@ouro.bot/cli 0.1.0-alpha.56 → 0.1.0-alpha.561

package/dist/heart/cross-chat-delivery.js

@@ -38,31 +38,16 @@ async function deliverCrossChatMessage(request, deps) {
             authorizingTrustLevel: request.authorizingSession?.trustLevel ?? null,
         },
     });
-    if (request.intent === "generic_outreach") {
-        const result = queueForLater(request, deps, "generic outreach stays queued until the target session is next active");
-        (0, runtime_1.emitNervesEvent)({
-            component: "engine",
-            event: "engine.cross_chat_delivery_end",
-            message: "queued generic outreach for later delivery",
-            meta: {
-                friendId: request.friendId,
-                channel: request.channel,
-                key: request.key,
-                status: result.status,
-            },
-        });
-        return result;
-    }
-    if (!isExplicitlyAuthorized(request)) {
+    if (!isExplicitlyAuthorized(request) && request.intent !== "generic_outreach") {
         const result = {
             status: "blocked",
-            detail: "explicit cross-chat delivery requires a trusted asking session",
+            detail: "cross-chat delivery requires a trusted asking session or generic outreach intent",
         };
         (0, runtime_1.emitNervesEvent)({
             level: "warn",
             component: "engine",
             event: "engine.cross_chat_delivery_end",
-            message: "blocked explicit cross-chat delivery",
+            message: "blocked cross-chat delivery",
             meta: {
                 friendId: request.friendId,
                 channel: request.channel,

package/dist/heart/daemon/agent-config-check.js

@@ -0,0 +1,419 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.vaultUnlockOrRecoverFix = vaultUnlockOrRecoverFix;
+exports.checkAgentConfig = checkAgentConfig;
+exports.checkAgentConfigWithProviderHealth = checkAgentConfigWithProviderHealth;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const identity_1 = require("../identity");
+const runtime_1 = require("../../nerves/runtime");
+const provider_models_1 = require("../provider-models");
+const provider_credentials_1 = require("../provider-credentials");
+const provider_readiness_cache_1 = require("../provider-readiness-cache");
+const vault_unlock_1 = require("../../repertoire/vault-unlock");
+const readiness_repair_1 = require("./readiness-repair");
+const provider_ping_progress_1 = require("./provider-ping-progress");
+const LANES = [
+    { lane: "outward", facing: "humanFacing" },
+    { lane: "inner", facing: "agentFacing" },
+];
+function isAgentProvider(value) {
+    return Object.prototype.hasOwnProperty.call(identity_1.PROVIDER_CREDENTIALS, value);
+}
+function agentRootFor(agentName, bundlesRoot) {
+    return path.join(bundlesRoot, `${agentName}.ouro`);
+}
+function configPathFor(agentName, bundlesRoot) {
+    return path.join(agentRootFor(agentName, bundlesRoot), "agent.json");
+}
+function laneForFacing(facing) {
+    return facing === "humanFacing" ? "outward" : "inner";
+}
+function resolveFacingProvider(parsed, facing, agentName, agentJsonPath) {
+    const raw = parsed[facing];
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return {
+            ok: false,
+            result: {
+                ok: false,
+                error: `agent.json for '${agentName}' is missing ${facing}.provider`,
+                fix: `Add ${facing}: { provider, model } to ${agentJsonPath}. Valid providers: ${Object.keys(identity_1.PROVIDER_CREDENTIALS).join(", ")}`,
+            },
+        };
+    }
+    const provider = raw.provider;
+    if (typeof provider !== "string" || provider.length === 0) {
+        return {
+            ok: false,
+            result: {
+                ok: false,
+                error: `agent.json for '${agentName}' is missing ${facing}.provider`,
+                fix: `Set ${facing}.provider in ${agentJsonPath}. Valid providers: ${Object.keys(identity_1.PROVIDER_CREDENTIALS).join(", ")}`,
+            },
+        };
+    }
+    if (!isAgentProvider(provider)) {
+        return {
+            ok: false,
+            result: {
+                ok: false,
