neuralos 2.9.2 → 2.9.4

package/bin/gybackend.cjs

@@ -288865,6 +288865,32 @@ var TerminalService = class {
   setSessionLogger(logger) {
     this.sessionLogger = logger;
   }
+  /** Wire the asciinema-style session recorder (v2.9.x). Output events feed all active recordings. */
+  setSessionRecorder(recorder) {
+    this.sessionRecorder = recorder;
+  }
+  /** Live-recording state: terminalId -> recordingId. */
+  activeRecordings = /* @__PURE__ */ new Map();
+  sessionRecorder = null;
+  /** Begin recording a terminal's output. Returns the recordingId. */
+  startRecording(terminalId, opts = {}) {
+    if (!this.sessionRecorder) throw new Error("session recorder is not wired");
+    const id = this.sessionRecorder.start(terminalId, opts);
+    this.activeRecordings.set(terminalId, id);
+    return id;
+  }
+  /** Stop the active recording for a terminal (if any). Returns the recordingId or null. */
+  stopRecording(terminalId) {
+    const id = this.activeRecordings.get(terminalId);
+    if (!id) return null;
+    this.activeRecordings.delete(terminalId);
+    this.sessionRecorder?.stop(id);
+    return id;
+  }
+  /** True if a terminal is currently being recorded. */
+  isRecording(terminalId) {
+    return this.activeRecordings.has(terminalId);
+  }
   setRawEventPublisher(publisher) {
     this.rawEventPublisher = publisher;
   }
@@ -289326,6 +289352,13 @@ var TerminalService = class {
   handleData(terminalId, data) {
     const sanitizedData = stripInternalControlMarkers(data);
     const tab = this.terminals.get(terminalId);
+    const recordingId = this.activeRecordings.get(terminalId);
+    if (recordingId && this.sessionRecorder && sanitizedData) {
+      try {
+        this.sessionRecorder.out(recordingId, sanitizedData);
+      } catch {
+      }
+    }
     if (this.sessionLogger && tab) {
       if (!this.sessionLogStarted.has(terminalId)) {
         this.sessionLogStarted.add(terminalId);
@@ -342195,6 +342228,22 @@ var BUILTIN_TOOL_INFO = [
     name: "create_or_edit",
     description: CREATE_OR_EDIT_TOOL_DESCRIPTION
   },
+  {
+    name: "write_file",
+    description: WRITE_FILE_TOOL_DESCRIPTION
+  },
+  {
+    name: "edit_file",
+    description: EDIT_FILE_TOOL_DESCRIPTION
+  },
+  {
+    name: "skill",
+    description: "Load a skill to get detailed instructions for a specific task. Skills provide specialized knowledge, step-by-step guidance, and may include supporting files (scripts, references)."
+  },
+  {
+    name: "create_skill",
+    description: "Create a new skill in GyShell skills. This tool only creates new skills and does not modify or overwrite existing ones. If the skill name already exists, the call must fail and you should choose a different name. If you need to modify an existing skill, use edit_file to edit that skill's md file directly, or write_file only when intentionally replacing the full file."
+  },
   {
     name: "wait",
     description: WAIT_TOOL_DESCRIPTION
@@ -342294,6 +342343,42 @@ var BUILTIN_TOOL_INFO = [
   {
     name: "manage_trigger",
     description: MANAGE_TRIGGER_DESCRIPTION
+  },
+  {
+    name: "get_metrics",
+    description: 'Read host metrics as Prometheus exposition text (for a scraper) or a one-line dashboard summary. Use to answer "how are my hosts doing" or to feed an external Prometheus/OTel collector.'
+  },
+  {
+    name: "manage_secret",
+    description: "Manage the encrypted secrets vault \u2014 list metadata (never values), set, delete, or check a secret. Secrets are materialized only at exec time and never enter the conversation. Vault must be unlocked (RTERM_SECRETS_MASTER_KEY)."
