@ouro.bot/cli 0.1.0-alpha.440 → 0.1.0-alpha.442

package/changelog.json

@@ -1,6 +1,22 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.442",
+      "changes": [
+        "The shared CLI masthead now lands as a clean `OUROBOROS` wordmark instead of the older circle treatment, with compact/plain render paths trimmed down so the banner feels intentional rather than doubled or noisy.",
+        "The main human-facing screens now use warmer but more concrete first-run language: `ouro up`, the home screen, status, help, hatch, vault outcomes, and the connections screen now explain what Ouro is actually doing without leaning on unexplained `house` or `bay` metaphors.",
+        "Failed live provider checks in the connections screen now stay in the honest `needs attention` bucket instead of being downgraded to `needs credentials`, and hermetic runtime plus packaged-install coverage lock the wording into the shipped CLI."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.441",
+      "changes": [
+        "`ouro up` now lets the shared startup TUI own the masthead render path, so the screen no longer double-prints into scrollback and the shipped banner is a clean, correctly spelled classic `OUROBOROS` wordmark.",
+        "Vault unlock lookup now normalizes the canonical vault host while still reusing previously saved local unlock material from legacy vault coordinates, so a machine that already unlocked an agent vault does not get treated like it forgot after harmless vault-host drift.",
+        "macOS keychain read failures now surface as truthful local-store errors instead of being mislabeled as a locked vault, and new masthead/vault coverage plus packaged-install verification lock the fix into the shipped CLI."
+      ]
+    },
     {
       "version": "0.1.0-alpha.440",
       "changes": [

package/dist/heart/daemon/cli-exec.js

@@ -91,7 +91,6 @@ const agentic_repair_1 = require("./agentic-repair");
 const readiness_repair_1 = require("./readiness-repair");
 const human_readiness_1 = require("./human-readiness");
 const human_command_screens_1 = require("./human-command-screens");
-const terminal_ui_1 = require("./terminal-ui");
 const startup_tui_1 = require("./startup-tui");
 const stale_bundle_prune_1 = require("./stale-bundle-prune");
 const up_progress_1 = require("./up-progress");
@@ -1212,7 +1211,7 @@ async function executeVaultUnlock(command, deps) {
             {
                 title: "Next moves",
                 lines: [
-                    `Run ouro up to let the house retry ${command.agent}.`,
+                    `Run ouro up so Ouro can check ${command.agent} again.`,
                     `If credentials are still missing, run ouro auth --agent ${command.agent} --provider <provider>.`,
                 ],
             },
@@ -1282,7 +1281,7 @@ async function executeVaultCreate(command, deps) {
     ];
     return writeCommandOutcome(deps, {
         title: "Credential vault",
-        subtitle: `${command.agent} has a vault home now.`,
+        subtitle: `${command.agent}'s credential vault is ready.`,
         summary: `All raw credentials for ${command.agent} now live in this vault.`,
         sections: [
             {
@@ -1299,7 +1298,7 @@ async function executeVaultCreate(command, deps) {
                 title: "Next moves",
                 lines: [
                     `Authenticate the providers ${command.agent} should use with ouro auth --agent ${command.agent} --provider <provider>.`,
-                    `Then run ouro up so the house can bring ${command.agent} online.`,
+                    `Then run ouro up so Ouro can bring ${command.agent} online.`,
                 ],
             },
         ],
@@ -1494,7 +1493,7 @@ async function executeVaultRecover(command, deps) {
                 title: "Next moves",
                 lines: [
                     `Run ouro auth verify --agent ${command.agent} to re-check the stored providers.`,
-                    `Then run ouro up so the house can retry ${command.agent}.`,
+                    `Then run ouro up so Ouro can check ${command.agent} again.`,
                 ],
             },
         ],
@@ -2000,7 +1999,7 @@ async function buildConnectMenu(agent, deps, onProgress) {
         {
             option: "1",
             name: "Providers",
-            section: "Provider core",
+            section: "Providers",
             status: providerSummary.status,
             detailLines: providerSummary.detailLines,
             laneSummaries: providerSummary.laneSummaries,
@@ -2167,7 +2166,7 @@ async function executeConnectPerplexity(agent, deps) {
         ],
         nextMoves: [
             "Ask the agent to search.",
-            `Reopen the connect bay with ouro connect --agent ${agent} whenever you want to review capabilities.`,
+            `Reopen the connections screen with ouro connect --agent ${agent} whenever you want to review capabilities.`,
         ],
         fallbackLines: [
             `Perplexity connected for ${agent}`,
@@ -2248,7 +2247,7 @@ async function executeConnectEmbeddings(agent, deps) {
                 ],
                 nextMoves: [
                     `Rerun ouro connect embeddings --agent ${agent} with a working key.`,
-                    `Use ouro connect --agent ${agent} to review the rest of the capability bay.`,
+                    `Use ouro connect --agent ${agent} to review the rest of the connections screen.`,
                 ],
                 fallbackLines: [
                     `Embeddings key was saved for ${agent}, but the live check failed.`,
@@ -2277,7 +2276,7 @@ async function executeConnectEmbeddings(agent, deps) {
         ],
         nextMoves: [
             "Ask the agent to search notes or memory.",
-            `Reopen the connect bay with ouro connect --agent ${agent} whenever you want to review capabilities.`,
+            `Reopen the connections screen with ouro connect --agent ${agent} whenever you want to review capabilities.`,
         ],
         fallbackLines: [
             `Embeddings connected for ${agent}`,
@@ -2372,7 +2371,7 @@ async function executeConnectTeams(agent, deps) {
         ],
         nextMoves: [
             "Run ouro up so the daemon picks up the Teams sense change.",
-            `Reopen the connect bay with ouro connect --agent ${agent} whenever you want to review capabilities.`,
+            `Reopen the connections screen with ouro connect --agent ${agent} whenever you want to review capabilities.`,
         ],
         fallbackLines: [
             `Teams connected for ${agent}`,
@@ -3933,13 +3932,6 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
         }
         const linkedVersionBeforeUp = deps.getCurrentCliVersion?.() ?? null;
         const outputIsTTY = deps.isTTY ?? process.stdout.isTTY === true;
-        if (outputIsTTY && deps.writeRaw) {
-            deps.writeRaw(`${(0, terminal_ui_1.renderOuroMasthead)({
-                isTTY: true,
-                columns: deps.stdoutColumns ?? process.stdout.columns,
-                subtitle: "Preparing the house.",
-            }).trimEnd()}\n\n`);
-        }
         const progress = new up_progress_1.UpProgress({
             write: deps.writeRaw ?? deps.writeStdout,
             isTTY: outputIsTTY,
@@ -5387,7 +5379,7 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
             if (ttyBoardEnabled(deps)) {
                 deps.writeStdout(renderCommandBoard(deps, {
                     title: "Hatch an agent",
-                    subtitle: "Let’s bring a new agent into the house.",
+                    subtitle: "Let’s set up a new agent.",
                     summary: "Ouro will walk through the essentials, then hand the conversation to the specialist.",
                     sections: [
                         {
@@ -5438,7 +5430,7 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
                     lines: [
                         `Bundle: ${result.bundleRoot}`,
                         `Specialist identity: ${result.selectedIdentity}`,
-                        `House status: ${daemonResult.message}`,
+                        `Runtime status: ${daemonResult.message}`,
                     ],
                 },
                 {

