@ouro.bot/cli 0.1.0-alpha.157 → 0.1.0-alpha.159

package/AdoptionSpecialist.ouro/agent.json

@@ -1,7 +1,8 @@
 {
-  "version": 1,
+  "version": 2,
   "enabled": false,
-  "provider": "anthropic",
+  "humanFacing": { "provider": "anthropic", "model": "claude-opus-4-6" },
+  "agentFacing": { "provider": "anthropic", "model": "claude-opus-4-6" },
   "context": {
     "maxTokens": 80000,
     "contextMargin": 20

package/AdoptionSpecialist.ouro/psyche/SOUL.md

@@ -16,7 +16,7 @@ I help humans hatch new agent partners. I am one of thirteen serpent guides —
 1. Confirm provider setup and usable credentials.
 2. Interview for goals, style, and operating context.
 3. Synthesize a concrete hatchling identity and bootstrap files.
-4. Create canonical bundle structure with required defaults.
+4. Create canonical bundle structure with required defaults, configuring both `humanFacing` and `agentFacing` provider+model settings.
 5. Introduce the hatchling and hand off clearly.
 
 ## Filesystem orientation

package/README.md

@@ -90,7 +90,7 @@ Task docs do not live in this repo anymore. Planning and doing docs live in the
 
 ## Runtime Truths
 
-- `agent.json` is the source of truth for provider selection, phrase pools, context settings, and enabled senses.
+- `agent.json` is the source of truth for provider+model selection per facing (`humanFacing` and `agentFacing`), phrase pools, context settings, and enabled senses.
 - `configPath` must point to `~/.agentsecrets/<agent>/secrets.json`.
 - The daemon discovers bundles dynamically from `~/AgentBundles`.
 - `ouro status` reports version, last-updated time, discovered agents, senses, and workers.
@@ -109,11 +109,12 @@ When a model provider needs first-time setup, reauth, or an explicit switch, use
 ```bash
 ouro auth --agent <name>
 ouro auth --agent <name> --provider <provider>
+ouro auth --agent <name> --facing agent --provider <provider>
 ```
 
-The default form reauths the provider already selected in `agent.json`. The explicit
-`--provider` form is for adding or switching providers, and it updates `agent.json`
-to use the newly authenticated provider.
+The default form reauths the human-facing provider already selected in `agent.json`. The
+`--provider` form is for adding or switching providers. The `--facing` flag (values: `human`
+or `agent`) controls which facing gets updated; it defaults to `human` when omitted.
 
 ## Quickstart
 

package/changelog.json

@@ -1,6 +1,30 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.159",
+      "changes": [
+        "Human-facing and agent-facing provider configs: agent.json now has humanFacing and agentFacing blocks, each with provider and model. CLI/Teams/BlueBubbles use humanFacing, inner dialog uses agentFacing.",
+        "Model moved from secrets.json to agent.json. Secrets now store credentials only (API keys, tokens, endpoints).",
+        "Automatic v1 to v2 migration: existing bundles upgraded via UpdateHook at daemon startup and inline in loadAgentConfig/readAgentConfigForAgent.",
+        "CLI commands support --facing human|agent flag for config model and auth switch.",
+        "Provider factories accept model as parameter instead of reading from secrets config."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.158",
+      "changes": [
+        "Task scanner v2: explicit identity via kind: task field. Scanner only parses files that declare themselves as task cards — doing docs, planning docs, and artifacts silently skipped. Eliminates 184 false parse errors on real bundles.",
+        "Typed issue model: every scanner issue has a code, description, proposed fix, confidence (safe/needs_review), and category (live/migration). Replaces flat parseErrors/invalidFilenames arrays.",
+        "Board health line: compact board shows health: clean or health: 1 live, 10 migration. Live vs migration split prevents cleanup noise from looking like breakage.",
+        "Fix command: ouro task fix (dry-run), ouro task fix --safe (apply deterministic fixes), ouro task fix <id> (inspect/apply individual issues). Currently auto-fixes schema-missing-kind.",
+        "Cancelled status: new terminal state reachable from any active status. Auto-archives with work directory, hidden from active board view.",
+        "Derived child_tasks: computed at scan time from parent_task links. child_tasks removed from authored schema — no more hand-maintained stale arrays.",
+        "Work directory awareness: same-stem directories detected and listed on TaskFile (hasWorkDir, workDirFiles). Scanner never descends into them.",
+        "Collection root clutter detection: non-task support docs at collection root summarized as one aggregated migration issue per collection.",
+        "Root-only scanning: flat directory reads replace recursive walks. Faster and correct."
+      ]
+    },
     {
       "version": "0.1.0-alpha.157",
       "changes": [