+  },
+  {
+    name: "manage_oncall",
+    description: "Incident on-call paging \u2014 list open pages, raise a page for an incident under an escalation policy, acknowledge or resolve a page, list policies, or advance the escalation clock."
+  },
+  {
+    name: "get_cost",
+    description: "AI cost & budgets \u2014 summarize token spend in dollars (per model/profile, daily/monthly), check an intended run against budgets (ok/warn/throttle/deny), or list budgets."
+  },
+  {
+    name: "manage_recording",
+    description: "asciinema-style session recording \u2014 list, start, stop, replay (scrub), export (.cast), or delete a terminal session recording."
+  },
+  {
+    name: "manage_gitops",
+    description: "GitOps for desired state \u2014 export the live estate (connections/playbooks/triggers/etc.) as a content-hashed manifest, or detect drift / verify a manifest against live."
+  },
+  {
+    name: "manage_playbook_version",
+    description: "Playbook/runbook versioning + lint \u2014 statically lint a playbook definition (undefined params, dependsOn cycles, empty steps, missing rollback), list version history, roll back, or diff two versions."
+  },
+  {
+    name: "get_cloud_inventory",
+    description: "Cloud resource inventory (AWS/GCP/Azure) \u2014 summary counts by provider/state, query instances (filter by provider/state/region), or pull fresh inventory."
+  },
+  {
+    name: "get_live_dashboard",
+    description: "Live multi-client dashboard \u2014 read the current unified dashboard state/summary, or the number of connected dashboard subscribers."
   }
 ];
 function buildReadFileDescription(support) {
@@ -365944,6 +366029,29 @@ var WebSocketGatewayAdapter = class {
           `${request.method} is not available on this websocket gateway.`
         );
       }
+      if (request.method === "observability:liveDashboardSubscribe") {
+        const hub = bridge.liveDashboard;
+        const filter = params.filter;
+        const subId = `ws-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+        await hub.subscribe({
+          id: subId,
+          filter,
+          send: (payload) => {
+            this.safeSocketSend(socket, {
+              type: "gateway:event",
+              event: "observability:dashboard",
+              data: payload
+            });
+          }
+        });
+        const sock = socket;
+        const onClose = () => {
+          hub.unsubscribe(subId);
+          sock.off?.("close", onClose);
+        };
+        sock.on?.("close", onClose);
+        return { subscribed: true, subscriberId: subId };
+      }
       const fnName = request.method.slice("observability:".length);
       const fn = bridge[fnName];
       if (typeof fn !== "function") {
@@ -384404,15 +384512,73 @@ function createObservability(deps) {
   const escalationService = new EscalationService({ channels: deps.pagingChannels ?? [] });
   const costBudgetService = new CostBudgetService({ prices: deps.modelPrices });
   const sessionRecorder = new SessionRecorder({});
+  const defaultGitopsReadLive = () => {
+    const out = [];
+    try {
+      const settings = deps.settingsService?.getSettings?.();
+      const conns = settings?.connections ?? {};
+      for (const [kind, list] of Object.entries(conns)) {
+        if (!Array.isArray(list)) continue;
+        for (const c of list) {
+          const id = c?.id ?? c?.name;
+          if (id) out.push({ id: `connection:${kind}:${String(id)}`, kind: "connection", spec: c });
+        }
+      }
+    } catch {
+    }
+    try {
+      const am = deps.automationManager;
