reflectt-node 0.1.15 → 0.1.17

package/dist/cloud.js

@@ -18,14 +18,15 @@ import { chatManager } from './chat.js';
 import { remapGitHubMentions } from './github-webhook-attribution.js';
 import { slotManager } from './canvas-slots.js';
 import { getDb } from './db.js';
-import { getUsageSummary, getUsageByAgent, getUsageByModel, listCaps, checkCaps, getRoutingSuggestions } from './usage-tracking.js';
+import { getUsageSummary, getUsageByAgent, getUsageByModel, listCaps, checkCaps, getRoutingSuggestions, getCostForTaskId } from './usage-tracking.js';
 import { listReflections } from './reflections.js';
 import { listInsights } from './insights.js';
 import { readFileSync, existsSync, watch } from 'fs';
 import { join } from 'path';
 import { REFLECTT_HOME } from './config.js';
 import { getRequestMetrics } from './request-tracker.js';
-import { listApprovalQueue, listAgentEvents } from './agent-runs.js';
+import { listApprovalQueue, listAgentEvents, listAgentRuns } from './agent-runs.js';
+import { getUnpushedTrustEvents, markTrustEventsPushed } from './trust-events.js';
 /**
  * Docker identity guard: detect when a container has inherited cloud
  * credentials from a host volume mount. Without explicit opt-in, skip
@@ -68,6 +69,33 @@ let lastActivityAt = Date.now();
 export function markCloudActivity() {
     lastActivityAt = Date.now();
 }
+/** Request immediate canvas sync to cloud (called on canvas_render events) */
+export function requestImmediateCanvasSync() {
+    markCloudActivity();
+    // syncCanvas is module-scoped; we use a deferred call pattern
+    if (immediateSyncFn)
+        immediateSyncFn();
+}
+let immediateSyncFn = null;
+export function _registerImmediateSync(fn) {
+    immediateSyncFn = fn;
+}
+// ── canvas_push relay buffer ─────────────────────────────────────────────────
+// canvas_push events (utterance, work_released, approval_requested) are emitted
+// on the node event bus but never reached the cloud SSE stream. This buffer
+// collects them and flushes them in the next syncCanvas POST as push_events[].
+// The cloud then broadcasts each as a `canvas_push` SSE event to all subscribers.
+const MAX_PENDING_PUSH_EVENTS = 20;
+const pendingPushEvents = [];
+/** Queue a canvas_push event for relay to cloud in the next sync cycle. */
+export function queueCanvasPushEvent(event) {
+    pendingPushEvents.push({ ...event, _queuedAt: Date.now() });
+    // Cap buffer to prevent unbounded growth between syncs
+    while (pendingPushEvents.length > MAX_PENDING_PUSH_EVENTS)
+        pendingPushEvents.shift();
+    // Trigger immediate sync so the event reaches browsers quickly
+    requestImmediateCanvasSync();
+}
 /** Check if the system is idle */
 function isIdle() {
     return Date.now() - lastActivityAt > IDLE_THRESHOLD_MS;
@@ -249,7 +277,7 @@ export async function startCloudIntegration() {
         return;
     }
     config = {
-        cloudUrl: (process.env.REFLECTT_CLOUD_URL || fileConfig?.cloudUrl || 'https://app.reflectt.ai').replace(/\/+$/, ''),
+        cloudUrl: (process.env.REFLECTT_CLOUD_URL || fileConfig?.cloudUrl || 'https://api.reflectt.ai').replace(/\/+$/, ''),
         token: process.env.REFLECTT_HOST_TOKEN || '',
         hostName: process.env.REFLECTT_HOST_NAME || fileConfig?.hostName || 'unnamed-host',
         hostType: process.env.REFLECTT_HOST_TYPE || fileConfig?.hostType || 'openclaw',
@@ -349,6 +377,10 @@ export async function startCloudIntegration() {
     // Canvas sync — adaptive: 5s when active, 60s when idle
     // Uses a single 5s tick that skips when idle (unless enough time has passed)
     let lastCanvasSyncAt = 0;
+    _registerImmediateSync(() => {
+        syncCanvas().catch(() => { });
+        lastCanvasSyncAt = Date.now();
+    });
     syncCanvas().catch(() => { });
     state.canvasSyncTimer = setInterval(() => {
         const now = Date.now();
@@ -362,12 +394,24 @@ export async function startCloudIntegration() {
