@ouro.bot/cli 0.1.0-alpha.237 → 0.1.0-alpha.239

package/changelog.json

@@ -2,7 +2,14 @@
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
     {
-      "version": "0.1.0-alpha.237",
+      "version": "0.1.0-alpha.239",
+      "changes": [
+        "fix(friends): stable local CLI identity \u2014 dropped hostname from external ID (was `username@hostname`, now just `username`). macOS hostname instability (`Mac` vs `Aris-MacBook-Pro.local`) was creating duplicate friend records with separate sessions and trust levels.",
+        "feat(friends): migration fallback \u2014 FriendResolver now searches for old `username@*` format IDs when exact match fails, linking new stable ID to existing friend record."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.238",
       "changes": [
         "feat: pretty `ouro status` \u2014 ANSI colored output with box-drawing header, status dots, grouped senses/workers by agent. Added git sync info to overview.",
         "fix: socket half-close \u2014 sendDaemonCommand now calls client.end() after writing, preventing intermittent connection hangs.",

package/dist/heart/hatch/hatch-flow.js

@@ -91,7 +91,7 @@ function writeFriendImprint(bundleRoot, humanName, now) {
     fs.mkdirSync(friendsDir, { recursive: true });
     const nowIso = now.toISOString();
     const id = `friend-${(0, config_1.slugify)(humanName) || "friend"}`;
-    const localExternalId = `${os.userInfo().username}@${os.hostname()}`;
+    const localExternalId = os.userInfo().username;
     const record = {
         id,
         name: humanName,

package/dist/mind/friends/resolver.js

@@ -31,6 +31,42 @@ class FriendResolver {
         }
         if (existing)
             return existing;
+        // Migration: local provider previously used "${username}@${hostname}" format.
+        // If no exact match, try finding a friend with old-format external ID.
+        /* v8 ignore start -- one-time migration: hostname→username format, tested manually @preserve */
+        if (this.params.provider === "local" && !this.params.externalId.includes("@")) {
+            try {
+                const all = typeof this.store.listAll === "function" ? await this.store.listAll() : [];
+                const migrationMatch = all.find((f) => f.externalIds.some((eid) => eid.provider === "local" && eid.externalId.startsWith(this.params.externalId + "@")));
+                if (migrationMatch) {
+                    // Link the new external ID format to the existing friend
+                    const now = new Date().toISOString();
+                    migrationMatch.externalIds.push({
+                        provider: this.params.provider,
+                        externalId: this.params.externalId,
+                        linkedAt: now,
+                    });
+                    migrationMatch.updatedAt = now;
+                    try {
+                        await this.store.put(migrationMatch.id, migrationMatch);
+                    }
+                    catch {
+                        // best-effort persist
+                    }
+                    (0, runtime_1.emitNervesEvent)({
+                        component: "friends",
+                        event: "friends.local_id_migrated",
+                        message: `migrated local friend identity from hostname format to username-only`,
+                        meta: { friendId: migrationMatch.id, newExternalId: this.params.externalId },
+                    });
+                    return migrationMatch;
+                }
+            }
+            catch {
+                // fall through to create new
+            }
+        }
+        /* v8 ignore stop */
         // First encounter -- create new FriendRecord
         const now = new Date().toISOString();
         const externalId = {

package/dist/nerves/coverage/file-completeness.js

@@ -67,6 +67,8 @@ const DISPATCH_EXEMPT_PATTERNS = [
     "repertoire/api-client",
     "repertoire/github-client",
     "mind/embedding-provider",
+    // Commerce utility module: error classes and pure helpers (no independent side effects).
+    "repertoire/commerce-errors",
 ];
 function isDispatchExempt(filePath) {
     return DISPATCH_EXEMPT_PATTERNS.some((pattern) => filePath.includes(pattern));

