@ouro.bot/cli 0.1.0-alpha.43 → 0.1.0-alpha.430

package/dist/heart/{daemon → hatch}/hatch-flow.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.writeSecretsFile = writeSecretsFile;
+exports.storeHatchlingProviderCredentials = storeHatchlingProviderCredentials;
 exports.runHatchFlow = runHatchFlow;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
@@ -41,15 +41,15 @@ const path = __importStar(require("path"));
 const identity_1 = require("../identity");
 const config_1 = require("../config");
 const runtime_1 = require("../../nerves/runtime");
+const auth_flow_1 = require("../auth/auth-flow");
+const provider_models_1 = require("../provider-models");
+const habit_parser_1 = require("../habits/habit-parser");
+const machine_identity_1 = require("../machine-identity");
+const provider_credentials_1 = require("../provider-credentials");
+const provider_state_1 = require("../provider-state");
 const hatch_specialist_1 = require("./hatch-specialist");
 function requiredCredentialKeys(provider) {
-    if (provider === "anthropic")
-        return ["setupToken"];
-    if (provider === "openai-codex")
-        return ["oauthAccessToken"];
-    if (provider === "minimax")
-        return ["apiKey"];
-    return ["apiKey", "endpoint", "deployment"];
+    return identity_1.PROVIDER_CREDENTIALS[provider].required;
 }
 function validateCredentials(provider, credentials) {
     const missing = requiredCredentialKeys(provider).filter((key) => {
@@ -67,70 +67,8 @@ function validateCredentials(provider, credentials) {
         throw new Error(`Missing required credentials for ${provider}: ${missing.join(", ")}`);
     }
 }
-function buildSecretsTemplate() {
-    return {
-        providers: {
-            azure: {
-                modelName: "gpt-4o-mini",
-                apiKey: "",
-                endpoint: "",
-                deployment: "",
-                apiVersion: "2025-04-01-preview",
-            },
-            minimax: {
-                model: "minimax-text-01",
-                apiKey: "",
-            },
-            anthropic: {
-                model: "claude-opus-4-6",
-                setupToken: "",
-            },
-            "openai-codex": {
-                model: "gpt-5.4",
-                oauthAccessToken: "",
-            },
-        },
-        teams: {
-            clientId: "",
-            clientSecret: "",
-            tenantId: "",
-        },
-        oauth: {
-            graphConnectionName: "graph",
-            adoConnectionName: "ado",
-            githubConnectionName: "",
-        },
-        teamsChannel: {
-            skipConfirmation: true,
-            port: 3978,
-        },
-        integrations: {
-            perplexityApiKey: "",
-            openaiEmbeddingsApiKey: "",
-        },
-    };
-}
-function writeSecretsFile(agentName, provider, credentials, secretsRoot) {
-    const secrets = buildSecretsTemplate();
-    if (provider === "anthropic") {
-        secrets.providers.anthropic.setupToken = credentials.setupToken.trim();
-    }
-    else if (provider === "openai-codex") {
-        secrets.providers["openai-codex"].oauthAccessToken = credentials.oauthAccessToken.trim();
-    }
-    else if (provider === "minimax") {
-        secrets.providers.minimax.apiKey = credentials.apiKey.trim();
-    }
-    else {
-        secrets.providers.azure.apiKey = credentials.apiKey.trim();
-        secrets.providers.azure.endpoint = credentials.endpoint.trim();
-        secrets.providers.azure.deployment = credentials.deployment.trim();
-    }
-    const secretsDir = path.join(secretsRoot, agentName);
-    fs.mkdirSync(secretsDir, { recursive: true });
-    const secretsPath = path.join(secretsDir, "secrets.json");
-    fs.writeFileSync(secretsPath, `${JSON.stringify(secrets, null, 2)}\n`, "utf-8");
-    return secretsPath;
+async function storeHatchlingProviderCredentials(agentName, provider, credentials) {
