@ouro.bot/cli 0.1.0-alpha.421 → 0.1.0-alpha.423

package/README.md

@@ -179,7 +179,10 @@ ouro vault status --agent <name>
 ouro vault config set --agent <name> --key teams.clientSecret
 ouro vault config status --agent <name> --scope all
 ouro connect --agent <name>
+ouro connect providers --agent <name>
 ouro connect perplexity --agent <name>
+ouro connect embeddings --agent <name>
+ouro connect teams --agent <name>
 ouro connect bluebubbles --agent <name>
 ouro auth --agent <name>
 ouro auth --agent <name> --provider <provider>

package/changelog.json

@@ -1,6 +1,25 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.423",
+      "changes": [
+        "`ouro connect` now opens a real connect bay with one guided surface for provider auth, Perplexity, OpenAI embeddings, Teams, and BlueBubbles instead of a tiny menu that still required humans to memorize follow-up commands.",
+        "Added guided `ouro connect providers`, `ouro connect embeddings`, and `ouro connect teams` flows, plus richer connect-bay routing that distinguishes portable runtime config from machine-local attachments without printing secrets.",
+        "Credential/runtime changes now reuse one shared runtime-apply helper that checks daemon socket access, requests restart, polls daemon status, times out cleanly, and falls back clearly when daemon status is unavailable.",
+        "Command progress rendering now marks failed phases honestly with a failure state instead of a success checkmark plus `failed`, and the auth/provider docs, README, testing guide, OAUTH setup guide, and prompt truth text all point at the new connect-bay workflow.",
+        "`@ouro.bot/cli` and the `ouro.bot` wrapper are version-synced for the connect-bay and runtime-apply progress release."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.422",
+      "changes": [
+        "`ouro auth` now streams provider-vault read progress before browser/token work begins, so a locked, slow, or remote vault never looks like a dead terminal after the initial access check.",
+        "Provider credential saves now stream the post-write provider snapshot reload, including vault item reads and parsing, instead of going silent after `refreshing local provider snapshot`.",
+        "Auth-flow tests cover the pre-auth vault read and real Bitwarden-backed post-save refresh progress so the visible credential path stays protected.",
+        "`@ouro.bot/cli` and the `ouro.bot` wrapper are version-synced for the final auth-flow vault progress sweep."
+      ]
+    },
     {
       "version": "0.1.0-alpha.421",
       "changes": [

package/dist/heart/auth/auth-flow.js

@@ -387,7 +387,9 @@ async function runRuntimeAuthFlow(input, deps = {}) {
         meta: { agentName: input.agentName, provider: input.provider },
     });
     writeAuthProgress(input, `checking ${input.agentName}'s vault access...`);
-    const vault = await (0, provider_credentials_1.refreshProviderCredentialPool)(input.agentName);
+    const vault = await (0, provider_credentials_1.refreshProviderCredentialPool)(input.agentName, {
+        onProgress: (message) => writeAuthProgress(input, message),
+    });
     if (!vault.ok && vault.reason === "unavailable") {
         const fix = (0, vault_unlock_1.isCredentialVaultNotConfiguredError)(vault.error)
             ? (0, vault_unlock_1.vaultCreateRecoverFix)(input.agentName, `Then retry 'ouro auth --agent ${input.agentName} --provider ${input.provider}'.`)

