neuralos 2.9.1 → 2.9.3

package/bin/gybackend.cjs

@@ -9040,7 +9040,7 @@ var require_eventemitter3 = __commonJS({
       if (listeners.fn) return 1;
       return listeners.length;
     };
-    EventEmitter4.prototype.emit = function emit9(event, a1, a2, a3, a4, a5) {
+    EventEmitter4.prototype.emit = function emit10(event, a1, a2, a3, a4, a5) {
       var evt = prefix ? prefix + event : event;
       if (!this._events[evt]) return false;
       var listeners = this._events[evt], len = arguments.length, args, i;
@@ -51648,7 +51648,7 @@ var require_pdf_worker = __commonJS({
             });
             exports3.getMetrics = void 0;
             var _util = __w_pdfjs_require__(0);
-            var getMetrics = (0, _util.getLookupTableFactory)(function(t) {
+            var getMetrics2 = (0, _util.getLookupTableFactory)(function(t) {
               t["Courier"] = 600;
               t["Courier-Bold"] = 600;
               t["Courier-BoldOblique"] = 600;
@@ -54586,7 +54586,7 @@ var require_pdf_worker = __commonJS({
                 t2["a191"] = 918;
               });
             });
-            exports3.getMetrics = getMetrics;
+            exports3.getMetrics = getMetrics2;
           }),
           /* 142 */
           /***/
@@ -113850,7 +113850,7 @@ var require_pdf_worker2 = __commonJS({
             });
             exports3.getMetrics = void 0;
             var _util = __w_pdfjs_require__(0);
-            var getMetrics = (0, _util.getLookupTableFactory)(function(t) {
+            var getMetrics2 = (0, _util.getLookupTableFactory)(function(t) {
               t["Courier"] = 600;
               t["Courier-Bold"] = 600;
               t["Courier-BoldOblique"] = 600;
@@ -116788,7 +116788,7 @@ var require_pdf_worker2 = __commonJS({
                 t2["a191"] = 918;
               });
             });
-            exports3.getMetrics = getMetrics;
+            exports3.getMetrics = getMetrics2;
           }),
           /* 141 */
           /***/
@@ -170585,7 +170585,7 @@ var require_pdf_worker3 = __commonJS({
             });
             exports3.getMetrics = void 0;
             var _util = __w_pdfjs_require__(0);
-            var getMetrics = (0, _util.getLookupTableFactory)(function(t) {
+            var getMetrics2 = (0, _util.getLookupTableFactory)(function(t) {
               t["Courier"] = 600;
               t["Courier-Bold"] = 600;
               t["Courier-BoldOblique"] = 600;
@@ -173523,7 +173523,7 @@ var require_pdf_worker3 = __commonJS({
                 t2["a191"] = 918;
               });
             });
-            exports3.getMetrics = getMetrics;
+            exports3.getMetrics = getMetrics2;
           }),
           /* 30 */
           /***/
@@ -229083,7 +229083,7 @@ var require_pdf_worker4 = __commonJS({
             });
             exports3.getMetrics = void 0;
             var _util = __w_pdfjs_require__(2);
-            var getMetrics = (0, _util.getLookupTableFactory)(function(t) {
+            var getMetrics2 = (0, _util.getLookupTableFactory)(function(t) {
               t["Courier"] = 600;
               t["Courier-Bold"] = 600;
               t["Courier-BoldOblique"] = 600;
@@ -232021,7 +232021,7 @@ var require_pdf_worker4 = __commonJS({
                 t2["a191"] = 918;
               });
             });
-            exports3.getMetrics = getMetrics;
+            exports3.getMetrics = getMetrics2;
           }),
           /* 149 */
           /***/
@@ -281574,18 +281574,18 @@ var SSHBackend = class _SSHBackend {
     });
     return info.socket;
   }
-  async buildConnectSocketIfNeeded(sshConfig, emit9) {
+  async buildConnectSocketIfNeeded(sshConfig, emit10) {
     if (sshConfig.jumpHost) {
       const jumpId = `[Jump:${sshConfig.jumpHost.host}]`;
       console.log(`${jumpId} Starting jump host connection flow...`);
-      emit9(
+      emit10(
         `\x1B[36m\u25B9 ${jumpId} Establishing tunnel via jump host ${sshConfig.jumpHost.host}...\x1B[0m\r
 `
       );
       const jumpClient = new (loadSsh2()).Client();
       const jumpSock = await this.buildConnectSocketIfNeeded(
         sshConfig.jumpHost,
-        emit9
+        emit10
       );
       if (jumpSock) {
         console.log(
@@ -281629,7 +281629,7 @@ var SSHBackend = class _SSHBackend {
         });
         jumpClient.connect(jumpConnectConfig);
       });
-      emit9(
+      emit10(
         `\x1B[32m\u2714 ${jumpId} Jump host ready. Requesting forward to target ${sshConfig.host}:${sshConfig.port}...\x1B[0m\r
 `
       );
@@ -281945,25 +281945,25 @@ var SSHBackend = class _SSHBackend {
     };
     this.sessions.set(config2.id, instance);
     (async () => {
-      const emit9 = (data) => {
+      const emit10 = (data) => {
         instance.dataCallbacks.forEach((cb) => cb(data));
       };
       const emitExit = (code) => {
         this.emitExitOnce(config2.id, instance, code);
       };
       client2.on("ready", async () => {
-        emit9("\x1B[2J\x1B[H\x1B[32m\u2714 Connection established.\x1B[0m\r\n");
+        emit10("\x1B[2J\x1B[H\x1B[32m\u2714 Connection established.\x1B[0m\r\n");
         console.log(
           `[SSH] Connection ready for ${sshConfig.host}:${sshConfig.port}`
         );
         const rawShell = isRawShellPreset(sshConfig.algorithmsPreset);
         try {
-          emit9("\x1B[36m\u25B9 Setting up port forwards...\x1B[0m\r\n");
+          emit10("\x1B[36m\u25B9 Setting up port forwards...\x1B[0m\r\n");
           console.log(`[SSH] Setting up port forwards...`);
           await this.setupPortForwards(instance, sshConfig);
         } catch (e) {
           console.error(`[SSH] Port forward setup failed:`, e);
-          emit9(`\x1B[31m\u2718 Port forward failed: ${e.message}\x1B[0m\r
+          emit10(`\x1B[31m\u2718 Port forward failed: ${e.message}\x1B[0m\r
 `);
         }
         if (rawShell) {
@@ -281973,7 +281973,7 @@ var SSHBackend = class _SSHBackend {
           );
         } else {
           try {
-            emit9("\x1B[36m\u25B9 Detecting remote OS...\x1B[0m\r\n");
+            emit10("\x1B[36m\u25B9 Detecting remote OS...\x1B[0m\r\n");
