@ouro.bot/cli 0.1.0-alpha.52 → 0.1.0-alpha.521

package/dist/heart/{daemon → hatch}/specialist-prompt.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildSpecialistSystemPrompt = buildSpecialistSystemPrompt;
 const runtime_1 = require("../../nerves/runtime");
 /**
- * Build the adoption specialist's system prompt from its components.
+ * Build the serpent guide's system prompt from its components.
  * The prompt is written in first person (the specialist's own voice).
  */
 function buildSpecialistSystemPrompt(soulText, identityText, existingBundles, context) {
@@ -31,7 +31,7 @@ function buildSpecialistSystemPrompt(soulText, identityText, existingBundles, co
         "I am one of thirteen serpent guides who help humans hatch their first agent. The system randomly selected me for this session.",
         "Most humans only go through this process once, so this is likely the only time they'll meet me.",
         "I make this encounter count — warm, memorable, and uniquely mine.",
-        "IMPORTANT: I NEVER refer to myself as an 'adoption specialist' or use the words 'adoption specialist' — those are internal implementation labels, not something the human should ever see. I introduce myself by my own name from my identity.",
+        "IMPORTANT: I NEVER refer to myself by internal implementation labels — I introduce myself by my own name from my identity.",
         "",
         "## Voice rules",
         "IMPORTANT: I keep every response to 1-3 short sentences. I sound like a friend texting, not a manual.",
@@ -44,7 +44,7 @@ function buildSpecialistSystemPrompt(soulText, identityText, existingBundles, co
         `Provider: ${context.provider}`,
         `Temp directory: ${context.tempDir}`,
         "Final home: ~/AgentBundles/<Name>.ouro/",
-        "Secrets: ~/.agentsecrets/<name>/secrets.json",
+        "Provider credentials: the hatch tool stores them in the agent's vault.",
     ].join("\n"));
     sections.push([
         "## Bundle creation guidelines",
@@ -59,8 +59,10 @@ function buildSpecialistSystemPrompt(soulText, identityText, existingBundles, co
         "It also needs an **agent.json** with at minimum:",
         '```json',
         '{',
+        '  "version": 2,',
         '  "name": "AgentName",',
-        `  "provider": "${context.provider}",`,
+        `  "humanFacing": { "provider": "${context.provider}", "model": "${context.model}" },`,
+        `  "agentFacing": { "provider": "${context.provider}", "model": "${context.model}" },`,
         '  "enabled": true',
         '}',
         '```',
@@ -82,18 +84,19 @@ function buildSpecialistSystemPrompt(soulText, identityText, existingBundles, co
         "2. I write agent.json to the temp directory using write_file",
         "3. I suggest a PascalCase name for the hatchling and confirm with the human",
         "4. I call complete_adoption with the name and a warm handoff message",
-        "5. I call final_answer to end the session",
+        "5. I call settle to end the session",
     ].join("\n"));
     sections.push([
         "## Tools",
         "- `write_file`: Write a file to disk. Use this to write psyche files and agent.json to the temp directory.",
         "- `read_file`: Read a file from disk. Useful for reviewing existing agent bundles or migration sources.",
         "- `list_directory`: List directory contents. Useful for exploring existing agent bundles.",
-        "- I also have the normal local harness tools when useful here, including `shell`, `ouro task create`, `ouro reminder create`, memory tools, coding tools, and repo helpers.",
-        "- `complete_adoption`: Finalize the bundle. Validates, scaffolds structural dirs, moves to ~/AgentBundles/, writes secrets, plays hatch animation. I call this with `name` (PascalCase) and `handoff_message` (warm message for the human).",
-        "- `final_answer`: End the conversation with a final message. I call this after complete_adoption succeeds.",
