@ouro.bot/cli 0.1.0-alpha.411 → 0.1.0-alpha.413

package/changelog.json

@@ -1,6 +1,22 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.413",
+      "changes": [
+        "`ouro up` now shows real-time per-agent progress during provider checks -- the spinner displays which agent and vault operation is in progress (`slugger: reading vault items...`) instead of a static label with no detail.",
+        "Added `onProgress` callback to `refreshProviderCredentialPool` and `updateDetail()` method to `UpProgress` for sub-step spinner detail, threaded through the full `executeUpCommand` -> `checkAgentProviders` -> provider health check chain.",
+        "`@ouro.bot/cli` and the `ouro.bot` wrapper are version-synced for the progress threading release."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.412",
+      "changes": [
+        "Cross-process bw CLI lock prevents concurrent access to the same Bitwarden app data directory, fixing the root cause of intermittent vault timeout errors during `ouro up` provider checks on multi-agent machines.",
+        "Two-layer locking in `execBw`: in-process async mutex serializes within a Node.js process, cross-process `O_EXCL` file lock with PID stale detection serializes across processes.",
+        "`@ouro.bot/cli` and the `ouro.bot` wrapper are version-synced for the vault concurrency fix release."
+      ]
+    },
     {
       "version": "0.1.0-alpha.411",
       "changes": [

package/dist/heart/daemon/agent-config-check.js

@@ -332,7 +332,7 @@ async function checkAgentConfigWithProviderHealth(agentName, bundlesRoot, deps =
     if (stateResult.disabled)
         return { ok: true };
     const ping = deps.pingProvider ?? (await Promise.resolve().then(() => __importStar(require("../provider-ping")))).pingProvider;
-    const poolResult = await (0, provider_credentials_1.refreshProviderCredentialPool)(agentName);
+    const poolResult = await (0, provider_credentials_1.refreshProviderCredentialPool)(agentName, deps.onProgress ? { onProgress: deps.onProgress } : undefined);
     const pingGroups = new Map();
     const lanes = ["outward", "inner"];
     for (const lane of lanes) {

package/dist/heart/daemon/cli-exec.js

@@ -98,13 +98,14 @@ const DEFAULT_DAEMON_STARTUP_POLL_INTERVAL_MS = 500;
 const DEFAULT_DAEMON_STARTUP_STABILITY_WINDOW_MS = 1_500;
 const DEFAULT_DAEMON_STARTUP_RETRY_LIMIT = 1;
 const DEFAULT_DAEMON_STARTUP_LOG_LINES = 10;
-async function checkAgentProviders(deps, agentsOverride) {
+async function checkAgentProviders(deps, agentsOverride, onProgress) {
     const agents = agentsOverride ?? await listCliAgents(deps);
     const bundlesRoot = deps.bundlesRoot ?? (0, identity_1.getAgentBundlesRoot)();
     const degraded = [];
     for (const agent of [...new Set(agents)]) {
         try {
-            const result = await checkAgentProviderHealth(agent, bundlesRoot, deps);
+            onProgress?.(`${agent}: checking providers...`);
+            const result = await checkAgentProviderHealth(agent, bundlesRoot, deps, onProgress);
             if (result.ok)
                 continue;
             const errorReason = result.error ?? "agent provider health check failed";
@@ -136,9 +137,14 @@ async function checkAgentProviders(deps, agentsOverride) {
     }
     return degraded;
 }
-async function checkAgentProviderHealth(agentName, bundlesRoot, deps) {
-    if (deps.homeDir) {
-        return (0, agent_config_check_1.checkAgentConfigWithProviderHealth)(agentName, bundlesRoot, { homeDir: deps.homeDir });
+async function checkAgentProviderHealth(agentName, bundlesRoot, deps, onProgress) {
+    const liveDeps = {};
+    if (deps.homeDir)
+        liveDeps.homeDir = deps.homeDir;
+    if (onProgress)
+        liveDeps.onProgress = onProgress;
+    if (liveDeps.homeDir || liveDeps.onProgress) {
+        return (0, agent_config_check_1.checkAgentConfigWithProviderHealth)(agentName, bundlesRoot, liveDeps);
     }
     return (0, agent_config_check_1.checkAgentConfigWithProviderHealth)(agentName, bundlesRoot);
 }
@@ -151,8 +157,8 @@ async function listCliAgents(deps) {
     }
     return [];
 }
-async function checkAlreadyRunningAgentProviders(deps) {
-    return checkAgentProviders(deps);
+async function checkAlreadyRunningAgentProviders(deps, onProgress) {
+    return checkAgentProviders(deps, undefined, onProgress);
 }
 function readinessIssueFromDegraded(entry) {
     return entry.issue ?? (0, readiness_repair_1.genericReadinessIssue)({
@@ -2578,7 +2584,7 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
         let providerChecksAlreadyRun = false;
         if (!daemonAliveBeforeStart) {
             progress.startPhase("provider checks");
-            const preflightProviderDegraded = await checkAgentProviders(deps);
+            const preflightProviderDegraded = await checkAgentProviders(deps, undefined, (msg) => progress.updateDetail(msg));
             providerChecksAlreadyRun = true;
             progress.completePhase("provider checks", providerRepairCountSummary(preflightProviderDegraded.length));
             if (preflightProviderDegraded.length > 0) {
@@ -2616,7 +2622,7 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
         }, { initialAlive: daemonAliveBeforeStart });
         if (!providerChecksAlreadyRun || daemonResult.alreadyRunning) {
             progress.startPhase("provider checks");
-            const providerDegraded = await checkAlreadyRunningAgentProviders(deps);
+            const providerDegraded = await checkAlreadyRunningAgentProviders(deps, (msg) => progress.updateDetail(msg));
             daemonResult.stability = mergeStartupStability(daemonResult.stability, providerDegraded);
             progress.completePhase("provider checks", providerRepairCountSummary(providerDegraded.length));
         }

