@ouro.bot/cli 0.1.0-alpha.60 → 0.1.0-alpha.600

package/dist/heart/{daemon → hatch}/specialist-tools.js

@@ -35,19 +35,21 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getSpecialistTools = getSpecialistTools;
 exports.createSpecialistExecTool = createSpecialistExecTool;
-const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const tools_base_1 = require("../../repertoire/tools-base");
 const hatch_flow_1 = require("./hatch-flow");
 const hatch_animation_1 = require("./hatch-animation");
 const bundle_manifest_1 = require("../../mind/bundle-manifest");
+const identity_1 = require("../identity");
 const runtime_1 = require("../../nerves/runtime");
+const vault_setup_1 = require("../../repertoire/vault-setup");
+const vault_unlock_1 = require("../../repertoire/vault-unlock");
 const completeAdoptionTool = {
     type: "function",
     function: {
         name: "complete_adoption",
-        description: "finalize the agent bundle and hatch the new agent. call this only when you have written all 5 psyche files and agent.json to the temp directory, and the human has approved the bundle.",
+        description: "finalize the agent bundle and hatch the new agent. call this only when you have written all 5 psyche files and agent.json to the temp directory, and the human has approved the bundle. tool execution asks the human for the hatchling vault unlock secret through a hidden terminal prompt; do not ask for or include vault unlock secrets in chat or tool args.",
         parameters: {
             type: "object",
             properties: {
@@ -90,7 +92,7 @@ const listDirToolSchema = {
  * Returns the specialist's tool schema array.
  */
 function getSpecialistTools() {
-    return [completeAdoptionTool, tools_base_1.finalAnswerTool, readFileTool.tool, writeFileTool.tool, listDirToolSchema];
+    return [completeAdoptionTool, tools_base_1.settleTool, readFileTool.tool, writeFileTool.tool, listDirToolSchema];
 }
 const PSYCHE_FILES = ["SOUL.md", "IDENTITY.md", "LORE.md", "TACIT.md", "ASPIRATIONS.md"];
 function isPascalCase(name) {
@@ -105,21 +107,21 @@ function writeReadme(dir, purpose) {
     }
 }
 function scaffoldBundle(bundleRoot) {
-    writeReadme(path.join(bundleRoot, "memory"), "Persistent memory store.");
-    writeReadme(path.join(bundleRoot, "memory", "daily"), "Daily memory entries.");
-    writeReadme(path.join(bundleRoot, "memory", "archive"), "Archived memory.");
+    writeReadme(path.join(bundleRoot, "notes"), "Persistent notes store.");
+    writeReadme(path.join(bundleRoot, "notes", "daily"), "Daily note entries.");
+    writeReadme(path.join(bundleRoot, "notes", "archive"), "Archived notes.");
     writeReadme(path.join(bundleRoot, "friends"), "Known friend records.");
     writeReadme(path.join(bundleRoot, "tasks"), "Task files.");
-    writeReadme(path.join(bundleRoot, "tasks", "habits"), "Recurring tasks.");
     writeReadme(path.join(bundleRoot, "tasks", "one-shots"), "One-shot tasks.");
+    writeReadme(path.join(bundleRoot, "habits"), "Recurring habits and autonomous rhythms.");
     writeReadme(path.join(bundleRoot, "tasks", "ongoing"), "Ongoing tasks.");
     writeReadme(path.join(bundleRoot, "skills"), "Local skill files.");
     writeReadme(path.join(bundleRoot, "senses"), "Sense-specific config.");
     writeReadme(path.join(bundleRoot, "senses", "teams"), "Teams sense config.");
-    // Memory scaffold files
-    const memoryRoot = path.join(bundleRoot, "memory");
-    const factsPath = path.join(memoryRoot, "facts.jsonl");
-    const entitiesPath = path.join(memoryRoot, "entities.json");
