@ouro.bot/cli 0.1.0-alpha.35 → 0.1.0-alpha.350

package/dist/heart/cross-chat-delivery.js

@@ -0,0 +1,131 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deliverCrossChatMessage = deliverCrossChatMessage;
+const types_1 = require("../mind/friends/types");
+const runtime_1 = require("../nerves/runtime");
+function buildPendingEnvelope(request, agentName, now) {
+    return {
+        from: agentName,
+        friendId: request.friendId,
+        channel: request.channel,
+        key: request.key,
+        content: request.content,
+        timestamp: now,
+    };
+}
+function queueForLater(request, deps, detail) {
+    deps.queuePending(buildPendingEnvelope(request, deps.agentName, (deps.now ?? Date.now)()));
+    return {
+        status: "queued_for_later",
+        detail,
+    };
+}
+function isExplicitlyAuthorized(request) {
+    return request.intent === "explicit_cross_chat"
+        && Boolean(request.authorizingSession)
+        && (0, types_1.isTrustedLevel)(request.authorizingSession?.trustLevel);
+}
+async function deliverCrossChatMessage(request, deps) {
+    (0, runtime_1.emitNervesEvent)({
+        component: "engine",
+        event: "engine.cross_chat_delivery_start",
+        message: "resolving cross-chat delivery",
+        meta: {
+            friendId: request.friendId,
+            channel: request.channel,
+            key: request.key,
+            intent: request.intent,
+            authorizingTrustLevel: request.authorizingSession?.trustLevel ?? null,
+        },
+    });
+    if (!isExplicitlyAuthorized(request) && request.intent !== "generic_outreach") {
+        const result = {
+            status: "blocked",
+            detail: "cross-chat delivery requires a trusted asking session or generic outreach intent",
+        };
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "engine",
+            event: "engine.cross_chat_delivery_end",
+            message: "blocked cross-chat delivery",
+            meta: {
+                friendId: request.friendId,
+                channel: request.channel,
+                key: request.key,
+                status: result.status,
+            },
+        });
+        return result;
+    }
+    const deliverer = deps.deliverers?.[request.channel];
+    if (!deliverer) {
+        const result = queueForLater(request, deps, "live delivery unavailable right now; queued for the next active turn");
+        (0, runtime_1.emitNervesEvent)({
+            component: "engine",
+            event: "engine.cross_chat_delivery_end",
+            message: "queued explicit cross-chat delivery because no live deliverer was available",
+            meta: {
+                friendId: request.friendId,
+                channel: request.channel,
+                key: request.key,
+                status: result.status,
+            },
+        });
+        return result;
+    }
+    try {
+        const direct = await deliverer(request);
+        if (direct.status === "delivered_now" || direct.status === "blocked" || direct.status === "failed") {
+            const result = {
+                status: direct.status,
+                detail: direct.detail,
+            };
+            (0, runtime_1.emitNervesEvent)({
+                level: result.status === "failed" ? "error" : result.status === "blocked" ? "warn" : "info",
+                component: "engine",
+                event: "engine.cross_chat_delivery_end",
+                message: "completed direct cross-chat delivery resolution",
+                meta: {
+                    friendId: request.friendId,
+                    channel: request.channel,
+                    key: request.key,
+                    status: result.status,
+                },
+            });
+            return result;
+        }
+        const result = queueForLater(request, deps, direct.detail.trim() || "live delivery unavailable right now; queued for the next active turn");
+        (0, runtime_1.emitNervesEvent)({
+            component: "engine",
+            event: "engine.cross_chat_delivery_end",
+            message: "queued explicit cross-chat delivery after adapter reported unavailability",
+            meta: {
+                friendId: request.friendId,
+                channel: request.channel,
+                key: request.key,
+                status: result.status,
+            },
+        });
+        return result;
+    }