package/dist/repertoire/bitwarden-store.js

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.BitwardenCredentialStore = void 0;
 const node_child_process_1 = require("node:child_process");
 const runtime_1 = require("../nerves/runtime");
+const bw_installer_1 = require("./bw-installer");
 // ---------------------------------------------------------------------------
 // bw CLI wrapper
 // ---------------------------------------------------------------------------
@@ -76,6 +77,8 @@ class BitwardenCredentialStore {
      * Retries transient failures (network/timeout) up to MAX_RETRIES with exponential backoff.
      */
     async login() {
+        // Ensure bw CLI is installed before any bw commands
+        await (0, bw_installer_1.ensureBwCli)();
         let lastError;
         for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
             try {

package/dist/repertoire/bw-installer.js

@@ -0,0 +1,79 @@
+"use strict";
+/**
+ * Lazy bw CLI installer — auto-installs the Bitwarden CLI when not present.
+ *
+ * Mirrors the whisper-cpp pattern in senses/bluebubbles/media.ts:
+ * check PATH first, install via npm if missing, emit nerves event.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureBwCli = ensureBwCli;
+const node_child_process_1 = require("node:child_process");
+const runtime_1 = require("../nerves/runtime");
+const INSTALL_TIMEOUT_MS = 120_000;
+const WHICH_TIMEOUT_MS = 5_000;
+function execFileAsync(cmd, args, timeout) {
+    return new Promise((resolve, reject) => {
+        (0, node_child_process_1.execFile)(cmd, args, { timeout }, (err, stdout) => {
+            if (err) {
+                reject(err);
+                return;
+            }
+            resolve(stdout);
+        });
+    });
+}
+/**
+ * Ensure the `bw` CLI is available, installing it via npm if needed.
+ * Returns the path to the `bw` binary.
+ */
+async function ensureBwCli() {
+    // 1. Check if bw is already in PATH
+    try {
+        const existing = (await execFileAsync("which", ["bw"], WHICH_TIMEOUT_MS)).trim();
+        if (existing) {
+            return existing;
+        }
+    }
+    catch {
+        // Not found — fall through to install
+    }
+    // 2. Install via npm
+    (0, runtime_1.emitNervesEvent)({
+        event: "repertoire.bw_cli_install_start",
+        component: "repertoire",
+        message: "bw CLI not found, installing via npm",
+        meta: {},
+    });
+    try {
+        await execFileAsync("npm", ["install", "-g", "@bitwarden/cli"], INSTALL_TIMEOUT_MS);
+    }
+    catch (err) {
+        /* v8 ignore next -- execFileCb always throws Error instances @preserve */
+        const reason = err instanceof Error ? err.message : String(err);
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            event: "repertoire.bw_cli_install_fail",
+            component: "repertoire",
+            message: "failed to install bw CLI via npm",
+            meta: { reason },
+        });
+        throw new Error(`failed to install bw CLI via npm: ${reason}`);
+    }
+    // 3. Verify installation and return path
+    try {
+        const installed = (await execFileAsync("which", ["bw"], WHICH_TIMEOUT_MS)).trim();
+        if (installed) {
+            (0, runtime_1.emitNervesEvent)({
+                event: "repertoire.bw_cli_install_end",
+                component: "repertoire",
+                message: "bw CLI installed successfully",
+                meta: { path: installed },
+            });
+            return installed;
+        }
+    }
+    catch {
+        // Fall through to error
+    }
+    throw new Error("bw CLI installed via npm but binary not found in PATH");
+}