+                error: `Unknown provider '${provider}' in ${facing}.provider for '${agentName}'`,
+                fix: `Set ${facing}.provider to one of: ${Object.keys(identity_1.PROVIDER_CREDENTIALS).join(", ")}`,
+            },
+        };
+    }
+    const rawModel = raw.model;
+    const model = typeof rawModel === "string" && rawModel.trim().length > 0
+        ? rawModel.trim()
+        : (0, provider_models_1.getDefaultModelForProvider)(provider);
+    return { ok: true, selected: { facing, lane: laneForFacing(facing), provider, model } };
+}
+function readAgentConfigForProviderCheck(agentName, bundlesRoot) {
+    const agentJsonPath = configPathFor(agentName, bundlesRoot);
+    let raw;
+    try {
+        raw = fs.readFileSync(agentJsonPath, "utf-8");
+    }
+    catch {
+        return {
+            ok: false,
+            result: {
+                ok: false,
+                error: `agent.json not found at ${agentJsonPath}`,
+                fix: `Run 'ouro hatch ${agentName}' to create the agent bundle, or verify that ${bundlesRoot}/${agentName}.ouro/ exists.`,
+            },
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return {
+            ok: false,
+            result: {
+                ok: false,
+                error: `agent.json at ${agentJsonPath} contains invalid JSON`,
+                fix: `Open ${agentJsonPath} and fix the JSON syntax.`,
+            },
+        };
+    }
+    if (parsed.enabled === false) {
+        return { ok: true, disabled: true, agentJsonPath, parsed };
+    }
+    return { ok: true, disabled: false, agentJsonPath, parsed };
+}
+function readProviderSelectionForCheck(agentName, bundlesRoot) {
+    const configResult = readAgentConfigForProviderCheck(agentName, bundlesRoot);
+    if (!configResult.ok)
+        return { ok: false, result: configResult.result };
+    if (configResult.disabled)
+        return { ok: true, disabled: true };
+    const bindings = {};
+    for (const { lane, facing } of LANES) {
+        const selected = resolveFacingProvider(configResult.parsed, facing, agentName, configResult.agentJsonPath);
+        if (!selected.ok)
+            return { ok: false, result: selected.result };
+        bindings[lane] = selected.selected;
+    }
+    return {
+        ok: true,
+        disabled: false,
+        agentRoot: agentRootFor(agentName, bundlesRoot),
+        bindings,
+    };
+}
+function providerCredentialConfig(record) {
+    return {
+        ...record.credentials,
+        ...record.config,
+    };
+}
+function pingAttemptCount(result) {
+    if (Array.isArray(result.attempts))
+        return result.attempts.length;
+    return undefined;
+}
+function missingCredentialResult(agentName, lane, provider, model, credentialPath) {
+    return {
+        ok: false,
+        error: `${lane} provider ${provider} model ${model} has no credentials in ${agentName}'s vault at ${credentialPath}`,
+        fix: `Run 'ouro auth --agent ${agentName} --provider ${provider}' to authenticate.`,
+        issue: (0, readiness_repair_1.providerCredentialMissingIssue)({
+            agentName,
+            lane,
+            provider,
+            model,
+            credentialPath,
+        }),
+    };
+}
+function isTransientVaultError(error) {
+    const normalized = error.toLowerCase();
+    return (normalized.includes("timed out") ||
+        normalized.includes("econnrefused") ||
+        normalized.includes("socket hang up") ||
+        normalized.includes("etimedout"));
+}
+function invalidPoolResult(agentName, lane, provider, model, pool) {
+    if (pool.reason === "unavailable" && isTransientVaultError(pool.error)) {
+        return {
+            ok: false,
+            error: `${lane} provider ${provider} model ${model} cannot read provider credentials from ${agentName}'s vault: ${pool.error}`,
+            fix: `Vault read timed out -- this usually resolves on retry. Run 'ouro up' again.`,
+        };
+    }
+    if (pool.reason === "unavailable" && isVaultLockedError(pool.error)) {
+        return {
+            ok: false,
+            error: `${lane} provider ${provider} model ${model} cannot read provider credentials because ${agentName}'s credential vault is locked on this machine.`,
