@ouro.bot/cli 0.1.0-alpha.93 → 0.1.0-alpha.931

package/dist/senses/shepherd/surface.js

@@ -0,0 +1,123 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SHEPHERD_UUID = void 0;
+exports.resolveExistingLocalOwner = resolveExistingLocalOwner;
+exports.localShepherdFriendStore = localShepherdFriendStore;
+exports.machineShepherdHost = machineShepherdHost;
+exports.listShepherdTargets = listShepherdTargets;
+exports.validateShepherdTarget = validateShepherdTarget;
+exports.authorizedShepherdTargets = authorizedShepherdTargets;
+const path = __importStar(require("node:path"));
+const friends_1 = require("@ouro.bot/friends");
+const identity_1 = require("../../heart/identity");
+const runtime_credentials_1 = require("../../heart/runtime-credentials");
+const shepherd_config_1 = require("../../heart/shepherd-config");
+const tools_shepherd_1 = require("../../repertoire/tools-shepherd");
+const host_1 = require("./host");
+const runtime_1 = require("../../nerves/runtime");
+exports.SHEPHERD_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** Resolve the CLI's local identity, but forbid the resolver's first-encounter creation/promotion. */
+async function resolveExistingLocalOwner(store, username = (0, friends_1.machineOwnerUsername)()) {
+    if (!username)
+        throw new Error("local machine owner identity is unavailable");
+    let existing = await store.findByExternalId("local", username);
+    if (!existing) {
+        const matches = (store.listAll ? await store.listAll() : []).filter(friend => friend.externalIds.some(identity => identity.provider === "local" && identity.externalId.startsWith(`${username}@`)));
+        if (matches.length > 1)
+            throw new Error("local-family linking is ambiguous; authorized owner setup is required");
+        existing = matches[0] ?? null;
+    }
+    if (!existing || existing.trustLevel !== "family" || existing.admissionState === "revoked") {
+        throw new Error(`existing local-family linking is missing for OS user ${username}; authorized owner setup is required`);
+    }
+    // Snapshot lookup prevents FriendResolver from creating on a transient search failure or
+    // migrating an identity as a side effect. The same resolver/channel path still produces context.
+    const snapshot = existing;
+    const readonlyLookup = Object.create(store);
+    readonlyLookup.findByExternalId = async () => snapshot;
+    return (await new friends_1.FriendResolver(readonlyLookup, {
+        provider: "local", externalId: username, displayName: username, channel: "cli",
+    }).resolve()).friend.id;
+}
+function localShepherdFriendStore(agent) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(agent))
+        throw new Error("Shepherd requires a safe agent name");
+    return new friends_1.FileFriendStore(path.join((0, identity_1.getAgentBundlesRoot)(), `${agent}.ouro`, "friends"));
+}
+function machineShepherdHost(agent) {
+    const root = path.join((0, identity_1.getAgentBundlesRoot)(), `${agent}.ouro`);
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(agent) || !(0, tools_shepherd_1.shepherdToolsEnabled)(root)) {
+        throw new Error("agent does not have Shepherd enabled");
+    }
+    const machine = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent);
+    if (!machine.ok)
+        throw new Error("machine Shepherd connection configuration is unavailable");
+    const connection = (0, shepherd_config_1.resolveShepherdConnection)(agent, machine.config);
+    if (!connection.ok)
+        throw new Error(connection.error);
+    if (connection.connection.host !== "cmux")
+        throw new Error("the dedicated composer requires cmux stable surface UUIDs");
+    return (0, host_1.createShepherdHost)(connection.connection, { agentName: agent });
+}
+async function listShepherdTargets(host, composerTty) {
+    return (await host.list()).filter(session => session.agent && exports.SHEPHERD_UUID.test(session.id)
+        && (!composerTty || (session.tty && session.tty.replace(/^\/dev\//, "") !== composerTty.replace(/^\/dev\//, "")))).map(session => Object.freeze({
+        id: session.id,
+        host: "cmux",
+        label: [session.agent, session.cwd, session.workspaceTitle, session.title]
+            .filter(Boolean).map(part => part.replace(/[\x00-\x1f\x7f-\x9f]/g, "").slice(0, 160)).join(" / "),
+        displayLabel: [session.title, session.workspaceTitle, `${session.agent} session`, "Coding session"]
+            .map(part => (part ?? "").replace(/[\x00-\x1f\x7f-\x9f]/g, "").trim())
+            .find(part => part && !/[\\/]/.test(part) && !/[0-9a-f]{8}-[0-9a-f-]{27,}/i.test(part)).slice(0, 72),
+        selected: session.selected === true,
+    }));
+}
+async function validateShepherdTarget(host, id) {
+    if (!exports.SHEPHERD_UUID.test(id))
+        throw new Error("Shepherd session must be a stable UUID");
+    const matches = (await listShepherdTargets(host)).filter(target => target.id.toLowerCase() === id.toLowerCase());
+    if (matches.length !== 1)
+        throw new Error(`selected Shepherd terminal is unavailable: ${id}`);
+    return matches[0];
+}
+async function authorizedShepherdTargets(agent, friendId, composerTty) {
+    const owner = await resolveExistingLocalOwner(localShepherdFriendStore(agent));
+    if (owner !== friendId)
+        throw new Error("Shepherd composer requires this OS user's existing local-family identity");
+    const targets = await listShepherdTargets(machineShepherdHost(agent), composerTty);
+    (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.shepherd_targets_resolved", message: "resolved authorized independent composer targets", meta: { agent, count: targets.length } });
+    return targets;
+}

