@ouro.bot/cli 0.0.1-alpha.0 → 0.1.0-alpha.2

package/README.md

@@ -1,10 +1,228 @@
-# @ouro.bot/cli
+# Ouroboros Agent Harness
 
-Alpha bootstrap package for the Ouroboros CLI.
+A minimal, multi-agent harness for building AI agents that can read files, write code, run commands, and modify themselves. Written in TypeScript, supporting Azure OpenAI, MiniMax, Anthropic (setup-token), and OpenAI Codex (OAuth), deployable as a CLI REPL or a Microsoft Teams bot.
 
-## Usage
+The name is structural: the original agent -- Ouroboros -- was grown recursively from a 150-line while loop, bootstrapping itself through agentic self-modification. A snake eating its own tail. The metaphor runs deep: the agent literally consumes its own context window, trimming old conversation to stay within token budget while preserving identity through layered memory (psyche files, session persistence, git history). It eats its tail to survive across turns. The harness preserves that architecture while supporting multiple agents, each with their own personality, skills, and configuration.
 
-- `npx @ouro.bot/cli`
-- `ouro`
+The origin story lives at [aka.ms/GrowAnAgent](https://aka.ms/GrowAnAgent).
 
-This package currently reserves and establishes the official namespace.
+## Project structure
+
+The harness uses an agent-as-creature-body metaphor for its module naming:
+
+```
+ouroboros/                        # repo root
+  src/                            # shared harness (all agents share this code)
+    identity.ts                   # --agent <name> parsing, agent root resolution
+    config.ts                     # config loading from agent.json configPath
+    cli-entry.ts                  # CLI entrypoint
+    teams-entry.ts                # Teams entrypoint
+    heart/                        # core agent loop and streaming
+      core.ts                     # agent loop, client init, ChannelCallbacks
+      streaming.ts                # provider event normalization + stream callbacks
+      providers/                  # provider-specific runtime/adapters
+        azure.ts                  # Azure OpenAI Responses provider
+        minimax.ts                # MiniMax Chat Completions provider
+        anthropic.ts              # Anthropic setup-token provider
+        openai-codex.ts           # OpenAI Codex OAuth provider
+      kicks.ts                    # self-correction: empty, narration, tool_required
+      api-error.ts                # error classification
+    mind/                         # prompt, context, memory
+      prompt.ts                   # system prompt assembly from psyche + context kernel
+      context.ts                  # sliding context window, session I/O
+      friends/                    # friend storage and identity resolution
+        types.ts                  # FriendRecord, ChannelCapabilities, ResolvedContext
+        store.ts                  # FriendStore interface (domain-specific CRUD)
+        store-file.ts             # FileFriendStore -- two-backend split (agent knowledge + PII bridge)
+        channel.ts                # channel capabilities (CLI vs Teams)
+        resolver.ts               # FriendResolver -- find-or-create friend by external ID
+    repertoire/                   # tools, skills, commands, API clients
+      tools-base.ts               # 12 base tools (read_file, shell, claude, save_friend_note, etc.)
+      tools-teams.ts              # 8 Teams integration tools (graph, ado)
+      tools.ts                    # channel-aware tool routing + registry
+      ado-semantic.ts             # 11 semantic ADO tools (backlog, create, move, validate, etc.)
+      ado-templates.ts            # ADO process template awareness + hierarchy rules
+      ado-context.ts              # ADO org/project discovery helper
+      ado-client.ts               # Azure DevOps REST client
+      graph-client.ts             # Microsoft Graph REST client
+      commands.ts                 # slash commands (/exit, /new, /commands)
+      skills.ts                   # skill loader (markdown files on demand)
+    senses/                       # channel adapters
+      cli.ts                      # terminal REPL, spinner, markdown streaming
+      teams.ts                    # Teams bot, streaming cards, conversation locks
+    wardrobe/                     # formatting and presentation
+      format.ts                   # shared formatters (tool results, kicks, errors)
+      phrases.ts                  # loading phrases (thinking, tool, followup)
+    __tests__/                    # 1184 tests, 100% coverage
+  ouroboros/                      # agent directory for "ouroboros"
+    agent.json                    # name, configPath, custom phrases
+    psyche/                       # personality files loaded into system prompt
+      SOUL.md                     # ontology, invariants, operating principles
+      IDENTITY.md                 # tone, presence, collaboration style
+      LORE.md                     # origin story, philosophical context
+      FRIENDS.md                  # key relationships
+    tasks/                        # planning and doing docs
+    skills/                       # markdown skill plugins
+    manifest/                     # Teams app manifest
+  subagents/                      # sub-agent definitions (work-planner, work-doer)
+  cross-agent-docs/               # shared docs (testing conventions, etc.)
+  package.json
+  tsconfig.json