+            fix: vaultUnlockOrRecoverFix(agentName),
+            issue: (0, readiness_repair_1.vaultLockedIssue)(agentName),
+        };
+    }
+    if (pool.reason === "unavailable" && (0, vault_unlock_1.isCredentialVaultNotConfiguredError)(pool.error)) {
+        return {
+            ok: false,
+            error: `${lane} provider ${provider} model ${model} cannot read provider credentials because ${agentName}'s credential vault is not configured in agent.json.`,
+            fix: (0, vault_unlock_1.vaultCreateRecoverFix)(agentName, `Then run 'ouro auth --agent ${agentName} --provider ${provider}' and rerun 'ouro up'.`),
+            issue: (0, readiness_repair_1.vaultUnconfiguredIssue)(agentName),
+        };
+    }
+    if (pool.reason === "invalid") {
+        return {
+            ok: false,
+            error: `${lane} provider ${provider} model ${model} cannot read provider credentials from ${agentName}'s vault at ${pool.poolPath}: ${pool.error}`,
+            fix: `Run 'ouro auth --agent ${agentName} --provider ${provider}' to rewrite this provider credential, then run 'ouro up' again.`,
+        };
+    }
+    return {
+        ok: false,
+        error: `${lane} provider ${provider} model ${model} cannot read provider credentials from ${agentName}'s vault at ${pool.poolPath}: ${pool.error}`,
+        fix: vaultUnlockOrRecoverFix(agentName, `Then run 'ouro up' again. If the credential is missing or stale after unlock or recovery, run 'ouro auth --agent ${agentName} --provider ${provider}'.`),
+    };
+}
+function isVaultLockedError(error) {
+    const normalized = error.toLowerCase();
+    return /(?:ouro )?credential vault is locked|vault(?: is)? locked/.test(normalized);
+}
+function vaultUnlockOrRecoverFix(agentName, nextStep = "Then run 'ouro up' again.") {
+    return (0, vault_unlock_1.vaultUnlockReplaceRecoverFix)(agentName, nextStep);
+}
+function failedPingResult(agentName, lane, provider, model, result) {
+    return {
+        ok: false,
+        error: `${lane} provider ${provider} model ${model} failed live check: ${result.message}`,
+        fix: (0, readiness_repair_1.providerLiveCheckFix)({
+            agentName,
+            lane,
+            provider,
+            classification: result.classification,
+        }),
+        issue: (0, readiness_repair_1.providerLiveCheckFailedIssue)({
+            agentName,
+            lane,
+            provider,
+            model,
+            classification: result.classification,
+            message: result.message,
+        }),
+    };
+}
+function credentialRecordForLane(pool, provider) {
+    return pool.providers[provider];
+}
+function laneAudienceLabel(lane) {
+    return lane === "outward" ? "chat" : "inner dialog";
+}
+function bindingLabel(binding) {
+    return `${binding.provider} / ${binding.model}`;
+}
+function selectedProviderPlan(agentName, bindings) {
+    return [
+        `${agentName}: checking the providers in agent.json`,
+        ...LANES.map(({ lane }) => `- ${laneAudienceLabel(lane)}: ${bindingLabel(bindings[lane])}`),
+    ].join("\n");
+}
+function selectedProvidersForBindings(bindings) {
+    return [...new Set(LANES.map(({ lane }) => bindings[lane].provider))];
+}
+function mapVaultRefreshProgress(agentName, onProgress) {
+    return (message) => {
+        if (message.startsWith("reading vault items for ")) {
+            onProgress(`${agentName}: opening saved provider credentials in the vault`);
+            return;
+        }
+        const providerRead = message.match(/^reading ([a-z0-9-]+) credentials\.\.\.$/i);
+        if (providerRead) {
+            onProgress(`${agentName}: reading saved ${providerRead[1]} credentials`);
+            return;
+        }
+        if (message === "parsing provider credentials...") {
+            onProgress(`${agentName}: organizing saved provider credentials`);
+        }
+    };
+}
+function providerPingSubject(agentName, lanes) {
+    const laneList = lanes.map((lane) => laneAudienceLabel(lane)).join(" + ");
+    return `${agentName} (${laneList})`;
+}
+/**
+ * Structural validation only. Live provider credential validation belongs to
+ * checkAgentConfigWithProviderHealth(), which reads the agent vault and pings.
