@ouro.bot/cli 0.1.0-alpha.437 → 0.1.0-alpha.439

package/changelog.json

@@ -1,6 +1,22 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.439",
+      "changes": [
+        "When an older Ouro-owned launcher is shadowing the managed `~/.ouro-cli/bin/ouro` path, system setup now repairs it in place instead of dumping a PATH lecture onto the human. Old global Homebrew/npm launchers that clearly belong to Ouro get rewritten to the current managed wrapper automatically.",
+        "That repair is intentionally narrow and truthful: Ouro only rewrites a shadowed launcher when its realpath or readable content proves it is one of our old launchers. Unknown launchers still keep the explicit PATH warning instead of being touched.",
+        "New path-installer and startup output coverage lock in the self-heal path, including readable non-Ouro launchers, disappearing files, write failures, and the happy-path repair of a stale `/opt/homebrew/bin/ouro`, with full coverage, integration, and packaged-install validation on top."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.438",
+      "changes": [
+        "Live provider failures now keep their real diagnosis all the way through startup, repair, and the connect bay: expired credentials still prompt re-auth, but busy providers, provider outages, rate limits, quota failures, and network trouble now point humans toward retrying later, checking usage, or switching lanes instead of being mislabeled as an auth problem.",
+        "The readiness board and connect bay now share one classification-aware repair model, so a lane only says `needs credentials` when the live ping actually came back as an auth failure; other live-check failures stay in the broader `needs attention` bucket with matching next actions.",
+        "New daemon, connect-bay, human-readiness, hermetic-runtime, and full-suite coverage lock in the truthful failure guidance, and packaged-install verification confirms the fix survives beyond the repo checkout into the shipped CLI."
+      ]
+    },
     {
       "version": "0.1.0-alpha.437",
       "changes": [

package/dist/heart/daemon/agent-config-check.js

@@ -298,12 +298,18 @@ function failedPingResult(agentName, lane, provider, model, result) {
     return {
         ok: false,
         error: `${lane} provider ${provider} model ${model} failed live check: ${result.message}`,
-        fix: `Run 'ouro auth --agent ${agentName} --provider ${provider}' to refresh credentials.`,
+        fix: (0, readiness_repair_1.providerLiveCheckFix)({
+            agentName,
+            lane,
+            provider,
+            classification: result.classification,
+        }),
         issue: (0, readiness_repair_1.providerLiveCheckFailedIssue)({
             agentName,
             lane,
             provider,
             model,
+            classification: result.classification,
             message: result.message,
         }),
     };

package/dist/heart/daemon/cli-exec.js

@@ -3262,6 +3262,9 @@ async function performSystemSetup(deps) {
             if (installResult.repairedOldLauncher) {
                 deps.writeStdout("repaired stale ouro launcher at ~/.local/bin/ouro");
             }
+            if (installResult.repairedShadowedLauncherPath) {
+                deps.writeStdout(`updated stale ouro launcher at ${installResult.repairedShadowedLauncherPath}`);
+            }
             if (installResult.pathResolution?.status === "shadowed") {
                 deps.writeStdout(`fix ouro PATH: ${installResult.pathResolution.detail}; ` +
                     `fix: ${installResult.pathResolution.remediation}`);

