey = !!(textField(portableVoice, "openaiRealtimeApiKey")
+            || textField(integrations, "openaiApiKey")
+            || textField(integrations, "openaiEmbeddingsApiKey"));
+        const missing = [];
+        /* v8 ignore start -- voice setup missing-field matrix is enforced by the voice runtime resolver; sense-manager only renders human-readable readiness facts @preserve */
+        if (conversationEngine === "openai-realtime" || conversationEngine === "openai-sip") {
+            if (conversationEngine === "openai-realtime" && twilioTransportMode !== "media-stream") {
+                missing.push("voice.twilioTransportMode=media-stream");
+            }
+            if (!hasOpenAIRealtimeKey) {
+                missing.push("voice.openaiRealtimeApiKey");
+            }
+            if (conversationEngine === "openai-sip") {
+                if (!textField(portableVoice, "openaiSipProjectId") && !textField(voice, "openaiSipProjectId")) {
+                    missing.push("voice.openaiSipProjectId");
+                }
+                const allowUnsignedWebhooks = booleanField(portableVoice, "openaiSipAllowUnsignedWebhooks")
+                    || booleanField(voice, "openaiSipAllowUnsignedWebhooks");
+                if (!allowUnsignedWebhooks && !textField(portableVoice, "openaiSipWebhookSecret") && !textField(voice, "openaiSipWebhookSecret")) {
+                    missing.push("voice.openaiSipWebhookSecret");
+                }
+            }
+        }
+        else {
+            if (!textField(integrations, "elevenLabsApiKey"))
+                missing.push("integrations.elevenLabsApiKey");
+            if (!textField(integrations, "elevenLabsVoiceId") && !textField(portableVoice, "elevenLabsVoiceId")) {
+                missing.push("integrations.elevenLabsVoiceId");
+            }
+            if (!textField(voice, "whisperCliPath"))
+                missing.push("voice.whisperCliPath");
+            if (!textField(voice, "whisperModelPath"))
+                missing.push("voice.whisperModelPath");
+        }
+        /* v8 ignore stop */
+        base.voice = missing.length === 0
+            ? {
+                configured: true,
+                /* v8 ignore start -- voice detail copy mirrors runtime resolver modes; resolver tests own the matrix @preserve */
+                detail: conversationEngine === "openai-sip"
+                    ? twilioPublicUrl
+                        ? "OpenAI Realtime SIP speech-to-speech; Twilio phone transport attached"
+                        : "OpenAI Realtime SIP speech-to-speech"
+                    : conversationEngine === "openai-realtime"
+                        ? twilioPublicUrl
+                            ? "OpenAI Realtime speech-to-speech; Twilio phone transport attached"
+                            : "OpenAI Realtime speech-to-speech"
+                        : twilioPublicUrl
+                            ? "local Whisper.cpp STT + ElevenLabs TTS; Twilio phone transport attached"
+                            : "local Whisper.cpp STT + ElevenLabs TTS",
+                /* v8 ignore stop */
+            }
+            : {
+                configured: false,
+                optional: !machineRuntimeConfig.ok && machineRuntimeConfig.reason === "missing",
+                detail: !machineRuntimeConfig.ok && machineRuntimeConfig.reason === "missing"
+                    ? "not attached on this machine"
+                    : runtimeConfig.ok && machineRuntimeConfig.ok
+                        ? `missing ${missing.join("/")}`
+                        : !runtimeConfig.ok
+                            ? unavailableDetail
+                            : runtimeConfigUnavailableDetail(agent, machineRuntimeConfig),
+            };
+    }
+    if (senses.a2a.enabled) {
+        const port = numberField(a2a, "port", (0, config_1.defaultA2APort)(agent));
+        const endpointPath = (0, config_1.normalizeA2APath)(textField(a2a, "path") || config_1.A2A_DEFAULT_PATH);
+        const publicUrl = textField(a2a, "publicUrl");
+        base.a2a = {
+            configured: true,
+            /* v8 ignore next -- listSenseRows tests cover the public URL; daemon defaults cover the local port in live startup smoke @preserve */
+            detail: publicUrl ? `${publicUrl}${endpointPath}` : `:${port} ${endpointPath}`,
+        };
+    }
+    if (senses.shepherd.enabled) {
+        base.shepherd = !machineRuntimeConfig.ok && machineRuntimeConfig.reason !== "missing"
+            ? { configured: false, detail: runtimeConfigUnavailableDetail(agent, machineRuntimeConfig) }
+            : (0, shepherd_config_1.shepherdConfigFacts)(machinePayload);
+    }