             console.log(`[SSH] Detecting remote OS...`);
             const uname = await this.execCollect(client2, "uname -s");
             const u = (uname.stdout || uname.stderr || "").toLowerCase();
@@ -281993,13 +281993,13 @@ var SSHBackend = class _SSHBackend {
           if (!instance.remoteOs) instance.remoteOs = "unix";
           console.log(`[SSH] Remote OS detected: ${instance.remoteOs}`);
           try {
-            emit9("\x1B[36m\u25B9 Initializing SFTP channel...\x1B[0m\r\n");
+            emit10("\x1B[36m\u25B9 Initializing SFTP channel...\x1B[0m\r\n");
             await this.initializeSftp(instance);
-            emit9("\x1B[32m\u2714 SFTP channel ready.\x1B[0m\r\n");
+            emit10("\x1B[32m\u2714 SFTP channel ready.\x1B[0m\r\n");
           } catch (error40) {
             const message = error40 instanceof Error ? error40.message : String(error40);
             instance.sftpInitError = message;
-            emit9(
+            emit10(
               `\x1B[33m\u26A0 SFTP unavailable: ${message}. File panel features may be limited.\x1B[0m\r
 `
             );
@@ -282012,7 +282012,7 @@ var SSHBackend = class _SSHBackend {
             }
           }
         }
-        emit9("\x1B[36m\u25B9 Opening interactive shell...\x1B[0m\r\n");
+        emit10("\x1B[36m\u25B9 Opening interactive shell...\x1B[0m\r\n");
         console.log(`[SSH] Opening interactive shell...`);
         const initialWindowSize = this.resolveRequestedWindowSize(instance, {
           cols: config2.cols,
@@ -282042,7 +282042,7 @@ var SSHBackend = class _SSHBackend {
               console.error(`[SSH] Failed to open shell:`, err);
               instance.initializationState = "failed";
               instance.isInitializing = false;
-              emit9(`\x1B[31m\u2718 Failed to open shell: ${err.message}\x1B[0m\r
+              emit10(`\x1B[31m\u2718 Failed to open shell: ${err.message}\x1B[0m\r
 `);
               emitExit(-1);
               return;
@@ -282052,7 +282052,7 @@ var SSHBackend = class _SSHBackend {
             if (rawShell) {
               instance.initializationState = "ready";
               instance.isInitializing = false;
-              emit9("\x1B[32m\u2714 Shell ready.\x1B[0m\r\n");
+              emit10("\x1B[32m\u2714 Shell ready.\x1B[0m\r\n");
               console.log(
                 `[SSH] Raw-shell mode: shell ready immediately (preset=${sshConfig.algorithmsPreset}).`
               );
@@ -282060,14 +282060,14 @@ var SSHBackend = class _SSHBackend {
                 const chunk2 = data.toString();
                 const sanitizedChunk = this.stripReadyMarker(chunk2);
                 this.consumeOscMarkers(instance, sanitizedChunk);
-                if (sanitizedChunk) emit9(sanitizedChunk);
+                if (sanitizedChunk) emit10(sanitizedChunk);
               });
               stream.on("close", async (code) => {
                 emitExit(typeof code === "number" ? code : 0);
               });
               return;
             }
-            emit9("\x1B[36m\u25B9 Initializing shell integration...\x1B[0m\r\n");
+            emit10("\x1B[36m\u25B9 Initializing shell integration...\x1B[0m\r\n");
             console.log(
               `[SSH] Shell stream opened. Starting robust initialization...`
             );
@@ -282113,7 +282113,7 @@ var SSHBackend = class _SSHBackend {
                 if (retryCount >= maxRetries) {
                   instance.initializationState = "failed";
                   instance.isInitializing = false;
-                  emit9(
+                  emit10(
                     "\x1B[31m\u2718 Initialization failed. Entering fallback mode.\x1B[0m\r\n"
                   );
                   console.error(
@@ -282122,7 +282122,7 @@ var SSHBackend = class _SSHBackend {
                   clearInterval(watchdogInterval);
                   return;
                 }
-                emit9(
+                emit10(
                   `\x1B[33m\u26A0 Initialization timeout, retrying (${retryCount}/${maxRetries})...\x1B[0m\r
 `
                 );
@@ -282136,7 +282136,7 @@ var SSHBackend = class _SSHBackend {
               if (instance.isInitializing) {
                 instance.buffer += chunk2;
                 if (instance.buffer.includes(GYSHELL_READY_MARKER2)) {
-                  emit9("\x1B[2J\x1B[H");
+                  emit10("\x1B[2J\x1B[H");
                   isReadySent = true;
                   clearInterval(watchdogInterval);
                   const sawContinuation = /(?:\r?\n)>>\s*\r?\n/.test(instance.buffer) || instance.buffer.trimEnd().endsWith("\n>>") || instance.buffer.trimEnd().endsWith("\r\n>>");
@@ -282147,7 +282147,7 @@ var SSHBackend = class _SSHBackend {
                     const realContent = this.stripReadyMarker(
                       parts.slice(1).join(GYSHELL_READY_MARKER2)
                     ).trimStart();
-                    if (realContent) emit9(realContent);
+                    if (realContent) emit10(realContent);
                   }
                   instance.buffer = "";
                   if (sawContinuation && instance.remoteOs === "windows" && instance.stream) {
@@ -282163,7 +282163,7 @@ var SSHBackend = class _SSHBackend {
                 const sanitizedChunk = this.stripReadyMarker(chunk2);
                 this.consumeOscMarkers(instance, sanitizedChunk);
                 if (sanitizedChunk) {
-                  emit9(sanitizedChunk);
+                  emit10(sanitizedChunk);
                 }
               }
             });
@@ -282177,7 +282177,7 @@ var SSHBackend = class _SSHBackend {
         console.error(`[SSH] Client error:`, err);
         instance.initializationState = "failed";
         instance.isInitializing = false;
-        emit9(`\x1B[31m\u2718 SSH Error: ${err.message}\x1B[0m\r
+        emit10(`\x1B[31m\u2718 SSH Error: ${err.message}\x1B[0m\r
 `);
         emitExit(-1);
       });
@@ -282200,7 +282200,7 @@ var SSHBackend = class _SSHBackend {
               sshConfig.privateKeyPath
             );
           } catch (e) {
