@ouro.bot/cli 0.1.0-alpha.420 → 0.1.0-alpha.421

package/changelog.json

@@ -1,6 +1,16 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.421",
+      "changes": [
+        "`ouro vault create`, `ouro vault unlock`, `ouro vault replace`, `ouro vault recover`, `ouro vault status`, and `ouro vault config` now use the shared human CLI progress checklist for vault account creation, local unlock storage, vault probes, credential reads, runtime config writes, and recovery imports.",
+        "`ouro status --agent`, `ouro provider status`, `ouro config models`, and `ouro config model` now show progress while reading provider credentials, listing GitHub Copilot models, and checking selected models.",
+        "Hatch provider credential resolution and post-start `ouro up` repair auth now route progress through the shared command renderer instead of raw ad hoc output.",
+        "Credential command progress tests now cover successful phases, failure cleanup, provider model exceptions, and secret redaction so these flows stay visibly alive without leaking values.",
+        "`@ouro.bot/cli` and the `ouro.bot` wrapper are version-synced for the remaining credential command progress release."
+      ]
+    },
     {
       "version": "0.1.0-alpha.420",
       "changes": [

package/dist/heart/daemon/cli-exec.js

@@ -189,6 +189,18 @@ function createHumanCommandProgress(deps, commandName) {
         commandName,
     });
 }
+async function runCommandProgressPhase(progress, label, run, detail) {
+    progress.startPhase(label);
+    try {
+        const result = await Promise.resolve(run());
+        progress.completePhase(label, detail(result));
+        return result;
+    }
+    catch (error) {
+        progress.completePhase(label, "failed");
+        throw error;
+    }
+}
 function daemonProgressSummary(result) {
     if (result.verifyStartupStatus === false)
         return "not answering yet";
@@ -626,14 +638,25 @@ async function resolveHatchInput(command, deps) {
     if (!agentName || !humanName || !(0, cli_parse_2.isAgentProvider)(providerRaw)) {
         throw new Error(`Usage\n${(0, cli_parse_2.usage)()}`);
     }
-    const credentials = await (0, auth_flow_1.resolveHatchCredentials)({
-        agentName,
-        provider: providerRaw,
-        credentials: command.credentials,
-        promptInput: prompt,
-        runAuthFlow: deps.runAuthFlow,
-        onProgress: deps.writeStdout,
-    });
+    const progress = createHumanCommandProgress(deps, "hatch auth");
+    let credentials;
+    try {
+        progress.startPhase(`resolving ${providerRaw} credentials`);
+        credentials = await (0, auth_flow_1.resolveHatchCredentials)({
+            agentName,
+            provider: providerRaw,
+            credentials: command.credentials,
+            promptInput: prompt,
+            runAuthFlow: deps.runAuthFlow,
+            onProgress: (message) => progress.updateDetail(message),
+        });
+        progress.completePhase(`resolving ${providerRaw} credentials`, "ready");
+    }
+    catch (error) {
+        progress.end();
+        throw error;
+    }
+    progress.end();
     return {
         agentName,
         humanName,
@@ -813,7 +836,7 @@ function rejectGeneratedVaultUnlockSecret(action) {
     throw new Error(`vault ${action} no longer supports --generate-unlock-secret. Re-run without that flag and enter a human-chosen unlock secret; Ouro will not print vault unlock secrets.`);
 }
 async function createRepairVaultForAgent(input) {
-    const result = await (0, vault_setup_1.createVaultAccount)("Ouro credential vault", input.serverUrl, input.email, input.unlockSecret);
+    const result = await runCommandProgressPhase(input.progress, "creating vault account", () => (0, vault_setup_1.createVaultAccount)("Ouro credential vault", input.serverUrl, input.email, input.unlockSecret), (created) => created.success ? "created" : "failed");
     if (!result.success) {
         const message = [
             `vault ${input.action} failed for ${input.agentName}: ${result.error}`,
@@ -827,14 +850,18 @@ async function createRepairVaultForAgent(input) {
         input.deps.writeStdout(message);
         return { ok: false, message };
     }
-    writeAgentVaultConfig(input.agentName, input.configPath, input.config, { email: input.email, serverUrl: input.serverUrl });
-    const store = (0, vault_unlock_1.storeVaultUnlockSecret)({
-        agentName: input.agentName,
-        email: input.email,
-        serverUrl: input.serverUrl,
-    }, input.unlockSecret, { homeDir: input.deps.homeDir, store: input.store });