package/dist/heart/daemon/up-progress.js

@@ -52,6 +52,16 @@ class UpProgress {
             return;
         this.write(label);
     }
+    /**
+     * Update the sub-step detail on the current spinner phase. Rendered as
+     * "label (Xs) -- detail" in TTY mode. No-op in non-TTY mode or when
+     * no phase is active.
+     */
+    updateDetail(detail) {
+        if (!this.isTTY || !this.currentPhase)
+            return;
+        this.currentPhase.detail = detail;
+    }
     /**
      * Mark the current phase as done. In non-TTY mode, immediately writes
      * a static line. Emits a nerves event for observability.
@@ -94,7 +104,8 @@ class UpProgress {
             const elapsedSec = (elapsed / 1000).toFixed(1);
             const frameIndex = Math.floor(elapsed / 80) % SPINNER_FRAMES.length;
             const spinner = SPINNER_FRAMES[frameIndex];
-            lines.push(`  ${BOLD}${spinner}${RESET} ${this.currentPhase.label} ${DIM}(${elapsedSec}s)${RESET}`);
+            const detailSuffix = this.currentPhase.detail ? ` \u2014 ${this.currentPhase.detail}` : "";
+            lines.push(`  ${BOLD}${spinner}${RESET} ${this.currentPhase.label} ${DIM}(${elapsedSec}s)${detailSuffix}${RESET}`);
         }
         let output = "";
         if (this.prevLineCount > 0) {

package/dist/heart/provider-credentials.js

@@ -224,6 +224,7 @@ function readProviderCredentialPool(agentName) {
 async function refreshProviderCredentialPool(agentName, options = {}) {
     try {
         const store = (0, credential_access_1.getCredentialStore)(agentName);
+        options.onProgress?.(`reading vault items for ${agentName}...`);
         const items = await store.list();
         const providers = {};
         let updatedAt = new Date(0).toISOString();
@@ -233,6 +234,7 @@ async function refreshProviderCredentialPool(agentName, options = {}) {
             const provider = item.domain.slice(VAULT_ITEM_PREFIX.length);
             if (!isAgentProvider(provider))
                 continue;
+            options.onProgress?.(`reading ${provider} credentials...`);
             const raw = await store.getRawSecret(item.domain, "password");
             const payload = validateProviderCredentialPayload(JSON.parse(raw), provider);
             const record = recordFromPayload(payload);
@@ -240,6 +242,7 @@ async function refreshProviderCredentialPool(agentName, options = {}) {
             if (record.updatedAt > updatedAt)
                 updatedAt = record.updatedAt;
         }
+        options.onProgress?.("parsing provider credentials...");
         const pool = {
             schemaVersion: 1,
             updatedAt,