+        "- I also have the normal local harness tools when useful here, including `shell`, `ouro task create`, `ouro reminder create`, note tools, coding tools, and repo helpers.",
+        "- `complete_adoption`: Finalize the bundle. Validates, asks the harness to collect and confirm the hatchling vault unlock secret through hidden terminal prompts, scaffolds structural dirs, moves to ~/AgentBundles/, writes secrets, plays hatch animation. I call this with `name` (PascalCase) and `handoff_message` (warm message for the human).",
+        "- The complete_adoption tool triggers hidden terminal prompts for the hatchling vault unlock secret. I must never ask the human to type the vault unlock secret into chat, and I must never include it in tool arguments.",
+        "- `settle`: End the conversation with a final message. I call this after complete_adoption succeeds.",
         "",
-        "I must call `final_answer` when I am done to end the session cleanly.",
+        "I must call `settle` when I am done to end the session cleanly.",
     ].join("\n"));
     return sections.join("\n\n");
 }

package/dist/heart/{daemon → hatch}/specialist-tools.js

@@ -35,19 +35,21 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getSpecialistTools = getSpecialistTools;
 exports.createSpecialistExecTool = createSpecialistExecTool;
-const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const tools_base_1 = require("../../repertoire/tools-base");
 const hatch_flow_1 = require("./hatch-flow");
 const hatch_animation_1 = require("./hatch-animation");
 const bundle_manifest_1 = require("../../mind/bundle-manifest");
+const identity_1 = require("../identity");
 const runtime_1 = require("../../nerves/runtime");
+const vault_setup_1 = require("../../repertoire/vault-setup");
+const vault_unlock_1 = require("../../repertoire/vault-unlock");
 const completeAdoptionTool = {
     type: "function",
     function: {
         name: "complete_adoption",
-        description: "finalize the agent bundle and hatch the new agent. call this only when you have written all 5 psyche files and agent.json to the temp directory, and the human has approved the bundle.",
+        description: "finalize the agent bundle and hatch the new agent. call this only when you have written all 5 psyche files and agent.json to the temp directory, and the human has approved the bundle. tool execution asks the human for the hatchling vault unlock secret through a hidden terminal prompt; do not ask for or include vault unlock secrets in chat or tool args.",
         parameters: {
             type: "object",
             properties: {
@@ -90,7 +92,7 @@ const listDirToolSchema = {
  * Returns the specialist's tool schema array.
  */
 function getSpecialistTools() {
-    return [completeAdoptionTool, tools_base_1.finalAnswerTool, readFileTool.tool, writeFileTool.tool, listDirToolSchema];
+    return [completeAdoptionTool, tools_base_1.settleTool, readFileTool.tool, writeFileTool.tool, listDirToolSchema];
 }
 const PSYCHE_FILES = ["SOUL.md", "IDENTITY.md", "LORE.md", "TACIT.md", "ASPIRATIONS.md"];
 function isPascalCase(name) {
@@ -105,21 +107,21 @@ function writeReadme(dir, purpose) {
     }
 }
 function scaffoldBundle(bundleRoot) {
-    writeReadme(path.join(bundleRoot, "memory"), "Persistent memory store.");
-    writeReadme(path.join(bundleRoot, "memory", "daily"), "Daily memory entries.");
-    writeReadme(path.join(bundleRoot, "memory", "archive"), "Archived memory.");
+    writeReadme(path.join(bundleRoot, "notes"), "Persistent notes store.");
+    writeReadme(path.join(bundleRoot, "notes", "daily"), "Daily note entries.");
+    writeReadme(path.join(bundleRoot, "notes", "archive"), "Archived notes.");
     writeReadme(path.join(bundleRoot, "friends"), "Known friend records.");
     writeReadme(path.join(bundleRoot, "tasks"), "Task files.");
-    writeReadme(path.join(bundleRoot, "tasks", "habits"), "Recurring tasks.");
