@ouro.bot/cli 0.1.0-alpha.396 → 0.1.0-alpha.398

package/changelog.json

@@ -1,6 +1,25 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.398",
+      "changes": [
+        "`ouro auth --agent <agent> --provider <provider>` now prints safe progress breadcrumbs while it checks vault access, runs provider login, stores credentials in the agent vault, refreshes the local provider snapshot, and verifies the provider.",
+        "Provider auth launched from `ouro repair` and hatch bootstrap now uses the same auth progress hook, so browser/login flows no longer leave humans staring at a silent cursor after the provider says login succeeded.",
+        "Auth progress messages are phase labels only; they never include OAuth tokens, API keys, vault unlock secrets, or credential payload values.",
+        "`@ouro.bot/cli` and the `ouro.bot` wrapper are version-synced for the auth progress breadcrumb release."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.397",
+      "changes": [
+        "`ouro up` provider repair output now uses compact readiness cards and `need repair` progress labels instead of dense degraded-agent prose.",
+        "Guided readiness repair and post-repair summaries now share the same typed issue renderer, so locked vaults, missing provider credentials, and generic repair hints show consistent `next`/`or` commands.",
+        "`ouro vault replace` now prompts for a `new` unlock secret and prints a short recovery handoff to `ouro repair --agent <agent>` instead of dumping generic provider/runtime credential commands into the middle of `ouro up`.",
+        "`ouro vault recover` also prompts for a `new` unlock secret while continuing to avoid printing credential values or portable unlock material.",
+        "`@ouro.bot/cli` and the `ouro.bot` wrapper are version-synced for the provider repair visual cleanup release."
+      ]
+    },
     {
       "version": "0.1.0-alpha.396",
       "changes": [

package/dist/heart/auth/auth-flow.js

@@ -187,6 +187,9 @@ function ensurePromptInput(promptInput, provider) {
         return promptInput;
     throw new Error(`No prompt input is available for ${provider} authentication.`);
 }
+function writeAuthProgress(input, message) {
+    input.onProgress?.(message);
+}
 function validateAnthropicToken(token) {
     const trimmed = token.trim();
     if (!trimmed) {
@@ -206,10 +209,12 @@ async function collectRuntimeAuthCredentials(input, deps) {
     if (input.provider === "github-copilot") {
         let token = process.env.GH_TOKEN?.trim() || process.env.GITHUB_TOKEN?.trim() || "";
         if (!token) {
+            writeAuthProgress(input, "checking GitHub CLI credentials...");
             const result = spawnSync("gh", ["auth", "token"], { encoding: "utf8" });
             token = (result.status === 0 && result.stdout ? result.stdout.trim() : "");
         }
         if (!token) {
+            writeAuthProgress(input, "starting GitHub login...");
             (0, runtime_1.emitNervesEvent)({
                 component: "daemon",
                 event: "daemon.auth_gh_login_start",
@@ -228,6 +233,7 @@ async function collectRuntimeAuthCredentials(input, deps) {
                 throw new Error("gh auth login completed but no token was found. Run `gh auth login` and try again.");
             }
         }
+        writeAuthProgress(input, "checking GitHub Copilot access...");
         const response = await fetch("https://api.github.com/copilot_internal/user", {
             headers: { Authorization: `Bearer ${token}` },
         });
@@ -252,6 +258,7 @@ async function collectRuntimeAuthCredentials(input, deps) {
             message: "starting codex login for runtime auth",
             meta: { agentName: input.agentName },
         });
+        writeAuthProgress(input, "starting openai-codex browser login...");
         const result = spawnSync("codex", ["login"], { stdio: "inherit" });
         if (result.error) {
             throw new Error(`Failed to run 'codex login': ${result.error.message}`);
@@ -259,6 +266,7 @@ async function collectRuntimeAuthCredentials(input, deps) {
         if (result.status !== 0) {
             throw new Error(`'codex login' exited with status ${result.status}.`);
         }
+        writeAuthProgress(input, "openai-codex login complete; reading local Codex token...");
         const token = readCodexAccessToken(homeDir);
         if (!token) {
             throw new Error("Codex login completed but no token was found in ~/.codex/auth.json. Re-run `codex login` and try again.");
@@ -272,6 +280,7 @@ async function collectRuntimeAuthCredentials(input, deps) {
             message: "starting claude setup-token for runtime auth",
             meta: { agentName: input.agentName },
         });
+        writeAuthProgress(input, "starting anthropic setup-token flow...");
         const result = spawnSync("claude", ["setup-token"], { stdio: "inherit" });
         if (result.error) {
