idlewatch 0.1.0

package/bin/idlewatch-agent.js

@@ -0,0 +1,1053 @@
+#!/usr/bin/env node
+import fs from 'fs'
+import { accessSync, constants } from 'node:fs'
+import os from 'os'
+import path from 'path'
+import process from 'process'
+import { spawnSync } from 'node:child_process'
+import { createRequire } from 'module'
+import { parseOpenClawUsage } from '../src/openclaw-usage.js'
+import { gpuSampleDarwin } from '../src/gpu.js'
+import { memUsedPct, memoryPressureDarwin } from '../src/memory.js'
+import { deriveUsageFreshness } from '../src/usage-freshness.js'
+import { deriveUsageAlert } from '../src/usage-alert.js'
+import { loadLastGoodUsageSnapshot, persistLastGoodUsageSnapshot } from '../src/openclaw-cache.js'
+import { runEnrollmentWizard } from '../src/enrollment.js'
+import { enrichWithOpenClawFleetTelemetry } from '../src/telemetry-mapping.js'
+import pkg from '../package.json' with { type: 'json' }
+
+function printHelp() {
+  console.log(`idlewatch-agent\n\nUsage:\n  idlewatch-agent [quickstart] [--dry-run] [--once] [--help]\n\nOptions:\n  quickstart  Run first-run enrollment wizard and generate secure env config\n  --dry-run   Collect and print one telemetry sample, then exit without Firebase writes\n  --once      Collect and publish one telemetry sample, then exit\n  --help      Show this help message\n\nEnvironment:\n  IDLEWATCH_HOST                     Optional custom host label (default: hostname)\n  IDLEWATCH_INTERVAL_MS              Sampling interval in ms (default: 10000)\n  IDLEWATCH_LOCAL_LOG_PATH           Optional NDJSON file path for local sample durability\n  IDLEWATCH_OPENCLAW_USAGE           OpenClaw usage lookup mode: auto|off (default: auto)\n  IDLEWATCH_OPENCLAW_PROBE_TIMEOUT_MS OpenClaw command timeout per probe in ms (default: 2500)\n  IDLEWATCH_OPENCLAW_PROBE_RETRIES   Extra OpenClaw probe sweep retries after first pass (default: 1)\n  IDLEWATCH_OPENCLAW_MAX_OUTPUT_BYTES   Max per-command OpenClaw probe output capture in bytes before truncation (default: 2097152 / 2MB)\n  IDLEWATCH_OPENCLAW_MAX_OUTPUT_BYTES_HARD_CAP  Hard cap for auto-retry output capture escalation (default: 16777216 / 16MB)\n  IDLEWATCH_USAGE_STALE_MS           Mark OpenClaw usage stale beyond this age in ms (default: max(interval*3,60000))\n  IDLEWATCH_USAGE_NEAR_STALE_MS      Mark OpenClaw usage as aging beyond this age in ms (default: floor((stale+grace)*0.85))\n  IDLEWATCH_USAGE_STALE_GRACE_MS     Extra grace window before status becomes stale (default: min(interval,10000))\n  IDLEWATCH_USAGE_REFRESH_REPROBES   Forced uncached reprobes when usage crosses stale threshold (default: 1)\n  IDLEWATCH_USAGE_REFRESH_DELAY_MS   Delay between forced stale-threshold reprobes in ms (default: 250)\n  IDLEWATCH_USAGE_REFRESH_ON_NEAR_STALE Trigger refresh when usage is near-stale: 1|0 (default: 1)\n  IDLEWATCH_USAGE_IDLE_AFTER_MS      Downgrade stale usage alerts to idle notice beyond this age in ms (default: 21600000)\n  IDLEWATCH_OPENCLAW_LAST_GOOD_MAX_AGE_MS  Reuse last successful usage snapshot after probe failures up to this age in ms\n  IDLEWATCH_OPENCLAW_LAST_GOOD_CACHE_PATH Persist/reuse last successful usage snapshot across restarts (default: ~/.idlewatch/cache/<host>-openclaw-last-good.json)\n  IDLEWATCH_REQUIRE_FIREBASE_WRITES  Require Firebase publish path in --once mode: 1|0 (default: 0)\n  FIREBASE_PROJECT_ID                Firebase project id\n  FIREBASE_SERVICE_ACCOUNT_FILE      Path to service account JSON file (preferred for production)\n  FIREBASE_SERVICE_ACCOUNT_JSON      Raw JSON service account (supported, less secure than file path)\n  FIREBASE_SERVICE_ACCOUNT_B64       Base64-encoded JSON service account (legacy)\n  FIRESTORE_EMULATOR_HOST            Optional Firestore emulator host; allows local writes without service-account creds\n  IDLEWATCH_CLOUD_INGEST_URL         Optional cloud ingest endpoint (e.g. https://idlewatch.com/api/ingest)\n  IDLEWATCH_CLOUD_API_KEY            Cloud API key from dashboard for device linking\n  IDLEWATCH_REQUIRE_CLOUD_WRITES     Require cloud publish path in --once mode: 1|0 (default: 0)\n`)
+}
+
+const require = createRequire(import.meta.url)
+
+function parseEnvFileToObject(envFilePath) {
+  const raw = fs.readFileSync(envFilePath, 'utf8')
+  const env = {}
+  for (const line of raw.split(/\r?\n/)) {
+    const trimmed = line.trim()
+    if (!trimmed || trimmed.startsWith('#')) continue
+    const idx = trimmed.indexOf('=')
+    if (idx <= 0) continue
+    const key = trimmed.slice(0, idx).trim()
+    const value = trimmed.slice(idx + 1).trim()
+    if (key) env[key] = value
+  }
+  return env
+}
+
+function parseMonitorTargets(raw) {
+  const allowed = new Set(['cpu', 'memory', 'gpu', 'openclaw'])
+  const fallback = ['cpu', 'memory', 'openclaw', 'gpu']
+
+  if (!raw || typeof raw !== 'string') {
+    return new Set(fallback)
+  }
+
+  const parsed = raw
+    .split(',')
+    .map((item) => item.trim().toLowerCase())
+    .filter((item) => allowed.has(item))
+
+  if (parsed.length === 0) return new Set(fallback)
+  return new Set(parsed)
+}
+
+const argv = process.argv.slice(2)
+const quickstartRequested = argv[0] === 'quickstart' || argv.includes('--quickstart')
+const args = new Set(argv)
+if (args.has('--help') || args.has('-h')) {
+  printHelp()
+  process.exit(0)
+}
+
+if (quickstartRequested) {
+  try {
+    const result = await runEnrollmentWizard()
+    console.log(`Enrollment complete. Mode=${result.mode} envFile=${result.outputEnvFile}`)
+
+    const enrolledEnv = parseEnvFileToObject(result.outputEnvFile)
+    const onceRun = spawnSync(process.execPath, [process.argv[1], '--once'], {
+      stdio: 'inherit',
+      env: {
+        ...process.env,
+        ...enrolledEnv
+      }
+    })
+
+    if (onceRun.status === 0) {
+      console.log('✅ Initial telemetry sample sent successfully.')