+    // Notes scaffold files
+    const notesRoot = path.join(bundleRoot, "notes");
+    const factsPath = path.join(notesRoot, "facts.jsonl");
+    const entitiesPath = path.join(notesRoot, "entities.json");
     /* v8 ignore next -- defensive: guard against re-scaffold on existing bundle @preserve */
     if (!fs.existsSync(factsPath))
         fs.writeFileSync(factsPath, "", "utf-8");
@@ -166,13 +168,34 @@ async function execCompleteAdoption(args, deps) {
     if (fs.existsSync(targetBundle)) {
         return `error: bundle '${name}.ouro' already exists at ${deps.bundlesRoot}. choose a different name.`;
     }
+    if (!deps.promptSecret) {
+        return "error: complete_adoption requires an interactive vault unlock secret prompt. Re-run `ouro hatch` in a terminal so the human can enter a hatchling vault unlock secret without echoing it.";
+    }
+    const vault = (0, identity_1.resolveVaultConfig)(name);
+    let vaultUnlockSecret;
+    try {
+        vaultUnlockSecret = await (0, vault_unlock_1.promptConfirmedVaultUnlockSecret)({
+            promptSecret: deps.promptSecret,
+            question: `Choose Ouro vault unlock secret for ${vault.email}: `,
+            confirmQuestion: `Confirm Ouro vault unlock secret for ${vault.email}: `,
+            emptyError: "hatchling vault creation requires an unlock secret. Re-run `ouro hatch` in an interactive terminal and enter a human-chosen unlock secret.",
+        });
+    }
+    catch (error) {
+        return `error: failed to read hatchling vault unlock secret: ${error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error)}`;
+    }
     // Scaffold structural dirs into tempDir
     scaffoldBundle(deps.tempDir);
     // Move tempDir -> final bundle location
     moveDir(deps.tempDir, targetBundle);
     // Write secrets
     try {
-        (0, hatch_flow_1.writeSecretsFile)(name, deps.provider, deps.credentials, deps.secretsRoot);
+        const vaultResult = await (0, vault_setup_1.createVaultAccount)(name, vault.serverUrl, vault.email, vaultUnlockSecret);
+        if (!vaultResult.success) {
+            throw new Error(`failed to create vault: ${vaultResult.error}`);
+        }
+        (0, vault_unlock_1.storeVaultUnlockSecret)({ agentName: name, email: vault.email, serverUrl: vault.serverUrl }, vaultUnlockSecret);
+        await (0, hatch_flow_1.storeHatchlingProviderCredentials)(name, deps.provider, deps.credentials);
     }
     catch (e) {
         // Rollback: remove the moved bundle

package/dist/heart/identity.js

@@ -33,7 +33,12 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HARNESS_CANONICAL_REPO_URL = exports.DEFAULT_AGENT_SENSES = exports.DEFAULT_AGENT_PHRASES = exports.DEFAULT_AGENT_CONTEXT = void 0;
+exports.HARNESS_CANONICAL_REPO_URL = exports.DEFAULT_AGENT_SENSES = exports.LEGACY_VAULT_SERVER_URL_ALIASES = exports.DEFAULT_VAULT_SERVER_URL = exports.DEFAULT_AGENT_PHRASES = exports.DEFAULT_AGENT_CONTEXT = exports.PROVIDER_CREDENTIALS = void 0;
+exports.normalizeVaultServerUrl = normalizeVaultServerUrl;
+exports.getVaultServerUrlCandidates = getVaultServerUrlCandidates;
+exports.defaultStableVaultEmail = defaultStableVaultEmail;
+exports.resolveVaultConfig = resolveVaultConfig;
+exports.normalizeSenses = normalizeSenses;
 exports.buildDefaultAgentTemplate = buildDefaultAgentTemplate;
 exports.getAgentName = getAgentName;
 exports.getRepoRoot = getRepoRoot;
@@ -45,8 +50,8 @@ exports.getAgentDaemonStateRoot = getAgentDaemonStateRoot;
 exports.getAgentDaemonLogsDir = getAgentDaemonLogsDir;
