neuralos 2.9.1 → 2.9.2

package/bin/gybackend.cjs

@@ -9040,7 +9040,7 @@ var require_eventemitter3 = __commonJS({
       if (listeners.fn) return 1;
       return listeners.length;
     };
-    EventEmitter4.prototype.emit = function emit9(event, a1, a2, a3, a4, a5) {
+    EventEmitter4.prototype.emit = function emit10(event, a1, a2, a3, a4, a5) {
       var evt = prefix ? prefix + event : event;
       if (!this._events[evt]) return false;
       var listeners = this._events[evt], len = arguments.length, args, i;
@@ -51648,7 +51648,7 @@ var require_pdf_worker = __commonJS({
             });
             exports3.getMetrics = void 0;
             var _util = __w_pdfjs_require__(0);
-            var getMetrics = (0, _util.getLookupTableFactory)(function(t) {
+            var getMetrics2 = (0, _util.getLookupTableFactory)(function(t) {
               t["Courier"] = 600;
               t["Courier-Bold"] = 600;
               t["Courier-BoldOblique"] = 600;
@@ -54586,7 +54586,7 @@ var require_pdf_worker = __commonJS({
                 t2["a191"] = 918;
               });
             });
-            exports3.getMetrics = getMetrics;
+            exports3.getMetrics = getMetrics2;
           }),
           /* 142 */
           /***/
@@ -113850,7 +113850,7 @@ var require_pdf_worker2 = __commonJS({
             });
             exports3.getMetrics = void 0;
             var _util = __w_pdfjs_require__(0);
-            var getMetrics = (0, _util.getLookupTableFactory)(function(t) {
+            var getMetrics2 = (0, _util.getLookupTableFactory)(function(t) {
               t["Courier"] = 600;
               t["Courier-Bold"] = 600;
               t["Courier-BoldOblique"] = 600;
@@ -116788,7 +116788,7 @@ var require_pdf_worker2 = __commonJS({
                 t2["a191"] = 918;
               });
             });
-            exports3.getMetrics = getMetrics;
+            exports3.getMetrics = getMetrics2;
           }),
           /* 141 */
           /***/
@@ -170585,7 +170585,7 @@ var require_pdf_worker3 = __commonJS({
             });
             exports3.getMetrics = void 0;
             var _util = __w_pdfjs_require__(0);
-            var getMetrics = (0, _util.getLookupTableFactory)(function(t) {
+            var getMetrics2 = (0, _util.getLookupTableFactory)(function(t) {
               t["Courier"] = 600;
               t["Courier-Bold"] = 600;
               t["Courier-BoldOblique"] = 600;
@@ -173523,7 +173523,7 @@ var require_pdf_worker3 = __commonJS({
                 t2["a191"] = 918;
               });
             });
-            exports3.getMetrics = getMetrics;
+            exports3.getMetrics = getMetrics2;
           }),
           /* 30 */
           /***/
@@ -229083,7 +229083,7 @@ var require_pdf_worker4 = __commonJS({
             });
             exports3.getMetrics = void 0;
             var _util = __w_pdfjs_require__(2);
-            var getMetrics = (0, _util.getLookupTableFactory)(function(t) {
+            var getMetrics2 = (0, _util.getLookupTableFactory)(function(t) {
               t["Courier"] = 600;
               t["Courier-Bold"] = 600;
               t["Courier-BoldOblique"] = 600;
@@ -232021,7 +232021,7 @@ var require_pdf_worker4 = __commonJS({
                 t2["a191"] = 918;
               });
             });
-            exports3.getMetrics = getMetrics;
+            exports3.getMetrics = getMetrics2;
           }),
           /* 149 */
           /***/
@@ -281574,18 +281574,18 @@ var SSHBackend = class _SSHBackend {
     });
     return info.socket;
   }
-  async buildConnectSocketIfNeeded(sshConfig, emit9) {
+  async buildConnectSocketIfNeeded(sshConfig, emit10) {
     if (sshConfig.jumpHost) {
       const jumpId = `[Jump:${sshConfig.jumpHost.host}]`;
       console.log(`${jumpId} Starting jump host connection flow...`);
-      emit9(
+      emit10(
         `\x1B[36m\u25B9 ${jumpId} Establishing tunnel via jump host ${sshConfig.jumpHost.host}...\x1B[0m\r
 `
       );
       const jumpClient = new (loadSsh2()).Client();
       const jumpSock = await this.buildConnectSocketIfNeeded(
         sshConfig.jumpHost,
-        emit9
+        emit10
       );
       if (jumpSock) {
         console.log(
@@ -281629,7 +281629,7 @@ var SSHBackend = class _SSHBackend {
         });
         jumpClient.connect(jumpConnectConfig);
       });
-      emit9(
+      emit10(
         `\x1B[32m\u2714 ${jumpId} Jump host ready. Requesting forward to target ${sshConfig.host}:${sshConfig.port}...\x1B[0m\r
 `
       );
@@ -281945,25 +281945,25 @@ var SSHBackend = class _SSHBackend {
     };
     this.sessions.set(config2.id, instance);
     (async () => {
-      const emit9 = (data) => {
+      const emit10 = (data) => {
         instance.dataCallbacks.forEach((cb) => cb(data));
       };
       const emitExit = (code) => {
         this.emitExitOnce(config2.id, instance, code);
       };
       client2.on("ready", async () => {
-        emit9("\x1B[2J\x1B[H\x1B[32m\u2714 Connection established.\x1B[0m\r\n");
+        emit10("\x1B[2J\x1B[H\x1B[32m\u2714 Connection established.\x1B[0m\r\n");
         console.log(
           `[SSH] Connection ready for ${sshConfig.host}:${sshConfig.port}`
         );
         const rawShell = isRawShellPreset(sshConfig.algorithmsPreset);
         try {
-          emit9("\x1B[36m\u25B9 Setting up port forwards...\x1B[0m\r\n");
+          emit10("\x1B[36m\u25B9 Setting up port forwards...\x1B[0m\r\n");
           console.log(`[SSH] Setting up port forwards...`);
           await this.setupPortForwards(instance, sshConfig);
         } catch (e) {
           console.error(`[SSH] Port forward setup failed:`, e);
-          emit9(`\x1B[31m\u2718 Port forward failed: ${e.message}\x1B[0m\r
