@ouro.bot/cli 0.1.0-alpha.654 → 0.1.0-alpha.657

package/changelog.json

@@ -1,6 +1,24 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.657",
+      "changes": [
+        "Harden Workbench sense coverage and CI readiness checks."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.656",
+      "changes": [
+        "Add Ouro Workbench as a first-class local sense with CLI repair, MCP registration status, prompt inventory, and source-of-truth tests."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.655",
+      "changes": [
+        "Add focused help for A2A CLI subcommands."
+      ]
+    },
     {
       "version": "0.1.0-alpha.654",
       "changes": [

package/dist/heart/config-registry.js

@@ -200,6 +200,15 @@ const registryData = [
         topics: ["senses", "voice", "audio", "speech", "channels", "interface"],
         validate: validateObject({ enabled: validateBoolean }),
     },
+    {
+        path: "senses.workbench",
+        tier: "self",
+        description: "Workbench sense configuration. Controls whether the native terminal-agent control room is enabled for this agent.",
+        default: { enabled: false },
+        effects: "Enables the local Ouro Workbench sense. Workbench MCP registration remains in mcpServers.ouro_workbench.",
+        topics: ["senses", "workbench", "mcp", "terminal", "channels", "interface"],
+        validate: validateObject({ enabled: validateBoolean }),
+    },
     {
         path: "sync.enabled",
         tier: "self",