-    (0, credential_access_1.resetCredentialStore)();
-    await (0, credential_access_1.getCredentialStore)(input.agentName).get("__ouro_vault_probe__");
+    const store = await runCommandProgressPhase(input.progress, "saving local unlock", () => {
+        writeAgentVaultConfig(input.agentName, input.configPath, input.config, { email: input.email, serverUrl: input.serverUrl });
+        return (0, vault_unlock_1.storeVaultUnlockSecret)({
+            agentName: input.agentName,
+            email: input.email,
+            serverUrl: input.serverUrl,
+        }, input.unlockSecret, { homeDir: input.deps.homeDir, store: input.store });
+    }, (saved) => saved.kind);
+    await runCommandProgressPhase(input.progress, "checking vault access", async () => {
+        (0, credential_access_1.resetCredentialStore)();
+        await (0, credential_access_1.getCredentialStore)(input.agentName).get("__ouro_vault_probe__");
+    }, () => "ok");
     return { ok: true, store };
 }
 async function executeVaultUnlock(command, deps) {
@@ -845,13 +872,22 @@ async function executeVaultUnlock(command, deps) {
     const { config } = (0, auth_flow_1.readAgentConfigForAgent)(command.agent, deps.bundlesRoot);
     const vault = (0, identity_1.resolveVaultConfig)(command.agent, config.vault);
     const unlockSecret = await promptSecret(`Ouro vault unlock secret for ${vault.email}: `);
-    const store = (0, vault_unlock_1.storeVaultUnlockSecret)({
-        agentName: command.agent,
-        email: vault.email,
-        serverUrl: vault.serverUrl,
-    }, unlockSecret, { homeDir: deps.homeDir, store: command.store });
-    (0, credential_access_1.resetCredentialStore)();
-    await (0, credential_access_1.getCredentialStore)(command.agent).get("__ouro_vault_probe__");
+    const progress = createHumanCommandProgress(deps, "vault unlock");
+    let store;
+    try {
+        store = await runCommandProgressPhase(progress, "saving local unlock", () => (0, vault_unlock_1.storeVaultUnlockSecret)({
+            agentName: command.agent,
+            email: vault.email,
+            serverUrl: vault.serverUrl,
+        }, unlockSecret, { homeDir: deps.homeDir, store: command.store }), (saved) => saved.kind);
+        await runCommandProgressPhase(progress, "checking vault access", async () => {
+            (0, credential_access_1.resetCredentialStore)();
+            await (0, credential_access_1.getCredentialStore)(command.agent).get("__ouro_vault_probe__");
+        }, () => "ok");
+    }
+    finally {
+        progress.end();
+    }
     const message = [
         `vault unlocked for ${command.agent} on this machine`,
         `vault: ${vault.email} at ${vault.serverUrl}`,
@@ -877,25 +913,40 @@ async function executeVaultCreate(command, deps) {
         confirmQuestion: `Confirm Ouro vault unlock secret for ${email}: `,
         emptyError: "vault create requires an unlock secret. Re-run in an interactive terminal and enter a human-chosen unlock secret.",
     });
-    const result = await (0, vault_setup_1.createVaultAccount)("Ouro credential vault", serverUrl, email, unlockSecret);
-    if (!result.success) {
-        const message = [
-            `vault create failed for ${command.agent}: ${result.error}`,
-            "",
-            "If this vault account already exists, run:",
-            `  ouro vault unlock --agent ${command.agent}`,
-        ].join("\n");
-        deps.writeStdout(message);
-        return message;
+    const progress = createHumanCommandProgress(deps, "vault create");
+    let store;
+    try {
+        const result = await runCommandProgressPhase(progress, "creating vault account", () => (0, vault_setup_1.createVaultAccount)("Ouro credential vault", serverUrl, email, unlockSecret), (created) => created.success ? "created" : "failed");
+        if (!result.success) {
+            const message = [
+                `vault create failed for ${command.agent}: ${result.error}`,
+                "",
+                "If this vault account already exists, run:",
+                `  ouro vault unlock --agent ${command.agent}`,
+            ].join("\n");
+            progress.end();
+            deps.writeStdout(message);
+            return message;
+        }
+        store = await runCommandProgressPhase(progress, "saving local unlock", () => {
+            writeAgentVaultConfig(command.agent, configPath, config, { email, serverUrl });
+            return (0, vault_unlock_1.storeVaultUnlockSecret)({
+                agentName: command.agent,
+                email,
+                serverUrl,
