@ouro.bot/cli 0.1.0-alpha.552 → 0.1.0-alpha.554

package/dist/heart/daemon/cli-exec.js

@@ -40,8 +40,6 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.summarizeDaemonStartupFailure = summarizeDaemonStartupFailure;
-exports.writeDriftAdvisorySummary = writeDriftAdvisorySummary;
-exports.collectAgentDriftAdvisories = collectAgentDriftAdvisories;
 exports.writeSyncProbeSummary = writeSyncProbeSummary;
 exports.summarizeSyncProbeFindings = summarizeSyncProbeFindings;
 exports.mergeStartupStability = mergeStartupStability;
@@ -78,7 +76,6 @@ const provider_credentials_1 = require("../provider-credentials");
 const runtime_credentials_1 = require("../runtime-credentials");
 const provider_binding_resolver_1 = require("../provider-binding-resolver");
 const provider_visibility_1 = require("../provider-visibility");
-const provider_state_1 = require("../provider-state");
 const machine_identity_1 = require("../machine-identity");
 const provider_models_1 = require("../provider-models");
 const ouro_version_manager_1 = require("../versioning/ouro-version-manager");
@@ -98,7 +95,6 @@ const cli_help_1 = require("./cli-help");
 const cli_render_1 = require("./cli-render");
 const cli_defaults_1 = require("./cli-defaults");
 const agent_config_check_1 = require("./agent-config-check");
-const drift_detection_1 = require("./drift-detection");
 const doctor_1 = require("./doctor");
 const cli_render_doctor_1 = require("./cli-render-doctor");
 const interactive_repair_1 = require("./interactive-repair");
@@ -486,61 +482,6 @@ function daemonUnavailableStatusJsonOutput(socketPath, healthFilePath) {
         ...(healthFilePath ? { healthFilePath } : {}),
     }, null, 2);
 }
-/**
- * Layer 4: render a per-agent drift advisory block to stdout. Called from
- * the `--no-repair` summary path when one or more enabled agents have a
- * mismatch between `agent.json` (intent) and `state/providers.json`
- * (observation). The block surfaces the lane, intent vs observed
- * binding, and the copy-pasteable `ouro use` repair command per finding.
- *
- * Drift is advisory: this helper only PRINTS the advisory; running the
- * repair command is the operator's call (and is Layer 3 RepairGuide's
- * domain when the daemon does it automatically).
- *
- * Exported for direct unit-testing; the production callers are
- * inside this module.
- */
-function writeDriftAdvisorySummary(deps, advisories) {
-    if (advisories.length === 0)
-        return;
-    const lines = ["Drift advisory: agent intent does not match this machine's observed binding"];
-    for (const advisory of advisories) {
-        lines.push("");
-        lines.push(`  ${advisory.agent} (${advisory.lane}):`);
-        lines.push(`    intent:   ${advisory.intentProvider}/${advisory.intentModel}`);
-        lines.push(`    observed: ${advisory.observedProvider}/${advisory.observedModel}`);
-        lines.push(`    repair:   ${advisory.repairCommand}`);
-    }
-    deps.writeStdout(lines.join("\n"));
-}
-/**
- * Collect drift findings across every enabled agent in the bundles
- * directory. Used by the `--no-repair` summary path so that drift
- * advisories ride along with (or stand alone in place of) the existing
- * provider-repair summary. Errors during a single agent's load (e.g.
- * malformed `agent.json`) are swallowed: drift detection is advisory
- * and must not block the rest of the boot path.
- */
-async function collectAgentDriftAdvisories(deps) {
-    const agents = await listCliAgents(deps);
-    const bundlesRoot = deps.bundlesRoot ?? (0, identity_1.getAgentBundlesRoot)();
-    const findings = [];
-    for (const agent of [...new Set(agents)]) {
-        try {
-            const inputs = (0, drift_detection_1.loadDriftInputsForAgent)(bundlesRoot, agent);
-            const agentFindings = (0, drift_detection_1.detectProviderBindingDrift)({
-                agentName: agent,
-                agentJson: inputs.agentJson,
-                providerState: inputs.providerState,
-            });
-            findings.push(...agentFindings);
-        }
-        catch {
-            // Best-effort: a per-agent read failure is not blocking.