+          emit10(`\x1B[31m\u2718 Port forward failed: ${e.message}\x1B[0m\r
 `);
         }
         if (rawShell) {
@@ -281973,7 +281973,7 @@ var SSHBackend = class _SSHBackend {
           );
         } else {
           try {
-            emit9("\x1B[36m\u25B9 Detecting remote OS...\x1B[0m\r\n");
+            emit10("\x1B[36m\u25B9 Detecting remote OS...\x1B[0m\r\n");
             console.log(`[SSH] Detecting remote OS...`);
             const uname = await this.execCollect(client2, "uname -s");
             const u = (uname.stdout || uname.stderr || "").toLowerCase();
@@ -281993,13 +281993,13 @@ var SSHBackend = class _SSHBackend {
           if (!instance.remoteOs) instance.remoteOs = "unix";
           console.log(`[SSH] Remote OS detected: ${instance.remoteOs}`);
           try {
-            emit9("\x1B[36m\u25B9 Initializing SFTP channel...\x1B[0m\r\n");
+            emit10("\x1B[36m\u25B9 Initializing SFTP channel...\x1B[0m\r\n");
             await this.initializeSftp(instance);
-            emit9("\x1B[32m\u2714 SFTP channel ready.\x1B[0m\r\n");
+            emit10("\x1B[32m\u2714 SFTP channel ready.\x1B[0m\r\n");
           } catch (error40) {
             const message = error40 instanceof Error ? error40.message : String(error40);
             instance.sftpInitError = message;
-            emit9(
+            emit10(
               `\x1B[33m\u26A0 SFTP unavailable: ${message}. File panel features may be limited.\x1B[0m\r
 `
             );
@@ -282012,7 +282012,7 @@ var SSHBackend = class _SSHBackend {
             }
           }
         }
-        emit9("\x1B[36m\u25B9 Opening interactive shell...\x1B[0m\r\n");
+        emit10("\x1B[36m\u25B9 Opening interactive shell...\x1B[0m\r\n");
         console.log(`[SSH] Opening interactive shell...`);
         const initialWindowSize = this.resolveRequestedWindowSize(instance, {
           cols: config2.cols,
@@ -282042,7 +282042,7 @@ var SSHBackend = class _SSHBackend {
               console.error(`[SSH] Failed to open shell:`, err);
               instance.initializationState = "failed";
               instance.isInitializing = false;
-              emit9(`\x1B[31m\u2718 Failed to open shell: ${err.message}\x1B[0m\r
+              emit10(`\x1B[31m\u2718 Failed to open shell: ${err.message}\x1B[0m\r
 `);
               emitExit(-1);
               return;
@@ -282052,7 +282052,7 @@ var SSHBackend = class _SSHBackend {
             if (rawShell) {
               instance.initializationState = "ready";
               instance.isInitializing = false;
-              emit9("\x1B[32m\u2714 Shell ready.\x1B[0m\r\n");
+              emit10("\x1B[32m\u2714 Shell ready.\x1B[0m\r\n");
               console.log(
                 `[SSH] Raw-shell mode: shell ready immediately (preset=${sshConfig.algorithmsPreset}).`
               );
@@ -282060,14 +282060,14 @@ var SSHBackend = class _SSHBackend {
                 const chunk2 = data.toString();
                 const sanitizedChunk = this.stripReadyMarker(chunk2);
                 this.consumeOscMarkers(instance, sanitizedChunk);
-                if (sanitizedChunk) emit9(sanitizedChunk);
+                if (sanitizedChunk) emit10(sanitizedChunk);
               });
               stream.on("close", async (code) => {
                 emitExit(typeof code === "number" ? code : 0);
               });
               return;
             }
-            emit9("\x1B[36m\u25B9 Initializing shell integration...\x1B[0m\r\n");
+            emit10("\x1B[36m\u25B9 Initializing shell integration...\x1B[0m\r\n");
             console.log(
               `[SSH] Shell stream opened. Starting robust initialization...`
             );
@@ -282113,7 +282113,7 @@ var SSHBackend = class _SSHBackend {
                 if (retryCount >= maxRetries) {
                   instance.initializationState = "failed";
                   instance.isInitializing = false;
-                  emit9(
+                  emit10(
                     "\x1B[31m\u2718 Initialization failed. Entering fallback mode.\x1B[0m\r\n"
                   );
                   console.error(
@@ -282122,7 +282122,7 @@ var SSHBackend = class _SSHBackend {
                   clearInterval(watchdogInterval);
                   return;
                 }
-                emit9(
+                emit10(
                   `\x1B[33m\u26A0 Initialization timeout, retrying (${retryCount}/${maxRetries})...\x1B[0m\r
 `
                 );
@@ -282136,7 +282136,7 @@ var SSHBackend = class _SSHBackend {
               if (instance.isInitializing) {
                 instance.buffer += chunk2;
                 if (instance.buffer.includes(GYSHELL_READY_MARKER2)) {
-                  emit9("\x1B[2J\x1B[H");
+                  emit10("\x1B[2J\x1B[H");
                   isReadySent = true;
                   clearInterval(watchdogInterval);
                   const sawContinuation = /(?:\r?\n)>>\s*\r?\n/.test(instance.buffer) || instance.buffer.trimEnd().endsWith("\n>>") || instance.buffer.trimEnd().endsWith("\r\n>>");
@@ -282147,7 +282147,7 @@ var SSHBackend = class _SSHBackend {
                     const realContent = this.stripReadyMarker(
                       parts.slice(1).join(GYSHELL_READY_MARKER2)
                     ).trimStart();
-                    if (realContent) emit9(realContent);
+                    if (realContent) emit10(realContent);
                   }
                   instance.buffer = "";
                   if (sawContinuation && instance.remoteOs === "windows" && instance.stream) {
@@ -282163,7 +282163,7 @@ var SSHBackend = class _SSHBackend {
                 const sanitizedChunk = this.stripReadyMarker(chunk2);
                 this.consumeOscMarkers(instance, sanitizedChunk);
