@ouro.bot/cli 0.1.0-alpha.417 → 0.1.0-alpha.419

package/README.md

@@ -99,6 +99,7 @@ Task docs do not live in this repo anymore. Planning and doing docs live in the
 - Vault unlock material is local machine state. Prefer macOS Keychain, Windows DPAPI, or Linux Secret Service; plaintext fallback is allowed only by explicit human choice.
 - New vault unlock secrets are confirmed before use and rejected if they do not meet the minimum strength requirements.
 - Provider and runtime credentials are loaded into process memory at startup/auth/unlock/refresh and reused. The remote vault is not queried for every model or sense request.
+- Human-facing CLI commands that can wait on browser auth, vault IO, daemon startup, daemon restart, provider checks, or connector setup use a shared progress checklist. If a cursor may blink for more than a few seconds, the command should print or animate the current step instead of going quiet.
 - CLI commands that mutate bundle config, such as vault setup or `ouro connect bluebubbles`, run bundle sync after the change when `sync.enabled` is true and report a compact `bundle sync:` line.
 - The daemon discovers bundles dynamically from `~/AgentBundles`.
 - `ouro status` reports version, last-updated time, discovered agents, senses, and workers.
@@ -120,7 +121,7 @@ ouro auth --agent <name>
 ouro auth --agent <name> --provider <provider>
 ```
 
-`ouro auth` stores credentials in the owning agent's vault. It does not switch a lane or write provider/model selection.
+`ouro auth` stores credentials in the owning agent's vault. It does not switch a lane or write provider/model selection. The command shows progress while browser login, vault storage, refresh, and verification are happening.
 
 When you want this machine to use a provider/model for a lane, use:
 

package/changelog.json

@@ -1,6 +1,29 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.419",
+      "changes": [
+        "`ouro auth`, `ouro provider refresh`, `ouro connect perplexity`, and `ouro connect bluebubbles` now use the shared human CLI progress checklist so browser login, vault reads/writes, daemon reloads, and verification steps stay visible instead of leaving a blinking cursor.",
+        "`ouro connect perplexity` now introduces the flow before the hidden API-key prompt, shows vault storage and reload progress, keeps the key out of output, and ends with a compact next step for using Perplexity search.",
+        "`ouro connect bluebubbles` now introduces the local-machine attachment before prompts, shows machine runtime config and `agent.json` enablement progress, and keeps the app password out of output.",
+        "`ouro provider refresh` now shows vault-read progress and reload status, and refresh/auth/connect failure paths preserve the last visible progress context while still rethrowing actionable errors.",
+        "The CLI progress renderer is documented as a shared human-facing contract: long-running human flows should show current work, stay concise, and never print secrets.",
+        "`@ouro.bot/cli` and the `ouro.bot` wrapper are version-synced for the provider onboarding progress release."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.418",
+      "changes": [
+        "`ouro up` now uses the live progress renderer in interactive terminals instead of forcing static non-TTY output, so long startup/check phases animate instead of leaving a blinking cursor.",
+        "Non-TTY and captured `ouro up` output now prints current phase starts and changed detail lines (`launching daemon process`, `waiting for daemon socket`, `daemon answered`) before completion, avoiding silent waits in logs and terminal sessions that cannot render spinners.",
+        "Daemon startup readiness is completed explicitly before provider checks begin; `ouro up` no longer marks `starting daemon` as done by accidentally auto-completing it when the next phase starts.",
+        "Daemon startup polling can now report progress into the parent `ouro up` checklist without rendering its own nested startup TUI, keeping startup output as one coherent surface.",
+        "Runtime drift restart messages now summarize drift categories such as `code path` or `managed agents` without printing raw worktree/package paths in normal CLI output.",
+        "Default CLI stdout now writes exactly one newline instead of using `console.log`, removing the extra blank lines caused when progress renderers already include newline-terminated output.",
+        "`@ouro.bot/cli` and the `ouro.bot` wrapper are version-synced for the `ouro up` progress polish release."
+      ]
+    },
     {
       "version": "0.1.0-alpha.417",
       "changes": [

package/dist/heart/daemon/cli-defaults.js

@@ -89,9 +89,13 @@ function defaultStartDaemonProcess(socketPath) {
     return Promise.resolve({ pid: child.pid ?? null });
 }
 function defaultWriteStdout(text) {
-    // eslint-disable-next-line no-console -- terminal UX: CLI command output
-    console.log(text);
+    process.stdout.write(text.endsWith("\n") ? text : `${text}\n`);
 }
+/* v8 ignore start -- thin terminal adapter around process stdout @preserve */
+function defaultWriteRaw(text) {
+    process.stdout.write(text);
+}
+/* v8 ignore stop */
 /**
  * Read the runtimeVersion from the first .ouro bundle's bundle-meta.json.
  * Returns undefined if none found or unreadable.