+    if (workbenchHasStaleBundleEntry || senses.workbench.enabled) {
+        base.workbench = {
+            configured: false,
+            detail: WORKBENCH_STALE_BUNDLE_DETAIL,
+        };
+    }
     return base;
 }
+function senseRepairHint(agent, sense) {
+    if (sense === "teams") {
+        return `Run 'ouro vault config set --agent ${agent} --key teams.clientId', teams.clientSecret, and teams.tenantId; then run 'ouro up' again.`;
+    }
+    if (sense === "mail") {
+        return `Agent-runnable: provision Mailroom access with 'ouro connect mail --agent ${agent}', then restart with 'ouro up'.`;
+    }
+    if (sense === "voice") {
+        return `Agent-runnable: run 'ouro connect voice --agent ${agent}' for config guidance; use voice.twilioConversationEngine=openai-sip with voice.openaiRealtimeApiKey, voice.openaiSipProjectId, and voice.openaiSipWebhookSecret for preferred SIP phone voice; use openai-realtime for Media Streams fallback, or save ElevenLabs and local Whisper.cpp settings for cascade fallback; then run 'ouro up' again.`;
+    }
+    /* v8 ignore next -- A2A currently has no credential-gated not-configured state; kept for future repair copy symmetry @preserve */
+    if (sense === "a2a") {
+        return `Agent-runnable: run 'ouro connect a2a --agent ${agent}', then restart with 'ouro up'.`;
+    }
+    if (sense === "telegram") {
+        return agent === "sanctuary"
+            ? "Agent-runnable: complete or recover the root authority migration; do not restore a resident Telegram token."
+            : `Agent-runnable: store Telegram bot/user/chat coordinates with 'ouro connect telegram --agent ${agent}', then restart with 'ouro up'.`;
+    }
+    if (sense === "shepherd")
+        return (0, shepherd_config_1.shepherdRepairHint)(agent);
+    /* v8 ignore next -- Workbench is deliberately not daemon-managed, so getSenseInventory never asks the daemon manager for a repair hint @preserve */
+    if (sense === "workbench") {
+        return `Agent-runnable: install Ouro Workbench.app, then launch the boss through Workbench or run 'ouro acp-serve --agent ${agent} --workbench-mcp'; 'ouro connect workbench --agent ${agent}' only cleans stale bundle entries.`;
+    }
+    return `Run 'ouro connect bluebubbles --agent ${agent}' to attach BlueBubbles on this machine; then run 'ouro up' again.`;
+}
+function currentMachineId() {
+    return (0, machine_identity_1.loadOrCreateMachineIdentity)({ homeDir: os.homedir() }).machineId;
+}
 function parseSenseSnapshotName(name) {
     const parts = name.split(":");
     if (parts.length !== 2)
         return null;
     const [agent, sense] = parts;
-    if (sense !== "teams" && sense !== "bluebubbles")
+    if (sense !== "teams" && sense !== "bluebubbles" && sense !== "mail" && sense !== "voice" && sense !== "a2a" && sense !== "telegram" && sense !== "shepherd")
         return null;
     return { agent, sense };
 }
@@ -177,6 +402,41 @@ function runtimeInfoFor(status) {
         return { runtime: "running" };
     return { runtime: "error" };
 }
+function managedSenseEntry(sense) {
+    if (sense === "teams")
+        return "senses/teams-entry.js";
+    if (sense === "bluebubbles")
+        return "senses/bluebubbles/entry.js";
+    if (sense === "voice")
+        return "senses/voice-entry.js";
+    if (sense === "a2a")
+        return "senses/a2a-entry.js";
+    if (sense === "telegram")
+        return "senses/telegram-entry.js";
+    if (sense === "shepherd")
+        return "senses/shepherd-entry.js";
+    return "senses/mail-entry.js";
+}
+function runtimeCredentialBootstrapFor(agent, sense) {
+    const runtime = (0, runtime_credentials_1.readRuntimeCredentialConfig)(agent);
+    const usesMachineConfig = sense === "bluebubbles" || sense === "voice" || sense === "a2a" || sense === "telegram" || sense === "shepherd";
+    const machineId = usesMachineConfig ? currentMachineId() : undefined;
+    const machine = usesMachineConfig ? (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent) : null;
+    const providerPool = (0, provider_credentials_1.readProviderCredentialPool)(agent);
+    const providerCredentialRecords = providerPool.ok
+        ? Object.values(providerPool.pool.providers).filter((record) => !!record)
+        : [];
+    const bootstrap = {
+        agentName: agent,
+        runtimeConfig: runtime.ok ? runtime.config : undefined,
+        machineRuntimeConfig: machine?.ok ? machine.config : undefined,
+        machineId,
+        providerCredentialRecords: providerCredentialRecords.length > 0 ? providerCredentialRecords : undefined,
+    };
+    if (!bootstrap.runtimeConfig && !bootstrap.machineRuntimeConfig && !bootstrap.providerCredentialRecords)