                 if (sanitizedChunk) {
-                  emit9(sanitizedChunk);
+                  emit10(sanitizedChunk);
                 }
               }
             });
@@ -282177,7 +282177,7 @@ var SSHBackend = class _SSHBackend {
         console.error(`[SSH] Client error:`, err);
         instance.initializationState = "failed";
         instance.isInitializing = false;
-        emit9(`\x1B[31m\u2718 SSH Error: ${err.message}\x1B[0m\r
+        emit10(`\x1B[31m\u2718 SSH Error: ${err.message}\x1B[0m\r
 `);
         emitExit(-1);
       });
@@ -282200,7 +282200,7 @@ var SSHBackend = class _SSHBackend {
               sshConfig.privateKeyPath
             );
           } catch (e) {
-            emit9(
+            emit10(
               `\x1B[31m\u2718 Failed to read private key: ${e.message}\x1B[0m\r
 `
             );
@@ -282212,19 +282212,19 @@ var SSHBackend = class _SSHBackend {
       }
       try {
         await new Promise((r) => setTimeout(r, 50));
-        emit9(
+        emit10(
           `\x1B[36m\u25B9 Connecting to ${sshConfig.host}:${sshConfig.port}...\x1B[0m\r
 `
         );
         console.log(
           `[SSH] Attempting to connect to ${sshConfig.host}:${sshConfig.port}...`
         );
-        const sock = await this.buildConnectSocketIfNeeded(sshConfig, emit9);
+        const sock = await this.buildConnectSocketIfNeeded(sshConfig, emit10);
         if (sock) {
           console.log(
             `[SSH] SUCCESS: Connection to ${sshConfig.host} will be tunneled through sock (Jump Host/Proxy).`
           );
-          emit9(
+          emit10(
             "\x1B[36m\u25B9 [Final] Using tunnel socket for target connection...\x1B[0m\r\n"
           );
           connectConfig.sock = sock;
@@ -282238,7 +282238,7 @@ var SSHBackend = class _SSHBackend {
         const errMsg = e instanceof Error ? e.message : String(e);
         instance.initializationState = "failed";
         instance.isInitializing = false;
-        emit9(`\x1B[31m\u2718 Connection failed: ${errMsg}\x1B[0m\r
+        emit10(`\x1B[31m\u2718 Connection failed: ${errMsg}\x1B[0m\r
 `);
         emitExit(-1);
       }
@@ -327549,7 +327549,7 @@ var initializeSax = function() {
     if (parser.opt.xmlns) parser.ns = Object.create(rootNS);
     parser.trackPosition = parser.opt.position !== false;
     if (parser.trackPosition) parser.position = parser.line = parser.column = 0;
-    emit9(parser, "onready");
+    emit10(parser, "onready");
   }
   if (!Object.create) Object.create = function(o) {
     function F() {
@@ -328015,16 +328015,16 @@ var initializeSax = function() {
   });
   for (var s in sax$1.STATE) sax$1.STATE[sax$1.STATE[s]] = s;
   S = sax$1.STATE;
-  function emit9(parser, event, data) {
+  function emit10(parser, event, data) {
     parser[event] && parser[event](data);
   }
   function emitNode(parser, nodeType, data) {
     if (parser.textNode) closeText(parser);
-    emit9(parser, nodeType, data);
+    emit10(parser, nodeType, data);
   }
   function closeText(parser) {
     parser.textNode = textopts(parser.opt, parser.textNode);
-    if (parser.textNode) emit9(parser, "ontext", parser.textNode);
+    if (parser.textNode) emit10(parser, "ontext", parser.textNode);
     parser.textNode = "";
   }
   function textopts(opt, text) {
@@ -328037,7 +328037,7 @@ var initializeSax = function() {
     if (parser.trackPosition) er += "\nLine: " + parser.line + "\nColumn: " + parser.column + "\nChar: " + parser.c;
     er = new Error(er);
     parser.error = er;
-    emit9(parser, "onerror", er);
+    emit10(parser, "onerror", er);
     return parser;
   }
   function end(parser) {
@@ -328046,7 +328046,7 @@ var initializeSax = function() {
     closeText(parser);
     parser.c = "";
     parser.closed = true;
-    emit9(parser, "onend");
+    emit10(parser, "onend");
     SAXParser.call(parser, parser.strict, parser.opt);
     return parser;
   }
@@ -346381,6 +346381,332 @@ ${body}`;
   return msg;
 }
 
+// packages/backend/src/services/AgentHelper/tools/observability_tools.ts
+function emit9(context2, toolName, input, output) {
+  context2.sendEvent(context2.sessionId, {
+    messageId: context2.messageId,
+    type: "tool_call",
+    toolName,
+    input: typeof input === "string" ? input : JSON.stringify(input),
+    output
+  });
+}
+function obs(context2, toolName, args) {
+  const o = context2.observability;
+  if (!o) {
+    const msg = `${toolName} is not available in this runtime (observability not wired).`;
+    emit9(context2, toolName, args, msg);
+    return { o: null, msg };
+  }
+  return { o, msg: null };
+}
+var getMetricsSchema = external_exports.object({
+  format: external_exports.enum(["prometheus", "summary"]).optional().describe("'prometheus' = exposition text for a scraper; 'summary' = dashboard summary line (default).")
+});
+async function getMetrics(args, context2) {
+  const { o, msg } = obs(context2, "get_metrics", args);
+  if (!o) return msg;
+  const out = args.format === "prometheus" ? o.metricsExport.renderPrometheus() || "# no host metrics recorded yet" : await o.dashboard.summary();
+  emit9(context2, "get_metrics", args, out);
+  return out;
+}
+var manageSecretSchema = external_exports.object({
+  action: external_exports.enum(["list", "set", "delete", "has"]).describe("list metadata (never values), set a secret, delete one, or check existence."),
+  key: external_exports.string().optional().describe("Secret key (required for set/delete/has)."),
+  value: external_exports.string().optional().describe("Secret value (required for set). Never echoed back."),
+  labels: external_exports.record(external_exports.string()).optional().describe("Optional labels (service, scope, connection id).")