-            emit9(
+            emit10(
               `\x1B[31m\u2718 Failed to read private key: ${e.message}\x1B[0m\r
 `
             );
@@ -282212,19 +282212,19 @@ var SSHBackend = class _SSHBackend {
       }
       try {
         await new Promise((r) => setTimeout(r, 50));
-        emit9(
+        emit10(
           `\x1B[36m\u25B9 Connecting to ${sshConfig.host}:${sshConfig.port}...\x1B[0m\r
 `
         );
         console.log(
           `[SSH] Attempting to connect to ${sshConfig.host}:${sshConfig.port}...`
         );
-        const sock = await this.buildConnectSocketIfNeeded(sshConfig, emit9);
+        const sock = await this.buildConnectSocketIfNeeded(sshConfig, emit10);
         if (sock) {
           console.log(
             `[SSH] SUCCESS: Connection to ${sshConfig.host} will be tunneled through sock (Jump Host/Proxy).`
           );
-          emit9(
+          emit10(
             "\x1B[36m\u25B9 [Final] Using tunnel socket for target connection...\x1B[0m\r\n"
           );
           connectConfig.sock = sock;
@@ -282238,7 +282238,7 @@ var SSHBackend = class _SSHBackend {
         const errMsg = e instanceof Error ? e.message : String(e);
         instance.initializationState = "failed";
         instance.isInitializing = false;
-        emit9(`\x1B[31m\u2718 Connection failed: ${errMsg}\x1B[0m\r
+        emit10(`\x1B[31m\u2718 Connection failed: ${errMsg}\x1B[0m\r
 `);
         emitExit(-1);
       }
@@ -327549,7 +327549,7 @@ var initializeSax = function() {
     if (parser.opt.xmlns) parser.ns = Object.create(rootNS);
     parser.trackPosition = parser.opt.position !== false;
     if (parser.trackPosition) parser.position = parser.line = parser.column = 0;
-    emit9(parser, "onready");
+    emit10(parser, "onready");
   }
   if (!Object.create) Object.create = function(o) {
     function F() {
@@ -328015,16 +328015,16 @@ var initializeSax = function() {
   });
   for (var s in sax$1.STATE) sax$1.STATE[sax$1.STATE[s]] = s;
   S = sax$1.STATE;
-  function emit9(parser, event, data) {
+  function emit10(parser, event, data) {
     parser[event] && parser[event](data);
   }
   function emitNode(parser, nodeType, data) {
     if (parser.textNode) closeText(parser);
-    emit9(parser, nodeType, data);
+    emit10(parser, nodeType, data);
   }
   function closeText(parser) {
     parser.textNode = textopts(parser.opt, parser.textNode);
-    if (parser.textNode) emit9(parser, "ontext", parser.textNode);
+    if (parser.textNode) emit10(parser, "ontext", parser.textNode);
     parser.textNode = "";
   }
   function textopts(opt, text) {
@@ -328037,7 +328037,7 @@ var initializeSax = function() {
     if (parser.trackPosition) er += "\nLine: " + parser.line + "\nColumn: " + parser.column + "\nChar: " + parser.c;
     er = new Error(er);
     parser.error = er;
-    emit9(parser, "onerror", er);
+    emit10(parser, "onerror", er);
     return parser;
   }
   function end(parser) {
@@ -328046,7 +328046,7 @@ var initializeSax = function() {
     closeText(parser);
     parser.c = "";
     parser.closed = true;
-    emit9(parser, "onend");
+    emit10(parser, "onend");
     SAXParser.call(parser, parser.strict, parser.opt);
     return parser;
   }
@@ -342195,6 +342195,22 @@ var BUILTIN_TOOL_INFO = [
     name: "create_or_edit",
     description: CREATE_OR_EDIT_TOOL_DESCRIPTION
   },
+  {
+    name: "write_file",
+    description: WRITE_FILE_TOOL_DESCRIPTION
+  },
+  {
+    name: "edit_file",
+    description: EDIT_FILE_TOOL_DESCRIPTION
+  },
+  {
+    name: "skill",
+    description: "Load a skill to get detailed instructions for a specific task. Skills provide specialized knowledge, step-by-step guidance, and may include supporting files (scripts, references)."
+  },
+  {
+    name: "create_skill",
+    description: "Create a new skill in GyShell skills. This tool only creates new skills and does not modify or overwrite existing ones. If the skill name already exists, the call must fail and you should choose a different name. If you need to modify an existing skill, use edit_file to edit that skill's md file directly, or write_file only when intentionally replacing the full file."
+  },
   {
     name: "wait",
     description: WAIT_TOOL_DESCRIPTION
@@ -342294,6 +342310,42 @@ var BUILTIN_TOOL_INFO = [
   {
     name: "manage_trigger",
     description: MANAGE_TRIGGER_DESCRIPTION
+  },
+  {
+    name: "get_metrics",
+    description: 'Read host metrics as Prometheus exposition text (for a scraper) or a one-line dashboard summary. Use to answer "how are my hosts doing" or to feed an external Prometheus/OTel collector.'
+  },
+  {
+    name: "manage_secret",
+    description: "Manage the encrypted secrets vault \u2014 list metadata (never values), set, delete, or check a secret. Secrets are materialized only at exec time and never enter the conversation. Vault must be unlocked (RTERM_SECRETS_MASTER_KEY)."
+  },
+  {
+    name: "manage_oncall",
+    description: "Incident on-call paging \u2014 list open pages, raise a page for an incident under an escalation policy, acknowledge or resolve a page, list policies, or advance the escalation clock."
+  },
+  {
+    name: "get_cost",
+    description: "AI cost & budgets \u2014 summarize token spend in dollars (per model/profile, daily/monthly), check an intended run against budgets (ok/warn/throttle/deny), or list budgets."
+  },
+  {
+    name: "manage_recording",
+    description: "asciinema-style session recording \u2014 list, start, stop, replay (scrub), export (.cast), or delete a terminal session recording."
+  },
+  {
+    name: "manage_gitops",
+    description: "GitOps for desired state \u2014 export the live estate (connections/playbooks/triggers/etc.) as a content-hashed manifest, or detect drift / verify a manifest against live."
+  },
+  {
+    name: "manage_playbook_version",
+    description: "Playbook/runbook versioning + lint \u2014 statically lint a playbook definition (undefined params, dependsOn cycles, empty steps, missing rollback), list version history, roll back, or diff two versions."
