@ouro.bot/cli 0.1.0-alpha.431 → 0.1.0-alpha.433

package/dist/heart/daemon/cli-exec.js

@@ -76,6 +76,7 @@ const provider_state_1 = require("../provider-state");
 const machine_identity_1 = require("../machine-identity");
 const provider_models_1 = require("../provider-models");
 const ouro_version_manager_1 = require("../versioning/ouro-version-manager");
+const update_checker_1 = require("../versioning/update-checker");
 const sync_1 = require("../sync");
 const cli_parse_1 = require("./cli-parse");
 const cli_parse_2 = require("./cli-parse");
@@ -104,6 +105,55 @@ const DEFAULT_DAEMON_STARTUP_POLL_INTERVAL_MS = 500;
 const DEFAULT_DAEMON_STARTUP_STABILITY_WINDOW_MS = 1_500;
 const DEFAULT_DAEMON_STARTUP_RETRY_LIMIT = 1;
 const DEFAULT_DAEMON_STARTUP_LOG_LINES = 10;
+function summarizeCliUpdateCheckStatus(error, timedOut = false) {
+    const normalized = error.trim().toLowerCase();
+    if (timedOut || normalized.includes("timed out") || normalized.includes("abort")) {
+        return "skipped; registry did not answer";
+    }
+    if (normalized.includes("registry unavailable")) {
+        return "skipped; registry unavailable";
+    }
+    if (normalized.includes("network") ||
+        normalized.includes("fetch failed") ||
+        normalized.includes("enotfound") ||
+        normalized.includes("eai_again") ||
+        normalized.includes("econnreset")) {
+        return "skipped; registry unavailable";
+    }
+    return "skipped; update check unavailable";
+}
+async function runCliUpdateCheckWithTimeout(checkForCliUpdate, timeoutMs = update_checker_1.CLI_UPDATE_CHECK_TIMEOUT_MS) {
+    return await new Promise((resolve, reject) => {
+        let settled = false;
+        const timeoutId = setTimeout(() => {
+            settled = true;
+            resolve({
+                timedOut: true,
+                result: {
+                    available: false,
+                    error: `update check timed out after ${Math.max(1, Math.round(timeoutMs / 1000))}s`,
+                },
+            });
+        }, timeoutMs);
+        /* v8 ignore start -- Promise-settlement wiring is exercised by command tests; v8 misses these callback lines @preserve */
+        void checkForCliUpdate()
+            .then((result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timeoutId);
+            resolve({ result, timedOut: false });
+        })
+            .catch((error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timeoutId);
+            reject(error);
+        });
+        /* v8 ignore stop */
+    });
+}
 async function checkAgentProviders(deps, agentsOverride, onProgress) {
     const agents = agentsOverride ?? await listCliAgents(deps);
     const bundlesRoot = deps.bundlesRoot ?? (0, identity_1.getAgentBundlesRoot)();
@@ -376,15 +426,14 @@ function ttyBoardEnabled(deps) {
     return deps.isTTY ?? process.stdout.isTTY === true;
 }
 function renderCommandBoard(deps, options) {
-    return (0, terminal_ui_1.renderTerminalBoard)({
-        isTTY: true,
-        columns: deps.stdoutColumns ?? process.stdout.columns,
-        masthead: {
-            subtitle: options.subtitle,
-        },
+    return (0, human_command_screens_1.renderHumanCommandBoard)({
         title: options.title,
+        subtitle: options.subtitle,
         summary: options.summary,
+        isTTY: true,
+        columns: deps.stdoutColumns ?? process.stdout.columns,
         sections: options.sections,
+        actions: options.actions,
     }).trimEnd();
 }
 function writeConnectorIntro(deps, options) {
@@ -398,6 +447,57 @@ function writeConnectorIntro(deps, options) {
         : options.fallbackLines.join("\n");
     deps.writeStdout(text);
 }
+function formatLocalUnlockStoreLine(store) {
+    return `local unlock store: ${store.kind}${store.secure ? "" : " (explicit plaintext fallback)"}`;
+}
+function writeCommandOutcome(deps, options) {
+    const message = ttyBoardEnabled(deps)
+        ? renderCommandBoard(deps, {
+            title: options.title,
+            subtitle: options.subtitle,
+            summary: options.summary,
+            sections: options.sections,
+        })
+        : options.fallbackLines.join("\n");
+    deps.writeStdout(message);
+    return message;
+}
+function writeCapabilityOutcome(deps, options) {
+    return writeCommandOutcome(deps, {
+        title: "Capability connected",
+        subtitle: options.subtitle,
+        summary: options.summary,
+        sections: [
+            {
+                title: "What changed",
+                lines: options.whatChanged,
+            },
+            {
+                title: "Next moves",
+                lines: options.nextMoves,
+            },
+        ],
+        fallbackLines: options.fallbackLines,
+    });
+}
+function writeCapabilityAttention(deps, options) {
+    return writeCommandOutcome(deps, {
+        title: "Capability needs attention",
+        subtitle: options.subtitle,
+        summary: options.summary,
+        sections: [
+            {
+                title: "What changed",
+                lines: options.whatChanged,
+            },
+            {
+                title: "Next moves",
+                lines: options.nextMoves,
+            },
+        ],
+        fallbackLines: options.fallbackLines,
+    });
+}
 async function promptForNamedAgent(title, subtitle, agents, deps) {
     if (!deps.promptInput)
         throw new Error("agent selection requires interactive input");
@@ -906,10 +1006,6 @@ function pushAgentBundleAfterCliMutation(agent, deps) {
     }
     return `bundle sync: could not push bundle changes (${result.error})`;
 }
-function appendBundleSyncSummary(message, agent, deps) {
-    const syncSummary = pushAgentBundleAfterCliMutation(agent, deps);
-    return syncSummary ? `${message}\n${syncSummary}` : message;
-}