+      process.exit(0)
+    }
+
+    console.log('⚠️ Initial --once sample did not complete successfully.')
+    console.log(`You can retry with: set -a; source "${result.outputEnvFile}"; set +a && idlewatch-agent --once`)
+    process.exit(onceRun.status ?? 1)
+  } catch (err) {
+    console.error(`Enrollment failed: ${err.message}`)
+    process.exit(1)
+  }
+}
+
+const DRY_RUN = args.has('--dry-run')
+const ONCE = args.has('--once')
+const HOST = process.env.IDLEWATCH_HOST || os.hostname()
+const SAFE_HOST = HOST.replace(/[^a-zA-Z0-9_.-]/g, '_')
+const INTERVAL_MS = Number(process.env.IDLEWATCH_INTERVAL_MS || 10000)
+const PROJECT_ID = process.env.FIREBASE_PROJECT_ID
+const CREDS_FILE = process.env.FIREBASE_SERVICE_ACCOUNT_FILE
+const CREDS_JSON = process.env.FIREBASE_SERVICE_ACCOUNT_JSON
+const CREDS_B64 = process.env.FIREBASE_SERVICE_ACCOUNT_B64
+const FIRESTORE_EMULATOR_HOST = process.env.FIRESTORE_EMULATOR_HOST
+const OPENCLAW_USAGE_MODE = (process.env.IDLEWATCH_OPENCLAW_USAGE || 'auto').toLowerCase()
+const MONITOR_TARGETS = parseMonitorTargets(process.env.IDLEWATCH_MONITOR_TARGETS)
+const MONITOR_CPU = MONITOR_TARGETS.has('cpu')
+const MONITOR_MEMORY = MONITOR_TARGETS.has('memory')
+const MONITOR_GPU = MONITOR_TARGETS.has('gpu')
+const MONITOR_OPENCLAW = MONITOR_TARGETS.has('openclaw')
+const EFFECTIVE_OPENCLAW_MODE = MONITOR_OPENCLAW ? OPENCLAW_USAGE_MODE : 'off'
+const REQUIRE_FIREBASE_WRITES = process.env.IDLEWATCH_REQUIRE_FIREBASE_WRITES === '1'
+const CLOUD_INGEST_URL = process.env.IDLEWATCH_CLOUD_INGEST_URL
+const CLOUD_API_KEY = process.env.IDLEWATCH_CLOUD_API_KEY
+const REQUIRE_CLOUD_WRITES = process.env.IDLEWATCH_REQUIRE_CLOUD_WRITES === '1'
+const OPENCLAW_PROBE_TIMEOUT_MS = Number(process.env.IDLEWATCH_OPENCLAW_PROBE_TIMEOUT_MS || 2500)
+const OPENCLAW_PROBE_MAX_OUTPUT_BYTES = process.env.IDLEWATCH_OPENCLAW_MAX_OUTPUT_BYTES
+  ? Number(process.env.IDLEWATCH_OPENCLAW_MAX_OUTPUT_BYTES)
+  : 2 * 1024 * 1024
+const OPENCLAW_PROBE_MAX_OUTPUT_BYTES_HARD_CAP = process.env.IDLEWATCH_OPENCLAW_MAX_OUTPUT_BYTES_HARD_CAP
+  ? Number(process.env.IDLEWATCH_OPENCLAW_MAX_OUTPUT_BYTES_HARD_CAP)
+  : 16 * 1024 * 1024
+const OPENCLAW_BIN_STRICT = process.env.IDLEWATCH_OPENCLAW_BIN_STRICT === '1'
+const OPENCLAW_PROBE_RETRIES = process.env.IDLEWATCH_OPENCLAW_PROBE_RETRIES
+  ? Number(process.env.IDLEWATCH_OPENCLAW_PROBE_RETRIES)
+  : 1
+const BASE_DIR = path.join(os.homedir(), '.idlewatch')
+
+const LOCAL_LOG_PATH = process.env.IDLEWATCH_LOCAL_LOG_PATH
+  ? path.resolve(process.env.IDLEWATCH_LOCAL_LOG_PATH)
+  : path.join(BASE_DIR, 'logs', `${SAFE_HOST}-metrics.ndjson`)
+
+if (!Number.isFinite(INTERVAL_MS) || INTERVAL_MS <= 0) {
+  console.error(`Invalid IDLEWATCH_INTERVAL_MS: ${process.env.IDLEWATCH_INTERVAL_MS}. Expected a positive number.`)
+  process.exit(1)
+}
+
+if (!Number.isFinite(OPENCLAW_PROBE_TIMEOUT_MS) || OPENCLAW_PROBE_TIMEOUT_MS <= 0) {
+  console.error(
+    `Invalid IDLEWATCH_OPENCLAW_PROBE_TIMEOUT_MS: ${process.env.IDLEWATCH_OPENCLAW_PROBE_TIMEOUT_MS}. Expected a positive number.`
+  )
+  process.exit(1)
+}
+
+if (!Number.isFinite(OPENCLAW_PROBE_MAX_OUTPUT_BYTES) || OPENCLAW_PROBE_MAX_OUTPUT_BYTES <= 0) {
+  console.error(
+    `Invalid IDLEWATCH_OPENCLAW_MAX_OUTPUT_BYTES: undefined. Expected a positive number.`
+  )
+  process.exit(1)
+}
+
+if (!Number.isFinite(OPENCLAW_PROBE_MAX_OUTPUT_BYTES_HARD_CAP) || OPENCLAW_PROBE_MAX_OUTPUT_BYTES_HARD_CAP < OPENCLAW_PROBE_MAX_OUTPUT_BYTES) {
+  console.error(
+    `Invalid IDLEWATCH_OPENCLAW_MAX_OUTPUT_BYTES_HARD_CAP: ${process.env.IDLEWATCH_OPENCLAW_MAX_OUTPUT_BYTES_HARD_CAP}. Must be a number >= IDLEWATCH_OPENCLAW_MAX_OUTPUT_BYTES.`
+  )
+  process.exit(1)
+}
+
+if (!Number.isInteger(OPENCLAW_PROBE_RETRIES) || OPENCLAW_PROBE_RETRIES < 0) {
+  console.error(
+    `Invalid IDLEWATCH_OPENCLAW_PROBE_RETRIES: ${process.env.IDLEWATCH_OPENCLAW_PROBE_RETRIES}. Expected an integer >= 0.`
+  )
+  process.exit(1)
+}
+
+const USAGE_STALE_MS = process.env.IDLEWATCH_USAGE_STALE_MS
+  ? Number(process.env.IDLEWATCH_USAGE_STALE_MS)
+  : Math.max(INTERVAL_MS * 3, 60000)
+
