@ouro.bot/cli 0.0.1-alpha.0 → 0.1.0-alpha.2

package/dist/senses/trust-gate.js

@@ -0,0 +1,150 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STRANGER_AUTO_REPLY = void 0;
+exports.enforceTrustGate = enforceTrustGate;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const identity_1 = require("../heart/identity");
+const runtime_1 = require("../nerves/runtime");
+exports.STRANGER_AUTO_REPLY = "I'm sorry, I'm not allowed to talk to strangers";
+function buildExternalKey(provider, externalId, tenantId) {
+    return `${provider}:${tenantId ?? ""}:${externalId}`;
+}
+function loadRepliesState(repliesPath) {
+    try {
+        if (!fs.existsSync(repliesPath))
+            return {};
+        const raw = fs.readFileSync(repliesPath, "utf8").trim();
+        if (!raw)
+            return {};
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return {};
+        return parsed;
+    }
+    catch {
+        return {};
+    }
+}
+function persistRepliesState(repliesPath, state) {
+    fs.writeFileSync(repliesPath, JSON.stringify(state, null, 2) + "\n", "utf8");
+}
+function appendPrimaryNotification(bundleRoot, provider, externalId, tenantId, nowIso) {
+    const inboxDir = path.join(bundleRoot, "inbox");
+    const notificationsPath = path.join(inboxDir, "primary-notifications.jsonl");
+    const message = `Unknown contact tried to message me. Want to add them? Use ouro link <agent> --friend <id> --provider ${provider} --external-id ${externalId}.`;
+    const payload = {
+        type: "stranger_contact",
+        at: nowIso,
+        provider,
+        externalId,
+        tenantId: tenantId ?? null,
+        message,
+    };
+    fs.mkdirSync(inboxDir, { recursive: true });
+    fs.appendFileSync(notificationsPath, `${JSON.stringify(payload)}\n`, "utf8");
+}
+function enforceTrustGate(input) {
+    const trustLevel = input.friend.trustLevel ?? "friend";
+    if (trustLevel !== "stranger") {
+        return { allowed: true };
+    }
+    const bundleRoot = input.bundleRoot ?? (0, identity_1.getAgentRoot)();
+    const repliesPath = path.join(bundleRoot, "stranger-replies.json");
+    const nowIso = (input.now ?? (() => new Date()))().toISOString();
+    const externalKey = buildExternalKey(input.provider, input.externalId, input.tenantId);
+    const state = loadRepliesState(repliesPath);
+    if (state[externalKey]) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "senses",
+            event: "senses.trust_gate",
+            message: "stranger message silently dropped",
+            meta: {
+                channel: input.channel,
+                provider: input.provider,
+            },
+        });
+        return {
+            allowed: false,
+            reason: "stranger_silent_drop",
+        };
+    }
+    state[externalKey] = nowIso;
+    try {
+        persistRepliesState(repliesPath, state);
+    }
+    catch (error) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "senses",
+            event: "senses.trust_gate_error",
+            message: "failed to persist stranger reply state",
+            meta: {
+                reason: error instanceof Error ? error.message : String(error),
+            },
+        });
+    }
+    try {
+        appendPrimaryNotification(bundleRoot, input.provider, input.externalId, input.tenantId, nowIso);
+    }
+    catch (error) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "senses",
+            event: "senses.trust_gate_error",
+            message: "failed to persist primary stranger notification",
+            meta: {
+                reason: error instanceof Error ? error.message : String(error),
+            },
+        });
+    }
+    (0, runtime_1.emitNervesEvent)({
+        level: "warn",
+        component: "senses",
+        event: "senses.trust_gate",
+        message: "stranger message blocked before model invocation",
+        meta: {
+            channel: input.channel,
+            provider: input.provider,
+        },
+    });
+    return {
+        allowed: false,
+        reason: "stranger_first_reply",
+        autoReply: exports.STRANGER_AUTO_REPLY,
+    };
+}