 function writeAgentVaultConfig(agentName, configPath, config, vault) {
     const nextConfig = {
         ...config,
@@ -1094,13 +1190,34 @@ async function executeVaultUnlock(command, deps) {
     finally {
         progress.end();
     }
-    const message = [
+    const fallbackLines = [
         `vault unlocked for ${command.agent} on this machine`,
         `vault: ${vault.email} at ${vault.serverUrl}`,
-        `local unlock store: ${store.kind}${store.secure ? "" : " (explicit plaintext fallback)"}`,
-    ].join("\n");
-    deps.writeStdout(message);
-    return message;
+        formatLocalUnlockStoreLine(store),
+    ];
+    return writeCommandOutcome(deps, {
+        title: "Credential vault",
+        subtitle: `${command.agent}'s vault is open on this machine again.`,
+        summary: `This machine can now open ${command.agent}'s vault without re-entering the unlock secret every request.`,
+        sections: [
+            {
+                title: "What changed",
+                lines: [
+                    `Vault: ${vault.email} at ${vault.serverUrl}`,
+                    formatLocalUnlockStoreLine(store),
+                    "secret was not printed",
+                ],
+            },
+            {
+                title: "Next moves",
+                lines: [
+                    `Run ouro up to let the house retry ${command.agent}.`,
+                    `If credentials are still missing, run ouro auth --agent ${command.agent} --provider <provider>.`,
+                ],
+            },
+        ],
+        fallbackLines,
+    });
 }
 async function executeVaultCreate(command, deps) {
     if (command.agent === "SerpentGuide") {
@@ -1153,15 +1270,40 @@ async function executeVaultCreate(command, deps) {
     /* v8 ignore next -- defensive: success path assigns store before continuing @preserve */
     if (!store)
         throw new Error(`vault create failed for ${command.agent}: local unlock material was not saved`);
-    const message = appendBundleSyncSummary([
+    const syncSummary = pushAgentBundleAfterCliMutation(command.agent, deps);
+    const fallbackLines = [
         `vault created for ${command.agent}`,
         `vault: ${email} at ${serverUrl}`,
-        `local unlock store: ${store.kind}${store.secure ? "" : " (explicit plaintext fallback)"}`,
+        formatLocalUnlockStoreLine(store),
         "All raw credentials for this agent will be stored in this Ouro credential vault.",
         "Keep the vault unlock secret saved outside Ouro. Another machine will need it once.",
-    ].join("\n"), command.agent, deps);
-    deps.writeStdout(message);
-    return message;
+        ...(syncSummary ? [syncSummary] : []),
+    ];
+    return writeCommandOutcome(deps, {
+        title: "Credential vault",
+        subtitle: `${command.agent} has a vault home now.`,
+        summary: `All raw credentials for ${command.agent} now live in this vault.`,
+        sections: [
+            {
+                title: "What changed",
+                lines: [
+                    `Vault: ${email} at ${serverUrl}`,
+                    formatLocalUnlockStoreLine(store),
+                    "This vault will hold provider and runtime credentials for the agent.",
+                    "secret was not printed",
+                    ...(syncSummary ? [syncSummary] : []),
+                ],
+            },
+            {
+                title: "Next moves",
+                lines: [
+                    `Authenticate the providers ${command.agent} should use with ouro auth --agent ${command.agent} --provider <provider>.`,
+                    `Then run ouro up so the house can bring ${command.agent} online.`,
+                ],
+            },
+        ],
+        fallbackLines,
+    });
 }
 async function executeVaultReplace(command, deps) {
     if (command.agent === "SerpentGuide") {
@@ -1204,16 +1346,42 @@ async function executeVaultReplace(command, deps) {
         throw new Error(`vault replace failed for ${command.agent}: no vault repair result`);
     if (!repair.ok)
         return repair.message;
-    const message = appendBundleSyncSummary([
+    const syncSummary = pushAgentBundleAfterCliMutation(command.agent, deps);
+    const fallbackLines = [
         `vault replaced for ${command.agent}`,
         `vault: ${email} at ${serverUrl}`,
-        `local unlock store: ${repair.store.kind}${repair.store.secure ? "" : " (explicit plaintext fallback)"}`,
+        formatLocalUnlockStoreLine(repair.store),
         "imported: none",
         `next: ouro repair --agent ${command.agent}`,
         "Keep the vault unlock secret saved outside Ouro. Another machine will need it once.",
-    ].join("\n"), command.agent, deps);
-    deps.writeStdout(message);
-    return message;
+        ...(syncSummary ? [syncSummary] : []),
+    ];
+    return writeCommandOutcome(deps, {
+        title: "Credential vault",
+        subtitle: `${command.agent} has a fresh vault.`,
+        summary: `${command.agent} now has a fresh empty vault.`,
+        sections: [
+            {
+                title: "What changed",
+                lines: [
+                    `Vault: ${email} at ${serverUrl}`,
+                    formatLocalUnlockStoreLine(repair.store),
+                    "Imported: none",
+                    "secret was not printed",
+                    ...(syncSummary ? [syncSummary] : []),
+                ],
+            },
+            {
+                title: "Next moves",
+                lines: [
+                    `Re-enter provider credentials with ouro auth --agent ${command.agent} --provider <provider>.`,
+                    `Re-enter runtime secrets with ouro connect --agent ${command.agent} or ouro vault config set --agent ${command.agent} --key <field>.`,
+                    `Then run ouro repair --agent ${command.agent} or ouro up.`,
+                ],