+            }, unlockSecret, { homeDir: deps.homeDir, store: command.store });
+        }, (saved) => saved.kind);
+        await runCommandProgressPhase(progress, "checking vault access", async () => {
+            (0, credential_access_1.resetCredentialStore)();
+            await (0, credential_access_1.getCredentialStore)(command.agent).get("__ouro_vault_probe__");
+        }, () => "ok");
+    }
+    finally {
+        progress.end();
     }
-    writeAgentVaultConfig(command.agent, configPath, config, { email, serverUrl });
-    const store = (0, vault_unlock_1.storeVaultUnlockSecret)({
-        agentName: command.agent,
-        email,
-        serverUrl,
-    }, unlockSecret, { homeDir: deps.homeDir, store: command.store });
-    (0, credential_access_1.resetCredentialStore)();
-    await (0, credential_access_1.getCredentialStore)(command.agent).get("__ouro_vault_probe__");
+    /* v8 ignore next -- defensive: success path assigns store before continuing @preserve */
+    if (!store)
+        throw new Error(`vault create failed for ${command.agent}: local unlock material was not saved`);
     const message = appendBundleSyncSummary([
         `vault created for ${command.agent}`,
         `vault: ${email} at ${serverUrl}`,
@@ -923,17 +974,28 @@ async function executeVaultReplace(command, deps) {
         confirmQuestion: `Confirm new Ouro vault unlock secret for ${email}: `,
         emptyError: "vault replace requires an unlock secret. Re-run in an interactive terminal and enter a human-chosen unlock secret.",
     });
-    const repair = await createRepairVaultForAgent({
-        action: "replace",
-        agentName: command.agent,
-        email,
-        serverUrl,
-        unlockSecret,
-        store: command.store,
-        deps,
-        configPath,
-        config,
-    });
+    const progress = createHumanCommandProgress(deps, "vault replace");
+    let repair;
+    try {
+        repair = await createRepairVaultForAgent({
+            action: "replace",
+            agentName: command.agent,
+            email,
+            serverUrl,
+            unlockSecret,
+            store: command.store,
+            deps,
+            progress,
+            configPath,
+            config,
+        });
+    }
+    finally {
+        progress.end();
+    }
+    /* v8 ignore next -- defensive: createRepairVaultForAgent either returns or throws @preserve */
+    if (!repair)
+        throw new Error(`vault replace failed for ${command.agent}: no vault repair result`);
     if (!repair.ok)
         return repair.message;
     const message = appendBundleSyncSummary([
@@ -966,43 +1028,60 @@ async function executeVaultRecover(command, deps) {
         confirmQuestion: `Confirm new Ouro vault unlock secret for ${email}: `,
         emptyError: "vault recover requires an unlock secret. Re-run in an interactive terminal and enter a human-chosen unlock secret.",
     });
-    const repair = await createRepairVaultForAgent({
-        action: "recover",
-        agentName: command.agent,
-        email,
-        serverUrl,
-        unlockSecret,
-        store: command.store,
-        deps,
-        configPath,
-        config,
-    });
-    if (!repair.ok)
-        return repair.message;
+    const progress = createHumanCommandProgress(deps, "vault recover");
+    let repair;
     const importedProviders = new Set();
-    let mergedRecoveredRuntimeConfig = {};
-    for (const source of sourceImports) {
-        for (const provider of source.providers) {
-            await (0, provider_credentials_1.upsertProviderCredential)({
-                agentName: command.agent,
-                provider: provider.provider,
-                credentials: provider.credentials,
-                config: provider.config,
-                provenance: { source: "manual" },
-                now,
-            });
-            importedProviders.add(provider.provider);
-        }
-        mergedRecoveredRuntimeConfig = mergeRuntimeConfig(mergedRecoveredRuntimeConfig, source.runtimeConfig);
-    }
-    const { agentConfig: mergedRuntimeConfig, machineConfig: mergedMachineRuntimeConfig } = splitRuntimeConfigByScope(mergedRecoveredRuntimeConfig);
-    const runtimeFields = summarizeRuntimeConfigFields(mergedRuntimeConfig);
-    const machineRuntimeFields = summarizeRuntimeConfigFields(mergedMachineRuntimeConfig);
-    if (runtimeFields.length > 0) {
-        await (0, runtime_credentials_1.upsertRuntimeCredentialConfig)(command.agent, mergedRuntimeConfig, now);
+    let runtimeFields = [];
+    let machineRuntimeFields = [];