+      const groups = am?.listGroups?.() ?? [];
+      for (const g of groups) {
+        const id = g?.id ?? g?.name;
+        if (id) out.push({ id: `group:${String(id)}`, kind: "group", spec: g });
+      }
+      const scripts = am?.listScripts?.() ?? [];
+      for (const s of scripts) {
+        const id = s?.id ?? s?.name;
+        if (id) out.push({ id: `script:${String(id)}`, kind: "script", spec: s });
+      }
+      const playbooks = am?.listPlaybooks?.() ?? [];
+      for (const p of playbooks) {
+        const id = p?.id ?? p?.name;
+        if (id) out.push({ id: `playbook:${String(id)}`, kind: "playbook", spec: p });
+      }
+      const templates = am?.listTemplates?.() ?? [];
+      for (const t of templates) {
+        const id = t?.id ?? t?.name;
+        if (id) out.push({ id: `template:${String(id)}`, kind: "template", spec: t });
+      }
+      const tasks = am?.listScheduledTasks?.() ?? [];
+      for (const t of tasks) {
+        const id = t?.id ?? t?.name;
+        if (id) out.push({ id: `scheduledTask:${String(id)}`, kind: "scheduledTask", spec: t });
+      }
+    } catch {
+    }
+    return out;
+  };
   const gitopsService = new GitOpsService({
-    readLive: deps.gitopsReadLive ?? (() => []),
+    readLive: deps.gitopsReadLive ?? defaultGitopsReadLive,
     applyEntity: deps.gitopsApplyEntity
   });
   const playbookVersioning = new PlaybookVersioning({});
+  const runCliJson = async (bin, args) => {
+    const { execFile: execFile2 } = await import("node:child_process");
+    return new Promise((resolve2, reject) => {
+      execFile2(bin, args, { timeout: 6e4, maxBuffer: 16 * 1024 * 1024 }, (err, stdout) => {
+        if (err) return reject(err);
+        try {
+          resolve2(JSON.parse(stdout));
+        } catch (e) {
+          reject(e instanceof Error ? e : new Error("invalid JSON"));
+        }
+      });
+    });
+  };
   const cloudInventory = new CloudInventory({
-    fetchAwsInstances: deps.fetchAwsInstances,
-    fetchGcpInstances: deps.fetchGcpInstances,
-    fetchAzureVms: deps.fetchAzureVms
+    fetchAwsInstances: deps.fetchAwsInstances ?? (async () => runCliJson("aws", ["ec2", "describe-instances", "--output", "json"])),
+    fetchGcpInstances: deps.fetchGcpInstances ?? (async () => runCliJson("gcloud", ["compute", "instances", "list", "--format", "json"])),
+    fetchAzureVms: deps.fetchAzureVms ?? (async () => runCliJson("az", ["vm", "list", "--show-details", "--output", "json"]))
   });
   const liveDashboardHub = new LiveDashboardHub({
     getState: () => dashboard.state()
@@ -384428,6 +384594,45 @@ function createObservability(deps) {
     } catch {
     }
   });
+  let lastCostRunId = null;
+  const feedCostFromRuns = () => {
+    try {
+      const runs = deps.agentRunLedger?.listRuns?.({ limit: 100 }) ?? [];
+      for (const r of runs) {
+        if (r.runId === lastCostRunId) break;
+        if (!r.model || r.promptTokens === 0 && r.completionTokens === 0) continue;
+        costBudgetService.record({ model: r.model, promptTokens: r.promptTokens, completionTokens: r.completionTokens });
+      }
+      const newest = runs[0];
+      if (newest) lastCostRunId = newest.runId;
+    } catch {
+    }
+  };
+  const costFeedTimer = setInterval(feedCostFromRuns, 6e4);
+  if (typeof costFeedTimer.unref === "function") costFeedTimer.unref();
+  feedCostFromRuns();
+  let otelPushTimer;
+  if (otelExporter) {
+    const intervalMs = Number(process.env.OTEL_EXPORTER_OTLP_INTERVAL_MS ?? 3e4) || 3e4;
+    const pushOnce = async () => {
+      try {
+        renderPrometheus();
