@ouro.bot/cli 0.1.0-alpha.674 → 0.1.0-alpha.676

package/dist/heart/daemon/cli-exec.js

@@ -100,6 +100,7 @@ const core_2 = require("../../nerves/review/core");
 const cli_render_1 = require("./cli-render");
 const cli_defaults_1 = require("./cli-defaults");
 const agent_config_check_1 = require("./agent-config-check");
+const private_runtime_1 = require("../private-runtime");
 const doctor_1 = require("./doctor");
 const cli_render_doctor_1 = require("./cli-render-doctor");
 const interactive_repair_1 = require("./interactive-repair");
@@ -312,10 +313,13 @@ function providerStatusRowsCoverAgents(rows, agents) {
     }
     return true;
 }
+function providerRowNeedsLiveReadinessRefresh(row) {
+    return row.provider !== "unconfigured" && row.readiness === "unknown";
+}
 async function checkAgentProvidersFromDaemonStatus(deps, agents, onProgress) {
     const uniqueAgents = [...new Set(agents)];
     if (uniqueAgents.length === 0)
-        return [];
+        return { degraded: [], needsLiveReadinessRefresh: false };
     let response;
     try {
         response = await deps.sendCommand(deps.socketPath, { kind: "daemon.status" });
@@ -342,7 +346,10 @@ async function checkAgentProvidersFromDaemonStatus(deps, agents, onProgress) {
     onProgress?.(degraded.length === 0
         ? "provider readiness confirmed by daemon status"
         : "provider readiness reported by daemon status");
-    return degraded;
+    return {
+        degraded,
+        needsLiveReadinessRefresh: rows.some(providerRowNeedsLiveReadinessRefresh),
+    };
 }
 async function checkAgentProviderHealth(agentName, bundlesRoot, deps, onProgress, options = {}) {
     const liveDeps = {};
@@ -425,11 +432,12 @@ function agentResolutionFailureMode(command) {
         case "attention.list":
         case "attention.show":
         case "attention.history":
+        case "private.decisions":
+        case "private.status":
         case "work.card":
         case "work.gauntlet":
         case "work.sentinel":
         case "work.sentinel.refresh":
-        case "inner.status":
         case "session.list":
             return "return-message";
         case "a2a.card":
@@ -513,9 +521,57 @@ function managedAgentsSignature(agentNames) {
 async function checkAlreadyRunningAgentProviders(deps, onProgress) {
     const agents = await listCliAgents(deps);
     const statusResult = await checkAgentProvidersFromDaemonStatus(deps, agents, onProgress);
-    if (statusResult)
-        return statusResult;
-    return checkAgentProviders(deps, agents, onProgress);
+    if (statusResult) {
+        const configResult = await checkAgentConfigsOffline(deps, agents);
+        if (configResult.length > 0) {
+            return { degraded: [...statusResult.degraded, ...configResult], source: "daemon-status" };
+        }
+        if (statusResult.needsLiveReadinessRefresh) {
+            return { degraded: await checkAgentProviders(deps, agents, onProgress), source: "live-provider-check" };
+        }
+        return { degraded: statusResult.degraded, source: "daemon-status" };
+    }
+    return { degraded: await checkAgentConfigsOffline(deps, agents, onProgress), source: "offline-config" };
+}
+async function checkAgentConfigsOffline(deps, agents, onProgress) {
+    const bundlesRoot = deps.bundlesRoot ?? (0, identity_1.getAgentBundlesRoot)();
+    const degraded = [];
+    for (const agent of [...new Set(agents)]) {
+        try {
+            const result = (0, agent_config_check_1.checkAgentConfig)(agent, bundlesRoot);
+            if (result.ok)
+                continue;
+            const errorReason = result.error ?? "agent config validation failed";
+            const fixHint = result.fix ?? "";
+            degraded.push({ agent, errorReason, fixHint, ...(result.issue ? { issue: result.issue } : {}) });
+            (0, runtime_1.emitNervesEvent)({
+                level: "error",
+                component: "daemon",
+                event: "daemon.agent_config_invalid",
+                message: errorReason,
+                meta: { agent, fixProvided: fixHint.length > 0, source: "already-running-offline-config-check" },
+            });
+        }
+        catch (error) {
+            const errorReason = error instanceof Error ? error.message : String(error);
+            degraded.push({
+                agent,
+                errorReason,
+                fixHint: "Run 'ouro doctor' for diagnostics, then retry 'ouro up'.",
+            });
+            (0, runtime_1.emitNervesEvent)({
+                level: "error",
+                component: "daemon",
+                event: "daemon.agent_config_invalid",
+                message: errorReason,
+                meta: { agent, fixProvided: true, source: "already-running-offline-config-check" },
+            });
+        }
+    }
+    onProgress?.(degraded.length === 0
+        ? "agent config validated offline; provider readiness will refresh on explicit provider commands"
+        : "agent config validation reported by offline startup check");
+    return degraded;
 }