package/dist/heart/daemon/cli-exec.js

@@ -71,6 +71,7 @@ const auth_flow_1 = require("../auth/auth-flow");
 const provider_credentials_1 = require("../provider-credentials");
 const runtime_credentials_1 = require("../runtime-credentials");
 const provider_binding_resolver_1 = require("../provider-binding-resolver");
+const provider_visibility_1 = require("../provider-visibility");
 const provider_state_1 = require("../provider-state");
 const machine_identity_1 = require("../machine-identity");
 const provider_models_1 = require("../provider-models");
@@ -197,7 +198,7 @@ async function runCommandProgressPhase(progress, label, run, detail) {
         return result;
     }
     catch (error) {
-        progress.completePhase(label, "failed");
+        progress.failPhase(label, "failed");
         throw error;
     }
 }
@@ -1227,6 +1228,50 @@ function currentMachineId(deps) {
         now: () => providerCliNow(deps),
     }).machineId;
 }
+const DEFAULT_RUNTIME_APPLY_TIMEOUT_MS = 15_000;
+const DEFAULT_RUNTIME_APPLY_POLL_INTERVAL_MS = 500;
+const DEFAULT_DAEMON_STATUS_TIMEOUT_MS = 4_000;
+const DEFAULT_AGENT_RESTART_TIMEOUT_MS = 8_000;
+const CONNECT_PROVIDER_CHOICES = ["openai-codex", "anthropic", "minimax", "azure", "github-copilot"];
+function hasRuntimeConfigValue(config, key) {
+    const segments = key.split(".");
+    let cursor = config;
+    for (const segment of segments) {
+        if (!cursor || typeof cursor !== "object" || Array.isArray(cursor))
+            return false;
+        cursor = cursor[segment];
+    }
+    return typeof cursor === "string" && cursor.trim().length > 0;
+}
+function runtimeConfigReadStatus(runtime) {
+    if (runtime.reason === "missing")
+        return "missing";
+    if (/locked/i.test(runtime.error))
+        return "locked";
+    return "needs attention";
+}
+function cliNowMs(deps) {
+    return (deps.now ?? Date.now)();
+}
+function cliSleep(deps, ms) {
+    if (deps.sleep)
+        return deps.sleep(ms);
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function withCliTimeout(timeoutMs, label, run) {
+    let timer;
+    try {
+        return await Promise.race([
+            run(),
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error(label)), timeoutMs);
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 async function promptRuntimeConfigValue(command, deps) {
     if (command.value !== undefined)
         return command.value;
@@ -1242,7 +1287,7 @@ async function promptRuntimeConfigValue(command, deps) {
 function runtimeScopeLabel(scope) {
     return scope === "machine" ? "this machine's vault runtime config item" : "the agent vault runtime/config item";
 }
-async function storeRuntimeConfigKey(input) {
+async function storeRuntimeConfigKeys(input) {
     const machineId = input.scope === "machine" ? currentMachineId(input.deps) : undefined;
     input.onProgress?.("checking existing runtime config");
     const current = input.scope === "machine"
@@ -1251,23 +1296,77 @@ async function storeRuntimeConfigKey(input) {
     if (!current.ok && current.reason !== "missing") {
         throw new Error(`cannot read existing runtime credentials from ${current.itemPath}: ${current.error}`);
     }
-    input.onProgress?.(`storing ${input.key} in ${current.itemPath}`);
-    const nextConfig = setRuntimeConfigValue(current.ok ? current.config : {}, input.key, input.value);
+    let nextConfig = current.ok ? current.config : {};
+    for (const entry of input.entries) {
+        input.onProgress?.(`storing ${entry.key} in ${current.itemPath}`);
+        nextConfig = setRuntimeConfigValue(nextConfig, entry.key, entry.value);
+    }
     const stored = input.scope === "machine"
         ? await (0, runtime_credentials_1.upsertMachineRuntimeCredentialConfig)(input.agent, machineId, nextConfig, providerCliNow(input.deps))
         : await (0, runtime_credentials_1.upsertRuntimeCredentialConfig)(input.agent, nextConfig, providerCliNow(input.deps));
-    input.onProgress?.(`stored ${input.key}; credential value was not printed`);
+    input.onProgress?.(`stored ${input.entries.map((entry) => entry.key).join(", ")}; credential values were not printed`);
     return { revision: stored.revision, itemPath: stored.itemPath, ...(machineId ? { machineId } : {}) };
 }
-async function reloadRunningAgentAfterCredentialChange(agent, deps) {
+async function storeRuntimeConfigKey(input) {
+    return storeRuntimeConfigKeys({
+        agent: input.agent,
+        entries: [{ key: input.key, value: input.value }],
+        scope: input.scope,
+        deps: input.deps,
+        onProgress: input.onProgress,
+    });
+}
+function readRuntimeApplyWorker(payload, agent) {
+    return payload.workers.find((worker) => worker.agent === agent) ?? null;
+}
+async function applyRuntimeChangeToRunningAgent(agent, deps, onProgress) {
     try {
+        onProgress?.("checking daemon socket");
         const alive = await deps.checkSocketAlive(deps.socketPath);