+        await otelExporter.push(prometheusRegistry);
+      } catch {
+      }
+    };
+    otelPushTimer = setInterval(() => {
+      void pushOnce();
+    }, intervalMs);
+    if (typeof otelPushTimer.unref === "function") otelPushTimer.unref();
+    void pushOnce();
+  }
+  const oncallTickTimer = setInterval(() => {
+    void escalationService.tick().catch(() => {
+    });
+  }, 3e4);
+  if (typeof oncallTickTimer.unref === "function") oncallTickTimer.unref();
+  deps.onBackgroundDrivers?.({ otelPushTimer, oncallTickTimer });
   return {
     metricsLedger,
     goldenSignals,
@@ -384520,10 +384725,17 @@ function createObservabilityBridge(deps) {
     costRemoveBudget: async (params) => ({ removed: requireObs(deps).cost.removeBudget(params.id) }),
     // ── session recording ───────────────────────────────────────────────────
     recordingList: async () => requireObs(deps).recording.list(),
-    recordingStart: async (params) => ({
-      recordingId: requireObs(deps).recording.start(params.terminalId, params)
-    }),
+    recordingStart: async (params) => {
+      const ts = deps.terminalService?.();
+      if (ts) return { recordingId: ts.startRecording(params.terminalId, params) };
+      return { recordingId: requireObs(deps).recording.start(params.terminalId, params) };
+    },
     recordingStop: async (params) => requireObs(deps).recording.stop(params.recordingId),
+    recordingStopTerminal: async (params) => {
+      const ts = deps.terminalService?.();
+      const id = ts?.stopRecording(params.terminalId);
+      return { recordingId: id, stopped: id !== null && id !== void 0 };
+    },
     recordingReplay: async (params) => requireObs(deps).recording.replay(params.recordingId, params),
     recordingExportCast: async (params) => requireObs(deps).recording.exportCast(params.recordingId),
     recordingDelete: async (params) => ({ deleted: requireObs(deps).recording.delete(params.recordingId) }),
@@ -384550,7 +384762,11 @@ function createObservabilityBridge(deps) {
     },
     // ── live dashboard hub ──────────────────────────────────────────────────
     liveDashboardState: async () => requireObs(deps).liveDashboard.lastState() ?? await requireObs(deps).dashboard.state(),
-    liveDashboardSubscriberCount: async () => ({ count: requireObs(deps).liveDashboard.subscriberCount() })
+    liveDashboardSubscriberCount: async () => ({ count: requireObs(deps).liveDashboard.subscriberCount() }),
+    /** the raw hub (used by the gateway adapter for liveDashboardSubscribe). */
+    get liveDashboard() {
+      return requireObs(deps).liveDashboard;
+    }
   };
 }
 
@@ -386556,6 +386772,7 @@ async function startGyBackend() {
     agentRunLedger,
     gatewayService,
     resourceMonitorService,
+    settingsService,
     setMonitorPublisher: (pub) => resourceMonitorService.setPublisher((channel, data) => {
       pub(channel, data);
     }),
@@ -386564,6 +386781,7 @@ async function startGyBackend() {
   });
   console.log(`[gybackend] Observability wired: dashboard state available (hosts=${observability.metricsLedger.hosts().length})`);
   agentService.setObservability(observability);
+  terminalService.setSessionRecorder(observability.recording);
   if (settingsService.getSettings().sessionLogging?.enabled) {
     const logDir = import_node_path28.default.join(
       import_node_process2.default.env.GYSHELL_STORE_DIR || "",
@@ -387008,7 +387226,8 @@ async function startGyBackend() {
       // (metrics export, secrets, on-call, cost, recording, gitops, playbooks,
       // cloud, live dashboard) as observability:* RPC methods.
