@ouro.bot/cli 0.1.0-alpha.195 → 0.1.0-alpha.197

package/changelog.json

@@ -1,6 +1,19 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.197",
+      "changes": [
+        "fix(daemon): validate agent config before spawn \u2014 skips agents with missing credentials instead of crash-looping"
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.196",
+      "changes": [
+        "fix: ouro up verifies daemon is alive before reporting started (polls socket for 10s)",
+        "fix: daemon-runtime-sync also verifies after replacing a stale daemon"
+      ]
+    },
     {
       "version": "0.1.0-alpha.195",
       "changes": [

package/dist/heart/daemon/agent-config-check.js

@@ -0,0 +1,149 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkAgentConfig = checkAgentConfig;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const identity_1 = require("../identity");
+const runtime_1 = require("../../nerves/runtime");
+/**
+ * Pre-spawn validation: ensures agent.json exists and required secrets are present.
+ * Returns `{ ok: true }` when the agent is ready to run, or a descriptive error
+ * with an actionable fix message when something is missing.
+ */
+function checkAgentConfig(agentName, bundlesRoot, secretsRoot) {
+    const agentJsonPath = path.join(bundlesRoot, `${agentName}.ouro`, "agent.json");
+    let raw;
+    try {
+        raw = fs.readFileSync(agentJsonPath, "utf-8");
+    }
+    catch {
+        return {
+            ok: false,
+            error: `agent.json not found at ${agentJsonPath}`,
+            fix: `Run 'ouro hatch ${agentName}' to create the agent bundle, or verify that ${bundlesRoot}/${agentName}.ouro/ exists.`,
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return {
+            ok: false,
+            error: `agent.json at ${agentJsonPath} contains invalid JSON`,
+            fix: `Open ${agentJsonPath} and fix the JSON syntax.`,
+        };
+    }
+    // Disabled agents are valid — they just won't run
+    if (parsed.enabled === false) {
+        return { ok: true };
+    }
+    // Resolve provider: humanFacing.provider > config.provider
+    let provider;
+    const humanFacing = parsed.humanFacing;
+    if (humanFacing && typeof humanFacing.provider === "string") {
+        provider = humanFacing.provider;
+    }
+    else if (typeof parsed.provider === "string") {
+        provider = parsed.provider;
+    }
+    if (!provider) {
+        return {
+            ok: false,
+            error: `agent.json for '${agentName}' has no provider configured`,
+            fix: `Add humanFacing.provider to ${agentJsonPath}. Valid providers: ${Object.keys(identity_1.PROVIDER_CREDENTIALS).join(", ")}`,
+        };
+    }
+    const requiredFields = identity_1.PROVIDER_CREDENTIALS[provider];
+    if (!requiredFields) {
+        return {
+            ok: false,
+            error: `Unknown provider '${provider}' in agent.json for '${agentName}'`,
+            fix: `Set humanFacing.provider to one of: ${Object.keys(identity_1.PROVIDER_CREDENTIALS).join(", ")}`,
+        };
+    }
+    // Azure with managed identity does not require apiKey — skip secrets check
+    // when endpoint + deployment are present (managed identity auth)
+    const secretsJsonPath = path.join(secretsRoot, agentName, "secrets.json");
+    let secrets;
+    try {
+        const secretsRaw = fs.readFileSync(secretsJsonPath, "utf-8");
+        secrets = JSON.parse(secretsRaw);
+    }
+    catch {
+        return {
+            ok: false,
+            error: `secrets.json not found or unreadable at ${secretsJsonPath}`,
+            fix: `Run 'ouro auth ${agentName}' to configure credentials, or create ${secretsJsonPath} with providers.${provider} credentials.`,
+        };
+    }
+    const providers = secrets.providers;
+    const providerSecrets = providers?.[provider];
+    if (!providerSecrets) {
+        return {
+            ok: false,
+            error: `secrets.json for '${agentName}' is missing providers.${provider} section`,
+            fix: `Run 'ouro auth ${agentName}' to configure ${provider} credentials.`,
+        };
+    }
+    // Azure special case: managed identity only needs endpoint + deployment
+    if (provider === "azure") {
+        const hasEndpoint = typeof providerSecrets.endpoint === "string" && providerSecrets.endpoint.length > 0;
+        const hasDeployment = typeof providerSecrets.deployment === "string" && providerSecrets.deployment.length > 0;
+        const hasManagedId = typeof providerSecrets.managedIdentityClientId === "string" && providerSecrets.managedIdentityClientId.length > 0;
+        if (hasEndpoint && hasDeployment && hasManagedId) {
+            return { ok: true };
+        }
+    }
+    const missing = requiredFields.filter((field) => {
+        const val = providerSecrets[field];
+        return typeof val !== "string" || val.length === 0;
+    });
+    if (missing.length > 0) {
+        return {
+            ok: false,
+            error: `secrets.json for '${agentName}' is missing required ${provider} credentials: ${missing.join(", ")}`,
+            fix: `Run 'ouro auth ${agentName}' to set up ${provider} credentials, or add the missing fields to providers.${provider} in ${secretsJsonPath}.`,
+        };
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.agent_config_valid",
+        message: "agent config validation passed",
+        meta: { agent: agentName, provider },
+    });
+    return { ok: true };
+}

