@ouro.bot/cli 0.1.0-alpha.99 → 0.1.0-alpha.991

package/dist/heart/daemon/agent-discovery.js

@@ -33,12 +33,137 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isLibraryKind = isLibraryKind;
+exports.parseAgentHome = parseAgentHome;
+exports.normalizeMachineName = normalizeMachineName;
+exports.agentHomeLabel = agentHomeLabel;
+exports.readAgentHomeElsewhere = readAgentHomeElsewhere;
+exports.listAllBundleAgents = listAllBundleAgents;
 exports.listEnabledBundleAgents = listEnabledBundleAgents;
+exports.listHomeBundleAgents = listHomeBundleAgents;
+exports.readPrivateRuntimeConfig = readPrivateRuntimeConfig;
+exports.listBundleSyncRows = listBundleSyncRows;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
 const identity_1 = require("../identity");
+const machine_identity_1 = require("../machine-identity");
 const runtime_1 = require("../../nerves/runtime");
-function listEnabledBundleAgents(options = {}) {
+const sync_health_1 = require("../sync-health");
+/**
+ * True when the value is the string `"library"`. Library bundles are
+ * content-only resources — never run as agents, never appear in sync surfaces.
+ */
+function isLibraryKind(kind) {
+    return kind === "library";
+}
+function isRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function hasConfiguredVault(parsed) {
+    const vault = parsed.vault;
+    if (!isRecord(vault))
+        return false;
+    return typeof vault.email === "string" && vault.email.trim().length > 0
+        && typeof vault.serverUrl === "string" && vault.serverUrl.trim().length > 0;
+}
+function hasEnabledSync(parsed) {
+    const sync = parsed.sync;
+    return isRecord(sync) && sync.enabled === true;
+}
+function hasEnabledExternalSense(parsed) {
+    const senses = parsed.senses;
+    if (!isRecord(senses))
+        return false;
+    for (const [name, value] of Object.entries(senses)) {
+        if (name === "cli")
+            continue;
+        if (isRecord(value) && value.enabled === true)
+            return true;
+    }
+    return false;
+}
+function isManageableAgentConfig(parsed) {
+    return hasConfiguredVault(parsed)
+        || hasEnabledSync(parsed)
+        || hasEnabledExternalSense(parsed);
+}
+function nonEmptyString(value) {
+    return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+/** Parse the `home` block of agent.json; null when absent or unusable. */
+function parseAgentHome(value) {
+    if (!isRecord(value))
+        return null;
+    const machineId = nonEmptyString(value.machineId);
+    if (!machineId)
+        return null;
+    const home = {
+        machineId,
+        machineName: nonEmptyString(value.machineName) ?? machineId,
+        since: nonEmptyString(value.since) ?? "",
+    };
+    const previous = isRecord(value.previous) ? parseAgentHome(value.previous) : null;
+    if (previous)
+        home.previous = { machineId: previous.machineId, machineName: previous.machineName };
+    return home;
+}
+/** Hostnames compare without case or a trailing `.local`. */
+function normalizeMachineName(name) {
+    return name.trim().replace(/\.local$/i, "").toLowerCase();
+}
+/**
+ * How a home is shown: its name plus a short id, so two Macs that are both
+ * called "Mac" stay distinguishable.
+ */
+function agentHomeLabel(home) {
+    if (home.machineName === home.machineId)
+        return home.machineId;
+    return `${home.machineName} (${home.machineId.replace(/^machine_/, "").slice(0, 8)})`;
+}
+/**
+ * The home this bundle names when it is another machine, else null. Used by
+ * the turn pipeline to decline turns for an agent that has moved away.