package/dist/heart/config.js

@@ -63,10 +63,7 @@ const identity_1 = require("./identity");
 const runtime_1 = require("../nerves/runtime");
 const DEFAULT_SECRETS_TEMPLATE = {
     providers: {
-        // Keep provider field ordering consistent: model first, then auth credentials,
-        // then provider-specific transport fields.
         azure: {
-            modelName: "",
             apiKey: "",
             endpoint: "",
             deployment: "",
@@ -74,19 +71,15 @@ const DEFAULT_SECRETS_TEMPLATE = {
             managedIdentityClientId: "",
         },
         minimax: {
-            model: "",
             apiKey: "",
         },
         anthropic: {
-            model: "claude-opus-4-6",
             setupToken: "",
         },
         "openai-codex": {
-            model: "gpt-5.4",
             oauthAccessToken: "",
         },
         "github-copilot": {
-            model: "claude-sonnet-4.6",
             githubToken: "",
             baseUrl: "",
         },

package/dist/heart/core.js

@@ -33,30 +33,36 @@ const identity_2 = require("./identity");
 const socket_client_1 = require("./daemon/socket-client");
 const obligations_1 = require("./obligations");
 const tool_loop_1 = require("./tool-loop");
-let _providerRuntime = null;
-function getProviderRuntimeFingerprint() {
-    const provider = (0, identity_1.loadAgentConfig)().provider;
+const _providerRuntimes = {
+    human: null,
+    agent: null,
+};
+function getProviderRuntimeFingerprint(facing) {
+    const config = (0, identity_1.loadAgentConfig)();
+    const facingConfig = facing === "human" ? config.humanFacing : config.agentFacing;
+    const provider = facingConfig.provider;
+    const model = facingConfig.model;
     /* v8 ignore next -- switch: not all provider branches exercised in CI @preserve */
     switch (provider) {
         case "azure": {
-            const { apiKey, endpoint, deployment, modelName, apiVersion, managedIdentityClientId } = (0, config_1.getAzureConfig)();
-            return JSON.stringify({ provider, apiKey, endpoint, deployment, modelName, apiVersion, managedIdentityClientId });
+            const { apiKey, endpoint, deployment, apiVersion, managedIdentityClientId } = (0, config_1.getAzureConfig)();
+            return JSON.stringify({ provider, model, apiKey, endpoint, deployment, apiVersion, managedIdentityClientId });
         }
         case "anthropic": {
-            const { model, setupToken } = (0, config_1.getAnthropicConfig)();
+            const { setupToken } = (0, config_1.getAnthropicConfig)();
             return JSON.stringify({ provider, model, setupToken });
         }
         case "minimax": {
-            const { apiKey, model } = (0, config_1.getMinimaxConfig)();
-            return JSON.stringify({ provider, apiKey, model });
+            const { apiKey } = (0, config_1.getMinimaxConfig)();
+            return JSON.stringify({ provider, model, apiKey });
         }
         case "openai-codex": {
-            const { model, oauthAccessToken } = (0, config_1.getOpenAICodexConfig)();
+            const { oauthAccessToken } = (0, config_1.getOpenAICodexConfig)();
             return JSON.stringify({ provider, model, oauthAccessToken });
         }
         /* v8 ignore start -- fingerprint: tested via provider init tests @preserve */
         case "github-copilot": {
-            const { model, githubToken, baseUrl } = (0, config_1.getGithubCopilotConfig)();
+            const { githubToken, baseUrl } = (0, config_1.getGithubCopilotConfig)();
             return JSON.stringify({ provider, model, githubToken, baseUrl });
         }
         /* v8 ignore stop */
@@ -71,18 +77,22 @@ function createProviderRegistry() {
         "github-copilot": github_copilot_1.createGithubCopilotProviderRuntime,
     };
     return {
-        resolve() {
-            const provider = (0, identity_1.loadAgentConfig)().provider;
-            return factories[provider]();
+        resolve(provider, model) {
+            const resolvedProvider = provider ?? (0, identity_1.loadAgentConfig)().humanFacing.provider;
+            const resolvedModel = model ?? (0, identity_1.loadAgentConfig)().humanFacing.model;
+            return factories[resolvedProvider](resolvedModel);
         },
     };
 }
-function getProviderRuntime() {
+function getProviderRuntime(facing = "human") {
     try {
-        const fingerprint = getProviderRuntimeFingerprint();
