@telora/daemon 0.21.26 → 0.21.82

package/dist/shell/circuit-wedge-watcher.js

@@ -0,0 +1,94 @@
+/**
+ * Wedged-circuit watcher (Daemon Resilience Hardening, injection #13).
+ *
+ * Periodically inspects the control-plane circuit breakers and, when one has
+ * been held open past a threshold, emits an error-severity health event naming
+ * the wedged circuit. Without this signal the daemon can sit silently idle --
+ * exactly the 2026-05-28 incident, where a control-plane circuit stayed open
+ * ~2h and no team could spawn, with nothing surfacing the cause to the operator.
+ *
+ * Open-duration is tracked here (by sampling getState()) rather than inside the
+ * breaker, so the watcher depends only on the already-published CircuitBreaker
+ * surface and all new logic lives in the daemon package.
+ */
+import { healthEvents, safeInterval } from '@telora/daemon-core';
+import { getApiCircuitBreakers, CONCERN_CLASS } from '../queries/shared.js';
+/** Default: a control-plane circuit open continuously this long is "wedged". */
+const DEFAULT_WEDGE_THRESHOLD_MS = 120_000;
+/** Default polling cadence for the watcher. */
+const DEFAULT_CHECK_INTERVAL_MS = 30_000;
+export function createWedgeTracking() {
+    return { openSince: new Map(), reported: new Set() };
+}
+/**
+ * Inspect control-plane breakers and return the concerns NEWLY detected as
+ * wedged (open continuously >= thresholdMs and not yet reported this episode).
+ *
+ * Pure with respect to `now` (injectable clock) and `tracking` (caller-owned
+ * state), so it is unit-testable with a simulated clock and a real
+ * CircuitBreaker. Fires once per wedge episode; a recovery (breaker closes)
+ * clears the tracking so a later wedge re-fires.
+ */
+export function detectWedgedControlPlaneCircuits(breakers, concernClass, thresholdMs, tracking, now = Date.now()) {
+    const newlyWedged = [];
+    for (const [concern, breaker] of Object.entries(breakers)) {
+        if (concernClass[concern] !== 'control-plane')
+            continue;
+        const isOpen = breaker.getState() !== 'closed';
+        if (!isOpen) {
+            // Recovered (or never open): end the episode so a future wedge re-fires.
+            tracking.openSince.delete(concern);
+            tracking.reported.delete(concern);
+            continue;
+        }
+        if (!tracking.openSince.has(concern)) {
+            tracking.openSince.set(concern, now);
+        }
+        const openSince = tracking.openSince.get(concern) ?? now;
+        if (now - openSince >= thresholdMs && !tracking.reported.has(concern)) {
+            tracking.reported.add(concern);
+            newlyWedged.push(concern);
+        }
+    }
+    return newlyWedged;
+}
+/**
+ * Emit an error-severity health event for each newly-wedged concern. The event
+ * flows into heartbeat metadata for dashboard visibility (the operator signal).
+ */
+export function emitWedgedCircuitHealthEvents(concerns) {
+    for (const concern of concerns) {
+        healthEvents.emit({
+            severity: 'error',
+            source: `circuit:${concern}`,
+            code: 'circuit.wedged',
+            message: `Control-plane circuit '${concern}' has been open past the wedge threshold; ` +
+                `control-plane actions (e.g. session creation) are blocked. Investigate the ` +
+                `upstream failure or force-close all breakers (SIGUSR2).`,
+        });
+    }
+}
+let tracking = createWedgeTracking();
+let timer = null;
+/**
+ * Start the periodic wedged-circuit watcher. Idempotent-ish: a prior timer is
+ * cleared first. The interval body is wrapped by safeInterval so a throw cannot
+ * crash the process.