+});
+async function manageSecret(args, context2) {
+  const { o, msg } = obs(context2, "manage_secret", args);
+  if (!o) return msg;
+  const v = o.secrets;
+  if (!v.unlocked()) {
+    const m = "Secrets vault is locked \u2014 start RTerm with RTERM_SECRETS_MASTER_KEY set.";
+    emit9(context2, "manage_secret", args, m);
+    return m;
+  }
+  let out;
+  if (args.action === "list") {
+    const items = v.list();
+    out = items.length ? items.map((m) => `- ${m.key}${m.labels ? ` ${JSON.stringify(m.labels)}` : ""} (updated ${new Date(m.updatedAt).toISOString()})`).join("\n") : "No secrets stored.";
+  } else if (args.action === "set") {
+    if (!args.key || args.value === void 0) {
+      out = "set requires key + value.";
+    } else {
+      v.set(args.key, args.value, args.labels);
+      out = `Stored secret '${args.key}'.`;
+    }
+  } else if (args.action === "delete") {
+    if (!args.key) {
+      out = "delete requires key.";
+    } else {
+      out = v.delete(args.key) ? `Deleted secret '${args.key}'.` : `No secret '${args.key}'.`;
+    }
+  } else {
+    if (!args.key) {
+      out = "has requires key.";
+    } else {
+      out = v.has(args.key) ? `'${args.key}' exists.` : `'${args.key}' does not exist.`;
+    }
+  }
+  emit9(context2, "manage_secret", args, out);
+  return out;
+}
+var manageOncallSchema = external_exports.object({
+  action: external_exports.enum(["open_pages", "page", "ack", "resolve", "list_policies", "tick"]).describe("List open pages, raise a page, ack/resolve a page, list policies, or advance the escalation clock."),
+  pageId: external_exports.string().optional().describe("Page id (ack/resolve)."),
+  by: external_exports.string().optional().describe("Who is acknowledging (ack)."),
+  incidentId: external_exports.string().optional().describe("Incident id (page)."),
+  policyId: external_exports.string().optional().describe("Escalation policy id (page)."),
+  title: external_exports.string().optional().describe("Page title (page)."),
+  severity: external_exports.string().optional().describe("Severity e.g. sev1/sev2/sev3 (page).")
+});
+async function manageOncall(args, context2) {
+  const { o, msg } = obs(context2, "manage_oncall", args);
+  if (!o) return msg;
+  const s = o.oncall;
+  let out;
+  try {
+    if (args.action === "open_pages") {
+      const pages = s.openPages();
+      out = pages.length ? pages.map((p) => `- [${p.severity}] ${p.title} (level ${p.levelIndex}, page ${p.id})`).join("\n") : "No open pages.";
+    } else if (args.action === "list_policies") {
+      const pols = s.listPolicies();
+      out = pols.length ? pols.map((p) => `- ${p.name} (${p.id}): ${p.levels.length} level(s)`).join("\n") : "No escalation policies registered.";
+    } else if (args.action === "page") {
+      if (!args.incidentId || !args.policyId || !args.title || !args.severity) {
+        out = "page requires incidentId, policyId, title, severity.";
+      } else {
+        const p = await s.page({ incidentId: args.incidentId, policyId: args.policyId, title: args.title, severity: args.severity });
+        out = `Paged (page ${p.id}) at level 0.`;
+      }
+    } else if (args.action === "ack") {
+      if (!args.pageId || !args.by) {
+        out = "ack requires pageId + by.";
+      } else {
+        s.acknowledge(args.pageId, args.by);
+        out = `Page ${args.pageId} acknowledged by ${args.by}.`;
+      }
+    } else if (args.action === "resolve") {
+      if (!args.pageId) {
+        out = "resolve requires pageId.";
+      } else {
+        s.resolve(args.pageId);
+        out = `Page ${args.pageId} resolved.`;
+      }
+    } else {
+      const esc2 = await s.tick();
+      out = esc2.length ? `Escalated ${esc2.length} page(s).` : "No pages needed escalation.";
+    }
+  } catch (e) {
+    out = `on-call error: ${e instanceof Error ? e.message : String(e)}`;
+  }
+  emit9(context2, "manage_oncall", args, out);
+  return out;
+}
+var getCostSchema = external_exports.object({
+  action: external_exports.enum(["summary", "check", "list_budgets"]).describe("summary of spend, check a run against budgets, or list budgets."),
+  period: external_exports.enum(["daily", "monthly"]).optional().describe("Window for summary (default daily)."),
+  model: external_exports.string().optional().describe("Filter by model / the model to check."),
+  profileId: external_exports.string().optional().describe("Filter by profile / the profile to check.")
+});
+async function getCost(args, context2) {
+  const { o, msg } = obs(context2, "get_cost", args);
+  if (!o) return msg;
+  let out;
+  if (args.action === "summary") {
+    const s = o.cost.summarize({ period: args.period ?? "daily", model: args.model, profileId: args.profileId });
+    const lines = s.byModel.map((m) => `  ${m.model}: $${m.usd.toFixed(4)} (${m.promptTokens}in/${m.completionTokens}out)`).join("\n");
+    out = `Spend (${args.period ?? "daily"}): $${s.totalUsd.toFixed(4)} total.${lines ? "\n" + lines : ""}`;
+  } else if (args.action === "check") {
+    const r = o.cost.check({ model: args.model, profileId: args.profileId });
+    out = `Budget check \u2192 ${r.action.toUpperCase()}${r.statuses.length ? ` (${r.statuses.map((s) => `${s.budget.id}=${(s.ratio * 100).toFixed(0)}%`).join(", ")})` : " (no matching budgets)"}.`;
+  } else {
+    const b = o.cost.listBudgets();
+    out = b.length ? b.map((x) => `- ${x.id}: ${x.model ?? "*"}/${x.profileId ?? "*"} ${x.period} cap $${x.capUsd}`).join("\n") : "No budgets configured.";
+  }
+  emit9(context2, "get_cost", args, out);
+  return out;
+}
+var manageRecordingSchema = external_exports.object({
+  action: external_exports.enum(["list", "start", "stop", "replay", "export_cast", "delete"]).describe("List, start, stop, replay, export (.cast), or delete a recording."),
+  recordingId: external_exports.string().optional().describe("Recording id (stop/replay/export_cast/delete)."),
+  terminalId: external_exports.string().optional().describe("Terminal to record (start)."),
+  title: external_exports.string().optional().describe("Title (start)."),
+  fromSec: external_exports.number().optional().describe("Replay start offset seconds."),
+  durationSec: external_exports.number().optional().describe("Replay duration seconds.")