@@ -486,6 +490,8 @@ function createDefaultOuroCliDeps(socketPath = socket_client_1.DEFAULT_DAEMON_SO
         sendCommand: socket_client_1.sendDaemonCommand,
         startDaemonProcess: defaultStartDaemonProcess,
         writeStdout: defaultWriteStdout,
+        writeRaw: defaultWriteRaw,
+        isTTY: process.stdout.isTTY === true,
         checkSocketAlive: socket_client_1.checkDaemonSocketAlive,
         cleanupStaleSocket: defaultCleanupStaleSocket,
         fallbackPendingMessage: defaultFallbackPendingMessage,

package/dist/heart/daemon/cli-exec.js

@@ -179,6 +179,25 @@ function providerRepairCountSummary(count) {
         return "ok";
     return `${count} ${count === 1 ? "needs" : "need"} attention`;
 }
+function createHumanCommandProgress(deps, commandName) {
+    return new up_progress_1.CommandProgress({
+        write: deps.writeRaw ?? deps.writeStdout,
+        isTTY: deps.isTTY ?? false,
+        now: deps.now ?? (() => Date.now()),
+        autoRender: true,
+        eventScope: "command",
+        commandName,
+    });
+}
+function daemonProgressSummary(result) {
+    if (result.verifyStartupStatus === false)
+        return "not answering yet";
+    if (result.alreadyRunning)
+        return "already running";
+    if (result.message.includes("restarted"))
+        return "restarted and ready";
+    return "ready";
+}
 async function reportPostRepairProviderHealth(deps, repairedAgents, onProgress) {
     const remainingDegraded = await checkAgentProviders(deps, repairedAgents, onProgress);
     (0, runtime_1.emitNervesEvent)({
@@ -314,17 +333,19 @@ async function ensureDaemonRunning(deps, options = {}) {
             sendCommand: deps.sendCommand,
             socketPath: deps.socketPath,
             daemonPid: runtimeResult.startedPid ?? null,
-            /* v8 ignore next -- thin wrapper: raw process.stdout.write for ANSI cursor control @preserve */
-            writeRaw: (text) => process.stdout.write(text),
-            /* v8 ignore next -- thin wrapper: real stdout TTY detection injected for captured-output safety @preserve */
-            isTTY: process.stdout.isTTY === true,
-            /* v8 ignore next -- thin wrapper: real Date.now() injected for testability @preserve */
-            now: () => Date.now(),
-            /* v8 ignore next -- thin wrapper: real setTimeout injected for testability @preserve */
-            sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+            /* v8 ignore next -- thin wrapper: real stdout fallback injected by default deps @preserve */
+            writeRaw: deps.writeRaw ?? ((text) => process.stdout.write(text)),
+            /* v8 ignore next -- thin wrapper: real stdout TTY detection injected by default deps @preserve */
+            isTTY: deps.isTTY ?? process.stdout.isTTY === true,
+            /* v8 ignore next -- thin wrapper: real Date.now fallback injected by default deps @preserve */
+            now: deps.now ?? (() => Date.now()),
+            /* v8 ignore next -- thin wrapper: real setTimeout fallback injected by default deps @preserve */
+            sleep: deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms))),
             /* v8 ignore start -- daemon log tail + pid check: reads real filesystem, tested via deployment @preserve */
             readLatestDaemonEvent: readLatestDaemonStartupEvent,
             /* v8 ignore stop */
+            onProgress: deps.reportDaemonStartupPhase,
+            render: !deps.reportDaemonStartupPhase,
         });
         return {
             alreadyRunning: runtimeResult.alreadyRunning,
@@ -339,8 +360,8 @@ async function ensureDaemonRunning(deps, options = {}) {
     };
     let lastPid = null;
     for (let attempt = 0; attempt <= retryLimit; attempt += 1) {
-        deps.reportDaemonStartupPhase?.("starting daemon...");
-        deps.reportDaemonStartupPhase?.("waiting for daemon socket...");
+        deps.reportDaemonStartupPhase?.("launching daemon process");
+        deps.reportDaemonStartupPhase?.("waiting for daemon socket");
         deps.cleanupStaleSocket(deps.socketPath);
         const bootStartedAtMs = (deps.now ?? Date.now)();
         const started = await deps.startDaemonProcess(deps.socketPath);
@@ -354,17 +375,19 @@ async function ensureDaemonRunning(deps, options = {}) {
                 sendCommand: deps.sendCommand,
                 socketPath: deps.socketPath,
                 daemonPid: lastPid,
-                /* v8 ignore next -- thin wrapper: raw process.stdout.write for ANSI cursor control @preserve */
-                writeRaw: (text) => process.stdout.write(text),
-                /* v8 ignore next -- thin wrapper: real stdout TTY detection injected for captured-output safety @preserve */
-                isTTY: process.stdout.isTTY === true,
-                /* v8 ignore next -- thin wrapper: real Date.now() injected for testability @preserve */
-                now: () => Date.now(),
-                /* v8 ignore next -- thin wrapper: real setTimeout injected for testability @preserve */
-                sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+                /* v8 ignore next -- thin wrapper: real stdout fallback injected by default deps @preserve */
+                writeRaw: deps.writeRaw ?? ((text) => process.stdout.write(text)),
+                /* v8 ignore next -- thin wrapper: real stdout TTY detection injected by default deps @preserve */
+                isTTY: deps.isTTY ?? process.stdout.isTTY === true,
+                /* v8 ignore next -- thin wrapper: real Date.now fallback injected by default deps @preserve */