       observabilityBridge: createObservabilityBridge({
-        observability: () => observability
+        observability: () => observability,
+        terminalService: () => terminalService
       })
     })
   });

package/bin/gybackend.js

@@ -288865,6 +288865,32 @@ var TerminalService = class {
   setSessionLogger(logger) {
     this.sessionLogger = logger;
   }
+  /** Wire the asciinema-style session recorder (v2.9.x). Output events feed all active recordings. */
+  setSessionRecorder(recorder) {
+    this.sessionRecorder = recorder;
+  }
+  /** Live-recording state: terminalId -> recordingId. */
+  activeRecordings = /* @__PURE__ */ new Map();
+  sessionRecorder = null;
+  /** Begin recording a terminal's output. Returns the recordingId. */
+  startRecording(terminalId, opts = {}) {
+    if (!this.sessionRecorder) throw new Error("session recorder is not wired");
+    const id = this.sessionRecorder.start(terminalId, opts);
+    this.activeRecordings.set(terminalId, id);
+    return id;
+  }
+  /** Stop the active recording for a terminal (if any). Returns the recordingId or null. */
+  stopRecording(terminalId) {
+    const id = this.activeRecordings.get(terminalId);
+    if (!id) return null;
+    this.activeRecordings.delete(terminalId);
+    this.sessionRecorder?.stop(id);
+    return id;
+  }
+  /** True if a terminal is currently being recorded. */
+  isRecording(terminalId) {
+    return this.activeRecordings.has(terminalId);
+  }
   setRawEventPublisher(publisher) {
     this.rawEventPublisher = publisher;
   }
@@ -289326,6 +289352,13 @@ var TerminalService = class {
   handleData(terminalId, data) {
     const sanitizedData = stripInternalControlMarkers(data);
     const tab = this.terminals.get(terminalId);
+    const recordingId = this.activeRecordings.get(terminalId);
+    if (recordingId && this.sessionRecorder && sanitizedData) {
+      try {
+        this.sessionRecorder.out(recordingId, sanitizedData);
+      } catch {
+      }
+    }
     if (this.sessionLogger && tab) {
       if (!this.sessionLogStarted.has(terminalId)) {
         this.sessionLogStarted.add(terminalId);
@@ -342195,6 +342228,22 @@ var BUILTIN_TOOL_INFO = [
     name: "create_or_edit",
     description: CREATE_OR_EDIT_TOOL_DESCRIPTION
   },
+  {
+    name: "write_file",
+    description: WRITE_FILE_TOOL_DESCRIPTION
+  },
+  {
+    name: "edit_file",
+    description: EDIT_FILE_TOOL_DESCRIPTION
+  },
+  {
+    name: "skill",
+    description: "Load a skill to get detailed instructions for a specific task. Skills provide specialized knowledge, step-by-step guidance, and may include supporting files (scripts, references)."
+  },
+  {
+    name: "create_skill",
+    description: "Create a new skill in GyShell skills. This tool only creates new skills and does not modify or overwrite existing ones. If the skill name already exists, the call must fail and you should choose a different name. If you need to modify an existing skill, use edit_file to edit that skill's md file directly, or write_file only when intentionally replacing the full file."
+  },
   {
     name: "wait",
     description: WAIT_TOOL_DESCRIPTION
@@ -342294,6 +342343,42 @@ var BUILTIN_TOOL_INFO = [
   {
     name: "manage_trigger",
     description: MANAGE_TRIGGER_DESCRIPTION
+  },
+  {
+    name: "get_metrics",
+    description: 'Read host metrics as Prometheus exposition text (for a scraper) or a one-line dashboard summary. Use to answer "how are my hosts doing" or to feed an external Prometheus/OTel collector.'
+  },
+  {
+    name: "manage_secret",
+    description: "Manage the encrypted secrets vault \u2014 list metadata (never values), set, delete, or check a secret. Secrets are materialized only at exec time and never enter the conversation. Vault must be unlocked (RTERM_SECRETS_MASTER_KEY)."
+  },
+  {
+    name: "manage_oncall",
+    description: "Incident on-call paging \u2014 list open pages, raise a page for an incident under an escalation policy, acknowledge or resolve a page, list policies, or advance the escalation clock."
+  },
+  {
+    name: "get_cost",
+    description: "AI cost & budgets \u2014 summarize token spend in dollars (per model/profile, daily/monthly), check an intended run against budgets (ok/warn/throttle/deny), or list budgets."
+  },
+  {
+    name: "manage_recording",
+    description: "asciinema-style session recording \u2014 list, start, stop, replay (scrub), export (.cast), or delete a terminal session recording."
+  },
+  {
+    name: "manage_gitops",
+    description: "GitOps for desired state \u2014 export the live estate (connections/playbooks/triggers/etc.) as a content-hashed manifest, or detect drift / verify a manifest against live."
