@ouro.bot/cli 0.1.0-alpha.416 → 0.1.0-alpha.418

package/changelog.json

@@ -1,6 +1,28 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.418",
+      "changes": [
+        "`ouro up` now uses the live progress renderer in interactive terminals instead of forcing static non-TTY output, so long startup/check phases animate instead of leaving a blinking cursor.",
+        "Non-TTY and captured `ouro up` output now prints current phase starts and changed detail lines (`launching daemon process`, `waiting for daemon socket`, `daemon answered`) before completion, avoiding silent waits in logs and terminal sessions that cannot render spinners.",
+        "Daemon startup readiness is completed explicitly before provider checks begin; `ouro up` no longer marks `starting daemon` as done by accidentally auto-completing it when the next phase starts.",
+        "Daemon startup polling can now report progress into the parent `ouro up` checklist without rendering its own nested startup TUI, keeping startup output as one coherent surface.",
+        "Runtime drift restart messages now summarize drift categories such as `code path` or `managed agents` without printing raw worktree/package paths in normal CLI output.",
+        "Default CLI stdout now writes exactly one newline instead of using `console.log`, removing the extra blank lines caused when progress renderers already include newline-terminated output.",
+        "`@ouro.bot/cli` and the `ouro.bot` wrapper are version-synced for the `ouro up` progress polish release."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.417",
+      "changes": [
+        "`isTransientError` now recognizes timeout errors after `formatBwCliError` transforms them, so retries fire correctly even when the raw `ETIMEDOUT` code is lost during formatting.",
+        "New `withTransientRetry` wrapper on read operations (`get`, `getRawSecret`, `list`) retries up to 3 times with exponential backoff (500ms, 1s, 2s) and emits `repertoire.bw_transient_retry` nerves events, so transient vault hiccups resolve silently.",
+        "`bw sync` now runs after every login/unlock in `loginAttempt()`, ensuring vault data is synchronized with the server before any read operations.",
+        "Timeout error messages changed from a generic 'timed out while waiting for a vault response' to actionable guidance: 'timed out -- usually resolves on retry. If it persists, check network connectivity to the vault server.'",
+        "`@ouro.bot/cli` and the `ouro.bot` wrapper are version-synced for the Bitwarden store resilience release."
+      ]
+    },
     {
       "version": "0.1.0-alpha.416",
       "changes": [

package/dist/heart/daemon/cli-defaults.js

@@ -89,9 +89,13 @@ function defaultStartDaemonProcess(socketPath) {
     return Promise.resolve({ pid: child.pid ?? null });
 }
 function defaultWriteStdout(text) {
-    // eslint-disable-next-line no-console -- terminal UX: CLI command output
-    console.log(text);
+    process.stdout.write(text.endsWith("\n") ? text : `${text}\n`);
 }
+/* v8 ignore start -- thin terminal adapter around process stdout @preserve */
+function defaultWriteRaw(text) {
+    process.stdout.write(text);
+}
+/* v8 ignore stop */
 /**
  * Read the runtimeVersion from the first .ouro bundle's bundle-meta.json.
  * Returns undefined if none found or unreadable.
@@ -486,6 +490,8 @@ function createDefaultOuroCliDeps(socketPath = socket_client_1.DEFAULT_DAEMON_SO
         sendCommand: socket_client_1.sendDaemonCommand,
         startDaemonProcess: defaultStartDaemonProcess,
         writeStdout: defaultWriteStdout,
+        writeRaw: defaultWriteRaw,
+        isTTY: process.stdout.isTTY === true,
         checkSocketAlive: socket_client_1.checkDaemonSocketAlive,
         cleanupStaleSocket: defaultCleanupStaleSocket,
         fallbackPendingMessage: defaultFallbackPendingMessage,