+ */
+function readAgentHomeElsewhere(agentRoot, machineId = (0, machine_identity_1.readMachineIdentity)()?.machineId ?? null) {
+    if (machineId === null)
+        return null;
+    let home;
+    try {
+        home = parseAgentHome(JSON.parse(fs.readFileSync(path.join(agentRoot, "agent.json"), "utf-8")).home);
+    }
+    catch {
+        return null;
+    }
+    return home && home.machineId !== machineId ? home : null;
+}
+function stripDiscoveryMetadata(row) {
+    const publicRow = { name: row.name, enabled: row.enabled };
+    if (row.kind !== undefined)
+        publicRow.kind = row.kind;
+    if (row.managementBlockedReason !== undefined) {
+        publicRow.managementBlockedReason = row.managementBlockedReason;
+    }
+    if (row.homeState !== undefined)
+        publicRow.homeState = row.homeState;
+    if (row.home)
+        publicRow.homeMachine = agentHomeLabel(row.home);
+    if (row.homeNameMatchesThisMachine)
+        publicRow.homeNameMatchesThisMachine = true;
+    return publicRow;
+}
+/**
+ * Walk the bundles root and return one row per `<name>.ouro` directory whose
+ * `agent.json` is readable and parseable. Includes both enabled and disabled
+ * agents AND library-kind bundles — callers that need only real agents should
+ * use `listEnabledBundleAgents` (which filters both `enabled` and `kind`).
+ *
+ * Bundles whose `agent.json` is missing, malformed, or unreadable are skipped
+ * silently (they aren't real agents from the harness's perspective).
+ *
+ * Sorted alphabetically by name for stable display.
+ */
+function discoverBundleAgents(options = {}) {
     const bundlesRoot = options.bundlesRoot ?? (0, identity_1.getAgentBundlesRoot)();
     const readdirSync = options.readdirSync ?? fs.readdirSync;
     const readFileSync = options.readFileSync ?? fs.readFileSync;
@@ -63,19 +188,178 @@ function listEnabledBundleAgents(options = {}) {
         const agentName = entry.name.slice(0, -5);
         const configPath = path.join(bundlesRoot, entry.name, "agent.json");
         let enabled = true;
+        let kind;
+        let manageable = false;
+        let home = null;
         try {
             const raw = readFileSync(configPath, "utf-8");
             const parsed = JSON.parse(raw);
+            if (!isRecord(parsed))
+                continue;
             if (typeof parsed.enabled === "boolean") {
                 enabled = parsed.enabled;
             }
+            if (typeof parsed.kind === "string") {
+                kind = parsed.kind;
+            }
+            manageable = isManageableAgentConfig(parsed);
+            home = parseAgentHome(parsed.home);
         }
         catch {
             continue;
         }
+        const row = { name: agentName, enabled, manageable, home };
+        if (kind !== undefined)
+            row.kind = kind;
+        if (enabled && !isLibraryKind(kind) && !manageable) {
+            row.managementBlockedReason = "inactive scaffold: no vault locator, sync, or enabled external sense";
+        }
+        discovered.push(row);
+    }
+    if (discovered.length === 0)
+        return discovered;
+    const identity = options.machineId === undefined ? (0, machine_identity_1.readMachineIdentity)() : null;
+    const machineId = options.machineId === undefined ? identity?.machineId ?? null : options.machineId;
+    const thisMachineNames = new Set((options.hostnameAliases ?? identity?.hostnameAliases ?? []).map(normalizeMachineName));
+    const holdsAHome = machineId !== null && discovered.some((row) => row.home?.machineId === machineId);
+    for (const row of discovered) {
+        if (!row.enabled || isLibraryKind(row.kind) || !row.manageable)
+            continue;
+        if (row.home) {
+            row.homeState = row.home.machineId === machineId ? "here" : "elsewhere";
+            if (row.homeState === "elsewhere" && thisMachineNames.has(normalizeMachineName(row.home.machineName))) {
+                row.homeNameMatchesThisMachine = true;
+            }
+        }
+        else {
+            row.homeState = holdsAHome ? "unclaimed" : "fallback";
+        }
+    }
+    return discovered.sort((left, right) => left.name.localeCompare(right.name));
+}
+function listAllBundleAgents(options = {}) {
+    return discoverBundleAgents(options).map(stripDiscoveryMetadata);
+}
+/**
+ * Real agents only — excludes both disabled bundles and library-kind bundles.
+ * Library bundles (SerpentGuide, RepairGuide, …) are content-only and must
+ * never appear in spawn lists, status rollups, or sync rows.
+ */
+function listEnabledBundleAgents(options = {}) {
+    return discoverBundleAgents(options)
+        .filter((row) => row.enabled && !isLibraryKind(row.kind) && row.manageable)
+        .map((row) => row.name);
+}
+/**
+ * The agents this machine's daemon runs: enabled, manageable agents homed here,
+ * plus unclaimed agents while this machine holds no home (`fallback`).