+                now: deps.now ?? (() => Date.now()),
+                /* v8 ignore next -- thin wrapper: real setTimeout fallback injected by default deps @preserve */
+                sleep: deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms))),
                 /* v8 ignore start -- daemon log tail + pid check: reads real filesystem, tested via deployment @preserve */
                 readLatestDaemonEvent: readLatestDaemonStartupEvent,
                 /* v8 ignore stop */
+                onProgress: deps.reportDaemonStartupPhase,
+                render: !deps.reportDaemonStartupPhase,
             });
             return {
                 alreadyRunning: false,
@@ -376,7 +399,7 @@ async function ensureDaemonRunning(deps, options = {}) {
         if (!startupFailure.retryable || attempt >= retryLimit) {
             break;
         }
-        deps.reportDaemonStartupPhase?.("daemon startup lost stability; cleaning up and retrying once...");
+        deps.reportDaemonStartupPhase?.("daemon startup lost stability; retrying once");
     }
     return {
         alreadyRunning: false,
@@ -449,7 +472,7 @@ async function waitForDaemonStartup(deps, options) {
         if (!sawSocket) {
             sawSocket = true;
             stableSinceMs = now();
-            deps.reportDaemonStartupPhase?.("verifying daemon health...");
+            deps.reportDaemonStartupPhase?.("verifying daemon health");
         }
         if (!hasFreshCurrentBootHealthSignal(deps, options.bootStartedAtMs, options.pid)) {
             continue;
@@ -1129,18 +1152,35 @@ function runtimeScopeLabel(scope) {
 }
 async function storeRuntimeConfigKey(input) {
     const machineId = input.scope === "machine" ? currentMachineId(input.deps) : undefined;
+    input.onProgress?.("checking existing runtime config");
     const current = input.scope === "machine"
         ? await (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(input.agent, machineId, { preserveCachedOnFailure: true })
         : await (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(input.agent, { preserveCachedOnFailure: true });
     if (!current.ok && current.reason !== "missing") {
         throw new Error(`cannot read existing runtime credentials from ${current.itemPath}: ${current.error}`);
     }
+    input.onProgress?.(`storing ${input.key} in ${current.itemPath}`);
     const nextConfig = setRuntimeConfigValue(current.ok ? current.config : {}, input.key, input.value);
     const stored = input.scope === "machine"
         ? await (0, runtime_credentials_1.upsertMachineRuntimeCredentialConfig)(input.agent, machineId, nextConfig, providerCliNow(input.deps))
         : await (0, runtime_credentials_1.upsertRuntimeCredentialConfig)(input.agent, nextConfig, providerCliNow(input.deps));
+    input.onProgress?.(`stored ${input.key}; credential value was not printed`);
     return { revision: stored.revision, itemPath: stored.itemPath, ...(machineId ? { machineId } : {}) };
 }
+async function reloadRunningAgentAfterCredentialChange(agent, deps) {
+    try {
+        const alive = await deps.checkSocketAlive(deps.socketPath);
+        if (!alive)
+            return "daemon is not running; next `ouro up` will load it";
+        const response = await deps.sendCommand(deps.socketPath, { kind: "agent.restart", agent });
+        if (response.ok)
+            return `restarted ${agent} so the running agent reloads credentials`;
+        return `daemon restart skipped: ${response.error ?? response.message ?? "unknown daemon error"}`;
+    }
+    catch (error) {
+        return `daemon restart skipped: ${error instanceof Error ? error.message : String(error)}`;
+    }
+}
 async function executeVaultConfigSet(command, deps) {
     if (command.agent === "SerpentGuide") {
         throw new Error("SerpentGuide does not have persistent runtime credentials. Store credentials in the hatchling agent vault.");
@@ -1255,18 +1295,16 @@ function enableAgentSense(agent, sense, deps) {
 function connectMenu(agent) {
     return [
         `Connect ${agent}`,
+        "Pick what this agent should be able to use.",
         "",
-        "Portable agent capabilities",
         "  1. Perplexity search",
-        "     stores: agent vault runtime/config -> integrations.perplexityApiKey",
+        "     Portable. Stores an API key in the agent vault.",
         "",
-        "This machine only",
         "  2. BlueBubbles iMessage",
-        "     stores: agent vault runtime/machines/<this-machine>/config",
+        "     This machine only. Connects a local Mac Messages bridge.",
         "",
-        "Model providers",
         "  3. Provider auth",
-        `     runs separately: ouro auth --agent ${agent} --provider <provider>`,
+        `     Model credentials: ouro auth --agent ${agent} --provider <provider>`,
         "",
         "  4. Cancel",
         "",
@@ -1278,23 +1316,45 @@ async function executeConnectPerplexity(agent, deps) {
         throw new Error("SerpentGuide has no persistent runtime credentials. Connect Perplexity on the hatchling agent instead.");
     }
     const promptSecret = requirePromptSecret(deps, "Perplexity API key entry");
+    deps.writeStdout([
+        `Connect Perplexity for ${agent}`,
+        "The API key stays hidden while you type.",
+        `Ouro stores it in ${agent}'s vault runtime/config item.`,
+    ].join("\n"));
     const key = (await promptSecret("Perplexity API key: ")).trim();
     if (!key)
         throw new Error("Perplexity API key cannot be blank");