     writeReadme(path.join(bundleRoot, "tasks", "one-shots"), "One-shot tasks.");
+    writeReadme(path.join(bundleRoot, "habits"), "Recurring habits and autonomous rhythms.");
     writeReadme(path.join(bundleRoot, "tasks", "ongoing"), "Ongoing tasks.");
     writeReadme(path.join(bundleRoot, "skills"), "Local skill files.");
     writeReadme(path.join(bundleRoot, "senses"), "Sense-specific config.");
     writeReadme(path.join(bundleRoot, "senses", "teams"), "Teams sense config.");
-    // Memory scaffold files
-    const memoryRoot = path.join(bundleRoot, "memory");
-    const factsPath = path.join(memoryRoot, "facts.jsonl");
-    const entitiesPath = path.join(memoryRoot, "entities.json");
+    // Notes scaffold files
+    const notesRoot = path.join(bundleRoot, "notes");
+    const factsPath = path.join(notesRoot, "facts.jsonl");
+    const entitiesPath = path.join(notesRoot, "entities.json");
     /* v8 ignore next -- defensive: guard against re-scaffold on existing bundle @preserve */
     if (!fs.existsSync(factsPath))
         fs.writeFileSync(factsPath, "", "utf-8");
@@ -166,13 +168,34 @@ async function execCompleteAdoption(args, deps) {
     if (fs.existsSync(targetBundle)) {
         return `error: bundle '${name}.ouro' already exists at ${deps.bundlesRoot}. choose a different name.`;
     }
+    if (!deps.promptSecret) {
+        return "error: complete_adoption requires an interactive vault unlock secret prompt. Re-run `ouro hatch` in a terminal so the human can enter a hatchling vault unlock secret without echoing it.";
+    }
+    const vault = (0, identity_1.resolveVaultConfig)(name);
+    let vaultUnlockSecret;
+    try {
+        vaultUnlockSecret = await (0, vault_unlock_1.promptConfirmedVaultUnlockSecret)({
+            promptSecret: deps.promptSecret,
+            question: `Choose Ouro vault unlock secret for ${vault.email}: `,
+            confirmQuestion: `Confirm Ouro vault unlock secret for ${vault.email}: `,
+            emptyError: "hatchling vault creation requires an unlock secret. Re-run `ouro hatch` in an interactive terminal and enter a human-chosen unlock secret.",
+        });
+    }
+    catch (error) {
+        return `error: failed to read hatchling vault unlock secret: ${error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error)}`;
+    }
     // Scaffold structural dirs into tempDir
     scaffoldBundle(deps.tempDir);
     // Move tempDir -> final bundle location
     moveDir(deps.tempDir, targetBundle);
     // Write secrets
     try {
-        (0, hatch_flow_1.writeSecretsFile)(name, deps.provider, deps.credentials, deps.secretsRoot);
+        const vaultResult = await (0, vault_setup_1.createVaultAccount)(name, vault.serverUrl, vault.email, vaultUnlockSecret);
+        if (!vaultResult.success) {
+            throw new Error(`failed to create vault: ${vaultResult.error}`);
+        }
+        (0, vault_unlock_1.storeVaultUnlockSecret)({ agentName: name, email: vault.email, serverUrl: vault.serverUrl }, vaultUnlockSecret);
+        await (0, hatch_flow_1.storeHatchlingProviderCredentials)(name, deps.provider, deps.credentials);
     }
     catch (e) {
         // Rollback: remove the moved bundle

package/dist/heart/identity.js

@@ -33,14 +33,25 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_AGENT_SENSES = exports.DEFAULT_AGENT_PHRASES = exports.DEFAULT_AGENT_CONTEXT = void 0;
+exports.HARNESS_CANONICAL_REPO_URL = exports.DEFAULT_AGENT_SENSES = exports.LEGACY_VAULT_SERVER_URL_ALIASES = exports.DEFAULT_VAULT_SERVER_URL = exports.DEFAULT_AGENT_PHRASES = exports.DEFAULT_AGENT_CONTEXT = exports.PROVIDER_CREDENTIALS = void 0;
+exports.normalizeVaultServerUrl = normalizeVaultServerUrl;
+exports.getVaultServerUrlCandidates = getVaultServerUrlCandidates;
+exports.defaultStableVaultEmail = defaultStableVaultEmail;
+exports.resolveVaultConfig = resolveVaultConfig;
+exports.normalizeSenses = normalizeSenses;
 exports.buildDefaultAgentTemplate = buildDefaultAgentTemplate;
