@ouro.bot/cli 0.1.0-alpha.413 → 0.1.0-alpha.415

package/changelog.json

@@ -1,6 +1,24 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.415",
+      "changes": [
+        "Transient vault errors (timeout, ECONNREFUSED, socket hang up) are now classified separately from vault-locked errors in `ouro up` provider checks -- operators see retry guidance instead of misleading unlock/replace/recover instructions.",
+        "Fix text across vault unlock, vault create, missing credential, and failed ping results tightened to concise single-line instructions.",
+        "`@ouro.bot/cli` and the `ouro.bot` wrapper are version-synced for the error classification release."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.414",
+      "changes": [
+        "`openai-codex` live checks now use the same Responses API request shape as real Codex turns, so `ouro up` and `ouro auth verify` stop reporting false `400 status code (no body)` failures for healthy GPT-5.4 credentials.",
+        "`ouro up` now detects daemon roster drift when enabled agent bundles change on disk and restarts the stale daemon, which removes ghost agents like a locally-removed `ouroboros` from the repair queue instead of pretending they still live here.",
+        "Bundle skeleton contract coverage now validates whichever local agent bundles actually exist, so one-agent machines can keep `slugger` installed without failing the full test suite just because `ouroboros` was intentionally removed.",
+        "Expanded Codex provider runtime coverage to exercise the real turn path, preserved output-item turn state, runtime error classification, and the ping callback bundle, which keeps the global 100% coverage gate green for this repair.",
+        "`@ouro.bot/cli` and the `ouro.bot` wrapper are version-synced for the Codex live-check and daemon-roster drift repair release."
+      ]
+    },
     {
       "version": "0.1.0-alpha.413",
       "changes": [

package/dist/heart/daemon/agent-config-check.js

@@ -233,7 +233,7 @@ function missingCredentialResult(agentName, lane, provider, model, credentialPat
     return {
         ok: false,
         error: `${lane} provider ${provider} model ${model} has no credentials in ${agentName}'s vault at ${credentialPath}`,
-        fix: `Run 'ouro auth --agent ${agentName} --provider ${provider}' to authenticate this machine, or run 'ouro use --agent ${agentName} --lane ${lane} --provider <provider> --model <model>' to choose a working provider/model.`,
+        fix: `Run 'ouro auth --agent ${agentName} --provider ${provider}' to authenticate.`,
         issue: (0, readiness_repair_1.providerCredentialMissingIssue)({
             agentName,
             lane,
@@ -243,7 +243,21 @@ function missingCredentialResult(agentName, lane, provider, model, credentialPat
         }),
     };
 }
+function isTransientVaultError(error) {
+    const normalized = error.toLowerCase();
+    return (normalized.includes("timed out") ||
+        normalized.includes("econnrefused") ||
+        normalized.includes("socket hang up") ||
+        normalized.includes("etimedout"));
+}
 function invalidPoolResult(agentName, lane, provider, model, pool) {
+    if (pool.reason === "unavailable" && isTransientVaultError(pool.error)) {
+        return {
+            ok: false,
+            error: `${lane} provider ${provider} model ${model} cannot read provider credentials from ${agentName}'s vault: ${pool.error}`,
+            fix: `Vault read timed out -- this usually resolves on retry. Run 'ouro up' again.`,
+        };
+    }
     if (pool.reason === "unavailable" && isVaultLockedError(pool.error)) {
         return {
             ok: false,
@@ -284,7 +298,7 @@ function failedPingResult(agentName, lane, provider, model, result) {
     return {
         ok: false,
         error: `${lane} provider ${provider} model ${model} failed live check: ${result.message}`,
-        fix: `Run 'ouro auth --agent ${agentName} --provider ${provider}' to refresh credentials, or run 'ouro use --agent ${agentName} --lane ${lane} --provider <provider> --model <model>' to switch this lane.`,
+        fix: `Run 'ouro auth --agent ${agentName} --provider ${provider}' to refresh credentials.`,
         issue: (0, readiness_repair_1.providerLiveCheckFailedIssue)({
             agentName,
             lane,