package/dist/heart/daemon/cli-help.js

@@ -14,7 +14,7 @@ exports.getCommandHelp = getCommandHelp;
 exports.COMMAND_REGISTRY = {
     up: {
         category: "Lifecycle",
-        description: "Prepare the house: start the background runtime, refresh what this machine needs, and surface anything still asking for care. In a human TTY, bare `ouro` opens the home screen instead; noninteractive shells still route bare `ouro` to `ouro up`.",
+        description: "Start and check Ouro: bring up the background runtime, refresh what this machine needs, and show anything that still needs attention. In a human TTY, bare `ouro` opens the home screen instead; noninteractive shells still route bare `ouro` to `ouro up`.",
         usage: "ouro [up] [--no-repair]",
         example: "ouro up --no-repair",
     },
@@ -32,7 +32,7 @@ exports.COMMAND_REGISTRY = {
     },
     status: {
         category: "Lifecycle",
-        description: "Show the house status",
+        description: "Show Ouro status for this machine",
         usage: "ouro status",
         example: "ouro status",
     },
@@ -165,7 +165,7 @@ exports.COMMAND_REGISTRY = {
     },
     connect: {
         category: "Auth",
-        description: "Connect providers, portable integrations, and local senses from one guided bay",
+        description: "Set up providers, portable integrations, and local senses from one guided screen",
         usage: "ouro connect [providers|perplexity|embeddings|teams|bluebubbles] [--agent <name>]",
         example: "ouro connect",
         subcommands: ["providers", "perplexity", "embeddings", "teams", "bluebubbles"],
@@ -278,7 +278,7 @@ const SUBCOMMAND_HELP = {
         example: "ouro connect perplexity",
     },
     "connect providers": {
-        description: "Open provider auth from the connect bay without remembering the auth command",
+        description: "Open provider setup from the connections screen without remembering the auth command",
         usage: "ouro connect providers [--agent <name>]",
         example: "ouro connect providers",
     },