-        if (!_providerRuntime || _providerRuntime.fingerprint !== fingerprint) {
-            const runtime = createProviderRegistry().resolve();
-            _providerRuntime = runtime ? { fingerprint, runtime } : null;
+        const fingerprint = getProviderRuntimeFingerprint(facing);
+        const cached = _providerRuntimes[facing];
+        if (!cached || cached.fingerprint !== fingerprint) {
+            const config = (0, identity_1.loadAgentConfig)();
+            const facingConfig = facing === "human" ? config.humanFacing : config.agentFacing;
+            const runtime = createProviderRegistry().resolve(facingConfig.provider, facingConfig.model);
+            _providerRuntimes[facing] = runtime ? { fingerprint, runtime } : null;
         }
     }
     catch (error) {
@@ -99,7 +109,7 @@ function getProviderRuntime() {
         process.exit(1);
         throw new Error("unreachable");
     }
-    if (!_providerRuntime) {
+    if (!_providerRuntimes[facing]) {
         (0, runtime_1.emitNervesEvent)({
             level: "error",
             event: "engine.provider_init_error",
@@ -110,7 +120,7 @@ function getProviderRuntime() {
         process.exit(1);
         throw new Error("unreachable");
     }
-    return _providerRuntime.runtime;
+    return _providerRuntimes[facing].runtime;
 }
 /**
  * Clear the cached provider runtime so the next access re-creates it from
@@ -118,17 +128,18 @@ function getProviderRuntime() {
  * provider fingerprint changes on disk.
  */
 function resetProviderRuntime() {
-    _providerRuntime = null;
+    _providerRuntimes.human = null;
+    _providerRuntimes.agent = null;
 }
-function getModel() {
-    return getProviderRuntime().model;
+function getModel(facing = "human") {
+    return getProviderRuntime(facing).model;
 }
-function getProvider() {
-    return getProviderRuntime().id;
+function getProvider(facing = "human") {
+    return getProviderRuntime(facing).id;
 }
-function createSummarize() {
+function createSummarize(facing = "human") {
     return async (transcript, instruction) => {
-        const runtime = getProviderRuntime();
+        const runtime = getProviderRuntime(facing);
         const client = runtime.client;
         const response = await client.chat.completions.create({
             model: runtime.model,
@@ -141,18 +152,21 @@ function createSummarize() {
         return response.choices?.[0]?.message?.content ?? transcript;
     };
 }
-function getProviderDisplayLabel() {
-    const provider = (0, identity_1.loadAgentConfig)().provider;
+function getProviderDisplayLabel(facing = "human") {
+    const config = (0, identity_1.loadAgentConfig)();
+    const facingConfig = facing === "human" ? config.humanFacing : config.agentFacing;
+    const provider = facingConfig.provider;
+    const model = facingConfig.model || "unknown";
     const providerLabelBuilders = {
         azure: () => {
-            const config = (0, config_1.getAzureConfig)();
-            return `azure openai (${config.deployment || "default"}, model: ${config.modelName || "unknown"})`;
+            const azureCfg = (0, config_1.getAzureConfig)();
+            return `azure openai (${azureCfg.deployment || "default"}, model: ${model})`;
         },
-        anthropic: () => `anthropic (${(0, config_1.getAnthropicConfig)().model || "unknown"})`,
-        minimax: () => `minimax (${(0, config_1.getMinimaxConfig)().model || "unknown"})`,
-        "openai-codex": () => `openai codex (${(0, config_1.getOpenAICodexConfig)().model || "unknown"})`,
+        anthropic: () => `anthropic (${model})`,
+        minimax: () => `minimax (${model})`,
+        "openai-codex": () => `openai codex (${model})`,
         /* v8 ignore next -- branch: tested via display label unit test @preserve */
-        "github-copilot": () => `github copilot (${(0, config_1.getGithubCopilotConfig)().model || "unknown"})`,
+        "github-copilot": () => `github copilot (${model})`,
     };
     return providerLabelBuilders[provider]();
 }
@@ -431,7 +445,8 @@ const TRANSIENT_RETRY_LABELS = {
     "unknown": "error",
 };
 async function runAgent(messages, callbacks, channel, signal, options) {
-    const providerRuntime = getProviderRuntime();
+    const facing = (0, channel_1.channelToFacing)(channel);
+    const providerRuntime = getProviderRuntime(facing);
     const provider = providerRuntime.id;
     const toolChoiceRequired = options?.toolChoiceRequired ?? true;
     const traceId = options?.traceId;