+            },
+        ],
+        fallbackLines,
+    });
 }
 async function executeVaultRecover(command, deps) {
     if (command.agent === "SerpentGuide") {
@@ -1290,19 +1458,47 @@ async function executeVaultRecover(command, deps) {
         progress.end();
     }
     const providerList = [...importedProviders].sort();
-    const message = appendBundleSyncSummary([
+    const syncSummary = pushAgentBundleAfterCliMutation(command.agent, deps);
+    const fallbackLines = [
         `vault recovered for ${command.agent}`,
         `vault: ${email} at ${serverUrl}`,
-        `local unlock store: ${repair.store.kind}${repair.store.secure ? "" : " (explicit plaintext fallback)"}`,
+        formatLocalUnlockStoreLine(repair.store),
         `sources imported: ${sourceImports.length}`,
         `provider credentials imported: ${providerList.length === 0 ? "none" : providerList.join(", ")}`,
         `runtime credentials imported: ${runtimeFields.length === 0 ? "none" : runtimeFields.join(", ")}`,
         `machine runtime credentials imported: ${machineRuntimeFields.length === 0 ? "none" : machineRuntimeFields.join(", ")}`,
         "credential values were not printed",
         "Keep the vault unlock secret saved outside Ouro. Another machine will need it once.",
-    ].join("\n"), command.agent, deps);
-    deps.writeStdout(message);
-    return message;
+        ...(syncSummary ? [syncSummary] : []),
+    ];
+    return writeCommandOutcome(deps, {
+        title: "Credential vault",
+        subtitle: `${command.agent}'s vault is back in service.`,
+        summary: `Recovered credentials have been moved back into ${command.agent}'s vault.`,
+        sections: [
+            {
+                title: "What changed",
+                lines: [
+                    `Vault: ${email} at ${serverUrl}`,
+                    formatLocalUnlockStoreLine(repair.store),
+                    `Sources imported: ${sourceImports.length}`,
+                    `Provider credentials: ${providerList.length === 0 ? "none" : providerList.join(", ")}`,
+                    `Runtime credentials: ${runtimeFields.length === 0 ? "none" : runtimeFields.join(", ")}`,
+                    `Machine runtime credentials: ${machineRuntimeFields.length === 0 ? "none" : machineRuntimeFields.join(", ")}`,
+                    "secret was not printed",
+                    ...(syncSummary ? [syncSummary] : []),
+                ],
+            },
+            {
+                title: "Next moves",
+                lines: [
+                    `Run ouro auth verify --agent ${command.agent} to re-check the stored providers.`,
+                    `Then run ouro up so the house can retry ${command.agent}.`,
+                ],
+            },
+        ],
+        fallbackLines,
+    });
 }
 async function executeVaultStatus(command, deps) {
     if (command.agent === "SerpentGuide") {
@@ -1931,16 +2127,27 @@ async function executeConnectPerplexity(agent, deps) {
         if (!verification.ok) {
             progress.failPhase("verifying Perplexity search", verification.summary);
             progress.end();
-            const message = [
-                `Perplexity key was saved for ${agent}, but the live check failed.`,
-                `stored: ${stored.itemPath}`,
-                `live check: ${verification.summary}`,
-                "secret was not printed",
-                "",
-                `Next: rerun \`ouro connect perplexity --agent ${agent}\` with a working key.`,
-            ].join("\n");
-            deps.writeStdout(message);
-            return message;
+            return writeCapabilityAttention(deps, {
+                subtitle: `${agent}'s Perplexity key needs another pass.`,
+                summary: "Perplexity search was saved, but the live check failed.",
+                whatChanged: [
+                    `Stored: ${stored.itemPath}`,
+                    `Live check: ${verification.summary}`,
+                    "secret was not printed",
+                ],
+                nextMoves: [
+                    `Rerun ouro connect perplexity --agent ${agent} with a working key.`,
+                    `Use ouro connect --agent ${agent} to review the rest of the capability bay.`,
+                ],
+                fallbackLines: [
+                    `Perplexity key was saved for ${agent}, but the live check failed.`,
+                    `stored: ${stored.itemPath}`,
+                    `live check: ${verification.summary}`,
+                    "secret was not printed",
+                    "",
+                    `Next: rerun \`ouro connect perplexity --agent ${agent}\` with a working key.`,
+                ],
+            });
         }
         progress.completePhase("verifying Perplexity search", verification.summary);
         reload = await runCommandProgressPhase(progress, `applying change to running ${agent}`, () => applyRuntimeChangeToRunningAgent(agent, deps, (message) => progress.updateDetail(message)), (result) => result);
@@ -1948,17 +2155,29 @@ async function executeConnectPerplexity(agent, deps) {
     finally {
         progress.end();
     }
-    const message = [
-        `Perplexity connected for ${agent}`,
-        "capability: Perplexity search",
-        `stored: ${stored.itemPath}`,
-        `running agent: ${reload}`,
-        "secret was not printed",
-        "",
-        "Next: ask the agent to search.",
-    ].join("\n");
-    deps.writeStdout(message);
-    return message;
+    return writeCapabilityOutcome(deps, {
+        subtitle: `${agent}'s search compass is online.`,
+        summary: `Perplexity search is ready to travel with ${agent}.`,
+        whatChanged: [
+            `Capability: Perplexity search`,
+            `Stored: ${stored.itemPath}`,
+            `Running agent: ${reload}`,
+            "secret was not printed",