package/dist/senses/shepherd/target-binding.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertBoundShepherdTarget = assertBoundShepherdTarget;
+const runtime_1 = require("../../nerves/runtime");
+/** A composer locator is enforced at execution, not merely suggested to the model. */
+function assertBoundShepherdTarget(bound, session, host) {
+    if (!bound)
+        return;
+    if (session !== bound.id || (host !== undefined && host !== bound.host)) {
+        (0, runtime_1.emitNervesEvent)({ level: "warn", component: "senses", event: "senses.shepherd_target_refused", message: "refused a terminal operation outside the fixed composer target", meta: { host: bound.host, session: bound.id } });
+        throw new Error(`this composer is bound to ${bound.host} UUID ${bound.id}; short refs and other targets are refused`);
+    }
+}

package/dist/senses/shepherd/terminal-process.js

@@ -0,0 +1,147 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.identifyTerminalProcesses = identifyTerminalProcesses;
+const path = __importStar(require("node:path"));
+const node_util_1 = require("node:util");
+const runtime_1 = require("../../nerves/runtime");
+async function runCommand(command, args) {
+    const { execFile } = await Promise.resolve().then(() => __importStar(require("node:child_process")));
+    const exec = (0, node_util_1.promisify)(execFile);
+    const { stdout } = await exec(command, args, { timeout: 3_000, maxBuffer: 4 * 1024 * 1024 });
+    return stdout;
+}
+/** Batched process/cwd lookups; Node launchers need one additional argv snapshot, never a subprocess per surface. */
+async function identifyTerminalProcesses(ttys, run = runCommand) {
+    const result = new Map();
+    if (ttys.length === 0)
+        return result;
+    const wanted = new Set(ttys.map((tty) => tty.replace(/^\/dev\//, "")));
+    const agents = new Map();
+    const snapshots = new Map();
+    const nodeLaunchers = new Map();
+    try {
+        for (const line of (await run("ps", ["-axo", "pid=,ppid=,pgid=,tpgid=,tty=,comm="])).split("\n")) {
+            const match = line.trim().match(/^(\d+)\s+(\d+)\s+(\d+)\s+(-?\d+)\s+(\S+)\s+(.+)$/);
+            if (!match)
+                continue;
+            const [, pid, parent, group, foreground, tty, command] = match;
+            if (!wanted.has(tty) || group !== foreground)
+                continue;
+            snapshots.set(Number(pid), `${pid} ${parent} ${group} ${foreground} ${tty} ${command}`);
+            const executable = path.basename(command);
+            if (executable === "node")
+                nodeLaunchers.set(Number(pid), { parent: Number(parent), tty: tty });
+            const agent = executable === "claude" ? "Claude Code" : executable === "copilot" ? "Copilot" : executable === "codex" ? "Codex" : null;
+            if (!agent)
+                continue;
+            const candidates = agents.get(tty) ?? [];
+            candidates.push({ pid: Number(pid), parent: Number(parent), agent });
+            agents.set(tty, candidates);
+        }
+    }
+    catch (error) {
+        (0, runtime_1.emitNervesEvent)({ level: "warn", component: "senses", event: "senses.shepherd_process_lookup_error", message: "could not identify terminal foreground agents", meta: { error: String(error) } });
+        return result;
+    }
+    if (nodeLaunchers.size > 0) {
+        try {
+            for (const line of (await run("ps", ["-p", [...nodeLaunchers.keys()].join(","), "-o", "pid=,args="])).split("\n")) {
+                const match = line.trim().match(/^(\d+)\s+\S+\s+(\S+)/);
+                if (!match)