+        return null;
+    return bootstrap;
+}
 function blueBubblesRuntimeStateIsFresh(lastCheckedAt, now = Date.now()) {
     if (!lastCheckedAt) {
         return false;
@@ -187,53 +447,189 @@ function blueBubblesRuntimeStateIsFresh(lastCheckedAt, now = Date.now()) {
     }
     return checkedAt >= now - BLUEBUBBLES_RUNTIME_FRESHNESS_WINDOW_MS;
 }
+function readBlueBubblesRuntimeJson(runtimePath) {
+    try {
+        const raw = fs.readFileSync(runtimePath, "utf-8");
+        const parsed = JSON.parse(raw);
+        /* v8 ignore start -- branches: ternary fallbacks for missing/malformed BB runtime fields @preserve */
+        return {
+            upstreamStatus: parsed.upstreamStatus === "ok" || parsed.upstreamStatus === "error"
+                ? parsed.upstreamStatus
+                : "unknown",
+            detail: typeof parsed.detail === "string" && parsed.detail.trim()
+                ? parsed.detail
+                : "startup health probe pending",
+            lastCheckedAt: typeof parsed.lastCheckedAt === "string" ? parsed.lastCheckedAt : undefined,
+            proofMethod: typeof parsed.proofMethod === "string" && parsed.proofMethod.trim()
+                ? parsed.proofMethod
+                : undefined,
+            pendingRecoveryCount: typeof parsed.pendingRecoveryCount === "number" && Number.isFinite(parsed.pendingRecoveryCount)
+                ? parsed.pendingRecoveryCount
+                : 0,
+            failedRecoveryCount: typeof parsed.failedRecoveryCount === "number" && Number.isFinite(parsed.failedRecoveryCount)
+                ? parsed.failedRecoveryCount
+                : 0,
+            oldestPendingRecoveryAt: typeof parsed.oldestPendingRecoveryAt === "string" ? parsed.oldestPendingRecoveryAt : undefined,
+            oldestPendingRecoveryAgeMs: typeof parsed.oldestPendingRecoveryAgeMs === "number" && Number.isFinite(parsed.oldestPendingRecoveryAgeMs)
+                ? parsed.oldestPendingRecoveryAgeMs
+                : undefined,
+            activeTurnCount: typeof parsed.activeTurnCount === "number" && Number.isFinite(parsed.activeTurnCount)
+                ? parsed.activeTurnCount
+                : undefined,
+            stalledTurnCount: typeof parsed.stalledTurnCount === "number" && Number.isFinite(parsed.stalledTurnCount)
+                ? parsed.stalledTurnCount
+                : undefined,
+            oldestActiveTurnStartedAt: typeof parsed.oldestActiveTurnStartedAt === "string" ? parsed.oldestActiveTurnStartedAt : undefined,
+            oldestActiveTurnAgeMs: typeof parsed.oldestActiveTurnAgeMs === "number" && Number.isFinite(parsed.oldestActiveTurnAgeMs)
+                ? parsed.oldestActiveTurnAgeMs
+                : undefined,
+        };
+        /* v8 ignore stop */
+        /* v8 ignore start -- defensive: catch for missing/corrupt BB runtime state file @preserve */
+    }
+    catch {
+        return { upstreamStatus: "unknown", detail: "startup health probe pending", pendingRecoveryCount: 0, failedRecoveryCount: 0 };
+    }
+    /* v8 ignore stop */
+}
 function readBlueBubblesRuntimeFacts(agent, bundlesRoot, snapshot) {
     const agentRoot = path.join(bundlesRoot, `${agent}.ouro`);
     const runtimePath = path.join(agentRoot, "state", "senses", "bluebubbles", "runtime.json");
     if (!fs.existsSync(runtimePath)) {
         return { runtime: snapshot?.runtime };
     }
-    const state = (0, bluebubbles_runtime_state_1.readBlueBubblesRuntimeState)(agent, agentRoot);
+    const state = readBlueBubblesRuntimeJson(runtimePath);
+    const checkedAtMs = state.lastCheckedAt ? Date.parse(state.lastCheckedAt) : Number.NaN;
+    const proofFacts = {
+        proofMethod: state.proofMethod ?? "bluebubbles.checkHealth",
+        lastProofAt: state.lastCheckedAt,
+        proofAgeMs: Number.isFinite(checkedAtMs) ? Math.max(0, Date.now() - checkedAtMs) : undefined,
+        pendingRecoveryCount: state.pendingRecoveryCount,
+        failedRecoveryCount: state.failedRecoveryCount,
+        oldestPendingRecoveryAt: state.oldestPendingRecoveryAt,
+        oldestPendingRecoveryAgeMs: state.oldestPendingRecoveryAgeMs,
+        activeTurnCount: state.activeTurnCount,
+        stalledTurnCount: state.stalledTurnCount,
+        oldestActiveTurnStartedAt: state.oldestActiveTurnStartedAt,
+        oldestActiveTurnAgeMs: state.oldestActiveTurnAgeMs,
+    };
     if (!blueBubblesRuntimeStateIsFresh(state.lastCheckedAt)) {
-        return { runtime: snapshot?.runtime };
+        return {
+            runtime: snapshot?.runtime,
+            lastFailure: state.lastCheckedAt ? "BlueBubbles proof is stale" : undefined,