+    catch (error) {
+        const result = {
+            status: "failed",
+            detail: error instanceof Error ? error.message : String(error),
+        };
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "engine",
+            event: "engine.cross_chat_delivery_end",
+            message: "cross-chat delivery threw unexpectedly",
+            meta: {
+                friendId: request.friendId,
+                channel: request.channel,
+                key: request.key,
+                status: result.status,
+                reason: result.detail,
+            },
+        });
+        return result;
+    }
+}

package/dist/heart/daemon/agent-config-check.js

@@ -0,0 +1,561 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkAgentConfig = checkAgentConfig;
+exports.checkAgentConfigWithProviderHealth = checkAgentConfigWithProviderHealth;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const identity_1 = require("../identity");
+const runtime_1 = require("../../nerves/runtime");
+const provider_models_1 = require("../provider-models");
+const machine_identity_1 = require("../machine-identity");
+const provider_state_1 = require("../provider-state");
+const provider_credential_pool_1 = require("../provider-credential-pool");
+function isAgentProvider(value) {
+    return Object.prototype.hasOwnProperty.call(identity_1.PROVIDER_CREDENTIALS, value);
+}
+function agentRootFor(agentName, bundlesRoot) {
+    return path.join(bundlesRoot, `${agentName}.ouro`);
+}
+function configPathFor(agentName, bundlesRoot) {
+    return path.join(agentRootFor(agentName, bundlesRoot), "agent.json");
+}
+function formatFacingList(facings) {
+    if (facings.length === 1)
+        return facings[0];
+    return `${facings.slice(0, -1).join(", ")} and ${facings[facings.length - 1]}`;
+}
+function selectedProviderMap(selectedProviders) {
+    const byProvider = new Map();
+    for (const selected of selectedProviders) {
+        const facings = byProvider.get(selected.provider) ?? [];
+        facings.push(selected.facing);
+        byProvider.set(selected.provider, facings);
+    }
+    return byProvider;
+}
+function resolveFacingProvider(parsed, facing, agentName, agentJsonPath) {
+    const raw = parsed[facing];
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return {
+            ok: false,
+            result: {
+                ok: false,
+                error: `agent.json for '${agentName}' is missing ${facing}.provider`,
+                fix: `Add ${facing}: { provider, model } to ${agentJsonPath}. Valid providers: ${Object.keys(identity_1.PROVIDER_CREDENTIALS).join(", ")}`,
+            },
+        };
+    }
+    const provider = raw.provider;
+    if (typeof provider !== "string" || provider.length === 0) {
+        return {
+            ok: false,
+            result: {
+                ok: false,
+                error: `agent.json for '${agentName}' is missing ${facing}.provider`,
+                fix: `Set ${facing}.provider in ${agentJsonPath}. Valid providers: ${Object.keys(identity_1.PROVIDER_CREDENTIALS).join(", ")}`,
+            },
+        };
+    }
+    if (!isAgentProvider(provider)) {
+        return {
+            ok: false,
+            result: {
+                ok: false,
+                error: `Unknown provider '${provider}' in ${facing}.provider for '${agentName}'`,
+                fix: `Set ${facing}.provider to one of: ${Object.keys(identity_1.PROVIDER_CREDENTIALS).join(", ")}`,
+            },
+        };
+    }
+    return { ok: true, selected: { facing, provider } };
+}
+function resolveSelectedProviders(parsed, agentName, agentJsonPath) {
+    const hasHumanFacing = parsed.humanFacing !== undefined;
+    const hasAgentFacing = parsed.agentFacing !== undefined;
+    if (!hasHumanFacing && !hasAgentFacing && typeof parsed.provider === "string") {
+        if (!isAgentProvider(parsed.provider)) {
+            return {
+                ok: false,
+                result: {
+                    ok: false,
+                    error: `Unknown provider '${parsed.provider}' in agent.json for '${agentName}'`,
+                    fix: `Set provider to one of: ${Object.keys(identity_1.PROVIDER_CREDENTIALS).join(", ")}`,
+                },
+            };
+        }
+        return { ok: true, selectedProviders: [{ facing: "provider", provider: parsed.provider }] };
+    }