 exports.getAgentName = getAgentName;
 exports.getRepoRoot = getRepoRoot;
 exports.getAgentBundlesRoot = getAgentBundlesRoot;
 exports.getAgentRoot = getAgentRoot;
 exports.getAgentStateRoot = getAgentStateRoot;
-exports.getAgentSecretsPath = getAgentSecretsPath;
+exports.getAgentRepoWorkspacesRoot = getAgentRepoWorkspacesRoot;
+exports.getAgentDaemonStateRoot = getAgentDaemonStateRoot;
+exports.getAgentDaemonLogsDir = getAgentDaemonLogsDir;
+exports.getAgentDaemonLoggingConfigPath = getAgentDaemonLoggingConfigPath;
+exports.getAgentMessagesRoot = getAgentMessagesRoot;
+exports.getAgentMailroomRoot = getAgentMailroomRoot;
+exports.getAgentToolsRoot = getAgentToolsRoot;
 exports.loadAgentConfig = loadAgentConfig;
 exports.setAgentName = setAgentName;
 exports.setAgentConfigOverride = setAgentConfigOverride;
@@ -50,6 +61,15 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const runtime_1 = require("../nerves/runtime");
+const migrate_config_1 = require("./migrate-config");
+/** Single source of truth for per-provider credential field names, env var mappings, and prompt labels. */
+exports.PROVIDER_CREDENTIALS = {
+    anthropic: { required: ["setupToken"], envVars: { ANTHROPIC_API_KEY: "setupToken" }, promptLabels: { setupToken: "Anthropic setup-token" } },
+    "openai-codex": { required: ["oauthAccessToken"], envVars: { OPENAI_API_KEY: "oauthAccessToken" }, promptLabels: { oauthAccessToken: "OpenAI Codex OAuth token" } },
+    azure: { required: ["apiKey", "endpoint", "deployment"], envVars: { AZURE_OPENAI_API_KEY: "apiKey", AZURE_OPENAI_KEY: "apiKey", AZURE_OPENAI_ENDPOINT: "endpoint", AZURE_OPENAI_DEPLOYMENT: "deployment" }, promptLabels: { apiKey: "Azure API key", endpoint: "Azure endpoint", deployment: "Azure deployment" } },
+    minimax: { required: ["apiKey"], envVars: { MINIMAX_API_KEY: "apiKey" }, promptLabels: { apiKey: "MiniMax API key" } },
+    "github-copilot": { required: ["githubToken", "baseUrl"], envVars: { GH_TOKEN: "githubToken", GITHUB_TOKEN: "githubToken" }, promptLabels: { githubToken: "GitHub token" } },
+};
 exports.DEFAULT_AGENT_CONTEXT = {
     maxTokens: 80000,
     contextMargin: 20,
@@ -59,16 +79,70 @@ exports.DEFAULT_AGENT_PHRASES = {
     tool: ["running tool"],
     followup: ["processing"],
 };
+exports.DEFAULT_VAULT_SERVER_URL = "https://vault.ouroboros.bot";
+exports.LEGACY_VAULT_SERVER_URL_ALIASES = [
+    "https://vault.ouro.bot",
+    "https://ouro-vault.gentleflower-74452a1e.eastus2.azurecontainerapps.io",
+];
+function normalizeVaultServerUrl(serverUrl) {
+    const trimmed = serverUrl.trim();
+    const withoutTrailingSlash = trimmed.replace(/\/+$/, "");
+    if (!withoutTrailingSlash) {
+        return exports.DEFAULT_VAULT_SERVER_URL;
+    }
+    if (exports.LEGACY_VAULT_SERVER_URL_ALIASES.includes(withoutTrailingSlash)) {
+        return exports.DEFAULT_VAULT_SERVER_URL;
+    }
+    return withoutTrailingSlash;
+}
+function getVaultServerUrlCandidates(serverUrl) {
+    const raw = serverUrl.trim();
+    const withoutTrailingSlash = raw.replace(/\/+$/, "");
+    const normalized = normalizeVaultServerUrl(serverUrl);
+    const candidates = [normalized];
+    for (const candidate of [withoutTrailingSlash, raw]) {
+        if (candidate && !candidates.includes(candidate)) {
+            candidates.push(candidate);
+        }
+    }
+    if (normalized === exports.DEFAULT_VAULT_SERVER_URL) {
+        for (const alias of exports.LEGACY_VAULT_SERVER_URL_ALIASES) {
+            if (!candidates.includes(alias)) {
+                candidates.push(alias);
+            }
+        }
+    }
+    return candidates;
+}
+function defaultStableVaultEmail(agentName) {
+    const local = agentName
+        .toLowerCase()
+        .replace(/[^a-z0-9._-]+/g, "-")
+        .replace(/^-+|-+$/g, "") || "agent";
+    return `${local}@ouro.bot`;
+}
+/**
+ * Resolve the vault config for an agent, applying defaults.
+ * If vault is not configured in agent.json, returns default values.