-    const stored = await storeRuntimeConfigKey({
-        agent,
-        key: "integrations.perplexityApiKey",
-        value: key,
-        scope: "agent",
-        deps,
-    });
+    const progress = createHumanCommandProgress(deps, "connect perplexity");
+    let stored;
+    let reload;
+    try {
+        progress.startPhase("saving Perplexity search");
+        stored = await storeRuntimeConfigKey({
+            agent,
+            key: "integrations.perplexityApiKey",
+            value: key,
+            scope: "agent",
+            deps,
+            onProgress: (message) => progress.updateDetail(message),
+        });
+        progress.completePhase("saving Perplexity search", "secret stored");
+        progress.startPhase(`reloading ${agent}`);
+        reload = await reloadRunningAgentAfterCredentialChange(agent, deps);
+        progress.completePhase(`reloading ${agent}`, reload);
+        progress.end();
+    }
+    catch (error) {
+        progress.end();
+        throw error;
+    }
     const message = [
         `Perplexity connected for ${agent}`,
         "capability: Perplexity search",
         `stored: ${stored.itemPath}`,
+        `reload: ${reload}`,
         "secret was not printed",
         "",
-        "Next: ask the agent to search, or run `ouro up` again if the daemon was already running.",
+        "Next: ask the agent to search.",
     ].join("\n");
     deps.writeStdout(message);
     return message;
@@ -1305,6 +1365,11 @@ async function executeConnectBlueBubbles(agent, deps) {
     }
     const promptInput = requirePromptInput(deps, "BlueBubbles setup");
     const promptSecret = requirePromptSecret(deps, "BlueBubbles password entry");
+    deps.writeStdout([
+        `Connect BlueBubbles for ${agent}`,
+        "This is a local attachment for this machine.",
+        "The app password stays hidden while you type.",
+    ].join("\n"));
     const serverUrl = (await promptInput("BlueBubbles server URL for this machine: ")).trim();
     if (!serverUrl)
         throw new Error("BlueBubbles server URL cannot be blank");
@@ -1315,25 +1380,40 @@ async function executeConnectBlueBubbles(agent, deps) {
     const webhookPath = normalizeWebhookPath(await promptInput("Local webhook path [/bluebubbles-webhook]: "), "/bluebubbles-webhook");
     const requestTimeoutMs = parseOptionalPositiveInteger(await promptInput("Request timeout ms [30000]: "), 30000, "BlueBubbles request timeout");
     const machineId = currentMachineId(deps);
-    const current = await (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(agent, machineId, { preserveCachedOnFailure: true });
-    if (!current.ok && current.reason !== "missing") {
-        throw new Error(`cannot read existing machine runtime credentials from ${current.itemPath}: ${current.error}`);
+    const progress = createHumanCommandProgress(deps, "connect bluebubbles");
+    let stored;
+    try {
+        progress.startPhase("saving BlueBubbles attachment");
+        progress.updateDetail("checking existing machine runtime config");
+        const current = await (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(agent, machineId, { preserveCachedOnFailure: true });
+        if (!current.ok && current.reason !== "missing") {
+            progress.end();
+            throw new Error(`cannot read existing machine runtime credentials from ${current.itemPath}: ${current.error}`);
+        }
+        const nextConfig = {
+            ...(current.ok ? current.config : {}),
+            bluebubbles: {
+                serverUrl,
+                password,
+                accountId: "default",
+            },
+            bluebubblesChannel: {
+                port,
+                webhookPath,
+                requestTimeoutMs,
+            },
+        };
+        progress.updateDetail("storing local machine config");
+        stored = await (0, runtime_credentials_1.upsertMachineRuntimeCredentialConfig)(agent, machineId, nextConfig, providerCliNow(deps));
+        progress.updateDetail("enabling BlueBubbles in agent.json");
+        enableAgentSense(agent, "bluebubbles", deps);
+        progress.completePhase("saving BlueBubbles attachment", "secret stored");
+        progress.end();
+    }
+    catch (error) {
+        progress.end();
+        throw error;
     }
-    const nextConfig = {
-        ...(current.ok ? current.config : {}),
-        bluebubbles: {
-            serverUrl,
-            password,
-            accountId: "default",
-        },
-        bluebubblesChannel: {
-            port,
-            webhookPath,
-            requestTimeoutMs,
-        },
-    };
-    const stored = await (0, runtime_credentials_1.upsertMachineRuntimeCredentialConfig)(agent, machineId, nextConfig, providerCliNow(deps));
-    enableAgentSense(agent, "bluebubbles", deps);
     const message = appendBundleSyncSummary([
         `BlueBubbles attached for ${agent} on this machine`,
         `machine: ${machineId}`,
@@ -1635,38 +1715,40 @@ async function executeProviderRefresh(command, deps) {
         deps.writeStdout(message);
         return message;
     }
-    const pool = await (0, provider_credentials_1.refreshProviderCredentialPool)(command.agent);
+    const progress = createHumanCommandProgress(deps, "provider refresh");
+    progress.startPhase("refreshing provider credentials");
+    let pool;
+    try {
+        pool = await (0, provider_credentials_1.refreshProviderCredentialPool)(command.agent, {
+            onProgress: (message) => progress.updateDetail(message),