+    const human = resolveFacingProvider(parsed, "humanFacing", agentName, agentJsonPath);
+    if (!human.ok)
+        return human;
+    const agent = resolveFacingProvider(parsed, "agentFacing", agentName, agentJsonPath);
+    if (!agent.ok)
+        return agent;
+    return { ok: true, selectedProviders: [human.selected, agent.selected] };
+}
+function readConfigCheckContext(agentName, bundlesRoot, secretsRoot) {
+    const agentJsonPath = path.join(bundlesRoot, `${agentName}.ouro`, "agent.json");
+    let raw;
+    try {
+        raw = fs.readFileSync(agentJsonPath, "utf-8");
+    }
+    catch {
+        return {
+            ok: false,
+            result: {
+                ok: false,
+                error: `agent.json not found at ${agentJsonPath}`,
+                fix: `Run 'ouro hatch ${agentName}' to create the agent bundle, or verify that ${bundlesRoot}/${agentName}.ouro/ exists.`,
+            },
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return {
+            ok: false,
+            result: {
+                ok: false,
+                error: `agent.json at ${agentJsonPath} contains invalid JSON`,
+                fix: `Open ${agentJsonPath} and fix the JSON syntax.`,
+            },
+        };
+    }
+    // Disabled agents are valid — they just won't run
+    if (parsed.enabled === false) {
+        return {
+            ok: true,
+            context: {
+                agentJsonPath,
+                secretsJsonPath: path.join(secretsRoot, agentName, "secrets.json"),
+                providers: {},
+                selectedProviders: [],
+            },
+        };
+    }
+    const selected = resolveSelectedProviders(parsed, agentName, agentJsonPath);
+    if (!selected.ok)
+        return selected;
+    const secretsJsonPath = path.join(secretsRoot, agentName, "secrets.json");
+    let secrets;
+    try {
+        const secretsRaw = fs.readFileSync(secretsJsonPath, "utf-8");
+        secrets = JSON.parse(secretsRaw);
+    }
+    catch {
+        const firstProvider = selected.selectedProviders[0].provider;
+        return {
+            ok: false,
+            result: {
+                ok: false,
+                error: `secrets.json not found or unreadable at ${secretsJsonPath}`,
+                fix: `Run 'ouro auth --agent ${agentName} --provider ${firstProvider}' to configure credentials, or create ${secretsJsonPath} with providers.${firstProvider} credentials.`,
+            },
+        };
+    }
+    const providers = secrets.providers;
+    if (!providers || typeof providers !== "object" || Array.isArray(providers)) {
+        const firstProvider = selected.selectedProviders[0].provider;
+        return {
+            ok: false,
+            result: {
+                ok: false,
+                error: `secrets.json for '${agentName}' is missing providers object`,
+                fix: `Run 'ouro auth --agent ${agentName} --provider ${firstProvider}' to configure credentials.`,
+            },
+        };
+    }
+    return {
+        ok: true,
+        context: {
+            agentJsonPath,
+            secretsJsonPath,
+            providers,
+            selectedProviders: selected.selectedProviders,
+        },
+    };
+}
+function readAgentConfigForProviderState(agentName, bundlesRoot) {
+    const agentJsonPath = configPathFor(agentName, bundlesRoot);
+    let raw;
+    try {
+        raw = fs.readFileSync(agentJsonPath, "utf-8");
+    }
+    catch {
+        return {
+            ok: false,
+            result: {
+                ok: false,
+                error: `agent.json not found at ${agentJsonPath}`,
+                fix: `Run 'ouro hatch ${agentName}' to create the agent bundle, or verify that ${bundlesRoot}/${agentName}.ouro/ exists.`,
+            },
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return {
+            ok: false,
+            result: {
+                ok: false,
+                error: `agent.json at ${agentJsonPath} contains invalid JSON`,
+                fix: `Open ${agentJsonPath} and fix the JSON syntax.`,
+            },
+        };
+    }
+    if (parsed.enabled === false) {
+        return { ok: true, disabled: true, agentJsonPath, parsed };
+    }
+    return { ok: true, disabled: false, agentJsonPath, parsed };
+}
+function readFacingForBootstrap(parsed, facing, agentName, agentJsonPath) {
+    const providerResult = resolveFacingProvider(parsed, facing, agentName, agentJsonPath);