+ */
+export function startCircuitWedgeWatcher(opts) {
+    const thresholdMs = opts?.thresholdMs ?? DEFAULT_WEDGE_THRESHOLD_MS;
+    const intervalMs = opts?.intervalMs ?? DEFAULT_CHECK_INTERVAL_MS;
+    stopCircuitWedgeWatcher();
+    tracking = createWedgeTracking();
+    timer = safeInterval(() => {
+        const wedged = detectWedgedControlPlaneCircuits(getApiCircuitBreakers(), CONCERN_CLASS, thresholdMs, tracking);
+        emitWedgedCircuitHealthEvents(wedged);
+    }, intervalMs, 'circuit-wedge-watcher');
+}
+export function stopCircuitWedgeWatcher() {
+    if (timer) {
+        clearInterval(timer);
+        timer = null;
+    }
+}
+//# sourceMappingURL=circuit-wedge-watcher.js.map

package/dist/shell/circuit-wedge-watcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"circuit-wedge-watcher.js","sourceRoot":"","sources":["../../src/shell/circuit-wedge-watcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAqB,MAAM,sBAAsB,CAAC;AAE/F,gFAAgF;AAChF,MAAM,0BAA0B,GAAG,OAAO,CAAC;AAC3C,+CAA+C;AAC/C,MAAM,yBAAyB,GAAG,MAAM,CAAC;AASzC,MAAM,UAAU,mBAAmB;IACjC,OAAO,EAAE,SAAS,EAAE,IAAI,GAAG,EAAkB,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAU,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gCAAgC,CAC9C,QAAwC,EACxC,YAA0C,EAC1C,WAAmB,EACnB,QAAuB,EACvB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1D,IAAI,YAAY,CAAC,OAAO,CAAC,KAAK,eAAe;YAAE,SAAS;QAExD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,KAAK,QAAQ,CAAC;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,yEAAyE;YACzE,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACnC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAClC,SAAS;QACX,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC;QACzD,IAAI,GAAG,GAAG,SAAS,IAAI,WAAW,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACtE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC/B,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAkB;IAC9D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,YAAY,CAAC,IAAI,CAAC;YAChB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,WAAW,OAAO,EAAE;YAC5B,IAAI,EAAE,gBAAgB;YACtB,OAAO,EACL,0BAA0B,OAAO,4CAA4C;gBAC7E,6EAA6E;gBAC7E,yDAAyD;SAC5D,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,IAAI,QAAQ,GAAG,mBAAmB,EAAE,CAAC;AACrC,IAAI,KAAK,GAA0C,IAAI,CAAC;AAExD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAoD;IAC3F,MAAM,WAAW,GAAG,IAAI,EAAE,WAAW,IAAI,0BAA0B,CAAC;IACpE,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,IAAI,yBAAyB,CAAC;IACjE,uBAAuB,EAAE,CAAC;IAC1B,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACjC,KAAK,GAAG,YAAY,CAClB,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,gCAAgC,CAC7C,qBAAqB,EAAE,EACvB,aAAa,EACb,WAAW,EACX,QAAQ,CACT,CAAC;QACF,6BAA6B,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC,EACD,UAAU,EACV,uBAAuB,CACxB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,IAAI,KAAK,EAAE,CAAC;QACV,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/shell/config-hot-reload.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Pure classification + planning for SIGHUP config hot-reload.
+ *
+ * The SIGHUP hot-reload seam historically reconciled ONLY the products array
+ * (unified-engine-lifecycle.ts). This module generalizes it: given the live
+ * resolved engine config and a freshly-resolved config from the edited
+ * daemon.json, it classifies each changed field into one of three buckets --
+ *
+ *   - LIVE-APPLICABLE scalar: a pure-policy value (loop/verification-adjacent
+ *     thresholds, token/cost limits, log retention, policyFailureMode,
+ *     maxTotalSessions) that is safe to apply to a running fleet with no
+ *     team killed. Applied by mutating the shared engine config object in
+ *     place so the next tick/spawn reads the new value, plus the
+ *     ResourceGovernor session-cap setters for maxTotalSessions.
+ *   - RESTART-REQUIRED: an identity field (teloraUrl/trackerId/organizationId/
+ *     productId) or a bound-resource field (a path, a bound port, a boot-time
+ *     resource) that cannot change under a live process -- surfaced as a
+ *     "restart required" warning, exactly as products-only hot-reload already
+ *     warns for identity changes.
+ *   - Lacuna sidecar: a transition (start / stop / restart / unchanged) derived
+ *     from the enabled flag and the bound host/port/source, applied by the
+ *     lifecycle start/stop helpers (which never touch a running team).
+ *
+ * Everything here is PURE and side-effect-free: it computes a plan. The apply
+ * (process/IO) lives in unified-engine-lifecycle.ts so this layer stays
+ * unit-testable without a live daemon or SIGHUP.
+ */
+import type { LacunaConfig } from '../types/index.js';
+/**
+ * The live-applicable scalar fields of the resolved engine config. These are
+ * pure-policy values with no bound OS resource behind them; applying a new
+ * value to the running config object is non-disruptive to in-flight teams.
+ *
+ * `maxTotalSessions` is special-cased downstream: besides the in-place config
+ * mutation it drives the ResourceGovernor per-engine limit (setEngineLimit),
+ * which is the authoritative concurrency cap the listener gates spawns on.
+ */
+export declare const LIVE_APPLICABLE_SCALARS: readonly ["maxTotalSessions", "tokenLimit", "costLimit", "mergeLockTimeoutMs", "mergeLockContentionWarningMs", "policyFailureMode", "logMaxAgeDays", "logMaxTotalBytes", "logMaxFiles"];
+export type LiveApplicableScalar = (typeof LIVE_APPLICABLE_SCALARS)[number];
+/**
+ * Fields that CANNOT be applied to a running process. Identity fields re-bind
+ * the daemon's connection; bound-resource fields (paths resolved at boot, the
+ * OTLP telemetry port, the git worktree root, the integration branch) are
+ * captured by long-lived handles. A change here is surfaced as a warning so the
+ * operator knows a restart is needed -- never silently ignored, never applied.