 exports.getAgentDaemonLoggingConfigPath = getAgentDaemonLoggingConfigPath;
 exports.getAgentMessagesRoot = getAgentMessagesRoot;
+exports.getAgentMailroomRoot = getAgentMailroomRoot;
 exports.getAgentToolsRoot = getAgentToolsRoot;
-exports.getAgentSecretsPath = getAgentSecretsPath;
 exports.loadAgentConfig = loadAgentConfig;
 exports.setAgentName = setAgentName;
 exports.setAgentConfigOverride = setAgentConfigOverride;
@@ -56,6 +61,15 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const runtime_1 = require("../nerves/runtime");
+const migrate_config_1 = require("./migrate-config");
+/** Single source of truth for per-provider credential field names, env var mappings, and prompt labels. */
+exports.PROVIDER_CREDENTIALS = {
+    anthropic: { required: ["setupToken"], envVars: { ANTHROPIC_API_KEY: "setupToken" }, promptLabels: { setupToken: "Anthropic setup-token" } },
+    "openai-codex": { required: ["oauthAccessToken"], envVars: { OPENAI_API_KEY: "oauthAccessToken" }, promptLabels: { oauthAccessToken: "OpenAI Codex OAuth token" } },
+    azure: { required: ["apiKey", "endpoint", "deployment"], envVars: { AZURE_OPENAI_API_KEY: "apiKey", AZURE_OPENAI_KEY: "apiKey", AZURE_OPENAI_ENDPOINT: "endpoint", AZURE_OPENAI_DEPLOYMENT: "deployment" }, promptLabels: { apiKey: "Azure API key", endpoint: "Azure endpoint", deployment: "Azure deployment" } },
+    minimax: { required: ["apiKey"], envVars: { MINIMAX_API_KEY: "apiKey" }, promptLabels: { apiKey: "MiniMax API key" } },
+    "github-copilot": { required: ["githubToken", "baseUrl"], envVars: { GH_TOKEN: "githubToken", GITHUB_TOKEN: "githubToken" }, promptLabels: { githubToken: "GitHub token" } },
+};
 exports.DEFAULT_AGENT_CONTEXT = {
     maxTokens: 80000,
     contextMargin: 20,
@@ -65,16 +79,72 @@ exports.DEFAULT_AGENT_PHRASES = {
     tool: ["running tool"],
     followup: ["processing"],
 };
+exports.DEFAULT_VAULT_SERVER_URL = "https://vault.ouro.bot";
+exports.LEGACY_VAULT_SERVER_URL_ALIASES = [
+    "https://vault.ouroboros.bot",
+    "https://ouro-vault.gentleflower-74452a1e.eastus2.azurecontainerapps.io",
+];
+function normalizeVaultServerUrl(serverUrl) {
+    const trimmed = serverUrl.trim();
+    const withoutTrailingSlash = trimmed.replace(/\/+$/, "");
+    if (!withoutTrailingSlash) {
+        return exports.DEFAULT_VAULT_SERVER_URL;
+    }
+    if (exports.LEGACY_VAULT_SERVER_URL_ALIASES.includes(withoutTrailingSlash)) {
+        return exports.DEFAULT_VAULT_SERVER_URL;
+    }
+    return withoutTrailingSlash;
+}
+function getVaultServerUrlCandidates(serverUrl) {
+    const raw = serverUrl.trim();
+    const withoutTrailingSlash = raw.replace(/\/+$/, "");
+    const normalized = normalizeVaultServerUrl(serverUrl);
+    const candidates = [normalized];
+    for (const candidate of [withoutTrailingSlash, raw]) {
+        if (candidate && !candidates.includes(candidate)) {
+            candidates.push(candidate);
+        }
+    }
+    if (normalized === exports.DEFAULT_VAULT_SERVER_URL) {
+        for (const alias of exports.LEGACY_VAULT_SERVER_URL_ALIASES) {
+            if (!candidates.includes(alias)) {
+                candidates.push(alias);
+            }
+        }
+    }
+    return candidates;
+}
+function defaultStableVaultEmail(agentName) {
+    const local = agentName
+        .toLowerCase()
+        .replace(/[^a-z0-9._-]+/g, "-")
+        .replace(/^-+|-+$/g, "") || "agent";
+    return `${local}@ouro.bot`;
+}
+/**
+ * Resolve the vault config for an agent, applying defaults.
+ * If vault is not configured in agent.json, returns default values.