+ */
+function listHomeBundleAgents(options = {}) {
+    return discoverBundleAgents(options)
+        .filter((row) => row.enabled && !isLibraryKind(row.kind) && row.manageable)
+        .filter((row) => row.homeState === "here" || row.homeState === "fallback")
+        .map((row) => row.name);
+}
+function readPrivateRuntimeConfig(agent, options = {}) {
+    const bundlesRoot = options.bundlesRoot ?? (0, identity_1.getAgentBundlesRoot)();
+    const readFileSync = options.readFileSync ?? fs.readFileSync;
+    const configPath = path.join(bundlesRoot, `${agent}.ouro`, "agent.json");
+    try {
+        const raw = readFileSync(configPath, "utf-8");
+        const parsed = JSON.parse(raw);
+        const privateRuntime = parsed.privateRuntime;
+        if (privateRuntime && typeof privateRuntime === "object" && !Array.isArray(privateRuntime)) {
+            return {
+                autoStart: privateRuntime.autoStart === true,
+                source: "privateRuntime",
+            };
+        }
+        return { autoStart: false, source: "default" };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "daemon",
+            event: "daemon.private_runtime_policy_read_failed",
+            message: "failed to read private-runtime auto-start policy; refusing autonomous private-runtime start",
+            meta: {
+                agent,
+                configPath,
+                error: message,
+            },
+        });
+        return { autoStart: false, source: "unreadable", error: message };
+    }
+}
+/**
+ * Read the per-agent sync block from each enabled bundle's agent.json.
+ * Used by the daemon (and stopped-state status renderer) to build per-agent
+ * sync rows without depending on argv-derived global identity. Bundles that
+ * cannot be read are skipped silently.
+ *
+ * For rows with sync enabled, also checks whether the bundle is a git repo
+ * (via .git directory presence) and resolves the remote URL via
+ * `git remote get-url <remote>`. On any error the URL is left undefined and
+ * the status renderer falls back to "local only" or "not a git repo".
+ */
+function listBundleSyncRows(options = {}) {
+    const bundlesRoot = options.bundlesRoot ?? (0, identity_1.getAgentBundlesRoot)();
+    const readFileSync = options.readFileSync ?? fs.readFileSync;
+    const execFileSync = options.execFileSync ?? child_process_1.execFileSync;
+    const existsSync = options.existsSync ?? fs.existsSync;
+    const agents = listEnabledBundleAgents(options);
+    const rows = [];
+    for (const agent of agents) {
+        const bundleRoot = path.join(bundlesRoot, `${agent}.ouro`);
+        const configPath = path.join(bundleRoot, "agent.json");
+        let enabled = false;
+        let remote = "origin";
+        let branch = "main";
+        try {
+            const raw = readFileSync(configPath, "utf-8");
+            const parsed = JSON.parse(raw);
+            if (parsed.sync && typeof parsed.sync === "object") {
+                if (typeof parsed.sync.enabled === "boolean")
+                    enabled = parsed.sync.enabled;
+                if (typeof parsed.sync.remote === "string" && parsed.sync.remote.length > 0) {
+                    remote = parsed.sync.remote;
+                }
+                if (typeof parsed.sync.branch === "string" && parsed.sync.branch.length > 0) {
+                    branch = parsed.sync.branch;
+                }
+            }
+        }
+        catch {
+            // Best-effort: bundle without readable config still gets a row with defaults
+        }
+        const row = { agent, enabled, remote, branch };
         if (enabled) {
-            discovered.push(agentName);
+            // Only meaningful when sync is enabled — we don't care about disabled bundles'
+            // git state. Check .git presence before attempting any git invocation.
+            const gitInitialized = existsSync(path.join(bundleRoot, ".git"));
+            row.gitInitialized = gitInitialized;
+            if (gitInitialized) {
+                try {
+                    const out = execFileSync("git", ["remote", "get-url", remote], {
+                        cwd: bundleRoot,
+                        stdio: "pipe",
+                        timeout: 5000,
+                    }).toString().trim();
+                    if (out.length > 0)
+                        row.remoteUrl = out;
+                }
+                catch {
+                    // No remote configured or git missing — leave remoteUrl undefined.
