@ouro.bot/cli 0.1.0-alpha.200 → 0.1.0-alpha.202

package/changelog.json

@@ -1,6 +1,22 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.202",
+      "changes": [
+        "refactor: unify hatch + runtime auth into single credential path (PROVIDER_CREDENTIALS table)",
+        "fix: github-copilot credential discovery from stored secrets and env vars",
+        "feat: ping-verify credentials before entering serpent guide session",
+        "fix: clean up React tooltip timeouts on unmount to prevent state update warning",
+        "fix: guard against undefined child from spawn to prevent unhandled rejections"
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.201",
+      "changes": [
+        "fix: don't launchctl bootstrap after daemon start \u2014 was starting competing daemon that killed the first"
+      ]
+    },
     {
       "version": "0.1.0-alpha.200",
       "changes": [

package/dist/heart/config.js

@@ -41,6 +41,7 @@ exports.getMinimaxConfig = getMinimaxConfig;
 exports.getAnthropicConfig = getAnthropicConfig;
 exports.getOpenAICodexConfig = getOpenAICodexConfig;
 exports.getGithubCopilotConfig = getGithubCopilotConfig;
+exports.getProviderConfig = getProviderConfig;
 exports.getTeamsConfig = getTeamsConfig;
 exports.getTeamsSecondaryConfig = getTeamsSecondaryConfig;
 exports.getContextConfig = getContextConfig;
@@ -270,6 +271,10 @@ function getGithubCopilotConfig() {
     const config = loadConfig();
     return { ...config.providers["github-copilot"] };
 }
+function getProviderConfig(provider) {
+    const config = loadConfig();
+    return { ...config.providers[provider] };
+}
 function getTeamsConfig() {
     const config = loadConfig();
     return { ...config.teams };

package/dist/heart/core.js

@@ -42,31 +42,8 @@ function getProviderRuntimeFingerprint(facing) {
     const facingConfig = facing === "human" ? config.humanFacing : config.agentFacing;
     const provider = facingConfig.provider;
     const model = facingConfig.model;
-    /* v8 ignore next -- switch: not all provider branches exercised in CI @preserve */
-    switch (provider) {
-        case "azure": {
-            const { apiKey, endpoint, deployment, apiVersion, managedIdentityClientId } = (0, config_1.getAzureConfig)();
-            return JSON.stringify({ provider, model, apiKey, endpoint, deployment, apiVersion, managedIdentityClientId });
-        }
-        case "anthropic": {
-            const { setupToken } = (0, config_1.getAnthropicConfig)();
-            return JSON.stringify({ provider, model, setupToken });
-        }
-        case "minimax": {
-            const { apiKey } = (0, config_1.getMinimaxConfig)();
-            return JSON.stringify({ provider, model, apiKey });
-        }
-        case "openai-codex": {
-            const { oauthAccessToken } = (0, config_1.getOpenAICodexConfig)();
-            return JSON.stringify({ provider, model, oauthAccessToken });
-        }
-        /* v8 ignore start -- fingerprint: tested via provider init tests @preserve */
-        case "github-copilot": {
-            const { githubToken, baseUrl } = (0, config_1.getGithubCopilotConfig)();
-            return JSON.stringify({ provider, model, githubToken, baseUrl });
-        }
-        /* v8 ignore stop */
-    }
+    const providerConfig = (0, config_1.getProviderConfig)(provider);
+    return JSON.stringify({ provider, model, ...providerConfig });
 }
 function createProviderRegistry() {
     const factories = {

package/dist/heart/daemon/agent-config-check.js

@@ -87,8 +87,8 @@ function checkAgentConfig(agentName, bundlesRoot, secretsRoot) {
             fix: `Add humanFacing.provider to ${agentJsonPath}. Valid providers: ${Object.keys(identity_1.PROVIDER_CREDENTIALS).join(", ")}`,
         };
     }
-    const requiredFields = identity_1.PROVIDER_CREDENTIALS[provider];
-    if (!requiredFields) {
+    const desc = identity_1.PROVIDER_CREDENTIALS[provider];
+    if (!desc) {
         return {
             ok: false,
             error: `Unknown provider '${provider}' in agent.json for '${agentName}'`,
@@ -128,7 +128,7 @@ function checkAgentConfig(agentName, bundlesRoot, secretsRoot) {
             return { ok: true };
         }
     }
-    const missing = requiredFields.filter((field) => {
+    const missing = desc.required.filter((field) => {
         const val = providerSecrets[field];
         return typeof val !== "string" || val.length === 0;
     });