             throw new Error(`Failed to run 'claude setup-token': ${result.error.message}`);
@@ -287,6 +296,7 @@ async function collectRuntimeAuthCredentials(input, deps) {
         /* v8 ignore start -- token exchange: requires live Anthropic OAuth endpoint @preserve */
         try {
             const { refreshAnthropicToken } = await Promise.resolve().then(() => __importStar(require("../providers/anthropic-token")));
+            writeAuthProgress(input, "exchanging anthropic setup token...");
             const tokenState = await refreshAnthropicToken(setupToken);
             if (tokenState) {
                 return {
@@ -329,6 +339,7 @@ async function resolveHatchCredentials(input) {
             agentName: input.agentName,
             provider: input.provider,
             promptInput: input.promptInput,
+            onProgress: input.onProgress,
         });
         Object.assign(credentials, result.credentials);
         /* v8 ignore next 3 -- branch: auth flow always fills all required fields in production @preserve */
@@ -357,12 +368,15 @@ async function runRuntimeAuthFlow(input, deps = {}) {
         message: "starting runtime auth flow",
         meta: { agentName: input.agentName, provider: input.provider },
     });
+    writeAuthProgress(input, `checking ${input.agentName}'s vault access...`);
     const vault = await (0, provider_credentials_1.refreshProviderCredentialPool)(input.agentName);
     if (!vault.ok && vault.reason === "unavailable") {
         throw new Error(`${vault.error}\n${(0, vault_unlock_1.vaultUnlockReplaceRecoverFix)(input.agentName, `Then retry 'ouro auth --agent ${input.agentName} --provider ${input.provider}'.`)}`);
     }
     const credentials = await collectRuntimeAuthCredentials(input, deps);
+    writeAuthProgress(input, `${input.provider} credentials collected; storing in ${input.agentName}'s vault...`);
     const { credentialPath } = await storeProviderCredentials(input.agentName, input.provider, credentials);
+    writeAuthProgress(input, `credentials stored at ${credentialPath}; local provider snapshot refreshed.`);
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
         event: "daemon.auth_flow_end",

package/dist/heart/daemon/cli-exec.js

@@ -153,6 +153,25 @@ async function listCliAgents(deps) {
 async function checkAlreadyRunningAgentProviders(deps) {
     return checkAgentProviders(deps);
 }
+function readinessIssueFromDegraded(entry) {
+    return entry.issue ?? (0, readiness_repair_1.genericReadinessIssue)({
+        summary: `${entry.agent}: ${entry.errorReason}`,
+        ...(entry.fixHint ? { fix: entry.fixHint } : {}),
+    });
+}
+function writeProviderRepairSummary(deps, title, degraded) {
+    deps.writeStdout(title);
+    for (const entry of degraded) {
+        for (const line of (0, readiness_repair_1.renderReadinessIssueNextSteps)(readinessIssueFromDegraded(entry))) {
+            deps.writeStdout(line);
+        }
+    }
+}
+function providerRepairCountSummary(count) {
+    if (count === 0)
+        return "ok";
+    return `${count} ${count === 1 ? "needs" : "need"} repair`;
+}
 async function reportPostRepairProviderHealth(deps, repairedAgents) {
     const remainingDegraded = await checkAgentProviders(deps, repairedAgents);
     (0, runtime_1.emitNervesEvent)({
@@ -168,14 +187,8 @@ async function reportPostRepairProviderHealth(deps, repairedAgents) {
         deps.writeStdout("provider checks recovered after repair");
         return remainingDegraded;
     }
-    deps.writeStdout("provider checks still degraded after repair:");
-    for (const d of remainingDegraded) {
-        deps.writeStdout(`  ${d.agent}: ${d.errorReason}`);
-        if (d.fixHint) {
-            deps.writeStdout(`    fix: ${d.fixHint}`);
-        }
-    }
-    deps.writeStdout("run `ouro up` again after applying the remaining fixes.");
+    writeProviderRepairSummary(deps, "Still blocked:", remainingDegraded);
+    deps.writeStdout("Run `ouro up` again after these are fixed.");
     return remainingDegraded;
 }
 async function checkProviderHealthBeforeChat(agentName, deps) {
@@ -582,6 +595,7 @@ async function resolveHatchInput(command, deps) {
         credentials: command.credentials,
         promptInput: prompt,
         runAuthFlow: deps.runAuthFlow,
+        onProgress: deps.writeStdout,
     });
     return {
         agentName,
@@ -825,7 +839,7 @@ async function executeVaultReplace(command, deps) {
     const configuredVault = (0, identity_1.resolveVaultConfig)(command.agent, config.vault);
     const email = command.email ?? defaultRepairVaultEmail(command.agent, config);
     const serverUrl = command.serverUrl ?? config.vault?.serverUrl ?? configuredVault.serverUrl;
-    const unlockSecret = (await promptSecret(`Choose Ouro vault unlock secret for ${email}: `)).trim();
+    const unlockSecret = (await promptSecret(`Choose new Ouro vault unlock secret for ${email}: `)).trim();
     if (!unlockSecret) {