+ */
+export declare const RESTART_REQUIRED_FIELDS: readonly ["teloraUrl", "trackerId", "organizationId", "productId", "repoPath", "worktreeDir", "integrationBranch", "logDir", "claudeCodePath", "sessionTimeoutMs"];
+export type RestartRequiredField = (typeof RESTART_REQUIRED_FIELDS)[number];
+/** A single changed field, old -> new, for logging. */
+export interface FieldChange {
+    field: string;
+    oldValue: unknown;
+    newValue: unknown;
+}
+/** The computed apply plan for a scalar/identity diff. */
+export interface ConfigChangePlan {
+    /** Live-applicable scalar changes, keyed by field, carrying the new value. */
+    liveScalars: FieldChange[];
+    /** Changes that require a restart (identity / bound-resource). */
+    restartRequired: FieldChange[];
+    /** True when maxTotalSessions changed -- the caller drives the governor cap. */
+    sessionCapChanged: boolean;
+    /** The new maxTotalSessions when it changed (else null). */
+    newMaxTotalSessions: number | null;
+}
+/** Shape this module reads from a resolved engine config. Loose by design. */
+export type ResolvedConfigLike = Record<string, unknown>;
+/**
+ * Classify the scalar/identity diff between the live engine config and a
+ * freshly-resolved config from the edited daemon.json. Pure: reads only the
+ * two objects, returns a plan. Products and lacuna are handled by their own
+ * dedicated paths and are intentionally NOT classified here.
+ */
+export declare function classifyConfigChanges(live: ResolvedConfigLike, next: ResolvedConfigLike): ConfigChangePlan;
+/**
+ * The Lacuna sidecar lifecycle transition implied by an old -> new config.
+ *
+ * - `start`     -- was disabled, now enabled: launch the sidecar.
+ * - `stop`      -- was enabled, now disabled: tear the sidecar down.
+ * - `restart`   -- stays enabled but a BOUND field (host/port/source/upstream/
+ *                  readyTimeout/compress) changed: stop then start so the new
+ *                  binding takes effect. Fail-open by construction downstream.
+ * - `unchanged` -- no lifecycle action needed (still disabled, or enabled with
+ *                  no bound-field change).
+ */
+export type LacunaTransition = 'start' | 'stop' | 'restart' | 'unchanged';
+/**
+ * Compute the sidecar transition from old vs new lacuna config. Pure.
+ */
+export declare function computeLacunaTransition(oldLacuna: LacunaConfig, newLacuna: LacunaConfig): LacunaTransition;
+//# sourceMappingURL=config-hot-reload.d.ts.map

package/dist/shell/config-hot-reload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-hot-reload.d.ts","sourceRoot":"","sources":["../../src/shell/config-hot-reload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,yLAU1B,CAAC;AAEX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5E;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,oKAa1B,CAAC;AAEX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5E,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,8EAA8E;IAC9E,WAAW,EAAE,WAAW,EAAE,CAAC;IAC3B,kEAAkE;IAClE,eAAe,EAAE,WAAW,EAAE,CAAC;IAC/B,gFAAgF;IAChF,iBAAiB,EAAE,OAAO,CAAC;IAC3B,4DAA4D;IAC5D,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,8EAA8E;AAC9E,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEzD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE,kBAAkB,GACvB,gBAAgB,CA2BlB;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,WAAW,CAAC;AAc1E;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,YAAY,EACvB,SAAS,EAAE,YAAY,GACtB,gBAAgB,CAOlB"}

package/dist/shell/config-hot-reload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-hot-reload.js","sourceRoot":"","sources":["../../src/shell/config-hot-reload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,kBAAkB;IAClB,YAAY;IACZ,WAAW;IACX,oBAAoB;IACpB,8BAA8B;IAC9B,mBAAmB;IACnB,eAAe;IACf,kBAAkB;IAClB,aAAa;CACL,CAAC;AAIX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,WAAW;IACX,WAAW;IACX,WAAW;IACX,gBAAgB;IAChB,WAAW;IACX,iBAAiB;IACjB,UAAU;IACV,aAAa;IACb,mBAAmB;IACnB,QAAQ;IACR,gBAAgB;IAChB,kBAAkB;CACV,CAAC;AA0BX;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAwB,EACxB,IAAwB;IAExB,MAAM,WAAW,GAAkB,EAAE,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,uBAAuB,EAAE,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACzC,WAAW,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAkB,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,uBAAuB,EAAE,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACzC,eAAe,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,kBAAkB,CAAC,CAAC;IAC1E,MAAM,MAAM,GACV,SAAS,IAAI,OAAO,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC;QACxF,CAAC,CAAC,SAAS,CAAC,QAAQ;QACpB,CAAC,CAAC,IAAI,CAAC;IAEX,OAAO;QACL,WAAW;QACX,eAAe;QACf,iBAAiB,EAAE,SAAS,KAAK,SAAS;QAC1C,mBAAmB,EAAE,MAAM;KAC5B,CAAC;AACJ,CAAC;AAeD,mFAAmF;AACnF,SAAS,uBAAuB,CAAC,CAAe,EAAE,CAAe;IAC/D,OAAO,CACL,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QACjB,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QACjB,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QACrB,CAAC,CAAC,eAAe,KAAK,CAAC,CAAC,eAAe;QACvC,CAAC,CAAC,eAAe,KAAK,CAAC,CAAC,eAAe;QACvC,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,cAAc,CACtC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAAuB,EACvB,SAAuB;IAEvB,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5D,IAAI,SAAS,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC;IAC3D,IAAI,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QAC3C,OAAO,uBAAuB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IACjF,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/shell/config-reconcile.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Daemon config self-heal: prune products deleted from the backend.