+                    continue;
+                const launcher = nodeLaunchers.get(Number(match[1]));
+                if (!launcher || !/(?:^|\/)copilot\/pkg\/[^/]+\/[^/]+\/cli-main\.js$/.test(match[2]))
+                    continue;
+                const candidates = agents.get(launcher.tty) ?? [];
+                candidates.push({ pid: Number(match[1]), parent: launcher.parent, agent: "Copilot" });
+                agents.set(launcher.tty, candidates);
+            }
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({ level: "warn", component: "senses", event: "senses.shepherd_process_lookup_error", message: "could not identify Node-hosted terminal agents", meta: { error: String(error) } });
+        }
+    }
+    const selected = new Map();
+    for (const [tty, candidates] of agents) {
+        const roots = candidates.filter((candidate) => !candidates.some((parent) => parent.pid === candidate.parent));
+        const outer = roots[0] ?? candidates[0];
+        selected.set(tty, { ...outer, unique: roots.length === 1 });
+        result.set(tty, { agent: outer.agent, cwd: null });
+    }
+    if (selected.size === 0)
+        return result;
+    try {
+        const cwdByPid = new Map();
+        let pid = 0;
+        const output = await run("lsof", ["-a", "-p", [...selected.values()].map((agent) => agent.pid).join(","), "-d", "cwd", "-Fn"]);
+        for (const line of output.split("\n")) {
+            if (line.startsWith("p"))
+                pid = Number(line.slice(1));
+            else if (line.startsWith("n") && pid)
+                cwdByPid.set(pid, line.slice(1));
+        }
+        for (const [tty, agent] of selected)
+            result.set(tty, { agent: agent.agent, cwd: cwdByPid.get(agent.pid) ?? null });
+    }
+    catch (error) {
+        (0, runtime_1.emitNervesEvent)({ level: "warn", component: "senses", event: "senses.shepherd_cwd_lookup_error", message: "could not read foreground agent folders", meta: { error: String(error) } });
+    }
+    // A fresh batched snapshot verifies the same foreground process, not just a reusable PID.
+    // Unsupported ps variants and disappearing processes leave presentation intact but no authority.
+    try {
+        const starts = new Map();
+        for (const line of (await run("ps", ["-p", [...selected.values()].map(agent => agent.pid).join(","), "-o", "pid=,ppid=,pgid=,tpgid=,tty=,lstart=,comm="])).split("\n")) {
+            const match = line.trim().match(/^(\d+)\s+(\d+)\s+(\d+)\s+(-?\d+)\s+(\S+)\s+([A-Z][a-z]{2}\s+[A-Z][a-z]{2}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}\s+\d{4})\s+(.+)$/);
+            if (!match)
+                continue;
+            const [, pid, parent, group, foreground, tty, start, command] = match;
+            if (snapshots.get(Number(pid)) !== `${pid} ${parent} ${group} ${foreground} ${tty} ${command}`)
+                continue;
+            const values = starts.get(Number(pid)) ?? [];
+            values.push(start.replace(/\s+/g, " "));
+            starts.set(Number(pid), values);
+        }
+        for (const [tty, agent] of selected) {
+            const values = starts.get(agent.pid);
+            if (agent.unique && values?.length === 1)
+                result.get(tty).instance = `${agent.pid}:${values[0]}`;
+        }
+    }
+    catch (error) {
+        (0, runtime_1.emitNervesEvent)({ level: "warn", component: "senses", event: "senses.shepherd_process_lookup_error", message: "could not verify foreground process start identity", meta: { error: String(error) } });
+    }
+    return result;
+}