     syncRunApprovals().catch(() => { });
     state.approvalSyncTimer = setInterval(() => {
         syncRunApprovals().catch(() => { });
+        pollAgentDecisions().catch(() => { }); // poll queued relay decisions (NAT-behind hosts)
+        pollCanvasQueryRelay().catch(() => { }); // poll canvas/query relay queue (NAT-behind hosts)
     }, APPROVAL_SYNC_INTERVAL_MS);
     // Run event sync — every 5s
     syncRunEvents().catch(() => { });
     state.runEventSyncTimer = setInterval(() => {
         syncRunEvents().catch(() => { });
     }, RUN_EVENT_SYNC_INTERVAL_MS);
+    // Agent runs sync — every 30s (pushes run records to cloud action_runs table)
+    syncAgentRuns().catch(() => { });
+    setInterval(() => {
+        syncAgentRuns().catch(() => { });
+    }, 30_000);
+    // Trust event sync — every 60s (pushes unpushed trust signals to cloud)
+    syncTrustEvents().catch(() => { });
+    setInterval(() => {
+        syncTrustEvents().catch(() => { });
+    }, 60_000);
     // Usage sync — adaptive: 15s when active, 60s when idle
     let lastUsageSyncAt = 0;
     syncUsage().catch(() => { });
@@ -540,6 +584,17 @@ export function stopCloudIntegration() {
     }
     logConnectionEvent({ type: 'disconnected', timestamp: Date.now(), reason: 'shutdown' });
     console.log('☁️  Cloud integration: stopped');
+    // Clear canvas state on Fly so subscribers see an empty room, not ghost agents
+    if (state.hostId && state.credential && config) {
+        const clearUrl = `${config.cloudUrl}/api/hosts/${state.hostId}/canvas/clear`;
+        fetch(clearUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${state.credential}`,
+            },
+        }).catch(() => { });
+    }
 }
 // ---- Data providers ----
 function getAgents() {
@@ -556,11 +611,16 @@ function getAgents() {
             name: role.name,
             status: p
                 ? (p.status === 'working' || p.status === 'reviewing' ? 'active'
-                    : p.status === 'offline' ? 'offline'
-                        : 'idle')
+                    : p.status === 'waiting' ? 'waiting'
+                        : p.status === 'offline' ? 'offline'
+                            : 'idle')
                 : 'offline',
             currentTask: p?.task,
             lastSeen: p?.lastUpdate,
+            ...(p?.status === 'waiting' && p.waiting ? {
+                waitingFor: p.waiting.waitingFor,
+                waitingTaskId: p.waiting.taskId,
+            } : {}),
         });
     }
     // Also include any presence entries not in TEAM-ROLES (shouldn't happen, but defensive)
@@ -569,10 +629,15 @@ function getAgents() {
             agents.push({
                 name: p.agent,
                 status: p.status === 'working' || p.status === 'reviewing' ? 'active'
-                    : p.status === 'offline' ? 'offline'
-                        : 'idle',
+                    : p.status === 'waiting' ? 'waiting'
+                        : p.status === 'offline' ? 'offline'
+                            : 'idle',
                 currentTask: p.task,
                 lastSeen: p.lastUpdate,
+                ...(p.status === 'waiting' && p.waiting ? {
+                    waitingFor: p.waiting.waitingFor,
+                    waitingTaskId: p.waiting.taskId,
+                } : {}),
             });
         }
     }
@@ -587,6 +652,7 @@ function getTasks() {
         assignee: t.assignee,
         priority: t.priority,
         updatedAt: t.updatedAt || t.createdAt,
+        createdAt: t.createdAt,
     }));
 }
 // ---- Cloud communication ----
@@ -596,6 +662,29 @@ async function sendHeartbeat() {
     const agents = getAgents();
     const tasks = getTasks();
     const doingTasks = tasks.filter(t => t.status === 'doing');
+    // ── Slow task detection ───────────────────────────────────────────────
+    // Include tasks that have been doing >4h with no activity (slow-flagged).
+    // These are NOT explicitly blocked — they're just stale.