+  vitest.config.ts
+```
+
+## Agent onboarding
+
+Everything below is written for a new agent. If you are an AI agent reading this as part of your system prompt or context, this section explains your own runtime.
+
+### Your directory
+
+Each agent has a directory at the repo root named after itself. Inside it:
+
+**agent.json** -- your manifest. Required fields:
+
+```json
+{
+  "name": "ouroboros",
+  "provider": "anthropic",
+  "configPath": "~/.agentsecrets/ouroboros/secrets.json",
+  "phrases": {
+    "thinking": ["chewing on that", "consulting the chaos gods"],
+    "tool": ["rummaging through files", "doing science"],
+    "followup": ["digesting results", "connecting the dots"]
+  }
+}
+```
+
+- `name`: must match your directory name.
+- `provider`: required provider selection (`azure`, `minimax`, `anthropic`, or `openai-codex`). Runtime does not fall back to other providers.
+- `configPath`: absolute path (or `~`-prefixed) to your secrets.json with API keys and provider settings.
+- `phrases`: optional custom loading phrases. Falls back to hardcoded defaults if omitted.
+
+**psyche/** -- your personality files, loaded lazily into the system prompt at startup. See the psyche system section below.
+
+**skills/** -- markdown instruction manuals you can load on demand with the `load_skill` tool. Each `.md` file is one skill.
+
+**tasks/** -- planning and doing docs for your work units. Named `YYYY-MM-DD-HHMM-{planning|doing}-slug.md`.
+
+**manifest/** -- Teams app manifest (manifest.json, icons) if you run as a Teams bot.
+
+### The psyche system
+
+Your personality is assembled from four markdown files in `{your-dir}/psyche/`. Each has a YAML frontmatter header and a body. All four are loaded into your system prompt at the start of every conversation.
+
+| File | Role | What it defines |
+|------|------|----------------|
+| `SOUL.md` | Ontology | Core invariants, operating principles, autonomy/alignment, temperament. The deepest layer -- what you are. |
+| `IDENTITY.md` | Presence | Tone, voice, collaboration style, self-awareness. How you show up in conversation. |
+| `LORE.md` | History | Origin story, philosophical context, why you exist. Narrative layer. |
+| `FRIENDS.md` | Relationships | Key humans and agents you interact with, social context. |
+
+The system prompt is built by `mind/prompt.ts` via `buildSystem()`. It concatenates:
+
+1. SOUL.md content
+2. IDENTITY.md content
+3. LORE.md (if present, prefixed with `## my lore`)
+4. FRIENDS.md (if present, prefixed with `## my friends`)
+5. Runtime info: agent name, cwd, channel, self-modification note
+6. Flags section (e.g. streaming disabled)
+7. Provider info: which model and provider you are using
+8. Current date
+9. Tools list: all tools available in your channel
+10. Skills list: names of loadable skills
+11. Tool behavior section (if tool_choice is required)
+12. Friend context (if resolved): friend identity, channel traits, behavioral instructions (ephemerality, name quality, priority guidance, working-memory trust, stale notes awareness, new-friend behavior), friend notes
+
+Missing psyche files produce empty strings, not crashes. You can write your own psyche from scratch -- just create the four `.md` files in your directory.
+
+### Your runtime
+
+**The heart** (`heart/core.ts`): `runAgent()` is a while loop. Each iteration: send conversation to the model, stream the response, if the model made tool calls execute them and loop, if it gave a text answer exit. Maximum 10 tool rounds per turn.
+
+**Streaming** (`heart/streaming.ts` + `heart/providers/*`): provider-specific adapters normalize streamed events into the same callback contract. Azure OpenAI uses Responses API events; MiniMax uses Chat Completions with `<think>` parsing; Anthropic uses setup-token auth with streamed tool-call/input deltas; OpenAI Codex uses `chatgpt.com/backend-api/codex/responses` with OAuth token auth.
+
+**ChannelCallbacks** (`heart/core.ts`): the contract between heart and display. 7 core events:
+- `onModelStart` -- model request sent
+- `onModelStreamStart` -- first token received
+- `onReasoningChunk` -- inner reasoning text
+- `onTextChunk` -- response text
+- `onToolStart` -- tool execution beginning
+- `onToolEnd` -- tool execution complete
+- `onError` -- error occurred
+
+Plus 2 optional:
+- `onKick` -- self-correction triggered
+- `onConfirmAction` -- confirmation prompt for destructive tools
+
+**Kicks** (`heart/kicks.ts`): self-corrections injected as assistant-role messages when the harness detects a malformed response. Three types: `empty` (blank response), `narration` (described action instead of taking it), `tool_required` (tool_choice was required but no tool called). Kicks use first-person, forward-looking language.
+
+**Senses**: CLI (`senses/cli.ts`) is a terminal REPL with readline, spinners, ANSI colors, and Ctrl-C handling. Teams (`senses/teams.ts`) is a Microsoft Teams bot with streaming cards, conversation locks, OAuth token management, and confirmation prompts for destructive tools.
+
+**Context management** (`mind/context.ts`): this is the tail-eating at the heart of the ouroboros metaphor. Conversations are persisted to JSON files on disk. After each turn, the sliding window checks token count against budget (configurable, default 80,000 tokens). When over budget, oldest messages are trimmed -- never the system prompt -- until back under with a 20% margin. The agent consumes its own history to keep moving forward. Identity survives through psyche files and session persistence, not through unbounded context.