+    return (await (0, auth_flow_1.storeProviderCredentials)(agentName, provider, credentials)).credentialPath;
 }
 function writeReadme(dir, purpose) {
     fs.mkdirSync(dir, { recursive: true });
@@ -139,36 +77,16 @@ function writeReadme(dir, purpose) {
         fs.writeFileSync(readmePath, `# ${path.basename(dir)}\n\n${purpose}\n`, "utf-8");
     }
 }
-function pad(value) {
-    return String(value).padStart(2, "0");
-}
-function formatTaskStem(now) {
-    return `${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())}-${pad(now.getHours())}${pad(now.getMinutes())}`;
-}
-function writeHeartbeatTask(bundleRoot, now) {
-    const habitsDir = path.join(bundleRoot, "tasks", "habits");
+function writeHeartbeatHabit(bundleRoot, now) {
+    const habitsDir = path.join(bundleRoot, "habits");
     fs.mkdirSync(habitsDir, { recursive: true });
-    const stem = formatTaskStem(now);
-    const filePath = path.join(habitsDir, `${stem}-heartbeat.md`);
-    const iso = now.toISOString();
-    const content = [
-        "---",
-        "type: habit",
-        "category: runtime",
-        "title: Heartbeat check-in",
-        "status: processing",
-        `created: ${iso}`,
-        `updated: ${iso}`,
-        "requester: system",
-        "validator: null",
-        "cadence: \"30m\"",
-        "scheduledAt: null",
-        "lastRun: null",
-        "---",
-        "",
-        "Run a lightweight heartbeat cycle. Review task board and inbox.",
-        "",
-    ].join("\n");
+    const filePath = path.join(habitsDir, "heartbeat.md");
+    const content = (0, habit_parser_1.renderHabitFile)({
+        title: "Heartbeat check-in",
+        cadence: "30m",
+        status: "active",
+        created: now.toISOString(),
+    }, "Run a lightweight heartbeat cycle. Review task board and inbox.\nCheck on pending obligations. Journal anything important.");
     fs.writeFileSync(filePath, content, "utf-8");
 }
 function writeFriendImprint(bundleRoot, humanName, now) {
@@ -176,7 +94,7 @@ function writeFriendImprint(bundleRoot, humanName, now) {
     fs.mkdirSync(friendsDir, { recursive: true });
     const nowIso = now.toISOString();
     const id = `friend-${(0, config_1.slugify)(humanName) || "friend"}`;
-    const localExternalId = `${os.userInfo().username}@${os.hostname()}`;
+    const localExternalId = os.userInfo().username;
     const record = {
         id,
         name: humanName,
@@ -200,19 +118,38 @@ function writeFriendImprint(bundleRoot, humanName, now) {
     };
     fs.writeFileSync(path.join(friendsDir, `${id}.json`), `${JSON.stringify(record, null, 2)}\n`, "utf-8");
 }
-function writeMemoryScaffold(bundleRoot) {
-    const memoryRoot = path.join(bundleRoot, "psyche", "memory");
-    fs.mkdirSync(path.join(memoryRoot, "daily"), { recursive: true });
-    fs.mkdirSync(path.join(memoryRoot, "archive"), { recursive: true });
-    fs.writeFileSync(path.join(memoryRoot, "facts.jsonl"), "", "utf-8");
-    fs.writeFileSync(path.join(memoryRoot, "entities.json"), "{}\n", "utf-8");
+function writeDiaryScaffold(bundleRoot) {
+    const diaryRoot = path.join(bundleRoot, "diary");
+    fs.mkdirSync(path.join(diaryRoot, "daily"), { recursive: true });
+    fs.mkdirSync(path.join(diaryRoot, "archive"), { recursive: true });
+    fs.writeFileSync(path.join(diaryRoot, "facts.jsonl"), "", "utf-8");
+    fs.writeFileSync(path.join(diaryRoot, "entities.json"), "{}\n", "utf-8");
 }
 function writeHatchlingAgentConfig(bundleRoot, input) {
     const template = (0, identity_1.buildDefaultAgentTemplate)(input.agentName);
+    const model = (0, provider_models_1.getDefaultModelForProvider)(input.provider);
     template.provider = input.provider;
+    template.humanFacing = { provider: input.provider, model };
+    template.agentFacing = { provider: input.provider, model };
     template.enabled = true;