+if (!Number.isFinite(USAGE_STALE_MS) || USAGE_STALE_MS <= 0) {
+  console.error(`Invalid IDLEWATCH_USAGE_STALE_MS: ${process.env.IDLEWATCH_USAGE_STALE_MS}. Expected a positive number.`)
+  process.exit(1)
+}
+
+const USAGE_STALE_GRACE_MS = process.env.IDLEWATCH_USAGE_STALE_GRACE_MS
+  ? Number(process.env.IDLEWATCH_USAGE_STALE_GRACE_MS)
+  : Math.min(INTERVAL_MS, 10000)
+
+if (!Number.isFinite(USAGE_STALE_GRACE_MS) || USAGE_STALE_GRACE_MS < 0) {
+  console.error(
+    `Invalid IDLEWATCH_USAGE_STALE_GRACE_MS: ${process.env.IDLEWATCH_USAGE_STALE_GRACE_MS}. Expected a non-negative number.`
+  )
+  process.exit(1)
+}
+
+const USAGE_NEAR_STALE_MS = process.env.IDLEWATCH_USAGE_NEAR_STALE_MS
+  ? Number(process.env.IDLEWATCH_USAGE_NEAR_STALE_MS)
+  : Math.floor((USAGE_STALE_MS + USAGE_STALE_GRACE_MS) * 0.85)
+
+if (!Number.isFinite(USAGE_NEAR_STALE_MS) || USAGE_NEAR_STALE_MS < 0) {
+  console.error(
+    `Invalid IDLEWATCH_USAGE_NEAR_STALE_MS: ${process.env.IDLEWATCH_USAGE_NEAR_STALE_MS}. Expected a non-negative number.`
+  )
+  process.exit(1)
+}
+
+const USAGE_REFRESH_REPROBES = process.env.IDLEWATCH_USAGE_REFRESH_REPROBES
+  ? Number(process.env.IDLEWATCH_USAGE_REFRESH_REPROBES)
+  : 1
+
+if (!Number.isInteger(USAGE_REFRESH_REPROBES) || USAGE_REFRESH_REPROBES < 0) {
+  console.error(
+    `Invalid IDLEWATCH_USAGE_REFRESH_REPROBES: ${process.env.IDLEWATCH_USAGE_REFRESH_REPROBES}. Expected an integer >= 0.`
+  )
+  process.exit(1)
+}
+
+const USAGE_REFRESH_DELAY_MS = process.env.IDLEWATCH_USAGE_REFRESH_DELAY_MS
+  ? Number(process.env.IDLEWATCH_USAGE_REFRESH_DELAY_MS)
+  : 250
+
+if (!Number.isFinite(USAGE_REFRESH_DELAY_MS) || USAGE_REFRESH_DELAY_MS < 0) {
+  console.error(
+    `Invalid IDLEWATCH_USAGE_REFRESH_DELAY_MS: ${process.env.IDLEWATCH_USAGE_REFRESH_DELAY_MS}. Expected a non-negative number.`
+  )
+  process.exit(1)
+}
+
+const USAGE_REFRESH_ON_NEAR_STALE = process.env.IDLEWATCH_USAGE_REFRESH_ON_NEAR_STALE
+  ? Number(process.env.IDLEWATCH_USAGE_REFRESH_ON_NEAR_STALE)
+  : 1
+
+if (![0, 1].includes(USAGE_REFRESH_ON_NEAR_STALE)) {
+  console.error(
+    `Invalid IDLEWATCH_USAGE_REFRESH_ON_NEAR_STALE: ${process.env.IDLEWATCH_USAGE_REFRESH_ON_NEAR_STALE}. Expected 0 or 1.`
+  )
+  process.exit(1)
+}
+
+const USAGE_IDLE_AFTER_MS = process.env.IDLEWATCH_USAGE_IDLE_AFTER_MS
+  ? Number(process.env.IDLEWATCH_USAGE_IDLE_AFTER_MS)
+  : 21600000
+
+if (!Number.isFinite(USAGE_IDLE_AFTER_MS) || USAGE_IDLE_AFTER_MS <= 0) {
+  console.error(
+    `Invalid IDLEWATCH_USAGE_IDLE_AFTER_MS: ${process.env.IDLEWATCH_USAGE_IDLE_AFTER_MS}. Expected a positive number.`
+  )
+  process.exit(1)
+}
+
+const OPENCLAW_LAST_GOOD_MAX_AGE_MS = process.env.IDLEWATCH_OPENCLAW_LAST_GOOD_MAX_AGE_MS
+  ? Number(process.env.IDLEWATCH_OPENCLAW_LAST_GOOD_MAX_AGE_MS)
+  : Math.max(USAGE_STALE_MS + USAGE_STALE_GRACE_MS, 120000)
+
+if (process.env.IDLEWATCH_OPENCLAW_LAST_GOOD_MAX_AGE_MS && (!Number.isFinite(OPENCLAW_LAST_GOOD_MAX_AGE_MS) || OPENCLAW_LAST_GOOD_MAX_AGE_MS <= 0)) {
+  console.error(
+    `Invalid IDLEWATCH_OPENCLAW_LAST_GOOD_MAX_AGE_MS: ${process.env.IDLEWATCH_OPENCLAW_LAST_GOOD_MAX_AGE_MS}. Expected a positive number.`
+  )
+  process.exit(1)
+}
+
+const OPENCLAW_LAST_GOOD_CACHE_PATH = process.env.IDLEWATCH_OPENCLAW_LAST_GOOD_CACHE_PATH
+  ? path.resolve(process.env.IDLEWATCH_OPENCLAW_LAST_GOOD_CACHE_PATH)
+  : path.join(BASE_DIR, 'cache', `${SAFE_HOST}-openclaw-last-good.json`)
+
+let appReady = false
+let firebaseConfigError = null
+let admin = null
+
+function loadFirebaseAdmin() {
+  if (admin) return admin
+  try {
+    admin = require('firebase-admin')
+    return admin
+  } catch (err) {
+    firebaseConfigError = `Failed to load firebase-admin runtime dependency: ${err.message}`
+    return null
+  }
+}
+
+if (PROJECT_ID || CREDS_FILE || CREDS_JSON || CREDS_B64 || FIRESTORE_EMULATOR_HOST) {
+  if (!PROJECT_ID) {
+    firebaseConfigError =
+      'FIREBASE_PROJECT_ID is missing. Set FIREBASE_PROJECT_ID plus FIREBASE_SERVICE_ACCOUNT_FILE (preferred) or FIREBASE_SERVICE_ACCOUNT_JSON / FIREBASE_SERVICE_ACCOUNT_B64. For emulator-only mode, set FIREBASE_PROJECT_ID + FIRESTORE_EMULATOR_HOST.'