+                }
+                const health = (0, sync_health_1.readBundleSyncHealth)(bundleRoot, { readFileSync });
+                if (health.failure)
+                    row.failure = health.failure;
+                if (health.skippedFiles.length > 0)
+                    row.skippedFiles = health.skippedFiles;
+            }
         }
+        rows.push(row);
     }
-    return discovered.sort((left, right) => left.localeCompare(right));
+    return rows;
 }

package/dist/heart/daemon/agent-home.js

@@ -0,0 +1,355 @@
+"use strict";
+/**
+ * Home-machine leases: each agent runs on exactly one machine.
+ *
+ * The lease lives in the bundle's synced agent.json as `home`, naming the
+ * machine (by its stable `~/.ouro-cli/machine.json` id) that runs the agent.
+ * Agent discovery reads it (see `AgentHomeState` in agent-discovery.ts); this
+ * module writes it (`ouro move <agent> here`) and checks a running daemon
+ * against it.
+ *
+ * A move is a compare-and-swap on the bundle's remote. It runs under the
+ * bundle sync lock, honours a sync pause, and names `<remote>` and
+ * `sync.branch` explicitly (never `@{u}`). It starts only from a bundle that
+ * is exactly at `<remote>/<branch>` (nothing unpushed, agent.json clean),
+ * commits only agent.json and pushes `HEAD:<branch>`. A fast-forward push
+ * succeeds only if nobody pushed in between. When the push is refused, the
+ * move is undone; if the remote's lease changed meanwhile, another machine won
+ * and the move stops, otherwise it is retried once on the new remote state.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.machineDisplayName = machineDisplayName;
+exports.moveAgentHomeHere = moveAgentHomeHere;
+exports.readUpstreamAgentHome = readUpstreamAgentHome;
+exports.checkAgentHomes = checkAgentHomes;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const runtime_1 = require("../../nerves/runtime");
+const sync_1 = require("../sync");
+const agent_discovery_1 = require("./agent-discovery");
+const SYNC_NETWORK = {
+    fetch: (agentRoot, config) => (0, sync_1.fetchRemote)(agentRoot, config),
+    push: (agentRoot, config) => (0, sync_1.pushHeadToBranch)(agentRoot, config),
+};
+const MOVE_ATTEMPTS = 2;
+const MOVE_LOCK_WAIT_MS = 10_000;
+function readSyncSettings(parsed) {
+    const sync = parsed.sync;
+    return {
+        enabled: sync?.enabled === true,
+        remote: typeof sync?.remote === "string" && sync.remote.trim() ? sync.remote : "origin",
+        branch: typeof sync?.branch === "string" && sync.branch.trim() ? sync.branch : "main",
+    };
+}
+function errorText(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function sameHome(left, right) {
+    return (left?.machineId ?? null) === (right?.machineId ?? null);
+}
+/** A readable machine name for a lease: the hostname without `.local`, or the id. */
+function machineDisplayName(hostname, machineId) {
+    return hostname.trim().replace(/\.local$/, "") || machineId;
+}
+/** The last push failure the bundle sync recorded, if any. */
+function recordedPushError(agentRoot) {
+    try {
+        const record = JSON.parse(fs.readFileSync(path.join(agentRoot, "state", "pending-sync.json"), "utf-8"));
+        return typeof record.error === "string" && record.error.trim() ? record.error.trim() : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Record this machine as the agent's home in its synced agent.json. */
+async function moveAgentHomeHere(options) {
+    const { agent, machineId, machineName } = options;
+    const agentRoot = path.join(options.bundlesRoot, `${agent}.ouro`);
+    const configPath = path.join(agentRoot, "agent.json");
+    const git = options.execFileSync ?? child_process_1.execFileSync;
+    const network = options.network ?? SYNC_NETWORK;
+    const now = options.now ?? (() => new Date());
+    const run = (args) => git("git", args, { cwd: agentRoot, stdio: "pipe", timeout: 30_000 }).toString().trim();
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.agent_home_move_start",
+        message: "moving agent home to this machine",
+        meta: { agent, machineId },
+    });
+    const finish = (result) => {
+        (0, runtime_1.emitNervesEvent)({