package/dist/heart/daemon/cli-exec.js

@@ -2496,25 +2496,64 @@ function enableAgentSense(agent, sense, deps) {
         mail: senses.mail ?? { enabled: false },
         voice: senses.voice ?? { enabled: false },
         a2a: senses.a2a ?? { enabled: false },
+        workbench: senses.workbench ?? { enabled: false },
         [sense]: { ...existing, enabled: true },
     };
     fs.writeFileSync(configPath, `${JSON.stringify(raw, null, 2)}\n`, "utf-8");
 }
-const CONNECT_MENU_PROMPT = "Choose [1-8] or type a name: ";
+const CONNECT_MENU_PROMPT = "Choose [1-9] or type a name: ";
 function connectMenuIsTTY(deps) {
     return deps.isTTY ?? process.stdout.isTTY === true;
 }
 function readConnectBaySenseFlags(agent, deps) {
     const configPath = path.join(providerCliAgentRoot({ agent }, deps), "agent.json");
     const parsed = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+    const workbenchCommand = parsed.mcpServers?.ouro_workbench?.command;
     return {
         teamsEnabled: parsed.senses?.teams?.enabled === true,
         blueBubblesEnabled: parsed.senses?.bluebubbles?.enabled === true,
         mailEnabled: parsed.senses?.mail?.enabled === true,
         voiceEnabled: parsed.senses?.voice?.enabled === true,
         a2aEnabled: parsed.senses?.a2a?.enabled === true,
+        workbenchEnabled: parsed.senses?.workbench?.enabled === true,
+        workbenchMcpCommand: typeof workbenchCommand === "string" && workbenchCommand.trim().length > 0
+            ? workbenchCommand
+            : null,
     };
 }
+function defaultWorkbenchMcpCandidates(deps) {
+    const homeDir = deps.homeDir ?? os.homedir();
+    return [
+        path.join(homeDir, "Applications", "Ouro Workbench.app", "Contents", "MacOS", "OuroWorkbenchMCP"),
+        path.join("/Applications", "Ouro Workbench.app", "Contents", "MacOS", "OuroWorkbenchMCP"),
+    ];
+}
+function cliPathExists(deps, filePath) {
+    return !!filePath && (deps.existsSync ?? fs.existsSync)(filePath);
+}
+function findInstalledWorkbenchMcp(deps, preferred) {
+    const candidates = [
+        ...(preferred ? [preferred] : []),
+        ...defaultWorkbenchMcpCandidates(deps),
+    ];
+    return candidates.find((candidate) => cliPathExists(deps, candidate)) ?? null;
+}
+function writeWorkbenchMcpRegistration(agent, executablePath, deps) {
+    const { configPath } = (0, auth_flow_1.readAgentConfigForAgent)(agent, deps.bundlesRoot);
+    enableAgentSense(agent, "workbench", deps);
+    const nextRaw = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+    const mcpServers = nextRaw.mcpServers && typeof nextRaw.mcpServers === "object" && !Array.isArray(nextRaw.mcpServers)
+        ? nextRaw.mcpServers
+        : {};
+    nextRaw.mcpServers = {
+        ...mcpServers,
+        ouro_workbench: {
+            command: executablePath,
+            args: [],
+        },
+    };
+    fs.writeFileSync(configPath, `${JSON.stringify(nextRaw, null, 2)}\n`, "utf-8");
+}
 async function buildConnectMenu(agent, deps, onProgress) {
     const bundlesRoot = path.dirname(providerCliAgentRoot({ agent }, deps));
     let providerHealth;
@@ -2542,7 +2581,7 @@ async function buildConnectMenu(agent, deps, onProgress) {
     const runtimeConfig = await (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(agent, { preserveCachedOnFailure: true });
     onProgress?.("loading this machine's settings");
     const machineRuntime = await (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(agent, currentMachineId(deps), { preserveCachedOnFailure: true });
-    const { teamsEnabled, blueBubblesEnabled, mailEnabled, voiceEnabled, a2aEnabled } = readConnectBaySenseFlags(agent, deps);
+    const { teamsEnabled, blueBubblesEnabled, mailEnabled, voiceEnabled, a2aEnabled, workbenchEnabled, workbenchMcpCommand, } = readConnectBaySenseFlags(agent, deps);
     const perplexityApiKey = runtimeConfig.ok
         ? readRuntimeConfigString(runtimeConfig.config, "integrations.perplexityApiKey")
         : null;
@@ -2698,6 +2737,26 @@ async function buildConnectMenu(agent, deps, onProgress) {
             : "missing"
         : runtimeConfigReadStatus(runtimeConfig);
     const a2aStatus = a2aEnabled ? "ready" : "missing";
+    const installedWorkbenchMcp = findInstalledWorkbenchMcp(deps, workbenchMcpCommand);
+    const configuredWorkbenchMcpExists = cliPathExists(deps, workbenchMcpCommand);
+    const workbenchStatus = workbenchEnabled && configuredWorkbenchMcpExists
+        ? "ready"
+        : workbenchEnabled || workbenchMcpCommand
+            ? "needs attention"
+            : installedWorkbenchMcp
+                ? "not attached"
+                : "missing";
+    const workbenchDetailLines = [
+        workbenchEnabled ? "senses.workbench.enabled = true" : "senses.workbench.enabled is not enabled",
+        workbenchMcpCommand
+            ? configuredWorkbenchMcpExists
+                ? `MCP command registered: ${workbenchMcpCommand}`
+                : `registered MCP command is missing: ${workbenchMcpCommand}`