package/dist/senses/shepherd-entry.js

@@ -0,0 +1,98 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const agentArgIndex = process.argv.indexOf("--agent");
+const agentName = agentArgIndex >= 0 ? process.argv[agentArgIndex + 1] : undefined;
+if (!agentName) {
+    // eslint-disable-next-line no-console -- pre-boot guard: --agent check before imports
+    console.error("Missing required --agent <name> argument.\nUsage: node dist/senses/shepherd-entry.js --agent ouroboros");
+    process.exit(1);
+}
+const runtime_logging_1 = require("../heart/daemon/runtime-logging");
+const runtime_1 = require("../nerves/runtime");
+(0, runtime_logging_1.configureDaemonRuntimeLogger)("shepherd");
+(0, runtime_1.emitNervesEvent)({
+    component: "senses",
+    event: "senses.entry_boot",
+    message: "booting Shepherd entrypoint",
+    meta: { entry: "shepherd", agentName },
+});
+Promise.resolve().then(() => __importStar(require("../heart/runtime-credentials"))).then(async ({ readMachineRuntimeCredentialConfig, refreshMachineRuntimeCredentialConfig, waitForRuntimeCredentialBootstrap }) => {
+    await waitForRuntimeCredentialBootstrap(agentName);
+    if (!readMachineRuntimeCredentialConfig(agentName).ok) {
+        const { loadOrCreateMachineIdentity } = await Promise.resolve().then(() => __importStar(require("../heart/machine-identity")));
+        await refreshMachineRuntimeCredentialConfig(agentName, loadOrCreateMachineIdentity().machineId, { preserveCachedOnFailure: true }).catch(() => undefined);
+    }
+    const { startShepherdSenseApp } = await Promise.resolve().then(() => __importStar(require("./shepherd/sense")));
+    const app = await startShepherdSenseApp({ agentName: agentName });
+    let attention;
+    if (process.platform === "darwin") {
+        const { resolveShepherdConnection } = await Promise.resolve().then(() => __importStar(require("../heart/shepherd-config")));
+        const machine = readMachineRuntimeCredentialConfig(agentName);
+        const connection = machine.ok ? resolveShepherdConnection(agentName, machine.config) : null;
+        if (connection?.ok && connection.connection.host === "cmux") {
+            const { startManagedShepherdAttention } = await Promise.resolve().then(() => __importStar(require("./shepherd/attention")));
+            const { DEFAULT_DAEMON_SOCKET_PATH } = await Promise.resolve().then(() => __importStar(require("../heart/daemon/socket-client")));
+            const { frontendSocketPathForDaemon } = await Promise.resolve().then(() => __importStar(require("../heart/frontend-socket")));
+            try {
+                attention = await startManagedShepherdAttention({ agent: agentName, socketPath: frontendSocketPathForDaemon(DEFAULT_DAEMON_SOCKET_PATH), cmuxConnection: connection.connection });
+            }
+            catch (error) {
+                (0, runtime_1.emitNervesEvent)({ level: "warn", component: "senses", event: "senses.shepherd_attention_unavailable", message: "native session attention is unavailable; Shepherd supervision remains running", meta: { agentName, error: String(error) } });
+            }
+        }
+    }
+    const shutdown = () => {
+        app.stop();
+        void (attention?.close() ?? Promise.resolve()).then(() => process.exit(0), error => {
+            (0, runtime_1.emitNervesEvent)({ level: "error", component: "senses", event: "senses.shepherd_attention_shutdown_error", message: "could not close native session attention", meta: { error: String(error) } });
+            process.exit(1);
+        });
+    };
+    process.once("SIGTERM", shutdown);
+    process.once("SIGINT", shutdown);
+})
+    .catch((error) => {
+    (0, runtime_1.emitNervesEvent)({
+        level: "error",
+        component: "senses",
+        event: "senses.entry_error",
+        message: "Shepherd entrypoint failed",
+        meta: { entry: "shepherd", agentName, error: error instanceof Error ? error.message : String(error) },
+    });
+    // eslint-disable-next-line no-console -- fatal startup guard for sense process
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+});