+    try {
+        repair = await createRepairVaultForAgent({
+            action: "recover",
+            agentName: command.agent,
+            email,
+            serverUrl,
+            unlockSecret,
+            store: command.store,
+            deps,
+            progress,
+            configPath,
+            config,
+        });
+        if (!repair.ok)
+            return repair.message;
+        await runCommandProgressPhase(progress, "importing recovered credentials", async () => {
+            let mergedRecoveredRuntimeConfig = {};
+            for (const source of sourceImports) {
+                for (const provider of source.providers) {
+                    await (0, provider_credentials_1.upsertProviderCredential)({
+                        agentName: command.agent,
+                        provider: provider.provider,
+                        credentials: provider.credentials,
+                        config: provider.config,
+                        provenance: { source: "manual" },
+                        now,
+                    });
+                    importedProviders.add(provider.provider);
+                }
+                mergedRecoveredRuntimeConfig = mergeRuntimeConfig(mergedRecoveredRuntimeConfig, source.runtimeConfig);
+            }
+            const splitRuntimeConfig = splitRuntimeConfigByScope(mergedRecoveredRuntimeConfig);
+            runtimeFields = summarizeRuntimeConfigFields(splitRuntimeConfig.agentConfig);
+            machineRuntimeFields = summarizeRuntimeConfigFields(splitRuntimeConfig.machineConfig);
+            if (runtimeFields.length > 0) {
+                await (0, runtime_credentials_1.upsertRuntimeCredentialConfig)(command.agent, splitRuntimeConfig.agentConfig, now);
+            }
+            if (machineRuntimeFields.length > 0) {
+                await (0, runtime_credentials_1.upsertMachineRuntimeCredentialConfig)(command.agent, currentMachineId(deps), splitRuntimeConfig.machineConfig, now);
+            }
+            return {
+                providerCount: importedProviders.size,
+                runtimeCount: runtimeFields.length,
+                machineRuntimeCount: machineRuntimeFields.length,
+            };
+        }, (imported) => `${imported.providerCount} providers, ${imported.runtimeCount + imported.machineRuntimeCount} runtime fields`);
     }
-    if (machineRuntimeFields.length > 0) {
-        await (0, runtime_credentials_1.upsertMachineRuntimeCredentialConfig)(command.agent, currentMachineId(deps), mergedMachineRuntimeConfig, now);
+    finally {
+        progress.end();
     }
     const providerList = [...importedProviders].sort();
     const message = appendBundleSyncSummary([
@@ -1053,26 +1132,39 @@ async function executeVaultStatus(command, deps) {
         `local unlock: ${status.stored ? "available" : "missing"}`,
     ];
     if (status.stored) {
-        const runtime = await (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(command.agent, { preserveCachedOnFailure: true });
-        if (runtime.ok) {
-            lines.push(`runtime credentials: ${summarizeRuntimeConfigFields(runtime.config).join(", ") || "none stored"} (${runtime.revision})`);
-        }
-        else {
-            lines.push(`runtime credentials: ${runtime.reason} (${runtime.error})`);
-            if (runtime.reason === "missing") {
-                lines.push(`  fix: Run 'ouro vault config set --agent ${command.agent} --key <field>' to store sense/integration credentials.`);
+        const progress = createHumanCommandProgress(deps, "vault status");
+        try {
+            const runtime = await runCommandProgressPhase(progress, "reading runtime credentials", () => (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(command.agent, { preserveCachedOnFailure: true }), (runtimeResult) => runtimeResult.ok ? runtimeResult.revision : runtimeResult.reason);
+            if (runtime.ok) {
+                lines.push(`runtime credentials: ${summarizeRuntimeConfigFields(runtime.config).join(", ") || "none stored"} (${runtime.revision})`);
             }
-        }
-        const pool = await (0, provider_credentials_1.refreshProviderCredentialPool)(command.agent);
-        if (pool.ok) {
-            const summary = (0, provider_credentials_1.summarizeProviderCredentialPool)(pool.pool);
-            lines.push(`provider credentials: ${summary.providers.length === 0 ? "none stored" : ""}`);
-            for (const provider of summary.providers) {