+  } else if (FIRESTORE_EMULATOR_HOST) {
+    const firebaseAdmin = loadFirebaseAdmin()
+    if (firebaseAdmin) {
+      try {
+        firebaseAdmin.initializeApp({ projectId: PROJECT_ID })
+        appReady = true
+      } catch (err) {
+        firebaseConfigError = `Failed to initialize Firebase emulator mode: ${err.message}`
+      }
+    }
+  } else if (!CREDS_FILE && !CREDS_JSON && !CREDS_B64) {
+    firebaseConfigError =
+      'Firebase credentials are missing. Set FIREBASE_SERVICE_ACCOUNT_FILE (preferred) or FIREBASE_SERVICE_ACCOUNT_JSON / FIREBASE_SERVICE_ACCOUNT_B64. For emulator-only mode, set FIRESTORE_EMULATOR_HOST.'
+  } else {
+    const firebaseAdmin = loadFirebaseAdmin()
+    if (firebaseAdmin) {
+      try {
+        const credsRaw = CREDS_FILE
+          ? fs.readFileSync(path.resolve(CREDS_FILE), 'utf8')
+          : (CREDS_JSON || Buffer.from(CREDS_B64, 'base64').toString('utf8'))
+        const creds = JSON.parse(credsRaw)
+        firebaseAdmin.initializeApp({ credential: firebaseAdmin.credential.cert(creds), projectId: PROJECT_ID })
+        appReady = true
+      } catch (err) {
+        firebaseConfigError = `Failed to initialize Firebase credentials: ${err.message}`
+      }
+    }
+  }
+}
+
+if (firebaseConfigError) {
+  console.error(`Firebase configuration error: ${firebaseConfigError}`)
+  process.exit(1)
+}
+
+if (!appReady) {
+  console.error(
+    'Firebase is not configured. Running in local-only mode (stdout logging only). Set FIREBASE_PROJECT_ID + FIREBASE_SERVICE_ACCOUNT_FILE (preferred, or FIREBASE_SERVICE_ACCOUNT_JSON / FIREBASE_SERVICE_ACCOUNT_B64), or use FIREBASE_PROJECT_ID + FIRESTORE_EMULATOR_HOST for emulator writes.'
+  )
+}
+
+if (REQUIRE_FIREBASE_WRITES && !appReady) {
+  console.error(
+    'IDLEWATCH_REQUIRE_FIREBASE_WRITES=1 requires Firebase to be configured. Set FIREBASE_PROJECT_ID with service-account creds (or FIRESTORE_EMULATOR_HOST for emulator mode).'
+  )
+  process.exit(1)
+}
+
+function ensureDirFor(filePath) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true })
+}
+
+function appendLocal(row) {
+  try {
+    ensureDirFor(LOCAL_LOG_PATH)
+    fs.appendFileSync(LOCAL_LOG_PATH, `${JSON.stringify(row)}\n`, 'utf8')
+  } catch (err) {
+    console.error(`Local log append failed (${LOCAL_LOG_PATH}): ${err.message}`)
+  }
+}
+
+function snapshotCpuTimes() {
+  return os.cpus().map((c) => ({ ...c.times }))
+}
+
+function cpuPctFromDeltas(previous, current) {
+  if (!previous || !current || previous.length !== current.length) return null
+  let idle = 0
+  let total = 0
+  for (let i = 0; i < previous.length; i++) {
+    const before = previous[i]
+    const after = current[i]
+    const didle = after.idle - before.idle
+    const dtotal =
+      (after.user - before.user) +
+      (after.nice - before.nice) +
+      (after.sys - before.sys) +
+      (after.irq - before.irq) +
+      didle
+    idle += didle
+    total += dtotal
+  }
+  if (total <= 0) return null
+  return Math.max(0, Math.min(100, Number((100 * (1 - idle / total)).toFixed(2))))
+}
+
+let previousCpuSnapshot = snapshotCpuTimes()
+function cpuPct() {
+  const current = snapshotCpuTimes()
+  const pct = cpuPctFromDeltas(previousCpuSnapshot, current)
+  previousCpuSnapshot = current
+  return pct ?? 0
+}
+
+const OPENCLAW_USAGE_TTL_MS = Math.max(INTERVAL_MS, 30000)
+const MEM_PRESSURE_TTL_MS = Math.max(INTERVAL_MS, 30000)
+let openClawUsageCache = {
+  at: 0,
+  value: {
+    usage: null,
+    probe: {
+      result: EFFECTIVE_OPENCLAW_MODE === 'off' ? 'disabled' : 'unavailable',
+      attempts: 0,
+      sweeps: 0,
+      command: null,
+      error: null,
+      usedFallbackCache: false,
+      fallbackAgeMs: null,
+      fallbackCacheSource: null
+    }
+  }
+}
+let lastGoodOpenClawUsage = (() => {
+  const cached = loadLastGoodUsageSnapshot(OPENCLAW_LAST_GOOD_CACHE_PATH)
+  if (!cached) return null
+  return { at: cached.at, usage: cached.usage, source: 'disk' }
+})()
+let preferredOpenClawProbe = null
+let memPressureCache = { at: 0, value: { pct: null, cls: 'unavailable', source: 'unavailable' } }
+
+function loadMemPressure() {
+  if (process.platform !== 'darwin') {
+    return { pct: null, cls: 'unavailable', source: 'unsupported' }
+  }
+
+  const now = Date.now()
+  if (now - memPressureCache.at < MEM_PRESSURE_TTL_MS) return memPressureCache.value
+  const sampled = memoryPressureDarwin()
+  memPressureCache = { at: now, value: sampled }
+  return sampled
+}
+
+function gpuSampleNvidiaSmi() {
+  try {
+    const probe = spawnSync(
+      'nvidia-smi',
+      ['--query-gpu=utilization.gpu', '--format=csv,noheader,nounits'],
+      { encoding: 'utf8', timeout: 1500, maxBuffer: 256 * 1024 }
+    )
+
+    if (probe.error || probe.status !== 0) {
+      return { pct: null, source: 'nvidia-smi-unavailable', confidence: 'none', sampleWindowMs: null }
+    }
+
+    const values = (probe.stdout || '')
+      .split(/\r?\n/)
+      .map((line) => Number(line.trim()))
+      .filter((value) => Number.isFinite(value) && value >= 0)
+
+    if (values.length === 0) {
+      return { pct: null, source: 'nvidia-smi-empty', confidence: 'none', sampleWindowMs: null }
+    }
+
+    const average = values.reduce((sum, value) => sum + value, 0) / values.length