+  },
+  {
+    name: "manage_playbook_version",
+    description: "Playbook/runbook versioning + lint \u2014 statically lint a playbook definition (undefined params, dependsOn cycles, empty steps, missing rollback), list version history, roll back, or diff two versions."
+  },
+  {
+    name: "get_cloud_inventory",
+    description: "Cloud resource inventory (AWS/GCP/Azure) \u2014 summary counts by provider/state, query instances (filter by provider/state/region), or pull fresh inventory."
+  },
+  {
+    name: "get_live_dashboard",
+    description: "Live multi-client dashboard \u2014 read the current unified dashboard state/summary, or the number of connected dashboard subscribers."
   }
 ];
 function buildReadFileDescription(support) {
@@ -365944,6 +366029,29 @@ var WebSocketGatewayAdapter = class {
           `${request.method} is not available on this websocket gateway.`
         );
       }
+      if (request.method === "observability:liveDashboardSubscribe") {
+        const hub = bridge.liveDashboard;
+        const filter = params.filter;
+        const subId = `ws-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+        await hub.subscribe({
+          id: subId,
+          filter,
+          send: (payload) => {
+            this.safeSocketSend(socket, {
+              type: "gateway:event",
+              event: "observability:dashboard",
+              data: payload
+            });
+          }
+        });
+        const sock = socket;
+        const onClose = () => {
+          hub.unsubscribe(subId);
+          sock.off?.("close", onClose);
+        };
+        sock.on?.("close", onClose);
+        return { subscribed: true, subscriberId: subId };
+      }
       const fnName = request.method.slice("observability:".length);
       const fn = bridge[fnName];
       if (typeof fn !== "function") {
@@ -384404,15 +384512,73 @@ function createObservability(deps) {
   const escalationService = new EscalationService({ channels: deps.pagingChannels ?? [] });
   const costBudgetService = new CostBudgetService({ prices: deps.modelPrices });
   const sessionRecorder = new SessionRecorder({});
+  const defaultGitopsReadLive = () => {
+    const out = [];
+    try {
+      const settings = deps.settingsService?.getSettings?.();
+      const conns = settings?.connections ?? {};
+      for (const [kind, list] of Object.entries(conns)) {
+        if (!Array.isArray(list)) continue;
+        for (const c of list) {
+          const id = c?.id ?? c?.name;
+          if (id) out.push({ id: `connection:${kind}:${String(id)}`, kind: "connection", spec: c });
+        }
+      }
+    } catch {
+    }
+    try {
+      const am = deps.automationManager;
+      const groups = am?.listGroups?.() ?? [];
+      for (const g of groups) {
+        const id = g?.id ?? g?.name;
+        if (id) out.push({ id: `group:${String(id)}`, kind: "group", spec: g });
+      }
+      const scripts = am?.listScripts?.() ?? [];
+      for (const s of scripts) {
+        const id = s?.id ?? s?.name;
+        if (id) out.push({ id: `script:${String(id)}`, kind: "script", spec: s });
+      }
+      const playbooks = am?.listPlaybooks?.() ?? [];
+      for (const p of playbooks) {
+        const id = p?.id ?? p?.name;
+        if (id) out.push({ id: `playbook:${String(id)}`, kind: "playbook", spec: p });
+      }
+      const templates = am?.listTemplates?.() ?? [];
+      for (const t of templates) {
+        const id = t?.id ?? t?.name;
+        if (id) out.push({ id: `template:${String(id)}`, kind: "template", spec: t });
+      }
+      const tasks = am?.listScheduledTasks?.() ?? [];
+      for (const t of tasks) {
+        const id = t?.id ?? t?.name;
+        if (id) out.push({ id: `scheduledTask:${String(id)}`, kind: "scheduledTask", spec: t });