package/dist/repertoire/commerce-errors.js

@@ -0,0 +1,109 @@
+"use strict";
+/**
+ * Commerce-specific error types and helpers.
+ *
+ * These errors carry structured `code` and `meta` fields for nerves event
+ * compatibility and provide patterns for common commerce failure modes:
+ * retry, price change detection, and partial failure reporting.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProfileError = exports.BookingError = exports.PaymentError = exports.CommerceError = void 0;
+exports.retryOnce = retryOnce;
+exports.priceChangeGuard = priceChangeGuard;
+exports.partialFailureReport = partialFailureReport;
+// ---------------------------------------------------------------------------
+// Error types
+// ---------------------------------------------------------------------------
+class CommerceError extends Error {
+    code;
+    meta;
+    constructor(message, code, meta = {}) {
+        super(message);
+        this.name = "CommerceError";
+        this.code = code;
+        this.meta = meta;
+    }
+}
+exports.CommerceError = CommerceError;
+class PaymentError extends CommerceError {
+    constructor(message, code, meta = {}) {
+        super(message, code, meta);
+        this.name = "PaymentError";
+    }
+}
+exports.PaymentError = PaymentError;
+class BookingError extends CommerceError {
+    constructor(message, code, meta = {}) {
+        super(message, code, meta);
+        this.name = "BookingError";
+    }
+}
+exports.BookingError = BookingError;
+class ProfileError extends CommerceError {
+    constructor(message, code, meta = {}) {
+        super(message, code, meta);
+        this.name = "ProfileError";
+    }
+}
+exports.ProfileError = ProfileError;
+// ---------------------------------------------------------------------------
+// Transient error detection
+// ---------------------------------------------------------------------------
+const TRANSIENT_CODES = new Set(["COMMERCE_TRANSIENT", "COMMERCE_TIMEOUT", "COMMERCE_NETWORK"]);
+function isTransient(err) {
+    return err instanceof CommerceError && TRANSIENT_CODES.has(err.code);
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Retry a function once on transient failure, then throw.
+ * Non-transient errors are thrown immediately without retry.
+ */
+async function retryOnce(fn) {
+    try {
+        return await fn();
+    }
+    catch (err) {
+        if (!isTransient(err))
+            throw err;
+        // One retry
+        return fn();
+    }
+}
+/**
+ * Throw PaymentError if the actual price differs from the approved price
+ * by more than 5%. Used to protect against price changes between search
+ * and booking.
+ */
+function priceChangeGuard(approved, actual) {
+    if (approved === 0 && actual === 0)
+        return;
+    if (approved === 0) {
+        throw new PaymentError(`price changed from $0 to $${actual} — cannot verify percentage change`, "PAYMENT_PRICE_CHANGED", { approved, actual });
+    }
+    const delta = Math.abs(actual - approved) / approved;
+    if (delta > 0.05) {
+        throw new PaymentError(`price changed by ${(delta * 100).toFixed(1)}% (approved: $${approved}, actual: $${actual})`, "PAYMENT_PRICE_CHANGED", { approved, actual, deltaPercent: delta * 100 });
+    }
+}
+/**
+ * Format a human-readable status report for multi-service booking attempts.
+ * Each entry has a service name, status, and optional error message.
+ */
+function partialFailureReport(results) {
+    if (results.length === 0) {
+        return "no services attempted.";
+    }
+    const lines = results.map((r) => {
+        const status = r.status === "success" ? "success" : "failed";
+        const detail = r.error ? ` — ${r.error}` : "";
+        return `  ${r.service}: ${status}${detail}`;
+    });
+    const succeeded = results.filter((r) => r.status === "success").length;
+    const failed = results.length - succeeded;
+    return [
+        `booking status: ${succeeded} succeeded, ${failed} failed`,
+        ...lines,
+    ].join("\n");
+}

