@ouro.bot/cli 0.1.0-alpha.345 → 0.1.0-alpha.346

package/changelog.json

@@ -1,6 +1,12 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.346",
+      "changes": [
+        "Effective provider bindings now have a shared resolver primitive that reads machine-local `state/providers.json`, summarizes machine-wide credential provenance from `~/.agentsecrets/providers.json` without exposing secrets, maps legacy facing names to lane names, and marks readiness stale when provider/model or credential revisions change."
+      ]
+    },
     {
       "version": "0.1.0-alpha.345",
       "changes": [

package/dist/heart/provider-binding-resolver.js

@@ -0,0 +1,240 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeProviderLane = normalizeProviderLane;
+exports.resolveEffectiveProviderBinding = resolveEffectiveProviderBinding;
+const runtime_1 = require("../nerves/runtime");
+const provider_credential_pool_1 = require("./provider-credential-pool");
+const provider_state_1 = require("./provider-state");
+function legacyLaneWarning(selector, lane) {
+    return {
+        code: "legacy-lane-selector",
+        message: `${selector} is legacy provider wording; using ${lane} lane`,
+    };
+}
+function normalizeProviderLane(selector) {
+    switch (selector) {
+        case "outward":
+            return { lane: "outward", warnings: [] };
+        case "inner":
+            return { lane: "inner", warnings: [] };
+        case "human":
+        case "humanFacing":
+            return { lane: "outward", warnings: [legacyLaneWarning(selector, "outward")] };
+        case "agent":
+        case "agentFacing":
+            return { lane: "inner", warnings: [legacyLaneWarning(selector, "inner")] };
+    }
+}
+function buildUseRepair(agentName, lane, force = false) {
+    return {
+        command: `ouro use --agent ${agentName} --lane ${lane} --provider <provider> --model <model>${force ? " --force" : ""}`,
+        message: force
+            ? `Rewrite this machine's ${lane} provider binding for ${agentName}.`
+            : `Choose the provider/model this machine should use for ${agentName}'s ${lane} lane.`,
+    };
+}
+function buildAuthRepair(agentName, provider) {
+    return {
+        command: `ouro auth --agent ${agentName} --provider ${provider}`,
+        message: `Authenticate ${provider} once for this machine's shared credential pool.`,
+    };
+}
+function missingProviderStateWarning(agentName) {
+    return {
+        code: "provider-state-missing",
+        message: `No local provider binding exists for ${agentName} on this machine.`,
+    };
+}
+function invalidProviderStateWarning(agentName) {
+    return {
+        code: "provider-state-invalid",
+        message: `Local provider binding state for ${agentName} is invalid.`,
+    };
+}
+function missingCredentialWarning(provider) {
+    return {
+        code: "credential-missing",
+        message: `${provider} has no credential record in the machine credential pool.`,
+    };
+}
+function invalidCredentialPoolWarning(provider) {
+    return {
+        code: "credential-pool-invalid",
+        message: `${provider} cannot read credentials because the machine credential pool is invalid.`,
+    };
+}
+function presentCredential(record) {
+    return {
+        status: "present",
+        provider: record.provider,
+        revision: record.revision,
+        source: record.provenance.source,
+        contributedByAgent: record.provenance.contributedByAgent,
+        updatedAt: record.updatedAt,
+        credentialFields: Object.keys(record.credentials).sort(),
+        configFields: Object.keys(record.config).sort(),
+    };
+}
+function resolveCredential(poolResult, provider, agentName) {
+    if (poolResult.ok) {
+        const record = poolResult.pool.providers[provider];
+        if (record)
+            return { credential: presentCredential(record), warnings: [] };
+        return {
+            credential: {
+                status: "missing",
+                provider,
+                poolPath: poolResult.poolPath,
+                repair: buildAuthRepair(agentName, provider),
+            },
+            warnings: [missingCredentialWarning(provider)],
+        };
+    }
+    if (poolResult.reason === "invalid") {
+        return {
+            credential: {
+                status: "invalid-pool",
+                provider,
+                poolPath: poolResult.poolPath,
+                error: poolResult.error,
+                repair: buildAuthRepair(agentName, provider),
+            },
+            warnings: [invalidCredentialPoolWarning(provider)],
+        };
+    }
+    return {
+        credential: {
+            status: "missing",
+            provider,
+            poolPath: poolResult.poolPath,
+            repair: buildAuthRepair(agentName, provider),
+        },
+        warnings: [missingCredentialWarning(provider)],
+    };
+}
+function readinessFromState(readiness) {
+    return {
+        status: readiness.status,
+        checkedAt: readiness.checkedAt,
+        credentialRevision: readiness.credentialRevision,
+        error: readiness.error,
+        attempts: readiness.attempts,
+    };
+}
+function staleReadiness(readiness, reason) {