+ */
+function checkAgentConfig(agentName, bundlesRoot) {
+    const selectionResult = readProviderSelectionForCheck(agentName, bundlesRoot);
+    if (!selectionResult.ok)
+        return selectionResult.result;
+    if (selectionResult.disabled)
+        return { ok: true };
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.agent_config_valid",
+        message: "agent config validation passed",
+        meta: {
+            agent: agentName,
+            providers: selectedProvidersForBindings(selectionResult.bindings),
+            liveProviderCheck: false,
+        },
+    });
+    return { ok: true };
+}
+async function checkAgentConfigWithProviderHealth(agentName, bundlesRoot, deps = {}) {
+    const selectionResult = readProviderSelectionForCheck(agentName, bundlesRoot);
+    if (!selectionResult.ok)
+        return selectionResult.result;
+    if (selectionResult.disabled)
+        return { ok: true };
+    deps.onProgress?.(selectedProviderPlan(agentName, selectionResult.bindings));
+    const ping = deps.pingProvider ?? (await Promise.resolve().then(() => __importStar(require("../provider-ping")))).pingProvider;
+    const providers = selectedProvidersForBindings(selectionResult.bindings);
+    const poolResult = await (0, provider_credentials_1.refreshProviderCredentialPool)(agentName, {
+        ...(deps.onProgress ? { onProgress: mapVaultRefreshProgress(agentName, deps.onProgress) } : {}),
+        providers,
+        preserveCachedOnFailure: true,
+    });
+    const pingGroups = new Map();
+    for (const { lane } of LANES) {
+        const binding = selectionResult.bindings[lane];
+        if (!poolResult.ok) {
+            if (poolResult.reason === "missing") {
+                return missingCredentialResult(agentName, lane, binding.provider, binding.model, poolResult.poolPath);
+            }
+            return invalidPoolResult(agentName, lane, binding.provider, binding.model, {
+                ...poolResult,
+                reason: poolResult.reason,
+            });
+        }
+        const record = credentialRecordForLane(poolResult.pool, binding.provider);
+        if (!record) {
+            return missingCredentialResult(agentName, lane, binding.provider, binding.model, poolResult.poolPath);
+        }
+        const key = `${binding.provider}\0${binding.model}\0${record.revision}`;
+        const group = pingGroups.get(key);
+        if (group) {
+            group.lanes.push(lane);
+        }
+        else {
+            pingGroups.set(key, {
+                provider: binding.provider,
+                model: binding.model,
+                record,
+                lanes: [lane],
+            });
+        }
+    }
+    const groups = [...pingGroups.values()];
+    const pingResults = await Promise.all(groups.map(async (group) => {
+        const result = await ping(group.provider, providerCredentialConfig(group.record), {
+            model: group.model,
+            ...(deps.providerPingOptions ?? {}),
+            ...(deps.onProgress
+                ? (0, provider_ping_progress_1.createProviderPingProgressReporter)({
+                    provider: group.provider,
+                    model: group.model,
+                    subject: providerPingSubject(agentName, group.lanes),
+                }, deps.onProgress)
+                : {}),
+        });
+        return { group, result };
+    }));
+    let firstFailure = null;
+    for (const { group, result } of pingResults) {
+        if (!result.ok) {
+            for (const lane of group.lanes) {
+                (0, provider_readiness_cache_1.recordProviderLaneReadiness)({
+                    agentName,
+                    lane,
+                    provider: group.provider,
+                    model: group.model,
+                    credentialRevision: group.record.revision,
+                    status: "failed",
+                    checkedAt: new Date().toISOString(),
+                    error: result.message,
+                    attempts: pingAttemptCount(result),
+                });
+            }
+            firstFailure ??= failedPingResult(agentName, group.lanes[0], group.provider, group.model, result);
+            continue;
+        }
+        for (const lane of group.lanes) {
+            (0, provider_readiness_cache_1.recordProviderLaneReadiness)({
+                agentName,
+                lane,
+                provider: group.provider,
+                model: group.model,
+                credentialRevision: group.record.revision,
+                status: "ready",
+                checkedAt: new Date().toISOString(),
+                attempts: pingAttemptCount(result),
+            });
+        }
+    }
+    if (firstFailure)
+        return firstFailure;
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.agent_config_valid",
+        message: "agent config validation passed",
+        meta: {
+            agent: agentName,
+            providers: [...new Set([...pingGroups.values()].map((group) => group.provider))],
+            liveProviderCheck: true,
+        },
+    });
+    return { ok: true };
+}

package/dist/heart/daemon/agent-discovery.js

@@ -33,12 +33,34 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isLibraryKind = isLibraryKind;
+exports.listAllBundleAgents = listAllBundleAgents;
 exports.listEnabledBundleAgents = listEnabledBundleAgents;
+exports.listBundleSyncRows = listBundleSyncRows;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
 const identity_1 = require("../identity");
 const runtime_1 = require("../../nerves/runtime");
-function listEnabledBundleAgents(options = {}) {
+/**
+ * True when the value is the string `"library"`. Library bundles are
+ * content-only resources — never run as agents, never appear in sync surfaces.
+ */
+function isLibraryKind(kind) {
+    return kind === "library";
+}
+/**
+ * Walk the bundles root and return one row per `<name>.ouro` directory whose
+ * `agent.json` is readable and parseable. Includes both enabled and disabled
+ * agents AND library-kind bundles — callers that need only real agents should
+ * use `listEnabledBundleAgents` (which filters both `enabled` and `kind`).