+        ],
+        nextMoves: [
+            "Ask the agent to search.",
+            `Reopen the connect bay with ouro connect --agent ${agent} whenever you want to review capabilities.`,
+        ],
+        fallbackLines: [
+            `Perplexity connected for ${agent}`,
+            "capability: Perplexity search",
+            `stored: ${stored.itemPath}`,
+            `running agent: ${reload}`,
+            "secret was not printed",
+            "",
+            "Next: ask the agent to search.",
+        ],
+    });
 }
 async function executeConnectEmbeddings(agent, deps) {
     if (agent === "SerpentGuide") {
@@ -2018,16 +2237,27 @@ async function executeConnectEmbeddings(agent, deps) {
         if (!verification.ok) {
             progress.failPhase("verifying memory embeddings", verification.summary);
             progress.end();
-            const message = [
-                `Embeddings key was saved for ${agent}, but the live check failed.`,
-                `stored: ${stored.itemPath}`,
-                `live check: ${verification.summary}`,
-                "secret was not printed",
-                "",
-                `Next: rerun \`ouro connect embeddings --agent ${agent}\` with a working key.`,
-            ].join("\n");
-            deps.writeStdout(message);
-            return message;
+            return writeCapabilityAttention(deps, {
+                subtitle: `${agent}'s memory key needs another pass.`,
+                summary: "Memory embeddings were saved, but the live check failed.",
+                whatChanged: [
+                    `Stored: ${stored.itemPath}`,
+                    `Live check: ${verification.summary}`,
+                    "secret was not printed",
+                ],
+                nextMoves: [
+                    `Rerun ouro connect embeddings --agent ${agent} with a working key.`,
+                    `Use ouro connect --agent ${agent} to review the rest of the capability bay.`,
+                ],
+                fallbackLines: [
+                    `Embeddings key was saved for ${agent}, but the live check failed.`,
+                    `stored: ${stored.itemPath}`,
+                    `live check: ${verification.summary}`,
+                    "secret was not printed",
+                    "",
+                    `Next: rerun \`ouro connect embeddings --agent ${agent}\` with a working key.`,
+                ],
+            });
         }
         progress.completePhase("verifying memory embeddings", verification.summary);
         reload = await runCommandProgressPhase(progress, `applying change to running ${agent}`, () => applyRuntimeChangeToRunningAgent(agent, deps, (message) => progress.updateDetail(message)), (result) => result);
@@ -2035,17 +2265,29 @@ async function executeConnectEmbeddings(agent, deps) {
     finally {
         progress.end();
     }
-    const message = [
-        `Embeddings connected for ${agent}`,
-        "capability: memory embeddings",
-        `stored: ${stored.itemPath}`,
-        `running agent: ${reload}`,
-        "secret was not printed",
-        "",
-        "Next: ask the agent to search notes or memory.",
-    ].join("\n");
-    deps.writeStdout(message);
-    return message;
+    return writeCapabilityOutcome(deps, {
+        subtitle: `${agent}'s memory index is online.`,
+        summary: `Memory embeddings are ready to travel with ${agent}.`,
+        whatChanged: [
+            "Capability: memory embeddings",
+            `Stored: ${stored.itemPath}`,
+            `Running agent: ${reload}`,
+            "secret was not printed",
+        ],
+        nextMoves: [
+            "Ask the agent to search notes or memory.",
+            `Reopen the connect bay with ouro connect --agent ${agent} whenever you want to review capabilities.`,
+        ],
+        fallbackLines: [
+            `Embeddings connected for ${agent}`,
+            "capability: memory embeddings",
+            `stored: ${stored.itemPath}`,
+            `running agent: ${reload}`,
+            "secret was not printed",
+            "",
+            "Next: ask the agent to search notes or memory.",
+        ],
+    });
 }
 async function executeConnectTeams(agent, deps) {
     if (agent === "SerpentGuide") {
@@ -2053,11 +2295,38 @@ async function executeConnectTeams(agent, deps) {
     }
     const promptInput = requirePromptInput(deps, "Teams setup");
     const promptSecret = requirePromptSecret(deps, "Teams client secret entry");
-    deps.writeStdout([
-        `Connect Teams for ${agent}`,
-        "This connects the Teams sense.",
-        "The client secret stays hidden while you type.",
-    ].join("\n"));
+    writeConnectorIntro(deps, {
+        title: "Connect Teams",
+        subtitle: `${agent} gets a portable Teams sense.`,
+        summary: "Add the app credentials once, keep the secret hidden, and let Teams travel with this agent.",
+        sections: [
+            {
+                title: "Unlocks",
+                lines: [
+                    "Microsoft Teams messages and actions inside Ouro.",
+                ],
+            },
+            {
+                title: "What you need",
+                lines: [
+                    "A Teams client ID, client secret, and tenant ID.",
+                    "The client secret stays hidden while you type.",
+                ],
+            },
+            {
+                title: "Where it lives",
+                lines: [
+                    `${agent}'s vault runtime/config item.`,
+                    "It travels with the agent across machines.",
+                ],
+            },
+        ],
+        fallbackLines: [
+            `Connect Teams for ${agent}`,
+            "The client secret stays hidden while you type.",
+            `Ouro stores the setup in ${agent}'s vault runtime/config item.`,