 function readinessIssueFromDegraded(entry) {
     return entry.issue ?? (0, readiness_repair_1.genericReadinessIssue)({
@@ -548,6 +604,23 @@ function providerRepairCountSummary(count) {
         return "selected providers answered live checks";
     return `${count} ${count === 1 ? "needs" : "need"} attention`;
 }
+function startupConfigCheckSummary(count) {
+    if (count === 0)
+        return "agent config validated offline";
+    return `${count} ${count === 1 ? "needs" : "need"} attention`;
+}
+function startupProviderCheckSummary(result) {
+    if (result.source === "daemon-status" && result.degraded.length === 0) {
+        return "provider readiness confirmed by daemon status";
+    }
+    if (result.source === "daemon-status") {
+        return providerRepairCountSummary(result.degraded.length);
+    }
+    if (result.source === "live-provider-check") {
+        return providerRepairCountSummary(result.degraded.length);
+    }
+    return startupConfigCheckSummary(result.degraded.length);
+}
 /**
  * Layer 2: human-readable summary of boot-sync-probe findings, written to
  * stdout when any non-clean finding surfaces. The order reads "blockers
@@ -910,7 +983,13 @@ async function ensureDaemonRunning(deps, options = {}) {
         }
         return null;
     };
-    const alive = options.initialAlive ?? await deps.checkSocketAlive(deps.socketPath);
+    let alive;
+    if (typeof options.initialAlive === "boolean") {
+        alive = options.initialAlive;
+    }
+    else {
+        alive = await deps.checkSocketAlive(deps.socketPath);
+    }
     if (alive) {
         const localRuntime = (0, runtime_metadata_1.getRuntimeMetadata)();
         const localManagedAgents = managedAgentsSignature((0, agent_discovery_1.listEnabledBundleAgents)({
@@ -1362,6 +1441,12 @@ function writeAgentVaultConfig(agentName, configPath, config, vault) {
 function isJsonRecord(value) {
     return !!value && typeof value === "object" && !Array.isArray(value);
 }
+function daemonMessageReceiptId(response) {
+    if (!isJsonRecord(response.data))
+        return undefined;
+    const id = response.data.id;
+    return typeof id === "string" && id.trim().length > 0 ? id : undefined;
+}
 function cloneJsonRecord(value) {
     return JSON.parse(JSON.stringify(value));
 }
@@ -3850,6 +3935,22 @@ function makeBackgroundOperationId(kind) {
     const prefix = kind === "mail.import-mbox" ? "op_mail_import" : "op_mail_backfill";
     return `${prefix}_${(0, crypto_1.randomUUID)().slice(0, 8)}`;
 }
+function buildMailOperationPrivateWakeCommand(agentName, record) {
+    const status = record.status === "failed" ? "failed" : "succeeded";
+    return {
+        kind: "private.wake",
+        agent: agentName,
+        reason: "mail background operation private attention",
+        triggerSource: "mail-background-operation",
+        budgetClass: "interactive",
+        idempotencyKey: `mail-operation:${agentName}:${record.id}:${status}`,
+        originRefs: [
+            { kind: "background-operation", id: record.id },
+            { kind: "mail-operation", id: record.kind },
+            { kind: "mail-operation-status", id: status },
+        ],
+    };
+}
 async function notifyMailOperation(agentName, record, deps) {
     const lines = [
         "[Background Operation]",
@@ -3881,7 +3982,7 @@ async function notifyMailOperation(agentName, record, deps) {
         mode: "reflect",
     });
     await queueMailOperationTargetNotification(agentName, content, deps).catch(() => undefined);
-    await deps.sendCommand(deps.socketPath, { kind: "inner.wake", agent: agentName })
+    await deps.sendCommand(deps.socketPath, buildMailOperationPrivateWakeCommand(agentName, record))
         .then(() => undefined)
         .catch(() => undefined);
 }
@@ -6159,9 +6260,10 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
             }
         }
         progress.startPhase("provider checks");
-        const providerDegraded = await checkAlreadyRunningAgentProviders(deps, (msg) => progress.updateDetail(msg));
+        const providerCheck = await checkAlreadyRunningAgentProviders(deps, (msg) => progress.updateDetail(msg));
+        const providerDegraded = providerCheck.degraded;
         daemonResult.stability = mergeStartupStability(daemonResult.stability, providerDegraded);
-        progress.completePhase("provider checks", providerRepairCountSummary(providerDegraded.length));
+        progress.completePhase("provider checks", startupProviderCheckSummary(providerCheck));
         progress.startPhase("final daemon check");
         const finalDaemonCheck = await verifyDaemonReadyForHandoff(deps, {
             allowDegradedHealth: Boolean(command.noRepair
@@ -6616,7 +6718,7 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
         // when the daemon socket file doesn't exist — otherwise every
         // Claude Code lifecycle event during a daemon-down window logs two
         // ENOENT errors in ouro.ndjson (one for message.send, one for
-        // inner.wake) which makes it hard to read the log around outages.