+ */
+function resolveVaultConfig(agentName, config) {
+    return {
+        email: config?.email ?? defaultStableVaultEmail(agentName),
+        serverUrl: normalizeVaultServerUrl(config?.serverUrl ?? exports.DEFAULT_VAULT_SERVER_URL),
+    };
+}
 exports.DEFAULT_AGENT_SENSES = {
     cli: { enabled: true },
     teams: { enabled: false },
     bluebubbles: { enabled: false },
+    mail: { enabled: false },
+    voice: { enabled: false },
 };
 function normalizeSenses(value, configFile) {
     const defaults = {
         cli: { ...exports.DEFAULT_AGENT_SENSES.cli },
         teams: { ...exports.DEFAULT_AGENT_SENSES.teams },
         bluebubbles: { ...exports.DEFAULT_AGENT_SENSES.bluebubbles },
+        mail: { ...exports.DEFAULT_AGENT_SENSES.mail },
+        voice: { ...exports.DEFAULT_AGENT_SENSES.voice },
     };
     if (value === undefined) {
         return defaults;
@@ -90,7 +160,7 @@ function normalizeSenses(value, configFile) {
         throw new Error(`agent.json at ${configFile} must include senses as an object when present.`);
     }
     const raw = value;
-    const senseNames = ["cli", "teams", "bluebubbles"];
+    const senseNames = ["cli", "teams", "bluebubbles", "mail", "voice"];
     for (const senseName of senseNames) {
         const rawSense = raw[senseName];
         if (rawSense === undefined) {
@@ -123,14 +193,17 @@ function normalizeSenses(value, configFile) {
 }
 function buildDefaultAgentTemplate(_agentName) {
     return {
-        version: 1,
+        version: 2,
         enabled: true,
-        provider: "anthropic",
+        humanFacing: { provider: "anthropic", model: "claude-opus-4-6" },
+        agentFacing: { provider: "anthropic", model: "claude-opus-4-6" },
         context: { ...exports.DEFAULT_AGENT_CONTEXT },
         senses: {
             cli: { ...exports.DEFAULT_AGENT_SENSES.cli },
             teams: { ...exports.DEFAULT_AGENT_SENSES.teams },
             bluebubbles: { ...exports.DEFAULT_AGENT_SENSES.bluebubbles },
+            mail: { ...exports.DEFAULT_AGENT_SENSES.mail },
+            voice: { ...exports.DEFAULT_AGENT_SENSES.voice },
         },
         phrases: {
             thinking: [...exports.DEFAULT_AGENT_PHRASES.thinking],
@@ -148,12 +221,6 @@ let _agentConfigOverride = null;
  */
 function getAgentName() {
     if (_cachedAgentName) {
-        (0, runtime_1.emitNervesEvent)({
-            event: "identity.resolve",
-            component: "config/identity",
-            message: "resolved agent name from cache",
-            meta: { source: "cache" },
-        });
         return _cachedAgentName;
     }
     const idx = process.argv.indexOf("--agent");
@@ -222,26 +289,17 @@ function getAgentDaemonLoggingConfigPath(agentName) {
 function getAgentMessagesRoot(agentName) {
     return path.join(getAgentStateRoot(resolveOptionalAgentName(agentName)), "messages");
 }
+function getAgentMailroomRoot(agentName) {
+    return path.join(getAgentStateRoot(resolveOptionalAgentName(agentName)), "mailroom");
+}
 function getAgentToolsRoot(agentName) {
     return path.join(getAgentStateRoot(resolveOptionalAgentName(agentName)), "tools");
 }
-/**
- * Returns the conventional secrets path: `~/.agentsecrets/<agentName>/secrets.json`
- */
-function getAgentSecretsPath(agentName = getAgentName()) {
-    return path.join(os.homedir(), ".agentsecrets", agentName, "secrets.json");
+const VALID_PROVIDERS = ["azure", "minimax", "anthropic", "openai-codex", "github-copilot"];
+function isValidProvider(value) {
+    return typeof value === "string" && VALID_PROVIDERS.includes(value);
 }
-/**
- * Load and parse `<agentRoot>/agent.json`.
- * Reads the file fresh on each call unless an override is set.
- * Throws descriptive error if file is missing or contains invalid JSON.
- */
-function loadAgentConfig() {
-    if (_agentConfigOverride) {
-        return _agentConfigOverride;
-    }
-    const agentRoot = getAgentRoot();
-    const configFile = path.join(agentRoot, "agent.json");
+function readAndParseAgentJson(configFile) {
     let raw;
     try {
         raw = fs.readFileSync(configFile, "utf-8");
@@ -259,9 +317,8 @@ function loadAgentConfig() {
         });
         throw new Error(`Cannot read agent.json at ${configFile}. Does the agent directory exist?`);
     }
-    let parsed;
     try {
-        parsed = JSON.parse(raw);
+        return JSON.parse(raw);
     }
     catch (error) {
         (0, runtime_1.emitNervesEvent)({
@@ -276,6 +333,62 @@ function loadAgentConfig() {
         });
         throw new Error(`Invalid JSON in agent.json at ${configFile}. Check syntax.`);
     }
+}
+function validateFacingConfig(parsed, facingName, configFile) {
+    const raw = parsed[facingName];
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            event: "config_identity.error",
+            component: "config/identity",
+            message: `agent config missing or invalid ${facingName}`,
+            meta: { path: configFile, [facingName]: raw ?? null },
+        });
+        throw new Error(`agent.json at ${configFile} must include ${facingName} as { provider, model }.`);
+    }
+    const facing = raw;
+    if (!isValidProvider(facing.provider)) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            event: "config_identity.error",
+            component: "config/identity",
+            message: `agent config has invalid provider in ${facingName}`,
+            meta: { path: configFile, provider: facing.provider ?? null },
+        });
+        throw new Error(`agent.json at ${configFile} ${facingName}.provider must be one of: ${VALID_PROVIDERS.join(", ")}.`);
+    }
+    if (typeof facing.model !== "string") {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            event: "config_identity.error",
+            component: "config/identity",
+            message: `agent config has invalid model in ${facingName}`,
+            meta: { path: configFile, model: facing.model ?? null },
+        });
+        throw new Error(`agent.json at ${configFile} ${facingName}.model must be a string.`);
+    }
+    return { provider: facing.provider, model: facing.model };
+}
+/**
+ * Load and parse `<agentRoot>/agent.json`.