-        }
-    }
-    return findings;
-}
 function providerRepairCountSummary(count) {
     if (count === 0)
         return "selected providers answered live checks";
@@ -1305,7 +1246,7 @@ async function resolveHatchInput(command, deps) {
         migrationPath: command.migrationPath,
     };
 }
-// ── Provider state CLI helpers ──
+// ── Provider selection CLI helpers ──
 function providerCliHomeDir(deps) {
     return (0, provider_credentials_1.providerCredentialMachineHomeDir)(deps.homeDir);
 }
@@ -4343,56 +4284,12 @@ async function executeConnect(command, deps) {
     deps.writeStdout(message);
     return message;
 }
-function readOrBootstrapProviderState(agentName, deps) {
-    const agentRoot = providerCliAgentRoot({ agent: agentName }, deps);
-    const readResult = (0, provider_state_1.readProviderState)(agentRoot);
-    if (readResult.ok)
-        return { agentRoot, state: readResult.state };
-    if (readResult.reason === "invalid") {
-        throw new Error(`provider state for ${agentName} is invalid at ${readResult.statePath}: ${readResult.error}`);
-    }
-    const { config } = (0, auth_flow_1.readAgentConfigForAgent)(agentName, deps.bundlesRoot);
-    const homeDir = providerCliHomeDir(deps);
-    const machine = (0, machine_identity_1.loadOrCreateMachineIdentity)({
-        homeDir,
-        now: () => providerCliNow(deps),
-    });
-    const state = (0, provider_state_1.bootstrapProviderStateFromAgentConfig)({
-        machineId: machine.machineId,
-        now: providerCliNow(deps),
-        agentConfig: {
-            humanFacing: {
-                provider: config.humanFacing.provider,
-                model: config.humanFacing.model || (0, provider_models_1.getDefaultModelForProvider)(config.humanFacing.provider),
-            },
-            agentFacing: {
-                provider: config.agentFacing.provider,
-                model: config.agentFacing.model || (0, provider_models_1.getDefaultModelForProvider)(config.agentFacing.provider),
-            },
-        },
-    });
-    (0, provider_state_1.writeProviderState)(agentRoot, state);
-    (0, runtime_1.emitNervesEvent)({
-        component: "daemon",
-        event: "daemon.provider_state_bootstrapped",
-        message: "bootstrapped local provider state from agent config",
-        meta: { agent: agentName, agentRoot },
-    });
-    return { agentRoot, state };
-}
 function credentialPingConfig(record) {
     return {
         ...record.credentials,
         ...record.config,
     };
 }
-function pingAttemptCount(result) {
-    if (typeof result.attempts === "number")
-        return result.attempts;
-    if (Array.isArray(result.attempts))
-        return result.attempts.length;
-    return undefined;
-}
 async function readProviderCredentialRecord(agent, provider, _deps, options = {}) {
     const poolResult = await (0, provider_credentials_1.refreshProviderCredentialPool)(agent, { ...options, providers: [provider] });
     if (poolResult.ok) {
@@ -4410,39 +4307,38 @@ async function readProviderCredentialRecord(agent, provider, _deps, options = {}
         error: `no credentials stored for ${provider}`,
     };
 }
-function writeProviderBinding(input) {
-    const updatedAt = providerCliNow(input.deps).toISOString();
-    input.state.updatedAt = updatedAt;
-    input.state.lanes[input.lane] = {
-        provider: input.provider,
-        model: input.model,
-        source: "local",
-        updatedAt,
-    };
-    input.state.readiness[input.lane] = {
-        status: input.status,
-        provider: input.provider,
-        model: input.model,
-        checkedAt: updatedAt,
-        ...(input.credentialRevision ? { credentialRevision: input.credentialRevision } : {}),
-        ...(input.error ? { error: input.error } : {}),
-        ...(input.attempts !== undefined ? { attempts: input.attempts } : {}),
+function providerFacingKeyForLane(lane) {
+    return lane === "inner" ? "agentFacing" : "humanFacing";
+}
+function providerConfigBinding(config, lane) {
+    const binding = config[providerFacingKeyForLane(lane)];
+    return {
+        provider: binding.provider,
+        model: binding.model || (0, provider_models_1.getDefaultModelForProvider)(binding.provider),
     };
-    (0, provider_state_1.writeProviderState)(input.agentRoot, input.state);
-}
-function writeProviderReadiness(input) {
-    const checkedAt = providerCliNow(input.deps).toISOString();