+  },
+  {
+    name: "get_cloud_inventory",
+    description: "Cloud resource inventory (AWS/GCP/Azure) \u2014 summary counts by provider/state, query instances (filter by provider/state/region), or pull fresh inventory."
+  },
+  {
+    name: "get_live_dashboard",
+    description: "Live multi-client dashboard \u2014 read the current unified dashboard state/summary, or the number of connected dashboard subscribers."
   }
 ];
 function buildReadFileDescription(support) {
@@ -346381,6 +346433,332 @@ ${body}`;
   return msg;
 }
 
+// packages/backend/src/services/AgentHelper/tools/observability_tools.ts
+function emit9(context2, toolName, input, output) {
+  context2.sendEvent(context2.sessionId, {
+    messageId: context2.messageId,
+    type: "tool_call",
+    toolName,
+    input: typeof input === "string" ? input : JSON.stringify(input),
+    output
+  });
+}
+function obs(context2, toolName, args) {
+  const o = context2.observability;
+  if (!o) {
+    const msg = `${toolName} is not available in this runtime (observability not wired).`;
+    emit9(context2, toolName, args, msg);
+    return { o: null, msg };
+  }
+  return { o, msg: null };
+}
+var getMetricsSchema = external_exports.object({
+  format: external_exports.enum(["prometheus", "summary"]).optional().describe("'prometheus' = exposition text for a scraper; 'summary' = dashboard summary line (default).")
+});
+async function getMetrics(args, context2) {
+  const { o, msg } = obs(context2, "get_metrics", args);
+  if (!o) return msg;
+  const out = args.format === "prometheus" ? o.metricsExport.renderPrometheus() || "# no host metrics recorded yet" : await o.dashboard.summary();
+  emit9(context2, "get_metrics", args, out);
+  return out;
+}
+var manageSecretSchema = external_exports.object({
+  action: external_exports.enum(["list", "set", "delete", "has"]).describe("list metadata (never values), set a secret, delete one, or check existence."),
+  key: external_exports.string().optional().describe("Secret key (required for set/delete/has)."),
+  value: external_exports.string().optional().describe("Secret value (required for set). Never echoed back."),
+  labels: external_exports.record(external_exports.string()).optional().describe("Optional labels (service, scope, connection id).")
+});
+async function manageSecret(args, context2) {
+  const { o, msg } = obs(context2, "manage_secret", args);
+  if (!o) return msg;
+  const v = o.secrets;
+  if (!v.unlocked()) {
+    const m = "Secrets vault is locked \u2014 start RTerm with RTERM_SECRETS_MASTER_KEY set.";
+    emit9(context2, "manage_secret", args, m);
+    return m;
+  }
+  let out;
+  if (args.action === "list") {
+    const items = v.list();
+    out = items.length ? items.map((m) => `- ${m.key}${m.labels ? ` ${JSON.stringify(m.labels)}` : ""} (updated ${new Date(m.updatedAt).toISOString()})`).join("\n") : "No secrets stored.";
+  } else if (args.action === "set") {
+    if (!args.key || args.value === void 0) {
+      out = "set requires key + value.";
+    } else {
+      v.set(args.key, args.value, args.labels);
+      out = `Stored secret '${args.key}'.`;
+    }
+  } else if (args.action === "delete") {
+    if (!args.key) {
+      out = "delete requires key.";
+    } else {
+      out = v.delete(args.key) ? `Deleted secret '${args.key}'.` : `No secret '${args.key}'.`;
+    }
+  } else {
+    if (!args.key) {
+      out = "has requires key.";
+    } else {
+      out = v.has(args.key) ? `'${args.key}' exists.` : `'${args.key}' does not exist.`;
+    }
+  }
+  emit9(context2, "manage_secret", args, out);
+  return out;
+}
+var manageOncallSchema = external_exports.object({
+  action: external_exports.enum(["open_pages", "page", "ack", "resolve", "list_policies", "tick"]).describe("List open pages, raise a page, ack/resolve a page, list policies, or advance the escalation clock."),
+  pageId: external_exports.string().optional().describe("Page id (ack/resolve)."),
+  by: external_exports.string().optional().describe("Who is acknowledging (ack)."),
+  incidentId: external_exports.string().optional().describe("Incident id (page)."),
+  policyId: external_exports.string().optional().describe("Escalation policy id (page)."),
+  title: external_exports.string().optional().describe("Page title (page)."),
+  severity: external_exports.string().optional().describe("Severity e.g. sev1/sev2/sev3 (page).")
+});
+async function manageOncall(args, context2) {
+  const { o, msg } = obs(context2, "manage_oncall", args);
+  if (!o) return msg;
+  const s = o.oncall;
+  let out;
+  try {
+    if (args.action === "open_pages") {
+      const pages = s.openPages();
+      out = pages.length ? pages.map((p) => `- [${p.severity}] ${p.title} (level ${p.levelIndex}, page ${p.id})`).join("\n") : "No open pages.";
+    } else if (args.action === "list_policies") {
+      const pols = s.listPolicies();
+      out = pols.length ? pols.map((p) => `- ${p.name} (${p.id}): ${p.levels.length} level(s)`).join("\n") : "No escalation policies registered.";
+    } else if (args.action === "page") {
+      if (!args.incidentId || !args.policyId || !args.title || !args.severity) {
+        out = "page requires incidentId, policyId, title, severity.";
+      } else {
+        const p = await s.page({ incidentId: args.incidentId, policyId: args.policyId, title: args.title, severity: args.severity });
+        out = `Paged (page ${p.id}) at level 0.`;
+      }
+    } else if (args.action === "ack") {
+      if (!args.pageId || !args.by) {
+        out = "ack requires pageId + by.";
+      } else {
+        s.acknowledge(args.pageId, args.by);
+        out = `Page ${args.pageId} acknowledged by ${args.by}.`;
+      }
+    } else if (args.action === "resolve") {
+      if (!args.pageId) {
+        out = "resolve requires pageId.";
+      } else {
+        s.resolve(args.pageId);
+        out = `Page ${args.pageId} resolved.`;
+      }
+    } else {
+      const esc2 = await s.tick();
+      out = esc2.length ? `Escalated ${esc2.length} page(s).` : "No pages needed escalation.";
+    }
+  } catch (e) {
+    out = `on-call error: ${e instanceof Error ? e.message : String(e)}`;
+  }
+  emit9(context2, "manage_oncall", args, out);
+  return out;
+}
+var getCostSchema = external_exports.object({
+  action: external_exports.enum(["summary", "check", "list_budgets"]).describe("summary of spend, check a run against budgets, or list budgets."),
+  period: external_exports.enum(["daily", "monthly"]).optional().describe("Window for summary (default daily)."),
+  model: external_exports.string().optional().describe("Filter by model / the model to check."),
+  profileId: external_exports.string().optional().describe("Filter by profile / the profile to check.")