package/dist/heart/daemon/auth-flow.js

@@ -263,7 +263,7 @@ async function collectRuntimeAuthCredentials(input, deps) {
     const spawnSync = deps.spawnSync ?? child_process_1.spawnSync;
     const homeDir = deps.homeDir ?? os.homedir();
     if (input.provider === "github-copilot") {
-        let token = process.env.GH_TOKEN?.trim() || "";
+        let token = process.env.GH_TOKEN?.trim() || process.env.GITHUB_TOKEN?.trim() || "";
         if (!token) {
             const result = spawnSync("gh", ["auth", "token"], { encoding: "utf8" });
             token = (result.status === 0 && result.stdout ? result.stdout.trim() : "");
@@ -361,95 +361,62 @@ async function collectRuntimeAuthCredentials(input, deps) {
         /* v8 ignore stop */
         return { setupToken };
     }
-    if (input.provider === "minimax") {
-        const prompt = ensurePromptInput(input.promptInput, input.provider);
-        const apiKey = (await prompt("MiniMax API key: ")).trim();
-        if (!apiKey)
-            throw new Error("MiniMax API key is required.");
-        return { apiKey };
-    }
+    // Generic prompt-for-fields fallback (minimax, azure, any future simple providers)
     const prompt = ensurePromptInput(input.promptInput, input.provider);
-    const apiKey = (await prompt("Azure API key: ")).trim();
-    const endpoint = (await prompt("Azure endpoint: ")).trim();
-    const deployment = (await prompt("Azure deployment: ")).trim();
-    if (!apiKey || !endpoint || !deployment) {
-        throw new Error("Azure API key, endpoint, and deployment are required.");
+    const desc = identity_1.PROVIDER_CREDENTIALS[input.provider];
+    const creds = {};
+    for (const field of desc.required) {
+        /* v8 ignore next -- fallback: all current providers define promptLabels for required fields @preserve */
+        const label = desc.promptLabels[field] ?? field;
+        const value = (await prompt(`${label}: `)).trim();
+        if (!value)
+            throw new Error(`${label} is required.`);
+        creds[field] = value;
     }
-    return { apiKey, endpoint, deployment };
+    return creds;
 }
 async function resolveHatchCredentials(input) {
-    const prompt = input.promptInput;
     const credentials = { ...(input.credentials ?? {}) };
-    if (input.provider === "github-copilot" && !credentials.githubToken && input.runAuthFlow) {
-        const result = await input.runAuthFlow({
-            agentName: input.agentName,
-            provider: "github-copilot",
-            promptInput: prompt,
-        });
-        Object.assign(credentials, result.credentials);
-    }
-    if (input.provider === "anthropic" && !credentials.setupToken && input.runAuthFlow) {
+    // If all required fields are already provided, return as-is
+    const cred = credentials;
+    const missing = identity_1.PROVIDER_CREDENTIALS[input.provider].required.some((key) => !cred[key]);
+    if (!missing)
+        return credentials;
+    // Try the full auth flow (wraps collectRuntimeAuthCredentials + writes secrets)
+    if (input.runAuthFlow) {
         const result = await input.runAuthFlow({
             agentName: input.agentName,
-            provider: "anthropic",
-            promptInput: prompt,
+            provider: input.provider,
+            promptInput: input.promptInput,
         });
         Object.assign(credentials, result.credentials);
+        /* v8 ignore next 3 -- branch: auth flow always fills all required fields in production @preserve */
+        if (!identity_1.PROVIDER_CREDENTIALS[input.provider].required.some((key) => !credentials[key])) {