-    input.state.updatedAt = checkedAt;
-    input.state.readiness[input.lane] = {
-        status: input.status,
-        provider: input.provider,
-        model: input.model,
-        checkedAt,
-        credentialRevision: input.credentialRevision,
-        ...(input.error ? { error: input.error } : {}),
-        ...(input.attempts !== undefined ? { attempts: input.attempts } : {}),
+}
+function writeAgentProviderBinding(input) {
+    const { configPath, config } = (0, auth_flow_1.readAgentConfigForAgent)(input.agent, input.deps.bundlesRoot);
+    const facingKey = providerFacingKeyForLane(input.lane);
+    const nextConfig = {
+        ...config,
+        [facingKey]: {
+            ...config[facingKey],
+            provider: input.provider,
+            model: input.model,
+        },
     };
-    (0, provider_state_1.writeProviderState)(input.agentRoot, input.state);
+    fs.writeFileSync(configPath, `${JSON.stringify(nextConfig, null, 2)}\n`, "utf-8");
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.provider_selection_updated",
+        message: "updated provider selection in agent config",
+        meta: { agent: input.agent, lane: input.lane, provider: input.provider, model: input.model, configPath },
+    });
+}
+function appendBundleSyncSummary(message, agent, deps) {
+    const syncSummary = pushAgentBundleAfterCliMutation(agent, deps);
+    return syncSummary ? [message, syncSummary].join("\n") : message;
 }
 async function executeProviderUse(command, deps, options = {}) {
     const progress = options.writeStdout === false ? null : createHumanCommandProgress(deps, "provider use");
@@ -4453,7 +4349,6 @@ async function executeProviderUse(command, deps, options = {}) {
         return message;
     };
     try {
-        const { agentRoot, state } = readOrBootstrapProviderState(command.agent, deps);
         progress?.startPhase(`reading ${command.provider} credentials`);
         const credential = await readProviderCredentialRecord(command.agent, command.provider, deps, {
             onProgress: (message) => progress?.updateDetail(message),
@@ -4467,17 +4362,14 @@ async function executeProviderUse(command, deps, options = {}) {
                 ].join("\n");
                 return writeMessage(message);
             }
-            writeProviderBinding({
-                agentRoot,
-                state,
+            writeAgentProviderBinding({
+                agent: command.agent,
                 lane: command.lane,
                 provider: command.provider,
                 model: command.model,
                 deps,
-                status: "failed",
-                error: credential.error,
             });
-            const message = `forced ${command.agent} ${command.lane} to ${command.provider} / ${command.model}: failed (${credential.error})`;
+            const message = appendBundleSyncSummary(`forced ${command.agent} ${command.lane} to ${command.provider} / ${command.model}: failed (${credential.error})`, command.agent, deps);
             return writeMessage(message);
         }
         progress?.completePhase(`reading ${command.provider} credentials`, "found");
@@ -4488,29 +4380,23 @@ async function executeProviderUse(command, deps, options = {}) {
             sleep: deps.sleep,
             ...(0, provider_ping_progress_1.createProviderPingProgressReporter)({ provider: command.provider, model: command.model }, (message) => progress?.updateDetail(message)),
         });
-        const attempts = pingAttemptCount(pingResult);
         const status = pingResult.ok ? "ready" : `failed (${pingResult.message})`;
         progress?.completePhase(`checking ${command.provider} / ${command.model}`, status);
         if (!pingResult.ok && !command.force) {
             const message = [
                 `${command.agent} ${command.lane} ${command.provider} / ${command.model}: failed (${pingResult.message})`,
-                `Fix credentials with \`ouro auth --agent ${command.agent} --provider ${command.provider}\` or force the local binding with \`ouro use --agent ${command.agent} --lane ${command.lane} --provider ${command.provider} --model ${command.model} --force\`.`,
+                `Fix credentials with \`ouro auth --agent ${command.agent} --provider ${command.provider}\` or force agent.json with \`ouro use --agent ${command.agent} --lane ${command.lane} --provider ${command.provider} --model ${command.model} --force\`.`,