+});
+async function getCost(args, context2) {
+  const { o, msg } = obs(context2, "get_cost", args);
+  if (!o) return msg;
+  let out;
+  if (args.action === "summary") {
+    const s = o.cost.summarize({ period: args.period ?? "daily", model: args.model, profileId: args.profileId });
+    const lines = s.byModel.map((m) => `  ${m.model}: $${m.usd.toFixed(4)} (${m.promptTokens}in/${m.completionTokens}out)`).join("\n");
+    out = `Spend (${args.period ?? "daily"}): $${s.totalUsd.toFixed(4)} total.${lines ? "\n" + lines : ""}`;
+  } else if (args.action === "check") {
+    const r = o.cost.check({ model: args.model, profileId: args.profileId });
+    out = `Budget check \u2192 ${r.action.toUpperCase()}${r.statuses.length ? ` (${r.statuses.map((s) => `${s.budget.id}=${(s.ratio * 100).toFixed(0)}%`).join(", ")})` : " (no matching budgets)"}.`;
+  } else {
+    const b = o.cost.listBudgets();
+    out = b.length ? b.map((x) => `- ${x.id}: ${x.model ?? "*"}/${x.profileId ?? "*"} ${x.period} cap $${x.capUsd}`).join("\n") : "No budgets configured.";
+  }
+  emit9(context2, "get_cost", args, out);
+  return out;
+}
+var manageRecordingSchema = external_exports.object({
+  action: external_exports.enum(["list", "start", "stop", "replay", "export_cast", "delete"]).describe("List, start, stop, replay, export (.cast), or delete a recording."),
+  recordingId: external_exports.string().optional().describe("Recording id (stop/replay/export_cast/delete)."),
+  terminalId: external_exports.string().optional().describe("Terminal to record (start)."),
+  title: external_exports.string().optional().describe("Title (start)."),
+  fromSec: external_exports.number().optional().describe("Replay start offset seconds."),
+  durationSec: external_exports.number().optional().describe("Replay duration seconds.")
+});
+async function manageRecording(args, context2) {
+  const { o, msg } = obs(context2, "manage_recording", args);
+  if (!o) return msg;
+  const r = o.recording;
+  let out;
+  try {
+    if (args.action === "list") {
+      const list = r.list();
+      out = list.length ? list.map((x) => `- ${x.id} (${x.terminalId}) ${x.events} events${x.endedAt ? " [stopped]" : " [recording]"}`).join("\n") : "No recordings.";
+    } else if (args.action === "start") {
+      if (!args.terminalId) {
+        out = "start requires terminalId.";
+      } else {
+        out = `Recording started: ${r.start(args.terminalId, { title: args.title })}`;
+      }
+    } else if (args.action === "stop") {
+      if (!args.recordingId) {
+        out = "stop requires recordingId.";
+      } else {
+        const rec = r.stop(args.recordingId);
+        out = `Recording ${args.recordingId} stopped (${rec.events.length} events).`;
+      }
+    } else if (args.action === "replay") {
+      if (!args.recordingId) {
+        out = "replay requires recordingId.";
+      } else {
+        const ev = r.replay(args.recordingId, { fromSec: args.fromSec, durationSec: args.durationSec });
+        out = ev.length ? ev.map((e) => `[+${e.t.toFixed(1)}s] ${e.data}`).join("") : "(no events in window)";
+      }
+    } else if (args.action === "export_cast") {
+      if (!args.recordingId) {
+        out = "export_cast requires recordingId.";
+      } else {
+        out = r.exportCast(args.recordingId);
+      }
+    } else {
+      if (!args.recordingId) {
+        out = "delete requires recordingId.";
+      } else {
+        out = r.delete(args.recordingId) ? `Deleted ${args.recordingId}.` : `No recording ${args.recordingId}.`;
+      }
+    }
+  } catch (e) {
+    out = `recording error: ${e instanceof Error ? e.message : String(e)}`;
+  }
+  emit9(context2, "manage_recording", args, out);
+  return out;
+}
+var manageGitopsSchema = external_exports.object({
+  action: external_exports.enum(["export", "drift", "in_sync"]).describe("export the live desired-state manifest, or diff/verify a manifest against live."),
+  manifest: external_exports.any().optional().describe("A StateManifest (for drift/in_sync).")
+});
+async function manageGitops(args, context2) {
+  const { o, msg } = obs(context2, "manage_gitops", args);
+  if (!o) return msg;
+  let out;
+  try {
+    if (args.action === "export") {
+      const m = await o.gitops.exportLive();
+      out = `Exported manifest: ${m.entities.length} entities, stateHash ${m.stateHash.slice(0, 12)}\u2026`;
+    } else if (args.action === "drift") {
+      if (!args.manifest) {
+        out = "drift requires a manifest.";
+      } else {
+        const d = await o.gitops.drift(args.manifest);
+        out = d.length ? d.map((x) => `- ${x.id} (${x.kind}): ${x.drift}`).join("\n") : "No drift \u2014 live matches the manifest.";
+      }
+    } else {
+      if (!args.manifest) {
+        out = "in_sync requires a manifest.";
+      } else {
+        out = await o.gitops.inSync(args.manifest) ? "In sync." : "Out of sync (drift present).";
+      }
+    }
+  } catch (e) {
+    out = `gitops error: ${e instanceof Error ? e.message : String(e)}`;
+  }
+  emit9(context2, "manage_gitops", args, out);
+  return out;
+}
+var managePlaybookVersionSchema = external_exports.object({
+  action: external_exports.enum(["lint", "history", "rollback", "diff"]).describe("lint a playbook def, list version history, roll back, or diff two versions."),
+  playbookId: external_exports.string().optional().describe("Playbook id (history/rollback/diff)."),
+  def: external_exports.any().optional().describe("Playbook definition (lint)."),
+  version: external_exports.number().int().optional().describe("Version to roll back to (rollback)."),
+  a: external_exports.number().int().optional().describe("First version (diff)."),
+  b: external_exports.number().int().optional().describe("Second version (diff).")