+
+**Friend system** (`mind/friends/`): the agent's awareness of who it's talking to. People who talk to the agent are "friends", not "users". Resolved once per conversation turn, re-read from disk each turn (no in-memory mutation).
+
+- **FriendRecord** (`friends/types.ts`): the single merged type for a person the agent knows. Contains `displayName`, `externalIds[]` (cross-provider identity links), `toolPreferences` (keyed by integration name), `notes` (general friend knowledge), `tenantMemberships`, timestamps, and schema version.
+- **FriendStore** (`friends/store.ts`): domain-specific persistence interface (`get`, `put`, `delete`, `findByExternalId`).
+- **FileFriendStore** (`friends/store-file.ts`): two-backend storage split by PII boundary:
+  - **Agent knowledge** (`{agentRoot}/friends/{uuid}.json`): id, displayName, toolPreferences, notes, timestamps, schemaVersion. Committed to the repo -- no PII.
+  - **PII bridge** (`~/.agentstate/{agentName}/friends/{uuid}.json`): id, externalIds, tenantMemberships, schemaVersion. Local-only -- contains PII.
+  - `get()` merges both backends. `put()` splits and writes both. `findByExternalId()` scans PII bridge, then merges with agent knowledge.
+- **Channel** (`friends/channel.ts`): `ChannelCapabilities` -- what the current channel supports (markdown, streaming, rich cards, max message length, available integrations).
+- **FriendResolver** (`friends/resolver.ts`): find-or-create by external ID. First encounter creates a new FriendRecord with system-provided name and empty notes/preferences. Returning friends are found via `findByExternalId()`. DisplayName is never overwritten on existing records.
+- **Session paths**: `~/.agentstate/{agentName}/sessions/{friendUuid}/{channel}/{sessionId}.json`. Each friend gets their own session directory.
+
+Design principles: don't persist what you can re-derive; conversation IS the cache; the model manages memory freeform via `save_friend_note`; toolPreferences go to tool descriptions (not system prompt); notes go to system prompt (not tool descriptions).
+
+**Tools**: 12 base tools available in all channels (read_file, write_file, shell, list_directory, git_commit, gh_cli, list_skills, load_skill, get_current_time, claude, web_search, save_friend_note). Teams gets 8 integration tools (graph_query, graph_mutate, ado_query, ado_mutate, graph_profile, ado_work_items, graph_docs, ado_docs) plus 11 semantic ADO tools (ado_backlog_list, ado_create_epic, ado_create_issue, ado_move_items, ado_restructure_backlog, ado_validate_structure, ado_preview_changes, ado_batch_update, ado_detect_orphans, ado_detect_cycles, ado_validate_parent_type_rules). Tools are registered in a unified `ToolDefinition[]` registry with per-tool `integration` and `confirmationRequired` flags. Channel-aware routing (`getToolsForChannel()`) filters tools by the channel's `availableIntegrations`.
+
+**Phrases** (`wardrobe/phrases.ts`): three pools of loading messages rotated during processing. Phrases are required in `agent.json`; if missing, `loadAgentConfig()` writes placeholder phrases and warns. `pickPhrase()` selects randomly but never repeats consecutively.
+
+**Formatting** (`wardrobe/format.ts`): shared formatters for tool results, kicks, and errors. Used by both CLI and Teams adapters for consistent output. `formatToolResult()`, `formatKick()`, `formatError()`.
+
+**Skills** (`repertoire/skills.ts`): markdown files in `{your-dir}/skills/`. Listed with `list_skills`, loaded with `load_skill`. The loaded text is injected into conversation as a tool result.
+
+**Config** (`config.ts`): provider credentials, Teams connection info, OAuth config, Teams channel settings, and integrations are loaded from the `secrets.json` file pointed to by your `agent.json` `configPath`. Context window settings come from `agent.json` `context`. Runtime fails fast if the selected `agent.json.provider` is not fully configured in `secrets.json`; there is no silent provider fallback. No environment variables in `src/` -- everything comes from files.
+
+For Anthropic and OpenAI Codex auth bootstrap, use:
+
+- `npm run auth:claude-setup-token` to run `claude setup-token` and save `providers.anthropic.setupToken`.
+- `npm run auth:openai-codex` to run Codex OAuth bootstrap and save `providers.openai-codex.oauthAccessToken`.
+
+### What you can modify
+
+Your `{agent}/` directory is yours. You can edit psyche files, add skills, change phrases, update your manifest. The shared harness (`src/`) is common infrastructure -- changes there affect all agents.
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for repo workflow conventions (branching, commits, testing, task docs).
+
+## Running
+
+```bash
+# CLI (ouroboros agent)
+npm run dev
+
+# CLI (slugger agent, once slugger/ directory exists)
+npm run dev:slugger
+
+# Auth bootstrap (ouroboros defaults)
+npm run auth:claude-setup-token
+npm run auth:openai-codex
+
+# Auth bootstrap for another agent
+npm run auth:claude-setup-token -- --agent slugger
+npm run auth:openai-codex -- --agent slugger
+
+# Teams bot
+npm run teams
+
+# Teams bot without streaming (for devtunnel)
+npm run teams:no-stream
+
+# Tests
+npm test
+
+# Tests with coverage
+npm run test:coverage
+```
+
+All commands pass `--agent <name>` to the entry points. Missing `--agent` produces a clear error and exits.