+    const SLOW_HEARTBEAT_MS = 4 * 60 * 60 * 1000;
+    const nowTs = Date.now();
+    const slowTasks = doingTasks.reduce((acc, t) => {
+        const comments = taskManager.getTaskComments(t.id);
+        const lastComment = comments.length > 0 ? comments[comments.length - 1] : null;
+        const lastActivityAt = lastComment?.timestamp ?? t.updatedAt ?? t.createdAt ?? nowTs;
+        const age = nowTs - lastActivityAt;
+        if (age > SLOW_HEARTBEAT_MS) {
+            acc.push({
+                id: t.id,
+                title: t.title,
+                assignee: t.assignee || undefined,
+                priority: t.priority || undefined,
+                slowSinceMs: age,
+                slowSinceHours: Math.round(age / 36_000) / 100,
+                lastActivityAt: lastActivityAt,
+            });
+        }
+        return acc;
+    }, []);
     // Cloud API: POST /api/hosts/:hostId/heartbeat
     // Expects: { status, agents?, activeTasks? }
     // Host is "online" if the server is running and responding.
@@ -606,13 +695,24 @@ async function sendHeartbeat() {
         contractVersion: 'host-heartbeat.v1',
         status: hostStatus,
         timestamp: Date.now(),
-        agents: agents.map(a => ({
-            id: a.name,
-            name: a.name,
-            status: a.status,
-            currentTaskId: a.currentTask || undefined,
-            lastSeenAt: a.lastSeen || Date.now(),
-        })),
+        agents: agents.map(a => {
+            const agentAliases = [a.name];
+            const todoCount = tasks.filter(t => t.status === 'todo' && agentAliases.includes(t.assignee || '')).length;
+            const doingCount = tasks.filter(t => t.status === 'doing' && agentAliases.includes(t.assignee || '')).length;
+            const blockedCount = tasks.filter(t => t.status === 'blocked' && agentAliases.includes(t.assignee || '')).length;
+            return {
+                id: a.name,
+                name: a.name,
+                status: a.status,
+                currentTaskId: a.currentTask || undefined,
+                lastSeenAt: a.lastSeen || Date.now(),
+                taskCounts: { todo: todoCount, doing: doingCount, blocked: blockedCount },
+                ...(a.status === 'waiting' ? {
+                    waitingFor: a.waitingFor,
+                    waitingTaskId: a.waitingTaskId,
+                } : {}),
+            };
+        }),
         activeTasks: doingTasks.map(t => ({
             id: t.id,
             title: t.title,
@@ -621,6 +721,7 @@ async function sendHeartbeat() {
             priority: t.priority || undefined,
             updatedAt: t.updatedAt || Date.now(),
         })),
+        slowTasks: slowTasks.length > 0 ? slowTasks : undefined,
         metrics: (() => {
             const m = getRequestMetrics();
             return {
@@ -888,7 +989,7 @@ async function syncChat() {
         // CRITICAL: use oldestFirst=true so the cursor walks forward through ALL
         // messages without skipping. Default getMessages returns newest-N (DESC
         // then reversed), which drops older messages in high-traffic windows.
-        // This was the root cause of cloud chat sync gaps Ryan reported.
+        // This was the root cause of cloud chat sync gaps reported.
         const recentMessages = chatManager.getMessages({
             after: chatSyncCursor,
             limit: 100,
@@ -969,6 +1070,53 @@ async function syncChat() {
 }
 // ---- Canvas sync ----
 let canvasSyncErrors = 0;
+// ── Needs-attention call hook ─────────────────────────────────────────────
+// Track previous agent states to detect needs-attention transitions.
+// When an agent newly enters needs-attention/urgent, fire POST /call on the
+// Fly API for org members who have call_on_needs_attention=true.
+// The Fly API resolves phone numbers from team_members.notification_phone.
+const prevAgentStates = new Map(); // agentId → state
+function checkNeedsAttentionTransitions(agents, hostId, cloudUrl, credential) {
+    for (const [agentId, agentData] of Object.entries(agents)) {
+        const agentState = agentData?.state;
+        if (!agentState)
+            continue;
+        const prev = prevAgentStates.get(agentId);
+        const isAlert = agentState === 'needs-attention' || agentState === 'urgent';
+        const wasAlert = prev === 'needs-attention' || prev === 'urgent';
+        prevAgentStates.set(agentId, agentState);
+        // Only fire on NEW transitions into alert state
+        if (!isAlert || wasAlert)
+            continue;
+        const taskData = agentData?.payload;
+        const taskTitle = taskData?.task || taskData?.title || undefined;
+        console.log(`☁️  [Canvas] needs-attention: @${agentId} → auto-call hook`);
+        // POST /call to Fly — Fly resolves phones for members with call_on_needs_attention=true
+        // If no members have that preference set, the call is a no-op (400 with no phone).
