@ouro.bot/cli 0.1.0-alpha.555 → 0.1.0-alpha.557

package/changelog.json

@@ -1,6 +1,20 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.557",
+      "changes": [
+        "`ouro vault unlock` now validates the typed unlock secret against the agent vault before replacing this machine's saved local unlock material, so a failed unlock attempt cannot poison a previously working Keychain/DPAPI/Secret Service/plaintext entry.",
+        "The Bitwarden adapter now rebuilds stale per-agent local `bw` profiles when they point at the wrong vault account/server or reject a saved unlock during unlock, reducing restart-time false locked-vault failures while keeping wrong saved secrets explicit.",
+        "`@ouro.bot/cli` and the `ouro.bot` wrapper are version-synced for the vault unlock hardening release."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.556",
+      "changes": [
+        "`ouro up` runtime replacement now captures the daemon boot timestamp before starting the replacement process, so a fast healthy daemon is not rejected for publishing health before the monitor begins polling."
+      ]
+    },
     {
       "version": "0.1.0-alpha.555",
       "changes": [

package/dist/heart/daemon/cli-exec.js

@@ -889,9 +889,10 @@ async function ensureDaemonRunning(deps, options = {}) {
             startDaemonProcess: deps.startDaemonProcess,
             checkSocketAlive: deps.checkSocketAlive,
             onProgress: deps.reportDaemonStartupPhase,
-            waitForDaemonStartup: async ({ pid }) => {
+            now: deps.now,
+            waitForDaemonStartup: async ({ pid, bootStartedAtMs }) => {
                 const startupFailure = await waitForDaemonStartup(deps, {
-                    bootStartedAtMs: (deps.now ?? Date.now)(),
+                    bootStartedAtMs,
                     pid,
                     serviceLabel: "replacement background service",
                     readLatestDaemonEvent: readLatestDaemonStartupEvent,
@@ -1452,15 +1453,13 @@ async function executeVaultUnlock(command, deps) {
     const progress = createHumanCommandProgress(deps, "vault unlock");
     let store;
     try {
+        await runCommandProgressPhase(progress, "checking vault access", () => (0, credential_access_1.probeCredentialVaultAccess)(command.agent, unlockSecret, { homeDir: deps.homeDir }), () => "ok");
         store = await runCommandProgressPhase(progress, "saving local unlock", () => (0, vault_unlock_1.storeVaultUnlockSecret)({
             agentName: command.agent,
             email: vault.email,
             serverUrl: vault.serverUrl,
         }, unlockSecret, { homeDir: deps.homeDir, store: command.store }), (saved) => saved.kind);
-        await runCommandProgressPhase(progress, "checking vault access", async () => {
-            (0, credential_access_1.resetCredentialStore)();
-            await (0, credential_access_1.getCredentialStore)(command.agent).get("__ouro_vault_probe__");
-        }, () => "ok");
+        (0, credential_access_1.resetCredentialStore)();
     }
     finally {
         progress.end();

package/dist/heart/daemon/daemon-runtime-sync.js

@@ -164,10 +164,11 @@ async function ensureCurrentDaemonRuntime(deps) {
             }
             deps.cleanupStaleSocket(deps.socketPath);
             deps.onProgress?.("starting the replacement background service");
+            const bootStartedAtMs = (deps.now ?? Date.now)();
             const started = await deps.startDaemonProcess(deps.socketPath);
             const pid = started.pid ?? "unknown";
             const startupCheck = deps.waitForDaemonStartup
-                ? await deps.waitForDaemonStartup({ pid: started.pid ?? null })
+                ? await deps.waitForDaemonStartup({ pid: started.pid ?? null, bootStartedAtMs })
                 : { ok: await verifyDaemonStarted(deps) };
             const verified = startupCheck.ok;
             /* v8 ignore next -- daemon liveness failure: requires real daemon crash timing @preserve */