     fs.writeFileSync(path.join(bundleRoot, "agent.json"), `${JSON.stringify(template, null, 2)}\n`, "utf-8");
 }
+function writeHatchlingProviderState(bundleRoot, input, now) {
+    const model = (0, provider_models_1.getDefaultModelForProvider)(input.provider);
+    const machine = (0, machine_identity_1.loadOrCreateMachineIdentity)({
+        homeDir: (0, provider_credentials_1.providerCredentialMachineHomeDir)(),
+        now: () => now,
+    });
+    const state = (0, provider_state_1.bootstrapProviderStateFromAgentConfig)({
+        machineId: machine.machineId,
+        now,
+        agentConfig: {
+            humanFacing: { provider: input.provider, model },
+            agentFacing: { provider: input.provider, model },
+        },
+    });
+    (0, provider_state_1.writeProviderState)(bundleRoot, state);
+}
 async function runHatchFlow(input, deps = {}) {
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
@@ -222,7 +159,6 @@ async function runHatchFlow(input, deps = {}) {
     });
     validateCredentials(input.provider, input.credentials);
     const bundlesRoot = deps.bundlesRoot ?? path.join(os.homedir(), "AgentBundles");
-    const secretsRoot = deps.secretsRoot ?? path.join(os.homedir(), ".agentsecrets");
     const sourceIdentities = deps.specialistIdentitySourceDir ?? (0, hatch_specialist_1.getSpecialistIdentitySourceDir)();
     const targetIdentities = deps.specialistIdentityTargetDir ?? (0, hatch_specialist_1.getRepoSpecialistIdentitiesDir)();
     const now = deps.now ? deps.now() : new Date();
@@ -235,25 +171,25 @@ async function runHatchFlow(input, deps = {}) {
         identitiesDir: targetIdentities,
         random,
     });
-    const specialistSecretsPath = writeSecretsFile("AdoptionSpecialist", input.provider, input.credentials, secretsRoot);
-    const hatchlingSecretsPath = writeSecretsFile(input.agentName, input.provider, input.credentials, secretsRoot);
     const bundleRoot = path.join(bundlesRoot, `${input.agentName}.ouro`);
     fs.mkdirSync(bundleRoot, { recursive: true });
     writeReadme(bundleRoot, "Root of this agent bundle.");
     writeReadme(path.join(bundleRoot, "psyche"), "Identity and behavior files.");
-    writeReadme(path.join(bundleRoot, "psyche", "memory"), "Persistent memory store.");
+    writeReadme(path.join(bundleRoot, "diary"), "Persistent diary -- things I have learned and chosen to keep.");
     writeReadme(path.join(bundleRoot, "friends"), "Known friend records.");
     writeReadme(path.join(bundleRoot, "tasks"), "Task files.");
-    writeReadme(path.join(bundleRoot, "tasks", "habits"), "Recurring tasks.");
     writeReadme(path.join(bundleRoot, "tasks", "one-shots"), "One-shot tasks.");
     writeReadme(path.join(bundleRoot, "tasks", "ongoing"), "Ongoing tasks.");
+    writeReadme(path.join(bundleRoot, "habits"), "Recurring habits and autonomous rhythms.");
     writeReadme(path.join(bundleRoot, "skills"), "Local skill files.");
     writeReadme(path.join(bundleRoot, "senses"), "Sense-specific config.");
     writeReadme(path.join(bundleRoot, "senses", "teams"), "Teams sense config.");
     writeHatchlingAgentConfig(bundleRoot, input);
-    writeMemoryScaffold(bundleRoot);
+    const credentialPath = await storeHatchlingProviderCredentials(input.agentName, input.provider, input.credentials);
+    writeHatchlingProviderState(bundleRoot, input, now);
+    writeDiaryScaffold(bundleRoot);
     writeFriendImprint(bundleRoot, input.humanName, now);
-    writeHeartbeatTask(bundleRoot, now);
+    writeHeartbeatHabit(bundleRoot, now);
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
         event: "daemon.hatch_flow_end",
@@ -263,7 +199,6 @@ async function runHatchFlow(input, deps = {}) {
     return {
         bundleRoot,
         selectedIdentity: selected.fileName,
-        specialistSecretsPath,
-        hatchlingSecretsPath,
+        credentialPath,
     };
 }