package/dist/heart/daemon/cli-exec.js

@@ -179,6 +179,15 @@ function providerRepairCountSummary(count) {
         return "ok";
     return `${count} ${count === 1 ? "needs" : "need"} attention`;
 }
+function daemonProgressSummary(result) {
+    if (result.verifyStartupStatus === false)
+        return "not answering yet";
+    if (result.alreadyRunning)
+        return "already running";
+    if (result.message.includes("restarted"))
+        return "restarted and ready";
+    return "ready";
+}
 async function reportPostRepairProviderHealth(deps, repairedAgents, onProgress) {
     const remainingDegraded = await checkAgentProviders(deps, repairedAgents, onProgress);
     (0, runtime_1.emitNervesEvent)({
@@ -314,17 +323,19 @@ async function ensureDaemonRunning(deps, options = {}) {
             sendCommand: deps.sendCommand,
             socketPath: deps.socketPath,
             daemonPid: runtimeResult.startedPid ?? null,
-            /* v8 ignore next -- thin wrapper: raw process.stdout.write for ANSI cursor control @preserve */
-            writeRaw: (text) => process.stdout.write(text),
-            /* v8 ignore next -- thin wrapper: real stdout TTY detection injected for captured-output safety @preserve */
-            isTTY: process.stdout.isTTY === true,
-            /* v8 ignore next -- thin wrapper: real Date.now() injected for testability @preserve */
-            now: () => Date.now(),
-            /* v8 ignore next -- thin wrapper: real setTimeout injected for testability @preserve */
-            sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+            /* v8 ignore next -- thin wrapper: real stdout fallback injected by default deps @preserve */
+            writeRaw: deps.writeRaw ?? ((text) => process.stdout.write(text)),
+            /* v8 ignore next -- thin wrapper: real stdout TTY detection injected by default deps @preserve */
+            isTTY: deps.isTTY ?? process.stdout.isTTY === true,
+            /* v8 ignore next -- thin wrapper: real Date.now fallback injected by default deps @preserve */
+            now: deps.now ?? (() => Date.now()),
+            /* v8 ignore next -- thin wrapper: real setTimeout fallback injected by default deps @preserve */
+            sleep: deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms))),
             /* v8 ignore start -- daemon log tail + pid check: reads real filesystem, tested via deployment @preserve */
             readLatestDaemonEvent: readLatestDaemonStartupEvent,
             /* v8 ignore stop */
+            onProgress: deps.reportDaemonStartupPhase,
+            render: !deps.reportDaemonStartupPhase,
         });
         return {
             alreadyRunning: runtimeResult.alreadyRunning,
@@ -339,8 +350,8 @@ async function ensureDaemonRunning(deps, options = {}) {
     };
     let lastPid = null;
     for (let attempt = 0; attempt <= retryLimit; attempt += 1) {
-        deps.reportDaemonStartupPhase?.("starting daemon...");
-        deps.reportDaemonStartupPhase?.("waiting for daemon socket...");
+        deps.reportDaemonStartupPhase?.("launching daemon process");
+        deps.reportDaemonStartupPhase?.("waiting for daemon socket");
         deps.cleanupStaleSocket(deps.socketPath);
         const bootStartedAtMs = (deps.now ?? Date.now)();
         const started = await deps.startDaemonProcess(deps.socketPath);
@@ -354,17 +365,19 @@ async function ensureDaemonRunning(deps, options = {}) {
                 sendCommand: deps.sendCommand,
                 socketPath: deps.socketPath,
                 daemonPid: lastPid,
-                /* v8 ignore next -- thin wrapper: raw process.stdout.write for ANSI cursor control @preserve */
-                writeRaw: (text) => process.stdout.write(text),
-                /* v8 ignore next -- thin wrapper: real stdout TTY detection injected for captured-output safety @preserve */
-                isTTY: process.stdout.isTTY === true,
-                /* v8 ignore next -- thin wrapper: real Date.now() injected for testability @preserve */
-                now: () => Date.now(),