             ].join("\n");
             return writeMessage(message);
         }
-        writeProviderBinding({
-            agentRoot,
-            state,
+        writeAgentProviderBinding({
+            agent: command.agent,
             lane: command.lane,
             provider: command.provider,
             model: command.model,
             deps,
-            status: pingResult.ok ? "ready" : "failed",
-            credentialRevision: credential.record.revision,
-            ...(!pingResult.ok ? { error: pingResult.message } : {}),
-            ...(attempts !== undefined ? { attempts } : {}),
         });
-        const message = `${command.force ? "forced " : ""}${command.agent} ${command.lane} ${command.provider} / ${command.model}: ${status}`;
+        const message = appendBundleSyncSummary(`${command.force ? "forced " : ""}${command.agent} ${command.lane} ${command.provider} / ${command.model}: ${status}`, command.agent, deps);
         (0, runtime_1.emitNervesEvent)({
             component: "daemon",
             event: "daemon.provider_use_completed",
@@ -4532,8 +4418,8 @@ async function executeProviderCheck(command, deps) {
         return message;
     };
     try {
-        const { agentRoot, state } = readOrBootstrapProviderState(command.agent, deps);
-        const binding = state.lanes[command.lane];
+        const { config } = (0, auth_flow_1.readAgentConfigForAgent)(command.agent, deps.bundlesRoot);
+        const binding = providerConfigBinding(config, command.lane);
         progress.startPhase(`reading ${binding.provider} credentials`);
         const credential = await readProviderCredentialRecord(command.agent, binding.provider, deps, {
             onProgress: (message) => progress.updateDetail(message),
@@ -4554,21 +4440,8 @@ async function executeProviderCheck(command, deps) {
             sleep: deps.sleep,
             ...(0, provider_ping_progress_1.createProviderPingProgressReporter)({ provider: binding.provider, model: binding.model }, (message) => progress.updateDetail(message)),
         });
-        const attempts = pingAttemptCount(pingResult);
         const status = pingResult.ok ? "ready" : `failed (${pingResult.message})`;
         progress.completePhase(`checking ${binding.provider} / ${binding.model}`, status);
-        writeProviderReadiness({
-            agentRoot,
-            state,
-            lane: command.lane,
-            provider: binding.provider,
-            model: binding.model,
-            deps,
-            status: pingResult.ok ? "ready" : "failed",
-            credentialRevision: credential.record.revision,
-            ...(!pingResult.ok ? { error: pingResult.message } : {}),
-            ...(attempts !== undefined ? { attempts } : {}),
-        });
         const message = `${command.agent} ${command.lane} ${binding.provider} / ${binding.model}: ${status}`;
         (0, runtime_1.emitNervesEvent)({
             component: "daemon",
@@ -4577,11 +4450,13 @@ async function executeProviderCheck(command, deps) {
             meta: { agent: command.agent, lane: command.lane, provider: binding.provider, model: binding.model, status: pingResult.ok ? "ready" : "failed" },
         });
         return writeMessage(message);
+        /* v8 ignore start -- defensive rethrow: provider-check dependency failures are covered at the caller boundary @preserve */
     }
     catch (error) {
         progress.end();
         throw error;
     }
+    /* v8 ignore stop */
 }
 function renderProviderCredentialLine(agentName, credential) {
     if (credential.status === "present") {
@@ -4600,12 +4475,12 @@ function renderProviderCredentialLine(agentName, credential) {
 async function executeProviderStatus(command, deps) {
     const agentRoot = providerCliAgentRoot(command, deps);
     const progress = createHumanCommandProgress(deps, "provider status");
-    const stateResult = (0, provider_state_1.readProviderState)(agentRoot);
     try {
-        if (stateResult.ok) {
+        const { config } = (0, auth_flow_1.readAgentConfigForAgent)(command.agent, deps.bundlesRoot);
+        {
             const selectedProviders = [...new Set([
-                    stateResult.state.lanes.outward.provider,
-                    stateResult.state.lanes.inner.provider,
+                    config.humanFacing.provider,
+                    config.agentFacing.provider,
                 ])];