+            return credentials;
+        }
     }
-    if (input.provider === "anthropic" && !credentials.setupToken && prompt) {
-        credentials.setupToken = await prompt("Anthropic setup-token: ");
-    }
-    if (input.provider === "openai-codex" && !credentials.oauthAccessToken && input.runAuthFlow) {
-        const result = await input.runAuthFlow({
-            agentName: input.agentName,
-            provider: "openai-codex",
-            promptInput: prompt,
-        });
-        Object.assign(credentials, result.credentials);
-    }
-    if (input.provider === "openai-codex" && !credentials.oauthAccessToken && prompt) {
-        credentials.oauthAccessToken = await prompt("OpenAI Codex OAuth token: ");
-    }
-    if (input.provider === "minimax" && !credentials.apiKey && prompt) {
-        credentials.apiKey = await prompt("MiniMax API key: ");
-    }
-    if (input.provider === "azure") {
-        if (!credentials.apiKey && prompt)
-            credentials.apiKey = await prompt("Azure API key: ");
-        if (!credentials.endpoint && prompt)
-            credentials.endpoint = await prompt("Azure endpoint: ");
-        if (!credentials.deployment && prompt)
-            credentials.deployment = await prompt("Azure deployment: ");
+    // Prompt for any still-missing required fields
+    /* v8 ignore next -- guard: no promptInput means we can't collect remaining fields @preserve */
+    if (input.promptInput) {
+        const desc = identity_1.PROVIDER_CREDENTIALS[input.provider];
+        for (const field of desc.required) {
+            if (!cred[field]) {
+                const label = desc.promptLabels[field] ?? field;
+                cred[field] = await input.promptInput(`${label}: `);
+            }
+        }
     }
     return credentials;
 }
 function applyCredentials(secrets, provider, credentials) {
-    if (provider === "anthropic") {
-        secrets.providers.anthropic.setupToken = credentials.setupToken.trim();
-        /* v8 ignore start -- token refresh fields: populated when OAuth exchange succeeds @preserve */
-        if (credentials.refreshToken)
-            secrets.providers.anthropic.refreshToken = credentials.refreshToken;
-        if (credentials.expiresAt)
-            secrets.providers.anthropic.expiresAt = credentials.expiresAt;
-        /* v8 ignore stop */
-        return;
-    }
-    if (provider === "github-copilot") {
-        secrets.providers["github-copilot"].githubToken = credentials.githubToken.trim();
-        secrets.providers["github-copilot"].baseUrl = credentials.baseUrl.trim();
-        return;
-    }
-    if (provider === "openai-codex") {
-        secrets.providers["openai-codex"].oauthAccessToken = credentials.oauthAccessToken.trim();
-        return;
-    }
-    if (provider === "minimax") {
-        secrets.providers.minimax.apiKey = credentials.apiKey.trim();
-        return;
+    const target = secrets.providers[provider];
+    // Copy all non-empty credential fields to the provider's secrets block
+    for (const [key, value] of Object.entries(credentials)) {
+        /* v8 ignore next -- guard: skip null/empty fields from partial credential objects @preserve */
+        if (value != null && value !== "") {
+            target[key] = typeof value === "string" ? value.trim() : value;
+        }
     }
-    secrets.providers.azure.apiKey = credentials.apiKey.trim();
-    secrets.providers.azure.endpoint = credentials.endpoint.trim();
-    secrets.providers.azure.deployment = credentials.deployment.trim();
 }
 async function runRuntimeAuthFlow(input, deps = {}) {
     (0, runtime_1.emitNervesEvent)({