+    return {
+      pct: Math.max(0, Math.min(100, average)),
+      source: 'nvidia-smi',
+      confidence: 'medium',
+      sampleWindowMs: null
+    }
+  } catch {
+    return { pct: null, source: 'nvidia-smi-error', confidence: 'none', sampleWindowMs: null }
+  }
+}
+
+function resolveOpenClawBinaries() {
+  const explicit = (process.env.IDLEWATCH_OPENCLAW_BIN?.trim()) || (process.env.IDLEWATCH_OPENCLAW_BIN_HINT?.trim())
+  const homeDir = process.env.HOME?.trim()
+
+  if (OPENCLAW_BIN_STRICT && explicit) {
+    return [explicit]
+  }
+
+  const bins = [
+    explicit,
+    '/opt/homebrew/bin/openclaw',
+    '/usr/local/bin/openclaw',
+    '/usr/bin/openclaw',
+    '/usr/local/sbin/openclaw',
+    '/usr/sbin/openclaw',
+    homeDir ? `${homeDir}/.local/bin/openclaw` : null,
+    homeDir ? `${homeDir}/bin/openclaw` : null,
+    homeDir ? `${homeDir}/.npm-global/bin/openclaw` : null,
+    homeDir ? `${homeDir}/.nvm/versions/node/${process.version}/bin/openclaw` : null,
+    '/opt/homebrew/lib/node_modules/.bin/openclaw',
+    'openclaw'
+  ].filter(Boolean)
+
+  const deduped = []
+  const seen = new Set()
+  for (const binPath of bins) {
+    if (seen.has(binPath)) continue
+    seen.add(binPath)
+    deduped.push(binPath)
+  }
+  return deduped
+}
+
+function loadOpenClawUsage(forceRefresh = false) {
+  if (EFFECTIVE_OPENCLAW_MODE === 'off') {
+    return {
+      usage: null,
+      probe: {
+        result: 'disabled',
+        attempts: 0,
+        sweeps: 0,
+        command: null,
+        error: null,
+        usedFallbackCache: false,
+        fallbackAgeMs: null,
+        fallbackCacheSource: null,
+        durationMs: null
+      }
+    }
+  }
+
+  const now = Date.now()
+  if (!forceRefresh && now - openClawUsageCache.at < OPENCLAW_USAGE_TTL_MS) return openClawUsageCache.value
+
+  const binaries = resolveOpenClawBinaries()
+  const subcommands = [
+    ['status', '--json'],
+    ['usage', '--json'],
+    ['session', 'status', '--json'],
+    ['session_status', '--json'],
+    ['stats', '--json']
+  ]
+
+  const pathEntries = (process.env.PATH || '').split(':').filter(Boolean)
+
+  function isExecutable(candidate) {
+    try {
+      accessSync(candidate, constants.X_OK)
+      return true
+    } catch {
+      return false
+    }
+  }
+
+  function hasPathExecutable(binName) {
+    for (const entry of pathEntries) {
+      const candidate = path.join(entry, binName)
+      if (isExecutable(candidate)) return true
+    }
+    return false
+  }
+
+  function isBinaryAvailable(binPath) {
+    if (binPath.includes('/')) {
+      return isExecutable(binPath)
+    }
+
+    return hasPathExecutable(binPath)
+  }
+
+  // Build an augmented PATH for probe subprocesses so that #!/usr/bin/env node
+  // scripts (like openclaw) can locate the node binary even when the packaged
+  // app runs with a restricted PATH (e.g. /usr/bin:/bin:/usr/sbin:/sbin).
+  const probeEnv = (() => {
+    const currentPath = process.env.PATH || ''
+    const extraDirs = new Set()
+
+    // Add directory of the running node binary (handles packaged + nvm setups)
+    const nodeDir = path.dirname(process.execPath)
+    if (nodeDir && nodeDir !== '.') extraDirs.add(nodeDir)
+
+    // Common Homebrew / system node locations
+    for (const dir of ['/opt/homebrew/bin', '/usr/local/bin', `${process.env.HOME || ''}/.local/bin`]) {
+      if (dir) extraDirs.add(dir)
+    }
+
+    const pathDirs = currentPath.split(':').filter(Boolean)
+    const augmented = [...new Set([...extraDirs, ...pathDirs])].join(':')
+    return { ...process.env, PATH: augmented }
+  })()
+
+  function runProbe(binPath, args) {
+    const startMs = Date.now()
+    let limit = OPENCLAW_PROBE_MAX_OUTPUT_BYTES
+
+    while (limit <= OPENCLAW_PROBE_MAX_OUTPUT_BYTES_HARD_CAP) {
+      try {
+        const result = spawnSync(binPath, args, {
+          encoding: 'utf8',
+          stdio: ['ignore', 'pipe', 'pipe'],
+          timeout: OPENCLAW_PROBE_TIMEOUT_MS,
+          maxBuffer: limit,
+          env: probeEnv
+        })
+
+        const stdoutPayload = typeof result.stdout === 'string' ? result.stdout.trim() : ''
+        const stderrPayload = typeof result.stderr === 'string' ? result.stderr.trim() : ''
+        const status = result.status === 0 ? 'ok' : 'ok-with-stderr'
+        const commandStatus = result.status
+        const combinedOutput = [stdoutPayload, stderrPayload].filter(Boolean).join('\n')
+
+        if (combinedOutput) {
+          return {
+            out: combinedOutput,
+            error: status === 'ok'
+              ? null
+              : `command-exited-${String(commandStatus || 'nonzero')}: ${(stderrPayload || 'non-zero-exit').split('\n')[0].slice(0, 120)}`,
+            status,
+            maxBuffer: limit,
+            durationMs: Date.now() - startMs
+          }
+        }
+
+        if (result.error?.code === 'ENOENT') {
+          return {
+            out: null,
+            error: 'openclaw-not-found',
+            status: 'command-error',
+            maxBuffer: limit,
+            durationMs: Date.now() - startMs
+          }
+        }
+
+        if (result.status !== 0) {
+          return {
+            out: null,
+            error: `command-exited-${String(commandStatus || 'nonzero')}`,