+            : "mcpServers.ouro_workbench is not registered",
+        installedWorkbenchMcp
+            ? `OuroWorkbenchMCP found: ${installedWorkbenchMcp}`
+            : "OuroWorkbenchMCP not found in ~/Applications or /Applications",
+    ];
     const entries = [
         {
             option: "1",
@@ -2826,6 +2885,20 @@ async function buildConnectMenu(agent, deps, onProgress) {
                 status: a2aStatus,
             }) ? `ouro connect a2a --agent ${agent}` : undefined,
         },
+        {
+            option: "9",
+            name: "Ouro Workbench",
+            section: "This machine",
+            status: workbenchStatus,
+            description: "Native terminal-agent control room and local MCP sense.",
+            detailLines: workbenchDetailLines,
+            nextAction: (0, connect_bay_1.connectEntryNeedsAttention)({
+                option: "9",
+                name: "Ouro Workbench",
+                section: "This machine",
+                status: workbenchStatus,
+            }) ? `ouro connect workbench --agent ${agent}` : undefined,
+        },
     ];
     const isTTY = connectMenuIsTTY(deps);
     return (0, connect_bay_1.renderConnectBay)(entries, {
@@ -4364,6 +4437,8 @@ function connectMenuTarget(answer) {
     /* v8 ignore next -- direct `ouro connect a2a` covers behavior; interactive menu requires broader provider/vault readiness work @preserve */
     if (normalized === "8" || normalized === "a2a" || normalized === "agent2agent" || normalized === "agent-to-agent")
         return "a2a";
+    if (normalized === "9" || normalized === "workbench" || normalized === "ouro-workbench" || normalized === "terminal-workbench")
+        return "workbench";
     return "cancel";
 }
 async function executeConnectVoice(agent, deps) {
@@ -4421,6 +4496,30 @@ async function executeConnectA2A(agent, deps) {
     deps.writeStdout(message);
     return message;
 }
+async function executeConnectWorkbench(agent, deps) {
+    const { workbenchMcpCommand } = readConnectBaySenseFlags(agent, deps);
+    const executablePath = findInstalledWorkbenchMcp(deps, workbenchMcpCommand);
+    if (!executablePath) {
+        throw new Error([
+            `Ouro Workbench is not installed for ${agent} on this machine.`,
+            "Expected the MCP executable at one of:",
+            ...defaultWorkbenchMcpCandidates(deps).map((candidate) => `  ${candidate}`),
+            "Install or copy Ouro Workbench.app there, then run:",
+            `  ouro connect workbench --agent ${agent}`,
+        ].join("\n"));
+    }
+    writeWorkbenchMcpRegistration(agent, executablePath, deps);
+    const syncSummary = pushAgentBundleAfterCliMutation(agent, deps);
+    const message = [
+        `Workbench connected for ${agent}`,
+        "agent.json: senses.workbench.enabled = true",
+        `agent.json: mcpServers.ouro_workbench.command = ${executablePath}`,
+        "Workbench is a local machine sense; provider secrets stay in the agent vault.",
+        ...(syncSummary ? [syncSummary] : []),
+    ].join("\n");
+    deps.writeStdout(message);
+    return message;
+}
 async function executeConnect(command, deps) {
     if (command.target === "providers")
         return executeConnectProviders(command.agent, deps);
@@ -4438,6 +4537,8 @@ async function executeConnect(command, deps) {
         return executeConnectVoice(command.agent, deps);
     if (command.target === "a2a")
         return executeConnectA2A(command.agent, deps);
+    if (command.target === "workbench")
+        return executeConnectWorkbench(command.agent, deps);
     const progress = createHumanCommandProgress(deps, "connect");
     let menu;
     try {
@@ -4449,7 +4550,7 @@ async function executeConnect(command, deps) {
     const promptInput = deps.promptInput;
     if (!promptInput) {
         const message = [
-            menu.replace(/\nChoose \[1-8\] or type a name: $/, ""),
+            menu.replace(/\nChoose \[1-9\] or type a name: $/, ""),
             "",
             `Run: ouro connect providers --agent ${command.agent}`,
             `Run: ouro connect perplexity --agent ${command.agent}`,
@@ -4459,6 +4560,7 @@ async function executeConnect(command, deps) {
             `Run: ouro connect mail --agent ${command.agent}`,
             `Run: ouro connect voice --agent ${command.agent}`,
             `Run: ouro connect a2a --agent ${command.agent}`,
+            `Run: ouro connect workbench --agent ${command.agent}`,
         ].join("\n");
         deps.writeStdout(message);
         return message;
@@ -4481,6 +4583,8 @@ async function executeConnect(command, deps) {
     /* v8 ignore next -- direct `ouro connect a2a` covers behavior; interactive menu requires broader provider/vault readiness work @preserve */
     if (answer === "a2a")
         return executeConnectA2A(command.agent, deps);
+    if (answer === "workbench")
+        return executeConnectWorkbench(command.agent, deps);
     const message = "connect cancelled.";
     deps.writeStdout(message);
     return message;