+        const callUrl = `${cloudUrl}/api/hosts/${hostId}/call`;
+        fetch(callUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${credential}`,
+            },
+            body: JSON.stringify({
+                agentId,
+                agentName: agentId,
+                taskTitle,
+                // No `to` — Fly resolves phone from team_members.notification_phone
+                // for members with call_on_needs_attention=true
+            }),
+        }).then(r => {
+            if (!r.ok && r.status !== 400) {
+                console.warn(`☁️  [Canvas] auto-call failed: ${r.status}`);
+            }
+        }).catch(err => {
+            // Non-fatal: call is best-effort
+            console.warn(`☁️  [Canvas] auto-call error: ${err instanceof Error ? err.message : err}`);
+        });
+    }
+}
 async function syncCanvas() {
     if (!state.hostId || !config)
         return;
@@ -984,8 +1132,138 @@ async function syncCanvas() {
         }
     }
     catch { /* local API not ready */ }
-    // Push to cloud — include both slots and agent states
-    const result = await cloudPost(`/api/hosts/${state.hostId}/canvas`, { slots: activeSlots, agents });
+    // ── Task-derived agent presence ─────────────────────────────────────────
+    // Agents that have open tasks are present even if they haven't pushed native
+    // canvas state. Any agent with a doing/validating task → "working".
+    // Any agent with a todo task (but no doing) → "working" (queued work).
+    // Native canvas state takes precedence when present — only fill gaps.
+    try {
+        const ACTIVE_STATUSES = ['doing', 'validating', 'todo'];
+        const byAgent = {};
+        for (const status of ACTIVE_STATUSES) {
+            const res = await fetch(`http://127.0.0.1:4445/tasks?status=${status}&limit=100`);
+            if (!res.ok)
+                continue;
+            const data = await res.json();
+            const tasks = data.tasks ?? [];
+            for (const task of tasks) {
+                const assignee = task.assignee;
+                if (!assignee || assignee === 'unassigned')
+                    continue;
+                // Higher-priority status wins: doing > validating > todo
+                const existing = byAgent[assignee];
+                const priority = { doing: 0, validating: 1, todo: 2 };
+                const newPriority = priority[status] ?? 99;
+                const existingPriority = existing ? (priority[existing.bestStatus] ?? 99) : 99;
+                if (!existing || newPriority < existingPriority) {
+                    byAgent[assignee] = { bestStatus: status, taskTitle: task.title };
+                }
+            }
+        }
+        // Merge derived states into agents — native canvas state takes precedence
+        const now = Date.now();
+        for (const [agentId, info] of Object.entries(byAgent)) {
+            if (agents[agentId])
+                continue; // native state present — don't override
+            const derivedState = info.bestStatus === 'doing' ? 'working'
+                : info.bestStatus === 'validating' ? 'working'
+                    : 'working'; // todo → working (has queued work)
+            agents[agentId] = {
+                state: derivedState,
+                currentTask: info.taskTitle,
+                updatedAt: now,
+                source: 'task-derived',
+            };
+        }
+        // ── Waiting state overlay ───────────────────────────────────────────
+        // Agents in waiting status get state='needs-attention' (amber pulse) on canvas.
+        // This runs AFTER task-derived but BEFORE thinking inference — waiting overrides working.
+        // Native canvas state still wins if explicitly set.
+        const allAgentInfos = getAgents();
+        for (const agent of allAgentInfos) {
+            if (agent.status !== 'waiting')
+                continue;
+            if (agents[agent.name])
+                continue; // native state — don't override
+            agents[agent.name] = {
+                state: 'waiting', // soft amber drift — distinct from needs-attention (bright pulse)
+                updatedAt: now,
+                source: 'waiting-derived',
+                waitingFor: agent.waitingFor ?? null,
+                waitingTaskId: agent.waitingTaskId ?? null,
+            };
+        }
+    }
+    catch { /* task API not ready — not fatal */ }
+    // ── Thinking state inference ────────────────────────────────────────────
+    // Agent has an active (running, non-completed) run AND hasn't sent a message
+    // in >2min → auto-derive state = 'thinking'. Explicit native canvas state always
+    // wins; this only fills gaps left after task-derived and native state passes.