+});
+async function managePlaybookVersion(args, context2) {
+  const { o, msg } = obs(context2, "manage_playbook_version", args);
+  if (!o) return msg;
+  let out;
+  try {
+    if (args.action === "lint") {
+      if (!args.def) {
+        out = "lint requires a playbook def.";
+      } else {
+        const issues = o.playbooks.lint(args.def);
+        out = issues.length ? issues.map((i) => `- [${i.severity}] ${i.rule}: ${i.message}`).join("\n") : "Playbook lints clean.";
+      }
+    } else if (args.action === "history") {
+      if (!args.playbookId) {
+        out = "history requires playbookId.";
+      } else {
+        const h = o.playbooks.versioning.history(args.playbookId);
+        out = h.length ? h.map((v) => `- v${v.version} (${v.hash})${v.comment ? ` ${v.comment}` : ""}`).join("\n") : `No versions for '${args.playbookId}'.`;
+      }
+    } else if (args.action === "rollback") {
+      if (!args.playbookId || args.version === void 0) {
+        out = "rollback requires playbookId + version.";
+      } else {
+        const v = o.playbooks.versioning.rollback(args.playbookId, args.version);
+        out = `Rolled back to v${args.version} \u2192 new v${v.version}.`;
+      }
+    } else {
+      if (!args.playbookId || args.a === void 0 || args.b === void 0) {
+        out = "diff requires playbookId + a + b.";
+      } else {
+        out = o.playbooks.versioning.diff(args.playbookId, args.a, args.b);
+      }
+    }
+  } catch (e) {
+    out = `playbook error: ${e instanceof Error ? e.message : String(e)}`;
+  }
+  emit9(context2, "manage_playbook_version", args, out);
+  return out;
+}
+var getCloudInventorySchema = external_exports.object({
+  action: external_exports.enum(["summary", "query", "sync"]).describe("summary counts, query resources, or pull fresh inventory."),
+  provider: external_exports.enum(["aws", "gcp", "azure"]).optional().describe("Filter by provider."),
+  state: external_exports.string().optional().describe("Filter by state (running/stopped/\u2026)."),
+  region: external_exports.string().optional().describe("Filter by region.")
+});
+async function getCloudInventory(args, context2) {
+  const { o, msg } = obs(context2, "get_cloud_inventory", args);
+  if (!o) return msg;
+  let out;
+  try {
+    if (args.action === "summary") {
+      const s = o.cloud.summary();
+      out = `Cloud inventory: ${s.total} resources. By provider: ${JSON.stringify(s.byProvider)}. By state: ${JSON.stringify(s.byState)}.`;
+    } else if (args.action === "query") {
+      const r = o.cloud.query({ provider: args.provider, state: args.state, region: args.region });
+      out = r.length ? r.map((x) => `- [${x.provider}] ${x.name} (${x.machineType ?? x.kind}) ${x.state ?? ""} ${x.region ?? ""}`).join("\n") : "No matching cloud resources.";
+    } else {
+      const r = await o.cloud.sync();
+      out = `Synced ${r.added} resources${r.errors.length ? `, ${r.errors.length} account error(s)` : ""}.`;
+    }
+  } catch (e) {
+    out = `cloud error: ${e instanceof Error ? e.message : String(e)}`;
+  }
+  emit9(context2, "get_cloud_inventory", args, out);
+  return out;
+}
+var getLiveDashboardSchema = external_exports.object({
+  action: external_exports.enum(["state", "subscribers"]).describe("'state' = current dashboard state; 'subscribers' = connected client count.")
+});
+async function getLiveDashboard(args, context2) {
+  const { o, msg } = obs(context2, "get_live_dashboard", args);
+  if (!o) return msg;
+  let out;
+  if (args.action === "subscribers") {
+    out = `${o.liveDashboard.subscriberCount()} dashboard subscriber(s) connected.`;
+  } else {
+    const s = await o.dashboard.summary();
+    out = s;
+  }
+  emit9(context2, "get_live_dashboard", args, out);
+  return out;
+}
+
 // packages/backend/src/services/AgentHelper/tools/skill_tools.ts
 var skillToolSchema = external_exports.object({
   name: external_exports.string().describe("The skill identifier from available_skills")
@@ -346648,6 +347026,51 @@ function buildToolsForModel(readFileSupport) {
       name: "import_putty",
       description: BUILTIN_TOOL_INFO.find((t) => t.name === "import_putty")?.description ?? "",
       schema: importPuttySchema
+    },
+    {
+      name: "get_metrics",
+      description: 'Read host metrics as Prometheus exposition text (for a scraper) or a one-line dashboard summary. Use to answer "how are my hosts doing" or to feed an external Prometheus/OTel collector.',
+      schema: getMetricsSchema
+    },
+    {
+      name: "manage_secret",
+      description: "Manage the encrypted secrets vault \u2014 list metadata (never values), set, delete, or check a secret. Secrets are materialized only at exec time and never enter the conversation. Vault must be unlocked (RTERM_SECRETS_MASTER_KEY).",
+      schema: manageSecretSchema
+    },
+    {
+      name: "manage_oncall",
+      description: "Incident on-call paging \u2014 list open pages, raise a page for an incident under an escalation policy, acknowledge or resolve a page, list policies, or advance the escalation clock.",
+      schema: manageOncallSchema
+    },
+    {
+      name: "get_cost",
+      description: "AI cost & budgets \u2014 summarize token spend in dollars (per model/profile, daily/monthly), check an intended run against budgets (ok/warn/throttle/deny), or list budgets.",
+      schema: getCostSchema
+    },
+    {
+      name: "manage_recording",
+      description: "asciinema-style session recording \u2014 list, start, stop, replay (scrub), export (.cast), or delete a terminal session recording.",
+      schema: manageRecordingSchema
+    },
+    {
+      name: "manage_gitops",
+      description: "GitOps for desired state \u2014 export the live estate (connections/playbooks/triggers/etc.) as a content-hashed manifest, or detect drift / verify a manifest against live.",
+      schema: manageGitopsSchema
+    },
+    {
+      name: "manage_playbook_version",
+      description: "Playbook/runbook versioning + lint \u2014 statically lint a playbook definition (undefined params, dependsOn cycles, empty steps, missing rollback), list version history, roll back, or diff two versions.",
+      schema: managePlaybookVersionSchema
+    },
+    {
+      name: "get_cloud_inventory",
+      description: "Cloud resource inventory (AWS/GCP/Azure) \u2014 summary counts by provider/state, query instances (filter by provider/state/region), or pull fresh inventory.",
+      schema: getCloudInventorySchema
+    },
+    {
+      name: "get_live_dashboard",