package/dist/heart/daemon/daemon-cli.js

@@ -561,20 +561,10 @@ function parseLinkCommand(args, kind = "friend.link") {
 function isAgentProvider(value) {
     return value === "azure" || value === "anthropic" || value === "minimax" || value === "openai-codex" || value === "github-copilot";
 }
-/* v8 ignore start -- hasStoredCredentials: per-provider branches tested via auth switch tests @preserve */
+/* v8 ignore next 3 -- only called from auth.switch inside integration block @preserve */
 function hasStoredCredentials(provider, providerSecrets) {
-    if (provider === "anthropic")
-        return !!providerSecrets.setupToken;
-    if (provider === "openai-codex")
-        return !!providerSecrets.oauthAccessToken;
-    if (provider === "github-copilot")
-        return !!providerSecrets.githubToken;
-    if (provider === "minimax")
-        return !!providerSecrets.apiKey;
-    // azure
-    return !!providerSecrets.endpoint && !!providerSecrets.apiKey;
+    return identity_1.PROVIDER_CREDENTIALS[provider].required.every((key) => !!providerSecrets[key]);
 }
-/* v8 ignore stop */
 /* v8 ignore start -- verifyProviderCredentials: delegates to pingProvider @preserve */
 async function verifyProviderCredentials(provider, providers) {
     const config = providers[provider];
@@ -1298,14 +1288,10 @@ function defaultEnsureDaemonBootPersistence(socketPath) {
         return;
     }
     const homeDir = os.homedir();
-    const launchdDeps = {
-        exec: (cmd) => { (0, child_process_1.execSync)(cmd, { stdio: "ignore" }); },
+    const writeDeps = {
         writeFile: (filePath, content) => fs.writeFileSync(filePath, content, "utf-8"),
-        removeFile: (filePath) => fs.rmSync(filePath, { force: true }),
-        existsFile: (filePath) => fs.existsSync(filePath),
         mkdirp: (dir) => fs.mkdirSync(dir, { recursive: true }),
         homeDir,
-        userUid: process.getuid?.() ?? 0,
     };
     const entryPath = path.join((0, identity_1.getRepoRoot)(), "dist", "heart", "daemon", "daemon-entry.js");
     /* v8 ignore next -- covered via mock in daemon-cli-defaults.test.ts; v8 on CI attributes the real fs.existsSync branch to the non-mock load @preserve */
@@ -1319,7 +1305,12 @@ function defaultEnsureDaemonBootPersistence(socketPath) {
         });
     }
     const logDir = (0, identity_1.getAgentDaemonLogsDir)();
-    (0, launchd_1.installLaunchAgent)(launchdDeps, {
+    // Write plist only — do NOT launchctl bootstrap.
+    // The daemon is already running (started by ouro up). Bootstrapping would
+    // start a SECOND daemon via launchd's RunAtLoad, causing a race where
+    // killOrphanProcesses kills the first daemon and both end up dead.
+    // The plist on disk is sufficient: launchd picks it up on login.
+    (0, launchd_1.writeLaunchAgentPlist)(writeDeps, {
         nodePath: process.execPath,
         entryPath,
         socketPath,
@@ -1378,17 +1369,16 @@ function discoverExistingCredentials(secretsRoot) {
         if (!parsed.providers)
             continue;
         for (const [provName, provConfig] of Object.entries(parsed.providers)) {
-            if (provName === "anthropic" && provConfig.setupToken) {
-                found.push({ agentName: entry.name, provider: "anthropic", credentials: { setupToken: provConfig.setupToken }, providerConfig: { ...provConfig } });
-            }
-            else if (provName === "openai-codex" && provConfig.oauthAccessToken) {
-                found.push({ agentName: entry.name, provider: "openai-codex", credentials: { oauthAccessToken: provConfig.oauthAccessToken }, providerConfig: { ...provConfig } });
-            }
-            else if (provName === "minimax" && provConfig.apiKey) {
-                found.push({ agentName: entry.name, provider: "minimax", credentials: { apiKey: provConfig.apiKey }, providerConfig: { ...provConfig } });
-            }
-            else if (provName === "azure" && provConfig.apiKey && provConfig.endpoint && provConfig.deployment) {
-                found.push({ agentName: entry.name, provider: "azure", credentials: { apiKey: provConfig.apiKey, endpoint: provConfig.endpoint, deployment: provConfig.deployment }, providerConfig: { ...provConfig } });
+            const desc = identity_1.PROVIDER_CREDENTIALS[provName];
+            /* v8 ignore next -- guard: unknown provider names in stored secrets @preserve */
+            if (!desc)
+                continue;
+            const hasRequired = desc.required.every((key) => !!provConfig[key]);
+            if (hasRequired) {
+                const credentials = {};
+                for (const key of Object.keys(provConfig))
+                    credentials[key] = provConfig[key];
+                found.push({ agentName: entry.name, provider: provName, credentials, providerConfig: { ...provConfig } });
             }
         }
     }
@@ -1432,33 +1422,27 @@ async function defaultRunSerpentGuide() {
             "github-copilot": "claude-sonnet-4.6",
             azure: "",
         };
-        // Scan environment variables for API keys
-        const envKeys = [
-            { provider: "anthropic", envVar: "ANTHROPIC_API_KEY", credKey: "setupToken" },
-            { provider: "openai-codex", envVar: "OPENAI_API_KEY", credKey: "oauthAccessToken" },
-            { provider: "azure", envVar: "AZURE_OPENAI_API_KEY", credKey: "apiKey" },