+            failureLayer: state.lastCheckedAt ? "proof_freshness" : undefined,
+        };
+    }
+    if (snapshot?.runtime !== "running") {
+        return {
+            runtime: "error",
+            detail: "BlueBubbles listener is not running",
+            ...proofFacts,
+            lastFailure: "listener process is not running",
+            failureLayer: "listener",
+            recoveryAction: "daemon process manager will restart the BlueBubbles listener after an unsolicited exit",
+        };
     }
     if (state.upstreamStatus === "error") {
         return {
             runtime: "error",
             detail: state.detail,
+            ...proofFacts,
+            lastFailure: state.detail,
+            failureLayer: "upstream",
+            recoveryAction: "verify BlueBubbles server/app auth and local machine attachment, then retry the listener",
+        };
+    }
+    if (state.pendingRecoveryCount > 0) {
+        return {
+            runtime: "error",
+            detail: state.detail,
+            ...proofFacts,
+            lastFailure: state.detail,
+            failureLayer: "recovery_queue",
+            recoveryAction: "queued recovery will retry; inspect BlueBubbles inbound/recovery sidecar logs if age keeps growing",
+        };
+    }
+    if ((state.stalledTurnCount ?? 0) > 0) {
+        return {
+            runtime: "error",
+            detail: state.detail,
+            ...proofFacts,
+            lastFailure: state.detail,
+            failureLayer: "live_turn_stall",
+            recoveryAction: "live iMessage turn timeout/watchdog will release the lane and recovery will retry captured messages",
         };
     }
     if (state.upstreamStatus === "ok") {
-        return { runtime: "running" };
+        return {
+            runtime: "running",
+            ...proofFacts,
+            ...(state.failedRecoveryCount > 0 ? { detail: state.detail } : {}),
+            ...(state.failedRecoveryCount > 0 ? {
+                lastFailure: state.detail,
+                failureLayer: "recovery_quarantine",
+                recoveryAction: "inspect quarantined BlueBubbles recovery failures; live transport remains reachable",
+            } : {}),
+        };
     }
-    return { runtime: snapshot?.runtime };
+    return { runtime: snapshot?.runtime, ...proofFacts };
 }
 class DaemonSenseManager {
     processManager;
     contexts;
+    pendingConfigRefreshes = new Set();
+    configRefreshRetryTimers = new Map();
+    configRefreshRetryAttempts = new Map();
     bundlesRoot;
     constructor(options) {
         const bundlesRoot = options.bundlesRoot ?? path.join(os.homedir(), "AgentBundles");
-        const secretsRoot = options.secretsRoot ?? path.join(os.homedir(), ".agentsecrets");
         this.bundlesRoot = bundlesRoot;
         this.contexts = new Map(options.agents.map((agent) => {
-            const senses = readAgentSenses(path.join(bundlesRoot, `${agent}.ouro`, "agent.json"));
-            const facts = senseFactsFromSecrets(agent, senses, path.join(secretsRoot, agent, "secrets.json"));
-            return [agent, { senses, facts }];
+            const { senses, workbenchHasStaleBundleEntry } = readAgentSenses(path.join(bundlesRoot, `${agent}.ouro`, "agent.json"));
+            const facts = senseFactsFromRuntimeConfig(agent, senses, (0, runtime_credentials_1.readRuntimeCredentialConfig)(agent), (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent), workbenchHasStaleBundleEntry);
+            return [agent, { senses, workbenchHasStaleBundleEntry, facts }];
         }));
         const managedSenseAgents = [...this.contexts.entries()].flatMap(([agent, context]) => {
-            return ["teams", "bluebubbles"]
-                .filter((sense) => context.senses[sense].enabled && context.facts[sense].configured)
+            return ["teams", "bluebubbles", "mail", "voice", "a2a", "telegram", "shepherd"]
+                .filter((sense) => context.senses[sense].enabled)
                 .map((sense) => ({
                 name: `${agent}:${sense}`,
                 agentArg: agent,
-                entry: sense === "teams" ? "senses/teams-entry.js" : "senses/bluebubbles-entry.js",
+                entry: managedSenseEntry(sense),
                 channel: sense,
                 autoStart: true,
+                ...(sense === "a2a" ? { args: managedA2AArgs(agent), getArgs: () => managedA2AArgs(agent) } : {}),
+                getRuntimeCredentialBootstrap: () => runtimeCredentialBootstrapFor(agent, sense),
             }));
         });
         this.processManager = options.processManager ?? new process_manager_1.DaemonProcessManager({
             agents: managedSenseAgents,
+            configCheck: async (name) => {