package/dist/heart/daemon/connect-bay.js

@@ -87,9 +87,8 @@ function resolveProviderHealthStatus(providerHealth) {
         return "needs setup";
     if (issue?.kind === "provider-credentials-missing")
         return "needs credentials";
-    if (issue?.kind === "provider-live-check-failed") {
-        return issue.actions[0]?.kind === "provider-auth" ? "needs credentials" : "needs attention";
-    }
+    if (issue?.kind === "provider-live-check-failed")
+        return "needs attention";
     const error = String(providerHealth.error).toLowerCase();
     const fix = String(providerHealth.fix).toLowerCase();
     if (error.includes("failed live check"))
@@ -169,8 +168,8 @@ function panel(title, body, width) {
     return lines;
 }
 function renderHeader(agent, width) {
-    return panel(`${agent} connect bay`, [
-        tty("Bring one capability online.", BONE, true),
+    return panel(`${agent} connections`, [
+        tty("Set up or review one capability at a time.", BONE, true),
         tty("Everything on this screen was checked live just now.", MIST),
     ], width);
 }
@@ -266,23 +265,23 @@ function renderTtyBay(entries, options) {
     const masthead = (0, terminal_ui_1.renderOuroMasthead)({
         isTTY: true,
         columns,
-        subtitle: "Bring one capability online at a time.",
+        subtitle: "Set up connections one step at a time.",
     }).trimEnd();
     const header = renderHeader(options.agent, fullWidth);
     const nextEntry = entries.find((entry) => isProblemStatus(entry.status));
-    const providerEntry = entries.find((entry) => entry.section === "Provider core");
+    const providerEntry = entries.find((entry) => entry.section === "Providers");
     const portableEntries = entries.filter((entry) => entry.section === "Portable");
     const machineEntries = entries.filter((entry) => entry.section === "This machine");
     const wide = columns >= 118;
     const footer = [
-        tty("Pick a path. Type the number or the name.", MIST),
+        tty("Choose a number, or type the capability name.", MIST),
         options.prompt,
     ];
     if (!wide) {
         const panels = [
             header,
-            panel("Next best move", nextMoveBody(nextEntry), fullWidth),
-            panel("Provider core", renderProviderBody(providerEntry, fullWidth), fullWidth),
+            panel("Recommended next step", nextMoveBody(nextEntry), fullWidth),
+            panel("Providers", renderProviderBody(providerEntry, fullWidth), fullWidth),
             panel("Portable", renderCapabilityBody(portableEntries, fullWidth), fullWidth),
             panel("This machine", renderCapabilityBody(machineEntries, fullWidth), fullWidth),
         ];
@@ -291,18 +290,18 @@ function renderTtyBay(entries, options) {
     const gap = 2;
     const leftWidth = Math.max(52, Math.floor((fullWidth - gap) / 2));
     const rightWidth = Math.max(40, fullWidth - gap - leftWidth);
-    const topRow = combineColumns(panel("Next best move", nextMoveBody(nextEntry), leftWidth), panel("This machine", renderCapabilityBody(machineEntries, rightWidth), rightWidth), leftWidth, rightWidth, gap);
-    const bottomRow = combineColumns(panel("Provider core", renderProviderBody(providerEntry, leftWidth), leftWidth), panel("Portable", renderCapabilityBody(portableEntries, rightWidth), rightWidth), leftWidth, rightWidth, gap);
+    const topRow = combineColumns(panel("Recommended next step", nextMoveBody(nextEntry), leftWidth), panel("This machine", renderCapabilityBody(machineEntries, rightWidth), rightWidth), leftWidth, rightWidth, gap);
+    const bottomRow = combineColumns(panel("Providers", renderProviderBody(providerEntry, leftWidth), leftWidth), panel("Portable", renderCapabilityBody(portableEntries, rightWidth), rightWidth), leftWidth, rightWidth, gap);
     return [masthead, "", ...header, "", ...topRow, "", ...bottomRow, "", ...footer].join("\n");
 }
 function renderNonTtyBay(entries, options) {
     const nextEntry = entries.find((entry) => isProblemStatus(entry.status));
     const lines = [
-        `${options.agent} connect bay`,
-        "Bring one capability online. Provider status was checked live just now.",
+        `${options.agent} connections`,
+        "Set up or review one capability at a time. Provider status was checked live just now.",
         "",
-        "Next best move",
-        "--------------",
+        "Recommended next step",
+        "---------------------",
     ];
     if (!nextEntry) {
         lines.push("Everything here is ready. Pick what you want to review or refresh.");
@@ -315,7 +314,7 @@ function renderNonTtyBay(entries, options) {
             lines.push(`run: ${nextEntry.nextAction}`);
     }
     lines.push("");
-    for (const section of ["Provider core", "Portable", "This machine"]) {
+    for (const section of ["Providers", "Portable", "This machine"]) {
         lines.push(section);
         lines.push("-".repeat(Math.max(6, section.length + 4)));
         for (const entry of entries.filter((candidate) => candidate.section === section)) {
@@ -338,7 +337,7 @@ function renderNonTtyBay(entries, options) {
     }
     lines.push("6. Not now");
     lines.push("");
-    lines.push("Pick a path. Type the number or the name.");
+    lines.push("Choose a number, or type the capability name.");
     lines.push(options.prompt);
     return lines.join("\n");
 }