-            { provider: "azure", envVar: "AZURE_OPENAI_KEY", credKey: "apiKey" },
-            { provider: "minimax", envVar: "MINIMAX_API_KEY", credKey: "apiKey" },
-            { provider: "github-copilot", envVar: "GITHUB_TOKEN", credKey: "token" },
-        ];
+        // Scan environment variables for API keys using the canonical descriptor
         const envDiscovered = [];
-        for (const { provider, envVar, credKey } of envKeys) {
-            const value = process.env[envVar];
-            if (value) {
-                const envCred = { [credKey]: value };
-                // For Azure, also check for endpoint and deployment env vars
-                if (provider === "azure") {
-                    const endpoint = process.env.AZURE_OPENAI_ENDPOINT;
-                    const deployment = process.env.AZURE_OPENAI_DEPLOYMENT;
-                    if (endpoint)
-                        envCred.endpoint = endpoint;
-                    if (deployment)
-                        envCred.deployment = deployment;
+        for (const [provider, desc] of Object.entries(identity_1.PROVIDER_CREDENTIALS)) {
+            const envCred = {};
+            let firstEnvVar;
+            for (const [envVar, credKey] of Object.entries(desc.envVars)) {
+                const value = process.env[envVar];
+                if (value) {
+                    ;
+                    envCred[credKey] = value;
+                    if (!firstEnvVar)
+                        firstEnvVar = envVar;
                 }
+            }
+            // Only register if at least one required field was found
+            const hasRequired = desc.required.some((key) => !!envCred[key]);
+            if (hasRequired && firstEnvVar) {
                 const provCfg = { model: defaultModels[provider] };
                 if (provider === "azure" && envCred.deployment)
                     provCfg.deployment = envCred.deployment;
-                envDiscovered.push({ provider, agentName: "env", credentials: envCred, providerConfig: provCfg, envVar });
+                envDiscovered.push({ provider, agentName: "env", credentials: envCred, providerConfig: provCfg, envVar: firstEnvVar });
                 discovered.push({ provider, agentName: "env", credentials: envCred, providerConfig: provCfg });
             }
         }
@@ -1490,17 +1474,7 @@ async function defaultRunSerpentGuide() {
                 }
                 providerRaw = pRaw;
                 providerConfig = { model: defaultModels[providerRaw] };
-                if (providerRaw === "anthropic")
-                    credentials.setupToken = await coldPrompt("API key: ");
-                if (providerRaw === "openai-codex")
-                    credentials.oauthAccessToken = await coldPrompt("OAuth token: ");
-                if (providerRaw === "minimax")
-                    credentials.apiKey = await coldPrompt("API key: ");
-                if (providerRaw === "azure") {
-                    credentials.apiKey = await coldPrompt("API key: ");
-                    credentials.endpoint = await coldPrompt("endpoint: ");
-                    credentials.deployment = await coldPrompt("deployment: ");
-                }
+                credentials = await (0, auth_flow_1.collectRuntimeAuthCredentials)({ agentName: "SerpentGuide", provider: providerRaw, promptInput: coldPrompt }, {});
             }
         }
         else {
@@ -1514,17 +1488,7 @@ async function defaultRunSerpentGuide() {
             }
             providerRaw = pRaw;
             providerConfig = { model: defaultModels[providerRaw] };
-            if (providerRaw === "anthropic")
-                credentials.setupToken = await coldPrompt("API key: ");
-            if (providerRaw === "openai-codex")
-                credentials.oauthAccessToken = await coldPrompt("OAuth token: ");
-            if (providerRaw === "minimax")
-                credentials.apiKey = await coldPrompt("API key: ");
-            if (providerRaw === "azure") {
-                credentials.apiKey = await coldPrompt("API key: ");
-                credentials.endpoint = await coldPrompt("endpoint: ");
-                credentials.deployment = await coldPrompt("deployment: ");
-            }
+            credentials = await (0, auth_flow_1.collectRuntimeAuthCredentials)({ agentName: "SerpentGuide", provider: providerRaw, promptInput: coldPrompt }, {});
         }
         coldRl.close();
         process.stdout.write("\n");
@@ -1560,6 +1524,13 @@ async function defaultRunSerpentGuide() {
                 [providerRaw]: { ...providerConfig, ...credentials },
             },
         });
+        // Ping-verify credentials before entering the serpent guide session
+        const { pingProvider } = await Promise.resolve().then(() => __importStar(require("../provider-ping")));
+        const pingResult = await pingProvider(providerRaw, { ...providerConfig, ...credentials });
+        if (!pingResult.ok) {
+            process.stdout.write(`credentials didn't work (${pingResult.message}). run 'ouro hatch' to try again.\n`);
+            return null;
+        }
         const existingBundles = (0, specialist_orchestrator_1.listExistingBundles)(bundlesRoot);
         const systemPrompt = (0, specialist_prompt_1.buildSpecialistSystemPrompt)(soulText, identity.content, existingBundles, {
             tempDir,