+        });
+    }
+    catch (error) {
+        progress.end();
+        throw error;
+    }
     const lines = [];
     if (pool.ok) {
         const summary = (0, provider_credentials_1.summarizeProviderCredentialPool)(pool.pool);
         lines.push(`refreshed provider credential snapshot for ${command.agent}`);
         lines.push(`providers: ${summary.providers.map((provider) => provider.provider).join(", ") || "none"}`);
+        progress.completePhase("refreshing provider credentials", summary.providers.map((provider) => provider.provider).join(", ") || "none");
     }
     else {
+        progress.end();
         lines.push(`provider credential refresh failed for ${command.agent}: ${pool.error}`);
         lines.push((0, vault_unlock_1.vaultUnlockReplaceRecoverFix)(command.agent, "Then retry 'ouro provider refresh'."));
         const message = lines.join("\n");
         deps.writeStdout(message);
         return message;
     }
-    try {
-        const alive = await deps.checkSocketAlive(deps.socketPath);
-        if (alive) {
-            const response = await deps.sendCommand(deps.socketPath, { kind: "agent.restart", agent: command.agent });
-            if (response.ok) {
-                lines.push(`restarted ${command.agent} so the running agent reloads credentials`);
-            }
-            else {
-                lines.push(`daemon restart skipped: ${response.error ?? response.message ?? "unknown daemon error"}`);
-            }
-        }
-        else {
-            lines.push("daemon is not running; the next start will load the refreshed snapshot");
-        }
-    }
-    catch (error) {
-        lines.push(`daemon restart skipped: ${error instanceof Error ? error.message : String(error)}`);
-    }
+    progress.startPhase(`reloading ${command.agent}`);
+    const reload = await reloadRunningAgentAfterCredentialChange(command.agent, deps);
+    progress.completePhase(`reloading ${command.agent}`, reload);
+    progress.end();
+    lines.push(reload === "daemon is not running; next `ouro up` will load it"
+        ? "daemon is not running; the next start will load the refreshed snapshot"
+        : reload);
     const message = lines.join("\n");
     deps.writeStdout(message);
     return message;
@@ -2469,7 +2551,13 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
             }
         }
         const linkedVersionBeforeUp = deps.getCurrentCliVersion?.() ?? null;
-        const progress = new up_progress_1.UpProgress({ write: deps.writeStdout, isTTY: false });
+        const outputIsTTY = deps.isTTY ?? process.stdout.isTTY === true;
+        const progress = new up_progress_1.UpProgress({
+            write: deps.writeRaw ?? deps.writeStdout,
+            isTTY: outputIsTTY,
+            now: deps.now ?? (() => Date.now()),
+            autoRender: true,
+        });
         // ── versioned CLI update check ──
         if (deps.checkForCliUpdate) {
             progress.startPhase("update check");
@@ -2631,6 +2719,12 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
                 progress.announceStep?.(label);
             },
         }, { initialAlive: daemonAliveBeforeStart });
+        progress.completePhase("starting daemon", daemonProgressSummary(daemonResult));
+        if (daemonResult.verifyStartupStatus === false) {
+            progress.end();
+            deps.writeStdout(daemonResult.message);
+            return daemonResult.message;
+        }
         if (!providerChecksAlreadyRun || daemonResult.alreadyRunning) {
             progress.startPhase("provider checks");
             const providerDegraded = await checkAlreadyRunningAgentProviders(deps, (msg) => progress.updateDetail(msg));
@@ -2638,7 +2732,6 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
             progress.completePhase("provider checks", providerRepairCountSummary(providerDegraded.length));
         }
         progress.end();
-        deps.writeStdout(daemonResult.message);
         // Interactive repair for degraded agents (Unit 5) — skipped by --no-repair (Unit 6)
         if (daemonResult.stability?.degraded && daemonResult.stability.degraded.length > 0) {
             if (command.noRepair) {
@@ -3324,31 +3417,43 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
         const provider = command.provider ?? (0, auth_flow_1.readAgentConfigForAgent)(command.agent, deps.bundlesRoot).config.humanFacing.provider;
         /* v8 ignore next -- tests always inject runAuthFlow; default is for production @preserve */
         const authRunner = deps.runAuthFlow ?? (await Promise.resolve().then(() => __importStar(require("../auth/auth-flow")))).runRuntimeAuthFlow;
-        const result = await authRunner({
-            agentName: command.agent,
-            provider,
-            promptInput: deps.promptInput,
-            onProgress: deps.writeStdout,
-        });
+        const progress = createHumanCommandProgress(deps, "auth");
+        progress.startPhase(`authenticating ${provider}`);
+        let result;
+        try {
+            result = await authRunner({
+                agentName: command.agent,
+                provider,
+                promptInput: deps.promptInput,
+                onProgress: (message) => progress.updateDetail(message),
+            });
+        }
+        catch (error) {
+            progress.end();
+            throw error;
+        }
+        progress.completePhase(`authenticating ${provider}`, "credentials stored");
         // Behavior: ouro auth stores credentials only — does NOT switch provider.