+        // private.wake) which makes it hard to read the log around outages.
         // The hook is best-effort: dropping notifications when the daemon
         // is down is the correct behavior; we just don't want to log spam
         // about it.
@@ -6627,14 +6729,25 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
                 // single tool use. A long Claude Code working session can fire
                 // dozens of post-tool-use hooks per minute; waking the agent
                 // synchronously on each one creates a feedback storm where the
-                // inner loop is re-prompted faster than it can rest, the
+                // private runtime is re-prompted faster than it can rest, the
                 // "...time passing. anything stirring?" probe fires back-to-back,
                 // and the agent burns its attention budget responding to wakes
                 // instead of doing actual work. The message is still delivered
                 // either way (above); the agent picks it up on its next natural
                 // turn.
                 if (eventType === "session-start" || eventType === "stop") {
-                    await deps.sendCommand(deps.socketPath, { kind: "inner.wake", agent: command.agent }).catch(() => { });
+                    await deps.sendCommand(deps.socketPath, {
+                        kind: "private.wake",
+                        agent: command.agent,
+                        reason: `Claude Code ${eventType} hook`,
+                        triggerSource: "dev-tool-hook",
+                        budgetClass: "interactive",
+                        idempotencyKey: `dev-tool-hook:${command.agent}:${eventType}:${sessionId}`,
+                        originRefs: [
+                            { kind: "dev-tool-hook", id: eventType },
+                            { kind: "session", id: sessionId },
+                        ],
+                    }).catch(() => { });
                 }
             }
             catch { /* daemon not running — silent */ }
@@ -6817,6 +6930,32 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
         return "";
     }
     /* v8 ignore stop */
+    if (command.kind === "private.decisions") {
+        let response;
+        try {
+            response = await deps.sendCommand(deps.socketPath, {
+                kind: "private.decisions",
+                agent: command.agent,
+                limit: command.limit,
+            });
+        }
+        catch {
+            const message = "daemon unavailable — start with `ouro up` first";
+            deps.writeStdout(message);
+            return message;
+        }
+        if (!response.ok) {
+            const message = response.error ?? "unknown error";
+            deps.writeStdout(message);
+            return message;
+        }
+        const payload = (0, private_runtime_1.privateDecisionReadPayloadFromDaemonData)(response.data, command.agent);
+        const message = command.json
+            ? (0, private_runtime_1.formatPrivateDecisionReadJson)(payload)
+            : (0, private_runtime_1.formatPrivateDecisionReadText)(payload);
+        deps.writeStdout(message);
+        return message;
+    }
     // ── mcp subcommands (routed through daemon socket) ──
     if (command.kind === "mcp.list" || command.kind === "mcp.call") {
         const daemonCommand = toDaemonCommand(command);
@@ -7371,7 +7510,7 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
             /* v8 ignore next -- production fallback: tests always inject bundlesRoot via createTmpBundle @preserve */
             const bundlesRoot = deps.bundlesRoot ?? (0, identity_1.getAgentBundlesRoot)();
             const agentRoot = path.join(bundlesRoot, `${command.agent}.ouro`);
-            const sessionFilePath = (0, thoughts_1.getInnerDialogSessionPath)(agentRoot);
+            const sessionFilePath = (0, thoughts_1.getPrivateRuntimeSessionPath)(agentRoot);
             if (command.json) {
                 try {
                     const raw = fs.readFileSync(sessionFilePath, "utf-8");
@@ -7379,12 +7518,12 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
                     return raw;
                 }
                 catch {
-                    const message = "no inner dialog session found";
+                    const message = "no private-runtime session found";
                     deps.writeStdout(message);
                     return message;
                 }
             }
-            const turns = (0, thoughts_1.parseInnerDialogSession)(sessionFilePath);
+            const turns = (0, thoughts_1.parsePrivateRuntimeSession)(sessionFilePath);
             const message = (0, thoughts_1.formatThoughtTurns)(turns, command.last ?? 10);
             deps.writeStdout(message);
             if (command.follow) {
@@ -7516,9 +7655,9 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
         deps.writeStdout(message);
         return message;
     }
-    // ── inner dialog status (local, no daemon socket needed) ──
-    /* v8 ignore start -- inner status handler: requires real agent state on disk @preserve */
-    if (command.kind === "inner.status") {
+    // ── private runtime status (local, no daemon socket needed) ──
+    /* v8 ignore start -- private status handler: requires real agent state on disk @preserve */
+    if (command.kind === "private.status") {
         try {
             const agentRoot = deps.agentBundleRoot ?? (0, identity_1.getAgentRoot)(command.agent);
             const { buildInnerStatusOutput } = await Promise.resolve().then(() => __importStar(require("./inner-status")));
@@ -7526,8 +7665,8 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
             const { parseFrontmatter } = await Promise.resolve().then(() => __importStar(require("../../util/frontmatter")));
             const { listActiveReturnObligations } = await Promise.resolve().then(() => __importStar(require("../../arc/obligations")));
             const { resolveDeskRecordPaths } = await Promise.resolve().then(() => __importStar(require("../../mind/record-paths")));
-            // Read runtime state
-            const innerSessionPath = (0, thoughts_1.getInnerDialogSessionPath)(agentRoot);
+            // Read runtime state from the persisted historical session location.
