@ouro.bot/cli 0.1.0-alpha.377 → 0.1.0-alpha.378

package/README.md

@@ -13,6 +13,7 @@ Ouroboros is a TypeScript harness for daemon-managed agents that live in externa
 - Agent bundles live outside the repo at `~/AgentBundles/<agent>.ouro/`.
 - Credentials live in the owning agent's Bitwarden/Vaultwarden vault. Provider credentials use `providers/<provider>`, runtime/sense/integration credentials use `runtime/config`, and travel/tool credentials use ordinary vault credential items.
 - Vault coordinates and local runtime state live in the agent bundle; raw credentials do not.
+- The only Ouro-owned durable credential locations are the bundle and the agent vault. Local unlock material is a machine-local cache, not a credential source of truth.
 - Machine-scoped test and runtime spillover lives under `~/.agentstate/...`.
 
 Current first-class senses:
@@ -195,7 +196,7 @@ ouro hook <event> --agent <name>          # fire a lifecycle hook (SessionStart,
 
 ## Setting Up On Another Machine
 
-To clone an existing agent onto a new machine (macOS, Linux, or Windows via WSL2), see **[docs/cross-machine-setup.md](docs/cross-machine-setup.md)**. The short version: `npx ouro.bot`, pick "clone", enter the bundle's git remote URL, and follow the guided prompts (auth, daemon start, dev tool setup are all offered inline).
+To clone an existing agent onto a new machine (macOS, Linux, or Windows via WSL2), see **[docs/cross-machine-setup.md](docs/cross-machine-setup.md)**. The short version is bundle plus vault: `npx ouro.bot`, pick "clone", enter the bundle's git remote URL, unlock the agent vault, refresh/verify credentials, and start with `ouro up`.
 
 ## The Agent's Inner Life
 

package/changelog.json

@@ -1,6 +1,15 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.378",
+      "changes": [
+        "Existing-agent continuation docs now spell out the bundle plus vault flow: clone the bundle, unlock the agent vault, refresh and verify provider/runtime credentials, then run `ouro up`.",
+        "Locked-vault and vault-create guidance no longer names an operator password manager as an Ouro credential location; local unlock material is documented as a machine-local cache, not a source of truth.",
+        "`ouro clone` non-interactive next steps now lead with `ouro vault unlock`, `ouro provider refresh`, and `ouro auth verify` instead of stale `ouro auth run` guidance.",
+        "`@ouro.bot/cli` and the `ouro.bot` wrapper are version-synced for the existing-bundle vault continuation release."
+      ]
+    },
     {
       "version": "0.1.0-alpha.377",
       "changes": [

package/dist/heart/daemon/cli-exec.js

@@ -674,9 +674,9 @@ async function executeVaultCreate(command, deps) {
                 "",
                 `vault unlock secret: ${unlockSecret}`,
                 "",
-                "Store this in the operator password manager now. Another machine cannot unlock the vault without it.",
+                "Keep this saved outside Ouro now. Another machine cannot unlock the vault without it.",
             ]
-            : ["Store the vault unlock secret in the operator password manager. Another machine will need it once."]),
+            : ["Keep the vault unlock secret saved outside Ouro. Another machine will need it once."]),
     ].join("\n");
     deps.writeStdout(message);
     return message;
@@ -3140,7 +3140,7 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
                     /* v8 ignore start -- chained command failures: tested via interactive clone test, catch branches are defensive @preserve */
                 }
                 catch (e) {
-                    deps.writeStdout(`auth setup failed: ${e instanceof Error ? e.message : String(e)}\nYou can retry later with: ouro auth run --agent ${agentName}`);
+                    deps.writeStdout(`auth setup failed: ${e instanceof Error ? e.message : String(e)}\nYou can retry later with: ouro auth --agent ${agentName}`);
                 }
                 /* v8 ignore stop */
             }
@@ -3172,7 +3172,7 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
             }
         }
         else {
-            deps.writeStdout(`\nnext steps:\n  ouro auth run --agent ${agentName}\n  ouro up\n  ouro setup --tool claude-code --agent ${agentName}`);
+            deps.writeStdout(`\nnext steps:\n  ouro vault unlock --agent ${agentName}\n  ouro provider refresh --agent ${agentName}\n  ouro auth verify --agent ${agentName}\n  ouro up\n  ouro setup --tool claude-code --agent ${agentName}`);
         }
         /* v8 ignore start -- PATH hint: only fires inside npx, not testable in vitest @preserve */
         if (process.env.npm_execpath) {

package/dist/repertoire/vault-unlock.js

@@ -110,7 +110,7 @@ function lockedMessage(config, store) {
         "This computer does not currently have usable local unlock material for that vault.",
         "This can happen on a new computer, after a local profile or hostname migration, or if the local unlock entry was removed.",
         "",
-        `Run \`${command}\` and enter the vault unlock secret from the operator password manager.`,
+        `Run \`${command}\` and enter the saved agent vault unlock secret from the human/operator who controls that vault.`,
         "If nobody saved that unlock secret, Ouro cannot recover it; create or rotate the agent vault and re-enter credentials.",
     ].join("\n");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.377",
+  "version": "0.1.0-alpha.378",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",