package/dist/heart/daemon/auth-flow.js

@@ -47,6 +47,7 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const runtime_1 = require("../../nerves/runtime");
 const identity_1 = require("../identity");
+const migrate_config_1 = require("../migrate-config");
 const ANTHROPIC_SETUP_TOKEN_PREFIX = "sk-ant-oat01-";
 const ANTHROPIC_SETUP_TOKEN_MIN_LENGTH = 80;
 const DEFAULT_SECRETS_TEMPLATE = {
@@ -129,9 +130,22 @@ function readJsonRecord(filePath, label) {
     }
 }
 function readAgentConfigForAgent(agentName, bundlesRoot = (0, identity_1.getAgentBundlesRoot)()) {
-    const configPath = path.join(bundlesRoot, `${agentName}.ouro`, "agent.json");
-    const parsed = readJsonRecord(configPath, "agent config");
-    const provider = parsed.provider;
+    const agentRoot = path.join(bundlesRoot, `${agentName}.ouro`);
+    const configPath = path.join(agentRoot, "agent.json");
+    let parsed = readJsonRecord(configPath, "agent config");
+    // Inline migration: v1 -> v2
+    const version = typeof parsed.version === "number" ? parsed.version : 1;
+    if (version < 2) {
+        (0, migrate_config_1.migrateAgentConfigV1ToV2)(agentRoot);
+        parsed = readJsonRecord(configPath, "agent config");
+    }
+    // Validate v2 required facing fields
+    const humanFacing = parsed.humanFacing;
+    const agentFacing = parsed.agentFacing;
+    if (!humanFacing || typeof humanFacing !== "object") {
+        throw new Error(`agent.json at ${configPath} has unsupported provider '${String(parsed.provider)}'`);
+    }
+    const provider = humanFacing.provider;
     if (provider !== "azure" &&
         provider !== "anthropic" &&
         provider !== "minimax" &&
@@ -139,20 +153,27 @@ function readAgentConfigForAgent(agentName, bundlesRoot = (0, identity_1.getAgen
         provider !== "github-copilot") {
         throw new Error(`agent.json at ${configPath} has unsupported provider '${String(provider)}'`);
     }
+    if (!agentFacing || typeof agentFacing !== "object") {
+        throw new Error(`agent.json at ${configPath} has unsupported provider '${String(parsed.provider)}'`);
+    }
     return {
         configPath,
         config: parsed,
     };
 }
-function writeAgentProviderSelection(agentName, provider, bundlesRoot = (0, identity_1.getAgentBundlesRoot)()) {
+function writeAgentProviderSelection(agentName, facing, provider, bundlesRoot = (0, identity_1.getAgentBundlesRoot)()) {
     const { configPath, config } = readAgentConfigForAgent(agentName, bundlesRoot);
-    const nextConfig = { ...config, provider };
+    const facingKey = facing === "human" ? "humanFacing" : "agentFacing";
+    const nextConfig = {
+        ...config,
+        [facingKey]: { ...config[facingKey], provider },
+    };
     fs.writeFileSync(configPath, `${JSON.stringify(nextConfig, null, 2)}\n`, "utf8");
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
         event: "daemon.auth_provider_selected",
         message: "updated agent provider selection after auth flow",
-        meta: { agentName, provider, configPath },
+        meta: { agentName, facing, provider, configPath },
     });
     return configPath;
 }
@@ -189,25 +210,24 @@ function writeProviderCredentials(agentName, provider, credentials, deps = {}) {
     writeSecrets(secretsPath, secrets);
     return { secretsPath, secrets };
 }
-const MODEL_FIELD = {
-    azure: "modelName",
-    minimax: "model",
-    anthropic: "model",
-    "openai-codex": "model",
-    "github-copilot": "model",
-};
-function writeAgentModel(agentName, modelName, deps = {}) {
-    const { config } = readAgentConfigForAgent(agentName, deps.bundlesRoot);
-    const provider = config.provider;
-    const { secretsPath, secrets } = loadAgentSecrets(agentName, deps);
-    const providerSecrets = secrets.providers[provider];
-    /* v8 ignore next -- fallback: all known providers are in MODEL_FIELD @preserve */
-    const fieldName = MODEL_FIELD[provider] ?? "model";
-    /* v8 ignore next -- defensive: fieldName always exists in template @preserve */
-    const previousModel = providerSecrets[fieldName] ?? "";
-    providerSecrets[fieldName] = modelName;
-    writeSecrets(secretsPath, secrets);
-    return { secretsPath, provider, previousModel };
+function writeAgentModel(agentName, facing, modelName, deps = {}) {
+    const { configPath, config } = readAgentConfigForAgent(agentName, deps.bundlesRoot);
+    const facingKey = facing === "human" ? "humanFacing" : "agentFacing";
+    const facingBlock = config[facingKey];
+    const previousModel = facingBlock.model;
+    const provider = facingBlock.provider;
+    const nextConfig = {
+        ...config,
+        [facingKey]: { ...facingBlock, model: modelName },
+    };
+    fs.writeFileSync(configPath, `${JSON.stringify(nextConfig, null, 2)}\n`, "utf8");
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.config_model_updated",
+        message: "updated agent model in agent.json",
+        meta: { agentName, facing, provider, modelName, previousModel, configPath },
+    });
+    return { configPath, provider, previousModel };
 }
 function readCodexAccessToken(homeDir) {
     const authPath = path.join(homeDir, ".codex", "auth.json");