+    // @swift @kotlin: once this ships, local heuristics for thinking can be removed.
+    try {
+        const THINKING_SILENCE_MS = 2 * 60 * 1000; // 2 minutes
+        const now2 = Date.now();
+        const presences = presenceManager.getAllPresence();
+        const presenceByAgent = new Map(presences.map(p => [p.agent, p]));
+        const allAgents = getAgents();
+        for (const agent of allAgents) {
+            // Skip if already has an explicit state (native or task-derived)
+            if (agents[agent.name])
+                continue;
+            // Check for an active (incomplete) run
+            const runs = listAgentRuns(agent.name, 'default', { limit: 5 });
+            const hasActiveRun = runs.some(r => r.status === 'working' && r.completedAt === null);
+            if (!hasActiveRun)
+                continue;
+            // Check message silence window
+            const presence = presenceByAgent.get(agent.name);
+            const lastMsgTs = presence?.lastUpdate ?? 0;
+            if (now2 - lastMsgTs > THINKING_SILENCE_MS) {
+                agents[agent.name] = {
+                    state: 'thinking',
+                    updatedAt: now2,
+                    source: 'thinking-inferred',
+                };
+            }
+        }
+    }
+    catch { /* non-fatal */ }
+    // ── Needs-attention call hook ───────────────────────────────────────────
+    // Check for new needs-attention transitions BEFORE pushing to cloud.
+    // The Fly canvas handler also triggers auto-calls, but this node-side hook
+    // fires immediately on state detection — no waiting for Fly SSE round-trip.
+    if (Object.keys(agents).length > 0 && state.hostId && state.credential && config.cloudUrl) {
+        checkNeedsAttentionTransitions(agents, state.hostId, config.cloudUrl, state.credential);
+    }
+    // Inject agent avatars into sync payload — browsers on app.reflectt.ai read avatar
+    // from agent state (canvasStore), not from a separate API call. We merge avatar
+    // into each agent entry here so cloud browsers render custom orbs instead of circles.
+    // Agents with avatars who haven't posted a canvas state get a floor stub so their
+    // custom orb always reaches the cloud (not just when canvas/state is called).
+    // task-1773690756100
+    try {
+        const db = getDb();
+        const avatarRows = db.prepare("SELECT agent_id, settings FROM agent_config WHERE settings LIKE '%avatar%'").all();
+        for (const row of avatarRows) {
+            try {
+                const s = JSON.parse(row.settings);
+                if (s.avatar?.content) {
+                    if (agents[row.agent_id]) {
+                        // Agent already has a canvas state — just inject the avatar string
+                        agents[row.agent_id].avatar = s.avatar.content;
+                    }
+                    // No floor stub for agents without canvas state — this was causing extra
+                    // agents to appear in the canvas constellation and fighting SSE presence updates.
+                    // Avatars only render when the agent has an active canvas state.