package/dist/heart/daemon/cli-help.js

@@ -187,9 +187,9 @@ exports.COMMAND_REGISTRY = {
     connect: {
         category: "Auth",
         description: "Set up providers, portable integrations, and local senses from one guided screen",
-        usage: "ouro connect [providers|perplexity|embeddings|teams|bluebubbles|mail|voice|a2a] [--agent <name>]",
+        usage: "ouro connect [providers|perplexity|embeddings|teams|bluebubbles|mail|voice|a2a|workbench] [--agent <name>]",
         example: "ouro connect",
-        subcommands: ["providers", "perplexity", "embeddings", "teams", "bluebubbles", "mail", "voice", "a2a"],
+        subcommands: ["providers", "perplexity", "embeddings", "teams", "bluebubbles", "mail", "voice", "a2a", "workbench"],
     },
     a2a: {
         category: "Friends",
@@ -342,6 +342,26 @@ const SUBCOMMAND_HELP = {
         usage: "ouro connect a2a [--agent <name>]",
         example: "ouro connect a2a --agent <agent>",
     },
+    "connect workbench": {
+        description: "Attach native Ouro Workbench on this machine and register its MCP sense",
+        usage: "ouro connect workbench [--agent <name>]",
+        example: "ouro connect workbench --agent <agent>",
+    },
+    "a2a card": {
+        description: "Print this agent's A2A Agent Card",
+        usage: "ouro a2a card [--agent <name>] [--base-url <url>] [--json]",
+        example: "ouro a2a card --agent <agent> --base-url https://agent.example --json",
+    },
+    "a2a onboard": {
+        description: "Onboard an A2A peer into the existing friend model",
+        usage: "ouro a2a onboard [--agent <name>] --card-url <url> [--trust <level>] [--name <name>]",
+        example: "ouro a2a onboard --agent <agent> --card-url https://peer.example/.well-known/agent-card.json --trust friend",
+    },
+    "a2a serve": {
+        description: "Run this agent's local A2A JSON-RPC sense server",
+        usage: "ouro a2a serve [--agent <name>] [--host <host>] [--port <port>] [--base-url <url>] [--path <path>]",
+        example: "ouro a2a serve --agent <agent> --base-url https://agent.example",
+    },
     "account ensure": {
         description: "Idempotently prepare an agent's vault-backed work substrate account and private Mailroom mailbox",
         usage: "ouro account ensure [--agent <name>] [--owner-email <email> --source <label>|--no-delegated-source] [--rotate-missing-mail-keys]",

package/dist/heart/daemon/cli-parse.js

@@ -84,7 +84,7 @@ function usage() {
         "  ouro -v|--version",
         "  ouro auth [--agent <name>] [--provider <provider>]",
         "  ouro account ensure [--agent <name>] [--owner-email <email> --source <label>|--no-delegated-source] [--rotate-missing-mail-keys]",
-        "  ouro connect [providers|perplexity|embeddings|teams|bluebubbles|mail|voice|a2a] [--agent <name>] [--owner-email <email> --source <label>|--no-delegated-source] [--rotate-missing-mail-keys]",
+        "  ouro connect [providers|perplexity|embeddings|teams|bluebubbles|mail|voice|a2a|workbench] [--agent <name>] [--owner-email <email> --source <label>|--no-delegated-source] [--rotate-missing-mail-keys]",
         "  ouro mail import-mbox --file <path> [--owner-email <email>] [--source <label>] [--agent <name>] [--foreground]",
         "  ouro mail backfill-indexes [--agent <name>] [--foreground]",
         "  ouro auth verify [--agent <name>] [--provider <provider>]",
@@ -744,7 +744,9 @@ function normalizeConnectTarget(value) {
         return "voice";
     if (value === "a2a" || value === "agent2agent" || value === "agent-to-agent")
         return "a2a";
-    throw new Error("Usage: ouro connect [providers|perplexity|embeddings|teams|bluebubbles|mail|voice|a2a] [--agent <name>]");
+    if (value === "workbench" || value === "ouro-workbench" || value === "terminal-workbench")
+        return "workbench";
+    throw new Error("Usage: ouro connect [providers|perplexity|embeddings|teams|bluebubbles|mail|voice|a2a|workbench] [--agent <name>]");
 }
 function extractMailSourceFlags(args, usageText) {
     const rest = [];
@@ -797,7 +799,7 @@ function extractMailSourceFlags(args, usageText) {
     };
 }
 function parseConnectCommand(args) {
-    const usageText = "Usage: ouro connect [providers|perplexity|embeddings|teams|bluebubbles|mail|voice|a2a] [--agent <name>] [--owner-email <email> --source <label>|--no-delegated-source] [--rotate-missing-mail-keys]";
+    const usageText = "Usage: ouro connect [providers|perplexity|embeddings|teams|bluebubbles|mail|voice|a2a|workbench] [--agent <name>] [--owner-email <email> --source <label>|--no-delegated-source] [--rotate-missing-mail-keys]";
     const { agent, rest: afterAgent } = extractAgentFlag(args);
     const mailFlags = extractMailSourceFlags(afterAgent, usageText);
     if (mailFlags.rest.length > 1)