+ *
+ * Registration into ~/.telora/daemon.json is asymmetric -- adding a product has
+ * two hot-reloading paths (telora_connector_start and telora_product create ->
+ * addProductToDaemonConfig() + SIGHUP), but removal has none. A product deleted
+ * out-of-band (SQL/UI) leaves a permanent stale entry, so every poll tick the
+ * focus engine iterates config.products, calls a backend that 404s, and scans a
+ * repoPath that may no longer exist.
+ *
+ * This module closes that gap by RECONCILIATION, not an explicit command:
+ * config (reality) reconciles toward the backend (intent). On each tick the
+ * daemon looks up every configured product; when a lookup returns a DEFINITIVE
+ * backend not-found (HTTP 404), that entry is removed from both the in-memory
+ * config.products array (poll loop stops iterating it immediately) and the
+ * on-disk daemon.json (rewritten 0600, all other fields preserved).
+ *
+ * SAFETY CONSTRAINT (non-negotiable): prune ONLY on a definitive not-found.
+ * Transient errors (network blip, 5xx, timeout, read-only mode, circuit open)
+ * and a merely-missing repo directory NEVER trigger removal -- a transient
+ * outage must not silently unregister live products. The backend not-found is
+ * the sole authoritative deletion signal.
+ *
+ * The disk read-merge-write mirrors the shape of the MCP-side
+ * addProductToDaemonConfig(); the daemon cannot import that helper (it lives in
+ * a separate package), so the shape is re-implemented here.
+ */
+import type { DaemonConfig } from '../types/index.js';
+/**
+ * Classification of a single product lookup against the backend.
+ *
+ * - 'found'      -> the product exists; keep it.
+ * - 'not_found'  -> DEFINITIVE backend not-found (404); prune it.
+ * - 'transient'  -> network / 5xx / timeout / read-only / circuit / anything
+ *                   that is not a definitive 404; KEEP it (safety constraint).
+ */
+export type ProductLookupOutcome = 'found' | 'not_found' | 'transient';
+export interface PruneDiskResult {
+    /** True when daemon.json was rewritten without the pruned entry. */
+    written: boolean;
+    /** The config file targeted (global if present, else repo-local). */
+    configPath: string;
+    /** Why the disk write was skipped (config missing / corrupt), when not written. */
+    reason?: string;
+}
+export interface ReconcileDeps {
+    /** Classify a configured product against the backend. */
+    lookupProduct(productId: string): Promise<ProductLookupOutcome>;
+    /** Remove the product from daemon.json on disk (read-merge-write, 0600). */
+    pruneFromDisk(productId: string): PruneDiskResult;
+    /** Emit an operator-visible log line (-> ~/.telora/daemon.log). */
+    log(message: string): void;
+}
+export interface ReconcileResult {
+    /** Products checked this tick. */
+    checked: number;
+    /** Ids pruned this tick (definitive not-found). */
+    pruned: string[];
+    /** Surviving product count after the tick. */
+    kept: number;
+}
+/**
+ * Return a copy of an existing daemon.json object with the given product ids
+ * removed from products[], preserving every other field (identity, engines,
+ * surviving products, and any operator customizations).
+ *
+ * Mirrors the normalization mergeConfig() applies on the add path: a legacy
+ * flat `productId` + `repoPath` pair is migrated into products[] first, then
+ * the flat fields are dropped so products[] is the single canonical surface.
+ */
+export declare function removeProductsFromConfig(existing: Record<string, unknown>, removedIds: string[]): Record<string, unknown>;
+/**
+ * Resolve the daemon.json the running daemon reads: the global
+ * ~/.telora/daemon.json when it exists (the daemon is launched with
+ * `--config <global>` in that case), else the repo-local .telora/daemon.json.
