@ouro.bot/cli 0.1.0-alpha.17 → 0.1.0-alpha.170

package/dist/heart/providers/azure.js

@@ -1,35 +1,137 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyAzureError = classifyAzureError;
+exports.createAzureTokenProvider = createAzureTokenProvider;
 exports.createAzureProviderRuntime = createAzureProviderRuntime;
 const openai_1 = require("openai");
 const config_1 = require("../config");
 const runtime_1 = require("../../nerves/runtime");
 const streaming_1 = require("../streaming");
-function createAzureProviderRuntime() {
+const model_capabilities_1 = require("../model-capabilities");
+const COGNITIVE_SERVICES_SCOPE = "https://cognitiveservices.azure.com/.default";
+/* v8 ignore start -- shared network error utility, tested via classification tests @preserve */
+function isNetworkError(error) {
+    const code = error.code || "";
+    if (["ECONNRESET", "ECONNREFUSED", "ENOTFOUND", "ETIMEDOUT", "EPIPE",
+        "EAI_AGAIN", "EHOSTUNREACH", "ENETUNREACH", "ECONNABORTED"].includes(code))
+        return true;
+    const msg = error.message || "";
+    return msg.includes("fetch failed") || msg.includes("socket hang up") || msg.includes("getaddrinfo");
+}
+/* v8 ignore stop */
+function classifyAzureError(error) {
+    const status = error.status;
+    if (status === 401 || status === 403)
+        return "auth-failure";
+    if (status === 429)
+        return "rate-limit";
+    if (status && status >= 500)
+        return "server-error";
+    if (isNetworkError(error))
+        return "network-error";
+    return "unknown";
+}
+// @azure/identity is imported dynamically (below) rather than at the top level
+// because it's a heavy package (~30+ transitive deps) and we only need it when
+// using the managed-identity auth path. API-key users and other providers
+// shouldn't pay the cold-start cost.
+function createAzureTokenProvider(managedIdentityClientId) {
+    let credential = null;
+    return async () => {
+        try {
+            if (!credential) {
+                const { DefaultAzureCredential } = await Promise.resolve().then(() => __importStar(require("@azure/identity")));
+                const credentialOptions = managedIdentityClientId
+                    ? { managedIdentityClientId }
+                    : undefined;
+                credential = new DefaultAzureCredential(credentialOptions);
+            }
+            const tokenResponse = await credential.getToken(COGNITIVE_SERVICES_SCOPE);
+            return tokenResponse.token;
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            throw new Error(`Azure OpenAI authentication failed: ${detail}\n` +
+                "To fix this, either:\n" +
+                "  1. Set providers.azure.apiKey in secrets.json, or\n" +
+                "  2. Run 'az login' to authenticate with your Azure account (for local dev), or\n" +
+                "  3. Attach a managed identity to your App Service and set providers.azure.managedIdentityClientId in secrets.json (for deployed environments)");
+        }
+    };
+}
+function createAzureProviderRuntime(model) {
+    const azureConfig = (0, config_1.getAzureConfig)();
+    const useApiKey = !!azureConfig.apiKey;
+    const authMethod = useApiKey ? "key" : "managed-identity";
     (0, runtime_1.emitNervesEvent)({
         component: "engine",
         event: "engine.provider_init",
         message: "azure provider init",
-        meta: { provider: "azure" },
+        meta: { provider: "azure", authMethod },
     });
-    const azureConfig = (0, config_1.getAzureConfig)();
-    if (!(azureConfig.apiKey && azureConfig.endpoint && azureConfig.deployment && azureConfig.modelName)) {
+    if (!(azureConfig.endpoint && azureConfig.deployment)) {
         throw new Error("provider 'azure' is selected in agent.json but providers.azure is incomplete in secrets.json.");
     }
-    const client = new openai_1.AzureOpenAI({
-        apiKey: azureConfig.apiKey,
+    const modelCaps = (0, model_capabilities_1.getModelCapabilities)(model);
+    const capabilities = new Set();
+    if (modelCaps.reasoningEffort)
+        capabilities.add("reasoning-effort");
+    const clientOptions = {
         endpoint: azureConfig.endpoint.replace(/\/openai.*$/, ""),
         deployment: azureConfig.deployment,
         apiVersion: azureConfig.apiVersion,
         timeout: 30000,
         maxRetries: 0,
-    });
+    };
+    if (useApiKey) {
+        clientOptions.apiKey = azureConfig.apiKey;
+    }
+    else {
+        const managedIdentityClientId = azureConfig.managedIdentityClientId || undefined;
+        clientOptions.azureADTokenProvider = createAzureTokenProvider(managedIdentityClientId);
+    }
+    const client = new openai_1.AzureOpenAI(clientOptions);
     let nativeInput = null;
     let nativeInstructions = "";
     return {