+                }
+            }
+            catch { /* skip */ }
+        }
+    }
+    catch { /* non-blocking */ }
+    // Push to cloud — include slots, agent states, and any buffered canvas_push events
+    const pushEventsToSend = pendingPushEvents.splice(0, pendingPushEvents.length);
+    const result = await cloudPost(`/api/hosts/${state.hostId}/canvas`, { slots: activeSlots, agents, push_events: pushEventsToSend.length > 0 ? pushEventsToSend : undefined });
     if (result.success && result.data) {
         state.lastCanvasSync = Date.now();
         if (canvasSyncErrors > 0) {
@@ -998,6 +1276,10 @@ async function syncCanvas() {
         if (canvasSyncErrors <= 3 || canvasSyncErrors % 20 === 0) {
             console.warn(`☁️  [Canvas] Sync failed (${canvasSyncErrors}): ${result.error}`);
         }
+        // Re-queue events that failed to send (up to cap)
+        if (pushEventsToSend.length > 0) {
+            pendingPushEvents.unshift(...pushEventsToSend.slice(-MAX_PENDING_PUSH_EVENTS));
+        }
     }
 }
 // ---- Run Approval Sync ----
@@ -1012,7 +1294,19 @@ async function syncRunApprovals() {
         return;
     lastApprovalSyncAt = now;
     try {
-        const items = listApprovalQueue({ category: 'review', limit: 20 });
+        const KNOWN_AGENTS_SYNC = new Set([
+            'link', 'kai', 'pixel', 'sage', 'scout', 'echo',
+            'rhythm', 'spark', 'swift', 'kotlin', 'harmony',
+            'artdirector', 'uipolish', 'coo', 'cos', 'pm', 'qa',
+            'shield', 'kindling', 'quill', 'funnel', 'attribution',
+            'bookkeeper', 'legal-counsel', 'evi-scout',
+        ]);
+        const rawItems = listApprovalQueue({ category: 'review', limit: 20 });
+        // Filter out agent-to-agent reviews — only sync human-required approvals to cloud
+        const items = rawItems.filter(item => {
+            const reviewer = (item.agentId ?? '').toLowerCase().trim();
+            return !reviewer || !KNOWN_AGENTS_SYNC.has(reviewer);
+        });
         if (items.length === 0 && approvalSyncErrors === 0)
             return; // Skip push when empty and no prior errors
         const payload = items.map(item => ({
@@ -1045,6 +1339,180 @@ async function syncRunApprovals() {
         }
     }
 }
+// ---- Agent Decision Relay Poll ----
+// When decisions are made via the cloud canvas while the node is behind NAT,
+// they are queued at GET /api/hosts/:id/agent-interface/decisions.
+// This function polls that queue and processes each decision locally.
+let lastDecisionPollAt = 0;
+const DECISION_POLL_INTERVAL_MS = 10_000; // 10s — same cadence as approval sync
+async function pollAgentDecisions() {
+    if (!state.hostId || !config)
+        return;
+    const now = Date.now();
+    if (now - lastDecisionPollAt < DECISION_POLL_INTERVAL_MS)
+        return;
+    lastDecisionPollAt = now;
+    try {
+        const result = await cloudGet(`/api/hosts/${state.hostId}/agent-interface/decisions`);
+        if (!result.success)
+            return;
+        const decisions = Array.isArray(result.data?.decisions) ? result.data.decisions : [];
+        if (decisions.length === 0)
+            return;
+        const acked = [];
+        for (const d of decisions) {
+            try {
+                const endpoint = `/agent-interface/runs/${d.eventId}/${d.decision === 'approve' ? 'approve' : 'reject'}`;
+                const res = await fetch(`http://127.0.0.1:4445${endpoint}`, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    signal: AbortSignal.timeout(3000),
+                });
+                // ACK on success OR 404/409 (run already decided / not found — still remove from queue)
+                if (res.ok || res.status === 404 || res.status === 409) {
+                    acked.push(d.eventId);
+                }
+            }
+            catch {
+                // Individual failure — leave in queue, retry next cycle
+            }
+        }
+        if (acked.length > 0) {
+            await cloudPost(`/api/hosts/${state.hostId}/agent-interface/decisions/ack`, { eventIds: acked });
+            console.log(`☁️  [DecisionRelay] Processed ${acked.length}/${decisions.length} queued decisions`);
+        }
+    }
+    catch {
+        // Non-critical — decisions will be retried next cycle
+    }
+}
+// ── Canvas query relay polling ────────────────────────────────────────────────
+// When canvas/query is called from a NAT-behind node, the cloud queues the query
+// at GET /api/hosts/:id/canvas/query/pending. We poll here, POST each query to
+// the local node, and ACK. The node emits canvas_message via eventBus → canvas_push
+// relay → cloud → browser pulse subscribers.
+let lastCanvasQueryPollAt = 0;
+const CANVAS_QUERY_POLL_INTERVAL_MS = 8_000; // 8s — faster than decisions (user-facing)
+async function pollCanvasQueryRelay() {
+    if (!state.hostId || !config)
+        return;
+    const now = Date.now();
+    if (now - lastCanvasQueryPollAt < CANVAS_QUERY_POLL_INTERVAL_MS)
+        return;
+    lastCanvasQueryPollAt = now;
+    try {
+        const result = await cloudGet(`/api/hosts/${state.hostId}/canvas/query/pending`);
+        if (!result.success)
+            return;
+        const queries = Array.isArray(result.data?.queries) ? result.data.queries : [];
+        if (queries.length === 0)
+            return;
+        const acked = [];
+        for (const q of queries) {
+            try {
+                // POST to local node — canvas/query processes it and emits canvas_message via eventBus.