         throw new Error("vault replace requires an unlock secret. Re-run in an interactive terminal and enter a human-chosen unlock secret.");
     }
@@ -846,13 +860,8 @@ async function executeVaultReplace(command, deps) {
         `vault replaced for ${command.agent}`,
         `vault: ${email} at ${serverUrl}`,
         `local unlock store: ${repair.store.kind}${repair.store.secure ? "" : " (explicit plaintext fallback)"}`,
-        "credentials imported: none",
-        "This is the no-export path for agents that predate vault auth or lost an unsaved unlock secret.",
-        "Re-auth/re-enter the credentials this agent should use:",
-        `  ouro auth --agent ${command.agent} --provider <provider>`,
-        `  ouro vault config set --agent ${command.agent} --key <field>`,
-        `  ouro provider refresh --agent ${command.agent}`,
-        `  ouro auth verify --agent ${command.agent}`,
+        "imported: none",
+        `next: ouro repair --agent ${command.agent}`,
         "Keep the vault unlock secret saved outside Ouro. Another machine will need it once.",
     ].join("\n");
     deps.writeStdout(message);
@@ -871,7 +880,7 @@ async function executeVaultRecover(command, deps) {
     const configuredVault = (0, identity_1.resolveVaultConfig)(command.agent, config.vault);
     const email = command.email ?? defaultRepairVaultEmail(command.agent, config);
     const serverUrl = command.serverUrl ?? config.vault?.serverUrl ?? configuredVault.serverUrl;
-    const unlockSecret = (await promptSecret(`Choose Ouro vault unlock secret for ${email}: `)).trim();
+    const unlockSecret = (await promptSecret(`Choose new Ouro vault unlock secret for ${email}: `)).trim();
     if (!unlockSecret) {
         throw new Error("vault recover requires an unlock secret. Re-run in an interactive terminal and enter a human-chosen unlock secret.");
     }
@@ -1406,6 +1415,7 @@ async function executeReadinessRepairAction(agent, action, deps) {
             agentName: agent,
             provider,
             promptInput: deps.promptInput,
+            onProgress: deps.writeStdout,
         });
         deps.writeStdout(result.message);
         await executeProviderRefresh({ kind: "provider.refresh", agent }, deps);
@@ -1450,12 +1460,7 @@ function readinessReportsFromDegraded(degraded) {
     return degraded.map((entry) => ({
         agent: entry.agent,
         ok: false,
-        issues: [
-            entry.issue ?? (0, readiness_repair_1.genericReadinessIssue)({
-                summary: entry.errorReason,
-                ...(entry.fixHint ? { fix: entry.fixHint } : {}),
-            }),
-        ],
+        issues: [readinessIssueFromDegraded(entry)],
     }));
 }
 async function runReadinessRepairForDegraded(degraded, deps) {
@@ -2234,30 +2239,25 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
             progress.startPhase("provider checks");
             const preflightProviderDegraded = await checkAgentProviders(deps);
             providerChecksAlreadyRun = true;
-            progress.completePhase("provider checks", preflightProviderDegraded.length > 0 ? `${preflightProviderDegraded.length} degraded` : "ok");
+            progress.completePhase("provider checks", providerRepairCountSummary(preflightProviderDegraded.length));
             if (preflightProviderDegraded.length > 0) {
                 progress.end();
                 if (command.noRepair) {
-                    deps.writeStdout("degraded agents:");
-                    for (const d of preflightProviderDegraded) {
-                        deps.writeStdout(`  ${d.agent}: ${d.errorReason}`);
-                        if (d.fixHint) {
-                            deps.writeStdout(`    fix: ${d.fixHint}`);
-                        }
-                    }
-                    const message = "daemon not started because provider checks are degraded; run `ouro repair` after applying the fixes.";
+                    writeProviderRepairSummary(deps, "Provider checks need repair:", preflightProviderDegraded);
+                    const message = "daemon not started: provider checks need repair. Run `ouro repair` or rerun `ouro up` to choose a repair path.";
                     deps.writeStdout(message);
                     return message;
                 }
                 const repairResult = await runReadinessRepairForDegraded(preflightProviderDegraded, deps);
                 if (!repairResult.repairsAttempted) {
-                    const message = "daemon not started because provider checks are degraded; run `ouro repair` after applying the fixes.";
+                    writeProviderRepairSummary(deps, "Provider checks still need repair:", preflightProviderDegraded);
+                    const message = "daemon not started: provider checks need repair. Run `ouro repair` or rerun `ouro up` to choose a repair path.";
                     deps.writeStdout(message);
                     return message;
                 }