         id: "azure",
-        model: azureConfig.modelName,
+        model,
         client,
+        capabilities,
+        supportedReasoningEfforts: modelCaps.reasoningEffort,
         resetTurnState(messages) {
             const { instructions, input } = (0, streaming_1.toResponsesInput)(messages);
             nativeInput = input;
@@ -48,7 +150,7 @@ function createAzureProviderRuntime() {
                 input: nativeInput,
                 instructions: nativeInstructions,
                 tools: (0, streaming_1.toResponsesTools)(request.activeTools),
-                reasoning: { effort: "medium", summary: "detailed" },
+                reasoning: { effort: request.reasoningEffort ?? "medium", summary: "detailed" },
                 stream: true,
                 store: false,
                 include: ["reasoning.encrypted_content"],
@@ -57,10 +159,14 @@ function createAzureProviderRuntime() {
                 params.metadata = { trace_id: request.traceId };
             if (request.toolChoiceRequired)
                 params.tool_choice = "required";
-            const result = await (0, streaming_1.streamResponsesApi)(this.client, params, request.callbacks, request.signal);
+            const result = await (0, streaming_1.streamResponsesApi)(this.client, params, request.callbacks, request.signal, request.eagerSettleStreaming);
             for (const item of result.outputItems)
                 nativeInput.push(item);
             return result;
         },
+        /* v8 ignore next 3 -- delegation: classification logic tested via classifyAzureError @preserve */
+        classifyError(error) {
+            return classifyAzureError(error);
+        },
     };
 }

package/dist/heart/providers/github-copilot.js

@@ -0,0 +1,157 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyGithubCopilotError = classifyGithubCopilotError;
+exports.createGithubCopilotProviderRuntime = createGithubCopilotProviderRuntime;
+const openai_1 = __importDefault(require("openai"));
+const config_1 = require("../config");
+const runtime_1 = require("../../nerves/runtime");
+const streaming_1 = require("../streaming");
+const model_capabilities_1 = require("../model-capabilities");
+/* v8 ignore start -- duplicated from shared provider utils, tested there @preserve */
+function isNetworkError(error) {
+    const code = error.code || "";
+    if (["ECONNRESET", "ECONNREFUSED", "ENOTFOUND", "ETIMEDOUT", "EPIPE",
+        "EAI_AGAIN", "EHOSTUNREACH", "ENETUNREACH", "ECONNABORTED"].includes(code))
+        return true;
+    const msg = error.message || "";
+    return msg.includes("fetch failed") || msg.includes("socket hang up") || msg.includes("getaddrinfo");
+}
+/* v8 ignore stop */
+/* v8 ignore start -- duplicated classification pattern, tested via provider unit tests @preserve */
+function classifyGithubCopilotError(error) {
+    const status = error.status;
+    if (status === 401 || status === 403)
+        return "auth-failure";
+    if (status === 429)
+        return "rate-limit";
+    if (status && status >= 500)
+        return "server-error";
+    if (isNetworkError(error))
+        return "network-error";
+    return "unknown";
+}
+/* v8 ignore stop */
+function createGithubCopilotProviderRuntime(model) {
+    (0, runtime_1.emitNervesEvent)({
+        component: "engine",
+        event: "engine.provider_init",
+        message: "github-copilot provider init",
+        meta: { provider: "github-copilot" },
+    });
+    const config = (0, config_1.getGithubCopilotConfig)();
+    if (!config.githubToken) {
+        throw new Error("provider 'github-copilot' is selected in agent.json but providers.github-copilot.githubToken is missing in secrets.json.");
+    }
+    if (!config.baseUrl) {
+        throw new Error("provider 'github-copilot' is selected in agent.json but providers.github-copilot.baseUrl is missing in secrets.json.");
+    }
+    const isCompletionsModel = model.startsWith("claude");
+    const modelCaps = (0, model_capabilities_1.getModelCapabilities)(model);
+    const capabilities = new Set();
+    /* v8 ignore next -- branch: capability detection tested via unit test @preserve */
+    if (modelCaps.reasoningEffort)
+        capabilities.add("reasoning-effort");
+    const client = new openai_1.default({
+        apiKey: config.githubToken,
+        baseURL: config.baseUrl,
+        timeout: 30000,
+        maxRetries: 0,
+    });
+    if (isCompletionsModel) {
+        // Chat completions path (Claude models via Copilot)
+        return {
+            id: "github-copilot",
+            model,
+            client,
+            capabilities,
+            supportedReasoningEfforts: modelCaps.reasoningEffort,
+            resetTurnState(_messages) {
+                // No provider-owned turn state for chat-completions path.