package/dist/heart/daemon/hatch-flow.js

@@ -45,16 +45,7 @@ const auth_flow_1 = require("./auth-flow");
 const habit_parser_1 = require("./habit-parser");
 const hatch_specialist_1 = require("./hatch-specialist");
 function requiredCredentialKeys(provider) {
-    if (provider === "anthropic")
-        return ["setupToken"];
-    if (provider === "openai-codex")
-        return ["oauthAccessToken"];
-    /* v8 ignore next -- branch tested via requiredCredentialKeys unit test @preserve */
-    if (provider === "github-copilot")
-        return ["githubToken"];
-    if (provider === "minimax")
-        return ["apiKey"];
-    return ["apiKey", "endpoint", "deployment"];
+    return identity_1.PROVIDER_CREDENTIALS[provider].required;
 }
 function validateCredentials(provider, credentials) {
     const missing = requiredCredentialKeys(provider).filter((key) => {

package/dist/heart/daemon/process-manager.js

@@ -77,6 +77,7 @@ class DaemonProcessManager {
                 stopRequested: false,
                 cooldownTimer: null,
                 cooldownRetryCount: 0,
+                fastCrashCount: 0,
                 snapshot: {
                     name: agent.name,
                     channel: agent.channel,
@@ -141,6 +142,12 @@ class DaemonProcessManager {
             env: state.config.env ? { ...process.env, ...state.config.env } : process.env,
             stdio: ["ignore", "ignore", "ignore", "ipc"],
         });
+        /* v8 ignore next 7 -- defensive: spawn should always return a ChildProcess @preserve */
+        if (!child) {
+            state.snapshot.status = "crashed";
+            (0, runtime_1.emitNervesEvent)({ level: "error", component: "daemon", event: "daemon.agent_spawn_failed", message: "spawn returned null", meta: { agent } });
+            return;
+        }
         state.process = child;
         state.snapshot.status = "running";
         state.snapshot.pid = child.pid ?? null;
@@ -251,6 +258,29 @@ class DaemonProcessManager {
             return;
         }
         state.snapshot.lastCrashAt = new Date(now).toISOString();
+        // Fast-crash detection: if the agent dies within 5 seconds of starting, it's likely
+        // a configuration issue (missing credentials, bad provider, etc.) not a transient failure.
+        // After 3 consecutive fast crashes, stop retrying and mark as config-failed.
+        const FAST_CRASH_THRESHOLD_MS = 5000;
+        const FAST_CRASH_MAX = 3;
+        if (runDuration < FAST_CRASH_THRESHOLD_MS) {
+            state.fastCrashCount = state.fastCrashCount + 1;
+            if (state.fastCrashCount >= FAST_CRASH_MAX) {
+                state.snapshot.status = "crashed";
+                (0, runtime_1.emitNervesEvent)({
+                    level: "error",
+                    component: "daemon",
+                    event: "daemon.agent_config_failure",
+                    message: `agent crashed ${FAST_CRASH_MAX} times within ${FAST_CRASH_THRESHOLD_MS}ms of startup — likely a configuration issue (missing credentials, bad provider). Not retrying. Fix the config and run \`ouro up\` to restart.`,
+                    meta: { agent: state.config.name, fastCrashCount: state.fastCrashCount, avgRunDurationMs: runDuration },