+});
+async function manageRecording(args, context2) {
+  const { o, msg } = obs(context2, "manage_recording", args);
+  if (!o) return msg;
+  const r = o.recording;
+  let out;
+  try {
+    if (args.action === "list") {
+      const list = r.list();
+      out = list.length ? list.map((x) => `- ${x.id} (${x.terminalId}) ${x.events} events${x.endedAt ? " [stopped]" : " [recording]"}`).join("\n") : "No recordings.";
+    } else if (args.action === "start") {
+      if (!args.terminalId) {
+        out = "start requires terminalId.";
+      } else {
+        out = `Recording started: ${r.start(args.terminalId, { title: args.title })}`;
+      }
+    } else if (args.action === "stop") {
+      if (!args.recordingId) {
+        out = "stop requires recordingId.";
+      } else {
+        const rec = r.stop(args.recordingId);
+        out = `Recording ${args.recordingId} stopped (${rec.events.length} events).`;
+      }
+    } else if (args.action === "replay") {
+      if (!args.recordingId) {
+        out = "replay requires recordingId.";
+      } else {
+        const ev = r.replay(args.recordingId, { fromSec: args.fromSec, durationSec: args.durationSec });
+        out = ev.length ? ev.map((e) => `[+${e.t.toFixed(1)}s] ${e.data}`).join("") : "(no events in window)";
+      }
+    } else if (args.action === "export_cast") {
+      if (!args.recordingId) {
+        out = "export_cast requires recordingId.";
+      } else {
+        out = r.exportCast(args.recordingId);
+      }
+    } else {
+      if (!args.recordingId) {
+        out = "delete requires recordingId.";
+      } else {
+        out = r.delete(args.recordingId) ? `Deleted ${args.recordingId}.` : `No recording ${args.recordingId}.`;
+      }
+    }
+  } catch (e) {
+    out = `recording error: ${e instanceof Error ? e.message : String(e)}`;
+  }
+  emit9(context2, "manage_recording", args, out);
+  return out;
+}
+var manageGitopsSchema = external_exports.object({
+  action: external_exports.enum(["export", "drift", "in_sync"]).describe("export the live desired-state manifest, or diff/verify a manifest against live."),
+  manifest: external_exports.any().optional().describe("A StateManifest (for drift/in_sync).")
+});
+async function manageGitops(args, context2) {
+  const { o, msg } = obs(context2, "manage_gitops", args);
+  if (!o) return msg;
+  let out;
+  try {
+    if (args.action === "export") {
+      const m = await o.gitops.exportLive();
+      out = `Exported manifest: ${m.entities.length} entities, stateHash ${m.stateHash.slice(0, 12)}\u2026`;
+    } else if (args.action === "drift") {
+      if (!args.manifest) {
+        out = "drift requires a manifest.";
+      } else {
+        const d = await o.gitops.drift(args.manifest);
+        out = d.length ? d.map((x) => `- ${x.id} (${x.kind}): ${x.drift}`).join("\n") : "No drift \u2014 live matches the manifest.";
+      }
+    } else {
+      if (!args.manifest) {
+        out = "in_sync requires a manifest.";
+      } else {
+        out = await o.gitops.inSync(args.manifest) ? "In sync." : "Out of sync (drift present).";
+      }
+    }
+  } catch (e) {
+    out = `gitops error: ${e instanceof Error ? e.message : String(e)}`;
+  }
+  emit9(context2, "manage_gitops", args, out);
+  return out;
+}
+var managePlaybookVersionSchema = external_exports.object({
+  action: external_exports.enum(["lint", "history", "rollback", "diff"]).describe("lint a playbook def, list version history, roll back, or diff two versions."),
+  playbookId: external_exports.string().optional().describe("Playbook id (history/rollback/diff)."),
+  def: external_exports.any().optional().describe("Playbook definition (lint)."),
+  version: external_exports.number().int().optional().describe("Version to roll back to (rollback)."),
+  a: external_exports.number().int().optional().describe("First version (diff)."),
+  b: external_exports.number().int().optional().describe("Second version (diff).")
+});
+async function managePlaybookVersion(args, context2) {
+  const { o, msg } = obs(context2, "manage_playbook_version", args);
+  if (!o) return msg;
+  let out;
+  try {
+    if (args.action === "lint") {
+      if (!args.def) {
+        out = "lint requires a playbook def.";
+      } else {
+        const issues = o.playbooks.lint(args.def);
+        out = issues.length ? issues.map((i) => `- [${i.severity}] ${i.rule}: ${i.message}`).join("\n") : "Playbook lints clean.";
+      }
+    } else if (args.action === "history") {
+      if (!args.playbookId) {
+        out = "history requires playbookId.";
+      } else {
+        const h = o.playbooks.versioning.history(args.playbookId);
+        out = h.length ? h.map((v) => `- v${v.version} (${v.hash})${v.comment ? ` ${v.comment}` : ""}`).join("\n") : `No versions for '${args.playbookId}'.`;
+      }
+    } else if (args.action === "rollback") {
+      if (!args.playbookId || args.version === void 0) {
+        out = "rollback requires playbookId + version.";
+      } else {
+        const v = o.playbooks.versioning.rollback(args.playbookId, args.version);
+        out = `Rolled back to v${args.version} \u2192 new v${v.version}.`;
+      }
+    } else {
+      if (!args.playbookId || args.a === void 0 || args.b === void 0) {
+        out = "diff requires playbookId + a + b.";
+      } else {
+        out = o.playbooks.versioning.diff(args.playbookId, args.a, args.b);
+      }
+    }
+  } catch (e) {
+    out = `playbook error: ${e instanceof Error ? e.message : String(e)}`;
+  }
+  emit9(context2, "manage_playbook_version", args, out);
+  return out;
+}
+var getCloudInventorySchema = external_exports.object({
+  action: external_exports.enum(["summary", "query", "sync"]).describe("summary counts, query resources, or pull fresh inventory."),
+  provider: external_exports.enum(["aws", "gcp", "azure"]).optional().describe("Filter by provider."),
+  state: external_exports.string().optional().describe("Filter by state (running/stopped/\u2026)."),
+  region: external_exports.string().optional().describe("Filter by region.")