+            },
+            appendToolOutput(_callId, _output) {
+                // Chat-completions providers rely on canonical messages only.
+            },
+            /* v8 ignore start -- streamTurn: tested via mock assertions in github-copilot.test.ts @preserve */
+            async streamTurn(request) {
+                const params = {
+                    messages: request.messages,
+                    tools: request.activeTools,
+                    stream: true,
+                };
+                if (this.model)
+                    params.model = this.model;
+                if (request.traceId)
+                    params.metadata = { trace_id: request.traceId };
+                if (request.toolChoiceRequired)
+                    params.tool_choice = "required";
+                try {
+                    return await (0, streaming_1.streamChatCompletion)(this.client, params, request.callbacks, request.signal, request.eagerSettleStreaming);
+                }
+                catch (error) {
+                    throw error instanceof Error ? error : new Error(String(error));
+                }
+            },
+            /* v8 ignore stop */
+            /* v8 ignore next 3 -- delegation: classification logic tested via classifyGithubCopilotError @preserve */
+            classifyError(error) {
+                return classifyGithubCopilotError(error);
+            },
+        };
+    }
+    // Responses API path (GPT models via Copilot)
+    let nativeInput = null;
+    let nativeInstructions = "";
+    return {
+        id: "github-copilot",
+        model,
+        client,
+        capabilities,
+        supportedReasoningEfforts: modelCaps.reasoningEffort,
+        /* v8 ignore start -- responses path: tested via mock assertions in github-copilot.test.ts @preserve */
+        resetTurnState(messages) {
+            const { instructions, input } = (0, streaming_1.toResponsesInput)(messages);
+            nativeInput = input;
+            nativeInstructions = instructions;
+        },
+        appendToolOutput(callId, output) {
+            if (!nativeInput)
+                return;
+            nativeInput.push({ type: "function_call_output", call_id: callId, output });
+        },
+        async streamTurn(request) {
+            if (!nativeInput)
+                this.resetTurnState(request.messages);
+            const params = {
+                model: this.model,
+                input: nativeInput,
+                instructions: nativeInstructions,
+                tools: (0, streaming_1.toResponsesTools)(request.activeTools),
+                reasoning: { effort: request.reasoningEffort ?? "medium", summary: "detailed" },
+                stream: true,
+                store: false,
+                include: ["reasoning.encrypted_content"],
+            };
+            if (request.traceId)
+                params.metadata = { trace_id: request.traceId };
+            if (request.toolChoiceRequired)
+                params.tool_choice = "required";
+            try {
+                const result = await (0, streaming_1.streamResponsesApi)(this.client, params, request.callbacks, request.signal, request.eagerSettleStreaming);
+                for (const item of result.outputItems)
+                    nativeInput.push(item);
+                return result;
+            }
+            catch (error) {
+                throw error instanceof Error ? error : new Error(String(error));
+            }
+        },
+        /* v8 ignore stop */
+        /* v8 ignore next 3 -- delegation: classification logic tested via classifyGithubCopilotError @preserve */
+        classifyError(error) {
+            return classifyGithubCopilotError(error);
+        },
+    };
+}

package/dist/heart/providers/minimax.js

@@ -3,12 +3,36 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyMinimaxError = classifyMinimaxError;
 exports.createMinimaxProviderRuntime = createMinimaxProviderRuntime;
 const openai_1 = __importDefault(require("openai"));
 const config_1 = require("../config");
 const runtime_1 = require("../../nerves/runtime");
+/* v8 ignore start -- shared network error utility, tested via classification tests @preserve */
+function isNetworkError(error) {
+    const code = error.code || "";
+    if (["ECONNRESET", "ECONNREFUSED", "ENOTFOUND", "ETIMEDOUT", "EPIPE",
+        "EAI_AGAIN", "EHOSTUNREACH", "ENETUNREACH", "ECONNABORTED"].includes(code))
+        return true;
+    const msg = error.message || "";
+    return msg.includes("fetch failed") || msg.includes("socket hang up") || msg.includes("getaddrinfo");
+}
+/* v8 ignore stop */
+function classifyMinimaxError(error) {
+    const status = error.status;
+    if (status === 401 || status === 403)
+        return "auth-failure";
+    if (status === 429)
+        return "rate-limit";
+    if (status && status >= 500)
+        return "server-error";
+    if (isNetworkError(error))
+        return "network-error";
+    return "unknown";
+}
 const streaming_1 = require("../streaming");
-function createMinimaxProviderRuntime() {
+const model_capabilities_1 = require("../model-capabilities");
+function createMinimaxProviderRuntime(model) {
     (0, runtime_1.emitNervesEvent)({
         component: "engine",
         event: "engine.provider_init",
@@ -19,6 +43,8 @@ function createMinimaxProviderRuntime() {
     if (!minimaxConfig.apiKey) {
         throw new Error("provider 'minimax' is selected in agent.json but providers.minimax.apiKey is missing in secrets.json.");
     }
+    // Registry consulted; MiniMax models return empty defaults (no capabilities to derive)
+    (0, model_capabilities_1.getModelCapabilities)(model);
     const client = new openai_1.default({
         apiKey: minimaxConfig.apiKey,
         baseURL: "https://api.minimaxi.chat/v1",
@@ -27,8 +53,9 @@ function createMinimaxProviderRuntime() {
     });
     return {
         id: "minimax",
-        model: minimaxConfig.model,
+        model,
         client,
+        capabilities: new Set(),
         resetTurnState(_messages) {
             // No provider-owned turn state for chat-completions providers.