package/dist/repertoire/bitwarden-store.js

@@ -88,7 +88,9 @@ function isBwSessionUnavailableMessage(message) {
         /local bitwarden session/i.test(message));
 }
 function isBwInvalidUnlockSecretMessage(message) {
-    return /invalid master password/i.test(message) || /saved vault unlock secret/i.test(message);
+    return (/invalid master password/i.test(message) ||
+        /saved vault unlock secret/i.test(message) ||
+        /username or password is incorrect/i.test(message));
 }
 function isBwTimeoutError(err) {
     const timeoutErr = err;
@@ -135,6 +137,13 @@ function isBwConfigLogoutRequired(err) {
 function isBwAlreadyLoggedInError(err) {
     return err.message.toLowerCase().includes("already logged in");
 }
+function isBwLoggedOutOrUnauthenticatedError(err) {
+    const message = err.message.toLowerCase();
+    return (message.includes("not logged in") ||
+        message.includes("not authenticated") ||
+        message.includes("unauthenticated") ||
+        message.includes("local bitwarden session because it is locked, missing, or expired"));
+}
 function shouldUseStructuredItemLookup(domain) {
     return domain.includes("/");
 }
@@ -393,6 +402,7 @@ class BitwardenCredentialStore {
     masterPassword;
     appDataDir;
     sessionToken = null;
+    terminalLoginError = null;
     bwBinaryPath = "bw";
     structuredItemCache = null;
     constructor(serverUrl, email, masterPassword, options = {}) {
@@ -416,6 +426,9 @@ class BitwardenCredentialStore {
      * Retries transient failures (network/timeout) up to MAX_RETRIES with exponential backoff.
      */
     async login() {
+        if (this.terminalLoginError) {
+            throw this.terminalLoginError;
+        }
         // Ensure bw CLI is installed before any bw commands
         this.bwBinaryPath = await (0, bw_installer_1.ensureBwCli)();
         if (this.appDataDir) {
@@ -432,6 +445,7 @@ class BitwardenCredentialStore {
                 lastError = err instanceof Error ? err : new Error(String(err));
                 // Don't retry non-transient errors (auth failures, bw not installed)
                 if (!isTransientError(lastError)) {
+                    this.terminalLoginError = lastError;
                     throw lastError;
                 }
                 // Don't retry after final attempt
@@ -447,22 +461,15 @@ class BitwardenCredentialStore {
                 await delay(backoffMs);
             }
         }
+        this.terminalLoginError = lastError;
         throw lastError;
     }
     /** Single login attempt — called by login() retry loop. */
     async loginAttempt() {
-        // Check current status
-        let status = {};
-        try {
-            const raw = await this.execBw(["status"]);
-            status = JSON.parse(raw);
-        }
-        catch (err) {
-            // If bw CLI is not installed or a transient error, propagate it for retry
-            if (err instanceof Error && (isBwNotInstalled(err) || isTransientError(err))) {
-                throw err;
-            }
-            // CLI not configured or broken — proceed with full setup
+        let status = await this.readStatus();
+        if (this.shouldRebuildLocalProfile(status)) {
+            await this.rebuildLocalProfile("local bw profile did not match requested vault", status);
+            status = { status: "unlocked", serverUrl: this.serverUrl, userEmail: this.email };
         }
         // Configure server URL if needed (only works when logged out)
         if (status.status === "unauthenticated" || !status.serverUrl) {
@@ -471,43 +478,28 @@ class BitwardenCredentialStore {
             }
             catch (error) {
                 const err = error;
-                // "Logout required" means already logged in — that's fine, skip config.
-                if (!isBwConfigLogoutRequired(err)) {
+                if (!isBwConfigLogoutRequired(err))
                     throw err;
-                }
+                // "Logout required" means bw already has local auth state; keep the
+                // existing behavior and proceed to login/unlock below.
             }
         }
-        if (status.status === "locked") {
-            // Already logged in, just needs unlock
-            const unlockOutput = await this.execBwWithPasswordEnv(["unlock", "--raw"]);
-            this.sessionToken = unlockOutput.trim();
-        }
-        else if (status.status === "unauthenticated" || !status.status) {
-            // Not logged in — full login
-            let loginOutput;
-            try {
-                loginOutput = await this.execBwWithPasswordEnv(["login", this.email, "--raw"]);
-            }
-            catch (error) {
-                const err = error;
-                if (!isBwAlreadyLoggedInError(err)) {
-                    throw err;
-                }
-                loginOutput = await this.execBwWithPasswordEnv(["unlock", "--raw"]);
+        if (!this.sessionToken) {
+            if (status.status === "locked") {
+                // Already logged in, just needs unlock.
+                const unlockOutput = await this.execWithLocalProfileRebuild("unlock rejected saved local unlock material", status, () => this.execBwWithPasswordEnv(["unlock", "--raw"]));
+                this.sessionToken = unlockOutput.trim();
             }
-            try {
-                const parsed = JSON.parse(loginOutput);
-                this.sessionToken = parsed.access_token ?? loginOutput.trim();
+            else if (status.status === "unauthenticated" || !status.status) {
+                // Not logged in -- full login.
+                this.sessionToken = this.sessionTokenFromLoginOutput(await this.loginWithPassword());
             }
-            catch {
-                this.sessionToken = loginOutput.trim();
+            else {
+                // Status is "unlocked" -- already good, just need the session token.
+                const unlockOutput = await this.execWithLocalProfileRebuild("unlocked bw profile rejected saved local unlock material", status, () => this.execBwWithPasswordEnv(["unlock", "--raw"]));