+    if (!providerResult.ok) {
+        return {
+            ok: false,
+            result: {
+                ok: false,
+                error: providerResult.result.error,
+                fix: `Run 'ouro use --agent ${agentName} --lane ${facing === "humanFacing" ? "outward" : "inner"} --provider <provider> --model <model>' to configure this machine's provider binding.`,
+            },
+        };
+    }
+    const raw = parsed[facing];
+    const model = typeof raw.model === "string" && raw.model.trim().length > 0
+        ? raw.model.trim()
+        : (0, provider_models_1.getDefaultModelForProvider)(providerResult.selected.provider);
+    return { ok: true, provider: providerResult.selected.provider, model };
+}
+function bootstrapMissingProviderState(input) {
+    const outward = readFacingForBootstrap(input.parsed, "humanFacing", input.agentName, input.agentJsonPath);
+    if (!outward.ok)
+        return { ok: false, error: outward.result.error, fix: outward.result.fix };
+    const inner = readFacingForBootstrap(input.parsed, "agentFacing", input.agentName, input.agentJsonPath);
+    if (!inner.ok)
+        return { ok: false, error: inner.result.error, fix: inner.result.fix };
+    const now = new Date();
+    const homeDir = (0, provider_credential_pool_1.providerCredentialHomeDirFromSecretsRoot)(input.secretsRoot);
+    const machine = (0, machine_identity_1.loadOrCreateMachineIdentity)({ homeDir, now: () => now });
+    const state = (0, provider_state_1.bootstrapProviderStateFromAgentConfig)({
+        machineId: machine.machineId,
+        now,
+        agentConfig: {
+            humanFacing: { provider: outward.provider, model: outward.model },
+            agentFacing: { provider: inner.provider, model: inner.model },
+        },
+    });
+    const agentRoot = agentRootFor(input.agentName, input.bundlesRoot);
+    (0, provider_state_1.writeProviderState)(agentRoot, state);
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.provider_state_bootstrapped",
+        message: "bootstrapped local provider state from agent config",
+        meta: { agent: input.agentName, agentRoot },
+    });
+    return { ok: true, agentRoot, state };
+}
+function readOrBootstrapProviderStateForCheck(agentName, bundlesRoot, secretsRoot) {
+    const configResult = readAgentConfigForProviderState(agentName, bundlesRoot);
+    if (!configResult.ok)
+        return { ok: false, result: configResult.result };
+    if (configResult.disabled)
+        return { ok: true, disabled: true };
+    const agentRoot = agentRootFor(agentName, bundlesRoot);
+    const stateResult = (0, provider_state_1.readProviderState)(agentRoot);
+    if (stateResult.ok) {
+        return { ok: true, disabled: false, agentRoot, state: stateResult.state };
+    }
+    if (stateResult.reason === "invalid") {
+        return {
+            ok: false,
+            result: {
+                ok: false,
+                error: `provider state for ${agentName} is invalid at ${stateResult.statePath}: ${stateResult.error}`,
+                fix: `Run 'ouro use --agent ${agentName} --lane outward --provider <provider> --model <model> --force' to rewrite this machine's provider binding.`,
+            },
+        };
+    }
+    const bootstrap = bootstrapMissingProviderState({
+        agentName,
+        bundlesRoot,
+        secretsRoot,
+        parsed: configResult.parsed,
+        agentJsonPath: configResult.agentJsonPath,
+    });
+    if (!bootstrap.ok)
+        return { ok: false, result: bootstrap };
+    return { ok: true, disabled: false, agentRoot: bootstrap.agentRoot, state: bootstrap.state };
+}
+function validateSelectedProviderSecrets(agentName, context) {
+    for (const [provider, facings] of selectedProviderMap(context.selectedProviders)) {
+        const desc = identity_1.PROVIDER_CREDENTIALS[provider];
+        const providerSecrets = context.providers[provider];
+        const selectedBy = formatFacingList(facings);
+        if (!providerSecrets) {
+            return {
+                ok: false,
+                error: `secrets.json for '${agentName}' is missing providers.${provider} section selected by ${selectedBy}`,
+                fix: `Run 'ouro auth --agent ${agentName} --provider ${provider}' to configure ${provider} credentials.`,
+            };
+        }
+        // Azure special case: managed identity only needs endpoint + deployment.