         },
@@ -47,7 +74,10 @@ function createMinimaxProviderRuntime() {
                 params.metadata = { trace_id: request.traceId };
             if (request.toolChoiceRequired)
                 params.tool_choice = "required";
-            return (0, streaming_1.streamChatCompletion)(this.client, params, request.callbacks, request.signal);
+            return (0, streaming_1.streamChatCompletion)(this.client, params, request.callbacks, request.signal, request.eagerSettleStreaming);
+        },
+        classifyError(error) {
+            return classifyMinimaxError(error);
         },
     };
 }

package/dist/heart/providers/openai-codex.js

@@ -3,12 +3,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyOpenAICodexError = classifyOpenAICodexError;
 exports.createOpenAICodexProviderRuntime = createOpenAICodexProviderRuntime;
 const openai_1 = __importDefault(require("openai"));
 const config_1 = require("../config");
 const identity_1 = require("../identity");
 const runtime_1 = require("../../nerves/runtime");
 const streaming_1 = require("../streaming");
+const model_capabilities_1 = require("../model-capabilities");
 const OPENAI_CODEX_AUTH_FAILURE_MARKERS = [
     "authentication failed",
     "unauthorized",
@@ -27,11 +29,11 @@ function getOpenAICodexOAuthInstructions() {
     const agentName = getOpenAICodexAgentNameForGuidance();
     return [
         "Fix:",
-        `  1. Run \`npm run auth:openai-codex -- --agent ${agentName}\``,
-        "     (or run `codex login` and set the OAuth token manually)",
+        `  1. Run \`ouro auth --agent ${agentName}\``,
         `  2. Open ${getOpenAICodexSecretsPathForGuidance()}`,
         "  3. Confirm providers.openai-codex.oauthAccessToken is set",
         "  4. This provider uses chatgpt.com/backend-api/codex/responses (not api.openai.com/responses).",
+        "  5. After reauth, retry the failed ouro command or reconnect this session.",
     ].join("\n");
 }
 function getOpenAICodexReauthGuidance(reason) {
@@ -41,6 +43,33 @@ function getOpenAICodexReauthGuidance(reason) {
         getOpenAICodexOAuthInstructions(),
     ].join("\n");
 }
+/* v8 ignore start -- shared network error utility, tested via classification tests @preserve */
+function isNetworkError(error) {
+    const code = error.code || "";
+    if (["ECONNRESET", "ECONNREFUSED", "ENOTFOUND", "ETIMEDOUT", "EPIPE",
+        "EAI_AGAIN", "EHOSTUNREACH", "ENETUNREACH", "ECONNABORTED"].includes(code))
+        return true;
+    const msg = error.message || "";
+    return msg.includes("fetch failed") || msg.includes("socket hang up") || msg.includes("getaddrinfo");
+}
+/* v8 ignore stop */
+function classifyOpenAICodexError(error) {
+    const status = error.status;
+    if (status === 401 || status === 403 || isOpenAICodexAuthFailure(error))
+        return "auth-failure";
+    if (status === 429) {
+        const lower = error.message.toLowerCase();
+        if (lower.includes("usage") || lower.includes("quota") || lower.includes("exceeded your"))
+            return "usage-limit";
+        return "rate-limit";
+    }
+    if (status && status >= 500)
+        return "server-error";
+    if (isNetworkError(error))
+        return "network-error";
+    return "unknown";
+}
+/* v8 ignore start -- auth detection: only called from classifyOpenAICodexError which always passes Error @preserve */
 function isOpenAICodexAuthFailure(error) {
     if (!(error instanceof Error))
         return false;
@@ -50,13 +79,7 @@ function isOpenAICodexAuthFailure(error) {
     const lower = error.message.toLowerCase();
     return OPENAI_CODEX_AUTH_FAILURE_MARKERS.some((marker) => lower.includes(marker));
 }
-function withOpenAICodexAuthGuidance(error) {
-    const base = error instanceof Error ? error.message : String(error);
-    if (isOpenAICodexAuthFailure(error)) {
-        return new Error(getOpenAICodexReauthGuidance(`OpenAI Codex authentication failed (${base}).`));