package/dist/heart/daemon/daemon-cli.js

@@ -65,6 +65,7 @@ const daemon_runtime_sync_1 = require("./daemon-runtime-sync");
 const agent_discovery_1 = require("./agent-discovery");
 const update_hooks_1 = require("./update-hooks");
 const bundle_meta_1 = require("./hooks/bundle-meta");
+const agent_config_v2_1 = require("./hooks/agent-config-v2");
 const bundle_manifest_1 = require("../../mind/bundle-manifest");
 const tasks_1 = require("../../repertoire/tasks");
 const thoughts_1 = require("./thoughts");
@@ -305,6 +306,7 @@ function usage() {
         "  ouro task create <title> [--type <type>] [--agent <name>]",
         "  ouro task update <id> <status> [--agent <name>]",
         "  ouro task show <id> [--agent <name>]",
+        "  ouro task fix [--safe|--all] [<id> [--option <N>]] [--agent <name>]",
         "  ouro task actionable|deps|sessions [--agent <name>]",
         "  ouro reminder create <title> --body <body> [--at <iso>] [--cadence <interval>] [--category <category>] [--agent <name>]",
         "  ouro friend list [--agent <name>]",
@@ -737,14 +739,51 @@ function parseTaskCommand(args) {
         return { kind: "task.deps", ...(agent ? { agent } : {}) };
     if (sub === "sessions")
         return { kind: "task.sessions", ...(agent ? { agent } : {}) };
+    if (sub === "fix") {
+        // fix --safe | fix --all | fix <id> [--option N] | fix (dry-run)
+        if (rest.length === 0)
+            return { kind: "task.fix", mode: "dry-run", ...(agent ? { agent } : {}) };
+        const first = rest[0];
+        if (first === "--safe" || first === "--all") {
+            return { kind: "task.fix", mode: "safe", ...(agent ? { agent } : {}) };
+        }
+        // first arg is an issue ID (contains a colon, e.g. schema-missing-kind:one-shots/foo.md)
+        const issueId = first;
+        let option;
+        for (let i = 1; i < rest.length; i++) {
+            if (rest[i] === "--option" && rest[i + 1]) {
+                option = parseInt(rest[i + 1], 10);
+                i += 1;
+            }
+        }
+        return {
+            kind: "task.fix",
+            mode: "single",
+            issueId,
+            ...(option !== undefined ? { option } : {}),
+            ...(agent ? { agent } : {}),
+        };
+    }
     throw new Error(`Usage\n${usage()}`);
 }
+function extractFacingFlag(args) {
+    const idx = args.indexOf("--facing");
+    if (idx === -1 || idx + 1 >= args.length)
+        return { rest: args };
+    const value = args[idx + 1];
+    if (value !== "human" && value !== "agent") {
+        throw new Error(`--facing must be 'human' or 'agent'`);
+    }
+    const rest = [...args.slice(0, idx), ...args.slice(idx + 2)];
+    return { facing: value, rest };
+}
 function parseAuthCommand(args) {
     const first = args[0];
     // Support both positional (`auth switch`) and flag (`auth --switch`) forms
     if (first === "verify" || first === "switch" || first === "--verify" || first === "--switch") {
         const subcommand = first.replace(/^--/, "");
-        const { agent, rest } = extractAgentFlag(args.slice(1));
+        const { agent, rest: afterAgent } = extractAgentFlag(args.slice(1));
+        const { facing, rest } = extractFacingFlag(afterAgent);
         let provider;
         /* v8 ignore start -- provider flag parsing: branches tested via CLI parsing tests @preserve */
         for (let i = 0; i < rest.length; i += 1) {
@@ -764,7 +803,7 @@ function parseAuthCommand(args) {
         if (subcommand === "switch") {
             if (!provider)
                 throw new Error(`auth switch requires --provider.\n${usage()}`);
-            return { kind: "auth.switch", agent, provider };