+                });
+                return; // Don't schedule cooldown recovery — this needs human/agent intervention
+            }
+        }
+        else {
+            // Reset fast-crash counter on a stable run
+            state.fastCrashCount = 0;
+        }
         state.crashTimestamps = state.crashTimestamps.filter((crashTs) => crashTs >= startOfHour(now));
         state.crashTimestamps.push(now);
         if (state.crashTimestamps.length > this.maxRestartsPerHour) {

package/dist/heart/identity.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HARNESS_CANONICAL_REPO_URL = exports.PROVIDER_CREDENTIALS = exports.DEFAULT_AGENT_SENSES = exports.DEFAULT_AGENT_PHRASES = exports.DEFAULT_AGENT_CONTEXT = void 0;
+exports.HARNESS_CANONICAL_REPO_URL = exports.DEFAULT_AGENT_SENSES = exports.DEFAULT_AGENT_PHRASES = exports.DEFAULT_AGENT_CONTEXT = exports.PROVIDER_CREDENTIALS = void 0;
 exports.buildDefaultAgentTemplate = buildDefaultAgentTemplate;
 exports.getAgentName = getAgentName;
 exports.getRepoRoot = getRepoRoot;
@@ -57,6 +57,14 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const runtime_1 = require("../nerves/runtime");
 const migrate_config_1 = require("./migrate-config");
+/** Single source of truth for per-provider credential field names, env var mappings, and prompt labels. */
+exports.PROVIDER_CREDENTIALS = {
+    anthropic: { required: ["setupToken"], envVars: { ANTHROPIC_API_KEY: "setupToken" }, promptLabels: { setupToken: "Anthropic setup-token" } },
+    "openai-codex": { required: ["oauthAccessToken"], envVars: { OPENAI_API_KEY: "oauthAccessToken" }, promptLabels: { oauthAccessToken: "OpenAI Codex OAuth token" } },
+    azure: { required: ["apiKey", "endpoint", "deployment"], envVars: { AZURE_OPENAI_API_KEY: "apiKey", AZURE_OPENAI_KEY: "apiKey", AZURE_OPENAI_ENDPOINT: "endpoint", AZURE_OPENAI_DEPLOYMENT: "deployment" }, promptLabels: { apiKey: "Azure API key", endpoint: "Azure endpoint", deployment: "Azure deployment" } },
+    minimax: { required: ["apiKey"], envVars: { MINIMAX_API_KEY: "apiKey" }, promptLabels: { apiKey: "MiniMax API key" } },
+    "github-copilot": { required: ["githubToken", "baseUrl"], envVars: { GH_TOKEN: "githubToken", GITHUB_TOKEN: "githubToken" }, promptLabels: { githubToken: "GitHub token" } },
+};
 exports.DEFAULT_AGENT_CONTEXT = {
     maxTokens: 80000,
     contextMargin: 20,
@@ -208,17 +216,6 @@ function resolveOptionalAgentName(agentName) {
 function getAgentStateRoot(agentName) {
     return path.join(getAgentRoot(resolveOptionalAgentName(agentName)), "state");
 }
-/**
- * Required credential fields per provider.
- * Used by daemon config-check to validate secrets before spawning an agent.
- */
-exports.PROVIDER_CREDENTIALS = {
-    azure: ["apiKey", "endpoint", "deployment"],
-    minimax: ["apiKey"],
-    anthropic: ["setupToken"],
-    "openai-codex": ["oauthAccessToken"],
-    "github-copilot": ["githubToken", "baseUrl"],
-};
 exports.HARNESS_CANONICAL_REPO_URL = "https://github.com/ouroborosbot/ouroboros.git";
 function getAgentRepoWorkspacesRoot(agentName) {
     return path.join(getAgentStateRoot(resolveOptionalAgentName(agentName)), "workspaces");