package/dist/heart/daemon/connect-bay.js

@@ -6,6 +6,7 @@ exports.connectEntryNeedsAttention = connectEntryNeedsAttention;
 exports.renderConnectBay = renderConnectBay;
 const runtime_1 = require("../../nerves/runtime");
 const terminal_ui_1 = require("./terminal-ui");
+const readiness_repair_1 = require("./readiness-repair");
 const CONNECT_STATUS_PRIORITY = {
     "needs attention": 0,
     locked: 1,
@@ -79,6 +80,16 @@ function extractCommand(fixHint, commandPrefix) {
 function resolveProviderHealthStatus(providerHealth) {
     if (!providerHealth || providerHealth.ok)
         return undefined;
+    const issue = providerHealth.issue;
+    if (issue?.kind === "vault-locked")
+        return "locked";
+    if (issue?.kind === "vault-unconfigured")
+        return "needs setup";
+    if (issue?.kind === "provider-credentials-missing")
+        return "needs credentials";
+    if (issue?.kind === "provider-live-check-failed") {
+        return issue.actions[0]?.kind === "provider-auth" ? "needs credentials" : "needs attention";
+    }
     const error = String(providerHealth.error).toLowerCase();
     const fix = String(providerHealth.fix).toLowerCase();
     if (error.includes("failed live check"))
@@ -99,7 +110,11 @@ function resolveProviderHealthStatus(providerHealth) {
         return "locked";
     return "needs attention";
 }
-function resolveProviderHealthCommand(fixHint, status) {
+function resolveProviderHealthCommand(providerHealth, status) {
+    const issueCommand = (0, readiness_repair_1.preferredConnectRepairAction)(providerHealth?.issue)?.command;
+    if (issueCommand)
+        return issueCommand;
+    const fixHint = providerHealth?.fix;
     if (!fixHint)
         return undefined;
     const prefixes = status === "locked"
@@ -329,7 +344,7 @@ function renderNonTtyBay(entries, options) {
 }
 function summarizeProviderLane(agent, lane, providerHealth) {
     const providerHealthStatus = resolveProviderHealthStatus(providerHealth);
-    const providerHealthCommand = resolveProviderHealthCommand(providerHealth?.fix, providerHealthStatus);
+    const providerHealthCommand = resolveProviderHealthCommand(providerHealth, providerHealthStatus);
     if (lane.status === "unconfigured") {
         return {
             lane: lane.lane,
@@ -372,7 +387,7 @@ function summarizeProviderLane(agent, lane, providerHealth) {
             status: "needs attention",
             title: `${lane.provider} / ${lane.model}`,
             detail: `failed live check: ${lane.readiness.error ?? "unknown error"}`,
-            action: providerHealth?.fix ?? `ouro auth --agent ${agent} --provider ${lane.provider}`,
+            action: providerHealthCommand ?? providerHealth?.fix ?? `ouro auth --agent ${agent} --provider ${lane.provider}`,
         };
     }
     if (lane.readiness.status === "stale") {
@@ -404,7 +419,7 @@ function summarizeProvidersForConnect(agent, visibility, providerHealth) {
     const laneSummaries = visibility.lanes.map((lane) => summarizeProviderLane(agent, lane, providerHealth));
     const worstLaneStatus = laneSummaries.reduce((worst, lane) => CONNECT_STATUS_PRIORITY[lane.status] < CONNECT_STATUS_PRIORITY[worst] ? lane.status : worst, "ready");
     const providerHealthStatus = resolveProviderHealthStatus(providerHealth);
-    const providerHealthCommand = resolveProviderHealthCommand(providerHealth?.fix, providerHealthStatus);
+    const providerHealthCommand = resolveProviderHealthCommand(providerHealth, providerHealthStatus);
     const nextLane = laneSummaries.find((lane) => isProblemStatus(lane.status));
     return {
         status: providerHealthStatus ?? worstLaneStatus,

package/dist/heart/daemon/human-readiness.js

@@ -22,7 +22,7 @@ function statusFromIssue(issue) {
         case "provider-credentials-missing":
             return "needs credentials";
         case "provider-live-check-failed":
-            return "needs attention";
+            return issue.actions[0]?.kind === "provider-auth" ? "needs credentials" : "needs attention";
         case "generic":
             return "needs attention";
     }