+            status: 'command-error',
+            maxBuffer: limit,
+            durationMs: Date.now() - startMs
+          }
+        }
+
+        return { out: null, error: null, status: 'ok', maxBuffer: limit, durationMs: Date.now() - startMs }
+      } catch (err) {
+        const stdoutText = typeof err?.stdout === 'string' ? err.stdout : ''
+        const stderrText = typeof err?.stderr === 'string' ? err.stderr : ''
+        const stdoutPayload = stdoutText.trim()
+        const stderrPayload = stderrText.trim()
+        const cmdStatus = err?.status
+
+        if ((err?.code === 'ERR_CHILD_PROCESS_STDIO_MAXBUFFER' || err?.code === 'ENOBUFS') && limit < OPENCLAW_PROBE_MAX_OUTPUT_BYTES_HARD_CAP) {
+          limit = Math.min(limit * 2, OPENCLAW_PROBE_MAX_OUTPUT_BYTES_HARD_CAP)
+          continue
+        }
+
+        if (stdoutPayload || stderrPayload) {
+          const candidateOutput = [stdoutPayload, stderrPayload].filter(Boolean).join('\n')
+          return {
+            out: candidateOutput,
+            error: `command-exited-${String(cmdStatus || 'nonzero')}: ${(stderrPayload || 'non-zero-exit').split('\n')[0].slice(0, 120)}`,
+            status: 'ok-with-stderr',
+            maxBuffer: limit,
+            durationMs: Date.now() - startMs
+          }
+        }
+
+        if (err?.code === 'ENOENT') {
+          return { out: null, error: 'openclaw-not-found', status: 'command-error', maxBuffer: limit, durationMs: Date.now() - startMs }
+        }
+
+        return {
+          out: null,
+          error: err?.message ? String(err.message).split('\n')[0].slice(0, 180) : 'command-failed',
+          status: 'command-error',
+          maxBuffer: limit,
+          durationMs: Date.now() - startMs
+        }
+      }
+    }
+
+    return {
+      out: null,
+      error: 'command-failed: max-buffer-limit-reached',
+      status: 'command-error',
+      maxBuffer: limit,
+      durationMs: Date.now() - startMs
+    }
+  }
+
+  let attempts = 0
+  let sweeps = 0
+  let sawCommandError = false
+  let sawParseError = false
+  let sawCommandMissing = false
+  let lastError = null
+
+  const evaluateProbe = (binPath, cmdArgs, isPreferred = false) => {
+    const cmdText = `${binPath} ${cmdArgs.join(' ')}`
+    attempts += 1
+    const probeRun = runProbe(binPath, cmdArgs)
+
+    if (probeRun.out !== null) {
+      const parsed = parseOpenClawUsage(probeRun.out)
+      if (parsed) {
+        preferredOpenClawProbe = { binPath, args: cmdArgs }
+        const usage = { ...parsed, sourceCommand: cmdText }
+        const value = {
+          usage,
+          probe: {
+            result: 'ok',
+            attempts,
+            sweeps,
+            command: cmdText,
+            error: probeRun.status === 'ok-with-stderr' ? probeRun.error : null,
+            usedFallbackCache: false,
+            fallbackAgeMs: null,
+            fallbackCacheSource: null,
+            durationMs: probeRun.durationMs
+          }
+        }
+        lastGoodOpenClawUsage = { at: now, usage, source: 'memory' }
+        persistLastGoodUsageSnapshot(OPENCLAW_LAST_GOOD_CACHE_PATH, { at: now, usage })
+        openClawUsageCache = { at: now, value }
+        return value
+      }
+
+      sawParseError = true
+      lastError = 'unrecognized-json-shape'
+      preferredOpenClawProbe = isPreferred ? null : preferredOpenClawProbe
+      return null
+    }
+
+    if (probeRun.status === 'command-error') {
+      if (probeRun.error === 'openclaw-not-found') {
+        sawCommandMissing = true
+        lastError = probeRun.error
+        preferredOpenClawProbe = isPreferred ? null : preferredOpenClawProbe
+        return null
+      }
+      sawCommandError = true
+      lastError = probeRun.error
+      preferredOpenClawProbe = isPreferred ? null : preferredOpenClawProbe
+      return null
+    }
+
+    return null
+  }
+
+  if (preferredOpenClawProbe) {
+    sweeps = 1
+    if (!isBinaryAvailable(preferredOpenClawProbe.binPath)) {
+      preferredOpenClawProbe = null
+    } else {
+      const cachedResult = evaluateProbe(preferredOpenClawProbe.binPath, preferredOpenClawProbe.args, true)
+      if (cachedResult) return cachedResult
+    }
+  }
+
+  for (let sweep = 0; sweep <= OPENCLAW_PROBE_RETRIES; sweep++) {
+    sweeps = sweep + 1
+    let sweepHasPotentialExecutable = false
+
+    for (const binPath of binaries) {
+      const candidateExecutable = isBinaryAvailable(binPath)
+      if (!candidateExecutable) {
+        continue
+      }
+
+      sweepHasPotentialExecutable = true
+      for (const args of subcommands) {
+        const candidateResult = evaluateProbe(binPath, args)
+        if (candidateResult) return candidateResult
+      }
+    }
+
+    if (
+      sawCommandMissing &&
+      !sawCommandError &&
+      !sawParseError &&
+      !sweepHasPotentialExecutable
+    ) {
+      break
+    }
+  }
+
+  const result = sawParseError
+    ? 'parse-error'
+    : sawCommandError
+      ? 'command-error'
+      : 'command-missing'
+
+  const fallbackAgeMs = lastGoodOpenClawUsage ? now - lastGoodOpenClawUsage.at : null
+  if (lastGoodOpenClawUsage && Number.isFinite(fallbackAgeMs) && fallbackAgeMs <= OPENCLAW_LAST_GOOD_MAX_AGE_MS) {