+    return {
+        ...readinessFromState(readiness),
+        status: "stale",
+        previousStatus: readiness.status,
+        reason,
+    };
+}
+function resolveReadiness(input) {
+    if (!input.readiness) {
+        if (input.credential.status === "missing") {
+            return { readiness: { status: "unknown", reason: "credential-missing" }, warnings: [] };
+        }
+        if (input.credential.status === "invalid-pool") {
+            return { readiness: { status: "unknown", reason: "credential-pool-invalid" }, warnings: [] };
+        }
+        return { readiness: { status: "unknown" }, warnings: [] };
+    }
+    if (input.readiness.provider !== input.provider || input.readiness.model !== input.model) {
+        return {
+            readiness: staleReadiness(input.readiness, "provider-model-changed"),
+            warnings: [{
+                    code: "readiness-stale",
+                    message: `${input.provider}/${input.model} readiness is stale because the last check was for ${input.readiness.provider}/${input.readiness.model}.`,
+                }],
+        };
+    }
+    if (input.credential.status === "present"
+        && input.readiness.credentialRevision !== undefined
+        && input.readiness.credentialRevision !== input.credential.revision) {
+        return {
+            readiness: staleReadiness(input.readiness, "credential-revision-changed"),
+            warnings: [{
+                    code: "readiness-stale",
+                    message: `${input.provider}/${input.model} readiness is stale because credential revision changed from ${input.readiness.credentialRevision} to ${input.credential.revision}.`,
+                }],
+        };
+    }
+    if (input.credential.status === "missing") {
+        return {
+            readiness: staleReadiness(input.readiness, "credential-missing"),
+            warnings: [],
+        };
+    }
+    if (input.credential.status === "invalid-pool") {
+        return {
+            readiness: staleReadiness(input.readiness, "credential-pool-invalid"),
+            warnings: [],
+        };
+    }
+    return { readiness: readinessFromState(input.readiness), warnings: [] };
+}
+function resolveEffectiveProviderBinding(input) {
+    const laneResolution = normalizeProviderLane(input.lane);
+    const stateResult = (0, provider_state_1.readProviderState)(input.agentRoot);
+    if (!stateResult.ok) {
+        const reason = stateResult.reason === "missing" ? "provider-state-missing" : "provider-state-invalid";
+        const stateWarning = stateResult.reason === "missing"
+            ? missingProviderStateWarning(input.agentName)
+            : invalidProviderStateWarning(input.agentName);
+        const result = {
+            ok: false,
+            lane: laneResolution.lane,
+            reason,
+            statePath: stateResult.statePath,
+            warnings: [...laneResolution.warnings, stateWarning],
+            repair: buildUseRepair(input.agentName, laneResolution.lane, stateResult.reason === "invalid"),
+        };
+        (0, runtime_1.emitNervesEvent)({
+            component: "config/identity",
+            event: "config.provider_binding_resolution_failed",
+            message: "provider binding resolution failed",
+            meta: { agentName: input.agentName, lane: laneResolution.lane, reason },
+        });
+        return result;
+    }
+    const laneBinding = stateResult.state.lanes[laneResolution.lane];
+    const poolResult = (0, provider_credential_pool_1.readProviderCredentialPool)(input.homeDir);
+    const credentialResult = resolveCredential(poolResult, laneBinding.provider, input.agentName);
+    const readinessResult = resolveReadiness({
+        provider: laneBinding.provider,
+        model: laneBinding.model,
+        readiness: stateResult.state.readiness[laneResolution.lane],
+        credential: credentialResult.credential,
+    });
+    const warnings = [
+        ...laneResolution.warnings,
+        ...credentialResult.warnings,
+        ...readinessResult.warnings,
+    ];
+    const binding = {
+        lane: laneResolution.lane,
+        provider: laneBinding.provider,
+        model: laneBinding.model,
+        source: laneBinding.source,
+        machineId: stateResult.state.machineId,
+        statePath: stateResult.statePath,
+        credential: credentialResult.credential,
+        readiness: readinessResult.readiness,
+        warnings,
+    };
+    (0, runtime_1.emitNervesEvent)({
+        component: "config/identity",
+        event: "config.provider_binding_resolved",
+        message: "resolved effective provider binding",
+        meta: {
+            agentName: input.agentName,
+            lane: binding.lane,
+            provider: binding.provider,
+            model: binding.model,
+            credentialStatus: binding.credential.status,
+            readinessStatus: binding.readiness.status,
+            warningCount: warnings.length,
+        },
+    });
+    return { ok: true, binding };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.345",
+  "version": "0.1.0-alpha.346",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",