@ouro.bot/cli 0.1.0-alpha.677 → 0.1.0-alpha.679

package/changelog.json

@@ -1,6 +1,18 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.679",
+      "changes": [
+        "Preserve machine runtime config during A2A identity writes and report BlueBubbles attachment gaps before stale proof facts."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.678",
+      "changes": [
+        "Register dev-tool MCP clients through the installed ouro command instead of repo dist, preventing Codex and Claude setup from pinning long-lived clients to stale ignored build artifacts."
+      ]
+    },
     {
       "version": "0.1.0-alpha.677",
       "changes": [

package/dist/a2a/identity.js

@@ -143,21 +143,28 @@ async function loadOrMintA2AIdentity(input) {
  * Load (or mint-on-first-use) THIS agent's own A2A identity from the machine-local
  * runtime config — the convenience entry the main-process tools use to obtain the
  * self identity that signs outbound sealed envelopes. Mirrors the a2a sense
- * entrypoint's load (read machine config → `loadOrMintA2AIdentity` → persist a fresh
- * seed under the right machine id). Reads the in-memory machine-config cache (no
- * remote vault round-trip per call). `sodium` is optional (defaults to `ready()`).
+ * entrypoint's load (use a cached seed when present, otherwise refresh machine
+ * config → `loadOrMintA2AIdentity` → merge a fresh seed under the right machine
+ * id). `sodium` is optional (defaults to `ready()`).
  */
 async function loadSelfA2AIdentity(input) {
     const sodium = input.sodium ?? await (0, a2a_client_1.ready)();
     const machineId = (0, machine_identity_1.loadOrCreateMachineIdentity)({ homeDir: os.homedir() }).machineId;
-    const read = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(input.agentName);
+    const cached = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(input.agentName);
+    const read = cached.ok && readStoredA2ASeed(cached.config)
+        ? cached
+        : await (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(input.agentName, machineId);
+    if (!read.ok && read.reason !== "missing") {
+        throw new Error(`A2A identity requires readable machine runtime config at ${read.itemPath}: ${read.error}`);
+    }
     const config = read.ok ? read.config : {};
     return loadOrMintA2AIdentity({
         agentName: input.agentName,
         sodium,
         config,
         upsert: async (next) => {
-            await (0, runtime_credentials_1.upsertMachineRuntimeCredentialConfig)(input.agentName, machineId, next);
+            const seed = readStoredA2ASeed(next);
+            await (0, runtime_credentials_1.mergeMachineRuntimeCredentialConfig)(input.agentName, machineId, { a2a: { identity: { ed25519Seed: seed } } });
         },
     });
 }

package/dist/heart/daemon/cli-exec.js

@@ -1865,7 +1865,7 @@ async function executeVaultRecover(command, deps) {
                 await (0, runtime_credentials_1.upsertRuntimeCredentialConfig)(command.agent, splitRuntimeConfig.agentConfig, now);
             }
             if (machineRuntimeFields.length > 0) {
-                await (0, runtime_credentials_1.upsertMachineRuntimeCredentialConfig)(command.agent, currentMachineId(deps), splitRuntimeConfig.machineConfig, now);
+                await (0, runtime_credentials_1.mergeMachineRuntimeCredentialConfig)(command.agent, currentMachineId(deps), splitRuntimeConfig.machineConfig, now);
             }
             return {
                 providerCount: importedProviders.size,
@@ -2125,19 +2125,20 @@ function runtimeScopeLabel(scope) {
 async function storeRuntimeConfigKeys(input) {
     const machineId = input.scope === "machine" ? currentMachineId(input.deps) : undefined;
     input.onProgress?.("checking existing runtime config");
-    const current = input.scope === "machine"
-        ? await (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(input.agent, machineId, { preserveCachedOnFailure: true })
-        : await (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(input.agent, { preserveCachedOnFailure: true });
-    if (!current.ok && current.reason !== "missing") {
-        throw new Error(`cannot read existing runtime credentials from ${current.itemPath}: ${current.error}`);
+    let nextConfig = {};
+    if (input.scope !== "machine") {
+        const current = await (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(input.agent, { preserveCachedOnFailure: true });
+        if (!current.ok && current.reason !== "missing") {
+            throw new Error(`cannot read existing runtime credentials from ${current.itemPath}: ${current.error}`);
+        }
+        nextConfig = current.ok ? current.config : {};
     }
-    let nextConfig = current.ok ? current.config : {};
     for (const entry of input.entries) {
-        input.onProgress?.(`storing ${entry.key} in ${current.itemPath}`);
+        input.onProgress?.(`storing ${entry.key} in ${runtimeScopeLabel(input.scope)}`);
         nextConfig = setRuntimeConfigValue(nextConfig, entry.key, entry.value);
     }
     const stored = input.scope === "machine"
-        ? await (0, runtime_credentials_1.upsertMachineRuntimeCredentialConfig)(input.agent, machineId, nextConfig, providerCliNow(input.deps))
+        ? await (0, runtime_credentials_1.mergeMachineRuntimeCredentialConfig)(input.agent, machineId, nextConfig, providerCliNow(input.deps))
         : await (0, runtime_credentials_1.upsertRuntimeCredentialConfig)(input.agent, nextConfig, providerCliNow(input.deps));
     input.onProgress?.(`stored ${input.entries.map((entry) => entry.key).join(", ")}; credential values were not printed`);
     return { revision: stored.revision, itemPath: stored.itemPath, ...(machineId ? { machineId } : {}) };
@@ -3470,8 +3471,7 @@ async function executeConnectBlueBubbles(agent, deps) {
             progress.end();
             throw new Error(`cannot read existing machine runtime credentials from ${current.itemPath}: ${current.error}`);
         }
-        const nextConfig = {
-            ...(current.ok ? current.config : {}),
+        const blueBubblesPatch = {
             bluebubbles: {
                 serverUrl,
                 password,
@@ -3485,7 +3485,7 @@ async function executeConnectBlueBubbles(agent, deps) {
             },
         };
         progress.updateDetail("storing local machine config");
-        stored = await (0, runtime_credentials_1.upsertMachineRuntimeCredentialConfig)(agent, machineId, nextConfig, providerCliNow(deps));
+        stored = await (0, runtime_credentials_1.mergeMachineRuntimeCredentialConfig)(agent, machineId, blueBubblesPatch, providerCliNow(deps));
         progress.updateDetail("enabling BlueBubbles in agent.json");
         enableAgentSense(agent, "bluebubbles", deps);
         progress.completePhase("saving BlueBubbles attachment", "secret stored");
@@ -6809,9 +6809,7 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
         }
         const sourceRoot = (0, identity_1.getRepoRoot)();
         const runtimeMode = (0, runtime_mode_1.detectRuntimeMode)(sourceRoot);
-        const baseMcpServeCommand = runtimeMode === "dev"
-            ? `node ${path.join(sourceRoot, "dist", "heart", "daemon", "ouro-bot-entry.js")} mcp-serve --agent ${setupAgent}`
-            : `ouro mcp-serve --agent ${setupAgent}`;
+        const baseMcpServeCommand = `ouro mcp-serve --agent ${setupAgent}`;
         const mcpServeCommand = `${mcpServePrefix}${baseMcpServeCommand}`;
         if (tool === "claude-code") {
             // 1. Register MCP server with Claude Code