+                // Process query locally and capture card for relay back to the browser.
+                // The card is included in the ACK payload → cloud broadcasts canvas_message to pulse SSE.
+                const res = await fetch('http://127.0.0.1:4445/canvas/query', {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({ query: q.query, sessionId: q.sessionId ?? undefined }),
+                    signal: AbortSignal.timeout(12000), // LLM calls can take ~10s
+                });
+                if (res.ok) {
+                    try {
+                        const data = await res.json();
+                        if (data.card) {
+                            // Include card in acked payload so cloud can broadcast it to browser subscribers
+                            ;
+                            q._card = data.card;
+                        }
+                    }
+                    catch { /* card extraction optional — still ACK */ }
+                    acked.push(q.queryId);
+                }
+                else if (res.status === 400) {
+                    // Invalid query — still ACK to remove from queue
+                    acked.push(q.queryId);
+                }
+            }
+            catch {
+                // Individual failure — leave in queue, retry next cycle
+            }
+        }
+        if (acked.length > 0) {
+            // Collect response cards for broadcast: cloud will emit canvas_message to pulse SSE
+            const cards = queries
+                .filter(q => acked.includes(q.queryId) && q._card)
+                .map(q => q._card);
+            await cloudPost(`/api/hosts/${state.hostId}/canvas/query/ack`, { queryIds: acked, cards });
+            console.log(`☁️  [CanvasQueryRelay] Processed ${acked.length}/${queries.length} relay queries, ${cards.length} cards broadcast`);
+        }
+    }
+    catch {
+        // Non-critical — queries will be retried next cycle
+    }
+}
+// ---- Agent Runs Sync ----
+// Push agent run records to cloud action_runs table (used by cloud Runs screen)
+let agentRunSyncErrors = 0;
+async function syncAgentRuns() {
+    if (!state.hostId || !config)
+        return;
+    try {
+        const agents = getAgents();
+        if (agents.length === 0)
+            return;
+        const allRuns = [];
+        for (const agent of agents) {
+            const runs = listAgentRuns(agent.name, 'default', { limit: 20 });
+            allRuns.push(...runs);
+        }
+        if (allRuns.length === 0)
+            return;
+        // Enrich runs with cost attribution from local model_usage table.
+        // task_id lives in contextSnapshot.taskId — only attributed when present.
+        // No time-window fallback (too error-prone for financial metrics).
+        const enrichedRuns = allRuns.map(run => {
+            const taskId = typeof run.contextSnapshot?.taskId === 'string' ? run.contextSnapshot.taskId : null;
+            return {
+                ...run,
+                taskId,
+                costUsd: taskId ? getCostForTaskId(taskId) : null,
+            };
+        });
+        const result = await cloudPost(`/api/hosts/${state.hostId}/runs/sync`, { runs: enrichedRuns });
+        if (result.success || result.data) {
+            if (agentRunSyncErrors > 0) {
+                console.log('☁️  [RunSync] Recovered after errors');
+                agentRunSyncErrors = 0;
+            }
+        }
+    }
+    catch (err) {
+        agentRunSyncErrors++;
+        if (agentRunSyncErrors <= 3) {
+            console.warn(`☁️  [RunSync] Error: ${err?.message}`);
+        }
+    }
+}
+// ---- Trust Event Sync ----
+// Push unpushed trust-collapse signals to cloud agent_trust_events table.
+async function syncTrustEvents() {
+    const { hostId } = state;
+    if (!hostId)
+        return;
+    const events = getUnpushedTrustEvents(50);
+    if (events.length === 0)
+        return;
+    try {
+        const result = await cloudPost(`/api/hosts/${hostId}/trust-events/sync`, { events: events.map(e => ({ id: e.id, agentId: e.agentId, type: e.eventType, severity: e.severity, taskId: e.taskId ?? null, summary: e.summary, metadata: e.context, emittedAt: e.occurredAt })) });
+        if (result.success || result.data?.ok) {
+            markTrustEventsPushed(events.map(e => e.id));
+        }
+    }
+    catch { /* non-fatal */ }
+}
 // ---- Run Event Sync ----
 // Push recent run events to cloud so Presence SSE relay has data
 let lastRunEventSyncAt = 0;