-    }
-    return error instanceof Error ? error : new Error(String(error));
-}
+/* v8 ignore stop */
 function decodeJwtPayload(token) {
     const parts = token.split(".");
     if (parts.length < 2)
@@ -87,7 +110,7 @@ function getChatGPTAccountIdFromToken(token) {
         return "";
     return accountId.trim();
 }
-function createOpenAICodexProviderRuntime() {
+function createOpenAICodexProviderRuntime(model) {
     (0, runtime_1.emitNervesEvent)({
         component: "engine",
         event: "engine.provider_init",
@@ -95,8 +118,8 @@ function createOpenAICodexProviderRuntime() {
         meta: { provider: "openai-codex" },
     });
     const codexConfig = (0, config_1.getOpenAICodexConfig)();
-    if (!(codexConfig.model && codexConfig.oauthAccessToken)) {
-        throw new Error(getOpenAICodexReauthGuidance("provider 'openai-codex' is selected in agent.json but providers.openai-codex.model/oauthAccessToken is incomplete in secrets.json."));
+    if (!codexConfig.oauthAccessToken) {
+        throw new Error(getOpenAICodexReauthGuidance("provider 'openai-codex' is selected in agent.json but providers.openai-codex.oauthAccessToken is missing in secrets.json."));
     }
     const token = codexConfig.oauthAccessToken.trim();
     if (!token) {
@@ -106,6 +129,12 @@ function createOpenAICodexProviderRuntime() {
     if (!chatgptAccountId) {
         throw new Error(getOpenAICodexReauthGuidance("OpenAI Codex OAuth access token is missing a chatgpt_account_id claim required for chatgpt.com/backend-api/codex."));
     }
+    const modelCaps = (0, model_capabilities_1.getModelCapabilities)(model);
+    const capabilities = new Set();
+    if (modelCaps.reasoningEffort)
+        capabilities.add("reasoning-effort");
+    if (modelCaps.phase)
+        capabilities.add("phase-annotation");
     const client = new openai_1.default({
         apiKey: token,
         baseURL: OPENAI_CODEX_BACKEND_BASE_URL,
@@ -121,8 +150,10 @@ function createOpenAICodexProviderRuntime() {
     let nativeInstructions = "";
     return {
         id: "openai-codex",
-        model: codexConfig.model,
+        model,
         client,
+        capabilities,
+        supportedReasoningEfforts: modelCaps.reasoningEffort,
         resetTurnState(messages) {
             const { instructions, input } = (0, streaming_1.toResponsesInput)(messages);
             nativeInput = input;
@@ -141,7 +172,7 @@ function createOpenAICodexProviderRuntime() {
                 input: nativeInput,
                 instructions: nativeInstructions,
                 tools: (0, streaming_1.toResponsesTools)(request.activeTools),
-                reasoning: { effort: "medium", summary: "detailed" },
+                reasoning: { effort: request.reasoningEffort ?? "medium", summary: "detailed" },
                 stream: true,
                 store: false,
                 include: ["reasoning.encrypted_content"],
@@ -149,14 +180,18 @@ function createOpenAICodexProviderRuntime() {
             if (request.toolChoiceRequired)
                 params.tool_choice = "required";
             try {
-                const result = await (0, streaming_1.streamResponsesApi)(this.client, params, request.callbacks, request.signal);
+                const result = await (0, streaming_1.streamResponsesApi)(this.client, params, request.callbacks, request.signal, request.eagerSettleStreaming);
                 for (const item of result.outputItems)
                     nativeInput.push(item);
                 return result;
             }
             catch (error) {
-                throw withOpenAICodexAuthGuidance(error);
+                throw error instanceof Error ? error : new Error(String(error));
             }
         },
+        /* v8 ignore next 3 -- delegation: classification logic tested via classifyOpenAICodexError @preserve */
+        classifyError(error) {
+            return classifyOpenAICodexError(error);
+        },
     };
 }