+    const value = {
+      usage: { ...lastGoodOpenClawUsage.usage, sourceCommand: `${lastGoodOpenClawUsage.usage.sourceCommand} (cached)` },
+      probe: {
+        result: 'fallback-cache',
+        attempts,
+        sweeps,
+        command: null,
+        error: lastError,
+        usedFallbackCache: true,
+        fallbackAgeMs,
+        fallbackCacheSource: lastGoodOpenClawUsage.source || 'memory',
+        durationMs: null
+      }
+    }
+    openClawUsageCache = { at: now, value }
+    return value
+  }
+
+  const value = {
+    usage: null,
+    probe: {
+      result,
+      attempts,
+      sweeps,
+      command: null,
+      error: lastError,
+      usedFallbackCache: false,
+      fallbackAgeMs: null,
+      fallbackCacheSource: null,
+      durationMs: null
+    }
+  }
+  openClawUsageCache = { at: now, value }
+  return value
+}
+
+async function publish(row, retries = 2) {
+  if (DRY_RUN) return false
+
+  if (CLOUD_INGEST_URL && CLOUD_API_KEY) {
+    let attempt = 0
+    while (attempt <= retries) {
+      try {
+        const response = await fetch(CLOUD_INGEST_URL, {
+          method: 'POST',
+          headers: {
+            'content-type': 'application/json',
+            'x-idlewatch-key': CLOUD_API_KEY
+          },
+          body: JSON.stringify(row)
+        })
+        if (!response.ok) {
+          throw new Error(`cloud_ingest_failed_${response.status}`)
+        }
+        return true
+      } catch (err) {
+        if (attempt >= retries) throw err
+        await new Promise((resolve) => setTimeout(resolve, 300 * (attempt + 1)))
+        attempt += 1
+      }
+    }
+    return false
+  }
+
+  if (!appReady) return false
+  const db = admin.firestore()
+  let attempt = 0
+  while (attempt <= retries) {
+    try {
+      await db.collection('metrics').add(row)
+      return true
+    } catch (err) {
+      if (attempt >= retries) throw err
+      await new Promise((resolve) => setTimeout(resolve, 300 * (attempt + 1)))
+      attempt += 1
+    }
+  }
+  return false
+}
+
+async function collectSample() {
+  const sampleStartMs = Date.now()
+  const openclawEnabled = EFFECTIVE_OPENCLAW_MODE !== 'off'
+
+  const disabledProbe = {
+    result: 'disabled',
+    attempts: 0,
+    sweeps: 0,
+    error: null,
+    durationMs: null,
+    usedFallbackCache: false,
+    fallbackAgeMs: null,
+    fallbackCacheSource: null
+  }
+
+  let usageProbe = openclawEnabled ? loadOpenClawUsage() : { usage: null, probe: disabledProbe }
+  let usage = usageProbe.usage
+  let usageFreshness = deriveUsageFreshness(usage, sampleStartMs, USAGE_STALE_MS, USAGE_NEAR_STALE_MS, USAGE_STALE_GRACE_MS)
+  let usageRefreshAttempted = false
+  let usageRefreshRecovered = false
+  let usageRefreshAttempts = 0
+  let usageRefreshDurationMs = null
+  let usageRefreshStartMs = null
+
+  const shouldRefreshForNearStale = USAGE_REFRESH_ON_NEAR_STALE === 1 && usageFreshness.isNearStale
+  const canRefreshFromCurrentState = usageProbe.probe.result === 'ok' || usageProbe.probe.result === 'fallback-cache'
+
+  if (openclawEnabled && usage && (usageFreshness.isPastStaleThreshold || shouldRefreshForNearStale) && canRefreshFromCurrentState) {
+    usageRefreshAttempted = true
+    usageRefreshStartMs = Date.now()
+
+    for (let attempt = 0; attempt <= USAGE_REFRESH_REPROBES; attempt++) {
+      usageRefreshAttempts += 1
+      if (attempt > 0 && USAGE_REFRESH_DELAY_MS > 0) {
+        await new Promise((resolve) => setTimeout(resolve, USAGE_REFRESH_DELAY_MS))
+      }
+
+      const refreshedUsageProbe = loadOpenClawUsage(true)
+      const refreshedUsage = refreshedUsageProbe.usage
+      const refreshedUsageTs = refreshedUsage?.usageTimestampMs
+      const previousUsageTs = usage?.usageTimestampMs
+
+      if (Number.isFinite(refreshedUsageTs) && (!Number.isFinite(previousUsageTs) || refreshedUsageTs > previousUsageTs)) {
+        usageProbe = refreshedUsageProbe
+        usage = refreshedUsage
+        usageFreshness = deriveUsageFreshness(usage, Date.now(), USAGE_STALE_MS, USAGE_NEAR_STALE_MS, USAGE_STALE_GRACE_MS)
+      }
+
+      if (!usageFreshness.isPastStaleThreshold) break
+    }
+
+    usageRefreshDurationMs = usageRefreshStartMs !== null ? Date.now() - usageRefreshStartMs : null
+    usageRefreshRecovered = usageFreshness.isPastStaleThreshold === false
+  }
+
+  const sampleAtMs = Date.now()
+  if (usage) {
+    usageFreshness = deriveUsageFreshness(usage, sampleAtMs, USAGE_STALE_MS, USAGE_NEAR_STALE_MS, USAGE_STALE_GRACE_MS)
+  }
+
+  const gpu = MONITOR_GPU
+    ? (process.platform === 'darwin'
+      ? gpuSampleDarwin()
+      : gpuSampleNvidiaSmi())
+    : { pct: null, source: 'disabled', confidence: 'none', sampleWindowMs: null }
+
+  const memPressure = MONITOR_MEMORY
+    ? loadMemPressure()
+    : { pct: null, cls: 'disabled', source: 'disabled' }
+
+  const usedMemPct = MONITOR_MEMORY ? memUsedPct() : null
+
+  const usageIntegrationStatus = usage
+    ? usageFreshness.isStale
+      ? 'stale'
+      : usage?.integrationStatus === 'partial'
+        ? 'ok'
+        : (usage?.integrationStatus ?? 'ok')
+    : (openclawEnabled ? 'unavailable' : 'disabled')
+
+  const source = {
+    monitorTargets: [...MONITOR_TARGETS],