package/dist/heart/daemon/sense-manager.js

@@ -756,17 +756,23 @@ class DaemonSenseManager {
         const rows = [...this.contexts.entries()].flatMap(([agent, context]) => {
             context.facts = senseFactsFromRuntimeConfig(agent, context.senses, (0, runtime_credentials_1.readRuntimeCredentialConfig)(agent), (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent));
             const blueBubblesRuntimeFacts = readBlueBubblesRuntimeFacts(agent, this.bundlesRoot, runtime.get(agent)?.bluebubbles);
+            const blueBubblesConfigured = context.facts.bluebubbles.configured;
             const runtimeInfo = {
                 cli: { configured: true },
                 teams: {
                     configured: context.facts.teams.configured,
                     ...(runtime.get(agent)?.teams ?? {}),
                 },
-                bluebubbles: {
-                    configured: context.facts.bluebubbles.configured,
-                    optional: context.facts.bluebubbles.optional,
-                    ...blueBubblesRuntimeFacts,
-                },
+                bluebubbles: blueBubblesConfigured
+                    ? {
+                        configured: true,
+                        optional: context.facts.bluebubbles.optional,
+                        ...blueBubblesRuntimeFacts,
+                    }
+                    : {
+                        configured: false,
+                        optional: context.facts.bluebubbles.optional,
+                    },
                 mail: {
                     configured: context.facts.mail.configured,
                     ...(runtime.get(agent)?.mail ?? {}),
@@ -793,11 +799,13 @@ class DaemonSenseManager {
                 status: entry.status,
                 detail: entry.enabled
                     ? entry.sense === "bluebubbles"
-                        ? blueBubblesRuntimeFacts.detail
-                            ?? context.facts[entry.sense].detail
+                        ? blueBubblesConfigured
+                            ? blueBubblesRuntimeFacts.detail
+                                ?? context.facts[entry.sense].detail
+                            : context.facts[entry.sense].detail
                         : context.facts[entry.sense].detail
                     : "not enabled in agent.json",
-                ...(entry.sense === "bluebubbles" ? {
+                ...(entry.sense === "bluebubbles" && blueBubblesConfigured ? {
                     proofMethod: blueBubblesRuntimeFacts.proofMethod,
                     lastProofAt: blueBubblesRuntimeFacts.lastProofAt,
                     proofAgeMs: blueBubblesRuntimeFacts.proofAgeMs,