+ */
+function resolveVaultConfig(agentName, config) {
+    return {
+        email: config?.email ?? defaultStableVaultEmail(agentName),
+        serverUrl: normalizeVaultServerUrl(config?.serverUrl ?? exports.DEFAULT_VAULT_SERVER_URL),
+    };
+}
 exports.DEFAULT_AGENT_SENSES = {
     cli: { enabled: true },
     teams: { enabled: false },
     bluebubbles: { enabled: false },
+    mail: { enabled: false },
 };
 function normalizeSenses(value, configFile) {
     const defaults = {
         cli: { ...exports.DEFAULT_AGENT_SENSES.cli },
         teams: { ...exports.DEFAULT_AGENT_SENSES.teams },
         bluebubbles: { ...exports.DEFAULT_AGENT_SENSES.bluebubbles },
+        mail: { ...exports.DEFAULT_AGENT_SENSES.mail },
     };
     if (value === undefined) {
         return defaults;
@@ -84,7 +158,7 @@ function normalizeSenses(value, configFile) {
         throw new Error(`agent.json at ${configFile} must include senses as an object when present.`);
     }
     const raw = value;
-    const senseNames = ["cli", "teams", "bluebubbles"];
+    const senseNames = ["cli", "teams", "bluebubbles", "mail"];
     for (const senseName of senseNames) {
         const rawSense = raw[senseName];
         if (rawSense === undefined) {
@@ -117,14 +191,16 @@ function normalizeSenses(value, configFile) {
 }
 function buildDefaultAgentTemplate(_agentName) {
     return {
-        version: 1,
+        version: 2,
         enabled: true,
-        provider: "anthropic",
+        humanFacing: { provider: "anthropic", model: "claude-opus-4-6" },
+        agentFacing: { provider: "anthropic", model: "claude-opus-4-6" },
         context: { ...exports.DEFAULT_AGENT_CONTEXT },
         senses: {
             cli: { ...exports.DEFAULT_AGENT_SENSES.cli },
             teams: { ...exports.DEFAULT_AGENT_SENSES.teams },
             bluebubbles: { ...exports.DEFAULT_AGENT_SENSES.bluebubbles },
+            mail: { ...exports.DEFAULT_AGENT_SENSES.mail },
         },
         phrases: {
             thinking: [...exports.DEFAULT_AGENT_PHRASES.thinking],
@@ -134,7 +210,6 @@ function buildDefaultAgentTemplate(_agentName) {
     };
 }
 let _cachedAgentName = null;
-let _cachedAgentConfig = null;
 let _agentConfigOverride = null;
 /**
  * Parse `--agent <name>` from process.argv.
@@ -185,38 +260,49 @@ function getAgentBundlesRoot() {
 function getAgentRoot(agentName = getAgentName()) {
     return path.join(getAgentBundlesRoot(), `${agentName}.ouro`);
 }
+function resolveOptionalAgentName(agentName) {
+    if (agentName && agentName.trim().length > 0)
+        return agentName.trim();
+    try {
+        return getAgentName();
+    }
+    catch {
+        return "slugger";
+    }
+}
 /**
  * Returns the bundle-local runtime state directory: `~/AgentBundles/<agentName>.ouro/state/`
  */
-function getAgentStateRoot(agentName = getAgentName()) {
-    return path.join(getAgentRoot(agentName), "state");
+function getAgentStateRoot(agentName) {
+    return path.join(getAgentRoot(resolveOptionalAgentName(agentName)), "state");
 }
-/**
- * Returns the conventional secrets path: `~/.agentsecrets/<agentName>/secrets.json`
- */
-function getAgentSecretsPath(agentName = getAgentName()) {
-    return path.join(os.homedir(), ".agentsecrets", agentName, "secrets.json");
+exports.HARNESS_CANONICAL_REPO_URL = "https://github.com/ouroborosbot/ouroboros.git";
+function getAgentRepoWorkspacesRoot(agentName) {
+    return path.join(getAgentStateRoot(resolveOptionalAgentName(agentName)), "workspaces");
 }
-/**
- * Load and parse `<agentRoot>/agent.json`.
- * Caches the result after first load.
- * Throws descriptive error if file is missing or contains invalid JSON.