+            return facing ? { kind: "auth.switch", agent, provider, facing } : { kind: "auth.switch", agent, provider };
         }
         return provider ? { kind: "auth.verify", agent, provider } : { kind: "auth.verify", agent };
     }
@@ -946,7 +985,8 @@ function parseFriendCommand(args) {
     throw new Error(`Usage\n${usage()}`);
 }
 function parseConfigCommand(args) {
-    const { agent, rest: cleaned } = extractAgentFlag(args);
+    const { agent, rest: afterAgent } = extractAgentFlag(args);
+    const { facing, rest: cleaned } = extractFacingFlag(afterAgent);
     const [sub, ...rest] = cleaned;
     if (!sub)
         throw new Error(`Usage\n${usage()}`);
@@ -956,7 +996,7 @@ function parseConfigCommand(args) {
         const modelName = rest[0];
         if (!modelName)
             throw new Error(`Usage: ouro config model --agent <name> <model-name>`);
-        return { kind: "config.model", agent, modelName };
+        return facing ? { kind: "config.model", agent, modelName, facing } : { kind: "config.model", agent, modelName };
     }
     if (sub === "models") {
         if (!agent)
@@ -1439,9 +1479,11 @@ async function defaultRunAdoptionSpecialist() {
         const { loadIdentityPhrases } = await Promise.resolve().then(() => __importStar(require("./specialist-orchestrator")));
         const phrases = loadIdentityPhrases(bundleSourceDir, identity.fileName);
         setAgentConfigOverride({
-            version: 1,
+            version: 2,
             enabled: true,
             provider: providerRaw,
+            humanFacing: { provider: providerRaw, model: "" },
+            agentFacing: { provider: providerRaw, model: "" },
             phrases,
         });
         patchRuntimeConfig({
@@ -1453,6 +1495,7 @@ async function defaultRunAdoptionSpecialist() {
         const systemPrompt = (0, specialist_prompt_1.buildSpecialistSystemPrompt)(soulText, identity.content, existingBundles, {
             tempDir,
             provider: providerRaw,
+            model: providerConfig.model ?? "",
         });
         // Build specialist tools
         const specialistTools = (0, specialist_tools_1.getSpecialistTools)();
@@ -1796,6 +1839,60 @@ function executeTaskCommand(command, taskMod) {
         const lines = taskMod.boardDeps();
         return lines.length > 0 ? lines.join("\n") : "no unresolved dependencies";
     }
+    if (command.kind === "task.fix") {
+        try {
+            const fixOptions = {
+                mode: command.mode,
+                ...(command.issueId ? { issueId: command.issueId } : {}),
+                ...(command.option !== undefined ? { option: command.option } : {}),
+            };
+            const result = taskMod.fix(fixOptions);
+            if (command.mode === "dry-run") {
+                if (result.remaining.length === 0) {
+                    return `task health: clean`;
+                }
+                const safeIssues = result.remaining.filter((i) => i.confidence === "safe");
+                const reviewIssues = result.remaining.filter((i) => i.confidence === "needs_review");
+                const lines = [`${result.remaining.length} issues found`];
+                if (safeIssues.length > 0) {
+                    lines.push("", `safe fixes (${safeIssues.length}):`);
+                    for (const issue of safeIssues) {
+                        lines.push(`  ${issue.code}:${issue.target} -- ${issue.description}`);
+                    }
+                }
+                if (reviewIssues.length > 0) {
+                    lines.push("", `needs review (${reviewIssues.length}):`);
+                    for (const issue of reviewIssues) {