package/dist/heart/daemon/sense-manager.js

@@ -57,6 +57,7 @@ function defaultSenses() {
         mail: { ...identity_1.DEFAULT_AGENT_SENSES.mail },
         voice: { ...identity_1.DEFAULT_AGENT_SENSES.voice },
         a2a: { ...identity_1.DEFAULT_AGENT_SENSES.a2a },
+        workbench: { ...identity_1.DEFAULT_AGENT_SENSES.workbench },
     };
 }
 function readAgentSenses(agentJsonPath) {
@@ -82,7 +83,7 @@ function readAgentSenses(agentJsonPath) {
     if (!rawSenses || typeof rawSenses !== "object" || Array.isArray(rawSenses)) {
         return defaults;
     }
-    for (const sense of ["cli", "teams", "bluebubbles", "mail", "voice", "a2a"]) {
+    for (const sense of ["cli", "teams", "bluebubbles", "mail", "voice", "a2a", "workbench"]) {
         const rawSense = rawSenses[sense];
         if (!rawSense || typeof rawSense !== "object" || Array.isArray(rawSense)) {
             continue;
@@ -147,6 +148,7 @@ function senseFactsFromRuntimeConfig(agent, senses, runtimeConfig, machineRuntim
         mail: { configured: false, detail: "not enabled in agent.json" },
         voice: { configured: false, detail: "not enabled in agent.json" },
         a2a: { configured: false, detail: "not enabled in agent.json" },
+        workbench: { configured: false, detail: "not enabled in agent.json" },
     };
     const payload = runtimeConfig.ok ? runtimeConfig.config : {};
     const unavailableDetail = runtimeConfigUnavailableDetail(agent, runtimeConfig);
@@ -301,6 +303,12 @@ function senseFactsFromRuntimeConfig(agent, senses, runtimeConfig, machineRuntim
             detail: publicUrl ? `${publicUrl}${endpointPath}` : `:${port} ${endpointPath}`,
         };
     }
+    if (senses.workbench.enabled) {
+        base.workbench = {
+            configured: true,
+            detail: "native Workbench local control room; MCP registration is stored in agent.json",
+        };
+    }
     return base;
 }
 function senseRepairHint(agent, sense) {
@@ -317,6 +325,10 @@ function senseRepairHint(agent, sense) {
     if (sense === "a2a") {
         return `Agent-runnable: run 'ouro connect a2a --agent ${agent}', then restart with 'ouro up'.`;
     }
+    /* v8 ignore next -- Workbench is deliberately not daemon-managed, so getSenseInventory never asks the daemon manager for a repair hint @preserve */
+    if (sense === "workbench") {
+        return `Agent-runnable: run 'ouro connect workbench --agent ${agent}' to enable senses.workbench.enabled and mcpServers.ouro_workbench in agent.json.`;
+    }
     return `Run 'ouro connect bluebubbles --agent ${agent}' to attach BlueBubbles on this machine; then run 'ouro up' again.`;
 }
 function currentMachineId() {
@@ -768,6 +780,9 @@ class DaemonSenseManager {
                     configured: context.facts.a2a.configured,
                     ...(runtime.get(agent)?.a2a ?? {}),
                 },
+                workbench: {
+                    configured: context.facts.workbench.configured,
+                },
             };
             const inventory = (0, sense_truth_1.getSenseInventory)({ senses: context.senses }, runtimeInfo);
             return inventory.map((entry) => ({