package/dist/heart/daemon/daemon-cli.js

@@ -266,15 +266,38 @@ async function ensureDaemonRunning(deps) {
             },
             cleanupStaleSocket: deps.cleanupStaleSocket,
             startDaemonProcess: deps.startDaemonProcess,
+            checkSocketAlive: deps.checkSocketAlive,
         });
     }
     deps.cleanupStaleSocket(deps.socketPath);
     const started = await deps.startDaemonProcess(deps.socketPath);
+    const pid = started.pid ?? "unknown";
+    // Verify the daemon actually comes up before reporting success
+    const verified = await verifyDaemonAlive(deps.checkSocketAlive, deps.socketPath);
+    /* v8 ignore start -- daemon liveness failure: requires real daemon crash timing @preserve */
+    if (!verified) {
+        return {
+            alreadyRunning: false,
+            message: `daemon spawned (pid ${pid}) but failed to respond within 10s — check \`ouro status\` or daemon logs`,
+        };
+    }
+    /* v8 ignore stop */
     return {
         alreadyRunning: false,
-        message: `daemon started (pid ${started.pid ?? "unknown"})`,
+        message: `daemon started (pid ${pid})`,
     };
 }
+/* v8 ignore start -- daemon liveness poll: real socket timing untestable in vitest @preserve */
+async function verifyDaemonAlive(checkSocketAlive, socketPath, maxWaitMs = 10_000, pollIntervalMs = 500) {
+    const deadline = Date.now() + maxWaitMs;
+    while (Date.now() < deadline) {
+        await new Promise((r) => setTimeout(r, pollIntervalMs));
+        if (await checkSocketAlive(socketPath))
+            return true;
+    }
+    return false;
+}
+/* v8 ignore stop */
 /**
  * Extract `--agent <name>` from an args array, returning the agent name and
  * the remaining args with the flag pair removed.

package/dist/heart/daemon/daemon-entry.js

@@ -54,6 +54,8 @@ const habit_migration_1 = require("./habit-migration");
 const os_cron_deps_1 = require("./os-cron-deps");
 const os_cron_1 = require("./os-cron");
 const daemon_tombstone_1 = require("./daemon-tombstone");
+const os = __importStar(require("os"));
+const agent_config_check_1 = require("./agent-config-check");
 function parseSocketPath(argv) {
     const socketIndex = argv.indexOf("--socket");
     if (socketIndex >= 0) {
@@ -92,6 +94,12 @@ const processManager = new process_manager_1.DaemonProcessManager({
         autoStart: true,
     })),
     existsSync: fs.existsSync,
+    /* v8 ignore next 4 -- wiring: delegates to checkAgentConfig which has full unit tests @preserve */
+    configCheck: (agent) => {
+        const bundlesRoot = (0, identity_1.getAgentBundlesRoot)();
+        const secretsRoot = path.join(os.homedir(), ".agentsecrets");
+        return (0, agent_config_check_1.checkAgentConfig)(agent, bundlesRoot, secretsRoot);
+    },
 });
 const scheduler = new task_scheduler_1.TaskDrivenScheduler({
     agents: [...managedAgents],