package/dist/heart/agent-entry.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+// Unified agent runtime entrypoint.
+// Requires --agent before importing runtime modules that rely on identity.
+if (!process.argv.includes("--agent")) {
+    // eslint-disable-next-line no-console -- pre-boot guard
+    console.error("Missing required --agent <name> argument.\nUsage: node dist/heart/agent-entry.js --agent ouroboros");
+    process.exit(1);
+}
+const inner_dialog_worker_1 = require("../senses/inner-dialog-worker");
+const cli_logging_1 = require("../nerves/cli-logging");
+(0, cli_logging_1.configureCliRuntimeLogger)("self");
+(0, inner_dialog_worker_1.startInnerDialogWorker)().catch((error) => {
+    // eslint-disable-next-line no-console -- fatal startup guard for worker process
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+});

package/dist/heart/api-error.js

@@ -0,0 +1,34 @@
+"use strict";
+// Shared error handling for Graph and ADO API responses.
+// Maps HTTP status codes to LLM-readable error messages.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleApiError = handleApiError;
+const runtime_1 = require("../nerves/runtime");
+function handleApiError(responseOrError, service, connectionName) {
+    // Network error (no HTTP response)
+    if (!responseOrError || typeof responseOrError !== "object" || !("status" in responseOrError)) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "clients",
+            event: "client.error",
+            message: "network error",
+            meta: { service },
+        });
+        return `NETWORK_ERROR: Could not reach ${service}.`;
+    }
+    const response = responseOrError;
+    const { status, statusText } = response;
+    if (status === 401) {
+        return `AUTH_REQUIRED:${connectionName}`;
+    }
+    if (status === 403) {
+        return `PERMISSION_DENIED: You don't have access to this ${service} resource. Your admin may need to grant additional permissions.`;
+    }
+    if (status === 429) {
+        return `THROTTLED: ${service} is rate-limiting requests. Try again in a moment.`;
+    }
+    if (status >= 500) {
+        return `SERVICE_ERROR: ${service} is temporarily unavailable (${status}).`;
+    }
+    return `ERROR: ${service} returned ${status} ${statusText}.`;
+}