package/dist/heart/daemon/readiness-repair.js

@@ -3,6 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.vaultLockedIssue = vaultLockedIssue;
 exports.vaultUnconfiguredIssue = vaultUnconfiguredIssue;
 exports.providerCredentialMissingIssue = providerCredentialMissingIssue;
+exports.providerLiveCheckFix = providerLiveCheckFix;
+exports.preferredConnectRepairAction = preferredConnectRepairAction;
 exports.providerLiveCheckFailedIssue = providerLiveCheckFailedIssue;
 exports.genericReadinessIssue = genericReadinessIssue;
 exports.isKnownReadinessIssue = isKnownReadinessIssue;
@@ -92,6 +94,110 @@ function providerCredentialMissingIssue(input) {
         ],
     };
 }
+function normalizeProviderLiveCheckClassification(classification) {
+    switch (classification) {
+        case "auth-failure":
+        case "usage-limit":
+        case "rate-limit":
+        case "server-error":
+        case "network-error":
+        case "unknown":
+            return classification;
+        default:
+            return "unknown";
+    }
+}
+function providerUseAction(input) {
+    return {
+        kind: "provider-use",
+        label: "Choose a different working provider/model",
+        command: `ouro use --agent ${input.agentName} --lane ${input.lane} --provider <provider> --model <model>`,
+        actor: "human-choice",
+        executable: false,
+        lane: input.lane,
+    };
+}
+function providerAuthAction(input) {
+    return {
+        kind: "provider-auth",
+        label: `Refresh ${input.provider} credentials`,
+        command: `ouro auth --agent ${input.agentName} --provider ${input.provider}`,
+        actor: "human-required",
+        provider: input.provider,
+    };
+}
+function providerRetryAction(input) {
+    return {
+        kind: "provider-retry",
+        label: input.label,
+        command: `ouro repair --agent ${input.agentName}`,
+        actor: "human-choice",
+        executable: false,
+    };
+}
+function providerLiveCheckFix(input) {
+    const classification = normalizeProviderLiveCheckClassification(input.classification);
+    const authCommand = `ouro auth --agent ${input.agentName} --provider ${input.provider}`;
+    const useCommand = `ouro use --agent ${input.agentName} --lane ${input.lane} --provider <provider> --model <model>`;
+    switch (classification) {
+        case "auth-failure":
+            return `Run '${authCommand}' to refresh credentials, or run '${useCommand}' to choose another provider/model for this lane.`;
+        case "usage-limit":
+            return `This usually means ${input.provider} hit a usage limit. Restore quota, then run 'ouro up' again. Or run '${useCommand}' to choose another provider/model for this lane.`;
+        case "rate-limit":
+            return `Run 'ouro up' again after a short wait. Or run '${useCommand}' to choose another provider/model for this lane.`;
+        case "server-error":
+            return `Run 'ouro up' again in a moment. If ${input.provider} keeps failing, run '${useCommand}' to choose another provider/model for this lane.`;
+        case "network-error":
+            return `Check the network or provider availability, then run 'ouro up' again. Or run '${useCommand}' to choose another provider/model for this lane.`;
+        case "unknown":
+            return `Run 'ouro up' again. If it keeps failing, run '${authCommand}' to refresh credentials or '${useCommand}' to choose another provider/model for this lane.`;
+    }
+}
+function providerLiveCheckActions(input) {
+    const classification = normalizeProviderLiveCheckClassification(input.classification);
+    const useAction = providerUseAction(input);
+    const authAction = providerAuthAction(input);
+    switch (classification) {
+        case "auth-failure":
+            return [authAction, useAction];
+        case "usage-limit":
+            return [
+                providerRetryAction({ agentName: input.agentName, label: "After restoring quota, check again" }),
+                useAction,
+            ];
+        case "rate-limit":
+            return [
+                providerRetryAction({ agentName: input.agentName, label: "Give it a minute, then check again" }),
+                useAction,
+            ];
+        case "server-error":
+            return [
+                providerRetryAction({ agentName: input.agentName, label: "Check again in a moment" }),
+                useAction,
+            ];
+        case "network-error":
+            return [
+                providerRetryAction({ agentName: input.agentName, label: "Check again after the network settles" }),
+                useAction,
+                authAction,
+            ];
+        case "unknown":
+            return [
+                providerRetryAction({ agentName: input.agentName, label: "Check again" }),
+                authAction,
+                useAction,
+            ];
+    }
+}
+function preferredConnectRepairAction(issue) {
+    if (!issue)
+        return undefined;
+    if (issue.kind === "provider-live-check-failed" && issue.actions[0]?.kind === "provider-retry") {
+        return issue.actions.find((action) => action.kind !== "provider-retry") ?? issue.actions[0];
+    }
+    return issue.actions[0];
+}
 function providerLiveCheckFailedIssue(input) {
     return {
         kind: "provider-live-check-failed",
@@ -99,23 +205,7 @@ function providerLiveCheckFailedIssue(input) {
         actor: "human-choice",
         summary: `${input.agentName}: ${input.lane} provider ${input.provider} / ${input.model} failed live check`,
         detail: input.message,
-        actions: [
-            {
-                kind: "provider-auth",
-                label: `Refresh ${input.provider} credentials`,
-                command: `ouro auth --agent ${input.agentName} --provider ${input.provider}`,
-                actor: "human-required",
-                provider: input.provider,
-            },
-            {
-                kind: "provider-use",
-                label: "Choose a different working provider/model for this lane",
-                command: `ouro use --agent ${input.agentName} --lane ${input.lane} --provider <provider> --model <model>`,
-                actor: "human-choice",
-                executable: false,
-                lane: input.lane,
-            },
-        ],
+        actions: providerLiveCheckActions(input),
     };
 }
 function genericReadinessIssue(input) {