package/dist/heart/identity.js

@@ -138,6 +138,7 @@ exports.DEFAULT_AGENT_SENSES = {
     mail: { enabled: false },
     voice: { enabled: false },
     a2a: { enabled: false },
+    workbench: { enabled: false },
 };
 function normalizeSenses(value, configFile) {
     const defaults = {
@@ -147,6 +148,7 @@ function normalizeSenses(value, configFile) {
         mail: { ...exports.DEFAULT_AGENT_SENSES.mail },
         voice: { ...exports.DEFAULT_AGENT_SENSES.voice },
         a2a: { ...exports.DEFAULT_AGENT_SENSES.a2a },
+        workbench: { ...exports.DEFAULT_AGENT_SENSES.workbench },
     };
     if (value === undefined) {
         return defaults;
@@ -162,7 +164,7 @@ function normalizeSenses(value, configFile) {
         throw new Error(`agent.json at ${configFile} must include senses as an object when present.`);
     }
     const raw = value;
-    const senseNames = ["cli", "teams", "bluebubbles", "mail", "voice", "a2a"];
+    const senseNames = ["cli", "teams", "bluebubbles", "mail", "voice", "a2a", "workbench"];
     for (const senseName of senseNames) {
         const rawSense = raw[senseName];
         if (rawSense === undefined) {
@@ -207,6 +209,7 @@ function buildDefaultAgentTemplate(_agentName) {
             mail: { ...exports.DEFAULT_AGENT_SENSES.mail },
             voice: { ...exports.DEFAULT_AGENT_SENSES.voice },
             a2a: { ...exports.DEFAULT_AGENT_SENSES.a2a },
+            workbench: { ...exports.DEFAULT_AGENT_SENSES.workbench },
         },
         phrases: {
             thinking: [...exports.DEFAULT_AGENT_PHRASES.thinking],

package/dist/heart/sense-truth.js

@@ -10,6 +10,7 @@ const SENSES = [
     { sense: "mail", label: "Mail", daemonManaged: true },
     { sense: "voice", label: "Voice", daemonManaged: true },
     { sense: "a2a", label: "A2A", daemonManaged: true },
+    { sense: "workbench", label: "Workbench", daemonManaged: false },
 ];
 function configuredSenses(senses) {
     const configured = senses ?? {};
@@ -21,6 +22,7 @@ function configuredSenses(senses) {
         mail: configured.mail ?? { ...identity_1.DEFAULT_AGENT_SENSES.mail },
         voice: configured.voice ?? { ...identity_1.DEFAULT_AGENT_SENSES.voice },
         a2a: configured.a2a ?? { ...identity_1.DEFAULT_AGENT_SENSES.a2a },
+        workbench: configured.workbench ?? { ...identity_1.DEFAULT_AGENT_SENSES.workbench },
     };
 }
 function resolveStatus(enabled, daemonManaged, runtimeInfo) {

package/dist/heart/turn-context.js

@@ -141,6 +141,7 @@ function readSenseStatusLines() {
         mail: configuredSenses.mail ?? { enabled: false },
         voice: configuredSenses.voice ?? { enabled: false },
         a2a: configuredSenses.a2a ?? { enabled: false },
+        workbench: configuredSenses.workbench ?? { enabled: false },
     };
     const payload = (0, config_1.loadConfig)();
     const agentName = (0, identity_1.getAgentName)();
@@ -185,6 +186,8 @@ function readSenseStatusLines() {
                 ? openAIRealtimeVoiceReady
                 : cascadeVoiceReady,
         a2a: true,
+        workbench: typeof config.mcpServers?.ouro_workbench?.command === "string"
+            && config.mcpServers.ouro_workbench.command.trim().length > 0,
     };
     const rows = [
         { label: "CLI", status: "interactive" },
@@ -208,6 +211,10 @@ function readSenseStatusLines() {
             label: "A2A",
             status: senses.a2a.enabled ? "ready" : "disabled",
         },
+        {
+            label: "Workbench",
+            status: !senses.workbench.enabled ? "disabled" : configured.workbench ? "ready" : "needs_config",
+        },
     ];
     return rows.map((row) => `- ${row.label}: ${row.status}`);
 }