-                lines.push(`  ${provider.provider}: credential fields ${provider.credentialFields.join(", ") || "none"}, config fields ${provider.configFields.join(", ") || "none"}`);
+            else {
+                lines.push(`runtime credentials: ${runtime.reason} (${runtime.error})`);
+                if (runtime.reason === "missing") {
+                    lines.push(`  fix: Run 'ouro vault config set --agent ${command.agent} --key <field>' to store sense/integration credentials.`);
+                }
+            }
+            const pool = await runCommandProgressPhase(progress, "reading provider credentials", () => (0, provider_credentials_1.refreshProviderCredentialPool)(command.agent, {
+                onProgress: (message) => progress.updateDetail(message),
+            }), (poolResult) => {
+                if (!poolResult.ok)
+                    return poolResult.reason;
+                const summary = (0, provider_credentials_1.summarizeProviderCredentialPool)(poolResult.pool);
+                return summary.providers.map((provider) => provider.provider).join(", ") || "none stored";
+            });
+            if (pool.ok) {
+                const summary = (0, provider_credentials_1.summarizeProviderCredentialPool)(pool.pool);
+                lines.push(`provider credentials: ${summary.providers.length === 0 ? "none stored" : ""}`);
+                for (const provider of summary.providers) {
+                    lines.push(`  ${provider.provider}: credential fields ${provider.credentialFields.join(", ") || "none"}, config fields ${provider.configFields.join(", ") || "none"}`);
+                }
+            }
+            else {
+                lines.push(`provider credentials: unavailable (${pool.error})`);
             }
         }
-        else {
-            lines.push(`provider credentials: unavailable (${pool.error})`);
+        finally {
+            progress.end();
         }
     }
     else {
@@ -1190,13 +1282,24 @@ async function executeVaultConfigSet(command, deps) {
     if (!value) {
         throw new Error("vault config set requires --value <value> or an interactive prompt");
     }
-    const stored = await storeRuntimeConfigKey({
-        agent: command.agent,
-        key: command.key,
-        value,
-        scope,
-        deps,
-    });
+    const progress = createHumanCommandProgress(deps, "vault config set");
+    let stored;
+    try {
+        stored = await runCommandProgressPhase(progress, "storing runtime credential", () => storeRuntimeConfigKey({
+            agent: command.agent,
+            key: command.key,
+            value,
+            scope,
+            deps,
+            onProgress: (message) => progress.updateDetail(message),
+        }), (result) => result.revision);
+    }
+    finally {
+        progress.end();
+    }
+    /* v8 ignore next -- defensive: storeRuntimeConfigKey either returns or throws @preserve */
+    if (!stored)
+        throw new Error(`vault config set failed for ${command.agent}: no stored runtime credential result`);
     const message = [
         `stored ${command.key} for ${command.agent} in ${runtimeScopeLabel(scope)}`,
         `runtime credentials: ${stored.revision}`,
@@ -1214,27 +1317,33 @@ async function executeVaultConfigStatus(command, deps) {
     }
     const scopes = command.scope === "all" ? ["agent", "machine"] : [command.scope ?? "agent"];
     const lines = [`agent: ${command.agent}`];
-    for (const scope of scopes) {
-        const machineId = scope === "machine" ? currentMachineId(deps) : undefined;
-        const runtime = scope === "machine"
-            ? await (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(command.agent, machineId, { preserveCachedOnFailure: true })
-            : await (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(command.agent, { preserveCachedOnFailure: true });
-        if (scopes.length > 1)
-            lines.push("");
-        lines.push(`${scope} runtime config item: ${runtime.itemPath}`);
-        if (runtime.ok) {
-            lines.push(`status: available (${runtime.revision})`);
-            const fields = summarizeRuntimeConfigFields(runtime.config);
-            lines.push(`fields: ${fields.length === 0 ? "none stored" : fields.join(", ")}`);
-        }
-        else {
-            lines.push(`status: ${runtime.reason}`);
-            lines.push(`error: ${runtime.error}`);
-            lines.push(runtime.reason === "missing"
-                ? `fix: Run 'ouro vault config set --agent ${command.agent} --key <field>${scope === "machine" ? " --scope machine" : ""}' to store runtime credentials.`