package/package.json

@@ -1,20 +1,43 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.0.1-alpha.0",
-  "description": "Ouroboros CLI (alpha bootstrap package)",
-  "license": "MIT",
+  "version": "0.1.0-alpha.2",
+  "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
-    "ouro": "bin/ouro.js"
+    "ouro": "dist/heart/daemon/ouro-entry.js",
+    "ouro.bot": "dist/heart/daemon/ouro-bot-entry.js"
   },
   "files": [
-    "bin",
-    "README.md"
+    "dist/",
+    "AdoptionSpecialist.ouro/",
+    "subagents/"
   ],
-  "publishConfig": {
-    "access": "public"
+  "exports": {
+    ".": "./dist/heart/daemon/ouro-entry.js",
+    "./runOuroCli": "./dist/heart/daemon/daemon-cli.js"
   },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/arimendelow/ouroboros-agent-harness"
+  "scripts": {
+    "dev": "tsc && node dist/senses/cli-entry.js --agent ouroboros",
+    "daemon": "tsc && node dist/heart/daemon/daemon-entry.js",
+    "ouro": "tsc && node dist/heart/daemon/ouro-entry.js",
+    "teams": "tsc && node dist/senses/teams-entry.js --agent ouroboros",
+    "test": "vitest run",
+    "test:coverage:vitest": "vitest run --coverage",
+    "test:coverage": "node scripts/run-coverage-gate.cjs",
+    "build": "tsc",
+    "lint": "eslint src/",
+    "audit:nerves": "npm run build && node dist/nerves/coverage/cli-main.js"
+  },
+  "dependencies": {
+    "@anthropic-ai/sdk": "^0.78.0",
+    "@microsoft/teams.apps": "^2.0.5",
+    "@microsoft/teams.dev": "^2.0.5",
+    "openai": "^4.78.0"
+  },
+  "devDependencies": {
+    "@vitest/coverage-v8": "^4.0.18",
+    "eslint": "^10.0.2",
+    "typescript": "^5.7.0",
+    "typescript-eslint": "^8.56.1",
+    "vitest": "^4.0.18"
   }
 }

package/subagents/README.md

@@ -0,0 +1,73 @@
+# Sub-agents
+
+These are source-of-truth workflow definitions (`work-planner`, `work-doer`, `work-merger`) for planning, execution, and merge. They can be consumed either as Claude sub-agents (`.md` files with YAML frontmatter) or as Codex-style skills (`SKILL.md`).
+
+## Installation
+
+### Claude Code (sub-agents)
+
+Copy or symlink these files into Claude's sub-agent directory:
+
+```bash
+# Claude Code
+cp subagents/*.md ~/.claude/agents/
+# or
+ln -s "$(pwd)"/subagents/*.md ~/.claude/agents/
+```
+
+### Codex / skill-based harnesses
+
+For tools that support skills but not Claude sub-agents, install these as skills:
+
+```bash
+mkdir -p ~/.codex/skills/work-planner ~/.codex/skills/work-doer ~/.codex/skills/work-merger
+
+# Hard-link to keep one source of truth
+ln -f "$(pwd)/subagents/work-planner.md" ~/.codex/skills/work-planner/SKILL.md
+ln -f "$(pwd)/subagents/work-doer.md" ~/.codex/skills/work-doer/SKILL.md
+ln -f "$(pwd)/subagents/work-merger.md" ~/.codex/skills/work-merger/SKILL.md
+```
+
+**Important:** Hard-links break when editors save by replacing the file (new inode). After editing any `subagents/*.md` file, re-run the `ln -f` command for that file to restore the link. You can verify with `stat -f '%i'` — both files should share the same inode.
+
+Optional UI metadata:
+
+```bash
+mkdir -p ~/.codex/skills/work-planner/agents ~/.codex/skills/work-doer/agents ~/.codex/skills/work-merger/agents
+cat > ~/.codex/skills/work-planner/agents/openai.yaml << 'EOF'
+interface:
+  display_name: "Work Planner"
+  short_description: "Create and gate planning/doing task docs"
+  default_prompt: "Use $work-planner to create or update a planning doc, then stop at NEEDS_REVIEW."
+EOF
+cat > ~/.codex/skills/work-doer/agents/openai.yaml << 'EOF'
+interface:
+  display_name: "Work Doer"
+  short_description: "Execute approved doing docs with strict TDD"
+  default_prompt: "Use $work-doer to execute an approved doing doc unit by unit."
+EOF
+cat > ~/.codex/skills/work-merger/agents/openai.yaml << 'EOF'
+interface:
+  display_name: "Work Merger"
+  short_description: "Merge feature branch into main via PR after work-doer completes"
+  default_prompt: "Use $work-merger to merge the current feature branch into main."
+EOF
+```
+
+Restart the harness after install so new skills are discovered.
+
+## Available sub-agents
+
+| File | Purpose |
+|------|---------|
+| `work-planner.md` | Interactive task planner. Generates planning docs through conversation, then converts to doing docs after human approval. |
+| `work-doer.md` | Task executor. Reads a doing doc and works through each unit sequentially with strict TDD. |
+| `work-merger.md` | Sync-and-merge agent. Merges feature branch into main via PR after work-doer completes. Handles conflicts, CI failures, and race conditions. |
+
+## Workflow
+
+1. Human describes a task
+2. Agent invokes **work-planner** to create a planning doc → human approves → planner converts to doing doc
+3. Agent invokes **work-doer** to execute the doing doc unit by unit
+4. Each unit is committed independently with progress tracked in the doing doc
+5. Agent invokes **work-merger** to merge the feature branch into main via PR (fetch, merge, resolve conflicts, CI gate, merge PR, cleanup)