             await runCommandProgressPhase(progress, "reading selected provider credentials", () => (0, provider_credentials_1.refreshProviderCredentialPool)(command.agent, {
                 providers: selectedProviders,
@@ -4630,14 +4505,17 @@ async function executeProviderStatus(command, deps) {
             homeDir,
             lane,
         });
+        /* v8 ignore start -- defensive: provider status pre-validates agent.json before resolving lane details @preserve */
         if (!resolved.ok) {
             lines.push(`  ${lane}: unavailable`);
-            lines.push(`    ${resolved.reason}: ${resolved.repair.command}`);
+            lines.push(`    ${resolved.reason}: ${resolved.error}`);
+            lines.push(`    repair: ${resolved.repair.command}`);
             continue;
         }
+        /* v8 ignore stop */
         const binding = resolved.binding;
         lines.push(`  ${lane}: ${binding.provider} / ${binding.model} (${binding.source})`);
-        lines.push(`    readiness: ${binding.readiness.status}${binding.readiness.error ? ` (${binding.readiness.error})` : ""}`);
+        lines.push(`    readiness: ${binding.readiness.status}`);
         lines.push(`    ${renderProviderCredentialLine(command.agent, binding.credential)}`);
         for (const warning of binding.warnings) {
             lines.push(`    warning: ${warning.message}`);
@@ -4668,7 +4546,7 @@ async function executeProviderRefresh(command, deps) {
     const lines = [];
     if (pool.ok) {
         const summary = (0, provider_credentials_1.summarizeProviderCredentialPool)(pool.pool);
-        lines.push(`refreshed provider credential snapshot for ${command.agent}`);
+        lines.push(`refreshed in-memory provider credentials for ${command.agent}`);
         lines.push(`providers: ${summary.providers.map((provider) => provider.provider).join(", ") || "none"}`);
         progress.completePhase("refreshing provider credentials", summary.providers.map((provider) => provider.provider).join(", ") || "none");
     }
@@ -4910,13 +4788,13 @@ async function runReadinessRepairForDegraded(degraded, deps) {
     return { repairsAttempted, remainingDegraded: current };
 }
 async function executeLegacyAuthSwitch(command, deps) {
-    const { state } = readOrBootstrapProviderState(command.agent, deps);
+    const { config } = (0, auth_flow_1.readAgentConfigForAgent)(command.agent, deps.bundlesRoot);
     const lanes = command.facing
         ? [command.facing === "human" ? "outward" : "inner"]
         : ["outward", "inner"];
     const messages = [];
     for (const lane of lanes) {
-        const model = state.lanes[lane].model;
+        const model = providerConfigBinding(config, lane).model;
         messages.push(await executeProviderUse({
             kind: "provider.use",
             agent: command.agent,
@@ -4928,7 +4806,7 @@ async function executeLegacyAuthSwitch(command, deps) {
         }, deps, { writeStdout: false }));
     }
     const message = [
-        `deprecated: switched this machine's local provider binding. \`ouro auth switch\` no longer edits agent.json.`,
+        `deprecated: switched provider selection in agent.json.`,
         ...messages,
         `Use \`ouro use --agent ${command.agent} --lane <outward|inner> --provider ${command.provider} --model <model>\` for explicit provider/model selection.`,
     ].join("\n");
@@ -4937,8 +4815,8 @@ async function executeLegacyAuthSwitch(command, deps) {
 }
 async function executeLegacyConfigModel(command, deps) {
     const lane = command.facing === "agent" ? "inner" : "outward";
-    const { agentRoot, state } = readOrBootstrapProviderState(command.agent, deps);
-    const binding = state.lanes[lane];
+    const { configPath, config } = (0, auth_flow_1.readAgentConfigForAgent)(command.agent, deps.bundlesRoot);
+    const binding = providerConfigBinding(config, lane);
     const progress = binding.provider === "github-copilot" ? createHumanCommandProgress(deps, "config model") : null;
     const writeMessage = (message) => {
         progress?.end();
@@ -4996,17 +4874,16 @@ async function executeLegacyConfigModel(command, deps) {
             throw error;
         }
     }
-    const updatedAt = providerCliNow(deps).toISOString();
-    state.updatedAt = updatedAt;
-    state.lanes[lane] = {
-        ...binding,
-        model: command.modelName,
-        source: "local",
-        updatedAt,
+    const facingKey = providerFacingKeyForLane(lane);