+      description: "Live multi-client dashboard \u2014 read the current unified dashboard state/summary, or the number of connected dashboard subscribers.",
+      schema: getLiveDashboardSchema
     }
   ].map((tool2) => convertToOpenAITool(tool2));
 }
@@ -346684,6 +347107,15 @@ var toolImplementations = {
   manageChange,
   manageTrigger,
   importPutty,
+  getMetrics,
+  manageSecret,
+  manageOncall,
+  getCost,
+  manageRecording,
+  manageGitops,
+  managePlaybookVersion,
+  getCloudInventory,
+  getLiveDashboard,
   writeFile,
   editFile,
   writeAndEdit,
@@ -348813,11 +349245,11 @@ var AbstractChatCompletionRunner = class extends EventStream {
       this._addMessage(message);
     return chatCompletion;
   }
-  _addMessage(message, emit9 = true) {
+  _addMessage(message, emit10 = true) {
     if (!("content" in message))
       message.content = null;
     this.messages.push(message);
-    if (emit9) {
+    if (emit10) {
       this._emit("message", message);
       if (isToolMessage2(message) && message.content) {
         this._emit("functionToolCallResult", message.content);
@@ -349069,8 +349501,8 @@ var ChatCompletionRunner = class _ChatCompletionRunner extends AbstractChatCompl
     runner._run(() => runner._runTools(client2, params, opts));
     return runner;
   }
-  _addMessage(message, emit9 = true) {
-    super._addMessage(message, emit9);
+  _addMessage(message, emit10 = true) {
+    super._addMessage(message, emit10);
     if (isAssistantMessage(message) && message.content) {
       this._emit("content", message.content);
     }
@@ -359896,6 +360328,7 @@ var AgentService_v2 = class {
   /** Optional automation store backing the automation agent tools. */
   automationManager;
   triggerEngine;
+  observability;
   /** Optional session-log handle for list_session_logs / read_session_log. */
   sessionLogger;
   /** Optional run ledger — persisted audit + token-cost record of every
@@ -359969,6 +360402,10 @@ var AgentService_v2 = class {
   setTriggerEngine(engine) {
     this.triggerEngine = engine ?? void 0;
   }
+  /** Wire the observability handle (v2.9.x) so the observability_* agent tools work. */
+  setObservability(obs2) {
+    this.observability = obs2 ?? void 0;
+  }
   /** Wire a session-log handle so list_session_logs / read_session_log work. */
   setSessionLogger(logger) {
     this.sessionLogger = logger ?? void 0;
@@ -361145,6 +361582,87 @@ Actually, your intention might be different. Please re-read the description of t
           }
           break;
         }
+        case "get_metrics": {
+          try {
+            const validatedArgs = getMetricsSchema.parse(toolCall.args || {});
+            result = await toolImplementations.getMetrics(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for get_metrics: ${err.message}`;
+          }
+          break;
+        }
+        case "manage_secret": {
+          try {
+            const validatedArgs = manageSecretSchema.parse(toolCall.args || {});
+            result = await toolImplementations.manageSecret(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for manage_secret: ${err.message}`;
+          }
+          break;
+        }
+        case "manage_oncall": {
+          try {
+            const validatedArgs = manageOncallSchema.parse(toolCall.args || {});
+            result = await toolImplementations.manageOncall(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for manage_oncall: ${err.message}`;
+          }
+          break;
+        }
+        case "get_cost": {
+          try {
+            const validatedArgs = getCostSchema.parse(toolCall.args || {});
+            result = await toolImplementations.getCost(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for get_cost: ${err.message}`;
+          }
+          break;
+        }
+        case "manage_recording": {
+          try {
+            const validatedArgs = manageRecordingSchema.parse(toolCall.args || {});
+            result = await toolImplementations.manageRecording(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for manage_recording: ${err.message}`;
+          }
+          break;
+        }
+        case "manage_gitops": {
+          try {
+            const validatedArgs = manageGitopsSchema.parse(toolCall.args || {});
+            result = await toolImplementations.manageGitops(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for manage_gitops: ${err.message}`;
+          }
+          break;
+        }
+        case "manage_playbook_version": {
+          try {
+            const validatedArgs = managePlaybookVersionSchema.parse(toolCall.args || {});
+            result = await toolImplementations.managePlaybookVersion(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for manage_playbook_version: ${err.message}`;
+          }
+          break;
+        }
+        case "get_cloud_inventory": {
+          try {
+            const validatedArgs = getCloudInventorySchema.parse(toolCall.args || {});
+            result = await toolImplementations.getCloudInventory(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for get_cloud_inventory: ${err.message}`;
+          }
+          break;
+        }
+        case "get_live_dashboard": {
+          try {
+            const validatedArgs = getLiveDashboardSchema.parse(toolCall.args || {});
+            result = await toolImplementations.getLiveDashboard(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for get_live_dashboard: ${err.message}`;
+          }
+          break;
+        }
         case "manage_device_memory": {
           try {
             const validatedArgs = manageDeviceMemorySchema.parse(toolCall.args || {});
@@ -361946,6 +362464,7 @@ ${reminder}`;
       agentRunLedger: this.agentRunLedger,
       changeLedger: this.changeLedger,
       triggerEngine: this.triggerEngine,
+      observability: this.observability,
       agentRunId,
       savedSshConnections: this.settings?.connections?.ssh ?? [],
       savedWinrmConnections: this.settings?.connections?.winrm ?? [],
@@ -365469,6 +365988,24 @@ var WebSocketGatewayAdapter = class {
   }
   async executeRequest(request, socket) {
     const params = request.params ?? {};
+    if (request.method.startsWith("observability:")) {
+      const bridge = this.options.observabilityBridge;
+      if (!bridge) {
+        throw new WebSocketRpcError(
+          "METHOD_NOT_FOUND",
+          `${request.method} is not available on this websocket gateway.`
+        );
+      }
+      const fnName = request.method.slice("observability:".length);
+      const fn = bridge[fnName];
+      if (typeof fn !== "function") {
+        throw new WebSocketRpcError(
+          "METHOD_NOT_FOUND",