-                : `fix: ${(0, vault_unlock_1.vaultUnlockReplaceRecoverFix)(command.agent, "Then retry 'ouro vault config status'.")}`);
+    const progress = createHumanCommandProgress(deps, "vault config status");
+    try {
+        for (const scope of scopes) {
+            const machineId = scope === "machine" ? currentMachineId(deps) : undefined;
+            const runtime = await runCommandProgressPhase(progress, `reading ${scope} runtime config`, () => scope === "machine"
+                ? (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(command.agent, machineId, { preserveCachedOnFailure: true })
+                : (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(command.agent, { preserveCachedOnFailure: true }), (runtimeResult) => runtimeResult.ok ? runtimeResult.revision : runtimeResult.reason);
+            if (scopes.length > 1)
+                lines.push("");
+            lines.push(`${scope} runtime config item: ${runtime.itemPath}`);
+            if (runtime.ok) {
+                lines.push(`status: available (${runtime.revision})`);
+                const fields = summarizeRuntimeConfigFields(runtime.config);
+                lines.push(`fields: ${fields.length === 0 ? "none stored" : fields.join(", ")}`);
+            }
+            else {
+                lines.push(`status: ${runtime.reason}`);
+                lines.push(`error: ${runtime.error}`);
+                lines.push(runtime.reason === "missing"
+                    ? `fix: Run 'ouro vault config set --agent ${command.agent} --key <field>${scope === "machine" ? " --scope machine" : ""}' to store runtime credentials.`
+                    : `fix: ${(0, vault_unlock_1.vaultUnlockReplaceRecoverFix)(command.agent, "Then retry 'ouro vault config status'.")}`);
+            }
         }
     }
+    finally {
+        progress.end();
+    }
     const message = lines.join("\n");
     deps.writeStdout(message);
     return message;
@@ -1714,7 +1823,20 @@ function renderProviderCredentialLine(credential) {
 }
 async function executeProviderStatus(command, deps) {
     const agentRoot = providerCliAgentRoot(command, deps);
-    await (0, provider_credentials_1.refreshProviderCredentialPool)(command.agent);
+    const progress = createHumanCommandProgress(deps, "provider status");
+    try {
+        await runCommandProgressPhase(progress, "reading provider credentials", () => (0, provider_credentials_1.refreshProviderCredentialPool)(command.agent, {
+            onProgress: (message) => progress.updateDetail(message),
+        }), (poolResult) => {
+            if (!poolResult.ok)
+                return poolResult.reason;
+            const summary = (0, provider_credentials_1.summarizeProviderCredentialPool)(poolResult.pool);
+            return summary.providers.map((provider) => provider.provider).join(", ") || "none stored";
+        });
+    }
+    finally {
+        progress.end();
+    }
     const homeDir = providerCliHomeDir(deps);
     const lines = [`provider status: ${command.agent}`];
     for (const lane of ["outward", "inner"]) {
@@ -2006,36 +2128,61 @@ async function executeLegacyConfigModel(command, deps) {
     const lane = command.facing === "agent" ? "inner" : "outward";
     const { agentRoot, state } = readOrBootstrapProviderState(command.agent, deps);
     const binding = state.lanes[lane];
+    const progress = binding.provider === "github-copilot" ? createHumanCommandProgress(deps, "config model") : null;
+    const writeMessage = (message) => {
+        progress?.end();
+        deps.writeStdout(message);
+        return message;
+    };
     if (binding.provider === "github-copilot") {
-        const credential = await readProviderCredentialRecord(command.agent, "github-copilot", deps);
-        if (credential.ok) {
-            const ghConfig = {
-                ...credential.record.config,
-                ...credential.record.credentials,
-            };
-            const githubToken = ghConfig.githubToken;
-            const baseUrl = ghConfig.baseUrl;
-            if (typeof githubToken === "string" && typeof baseUrl === "string") {
-                const fetchFn = deps.fetchImpl ?? fetch;
-                try {
-                    const models = await listGithubCopilotModels(baseUrl, githubToken, fetchFn);
-                    const available = models.map((m) => m.id);
-                    if (available.length > 0 && !available.includes(command.modelName)) {
-                        const message = `model '${command.modelName}' not found. available models:\n${available.map((id) => `  ${id}`).join("\n")}`;