package/dist/heart/versioning/ouro-path-installer.js

@@ -106,6 +106,72 @@ function isWrapperCurrent(scriptPath, existsSync, readFileSync) {
         return false;
     }
 }
+function isOwnedOuroLauncherPath(resolvedPath) {
+    const normalized = path.normalize(resolvedPath);
+    return (normalized.includes(`${path.sep}node_modules${path.sep}@ouro.bot${path.sep}cli${path.sep}`) ||
+        normalized.includes(`${path.sep}node_modules${path.sep}ouro.bot${path.sep}`));
+}
+function isOwnedOuroLauncherContent(content) {
+    return (content.includes("@ouro.bot/cli") ||
+        content.includes("ouro.bot@latest") ||
+        content.includes('exec npx --yes ouro.bot "$@"') ||
+        content.includes("CurrentVersion/node_modules/@ouro.bot/cli"));
+}
+function canRepairShadowedLauncher(shadowPath, existsSync, readFileSync, realpathSync) {
+    if (!existsSync(shadowPath))
+        return false;
+    try {
+        if (isOwnedOuroLauncherPath(realpathSync(shadowPath)))
+            return true;
+    }
+    catch {
+        // Fall through to content detection below.
+    }
+    try {
+        return isOwnedOuroLauncherContent(readFileSync(shadowPath, "utf-8"));
+    }
+    catch {
+        return false;
+    }
+}
+function repairShadowedLauncher(input) {
+    if (!canRepairShadowedLauncher(input.shadowPath, input.existsSync, input.readFileSync, input.realpathSync)) {
+        return null;
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.ouro_path_shadow_repair_start",
+        message: "repairing stale shadowed ouro launcher",
+        meta: { shadowPath: input.shadowPath },
+    });
+    try {
+        if (input.lstatSync(input.shadowPath).isSymbolicLink()) {
+            input.unlinkSync(input.shadowPath);
+        }
+        input.writeFileSync(input.shadowPath, WRAPPER_SCRIPT, { mode: 0o755 });
+        input.chmodSync(input.shadowPath, 0o755);
+        (0, runtime_1.emitNervesEvent)({
+            component: "daemon",
+            event: "daemon.ouro_path_shadow_repair_end",
+            message: "repaired stale shadowed ouro launcher",
+            meta: { shadowPath: input.shadowPath },
+        });
+        return input.shadowPath;
+    }
+    catch (error) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "daemon",
+            event: "daemon.ouro_path_shadow_repair_error",
+            message: "failed to repair stale shadowed ouro launcher",
+            meta: {
+                shadowPath: input.shadowPath,
+                error: error instanceof Error ? error.message : String(error),
+            },
+        });
+        return null;
+    }
+}
 function firstOuroOnPath(envPath, existsSync) {
     for (const dir of envPath.split(path.delimiter)) {
         if (!dir)
@@ -166,6 +232,9 @@ function installOuroCommand(deps = {}) {
     const readFileSync = deps.readFileSync ?? ((p, enc) => fs.readFileSync(p, enc));
     const appendFileSync = deps.appendFileSync ?? fs.appendFileSync;
     const chmodSync = deps.chmodSync ?? fs.chmodSync;
+    const realpathSync = deps.realpathSync ?? fs.realpathSync;
+    const lstatSync = deps.lstatSync ?? fs.lstatSync;
+    const unlinkSync = deps.unlinkSync ?? fs.unlinkSync;
     const envPath = deps.envPath ?? process.env.PATH ?? "";
     const shell = deps.shell ?? process.env.SHELL;
     /* v8 ignore stop */
@@ -212,7 +281,22 @@ function installOuroCommand(deps = {}) {
     }
     // ── Fast-path: modern wrapper already current ──
     if (modernCurrent) {
-        const pathResolution = resolvePath();