package/dist/heart/daemon/cli-exec.js

@@ -157,6 +157,10 @@ async function listCliAgents(deps) {
     }
     return [];
 }
+function managedAgentsSignature(agentNames) {
+    const unique = [...new Set(agentNames.map((agent) => agent.trim()).filter((agent) => agent.length > 0))].sort();
+    return unique.length > 0 ? unique.join(",") : "(none)";
+}
 async function checkAlreadyRunningAgentProviders(deps, onProgress) {
     return checkAgentProviders(deps, undefined, onProgress);
 }
@@ -267,6 +271,9 @@ async function ensureDaemonRunning(deps, options = {}) {
     const alive = options.initialAlive ?? await deps.checkSocketAlive(deps.socketPath);
     if (alive) {
         const localRuntime = (0, runtime_metadata_1.getRuntimeMetadata)();
+        const localManagedAgents = managedAgentsSignature((0, agent_discovery_1.listEnabledBundleAgents)({
+            bundlesRoot: deps.bundlesRoot ?? (0, identity_1.getAgentBundlesRoot)(),
+        }));
         let runningRuntimePromise = null;
         const fetchRunningRuntimeMetadata = async () => {
             runningRuntimePromise ??= (async () => {
@@ -277,6 +284,9 @@ async function ensureDaemonRunning(deps, options = {}) {
                     lastUpdated: payload?.overview.lastUpdated ?? "unknown",
                     repoRoot: payload?.overview.repoRoot ?? "unknown",
                     configFingerprint: payload?.overview.configFingerprint ?? "unknown",
+                    managedAgents: payload && payload.workers.length > 0
+                        ? managedAgentsSignature(payload.workers.map((worker) => worker.agent))
+                        : "unknown",
                 };
             })();
             return runningRuntimePromise;
@@ -287,6 +297,7 @@ async function ensureDaemonRunning(deps, options = {}) {
             localLastUpdated: localRuntime.lastUpdated,
             localRepoRoot: localRuntime.repoRoot,
             localConfigFingerprint: localRuntime.configFingerprint,
+            localManagedAgents,
             fetchRunningVersion: async () => (await fetchRunningRuntimeMetadata()).version,
             fetchRunningRuntimeMetadata,
             stopDaemon: async () => {