+      }
+    } catch {
+    }
+    return out;
+  };
   const gitopsService = new GitOpsService({
-    readLive: deps.gitopsReadLive ?? (() => []),
+    readLive: deps.gitopsReadLive ?? defaultGitopsReadLive,
     applyEntity: deps.gitopsApplyEntity
   });
   const playbookVersioning = new PlaybookVersioning({});
+  const runCliJson = async (bin, args) => {
+    const { execFile: execFile2 } = await import("node:child_process");
+    return new Promise((resolve2, reject) => {
+      execFile2(bin, args, { timeout: 6e4, maxBuffer: 16 * 1024 * 1024 }, (err, stdout) => {
+        if (err) return reject(err);
+        try {
+          resolve2(JSON.parse(stdout));
+        } catch (e) {
+          reject(e instanceof Error ? e : new Error("invalid JSON"));
+        }
+      });
+    });
+  };
   const cloudInventory = new CloudInventory({
-    fetchAwsInstances: deps.fetchAwsInstances,
-    fetchGcpInstances: deps.fetchGcpInstances,
-    fetchAzureVms: deps.fetchAzureVms
+    fetchAwsInstances: deps.fetchAwsInstances ?? (async () => runCliJson("aws", ["ec2", "describe-instances", "--output", "json"])),
+    fetchGcpInstances: deps.fetchGcpInstances ?? (async () => runCliJson("gcloud", ["compute", "instances", "list", "--format", "json"])),
+    fetchAzureVms: deps.fetchAzureVms ?? (async () => runCliJson("az", ["vm", "list", "--show-details", "--output", "json"]))
   });
   const liveDashboardHub = new LiveDashboardHub({
     getState: () => dashboard.state()
@@ -384428,6 +384594,45 @@ function createObservability(deps) {
     } catch {
     }
   });
+  let lastCostRunId = null;
+  const feedCostFromRuns = () => {
+    try {
+      const runs = deps.agentRunLedger?.listRuns?.({ limit: 100 }) ?? [];
+      for (const r of runs) {
+        if (r.runId === lastCostRunId) break;
+        if (!r.model || r.promptTokens === 0 && r.completionTokens === 0) continue;
+        costBudgetService.record({ model: r.model, promptTokens: r.promptTokens, completionTokens: r.completionTokens });
+      }
+      const newest = runs[0];
+      if (newest) lastCostRunId = newest.runId;
+    } catch {
+    }
+  };
+  const costFeedTimer = setInterval(feedCostFromRuns, 6e4);
+  if (typeof costFeedTimer.unref === "function") costFeedTimer.unref();
+  feedCostFromRuns();
+  let otelPushTimer;
+  if (otelExporter) {
+    const intervalMs = Number(process.env.OTEL_EXPORTER_OTLP_INTERVAL_MS ?? 3e4) || 3e4;
+    const pushOnce = async () => {
+      try {
+        renderPrometheus();
+        await otelExporter.push(prometheusRegistry);
+      } catch {
+      }
+    };
+    otelPushTimer = setInterval(() => {
+      void pushOnce();
+    }, intervalMs);
+    if (typeof otelPushTimer.unref === "function") otelPushTimer.unref();
+    void pushOnce();
+  }
+  const oncallTickTimer = setInterval(() => {
+    void escalationService.tick().catch(() => {
+    });
+  }, 3e4);
+  if (typeof oncallTickTimer.unref === "function") oncallTickTimer.unref();
+  deps.onBackgroundDrivers?.({ otelPushTimer, oncallTickTimer });
   return {
     metricsLedger,
     goldenSignals,
@@ -384520,10 +384725,17 @@ function createObservabilityBridge(deps) {
     costRemoveBudget: async (params) => ({ removed: requireObs(deps).cost.removeBudget(params.id) }),
     // ── session recording ───────────────────────────────────────────────────
     recordingList: async () => requireObs(deps).recording.list(),
-    recordingStart: async (params) => ({
-      recordingId: requireObs(deps).recording.start(params.terminalId, params)
-    }),
+    recordingStart: async (params) => {
+      const ts = deps.terminalService?.();
+      if (ts) return { recordingId: ts.startRecording(params.terminalId, params) };
+      return { recordingId: requireObs(deps).recording.start(params.terminalId, params) };