+});
+async function getCloudInventory(args, context2) {
+  const { o, msg } = obs(context2, "get_cloud_inventory", args);
+  if (!o) return msg;
+  let out;
+  try {
+    if (args.action === "summary") {
+      const s = o.cloud.summary();
+      out = `Cloud inventory: ${s.total} resources. By provider: ${JSON.stringify(s.byProvider)}. By state: ${JSON.stringify(s.byState)}.`;
+    } else if (args.action === "query") {
+      const r = o.cloud.query({ provider: args.provider, state: args.state, region: args.region });
+      out = r.length ? r.map((x) => `- [${x.provider}] ${x.name} (${x.machineType ?? x.kind}) ${x.state ?? ""} ${x.region ?? ""}`).join("\n") : "No matching cloud resources.";
+    } else {
+      const r = await o.cloud.sync();
+      out = `Synced ${r.added} resources${r.errors.length ? `, ${r.errors.length} account error(s)` : ""}.`;
+    }
+  } catch (e) {
+    out = `cloud error: ${e instanceof Error ? e.message : String(e)}`;
+  }
+  emit9(context2, "get_cloud_inventory", args, out);
+  return out;
+}
+var getLiveDashboardSchema = external_exports.object({
+  action: external_exports.enum(["state", "subscribers"]).describe("'state' = current dashboard state; 'subscribers' = connected client count.")
+});
+async function getLiveDashboard(args, context2) {
+  const { o, msg } = obs(context2, "get_live_dashboard", args);
+  if (!o) return msg;
+  let out;
+  if (args.action === "subscribers") {
+    out = `${o.liveDashboard.subscriberCount()} dashboard subscriber(s) connected.`;
+  } else {
+    const s = await o.dashboard.summary();
+    out = s;
+  }
+  emit9(context2, "get_live_dashboard", args, out);
+  return out;
+}
+
 // packages/backend/src/services/AgentHelper/tools/skill_tools.ts
 var skillToolSchema = external_exports.object({
   name: external_exports.string().describe("The skill identifier from available_skills")
@@ -346648,6 +346974,51 @@ function buildToolsForModel(readFileSupport) {
       name: "import_putty",
       description: BUILTIN_TOOL_INFO.find((t) => t.name === "import_putty")?.description ?? "",
       schema: importPuttySchema
+    },
+    {
+      name: "get_metrics",
+      description: 'Read host metrics as Prometheus exposition text (for a scraper) or a one-line dashboard summary. Use to answer "how are my hosts doing" or to feed an external Prometheus/OTel collector.',
+      schema: getMetricsSchema
+    },
+    {
+      name: "manage_secret",
+      description: "Manage the encrypted secrets vault \u2014 list metadata (never values), set, delete, or check a secret. Secrets are materialized only at exec time and never enter the conversation. Vault must be unlocked (RTERM_SECRETS_MASTER_KEY).",
+      schema: manageSecretSchema
+    },
+    {
+      name: "manage_oncall",
+      description: "Incident on-call paging \u2014 list open pages, raise a page for an incident under an escalation policy, acknowledge or resolve a page, list policies, or advance the escalation clock.",
+      schema: manageOncallSchema
+    },
+    {
+      name: "get_cost",
+      description: "AI cost & budgets \u2014 summarize token spend in dollars (per model/profile, daily/monthly), check an intended run against budgets (ok/warn/throttle/deny), or list budgets.",
+      schema: getCostSchema
+    },
+    {
+      name: "manage_recording",
+      description: "asciinema-style session recording \u2014 list, start, stop, replay (scrub), export (.cast), or delete a terminal session recording.",
+      schema: manageRecordingSchema
+    },
+    {
+      name: "manage_gitops",
+      description: "GitOps for desired state \u2014 export the live estate (connections/playbooks/triggers/etc.) as a content-hashed manifest, or detect drift / verify a manifest against live.",
+      schema: manageGitopsSchema
+    },
+    {
+      name: "manage_playbook_version",
+      description: "Playbook/runbook versioning + lint \u2014 statically lint a playbook definition (undefined params, dependsOn cycles, empty steps, missing rollback), list version history, roll back, or diff two versions.",
+      schema: managePlaybookVersionSchema
+    },
+    {
+      name: "get_cloud_inventory",
+      description: "Cloud resource inventory (AWS/GCP/Azure) \u2014 summary counts by provider/state, query instances (filter by provider/state/region), or pull fresh inventory.",
+      schema: getCloudInventorySchema
+    },
+    {
+      name: "get_live_dashboard",
+      description: "Live multi-client dashboard \u2014 read the current unified dashboard state/summary, or the number of connected dashboard subscribers.",
+      schema: getLiveDashboardSchema
     }
   ].map((tool2) => convertToOpenAITool(tool2));
 }
@@ -346684,6 +347055,15 @@ var toolImplementations = {
   manageChange,
   manageTrigger,
   importPutty,
+  getMetrics,
+  manageSecret,
+  manageOncall,
+  getCost,
+  manageRecording,
+  manageGitops,
+  managePlaybookVersion,
+  getCloudInventory,
+  getLiveDashboard,
   writeFile,
   editFile,
   writeAndEdit,
@@ -348813,11 +349193,11 @@ var AbstractChatCompletionRunner = class extends EventStream {
       this._addMessage(message);
     return chatCompletion;
   }
-  _addMessage(message, emit9 = true) {
+  _addMessage(message, emit10 = true) {
     if (!("content" in message))
       message.content = null;
     this.messages.push(message);
-    if (emit9) {
+    if (emit10) {
       this._emit("message", message);
       if (isToolMessage2(message) && message.content) {
         this._emit("functionToolCallResult", message.content);
@@ -349069,8 +349449,8 @@ var ChatCompletionRunner = class _ChatCompletionRunner extends AbstractChatCompl
     runner._run(() => runner._runTools(client2, params, opts));
     return runner;
   }
-  _addMessage(message, emit9 = true) {
-    super._addMessage(message, emit9);
+  _addMessage(message, emit10 = true) {
+    super._addMessage(message, emit10);