package/dist/heart/{daemon → hatch}/hatch-specialist.js

@@ -43,14 +43,14 @@ const path = __importStar(require("path"));
 const runtime_1 = require("../../nerves/runtime");
 function getSpecialistIdentitySourceDir() {
     // Prefer ~/AgentBundles/ if it exists (user may have customized identities)
-    const userSource = path.join(os.homedir(), "AgentBundles", "AdoptionSpecialist.ouro", "psyche", "identities");
+    const userSource = path.join(os.homedir(), "AgentBundles", "SerpentGuide.ouro", "psyche", "identities");
     if (fs.existsSync(userSource))
         return userSource;
     // Fall back to the bundled copy shipped with the npm package
-    return path.join(__dirname, "..", "..", "..", "AdoptionSpecialist.ouro", "psyche", "identities");
+    return path.join(__dirname, "..", "..", "..", "SerpentGuide.ouro", "psyche", "identities");
 }
 function getRepoSpecialistIdentitiesDir() {
-    return path.join(process.cwd(), "AdoptionSpecialist.ouro", "psyche", "identities");
+    return path.join(process.cwd(), "SerpentGuide.ouro", "psyche", "identities");
 }
 function listMarkdownIdentityFiles(dir) {
     let entries;

package/dist/heart/{daemon → hatch}/specialist-prompt.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildSpecialistSystemPrompt = buildSpecialistSystemPrompt;
 const runtime_1 = require("../../nerves/runtime");
 /**
- * Build the adoption specialist's system prompt from its components.
+ * Build the serpent guide's system prompt from its components.
  * The prompt is written in first person (the specialist's own voice).
  */
 function buildSpecialistSystemPrompt(soulText, identityText, existingBundles, context) {
@@ -31,7 +31,7 @@ function buildSpecialistSystemPrompt(soulText, identityText, existingBundles, co
         "I am one of thirteen serpent guides who help humans hatch their first agent. The system randomly selected me for this session.",
         "Most humans only go through this process once, so this is likely the only time they'll meet me.",
         "I make this encounter count — warm, memorable, and uniquely mine.",
-        "IMPORTANT: I NEVER refer to myself as an 'adoption specialist' or use the words 'adoption specialist' — those are internal implementation labels, not something the human should ever see. I introduce myself by my own name from my identity.",
+        "IMPORTANT: I NEVER refer to myself by internal implementation labels — I introduce myself by my own name from my identity.",
         "",
         "## Voice rules",
         "IMPORTANT: I keep every response to 1-3 short sentences. I sound like a friend texting, not a manual.",
@@ -44,7 +44,7 @@ function buildSpecialistSystemPrompt(soulText, identityText, existingBundles, co
         `Provider: ${context.provider}`,
         `Temp directory: ${context.tempDir}`,
         "Final home: ~/AgentBundles/<Name>.ouro/",
-        "Secrets: ~/.agentsecrets/<name>/secrets.json",
+        "Provider credentials: the hatch tool stores them in the agent's vault.",
     ].join("\n"));
     sections.push([
         "## Bundle creation guidelines",
@@ -59,8 +59,10 @@ function buildSpecialistSystemPrompt(soulText, identityText, existingBundles, co
         "It also needs an **agent.json** with at minimum:",
         '```json',
         '{',
+        '  "version": 2,',
         '  "name": "AgentName",',
-        `  "provider": "${context.provider}",`,
+        `  "humanFacing": { "provider": "${context.provider}", "model": "${context.model}" },`,
+        `  "agentFacing": { "provider": "${context.provider}", "model": "${context.model}" },`,
         '  "enabled": true',
         '}',
         '```',
@@ -82,18 +84,19 @@ function buildSpecialistSystemPrompt(soulText, identityText, existingBundles, co
         "2. I write agent.json to the temp directory using write_file",
         "3. I suggest a PascalCase name for the hatchling and confirm with the human",