+        let pathResolution = resolvePath();
+        const repairedShadowedLauncherPath = pathResolution.status === "shadowed" && pathResolution.resolvedPath
+            ? repairShadowedLauncher({
+                shadowPath: pathResolution.resolvedPath,
+                existsSync,
+                readFileSync,
+                writeFileSync,
+                chmodSync,
+                realpathSync,
+                lstatSync,
+                unlinkSync,
+            })
+            : null;
+        if (repairedShadowedLauncherPath) {
+            pathResolution = resolvePath();
+        }
         if (pathResolution.status === "shadowed") {
             (0, runtime_1.emitNervesEvent)({
                 level: "warn",
@@ -228,7 +312,16 @@ function installOuroCommand(deps = {}) {
             message: "ouro command already installed",
             meta: { scriptPath, pathStatus: pathResolution.status, resolvedPath: pathResolution.resolvedPath },
         });
-        return { installed: false, scriptPath, pathReady: isBinDirInPath(binDir, envPath), shellProfileUpdated: null, skippedReason: "already-installed", repairedOldLauncher, pathResolution };
+        return {
+            installed: false,
+            scriptPath,
+            pathReady: isBinDirInPath(binDir, envPath),
+            shellProfileUpdated: null,
+            skippedReason: "already-installed",
+            repairedOldLauncher,
+            repairedShadowedLauncherPath,
+            pathResolution,
+        };
     }
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
@@ -281,7 +374,22 @@ function installOuroCommand(deps = {}) {
             }
         }
     }
-    const pathResolution = resolvePath();
+    let pathResolution = resolvePath();
+    const repairedShadowedLauncherPath = pathResolution.status === "shadowed" && pathResolution.resolvedPath
+        ? repairShadowedLauncher({
+            shadowPath: pathResolution.resolvedPath,
+            existsSync,
+            readFileSync,
+            writeFileSync,
+            chmodSync,
+            realpathSync,
+            lstatSync,
+            unlinkSync,
+        })
+        : null;
+    if (repairedShadowedLauncherPath) {
+        pathResolution = resolvePath();
+    }
     if (pathResolution.status === "shadowed") {
         (0, runtime_1.emitNervesEvent)({
             level: "warn",
@@ -295,7 +403,23 @@ function installOuroCommand(deps = {}) {
         component: "daemon",
         event: "daemon.ouro_path_install_end",
         message: "ouro command installed",
-        meta: { scriptPath, pathReady, shellProfileUpdated, oldScriptPath: oldExists ? oldScriptPath : null, pathStatus: pathResolution.status, resolvedPath: pathResolution.resolvedPath },
+        meta: {
+            scriptPath,
+            pathReady,
+            shellProfileUpdated,
+            oldScriptPath: oldExists ? oldScriptPath : null,
+            repairedShadowedLauncherPath,
+            pathStatus: pathResolution.status,
+            resolvedPath: pathResolution.resolvedPath,
+        },
     });
-    return { installed: true, scriptPath, pathReady, shellProfileUpdated, repairedOldLauncher, pathResolution };
+    return {
+        installed: true,
+        scriptPath,
+        pathReady,
+        shellProfileUpdated,
+        repairedOldLauncher,
+        repairedShadowedLauncherPath,
+        pathResolution,
+    };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.437",
+  "version": "0.1.0-alpha.439",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",