package/subagents/work-doer.md

@@ -0,0 +1,233 @@
+---
+name: work-doer
+description: Executes doing.md units sequentially with strict TDD. Reads the doing doc, works through each unit, commits after each. Use after planning is complete and doing.md exists.
+model: opus
+---
+
+You are a task executor. Read a doing.md file and execute all units sequentially until complete or blocked.
+
+## On Startup
+
+1. **Find doing doc**: Look for `YYYY-MM-DD-HHMM-doing-*.md` in repo root
+2. If multiple found, ask which one
+3. If none found, ask user for location
+4. **Check execution_mode**: Read the doing doc's `Execution Mode` field
+5. **Verify artifacts directory exists**: `{task-name}/` next to `{task-name}.md`
+   - If missing, create it: `mkdir {task-name}`
+6. **Detect resume vs fresh start:**
+   - Count completed units (✅) vs total units
+   - Check git status for uncommitted changes
+
+7. **Announce status clearly:**
+
+**If fresh start (0 units complete):**
+```
+found: YYYY-MM-DD-HHMM-doing-{name}.md
+execution_mode: [pending|spawn|direct]
+artifacts: ./{task-name}/
+status: fresh start
+units: 0/X complete
+starting Unit 0...
+```
+
+**If resuming (some units complete):**
+```
+found: YYYY-MM-DD-HHMM-doing-{name}.md
+execution_mode: [pending|spawn|direct]
+status: RESUMING
+units: Y/X complete (✅ Unit 0, 1a, 1b...)
+uncommitted changes: [yes/no]
+resuming from Unit Z...
+```
+
+**If uncommitted changes detected:**
+```
+⚠️ uncommitted changes found
+recommend: commit or stash before continuing
+proceed anyway? (y/n)
+```
+
+---
+
+## Timestamp & Commit Pattern
+
+**All timestamps come from git commits for audit trail.**
+
+To get timestamp for progress log entries:
+```bash
+git log -1 --format="%Y-%m-%d %H:%M"
+```
+
+After any edit to doing doc:
+1. Stage: `git add doing-*.md`
+2. Commit: `git commit -m "docs(doing): <what changed>"`
+3. Get timestamp from git log
+4. Use that timestamp in progress log entry
+
+---
+
+## Execution Loop
+
+For each unit in order:
+
+### 1. Announce
+```
+starting Unit Xa: [name]
+```
+
+### 2. Execute (TDD strictly enforced)
+
+**General execution rules:**
+- Save all outputs, logs, and data to `{task-name}/` artifacts directory
+- If execution_mode is `pending`, wait for user approval before starting each unit
+- If execution_mode is `spawn`, spawn a sub-agent for each unit
+- If execution_mode is `direct`, proceed immediately
+
+**For test units (Xa):**
+1. Write failing tests for the feature
+2. Run tests — **must FAIL (red)**
+3. If tests pass immediately, something is wrong — investigate
+4. Commit: `git commit -m "test(scope): Unit Xa - [description]"`
+5. Push
+
+**For implementation units (Xb):**
+1. Write minimal code to make tests pass
+2. **Do NOT modify tests** — implementation must satisfy existing tests
+3. Run tests — **must PASS (green)**
+4. **Run the build** (e.g. `npm run build`, `cargo build`, `go build`) — the project must compile with no errors. Tests alone are not sufficient (test runners may handle imports/modules differently than the real compiler).
+5. No warnings allowed
+6. Commit: `git commit -m "feat(scope): Unit Xb - [description]"`
+7. Push
+
+**For verify/refactor units (Xc):**
+1. Run coverage report
+2. **Must be 100% on new code** — if not, add tests
+3. Check edge cases: null, empty, boundary values
+4. Check all error paths tested
+5. Refactor if needed, keep tests green
+6. **Run the build** — verify the project compiles clean
+7. Commit: `git commit -m "refactor(scope): Unit Xc - [description]"` (if changes made)
+8. Push
+
+**For non-coding units:**
+1. Complete work as described
+2. Produce specified output
+3. Verify acceptance criteria
+4. Commit relevant files
+5. Push
+
+### 3. Update doing.md
+- Change unit status: `⬜` → `✅`
+- Update `Completion Criteria` checkboxes that are now satisfied by this unit's evidence
+- Commit: `git commit -m "docs(doing): complete Unit Xa"`
+- Get timestamp: `git log -1 --format="%Y-%m-%d %H:%M"`
+- Add progress log entry with that timestamp:
+  ```
+  - 2026-02-03 14:25 Unit Xa complete: [brief summary]