+    const nextConfig = {
+        ...config,
+        [facingKey]: {
+            ...config[facingKey],
+            model: command.modelName,
+        },
     };
-    delete state.readiness[lane];
-    (0, provider_state_1.writeProviderState)(agentRoot, state);
-    const message = `deprecated: updated ${command.agent} model on ${lane}/${binding.provider}: ${binding.model} -> ${command.modelName}\nUse \`ouro use --agent ${command.agent} --lane ${lane} --provider ${binding.provider} --model ${command.modelName}\` next time.`;
+    fs.writeFileSync(configPath, `${JSON.stringify(nextConfig, null, 2)}\n`, "utf-8");
+    const message = appendBundleSyncSummary(`deprecated: updated ${command.agent} model in agent.json on ${lane}/${binding.provider}: ${binding.model} -> ${command.modelName}\nUse \`ouro use --agent ${command.agent} --lane ${lane} --provider ${binding.provider} --model ${command.modelName}\` next time.`, command.agent, deps);
     return writeMessage(message);
 }
 // ── System setup ──
@@ -5942,10 +5819,6 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
             if (command.noRepair) {
                 // --no-repair: write degraded summary and skip interactive repair
                 writeProviderRepairSummary(deps, "Provider checks need attention", daemonResult.stability.degraded);
-                // Layer 4: drift advisories ride along with the post-startup
-                // degraded summary too — same rationale as the preflight path.
-                const driftAdvisories = await collectAgentDriftAdvisories(deps);
-                writeDriftAdvisorySummary(deps, driftAdvisories);
                 deps.setExitCode?.(1);
                 (0, runtime_1.emitNervesEvent)({
                     level: "warn",
@@ -5954,7 +5827,6 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
                     message: "degraded agents detected with --no-repair, skipping interactive repair",
                     meta: {
                         degradedCount: daemonResult.stability.degraded.length,
-                        driftCount: driftAdvisories.length,
                     },
                 });
             }
@@ -5988,16 +5860,6 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
                 if (repairGuideShouldFire) {
                     const repairInput = [...untypedDegraded, ...typedDegraded];
                     const forceDiagnosis = untypedDegraded.length === 0 && typedDegraded.length >= 3;
-                    // Layer 3: collect drift findings here so the RepairGuide
-                    // prompt receives them as a structured JSON block. Drift is
-                    // already collected for the no-repair path above; we collect
-                    // again here because the repair path is a separate branch.
-                    // Filter to agents in repairInput so the diagnostic prompt
-                    // doesn't carry drift from healthy peers — narrows the
-                    // signal to the set being diagnosed.
-                    const repairAgentNames = new Set(repairInput.map((entry) => entry.agent));
-                    const repairDriftFindings = (await collectAgentDriftAdvisories(deps))
-                        .filter((finding) => repairAgentNames.has(finding.agent));
                     const repairResult = await (0, agentic_repair_1.runAgenticRepair)(repairInput, {
                         /* v8 ignore start -- production provider discovery wiring @preserve */
                         discoverWorkingProvider: async (agentName) => {
@@ -6043,7 +5905,6 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
                         isTTY: deps.isTTY ?? process.stdout.isTTY === true,
                         stdoutColumns: deps.stdoutColumns ?? process.stdout.columns,
                         forceDiagnosis,
-                        driftFindings: repairDriftFindings,
                         syncFindings: bootSyncFindings,
                     });
                     if (repairResult.repairsAttempted) {
@@ -6077,13 +5938,6 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
                 }
             }
         }
-        else if (command.noRepair) {
-            // Layer 4: no degraded agents to summarize, but --no-repair still
-            // surfaces drift advisories so the operator sees them without
-            // having to run `ouro inner status` per agent.