                 const remainingDegraded = await reportPostRepairProviderHealth(deps, preflightProviderDegraded.map((entry) => entry.agent));
                 if (remainingDegraded.length > 0) {
-                    const message = "daemon not started because provider checks are still degraded.";
+                    const message = "daemon not started: provider checks still need repair.";
                     deps.writeStdout(message);
                     return message;
                 }
@@ -2275,7 +2275,7 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
             progress.startPhase("provider checks");
             const providerDegraded = await checkAlreadyRunningAgentProviders(deps);
             daemonResult.stability = mergeStartupStability(daemonResult.stability, providerDegraded);
-            progress.completePhase("provider checks", providerDegraded.length > 0 ? `${providerDegraded.length} degraded` : "ok");
+            progress.completePhase("provider checks", providerRepairCountSummary(providerDegraded.length));
         }
         progress.end();
         deps.writeStdout(daemonResult.message);
@@ -2283,13 +2283,7 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
         if (daemonResult.stability?.degraded && daemonResult.stability.degraded.length > 0) {
             if (command.noRepair) {
                 // --no-repair: write degraded summary and skip interactive repair
-                deps.writeStdout("degraded agents:");
-                for (const d of daemonResult.stability.degraded) {
-                    deps.writeStdout(`  ${d.agent}: ${d.errorReason}`);
-                    if (d.fixHint) {
-                        deps.writeStdout(`    fix: ${d.fixHint}`);
-                    }
-                }
+                writeProviderRepairSummary(deps, "Provider checks need repair:", daemonResult.stability.degraded);
                 (0, runtime_1.emitNervesEvent)({
                     level: "warn",
                     component: "daemon",
@@ -2335,7 +2329,7 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
                         const provider = providerOverride ?? config.humanFacing.provider;
                         /* v8 ignore next -- tests always inject runAuthFlow; default is for production @preserve */
                         const authRunner = deps.runAuthFlow ?? (await Promise.resolve().then(() => __importStar(require("../auth/auth-flow")))).runRuntimeAuthFlow;
-                        await authRunner({ agentName: agent, provider, promptInput: deps.promptInput });
+                        await authRunner({ agentName: agent, provider, promptInput: deps.promptInput, onProgress: deps.writeStdout });
                     },
                     runVaultUnlock: async (agent) => {
                         await executeVaultUnlock({ kind: "vault.unlock", agent }, deps);
@@ -2971,6 +2965,7 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
             agentName: command.agent,
             provider,
             promptInput: deps.promptInput,
+            onProgress: deps.writeStdout,
         });
         // Behavior: ouro auth stores credentials only — does NOT switch provider.
         // Use `ouro auth switch` to change the active provider.
@@ -2978,6 +2973,7 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
         // Verify the credentials actually work by pinging the provider
         /* v8 ignore start -- integration: real API ping after auth @preserve */
         try {
+            deps.writeStdout(`verifying ${provider} credentials...`);
             const credential = await readProviderCredentialRecord(command.agent, provider, deps);
             const status = credential.ok
                 ? await verifyProviderCredentials(provider, {

package/dist/heart/daemon/readiness-repair.js

@@ -6,6 +6,7 @@ exports.providerLiveCheckFailedIssue = providerLiveCheckFailedIssue;
 exports.genericReadinessIssue = genericReadinessIssue;
 exports.isKnownReadinessIssue = isKnownReadinessIssue;
 exports.renderReadinessIssue = renderReadinessIssue;
+exports.renderReadinessIssueNextSteps = renderReadinessIssueNextSteps;
 exports.runGuidedReadinessRepair = runGuidedReadinessRepair;
 const runtime_1 = require("../../nerves/runtime");
 function vaultLockedIssue(agentName) {
@@ -13,24 +14,24 @@ function vaultLockedIssue(agentName) {
         kind: "vault-locked",
         severity: "blocked",
         actor: "human-required",
-        summary: `${agentName} needs its vault unlocked on this machine.`,
-        detail: "Choose the path that matches what the human actually has. Ouro will not print or store a portable copy of the unlock secret.",
+        summary: `${agentName}: vault locked`,
+        detail: "Pick the path that matches what the human actually has. Ouro will not print or store the unlock secret as a portable file.",
         actions: [
             {
                 kind: "vault-unlock",
-                label: "I have the saved vault unlock secret",