+ *
+ * Mirrors resolveDaemonPaths() in the MCP daemonConfig helper so add and remove
+ * target the identical file.
+ */
+export declare function resolveDaemonConfigPath(repoPath: string): string;
+/**
+ * Read-merge-write daemon.json removing one product entry, at mode 0600.
+ * Skips (never partially writes) when the config is missing or corrupt.
+ */
+export declare function writeConfigRemovingProduct(configPath: string, productId: string): PruneDiskResult;
+/**
+ * Look up a product by id and classify the outcome for reconciliation.
+ *
+ * Uses callApiOnce (a single attempt that BYPASSES the retry + circuit breaker)
+ * so a 404 resolves immediately and repeated not-found lookups never open the
+ * shared 'delivery' breaker. Only HTTP 404 is a definitive not-found; every
+ * other failure -- network error (no statusCode), 5xx, timeout, read-only-mode
+ * refusal (503) -- classifies as transient and keeps the product.
+ */
+export declare function classifyProductLookup(productId: string): Promise<ProductLookupOutcome>;
+/**
+ * Build the production dependency set for reconcileDaemonProducts. The config
+ * path is resolved once from the daemon's repoPath (stable for the run).
+ */
+export declare function buildReconcileDeps(config: DaemonConfig): ReconcileDeps;
+/**
+ * Reconcile config.products against backend reality once.
+ *
+ * For each configured product: look it up; on a DEFINITIVE not-found, remove it
+ * from the on-disk daemon.json and splice it out of the in-memory config.products
+ * array IN PLACE (so the array reference shared with the poll loop / listener /
+ * heartbeat sees the removal on its next cycle, and in-flight teams on surviving
+ * products are untouched). Any non-definitive outcome keeps the product.
+ *
+ * All fallible work is per-product isolated: a lookup or disk error for one
+ * product never aborts reconciliation of the others.
+ */
+export declare function reconcileDaemonProducts(config: Pick<DaemonConfig, 'products'>, deps: ReconcileDeps): Promise<ReconcileResult>;
+//# sourceMappingURL=config-reconcile.d.ts.map

package/dist/shell/config-reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-reconcile.d.ts","sourceRoot":"","sources":["../../src/shell/config-reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAWtD;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,WAAW,GAAG,WAAW,CAAC;AAEvE,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAC;IACjB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAChE,4EAA4E;IAC5E,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,CAAC;IAClD,mEAAmE;IACnE,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;CACd;AAMD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,UAAU,EAAE,MAAM,EAAE,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoBzB;AAMD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIhE;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,eAAe,CAgBjB;AAMD;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAQ5F;AAMD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,GAAG,aAAa,CAOtE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,EACtC,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,eAAe,CAAC,CA2C1B"}

package/dist/shell/config-reconcile.js

@@ -0,0 +1,189 @@
+/**
+ * Daemon config self-heal: prune products deleted from the backend.
+ *
+ * Registration into ~/.telora/daemon.json is asymmetric -- adding a product has
+ * two hot-reloading paths (telora_connector_start and telora_product create ->
+ * addProductToDaemonConfig() + SIGHUP), but removal has none. A product deleted
+ * out-of-band (SQL/UI) leaves a permanent stale entry, so every poll tick the
+ * focus engine iterates config.products, calls a backend that 404s, and scans a
+ * repoPath that may no longer exist.
+ *
+ * This module closes that gap by RECONCILIATION, not an explicit command:
+ * config (reality) reconciles toward the backend (intent). On each tick the
+ * daemon looks up every configured product; when a lookup returns a DEFINITIVE
+ * backend not-found (HTTP 404), that entry is removed from both the in-memory
+ * config.products array (poll loop stops iterating it immediately) and the
+ * on-disk daemon.json (rewritten 0600, all other fields preserved).
+ *
+ * SAFETY CONSTRAINT (non-negotiable): prune ONLY on a definitive not-found.
+ * Transient errors (network blip, 5xx, timeout, read-only mode, circuit open)
+ * and a merely-missing repo directory NEVER trigger removal -- a transient
+ * outage must not silently unregister live products. The backend not-found is
+ * the sole authoritative deletion signal.
+ *
+ * The disk read-merge-write mirrors the shape of the MCP-side
+ * addProductToDaemonConfig(); the daemon cannot import that helper (it lives in
+ * a separate package), so the shape is re-implemented here.
+ */
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { callApiOnce } from '../queries/shared.js';
+import { createLogger } from './log.js';
+const log = createLogger({ module: 'config-reconcile' });
+// ---------------------------------------------------------------------------
+// Pure config transform (no I/O -- unit-testable)
+// ---------------------------------------------------------------------------
+/**
+ * Return a copy of an existing daemon.json object with the given product ids
+ * removed from products[], preserving every other field (identity, engines,
+ * surviving products, and any operator customizations).