     if (isAssistantMessage(message) && message.content) {
       this._emit("content", message.content);
     }
@@ -359896,6 +360276,7 @@ var AgentService_v2 = class {
   /** Optional automation store backing the automation agent tools. */
   automationManager;
   triggerEngine;
+  observability;
   /** Optional session-log handle for list_session_logs / read_session_log. */
   sessionLogger;
   /** Optional run ledger — persisted audit + token-cost record of every
@@ -359969,6 +360350,10 @@ var AgentService_v2 = class {
   setTriggerEngine(engine) {
     this.triggerEngine = engine ?? void 0;
   }
+  /** Wire the observability handle (v2.9.x) so the observability_* agent tools work. */
+  setObservability(obs2) {
+    this.observability = obs2 ?? void 0;
+  }
   /** Wire a session-log handle so list_session_logs / read_session_log work. */
   setSessionLogger(logger) {
     this.sessionLogger = logger ?? void 0;
@@ -361145,6 +361530,87 @@ Actually, your intention might be different. Please re-read the description of t
           }
           break;
         }
+        case "get_metrics": {
+          try {
+            const validatedArgs = getMetricsSchema.parse(toolCall.args || {});
+            result = await toolImplementations.getMetrics(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for get_metrics: ${err.message}`;
+          }
+          break;
+        }
+        case "manage_secret": {
+          try {
+            const validatedArgs = manageSecretSchema.parse(toolCall.args || {});
+            result = await toolImplementations.manageSecret(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for manage_secret: ${err.message}`;
+          }
+          break;
+        }
+        case "manage_oncall": {
+          try {
+            const validatedArgs = manageOncallSchema.parse(toolCall.args || {});
+            result = await toolImplementations.manageOncall(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for manage_oncall: ${err.message}`;
+          }
+          break;
+        }
+        case "get_cost": {
+          try {
+            const validatedArgs = getCostSchema.parse(toolCall.args || {});
+            result = await toolImplementations.getCost(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for get_cost: ${err.message}`;
+          }
+          break;
+        }
+        case "manage_recording": {
+          try {
+            const validatedArgs = manageRecordingSchema.parse(toolCall.args || {});
+            result = await toolImplementations.manageRecording(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for manage_recording: ${err.message}`;
+          }
+          break;
+        }
+        case "manage_gitops": {
+          try {
+            const validatedArgs = manageGitopsSchema.parse(toolCall.args || {});
+            result = await toolImplementations.manageGitops(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for manage_gitops: ${err.message}`;
+          }
+          break;
+        }
+        case "manage_playbook_version": {
+          try {
+            const validatedArgs = managePlaybookVersionSchema.parse(toolCall.args || {});
+            result = await toolImplementations.managePlaybookVersion(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for manage_playbook_version: ${err.message}`;
+          }
+          break;
+        }
+        case "get_cloud_inventory": {
+          try {
+            const validatedArgs = getCloudInventorySchema.parse(toolCall.args || {});
+            result = await toolImplementations.getCloudInventory(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for get_cloud_inventory: ${err.message}`;
+          }
+          break;
+        }
+        case "get_live_dashboard": {
+          try {
+            const validatedArgs = getLiveDashboardSchema.parse(toolCall.args || {});
+            result = await toolImplementations.getLiveDashboard(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for get_live_dashboard: ${err.message}`;
+          }
+          break;
+        }
         case "manage_device_memory": {
           try {
             const validatedArgs = manageDeviceMemorySchema.parse(toolCall.args || {});
@@ -361946,6 +362412,7 @@ ${reminder}`;
       agentRunLedger: this.agentRunLedger,
       changeLedger: this.changeLedger,
       triggerEngine: this.triggerEngine,
+      observability: this.observability,
       agentRunId,
       savedSshConnections: this.settings?.connections?.ssh ?? [],
       savedWinrmConnections: this.settings?.connections?.winrm ?? [],
@@ -365469,6 +365936,24 @@ var WebSocketGatewayAdapter = class {
   }
   async executeRequest(request, socket) {
     const params = request.params ?? {};
+    if (request.method.startsWith("observability:")) {
+      const bridge = this.options.observabilityBridge;
+      if (!bridge) {
+        throw new WebSocketRpcError(
+          "METHOD_NOT_FOUND",
+          `${request.method} is not available on this websocket gateway.`
+        );
+      }
+      const fnName = request.method.slice("observability:".length);
+      const fn = bridge[fnName];
+      if (typeof fn !== "function") {
+        throw new WebSocketRpcError(
+          "METHOD_NOT_FOUND",
+          `Unknown observability method: ${request.method}`
+        );
+      }
+      return await fn(params);
+    }
     switch (request.method) {
       case "gateway:ping":
         return { pong: true, ts: Date.now() };
@@ -383986,6 +384471,89 @@ function createObservability(deps) {
   };
 }
 
+// packages/backend/src/services/Gateway/observabilityBridge.ts
+function requireObs(deps) {
+  const o = deps.observability();
+  if (!o) throw new Error("observability is not available on this runtime");
+  return o;
+}
+function createObservabilityBridge(deps) {
+  return {
+    // ── metrics / prometheus / otel ─────────────────────────────────────────
+    /** Prometheus exposition text for all host metrics. */