- */
-function loadAgentConfig() {
-    if (_agentConfigOverride) {
-        return _agentConfigOverride;
-    }
-    if (_cachedAgentConfig) {
-        (0, runtime_1.emitNervesEvent)({
-            event: "identity.resolve",
-            component: "config/identity",
-            message: "loaded agent config from cache",
-            meta: { source: "cache" },
-        });
-        return _cachedAgentConfig;
-    }
-    const agentRoot = getAgentRoot();
-    const configFile = path.join(agentRoot, "agent.json");
+function getAgentDaemonStateRoot(agentName) {
+    return path.join(getAgentStateRoot(resolveOptionalAgentName(agentName)), "daemon");
+}
+function getAgentDaemonLogsDir(agentName) {
+    return path.join(getAgentDaemonStateRoot(resolveOptionalAgentName(agentName)), "logs");
+}
+function getAgentDaemonLoggingConfigPath(agentName) {
+    return path.join(getAgentDaemonStateRoot(resolveOptionalAgentName(agentName)), "logging.json");
+}
+function getAgentMessagesRoot(agentName) {
+    return path.join(getAgentStateRoot(resolveOptionalAgentName(agentName)), "messages");
+}
+function getAgentMailroomRoot(agentName) {
+    return path.join(getAgentStateRoot(resolveOptionalAgentName(agentName)), "mailroom");
+}
+function getAgentToolsRoot(agentName) {
+    return path.join(getAgentStateRoot(resolveOptionalAgentName(agentName)), "tools");
+}
+const VALID_PROVIDERS = ["azure", "minimax", "anthropic", "openai-codex", "github-copilot"];
+function isValidProvider(value) {
+    return typeof value === "string" && VALID_PROVIDERS.includes(value);
+}
+function readAndParseAgentJson(configFile) {
     let raw;
     try {
         raw = fs.readFileSync(configFile, "utf-8");
@@ -234,9 +320,8 @@ function loadAgentConfig() {
         });
         throw new Error(`Cannot read agent.json at ${configFile}. Does the agent directory exist?`);
     }
-    let parsed;
     try {
-        parsed = JSON.parse(raw);
+        return JSON.parse(raw);
     }
     catch (error) {
         (0, runtime_1.emitNervesEvent)({
@@ -251,6 +336,62 @@ function loadAgentConfig() {
         });
         throw new Error(`Invalid JSON in agent.json at ${configFile}. Check syntax.`);
     }
+}
+function validateFacingConfig(parsed, facingName, configFile) {
+    const raw = parsed[facingName];
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            event: "config_identity.error",
+            component: "config/identity",
+            message: `agent config missing or invalid ${facingName}`,
+            meta: { path: configFile, [facingName]: raw ?? null },
+        });
+        throw new Error(`agent.json at ${configFile} must include ${facingName} as { provider, model }.`);
+    }
+    const facing = raw;
+    if (!isValidProvider(facing.provider)) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            event: "config_identity.error",
+            component: "config/identity",
+            message: `agent config has invalid provider in ${facingName}`,
+            meta: { path: configFile, provider: facing.provider ?? null },
+        });
+        throw new Error(`agent.json at ${configFile} ${facingName}.provider must be one of: ${VALID_PROVIDERS.join(", ")}.`);
+    }
+    if (typeof facing.model !== "string") {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            event: "config_identity.error",
+            component: "config/identity",
+            message: `agent config has invalid model in ${facingName}`,
+            meta: { path: configFile, model: facing.model ?? null },
+        });
+        throw new Error(`agent.json at ${configFile} ${facingName}.model must be a string.`);
+    }
+    return { provider: facing.provider, model: facing.model };
+}
+/**
+ * Load and parse `<agentRoot>/agent.json`.
+ * Reads the file fresh on each call unless an override is set.
+ * If the config is v1, auto-migrates to v2 via migrateAgentConfigV1ToV2 and re-reads.
+ * Throws descriptive error if file is missing or contains invalid JSON.