+                label: "Unlock with saved secret",
                 command: `ouro vault unlock --agent ${agentName}`,
                 actor: "human-required",
             },
             {
                 kind: "vault-replace",
-                label: "Nobody saved it; create an empty vault and re-enter credentials",
+                label: "Create empty replacement vault",
                 command: `ouro vault replace --agent ${agentName}`,
                 actor: "human-required",
             },
             {
                 kind: "vault-recover",
-                label: "I have an old JSON credential export",
+                label: "Recover from JSON export",
                 command: `ouro vault recover --agent ${agentName} --from <json>`,
                 actor: "human-required",
                 executable: false,
@@ -43,19 +44,19 @@ function providerCredentialMissingIssue(input) {
         kind: "provider-credentials-missing",
         severity: "blocked",
         actor: "human-required",
-        summary: `${input.agentName} is missing ${input.provider} credentials for the ${input.lane} lane.`,
-        detail: `Selected model: ${input.model}. Credential source: ${input.credentialPath}.`,
+        summary: `${input.agentName}: missing ${input.provider} credentials (${input.lane}, ${input.model})`,
+        detail: `source: ${input.credentialPath}`,
         actions: [
             {
                 kind: "provider-auth",
-                label: `Authenticate ${input.provider} for ${input.agentName}`,
+                label: `Authenticate ${input.provider}`,
                 command: `ouro auth --agent ${input.agentName} --provider ${input.provider}`,
                 actor: "human-required",
                 provider: input.provider,
             },
             {
                 kind: "provider-use",
-                label: "Choose a different working provider/model for this lane",
+                label: "Choose another provider/model",
                 command: `ouro use --agent ${input.agentName} --lane ${input.lane} --provider <provider> --model <model>`,
                 actor: "human-choice",
                 executable: false,
@@ -69,7 +70,7 @@ function providerLiveCheckFailedIssue(input) {
         kind: "provider-live-check-failed",
         severity: "blocked",
         actor: "human-choice",
-        summary: `${input.agentName}'s ${input.lane} lane provider ${input.provider} / ${input.model} failed its live check.`,
+        summary: `${input.agentName}: ${input.lane} provider ${input.provider} / ${input.model} failed live check`,
         detail: input.message,
         actions: [
             {
@@ -118,11 +119,21 @@ function renderReadinessIssue(issue) {
     }
     issue.actions.forEach((action, index) => {
         lines.push(`${index + 1}. ${action.label}`);
-        lines.push(`   runs: ${action.command}`);
+        lines.push(`   ${action.command}`);
     });
     lines.push(`${issue.actions.length + 1}. Skip for now`);
     return lines.join("\n");
 }
+function renderReadinessIssueNextSteps(issue) {
+    const lines = [`  ${issue.summary}`];
+    if (issue.detail && issue.kind !== "vault-locked") {
+        lines.push(`    ${issue.detail}`);
+    }
+    issue.actions.forEach((action, index) => {
+        lines.push(`    ${index === 0 ? "next" : "or"}: ${action.command}`);
+    });
+    return lines;
+}
 function selectedActionFor(answer, issue) {
     const selected = Number.parseInt(answer.trim(), 10);
     if (!Number.isFinite(selected))
@@ -160,11 +171,11 @@ async function runGuidedReadinessRepair(reports, deps) {
             const answer = await deps.promptInput(`Choose [1-${issue.actions.length + 1}]: `);
             const action = selectedActionFor(answer, issue);
             if (action === "skip") {
-                deps.writeStdout(`repair skipped for ${report.agent}.`);
+                deps.writeStdout(`skipped ${report.agent} for now.`);
                 continue;
             }
             if (!action) {
-                deps.writeStdout(`invalid repair choice for ${report.agent}; no repair attempted.`);
+                deps.writeStdout(`invalid choice for ${report.agent}; no repair attempted.`);
                 continue;
             }
             if (!isExecutableAction(action)) {
@@ -178,7 +189,7 @@ async function runGuidedReadinessRepair(reports, deps) {
             try {
                 await deps.runRepairAction(report.agent, action, issue);
                 repairsAttempted = true;
-                deps.writeStdout(`repair attempted for ${report.agent}`);
+                deps.writeStdout(`repair step finished for ${report.agent}.`);
             }
             catch (error) {
                 const message = error instanceof Error ? error.message : String(error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.396",
+  "version": "0.1.0-alpha.398",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",