         if (!alive)
-            return "daemon is not running; next `ouro up` will load it";
-        const response = await deps.sendCommand(deps.socketPath, { kind: "agent.restart", agent });
-        if (response.ok)
-            return `restarted ${agent} so the running agent reloads credentials`;
-        return `daemon restart skipped: ${response.error ?? response.message ?? "unknown daemon error"}`;
+            return "daemon is not running; next `ouro up` will load the change";
+        onProgress?.("requesting restart from daemon");
+        const response = await withCliTimeout(DEFAULT_AGENT_RESTART_TIMEOUT_MS, "daemon restart request timed out", () => deps.sendCommand(deps.socketPath, { kind: "agent.restart", agent }));
+        if (!response.ok)
+            return `daemon restart skipped: ${response.error ?? response.message ?? "unknown daemon error"}`;
+        const deadline = cliNowMs(deps) + DEFAULT_RUNTIME_APPLY_TIMEOUT_MS;
+        onProgress?.(`waiting for ${agent} to report running state`);
+        while (cliNowMs(deps) < deadline) {
+            try {
+                const statusResponse = await withCliTimeout(DEFAULT_DAEMON_STATUS_TIMEOUT_MS, "daemon status timed out", () => deps.sendCommand(deps.socketPath, { kind: "daemon.status" }));
+                if (statusResponse.ok) {
+                    const payload = (0, cli_render_1.parseStatusPayload)(statusResponse.data);
+                    if (!payload) {
+                        onProgress?.("daemon status did not include structured worker state");
+                        return "restart requested; daemon status is unavailable, so verify with `ouro status` if needed";
+                    }
+                    const worker = readRuntimeApplyWorker(payload, agent);
+                    if (!worker) {
+                        onProgress?.(`still waiting: ${agent} is not listed by daemon`);
+                    }
+                    else if (worker.status === "running") {
+                        onProgress?.(`daemon reports ${agent}/${worker.worker} running`);
+                        return `restarted ${agent} and the daemon reports it running`;
+                    }
+                    else if (worker.status === "crashed") {
+                        return `restart requested, but ${agent}/${worker.worker} crashed before reporting running${worker.errorReason ? `: ${worker.errorReason}` : worker.fixHint ? `: ${worker.fixHint}` : ""}`;
+                    }
+                    else {
+                        onProgress?.(`still waiting: ${agent}/${worker.worker} is ${worker.status}`);
+                    }
+                }
+                else {
+                    onProgress?.(`still waiting: daemon status returned ${statusResponse.error ?? statusResponse.message ?? "unknown error"}`);
+                }
+            }
+            catch (error) {
+                onProgress?.(`still waiting: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            if (cliNowMs(deps) >= deadline - DEFAULT_RUNTIME_APPLY_POLL_INTERVAL_MS)
+                break;
+            await cliSleep(deps, DEFAULT_RUNTIME_APPLY_POLL_INTERVAL_MS);
+        }
+        return `restart requested, but ${agent} did not report running before timeout. The change is stored; run \`ouro status\` or \`ouro up\` if it still looks stale.`;
     }
     catch (error) {
         return `daemon restart skipped: ${error instanceof Error ? error.message : String(error)}`;
@@ -1401,23 +1500,70 @@ function enableAgentSense(agent, sense, deps) {
     };
     fs.writeFileSync(configPath, `${JSON.stringify(raw, null, 2)}\n`, "utf-8");
 }
-function connectMenu(agent) {
+async function buildConnectMenu(agent, deps) {
+    const providerVisibility = (0, provider_visibility_1.buildAgentProviderVisibility)({
+        agentName: agent,
+        agentRoot: providerCliAgentRoot({ agent }, deps),
+        homeDir: providerCliHomeDir(deps),
+    });
+    const providerStatus = providerVisibility.lanes.some((lane) => lane.status === "unconfigured")
+        ? "needs setup"
+        : providerVisibility.lanes.some((lane) => lane.status === "configured" && lane.credential.status !== "present")
+            ? "needs auth"
+            : providerVisibility.lanes.some((lane) => lane.status === "configured" && (lane.readiness.status === "failed" || lane.readiness.status === "stale"))
+                ? "needs attention"
+                : "ready";
+    const providerDetail = providerVisibility.lanes.map((lane) => lane.status === "configured"
+        ? `${lane.lane}: ${lane.provider} / ${lane.model}`
+        : `${lane.lane}: choose provider/model`).join(" | ");
+    const runtimeConfig = await (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(agent, { preserveCachedOnFailure: true });
+    const machineRuntime = await (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(agent, currentMachineId(deps), { preserveCachedOnFailure: true });