         // Use `ouro auth switch` to change the active provider.
-        deps.writeStdout(result.message);
         // Verify the credentials actually work by pinging the provider
         /* v8 ignore start -- integration: real API ping after auth @preserve */
         try {
-            deps.writeStdout(`verifying ${provider} credentials...`);
+            progress.startPhase(`verifying ${provider}`);
             const credential = await readProviderCredentialRecord(command.agent, provider, deps);
             const status = credential.ok
                 ? await verifyProviderCredentials(provider, {
                     [provider]: { ...credential.record.config, ...credential.record.credentials },
                 })
                 : `stored but could not be re-read from vault (${credential.error})`;
-            deps.writeStdout(`${provider}: ${status}`);
+            progress.completePhase(`verifying ${provider}`, status);
         }
-        catch {
-            // Verification failure is non-blocking — credentials were saved regardless
+        catch (error) {
+            // Verification failure is non-blocking — credentials were saved regardless.
+            progress.completePhase(`verifying ${provider}`, `skipped (${error instanceof Error ? error.message : String(error)})`);
         }
         /* v8 ignore stop */
+        progress.end();
+        deps.writeStdout(result.message);
         return result.message;
     }
     // ── auth verify (local, no daemon socket needed) ──

package/dist/heart/daemon/daemon-runtime-sync.js

@@ -83,14 +83,8 @@ function collectRuntimeDriftReasons(local, running) {
     }
     return reasons;
 }
-function formatRuntimeValue(reason) {
-    if (reason.key === "configFingerprint") {
-        return `${reason.running.slice(0, 12)} -> ${reason.local.slice(0, 12)}`;
-    }
-    return `${reason.running} -> ${reason.local}`;
-}
-function formatRuntimeDriftSummary(reasons) {
-    return reasons.map((reason) => `${reason.label} ${formatRuntimeValue(reason)}`).join("; ");
+function formatRuntimeDriftPublicSummary(reasons) {
+    return reasons.map((reason) => reason.label).join(", ");
 }
 async function ensureCurrentDaemonRuntime(deps) {
     const localRuntime = normalizeRuntimeIdentity({
@@ -107,7 +101,7 @@ async function ensureCurrentDaemonRuntime(deps) {
         let result;
         if (driftReasons.length > 0) {
             const includesVersionDrift = driftReasons.some((entry) => entry.key === "version");
-            const driftSummary = formatRuntimeDriftSummary(driftReasons);
+            const publicDriftSummary = formatRuntimeDriftPublicSummary(driftReasons);
             try {
                 await deps.stopDaemon();
             }
@@ -117,7 +111,7 @@ async function ensureCurrentDaemonRuntime(deps) {
                     alreadyRunning: true,
                     message: includesVersionDrift
                         ? `daemon already running (${deps.socketPath}; could not replace stale daemon ${runningVersion} -> ${deps.localVersion}: ${reason})`
-                        : `daemon already running (${deps.socketPath}; could not replace drifted daemon ${driftSummary}: ${reason})`,
+                        : `daemon already running (${deps.socketPath}; could not replace runtime drift ${publicDriftSummary}: ${reason})`,
                 };
                 (0, runtime_1.emitNervesEvent)({
                     level: "warn",
@@ -148,12 +142,12 @@ async function ensureCurrentDaemonRuntime(deps) {
             const pid = started.pid ?? "unknown";
             const verified = await verifyDaemonStarted(deps);
             /* v8 ignore next -- daemon liveness failure: requires real daemon crash timing @preserve */
-            const suffix = verified ? "" : "\ndaemon did not answer yet, so Ouro is checking repair paths next.";
+            const suffix = verified ? "" : "\ndaemon restart has not answered yet; check logs with `ouro logs` or run `ouro doctor`.";
             result = {
                 alreadyRunning: false,
                 message: includesVersionDrift