package/dist/heart/daemon/daemon-runtime-sync.js

@@ -32,6 +32,7 @@ function normalizeRuntimeIdentity(value) {
         lastUpdated: typeof value.lastUpdated === "string" ? value.lastUpdated : "unknown",
         repoRoot: typeof value.repoRoot === "string" ? value.repoRoot : "unknown",
         configFingerprint: typeof value.configFingerprint === "string" ? value.configFingerprint : "unknown",
+        managedAgents: typeof value.managedAgents === "string" ? value.managedAgents : "unknown",
     };
 }
 async function readRunningRuntimeIdentity(deps) {
@@ -70,6 +71,16 @@ function collectRuntimeDriftReasons(local, running) {
             running: running.configFingerprint,
         });
     }
+    if (isKnownRuntimeValue(local.managedAgents)
+        && isKnownRuntimeValue(running.managedAgents)
+        && local.managedAgents !== running.managedAgents) {
+        reasons.push({
+            key: "managedAgents",
+            label: "managed agents",
+            local: local.managedAgents,
+            running: running.managedAgents,
+        });
+    }
     return reasons;
 }
 function formatRuntimeValue(reason) {
@@ -87,6 +98,7 @@ async function ensureCurrentDaemonRuntime(deps) {
         lastUpdated: deps.localLastUpdated,
         repoRoot: deps.localRepoRoot,
         configFingerprint: deps.localConfigFingerprint,
+        managedAgents: deps.localManagedAgents,
     });
     try {
         const runningRuntime = await readRunningRuntimeIdentity(deps);
@@ -118,10 +130,12 @@ async function ensureCurrentDaemonRuntime(deps) {
                         localLastUpdated: localRuntime.lastUpdated,
                         localRepoRoot: localRuntime.repoRoot,
                         localConfigFingerprint: localRuntime.configFingerprint,
+                        localManagedAgents: localRuntime.managedAgents,
                         runningVersion,
                         runningLastUpdated: runningRuntime.lastUpdated,
                         runningRepoRoot: runningRuntime.repoRoot,
                         runningConfigFingerprint: runningRuntime.configFingerprint,
+                        runningManagedAgents: runningRuntime.managedAgents,
                         action: "stale_replace_failed",
                         driftKeys: driftReasons.map((entry) => entry.key),
                         reason,
@@ -153,10 +167,12 @@ async function ensureCurrentDaemonRuntime(deps) {
                     localLastUpdated: localRuntime.lastUpdated,
                     localRepoRoot: localRuntime.repoRoot,
                     localConfigFingerprint: localRuntime.configFingerprint,
+                    localManagedAgents: localRuntime.managedAgents,
                     runningVersion,
                     runningLastUpdated: runningRuntime.lastUpdated,
                     runningRepoRoot: runningRuntime.repoRoot,
                     runningConfigFingerprint: runningRuntime.configFingerprint,
+                    runningManagedAgents: runningRuntime.managedAgents,
                     action: "stale_restarted",
                     driftKeys: driftReasons.map((entry) => entry.key),
                     pid: started.pid ?? null,
@@ -179,10 +195,12 @@ async function ensureCurrentDaemonRuntime(deps) {
                     localLastUpdated: localRuntime.lastUpdated,
                     localRepoRoot: localRuntime.repoRoot,
                     localConfigFingerprint: localRuntime.configFingerprint,
+                    localManagedAgents: localRuntime.managedAgents,
                     runningVersion,
                     runningLastUpdated: runningRuntime.lastUpdated,
                     runningRepoRoot: runningRuntime.repoRoot,
                     runningConfigFingerprint: runningRuntime.configFingerprint,
+                    runningManagedAgents: runningRuntime.managedAgents,
                     action: "unknown_version",
                 },
             });
@@ -206,6 +224,7 @@ async function ensureCurrentDaemonRuntime(deps) {
                 localLastUpdated: localRuntime.lastUpdated,
                 localRepoRoot: localRuntime.repoRoot,
                 localConfigFingerprint: localRuntime.configFingerprint,
+                localManagedAgents: localRuntime.managedAgents,
                 action: "status_lookup_failed",
                 reason,
             },
@@ -228,6 +247,7 @@ async function ensureCurrentDaemonRuntime(deps) {
             localLastUpdated: localRuntime.lastUpdated,
             localRepoRoot: localRuntime.repoRoot,
             localConfigFingerprint: localRuntime.configFingerprint,
+            localManagedAgents: localRuntime.managedAgents,
             action: "already_current",
         },
     });