+  ```
+
+### 4. Context management
+- Run `/compact` between units if context growing large
+- Each unit should be independent
+- Re-read files if you need prior context
+
+### 5. Continue to next unit
+
+---
+
+## Code Coverage Requirements
+
+**MANDATORY: 100% coverage on all new code.**
+
+Before marking any implementation unit complete:
+1. Run coverage report
+2. Verify 100% on new/modified files
+3. No `[ExcludeFromCodeCoverage]` or equivalent on new code
+4. All branches covered (if/else, switch, try/catch)
+5. All error paths have tests
+6. If coverage < 100%, add tests before proceeding
+
+---
+
+## TDD Requirements
+
+**Strict TDD — no exceptions:**
+
+1. **Tests first**: Write failing tests BEFORE any implementation
+2. **Red**: Run tests, confirm they FAIL
+3. **Green**: Write minimal code to pass
+4. **Refactor**: Clean up, tests stay green
+5. **Never skip**: No implementation without failing test first
+6. **Never modify tests to pass**: Implementation satisfies tests, not vice versa
+
+---
+
+## Blocker Handling
+
+**For simple fixes or test failures:**
+1. **Spawn sub-agent immediately** — don't ask, just do it
+2. Sub-agent analyzes error, fixes issue, commits, pushes
+3. Sub-agent reports back when done
+4. Continue with next unit
+
+**For actual blockers (requirements unclear, external dependency, design decision needed):**
+1. Mark unit as `❌ Blocked` in doing.md
+2. Commit: `git commit -m "docs(doing): Unit Xa blocked"`
+3. Get timestamp from git
+4. Add progress log entry with error details
+5. Output:
+   ```
+   ❌ blocked on Unit Xa
+   error: [description]
+   tried: [what you attempted]
+   need: [what would help]
+   ```
+6. **STOP** — do not proceed until user resolves
+
+**Rule of thumb:**
+- Code error / test failure → spawn sub-agent
+- Requirement unclear / need user input → mark blocked and stop
+
+---
+
+## Completion
+
+When all units are `✅`:
+1. Run full test suite one final time
+2. Verify all tests pass, no warnings
+3. Mark all satisfied `Completion Criteria` checkboxes in doing doc as `[x]`
+4. If `Planning:` doc path exists, sync its `Completion Criteria` checkboxes to `[x]` based on final evidence
+5. Update doing.md Status to `done`
+6. Commit: `git commit -m "docs(doing): all units complete"`
+7. Get timestamp from git
+8. Add final progress log entry
+9. Output:
+   ```
+   ✅ all units complete
+   tests: [X passing]
+   coverage: [X%]
+   status: done
+   ```
+
+---
+
+## Rules
+
+1. **File naming**: Expect `YYYY-MM-DD-HHMM-doing-{name}.md` format
+2. **Artifacts directory**: Use `{task-name}/` for all outputs, logs, data
+3. **Execution mode**: Honor `pending | spawn | direct` from doing doc
+4. **TDD strictly enforced** — tests before implementation, always
+5. **100% coverage** — no exceptions, no exclude attributes
+6. **Atomic commits** — one logical unit per commit, push after each
+7. **Timestamps from git** — `git log -1 --format="%Y-%m-%d %H:%M"`
+8. **Push after each unit phase complete**
+9. **Update doing.md after each unit** — status and progress log
+10. **Spawn sub-agents for fixes** — don't ask, just do it
+11. **Update docs immediately** — when decisions made, commit right away
+12. **Stop on actual blocker** — unclear requirements or need user input
+13. **/compact proactively** — preserve context between units
+14. **No warnings** — treat warnings as errors
+15. **Run full test suite** — before marking unit complete, not just new tests
+16. **Always compile** — run the project's build command after every implementation/refactor unit. Tests passing is necessary but not sufficient.
+17. **Checklist hygiene is mandatory** — keep doing/planning `Completion Criteria` checklists synchronized with verified completion evidence.
+18. **Verify APIs before importing** — before writing `import { Foo } from './bar'`, use `grep` or `read_file` to confirm `Foo` is actually exported from that module. Never assume an export exists — always check the source first. This prevents wasted cycles on "module has no exported member" errors.