-            const driftAdvisories = await collectAgentDriftAdvisories(deps);
-            writeDriftAdvisorySummary(deps, driftAdvisories);
-        }
         return daemonResult.message;
     }
     if (command.kind === "daemon.dev") {
@@ -6680,7 +6534,7 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
         deps.writeStdout(message);
         return message;
     }
-    // ── provider state commands (local, no daemon socket needed) ──
+    // ── provider commands (local, no daemon socket needed) ──
     if (command.kind === "provider.use") {
         return executeProviderUse(command, deps);
     }
@@ -7196,22 +7050,6 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
             catch { /* no habits — heartbeat unknown */ }
             // Attention count
             const activeObligations = listActiveReturnObligations(command.agent);
-            // Layer 4 drift findings for this agent. Best-effort: if agent.json
-            // is unreadable mid-call we just suppress the advisory rather than
-            // failing the inner-status render.
-            let driftFindings = [];
-            try {
-                const bundlesRoot = deps.bundlesRoot ?? (0, identity_1.getAgentBundlesRoot)();
-                const inputs = (0, drift_detection_1.loadDriftInputsForAgent)(bundlesRoot, command.agent);
-                driftFindings = (0, drift_detection_1.detectProviderBindingDrift)({
-                    agentName: command.agent,
-                    agentJson: inputs.agentJson,
-                    providerState: inputs.providerState,
-                });
-            }
-            catch {
-                driftFindings = [];
-            }
             const message = buildInnerStatusOutput({
                 agentName: command.agent,
                 runtimeState,
@@ -7219,7 +7057,6 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
                 heartbeat,
                 attentionCount: activeObligations.length,
                 now: Date.now(),
-                driftFindings,
             });
             deps.writeStdout(message);
             return message;

package/dist/heart/daemon/cli-help.js

@@ -289,7 +289,7 @@ const SUBCOMMAND_HELP = {
         example: "ouro auth verify --provider openai-codex",
     },
     "auth switch": {
-        description: "Switch local provider/model lanes after credentials are available",
+        description: "Switch agent.json provider/model lanes after credentials are available",
         usage: "ouro auth switch [--agent <name>] --provider <provider> [--facing human|agent]",
         example: "ouro auth switch --provider minimax",
     },

package/dist/heart/daemon/cli-render.js

@@ -623,26 +623,14 @@ function renderRollupStatusLine(health) {
         case "healthy":
             return `Last known status: healthy ${tail}`;
         case "partial": {
-            // `partial` arises from two independent sources:
-            //   (a) some enabled agents not in `running` state, or
-            //   (b) Layer-4 drift between agent.json (intent) and state/providers.json (observed).
-            // Either or both can be true. Render mentions both when applicable so
-            // the operator isn't misled into thinking agents are unhealthy when the
-            // only anomaly is configuration drift.
             const unhealthyCount = Object.values(health.agents).filter((agent) => agent.status !== "running").length;
-            const driftCount = (health.drift ?? []).length;
             const parts = [];
             if (unhealthyCount > 0) {
                 parts.push(`${unhealthyCount} agent${unhealthyCount === 1 ? "" : "s"} unhealthy`);
             }
-            if (driftCount > 0) {
-                parts.push(`drift on ${driftCount} agent${driftCount === 1 ? "" : "s"}`);
-            }
             // Fallback for legacy cached files: status="partial" with no
-            // visible cause (no unhealthy agents AND no drift array). This
-            // happens when the file pre-dates Layer 4 and the daemon flagged
-            // partial via some signal that's no longer expressible. Prompt
-            // refresh via `ouro up` rather than asserting a specific cause.