+                        lines.push(`  ${issue.code}:${issue.target} -- ${issue.description}`);
+                    }
+                }
+                lines.push("", `task health: ${result.health}`);
+                return lines.join("\n");
+            }
+            // safe, single, or --all modes: show what was done
+            const lines = [];
+            if (result.applied.length > 0) {
+                lines.push(`${result.applied.length} applied:`);
+                for (const issue of result.applied) {
+                    lines.push(`  ${issue.code}:${issue.target}`);
+                }
+            }
+            if (result.remaining.length > 0) {
+                lines.push(`${result.remaining.length} remaining:`);
+                for (const issue of result.remaining) {
+                    lines.push(`  ${issue.code}:${issue.target} -- ${issue.description}`);
+                }
+            }
+            if (result.applied.length === 0 && result.remaining.length === 0) {
+                lines.push("no issues");
+            }
+            lines.push(`task health: ${result.health}`);
+            return lines.join("\n");
+        }
+        catch (error) {
+            return `error: ${error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error)}`;
+        }
+    }
     // command.kind === "task.sessions"
     const lines = taskMod.boardSessions();
     return lines.length > 0 ? lines.join("\n") : "no active sessions";
@@ -2182,6 +2279,7 @@ async function runOuroCli(args, deps = createDefaultOuroCliDeps()) {
         }
         // Run update hooks before starting daemon so user sees the output
         (0, update_hooks_1.registerUpdateHook)(bundle_meta_1.bundleMetaHook);
+        (0, update_hooks_1.registerUpdateHook)(agent_config_v2_1.agentConfigV2Hook);
         const bundlesRoot = (0, identity_1.getAgentBundlesRoot)();
         const currentVersion = (0, bundle_manifest_1.getPackageVersion)();
         // Snapshot the previous CLI version from the first bundle-meta before
@@ -2580,7 +2678,7 @@ async function runOuroCli(args, deps = createDefaultOuroCliDeps()) {
     // ── task subcommands (local, no daemon socket needed) ──
     if (command.kind === "task.board" || command.kind === "task.create" || command.kind === "task.update" ||
         command.kind === "task.show" || command.kind === "task.actionable" || command.kind === "task.deps" ||
-        command.kind === "task.sessions") {
+        command.kind === "task.sessions" || command.kind === "task.fix") {
         /* v8 ignore start -- production default: requires full identity setup @preserve */
         const taskMod = deps.taskModule ?? (0, tasks_1.getTaskModule)();
         /* v8 ignore stop */
@@ -2672,7 +2770,7 @@ async function runOuroCli(args, deps = createDefaultOuroCliDeps()) {
     }
     // ── auth (local, no daemon socket needed) ──
     if (command.kind === "auth.run") {
-        const provider = command.provider ?? (0, auth_flow_1.readAgentConfigForAgent)(command.agent).config.provider;
+        const provider = command.provider ?? (0, auth_flow_1.readAgentConfigForAgent)(command.agent).config.humanFacing.provider;
         /* v8 ignore next -- tests always inject runAuthFlow; default is for production @preserve */
         const authRunner = deps.runAuthFlow ?? auth_flow_1.runRuntimeAuthFlow;
         const result = await authRunner({
@@ -2732,7 +2830,13 @@ async function runOuroCli(args, deps = createDefaultOuroCliDeps()) {
             deps.writeStdout(message);
             return message;
         }
-        (0, auth_flow_1.writeAgentProviderSelection)(command.agent, command.provider);