package/dist/heart/runtime-credentials.js

@@ -45,6 +45,7 @@ exports.refreshRuntimeCredentialConfig = refreshRuntimeCredentialConfig;
 exports.refreshMachineRuntimeCredentialConfig = refreshMachineRuntimeCredentialConfig;
 exports.upsertRuntimeCredentialConfig = upsertRuntimeCredentialConfig;
 exports.upsertMachineRuntimeCredentialConfig = upsertMachineRuntimeCredentialConfig;
+exports.mergeMachineRuntimeCredentialConfig = mergeMachineRuntimeCredentialConfig;
 exports.resetRuntimeCredentialConfigCache = resetRuntimeCredentialConfigCache;
 const crypto = __importStar(require("node:crypto"));
 const runtime_1 = require("../nerves/runtime");
@@ -314,6 +315,17 @@ async function refreshRuntimeCredentialConfig(agentName, options = {}) {
 async function refreshMachineRuntimeCredentialConfig(agentName, machineId, options = {}) {
     return refreshRuntimeCredentialConfigItem(agentName, machineRuntimeConfigItemName(machineId), cacheMachineResult, options);
 }
+function mergeRuntimeCredentialConfig(base, patch) {
+    const next = { ...base };
+    for (const key of Object.keys(patch)) {
+        const baseValue = next[key];
+        const patchValue = patch[key];
+        next[key] = isRecord(baseValue) && isRecord(patchValue)
+            ? mergeRuntimeCredentialConfig(baseValue, patchValue)
+            : patchValue;
+    }
+    return next;
+}
 async function upsertRuntimeCredentialConfig(agentName, config, now = new Date()) {
     const payload = {
         schemaVersion: 1,
@@ -361,6 +373,16 @@ async function upsertMachineRuntimeCredentialConfig(agentName, machineId, config
     cacheMachineResult(agentName, result);
     return result;
 }
+// Partial machine-runtime writers must use this helper, not raw upsert: one
+// machine item carries multiple local attachments such as A2A, BlueBubbles, and Voice.
+async function mergeMachineRuntimeCredentialConfig(agentName, machineId, patch, now = new Date()) {
+    const current = await refreshMachineRuntimeCredentialConfig(agentName, machineId);
+    if (!current.ok && current.reason !== "missing") {
+        throw new Error(`cannot merge machine runtime config at ${current.itemPath}: ${current.error}`);
+    }
+    const base = current.ok ? current.config : {};
+    return upsertMachineRuntimeCredentialConfig(agentName, machineId, mergeRuntimeCredentialConfig(base, patch), now);
+}
 function resetRuntimeCredentialConfigCache() {
     cachedRuntimeConfigs = new Map();
     cachedMachineRuntimeConfigs = new Map();

package/dist/senses/a2a-entry.js

@@ -60,7 +60,7 @@ Promise.all([
     Promise.resolve().then(() => __importStar(require("../heart/machine-identity"))),
     Promise.resolve().then(() => __importStar(require("@ouro.bot/friends/a2a-client"))),
 ])
-    .then(async ([{ startA2AServer }, { loadOrMintA2AIdentity }, { waitForRuntimeCredentialBootstrap, readMachineRuntimeCredentialConfig, upsertMachineRuntimeCredentialConfig }, { loadOrCreateMachineIdentity }, { ready },]) => {
+    .then(async ([{ startA2AServer }, { loadOrMintA2AIdentity, readStoredA2ASeed }, { waitForRuntimeCredentialBootstrap, readMachineRuntimeCredentialConfig, refreshMachineRuntimeCredentialConfig, mergeMachineRuntimeCredentialConfig }, { loadOrCreateMachineIdentity }, { ready },]) => {
     const os = await Promise.resolve().then(() => __importStar(require("node:os")));
     // Wait for the daemon to deliver the machine-local runtime config (carrying the
     // a2a identity seed) into the in-memory cache before we read or mint identity.
@@ -73,14 +73,21 @@ Promise.all([
     });
     const sodium = await ready();
     const machineId = loadOrCreateMachineIdentity({ homeDir: os.homedir() }).machineId;
-    const machineConfigRead = readMachineRuntimeCredentialConfig(agentName);
+    const cachedMachineConfigRead = readMachineRuntimeCredentialConfig(agentName);
+    const machineConfigRead = cachedMachineConfigRead.ok && readStoredA2ASeed(cachedMachineConfigRead.config)
+        ? cachedMachineConfigRead
+        : await refreshMachineRuntimeCredentialConfig(agentName, machineId);
+    if (!machineConfigRead.ok && machineConfigRead.reason !== "missing") {
+        throw new Error(`A2A identity requires readable machine runtime config at ${machineConfigRead.itemPath}: ${machineConfigRead.error}`);
+    }
     const machineConfig = machineConfigRead.ok ? machineConfigRead.config : {};
     const identity = await loadOrMintA2AIdentity({
         agentName,
         sodium,
         config: machineConfig,
         upsert: async (next) => {
-            await upsertMachineRuntimeCredentialConfig(agentName, machineId, next);
+            const seed = readStoredA2ASeed(next);
+            await mergeMachineRuntimeCredentialConfig(agentName, machineId, { a2a: { identity: { ed25519Seed: seed } } });
         },
     });
     const rawPort = argValue("--port");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.677",
+  "version": "0.1.0-alpha.679",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",