+    usage: usage ? 'openclaw' : openclawEnabled ? 'unavailable' : 'disabled',
+    usageIntegrationStatus,
+    usageIngestionStatus: openclawEnabled
+      ? usage && ['ok', 'fallback-cache'].includes(usageProbe.probe.result)
+        ? 'ok'
+        : 'unavailable'
+      : 'disabled',
+    usageActivityStatus: usage
+      ? usageFreshness.freshnessState
+      : (openclawEnabled ? 'unavailable' : 'disabled'),
+    usageProbeResult: usageProbe.probe.result,
+    usageProbeAttempts: usageProbe.probe.attempts,
+    usageProbeSweeps: usageProbe.probe.sweeps,
+    usageProbeTimeoutMs: OPENCLAW_PROBE_TIMEOUT_MS,
+    usageProbeRetries: OPENCLAW_PROBE_RETRIES,
+    usageProbeError: usageProbe.probe.error,
+    usageProbeDurationMs: usageProbe.probe.durationMs,
+    usageUsedFallbackCache: usageProbe.probe.usedFallbackCache,
+    usageFallbackCacheAgeMs: usageProbe.probe.fallbackAgeMs,
+    usageFallbackCacheSource: usageProbe.probe.fallbackCacheSource,
+    usageFreshnessState: openclawEnabled
+      ? usage
+        ? usageFreshness.freshnessState
+        : null
+      : 'disabled',
+    usageNearStale: usage ? usageFreshness.isNearStale : false,
+    usagePastStaleThreshold: usage ? usageFreshness.isPastStaleThreshold : false,
+    usageRefreshAttempted,
+    usageRefreshRecovered,
+    usageRefreshAttempts,
+    usageRefreshReprobes: USAGE_REFRESH_REPROBES,
+    usageRefreshDelayMs: USAGE_REFRESH_DELAY_MS,
+    usageRefreshDurationMs,
+    usageRefreshOnNearStale: USAGE_REFRESH_ON_NEAR_STALE === 1,
+    usageIdleAfterMsThreshold: USAGE_IDLE_AFTER_MS,
+    usageIdle: usage ? (Number.isFinite(usageFreshness.usageAgeMs) && usageFreshness.usageAgeMs >= USAGE_IDLE_AFTER_MS) : false,
+    usageCommand: usage?.sourceCommand ?? null,
+    usageStaleMsThreshold: USAGE_STALE_MS,
+    usageNearStaleMsThreshold: USAGE_NEAR_STALE_MS,
+    usageStaleGraceMs: USAGE_STALE_GRACE_MS,
+    memPressureSource: memPressure.source
+  }
+
+  const usageAlert = deriveUsageAlert(source, { usageAgeMs: usageFreshness.usageAgeMs, idleAfterMs: USAGE_IDLE_AFTER_MS })
+  source.usageAlertLevel = usageAlert.level
+  source.usageAlertReason = usageAlert.reason
+
+  const row = {
+    host: HOST,
+    ts: sampleAtMs,
+    cpuPct: MONITOR_CPU ? cpuPct() : null,
+    memPct: MONITOR_MEMORY ? usedMemPct : null,
+    memUsedPct: MONITOR_MEMORY ? usedMemPct : null,
+    memPressurePct: MONITOR_MEMORY ? memPressure.pct : null,
+    memPressureClass: MONITOR_MEMORY ? memPressure.cls : 'disabled',
+    gpuPct: MONITOR_GPU ? gpu.pct : null,
+    gpuSource: gpu.source,
+    gpuConfidence: gpu.confidence,
+    gpuSampleWindowMs: gpu.sampleWindowMs,
+    tokensPerMin: MONITOR_OPENCLAW ? (usage?.tokensPerMin ?? null) : null,
+    openclawModel: MONITOR_OPENCLAW ? (usage?.model ?? null) : null,
+    openclawTotalTokens: MONITOR_OPENCLAW ? (usage?.totalTokens ?? null) : null,
+    openclawSessionId: MONITOR_OPENCLAW ? (usage?.sessionId ?? null) : null,
+    openclawAgentId: MONITOR_OPENCLAW ? (usage?.agentId ?? null) : null,
+    openclawUsageTs: MONITOR_OPENCLAW ? (usage?.usageTimestampMs ?? null) : null,
+    openclawUsageAgeMs: MONITOR_OPENCLAW ? usageFreshness.usageAgeMs : null,
+    source
+  }
+
+  return enrichWithOpenClawFleetTelemetry(row, {
+    host: HOST,
+    collectedAtMs: sampleAtMs,
+    collector: 'idlewatch-agent',
+    collectorVersion: pkg.version
+  })
+}
+
+async function tick() {
+  const row = await collectSample()
+  console.log(JSON.stringify(row))
+  appendLocal(row)
+  const published = await publish(row)
+  if (REQUIRE_FIREBASE_WRITES && ONCE && !published) {
+    throw new Error('Firebase write was required but not executed. Check Firebase configuration and connectivity.')
+  }
+  if (REQUIRE_CLOUD_WRITES && ONCE && !published) {
+    throw new Error('Cloud write was required but not executed. Check API key and cloud connectivity.')
+  }
+}
+
+let running = false
+let stopped = false
+let inflightTick = null
+
+async function loop() {
+  if (stopped || running) return
+  running = true
+  try {
+    inflightTick = tick()
+    await inflightTick
+  } catch (e) {
+    console.error(e.message)
+  } finally {
+    inflightTick = null
+    running = false
+    if (!stopped) setTimeout(loop, INTERVAL_MS)
+  }
+}
+
+async function gracefulShutdown(signal) {
+  if (stopped) return
+  stopped = true
+  if (inflightTick) {
+    console.log(`idlewatch-agent received ${signal}, waiting for in-flight sample…`)
+    try { await inflightTick } catch { /* already logged */ }
+  }
+  console.log('idlewatch-agent stopped')
+  process.exit(0)
+}
+
+process.on('SIGINT', () => gracefulShutdown('SIGINT'))
+process.on('SIGTERM', () => gracefulShutdown('SIGTERM'))
+
+if (DRY_RUN || ONCE) {
+  const mode = DRY_RUN ? 'dry-run' : 'once'
+  console.log(
+    `idlewatch-agent ${mode} host=${HOST} intervalMs=${INTERVAL_MS} firebase=${appReady} localLog=${LOCAL_LOG_PATH}`
+  )
+  tick()
+    .then(() => process.exit(0))
+    .catch((e) => {
+      console.error(e.message)
+      process.exit(1)
+    })
+} else {
+  console.log(
+    `idlewatch-agent started host=${HOST} intervalMs=${INTERVAL_MS} firebase=${appReady} localLog=${LOCAL_LOG_PATH} monitorTargets=${[...MONITOR_TARGETS].join(',')} openclawUsage=${EFFECTIVE_OPENCLAW_MODE}`
+  )
+  loop()
+}