-                /* v8 ignore next -- thin wrapper: real setTimeout injected for testability @preserve */
-                sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+                /* v8 ignore next -- thin wrapper: real stdout fallback injected by default deps @preserve */
+                writeRaw: deps.writeRaw ?? ((text) => process.stdout.write(text)),
+                /* v8 ignore next -- thin wrapper: real stdout TTY detection injected by default deps @preserve */
+                isTTY: deps.isTTY ?? process.stdout.isTTY === true,
+                /* v8 ignore next -- thin wrapper: real Date.now fallback injected by default deps @preserve */
+                now: deps.now ?? (() => Date.now()),
+                /* v8 ignore next -- thin wrapper: real setTimeout fallback injected by default deps @preserve */
+                sleep: deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms))),
                 /* v8 ignore start -- daemon log tail + pid check: reads real filesystem, tested via deployment @preserve */
                 readLatestDaemonEvent: readLatestDaemonStartupEvent,
                 /* v8 ignore stop */
+                onProgress: deps.reportDaemonStartupPhase,
+                render: !deps.reportDaemonStartupPhase,
             });
             return {
                 alreadyRunning: false,
@@ -376,7 +389,7 @@ async function ensureDaemonRunning(deps, options = {}) {
         if (!startupFailure.retryable || attempt >= retryLimit) {
             break;
         }
-        deps.reportDaemonStartupPhase?.("daemon startup lost stability; cleaning up and retrying once...");
+        deps.reportDaemonStartupPhase?.("daemon startup lost stability; retrying once");
     }
     return {
         alreadyRunning: false,
@@ -449,7 +462,7 @@ async function waitForDaemonStartup(deps, options) {
         if (!sawSocket) {
             sawSocket = true;
             stableSinceMs = now();
-            deps.reportDaemonStartupPhase?.("verifying daemon health...");
+            deps.reportDaemonStartupPhase?.("verifying daemon health");
         }
         if (!hasFreshCurrentBootHealthSignal(deps, options.bootStartedAtMs, options.pid)) {
             continue;
@@ -2469,7 +2482,13 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
             }
         }
         const linkedVersionBeforeUp = deps.getCurrentCliVersion?.() ?? null;
-        const progress = new up_progress_1.UpProgress({ write: deps.writeStdout, isTTY: false });
+        const outputIsTTY = deps.isTTY ?? process.stdout.isTTY === true;
+        const progress = new up_progress_1.UpProgress({
+            write: deps.writeRaw ?? deps.writeStdout,
+            isTTY: outputIsTTY,
+            now: deps.now ?? (() => Date.now()),
+            autoRender: true,
+        });
         // ── versioned CLI update check ──
         if (deps.checkForCliUpdate) {
             progress.startPhase("update check");
@@ -2631,6 +2650,12 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
                 progress.announceStep?.(label);
             },
         }, { initialAlive: daemonAliveBeforeStart });
+        progress.completePhase("starting daemon", daemonProgressSummary(daemonResult));
+        if (daemonResult.verifyStartupStatus === false) {
+            progress.end();
+            deps.writeStdout(daemonResult.message);
+            return daemonResult.message;
+        }
         if (!providerChecksAlreadyRun || daemonResult.alreadyRunning) {
             progress.startPhase("provider checks");
             const providerDegraded = await checkAlreadyRunningAgentProviders(deps, (msg) => progress.updateDetail(msg));
@@ -2638,7 +2663,6 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
             progress.completePhase("provider checks", providerRepairCountSummary(providerDegraded.length));
         }
         progress.end();
-        deps.writeStdout(daemonResult.message);
         // Interactive repair for degraded agents (Unit 5) — skipped by --no-repair (Unit 6)
         if (daemonResult.stability?.degraded && daemonResult.stability.degraded.length > 0) {
             if (command.noRepair) {