package/dist/repertoire/commerce-self-test.js

@@ -0,0 +1,156 @@
+"use strict";
+/**
+ * Commerce self-test — per-service health checks for the agent's
+ * commerce infrastructure (Stripe, Duffel, LiteAPI).
+ *
+ * Used by the setup wizard to verify configuration and provide
+ * actionable error messages when services are misconfigured.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.commerceSelfTest = commerceSelfTest;
+const stripe_client_1 = require("./stripe-client");
+const duffel_client_1 = require("./duffel-client");
+const credential_access_1 = require("./credential-access");
+const runtime_1 = require("../nerves/runtime");
+// ---------------------------------------------------------------------------
+// Per-service tests
+// ---------------------------------------------------------------------------
+async function testStripe() {
+    try {
+        const client = await (0, stripe_client_1.createStripeClient)();
+        // Create a test card and immediately deactivate it
+        const card = await client.createVirtualCard({
+            type: "single_use",
+            spendLimit: 1,
+            currency: "usd",
+        });
+        await client.deactivateCard(card.cardId);
+        return { status: "ok", message: "Stripe Issuing working. Test card created and deactivated." };
+    }
+    catch (err) {
+        /* v8 ignore next -- reason @preserve */
+        const reason = err instanceof Error ? err.message : String(err);
+        if (reason.includes("no credential found") || reason.includes("restrictedKey")) {
+            return {
+                status: "error",
+                message: `Stripe key missing. Add your restricted key at https://dashboard.stripe.com/apikeys and store it in the vault as stripe.com/restrictedKey.`,
+            };
+        }
+        if (reason.includes("401") || reason.includes("Invalid API Key")) {
+            return {
+                status: "error",
+                message: `Stripe key returned 401. Verify it at https://dashboard.stripe.com/apikeys.`,
+            };
+        }
+        return {
+            status: "error",
+            message: `Stripe error: ${reason}`,
+        };
+    }
+}
+async function testDuffel() {
+    try {
+        const client = await (0, duffel_client_1.createDuffelClient)();
+        await client.searchFlights({
+            origin: "SFO",
+            destination: "JFK",
+            departureDate: new Date(Date.now() + 30 * 86400000).toISOString().split("T")[0],
+            passengers: [{ type: "adult" }],
+        });
+        return { status: "ok", message: "Duffel Flights working. Test search completed." };
+    }
+    catch (err) {
+        /* v8 ignore next -- reason @preserve */
+        const reason = err instanceof Error ? err.message : String(err);
+        if (reason.includes("no credential found") || reason.includes("apiKey")) {
+            return {
+                status: "error",
+                message: `Duffel key missing. Add your API key from https://app.duffel.com/tokens and store it in the vault as duffel.com/apiKey.`,
+            };
+        }
+        if (reason.includes("401") || reason.includes("Unauthorized")) {
+            return {
+                status: "error",
+                message: `Your Duffel key returned 401. Verify it at https://app.duffel.com/tokens.`,
+            };
+        }
+        return {
+            status: "error",
+            message: `Duffel error: ${reason}`,
+        };
+    }
+}
+async function testLiteApi() {
+    try {
+        const store = (0, credential_access_1.getCredentialStore)();
+        await store.getRawSecret("liteapi.travel", "apiKey");
+        // If we can retrieve the key, the config is present.
+        // LiteAPI is accessed via MCP, so we can't do a direct API call here.
+        // The actual health check happens when the MCP server starts.
+        return { status: "ok", message: "LiteAPI key found in vault. MCP server will use vault:liteapi.travel/apiKey." };
+    }
+    catch (err) {
+        /* v8 ignore next -- reason @preserve */
+        const reason = err instanceof Error ? err.message : String(err);
+        if (reason.includes("no credential found")) {
+            return {
+                status: "error",
+                message: `LiteAPI key missing. Get your API key from https://dashboard.liteapi.travel and store it in the vault as liteapi.travel/apiKey.`,
+            };
+        }
+        return {
+            status: "error",
+            message: `LiteAPI error: ${reason}`,
+        };
+    }
+}
+// ---------------------------------------------------------------------------
+// Main self-test
+// ---------------------------------------------------------------------------
+async function commerceSelfTest() {
+    (0, runtime_1.emitNervesEvent)({
+        component: "repertoire",
+        event: "repertoire.commerce_self_test_start",
+        message: "starting commerce self-test",
+        meta: {},
+    });
+    const [stripe, duffel, liteapi] = await Promise.all([
+        testStripe(),
+        testDuffel(),
+        testLiteApi(),
+    ]);
+    const services = { stripe, duffel, liteapi };
+    const okCount = Object.values(services).filter((s) => s.status === "ok").length;
+    const total = Object.keys(services).length;
+    let overall;
+    if (okCount === total) {
+        overall = "healthy";
+    }
+    else if (okCount > 0) {
+        overall = "partial";
+    }
+    else {
+        overall = "unhealthy";
+    }
+    const lines = [];
+    if (stripe.status === "ok")
+        lines.push("Stripe: working");
+    else
+        lines.push(`Stripe: ${stripe.message}`);
+    if (duffel.status === "ok")
+        lines.push("Duffel: working");
+    else
+        lines.push(`Duffel: ${duffel.message}`);
+    if (liteapi.status === "ok")
+        lines.push("LiteAPI: working");
+    else
+        lines.push(`LiteAPI: ${liteapi.message}`);
+    const summary = `Commerce health: ${okCount}/${total} services ok.\n${lines.join("\n")}`;
+    (0, runtime_1.emitNervesEvent)({
+        component: "repertoire",
+        event: "repertoire.commerce_self_test_end",
+        message: "commerce self-test complete",
+        meta: { overall, okCount, total },
+    });
+    return { overall, services, summary };
+}