+ */
+function loadAgentConfig() {
+    if (_agentConfigOverride) {
+        return _agentConfigOverride;
+    }
+    const agentRoot = getAgentRoot();
+    const configFile = path.join(agentRoot, "agent.json");
+    let parsed = readAndParseAgentJson(configFile);
+    // Inline migration: v1 -> v2
+    const rawVersion = parsed.version;
+    const initialVersion = typeof rawVersion === "number" ? rawVersion : 1;
+    if (initialVersion < 2) {
+        (0, migrate_config_1.migrateAgentConfigV1ToV2)(agentRoot);
+        parsed = readAndParseAgentJson(configFile);
+    }
     const existingPhrases = parsed.phrases;
     const needsFill = !existingPhrases ||
         !existingPhrases.thinking ||
@@ -272,27 +413,11 @@ function loadAgentConfig() {
         });
         fs.writeFileSync(configFile, JSON.stringify(parsed, null, 2) + "\n", "utf-8");
     }
-    const rawProvider = parsed.provider;
-    if (rawProvider !== "azure" &&
-        rawProvider !== "minimax" &&
-        rawProvider !== "anthropic" &&
-        rawProvider !== "openai-codex") {
-        (0, runtime_1.emitNervesEvent)({
-            level: "error",
-            event: "config_identity.error",
-            component: "config/identity",
-            message: "agent config missing or invalid provider",
-            meta: {
-                path: configFile,
-                provider: rawProvider,
-            },
-        });
-        throw new Error(`agent.json at ${configFile} must include provider: "azure", "minimax", "anthropic", or "openai-codex".`);
-    }
-    const rawVersion = parsed.version;
-    const version = rawVersion === undefined ? 1 : rawVersion;
-    if (typeof version !== "number" ||
-        !Number.isInteger(version) ||
+    // Validate v2 facing configs
+    const humanFacing = validateFacingConfig(parsed, "humanFacing", configFile);
+    const agentFacing = validateFacingConfig(parsed, "agentFacing", configFile);
+    const version = typeof parsed.version === "number" ? parsed.version : 1;
+    if (!Number.isInteger(version) ||
         version < 1) {
         (0, runtime_1.emitNervesEvent)({
             level: "error",
@@ -301,7 +426,7 @@ function loadAgentConfig() {
             message: "agent config missing or invalid version",
             meta: {
                 path: configFile,
-                version: rawVersion,
+                version: parsed.version,
             },
         });
         throw new Error(`agent.json at ${configFile} must include version as integer >= 1.`);
@@ -321,22 +446,37 @@ function loadAgentConfig() {
         });
         throw new Error(`agent.json at ${configFile} must include enabled as boolean.`);
     }
-    _cachedAgentConfig = {
+    // Tolerate deprecated provider field for backward compatibility
+    const rawProvider = parsed.provider;
+    const provider = isValidProvider(rawProvider) ? rawProvider : undefined;
+    // Spread parsed first so any field present in AgentConfig is carried
+    // through by default, then explicitly override the fields that need
+    // validation or normalization. This eliminates the field-drop bug class
+    // that caused the `sync` block (and previously `shell`) to be silently
+    // omitted from the returned config. Regression-guarded by the
+    // Required<AgentConfig> contract test in identity-contract.test.ts.
+    const config = {
+        ...parsed,
         version,
         enabled,
-        provider: rawProvider,
-        context: parsed.context,
-        logging: parsed.logging,
+        humanFacing,
+        agentFacing,
         senses: normalizeSenses(parsed.senses, configFile),
         phrases: parsed.phrases,
     };
+    if (provider !== undefined) {
+        config.provider = provider;
+    }
+    else {
+        delete config.provider;
+    }
     (0, runtime_1.emitNervesEvent)({
         event: "identity.resolve",
         component: "config/identity",
         message: "loaded agent config from disk",
         meta: { source: "disk" },
     });
-    return _cachedAgentConfig;
+    return config;
 }
 /**
  * Prime the agent name cache explicitly.
@@ -356,11 +496,11 @@ function setAgentConfigOverride(config) {
     _agentConfigOverride = config;
 }
 /**
- * Clear only the cached agent config while preserving the resolved agent identity.
- * Used when a running agent should pick up updated disk-backed config on the next turn.
+ * Preserve the compatibility hook for callers that previously cleared cached
+ * disk-backed agent config. Agent config is now read fresh on every call.
  */
 function resetAgentConfigCache() {
-    _cachedAgentConfig = null;
+    // No-op: disk-backed agent config is no longer memoized in-process.
 }
 /**
  * Clear all cached identity state.
@@ -368,6 +508,5 @@ function resetAgentConfigCache() {
  */
 function resetIdentity() {
     _cachedAgentName = null;
-    _cachedAgentConfig = null;
     _agentConfigOverride = null;
 }