package/dist/heart/providers/openai-codex.js

@@ -20,6 +20,16 @@ const OPENAI_CODEX_AUTH_FAILURE_MARKERS = [
     "invalid bearer token",
 ];
 const OPENAI_CODEX_BACKEND_BASE_URL = "https://chatgpt.com/backend-api/codex";
+const OPENAI_CODEX_PING_INPUT = [{ role: "user", content: "ping" }];
+const OPENAI_CODEX_PING_CALLBACKS = {
+    onModelStart() { },
+    onModelStreamStart() { },
+    onTextChunk() { },
+    onReasoningChunk() { },
+    onToolStart() { },
+    onToolEnd() { },
+    onError() { },
+};
 function getOpenAICodexAgentNameForGuidance() {
     return (0, identity_1.getAgentName)();
 }
@@ -82,6 +92,18 @@ function getChatGPTAccountIdFromToken(token) {
         return "";
     return accountId.trim();
 }
+function createOpenAICodexResponsesParams(input, instructions, model, reasoningEffort) {
+    return {
+        model,
+        input,
+        instructions,
+        tools: [],
+        reasoning: { effort: reasoningEffort, summary: "detailed" },
+        stream: true,
+        store: false,
+        include: ["reasoning.encrypted_content"],
+    };
+}
 function createOpenAICodexProviderRuntime(model, codexConfig = (0, config_1.getOpenAICodexConfig)()) {
     (0, runtime_1.emitNervesEvent)({
         component: "engine",
@@ -137,16 +159,8 @@ function createOpenAICodexProviderRuntime(model, codexConfig = (0, config_1.getO
         async streamTurn(request) {
             if (!nativeInput)
                 this.resetTurnState(request.messages);
-            const params = {
-                model: this.model,
-                input: nativeInput,
-                instructions: nativeInstructions,
-                tools: (0, streaming_1.toResponsesTools)(request.activeTools),
-                reasoning: { effort: request.reasoningEffort ?? "medium", summary: "detailed" },
-                stream: true,
-                store: false,
-                include: ["reasoning.encrypted_content"],
-            };
+            const params = createOpenAICodexResponsesParams(nativeInput, nativeInstructions, this.model, request.reasoningEffort ?? "medium");
+            params.tools = (0, streaming_1.toResponsesTools)(request.activeTools);
             if (request.toolChoiceRequired)
                 params.tool_choice = "required";
             try {
@@ -161,7 +175,7 @@ function createOpenAICodexProviderRuntime(model, codexConfig = (0, config_1.getO
         },
         /* v8 ignore start -- ping: tested via provider-ping.test.ts @preserve */
         async ping(signal) {
-            await this.client.responses.create({ model: this.model, input: "ping", max_output_tokens: 16 }, { signal });
+            await (0, streaming_1.streamResponsesApi)(this.client, createOpenAICodexResponsesParams(OPENAI_CODEX_PING_INPUT, "", this.model, "medium"), OPENAI_CODEX_PING_CALLBACKS, signal);
         },
         /* v8 ignore stop */
         /* v8 ignore next 3 -- delegation: classification logic tested via classifyOpenAICodexError @preserve */

package/dist/repertoire/vault-unlock.js

@@ -101,13 +101,8 @@ function missingSecureStoreMessage(config) {
             : "Run `ouro vault unlock --store plaintext-file` to store the vault unlock secret in a chmod 0600 local file.",
     ].join("\n");
 }
-function vaultUnlockReplaceRecoverFix(agentName, nextStep = "Then run 'ouro up' again.") {
-    return [
-        `Run 'ouro vault unlock --agent ${agentName}' if you have the saved vault unlock secret.`,
-        `If this agent predates vault auth or nobody saved the unlock secret, run 'ouro vault replace --agent ${agentName}' to create a new empty vault, then re-auth/re-enter credentials.`,
-        `If you do have a local JSON credential export, run 'ouro vault recover --agent ${agentName} --from <json>' to create the agent vault and import it.`,
-        nextStep,
-    ].join(" ");
+function vaultUnlockReplaceRecoverFix(agentName, _nextStep) {
+    return `Run 'ouro vault unlock --agent ${agentName}' or 'ouro vault replace --agent ${agentName}' if the secret is lost.`;
 }
 function credentialVaultNotConfiguredError(agentName, configPath) {
     return (`${CREDENTIAL_VAULT_NOT_CONFIGURED_PREFIX}${configPath}. ` +
@@ -116,12 +111,8 @@ function credentialVaultNotConfiguredError(agentName, configPath) {
 function isCredentialVaultNotConfiguredError(message) {
     return message.includes(CREDENTIAL_VAULT_NOT_CONFIGURED_PREFIX);
 }
-function vaultCreateRecoverFix(agentName, nextStep = "Then run 'ouro up' again.") {
-    return [
-        `Run 'ouro vault create --agent ${agentName}' to create this agent's vault.`,
-        `If you still have a local JSON credential export from an earlier alpha, run 'ouro vault recover --agent ${agentName} --from <json>' instead.`,
-        nextStep,
-    ].join(" ");
+function vaultCreateRecoverFix(agentName, _nextStep) {
+    return `Run 'ouro vault create --agent ${agentName}' to set up this agent's vault.`;
 }
 function vaultUnlockSecretStrengthIssues(secret) {
     const issues = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.413",
+  "version": "0.1.0-alpha.415",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",