+ *
+ * Bundles whose `agent.json` is missing, malformed, or unreadable are skipped
+ * silently (they aren't real agents from the harness's perspective).
+ *
+ * Sorted alphabetically by name for stable display.
+ */
+function listAllBundleAgents(options = {}) {
     const bundlesRoot = options.bundlesRoot ?? (0, identity_1.getAgentBundlesRoot)();
     const readdirSync = options.readdirSync ?? fs.readdirSync;
     const readFileSync = options.readFileSync ?? fs.readFileSync;
@@ -63,19 +85,96 @@ function listEnabledBundleAgents(options = {}) {
         const agentName = entry.name.slice(0, -5);
         const configPath = path.join(bundlesRoot, entry.name, "agent.json");
         let enabled = true;
+        let kind;
         try {
             const raw = readFileSync(configPath, "utf-8");
             const parsed = JSON.parse(raw);
             if (typeof parsed.enabled === "boolean") {
                 enabled = parsed.enabled;
             }
+            if (typeof parsed.kind === "string") {
+                kind = parsed.kind;
+            }
         }
         catch {
             continue;
         }
+        const row = { name: agentName, enabled };
+        if (kind !== undefined)
+            row.kind = kind;
+        discovered.push(row);
+    }
+    return discovered.sort((left, right) => left.name.localeCompare(right.name));
+}
+/**
+ * Real agents only — excludes both disabled bundles and library-kind bundles.
+ * Library bundles (SerpentGuide, RepairGuide, …) are content-only and must
+ * never appear in spawn lists, status rollups, or sync rows.
+ */
+function listEnabledBundleAgents(options = {}) {
+    return listAllBundleAgents(options)
+        .filter((row) => row.enabled && !isLibraryKind(row.kind))
+        .map((row) => row.name);
+}
+/**
+ * Read the per-agent sync block from each enabled bundle's agent.json.
+ * Used by the daemon (and stopped-state status renderer) to build per-agent
+ * sync rows without depending on argv-derived global identity. Bundles that
+ * cannot be read are skipped silently.
+ *
+ * For rows with sync enabled, also checks whether the bundle is a git repo
+ * (via .git directory presence) and resolves the remote URL via
+ * `git remote get-url <remote>`. On any error the URL is left undefined and
+ * the status renderer falls back to "local only" or "not a git repo".
+ */
+function listBundleSyncRows(options = {}) {
+    const bundlesRoot = options.bundlesRoot ?? (0, identity_1.getAgentBundlesRoot)();
+    const readFileSync = options.readFileSync ?? fs.readFileSync;
+    const execFileSync = options.execFileSync ?? child_process_1.execFileSync;
+    const existsSync = options.existsSync ?? fs.existsSync;
+    const agents = listEnabledBundleAgents(options);
+    const rows = [];
+    for (const agent of agents) {
+        const bundleRoot = path.join(bundlesRoot, `${agent}.ouro`);
+        const configPath = path.join(bundleRoot, "agent.json");
+        let enabled = false;
+        let remote = "origin";
+        try {
+            const raw = readFileSync(configPath, "utf-8");
+            const parsed = JSON.parse(raw);
+            if (parsed.sync && typeof parsed.sync === "object") {
+                if (typeof parsed.sync.enabled === "boolean")
+                    enabled = parsed.sync.enabled;
+                if (typeof parsed.sync.remote === "string" && parsed.sync.remote.length > 0) {
+                    remote = parsed.sync.remote;
+                }
+            }
+        }
+        catch {
+            // Best-effort: bundle without readable config still gets a row with defaults
+        }
+        const row = { agent, enabled, remote };
         if (enabled) {
-            discovered.push(agentName);
+            // Only meaningful when sync is enabled — we don't care about disabled bundles'
+            // git state. Check .git presence before attempting any git invocation.
+            const gitInitialized = existsSync(path.join(bundleRoot, ".git"));
+            row.gitInitialized = gitInitialized;
+            if (gitInitialized) {
+                try {
+                    const out = execFileSync("git", ["remote", "get-url", remote], {
+                        cwd: bundleRoot,
+                        stdio: "pipe",
+                        timeout: 5000,
+                    }).toString().trim();
+                    if (out.length > 0)
+                        row.remoteUrl = out;
+                }
+                catch {
+                    // No remote configured or git missing — leave remoteUrl undefined.
+                }
+            }
         }
+        rows.push(row);
     }
-    return discovered.sort((left, right) => left.localeCompare(right));
+    return rows;
 }