+    const agentConfig = (0, auth_flow_1.readAgentConfigForAgent)(agent, deps.bundlesRoot).config;
+    const teamsEnabled = agentConfig.senses?.teams?.enabled === true;
+    const blueBubblesEnabled = agentConfig.senses?.bluebubbles?.enabled === true;
+    const perplexityStatus = runtimeConfig.ok
+        ? hasRuntimeConfigValue(runtimeConfig.config, "integrations.perplexityApiKey") ? "ready" : "missing"
+        : runtimeConfigReadStatus(runtimeConfig);
+    const embeddingsStatus = runtimeConfig.ok
+        ? hasRuntimeConfigValue(runtimeConfig.config, "integrations.openaiEmbeddingsApiKey") ? "ready" : "missing"
+        : runtimeConfigReadStatus(runtimeConfig);
+    const teamsStatus = runtimeConfig.ok
+        ? hasRuntimeConfigValue(runtimeConfig.config, "teams.clientId")
+            && hasRuntimeConfigValue(runtimeConfig.config, "teams.clientSecret")
+            && hasRuntimeConfigValue(runtimeConfig.config, "teams.tenantId")
+            && teamsEnabled
+            ? "ready"
+            : "missing"
+        : runtimeConfigReadStatus(runtimeConfig);
+    const blueBubblesStatus = machineRuntime.ok
+        ? hasRuntimeConfigValue(machineRuntime.config, "bluebubbles.serverUrl")
+            && hasRuntimeConfigValue(machineRuntime.config, "bluebubbles.password")
+            && blueBubblesEnabled
+            ? "attached"
+            : "not attached"
+        : machineRuntimeReadStatus(machineRuntime);
     return [
-        `Connect ${agent}`,
-        "Pick what this agent should be able to use.",
+        `${agent} // connect bay`,
+        "Bring one capability online at a time.",
         "",
-        "  1. Perplexity search",
-        "     Portable. Stores an API key in the agent vault.",
+        `  1. [${providerStatus}] Providers`,
+        `     ${providerDetail}`,
         "",
-        "  2. BlueBubbles iMessage",
-        "     This machine only. Connects a local Mac Messages bridge.",
+        `  2. [${perplexityStatus}] Perplexity search`,
+        "     Portable. Web search via Perplexity.",
         "",
-        "  3. Provider auth",
-        `     Model credentials: ouro auth --agent ${agent} --provider <provider>`,
+        `  3. [${embeddingsStatus}] Memory embeddings`,
+        "     Portable. Memory retrieval and note search.",
         "",
-        "  4. Cancel",
+        `  4. [${teamsStatus}] Teams`,
+        "     Portable. Microsoft Teams sense credentials.",
         "",
-        "Choose [1-4]: ",
+        `  5. [${blueBubblesStatus}] BlueBubbles iMessage`,
+        "     This machine only. Local Mac Messages bridge.",
+        "",
+        "  6. Cancel",
+        "",
+        "Choose [1-6] or type a name: ",
     ].join("\n");
 }
 async function executeConnectPerplexity(agent, deps) {
@@ -1437,30 +1583,24 @@ async function executeConnectPerplexity(agent, deps) {
     let stored;
     let reload;
     try {
-        progress.startPhase("saving Perplexity search");
-        stored = await storeRuntimeConfigKey({
+        stored = await runCommandProgressPhase(progress, "saving Perplexity search", () => storeRuntimeConfigKey({
             agent,
             key: "integrations.perplexityApiKey",
             value: key,
             scope: "agent",
             deps,
             onProgress: (message) => progress.updateDetail(message),
-        });
-        progress.completePhase("saving Perplexity search", "secret stored");
-        progress.startPhase(`reloading ${agent}`);
-        reload = await reloadRunningAgentAfterCredentialChange(agent, deps);
-        progress.completePhase(`reloading ${agent}`, reload);
-        progress.end();
+        }), () => "secret stored");
+        reload = await runCommandProgressPhase(progress, `applying change to running ${agent}`, () => applyRuntimeChangeToRunningAgent(agent, deps, (message) => progress.updateDetail(message)), (result) => result);
     }
-    catch (error) {
+    finally {
         progress.end();
-        throw error;
     }
     const message = [
         `Perplexity connected for ${agent}`,
         "capability: Perplexity search",
         `stored: ${stored.itemPath}`,
-        `reload: ${reload}`,
+        `running agent: ${reload}`,
         "secret was not printed",
         "",
         "Next: ask the agent to search.",
@@ -1468,6 +1608,102 @@ async function executeConnectPerplexity(agent, deps) {
     deps.writeStdout(message);
     return message;
 }
+async function executeConnectEmbeddings(agent, deps) {
+    if (agent === "SerpentGuide") {
+        throw new Error("SerpentGuide has no persistent runtime credentials. Connect embeddings on the hatchling agent instead.");
+    }
+    const promptSecret = requirePromptSecret(deps, "OpenAI embeddings API key entry");
+    deps.writeStdout([
+        `Connect embeddings for ${agent}`,
+        "The API key stays hidden while you type.",
+        `Ouro stores it in ${agent}'s vault runtime/config item.`,
+    ].join("\n"));