+            level: result.ok ? "info" : "warn",
+            component: "daemon",
+            event: result.ok ? "daemon.agent_home_move_end" : "daemon.agent_home_move_error",
+            message: result.message,
+            meta: { agent, machineId, changed: result.changed },
+        });
+        return result;
+    };
+    const refuse = (message) => finish({ ok: false, changed: false, message });
+    const readConfig = () => {
+        const text = fs.readFileSync(configPath, "utf-8");
+        return { text, parsed: JSON.parse(text) };
+    };
+    const writeHome = (parsed, current) => {
+        const home = { machineId, machineName, since: now().toISOString() };
+        if (current)
+            home.previous = { machineId: current.machineId, machineName: current.machineName };
+        fs.writeFileSync(configPath, `${JSON.stringify({ ...parsed, home }, null, 2)}\n`, "utf-8");
+    };
+    const movedMessage = (current) => `${agent} now lives on ${(0, agent_discovery_1.agentHomeLabel)({ machineId, machineName })}${current ? ` (moved from ${(0, agent_discovery_1.agentHomeLabel)(current)})` : ""}`;
+    let config;
+    try {
+        config = readConfig();
+    }
+    catch (error) {
+        return refuse(`cannot read ${configPath}: ${errorText(error)}`);
+    }
+    const sync = readSyncSettings(config.parsed);
+    const hasGit = fs.existsSync(path.join(agentRoot, ".git"));
+    if (!sync.enabled || !hasGit) {
+        const current = (0, agent_discovery_1.parseAgentHome)(config.parsed.home);
+        if (current?.machineId === machineId) {
+            return finish({ ok: true, changed: false, message: `${agent} already lives on this machine (${(0, agent_discovery_1.agentHomeLabel)(current)})` });
+        }
+        writeHome(config.parsed, current);
+        const why = sync.enabled ? "the bundle is not a git repo" : "bundle sync is off";
+        return finish({ ok: true, changed: true, message: `${movedMessage(current)}; ${why}, so only this machine sees the change` });
+    }
+    const pausedRefusal = (until) => refuse(`${agent}'s bundle sync is paused until ${until}, so nothing changed; run \`ouro move ${agent} here\` again after that`);
+    const pausedUntil = (0, sync_1.syncPausedUntil)(agentRoot);
+    if (pausedUntil !== null)
+        return pausedRefusal(pausedUntil);
+    const lock = await (0, sync_1.holdSyncLock)(agentRoot, options.lockWaitMs ?? MOVE_LOCK_WAIT_MS);
+    if ("busy" in lock) {
+        return refuse(`another bundle sync holds ${agent}'s lock${lock.holderPid === null ? "" : ` (pid ${lock.holderPid})`}, so nothing changed; try again in a moment`);
+    }
+    try {
+        // A pause can begin while this move waited for the lock (the replay gate
+        // pauses, then takes the lock), so look again now that the lock is ours.
+        const pausedNow = (0, sync_1.syncPausedUntil)(agentRoot);
+        if (pausedNow !== null)
+            return pausedRefusal(pausedNow);
+        if (run(["status", "--porcelain", "--", "agent.json"]).length > 0) {
+            return refuse(`${agent}'s agent.json has uncommitted changes, so nothing changed; commit or discard them first (git -C ${agentRoot} diff agent.json)`);
+        }
+        const hasRemote = run(["remote"]).split("\n").includes(sync.remote);
+        const tracking = (0, sync_1.syncTrackingRef)(sync);
+        let seen = null;
+        let lastPushError = "";
+        for (let attempt = 1; attempt <= MOVE_ATTEMPTS; attempt++) {
+            if (hasRemote) {
+                const fetched = await network.fetch(agentRoot, sync);
+                if (!fetched.ok) {
+                    return refuse(`could not reach ${agent}'s bundle remote, so nothing changed: ${fetched.error}`);
+                }
+                try {
+                    run(["rev-parse", "--verify", "-q", tracking]);
+                }
+                catch {
+                    return refuse(`${agent}'s bundle remote has no ${sync.branch} branch to publish the move to, so nothing changed`);
+                }
+                const unpushed = Number(run(["rev-list", "--count", `${tracking}..HEAD`]));