package/dist/heart/daemon/daemon-runtime-sync.js

@@ -83,14 +83,8 @@ function collectRuntimeDriftReasons(local, running) {
     }
     return reasons;
 }
-function formatRuntimeValue(reason) {
-    if (reason.key === "configFingerprint") {
-        return `${reason.running.slice(0, 12)} -> ${reason.local.slice(0, 12)}`;
-    }
-    return `${reason.running} -> ${reason.local}`;
-}
-function formatRuntimeDriftSummary(reasons) {
-    return reasons.map((reason) => `${reason.label} ${formatRuntimeValue(reason)}`).join("; ");
+function formatRuntimeDriftPublicSummary(reasons) {
+    return reasons.map((reason) => reason.label).join(", ");
 }
 async function ensureCurrentDaemonRuntime(deps) {
     const localRuntime = normalizeRuntimeIdentity({
@@ -107,7 +101,7 @@ async function ensureCurrentDaemonRuntime(deps) {
         let result;
         if (driftReasons.length > 0) {
             const includesVersionDrift = driftReasons.some((entry) => entry.key === "version");
-            const driftSummary = formatRuntimeDriftSummary(driftReasons);
+            const publicDriftSummary = formatRuntimeDriftPublicSummary(driftReasons);
             try {
                 await deps.stopDaemon();
             }
@@ -117,7 +111,7 @@ async function ensureCurrentDaemonRuntime(deps) {
                     alreadyRunning: true,
                     message: includesVersionDrift
                         ? `daemon already running (${deps.socketPath}; could not replace stale daemon ${runningVersion} -> ${deps.localVersion}: ${reason})`
-                        : `daemon already running (${deps.socketPath}; could not replace drifted daemon ${driftSummary}: ${reason})`,
+                        : `daemon already running (${deps.socketPath}; could not replace runtime drift ${publicDriftSummary}: ${reason})`,
                 };
                 (0, runtime_1.emitNervesEvent)({
                     level: "warn",
@@ -148,12 +142,12 @@ async function ensureCurrentDaemonRuntime(deps) {
             const pid = started.pid ?? "unknown";
             const verified = await verifyDaemonStarted(deps);
             /* v8 ignore next -- daemon liveness failure: requires real daemon crash timing @preserve */
-            const suffix = verified ? "" : "\ndaemon did not answer yet, so Ouro is checking repair paths next.";
+            const suffix = verified ? "" : "\ndaemon restart has not answered yet; check logs with `ouro logs` or run `ouro doctor`.";
             result = {
                 alreadyRunning: false,
                 message: includesVersionDrift
                     ? `restarted stale daemon ${runningVersion} -> ${deps.localVersion} (pid ${pid})${suffix}`
-                    : `restarted drifted daemon (${driftSummary}) (pid ${pid})${suffix}`,
+                    : `restarted daemon after runtime drift: ${publicDriftSummary} (pid ${pid})${suffix}`,
                 verifyStartupStatus: verified,
                 startedPid: started.pid ?? null,
             };