+ *
+ * Mirrors the normalization mergeConfig() applies on the add path: a legacy
+ * flat `productId` + `repoPath` pair is migrated into products[] first, then
+ * the flat fields are dropped so products[] is the single canonical surface.
+ */
+export function removeProductsFromConfig(existing, removedIds) {
+    const merged = { ...existing };
+    const removeSet = new Set(removedIds);
+    let products = Array.isArray(merged.products)
+        ? merged.products
+        : [];
+    // Migrate legacy flat productId/repoPath into products[] (add-path parity).
+    if (products.length === 0 && typeof merged.productId === 'string' && merged.productId) {
+        const legacyRepoPath = typeof merged.repoPath === 'string' ? merged.repoPath : '';
+        products = [{ id: merged.productId, repoPath: legacyRepoPath }];
+    }
+    // Deprecated flat fields are never resurrected: products[] is canonical.
+    delete merged.productId;
+    delete merged.repoPath;
+    merged.products = products.filter((p) => !removeSet.has(p.id));
+    return merged;
+}
+// ---------------------------------------------------------------------------
+// Config-path resolution + disk write (I/O)
+// ---------------------------------------------------------------------------
+/**
+ * Resolve the daemon.json the running daemon reads: the global
+ * ~/.telora/daemon.json when it exists (the daemon is launched with
+ * `--config <global>` in that case), else the repo-local .telora/daemon.json.
+ *
+ * Mirrors resolveDaemonPaths() in the MCP daemonConfig helper so add and remove
+ * target the identical file.
+ */
+export function resolveDaemonConfigPath(repoPath) {
+    const globalPath = join(homedir(), '.telora', 'daemon.json');
+    if (existsSync(globalPath))
+        return globalPath;
+    return join(repoPath, '.telora', 'daemon.json');
+}
+/**
+ * Read-merge-write daemon.json removing one product entry, at mode 0600.
+ * Skips (never partially writes) when the config is missing or corrupt.
+ */
+export function writeConfigRemovingProduct(configPath, productId) {
+    if (!existsSync(configPath)) {
+        return { written: false, configPath, reason: 'no_config' };
+    }
+    let existing;
+    try {
+        existing = JSON.parse(readFileSync(configPath, 'utf-8'));
+    }
+    catch {
+        // Corrupt config: do not silently overwrite. In-memory prune still happens.
+        return { written: false, configPath, reason: 'corrupt_config' };
+    }
+    const merged = removeProductsFromConfig(existing, [productId]);
+    writeFileSync(configPath, JSON.stringify(merged, null, 2) + '\n', { mode: 0o600 });
+    return { written: true, configPath };
+}
+// ---------------------------------------------------------------------------
+// Backend lookup classification (I/O)
+// ---------------------------------------------------------------------------
+/**
+ * Look up a product by id and classify the outcome for reconciliation.
+ *
+ * Uses callApiOnce (a single attempt that BYPASSES the retry + circuit breaker)
+ * so a 404 resolves immediately and repeated not-found lookups never open the
+ * shared 'delivery' breaker. Only HTTP 404 is a definitive not-found; every
+ * other failure -- network error (no statusCode), 5xx, timeout, read-only-mode
+ * refusal (503) -- classifies as transient and keeps the product.
+ */
+export async function classifyProductLookup(productId) {
+    try {
+        await callApiOnce('get', { productId });
+        return 'found';
+    }
+    catch (err) {
+        const statusCode = err.statusCode;
+        return statusCode === 404 ? 'not_found' : 'transient';
+    }
+}
+// ---------------------------------------------------------------------------
+// Orchestrator
+// ---------------------------------------------------------------------------
+/**
+ * Build the production dependency set for reconcileDaemonProducts. The config
+ * path is resolved once from the daemon's repoPath (stable for the run).
+ */
+export function buildReconcileDeps(config) {
+    const configPath = resolveDaemonConfigPath(config.repoPath);
+    return {
+        lookupProduct: (productId) => classifyProductLookup(productId),
+        pruneFromDisk: (productId) => writeConfigRemovingProduct(configPath, productId),
+        log: (message) => log.warn(message),
+    };
+}
+/**
+ * Reconcile config.products against backend reality once.
+ *
+ * For each configured product: look it up; on a DEFINITIVE not-found, remove it
+ * from the on-disk daemon.json and splice it out of the in-memory config.products
+ * array IN PLACE (so the array reference shared with the poll loop / listener /
+ * heartbeat sees the removal on its next cycle, and in-flight teams on surviving
+ * products are untouched). Any non-definitive outcome keeps the product.
+ *
+ * All fallible work is per-product isolated: a lookup or disk error for one
+ * product never aborts reconciliation of the others.