+        if (provider === "azure") {
+            const hasEndpoint = typeof providerSecrets.endpoint === "string" && providerSecrets.endpoint.length > 0;
+            const hasDeployment = typeof providerSecrets.deployment === "string" && providerSecrets.deployment.length > 0;
+            const hasManagedId = typeof providerSecrets.managedIdentityClientId === "string" && providerSecrets.managedIdentityClientId.length > 0;
+            if (hasEndpoint && hasDeployment && hasManagedId) {
+                continue;
+            }
+        }
+        const missing = desc.required.filter((field) => {
+            const val = providerSecrets[field];
+            return typeof val !== "string" || val.length === 0;
+        });
+        if (missing.length > 0) {
+            return {
+                ok: false,
+                error: `secrets.json for '${agentName}' is missing required ${provider} credentials selected by ${selectedBy}: ${missing.join(", ")}`,
+                fix: `Run 'ouro auth --agent ${agentName} --provider ${provider}' to set up ${provider} credentials, or add the missing fields to providers.${provider} in ${context.secretsJsonPath}.`,
+            };
+        }
+    }
+    return { ok: true };
+}
+function emitConfigValid(agentName, context, liveProviderCheck) {
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.agent_config_valid",
+        message: "agent config validation passed",
+        meta: {
+            agent: agentName,
+            providers: [...selectedProviderMap(context.selectedProviders).keys()],
+            liveProviderCheck,
+        },
+    });
+}
+function providerCredentialConfig(record) {
+    return {
+        ...record.credentials,
+        ...record.config,
+    };
+}
+function pingAttemptCount(result) {
+    if (Array.isArray(result.attempts))
+        return result.attempts.length;
+    return undefined;
+}
+function writeLaneReadiness(input) {
+    const binding = input.state.lanes[input.lane];
+    const checkedAt = new Date().toISOString();
+    input.state.updatedAt = checkedAt;
+    input.state.readiness[input.lane] = {
+        status: input.status,
+        provider: binding.provider,
+        model: binding.model,
+        checkedAt,
+        credentialRevision: input.credentialRevision,
+        ...(input.error ? { error: input.error } : {}),
+        ...(input.attempts !== undefined ? { attempts: input.attempts } : {}),
+    };
+    (0, provider_state_1.writeProviderState)(input.agentRoot, input.state);
+}
+function legacyProviderCredentialCandidates(agentName, secretsRoot) {
+    const secretsPath = path.join(secretsRoot, agentName, "secrets.json");
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(secretsPath, "utf-8"));
+    }
+    catch {
+        return [];
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return [];
+    const providers = parsed.providers;
+    if (!providers || typeof providers !== "object" || Array.isArray(providers))
+        return [];
+    const candidates = [];
+    for (const [providerKey, rawConfig] of Object.entries(providers)) {
+        if (!isAgentProvider(providerKey) || !rawConfig || typeof rawConfig !== "object" || Array.isArray(rawConfig)) {
+            continue;
+        }
+        const split = (0, provider_credential_pool_1.splitProviderCredentialFields)(providerKey, rawConfig);
+        if (Object.keys(split.credentials).length === 0 && Object.keys(split.config).length === 0)
+            continue;
+        candidates.push({ provider: providerKey, credentials: split.credentials, config: split.config });
+    }
+    return candidates;
+}
+function readPoolWithLegacyMigration(agentName, homeDir, secretsRoot) {
+    const initial = (0, provider_credential_pool_1.readProviderCredentialPool)(homeDir);
+    if (initial.ok || initial.reason === "invalid")
+        return initial;
+    const candidates = legacyProviderCredentialCandidates(agentName, secretsRoot);
+    for (const candidate of candidates) {
+        (0, provider_credential_pool_1.upsertProviderCredential)({
+            homeDir,
+            provider: candidate.provider,
+            credentials: candidate.credentials,
+            config: candidate.config,
+            provenance: {
+                source: "legacy-agent-secrets",
+                contributedByAgent: agentName,
+            },
+        });
+    }
+    return candidates.length > 0 ? (0, provider_credential_pool_1.readProviderCredentialPool)(homeDir) : initial;
+}
+function missingCredentialResult(agentName, lane, provider, model, poolPath) {
+    return {
+        ok: false,
+        error: `${lane} provider ${provider} model ${model} has no credentials in the machine provider pool at ${poolPath}`,
+        fix: `Run 'ouro auth --agent ${agentName} --provider ${provider}' to authenticate this machine, or run 'ouro use --agent ${agentName} --lane ${lane} --provider <provider> --model <model>' to choose a working provider/model.`,
+    };
+}
+function invalidPoolResult(agentName, lane, provider, model, pool) {
+    return {
+        ok: false,
+        error: `${lane} provider ${provider} model ${model} cannot read machine provider credentials at ${pool.poolPath}: ${pool.error}`,
+        fix: `Fix ${pool.poolPath}, then run 'ouro auth --agent ${agentName} --provider ${provider}' or 'ouro use --agent ${agentName} --lane ${lane} --provider <provider> --model <model> --force'.`,
+    };
+}
+function failedPingResult(agentName, lane, provider, model, result) {
+    return {
+        ok: false,
+        error: `${lane} provider ${provider} model ${model} failed live check: ${result.message}`,
+        fix: `Run 'ouro auth --agent ${agentName} --provider ${provider}' to refresh credentials, or run 'ouro use --agent ${agentName} --lane ${lane} --provider <provider> --model <model>' to switch this lane.`,
+    };
+}
+function credentialRecordForLane(pool, provider) {
+    return pool.providers[provider];
+}
+/**
+ * Pre-spawn validation: ensures agent.json exists and required secrets are present.