+                this.sessionToken = unlockOutput.trim();
             }
         }
-        else {
-            // Status is "unlocked" — already good, just need the session token
-            const unlockOutput = await this.execBwWithPasswordEnv(["unlock", "--raw"]);
-            this.sessionToken = unlockOutput.trim();
-        }
         if (this.shouldSyncVaultAfterSession(status)) {
             /* v8 ignore next -- defensive: loginAttempt always sets sessionToken before sync @preserve */
             await this.execBw(["sync"], this.sessionToken ?? undefined);
@@ -521,6 +513,128 @@ class BitwardenCredentialStore {
                 meta: { email: this.email, serverUrl: this.serverUrl, freshnessWindowMs: BW_SYNC_FRESH_MS },
             });
         }
+        this.terminalLoginError = null;
+    }
+    async readStatus() {
+        try {
+            const raw = await this.execBw(["status"]);
+            const parsed = JSON.parse(raw);
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+                return {};
+            const record = parsed;
+            return {
+                ...(typeof record.status === "string" ? { status: record.status } : {}),
+                ...(typeof record.serverUrl === "string" ? { serverUrl: record.serverUrl } : {}),
+                ...(typeof record.userEmail === "string" ? { userEmail: record.userEmail } : {}),
+            };
+        }
+        catch (err) {
+            // If bw CLI is not installed or a transient error, propagate it for retry.
+            if (err instanceof Error && (isBwNotInstalled(err) || isTransientError(err))) {
+                throw err;
+            }
+            // CLI not configured or broken -- proceed with full setup.
+            return {};
+        }
+    }
+    normalizedServerUrl(value) {
+        return value.trim().replace(/\/+$/, "").toLowerCase();
+    }
+    shouldRebuildLocalProfile(status) {
+        if (status.status !== "locked" && status.status !== "unlocked")
+            return false;
+        if (status.serverUrl && this.normalizedServerUrl(status.serverUrl) !== this.normalizedServerUrl(this.serverUrl))
+            return true;
+        if (status.userEmail && status.userEmail.trim().toLowerCase() !== this.email.trim().toLowerCase())
+            return true;
+        return false;
+    }
+    sessionTokenFromLoginOutput(loginOutput) {
+        try {
+            const parsed = JSON.parse(loginOutput);
+            return typeof parsed.access_token === "string" && parsed.access_token.trim()
+                ? parsed.access_token.trim()
+                : loginOutput.trim();
+        }
+        catch {
+            return loginOutput.trim();
+        }
+    }
+    async loginWithPassword() {
+        try {
+            return await this.execBwWithPasswordEnv(["login", this.email, "--raw"]);
+        }
+        catch (error) {
+            const err = error;
+            if (!isBwAlreadyLoggedInError(err))
+                throw err;
+            return this.execBwWithPasswordEnv(["unlock", "--raw"]);
+        }
+    }
+    forgetLocalSyncMarker() {
+        if (!this.appDataDir)
+            return;
+        try {
+            fs.rmSync(path.join(this.appDataDir, BW_SYNC_MARKER_FILENAME), { force: true });
+        }
+        catch {
+            // A stale sync marker is only a cache hint; failure to remove it should not block auth repair.
+        }
+    }
+    async logoutLocalProfile(reason, status, cause) {
+        this.sessionToken = null;
+        this.structuredItemCache = null;
+        this.forgetLocalSyncMarker();
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            event: "repertoire.bw_local_profile_rebuild",
+            component: "repertoire",
+            message: "rebuilding local bw profile for agent vault",
+            meta: {
+                email: this.email,
+                serverUrl: this.serverUrl,
+                reason,
+                /* v8 ignore next -- defensive: every profile rebuild path starts from a locked/unlocked bw status @preserve */
+                previousStatus: status.status ?? "unknown",
+                previousServerUrl: status.serverUrl ?? null,
+                previousUserEmail: status.userEmail ?? null,
+                /* v8 ignore next -- defensive: internal rebuild callers pass Error or undefined causes @preserve */
+                error: cause instanceof Error ? cause.message : cause ? String(cause) : undefined,
+            },
+        });
+        try {
+            await this.execBw(["logout"]);
+        }
+        catch (error) {
+            const err = error;
+            if (isBwLoggedOutOrUnauthenticatedError(err))
+                return;
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                event: "repertoire.bw_local_profile_logout_failed",
+                component: "repertoire",
+                message: "failed to logout local bw profile before rebuild",
+                meta: { email: this.email, serverUrl: this.serverUrl, error: err.message },
+            });
+        }
+    }
+    async rebuildLocalProfile(reason, status, cause) {
+        await this.logoutLocalProfile(reason, status, cause);
+        await this.execBw(["config", "server", this.serverUrl]);
+        this.sessionToken = this.sessionTokenFromLoginOutput(await this.loginWithPassword());
+    }
+    async execWithLocalProfileRebuild(reason, status, operation) {
+        try {
+            return await operation();
+        }
+        catch (error) {
+            const err = error;
+            if (!isBwInvalidUnlockSecretMessage(err.message))
+                throw err;
+            await this.rebuildLocalProfile(reason, status, err);
+            /* v8 ignore next -- defensive: rebuildLocalProfile always stores a string session token on success @preserve */
+            return this.sessionToken ?? "";
+        }
     }
     async ensureSession() {
         if (!this.sessionToken) {