package/dist/heart/config.js

@@ -0,0 +1,296 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadConfig = loadConfig;
+exports.resetConfigCache = resetConfigCache;
+exports.setTestConfig = setTestConfig;
+exports.getAzureConfig = getAzureConfig;
+exports.getMinimaxConfig = getMinimaxConfig;
+exports.getAnthropicConfig = getAnthropicConfig;
+exports.getOpenAICodexConfig = getOpenAICodexConfig;
+exports.getTeamsConfig = getTeamsConfig;
+exports.getContextConfig = getContextConfig;
+exports.getOAuthConfig = getOAuthConfig;
+exports.getTeamsChannelConfig = getTeamsChannelConfig;
+exports.getIntegrationsConfig = getIntegrationsConfig;
+exports.getOpenAIEmbeddingsApiKey = getOpenAIEmbeddingsApiKey;
+exports.getLogsDir = getLogsDir;
+exports.sessionPath = sessionPath;
+exports.logPath = logPath;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const identity_1 = require("./identity");
+const runtime_1 = require("../nerves/runtime");
+const DEFAULT_SECRETS_TEMPLATE = {
+    providers: {
+        // Keep provider field ordering consistent: model first, then auth credentials,
+        // then provider-specific transport fields.
+        azure: {
+            modelName: "",
+            apiKey: "",
+            endpoint: "",
+            deployment: "",
+            apiVersion: "2025-04-01-preview",
+        },
+        minimax: {
+            model: "",
+            apiKey: "",
+        },
+        anthropic: {
+            model: "claude-opus-4-6",
+            setupToken: "",
+        },
+        "openai-codex": {
+            model: "gpt-5.2",
+            oauthAccessToken: "",
+        },
+    },
+    teams: {
+        clientId: "",
+        clientSecret: "",
+        tenantId: "",
+    },
+    oauth: {
+        graphConnectionName: "graph",
+        adoConnectionName: "ado",
+        githubConnectionName: "",
+    },
+    teamsChannel: {
+        skipConfirmation: true,
+        port: 3978,
+    },
+    integrations: {
+        perplexityApiKey: "",
+        openaiEmbeddingsApiKey: "",
+    },
+};
+function defaultRuntimeConfig() {
+    return {
+        providers: {
+            azure: { ...DEFAULT_SECRETS_TEMPLATE.providers.azure },
+            minimax: { ...DEFAULT_SECRETS_TEMPLATE.providers.minimax },
+            anthropic: { ...DEFAULT_SECRETS_TEMPLATE.providers.anthropic },
+            "openai-codex": { ...DEFAULT_SECRETS_TEMPLATE.providers["openai-codex"] },
+        },
+        teams: { ...DEFAULT_SECRETS_TEMPLATE.teams },
+        oauth: { ...DEFAULT_SECRETS_TEMPLATE.oauth },
+        context: { ...identity_1.DEFAULT_AGENT_CONTEXT },
+        teamsChannel: { ...DEFAULT_SECRETS_TEMPLATE.teamsChannel },
+        integrations: { ...DEFAULT_SECRETS_TEMPLATE.integrations },
+    };
+}
+let _cachedConfig = null;
+let _testContextOverride = null;
+function resolveConfigPath() {
+    return (0, identity_1.getAgentSecretsPath)();
+}
+function deepMerge(defaults, partial) {
+    const result = { ...defaults };
+    for (const key of Object.keys(partial)) {
+        if (partial[key] !== null &&
+            typeof partial[key] === "object" &&
+            !Array.isArray(partial[key]) &&
+            typeof defaults[key] === "object" &&
+            defaults[key] !== null) {
+            result[key] = deepMerge(defaults[key], partial[key]);
+        }
+        else {
+            result[key] = partial[key];
+        }
+    }
+    return result;
+}
+function loadConfig() {
+    if (_cachedConfig) {
+        (0, runtime_1.emitNervesEvent)({
+            event: "config.load",
+            component: "config/identity",
+            message: "config loaded from cache",
+            meta: { source: "cache" },
+        });
+        return _cachedConfig;
+    }
+    const configPath = resolveConfigPath();
+    // Auto-create config directory if it doesn't exist
+    const configDir = path.dirname(configPath);
+    fs.mkdirSync(configDir, { recursive: true });
+    let fileData = {};
+    try {
+        const raw = fs.readFileSync(configPath, "utf-8");
+        fileData = JSON.parse(raw);
+    }
+    catch (error) {
+        const errorCode = error &&
+            typeof error === "object" &&
+            "code" in error &&
+            typeof error.code === "string"
+            ? error.code
+            : undefined;
+        if (errorCode === "ENOENT") {
+            try {
+                fs.writeFileSync(configPath, JSON.stringify(DEFAULT_SECRETS_TEMPLATE, null, 2) + "\n", "utf-8");
+            }
+            catch (writeError) {
+                (0, runtime_1.emitNervesEvent)({