+                const parsed = parseSenseSnapshotName(name);
+                if (!parsed)
+                    return { ok: true };
+                const context = this.contexts.get(parsed.agent);
+                if (!context)
+                    return { ok: true };
+                context.facts = senseFactsFromRuntimeConfig(parsed.agent, context.senses, (0, runtime_credentials_1.readRuntimeCredentialConfig)(parsed.agent), (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(parsed.agent), context.workbenchHasStaleBundleEntry);
+                const fact = context.facts[parsed.sense];
+                if (fact.configured)
+                    return { ok: true };
+                this.scheduleSenseConfigRefresh(name, parsed);
+                if (fact.optional) {
+                    return {
+                        ok: false,
+                        skip: true,
+                        error: `${parsed.sense} is enabled for ${parsed.agent} but not attached on this machine`,
+                    };
+                }
+                return {
+                    ok: false,
+                    skip: true,
+                    error: `${parsed.sense} is enabled for ${parsed.agent} but runtime credentials are not ready: ${fact.detail}`,
+                    fix: senseRepairHint(parsed.agent, parsed.sense),
+                };
+            },
         });
         (0, runtime_1.emitNervesEvent)({
             component: "channels",
@@ -245,12 +641,231 @@ class DaemonSenseManager {
             },
         });
     }
+    scheduleSenseConfigRefresh(name, parsed, delayMs = 0) {
+        if (this.pendingConfigRefreshes.has(name) || this.configRefreshRetryTimers.has(name))
+            return;
+        if (delayMs > 0) {
+            const timer = setTimeout(() => {
+                this.configRefreshRetryTimers.delete(name);
+                this.pendingConfigRefreshes.add(name);
+                void this.refreshSenseConfigAndRetry(name, parsed);
+            }, delayMs);
+            this.configRefreshRetryTimers.set(name, timer);
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "channels",
+                event: "channel.daemon_sense_config_retry_scheduled",
+                message: "scheduled managed sense config retry",
+                meta: {
+                    agent: parsed.agent,
+                    sense: parsed.sense,
+                    managedName: name,
+                    delayMs,
+                    attempt: this.configRefreshRetryAttempts.get(name),
+                },
+            });
+            return;
+        }
+        this.pendingConfigRefreshes.add(name);
+        void this.refreshSenseConfigAndRetry(name, parsed);
+    }
+    nextConfigRetryDelayMs(name) {
+        const attempt = (this.configRefreshRetryAttempts.get(name) ?? 0) + 1;
+        this.configRefreshRetryAttempts.set(name, attempt);
+        return SENSE_CONFIG_RETRY_DELAYS_MS[Math.min(attempt - 1, SENSE_CONFIG_RETRY_DELAYS_MS.length - 1)];
+    }
+    clearConfigRetryState(name) {
+        clearTimeout(this.configRefreshRetryTimers.get(name));
+        this.configRefreshRetryTimers.delete(name);
+        this.configRefreshRetryAttempts.delete(name);
+    }
+    shouldRetryConfigRefresh(agent, sense, runtimeConfig, machineRuntimeConfig) {
+        if (!runtimeConfig.ok && runtimeConfig.reason === "unavailable")
+            return true;
+        if (needsMachineRuntimeConfig(agent, sense) &&
+            !machineRuntimeConfig.ok &&
+            machineRuntimeConfig.reason === "unavailable")
+            return true;
+        return false;
+    }
+    async refreshSenseConfigAndRetry(name, parsed) {
+        let retryAfterMs = null;
+        try {
+            const refreshed = await (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(parsed.agent, { preserveCachedOnFailure: true });
+            const machineRefreshed = needsMachineRuntimeConfig(parsed.agent, parsed.sense)
+                ? await (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(parsed.agent, currentMachineId(), { preserveCachedOnFailure: true })
+                : (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(parsed.agent);
+            const context = this.contexts.get(parsed.agent);
+            /* v8 ignore next -- defensive: config refreshes are only scheduled for known agent contexts @preserve */
+            if (!context)
+                return;
+            context.facts = senseFactsFromRuntimeConfig(parsed.agent, context.senses, refreshed, machineRefreshed, context.workbenchHasStaleBundleEntry);
+            if (!context.facts[parsed.sense].configured) {