                     ? `restarted stale daemon ${runningVersion} -> ${deps.localVersion} (pid ${pid})${suffix}`
-                    : `restarted drifted daemon (${driftSummary}) (pid ${pid})${suffix}`,
+                    : `restarted daemon after runtime drift: ${publicDriftSummary} (pid ${pid})${suffix}`,
                 verifyStartupStatus: verified,
                 startedPid: started.pid ?? null,
             };

package/dist/heart/daemon/startup-tui.js

@@ -134,6 +134,14 @@ async function pollDaemonStartup(deps) {
     let prevLineCount = 0;
     const isTTY = deps.isTTY ?? true;
     const isAlive = deps.isProcessAlive ?? defaultIsProcessAlive;
+    const shouldRender = deps.render ?? true;
+    let lastProgress = null;
+    const reportProgress = (message) => {
+        if (!deps.onProgress || message === lastProgress)
+            return;
+        lastProgress = message;
+        deps.onProgress(message);
+    };
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
         event: "daemon.startup_poll_start",
@@ -174,22 +182,30 @@ async function pollDaemonStartup(deps) {
             }
             // Show what the daemon is doing from its log
             const latestEvent = deps.readLatestDaemonEvent?.() ?? null;
-            const output = renderWaitingForDaemon(elapsed, latestEvent, prevLineCount, { isTTY });
-            deps.writeRaw(output);
-            prevLineCount = latestEvent ? 2 : 1;
+            reportProgress(latestEvent ?? "waiting for daemon");
+            if (shouldRender) {
+                const output = renderWaitingForDaemon(elapsed, latestEvent, prevLineCount, { isTTY });
+                deps.writeRaw(output);
+                prevLineCount = latestEvent ? 2 : 1;
+            }
         }
         if (payload) {
-            const output = renderStartupProgress(payload, elapsed, prevLineCount, { isTTY });
-            deps.writeRaw(output);
-            prevLineCount = payload.workers.length + 1;
+            reportProgress(formatStartupProgressDetail(payload));
+            if (shouldRender) {
+                const output = renderStartupProgress(payload, elapsed, prevLineCount, { isTTY });
+                deps.writeRaw(output);
+                prevLineCount = payload.workers.length + 1;
+            }
             const assessment = assessStability(payload, now);
             if (assessment.resolved) {
                 const result = {
                     stable: assessment.stable,
                     degraded: assessment.degraded,
                 };
-                const summary = renderFinalSummary(result, isTTY);
-                deps.writeRaw(summary);
+                if (shouldRender) {
+                    const summary = renderFinalSummary(result, isTTY);
+                    deps.writeRaw(summary);
+                }
                 (0, runtime_1.emitNervesEvent)({
                     component: "daemon",
                     event: "daemon.startup_poll_end",
@@ -206,6 +222,12 @@ async function pollDaemonStartup(deps) {
         await deps.sleep(POLL_INTERVAL_MS);
     }
 }
+function formatStartupProgressDetail(payload) {
+    if (payload.workers.length === 0)
+        return "daemon answered";
+    const workers = payload.workers.map((worker) => `${worker.agent}/${worker.worker} ${worker.status}`).join(", ");
+    return `waiting for agents: ${workers}`;
+}
 function colorStatus(status) {
     const statusColor = status === "running" ? GREEN
         : status === "crashed" ? RED

package/dist/heart/daemon/up-progress.js

@@ -1,17 +1,18 @@
 "use strict";
 /**
- * UpProgress — accumulated-checklist progress renderer for `ouro up`.
+ * UpProgress — accumulated-checklist progress renderer.
  *
  * Displays completed phases with checkmarks, the current phase with a
  * spinner and elapsed time, and pending phases as plain text. Uses ANSI
  * cursor control for in-place overwriting in TTY mode, and falls back to
  * static line-per-phase output in non-TTY mode.
  *
- * The caller drives animation by calling `render(now)` on a setInterval.
- * This module owns no timers.