+    },
     recordingStop: async (params) => requireObs(deps).recording.stop(params.recordingId),
+    recordingStopTerminal: async (params) => {
+      const ts = deps.terminalService?.();
+      const id = ts?.stopRecording(params.terminalId);
+      return { recordingId: id, stopped: id !== null && id !== void 0 };
+    },
     recordingReplay: async (params) => requireObs(deps).recording.replay(params.recordingId, params),
     recordingExportCast: async (params) => requireObs(deps).recording.exportCast(params.recordingId),
     recordingDelete: async (params) => ({ deleted: requireObs(deps).recording.delete(params.recordingId) }),
@@ -384550,7 +384762,11 @@ function createObservabilityBridge(deps) {
     },
     // ── live dashboard hub ──────────────────────────────────────────────────
     liveDashboardState: async () => requireObs(deps).liveDashboard.lastState() ?? await requireObs(deps).dashboard.state(),
-    liveDashboardSubscriberCount: async () => ({ count: requireObs(deps).liveDashboard.subscriberCount() })
+    liveDashboardSubscriberCount: async () => ({ count: requireObs(deps).liveDashboard.subscriberCount() }),
+    /** the raw hub (used by the gateway adapter for liveDashboardSubscribe). */
+    get liveDashboard() {
+      return requireObs(deps).liveDashboard;
+    }
   };
 }
 
@@ -386556,6 +386772,7 @@ async function startGyBackend() {
     agentRunLedger,
     gatewayService,
     resourceMonitorService,
+    settingsService,
     setMonitorPublisher: (pub) => resourceMonitorService.setPublisher((channel, data) => {
       pub(channel, data);
     }),
@@ -386564,6 +386781,7 @@ async function startGyBackend() {
   });
   console.log(`[gybackend] Observability wired: dashboard state available (hosts=${observability.metricsLedger.hosts().length})`);
   agentService.setObservability(observability);
+  terminalService.setSessionRecorder(observability.recording);
   if (settingsService.getSettings().sessionLogging?.enabled) {
     const logDir = import_node_path28.default.join(
       import_node_process2.default.env.GYSHELL_STORE_DIR || "",
@@ -387008,7 +387226,8 @@ async function startGyBackend() {
       // (metrics export, secrets, on-call, cost, recording, gitops, playbooks,
       // cloud, live dashboard) as observability:* RPC methods.
       observabilityBridge: createObservabilityBridge({
-        observability: () => observability
+        observability: () => observability,
+        terminalService: () => terminalService
       })
     })
   });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "neuralos",
-  "version": "2.9.2",
-  "description": "neuralOS — the headless AI-native backend for RTerm. Run RTerm-as-a-service (AI agent, SSH/WinRM/Serial/local terminals, fleet orchestration, advanced automation, SRE observability, Netdata, AWS APerf, plugin system, governance/audit, Prometheus/OTel metrics export, secrets vault, on-call paging, AI cost budgets, GitOps, cloud inventory). The RTerm desktop app stays RTerm; neuralOS is the standalone backend daemon. Dual-published as rterm-backend. v2.9.2: 9 capabilities now exposed as gateway RPC + agent tools.",
+  "version": "2.9.4",
+  "description": "neuralOS \u2014 the headless AI-native backend for RTerm. run RTerm-as-a-service (AI agent, SSH/WinRM/Serial/local terminals, fleet orchestration, advanced automation, SRE observability, Netdata, AWS APerf, plugin system, governance/audit, Prometheus/OTel metrics export, secrets vault, on-call paging, AI cost budgets, GitOps, cloud inventory). The RTerm desktop app stays RTerm; neuralOS is the standalone backend daemon. Dual-published as rterm-backend. v2.9.4: the 9 capabilities actually work out of the box (no placeholders).",
   "main": "bin/gybackend.js",
   "bin": {
     "neuralos": "bin/gybackend.js",