package/dist/mind/prompt.js

@@ -440,6 +440,7 @@ function localSenseStatusLines() {
         mail: configuredSenses.mail ?? { enabled: false },
         voice: configuredSenses.voice ?? { enabled: false },
         a2a: configuredSenses.a2a ?? { enabled: false },
+        workbench: configuredSenses.workbench ?? { enabled: false },
     };
     const payload = (0, config_1.loadConfig)();
     const runtimeConfig = (0, runtime_credentials_1.readRuntimeCredentialConfig)((0, identity_1.getAgentName)());
@@ -463,6 +464,8 @@ function localSenseStatusLines() {
             && hasTextField(voice, "whisperCliPath")
             && hasTextField(voice, "whisperModelPath"),
         a2a: true,
+        workbench: typeof config.mcpServers?.ouro_workbench?.command === "string"
+            && config.mcpServers.ouro_workbench.command.trim().length > 0,
     };
     const rows = [
         { label: "CLI", status: "interactive" },
@@ -486,6 +489,10 @@ function localSenseStatusLines() {
             label: "A2A",
             status: senses.a2a.enabled ? "ready" : "disabled",
         },
+        {
+            label: "Workbench",
+            status: !senses.workbench.enabled ? "disabled" : configured.workbench ? "ready" : "needs_config",
+        },
     ];
     return rows.map((row) => `- ${row.label}: ${row.status}`);
 }
@@ -504,6 +511,7 @@ function senseRuntimeGuidance(channel, preReadStatusLines) {
     lines.push("teams setup truth: run `ouro connect teams --agent <agent>` from the connect bay; it stores Teams runtime/config fields and enables `senses.teams.enabled`.");
     lines.push("bluebubbles setup truth: run `ouro connect bluebubbles --agent <agent>` from the connect bay; it stores this machine's BlueBubbles URL/password/listener config in the agent vault machine runtime item.");
     lines.push("a2a setup truth: run `ouro connect a2a --agent <agent>` to enable the A2A sense, `ouro a2a card --agent <agent> --base-url <public-url>` to publish an agent card, and `ouro a2a onboard --agent <agent> --card-url <peer-card-url>` to add a peer as an agent friend. A2A uses the existing friend trust model, not a separate trust registry.");
+    lines.push("workbench setup truth: Ouro Workbench is the local machine sense for terminal/TUI agents. Enabling it means `agent.json` has `senses.workbench.enabled=true` and an `mcpServers.ouro_workbench` entry pointing at the installed `OuroWorkbenchMCP` executable. The boss observes and queues auditable Workbench actions through `workbench_status`, `workbench_sense`, `workbench_transcript_tail`, `workbench_search_transcripts`, `workbench_recovery_drill`, and `workbench_request_action`; raw provider secrets remain in the agent vault, and Apple notarization is unrelated to local use.");
     lines.push("mail setup AX: if a human asks me to set up email, I do not hand them a terminal checklist. I guide the flow end-to-end: name the current phase, run agent-runnable commands myself with shell/tools when available, ask the human only for human-required facts or browser actions, wait for their reply, verify the result, then continue.");
     lines.push("mail setup hard rule: never tell the human to run `ouro account ensure`, `ouro connect mail`, `ouro mail import-mbox`, `ouro status`, or `ouro doctor` for setup. Say what I am about to run, run it myself, and report the result. If my current surface cannot run shell/tools, I ask for a tool-capable Ouro setup session or companion to continue; I do not offload CLI operation to the human.");
     lines.push("mail setup truth: Agent Mail uses Mailroom, not HEY OAuth/IMAP. For the full work substrate account, the agent-runnable command is `ouro account ensure --agent <agent> --owner-email <email> --source hey`; use `ouro connect mail --agent <agent> --owner-email <email> --source hey` for mail-only repair/provisioning, or `--no-delegated-source` for native-only mail. The detailed runbook is `docs/agent-mail-setup.md`.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.654",
+  "version": "0.1.0-alpha.657",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",