+        ],
+    });
     const clientId = (await promptInput("Teams client ID: ")).trim();
     if (!clientId)
         throw new Error("Teams client ID cannot be blank");
@@ -2089,17 +2358,32 @@ async function executeConnectTeams(agent, deps) {
     finally {
         progress.end();
     }
-    const message = appendBundleSyncSummary([
-        `Teams connected for ${agent}`,
-        "capability: Teams sense",
-        `stored: ${stored.itemPath}`,
-        "agent.json: senses.teams.enabled = true",
-        "secret was not printed",
-        "",
-        "Next: run `ouro up` so the daemon picks up the Teams sense change.",
-    ].join("\n"), agent, deps);
-    deps.writeStdout(message);
-    return message;
+    const syncSummary = pushAgentBundleAfterCliMutation(agent, deps);
+    return writeCapabilityOutcome(deps, {
+        subtitle: `${agent}'s Teams sense is configured.`,
+        summary: `Teams is ready for ${agent}.`,
+        whatChanged: [
+            "Capability: Teams sense",
+            `Stored: ${stored.itemPath}`,
+            "agent.json: senses.teams.enabled = true",
+            "secret was not printed",
+            ...(syncSummary ? [syncSummary] : []),
+        ],
+        nextMoves: [
+            "Run ouro up so the daemon picks up the Teams sense change.",
+            `Reopen the connect bay with ouro connect --agent ${agent} whenever you want to review capabilities.`,
+        ],
+        fallbackLines: [
+            `Teams connected for ${agent}`,
+            "capability: Teams sense",
+            `stored: ${stored.itemPath}`,
+            "agent.json: senses.teams.enabled = true",
+            "secret was not printed",
+            "",
+            "Next: run `ouro up` so the daemon picks up the Teams sense change.",
+            ...(syncSummary ? [syncSummary] : []),
+        ],
+    });
 }
 async function executeConnectBlueBubbles(agent, deps) {
     if (agent === "SerpentGuide") {
@@ -2107,11 +2391,38 @@ async function executeConnectBlueBubbles(agent, deps) {
     }
     const promptInput = requirePromptInput(deps, "BlueBubbles setup");
     const promptSecret = requirePromptSecret(deps, "BlueBubbles password entry");
-    deps.writeStdout([
-        `Connect BlueBubbles for ${agent}`,
-        "This is a local attachment for this machine.",
-        "The app password stays hidden while you type.",
-    ].join("\n"));
+    writeConnectorIntro(deps, {
+        title: "Connect BlueBubbles",
+        subtitle: `${agent} gets a local Messages bridge on this machine.`,
+        summary: "Attach this Mac's BlueBubbles bridge without pretending it travels anywhere else.",
+        sections: [
+            {
+                title: "Unlocks",
+                lines: [
+                    "Local iMessage bridge access on this machine only.",
+                ],
+            },
+            {
+                title: "What you need",
+                lines: [
+                    "A BlueBubbles server URL and app password.",
+                    "The app password stays hidden while you type.",
+                ],
+            },
+            {
+                title: "Where it lives",
+                lines: [
+                    `${agent}'s machine runtime config for this machine.`,
+                    "It does not travel to other machines unless you attach them too.",
+                ],
+            },
+        ],
+        fallbackLines: [
+            `Connect BlueBubbles for ${agent}`,
+            "This is a local attachment for this machine.",
+            "The app password stays hidden while you type.",
+        ],
+    });
     const serverUrl = (await promptInput("BlueBubbles server URL for this machine: ")).trim();
     if (!serverUrl)
         throw new Error("BlueBubbles server URL cannot be blank");
@@ -2156,17 +2467,32 @@ async function executeConnectBlueBubbles(agent, deps) {
         progress.end();
         throw error;
     }
-    const message = appendBundleSyncSummary([
-        `BlueBubbles attached for ${agent} on this machine`,
-        `machine: ${machineId}`,
-        `stored: ${stored.itemPath}`,
-        "agent.json: senses.bluebubbles.enabled = true",
-        "secret was not printed",
-        "",
-        "Next: point BlueBubbles at this machine's webhook, then run `ouro up`.",
-    ].join("\n"), agent, deps);
-    deps.writeStdout(message);
-    return message;
+    const syncSummary = pushAgentBundleAfterCliMutation(agent, deps);
+    return writeCapabilityOutcome(deps, {
+        subtitle: `${agent}'s local bridge is attached.`,
+        summary: `BlueBubbles is attached on this machine for ${agent}.`,
+        whatChanged: [
+            `Machine: ${machineId}`,
+            `Stored: ${stored.itemPath}`,
+            "agent.json: senses.bluebubbles.enabled = true",
+            "secret was not printed",
+            ...(syncSummary ? [syncSummary] : []),
+        ],
+        nextMoves: [
+            "Point BlueBubbles at this machine's webhook, then run ouro up.",
+            `Attach other machines separately if ${agent} should use BlueBubbles there too.`,
+        ],
+        fallbackLines: [
+            `BlueBubbles attached for ${agent} on this machine`,
+            `machine: ${machineId}`,
+            `stored: ${stored.itemPath}`,
+            "agent.json: senses.bluebubbles.enabled = true",
+            "secret was not printed",
+            "",
+            "Next: point BlueBubbles at this machine's webhook, then run `ouro up`.",
+            ...(syncSummary ? [syncSummary] : []),
+        ],
+    });
 }
 async function executeConnectProviders(agent, deps) {
     const promptInput = deps.promptInput;
@@ -2613,27 +2939,51 @@ async function executeAuthRun(command, deps) {
     // Behavior: ouro auth stores credentials only — does NOT switch provider.