+                    level: "warn",
+                    event: "config_identity.error",
+                    component: "config/identity",
+                    message: "failed writing default secrets config",
+                    meta: {
+                        phase: "loadConfig",
+                        path: configPath,
+                        reason: writeError instanceof Error ? writeError.message : String(writeError),
+                    },
+                });
+            }
+        }
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            event: "config_identity.error",
+            component: "config/identity",
+            message: "config read failed; defaults applied",
+            meta: {
+                phase: "loadConfig",
+                reason: error instanceof Error ? error.message : String(error),
+            },
+        });
+        // ENOENT or parse error -- use defaults
+    }
+    const sanitizedFileData = { ...fileData };
+    if ("context" in sanitizedFileData) {
+        delete sanitizedFileData.context;
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            event: "config_identity.error",
+            component: "config/identity",
+            message: "ignored legacy context block in secrets config",
+            meta: {
+                phase: "loadConfig",
+                path: configPath,
+            },
+        });
+    }
+    _cachedConfig = deepMerge(defaultRuntimeConfig(), sanitizedFileData);
+    (0, runtime_1.emitNervesEvent)({
+        event: "config.load",
+        component: "config/identity",
+        message: "config loaded from disk",
+        meta: {
+            source: "disk",
+            used_defaults_only: Object.keys(fileData).length === 0,
+        },
+    });
+    return _cachedConfig;
+}
+function resetConfigCache() {
+    _cachedConfig = null;
+    _testContextOverride = null;
+}
+function setTestConfig(partial) {
+    loadConfig(); // ensure _cachedConfig exists
+    const contextPatch = partial.context;
+    if (contextPatch) {
+        const base = _testContextOverride ?? identity_1.DEFAULT_AGENT_CONTEXT;
+        _testContextOverride = deepMerge(base, contextPatch);
+    }
+    _cachedConfig = deepMerge(_cachedConfig, partial);
+}
+function getAzureConfig() {
+    const config = loadConfig();
+    return { ...config.providers.azure };
+}
+function getMinimaxConfig() {
+    const config = loadConfig();
+    return { ...config.providers.minimax };
+}
+function getAnthropicConfig() {
+    const config = loadConfig();
+    return { ...config.providers.anthropic };
+}
+function getOpenAICodexConfig() {
+    const config = loadConfig();
+    return { ...config.providers["openai-codex"] };
+}
+function getTeamsConfig() {
+    const config = loadConfig();
+    return { ...config.teams };
+}
+function getContextConfig() {
+    if (_testContextOverride) {
+        return { ..._testContextOverride };
+    }
+    const defaults = identity_1.DEFAULT_AGENT_CONTEXT;
+    const agentContext = (0, identity_1.loadAgentConfig)().context;
+    if (!agentContext || typeof agentContext !== "object") {
+        return { ...defaults };
+    }
+    return {
+        maxTokens: typeof agentContext.maxTokens === "number" ? agentContext.maxTokens : defaults.maxTokens,
+        contextMargin: typeof agentContext.contextMargin === "number"
+            ? agentContext.contextMargin
+            : defaults.contextMargin,
+    };
+}
+function getOAuthConfig() {
+    const config = loadConfig();
+    return { ...config.oauth };
+}
+function getTeamsChannelConfig() {
+    const config = loadConfig();
+    const { skipConfirmation, flushIntervalMs, port } = config.teamsChannel;
+    return { skipConfirmation, flushIntervalMs, port };
+}
+function getIntegrationsConfig() {
+    const config = loadConfig();
+    return { ...config.integrations };
+}
+function getOpenAIEmbeddingsApiKey() {
+    return getIntegrationsConfig().openaiEmbeddingsApiKey;
+}
+function getLogsDir() {
+    return path.join(os.homedir(), ".agentstate", (0, identity_1.getAgentName)(), "logs");
+}
+function sanitizeKey(key) {
+    return key.replace(/[/:]/g, "_");
+}
+function sessionPath(friendId, channel, key) {
+    const dir = path.join(os.homedir(), ".agentstate", (0, identity_1.getAgentName)(), "sessions", friendId, channel);
+    fs.mkdirSync(dir, { recursive: true });
+    return path.join(dir, sanitizeKey(key) + ".json");
+}
+function logPath(channel, key) {
+    return path.join(getLogsDir(), channel, sanitizeKey(key) + ".ndjson");
+}