+    const key = (await promptSecret("OpenAI embeddings API key: ")).trim();
+    if (!key)
+        throw new Error("OpenAI embeddings API key cannot be blank");
+    const progress = createHumanCommandProgress(deps, "connect embeddings");
+    let stored;
+    let reload;
+    try {
+        stored = await runCommandProgressPhase(progress, "saving memory embeddings", () => storeRuntimeConfigKey({
+            agent,
+            key: "integrations.openaiEmbeddingsApiKey",
+            value: key,
+            scope: "agent",
+            deps,
+            onProgress: (message) => progress.updateDetail(message),
+        }), () => "secret stored");
+        reload = await runCommandProgressPhase(progress, `applying change to running ${agent}`, () => applyRuntimeChangeToRunningAgent(agent, deps, (message) => progress.updateDetail(message)), (result) => result);
+    }
+    finally {
+        progress.end();
+    }
+    const message = [
+        `Embeddings connected for ${agent}`,
+        "capability: memory embeddings",
+        `stored: ${stored.itemPath}`,
+        `running agent: ${reload}`,
+        "secret was not printed",
+        "",
+        "Next: ask the agent to search notes or memory.",
+    ].join("\n");
+    deps.writeStdout(message);
+    return message;
+}
+async function executeConnectTeams(agent, deps) {
+    if (agent === "SerpentGuide") {
+        throw new Error("SerpentGuide has no persistent runtime credentials. Connect Teams on the hatchling agent instead.");
+    }
+    const promptInput = requirePromptInput(deps, "Teams setup");
+    const promptSecret = requirePromptSecret(deps, "Teams client secret entry");
+    deps.writeStdout([
+        `Connect Teams for ${agent}`,
+        "This connects the Teams sense.",
+        "The client secret stays hidden while you type.",
+    ].join("\n"));
+    const clientId = (await promptInput("Teams client ID: ")).trim();
+    if (!clientId)
+        throw new Error("Teams client ID cannot be blank");
+    const clientSecret = (await promptSecret("Teams client secret: ")).trim();
+    if (!clientSecret)
+        throw new Error("Teams client secret cannot be blank");
+    const tenantId = (await promptInput("Teams tenant ID: ")).trim();
+    if (!tenantId)
+        throw new Error("Teams tenant ID cannot be blank");
+    const managedIdentityClientId = (await promptInput("Teams managed identity client ID [blank to skip]: ")).trim();
+    const progress = createHumanCommandProgress(deps, "connect teams");
+    let stored;
+    try {
+        stored = await runCommandProgressPhase(progress, "saving Teams setup", () => storeRuntimeConfigKeys({
+            agent,
+            entries: [
+                { key: "teams.clientId", value: clientId },
+                { key: "teams.clientSecret", value: clientSecret },
+                { key: "teams.tenantId", value: tenantId },
+                ...(managedIdentityClientId ? [{ key: "teams.managedIdentityClientId", value: managedIdentityClientId }] : []),
+            ],
+            scope: "agent",
+            deps,
+            onProgress: (message) => progress.updateDetail(message),
+        }), () => "secret stored");
+        progress.updateDetail("enabling Teams in agent.json");
+        enableAgentSense(agent, "teams", deps);
+    }
+    finally {
+        progress.end();
+    }
+    const message = appendBundleSyncSummary([
+        `Teams connected for ${agent}`,
+        "capability: Teams sense",
+        `stored: ${stored.itemPath}`,
+        "agent.json: senses.teams.enabled = true",
+        "secret was not printed",
+        "",
+        "Next: run `ouro up` so the daemon picks up the Teams sense change.",
+    ].join("\n"), agent, deps);
+    deps.writeStdout(message);
+    return message;
+}
 async function executeConnectBlueBubbles(agent, deps) {
     if (agent === "SerpentGuide") {
         throw new Error("SerpentGuide has no persistent runtime credentials. Attach BlueBubbles on the hatchling agent instead.");
@@ -1535,39 +1771,86 @@ async function executeConnectBlueBubbles(agent, deps) {
     deps.writeStdout(message);
     return message;
 }
+async function executeConnectProviders(agent, deps) {
+    const promptInput = deps.promptInput;
+    if (!promptInput) {
+        const message = [
+            `Provider auth for ${agent}`,
+            "Run one of:",
+            ...CONNECT_PROVIDER_CHOICES.map((provider) => `  ouro auth --agent ${agent} --provider ${provider}`),
+        ].join("\n");
+        deps.writeStdout(message);
+        return message;
+    }
+    const choice = (await promptInput([
+        `Which provider should ${agent} use credentials for?`,
+        ...CONNECT_PROVIDER_CHOICES.map((provider) => `  - ${provider}`),
+        "",
+        "Provider: ",
+    ].join("\n"))).trim().toLowerCase();
+    if (!(0, cli_parse_2.isAgentProvider)(choice)) {
+        throw new Error(`Unknown provider '${choice}'. Use ${CONNECT_PROVIDER_CHOICES.join("|")}.`);