     // Use `ouro auth switch` to change the active provider.
     // Verify the credentials actually work by pinging the provider.
+    let verificationStatus = "not checked";
     /* v8 ignore start -- integration: real API ping after auth @preserve */
     try {
         progress.startPhase(`verifying ${provider}`);
         const credential = await readProviderCredentialRecord(command.agent, provider, deps, {
             onProgress: (message) => progress.updateDetail(message),
         });
-        const status = credential.ok
+        verificationStatus = credential.ok
             ? await verifyProviderCredentials(provider, {
                 [provider]: { ...credential.record.config, ...credential.record.credentials },
             })
             : `stored but could not be re-read from vault (${credential.error})`;
-        progress.completePhase(`verifying ${provider}`, status);
+        progress.completePhase(`verifying ${provider}`, verificationStatus);
     }
     catch (error) {
         // Verification failure is non-blocking — credentials were saved regardless.
-        progress.completePhase(`verifying ${provider}`, `skipped (${error instanceof Error ? error.message : String(error)})`);
+        verificationStatus = `skipped (${error instanceof Error ? error.message : String(error)})`;
+        progress.completePhase(`verifying ${provider}`, verificationStatus);
     }
     /* v8 ignore stop */
     progress.end();
-    deps.writeStdout(result.message);
-    return result.message;
+    return writeCommandOutcome(deps, {
+        title: "Provider auth",
+        subtitle: `${command.agent} just refreshed ${provider}.`,
+        summary: `${command.agent} can now use ${provider} when this lane is selected.`,
+        sections: [
+            {
+                title: "What changed",
+                lines: [
+                    `Stored in: ${result.credentialPath}`,
+                    `Provider: ${provider}`,
+                    `Live check: ${verificationStatus}`,
+                    "secret was not printed",
+                ],
+            },
+            {
+                title: "Next moves",
+                lines: [
+                    `Choose it for a lane with ouro use --agent ${command.agent} --lane <outward|inner> --provider ${provider} --model <model>.`,
+                    `Double-check it any time with ouro auth verify --agent ${command.agent} --provider ${provider}.`,
+                ],
+            },
+        ],
+        fallbackLines: [result.message],
+    });
 }
 async function readinessReportForAgent(agent, deps) {
     const bundlesRoot = deps.bundlesRoot ?? (0, identity_1.getAgentBundlesRoot)();
@@ -3578,21 +3928,24 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
             deps.writeRaw(`${(0, terminal_ui_1.renderOuroMasthead)({
                 isTTY: true,
                 columns: deps.stdoutColumns ?? process.stdout.columns,
-                subtitle: "Bringing the house online.",
+                subtitle: "Preparing the house.",
             }).trimEnd()}\n\n`);
         }
         const progress = new up_progress_1.UpProgress({
             write: deps.writeRaw ?? deps.writeStdout,
             isTTY: outputIsTTY,
+            columns: deps.stdoutColumns ?? process.stdout.columns,
             now: deps.now ?? (() => Date.now()),
             autoRender: true,
         });
         // ── versioned CLI update check ──
         if (deps.checkForCliUpdate) {
             progress.startPhase("update check");
+            progress.updateDetail("checking npm registry\ncontinuing startup if it stays quiet");
             let pendingReExec = false;
+            let updateCheckStatus = "up to date";
             try {
-                const updateResult = await deps.checkForCliUpdate();
+                const { result: updateResult, timedOut } = await runCliUpdateCheckWithTimeout(deps.checkForCliUpdate, deps.updateCheckTimeoutMs ?? update_checker_1.CLI_UPDATE_CHECK_TIMEOUT_MS);
                 if (updateResult.available && updateResult.latestVersion) {
                     /* v8 ignore next -- fallback: getCurrentCliVersion always injected in tests @preserve */
                     const currentVersion = linkedVersionBeforeUp ?? "unknown";
@@ -3606,9 +3959,13 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
                     }
                     pendingReExec = true;
                 }
+                else if (updateResult.error) {
+                    updateCheckStatus = summarizeCliUpdateCheckStatus(updateResult.error, timedOut);
+                }
                 /* v8 ignore start -- update check error: tested via daemon-cli-update-flow.test.ts @preserve */
             }
             catch (error) {
+                updateCheckStatus = summarizeCliUpdateCheckStatus(error instanceof Error ? error.message : String(error));
                 (0, runtime_1.emitNervesEvent)({
                     level: "warn",
                     component: "daemon",
@@ -3623,7 +3980,7 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
                 deps.reExecFromNewVersion(args);
             }
             else {
-                progress.completePhase("update check", "up to date");
+                progress.completePhase("update check", updateCheckStatus);
             }
         }
         progress.startPhase("system setup");
@@ -3777,56 +4134,72 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
                 });
             }
             else {
-                const repairResult = await (0, agentic_repair_1.runAgenticRepair)(daemonResult.stability.degraded, {