+ */
+export async function reconcileDaemonProducts(config, deps) {
+    // Snapshot the entries to check so mutating config.products mid-loop is safe.
+    const toCheck = [...config.products];
+    const pruned = [];
+    for (const product of toCheck) {
+        let outcome;
+        try {
+            outcome = await deps.lookupProduct(product.id);
+        }
+        catch {
+            // Defensive: an unexpected throw is treated as transient -> keep.
+            outcome = 'transient';
+        }
+        // Safety constraint: prune ONLY on a definitive backend not-found.
+        if (outcome !== 'not_found')
+            continue;
+        let disk;
+        try {
+            disk = deps.pruneFromDisk(product.id);
+        }
+        catch (err) {
+            disk = {
+                written: false,
+                configPath: 'unknown',
+                reason: err instanceof Error ? err.message : String(err),
+            };
+        }
+        // In-memory self-heal: splice in place to preserve the shared array ref.
+        const idx = config.products.findIndex((p) => p.id === product.id);
+        if (idx >= 0)
+            config.products.splice(idx, 1);
+        pruned.push(product.id);
+        deps.log(`[config-reconcile] pruned product ${product.id} (repoPath: ${product.repoPath}) ` +
+            '-- backend returned not-found; ' +
+            (disk.written
+                ? `removed from ${disk.configPath}`
+                : `on-disk write skipped (${disk.reason ?? 'unknown'}); in-memory only`));
+    }
+    return { checked: toCheck.length, pruned, kept: config.products.length };
+}
+//# sourceMappingURL=config-reconcile.js.map

package/dist/shell/config-reconcile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-reconcile.js","sourceRoot":"","sources":["../../src/shell/config-reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAGlE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;AA4CzD,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAiC,EACjC,UAAoB;IAEpB,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAEtC,IAAI,QAAQ,GAAmB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3D,CAAC,CAAE,MAAM,CAAC,QAA2B;QACrC,CAAC,CAAC,EAAE,CAAC;IAEP,4EAA4E;IAC5E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACtF,MAAM,cAAc,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,QAAQ,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,yEAAyE;IACzE,OAAO,MAAM,CAAC,SAAS,CAAC;IACxB,OAAO,MAAM,CAAC,QAAQ,CAAC;IAEvB,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,4CAA4C;AAC5C,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IAC7D,IAAI,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IAC9C,OAAO,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAkB,EAClB,SAAiB;IAEjB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC7D,CAAC;IAED,IAAI,QAAiC,CAAC;IACtC,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA4B,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAClE,CAAC;IAED,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/D,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACvC,CAAC;AAED,8EAA8E;AAC9E,sCAAsC;AACtC,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,SAAiB;IAC3D,IAAI,CAAC;QACH,MAAM,WAAW,CAAuB,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,UAAU,GAAI,GAA+B,CAAC,UAAU,CAAC;QAC/D,OAAO,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC;IACxD,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAoB;IACrD,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5D,OAAO;QACL,aAAa,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,qBAAqB,CAAC,SAAS,CAAC;QAC9D,aAAa,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,0BAA0B,CAAC,UAAU,EAAE,SAAS,CAAC;QAC/E,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAsC,EACtC,IAAmB;IAEnB,8EAA8E;IAC9E,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,OAA6B,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,OAAO,GAAG,WAAW,CAAC;QACxB,CAAC;QAED,mEAAmE;QACnE,IAAI,OAAO,KAAK,WAAW;YAAE,SAAS;QAEtC,IAAI,IAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG;gBACL,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,SAAS;gBACrB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACzD,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC;QAClE,IAAI,GAAG,IAAI,CAAC;YAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAExB,IAAI,CAAC,GAAG,CACN,qCAAqC,OAAO,CAAC,EAAE,eAAe,OAAO,CAAC,QAAQ,IAAI;YAChF,iCAAiC;YACjC,CAAC,IAAI,CAAC,OAAO;gBACX,CAAC,CAAC,gBAAgB,IAAI,CAAC,UAAU,EAAE;gBACnC,CAAC,CAAC,0BAA0B,IAAI,CAAC,MAAM,IAAI,SAAS,mBAAmB,CAAC,CAC7E,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;AAC3E,CAAC"}

package/dist/shell/config.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Daemon configuration management.
+ *
+ * Loads configuration from:
+ * 1. Config file (.telora/daemon.json or --config path)
+ * 2. Environment variables (override config file)
+ *
+ * Uses shared BaseConfig infrastructure from @telora/daemon-core for fields
+ * common to both daemon and factory, then layers daemon-specific fields on top.
+ *
+ * Uses tracker-based authentication (same as MCP server) instead of service role key.