+                if (unpushed > 0) {
+                    const recorded = recordedPushError(agentRoot);
+                    const why = recorded ? `the last bundle push failed with: ${recorded}` : `run \`ouro sync --agent ${agent}\` to see why they did not publish`;
+                    return refuse(`${agent}'s bundle has ${unpushed} unpushed commit${unpushed === 1 ? "" : "s"}, so nothing changed; fix bundle sync first, because a move must not publish them as a side effect (${why})`);
+                }
+                try {
+                    run(["merge", "--ff-only", "-q", tracking]);
+                }
+                catch (error) {
+                    return refuse(`could not bring ${agent}'s bundle up to date with its remote, so nothing changed: ${errorText(error)}`);
+                }
+                config = readConfig();
+            }
+            const current = (0, agent_discovery_1.parseAgentHome)(config.parsed.home);
+            if (attempt === 1) {
+                seen = current;
+            }
+            else if (!sameHome(current, seen)) {
+                const winner = current ? (0, agent_discovery_1.agentHomeLabel)(current) : "no machine";
+                return refuse(`another machine changed ${agent}'s home while this move was being published (it now names ${winner}), so this move was undone; run \`ouro move ${agent} here\` again to take it over`);
+            }
+            if (current?.machineId === machineId) {
+                return finish({ ok: true, changed: false, message: `${agent} already lives on this machine (${(0, agent_discovery_1.agentHomeLabel)(current)})` });
+            }
+            writeHome(config.parsed, current);
+            try {
+                run(["-c", `user.name=${agent}`, "-c", `user.email=${agent}@ouro.local`, "commit", "-q", "-m", `home: ${agent} moves to ${machineName}`, "--", "agent.json"]);
+            }
+            catch (error) {
+                fs.writeFileSync(configPath, config.text, "utf-8");
+                return refuse(`could not commit the move, so nothing changed: ${errorText(error)}`);
+            }
+            if (!hasRemote) {
+                return finish({ ok: true, changed: true, message: `${movedMessage(current)}; the bundle has no remote, so only this machine sees the change` });
+            }
+            const pushed = await network.push(agentRoot, sync);
+            if (pushed.ok)
+                return finish({ ok: true, changed: true, message: movedMessage(current) });
+            lastPushError = pushed.error ?? "push failed";
+            // Undo exactly our own commit; the working tree goes back to the
+            // pre-move agent.json. If even that fails, say what to run by hand.
+            try {
+                run(["reset", "-q", "--soft", "HEAD~1"]);
+                run(["reset", "-q", "HEAD", "--", "agent.json"]);
+                fs.writeFileSync(configPath, config.text, "utf-8");
+            }
+            catch (error) {
+                return refuse(`the move could not be pushed (${lastPushError}) and its local commit could not be undone (${errorText(error)}); run \`git -C ${agentRoot} reset --soft HEAD~1\` and restore agent.json`);
+            }
+        }
+        return refuse(`could not push the move, so nothing changed: ${lastPushError}`);
+    }
+    catch (error) {
+        return refuse(`could not move ${agent}, so nothing changed: ${errorText(error)}`);
+    }
+    finally {
+        lock.release();
+    }
+}
+function execGit(cwd, args) {
+    return new Promise((resolve, reject) => {
+        (0, child_process_1.execFile)("git", args, { cwd, timeout: 20_000 }, (error, stdout) => {
+            if (error)
+                reject(error);
+            else
+                resolve(String(stdout));
+        });
+    });
+}
+/**
+ * Fetch `<remote>/<sync.branch>` (without touching the working tree) and read
+ * the lease in the remote's agent.json, so a machine notices a move away from
+ * it even while the agent is idle and never pulls. Fetch only, under the sync
+ * lock without waiting: a busy lock or a sync pause skips this check (unknown).
+ * It never commits or pushes.