+ * The caller can drive animation by calling `render(now)`. In production CLI
+ * use, `autoRender` starts a short-lived timer while a TTY phase is active so
+ * long operations never leave a dead-looking cursor.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UpProgress = void 0;
+exports.CommandProgress = exports.UpProgress = void 0;
 const runtime_1 = require("../../nerves/runtime");
 // ── ANSI constants (shared with startup-tui.ts pattern) ──
 const SPINNER_FRAMES = "\u280B\u2819\u2839\u2838\u283C\u2834\u2826\u2827\u2807\u280F";
@@ -23,15 +24,34 @@ const GREEN = "\x1b[38;2;46;204;64m";
 class UpProgress {
     write;
     isTTY;
+    now;
+    autoRender;
+    renderIntervalMs;
+    setTimer;
+    clearTimer;
+    eventScope;
+    commandName;
     completed = [];
     currentPhase = null;
+    currentDetail = null;
     prevLineCount = 0;
     ended = false;
+    renderTimer = null;
     constructor(options) {
         /* v8 ignore next -- thin wrapper: raw process.stdout.write for ANSI cursor control @preserve */
         this.write = options?.write ?? ((text) => process.stdout.write(text));
         /* v8 ignore next -- thin wrapper: real isTTY check injected for testability @preserve */
         this.isTTY = options?.isTTY ?? (process.stdout.isTTY === true);
+        /* v8 ignore next -- thin wrapper: real Date.now injected for testability @preserve */
+        this.now = options?.now ?? (() => Date.now());
+        this.autoRender = options?.autoRender ?? false;
+        this.renderIntervalMs = options?.renderIntervalMs ?? 80;
+        /* v8 ignore start -- real timers are injected in tests when needed @preserve */
+        this.setTimer = options?.setInterval ?? ((callback, ms) => setInterval(callback, ms));
+        this.clearTimer = options?.clearInterval ?? ((handle) => clearInterval(handle));
+        /* v8 ignore stop */
+        this.eventScope = options?.eventScope ?? "up";
+        this.commandName = options?.commandName ?? null;
     }
     /**
      * Begin a new phase with spinner. If a phase is already active, it is
@@ -41,26 +61,44 @@ class UpProgress {
         if (this.currentPhase) {
             this.completePhase(this.currentPhase.label);
         }
-        this.currentPhase = { label, startedAt: Date.now() };
+        this.currentPhase = { label, startedAt: this.now() };
+        this.currentDetail = null;
+        if (this.isTTY) {
+            this.ensureAutoRender();
+            this.flushRender();
+        }
+        else {
+            this.write(`  ... ${label}\n`);
+        }
     }
     /**
      * Emit a one-line status breadcrumb in non-TTY mode without affecting the
      * accumulated checklist state. Used for daemon startup sub-steps.
      */
     announceStep(label) {
+        if (this.currentPhase) {
+            this.updateDetail(label);
+            return;
+        }
         if (this.isTTY)
             return;
-        this.write(label);
+        this.write(`    ${label}\n`);
     }
     /**
      * Update the sub-step detail on the current spinner phase. Rendered as
-     * "label (Xs) -- detail" in TTY mode. No-op in non-TTY mode or when
-     * no phase is active.
+     * "label (Xs) -- detail" in TTY mode. In non-TTY mode, writes changed
+     * detail lines so long operations remain visible in logs and captured output.
      */
     updateDetail(detail) {
-        if (!this.isTTY || !this.currentPhase)
+        if (!this.currentPhase || detail === this.currentDetail)
             return;
+        this.currentDetail = detail;
         this.currentPhase.detail = detail;
+        if (this.isTTY) {
+            this.flushRender();
+            return;
+        }
+        this.write(`    ${detail}\n`);
     }
     /**
      * Mark the current phase as done. In non-TTY mode, immediately writes
@@ -70,16 +108,31 @@ class UpProgress {
         if (!this.currentPhase) {
             return;
         }
-        const elapsedMs = Date.now() - this.currentPhase.startedAt;
+        const elapsedMs = this.now() - this.currentPhase.startedAt;
         this.completed.push({ label, detail });
         this.currentPhase = null;
-        (0, runtime_1.emitNervesEvent)({
-            component: "daemon",
-            event: "daemon.up_phase_complete",
-            message: `phase complete: ${label}`,
-            meta: { phase: label, detail: detail ?? null, elapsedMs },
-        });
-        if (!this.isTTY) {
+        this.currentDetail = null;
+        this.stopAutoRender();
+        if (this.eventScope === "command") {
+            (0, runtime_1.emitNervesEvent)({
+                component: "daemon",
+                event: "daemon.cli_progress_phase_complete",
+                message: `phase complete: ${label}`,
+                meta: { command: this.commandName, phase: label, detail: detail ?? null, elapsedMs },
+            });
+        }
+        else {
+            (0, runtime_1.emitNervesEvent)({
+                component: "daemon",
+                event: "daemon.up_phase_complete",
+                message: `phase complete: ${label}`,
+                meta: { phase: label, detail: detail ?? null, elapsedMs },
+            });
+        }
+        if (this.isTTY) {
+            this.flushRender();
+        }
+        else {
             const detailStr = detail ? ` \u2014 ${detail}` : "";
             this.write(`  \u2713 ${label}${detailStr}\n`);
         }
@@ -134,13 +187,32 @@ class UpProgress {
         this.ended = true;
         if (this.currentPhase) {
             this.currentPhase = null;
+            this.currentDetail = null;
         }
+        this.stopAutoRender();
         if (this.isTTY) {
-            const output = this.render(Date.now());
-            if (output) {
-                this.write(output);
-            }
+            this.flushRender();
+        }
+    }
+    ensureAutoRender() {
+        if (!this.autoRender || !this.isTTY || this.renderTimer !== null) {
+            return;
+        }
+        this.renderTimer = this.setTimer(() => this.flushRender(), this.renderIntervalMs);
+    }
+    stopAutoRender() {
+        if (this.renderTimer === null) {
+            return;
+        }
+        this.clearTimer(this.renderTimer);
+        this.renderTimer = null;
+    }
+    flushRender() {
+        const output = this.render(this.now());
+        if (output) {
+            this.write(output);
         }
     }
 }
 exports.UpProgress = UpProgress;
+exports.CommandProgress = UpProgress;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.417",
+  "version": "0.1.0-alpha.419",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",