         "4. I call complete_adoption with the name and a warm handoff message",
-        "5. I call final_answer to end the session",
+        "5. I call settle to end the session",
     ].join("\n"));
     sections.push([
         "## Tools",
         "- `write_file`: Write a file to disk. Use this to write psyche files and agent.json to the temp directory.",
         "- `read_file`: Read a file from disk. Useful for reviewing existing agent bundles or migration sources.",
         "- `list_directory`: List directory contents. Useful for exploring existing agent bundles.",
-        "- I also have the normal local harness tools when useful here, including `shell`, `ouro task create`, `ouro reminder create`, memory tools, coding tools, and repo helpers.",
-        "- `complete_adoption`: Finalize the bundle. Validates, scaffolds structural dirs, moves to ~/AgentBundles/, writes secrets, plays hatch animation. I call this with `name` (PascalCase) and `handoff_message` (warm message for the human).",
-        "- `final_answer`: End the conversation with a final message. I call this after complete_adoption succeeds.",
+        "- I also have the normal local harness tools when useful here, including `shell`, `ouro task create`, `ouro reminder create`, note tools, coding tools, and repo helpers.",
+        "- `complete_adoption`: Finalize the bundle. Validates, asks the harness to collect and confirm the hatchling vault unlock secret through hidden terminal prompts, scaffolds structural dirs, moves to ~/AgentBundles/, writes secrets, plays hatch animation. I call this with `name` (PascalCase) and `handoff_message` (warm message for the human).",
+        "- The complete_adoption tool triggers hidden terminal prompts for the hatchling vault unlock secret. I must never ask the human to type the vault unlock secret into chat, and I must never include it in tool arguments.",
+        "- `settle`: End the conversation with a final message. I call this after complete_adoption succeeds.",
         "",
-        "I must call `final_answer` when I am done to end the session cleanly.",
+        "I must call `settle` when I am done to end the session cleanly.",
     ].join("\n"));
     return sections.join("\n\n");
 }

package/dist/heart/{daemon → hatch}/specialist-tools.js

@@ -35,19 +35,21 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getSpecialistTools = getSpecialistTools;
 exports.createSpecialistExecTool = createSpecialistExecTool;
-const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const tools_base_1 = require("../../repertoire/tools-base");
 const hatch_flow_1 = require("./hatch-flow");
 const hatch_animation_1 = require("./hatch-animation");
 const bundle_manifest_1 = require("../../mind/bundle-manifest");
+const identity_1 = require("../identity");
 const runtime_1 = require("../../nerves/runtime");
+const vault_setup_1 = require("../../repertoire/vault-setup");
+const vault_unlock_1 = require("../../repertoire/vault-unlock");
 const completeAdoptionTool = {
     type: "function",
     function: {
         name: "complete_adoption",
-        description: "finalize the agent bundle and hatch the new agent. call this only when you have written all 5 psyche files and agent.json to the temp directory, and the human has approved the bundle.",
+        description: "finalize the agent bundle and hatch the new agent. call this only when you have written all 5 psyche files and agent.json to the temp directory, and the human has approved the bundle. tool execution asks the human for the hatchling vault unlock secret through a hidden terminal prompt; do not ask for or include vault unlock secrets in chat or tool args.",
         parameters: {
             type: "object",
             properties: {
@@ -90,7 +92,7 @@ const listDirToolSchema = {
  * Returns the specialist's tool schema array.