+    }
+    return executeAuthRun({ kind: "auth.run", agent, provider: choice }, deps);
+}
+function machineRuntimeReadStatus(runtime) {
+    if (runtime.reason === "missing")
+        return "not attached";
+    if (/locked/i.test(runtime.error))
+        return "locked";
+    return "needs attention";
+}
+function connectMenuTarget(answer) {
+    const normalized = answer.trim().toLowerCase();
+    if (normalized === "1" || normalized === "providers" || normalized === "provider" || normalized === "auth")
+        return "providers";
+    if (normalized === "2" || normalized === "perplexity" || normalized === "perplexity-search" || normalized === "search")
+        return "perplexity";
+    if (normalized === "3" || normalized === "embeddings" || normalized === "embedding" || normalized === "memory" || normalized === "note-search" || normalized === "notes")
+        return "embeddings";
+    if (normalized === "4" || normalized === "teams" || normalized === "msteams" || normalized === "microsoft-teams")
+        return "teams";
+    if (normalized === "5" || normalized === "bluebubbles" || normalized === "imessage" || normalized === "messages")
+        return "bluebubbles";
+    return "cancel";
+}
 async function executeConnect(command, deps) {
+    if (command.target === "providers")
+        return executeConnectProviders(command.agent, deps);
     if (command.target === "perplexity")
         return executeConnectPerplexity(command.agent, deps);
+    if (command.target === "embeddings")
+        return executeConnectEmbeddings(command.agent, deps);
+    if (command.target === "teams")
+        return executeConnectTeams(command.agent, deps);
     if (command.target === "bluebubbles")
         return executeConnectBlueBubbles(command.agent, deps);
+    const menu = await buildConnectMenu(command.agent, deps);
     const promptInput = deps.promptInput;
     if (!promptInput) {
         const message = [
-            connectMenu(command.agent).replace(/\nChoose \[1-4\]: $/, ""),
+            menu.replace(/\nChoose \[1-6\] or type a name: $/, ""),
             "",
+            `Run: ouro connect providers --agent ${command.agent}`,
             `Run: ouro connect perplexity --agent ${command.agent}`,
-            `Or:  ouro connect bluebubbles --agent ${command.agent}`,
+            `Run: ouro connect embeddings --agent ${command.agent}`,
+            `Run: ouro connect teams --agent ${command.agent}`,
+            `Run: ouro connect bluebubbles --agent ${command.agent}`,
         ].join("\n");
         deps.writeStdout(message);
         return message;
     }
-    const answer = (await promptInput(connectMenu(command.agent))).trim().toLowerCase();
-    if (answer === "1" || answer === "perplexity" || answer === "perplexity-search") {
+    const answer = connectMenuTarget(await promptInput(menu));
+    if (answer === "providers")
+        return executeConnectProviders(command.agent, deps);
+    if (answer === "perplexity")
         return executeConnectPerplexity(command.agent, deps);
-    }
-    if (answer === "2" || answer === "bluebubbles" || answer === "imessage" || answer === "messages") {
+    if (answer === "embeddings")
+        return executeConnectEmbeddings(command.agent, deps);
+    if (answer === "teams")
+        return executeConnectTeams(command.agent, deps);
+    if (answer === "bluebubbles")
         return executeConnectBlueBubbles(command.agent, deps);
-    }
-    if (answer === "3" || answer === "provider" || answer === "providers" || answer === "auth") {
-        const message = [
-            "Provider auth is its own flow:",
-            `  ouro auth --agent ${command.agent} --provider <provider>`,
-            "",
-            "Use `ouro connect` for integrations and local senses after provider auth is ready.",
-        ].join("\n");
-        deps.writeStdout(message);
-        return message;
-    }
     const message = "connect cancelled.";
     deps.writeStdout(message);
     return message;
@@ -1896,13 +2179,9 @@ async function executeProviderRefresh(command, deps) {
         deps.writeStdout(message);
         return message;
     }
-    progress.startPhase(`reloading ${command.agent}`);
-    const reload = await reloadRunningAgentAfterCredentialChange(command.agent, deps);
-    progress.completePhase(`reloading ${command.agent}`, reload);
+    const reload = await runCommandProgressPhase(progress, `applying change to running ${command.agent}`, () => applyRuntimeChangeToRunningAgent(command.agent, deps, (message) => progress.updateDetail(message)), (result) => result);
     progress.end();
-    lines.push(reload === "daemon is not running; next `ouro up` will load it"
-        ? "daemon is not running; the next start will load the refreshed snapshot"
-        : reload);
+    lines.push(`running agent: ${reload}`);
     const message = lines.join("\n");
     deps.writeStdout(message);
     return message;