+    metricsPrometheus: async () => requireObs(deps).metricsExport.renderPrometheus(),
+    /** dashboard state (unified). */
+    dashboardState: async () => requireObs(deps).dashboard.state(),
+    /** dashboard summary line. */
+    dashboardSummary: async () => requireObs(deps).dashboard.summary(),
+    // ── secrets vault (metadata only — never values) ────────────────────────
+    secretsList: async (params) => requireObs(deps).secrets.list(params),
+    secretsSet: async (params) => {
+      const v = requireObs(deps).secrets;
+      v.set(params.key, params.value, params.labels);
+      return { ok: true, key: params.key };
+    },
+    secretsDelete: async (params) => ({ deleted: requireObs(deps).secrets.delete(params.key) }),
+    secretsHas: async (params) => ({ exists: requireObs(deps).secrets.has(params.key) }),
+    // ── on-call / escalation ────────────────────────────────────────────────
+    oncallListPolicies: async () => requireObs(deps).oncall.listPolicies(),
+    oncallRegisterPolicy: async (params) => {
+      requireObs(deps).oncall.registerPolicy(params);
+      return { ok: true, id: params.id };
+    },
+    oncallOpenPages: async () => requireObs(deps).oncall.openPages(),
+    oncallPage: async (params) => requireObs(deps).oncall.page(params),
+    oncallAck: async (params) => requireObs(deps).oncall.acknowledge(params.pageId, params.by),
+    oncallResolve: async (params) => requireObs(deps).oncall.resolve(params.pageId),
+    oncallTick: async () => requireObs(deps).oncall.tick(),
+    // ── AI cost & budgets ───────────────────────────────────────────────────
+    costSummary: async (params) => requireObs(deps).cost.summarize(params),
+    costRecord: async (params) => ({
+      usd: requireObs(deps).cost.record(params)
+    }),
+    costCheck: async (params) => requireObs(deps).cost.check(params),
+    costListBudgets: async () => requireObs(deps).cost.listBudgets(),
+    costSetBudget: async (params) => {
+      requireObs(deps).cost.setBudget(params);
+      return { ok: true, id: params.id };
+    },
+    costRemoveBudget: async (params) => ({ removed: requireObs(deps).cost.removeBudget(params.id) }),
+    // ── session recording ───────────────────────────────────────────────────
+    recordingList: async () => requireObs(deps).recording.list(),
+    recordingStart: async (params) => ({
+      recordingId: requireObs(deps).recording.start(params.terminalId, params)
+    }),
+    recordingStop: async (params) => requireObs(deps).recording.stop(params.recordingId),
+    recordingReplay: async (params) => requireObs(deps).recording.replay(params.recordingId, params),
+    recordingExportCast: async (params) => requireObs(deps).recording.exportCast(params.recordingId),
+    recordingDelete: async (params) => ({ deleted: requireObs(deps).recording.delete(params.recordingId) }),
+    // ── gitops ──────────────────────────────────────────────────────────────
+    gitopsExport: async () => requireObs(deps).gitops.exportLive(),
+    gitopsDrift: async (params) => requireObs(deps).gitops.drift(params.manifest),
+    gitopsInSync: async (params) => ({
+      inSync: await requireObs(deps).gitops.inSync(params.manifest)
+    }),
+    gitopsReconcile: async (params) => requireObs(deps).gitops.reconcile(params.manifest, { deleteRemoved: params.deleteRemoved }),
+    // ── playbook versioning + lint ──────────────────────────────────────────
+    playbookLint: async (params) => requireObs(deps).playbooks.lint(params.def),
+    playbookHistory: async (params) => requireObs(deps).playbooks.versioning.history(params.playbookId),
+    playbookSave: async (params) => requireObs(deps).playbooks.versioning.save(params.playbookId, params.def, params.comment),
+    playbookRollback: async (params) => requireObs(deps).playbooks.versioning.rollback(params.playbookId, params.version, params.comment),
+    playbookDiff: async (params) => requireObs(deps).playbooks.versioning.diff(params.playbookId, params.a, params.b),
+    // ── cloud inventory ─────────────────────────────────────────────────────
+    cloudSummary: async () => requireObs(deps).cloud.summary(),
+    cloudQuery: async (params) => requireObs(deps).cloud.query(params),
+    cloudSync: async () => requireObs(deps).cloud.sync(),
+    cloudAddAccount: async (params) => {
+      requireObs(deps).cloud.addAccount(params);
+      return { ok: true };
+    },
+    // ── live dashboard hub ──────────────────────────────────────────────────
+    liveDashboardState: async () => requireObs(deps).liveDashboard.lastState() ?? await requireObs(deps).dashboard.state(),
+    liveDashboardSubscriberCount: async () => ({ count: requireObs(deps).liveDashboard.subscriberCount() })
+  };
+}
+
 // packages/backend/src/services/ResourceMonitorService.ts
 var import_os2 = __toESM(require("os"), 1);
 var DEFAULT_POLL_INTERVAL_MS = 2e3;
@@ -385995,6 +386563,7 @@ async function startGyBackend() {
     }
   });
   console.log(`[gybackend] Observability wired: dashboard state available (hosts=${observability.metricsLedger.hosts().length})`);
+  agentService.setObservability(observability);
   if (settingsService.getSettings().sessionLogging?.enabled) {
     const logDir = import_node_path28.default.join(
       import_node_process2.default.env.GYSHELL_STORE_DIR || "",
@@ -386434,7 +387003,13 @@ async function startGyBackend() {
           gatewayService.broadcastRaw("tools:builtInUpdated", summary);
           return summary;
         }
-      }
+      },
+      // Observability bridge (v2.9.x): exposes the 9 platform capabilities
+      // (metrics export, secrets, on-call, cost, recording, gitops, playbooks,
+      // cloud, live dashboard) as observability:* RPC methods.
+      observabilityBridge: createObservabilityBridge({
+        observability: () => observability
+      })
     })
   });
   await wsGatewayControlService.applyPolicy(startupPolicy);