package/dist/heart/daemon/human-command-screens.js

@@ -21,7 +21,7 @@ function renderScreenEvent(screen) {
 function buildOuroHomeActions(agents) {
     if (agents.length === 0) {
         return [
-            { key: "1", label: "Hatch a new agent", kind: "hatch", command: "ouro hatch" },
+            { key: "1", label: "Create a new agent", kind: "hatch", command: "ouro hatch" },
             { key: "2", label: "Clone an existing bundle", kind: "clone", command: "ouro clone <remote>" },
             { key: "3", label: "Show help", kind: "help", command: "ouro --help" },
             { key: "4", label: "Exit", kind: "exit", command: "exit" },
@@ -36,9 +36,9 @@ function buildOuroHomeActions(agents) {
     }));
     return [
         ...actions,
-        { key: String(actions.length + 1), label: "Prepare the house", kind: "up", command: "ouro up" },
-        { key: String(actions.length + 2), label: "Connect an agent", kind: "connect", command: "ouro connect --agent <agent>" },
-        { key: String(actions.length + 3), label: "Repair an agent", kind: "repair", command: "ouro repair --agent <agent>" },
+        { key: String(actions.length + 1), label: "Start or check Ouro", kind: "up", command: "ouro up" },
+        { key: String(actions.length + 2), label: "Set up connections", kind: "connect", command: "ouro connect --agent <agent>" },
+        { key: String(actions.length + 3), label: "Fix setup issues", kind: "repair", command: "ouro repair --agent <agent>" },
         { key: String(actions.length + 4), label: "Show help", kind: "help", command: "ouro --help" },
         { key: String(actions.length + 5), label: "Exit", kind: "exit", command: "exit" },
     ];
@@ -60,10 +60,10 @@ function renderOuroHomeScreen(options) {
     const actions = buildOuroHomeActions(options.agents);
     const sections = [
         {
-            title: options.agents.length === 0 ? "Start here" : "Around the house",
+            title: options.agents.length === 0 ? "Start here" : "Available agents",
             lines: options.agents.length === 0
-                ? ["No agents are home yet. Hatch someone new or bring an existing bundle aboard."]
-                : options.agents.map((agent) => `${agent} is home and ready when called.`),
+                ? ["No agents are set up on this machine yet."]
+                : options.agents.map((agent) => `${agent} is available.`),
         },
     ];
     const actionRows = actions.map((action, index) => ({
@@ -77,13 +77,13 @@ function renderOuroHomeScreen(options) {
         columns: options.columns,
         masthead: {
             subtitle: options.agents.length === 0
-                ? "No agents are home yet."
-                : "Welcome home.",
+                ? "No agents are set up on this machine yet."
+                : "Choose an agent or a setup task.",
         },
         title: "Ouro home",
         summary: options.agents.length === 0
-            ? "Hatch someone new or bring an existing bundle aboard."
-            : "Choose who to wake or what to prepare without memorizing commands.",
+            ? "Create a new agent or clone an existing bundle to get started."
+            : "Choose an agent or a setup task without memorizing commands.",
         sections,
         actions: actionRows,
         prompt: `Choose [1-${actions.length}] or type a name: `,
@@ -159,7 +159,7 @@ function renderHouseStatusScreen(options) {
     renderScreenEvent("house-status");
     const sections = [
         {
-            title: "House pulse",
+            title: "Runtime",
             lines: [
                 `Daemon: ${options.payload.overview.daemon}`,
                 `Health: ${options.payload.overview.health}`,
@@ -226,9 +226,9 @@ function renderHouseStatusScreen(options) {
         });
     }
     return renderHumanCommandBoard({
-        title: "House status",
-        subtitle: "The house is awake enough to answer clearly.",
-        summary: "What is awake, resting, or asking for care.",
+        title: "Ouro status",
+        subtitle: "Current runtime status for this machine.",
+        summary: "What is running, what is stopped, and what needs attention.",
         isTTY: options.isTTY,
         columns: options.columns,
         sections,