+ * The tracker id can come from either TELORA_TRACKER_ID or `trackerId` in the
+ * config file (the connect flow persists it to ~/.telora/daemon.json, mode 0600,
+ * matching the security profile of .mcp.json which already stores the same secret).
+ */
+import type { DaemonConfig, DefaultVerificationConfig, DaemonProductEntry } from '../types/index.js';
+import type { ProductEntry } from '@telora/daemon-core';
+/**
+ * Resolve default-on verification carriage from the raw config file: the
+ * top-level global `defaultVerification` block and each product's per-product
+ * override (`products[].defaultVerification`), enriched onto the normalized
+ * products array.
+ *
+ * This is the SINGLE source of the file-level verification carriage. Both
+ * daemon-side entry points use it so they cannot drift:
+ *  - `loadConfig` (this module) -- the CLI / subcommand config path.
+ *  - `resolveEngineConfig` (unified-engine-lifecycle) -- the SINGLE runtime
+ *    resolver for every engine's config; it applies this carriage uniformly
+ *    so the file block reaches whichever engine's config wins the global
+ *    singleton.
+ *
+ * Env overrides (TELORA_DEFAULT_VERIFY_*) are NOT applied here -- they stay
+ * global and are layered on at read time by `resolveDefaultVerification`.
+ */
+export declare function resolveVerificationCarriage(fileConfig: Record<string, unknown>, baseProducts: readonly ProductEntry[]): {
+    defaultVerification?: DefaultVerificationConfig;
+    products: DaemonProductEntry[];
+};
+/**
+ * Load and validate daemon configuration.
+ *
+ * Priority (highest to lowest):
+ * 1. Environment variables
+ * 2. Config file values
+ * 3. Default values
+ *
+ * @param configPath Optional path to config file (default: .telora/daemon.json)
+ */
+export declare function loadConfig(configPath?: string): DaemonConfig;
+/**
+ * Create a product-scoped DaemonConfig by overriding productId, repoPath,
+ * worktreeDir, and logDir to target a specific product's repository.
+ *
+ * Downstream functions that use config.productId and config.repoPath
+ * work without modification when given a product-scoped config.
+ *
+ * Per-product local-model fields (codexHome, defaultCodingEngine, codexModel)
+ * are copied from the product entry; absent on the entry => undefined on the
+ * config (cloud parity).
+ *
+ * The per-product `defaultVerification` override is resolved from the matching
+ * entry in `config.products` (the enriched DaemonProductEntry list) so a caller
+ * passing a plain ProductEntry still gets the override. When the product
+ * declares no override, the spread carries the top-level global block through
+ * (global fallback); env overrides are applied above both at read time by
+ * resolveDefaultVerification.
+ */
+export declare function configForProduct(config: DaemonConfig, product: ProductEntry): DaemonConfig;
+/**
+ * Look up a ProductEntry by productId from the config's products array.
+ * Returns undefined if not found (defensive fallback).
+ */
+export declare function findProduct(config: DaemonConfig, productId: string): ProductEntry | undefined;
+/**
+ * Validate daemon configuration values at startup.
+ *
+ * Runs after loadConfig() but before initSupabase(). Collects fatal validation
+ * failures and throws a single error listing every problem, so operators can
+ * fix everything in one pass.
+ *
+ * Per-product repoPath problems are NOT fatal. A single misconfigured or
+ * mid-genesis product (its repoPath missing, or not yet a git repository) must
+ * not take down a multi-product daemon and stall every other product's work.
+ * Such products are SKIPPED -- pruned from `config.products` with a loud warning
+ * and a `product.skipped_invalid_repo` health event -- and the daemon proceeds
+ * managing the remaining viable products. It fails hard only when NO viable
+ * product remains (nothing to do) or a shared base field is invalid.
+ *
+ * Pruning mutates `config` in place: the surviving products replace
+ * `config.products`, and the deprecated `productId`/`repoPath`/`worktreeDir`/
+ * `logDir` legacy fields are re-derived from the new `products[0]` to preserve
+ * the runtime invariant that those mirror the first product.
+ *
+ * Uses validateBaseConfig() from @telora/daemon-core for shared fields,
+ * then appends daemon-specific validation errors.
+ */
+export declare function validateConfig(config: DaemonConfig): void;
+/**
+ * Print configuration summary (without sensitive values)
+ */
+export declare function printConfig(config: DaemonConfig): void;
+//# sourceMappingURL=config.d.ts.map

package/dist/shell/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/shell/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAYH,OAAO,KAAK,EAAE,YAAY,EAAoD,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvJ,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAwExD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,YAAY,EAAE,SAAS,YAAY,EAAE,GACpC;IAAE,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;IAAC,QAAQ,EAAE,kBAAkB,EAAE,CAAA;CAAE,CAYrF;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,YAAY,CA2L5D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,GAAG,YAAY,CAkB1F;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAE7F;AAqBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAqFzD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAiCtD"}