package/dist/repertoire/credential-access.js

@@ -45,6 +45,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AacCredentialStore = exports.BuiltInCredentialStore = void 0;
 exports.domainToSlug = domainToSlug;
+exports.ensureVaultDefaults = ensureVaultDefaults;
 exports.getCredentialStore = getCredentialStore;
 exports.resetCredentialStore = resetCredentialStore;
 const crypto = __importStar(require("node:crypto"));
@@ -415,6 +416,37 @@ exports.AacCredentialStore = AacCredentialStore;
 // Singleton + auto-detection
 // ---------------------------------------------------------------------------
 let _store = null;
+/**
+ * Auto-add vault defaults to agent.json when no vault section exists.
+ * Returns the vault config (either existing or freshly written defaults).
+ */
+function ensureVaultDefaults(agentName, agentRoot, existingVault) {
+    if (existingVault) {
+        return existingVault;
+    }
+    const configPath = path.join(agentRoot, "agent.json");
+    let raw;
+    try {
+        raw = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+    }
+    catch {
+        // agent.json unreadable — cannot auto-configure
+        return undefined;
+    }
+    const defaults = {
+        email: `${agentName}@ouro.bot`,
+        serverUrl: "https://vault.ouro.bot",
+    };
+    raw.vault = defaults;
+    fs.writeFileSync(configPath, JSON.stringify(raw, null, 2) + "\n", "utf-8");
+    (0, runtime_1.emitNervesEvent)({
+        event: "repertoire.vault_defaults_auto_configured",
+        component: "repertoire",
+        message: "auto-configured vault defaults in agent.json",
+        meta: { agentName, email: defaults.email, serverUrl: defaults.serverUrl },
+    });
+    return defaults;
+}
 /**
  * Get the credential store singleton.
  *
@@ -433,16 +465,19 @@ function getCredentialStore() {
         // Dynamic import to avoid circular dependency at module level
         const identity = require("../heart/identity");
         agentName = identity.getAgentName();
+        const agentRoot = identity.getAgentRoot(agentName);
         // Try to load vault config from agent.json + secrets.json
         const config = identity.loadAgentConfig?.();
-        const vaultConfig = identity.resolveVaultConfig?.(agentName, config?.vault);
+        // Auto-configure vault defaults if missing
+        const vaultSection = ensureVaultDefaults(agentName, agentRoot, config?.vault);
+        const vaultConfig = identity.resolveVaultConfig?.(agentName, vaultSection);
         const secretsPath = identity.getAgentSecretsPath?.(agentName);
         let vaultSecrets;
         /* v8 ignore start -- requires real agent secrets.json + vault config + bw CLI @preserve */
         if (secretsPath) {
             try {
-                const fs = require("fs");
-                const secrets = JSON.parse(fs.readFileSync(secretsPath, "utf-8"));
+                const fsSync = require("fs");
+                const secrets = JSON.parse(fsSync.readFileSync(secretsPath, "utf-8"));
                 vaultSecrets = secrets.vault;
             }
             catch {