package/dist/heart/daemon/terminal-ui.js

@@ -17,6 +17,14 @@ const GLOW = "\x1b[38;2;74;227;108m";
 const BONE = "\x1b[38;2;237;242;238m";
 const MIST = "\x1b[38;2;154;174;159m";
 const ANSI_RE = /\x1b\[[0-9;]*m/g;
+const MASTHEAD_WORD = "OUROBOROS";
+const CLASSIC_WORDMARK_GLYPHS = {
+    O: ["  ___  ", " / _ \\ ", "| | | |", "| |_| |", " \\___/ "],
+    U: [" _   _ ", "| | | |", "| | | |", "| |_| |", " \\___/ "],
+    R: [" ____  ", "|  _ \\ ", "| |_) |", "|  _ < ", "|_| \\_\\"],
+    B: [" ____  ", "| __ ) ", "|  _ \\ ", "| |_) |", "|____/ "],
+    S: [" ____  ", "/ ___| ", "\\___ \\ ", " ___) |", "|____/ "],
+};
 function color(text, tone, bold = false) {
     if (!text)
         return text;
@@ -87,37 +95,26 @@ function renderPanelPlain(title, lines) {
 }
 function mastheadArt(columns) {
     if ((columns ?? 88) >= 74) {
-        return [
-            "              .----------------------------.",
-            "          .--'    O U R O B O R O S        '--.",
-            "        .'       .--------------------.       '.",
-            "       /        /  .--------------.   \\        \\",
-            "       \\        \\  '--------------'   /        /",
-            "        '.       '--------------------'      .'",
-            "          '--._                          _.--'",
-            "               '------------------------'",
-        ];
+        const rows = Array.from({ length: 5 }, () => []);
+        for (const letter of MASTHEAD_WORD.split("")) {
+            const glyph = CLASSIC_WORDMARK_GLYPHS[letter];
+            for (const [index, line] of glyph.entries()) {
+                rows[index].push(line);
+            }
+        }
+        return rows.map((row) => row.join(" "));
     }
-    return [
-        "  O U R O B O R O S",
-        "  -----------------",
-    ];
+    return [MASTHEAD_WORD];
 }
 function renderOuroMasthead(options) {
-    const lines = mastheadArt(options.columns);
-    const subtitle = options.subtitle ?? "the house wakes when called";
-    const branded = [
-        ...lines,
-        "OUROBOROS",
-        subtitle,
-    ];
+    const lines = options.isTTY ? mastheadArt(options.columns) : [MASTHEAD_WORD];
+    const branded = options.subtitle ? [...lines, options.subtitle] : lines;
     if (!options.isTTY) {
         return `${branded.join("\n")}\n`;
     }
     const ttyLines = [
         ...lines.map((line, index) => color(line, index < 2 ? GLOW : SCALE, true)),
-        color("OUROBOROS", BONE, true),
-        color(subtitle, MIST),
+        ...(options.subtitle ? [color(options.subtitle, MIST)] : []),
     ];
     return `${ttyLines.join("\n")}\n`;
 }

package/dist/heart/daemon/up-progress.js

@@ -296,10 +296,10 @@ class UpProgress {
             isTTY: true,
             columns: this.columns,
             masthead: {
-                subtitle: "Preparing the house.",
+                subtitle: "Starting the local agent runtime.",
             },
-            title: "Preparing the house",
-            summary: "Ouro is warming the background systems and checking what still needs care before anyone steps in.",
+            title: "Starting Ouro",
+            summary: "Ouro is starting the background runtime, checking credentials, and surfacing anything that needs attention before chat begins.",
             currentStep: {
                 label: currentStepLabel,
                 detailLines: currentStepDetails,

package/dist/heart/identity.js

@@ -33,7 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HARNESS_CANONICAL_REPO_URL = exports.DEFAULT_AGENT_SENSES = exports.DEFAULT_VAULT_SERVER_URL = exports.DEFAULT_AGENT_PHRASES = exports.DEFAULT_AGENT_CONTEXT = exports.PROVIDER_CREDENTIALS = void 0;
+exports.HARNESS_CANONICAL_REPO_URL = exports.DEFAULT_AGENT_SENSES = exports.LEGACY_VAULT_SERVER_URL_ALIASES = exports.DEFAULT_VAULT_SERVER_URL = exports.DEFAULT_AGENT_PHRASES = exports.DEFAULT_AGENT_CONTEXT = exports.PROVIDER_CREDENTIALS = void 0;
+exports.normalizeVaultServerUrl = normalizeVaultServerUrl;
+exports.getVaultServerUrlCandidates = getVaultServerUrlCandidates;
 exports.defaultStableVaultEmail = defaultStableVaultEmail;
 exports.resolveVaultConfig = resolveVaultConfig;
 exports.normalizeSenses = normalizeSenses;
@@ -77,6 +79,40 @@ exports.DEFAULT_AGENT_PHRASES = {
     followup: ["processing"],
 };
 exports.DEFAULT_VAULT_SERVER_URL = "https://vault.ouroboros.bot";
+exports.LEGACY_VAULT_SERVER_URL_ALIASES = [
+    "https://vault.ouro.bot",
+    "https://ouro-vault.gentleflower-74452a1e.eastus2.azurecontainerapps.io",
+];
+function normalizeVaultServerUrl(serverUrl) {
+    const trimmed = serverUrl.trim();
+    const withoutTrailingSlash = trimmed.replace(/\/+$/, "");
+    if (!withoutTrailingSlash) {
+        return exports.DEFAULT_VAULT_SERVER_URL;
+    }
+    if (exports.LEGACY_VAULT_SERVER_URL_ALIASES.includes(withoutTrailingSlash)) {
+        return exports.DEFAULT_VAULT_SERVER_URL;
+    }
+    return withoutTrailingSlash;
+}
+function getVaultServerUrlCandidates(serverUrl) {
+    const raw = serverUrl.trim();
+    const withoutTrailingSlash = raw.replace(/\/+$/, "");
+    const normalized = normalizeVaultServerUrl(serverUrl);
+    const candidates = [normalized];
+    for (const candidate of [withoutTrailingSlash, raw]) {
+        if (candidate && !candidates.includes(candidate)) {
+            candidates.push(candidate);
+        }
+    }
+    if (normalized === exports.DEFAULT_VAULT_SERVER_URL) {
+        for (const alias of exports.LEGACY_VAULT_SERVER_URL_ALIASES) {
+            if (!candidates.includes(alias)) {
+                candidates.push(alias);
+            }
+        }
+    }
+    return candidates;
+}
 function defaultStableVaultEmail(agentName) {
     const local = agentName
         .toLowerCase()
@@ -91,7 +127,7 @@ function defaultStableVaultEmail(agentName) {
 function resolveVaultConfig(agentName, config) {
     return {
         email: config?.email ?? defaultStableVaultEmail(agentName),
-        serverUrl: config?.serverUrl ?? exports.DEFAULT_VAULT_SERVER_URL,
+        serverUrl: normalizeVaultServerUrl(config?.serverUrl ?? exports.DEFAULT_VAULT_SERVER_URL),
     };
 }
 exports.DEFAULT_AGENT_SENSES = {