-                    /* v8 ignore start -- production provider discovery wiring @preserve */
-                    discoverWorkingProvider: async (agentName) => {
-                        const { discoverWorkingProvider: discover } = await Promise.resolve().then(() => __importStar(require("./provider-discovery")));
-                        const { pingProvider } = await Promise.resolve().then(() => __importStar(require("../provider-ping")));
-                        return discover({
-                            agentName,
-                            pingProvider: pingProvider,
-                        });
-                    },
-                    createProviderRuntime: agentic_repair_1.createAgenticDiagnosisProviderRuntime,
-                    readDaemonLogsTail: () => {
-                        try {
-                            const fs = require("node:fs");
-                            const path = require("node:path");
-                            const logsDir = path.join(process.env["HOME"] ?? "", ".agentstate", "daemon", "logs");
-                            const files = fs.readdirSync(logsDir).filter((f) => f.endsWith(".log")).sort();
-                            if (files.length === 0)
-                                return "(no daemon logs found)";
-                            const lastLog = fs.readFileSync(path.join(logsDir, files[files.length - 1]), "utf8");
-                            const lines = lastLog.split("\n");
-                            return lines.slice(-50).join("\n");
-                        }
-                        catch {
-                            return "(unable to read daemon logs)";
-                        }
-                    },
-                    /* v8 ignore stop */
-                    runInteractiveRepair: interactive_repair_1.runInteractiveRepair,
-                    promptInput: deps.promptInput ?? (async () => "n"),
-                    writeStdout: deps.writeStdout,
-                    runAuthFlow: async (agent, providerOverride) => {
-                        await executeAuthRun({
-                            kind: "auth.run",
-                            agent,
-                            ...(providerOverride ? { provider: providerOverride } : {}),
-                        }, deps);
-                    },
-                    runVaultUnlock: async (agent) => {
-                        await executeVaultUnlock({ kind: "vault.unlock", agent }, deps);
-                    },
-                    skipQueueSummary: true,
-                });
-                if (repairResult.repairsAttempted) {
-                    const repairedAgents = daemonResult.stability.degraded
-                        .filter(interactive_repair_1.hasRunnableInteractiveRepair)
-                        .map((entry) => entry.agent);
+                const typedDegraded = daemonResult.stability.degraded.filter((entry) => (0, readiness_repair_1.isKnownReadinessIssue)(entry.issue));
+                const untypedDegraded = daemonResult.stability.degraded.filter((entry) => !(0, readiness_repair_1.isKnownReadinessIssue)(entry.issue));
+                let repairsAttempted = false;
+                const repairedAgents = new Set();
+                if (typedDegraded.length > 0) {
+                    const guidedRepair = await runReadinessRepairForDegraded(typedDegraded, deps);
+                    if (guidedRepair.repairsAttempted) {
+                        repairsAttempted = true;
+                        typedDegraded.forEach((entry) => repairedAgents.add(entry.agent));
+                    }
+                }
+                if (untypedDegraded.length > 0) {
+                    const repairResult = await (0, agentic_repair_1.runAgenticRepair)(untypedDegraded, {
+                        /* v8 ignore start -- production provider discovery wiring @preserve */
+                        discoverWorkingProvider: async (agentName) => {
+                            const { discoverWorkingProvider: discover } = await Promise.resolve().then(() => __importStar(require("./provider-discovery")));
+                            const { pingProvider } = await Promise.resolve().then(() => __importStar(require("../provider-ping")));
+                            return discover({
+                                agentName,
+                                pingProvider: pingProvider,
+                            });
+                        },
+                        createProviderRuntime: agentic_repair_1.createAgenticDiagnosisProviderRuntime,
+                        readDaemonLogsTail: () => {
+                            try {
+                                const fs = require("node:fs");
+                                const path = require("node:path");
+                                const logsDir = path.join(process.env["HOME"] ?? "", ".agentstate", "daemon", "logs");
+                                const files = fs.readdirSync(logsDir).filter((f) => f.endsWith(".log")).sort();
+                                if (files.length === 0)
+                                    return "(no daemon logs found)";
+                                const lastLog = fs.readFileSync(path.join(logsDir, files[files.length - 1]), "utf8");
+                                const lines = lastLog.split("\n");
+                                return lines.slice(-50).join("\n");
+                            }
+                            catch {
+                                return "(unable to read daemon logs)";
+                            }
+                        },
+                        /* v8 ignore stop */
+                        runInteractiveRepair: interactive_repair_1.runInteractiveRepair,