package/dist/heart/daemon/startup-tui.js

@@ -134,6 +134,14 @@ async function pollDaemonStartup(deps) {
     let prevLineCount = 0;
     const isTTY = deps.isTTY ?? true;
     const isAlive = deps.isProcessAlive ?? defaultIsProcessAlive;
+    const shouldRender = deps.render ?? true;
+    let lastProgress = null;
+    const reportProgress = (message) => {
+        if (!deps.onProgress || message === lastProgress)
+            return;
+        lastProgress = message;
+        deps.onProgress(message);
+    };
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
         event: "daemon.startup_poll_start",
@@ -174,22 +182,30 @@ async function pollDaemonStartup(deps) {
             }
             // Show what the daemon is doing from its log
             const latestEvent = deps.readLatestDaemonEvent?.() ?? null;
-            const output = renderWaitingForDaemon(elapsed, latestEvent, prevLineCount, { isTTY });
-            deps.writeRaw(output);
-            prevLineCount = latestEvent ? 2 : 1;
+            reportProgress(latestEvent ?? "waiting for daemon");
+            if (shouldRender) {
+                const output = renderWaitingForDaemon(elapsed, latestEvent, prevLineCount, { isTTY });
+                deps.writeRaw(output);
+                prevLineCount = latestEvent ? 2 : 1;
+            }
         }
         if (payload) {
-            const output = renderStartupProgress(payload, elapsed, prevLineCount, { isTTY });
-            deps.writeRaw(output);
-            prevLineCount = payload.workers.length + 1;
+            reportProgress(formatStartupProgressDetail(payload));
+            if (shouldRender) {
+                const output = renderStartupProgress(payload, elapsed, prevLineCount, { isTTY });
+                deps.writeRaw(output);
+                prevLineCount = payload.workers.length + 1;
+            }
             const assessment = assessStability(payload, now);
             if (assessment.resolved) {
                 const result = {
                     stable: assessment.stable,
                     degraded: assessment.degraded,
                 };
-                const summary = renderFinalSummary(result, isTTY);
-                deps.writeRaw(summary);
+                if (shouldRender) {
+                    const summary = renderFinalSummary(result, isTTY);
+                    deps.writeRaw(summary);
+                }
                 (0, runtime_1.emitNervesEvent)({
                     component: "daemon",
                     event: "daemon.startup_poll_end",
@@ -206,6 +222,12 @@ async function pollDaemonStartup(deps) {
         await deps.sleep(POLL_INTERVAL_MS);
     }
 }
+function formatStartupProgressDetail(payload) {
+    if (payload.workers.length === 0)
+        return "daemon answered";
+    const workers = payload.workers.map((worker) => `${worker.agent}/${worker.worker} ${worker.status}`).join(", ");
+    return `waiting for agents: ${workers}`;
+}
 function colorStatus(status) {
     const statusColor = status === "running" ? GREEN
         : status === "crashed" ? RED