package/dist/heart/provider-ping.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.sanitizeErrorMessage = sanitizeErrorMessage;
 exports.pingProvider = pingProvider;
 exports.runHealthInventory = runHealthInventory;
+const identity_1 = require("./identity");
 const anthropic_1 = require("./providers/anthropic");
 const azure_1 = require("./providers/azure");
 const minimax_1 = require("./providers/minimax");
@@ -42,25 +43,8 @@ function sanitizeErrorMessage(message) {
     return message;
 }
 function hasEmptyCredentials(provider, config) {
-    switch (provider) {
-        case "anthropic":
-            return !config.setupToken;
-        case "openai-codex":
-            return !config.oauthAccessToken;
-        case "minimax":
-            return !config.apiKey;
-        case "azure": {
-            const azure = config;
-            return !(azure.apiKey && azure.endpoint && azure.deployment);
-        }
-        case "github-copilot": {
-            const copilot = config;
-            return !(copilot.githubToken && copilot.baseUrl);
-        }
-        /* v8 ignore next 2 -- exhaustive: all providers handled above @preserve */
-        default:
-            return true;
-    }
+    const record = config;
+    return identity_1.PROVIDER_CREDENTIALS[provider].required.some((key) => !record[key]);
 }
 function createRuntimeForPing(provider, _config) {
     // The provider constructors read credentials from the active config via getXxxConfig().

package/dist/senses/cli/ouro-tui.js

@@ -151,6 +151,11 @@ function InputArea({ onSubmit, onCtrlC, history, agentName, model }) {
     const cursorRef = (0, react_1.useRef)(0);
     const historyIdx = (0, react_1.useRef)(-1);
     const savedInput = (0, react_1.useRef)("");
+    const tooltipTimerRef = (0, react_1.useRef)(null);
+    (0, react_1.useEffect)(() => () => {
+        if (tooltipTimerRef.current)
+            clearTimeout(tooltipTimerRef.current);
+    }, []);
     // Helper: update input and cursor together
     const updateInput = (text, pos) => {
         inputRef.current = text;
@@ -174,7 +179,9 @@ function InputArea({ onSubmit, onCtrlC, history, agentName, model }) {
         else if (action === "warn") {
             // tooltip handled below
             setTooltip("Ctrl-C again to exit");
-            setTimeout(() => setTooltip(""), 3000);
+            if (tooltipTimerRef.current)
+                clearTimeout(tooltipTimerRef.current);
+            tooltipTimerRef.current = setTimeout(() => setTooltip(""), 3000);
         }
         // "abort" and "exit" are handled by the parent (cli.ts)
     }, [onCtrlC]);
@@ -191,7 +198,9 @@ function InputArea({ onSubmit, onCtrlC, history, agentName, model }) {
                 updateInput("");
                 historyIdx.current = -1;
                 setTooltip("Esc again to clear");
-                setTimeout(() => setTooltip(""), 2000);
+                if (tooltipTimerRef.current)
+                    clearTimeout(tooltipTimerRef.current);
+                tooltipTimerRef.current = setTimeout(() => setTooltip(""), 2000);
             }
             else {
                 setTooltip("");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.200",
+  "version": "0.1.0-alpha.202",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",