package/dist/senses/surface-tool.js

@@ -0,0 +1,109 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleSurface = handleSurface;
+const attention_queue_1 = require("./attention-queue");
+const runtime_1 = require("../nerves/runtime");
+async function handleSurface(input) {
+    const { content, delegationId, friendId, deliveryHint, queue, routeToFriend, advanceObligation, completePonderPacket, fulfillHeartObligation, onRouteResult, } = input;
+    // Resolve target friend
+    let targetFriendId;
+    let queueItem;
+    const matchesFriend = (item, target) => item.friendId === target || item.friendName.toLowerCase() === target.toLowerCase();
+    const inferQueueItem = (target) => {
+        if (queue.length === 0)
+            return undefined;
+        const candidates = target
+            ? queue.filter((item) => matchesFriend(item, target))
+            : queue;
+        if (candidates.length === 1)
+            return candidates[0];
+        if (candidates.length > 1) {
+            return `multiple held thoughts match ${target ?? "this surface call"} — use delegationId to choose one`;
+        }
+        return undefined;
+    };
+    if (delegationId) {
+        // Look up in attention queue
+        const found = queue.find((item) => item.id === delegationId);
+        if (!found) {
+            return `no delegation found with id ${delegationId} — check your attention queue`;
+        }
+        targetFriendId = found.friendId;
+        queueItem = found;
+    }
+    else if (friendId) {
+        const inferred = inferQueueItem(friendId);
+        if (typeof inferred === "string")
+            return inferred;
+        queueItem = inferred;
+        targetFriendId = queueItem?.friendId ?? friendId;
+    }
+    else {
+        const inferred = inferQueueItem();
+        if (typeof inferred === "string")
+            return inferred;
+        if (inferred) {
+            queueItem = inferred;
+            targetFriendId = inferred.friendId;
+        }
+        else {
+            return "specify who this thought is for — use delegationId to address a held thought, or friendId for spontaneous outreach";
+        }
+    }
+    if (queueItem?.packetId && !delegationId) {
+        return `held private return ${queueItem.id} is waiting — call surface with delegationId="${queueItem.id}" so the return is tied to the correct packet`;
+    }
+    // Route to target
+    const result = deliveryHint
+        ? await routeToFriend(targetFriendId, content, queueItem, deliveryHint)
+        : await routeToFriend(targetFriendId, content, queueItem);
+    (0, runtime_1.emitNervesEvent)({
+        event: "senses.surface_routed",
+        component: "senses",
+        message: `surface routed to ${targetFriendId}: ${result.status}`,
+        meta: {
+            targetFriendId,
+            status: result.status,
+            hasDelegationId: !!delegationId,
+            ...(result.detail ? { detail: result.detail } : {}),
+        },
+    });
+    onRouteResult?.({ targetFriendId, queueItem, result });
+    // On successful routing with delegationId:
+    // 1. Advance obligation to "returned" (disk FIRST — crash safety)
+    // 2. Dequeue from process-local queue (AFTER obligation advance)
+    if (queueItem && result.status !== "failed") {
+        if (queueItem.obligationId) {
+            advanceObligation(queueItem.obligationId, {
+                status: "returned",
+                returnedAt: Date.now(),
+                returnTarget: "surface",
+            });
+        }
+        if (completePonderPacket && queueItem.packetId) {
+            try {
+                completePonderPacket(queueItem.packetId);
+            }
+            catch {
+                // swallowed — packet completion must never break surface delivery
+            }
+        }
+        // Fulfill the heart obligation for this origin (separate from inner/mind obligation)
+        if (fulfillHeartObligation) {
+            try {
+                fulfillHeartObligation({
+                    friendId: queueItem.friendId,
+                    channel: queueItem.channel,
+                    key: queueItem.key,
+                });
+            }
+            catch {
+                // swallowed — heart obligation fulfillment must never break surface delivery
+            }
+        }
+        (0, attention_queue_1.dequeueAttentionItem)(queue, queueItem.id);
+    }
+    // Return delivery status
+    const detail = result.detail ? ` — ${result.detail}` : "";
+    return `${result.status}${detail}`;
+}