+ */
+async function readUpstreamAgentHome(agentRoot, git = execGit) {
+    try {
+        const sync = readSyncSettings(JSON.parse(fs.readFileSync(path.join(agentRoot, "agent.json"), "utf-8")));
+        if (!sync.enabled || !fs.existsSync(path.join(agentRoot, ".git")))
+            return undefined;
+        if ((0, sync_1.syncPausedUntil)(agentRoot) !== null)
+            return undefined;
+        const lock = await (0, sync_1.holdSyncLock)(agentRoot, 0);
+        if ("busy" in lock)
+            return undefined;
+        try {
+            const fetched = await (0, sync_1.fetchRemote)(agentRoot, sync);
+            if (!fetched.ok)
+                return undefined;
+            const upstream = JSON.parse(await git(agentRoot, ["show", `${(0, sync_1.syncTrackingRef)(sync)}:agent.json`]));
+            return (0, agent_discovery_1.parseAgentHome)(upstream.home);
+        }
+        finally {
+            lock.release();
+        }
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Compare the agents a running daemon manages with their leases, both on disk
+ * and upstream. Running an agent homed elsewhere is a lease conflict: it is
+ * reported as critical and listed in `displaced` so the daemon stops it.
+ */
+async function checkAgentHomes(options) {
+    const rows = (0, agent_discovery_1.listAllBundleAgents)({
+        bundlesRoot: options.bundlesRoot,
+        machineId: options.machineId,
+        hostnameAliases: options.hostnameAliases ?? [],
+    });
+    const managed = new Set(options.managedAgents);
+    const readUpstreamHome = options.readUpstreamHome ?? readUpstreamAgentHome;
+    const conflicts = [];
+    const runningUnclaimed = [];
+    for (const row of rows) {
+        if (!managed.has(row.name))
+            continue;
+        if (row.homeState === "elsewhere") {
+            conflicts.push({ name: row.name, where: `homed on ${row.homeMachine}` });
+            continue;
+        }
+        if (row.homeState === "unclaimed") {
+            conflicts.push({ name: row.name, where: "not homed here, and this machine runs only its own agents" });
+            continue;
+        }
+        if (row.homeState === "fallback")
+            runningUnclaimed.push(row.name);
+    }
+    for (const name of options.managedAgents) {
+        if (conflicts.some((conflict) => conflict.name === name))
+            continue;
+        const row = rows.find((candidate) => candidate.name === name);
+        if (!row || (row.homeState !== "here" && row.homeState !== "fallback"))
+            continue;
+        const upstream = await readUpstreamHome(path.join(options.bundlesRoot, `${name}.ouro`));
+        if (upstream && upstream.machineId !== options.machineId) {
+            conflicts.push({ name, where: `moved to ${(0, agent_discovery_1.agentHomeLabel)(upstream)} upstream` });
+        }
+    }
+    const waiting = rows.filter((row) => !managed.has(row.name) && row.homeState === "here" && !row.managementBlockedReason);
+    const lookalikes = rows.filter((row) => row.homeNameMatchesThisMachine && row.homeState === "elsewhere");
+    const parts = [];
+    if (conflicts.length > 0) {
+        parts.push(`lease conflict: stopped ${conflicts.map((conflict) => `${conflict.name} (${conflict.where})`).join(", ")} on this machine`);
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "daemon",
+            event: "daemon.agent_home_conflict",
+            message: "daemon was running an agent homed on another machine; stopping it here",
+            meta: { agents: conflicts.map((conflict) => conflict.name), reasons: conflicts.map((conflict) => conflict.where) },
+        });
+    }
+    if (waiting.length > 0) {
+        parts.push(`homed here but not running: ${waiting.map((row) => row.name).join(", ")}; run \`ouro up\` to start`);
+    }
+    if (runningUnclaimed.length > 0) {
+        parts.push(`running without a home, so another machine may run ${runningUnclaimed.length === 1 ? "it" : "them"} too: ${runningUnclaimed.join(", ")}; claim with \`ouro move <agent> here\``);
+    }
+    for (const row of lookalikes) {
+        parts.push(`${row.name} is homed on ${row.homeMachine}, which has this machine's name but a different id; if this machine's identity was replaced, run \`ouro move ${row.name} here\``);
+    }
+    const displaced = conflicts.map((conflict) => conflict.name);
+    if (parts.length === 0) {
+        return { health: { name: "agent-home", status: "ok", message: "every running agent is homed here" }, displaced };
+    }
+    return { health: { name: "agent-home", status: conflicts.length > 0 ? "critical" : "warn", message: parts.join("; ") }, displaced };
+}