package/dist/repertoire/vault-unlock.js

@@ -48,6 +48,7 @@ const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
 const runtime_1 = require("../nerves/runtime");
+const identity_1 = require("../heart/identity");
 const VAULT_UNLOCK_SERVICE = "ouro.vault";
 const CREDENTIAL_VAULT_NOT_CONFIGURED_PREFIX = "credential vault is not configured in ";
 const PLAINTEXT_UNLOCK_DIR = path.join(".ouro-cli", "vault-unlock");
@@ -68,6 +69,19 @@ function vaultKey(config) {
 function vaultLabel(config) {
     return `${config.email} at ${config.serverUrl}`;
 }
+function canonicalizeVaultUnlockConfig(config) {
+    return {
+        ...config,
+        serverUrl: (0, identity_1.normalizeVaultServerUrl)(config.serverUrl),
+    };
+}
+function vaultConfigCandidates(config) {
+    const canonical = canonicalizeVaultUnlockConfig(config);
+    return (0, identity_1.getVaultServerUrlCandidates)(config.serverUrl).map((serverUrl) => ({
+        ...canonical,
+        serverUrl,
+    }));
+}
 function plaintextUnlockPath(config, deps) {
     const digest = crypto.createHash("sha256").update(vaultKey(config)).digest("hex").slice(0, 24);
     return path.join(homeDir(deps), PLAINTEXT_UNLOCK_DIR, `${digest}.secret`);
@@ -179,6 +193,7 @@ function validateStoreKind(store) {
     return requested;
 }
 function resolveVaultUnlockStore(config, deps = {}) {
+    const canonicalConfig = canonicalizeVaultUnlockConfig(config);
     const requested = validateStoreKind(deps.store);
     const currentPlatform = platform(deps);
     if (requested === "macos-keychain") {
@@ -200,33 +215,89 @@ function resolveVaultUnlockStore(config, deps = {}) {
         if (currentPlatform !== "win32") {
             throw new Error(`windows-dpapi unlock store is only available on Windows; this machine is ${currentPlatform}.`);
         }
-        return { kind: "windows-dpapi", secure: true, location: windowsDpapiUnlockPath(config, deps) };
+        return { kind: "windows-dpapi", secure: true, location: windowsDpapiUnlockPath(canonicalConfig, deps) };
     }
     if (requested === "plaintext-file") {
-        return { kind: "plaintext-file", secure: false, location: plaintextUnlockPath(config, deps) };
+        return { kind: "plaintext-file", secure: false, location: plaintextUnlockPath(canonicalConfig, deps) };
     }
     if (currentPlatform === "darwin") {
         return { kind: "macos-keychain", secure: true, location: "macOS Keychain" };
     }
     if (currentPlatform === "win32") {
-        return { kind: "windows-dpapi", secure: true, location: windowsDpapiUnlockPath(config, deps) };
+        return { kind: "windows-dpapi", secure: true, location: windowsDpapiUnlockPath(canonicalConfig, deps) };
     }
     if (currentPlatform === "linux" && commandExists("secret-tool", deps)) {
         return { kind: "linux-secret-service", secure: true, location: "Secret Service via secret-tool" };
     }
-    throw new Error(missingSecureStoreMessage(config));
+    throw new Error(missingSecureStoreMessage(canonicalConfig));
 }
-function readFromMacosKeychain(config, deps) {
+function readFromMacosKeychainExact(accountKey, deps) {
     const result = spawnSync(deps)("security", [
         "find-generic-password",
         "-s",
         VAULT_UNLOCK_SERVICE,
         "-a",
-        vaultKey(config),
+        accountKey,
         "-w",
     ], { encoding: "utf8" });
     const secret = typeof result.stdout === "string" ? result.stdout.trim() : "";
-    return result.status === 0 && secret ? secret : null;
+    if (result.status === 0) {
+        return secret || null;
+    }
+    const stderr = typeof result.stderr === "string" ? result.stderr.trim() : "";
+    const error = result.error instanceof Error ? result.error.message : "";
+    const detail = stderr || error;
+    if (!detail || /could not be found in the keychain/i.test(detail)) {
+        return null;
+    }
+    throw new Error(`failed to read vault unlock secret from macOS Keychain: ${detail}`);
+}
+function noteVaultUnlockSelfHeal(config, storeKind, sourceServerUrl) {
+    (0, runtime_1.emitNervesEvent)({
+        component: "repertoire",
+        event: "repertoire.vault_unlock_self_healed",
+        message: "rewrote local unlock material using canonical vault coordinates",
+        meta: {
+            store: storeKind,
+            email: config.email,