package/dist/heart/daemon/cli-help.js

@@ -165,10 +165,10 @@ exports.COMMAND_REGISTRY = {
     },
     connect: {
         category: "Auth",
-        description: "Connect integrations and local senses such as Perplexity search and BlueBubbles iMessage",
-        usage: "ouro connect [perplexity|bluebubbles] --agent <name>",
-        example: "ouro connect perplexity --agent ouroboros",
-        subcommands: ["perplexity", "bluebubbles"],
+        description: "Connect providers, portable integrations, and local senses from one guided bay",
+        usage: "ouro connect [providers|perplexity|embeddings|teams|bluebubbles] --agent <name>",
+        example: "ouro connect --agent ouroboros",
+        subcommands: ["providers", "perplexity", "embeddings", "teams", "bluebubbles"],
     },
     use: {
         category: "Auth",
@@ -277,6 +277,21 @@ const SUBCOMMAND_HELP = {
         usage: "ouro connect perplexity --agent <name>",
         example: "ouro connect perplexity --agent ouroboros",
     },
+    "connect providers": {
+        description: "Open provider auth from the connect bay without remembering the auth command",
+        usage: "ouro connect providers --agent <name>",
+        example: "ouro connect providers --agent ouroboros",
+    },
+    "connect embeddings": {
+        description: "Connect memory embeddings for this agent",
+        usage: "ouro connect embeddings --agent <name>",
+        example: "ouro connect embeddings --agent ouroboros",
+    },
+    "connect teams": {
+        description: "Connect Microsoft Teams credentials and enable the Teams sense",
+        usage: "ouro connect teams --agent <name>",
+        example: "ouro connect teams --agent ouroboros",
+    },
     "connect bluebubbles": {
         description: "Attach BlueBubbles iMessage to this machine only",
         usage: "ouro connect bluebubbles --agent <name>",

package/dist/heart/daemon/cli-parse.js

@@ -83,7 +83,7 @@ function usage() {
         "  ouro config model --agent <name> <model-name>",
         "  ouro config models --agent <name>",
         "  ouro auth --agent <name> [--provider <provider>]",
-        "  ouro connect [perplexity|bluebubbles] --agent <name>",
+        "  ouro connect [providers|perplexity|embeddings|teams|bluebubbles] --agent <name>",
         "  ouro auth verify --agent <name> [--provider <provider>]",
         "  ouro auth switch --agent <name> --provider <provider>",
         "  ouro vault create --agent <name> --email <email> [--server <url>] [--store <store>]",
@@ -588,18 +588,24 @@ function parseVaultConfigCommand(args) {
 function normalizeConnectTarget(value) {
     if (!value)
         return undefined;
+    if (value === "providers" || value === "provider" || value === "auth")
+        return "providers";
     if (value === "perplexity" || value === "perplexity-search")
         return "perplexity";
+    if (value === "embeddings" || value === "embedding" || value === "memory" || value === "note-search" || value === "notes")
+        return "embeddings";
+    if (value === "teams" || value === "msteams" || value === "microsoft-teams")
+        return "teams";
     if (value === "bluebubbles" || value === "imessage" || value === "messages")
         return "bluebubbles";
-    throw new Error("Usage: ouro connect [perplexity|bluebubbles] --agent <name>");
+    throw new Error("Usage: ouro connect [providers|perplexity|embeddings|teams|bluebubbles] --agent <name>");
 }
 function parseConnectCommand(args) {
     const { agent, rest } = extractAgentFlag(args);
     if (!agent)
-        throw new Error("Usage: ouro connect --agent <name> [perplexity|bluebubbles]");
+        throw new Error("Usage: ouro connect --agent <name> [providers|perplexity|embeddings|teams|bluebubbles]");
     if (rest.length > 1)
-        throw new Error("Usage: ouro connect [perplexity|bluebubbles] --agent <name>");
+        throw new Error("Usage: ouro connect [providers|perplexity|embeddings|teams|bluebubbles] --agent <name>");
     const target = normalizeConnectTarget(rest[0]);
     return { kind: "connect", agent, ...(target ? { target } : {}) };
 }