  */
 function getSpecialistTools() {
-    return [completeAdoptionTool, tools_base_1.finalAnswerTool, readFileTool.tool, writeFileTool.tool, listDirToolSchema];
+    return [completeAdoptionTool, tools_base_1.settleTool, readFileTool.tool, writeFileTool.tool, listDirToolSchema];
 }
 const PSYCHE_FILES = ["SOUL.md", "IDENTITY.md", "LORE.md", "TACIT.md", "ASPIRATIONS.md"];
 function isPascalCase(name) {
@@ -105,21 +107,21 @@ function writeReadme(dir, purpose) {
     }
 }
 function scaffoldBundle(bundleRoot) {
-    writeReadme(path.join(bundleRoot, "memory"), "Persistent memory store.");
-    writeReadme(path.join(bundleRoot, "memory", "daily"), "Daily memory entries.");
-    writeReadme(path.join(bundleRoot, "memory", "archive"), "Archived memory.");
+    writeReadme(path.join(bundleRoot, "notes"), "Persistent notes store.");
+    writeReadme(path.join(bundleRoot, "notes", "daily"), "Daily note entries.");
+    writeReadme(path.join(bundleRoot, "notes", "archive"), "Archived notes.");
     writeReadme(path.join(bundleRoot, "friends"), "Known friend records.");
     writeReadme(path.join(bundleRoot, "tasks"), "Task files.");
-    writeReadme(path.join(bundleRoot, "tasks", "habits"), "Recurring tasks.");
     writeReadme(path.join(bundleRoot, "tasks", "one-shots"), "One-shot tasks.");
+    writeReadme(path.join(bundleRoot, "habits"), "Recurring habits and autonomous rhythms.");
     writeReadme(path.join(bundleRoot, "tasks", "ongoing"), "Ongoing tasks.");
     writeReadme(path.join(bundleRoot, "skills"), "Local skill files.");
     writeReadme(path.join(bundleRoot, "senses"), "Sense-specific config.");
     writeReadme(path.join(bundleRoot, "senses", "teams"), "Teams sense config.");
-    // Memory scaffold files
-    const memoryRoot = path.join(bundleRoot, "memory");
-    const factsPath = path.join(memoryRoot, "facts.jsonl");
-    const entitiesPath = path.join(memoryRoot, "entities.json");
+    // Notes scaffold files
+    const notesRoot = path.join(bundleRoot, "notes");
+    const factsPath = path.join(notesRoot, "facts.jsonl");
+    const entitiesPath = path.join(notesRoot, "entities.json");
     /* v8 ignore next -- defensive: guard against re-scaffold on existing bundle @preserve */
     if (!fs.existsSync(factsPath))
         fs.writeFileSync(factsPath, "", "utf-8");
@@ -166,13 +168,34 @@ async function execCompleteAdoption(args, deps) {
     if (fs.existsSync(targetBundle)) {
         return `error: bundle '${name}.ouro' already exists at ${deps.bundlesRoot}. choose a different name.`;
     }
+    if (!deps.promptSecret) {
+        return "error: complete_adoption requires an interactive vault unlock secret prompt. Re-run `ouro hatch` in a terminal so the human can enter a hatchling vault unlock secret without echoing it.";
+    }
+    const vault = (0, identity_1.resolveVaultConfig)(name);
+    let vaultUnlockSecret;
+    try {
+        vaultUnlockSecret = await (0, vault_unlock_1.promptConfirmedVaultUnlockSecret)({
+            promptSecret: deps.promptSecret,
+            question: `Choose Ouro vault unlock secret for ${vault.email}: `,
+            confirmQuestion: `Confirm Ouro vault unlock secret for ${vault.email}: `,
+            emptyError: "hatchling vault creation requires an unlock secret. Re-run `ouro hatch` in an interactive terminal and enter a human-chosen unlock secret.",
+        });
+    }
+    catch (error) {
+        return `error: failed to read hatchling vault unlock secret: ${error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error)}`;
+    }
     // Scaffold structural dirs into tempDir
     scaffoldBundle(deps.tempDir);
     // Move tempDir -> final bundle location
     moveDir(deps.tempDir, targetBundle);
     // Write secrets
     try {
-        (0, hatch_flow_1.writeSecretsFile)(name, deps.provider, deps.credentials, deps.secretsRoot);
+        const vaultResult = await (0, vault_setup_1.createVaultAccount)(name, vault.serverUrl, vault.email, vaultUnlockSecret);
+        if (!vaultResult.success) {
+            throw new Error(`failed to create vault: ${vaultResult.error}`);
+        }
+        (0, vault_unlock_1.storeVaultUnlockSecret)({ agentName: name, email: vault.email, serverUrl: vault.serverUrl }, vaultUnlockSecret);
+        await (0, hatch_flow_1.storeHatchlingProviderCredentials)(name, deps.provider, deps.credentials);
     }
     catch (e) {
         // Rollback: remove the moved bundle