+            sourceServerUrl,
+            targetServerUrl: config.serverUrl,
+        },
+    });
+}
+function warnVaultUnlockSelfHealFailure(config, storeKind, sourceServerUrl, error) {
+    (0, runtime_1.emitNervesEvent)({
+        level: "warn",
+        component: "repertoire",
+        event: "repertoire.vault_unlock_self_heal_failed",
+        message: "failed to rewrite local unlock material using canonical vault coordinates",
+        meta: {
+            store: storeKind,
+            email: config.email,
+            sourceServerUrl,
+            targetServerUrl: config.serverUrl,
+            error: error instanceof Error ? error.message : String(error),
+        },
+    });
+}
+function readFromMacosKeychain(config, deps) {
+    const candidates = vaultConfigCandidates(config);
+    for (const [index, candidate] of candidates.entries()) {
+        const secret = readFromMacosKeychainExact(vaultKey(candidate), deps);
+        if (!secret)
+            continue;
+        if (index > 0) {
+            try {
+                writeToMacosKeychain(config, secret, deps);
+                noteVaultUnlockSelfHeal(config, "macos-keychain", candidate.serverUrl);
+            }
+            catch (error) {
+                warnVaultUnlockSelfHealFailure(config, "macos-keychain", candidate.serverUrl, error);
+            }
+        }
+        return secret;
+    }
+    return null;
 }
 function writeToMacosKeychain(config, secret, deps) {
     const result = spawnSync(deps)("security", [
@@ -244,16 +315,44 @@ function writeToMacosKeychain(config, secret, deps) {
         throw new Error(`failed to store vault unlock secret in macOS Keychain${stderr ? `: ${stderr}` : ""}`);
     }
 }
-function readFromLinuxSecretService(config, deps) {
+function readFromLinuxSecretServiceExact(accountKey, deps) {
     const result = spawnSync(deps)("secret-tool", [
         "lookup",
         "service",
         VAULT_UNLOCK_SERVICE,
         "account",
-        vaultKey(config),
+        accountKey,
     ], { encoding: "utf8" });
     const secret = typeof result.stdout === "string" ? result.stdout.trim() : "";
-    return result.status === 0 && secret ? secret : null;
+    if (result.status === 0) {
+        return secret || null;
+    }
+    const stderr = typeof result.stderr === "string" ? result.stderr.trim() : "";
+    const error = result.error instanceof Error ? result.error.message : "";
+    const detail = stderr || error;
+    if (!detail || /not found/i.test(detail)) {
+        return null;
+    }
+    throw new Error(`failed to read vault unlock secret from Linux Secret Service: ${detail}`);
+}
+function readFromLinuxSecretService(config, deps) {
+    const candidates = vaultConfigCandidates(config);
+    for (const [index, candidate] of candidates.entries()) {
+        const secret = readFromLinuxSecretServiceExact(vaultKey(candidate), deps);
+        if (!secret)
+            continue;
+        if (index > 0) {
+            try {
+                writeToLinuxSecretService(config, secret, deps);
+                noteVaultUnlockSelfHeal(config, "linux-secret-service", candidate.serverUrl);
+            }
+            catch (error) {
+                warnVaultUnlockSelfHealFailure(config, "linux-secret-service", candidate.serverUrl, error);
+            }
+        }
+        return secret;
+    }
+    return null;
 }
 function writeToLinuxSecretService(config, secret, deps) {
     const result = spawnSync(deps)("secret-tool", [
@@ -306,7 +405,7 @@ if ($payload.mode -eq "protect") {
     }
     return typeof result.stdout === "string" ? result.stdout : "";
 }
-function readFromWindowsDpapi(config, deps) {
+function readFromWindowsDpapiExact(config, deps) {
     const filePath = windowsDpapiUnlockPath(config, deps);
     if (!fs.existsSync(filePath))
         return null;
@@ -316,13 +415,32 @@ function readFromWindowsDpapi(config, deps) {
     const secret = runWindowsDpapi("unprotect", { ciphertext }, deps).trim();
     return secret || null;
 }
+function readFromWindowsDpapi(config, deps) {
+    const candidates = vaultConfigCandidates(config);
+    for (const [index, candidate] of candidates.entries()) {
+        const secret = readFromWindowsDpapiExact(candidate, deps);
+        if (!secret)
+            continue;
+        if (index > 0) {