package/dist/heart/daemon/up-progress.js

@@ -7,8 +7,9 @@
  * cursor control for in-place overwriting in TTY mode, and falls back to
  * static line-per-phase output in non-TTY mode.
  *
- * The caller drives animation by calling `render(now)` on a setInterval.
- * This module owns no timers.
+ * The caller can drive animation by calling `render(now)`. In production CLI
+ * use, `autoRender` starts a short-lived timer while a TTY phase is active so
+ * long operations never leave a dead-looking cursor.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.UpProgress = void 0;
@@ -23,15 +24,30 @@ const GREEN = "\x1b[38;2;46;204;64m";
 class UpProgress {
     write;
     isTTY;
+    now;
+    autoRender;
+    renderIntervalMs;
+    setTimer;
+    clearTimer;
     completed = [];
     currentPhase = null;
+    currentDetail = null;
     prevLineCount = 0;
     ended = false;
+    renderTimer = null;
     constructor(options) {
         /* v8 ignore next -- thin wrapper: raw process.stdout.write for ANSI cursor control @preserve */
         this.write = options?.write ?? ((text) => process.stdout.write(text));
         /* v8 ignore next -- thin wrapper: real isTTY check injected for testability @preserve */
         this.isTTY = options?.isTTY ?? (process.stdout.isTTY === true);
+        /* v8 ignore next -- thin wrapper: real Date.now injected for testability @preserve */
+        this.now = options?.now ?? (() => Date.now());
+        this.autoRender = options?.autoRender ?? false;
+        this.renderIntervalMs = options?.renderIntervalMs ?? 80;
+        /* v8 ignore start -- real timers are injected in tests when needed @preserve */
+        this.setTimer = options?.setInterval ?? ((callback, ms) => setInterval(callback, ms));
+        this.clearTimer = options?.clearInterval ?? ((handle) => clearInterval(handle));
+        /* v8 ignore stop */
     }
     /**
      * Begin a new phase with spinner. If a phase is already active, it is
@@ -41,26 +57,44 @@ class UpProgress {
         if (this.currentPhase) {
             this.completePhase(this.currentPhase.label);
         }
-        this.currentPhase = { label, startedAt: Date.now() };
+        this.currentPhase = { label, startedAt: this.now() };
+        this.currentDetail = null;
+        if (this.isTTY) {
+            this.ensureAutoRender();
+            this.flushRender();
+        }
+        else {
+            this.write(`  ... ${label}\n`);
+        }
     }
     /**
      * Emit a one-line status breadcrumb in non-TTY mode without affecting the
      * accumulated checklist state. Used for daemon startup sub-steps.
      */
     announceStep(label) {
+        if (this.currentPhase) {
+            this.updateDetail(label);
+            return;
+        }
         if (this.isTTY)
             return;
-        this.write(label);
+        this.write(`    ${label}\n`);
     }
     /**
      * Update the sub-step detail on the current spinner phase. Rendered as
-     * "label (Xs) -- detail" in TTY mode. No-op in non-TTY mode or when
-     * no phase is active.
+     * "label (Xs) -- detail" in TTY mode. In non-TTY mode, writes changed
+     * detail lines so long operations remain visible in logs and captured output.
      */
     updateDetail(detail) {
-        if (!this.isTTY || !this.currentPhase)
+        if (!this.currentPhase || detail === this.currentDetail)
             return;
+        this.currentDetail = detail;
         this.currentPhase.detail = detail;
+        if (this.isTTY) {
+            this.flushRender();
+            return;
+        }
+        this.write(`    ${detail}\n`);
     }
     /**
      * Mark the current phase as done. In non-TTY mode, immediately writes
@@ -70,16 +104,21 @@ class UpProgress {
         if (!this.currentPhase) {
             return;
         }
-        const elapsedMs = Date.now() - this.currentPhase.startedAt;
+        const elapsedMs = this.now() - this.currentPhase.startedAt;
         this.completed.push({ label, detail });
         this.currentPhase = null;
+        this.currentDetail = null;
+        this.stopAutoRender();
         (0, runtime_1.emitNervesEvent)({
             component: "daemon",
             event: "daemon.up_phase_complete",
             message: `phase complete: ${label}`,
             meta: { phase: label, detail: detail ?? null, elapsedMs },
         });
-        if (!this.isTTY) {
+        if (this.isTTY) {
+            this.flushRender();
+        }
+        else {
             const detailStr = detail ? ` \u2014 ${detail}` : "";
             this.write(`  \u2713 ${label}${detailStr}\n`);
         }
@@ -134,12 +173,30 @@ class UpProgress {
         this.ended = true;
         if (this.currentPhase) {
             this.currentPhase = null;
+            this.currentDetail = null;
         }
+        this.stopAutoRender();
         if (this.isTTY) {
-            const output = this.render(Date.now());
-            if (output) {
-                this.write(output);
-            }
+            this.flushRender();
+        }
+    }
+    ensureAutoRender() {
+        if (!this.autoRender || !this.isTTY || this.renderTimer !== null) {
+            return;
+        }
+        this.renderTimer = this.setTimer(() => this.flushRender(), this.renderIntervalMs);
+    }
+    stopAutoRender() {
+        if (this.renderTimer === null) {
+            return;
+        }
+        this.clearTimer(this.renderTimer);
+        this.renderTimer = null;
+    }
+    flushRender() {
+        const output = this.render(this.now());
+        if (output) {
+            this.write(output);
         }
     }
 }