package/dist/heart/daemon/up-progress.js

@@ -20,6 +20,7 @@ const RESET = "\x1b[0m";
 const BOLD = "\x1b[1m";
 const DIM = "\x1b[2m";
 const GREEN = "\x1b[38;2;46;204;64m";
+const RED = "\x1b[38;2;255;106;106m";
 // ── UpProgress class ──
 class UpProgress {
     write;
@@ -109,7 +110,7 @@ class UpProgress {
             return;
         }
         const elapsedMs = this.now() - this.currentPhase.startedAt;
-        this.completed.push({ label, detail });
+        this.completed.push({ status: "success", label, detail });
         this.currentPhase = null;
         this.currentDetail = null;
         this.stopAutoRender();
@@ -137,6 +138,41 @@ class UpProgress {
             this.write(`  \u2713 ${label}${detailStr}\n`);
         }
     }
+    failPhase(label, detail) {
+        if (!this.currentPhase) {
+            return;
+        }
+        const elapsedMs = this.now() - this.currentPhase.startedAt;
+        this.completed.push({ status: "failure", label, detail });
+        this.currentPhase = null;
+        this.currentDetail = null;
+        this.stopAutoRender();
+        if (this.eventScope === "command") {
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "daemon",
+                event: "daemon.cli_progress_phase_failed",
+                message: `phase failed: ${label}`,
+                meta: { command: this.commandName, phase: label, detail: detail ?? null, elapsedMs },
+            });
+        }
+        else {
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "daemon",
+                event: "daemon.up_phase_failed",
+                message: `phase failed: ${label}`,
+                meta: { phase: label, detail: detail ?? null, elapsedMs },
+            });
+        }
+        if (this.isTTY) {
+            this.flushRender();
+        }
+        else {
+            const detailStr = detail ? ` \u2014 ${detail}` : "";
+            this.write(`  \u2717 ${label}${detailStr}\n`);
+        }
+    }
     /**
      * Build an ANSI string for in-place terminal display. Returns empty
      * string in non-TTY mode (output is written eagerly in completePhase).
@@ -149,7 +185,12 @@ class UpProgress {
         // Completed phases
         for (const phase of this.completed) {
             const detailStr = phase.detail ? ` ${DIM}\u2014 ${phase.detail}${RESET}` : "";
-            lines.push(`  ${GREEN}\u2713${RESET} ${phase.label}${detailStr}`);
+            if (phase.status === "failure") {
+                lines.push(`  ${RED}\u2717${RESET} ${phase.label}${detailStr}`);
+            }
+            else {
+                lines.push(`  ${GREEN}\u2713${RESET} ${phase.label}${detailStr}`);
+            }
         }
         // Current phase with spinner
         if (this.currentPhase) {

package/dist/heart/provider-credentials.js

@@ -340,7 +340,9 @@ async function upsertProviderCredential(input) {
         notes: "Ouro provider credentials. The vault item password is a versioned JSON payload.",
     });
     input.onProgress?.(`refreshing local provider snapshot from ${input.agentName}'s vault...`);
-    const refreshResult = await refreshProviderCredentialPool(input.agentName);
+    const refreshResult = await refreshProviderCredentialPool(input.agentName, {
+        onProgress: input.onProgress,
+    });
     if (!refreshResult.ok) {
         throw new Error(`credential stored in vault, but the local provider snapshot could not be refreshed: ${refreshResult.error}. ` +
             `Run 'ouro provider refresh --agent ${input.agentName}' after fixing vault access, then run 'ouro auth verify --agent ${input.agentName}'.`);

package/dist/mind/prompt.js

@@ -451,8 +451,8 @@ function senseRuntimeGuidance(channel, preReadStatusLines) {
     lines.push("- running = enabled and currently active");
     lines.push("- error = enabled but unhealthy");
     lines.push("If asked how to enable another sense, I explain the relevant agent.json senses entry and required agent-vault runtime/config fields instead of guessing.");
-    lines.push("teams setup truth: enable `senses.teams.enabled`, then store `teams.clientId`, `teams.clientSecret`, and `teams.tenantId` in the agent vault runtime/config item.");
-    lines.push("bluebubbles setup truth: run `ouro connect bluebubbles --agent <agent>`; it stores this machine's BlueBubbles URL/password/listener config in the agent vault machine runtime item.");
+    lines.push("teams setup truth: run `ouro connect teams --agent <agent>` from the connect bay; it stores Teams runtime/config fields and enables `senses.teams.enabled`.");
+    lines.push("bluebubbles setup truth: run `ouro connect bluebubbles --agent <agent>` from the connect bay; it stores this machine's BlueBubbles URL/password/listener config in the agent vault machine runtime item.");
     if (channel === "cli") {
         lines.push("cli is interactive: it is available when the user opens it, not something `ouro up` daemonizes.");
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.421",
+  "version": "0.1.0-alpha.423",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",