+ * Reads the file fresh on each call unless an override is set.
+ * If the config is v1, auto-migrates to v2 via migrateAgentConfigV1ToV2 and re-reads.
+ * Throws descriptive error if file is missing or contains invalid JSON.
+ */
+function loadAgentConfig() {
+    if (_agentConfigOverride) {
+        return _agentConfigOverride;
+    }
+    const agentRoot = getAgentRoot();
+    const configFile = path.join(agentRoot, "agent.json");
+    let parsed = readAndParseAgentJson(configFile);
+    // Inline migration: v1 -> v2
+    const rawVersion = parsed.version;
+    const initialVersion = typeof rawVersion === "number" ? rawVersion : 1;
+    if (initialVersion < 2) {
+        (0, migrate_config_1.migrateAgentConfigV1ToV2)(agentRoot);
+        parsed = readAndParseAgentJson(configFile);
+    }
     const existingPhrases = parsed.phrases;
     const needsFill = !existingPhrases ||
         !existingPhrases.thinking ||
@@ -297,28 +410,11 @@ function loadAgentConfig() {
         });
         fs.writeFileSync(configFile, JSON.stringify(parsed, null, 2) + "\n", "utf-8");
     }
-    const rawProvider = parsed.provider;
-    if (rawProvider !== "azure" &&
-        rawProvider !== "minimax" &&
-        rawProvider !== "anthropic" &&
-        rawProvider !== "openai-codex") {
-        (0, runtime_1.emitNervesEvent)({
-            level: "error",
-            event: "config_identity.error",
-            component: "config/identity",
-            message: "agent config missing or invalid provider",
-            meta: {
-                path: configFile,
-                provider: rawProvider,
-            },
-        });
-        throw new Error(`agent.json at ${configFile} must include provider: "azure", "minimax", "anthropic", or "openai-codex".`);
-    }
-    const provider = rawProvider;
-    const rawVersion = parsed.version;
-    const version = rawVersion === undefined ? 1 : rawVersion;
-    if (typeof version !== "number" ||
-        !Number.isInteger(version) ||
+    // Validate v2 facing configs
+    const humanFacing = validateFacingConfig(parsed, "humanFacing", configFile);
+    const agentFacing = validateFacingConfig(parsed, "agentFacing", configFile);
+    const version = typeof parsed.version === "number" ? parsed.version : 1;
+    if (!Number.isInteger(version) ||
         version < 1) {
         (0, runtime_1.emitNervesEvent)({
             level: "error",
@@ -327,7 +423,7 @@ function loadAgentConfig() {
             message: "agent config missing or invalid version",
             meta: {
                 path: configFile,
-                version: rawVersion,
+                version: parsed.version,
             },
         });
         throw new Error(`agent.json at ${configFile} must include version as integer >= 1.`);
@@ -347,15 +443,30 @@ function loadAgentConfig() {
         });
         throw new Error(`agent.json at ${configFile} must include enabled as boolean.`);
     }
+    // Tolerate deprecated provider field for backward compatibility
+    const rawProvider = parsed.provider;
+    const provider = isValidProvider(rawProvider) ? rawProvider : undefined;
+    // Spread parsed first so any field present in AgentConfig is carried
+    // through by default, then explicitly override the fields that need
+    // validation or normalization. This eliminates the field-drop bug class
+    // that caused the `sync` block (and previously `shell`) to be silently
+    // omitted from the returned config. Regression-guarded by the
+    // Required<AgentConfig> contract test in identity-contract.test.ts.
     const config = {
+        ...parsed,
         version,
         enabled,
-        provider,
-        context: parsed.context,
-        logging: parsed.logging,
+        humanFacing,
+        agentFacing,
         senses: normalizeSenses(parsed.senses, configFile),
         phrases: parsed.phrases,
     };
+    if (provider !== undefined) {
+        config.provider = provider;
+    }
+    else {
+        delete config.provider;
+    }
     (0, runtime_1.emitNervesEvent)({
         event: "identity.resolve",
         component: "config/identity",