+                if (this.shouldRetryConfigRefresh(parsed.agent, parsed.sense, refreshed, machineRefreshed)) {
+                    retryAfterMs = this.nextConfigRetryDelayMs(name);
+                }
+                else {
+                    this.clearConfigRetryState(name);
+                }
+                return;
+            }
+            this.clearConfigRetryState(name);
+            setTimeout(() => {
+                void this.processManager.startAgent?.(name).catch((error) => {
+                    (0, runtime_1.emitNervesEvent)({
+                        level: "error",
+                        component: "channels",
+                        event: "channel.daemon_sense_autostart_error",
+                        message: "sense autostart failed",
+                        /* v8 ignore next -- defensive: process manager rejects with Error instances in normal use @preserve */
+                        meta: { error: error instanceof Error ? error.message : String(error) },
+                    });
+                });
+            }, 0);
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "error",
+                component: "channels",
+                event: "channel.daemon_sense_autostart_error",
+                message: "sense config refresh failed",
+                /* v8 ignore next -- defensive: runtime credential refresh rejects with Error instances in normal use @preserve */
+                meta: { error: error instanceof Error ? error.message : String(error) },
+            });
+        }
+        finally {
+            this.pendingConfigRefreshes.delete(name);
+            if (retryAfterMs !== null) {
+                this.scheduleSenseConfigRefresh(name, parsed, retryAfterMs);
+            }
+        }
+    }
+    async refreshEnabledSenseConfigs() {
+        const refreshes = [...this.contexts.entries()].map(async ([agent, context]) => {
+            const enabledManagedSenses = ["teams", "bluebubbles", "mail", "voice", "a2a", "telegram", "shepherd"]
+                .filter((sense) => context.senses[sense].enabled);
+            /* v8 ignore next -- periodic refresh work only exists when a managed background sense is enabled @preserve */
+            if (enabledManagedSenses.length === 0)
+                return;
+            const runtimeConfig = await (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(agent, { preserveCachedOnFailure: true });
+            const needsMachineConfig = enabledManagedSenses.some((sense) => needsMachineRuntimeConfig(agent, sense));
+            const machineRuntimeConfig = needsMachineConfig
+                ? await (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(agent, currentMachineId(), { preserveCachedOnFailure: true })
+                : (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent);
+            context.facts = senseFactsFromRuntimeConfig(agent, context.senses, runtimeConfig, machineRuntimeConfig, context.workbenchHasStaleBundleEntry);
+        });
+        await Promise.all(refreshes);
+    }
     async startAutoStartSenses() {
+        await this.refreshEnabledSenseConfigs();
         await this.processManager.startAutoStartAgents();
     }
+    triggerAutoStartSenses() {
+        void this.refreshEnabledSenseConfigs()
+            .catch((error) => {
+            (0, runtime_1.emitNervesEvent)({
+                level: "error",
+                component: "channels",
+                event: "channel.daemon_sense_autostart_error",
+                message: "sense config refresh failed",
+                meta: { error: error instanceof Error ? error.message : /* v8 ignore next -- defensive non-Error refresh rejection @preserve */ String(error) },
+            });
+        })
+            .then(() => {
+            if (this.processManager.triggerAutoStartAgents) {
+                this.processManager.triggerAutoStartAgents();
+                return;
+            }
+            void this.processManager.startAutoStartAgents().catch((error) => {
+                (0, runtime_1.emitNervesEvent)({
+                    level: "error",
+                    component: "channels",
+                    event: "channel.daemon_sense_autostart_error",
+                    message: "sense autostart failed",
+                    meta: { error: error instanceof Error ? error.message : String(error) },
+                });
+            });
+        });
+    }
     async stopAll() {
+        for (const timer of this.configRefreshRetryTimers.values()) {
+            clearTimeout(timer);
+        }
+        this.configRefreshRetryTimers.clear();
+        this.configRefreshRetryAttempts.clear();
         await this.processManager.stopAll();
     }