+                        promptInput: deps.promptInput ?? (async () => "n"),
+                        writeStdout: deps.writeStdout,
+                        runAuthFlow: async (agent, providerOverride) => {
+                            await executeAuthRun({
+                                kind: "auth.run",
+                                agent,
+                                ...(providerOverride ? { provider: providerOverride } : {}),
+                            }, deps);
+                        },
+                        runVaultUnlock: async (agent) => {
+                            await executeVaultUnlock({ kind: "vault.unlock", agent }, deps);
+                        },
+                        skipQueueSummary: true,
+                    });
+                    if (repairResult.repairsAttempted) {
+                        repairsAttempted = true;
+                        untypedDegraded
+                            .filter(interactive_repair_1.hasRunnableInteractiveRepair)
+                            .forEach((entry) => repairedAgents.add(entry.agent));
+                    }
+                }
+                if (repairsAttempted) {
                     progress.startPhase("post-repair check");
-                    await reportPostRepairProviderHealth(deps, repairedAgents, (msg) => progress.updateDetail(msg));
-                    progress.completePhase("post-repair check", providerRepairCountSummary(repairedAgents.length));
+                    await reportPostRepairProviderHealth(deps, [...repairedAgents], (msg) => progress.updateDetail(msg));
+                    progress.completePhase("post-repair check", providerRepairCountSummary(repairedAgents.size));
                 }
             }
         }
@@ -4028,16 +4401,16 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
         const sections = [localSection];
         if (deps.checkForCliUpdate) {
             try {
-                const updateResult = await deps.checkForCliUpdate();
+                const { result: updateResult, timedOut } = await runCliUpdateCheckWithTimeout(deps.checkForCliUpdate, deps.updateCheckTimeoutMs ?? update_checker_1.CLI_UPDATE_CHECK_TIMEOUT_MS);
                 if (updateResult.latestVersion) {
                     sections.push(`published latest: ${updateResult.latestVersion} (${updateResult.available ? "update available" : "up to date"})`);
                 }
                 else if (updateResult.error) {
-                    sections.push(`published latest: unavailable (${updateResult.error})`);
+                    sections.push(`published latest: unavailable (${summarizeCliUpdateCheckStatus(updateResult.error, timedOut)})`);
                 }
             }
             catch (err) {
-                const reason = err instanceof Error ? err.message : String(err);
+                const reason = summarizeCliUpdateCheckStatus(err instanceof Error ? err.message : String(err));
                 sections.push(`published latest: unavailable (${reason})`);
             }
         }
@@ -5040,9 +5413,31 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
             await deps.startChat(hatchInput.agentName);
             return "";
         }
-        const message = `hatched ${hatchInput.agentName} at ${result.bundleRoot} using specialist identity ${result.selectedIdentity}; ${daemonResult.message}`;
-        deps.writeStdout(message);
-        return message;
+        return writeCommandOutcome(deps, {
+            title: "Hatch complete",
+            subtitle: `${hatchInput.agentName} just arrived.`,
+            summary: `${hatchInput.agentName} is ready for first contact.`,
+            sections: [
+                {
+                    title: "What changed",
+                    lines: [
+                        `Bundle: ${result.bundleRoot}`,
+                        `Specialist identity: ${result.selectedIdentity}`,
+                        `House status: ${daemonResult.message}`,
+                    ],
+                },
+                {
+                    title: "Next moves",
+                    lines: [
+                        `Talk to them with ouro chat ${hatchInput.agentName}.`,
+                        `Use ouro connect --agent ${hatchInput.agentName} to bring more capabilities online.`,
+                    ],
+                },
+            ],
+            fallbackLines: [
+                `hatched ${hatchInput.agentName} at ${result.bundleRoot} using specialist identity ${result.selectedIdentity}; ${daemonResult.message}`,
+            ],
+        });
     }
     // ── doctor (local, no daemon socket needed) ──
     if (command.kind === "doctor") {
@@ -5227,7 +5622,17 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
     }
     const fallbackMessage = response.summary ?? response.message ?? (response.ok ? "ok" : `error: ${response.error ?? "unknown error"}`);
     const message = command.kind === "daemon.status"
-        ? (0, cli_render_1.formatDaemonStatusOutput)(response, fallbackMessage)
+        ? (() => {
+            const payload = (0, cli_render_1.parseStatusPayload)(response.data);
+            if (payload && ttyBoardEnabled(deps)) {
+                return (0, human_command_screens_1.renderHouseStatusScreen)({
+                    payload,
+                    isTTY: true,
+                    columns: deps.stdoutColumns ?? process.stdout.columns,
+                }).trimEnd();
+            }
+            return (0, cli_render_1.formatDaemonStatusOutput)(response, fallbackMessage);
+        })()
         : fallbackMessage;
     deps.writeStdout(message);
     return message;