+            const innerSessionPath = (0, thoughts_1.getPrivateRuntimeSessionPath)(agentRoot);
             const runtimeJsonPath = path.join(path.dirname(innerSessionPath), "runtime.json");
             let runtimeState = null;
             try {
@@ -7580,7 +7719,7 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
             catch { /* no habits — heartbeat unknown */ }
             // Attention count
             const activeObligations = listActiveReturnObligations(command.agent);
-            const message = buildInnerStatusOutput({
+            const statusOutput = buildInnerStatusOutput({
                 agentName: command.agent,
                 runtimeState,
                 recordSummary,
@@ -7588,6 +7727,9 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
                 attentionCount: activeObligations.length,
                 now: Date.now(),
             });
+            const message = command.legacyAlias === "inner"
+                ? [`legacy alias: use \`ouro private status --agent ${command.agent}\``, statusOutput].join("\n")
+                : statusOutput;
             deps.writeStdout(message);
             return message;
         }
@@ -7901,11 +8043,25 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
         response = await deps.sendCommand(deps.socketPath, daemonCommand);
         // `ouro msg` is operator-driven and expects the recipient to process the
         // message now (vs. on next natural turn). message.send is queue-only as
-        // of the 2026-05-11 fix; we explicitly fire inner.wake to preserve the
+        // of the 2026-05-11 fix; we explicitly fire private.wake to preserve the
         // historical CLI UX. Background callers (hooks, API) deliberately omit
         // this and let the agent pick up notifications on its next turn.
         if (command.kind === "message.send" && command.from === "ouro-cli") {
-            await deps.sendCommand(deps.socketPath, { kind: "inner.wake", agent: command.to }).catch(() => { });
+            const receiptId = daemonMessageReceiptId(response);
+            await deps.sendCommand(deps.socketPath, {
+                kind: "private.wake",
+                agent: command.to,
+                reason: "operator CLI message",
+                triggerSource: "operator-cli",
+                budgetClass: "interactive",
+                idempotencyKey: receiptId
+                    ? `cli:message:${command.to}:${receiptId}`
+                    : `cli:message:${command.to}:unreceipted`,
+                originRefs: [
+                    { kind: "cli-command", id: "ouro msg" },
+                    ...(receiptId ? [{ kind: "daemon-receipt", id: receiptId }] : []),
+                ],
+            }).catch(() => { });
         }
     }
     catch (error) {

package/dist/heart/daemon/cli-help.js

@@ -273,15 +273,23 @@ exports.COMMAND_REGISTRY = {
     },
     thoughts: {
         category: "Internal",
-        description: "View agent inner dialog thoughts",
+        description: "View private runtime transcript turns",
         usage: "ouro thoughts [--last <n>] [--json] [--follow] [--agent <name>]",
         example: "ouro thoughts --last 5 --follow",
     },
+    private: {
+        category: "Internal",
+        description: "Inspect private-runtime status and policy decisions",
+        usage: "ouro private status|decisions [--agent <name>] [--limit <n>] [--json]",
+        example: "ouro private status --agent ouroboros",
+        subcommands: ["status", "decisions"],
+    },
     inner: {
         category: "Internal",
-        description: "Show inner dialog status",
+        description: "Legacy alias for `ouro private status`",
         usage: "ouro inner [--agent <name>]",
         example: "ouro inner",
+        hidden: true,
     },
     attention: {
         category: "Internal",
@@ -331,6 +339,16 @@ exports.COMMAND_REGISTRY = {
     },
 };
 const SUBCOMMAND_HELP = {
+    "private decisions": {
+        description: "Read recent private-runtime allow/deny decisions from the policy ledger",
+        usage: "ouro private decisions [--agent <name>] [--limit <n>] [--json]",