-                        deps.writeStdout(message);
-                        return message;
+        try {
+            progress?.startPhase("reading github-copilot credentials");
+            const credential = await readProviderCredentialRecord(command.agent, "github-copilot", deps, {
+                onProgress: (message) => progress?.updateDetail(message),
+            });
+            if (credential.ok) {
+                const ghConfig = {
+                    ...credential.record.config,
+                    ...credential.record.credentials,
+                };
+                const githubToken = ghConfig.githubToken;
+                const baseUrl = ghConfig.baseUrl;
+                if (typeof githubToken === "string" && typeof baseUrl === "string") {
+                    progress?.completePhase("reading github-copilot credentials", "found");
+                    const fetchFn = deps.fetchImpl ?? fetch;
+                    try {
+                        progress?.startPhase("listing github-copilot models");
+                        const models = await listGithubCopilotModels(baseUrl, githubToken, fetchFn);
+                        const available = models.map((m) => m.id);
+                        progress?.completePhase("listing github-copilot models", `${available.length} model${available.length === 1 ? "" : "s"}`);
+                        if (available.length > 0 && !available.includes(command.modelName)) {
+                            const message = `model '${command.modelName}' not found. available models:\n${available.map((id) => `  ${id}`).join("\n")}`;
+                            return writeMessage(message);
+                        }
+                    }
+                    catch {
+                        progress?.completePhase("listing github-copilot models", "skipped");
+                        // Catalog validation failed; the live ping below gives the actionable result.
+                    }
+                    progress?.startPhase(`checking ${command.modelName}`);
+                    const pingResult = await (0, provider_ping_1.pingGithubCopilotModel)(baseUrl, githubToken, command.modelName, fetchFn);
+                    progress?.completePhase(`checking ${command.modelName}`, pingResult.ok ? "ok" : "failed");
+                    if (!pingResult.ok) {
+                        const message = `model '${command.modelName}' ping failed: ${pingResult.error}\nrun \`ouro config models --agent ${command.agent}\` to see available models.`;
+                        return writeMessage(message);
                     }
                 }
-                catch {
-                    // Catalog validation failed; the live ping below gives the actionable result.
-                }
-                const pingResult = await (0, provider_ping_1.pingGithubCopilotModel)(baseUrl, githubToken, command.modelName, fetchFn);
-                if (!pingResult.ok) {
-                    const message = `model '${command.modelName}' ping failed: ${pingResult.error}\nrun \`ouro config models --agent ${command.agent}\` to see available models.`;
-                    deps.writeStdout(message);
-                    return message;
+                else {
+                    progress?.completePhase("reading github-copilot credentials", "missing fields");
                 }
             }
+            else {
+                progress?.completePhase("reading github-copilot credentials", credential.reason);
+            }
+        }
+        catch (error) {
+            progress?.end();
+            throw error;
         }
     }
     const updatedAt = providerCliNow(deps).toISOString();
@@ -2049,8 +2196,7 @@ async function executeLegacyConfigModel(command, deps) {
     delete state.readiness[lane];
     (0, provider_state_1.writeProviderState)(agentRoot, state);
     const message = `deprecated: updated ${command.agent} model on ${lane}/${binding.provider}: ${binding.model} -> ${command.modelName}\nUse \`ouro use --agent ${command.agent} --lane ${lane} --provider ${binding.provider} --model ${command.modelName}\` next time.`;
-    deps.writeStdout(message);
-    return message;
+    return writeMessage(message);
 }
 // ── System setup ──
 async function registerOuroBundleTypeNonBlocking(deps) {
@@ -2847,11 +2993,11 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
                     promptInput: deps.promptInput ?? (async () => "n"),
                     writeStdout: deps.writeStdout,
                     runAuthFlow: async (agent, providerOverride) => {