+ * Returns `{ ok: true }` when the agent is ready to run, or a descriptive error
+ * with an actionable fix message when something is missing.
+ */
+function checkAgentConfig(agentName, bundlesRoot, secretsRoot) {
+    const contextResult = readConfigCheckContext(agentName, bundlesRoot, secretsRoot);
+    if (!contextResult.ok)
+        return contextResult.result;
+    const context = contextResult.context;
+    const structural = validateSelectedProviderSecrets(agentName, context);
+    if (!structural.ok)
+        return structural;
+    emitConfigValid(agentName, context, false);
+    return { ok: true };
+}
+async function checkAgentConfigWithProviderHealth(agentName, bundlesRoot, secretsRoot, deps = {}) {
+    const stateResult = readOrBootstrapProviderStateForCheck(agentName, bundlesRoot, secretsRoot);
+    if (!stateResult.ok)
+        return stateResult.result;
+    if (stateResult.disabled)
+        return { ok: true };
+    const ping = deps.pingProvider ?? (await Promise.resolve().then(() => __importStar(require("../provider-ping")))).pingProvider;
+    const homeDir = (0, provider_credential_pool_1.providerCredentialHomeDirFromSecretsRoot)(secretsRoot);
+    const poolResult = readPoolWithLegacyMigration(agentName, homeDir, secretsRoot);
+    const pingGroups = new Map();
+    const lanes = ["outward", "inner"];
+    for (const lane of lanes) {
+        const binding = stateResult.state.lanes[lane];
+        if (!poolResult.ok) {
+            if (poolResult.reason === "missing") {
+                return missingCredentialResult(agentName, lane, binding.provider, binding.model, poolResult.poolPath);
+            }
+            return invalidPoolResult(agentName, lane, binding.provider, binding.model, {
+                ...poolResult,
+                reason: "invalid",
+            });
+        }
+        const record = credentialRecordForLane(poolResult.pool, binding.provider);
+        if (!record) {
+            return missingCredentialResult(agentName, lane, binding.provider, binding.model, poolResult.poolPath);
+        }
+        const key = `${binding.provider}\0${binding.model}\0${record.revision}`;
+        const group = pingGroups.get(key);
+        if (group) {
+            group.lanes.push(lane);
+        }
+        else {
+            pingGroups.set(key, {
+                provider: binding.provider,
+                model: binding.model,
+                record,
+                lanes: [lane],
+            });
+        }
+    }
+    for (const group of pingGroups.values()) {
+        const result = await ping(group.provider, providerCredentialConfig(group.record), { model: group.model });
+        if (!result.ok) {
+            for (const lane of group.lanes) {
+                writeLaneReadiness({
+                    agentRoot: stateResult.agentRoot,
+                    state: stateResult.state,
+                    lane,
+                    status: "failed",
+                    credentialRevision: group.record.revision,
+                    error: result.message,
+                    attempts: pingAttemptCount(result),
+                });
+            }
+            return failedPingResult(agentName, group.lanes[0], group.provider, group.model, result);
+        }
+        for (const lane of group.lanes) {
+            writeLaneReadiness({
+                agentRoot: stateResult.agentRoot,
+                state: stateResult.state,
+                lane,
+                status: "ready",
+                credentialRevision: group.record.revision,
+                attempts: pingAttemptCount(result),
+            });
+        }
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.agent_config_valid",
+        message: "agent config validation passed",
+        meta: {
+            agent: agentName,
+            providers: [...new Set([...pingGroups.values()].map((group) => group.provider))],
+            liveProviderCheck: true,
+        },
+    });
+    return { ok: true };
+}