+        example: "ouro private decisions --agent ouroboros --json",
+    },
+    "private status": {
+        description: "Show private-runtime status from local agent state",
+        usage: "ouro private status [--agent <name>]",
+        example: "ouro private status --agent ouroboros",
+    },
     "auth verify": {
         description: "Verify agent provider credentials without changing provider/model lanes",
         usage: "ouro auth verify [--agent <name>] [--provider <provider>]",

package/dist/heart/daemon/cli-parse.js

@@ -118,9 +118,10 @@ function usage() {
         "  ouro friend create --name <name> [--trust <level>] [--agent <name>]",
         "  ouro friend update <id> --trust <level> [--agent <name>]",
         "  ouro thoughts [--last <n>] [--json] [--follow] [--agent <name>]",
+        "  ouro private decisions [--agent <name>] [--limit <n>] [--json]",
+        "  ouro private status [--agent <name>]",
         "  ouro work card|gauntlet|sentinel [refresh] [--agent <name>] [--format text|json|--json]",
         "  ouro nerves-review [--agent <name>] [--process <name>] [--component <substr>] [--event <substr>] [--level <level>] [--since <duration>] [--limit <n>] [--json]",
-        "  ouro inner [--agent <name>]",
         "  ouro friend link <agent> --friend <id> --provider <p> --external-id <eid>",
         "  ouro friend unlink <agent> --friend <id> --provider <p> --external-id <eid>",
         "  ouro a2a card [--agent <name>] [--base-url <url>] [--json]",
@@ -1637,6 +1638,46 @@ function parseNervesReviewCommand(args) {
         json,
     };
 }
+function parsePrivateCommand(args) {
+    const [subcommand] = args;
+    if (subcommand === "status") {
+        const { agent, rest } = extractAgentFlag(args.slice(1));
+        if (rest.length > 0) {
+            throw new Error("Usage: ouro private status [--agent <name>]");
+        }
+        return { kind: "private.status", ...(agent ? { agent } : {}) };
+    }
+    if (subcommand !== "decisions") {
+        throw new Error("Usage: ouro private decisions [--agent <name>] [--limit <n>] [--json] OR ouro private status [--agent <name>]");
+    }
+    const { agent, rest } = extractAgentFlag(args.slice(1));
+    let limit = 20;
+    let json = false;
+    for (let i = 0; i < rest.length; i += 1) {
+        const token = rest[i];
+        const next = rest[i + 1];
+        if (token === "--json") {
+            json = true;
+            continue;
+        }
+        if (token === "--limit" && next) {
+            const parsed = Number.parseInt(next, 10);
+            if (!Number.isInteger(parsed) || String(parsed) !== next || parsed < 1 || parsed > 1000) {
+                throw new Error("private decisions --limit must be an integer between 1 and 1000");
+            }
+            limit = parsed;
+            i += 1;
+            continue;
+        }
+        throw new Error("Usage: ouro private decisions [--agent <name>] [--limit <n>] [--json]");
+    }
+    return {
+        kind: "private.decisions",
+        ...(agent ? { agent } : {}),
+        limit,
+        json,
+    };
+}
 // ── Main dispatch ──
 function parseOuroCommand(args) {
     const [head, second] = args;
@@ -1787,13 +1828,15 @@ function parseOuroCommand(args) {
     }
     if (head === "thoughts")
         return parseThoughtsCommand(args.slice(1));
+    if (head === "private")
+        return parsePrivateCommand(args.slice(1));
     if (head === "attention")
         return parseAttentionCommand(args.slice(1));
     if (head === "work")
         return parseWorkCommand(args.slice(1));
     if (head === "inner") {
         const { agent } = extractAgentFlag(args.slice(1));
-        return { kind: "inner.status", ...(agent ? { agent } : {}) };
+        return { kind: "private.status", ...(agent ? { agent } : {}), legacyAlias: "inner" };
     }
     if (head === "chat") {
         if (!second)

package/dist/heart/daemon/cli-render.js

@@ -239,6 +239,7 @@ function parseStatusPayload(data) {
         return {
             agent,
             worker,
+            autoStart: booleanField(row.autoStart) ?? true,
             status,
             pid,
             restartCount,