-                        const { config } = (0, auth_flow_1.readAgentConfigForAgent)(agent, deps.bundlesRoot);
-                        const provider = providerOverride ?? config.humanFacing.provider;
-                        /* v8 ignore next -- tests always inject runAuthFlow; default is for production @preserve */
-                        const authRunner = deps.runAuthFlow ?? (await Promise.resolve().then(() => __importStar(require("../auth/auth-flow")))).runRuntimeAuthFlow;
-                        await authRunner({ agentName: agent, provider, promptInput: deps.promptInput, onProgress: deps.writeStdout });
+                        await executeAuthRun({
+                            kind: "auth.run",
+                            agent,
+                            ...(providerOverride ? { provider: providerOverride } : {}),
+                        }, deps);
                     },
                     runVaultUnlock: async (agent) => {
                         await executeVaultUnlock({ kind: "vault.unlock", agent }, deps);
@@ -3561,28 +3707,44 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
             deps.writeStdout(message);
             return message;
         }
-        const credential = await readProviderCredentialRecord(command.agent, "github-copilot", deps);
-        const ghConfig = credential.ok
-            ? { ...credential.record.config, ...credential.record.credentials }
-            : {};
-        if (typeof ghConfig.githubToken !== "string" || typeof ghConfig.baseUrl !== "string") {
-            throw new Error(`github-copilot credentials not configured. Run \`ouro auth --agent ${command.agent} --provider github-copilot\` first.`);
-        }
-        const fetchFn = deps.fetchImpl ?? fetch;
-        const models = await listGithubCopilotModels(ghConfig.baseUrl, ghConfig.githubToken, fetchFn);
-        if (models.length === 0) {
-            const message = "no models found";
+        const progress = createHumanCommandProgress(deps, "config models");
+        const writeMessage = (message) => {
+            progress.end();
             deps.writeStdout(message);
             return message;
+        };
+        try {
+            progress.startPhase("reading github-copilot credentials");
+            const credential = await readProviderCredentialRecord(command.agent, "github-copilot", deps, {
+                onProgress: (message) => progress.updateDetail(message),
+            });
+            const ghConfig = credential.ok
+                ? { ...credential.record.config, ...credential.record.credentials }
+                : {};
+            if (!credential.ok || typeof ghConfig.githubToken !== "string" || typeof ghConfig.baseUrl !== "string") {
+                progress.completePhase("reading github-copilot credentials", credential.ok ? "missing fields" : credential.reason);
+                throw new Error(`github-copilot credentials not configured. Run \`ouro auth --agent ${command.agent} --provider github-copilot\` first.`);
+            }
+            progress.completePhase("reading github-copilot credentials", "found");
+            const fetchFn = deps.fetchImpl ?? fetch;
+            progress.startPhase("listing github-copilot models");
+            const models = await listGithubCopilotModels(ghConfig.baseUrl, ghConfig.githubToken, fetchFn);
+            progress.completePhase("listing github-copilot models", `${models.length} model${models.length === 1 ? "" : "s"}`);
+            if (models.length === 0) {
+                return writeMessage("no models found");
+            }
+            const lines = ["available models:"];
+            for (const m of models) {
+                const caps = m.capabilities?.length ? ` (${m.capabilities.join(", ")})` : "";
+                lines.push(`  ${m.id}${caps}`);
+            }
+            const message = lines.join("\n");
+            return writeMessage(message);
         }
-        const lines = ["available models:"];
-        for (const m of models) {
-            const caps = m.capabilities?.length ? ` (${m.capabilities.join(", ")})` : "";
-            lines.push(`  ${m.id}${caps}`);
+        catch (error) {
+            progress.end();
+            throw error;
         }
-        const message = lines.join("\n");
-        deps.writeStdout(message);
-        return message;
     }
     /* v8 ignore stop */
     // ── config model (local, no daemon socket needed) ──

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.420",
+  "version": "0.1.0-alpha.421",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",