+    /* v8 ignore start -- pid collection for orphan cleanup pidfile @preserve */
+    listManagedPids() {
+        return this.processManager.listAgentSnapshots()
+            .map((s) => s.pid)
+            .filter((pid) => pid !== null && pid !== undefined);
+    }
+    /* v8 ignore stop */
+    listHealthProbes() {
+        const probes = [];
+        for (const [agent, context] of this.contexts.entries()) {
+            const runtimeConfig = (0, runtime_credentials_1.readRuntimeCredentialConfig)(agent);
+            const machineRuntimeConfig = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent);
+            context.facts = senseFactsFromRuntimeConfig(agent, context.senses, runtimeConfig, machineRuntimeConfig, context.workbenchHasStaleBundleEntry);
+            if (!context.senses.bluebubbles.enabled || !context.facts.bluebubbles.configured || !machineRuntimeConfig.ok) {
+                continue;
+            }
+            // DELIBERATELY no HTTP health probe for BlueBubbles.
+            //
+            // We used to register `createHttpHealthProbe(...)` here, which GETs the
+            // sense's /health endpoint every ~60s with a 5s timeout. On 2026-05-11
+            // that caused a death spiral:
+            //   1. Sense gets busy with real work (e.g. VLM image describe → 20+s)
+            //   2. /health probe times out at 5s
+            //   3. Daemon declares the sense "critical" → SIGTERMs it mid-work
+            //   4. Sense respawns, recovery loop replays the same inbound message
+            //      into the agent's BB session (visible side-effect — an affected
+            //      agent saw the same user text injected 76 times)
+            //   5. New sense hits the same VLM call, gets killed at 5s, repeat
+            //
+            // The probe was redundant supervision: dead processes are already
+            // recaptured by `processManager`'s child-process exit handler. The
+            // probe specifically caught "alive but hung" cases — but the cost
+            // (killing genuinely-busy processes and replaying messages) far
+            // outweighed the benefit. For "alive but hung" detection we now
+            // rely on the agent's own awareness: BB sense's runtime.json carries
+            // pendingRecoveryCount + lastRecoveredAt, surfaced in the agent
+            // prompt. If recovery has been wedged for too long, the agent can
+            // call `restart_runtime` itself (see alpha.598 / PR #723).
+            //
+            // The respawn-loop guard in processManager is the backstop: even if
+            // something else triggers a tight respawn cycle for any reason, the
+            // guard fires and refuses further restarts after N attempts in M
+            // minutes, so we can never re-enter the 2026-05-11 spiral.
+        }
+        return probes;
+    }
+    async restartSense(managedName) {
+        if (this.processManager.restartAgent) {
+            await this.processManager.restartAgent(managedName);
+            return;
+        }
+        await this.processManager.startAgent?.(managedName);
+    }
+    async reviveSense(agent, sense) {
+        const parsed = parseSenseSnapshotName(`${agent}:${sense}`);
+        if (!parsed)
+            return null;
+        const context = this.contexts.get(parsed.agent);
+        if (!context || !context.senses[parsed.sense].enabled)
+            return null;
+        const managedName = `${parsed.agent}:${parsed.sense}`;
+        const runtimeConfig = await (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(parsed.agent, { preserveCachedOnFailure: true });
+        const needsMachineConfig = needsMachineRuntimeConfig(parsed.agent, parsed.sense);
+        const machineRuntimeConfig = needsMachineConfig
+            ? await (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(parsed.agent, currentMachineId(), { preserveCachedOnFailure: true })
+            : (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(parsed.agent);
+        context.facts = senseFactsFromRuntimeConfig(parsed.agent, context.senses, runtimeConfig, machineRuntimeConfig, context.workbenchHasStaleBundleEntry);
+        this.processManager.resetAgentFailureState?.(managedName);
+        await this.processManager.startAgent?.(managedName);
+        return this.listSenseRows().find((row) => row.agent === parsed.agent && row.sense === parsed.sense) ?? null;
+    }
     listSenseRows() {
         const runtime = new Map();
         for (const snapshot of this.processManager.listAgentSnapshots()) {
@@ -262,16 +877,49 @@ class DaemonSenseManager {
             runtime.set(parsed.agent, current);
         }
         const rows = [...this.contexts.entries()].flatMap(([agent, context]) => {