package/dist/repertoire/credential-access.js

@@ -44,6 +44,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getCredentialStore = getCredentialStore;
+exports.probeCredentialVaultAccess = probeCredentialVaultAccess;
 exports.resetCredentialStore = resetCredentialStore;
 const crypto = __importStar(require("node:crypto"));
 const fs = __importStar(require("node:fs"));
@@ -64,13 +65,13 @@ function loadVaultSectionForAgent(agentName) {
         return { configPath };
     }
 }
-function bitwardenAppDataDir(agentName, vaultConfig) {
+function bitwardenAppDataDir(agentName, vaultConfig, homeDir = os.homedir()) {
     const digest = crypto
         .createHash("sha256")
         .update(`${agentName}:${vaultConfig.serverUrl}:${vaultConfig.email}`)
         .digest("hex")
         .slice(0, 24);
-    return path.join(os.homedir(), ".ouro-cli", "bitwarden", digest);
+    return path.join(homeDir, ".ouro-cli", "bitwarden", digest);
 }
 function getCredentialStore(agentNameInput) {
     const agentName = agentNameInput ?? identity.getAgentName();
@@ -106,6 +107,16 @@ function getCredentialStore(agentNameInput) {
     });
     return store;
 }
+async function probeCredentialVaultAccess(agentNameInput, unlockSecret, options = {}) {
+    const agentName = agentNameInput;
+    const { configPath, vault } = loadVaultSectionForAgent(agentName);
+    if (!vault || typeof vault.email !== "string" || vault.email.trim().length === 0) {
+        throw new Error((0, vault_unlock_1.credentialVaultNotConfiguredError)(agentName, configPath));
+    }
+    const vaultConfig = identity.resolveVaultConfig(agentName, vault);
+    const store = new bitwarden_store_1.BitwardenCredentialStore(vaultConfig.serverUrl, vaultConfig.email, unlockSecret, { appDataDir: bitwardenAppDataDir(agentName, vaultConfig, options.homeDir) });
+    await store.get("__ouro_vault_probe__");
+}
 function resetCredentialStore() {
     stores = new Map();
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.555",
+  "version": "0.1.0-alpha.557",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",