package/dist/repertoire/bitwarden-store.js

@@ -45,6 +45,7 @@ exports.BitwardenCredentialStore = void 0;
 exports.sanitizeCredentialErrorDetail = sanitizeCredentialErrorDetail;
 const node_child_process_1 = require("node:child_process");
 const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
 const runtime_1 = require("../nerves/runtime");
 const bw_installer_1 = require("./bw-installer");
 const MAX_ERROR_DETAIL_LENGTH = 500;
@@ -130,13 +131,118 @@ function isBwConfigLogoutRequired(err) {
     const message = err.message.toLowerCase();
     return message.includes("logout") && message.includes("required");
 }
+// ---------------------------------------------------------------------------
+// Cross-process bw CLI lock
+// ---------------------------------------------------------------------------
+// The bw CLI cannot handle concurrent access to the same app data directory.
+// Two processes (e.g. daemon worker + ouro up CLI) hitting the same dir
+// simultaneously corrupt bw's local state, producing empty/garbled output.
+//
+// We use two layers:
+//   1. In-process async mutex: a Map<string, Promise<void>> keyed by appDataDir
+//      serializes calls within a single Node.js process.
+//   2. Cross-process file lock: fs.openSync(lockPath, 'wx') with PID stale
+//      detection serializes across processes.
+// ---------------------------------------------------------------------------
+const BW_LOCK_FILENAME = ".ouro-bw.lock";
+const BW_LOCK_TIMEOUT_MS = 30_000;
+const BW_LOCK_POLL_MS = 100;
+/** In-process async mutex keyed by appDataDir. */
+const inProcessLocks = new Map();
+function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function acquireFileLock(lockPath) {
+    const content = `${process.pid}\n`;
+    const deadline = Date.now() + BW_LOCK_TIMEOUT_MS;
+    while (true) {
+        try {
+            const fd = fs.openSync(lockPath, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL);
+            fs.writeSync(fd, content);
+            fs.closeSync(fd);
+            return;
+        }
+        catch (err) {
+            if (err.code !== "EEXIST") {
+                throw err;
+            }
+            // Lock file exists -- check for stale lock
+            try {
+                const existing = fs.readFileSync(lockPath, "utf8").trim();
+                const pid = parseInt(existing, 10);
+                if (!isNaN(pid) && !isPidAlive(pid)) {
+                    // Stale lock -- remove and retry immediately
+                    try {
+                        fs.unlinkSync(lockPath);
+                    }
+                    catch { /* race with another cleaner is fine */ }
+                    continue;
+                }
+            }
+            catch { /* v8 ignore next -- race: lock file disappeared between openSync and readFileSync @preserve */
+                continue;
+            }
+            if (Date.now() >= deadline) {
+                throw new Error(`bw CLI lock timeout: could not acquire ${lockPath} within ${BW_LOCK_TIMEOUT_MS}ms`);
+            }
+            // Yield to the event loop before retrying
+            await delay(BW_LOCK_POLL_MS);
+        }
+    }
+}
+function releaseFileLock(lockPath) {
+    try {
+        fs.unlinkSync(lockPath);
+    }
+    catch {
+        // Already removed or never created -- safe to ignore
+    }
+}
+async function withBwLock(appDataDir, fn) {
+    if (!appDataDir) {
+        // No appDataDir means the default bw data location. Still need in-process
+        // serialization but cannot do cross-process file lock without a dir.
+        return fn();
+    }
+    const lockKey = appDataDir;
+    const lockPath = path.join(appDataDir, BW_LOCK_FILENAME);
+    // In-process serialization: chain onto the previous promise for this key
+    const previous = inProcessLocks.get(lockKey) ?? Promise.resolve();
+    let releaseLock;
+    const current = new Promise((resolve) => { releaseLock = resolve; });
+    inProcessLocks.set(lockKey, current);
+    await previous;
+    let fileLockAcquired = false;
+    try {
+        // Cross-process file lock
+        await acquireFileLock(lockPath);
+        fileLockAcquired = true;
+        return await fn();
+    }
+    finally {
+        if (fileLockAcquired) {
+            releaseFileLock(lockPath);
+        }
+        releaseLock();
+        // Clean up the map entry if we are the latest
+        if (inProcessLocks.get(lockKey) === current) {
+            inProcessLocks.delete(lockKey);
+        }
+    }
+}
 function execBw(args, sessionToken, appDataDir, stdin) {
     const env = {
         ...process.env,
         ...(sessionToken ? { BW_SESSION: sessionToken } : {}),
         ...(appDataDir ? { BITWARDENCLI_APPDATA_DIR: appDataDir } : {}),
     };
-    return new Promise((resolve, reject) => {
+    const runCommand = () => new Promise((resolve, reject) => {
         const child = (0, node_child_process_1.execFile)("bw", args, { timeout: 30_000, env }, (err, stdout, stderr) => {
             if (err) {
                 if (isBwNotInstalled(err)) {
@@ -152,6 +258,7 @@ function execBw(args, sessionToken, appDataDir, stdin) {
             child?.stdin?.end(stdin);
         }
     });
+    return withBwLock(appDataDir, runCommand);
 }
 /** Check if the error indicates the bw CLI binary is not installed. */
 function isBwNotInstalled(err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.411",
+  "version": "0.1.0-alpha.413",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",