+            try {
+                writeToWindowsDpapi(config, secret, deps);
+                noteVaultUnlockSelfHeal(config, "windows-dpapi", candidate.serverUrl);
+            }
+            catch (error) {
+                warnVaultUnlockSelfHealFailure(config, "windows-dpapi", candidate.serverUrl, error);
+            }
+        }
+        return secret;
+    }
+    return null;
+}
 function writeToWindowsDpapi(config, secret, deps) {
     const filePath = windowsDpapiUnlockPath(config, deps);
     const ciphertext = runWindowsDpapi("protect", { secret }, deps).trim();
     fs.mkdirSync(path.dirname(filePath), { recursive: true });
     fs.writeFileSync(filePath, `${ciphertext}\n`, "utf8");
 }
-function readFromPlaintextFile(config, deps) {
+function readFromPlaintextFileExact(config, deps) {
     const filePath = plaintextUnlockPath(config, deps);
     if (!fs.existsSync(filePath))
         return null;
@@ -335,6 +453,25 @@ function readFromPlaintextFile(config, deps) {
     const secret = fs.readFileSync(filePath, "utf8").trim();
     return secret || null;
 }
+function readFromPlaintextFile(config, deps) {
+    const candidates = vaultConfigCandidates(config);
+    for (const [index, candidate] of candidates.entries()) {
+        const secret = readFromPlaintextFileExact(candidate, deps);
+        if (!secret)
+            continue;
+        if (index > 0) {
+            try {
+                writeToPlaintextFile(config, secret, deps);
+                noteVaultUnlockSelfHeal(config, "plaintext-file", candidate.serverUrl);
+            }
+            catch (error) {
+                warnVaultUnlockSelfHealFailure(config, "plaintext-file", candidate.serverUrl, error);
+            }
+        }
+        return secret;
+    }
+    return null;
+}
 function writeToPlaintextFile(config, secret, deps) {
     const filePath = plaintextUnlockPath(config, deps);
     fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
@@ -369,10 +506,11 @@ function writeToStore(config, store, secret, deps) {
     writeToPlaintextFile(config, secret, deps);
 }
 function readVaultUnlockSecret(config, deps = {}) {
-    const store = resolveVaultUnlockStore(config, deps);
-    const secret = readFromStore(config, store, deps);
+    const canonicalConfig = canonicalizeVaultUnlockConfig(config);
+    const store = resolveVaultUnlockStore(canonicalConfig, deps);
+    const secret = readFromStore(canonicalConfig, store, deps);
     if (!secret) {
-        throw new Error(lockedMessage(config, store));
+        throw new Error(lockedMessage(canonicalConfig, store));
     }
     (0, runtime_1.emitNervesEvent)({
         component: "repertoire",
@@ -383,12 +521,13 @@ function readVaultUnlockSecret(config, deps = {}) {
     return { secret, store };
 }
 function storeVaultUnlockSecret(config, secret, deps = {}) {
+    const canonicalConfig = canonicalizeVaultUnlockConfig(config);
     const trimmed = secret.trim();
     if (!trimmed) {
         throw new Error("vault unlock secret is required");
     }
-    const store = resolveVaultUnlockStore(config, deps);
-    writeToStore(config, store, trimmed, deps);
+    const store = resolveVaultUnlockStore(canonicalConfig, deps);
+    writeToStore(canonicalConfig, store, trimmed, deps);
     (0, runtime_1.emitNervesEvent)({
         component: "repertoire",
         event: "repertoire.vault_unlock_stored",
@@ -399,15 +538,16 @@ function storeVaultUnlockSecret(config, secret, deps = {}) {
 }
 function getVaultUnlockStatus(config, deps = {}) {
     try {
-        const store = resolveVaultUnlockStore(config, deps);
-        const stored = !!readFromStore(config, store, deps);
+        const canonicalConfig = canonicalizeVaultUnlockConfig(config);
+        const store = resolveVaultUnlockStore(canonicalConfig, deps);
+        const stored = !!readFromStore(canonicalConfig, store, deps);
         return {
             configured: true,
             stored,
             store,
             fix: stored
                 ? "Vault unlock secret is available on this machine."
-                : lockedMessage(config, store),
+                : lockedMessage(canonicalConfig, store),
         };
     }
     catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.440",
+  "version": "0.1.0-alpha.442",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",