+            // visible cause. Prompt refresh via `ouro up` rather than asserting
+            // a specific cause.
             const detail = parts.length > 0
                 ? ` — ${parts.join("; ")}`
                 : " — stale cache, run `ouro up` to refresh";

package/dist/heart/daemon/daemon-entry.js

@@ -56,7 +56,6 @@ const os_cron_deps_1 = require("./os-cron-deps");
 const os_cron_1 = require("./os-cron");
 const daemon_tombstone_1 = require("./daemon-tombstone");
 const agent_config_check_1 = require("./agent-config-check");
-const drift_detection_1 = require("./drift-detection");
 const pulse_1 = require("./pulse");
 const socket_client_1 = require("./socket-client");
 const bundle_manifest_1 = require("../../mind/bundle-manifest");
@@ -235,33 +234,6 @@ function buildDaemonHealthState() {
         ...degradedComponents.map((entry) => ({ ...entry })),
         ...agentDegradedComponents,
     ];
-    // Layer 4: probe each enabled agent for drift between agent.json
-    // (intent) and state/providers.json (observed binding). The result is
-    // a single boolean — driftDetected — that downgrades the rollup from
-    // healthy to partial when true. Per-finding detail is consumed by
-    // render-side surfaces (inner-status, --no-repair summary) and by
-    // Layer 3 RepairGuide; the rollup itself only cares about presence.
-    // Best-effort: a single agent's read failure is not blocking — the
-    // function returns "no drift detected for that agent" and continues.
-    const bundlesRoot = (0, identity_1.getAgentBundlesRoot)();
-    const drift = [];
-    for (const snapshot of snapshots) {
-        try {
-            const inputs = (0, drift_detection_1.loadDriftInputsForAgent)(bundlesRoot, snapshot.name);
-            const findings = (0, drift_detection_1.detectProviderBindingDrift)({
-                agentName: snapshot.name,
-                agentJson: inputs.agentJson,
-                providerState: inputs.providerState,
-            });
-            if (findings.length > 0) {
-                drift.push(...findings);
-            }
-        }
-        catch {
-            // best-effort: continue scanning
-        }
-    }
-    const driftDetected = drift.length > 0;
     // Layer 1 rollup: project per-agent snapshots into the minimal
     // AgentRollupInput shape and let computeDaemonRollup decide. The
     // input is "every enabled agent" — managedAgents was filtered via
@@ -284,7 +256,6 @@ function buildDaemonHealthState() {
         })),
         bootstrapDegraded: degradedComponents,
         safeMode: false,
-        driftDetected,
     });
     return {
         status: rollupStatus,
@@ -294,7 +265,6 @@ function buildDaemonHealthState() {
         uptimeSeconds: Math.floor(process.uptime()),
         safeMode: null,
         degraded,
-        drift,
         agents: Object.fromEntries(snapshots.map((snapshot) => [
             snapshot.name,
             {

package/dist/heart/daemon/daemon-health.js

@@ -158,12 +158,6 @@ function readHealth(healthPath) {
             parsed.habits === null) {
             return null;
         }
-        // `drift` is required in DaemonHealthState but absent from cached
-        // health files written by pre-Layer-4 daemons. Tolerate that legacy
-        // shape by defaulting to []; the rest of the file is still valid.
-        const drift = Array.isArray(parsed.drift)
-            ? parsed.drift
-            : [];
         return {
             status: parsed.status,
             mode: parsed.mode,
@@ -172,7 +166,6 @@ function readHealth(healthPath) {
             uptimeSeconds: parsed.uptimeSeconds,
             safeMode: parsed.safeMode,
             degraded: parsed.degraded,
-            drift,
             agents: parsed.agents,
             habits: parsed.habits,
         };

package/dist/heart/daemon/daemon-rollup.js

@@ -50,8 +50,7 @@ function computeDaemonRollup(input) {
     // healthy vs partial.
     const hasUnhealthyAgent = notServing > 0;
     const hasBootstrapDegraded = input.bootstrapDegraded.length > 0;
-    const hasDrift = input.driftDetected === true;
-    if (hasUnhealthyAgent || hasBootstrapDegraded || hasDrift) {
+    if (hasUnhealthyAgent || hasBootstrapDegraded) {
         return "partial";
     }
     return "healthy";