+            context.facts = senseFactsFromRuntimeConfig(agent, context.senses, (0, runtime_credentials_1.readRuntimeCredentialConfig)(agent), (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent), context.workbenchHasStaleBundleEntry);
             const blueBubblesRuntimeFacts = readBlueBubblesRuntimeFacts(agent, this.bundlesRoot, runtime.get(agent)?.bluebubbles);
+            const blueBubblesConfigured = context.facts.bluebubbles.configured;
             const runtimeInfo = {
                 cli: { configured: true },
                 teams: {
                     configured: context.facts.teams.configured,
                     ...(runtime.get(agent)?.teams ?? {}),
                 },
-                bluebubbles: {
-                    configured: context.facts.bluebubbles.configured,
-                    ...blueBubblesRuntimeFacts,
+                bluebubbles: blueBubblesConfigured
+                    ? {
+                        configured: true,
+                        optional: context.facts.bluebubbles.optional,
+                        ...blueBubblesRuntimeFacts,
+                    }
+                    : {
+                        configured: false,
+                        optional: context.facts.bluebubbles.optional,
+                    },
+                mail: {
+                    configured: context.facts.mail.configured,
+                    ...(runtime.get(agent)?.mail ?? {}),
+                },
+                voice: {
+                    configured: context.facts.voice.configured,
+                    optional: context.facts.voice.optional,
+                    ...(runtime.get(agent)?.voice ?? {}),
+                },
+                a2a: {
+                    configured: context.facts.a2a.configured,
+                    ...(runtime.get(agent)?.a2a ?? {}),
+                },
+                telegram: {
+                    configured: context.facts.telegram.configured,
+                    ...(runtime.get(agent)?.telegram ?? {}),
+                },
+                workbench: {
+                    configured: context.facts.workbench.configured,
+                },
+                shepherd: {
+                    configured: context.facts.shepherd.configured,
+                    optional: context.facts.shepherd.optional,
+                    ...(runtime.get(agent)?.shepherd ?? {}),
                 },
             };
             const inventory = (0, sense_truth_1.getSenseInventory)({ senses: context.senses }, runtimeInfo);
@@ -283,10 +931,30 @@ class DaemonSenseManager {
                 status: entry.status,
                 detail: entry.enabled
                     ? entry.sense === "bluebubbles"
-                        ? blueBubblesRuntimeFacts.detail
-                            ?? context.facts[entry.sense].detail
+                        ? blueBubblesConfigured
+                            ? blueBubblesRuntimeFacts.detail
+                                ?? context.facts[entry.sense].detail
+                            : context.facts[entry.sense].detail
                         : context.facts[entry.sense].detail
-                    : "not enabled in agent.json",
+                    : entry.sense === "workbench"
+                        ? WORKBENCH_RUNTIME_INJECTION_DETAIL
+                        : "not enabled in agent.json",
+                ...(entry.sense === "bluebubbles" && blueBubblesConfigured ? {
+                    proofMethod: blueBubblesRuntimeFacts.proofMethod,
+                    lastProofAt: blueBubblesRuntimeFacts.lastProofAt,
+                    proofAgeMs: blueBubblesRuntimeFacts.proofAgeMs,
+                    lastFailure: blueBubblesRuntimeFacts.lastFailure,
+                    failureLayer: blueBubblesRuntimeFacts.failureLayer,
+                    recoveryAction: blueBubblesRuntimeFacts.recoveryAction,
+                    pendingRecoveryCount: blueBubblesRuntimeFacts.pendingRecoveryCount,
+                    failedRecoveryCount: blueBubblesRuntimeFacts.failedRecoveryCount,
+                    oldestPendingRecoveryAt: blueBubblesRuntimeFacts.oldestPendingRecoveryAt,
+                    oldestPendingRecoveryAgeMs: blueBubblesRuntimeFacts.oldestPendingRecoveryAgeMs,
+                    activeTurnCount: blueBubblesRuntimeFacts.activeTurnCount,
+                    stalledTurnCount: blueBubblesRuntimeFacts.stalledTurnCount,
+                    oldestActiveTurnStartedAt: blueBubblesRuntimeFacts.oldestActiveTurnStartedAt,
+                    oldestActiveTurnAgeMs: blueBubblesRuntimeFacts.oldestActiveTurnAgeMs,
+                } : {}),
             }));
         });
         (0, runtime_1.emitNervesEvent)({