package/dist/heart/daemon/daemon-runtime-sync.js

@@ -2,6 +2,21 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ensureCurrentDaemonRuntime = ensureCurrentDaemonRuntime;
 const runtime_1 = require("../../nerves/runtime");
+/* v8 ignore start -- daemon liveness poll: real socket timing untestable in vitest @preserve */
+async function verifyDaemonStarted(deps) {
+    if (!deps.checkSocketAlive)
+        return true;
+    const maxWaitMs = 10_000;
+    const pollIntervalMs = 500;
+    const deadline = Date.now() + maxWaitMs;
+    while (Date.now() < deadline) {
+        await new Promise((r) => setTimeout(r, pollIntervalMs));
+        if (await deps.checkSocketAlive(deps.socketPath))
+            return true;
+    }
+    return false;
+}
+/* v8 ignore stop */
 function isKnownVersion(version) {
     return version !== "unknown" && version.trim().length > 0;
 }
@@ -116,11 +131,15 @@ async function ensureCurrentDaemonRuntime(deps) {
             }
             deps.cleanupStaleSocket(deps.socketPath);
             const started = await deps.startDaemonProcess(deps.socketPath);
+            const pid = started.pid ?? "unknown";
+            const verified = await verifyDaemonStarted(deps);
+            /* v8 ignore next -- daemon liveness failure: requires real daemon crash timing @preserve */
+            const suffix = verified ? "" : " — but daemon failed to respond, check logs";
             result = {
                 alreadyRunning: false,
                 message: includesVersionDrift
-                    ? `restarted stale daemon from ${runningVersion} to ${deps.localVersion} (pid ${started.pid ?? "unknown"})`
-                    : `restarted drifted daemon (${driftSummary}) (pid ${started.pid ?? "unknown"})`,
+                    ? `restarted stale daemon from ${runningVersion} to ${deps.localVersion} (pid ${pid})${suffix}`
+                    : `restarted drifted daemon (${driftSummary}) (pid ${pid})${suffix}`,
             };
             (0, runtime_1.emitNervesEvent)({
                 component: "daemon",

package/dist/heart/daemon/process-manager.js

@@ -54,6 +54,7 @@ class DaemonProcessManager {
     cooldownRecoveryMs;
     maxCooldownRetries;
     existsSyncFn;
+    configCheckFn;
     constructor(options) {
         this.maxRestartsPerHour = options.maxRestartsPerHour ?? 10;
         this.stabilityThresholdMs = options.stabilityThresholdMs ?? 60_000;
@@ -66,6 +67,7 @@ class DaemonProcessManager {
         this.setTimeoutFn = options.setTimeoutFn ?? ((cb, delay) => setTimeout(cb, delay));
         this.clearTimeoutFn = options.clearTimeoutFn ?? ((timer) => clearTimeout(timer));
         this.existsSyncFn = options.existsSync ?? null;
+        this.configCheckFn = options.configCheck ?? null;
         for (const agent of options.agents) {
             this.agents.set(agent.name, {
                 config: agent,
@@ -104,6 +106,22 @@ class DaemonProcessManager {
         this.clearRestartTimer(state);
         state.stopRequested = false;
         state.snapshot.status = "starting";
+        if (this.configCheckFn) {
+            const result = this.configCheckFn(agent);
+            if (!result.ok) {
+                state.snapshot.status = "crashed";
+                (0, runtime_1.emitNervesEvent)({
+                    level: "error",
+                    component: "daemon",
+                    event: "daemon.agent_config_invalid",
+                    message: result.error ?? "agent config validation failed",
+                    meta: { agent, fix: result.fix ?? null },
+                });
+                process.stderr.write(`[daemon] ${agent}: ${result.error}\n` +
+                    (result.fix ? `  Fix: ${result.fix}\n` : ""));
+                return;
+            }
+        }
         const runCwd = (0, identity_1.getRepoRoot)();
         const entryScript = path.join((0, identity_1.getRepoRoot)(), "dist", state.config.entry);
         if (this.existsSyncFn && !this.existsSyncFn(entryScript)) {

package/dist/heart/identity.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HARNESS_CANONICAL_REPO_URL = exports.DEFAULT_AGENT_SENSES = exports.DEFAULT_AGENT_PHRASES = exports.DEFAULT_AGENT_CONTEXT = void 0;
+exports.HARNESS_CANONICAL_REPO_URL = exports.PROVIDER_CREDENTIALS = exports.DEFAULT_AGENT_SENSES = exports.DEFAULT_AGENT_PHRASES = exports.DEFAULT_AGENT_CONTEXT = void 0;
 exports.buildDefaultAgentTemplate = buildDefaultAgentTemplate;
 exports.getAgentName = getAgentName;
 exports.getRepoRoot = getRepoRoot;
@@ -208,6 +208,17 @@ function resolveOptionalAgentName(agentName) {
 function getAgentStateRoot(agentName) {
     return path.join(getAgentRoot(resolveOptionalAgentName(agentName)), "state");
 }
+/**
+ * Required credential fields per provider.
+ * Used by daemon config-check to validate secrets before spawning an agent.
+ */
+exports.PROVIDER_CREDENTIALS = {
+    azure: ["apiKey", "endpoint", "deployment"],
+    minimax: ["apiKey"],
+    anthropic: ["setupToken"],
+    "openai-codex": ["oauthAccessToken"],
+    "github-copilot": ["githubToken", "baseUrl"],
+};
 exports.HARNESS_CANONICAL_REPO_URL = "https://github.com/ouroborosbot/ouroboros.git";
 function getAgentRepoWorkspacesRoot(agentName) {
     return path.join(getAgentStateRoot(resolveOptionalAgentName(agentName)), "workspaces");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.195",
+  "version": "0.1.0-alpha.197",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",