+        if (command.facing) {
+            (0, auth_flow_1.writeAgentProviderSelection)(command.agent, command.facing, command.provider);
+        }
+        else {
+            (0, auth_flow_1.writeAgentProviderSelection)(command.agent, "human", command.provider);
+            (0, auth_flow_1.writeAgentProviderSelection)(command.agent, "agent", command.provider);
+        }
         const message = `switched ${command.agent} to ${command.provider} (verified working)`;
         deps.writeStdout(message);
         return message;
@@ -2742,7 +2846,7 @@ async function runOuroCli(args, deps = createDefaultOuroCliDeps()) {
     /* v8 ignore start -- config models: tested via daemon-cli.test.ts @preserve */
     if (command.kind === "config.models") {
         const { config } = (0, auth_flow_1.readAgentConfigForAgent)(command.agent);
-        const provider = config.provider;
+        const provider = config.humanFacing.provider;
         if (provider !== "github-copilot") {
             const message = `model listing not available for ${provider} — check provider documentation.`;
             deps.writeStdout(message);
@@ -2773,9 +2877,11 @@ async function runOuroCli(args, deps = createDefaultOuroCliDeps()) {
     // ── config model (local, no daemon socket needed) ──
     /* v8 ignore start -- config model: tested via daemon-cli.test.ts @preserve */
     if (command.kind === "config.model") {
+        const facing = command.facing ?? "human";
         // Validate model availability for github-copilot before writing
         const { config } = (0, auth_flow_1.readAgentConfigForAgent)(command.agent);
-        if (config.provider === "github-copilot") {
+        const facingConfig = facing === "human" ? config.humanFacing : config.agentFacing;
+        if (facingConfig.provider === "github-copilot") {
             const { secrets } = (0, auth_flow_1.loadAgentSecrets)(command.agent);
             const ghConfig = secrets.providers["github-copilot"];
             if (ghConfig.githubToken && ghConfig.baseUrl) {
@@ -2801,7 +2907,7 @@ async function runOuroCli(args, deps = createDefaultOuroCliDeps()) {
                 }
             }
         }
-        const { provider, previousModel } = (0, auth_flow_1.writeAgentModel)(command.agent, command.modelName);
+        const { provider, previousModel } = (0, auth_flow_1.writeAgentModel)(command.agent, facing, command.modelName);
         const message = previousModel
             ? `updated ${command.agent} model on ${provider}: ${previousModel} → ${command.modelName}`
             : `set ${command.agent} model on ${provider}: ${command.modelName}`;

package/dist/heart/daemon/daemon.js

@@ -46,6 +46,7 @@ const runtime_metadata_1 = require("./runtime-metadata");
 const runtime_mode_1 = require("./runtime-mode");
 const update_hooks_1 = require("./update-hooks");
 const bundle_meta_1 = require("./hooks/bundle-meta");
+const agent_config_v2_1 = require("./hooks/agent-config-v2");
 const bundle_manifest_1 = require("../../mind/bundle-manifest");
 const update_checker_1 = require("./update-checker");
 const staged_restart_1 = require("./staged-restart");
@@ -200,6 +201,7 @@ class OuroDaemon {
         });
         // Register update hooks and apply pending updates before starting agents
         (0, update_hooks_1.registerUpdateHook)(bundle_meta_1.bundleMetaHook);
+        (0, update_hooks_1.registerUpdateHook)(agent_config_v2_1.agentConfigV2Hook);
         const currentVersion = (0, bundle_manifest_1.getPackageVersion)();
         await (0, update_hooks_1.applyPendingUpdates)(this.bundlesRoot, currentVersion);
         // Start periodic update checker (polls npm registry every 30 minutes)