package/dist/senses/teams-entry.js

@@ -1,15 +1,75 @@
 "use strict";
-// Thin entrypoint for `npm run teams` / `node dist/senses/teams-entry.js --agent <name>`.
-// Separated from teams.ts so the Teams adapter is pure library code with clean
-// 100% test coverage -- entrypoints can't be covered by vitest since
-// require.main !== module in the test runner.
-// All config comes from the conventional ~/.agentsecrets/<agent>/secrets.json path.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
+const runtime_logging_1 = require("../heart/daemon/runtime-logging");
+const runtime_1 = require("../nerves/runtime");
 // Fail fast if --agent is missing (before any src/ code tries getAgentName())
-if (!process.argv.includes("--agent")) {
+const agentArgIndex = process.argv.indexOf("--agent");
+const agentName = agentArgIndex >= 0 ? process.argv[agentArgIndex + 1] : undefined;
+if (!agentName) {
     // eslint-disable-next-line no-console -- pre-boot guard: --agent check before imports
     console.error("Missing required --agent <name> argument.\nUsage: node dist/senses/teams-entry.js --agent ouroboros");
     process.exit(1);
 }
-const teams_1 = require("./teams");
-(0, teams_1.startTeamsApp)();
+// Without this the sense's events go to a console nobody reads: the daemon discards its output.
+(0, runtime_logging_1.configureDaemonRuntimeLogger)("teams");
+(0, runtime_1.emitNervesEvent)({
+    component: "senses",
+    event: "senses.entry_boot",
+    message: "booting Teams entrypoint",
+    meta: { entry: "teams", agentName },
+});
+Promise.resolve().then(() => __importStar(require("../heart/runtime-credentials"))).then(async ({ waitForRuntimeCredentialBootstrap, readRuntimeCredentialConfig, refreshRuntimeCredentialConfig }) => {
+    // The bot's credentials must be loaded before the listener starts: without them the Teams SDK
+    // validates no sender, and startTeamsApp refuses to start.
+    const bootstrapped = await waitForRuntimeCredentialBootstrap(agentName);
+    if (!bootstrapped && !readRuntimeCredentialConfig(agentName).ok) {
+        await refreshRuntimeCredentialConfig(agentName, { preserveCachedOnFailure: true }).catch(() => undefined);
+    }
+    const { startTeamsApp } = await Promise.resolve().then(() => __importStar(require("./teams")));
+    startTeamsApp();
+})
+    .catch((error) => {
+    (0, runtime_1.emitNervesEvent)({
+        level: "error",
+        component: "senses",
+        event: "senses.entry_error",
+        message: "Teams entrypoint failed",
+        meta: { entry: "teams", agentName, error: error instanceof Error ? error.message : String(error) },
+    });
+    // eslint-disable-next-line no-console -- fatal startup guard for sense process
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+});