fix(health-check): address Copilot review on proactive-sentinel

- Fix config-integrity to not falsely claim YAML validation
- Make disk-space check recursive for subdirectories
- Handle DEGRADED status in consecutiveFailures tracking
- Simplify stale-locks to direct scan instead of glob patterns
- Auto-register timers for watchpoints added after start()
- Use ?? instead of || for optional numeric defaults
- Copy module to .aiox-core/ for package shipping

Author: nikolasdehor

.aios-core/core/health-check/proactive-sentinel.js

@@ -169,16 +169,26 @@ class ProactiveSentinel extends EventEmitter {
       name: watchpoint.name,
       description: watchpoint.description || '',
       check: watchpoint.check,
-      intervalMs: watchpoint.intervalMs || this.config.defaultIntervalMs,
-      severity: watchpoint.severity || AlertSeverity.WARNING,
-      autoHeal: watchpoint.autoHeal || false,
+      intervalMs: watchpoint.intervalMs ?? this.config.defaultIntervalMs,
+      severity: watchpoint.severity ?? AlertSeverity.WARNING,
+      autoHeal: watchpoint.autoHeal ?? false,
       healerId: watchpoint.healerId || null,
       lastStatus: WatchpointStatus.UNKNOWN,
       lastCheck: null,
       consecutiveFailures: 0,
     };
 
     this.watchpoints.set(watchpoint.id, entry);
+
+    // If sentinel is already running, create a timer for the new watchpoint immediately
+    if (this.running) {
+      const timer = setInterval(() => {
+        this.evaluateWatchpoint(entry.id).catch(() => {});
+      }, entry.intervalMs);
+      if (timer.unref) timer.unref();
+      this._timers.set(entry.id, timer);
+    }
+
     this.emit(Events.WATCHPOINT_REGISTERED, { id: entry.id, name: entry.name });
     return entry;
   }
@@ -223,8 +233,8 @@ class ProactiveSentinel extends EventEmitter {
     wp.lastStatus = result.status || WatchpointStatus.UNKNOWN;
     wp.lastCheck = new Date().toISOString();
 
-    // Track consecutive failures
-    if (wp.lastStatus === WatchpointStatus.FAILING) {
+    // Track consecutive failures (DEGRADED counts as a soft failure)
+    if (wp.lastStatus === WatchpointStatus.FAILING || wp.lastStatus === WatchpointStatus.DEGRADED) {
       wp.consecutiveFailures++;
     } else if (wp.lastStatus === WatchpointStatus.HEALTHY) {
       wp.consecutiveFailures = 0;
@@ -243,7 +253,7 @@ class ProactiveSentinel extends EventEmitter {
 
     this.emit(Events.WATCHPOINT_EVALUATED, evaluation);
 
-    // Fire alert on status change to degraded/failing
+    // Fire alert on non-healthy status or repeated failures
     if (
       wp.lastStatus !== WatchpointStatus.HEALTHY &&
       wp.lastStatus !== WatchpointStatus.UNKNOWN &&
@@ -410,7 +420,7 @@ class ProactiveSentinel extends EventEmitter {
     this.registerWatchpoint({
       id: 'config-integrity',
       name: 'Config File Integrity',
-      description: 'Checks that core config files are valid JSON/YAML',
+      description: 'Checks that core JSON config files are valid and YAML files are readable',
       severity: AlertSeverity.CRITICAL,
       check: async () => {
         const configFiles = [
@@ -424,6 +434,15 @@ class ProactiveSentinel extends EventEmitter {
             const content = fs.readFileSync(file, 'utf8');
             if (file.endsWith('.json')) {
               JSON.parse(content);
+            } else if (file.endsWith('.yaml') || file.endsWith('.yml')) {
+              // Without a YAML parser, verify the file is readable and non-empty
+              if (!content.trim()) {
+                return {
+                  status: WatchpointStatus.FAILING,
+                  message: `Empty config: ${path.basename(file)}`,
+                  data: { file },
+                };
+              }
             }
           } catch {
             return {
@@ -479,24 +498,21 @@ class ProactiveSentinel extends EventEmitter {
       severity: AlertSeverity.WARNING,
       autoHeal: true,
       check: async () => {
-        const lockPatterns = [
-          path.join(projectRoot, '.aiox', '*.lock'),
-          path.join(projectRoot, '.aiox', 'locks', '*'),
-        ];
-
+        const lockDir = path.join(projectRoot, '.aiox');
         const staleLocks = [];
         const maxAge = 30 * 60 * 1000; // 30 minutes
 
-        for (const pattern of lockPatterns) {
-          const dir = path.dirname(pattern);
-          if (!fs.existsSync(dir)) continue;
-
-          const files = fs.readdirSync(dir).filter((f) => f.endsWith('.lock'));
+        if (fs.existsSync(lockDir)) {
+          const files = fs.readdirSync(lockDir).filter((f) => f.endsWith('.lock'));
           for (const file of files) {
-            const filePath = path.join(dir, file);
-            const stat = fs.statSync(filePath);
-            if (Date.now() - stat.mtimeMs > maxAge) {
-              staleLocks.push(filePath);
+            const filePath = path.join(lockDir, file);
+            try {
+              const stat = fs.statSync(filePath);
+              if (Date.now() - stat.mtimeMs > maxAge) {
+                staleLocks.push(filePath);
+              }
+            } catch {
+              // ignore inaccessible files
             }
           }
         }
@@ -524,16 +540,7 @@ class ProactiveSentinel extends EventEmitter {
           return { status: WatchpointStatus.HEALTHY, message: 'No .aiox dir' };
         }
 
-        let totalSize = 0;
-        const files = fs.readdirSync(memDir);
-        for (const file of files) {
-          try {
-            const stat = fs.statSync(path.join(memDir, file));
-            totalSize += stat.size;
-          } catch {
-            // ignore
-          }
-        }
+        const totalSize = this._getDirectorySize(memDir);
 
         const maxSize = 50 * 1024 * 1024; // 50MB warning threshold
         if (totalSize > maxSize) {
@@ -581,6 +588,35 @@ class ProactiveSentinel extends EventEmitter {
   //                              INTERNAL METHODS
   // ═══════════════════════════════════════════════════════════════════════════════
 
+  /**
+   * Recursively compute the total size of a directory in bytes
+   * @param {string} dir - Directory path
+   * @returns {number} Total size in bytes
+   * @private
+   */
+  _getDirectorySize(dir) {
+    let totalSize = 0;
+    try {
+      const entries = fs.readdirSync(dir, { withFileTypes: true });
+      for (const entry of entries) {
+        const fullPath = path.join(dir, entry.name);
+        try {
+          if (entry.isDirectory()) {
+            totalSize += this._getDirectorySize(fullPath);
+          } else {
+            const stat = fs.statSync(fullPath);
+            totalSize += stat.size;
+          }
+        } catch {
+          // ignore inaccessible entries
+        }
+      }
+    } catch {
+      // ignore unreadable directories
+    }
+    return totalSize;
+  }
+
   /**
    * Fire an alert
    * @private