package/dist/repertoire/bitwarden-store.js

@@ -116,7 +116,7 @@ function sanitizeBwErrorDetail(message) {
 function formatBwCliError(err, stderr = "", args = []) {
     const operation = formatBwOperation(args);
     if (isBwTimeoutError(err)) {
-        return new Error(`bw CLI error: ${operation} timed out while waiting for a vault response`);
+        return new Error(`bw CLI error: ${operation} timed out -- usually resolves on retry. If it persists, check network connectivity to the vault server.`);
     }
     const detail = sanitizeBwErrorDetail(stderr.trim() || err.message);
     if (detail === "command failed") {
@@ -274,10 +274,13 @@ function isTransientError(err) {
         msg.includes("enotfound") ||
         msg.includes("socket hang up") ||
         msg.includes("503") ||
-        msg.includes("server unavailable"));
+        msg.includes("server unavailable") ||
+        msg.includes("timed out"));
 }
 const MAX_RETRIES = 3;
 const BASE_BACKOFF_MS = 1000;
+const TRANSIENT_MAX_RETRIES = 3;
+const TRANSIENT_RETRY_BASE_MS = 500;
 function delay(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -469,6 +472,9 @@ class BitwardenCredentialStore {
             const unlockOutput = await execBw(["unlock", this.masterPassword, "--raw"], undefined, this.appDataDir);
             this.sessionToken = unlockOutput.trim();
         }
+        // Sync vault data after obtaining a fresh session token
+        /* v8 ignore next -- defensive: loginAttempt always sets sessionToken before sync @preserve */
+        await execBw(["sync"], this.sessionToken ?? undefined, this.appDataDir);
     }
     async ensureSession() {
         if (!this.sessionToken) {
@@ -494,6 +500,32 @@ class BitwardenCredentialStore {
             }
         }
     }
+    async withTransientRetry(operation) {
+        let lastError;
+        for (let attempt = 0; attempt < TRANSIENT_MAX_RETRIES; attempt++) {
+            try {
+                return await operation();
+            }
+            catch (err) {
+                /* v8 ignore next -- defensive: operation always throws Error instances @preserve */
+                lastError = err instanceof Error ? err : new Error(String(err));
+                if (!isTransientError(lastError)) {
+                    throw lastError;
+                }
+                if (attempt === TRANSIENT_MAX_RETRIES - 1)
+                    break;
+                const backoffMs = TRANSIENT_RETRY_BASE_MS * Math.pow(2, attempt);
+                (0, runtime_1.emitNervesEvent)({
+                    event: "repertoire.bw_transient_retry",
+                    component: "repertoire",
+                    message: `transient bw error, retrying in ${backoffMs}ms`,
+                    meta: { attempt: attempt + 1, backoffMs, reason: lastError.message },
+                });
+                await delay(backoffMs);
+            }
+        }
+        throw lastError;
+    }
     async get(domain) {
         (0, runtime_1.emitNervesEvent)({
             event: "repertoire.bw_credential_get_start",
@@ -501,7 +533,7 @@ class BitwardenCredentialStore {
             message: `getting credential via bw for ${domain}`,
             meta: { domain, backend: "bitwarden" },
         });
-        const item = await this.withSessionRetry((session) => this.findItemByDomain(domain, session));
+        const item = await this.withTransientRetry(() => this.withSessionRetry((session) => this.findItemByDomain(domain, session)));
         if (!item) {
             (0, runtime_1.emitNervesEvent)({
                 event: "repertoire.bw_credential_get_end",
@@ -525,7 +557,7 @@ class BitwardenCredentialStore {
         };
     }
     async getRawSecret(domain, field) {
-        const item = await this.withSessionRetry((session) => this.findItemByDomain(domain, session));
+        const item = await this.withTransientRetry(() => this.withSessionRetry((session) => this.findItemByDomain(domain, session)));
         if (!item) {
             throw new Error(`no credential found for domain "${domain}"`);
         }
@@ -595,7 +627,7 @@ class BitwardenCredentialStore {
             message: "listing bw credentials",
             meta: { backend: "bitwarden" },
         });
-        const stdout = await this.withSessionRetry((session) => execBw(["list", "items"], session, this.appDataDir));
+        const stdout = await this.withTransientRetry(() => this.withSessionRetry((session) => execBw(["list", "items"], session, this.appDataDir)));
         const items = parseBwItems(stdout, "bw list items");
         const results = items.map((item) => ({
             domain: item.name,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.416",
+  "version": "0.1.0-alpha.418",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",