+          `Unknown observability method: ${request.method}`
+        );
+      }
+      return await fn(params);
+    }
     switch (request.method) {
       case "gateway:ping":
         return { pong: true, ts: Date.now() };
@@ -383986,6 +384523,89 @@ function createObservability(deps) {
   };
 }
 
+// packages/backend/src/services/Gateway/observabilityBridge.ts
+function requireObs(deps) {
+  const o = deps.observability();
+  if (!o) throw new Error("observability is not available on this runtime");
+  return o;
+}
+function createObservabilityBridge(deps) {
+  return {
+    // ── metrics / prometheus / otel ─────────────────────────────────────────
+    /** Prometheus exposition text for all host metrics. */
+    metricsPrometheus: async () => requireObs(deps).metricsExport.renderPrometheus(),
+    /** dashboard state (unified). */
+    dashboardState: async () => requireObs(deps).dashboard.state(),
+    /** dashboard summary line. */
+    dashboardSummary: async () => requireObs(deps).dashboard.summary(),
+    // ── secrets vault (metadata only — never values) ────────────────────────
+    secretsList: async (params) => requireObs(deps).secrets.list(params),
+    secretsSet: async (params) => {
+      const v = requireObs(deps).secrets;
+      v.set(params.key, params.value, params.labels);
+      return { ok: true, key: params.key };
+    },
+    secretsDelete: async (params) => ({ deleted: requireObs(deps).secrets.delete(params.key) }),
+    secretsHas: async (params) => ({ exists: requireObs(deps).secrets.has(params.key) }),
+    // ── on-call / escalation ────────────────────────────────────────────────
+    oncallListPolicies: async () => requireObs(deps).oncall.listPolicies(),
+    oncallRegisterPolicy: async (params) => {
+      requireObs(deps).oncall.registerPolicy(params);
+      return { ok: true, id: params.id };
+    },
+    oncallOpenPages: async () => requireObs(deps).oncall.openPages(),
+    oncallPage: async (params) => requireObs(deps).oncall.page(params),
+    oncallAck: async (params) => requireObs(deps).oncall.acknowledge(params.pageId, params.by),
+    oncallResolve: async (params) => requireObs(deps).oncall.resolve(params.pageId),
+    oncallTick: async () => requireObs(deps).oncall.tick(),
+    // ── AI cost & budgets ───────────────────────────────────────────────────
+    costSummary: async (params) => requireObs(deps).cost.summarize(params),
+    costRecord: async (params) => ({
+      usd: requireObs(deps).cost.record(params)
+    }),
+    costCheck: async (params) => requireObs(deps).cost.check(params),
+    costListBudgets: async () => requireObs(deps).cost.listBudgets(),
+    costSetBudget: async (params) => {
+      requireObs(deps).cost.setBudget(params);
+      return { ok: true, id: params.id };
+    },
+    costRemoveBudget: async (params) => ({ removed: requireObs(deps).cost.removeBudget(params.id) }),
+    // ── session recording ───────────────────────────────────────────────────
+    recordingList: async () => requireObs(deps).recording.list(),
+    recordingStart: async (params) => ({
+      recordingId: requireObs(deps).recording.start(params.terminalId, params)
+    }),
+    recordingStop: async (params) => requireObs(deps).recording.stop(params.recordingId),
+    recordingReplay: async (params) => requireObs(deps).recording.replay(params.recordingId, params),
+    recordingExportCast: async (params) => requireObs(deps).recording.exportCast(params.recordingId),
+    recordingDelete: async (params) => ({ deleted: requireObs(deps).recording.delete(params.recordingId) }),
+    // ── gitops ──────────────────────────────────────────────────────────────
+    gitopsExport: async () => requireObs(deps).gitops.exportLive(),
+    gitopsDrift: async (params) => requireObs(deps).gitops.drift(params.manifest),
+    gitopsInSync: async (params) => ({
+      inSync: await requireObs(deps).gitops.inSync(params.manifest)
+    }),
+    gitopsReconcile: async (params) => requireObs(deps).gitops.reconcile(params.manifest, { deleteRemoved: params.deleteRemoved }),
+    // ── playbook versioning + lint ──────────────────────────────────────────
+    playbookLint: async (params) => requireObs(deps).playbooks.lint(params.def),
+    playbookHistory: async (params) => requireObs(deps).playbooks.versioning.history(params.playbookId),
+    playbookSave: async (params) => requireObs(deps).playbooks.versioning.save(params.playbookId, params.def, params.comment),
+    playbookRollback: async (params) => requireObs(deps).playbooks.versioning.rollback(params.playbookId, params.version, params.comment),
+    playbookDiff: async (params) => requireObs(deps).playbooks.versioning.diff(params.playbookId, params.a, params.b),
+    // ── cloud inventory ─────────────────────────────────────────────────────
+    cloudSummary: async () => requireObs(deps).cloud.summary(),
+    cloudQuery: async (params) => requireObs(deps).cloud.query(params),
+    cloudSync: async () => requireObs(deps).cloud.sync(),
+    cloudAddAccount: async (params) => {
+      requireObs(deps).cloud.addAccount(params);
+      return { ok: true };
+    },
+    // ── live dashboard hub ──────────────────────────────────────────────────
+    liveDashboardState: async () => requireObs(deps).liveDashboard.lastState() ?? await requireObs(deps).dashboard.state(),
+    liveDashboardSubscriberCount: async () => ({ count: requireObs(deps).liveDashboard.subscriberCount() })
+  };
+}
+
 // packages/backend/src/services/ResourceMonitorService.ts
 var import_os2 = __toESM(require("os"), 1);
 var DEFAULT_POLL_INTERVAL_MS = 2e3;
@@ -385995,6 +386615,7 @@ async function startGyBackend() {
     }
   });
   console.log(`[gybackend] Observability wired: dashboard state available (hosts=${observability.metricsLedger.hosts().length})`);
+  agentService.setObservability(observability);
   if (settingsService.getSettings().sessionLogging?.enabled) {
     const logDir = import_node_path28.default.join(
       import_node_process2.default.env.GYSHELL_STORE_DIR || "",
@@ -386434,7 +387055,13 @@ async function startGyBackend() {
           gatewayService.broadcastRaw("tools:builtInUpdated", summary);
           return summary;
         }
-      }
+      },
+      // Observability bridge (v2.9.x): exposes the 9 platform capabilities
+      // (metrics export, secrets, on-call, cost, recording, gitops, playbooks,
+      // cloud, live dashboard) as observability:* RPC methods.
+      observabilityBridge: createObservabilityBridge({
+        observability: () => observability
+      })
     })
   });
   await wsGatewayControlService.applyPolicy(startupPolicy);